Force SeaBIOS instead of OVMF-based firmware & some firmware lookup logic changes #12750
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…of OVMF EDKII CSM module was removed (https://bugzilla.tianocore.org/show_bug.cgi?id=4588), we want to force all existing VMs those are using a OVMF-based CSM firmware to step on the SeaBIOS. Signed-off-by: Alexander Mikhalitsyn <[email protected]>
|
I have tested this with a VM which was created on the LXD 5.19 and then upgraded to the LXD version with these patches. It works without any problems. |
mihalicyn
force-pushed
the
force_seabios_for_csm
branch
from
182772e to
f61b99c
Compare
simondeziel
previously approved these changes
Jan 19, 2024
mihalicyn
force-pushed
the
force_seabios_for_csm
branch
from
f61b99c to
b4d6b41
Compare
mihalicyn
force-pushed
the
force_seabios_for_csm
branch
from
b4d6b41 to
2ccefc7
Compare
simondeziel
previously approved these changes
Jan 19, 2024
mihalicyn
force-pushed
the
force_seabios_for_csm
branch
2 times, most recently
from
e451116 to
2fe9d31
Compare
tomponline
reviewed
Jan 19, 2024
- introduce new env variable LXD_QEMU_FW_PATH in addition to LXD_OVMF_PATH as this name is more correct. OVMF is a specific firmware name, while we can use SeaBIOS or, for example, ArmVirt. - make support of array of paths in the LXD_QEMU_FW_PATH/LXD_OVMF_PATH separated by ":" like PATH/LD_LIBRARY_PATH/etc. Signed-off-by: Alexander Mikhalitsyn <[email protected]>
Let's rename ovmf mentions to vmf (virtual machine firmware) depending on the context. As OVMF is a specific name of the EDK2-based firmware for x86_64. For arm64 we also use edk2-based firmware called ArmVirtQemu (from ArmVirtPkg). No functional changes here. Signed-off-by: Alexander Mikhalitsyn <[email protected]>
1. It makes no sense to set security.csm=true for arches except x86_64 as we don't have any kind of a "legacy" firmware for them. x86_64 architecture is a very special case cause we have a legacy (BIOS) and modern (UEFI) firmwares supported in LXD. 2. Same about having CSM enabled together with boot.debug_edk2, cause the last one means that EDK2 is used. Signed-off-by: Alexander Mikhalitsyn <[email protected]>
…s.bin bios-256k.bin is a standard name for SeaBIOS firmware, while seabios.bin is a specific one. Signed-off-by: Alexander Mikhalitsyn <[email protected]>
mihalicyn
force-pushed
the
force_seabios_for_csm
branch
from
2fe9d31 to
62ee9ff
Compare
|
@mihalicyn I took the liberty to edit the PR description for posterity to reflect the incompatibility with |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We want our users to step out from EDK2-based CSM firmwares to SeaBIOS as these firmwares were removed from upstream (see https://bugzilla.tianocore.org/show_bug.cgi?id=4588).
@tomponline suggested to extend firmware lookup algorithm to handle multiple paths specified in the
LXD_OVMF_PATH.Do some renaming
Forbid
security.csmfor arches exceptx86_64Forbid
boot.debug_edk2whensecurity.csm=trueForbid
security.securebootwhensecurity.csm=trueFixes ##12730