OVMF - Revision history

Lersek: replace stale contents with link to whitepaper

2015-03-10T14:27:43Z

replace stale contents with link to whitepaper

Bcran: Fixed links to tianocore wiki

2014-08-22T06:01:48Z

Fixed links to tianocore wiki

← Older revision		Revision as of 02:01, 22 August 2014
Line 11:		Line 11:
	== Building from source ==		== Building from source ==

	Clone either the main SVN repository (git svn recommended) or one of the git mirrors listed in the [http://sourceforge.net/~~apps/mediawiki/tianocore~~/~~index.php?title=~~Source_Control TianoCore wiki].		Clone either the main SVN repository (git svn recommended) or one of the git mirrors listed in the [http://tianocore.sourceforge.net/wiki/Source_Control TianoCore wiki].

	=== Frequent rebuilds ===		=== Frequent rebuilds ===

	For developers it is recommended to create a branch called <code>base_config</code> or something similar off the master branch (in the git svn or plain git clone), capture the config steps described [http://sourceforge.net/~~apps/mediawiki/tianocore~~/~~index.php?title=~~How_to_build_OVMF here] in commits (including setting up a reasonable <code>.gitignore</code> file), and keep rebasing <code>base_config</code> after <code>git svn rebase --use-log-author</code> / <code>git pull</code> commands. Fork/rebase your own development branches off/to <code>base_config</code>.		For developers it is recommended to create a branch called <code>base_config</code> or something similar off the master branch (in the git svn or plain git clone), capture the config steps described [http://tianocore.sourceforge.net/wiki/How_to_build_OVMF here] in commits (including setting up a reasonable <code>.gitignore</code> file), and keep rebasing <code>base_config</code> after <code>git svn rebase --use-log-author</code> / <code>git pull</code> commands. Fork/rebase your own development branches off/to <code>base_config</code>.

	The very first time you build the tree, and after <code>git clean -fdx</code> commands, you must (re)build BaseTools with <code>make -C "$EDK_TOOLS_PATH"</code>. (You're going to have that variable set in your environment after sourcing <code>edksetup.sh</code> in the root project dir; see the [http://sourceforge.net/~~apps/mediawiki/tianocore~~/~~index.php?title=~~OVMF TianoCore Wiki] again.)		The very first time you build the tree, and after <code>git clean -fdx</code> commands, you must (re)build BaseTools with <code>make -C "$EDK_TOOLS_PATH"</code>. (You're going to have that variable set in your environment after sourcing <code>edksetup.sh</code> in the root project dir; see the [http://tianocore.sourceforge.net/wiki/OVMF TianoCore Wiki] again.)

	=== One-off builds ===		=== One-off builds ===

Lersek: specify "hd,cdrom" boot order -- makes no difference while the target disk is unpartitioned, and is preferred after completing the installation

2013-08-26T10:01:18Z

specify "hd,cdrom" boot order -- makes no difference while the target disk is unpartitioned, and is preferred after completing the installation

← Older revision		Revision as of 06:01, 26 August 2013
Line 53:		Line 53:
	--machine=rhel6.4.0 \		--machine=rhel6.4.0 \
	--vcpus=4 \		--vcpus=4 \
	--boot=cdrom~~,hd~~ \		--boot=hd,cdrom \
	--disk=path=$TARGET_DISK,size=25,bus=virtio,format=qcow2 \		--disk=path=$TARGET_DISK,size=25,bus=virtio,format=qcow2 \
	--disk=path=$INSTALL_ISO,device=cdrom,bus=ide,perms=ro,format=raw \		--disk=path=$INSTALL_ISO,device=cdrom,bus=ide,perms=ro,format=raw \

