<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
p.msipheadera92f4c5c, li.msipheadera92f4c5c, div.msipheadera92f4c5c
{mso-style-name:msipheadera92f4c5c;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:87048229;
mso-list-template-ids:136236316;}
@list l0:level1
{mso-level-start-at:2;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1
{mso-list-id:1122580816;
mso-list-type:hybrid;
mso-list-template-ids:-739862912 -810002810 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l1:level1
{mso-level-text:"\(%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l2
{mso-list-id:1540362313;
mso-list-template-ids:-208096798;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="msipheadera92f4c5c" style="margin:0in"><span style="font-family:"Arial",sans-serif;color:#0078D7">[AMD Official Use Only - Internal Distribution Only]</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi All,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I may have mixed up my working and not working cases – sorry about this,<o:p></o:p></p>
<p class="MsoNormal">I have finally isolated my working and not-working cases, (for sure) as follows :<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l1 level1 lfo3">Not working :<o:p></o:p></li></ol>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">msg="launching /usr/local/bin/qemu-system-x86_64 with: [-name sandbox-csh -uuid 8b5369f5-1439-48d7-9b67-a32f6ef8ff7f -machine q35,accel=kvm,kernel_irqchip -cpu host, -qmp unix:/run/vc/vm/csh/qmp.sock,server,nowait -m 2048M,slots=10,maxmem=129755M
-device pci-bridge,bus=pcie.0,id=pci-bridge-0,chassis_nr=1,shpc=on,addr=2,romfile= -device virtio-serial-pci,disable-modern=false,id=serial0,romfile= -device virtconsole,chardev=charconsole0,id=console0 -chardev socket,id=charconsole0,path=/run/vc/vm/csh/console.sock,server,nowait
-object rng-random,id=rng0,filename=/dev/urandom -device virtio-rng-pci,rng=rng0,romfile= -device virtserialport,chardev=charch0,id=channel0,name=agent.channel.0 -chardev socket,id=charch0,path=/run/vc/vm/csh/kata.sock,server,nowait -device virtio-9p-pci,disable-modern=false,fsdev=extra-9p-kataShared,mount_tag=kataShared,romfile=
-fsdev local,id=extra-9p-kataShared,path=/run/kata-containers/shared/sandboxes/csh/shared,security_model=none,multidevs=remap -rtc base=utc,driftfix=slew,clock=host -global kvm-pit.lost_tick_policy=discard -vga none -no-user-config -nodefaults -nographic --no-reboot
-daemonize -object memory-backend-ram,id=dimm1,size=2048M -numa node,memdev=dimm1 -kernel /usr/share/kata-containers/vmlinuz-sev-es-5.6-v3.container -initrd /usr/share/kata-containers/kata-containers-initrd.img -append tsc=reliable no_timer_check rcupdate.rcu_expedited=1
i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 cryptomgr.notests net.ifnames=0 pci=lastbus=0 iommu=off debug panic=1 nr_cpus=240 agent.use_vsock=false root=/dev/vda1 rootflags=data=ordered,errors=remount-ro
agent.log=debug initcall_debug -bios /usr/local/share/qemu/OVMF_CODE.fd.kata -pidfile /run/vc/vm/csh/pid -D /run/vc/vm/csh/qemu.log -smp 1,cores=1,threads=1,sockets=240,maxcpus=240]"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<ol style="margin-top:0in" start="2" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l1 level1 lfo3">Working :<o:p></o:p></li></ol>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">/usr/local/bin/qemu-system-x86_64 -name sandbox-91d9f660fe1338d724c0ccd5c755a618d44100e697c82f8753d1051d2fdb30c1 -uuid e7888d8f-2e65-43d5-bc5a-3a3e853b3e13 -machine q35,accel=kvm,kernel_irqchip,nvdimm -cpu host -qmp unix:/run/vc/sbs/91d9f660fe1338d724c0ccd5c755a618d44100e697c82f8753d1051d2fdb30c1/qmp.sock,server,nowait
