README 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398
  1. === OVMF OVERVIEW ===
  2. The Open Virtual Machine Firmware (OVMF) project aims
  3. to support firmware for Virtual Machines using the edk2
  4. code base. More information can be found at:
  5. http://www.tianocore.org/ovmf/
  6. === STATUS ===
  7. Current capabilities:
  8. * IA32 and X64 architectures
  9. * QEMU (version 1.7.1 or later, with 1.7 or later machine types)
  10. - Video, keyboard, IDE, CD-ROM, serial
  11. - Runs UEFI shell
  12. - Optional NIC support.
  13. * UEFI Linux boots
  14. * UEFI Windows 8 boots
  15. * UEFI Windows 7 & Windows 2008 Server boot (see important notes below!)
  16. === FUTURE PLANS ===
  17. * Test/Stabilize UEFI Self-Certification Tests (SCT) results
  18. === BUILDING OVMF ===
  19. Pre-requisites:
  20. * Build environment capable of build the edk2 MdeModulePkg.
  21. * A properly configured ASL compiler:
  22. - Intel ASL compiler: Available from http://www.acpica.org
  23. - Microsoft ASL compiler: Available from http://www.acpi.info
  24. * NASM: http://www.nasm.us/
  25. Update Conf/target.txt ACTIVE_PLATFORM for OVMF:
  26. PEI arch DXE arch UEFI interfaces
  27. * OvmfPkg/OvmfPkgIa32.dsc IA32 IA32 IA32
  28. * OvmfPkg/OvmfPkgIa32X64.dsc IA32 X64 X64
  29. * OvmfPkg/OvmfPkgX64.dsc X64 X64 X64
  30. Update Conf/target.txt TARGET_ARCH based on the .dsc file:
  31. TARGET_ARCH
  32. * OvmfPkg/OvmfPkgIa32.dsc IA32
  33. * OvmfPkg/OvmfPkgIa32X64.dsc IA32 X64
  34. * OvmfPkg/OvmfPkgX64.dsc X64
  35. Following the edk2 build process, you will find the OVMF binaries
  36. under the $WORKSPACE/Build/*/*/FV directory. The actual path will
  37. depend on how your build is configured. You can expect to find
  38. these binary outputs:
  39. * OVMF.FD
  40. - Please note! This filename has changed. Older releases used OVMF.Fv.
  41. * OvmfVideo.rom
  42. - This file is not built separately any longer, starting with svn r13520.
  43. More information on building OVMF can be found at:
  44. https://github.com/tianocore/tianocore.github.io/wiki/How%20to%20build%20OVMF
  45. === RUNNING OVMF on QEMU ===
  46. * Be sure to use qemu-system-x86_64, if you are using an X64 firmware.
  47. (qemu-system-x86_64 works for the IA32 firmware as well, of course.)
  48. * Use OVMF for QEMU firmware (3 options available)
  49. - Option 1: Use QEMU -pflash parameter
  50. * QEMU/OVMF will use emulated flash, and fully support UEFI variables
  51. * Run qemu with: -pflash path/to/OVMF.fd
  52. * Note that this option is required for running SecureBoot-enabled builds
  53. (-D SECURE_BOOT_ENABLE).
  54. - Option 2: Use QEMU -bios parameter
  55. * Note that UEFI variables will be partially emulated, and non-volatile
  56. variables may lose their contents after a reboot
  57. * Run qemu with: -bios path/to/OVMF.fd
  58. - Option 3: Use QEMU -L parameter
  59. * Note that UEFI variables will be partially emulated, and non-volatile
  60. variables may lose their contents after a reboot
  61. * Either copy, rename or symlink OVMF.fd => bios.bin
  62. * Use the QEMU -L parameter to specify the directory where the bios.bin
  63. file is located.
  64. * The EFI shell is built into OVMF builds at this time, so it should
  65. run automatically if a UEFI boot application is not found on the
  66. removable media.