Lersek: Gerd's packages now enable win2k8r2sp1 to work out of the box

2013-06-20T11:33:52Z

Gerd's packages now enable win2k8r2sp1 to work out of the box

← Older revision		Revision as of 07:33, 20 June 2013
Line 206:		Line 206:
	<li>'''Windows 8'''. In order to test Secure Boot, enroll the keys from [http://blog.hansenpartnership.com/the-microsoft-keys/ James Bottomley's blog], [http://msdn.microsoft.com/en-us/library/windows/desktop/hh847889.aspx start PowerShell as an administrator], then [http://communities.intel.com/community/vproexpert/blog/2012/06/26/microsoft-windows-8--enabling-secure-boot verify Secure Boot].</li>		<li>'''Windows 8'''. In order to test Secure Boot, enroll the keys from [http://blog.hansenpartnership.com/the-microsoft-keys/ James Bottomley's blog], [http://msdn.microsoft.com/en-us/library/windows/desktop/hh847889.aspx start PowerShell as an administrator], then [http://communities.intel.com/community/vproexpert/blog/2012/06/26/microsoft-windows-8--enabling-secure-boot verify Secure Boot].</li>
	<li>'''Windows Server 2012''', reportedly.</li>		<li>'''Windows Server 2012''', reportedly.</li>
	<li>'''Windows Server 2008 R2 SP1'''. This guest has a bug (it requires VGA BIOS support even when booted by UEFI firmware). Thankfully, David Woodhouse and Kevin O'Connor implemented a Compatibility Support Module (CSM) for SeaBIOS. Some out-of-tree patches (as of now) are needed for OVMF from http://git.infradead.org/users/dwmw2/edk2.git/; ~~with those~~ this guest boots fine.</li>		<li>'''Windows Server 2008 R2 SP1'''. This guest has a bug (it requires VGA BIOS support even when booted by UEFI firmware). Thankfully, David Woodhouse and Kevin O'Connor implemented a Compatibility Support Module (CSM) for SeaBIOS. Some out-of-tree patches (as of now) are needed for OVMF from http://git.infradead.org/users/dwmw2/edk2.git/; they are included in Gerd's packages and this guest boots fine with them.</li>
	</ul>		</ul>

Lersek: fix typo in Gerd's name

2013-06-15T13:44:24Z

fix typo in Gerd's name

← Older revision		Revision as of 09:44, 15 June 2013
Line 5:		Line 5:
	This page is written as of edk2 svn rev 14423 (virtio-blk, virtio-scsi and virtio-net are supported, and several guests can be booted with, and recognize secure boot). For using OVMF directly with the qemu command line, refer to the [https://github.com/tianocore/edk2/blob/master/OvmfPkg/README README]; this page tries to detail OVMF usage under (RHEL-6.4) libvirt.		This page is written as of edk2 svn rev 14423 (virtio-blk, virtio-scsi and virtio-net are supported, and several guests can be booted with, and recognize secure boot). For using OVMF directly with the qemu command line, refer to the [https://github.com/tianocore/edk2/blob/master/OvmfPkg/README README]; this page tries to detail OVMF usage under (RHEL-6.4) libvirt.

	The recommended way for testing OVMF is installing Gerd ~~Hoffman~~'s RPM packages from his repo at http://www.kraxel.org/repos/, using yum. (The package to install is <code>edk2.git-ovmf-x64</code>; yum will pull in several dependencies from the repo.)		The recommended way for testing OVMF is installing Gerd Hoffmann's RPM packages from his repo at http://www.kraxel.org/repos/, using yum. (The package to install is <code>edk2.git-ovmf-x64</code>; yum will pull in several dependencies from the repo.)

	The firmware images are located in the <code>/usr/share/edk2.git/ovmf-x64</code> directory. <code>OVMF-pure-efi.fd</code> is a "pure UEFI" image, while <code>OVMF-with-csm.fd</code> includes the Compatibility Support Module (CSM) build of SeaBIOS. <code>bios.bin</code> is a symlink to the latter. Both images support Secure Boot.		The firmware images are located in the <code>/usr/share/edk2.git/ovmf-x64</code> directory. <code>OVMF-pure-efi.fd</code> is a "pure UEFI" image, while <code>OVMF-with-csm.fd</code> includes the Compatibility Support Module (CSM) build of SeaBIOS. <code>bios.bin</code> is a symlink to the latter. Both images support Secure Boot.

Lersek: update win2k8r2sp1 guest status

2013-06-15T13:42:26Z

update win2k8r2sp1 guest status

@@ Line 206: / Line 206: @@
 <li>'''Windows 8'''. In order to test Secure Boot, enroll the keys from [http://blog.hansenpartnership.com/the-microsoft-keys/ James Bottomley's blog], [http://msdn.microsoft.com/en-us/library/windows/desktop/hh847889.aspx start PowerShell as an administrator], then [http://communities.intel.com/community/vproexpert/blog/2012/06/26/microsoft-windows-8--enabling-secure-boot verify Secure Boot].</li>
 <li>'''Windows Server 2012''', reportedly.</li>
 </ul>

