Revision as of 08:01, 24 September 2016

Firmware installation

UEFI for x86 QEMU/KVM VMs is called OVMF (Open Virtual Machine Firmware). It comes from EDK2 (EFI Development Kit), which is the UEFI reference implementation.

Installing 'UEFI for QEMU' from Fedora repos

Since June 2016, OVMF is available in Fedora repositories. All you need to have installed is edk2-ovmf RPM. Furthermore, it should be now a dependency of the qemu package, so you probably have it installed already. This includes firmware for secureboot (OVMF_CODE.secboot.fd)

Installing 'UEFI for QEMU' nightly builds

Gerd Hoffmann, Red Hatter and QEMU developer, has a dnf repo on his personal site that provides nightly builds of a whole bunch of QEMU/KVM firmware, including EDK2/OVMF.

Here's how to pull down the nightly builds for x86:

 sudo dnf install dnf-plugins-core
 sudo dnf config-manager --add-repo http://www.kraxel.org/repos/firmware.repo
 sudo dnf install edk2.git-ovmf-x64

Note, these are nightly builds, and may occasionally be broken.

Optionally Configure libvirtd to advertise UEFI support

Libvirt needs to know about UEFI->NVRAM config file mapping, so it can advertise it to tools like virt-manager/virt-install. On Fedora 22 and later, libvirt packages are configured to look for the nightly build paths, so this will work out of the box.

However, if you want to use custom binaries, you will need to edit the nvram variable in /etc/libvirt/qemu.conf and restart libvirtd.

Creating a VM

virt-manager

Create a new VM in virt-manager. When you get to the final page of the 'New VM' wizard, do the following:

Click 'Customize before install', then select 'Finish'
On the 'Overview' screen, Change the 'Firmware' field to select the 'UEFI x86_64' option.
Click 'Begin Installation'
The boot screen you'll see should use linuxefi commands to boot the installer, and you should be able to run efibootmgr inside that system, to verify that you're running an UEFI OS.

virt-install

Add --boot uefi to your virt-install command. Example:

 sudo virt-install --name f20-uefi \
   --ram 2048 --disk size=20 \
   --boot uefi \
   --location https://dl.fedoraproject.org/pub/fedora/linux/releases/22/Workstation/x86_64/os/

Testing Secureboot in a VM

These steps describe how to test Fedora Secureboot support inside a KVM VM. The audience here is QA folks that want to test secureboot, and any other curious parties. This requires configuring the VM to use UEFI, so it builds upon the previous UEFI steps.

Run EnrollDefaultKeys.efi

(Formerly this article recommended the independent utility "LockDown_ms.efi".)

Since OVMF doesn't ship with any SecureBoot keys installed, we need to install some to mimic what an MS certified UEFI machine will ship with. OVMF now ships with the binaries required to set up a default set of keys. The easiest way is to use UefiShell.iso which is available at /usr/share/edk2/ovmf/UefiShell.iso. Boot your VM with this as the CD-ROM image and it should boot into the UEFI shell. At the prompt

Shell> fs0:
FS0:\> EnrollDefaultKeys.efi
FS0:\> reset
The VM will restart. Let it boot into Fedora as normal. Log in
You should see the string 'Secure boot enabled' in dmesg. Secureboot is now enabled for every subsequent boot.

Testing Fedora CD/DVD Secure Boot in a VM

Once you have a secureboot configured VM as described above, it's easy to use this to test ISO media secureboot support.

Use virt-manager to attach the ISO media to your VM
Use virt-manager to change the VM boot settings to boot off the CDROM
Start the VM
Switch to a terminal inside the VM, verify Secureboot is enabled by checking dmesg

Notes

Using UEFI with AArch64 VMs

Fedora's AArch64 releases will only run on UEFI, so require UEFI inside the VM. However the steps are slightly different. See this page for complete documentation: https://fedoraproject.org/wiki/Architectures/AArch64/Install_with_QEMU

