[AMD Official Use Only - Internal Distribution Only] Thanks again Christophe,
From my kata-runtime 1.x, setup :
root 2972741 2845780 0 20:13 pts/2 00:00:00 docker run --runtime kata-sev-runtime --cap-add=NET_ADMIN -it apache2-sev root 2018662 2018416 0 15:01 ? 00:00:16 /usr/local/bin/qemu-system-x86_64 -name sandbox-4a28f6d66e95a08be407b10e1fbfd6d0bd41d4048b5823029f02a17b7200adbc -uuid fce8220b-780b-4da6-8f5d-77ace1e06ed6 -machine q35,accel=kvm,kernel_irqchip,nvdimm -cpu host -qmp unix:/run/vc/sbs/4a28f6d66e95a08be407b10e1fbfd6d0bd41d4048b5823029f02a17b7200adbc/qmp.sock,server,nowait -m 512M,slots=2,maxmem=258779M -device pci-bridge,bus=pcie.0,id=pci-bridge-0,chassis_nr=1,shpc=on,addr=2 -device virtio-serial-pci,disable-legacy=on,id=serial0,iommu_platform=true -device virtconsole,chardev=charconsole0,id=console0 -chardev socket,id=charconsole0,path=/run/vc/sbs/4a28f6d66e95a08be407b10e1fbfd6d0bd41d4048b5823029f02a17b7200adbc/console.sock,server,nowait -object sev-guest,id=sev0,cbitpos=51,reduced-phys-bits=5 -machine memory-encryption=sev0 -device virtserialport,chardev=charch0,id=channel0,name=agent.channel.0 -chardev socket,id=charch0,path=/run/vc/sbs/4a28f6d66e95a08be407b10e1fbfd6d0bd41d4048b5823029f02a17b7200adbc/kata.sock,server,nowait -device virtio-9p-pci,disable-legacy=on,iommu_platform=true,fsdev=extra-9p-kataShared,mount_tag=kataShared -fsdev local,id=extra-9p-kataShared,path=/run/kata-containers/shared/sandboxes/4a28f6d66e95a08be407b10e1fbfd6d0bd41d4048b5823029f02a17b7200adbc,security_model=none -netdev tap,id=network-0,vhost=on,vhostfds=3:4:5:6:7:8:9:10,fds=11:12:13:14:15:16:17:18 -device driver=virtio-net-pci,netdev=network-0,mac=02:42:ac:11:00:02,disable-legacy=on,iommu_platform=true,mq=on,vectors=18 -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=discard -vga none -no-user-config -nodefaults -nographic -daemonize -kernel /usr/share/kata-containers/vmlinuz-sev-es-5.6-v3.container -initrd /usr/share/kata-containers/kata-containers-initrd.img -append tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 iommu=off cryptomgr.notests net.ifnames=0 pci=lastbus=0 debug panic=1 initcall_debug nr_cpus=240 ip=::::::4a28f6d66e95a08be407b10e1fbfd6d0bd41d4048b5823029f02a17b7200adbc::off:: root=/dev/vda1 rootflags=data=ordered,errors=remount-ro agent.log=debug initcall_debug -drive if=pflash,format=raw,unit=0,file=/usr/local/share/qemu/OVMF_CODE.fd.kata,readonly -smp 1,cores=1,threads=1,sockets=1,maxcpus=240 root 2972841 2970388 0 20:13 ? 00:00:00 containerd-shim -namespace moby -workdir /var/lib/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8 -address /var/run/docker/containerd/containerd.sock -containerd-binary /snap/docker/471/bin/containerd -runtime-root /var/run/docker/runtime-kata-sev-runtime -debug root 2973736 2972841 0 20:13 ? 00:00:00 /usr/libexec/kata-containers/kata-proxy -listen-socket unix:///run/vc/sbs/54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8/proxy.sock -mux-socket /run/vc/sbs/54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8/kata.sock -log debug -agent-logs-socket /run/vc/sbs/54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8/console.sock root 2973856 2972841 0 20:13 pts/4 00:00:00 /usr/libexec/kata-containers/kata-shim -agent unix:///run/vc/sbs/54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8/proxy.sock -container 54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8 -exec-id 54db6810ae4ed8ab3e7a378c4e95d73e334797a5a5234978b4f976750f4f64d8 -terminal -log debug --Best Regards, --Sandeep Gupta -----Original Message----- From: Christophe de Dinechin <cdupontd@redhat.com> Sent: Tuesday, January 5, 2021 11:25 AM To: Gupta, Sandeep <Sandeep.Gupta@amd.com> Cc: Fabiano Fidêncio <fidencio@redhat.com>; kata-dev@lists.katacontainers.io; Hollingsworth, Brent <brent.hollingsworth@amd.com> Subject: Re: [kata-dev] Regarding, Kata 2.0.0, kata-runtime, qemu OVMF [CAUTION: External Email]
On 5 Jan 2021, at 17:21, Gupta, Sandeep <Sandeep.Gupta@amd.com> wrote:
Hi Developers, One more please - for Kata 2.0.0, kata-runtime, qemu OVMF
In /etc/kata-containers/configuration.toml --