-m 512M,slots=2,maxmem=258779M -device pci-bridge,bus=pcie.0,id=pci-bridge-0,chassis_nr=1,shpc=on,addr=2 -device virtio-serial-pci,disable-legacy=on,id=serial0,iommu_platform=true -device virtconsole,chardev=charconsole0,id=console0 -chardev socket,id=charconsole0,path=/run/vc/sbs/91d9f660fe1338d724c0ccd5c755a618d44100e697c82f8753d1051d2fdb30c1/console.sock,server,nowait
-object sev-guest,id=sev0,cbitpos=51,reduced-phys-bits=5 -machine memory-encryption=sev0 -device virtserialport,chardev=charch0,id=channel0,name=agent.channel.0 -chardev socket,id=charch0,path=/run/vc/sbs/91d9f660fe1338d724c0ccd5c755a618d44100e697c82f8753d1051d2fdb30c1/kata.sock,server,nowait
-device virtio-9p-pci,disable-legacy=on,iommu_platform=true,fsdev=extra-9p-kataShared,mount_tag=kataShared -fsdev local,id=extra-9p-kataShared,path=/run/kata-containers/shared/sandboxes/91d9f660fe1338d724c0ccd5c755a618d44100e697c82f8753d1051d2fdb30c1,security_model=none
-netdev tap,id=network-0,vhost=on,vhostfds=3:4:5:6:7:8:9:10,fds=11:12:13:14:15:16:17:18 -device driver=virtio-net-pci,netdev=network-0,mac=02:42:ac:11:00:02,disable-legacy=on,iommu_platform=true,mq=on,vectors=18 -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=discard
-vga none -no-user-config -nodefaults -nographic -daemonize -kernel /usr/share/kata-containers/vmlinuz-sev-es-5.6-v3.container -initrd /usr/share/kata-containers/kata-containers-initrd.img -append tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1
i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 iommu=off cryptomgr.notests net.ifnames=0 pci=lastbus=0 debug panic=1 initcall_debug nr_cpus=240 ip=::::::91d9f660fe1338d724c0ccd5c755a618d44100e697c82f8753d1051d2fdb30c1::off::
root=/dev/vda1 rootflags=data=ordered,errors=remount-ro agent.log=debug initcall_debug -drive if=pflash,format=raw,unit=0,file=/usr/local/share/qemu/OVMF_CODE.fd.kata,readonly -smp 1,cores=1,threads=1,sockets=1,maxcpus=240<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">--Best Regards,<o:p></o:p></p>
<p class="MsoNormal">--Sandeep Gupta<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Christophe de Dinechin <cdupontd@redhat.com> <br>
<b>Sent:</b> Wednesday, January 6, 2021 7:00 AM<br>
<b>To:</b> Gupta, Sandeep <Sandeep.Gupta@amd.com><br>
<b>Cc:</b> Fabiano Fidêncio <fidencio@redhat.com>; kata-dev@lists.katacontainers.io; Hollingsworth, Brent <brent.hollingsworth@amd.com><br>
<b>Subject:</b> Re: [kata-dev] Regarding, Kata 2.0.0, kata-runtime, qemu OVMF<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[CAUTION: External Email] <o:p></o:p></p>
<div>
<p class="MsoNormal">Hi Sandeep, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On 6 Jan 2021, at 15:19, Christophe de Dinechin <<a href="mailto:cdupontd@redhat.com">cdupontd@redhat.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif">Hi Sandeep,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:13.5pt"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><o:p> </o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif">On 6 Jan 2021, at 09:51, Christophe de Dinechin <<a href="mailto:cdupontd@redhat.com">cdupontd@redhat.com</a>> wrote:<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal" style="margin-bottom:13.5pt"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif">Hi Sandeep,<br>
<br>
<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif">On 5 Jan 2021, at 21:19, Gupta, Sandeep <<a href="mailto:Sandeep.Gupta@amd.com">Sandeep.Gupta@amd.com</a>> wrote:<br>
