On 8 Jan 2021, at 21:16, Gupta, Sandeep <Sandeep.Gupta@amd.com <mailto:Sandeep.Gupta@amd.com>> wrote:
[AMD Official Use Only - Internal Distribution Only]
Thank you Christophe,
Yes - We change .../vendor/src/github.com/intel/govmm/qemu/qemu.go <http://github.com/intel/govmm/qemu/qemu.go>, "appendBios()"
func (config *Config) appendBios() { if config.Bios != "" { if config.Knobs.MemEncrypt == true { config.qemuParams = append(config.qemuParams, "-drive") config.qemuParams = append(config.qemuParams, fmt.Sprintf("if=pflash,format=raw,unit=0,file=%s,readonly", config.Bios)) } else { config.qemuParams = append(config.qemuParams, "-bios") config.qemuParams = append(config.qemuParams, config.Bios) } } }
So I see two problems with that change: 1/ I think it depends on using OVMF, not on encrypted memory. 2/ You need the VARS file as discussed earlier. I believe that a more robust solution would be: 1/ Add an OVMF option alongside "firmware", as well as OVMF_VARS 2/ When OVMF is specified, create a copy of the VARS file, and pass two -drive options, one for OVMF_CODE and one for the copied OVMF_VARS. 3/ When MemEncrypt is true, check that you ahve an OVMF given and no bios.