====== # WARNING: - any parameter specified here will take priority over the default # parameter value of the same name used to start the virtual machine. # Do not set values here unless you understand the impact of doing so as you # may stop the virtual machine from booting. # To see the list of default parameters, enable hypervisor debug, create a # container and look for 'default-kernel-parameters' log entries. kernel_params = " root=/dev/vda1 rootflags=data=ordered,errors=remount-ro agent.log=debug initcall_debug"
# Path to the firmware. # If you want that qemu uses the default firmware leave this option empty #firmware = "/usr/local/share/qemu/OVMF_CODE.fd.kata" firmware = "" ==========
If I use the default firmware - I get correct results :
# ctr run --runtime io.containerd.run.kata.v2 -t --rm docker.io/library/busybox:latest sh / # / # uname -a Linux sandeepg-ubuntu 5.6.0-sev-sev-es-5.6-v3.container #3 SMP Tue Nov 3 06:38:40 UTC 2020 x86_64 GNU/Linux / #
# ps -eaf | grep -i qemu
root 360867 1 0 15:56 ? 00:00:01 /usr/local/bin/qemu-system-x86_64 -name sandbox-sh -uuid 72820914-dcce-4cea-a01f-3cf9851d136d -machine q35,accel=kvm,kernel_irqchip -cpu host,pmu=off -qmp unix:/run/vc/vm/sh/qmp.sock,server,nowait -m 2048M,slots=10,maxmem=129755M -device pci-bridge,bus=pcie.0,id=pci-bridge-0,chassis_nr=1,shpc=on,addr=2,romfile= -device virtio-serial-pci,disable-modern=false,id=serial0,romfile= -device virtconsole,chardev=charconsole0,id=console0 -chardev socket,id=charconsole0,path=/run/vc/vm/sh/console.sock,server,nowait -device virtio-scsi-pci,id=scsi0,disable-modern=false,romfile= -object rng-random,id=rng0,filename=/dev/urandom -device virtio-rng-pci,rng=rng0,romfile= -device vhost-vsock-pci,disable-modern=false,vhostfd=3,id=vsock-1189071429,guest-cid=1189071429,romfile= -device virtio-9p-pci,disable-modern=false,fsdev=extra-9p-kataShared,mount_tag=kataShared,romfile= -fsdev local,id=extra-9p-kataShared,path=/run/kata-containers/shared/sandboxes/sh/shared,security_model=none,multidevs=remap -rtc base=utc,driftfix=slew,clock=host -global kvm-pit.lost_tick_policy=discard -vga none -no-user-config -nodefaults -nographic --no-reboot -daemonize -object memory-backend-ram,id=dimm1,size=2048M -numa node,memdev=dimm1 -kernel /usr/share/kata-containers/vmlinuz-sev-es-5.6-v3.container -initrd /usr/share/kata-containers/kata-containers-initrd.img -append tsc=reliable no_timer_check rcupdate.rcu_expedited=1 i8042.direct=1 i8042.dumbkbd=1 i8042.nopnp=1 i8042.noaux=1 noreplace-smp reboot=k console=hvc0 console=hvc1 cryptomgr.notests net.ifnames=0 pci=lastbus=0 quiet panic=1 nr_cpus=240 scsi_mod.scan=none root=/dev/vda1 rootflags=data=ordered,errors=remount-ro agent.log=debug initcall_debug -pidfile /run/vc/vm/sh/pid -smp 1,cores=1,threads=1,sockets=240,maxcpus=240 root 360966 360958 0 16:05 pts/2 00:00:00 grep --color=auto -i qemu
But if I use : firmware = "/usr/local/share/qemu/OVMF_CODE.fd.kata" I get Error:
# ctr run --runtime io.containerd.run.kata.v2 -t --rm docker.io/library/busybox:latest s ctr: failed to launch qemu: exit status 1, error messages from qemu log: qemu: could not load PC BIOS '/usr/local/share/qemu/OVMF_CODE.fd.kata' : unknown
Any suggestions please.
I did a quick look. The runtime apparently uses the -bios option when the firmware option is passed, not the -drive option as I thought it would. I'm not entirely sure you can boot OVMF that way. I don't have any idea at the moment why it worked with version 1.x. If you could share with me the 1.x qemu command line option with the firmware option, I'm curious to see what it is. Thanks Christophe
--Thanking You --Sandeep
_______________________________________________ kata-dev mailing list kata-dev@lists.katacontainers.io https://nam11.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists .katacontainers.io%2Fcgi-bin%2Fmailman%2Flistinfo%2Fkata-dev&data= 04%7C01%7Csandeep.gupta%40amd.com%7C5764f6fb89fd4809aafc08d8b1af94df%7 C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637454714974608155%7CUnkno wn%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiL CJXVCI6Mn0%3D%7C1000&sdata=U85zx8%2FDKniPytZoOsm%2F7eR%2FNq5e8aHFm fJKMKlX%2B84%3D&reserved=0