<br>
[AMD Official Use Only - Internal Distribution Only]<br>
<br>
Thanks again Christophe,<br>
<br>
>From my kata-runtime 1.x, setup :<br>
<br>
root 2972741 2845780 0 20:13 pts/2 00:00:00 docker run --runtime kata-sev-runtime --cap-add=NET_ADMIN -it apache2-sev<br>
<br>
<br>
root 2018662 2018416 0 15:01 ? 00:00:16 /usr/local/bin/qemu-system-x86_64 -name sandbox-4a28f6d66e95a08be407b10e1fbfd6d0bd41d4048b5823029f02a17b7200adbc -uuid fce8220b-780b-4da6-8f5d-77ace1e06ed6 -machine q35,accel=kvm,kernel_irqchip,nvdimm -cpu
host -qmp unix:/run/vc/sbs/4a28f6d66e95a08be407b10e1fbfd6d0bd41d4048b5823029f02a17b7200adbc/qmp.sock,server,nowait -m 512M,slots=2,maxmem=258779M -device pci-bridge,bus=pcie.0,id=pci-bridge-0,chassis_nr=1,shpc=on,addr=2 -device virtio-serial-pci,disable-legacy=on,id=serial0,iommu_platform=true
-device virtconsole,chardev=charconsole0,id=console0 -chardev socket,id=charconsole0,path=/run/vc/sbs/4a28f6d66e95a08be407b10e1fbfd6d0bd41d4048b5823029f02a17b7200adbc/console.sock,server,nowait -object sev-guest,id=sev0,cbitpos=51,reduced-phys-bits=5 -machine
memory-encryption=sev0 -device virtserialport,chardev=charch0,id=channel0,name=agent.channel.0 -chardev socket,id=charch0,path=/run/vc/sbs/4a28f6d66e95a08be407b10e1fbfd6d0bd41d4048b5823029f02a17b7200adbc/kata.sock,server,nowait -device virtio-9p-pci,disable-legacy=on,iommu_platform=true,fsdev=extra-9p-kataShared,mount_tag=kataShared
-fsdev local,id=extra-9p-kataShared,path=/run/kata-containers/shared/sandboxes/4a28f6d66e95a08be407b10e1fbfd6d0bd41d4048b5823029f02a17b7200adbc,security_model=none -netdev tap,id=network-0,vhost=on,vhostfds=3:4:5:6:7:8:9:10,fds=11:12:13:14:15:16:17:18 -device
driver=virtio-net-pci,netdev=network-0,mac=02:42:ac:11:00:02,disable-legacy=on,iommu_platform=true,mq=on,vectors=18 -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=discard -vga none -no-user-config -nodefaults -nographic -daemonize -kernel /usr/share/kata-containers/vmlinuz-sev-es-5.6-v3.container
-initrd /usr/share/kata-containers/kata-containers-initrd.img -append tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 iommu=off cryptomgr.notests
net.ifnames=0 pci=lastbus=0 debug panic=1 initcall_debug nr_cpus=240 ip=::::::4a28f6d66e95a08be407b10e1fbfd6d0bd41d4048b5823029f02a17b7200adbc::off:: root=/dev/vda1 rootflags=data=ordered,errors=remount-ro agent.log=debug initcall_debug -drive if=pflash,format=raw,unit=0,file=/usr/local/share/qemu/OVMF_CODE.fd.kata,readonly
-smp 1,cores=1,threads=1,sockets=1,maxcpus=240<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><br>
As Fabiano pointed out (indirectly), there is no "-bios" option in the command line above. So either<o:p></o:p></span></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif">I'm sorry, Fabiano pointed out that I somehow had managed to miss the -drive if=pflash,format=raw,unit=0,file=/usr/local/share/qemu/OVMF_CODE.fd.kata,readonly option. Not
enough coffee, I guess.<o:p></o:p></span></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There is something mysterious about this, as I pointed out in <a href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fkata-containers%2Fkata-containers%2Fissues%2F1231%23issuecomment-755333403&data=04%7C01%7Csandeep.gupta%40amd.com%7Cad9f58a692c841c2823508d8b253c2b1%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637455420113626564%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=mjbC4X7djDhpehe3PwNyz2ECrW7F5FeMMeMA4aYiLxQ%3D&reserved=0">https://github.com/kata-containers/kata-containers/issues/1231#issuecomment-755333403</a>.