  67. * On Linux, newer version of QEMU may enable KVM feature, and this might
  68. cause OVMF to fail to boot. The QEMU '-no-kvm' may allow OVMF to boot.
  69. * Capturing OVMF debug messages on qemu:
  70. - The default OVMF build writes debug messages to IO port 0x402. The
  71. following qemu command line options save them in the file called
  72. debug.log: '-debugcon file:debug.log -global isa-debugcon.iobase=0x402'.
  73. - It is possible to revert to the original behavior, when debug messages were
  74. written to the emulated serial port (potentially intermixing OVMF debug
  75. output with UEFI serial console output). For this the
  76. '-D DEBUG_ON_SERIAL_PORT' option has to be passed to the build command (see
  77. the next section), and in order to capture the serial output qemu needs to
  78. be started with eg. '-serial file:serial.log'.
  79. - Debug messages fall into several categories. Logged vs. suppressed
  80. categories are controlled at OVMF build time by the
  81. 'gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel' bitmask (an UINT32
  82. value) in the selected .dsc file. Individual bits of this bitmask are
  83. defined in <MdePkg/Include/Library/DebugLib.h>. One non-default bit (with
  84. some performance impact) that is frequently set for debugging is 0x00400000
  85. (DEBUG_VERBOSE).
  86. - The RELEASE build target ('-b RELEASE' build option, see below) disables
  87. all debug messages. The default build target is DEBUG.
  88. === Build Scripts ===
  89. On systems with the bash shell you can use OvmfPkg/build.sh to simplify
  90. building and running OVMF.
  91. So, for example, to build + run OVMF X64:
  92. $ OvmfPkg/build.sh -a X64
  93. $ OvmfPkg/build.sh -a X64 qemu
  94. And to run a 64-bit UEFI bootable ISO image:
  95. $ OvmfPkg/build.sh -a X64 qemu -cdrom /path/to/disk-image.iso
  96. To build a 32-bit OVMF without debug messages using GCC 4.8:
  97. $ OvmfPkg/build.sh -a IA32 -b RELEASE -t GCC48
  98. === SMM support ===
  99. Requirements:
  100. * SMM support requires QEMU 2.5.
  101. * The minimum required QEMU machine type is "pc-q35-2.5".
  102. * SMM with KVM requires Linux 4.4 (host).
  103. OVMF is capable of utilizing SMM if the underlying QEMU or KVM hypervisor
  104. emulates SMM. SMM is put to use in the S3 suspend and resume infrastructure,
  105. and in the UEFI variable driver stack. The purpose is (virtual) hardware
  106. separation between the runtime guest OS and the firmware (OVMF), with the
  107. intent to make Secure Boot actually secure, by preventing the runtime guest OS
  108. from tampering with the variable store and S3 areas.
  109. For SMM support, OVMF must be built with the "-D SMM_REQUIRE" option. The
  110. resultant firmware binary will check if QEMU actually provides SMM emulation;
  111. if it doesn't, then OVMF will log an error and trigger an assertion failure
  112. during boot (even in RELEASE builds). Both the naming of the flag (SMM_REQUIRE,
  113. instead of SMM_ENABLE), and this behavior are consistent with the goal
  114. described above: this is supposed to be a security feature, and fallbacks are
  115. not allowed. Similarly, a pflash-backed variable store is a requirement.
  116. QEMU should be started with the options listed below (in addition to any other
  117. guest-specific flags). The command line should be gradually composed from the
  118. hints below. '\' is used to extend the command line to multiple lines, and '^'
  119. can be used on Windows.