Lersek: Update guest status: F18, F19, RHEL-6.3, RHEL-6.4, Win8, Win2012Server

2013-06-15T12:57:51Z

Update guest status: F18, F19, RHEL-6.3, RHEL-6.4, Win8, Win2012Server

@@ Line 199: / Line 199: @@
 == Tested guest OS'en ==
 <ul>
-<li>Fedora 18 Alpha (XFCE edition). [[#Confirmation of secure boot in Fedora 18|Secure boot tested]] as well.</li>
+<li>'''Fedora 18''' (XFCE spin tested). When Fedora 18 was released, it co-operated with, and recognized Secure Boot. However some time later the signature verification algorithm changed in TianoCore, and currently OVMF doesn't accept the signatures on Fedora 18 shim. (Fedora 18 works fine on top of OVMF otherwise, when Secure Boot is disabled.)</li>
-<li>RHEL-6.3. (Its grub does not support booting from a virtio-blk disk. See [[#Making guests use it]] how to specify a virtio-scsi boot disk.)</li>
+<li>'''Fedora 19''' (XFCE spin tested). It supports Secure Boot on current OVMF. See [https://bugzilla.redhat.com/show_bug.cgi?id=963361#c9 Red Hat Bugzilla 963361 comment 9] and subsequent comments for the setup. In order to transfer certificates from host to guest (for key enrollment), it is recommended to prepare a disk image with a [http://libguestfs.org/ libguestfs] utility, like <code>guestfish</code> or <code>guestmount</code>, and attach it to the virtual machine.</li>
-<li>Windows 8 Consumer Preview Build 8250. [[#Confirmation of secure boot in Windows 8 Consumer Preview Build 8250|Secure boot tested]] as well. The fix for qemu-kvm [https://bugzilla.redhat.com/show_bug.cgi?id=854304 RHBZ#854304] may be necessary to run this guest. (Upstream qemu contains the [http://git.qemu.org/?p=qemu.git;a=commitdiff;h=4d09d37c6aa9a02b44b1fdb6268820fab92499bd fix] of course.)</li>
+<li>'''RHEL-6.3''' and '''RHEL-6.4'''. The <code>grub-efi</code> releases in these RHEL-6 minor releases don't support booting from a virtio-blk disk. Virtio-scsi is supported however (see libvirt XML configuration above). Grub-efi in a future RHEL-6 minor release should hopefully support virtio-blk as well, see [https://bugzilla.redhat.com/show_bug.cgi?id=916016 Red Hat Bugzilla 916016].</li>
-<li>Reportedly, Windows Server 2012.</li>
+<li>'''Windows 8'''. In order to test Secure Boot, enroll the keys from [http://blog.hansenpartnership.com/the-microsoft-keys/ James Bottomley's blog], [http://msdn.microsoft.com/en-us/library/windows/desktop/hh847889.aspx start PowerShell as an administrator], then [http://communities.intel.com/community/vproexpert/blog/2012/06/26/microsoft-windows-8--enabling-secure-boot verify Secure Boot].</li>
 </ul>
@@ Line 293: / Line 292: @@
 ====
 </pre>

Lersek: add and describe the qemu wrapper script I use on RHEL-6.4 for development

2013-06-15T12:21:28Z

add and describe the qemu wrapper script I use on RHEL-6.4 for development

Show changes

Lersek: remove debug log discussion (configuration, capturing); the README deals with them

2013-06-15T11:35:27Z

remove debug log discussion (configuration, capturing); the README deals with them

← Older revision		Revision as of 07:35, 15 June 2013
Line 23:		Line 23:
	<code>OvmfPkg/build.sh</code> takes care of BaseTools, configuration (according to command line options) and the main build. One potentially useful option is <code>-n THREADNUMBER</code>, which enables parallel make.		<code>OvmfPkg/build.sh</code> takes care of BaseTools, configuration (according to command line options) and the main build. One potentially useful option is <code>-n THREADNUMBER</code>, which enables parallel make.

	<code>-D FLAG</code> options control optional build features/aspects. Consult <code>OvmfPkg/build.sh</code>, <code>OvmfPkg/README</code>, the <code>OvmfPkg/.dsc</code> and <code>OvmfPkg/.fdf</code> files, and Gerd's SRPMs.		<code>-D FLAG</code> options control optional build features/aspects; among other things, verbosity of OVMF's debug log. Consult <code>OvmfPkg/build.sh</code>, <code>OvmfPkg/README</code>, the <code>OvmfPkg/.dsc</code> and <code>OvmfPkg/.fdf</code> files, and Gerd's SRPMs.

