m/bootdisk
1
0
Fork 0
Code Issues Activity

Refactor secure boot initialization: remove initsecureboot, integrate into initefi, and update drive references to use ovmfcodesb

Browse Source
This commit is contained in:
MatMoul
2026-02-16 02:23:52 +01:00
parent e6cfbe525f
commit 2afe2cc813
1 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/bootdisk
View File

@@ -18,20 +18,17 @@ ovmfcode=/usr/share/edk2-ovmf/x64/OVMF_CODE.4m.fd
ovmfcodesb=/usr/share/edk2-ovmf/x64/OVMF_CODE.secboot.4m.fd ovmfcodesb=/usr/share/edk2-ovmf/x64/OVMF_CODE.secboot.4m.fd
ovmfvars=/usr/share/edk2-ovmf/x64/OVMF_VARS.4m.fd ovmfvars=/usr/share/edk2-ovmf/x64/OVMF_VARS.4m.fd
initefi(){
if [[ ! -f ${qemuworkdir}/OVMF_VARS.fd ]]; then
cp ${ovmfvars} ${qemuworkdir}/OVMF_VARS.fd
fi
}
inittpm(){ inittpm(){
swtpm socket \ swtpm socket \
--tpm2 \ --tpm2 \
--tpmstate dir=${qemuworkdir} \ --tpmstate dir=${qemuworkdir} \
--ctrl type=unixio,path=${qemuworkdir}/swtpm-sock & --ctrl type=unixio,path=${qemuworkdir}/swtpm-sock &
} }
initsecureboot(){
if [[ ! -f ${qemuworkdir}/OVMF_CODE.secboot.fd ]]; then
cp ${ovmfcodesb} ${qemuworkdir}/OVMF_CODE.secboot.fd
fi
if [[ ! -f ${qemuworkdir}/OVMF_VARS.fd ]]; then
cp ${ovmfvars} ${qemuworkdir}/OVMF_VARS.fd
fi
}
initbootargs(){ initbootargs(){
bootargs="-boot menu=on,strict=on,reboot-timeout=1000 " bootargs="-boot menu=on,strict=on,reboot-timeout=1000 "
bootargs+="-rtc base=${qemurtcbase} " bootargs+="-rtc base=${qemurtcbase} "
@@ -56,21 +53,27 @@ bootbios(){
bootefi(){ bootefi(){
echo "Booting EFI..." echo "Booting EFI..."
initbootargs initbootargs
initefi
${qemubin} \ ${qemubin} \
-bios ${ovmfcode} \ -bios ${ovmfcode} \
${bootargs} \ ${bootargs} \
-machine accel=kvm \ -machine accel=kvm \
-drive if=pflash,format=raw,unit=0,file=${ovmfcode},readonly=on \
-drive if=pflash,format=raw,unit=1,file=${qemuworkdir}/OVMF_VARS.fd \
${qemusrctype} ${qemusrc} \ ${qemusrctype} ${qemusrc} \
${qemusdb} ${qemusdb}
} }
bootefitpm(){ bootefitpm(){
echo "Booting EFI + TPM..." echo "Booting EFI + TPM..."
initefi
inittpm inittpm
initbootargs initbootargs
${qemubin} \ ${qemubin} \
-bios ${ovmfcode} \ -bios ${ovmfcode} \
${bootargs} \ ${bootargs} \
-machine accel=kvm \ -machine accel=kvm \
-drive if=pflash,format=raw,unit=0,file=${ovmfcode},readonly=on \
-drive if=pflash,format=raw,unit=1,file=${qemuworkdir}/OVMF_VARS.fd \
-chardev socket,id=tpmchar,path=${qemuworkdir}/swtpm-sock \ -chardev socket,id=tpmchar,path=${qemuworkdir}/swtpm-sock \
-tpmdev emulator,id=tpmdev,chardev=tpmchar \ -tpmdev emulator,id=tpmdev,chardev=tpmchar \
-device tpm-tis,tpmdev=tpmdev \ -device tpm-tis,tpmdev=tpmdev \
@@ -79,8 +82,8 @@ bootefitpm(){
} }
bootefisec(){ bootefisec(){
echo "Booting EFI + TPM + Secure boot..." echo "Booting EFI + TPM + Secure boot..."
initefi
inittpm inittpm
initsecureboot
initbootargs initbootargs
${qemubin} \ ${qemubin} \
-bios ${ovmfcode} \ -bios ${ovmfcode} \
@@ -88,7 +91,7 @@ bootefisec(){
-machine type=q35,smm=on,accel=kvm \ -machine type=q35,smm=on,accel=kvm \
-global driver=cfi.pflash01,property=secure,value=on \ -global driver=cfi.pflash01,property=secure,value=on \
-global ICH9-LPC.disable_s3=1 \ -global ICH9-LPC.disable_s3=1 \
-drive if=pflash,format=raw,unit=0,file=${qemuworkdir}/OVMF_CODE.secboot.fd,readonly=on \ -drive if=pflash,format=raw,unit=0,file=${ovmfcodesb},readonly=on \
-drive if=pflash,format=raw,unit=1,file=${qemuworkdir}/OVMF_VARS.fd \ -drive if=pflash,format=raw,unit=1,file=${qemuworkdir}/OVMF_VARS.fd \
-chardev socket,id=tpmchar,path=${qemuworkdir}/swtpm-sock \ -chardev socket,id=tpmchar,path=${qemuworkdir}/swtpm-sock \
-tpmdev emulator,id=tpmdev,chardev=tpmchar \ -tpmdev emulator,id=tpmdev,chardev=tpmchar \