  120. * QEMU binary and options specific to 32-bit guests:
  121. $ qemu-system-i386 -cpu coreduo,-nx \
  122. or
  123. $ qemu-system-x86_64 -cpu <MODEL>,-lm,-nx \
  124. * QEMU binary for running 64-bit guests (no particular options):
  125. $ qemu-system-x86_64 \
  126. * Flags common to all SMM scenarios (only the Q35 machine type is supported):
  127. -machine q35,smm=on,accel=(tcg|kvm) \
  128. -m ... \
  129. -smp ... \
  130. -global driver=cfi.pflash01,property=secure,value=on \
  131. -drive if=pflash,format=raw,unit=0,file=OVMF_CODE.fd,readonly=on \
  132. -drive if=pflash,format=raw,unit=1,file=copy_of_OVMF_VARS.fd \
  133. * In order to disable S3, add:
  134. -global ICH9-LPC.disable_s3=1 \
  135. === Network Support ===
  136. OVMF provides a UEFI network stack by default. Its lowest level driver is the
  137. NIC driver, higher levels are generic. In order to make DHCP, PXE Boot, and eg.
  138. socket test utilities from the StdLib edk2 package work, (1) qemu has to be
  139. configured to emulate a NIC, (2) a matching UEFI NIC driver must be available
  140. when OVMF boots.
  141. (If a NIC is configured for the virtual machine, and -- dependent on boot order
  142. -- PXE booting is attempted, but no DHCP server responds to OVMF's DHCP
  143. DISCOVER message at startup, the boot process may take approx. 3 seconds
  144. longer.)
  145. * For each NIC emulated by qemu, a GPLv2 licensed UEFI driver is available from
  146. the iPXE project. The qemu source distribution contains prebuilt binaries of
  147. these drivers (and of course allows one to rebuild them from source as well).
  148. This is the recommended set of drivers.
  149. * Use the qemu -netdev and -device options, or the legacy -net option, to
  150. enable NIC support: <http://wiki.qemu.org/Documentation/Networking>.
  151. * The iPXE drivers are automatically available to and configured for OVMF in
  152. the default qemu installation.
  153. * Independently of the iPXE NIC drivers, the default OVMF build provides a
  154. basic virtio-net driver, located in OvmfPkg/VirtioNetDxe.
  155. * Also independently of the iPXE NIC drivers, Intel's proprietary E1000 NIC
  156. driver (from the BootUtil distribution) can be embedded in the OVMF image at
  157. build time:
  158. - Download BootUtil:
  159. - Navigate to
  160. https://downloadcenter.intel.com/download/19186/Ethernet-Intel-Ethernet-Connections-Boot-Utility-Preboot-Images-and-EFI-Drivers
  161. - Click the download link for "PREBOOT.EXE".
  162. - Accept the Intel Software License Agreement that appears.
  163. - Unzip "PREBOOT.EXE" into a separate directory (this works with the
  164. "unzip" utility on platforms different from Windows as well).
  165. - Copy the "APPS/EFI/EFIx64/E3522X2.EFI" driver binary to
  166. "Intel3.5/EFIX64/E3522X2.EFI" in your WORKSPACE.
  167. - Intel have stopped distributing an IA32 driver binary (which used to
  168. match the filename pattern "E35??E2.EFI"), thus this method will only
  169. work for the IA32X64 and X64 builds of OVMF.
  170. - Include the driver in OVMF during the build:
  171. - Add "-D E1000_ENABLE" to your build command (only when building
  172. "OvmfPkg/OvmfPkgIa32X64.dsc" or "OvmfPkg/OvmfPkgX64.dsc").
  173. - For example: "build -D E1000_ENABLE".
  174. * When a matching iPXE driver is configured for a NIC as described above, it
  175. takes priority over other drivers that could possibly drive the card too:
  176. | e1000 ne2k_pci pcnet rtl8139 virtio-net-pci
  177. ---------------------+------------------------------------------------
  178. iPXE | x x x x x
  179. VirtioNetDxe | x
  180. Intel BootUtil (X64) | x
  181. === HTTPS Boot ===
  182. HTTPS Boot is an alternative solution to PXE. It replaces the tftp server
  183. with a HTTPS server so the firmware can download the images through a trusted
  184. and encrypted connection.