Basically, govmm does not seem to emit that option.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">func (config *Config) appendBios() {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">if config.Bios != "" {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">config.qemuParams = append(config.qemuParams, "-bios")<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">config.qemuParams = append(config.qemuParams, config.Bios)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">}<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">}<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">It apparently has always been like this. Do you remember either patching that file, or maybe finding some other way to pass the OVMF arguments to qemu (like using a qemu wrapper)?<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif">Disregard what is below. Instead, now we have an observable command-line difference between 1.x and 2.0. My guess is that this explains why you have trouble with 2.0. Even
if my own quick experiments today showed that you can boot an OVMF with -bios, I'm not sure you can get SecureBoot that way, because of the missing vars partition.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif">I've opened <a href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fkata-containers%2Fkata-containers%2Fissues%2F1231&data=04%7C01%7Csandeep.gupta%40amd.com%7Cad9f58a692c841c2823508d8b253c2b1%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637455420113636556%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=bmWstpZedr0v1yYOjCXcOH37Z1KOTR3zxy2F%2FnCXmF0%3D&reserved=0">https://github.com/kata-containers/kata-containers/issues/1231</a>.
I will add a comment highlighting the difference.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><o:p> </o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-bottom:13.5pt"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><br>
1) You did that run without having the "firmware = " option. If that was the case, please send the command-line with the firmware option<br>
<br>
(Hypothesis: maybe you are looking at the wrong configuration file, e.g. you have a local /etc/ override; that might explain why it "worked" with 1.x, although it would then require investigation to understand why SEV was enabled without your firmware)<br>
<br>
2) Something else removes the firmware setting or causes qemu to not receive the -bios option<br>
<br>
When "firmware" is specified, qemu should be invoked with the -bios option, and the corresponding commit dates back to early 2018, so I don't expect any difference between 1.x and 2.0 there.<br>
<br>
<br>
Cheers,<br>
Christophe<br>
<br>
<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-bottom:13.5pt"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><br>
<br>
root 2972841 2970388 0 20:13 ? 00:00:00 containerd-shim -namespace moby -workdir /var/lib/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8 -address /var/run/docker/containerd/containerd.sock
-containerd-binary /snap/docker/471/bin/containerd -runtime-root /var/run/docker/runtime-kata-sev-runtime -debug<br>
<br>
<br>
root 2973736 2972841 0 20:13 ? 00:00:00 /usr/libexec/kata-containers/kata-proxy -listen-socket<span class="apple-converted-space"> </span><a href="unix://run/vc/sbs/54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8/proxy.sock">unix:///run/vc/sbs/54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8/proxy.sock</a><span class="apple-converted-space"> </span>-mux-socket
/run/vc/sbs/54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8/kata.sock -log debug -agent-logs-socket /run/vc/sbs/54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8/console.sock<br>
<br>
<br>