	== Using the firmware image with libvirt ==		== Using the firmware image with libvirt ==
Line 82:		Line 82:
	</ol>		</ol>

			=== qemu wrapper script under libvirt ===

			Libvirt (and its frontends, eg. virsh and virt-manager) provide a convenient way to manage virtual machines. However some qemu command line options are not directly exposed (at least not on a RHEL-6.4 host) that would prove useful otherwise. A script that wraps qemu and plays the emulator role for libvirt allows extra flexibility. (On the other side of the coin, it may introduce extra confusion, so use with care).
	~~== Saving OVMF debug messages ==~~

	~~Debug log verbosity is controlled at build time. See the <code>gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel</code> bitmask in <code>OvmfPkg/OvmfPkgX64.dsc</code>. The individual bits~~ (~~<code>DEBUG_*</code> macros) are explained in <code>MdePkg/Include/Library/DebugLib~~.~~h</code>.~~

	~~=== serial console ===~~

	~~Debug messages are written to the qemu debug port per default (see below~~)~~, but they can be redirected~~ to ~~the (~~virtual) serial console with the <code>-D DEBUG_ON_SERIAL_PORT</code> option at build time. In this case however the serial console will intermix framework debug messages with the TUI of the (U)EFI shell and other UEFI applications.

	~~===~~ qemu ~~debug port ===~~

	~~This is where the debug messages are written by default, but capturing them on the host requires the <code>-debugcon DEV -global isa-debugcon.iobase=0x402</code> qemu-kvm~~ command line ~~switches. These can be set~~ on a ~~guest-by~~-~~guest basis in the libvirt VM config XML files, using [http://libvirt~~.~~org/drvqemu~~.~~html#qemucommand~~ qemu~~:arg]~~.

	~~Alternatively~~, ~~one might contemplate a qemu-kvm wrapper script like the following:~~

	<pre>		<pre>

Lersek: refresh libvirt intro

2013-06-15T11:24:25Z

refresh libvirt intro

← Older revision		Revision as of 07:24, 15 June 2013
Line 25:		Line 25:
	<code>-D FLAG</code> options control optional build features/aspects. Consult <code>OvmfPkg/build.sh</code>, <code>OvmfPkg/README</code>, the <code>OvmfPkg/.dsc</code> and <code>OvmfPkg/.fdf</code> files, and Gerd's SRPMs.		<code>-D FLAG</code> options control optional build features/aspects. Consult <code>OvmfPkg/build.sh</code>, <code>OvmfPkg/README</code>, the <code>OvmfPkg/.dsc</code> and <code>OvmfPkg/.fdf</code> files, and Gerd's SRPMs.

	== ~~Making guests use it~~ ==		== Using the firmware image with libvirt ==

	~~So now you have either downloaded a prebuilt binary, or installed the noarch RPM in the host, or built <code>OVMF.fd</code> yourself. This "Flash Device" file~~ is ~~passed to qemu-kvm with the <code>-bios</code> option (with full pathname), which is accessible~~ in the ~~libvirt~~ domain XML as the <code>/domain/os/loader</code> element.		The boot firmware is set in the domain XML file under the <code>/domain/os/loader</code> element.

	Neither <code>virt-manager</code> nor <code>virt-install</code> seem to ~~make~~ this ~~option readily configurable at guest installation time in~~ RHEL-6.3. The following list of commands is one workaround. The <code>EMULATOR</code> bit is ~~elaborated upon under [[#~~qemu ~~debug port]]~~.		Neither <code>virt-manager</code> nor <code>virt-install</code> seem to expose this XML node on RHEL-6.4. The following list of commands is one workaround. The <code>EMULATOR</code> bit is discussed later -- it is useful to have a wrapper script in place, between libvirt and qemu, to add custom options.

	<pre>		<pre>
Line 51:		Line 51:
	--ram=4096 \		--ram=4096 \
	--arch=x86_64 \		--arch=x86_64 \
	--machine=rhel6.3.0 \		--machine=rhel6.4.0 \
	--vcpus=4 \		--vcpus=4 \
	--boot=cdrom,hd \		--boot=cdrom,hd \
	--disk=path=$TARGET_DISK,size=25,bus=virtio,format=qcow2 \		--disk=path=$TARGET_DISK,size=25,bus=virtio,format=qcow2 \
			--disk=path=$INSTALL_ISO,device=cdrom,bus=ide,perms=ro,format=raw \
	--disk=path=$DRIVER_ISO,device=cdrom,bus=ide,perms=ro,format=raw \		--disk=path=$DRIVER_ISO,device=cdrom,bus=ide,perms=ro,format=raw \
	~~--disk=path=$INSTALL_ISO,device=cdrom,bus=ide,perms=ro,format=raw \~~
	--print-step=1 \		--print-step=1 \
	\| xmlstarlet ed -u /domain/devices/emulator -v $EMULATOR \		\| xmlstarlet ed -u /domain/devices/emulator -v $EMULATOR \