Skip to content

Firmware (EDK2 / OVMF)

patches/EDK2/AMD-edk2-stable202605.patch and patches/EDK2/Intel-edk2-stable202605.patch change firmware identity values. steps/edk2.py clones EDK2, applies the patch, builds OVMF, and installs to /opt/vmw/firmware/.

See also: MEASURED_BOOT, BOOT_LOGO, identity strings.

Build

build -a X64 -p OvmfPkg/OvmfPkgX64.dsc -b RELEASE -t GCC -n 0 -s \
  --define SECURE_BOOT_ENABLE=TRUE \
  --define SMM_REQUIRE=TRUE \
  --define TPM1_ENABLE=TRUE \
  --define TPM2_ENABLE=TRUE

Matching domain XML:

<features>
  <smm state="on"/>
</features>
...
<tpm model="tpm-crb">
  <backend type="emulator" version="2.0"/>
</tpm>

The distro's edk2-ovmf package installs templates under /usr/share/edk2/x64/. steps/edk2.py builds firmware from source instead and installs it to /opt/vmw/firmware/, so the deployed image carries the patched identity values.

Boot logo BMP rules

The EDK2 image decoder rejects a logo that fails these checks, so steps/edk2.py validates it before copying it in:

  • Bytes 0–1 are 0x42 0x4D (BM).
  • Bit depth is 1, 4, 8, or 24.
  • Compression is 0.
  • Width and height are 65535 or less.

Source: GenC.py#L1892

Secure Boot key enrollment

build_ovmf() in steps/edk2.py reads this host's own EFI keys from /sys/firmware/efi/efivars/, writes them to JSON, and injects them into a raw .fd with virt-fw-vars --set-json. This matches the deployed firmware's Secure Boot keys to the host exactly.

Microsoft's published objects: secureboot_objects. PreSignedObjects holds PK/KEK/DB .der certificates. PostSignedObjects holds DBXUpdate.bin.

EDK2's own enrollment app: EnrollDefaultKeys (OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.{c,h,inf}).

Tooling: UEFI variable store, virt-fw-vars man page, efijson.py

"Last BIOS time: 0.0"

Task Manager reports a zero BIOS time because stock OVMF omits the FPDT module. Add the FPDT DXE to the ACPI support section of OvmfPkg/OvmfPkgX64.dsc:

MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTableDxe/FirmwarePerformanceDxe.inf

Implementation: MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTableDxe/FirmwarePerformanceDxe.c.

MOR / MORLock

Memory Overwrite Request control, expected on real Secure Boot systems:

OVMF TPM support

Boot order variable

VMMBootOrderNNNN (L"BootOrder%04x") is built in OvmfPkg/Library/QemuBootOrderLib/QemuBootOrderLib.c.

Specifications and GUIDs

Variable name GUID
EFI_GLOBAL_VARIABLE 8be4df61-93ca-11d2-aa0d-00e098032b8c
EFI_IMAGE_SECURITY_DATABASE_GUID d719b2cb-3d3a-4596-a3bc-dad00e67656f

Host paths

What Where
Writable NVRAM generated per domain /var/lib/libvirt/qemu/nvram
Disk images /var/lib/libvirt/images/
Built firmware /opt/vmw/firmware/