Al's Website

Just another WordPress site

Playing with UEFI Secure Boot – Part 1: OVMF

| 4 Comments

There’s a lot of FUD going around about Secure Boot, but very few people seem to really understand how it works. I decided to learn the hard way: by actually trying to set it all up and see what it does.

The first problem is that I don’t have any UEFI hardware to test on. Luckily there is a reference firmware for virtual machines called OVMF. This can be run in QEMU. The project page has binaries that you can try out, but in order to get Secure Boot you need to recompile it.

Rather than explain in full how to do that, I have added the extra steps required to build with Secure Boot to the UEFI-howto on the Ubuntu wiki. So the first thing for you to do is to follow all the steps on that guide. At the end you should have QEMU set up to run OVFM and also an (unsigned) HelloWorld.efi which you can run inside it.

In the end I have a file structure like this:

~/uefi
├── bios
│   ├── bios.bin -> edk2/Build/OvmfX64/DEBUG_GCC46/FV/OVMF.fd
│   └── vgabios-cirrus.bin -> edk2/Build/OvmfX64/DEBUG_GCC46/FV/OvmfVideo.rom
└── hda
    └── HelloWorld.efi -> edk2/Build/MdeModule/DEBUG_GCC46/X64/HelloWorld.efi

I run QEMU like this:

$ qemu-system-x86_64 -L ./bios -hda fat:hda -no-kvm

Verify that your OVMF build has Secure Boot support by typing “exit” to leave the EFI shell. Now choose the menu option “Device Manager”. You should now see another menu with “Secure Boot Configuration” as the only option.

IMPORTANT: QEMU/OVMF will not save any settings, so any changes you make in the EFI shell or menus won’t be saved if you shutdown QEMU.

I encourage anyone who is curious about how secure boot will look to the end user to try setting this up. Leave a comment if you have any problems.

4 Comments

  1. Hello…

    Missing hyperlink with characters “UEFI-howto on the Ubuntu wiki”.
    what’s the original article?

    https://wiki.ubuntu.com/wiki.ubuntu.com/UEFI/EDK2?action=fullsearch&context=180&value=UEFI&titlesearch=Titles

    Thanks
    Best Regards..

  2. Interestingly when I run qemu-system-X86_64w -L c:\ovmf -no-kvm I get the following error:
    Could not open option rom ‘kvmvapic.bin’: No such file or directory
    qemu-system-X86_64w: pci_add_option_rom: failed to find romfile “pxe-e1000.rom”

    I assume the kvmvapic.bin is not a fatal problem? But I can’t figure out when I need to build to get hold of the pxe-e1000.rom ? Any ideas?
    Thanks

    • Ignore the last post 🙂 I need to run it out of the Bios folder in Qemu which contains all the bios files I need. My newly compiled ovmf bios (with secure boot enabled) does work 🙂

Leave a Reply

Required fields are marked *.