root 2973856 2972841 0 20:13 pts/4 00:00:00 /usr/libexec/kata-containers/kata-shim -agent<span class="apple-converted-space"> </span><a href="unix://run/vc/sbs/54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8/proxy.sock">unix:///run/vc/sbs/54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8/proxy.sock</a><span class="apple-converted-space"> </span>-container
54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8 -exec-id 54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8 -terminal -log debug<br>
<br>
<br>
--Best Regards,<br>
--Sandeep Gupta<br>
<br>
<br>
-----Original Message-----<br>
From: Christophe de Dinechin <<a href="mailto:cdupontd@redhat.com">cdupontd@redhat.com</a>><span class="apple-converted-space"> </span><br>
Sent: Tuesday, January 5, 2021 11:25 AM<br>
To: Gupta, Sandeep <<a href="mailto:Sandeep.Gupta@amd.com">Sandeep.Gupta@amd.com</a>><br>
Cc: Fabiano Fidêncio <<a href="mailto:fidencio@redhat.com">fidencio@redhat.com</a>>;<span class="apple-converted-space"> </span><a href="mailto:kata-dev@lists.katacontainers.io">kata-dev@lists.katacontainers.io</a>; Hollingsworth, Brent <<a href="mailto:brent.hollingsworth@amd.com">brent.hollingsworth@amd.com</a>><br>
Subject: Re: [kata-dev] Regarding, Kata 2.0.0, kata-runtime, qemu OVMF<br>
<br>
[CAUTION: External Email]<br>
<br>
<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-bottom:13.5pt"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif">On 5 Jan 2021, at 17:21, Gupta, Sandeep <<a href="mailto:Sandeep.Gupta@amd.com">Sandeep.Gupta@amd.com</a>> wrote:<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><o:p> </o:p></span></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif">Hi Developers,<br>
One more please - for Kata 2.0.0, kata-runtime, qemu OVMF<br>
<br>
In /etc/kata-containers/configuration.toml --<br>
<br>
======<br>
# WARNING: - any parameter specified here will take priority over the<span class="apple-converted-space"> </span><br>
default # parameter value of the same name used to start the virtual machine.<br>
# Do not set values here unless you understand the impact of doing so<span class="apple-converted-space"> </span><br>
as you # may stop the virtual machine from booting.<br>
# To see the list of default parameters, enable hypervisor debug,<span class="apple-converted-space"> </span><br>
create a # container and look for 'default-kernel-parameters' log entries.<br>
kernel_params = " root=/dev/vda1 rootflags=data=ordered,errors=remount-ro agent.log=debug initcall_debug"<br>
<br>
# Path to the firmware.<br>
# If you want that qemu uses the default firmware leave this option<span class="apple-converted-space"> </span><br>
empty #firmware = "/usr/local/share/qemu/OVMF_CODE.fd.kata"<br>
firmware = ""<br>
==========<br>
<br>
If I use the default firmware - I get correct results :<br>
<br>
# ctr run --runtime io.containerd.run.kata.v2 -t --rm<span class="apple-converted-space"> </span><br>
<a href="https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fdocker.io%2Flibrary%2Fbusybox%3Alatest&data=04%7C01%7Csandeep.gupta%40amd.com%7Cad9f58a692c841c2823508d8b253c2b1%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637455420113636556%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ydvwfcetd0OtZk8JegCBHp88E3FaEkJ8wss86Q8HlGs%3D&reserved=0">docker.io/library/busybox:latest</a><span class="apple-converted-space"> </span>sh
/ # / # uname -a Linux<span class="apple-converted-space"> </span><br>
sandeepg-ubuntu 5.6.0-sev-sev-es-5.6-v3.container #3 SMP Tue Nov 3<span class="apple-converted-space"> </span><br>
06:38:40 UTC 2020 x86_64 GNU/Linux / #<br>
<br>
# ps -eaf | grep -i qemu<br>
<br>
root 360867 1 0 15:56 ? 00:00:01 /usr/local/bin/qemu-system-x86_64 -name sandbox-sh -uuid 72820914-dcce-4cea-a01f-3cf9851d136d -machine q35,accel=kvm,kernel_irqchip -cpu host,pmu=off -qmp unix:/run/vc/vm/sh/qmp.sock,server,nowait -m 2048M,slots=10,maxmem=129755M
