Booting Centos 7 from dvd under qemu with uefi firmware on a mac

Question

So, I'm in the process of trying to make what google calls a shielded image, which basically you provide the keys for the uefi boot process, and sign them image. Part one is building an image that boots with uefi instead of bios.

I started adapting a perfectly working script that built our image using standard bios, and have trimmed the thing down to this:

/usr/local/bin/qemu-system-x86_64 -display cocoa \
-name disk.raw \
-drive file=output_centos/disk.raw,if=virtio,cache=writeback,discard=ignore,format=raw \
-L ./bios \
-bios bios.bin \
-cdrom /Users/ron.jarrell/newwork/infra-centos/packer_cache/5a03ac2db9b9f47812a1c314ada462d469e94d91.iso \
-netdev user,id=user.0 \
-device virtio-net,netdev=user.0 \
-boot once=d 

The tianocore uefi bios loads fine, and boots up the dvd, but when I try to do the install I get "error: can't allocate kernel" and "error: you need to load the kernel first".

Eventually this will be rolled back into packer which is where I ripped out this command for testing.

The original config also had a "-machine type=pc,accel=hvf", which caused the boot to stall with:

"QEMU Flash: Attempting flash detection at FFE00010"

and stalls there forever.

Answer 1

The flash was apparently a red herring. Here's a packer file that will successfully take the centos7 DVD and load it up in such such a way that GCP will recognize it as being able to be marked "shielded" and "vtpm" enabled. More work required for secure and confidential.

{
  "builders": [
    {
      "accelerator": "hvf",
      "boot_command": [
        "<tab> console=ttyS0,115200n8 nomodeset text ks=http://{{ .HTTPIP }}:{{ .HTTPPort }}/centos7.ks<enter><wait>"
      ],
      "boot_key_interval": "10ms",
      "boot_wait": "1s",
      "communicator": "none",
      "disk_interface": "virtio",
      "disk_size": "4000",
      "format": "raw",
      "cpus": 4,
      "memory": 8192,
      "headless": false,
      "http_directory": "http",
      "iso_checksum": "sha256:101bc813d2af9ccf534d112cbe8670e6d900425b297d1a4d2529c5ad5f226372",
      "iso_url": "http://Your Mirror Here/centos/7/isos/x86_64/CentOS-7-x86_64-NetInstall-2003.iso",
      "net_device": "virtio-net",
      "output_directory": "output_centos_tdhtest",
      "qemu_binary": "/usr/local/bin/qemu-system-x86_64",
      "qemuargs": [
        ["-L", "./bios.bin"],
        ["-chardev", "file,id=pts,path=serial.log"],
        ["-device", "isa-serial,chardev=pts"],
        ["-m", "8G"],
        ["-smp", "cpus=4"],
        ["-display", "cocoa"]
      ],
      "shutdown_command": "",
      "shutdown_timeout": "20m",
      "skip_compaction": true,
      "type": "qemu",
      "vm_name": "disk.raw"
    }
  ],
  "post-processors": [
    [
      {
        "output": "disk.raw.tar.gz",
        "type": "compress"
      },
      {
        "bucket": "{{user `env_name`}}-os-images",
        "image_description": "CentOS 7 Server",
        "image_family": "centos-7",
        "image_name": "b1-centos7-server-{{timestamp}}",
        "image_guest_os_features": "UEFI_COMPATIBLE",
        "project_id": "{{user `gcp_project`}}",
        "type": "googlecompute-import"
      }
    ]
  ]
}

Supply your own kickstarter file.