  185. * To enable HTTPS Boot, you have to build OVMF with -D NETWORK_HTTP_BOOT_ENABLE
  186. and -D NETWORK_TLS_ENABLE. The former brings in the HTTP stack from
  187. NetworkPkg while the latter enables TLS support in both NetworkPkg and
  188. CryptoPkg.
  189. If you want to exclude the unsecured HTTP connection completely, OVMF has to
  190. be built with -D NETWORK_ALLOW_HTTP_CONNECTIONS=FALSE so that only the HTTPS
  191. connections will be accepted.
  192. * By default, there is no trusted certificate. The user has to import the
  193. certificates either manually with "Tls Auth Configuration" utility in the
  194. firmware UI or through the fw_cfg entry, etc/edk2/https/cacerts.
  195. -fw_cfg name=etc/edk2/https/cacerts,file=<certdb>
  196. The blob for etc/edk2/https/cacerts has to be in the format of Signature
  197. Database(*1). You can use p11-kit(*2) or efisiglit(*3) to create the
  198. certificate list.
  199. If you want to create the certificate list based on the CA certificates
  200. in your local host, p11-kit will be a good choice. Here is the command to
  201. create the list:
  202. p11-kit extract --format=edk2-cacerts --filter=ca-anchors \
  203. --overwrite --purpose=server-auth <certdb>
  204. If you only want to import one certificate, efisiglist is the tool for you:
  205. efisiglist -a <cert file> -o <certdb>
  206. Please note that the certificate has to be in the DER format.
  207. You can also append a certificate to the existing list with the following
  208. command:
  209. efisiglist -i <old certdb> -a <cert file> -o <new certdb>
  210. NOTE: You may need the patch to make efisiglist generate the correct header.
  211. (https://github.com/rhboot/pesign/pull/40)
  212. * Besides the trusted certificates, it's also possible to configure the trusted
  213. cipher suites for HTTPS through another fw_cfg entry: etc/edk2/https/ciphers.
  214. OVMF expects a binary UINT16 array which comprises the cipher suites HEX
  215. IDs(*4). If the cipher suite list is given, OVMF will choose the cipher
  216. suite from the intersection of the given list and the built-in cipher
  217. suites. Otherwise, OVMF just chooses whatever proper cipher suites from the
  218. built-in ones.
  219. - Using QEMU 5.2 or later, QEMU can expose the ordered list of permitted TLS
  220. cipher suites from the host side to OVMF:
  221. -object tls-cipher-suites,id=mysuite0,priority=@SYSTEM \
  222. -fw_cfg name=etc/edk2/https/ciphers,gen_id=mysuite0
  223. (Refer to the QEMU manual and to
  224. <https://gnutls.org/manual/html_node/Priority-Strings.html> for more
  225. information on the "priority" property.)
  226. - Using QEMU 5.1 or earlier, the array has to be passed from a file:
  227. -fw_cfg name=etc/edk2/https/ciphers,file=<cipher suites>
  228. whose contents can be generated with the following script, for example:
  229. export LC_ALL=C
  230. openssl ciphers -V \
  231. | sed -r -n \
  232. -e 's/^ *0x([0-9A-F]{2}),0x([0-9A-F]{2}) - .*$/\\\\x\1 \\\\x\2/p' \
  233. | xargs -r -- printf -- '%b' > ciphers.bin
  234. This script creates ciphers.bin that contains all the cipher suite IDs
  235. supported by openssl according to the local host configuration.
  236. You may want to enable only a limited set of cipher suites. Then, you
  237. should check the validity of your list first:
  238. openssl ciphers -V <cipher list>
  239. If all the cipher suites in your list map to the proper HEX IDs, go ahead
  240. to modify the script and execute it:
  241. export LC_ALL=C
  242. openssl ciphers -V <cipher list> \
  243. | sed -r -n \
  244. -e 's/^ *0x([0-9A-F]{2}),0x([0-9A-F]{2}) - .*$/\\\\x\1 \\\\x\2/p' \
  245. | xargs -r -- printf -- '%b' > ciphers.bin
  246. (*1) See "31.4.1 Signature Database" in UEFI specification 2.7 errata A.