-device pci-bridge,bus=pcie.0,id=pci-bridge-0,chassis_nr=1,shpc=on,addr=2,romfile= -device virtio-serial-pci,disable-modern=false,id=serial0,romfile= -device virtconsole,chardev=charconsole0,id=console0 -chardev socket,id=charconsole0,path=/run/vc/vm/sh/console.sock,server,nowait
-device virtio-scsi-pci,id=scsi0,disable-modern=false,romfile= -object rng-random,id=rng0,filename=/dev/urandom -device virtio-rng-pci,rng=rng0,romfile= -device vhost-vsock-pci,disable-modern=false,vhostfd=3,id=vsock-1189071429,guest-cid=1189071429,romfile=
-device virtio-9p-pci,disable-modern=false,fsdev=extra-9p-kataShared,mount_tag=kataShared,romfile= -fsdev local,id=extra-9p-kataShared,path=/run/kata-containers/shared/sandboxes/sh/shared,security_model=none,multidevs=remap -rtc base=utc,driftfix=slew,clock=host
-global kvm-pit.lost_tick_policy=discard -vga none -no-user-config -nodefaults -nographic --no-reboot -daemonize -object memory-backend-ram,id=dimm1,size=2048M -numa node,memdev=dimm1 -kernel /usr/share/kata-containers/vmlinuz-sev-es-5.6-v3.container -initrd
/usr/share/kata-containers/kata-containers-initrd.img -append tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 cryptomgr.notests net.ifnames=0 pci=lastbus=0
quiet panic=1 nr_cpus=240 scsi_mod.scan=none root=/dev/vda1 rootflags=data=ordered,errors=remount-ro agent.log=debug initcall_debug -pidfile /run/vc/vm/sh/pid -smp 1,cores=1,threads=1,sockets=240,maxcpus=240<br>
root 360966 360958 0 16:05 pts/2 00:00:00 grep --color=auto -i qemu<br>
<br>
<br>
But if I use : firmware = "/usr/local/share/qemu/OVMF_CODE.fd.kata"<br>
I get Error:<br>
<br>
# ctr run --runtime io.containerd.run.kata.v2 -t --rm<span class="apple-converted-space"> </span><br>
<a href="https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Fdocker.io%2Flibrary%2Fbusybox%3Alatest&data=04%7C01%7Csandeep.gupta%40amd.com%7Cad9f58a692c841c2823508d8b253c2b1%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637455420113646549%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=1RG1Xo7OIM%2FiffFhzJKRbahB%2Bd9bP7%2BrTijGuPwDjvs%3D&reserved=0">docker.io/library/busybox:latest</a><span class="apple-converted-space"> </span>s<br>
ctr: failed to launch qemu: exit status 1, error messages from qemu log: qemu: could not load PC BIOS '/usr/local/share/qemu/OVMF_CODE.fd.kata'<br>
: unknown<br>
<br>
Any suggestions please.<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal" style="margin-bottom:13.5pt"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><br>
I did a quick look. The runtime apparently uses the -bios option when the firmware option is passed, not the -drive option as I thought it would. I'm not entirely sure you can boot OVMF that way. I don't have any idea at the moment why it worked with version
1.x. If you could share with me the 1.x qemu command line option with the firmware option, I'm curious to see what it is.<br>
<br>
Thanks<br>
Christophe<br>
<br>
<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-size:13.5pt;font-family:"Helvetica",sans-serif"><br>
--Thanking You<br>
--Sandeep<br>
<br>
_______________________________________________<br>
kata-dev mailing list<br>
<a href="mailto:kata-dev@lists.katacontainers.io">kata-dev@lists.katacontainers.io</a><br>
<a href="https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists">https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists</a><br>
.katacontainers.io%2Fcgi-bin%2Fmailman%2Flistinfo%2Fkata-dev&data=<br>
04%7C01%7Csandeep.gupta%40amd.com%7C5764f6fb89fd4809aafc08d8b1af94df%7<br>
C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637454714974608155%7CUnkno<br>
wn%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiL<br>
CJXVCI6Mn0%3D%7C1000&sdata=U85zx8%2FDKniPytZoOsm%2F7eR%2FNq5e8aHFm<br>
fJKMKlX%2B84%3D&reserved=0<o:p></o:p></span></p>
</blockquote>
</blockquote>
</div>
</blockquote>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>