Extra links

@@ Line 1: / Line 1: @@
+= Firmware installation =
-= Using UEFI in a QEMU/KVM VM =
+UEFI for x86 QEMU/KVM VMs is called OVMF (Open Virtual Machine Firmware). It comes
+from EDK2 (EFI Development Kit), which is the UEFI reference implementation.
-== Installing 'UEFI for QEMU' nightly builds ==
+== Installing 'UEFI for QEMU' from Fedora repos ==
-UEFI for x86 QEMU/KVM VMs is called OVMF (Open Virtual Machine Firmware). It comes
+Since June 2016, OVMF is available in Fedora repositories. All you need to have installed is <code>edk2-ovmf</code> RPM. Furthermore, it should be now a dependency of the {{pkg|qemu}} package, so you probably have it installed already. This includes firmware for secureboot (<code>OVMF_CODE.secboot.fd</code>)
-from EDK2 (EFI Development Kit), which is the UEFI reference implementation.
-Unfortunately there are licensing issues which prevent us getting EDK2/OVMF
+== Installing 'UEFI for QEMU' nightly builds ==
-into Fedora (see [[#EDK2 Licensing Issues]] for more info). So we
-have to grab external packages.
-Gerd Hoffman, Red Hatter and QEMU developer, has a yum repo on his personal
+Gerd Hoffmann, Red Hatter and QEMU developer, has a [[dnf]] repo on his personal
 site that provides nightly builds of a whole bunch of QEMU/KVM firmware,
 including EDK2/OVMF.
@@ Line 17: / Line 16: @@
 Here's how to pull down the nightly builds for x86:
-   sudo wget http://www.kraxel.org/repos/firmware.repo -O /etc/yum.repos.d/firmware.repo
+   sudo dnf install dnf-plugins-core
-   sudo yum install edk2.git-ovmf-x64
+  sudo dnf config-manager --add-repo http://www.kraxel.org/repos/firmware.repo
+   sudo dnf install edk2.git-ovmf-x64
-== Install a Fedora VM with UEFI ==
+Note, these are nightly builds, and may occasionally be broken.
-{{admon/note | This examples assume you are using Fedora 21 packages. | UEFI VMs can be installed with older Fedora versions, but since as of Fedora 21 this stuff is still under active development, it's recommended to run the latest bits. }}
+== Optionally Configure libvirtd to advertise UEFI support ==
-First we need to install a guest using UEFI instead of traditional bios.
+Libvirt needs to know about UEFI->NVRAM config file mapping, so it can advertise it to tools like virt-manager/virt-install. On Fedora 22 and later, libvirt packages are configured to look for the nightly build paths, so this will work out of the box.
-Anaconda will put all the right bits in place for us.
-Here's an example F20 install:
+However, if you want to use custom binaries, you will need to edit the <b>nvram</b> variable in <b>/etc/libvirt/qemu.conf</b> and restart libvirtd.
+= Creating a VM =
+== virt-manager ==
+Create a new VM in virt-manager. When you get to the final page of the 'New VM' wizard, do the following:
+* Click 'Customize before install', then select 'Finish'
+* On the 'Overview' screen, Change the 'Firmware' field to select the 'UEFI x86_64' option.
+* Click 'Begin Installation'
+* The boot screen you'll see should use <code>linuxefi</code> commands to boot the installer, and you should be able to run <code>efibootmgr</code> inside that system, to verify that you're running an UEFI OS.
+== virt-install ==
+Add <code>--boot uefi</code> to your <code>virt-install</code> command. Example:
    sudo virt-install --name f20-uefi \
      --ram 2048 --disk size=20 \
-     --boot loader_type=pflash,loader_ro=yes,loader=/usr/share/edk2.git/ovmf-x64/OVMF_CODE-pure-efi.fd,nvram_template=/usr/share/edk2.git/ovmf-x64/OVMF_VARS-pure-efi.fd \
+     --boot uefi \
-     --location https://dl.fedoraproject.org/pub/fedora/linux/releases/20/Fedora/x86_64/os/
+     --location https://dl.fedoraproject.org/pub/fedora/linux/releases/22/Workstation/x86_64/os/
 = Testing Secureboot in a VM =
@@ Line 39: / Line 54: @@
 any other curious parties. This requires configuring the VM to use UEFI, so it builds upon the previous UEFI steps.
-== Grab LockDown_ms.efi ==
+== Run EnrollDefaultKeys.efi ==
-Since OVMF doesn't ship with any SecureBoot keys installed, we need to
+(Formerly this article recommended the independent utility "LockDown_ms.efi".)
-install some to mimic what an MS certified UEFI machine will ship with.
-Luckily there's a tool that does all this for us, called LockDown_ms.efi.
-This is derived from code in [http://git.kernel.org/?p=linux/kernel/git/jejb/efitools.git;a=summary efitools.git].
-Inside the guest, do:
+Since OVMF doesn't ship with any SecureBoot keys installed, we need to install some to mimic what an MS certified UEFI machine will ship with. OVMF now ships with the binaries required to set up a default set of keys. The easiest way is to use UefiShell.iso which is available at <code>/usr/share/edk2/ovmf/UefiShell.iso</code>. Boot your VM with this as the CD-ROM image and it should boot into the UEFI shell. At the prompt
-  sudo wget http://fedorapeople.org/~crobinso/secureboot/LockDown_ms.efi -O /boot/efi/EFI/fedora/LockDown_ms.efi
-Now we need to enroll the keys in UEFI.
-* Reboot the VM
-* When the TianoCore splash screen pops up, hit ESC
-* Select 'Boot Manager'
-* Select 'EFI Internal Shell'
-* Hit ESC to skip startup.nsh, or wait for the 5 second timeout.
 * Shell> fs0:
-* FS0:\> \EFI\fedora\LockDown_ms.efi
+* FS0:\> EnrollDefaultKeys.efi
 * FS0:\> reset
 * The VM will restart. Let it boot into Fedora as normal. Log in
@@ Line 73: / Line 76: @@
 = Notes =
-== EDK2 Licensing Issues ==
-EDK2 contains a FAT filesystem driver that is licensed under terms that
-make it not acceptable for packaging in Fedora. Particularly that there's
-a usage restricition only allowing the code to be used in a UEFI
-implementation. More details here at [http://tianocore.sourceforge.net/wiki/Edk2-fat-driver Edk2-fat-driver]
-The driver is critical functionality so removing it is not an option.
 == Using UEFI with AArch64 VMs ==
@@ Line 87: / Line 81: @@
 [[Architectures/ARM/AArch64|Fedora's AArch64 releases]] will only run on UEFI, so require UEFI inside the VM. However the steps are slightly different. See this page for complete documentation: https://fedoraproject.org/wiki/Architectures/AArch64/Install_with_QEMU
-== Extra links ==
+= Extra links =
+* [[QA:Testcase Virtualization UEFI]]
+* [http://www.linux-kvm.org/page/OVMF KVM wiki OVMF page]
 * [https://wiki.ubuntu.com/SecurityTeam/SecureBoot Ubuntu secureboot page]
 * [http://en.opensuse.org/openSUSE:UEFI_Secure_boot_using_qemu-kvm OpenSUSE secureboot page]
-* [http://www.linux-kvm.org/page/OVMF KVM wiki OVMF page]
+* [http://www.labbott.name/blog/2016/09/15/secure-ish-boot-with-qemu/ Using SecureBoot with QEMU]
 [[Category:Virtualization]] [[Category:QA]]

Search

Using UEFI with QEMU: Difference between revisions