Open Stack

> On 8 Jan 2021, at 21:16, Gupta, Sandeep <Sandeep.Gupta at amd.com <mailto:Sandeep.Gupta at amd.com>> wrote:
> 
> [AMD Official Use Only - Internal Distribution Only]
> 
> Thank you Christophe,
> 
> Yes  -  We change .../vendor/src/github.com/intel/govmm/qemu/qemu.go <http://github.com/intel/govmm/qemu/qemu.go>,   "appendBios()"
> 
> func (config *Config) appendBios() {
>        if config.Bios != "" {
>                if config.Knobs.MemEncrypt == true {
>                        config.qemuParams = append(config.qemuParams, "-drive")
>                        config.qemuParams = append(config.qemuParams, fmt.Sprintf("if=pflash,format=raw,unit=0,file=%s,readonly", config.Bios))
>                } else {
>                        config.qemuParams = append(config.qemuParams, "-bios")
>                        config.qemuParams = append(config.qemuParams, config.Bios)
>                }
>        }
> }

So I see two problems with that change:

1/ I think it depends on using OVMF, not on encrypted memory.

2/ You need the VARS file as discussed earlier.

I believe that a more robust solution would be:

1/ Add an OVMF option alongside "firmware", as well as OVMF_VARS

2/ When OVMF is specified, create a copy of the VARS file, and pass two -drive options, one for OVMF_CODE and one for the copied OVMF_VARS.

3/ When MemEncrypt is true, check that you ahve an OVMF given and no bios.
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.katacontainers.io/pipermail/kata-dev/attachments/20210113/1752601d/attachment.html>