So, I'm in the process of trying to make what google calls a shielded image, which basically you provide the keys for the uefi boot process, and sign them image. Part one is building an image that boots with uefi instead of bios.

I started adapting a perfectly working script that built our image using standard bios, and have trimmed the thing down to this:

/usr/local/bin/qemu-system-x86_64 -display cocoa \
-name disk.raw \
-drive file=output_centos/disk.raw,if=virtio,cache=writeback,discard=ignore,format=raw \
-L ./bios \
-bios bios.bin \
-cdrom /Users/ron.jarrell/newwork/infra-centos/packer_cache/5a03ac2db9b9f47812a1c314ada462d469e94d91.iso \
-netdev user,id=user.0 \
-device virtio-net,netdev=user.0 \
-boot once=d 

The tianocore uefi bios loads fine, and boots up the dvd, but when I try to do the install I get "error: can't allocate kernel" and "error: you need to load the kernel first".

Eventually this will be rolled back into packer which is where I ripped out this command for testing.

The original config also had a "-machine type=pc,accel=hvf", which caused the boot to stall with:

"QEMU Flash: Attempting flash detection at FFE00010"

and stalls there forever.


The flash was apparently a red herring. Here's a packer file that will successfully take the centos7 DVD and load it up in such such a way that GCP will recognize it as being able to be marked "shielded" and "vtpm" enabled. More work required for secure and confidential.

  "builders": [
      "accelerator": "hvf",
      "boot_command": [
        "<tab> console=ttyS0,115200n8 nomodeset text ks=http://{{ .HTTPIP }}:{{ .HTTPPort }}/centos7.ks<enter><wait>"
      "boot_key_interval": "10ms",
      "boot_wait": "1s",
      "communicator": "none",
      "disk_interface": "virtio",
      "disk_size": "4000",
      "format": "raw",
      "cpus": 4,
      "memory": 8192,
      "headless": false,
      "http_directory": "http",
      "iso_checksum": "sha256:101bc813d2af9ccf534d112cbe8670e6d900425b297d1a4d2529c5ad5f226372",
      "iso_url": "http://Your Mirror Here/centos/7/isos/x86_64/CentOS-7-x86_64-NetInstall-2003.iso",
      "net_device": "virtio-net",
      "output_directory": "output_centos_tdhtest",
      "qemu_binary": "/usr/local/bin/qemu-system-x86_64",
      "qemuargs": [
        ["-L", "./bios.bin"],
        ["-chardev", "file,id=pts,path=serial.log"],
        ["-device", "isa-serial,chardev=pts"],
        ["-m", "8G"],
        ["-smp", "cpus=4"],
        ["-display", "cocoa"]
      "shutdown_command": "",
      "shutdown_timeout": "20m",
      "skip_compaction": true,
      "type": "qemu",
      "vm_name": "disk.raw"
  "post-processors": [
        "output": "disk.raw.tar.gz",
        "type": "compress"
        "bucket": "{{user `env_name`}}-os-images",
        "image_description": "CentOS 7 Server",
        "image_family": "centos-7",
        "image_name": "b1-centos7-server-{{timestamp}}",
        "image_guest_os_features": "UEFI_COMPATIBLE",
        "project_id": "{{user `gcp_project`}}",
        "type": "googlecompute-import"

Supply your own kickstarter file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.