mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-11-06 13:20:20 +00:00
9c1524a01c
In qemu, enabling this feature boils down to adding the following onto the command line: -global driver=cfi.pflash01,property=secure,value=on However, there are some constraints resulting from the implementation. For instance, System Management Mode (SMM) is required to be enabled, the machine type must be q35-2.4 or later, and the guest should be x86_64. While technically it is possible to have 32 bit guests with secure boot, some non-trivial CPU flags tuning is required (for instance lm and nx flags must be prohibited). Given complexity of our CPU driver, this is not trivial. Therefore I've chosen to forbid 32 bit guests for now. If there's ever need, we can refine the check later. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
30 lines
1009 B
Plaintext
30 lines
1009 B
Plaintext
LC_ALL=C \
|
|
PATH=/bin \
|
|
HOME=/home/test \
|
|
USER=test \
|
|
LOGNAME=test \
|
|
QEMU_AUDIO_DRV=none \
|
|
/usr/bin/qemu \
|
|
-name test-bios \
|
|
-S \
|
|
-machine pc-q35-2.5,accel=tcg,smm=on \
|
|
-global driver=cfi.pflash01,property=secure,value=on \
|
|
-drive file=/usr/share/OVMF/OVMF_CODE.secboot.fd,if=pflash,format=raw,unit=0,\
|
|
readonly=on \
|
|
-drive file=/usr/share/OVMF/OVMF_VARS.fd,if=pflash,format=raw,unit=1 \
|
|
-m 1024 \
|
|
-smp 1,sockets=1,cores=1,threads=1 \
|
|
-uuid 362d1fc1-df7d-193e-5c18-49a71bd1da66 \
|
|
-nographic \
|
|
-nodefaults \
|
|
-monitor unix:/tmp/lib/domain--1-test-bios/monitor.sock,server,nowait \
|
|
-boot c \
|
|
-device i82801b11-bridge,id=pci.1,bus=pcie.0,addr=0x1e \
|
|
-device pci-bridge,chassis_nr=2,id=pci.2,bus=pci.1,addr=0x0 \
|
|
-device virtio-scsi-pci,id=scsi0,bus=pci.2,addr=0x1 \
|
|
-drive file=/dev/HostVG/QEMUGuest1,format=raw,if=none,id=drive-scsi0-0-0-0 \
|
|
-device scsi-disk,bus=scsi0.0,channel=0,scsi-id=0,lun=0,\
|
|
drive=drive-scsi0-0-0-0,id=scsi0-0-0-0 \
|
|
-serial pty \
|
|
-device virtio-balloon-pci,id=balloon0,bus=pci.2,addr=0x2
|