On 6 Jan 2021, at 18:07, Laszlo Ersek lersek@redhat.com wrote:
Hi Christophe!
On 01/06/21 16:11, Christophe de Dinechin wrote:
Hello Laszlo,
Happy New Year!
Same to you :)
I may need to pick your brain a little regarding an issue someone testing AMD SEV ran into with Kata.
Basically, here are the questions I have:
- Is it OK to pass an OVMF firmware to the -boot option of qemu?
What about SecureBoot in that case?
- Are there any expected behavioral differences between booting with the
-bios option and using a -drive if=pflash option? In particular, anything that could prevent SEV from activating in the guest kernel?
- Knowing that in the Kata case, we don't care about anything persisting
across reboots, is there any problem passing only the OVMF_CODE.fd image readonly using the -drive option, without having an OVMF_VARS.fd? Asking to see if we need to create an OVMF_VARS.fd for each container.
If you need a bit of context: https://github.com/kata-containers/kata-containers/issues/1231 and http://lists.katacontainers.io/pipermail/kata-dev/2021-January/001638.html
"-bios" should never be used with OVMF. If you don't need non-volatile UEFI variables to persist from one boot of the domain to the next, that's fine; in that case, please use a throw-away regular file for the variable store pflash chip. this file should be instantiated from "OVMF_VARS.fd", if you don't want the Secure Boot operational mode enabled right off the bat; otherwise, please copy (create) the domain's varstore from "OVMF_VARS.secboot.fd", before launching QEMU.
OK. Need to figure out how we package that image for Kata.
We have never tested SEV with "-bios" (well, because "-bios" is wrong to use with OVMF in the first place, regardless of SEV); and yes there have been SEV-related changes, specific to the flash driver in OVMF. (QEMU too received SEV-related changes around the parts responsible for loading OVMF, in "hw/i386/pc_sysfw.c".)
If that's not supposed to work, is there some relatively simple way to warn? Right now, while all the doc I saw about
The particulars of a SEV failure, when using "-bios", aren't even worth investigating -- please try to reproduce the issue first with two pflash chips.
Actually, I'm more interested in the correct way to fix it for Kata.
So I gather that the right approach is - Create a copy of the right OVMF_VARS file - Change the command line to have the correct two -drive options
Will do that.
Thanks a lot, Christophe