  247. (*2) p11-kit: https://github.com/p11-glue/p11-kit/
  248. (*3) efisiglist: https://github.com/rhboot/pesign/blob/master/src/efisiglist.c
  249. (*4) https://wiki.mozilla.org/Security/Server_Side_TLS#Cipher_names_correspondence_table
  250. === OVMF Flash Layout ===
  251. Like all current IA32/X64 system designs, OVMF's firmware device (rom/flash)
  252. appears in QEMU's physical address space just below 4GB (0x100000000).
  253. OVMF supports building a 1MB, 2MB or 4MB flash image (see the DSC files for the
  254. FD_SIZE_1MB, FD_SIZE_2MB, FD_SIZE_4MB build defines). The base address for the
  255. 1MB image in QEMU physical memory is 0xfff00000. The base address for the 2MB
  256. image is 0xffe00000. The base address for the 4MB image is 0xffc00000.
  257. Using the 1MB or 2MB image, the layout of the firmware device in memory looks
  258. like:
  259. +--------------------------------------- 4GB (0x100000000)
  260. | VTF0 (16-bit reset code) and OVMF SEC
  261. | (SECFV, 208KB/0x34000)
  262. +--------------------------------------- varies based on flash size
  263. |
  264. | Compressed main firmware image
  265. | (FVMAIN_COMPACT)
  266. |
  267. +--------------------------------------- base + 0x20000
  268. | Fault-tolerant write (FTW)
  269. | Spare blocks (64KB/0x10000)
  270. +--------------------------------------- base + 0x10000
  271. | FTW Work block (4KB/0x1000)
  272. +--------------------------------------- base + 0x0f000
  273. | Event log area (4KB/0x1000)
  274. +--------------------------------------- base + 0x0e000
  275. | Non-volatile variable storage
  276. | area (56KB/0xe000)
  277. +--------------------------------------- base address
  278. Using the 4MB image, the layout of the firmware device in memory looks like:
  279. +--------------------------------------- base + 0x400000 (4GB/0x100000000)
  280. | VTF0 (16-bit reset code) and OVMF SEC
  281. | (SECFV, 208KB/0x34000)
  282. +--------------------------------------- base + 0x3cc000
  283. |
  284. | Compressed main firmware image
  285. | (FVMAIN_COMPACT, 3360KB/0x348000)
  286. |
  287. +--------------------------------------- base + 0x84000
  288. | Fault-tolerant write (FTW)
  289. | Spare blocks (264KB/0x42000)
  290. +--------------------------------------- base + 0x42000
  291. | FTW Work block (4KB/0x1000)
  292. +--------------------------------------- base + 0x41000
  293. | Event log area (4KB/0x1000)
  294. +--------------------------------------- base + 0x40000
  295. | Non-volatile variable storage
  296. | area (256KB/0x40000)
  297. +--------------------------------------- base address (0xffc00000)
  298. The code in SECFV locates FVMAIN_COMPACT, and decompresses the
  299. main firmware (MAINFV) into RAM memory at address 0x800000. The
  300. remaining OVMF firmware then uses this decompressed firmware
  301. volume image.
  302. === UEFI Windows 7 & Windows 2008 Server ===
  303. * One of the '-vga std' and '-vga qxl' QEMU options should be used.
  304. * Only one video mode, 1024x768x32, is supported at OS runtime.
  305. * The '-vga qxl' QEMU option is recommended. After booting the installed
  306. guest OS, select the video card in Device Manager, and upgrade its driver
  307. to the QXL XDDM one. Download location:
  308. <http://www.spice-space.org/download.html>, Guest | Windows binaries.
  309. This enables further resolutions at OS runtime, and provides S3
  310. (suspend/resume) capability.