On 8 Jan 2021, at 21:16, Gupta, Sandeep <Sandeep.Gupta@amd.com> wrote:

[AMD Official Use Only - Internal Distribution Only]

Thank you Christophe,

Yes - We change .../vendor/src/github.com/intel/govmm/qemu/qemu.go,   "appendBios()"

func (config *Config) appendBios() {
       if config.Bios != "" {
               if config.Knobs.MemEncrypt == true {
                       config.qemuParams = append(config.qemuParams, "-drive")
                       config.qemuParams = append(config.qemuParams, fmt.Sprintf("if=pflash,format=raw,unit=0,file=%s,readonly", config.Bios))
               } else {
                       config.qemuParams = append(config.qemuParams, "-bios")
                       config.qemuParams = append(config.qemuParams, config.Bios)
               }
       }
}

So I see two problems with that change:

1/ I think it depends on using OVMF, not on encrypted memory.

2/ You need the VARS file as discussed earlier.

I believe that a more robust solution would be:

1/ Add an OVMF option alongside "firmware", as well as OVMF_VARS

2/ When OVMF is specified, create a copy of the VARS file, and pass two -drive options, one for OVMF_CODE and one for the copied OVMF_VARS.

3/ When MemEncrypt is true, check that you ahve an OVMF given and no bios.