QEMU EFI INSTALL
QEMU EFI CODE

# qemu-kvm -L /usr/share/qemu-ovmf/bios -hda fat:/hda-contents/ Please copy shim-opensuse.efi and shim.efi(signed by Microsoft) to hda-contents then launch kvm with OVMF:

QEMU EFI INSTALL

If you want test the openSUSE signed shim, please install shim package, it includes the following files: Then enroll them by this procedure: enroll PK, KEK and db *UEFI-SIGN*.der is certificate for enroll to db database in UEFI BIOS.*UEFI-CA*.der is certificate for enroll to KEK database in UEFI BIOS.

# openssl x509 -inform PEM -in openSUSE-UEFI-SIGN-Certificate.crt -outform DER -out r # openssl x509 -inform PEM -in openSUSE-UEFI-CA-Certificate.crt -outform DER -out r Note that in the Installation Setting's Booting section you may have to set the option manually to 'Enable Secure Boot:true'ДЇor openSUSE CA, the public space for grab it is from shim RPM source on OBS: Now like described before in the section #Import PK/KEK enroll the PK-Key: 'PK.der' (you can use the KEK-key too if you don't want to create your own PK, but it is better to create your own),the KEK-Key: 'MicCorKEKCA2011_.crt' and the DB-Key: 'MicCorUEFCA2011_.crt'. # qemu-system-x86_64 -L /usr/share/qemu-ovmf/bios -hda -cdrom -hdb fat:~/hda-contents/ Now get yourself an openSUSE image of your choice, prepare a virtual harddisk with qemu-img and start again qemu: In order to get openSUSE running the DB.crt and KEK.crt keys will have to be replaced by the public Microsoft keys:

QEMU EFI CODE

Per information from Insyde, the code path of this option is fully the same with 'enabled secure boot', just it ignore the result of secure boot check. Press Enter key to remove the on 'Attempt Secure Boot'Д«ack to shell prompt to run HelloWorld.efi, you will find it available, now. Then you can try the option for temporary disable secure boot:Дevice Manager > Secure Boot Configuration > Attempt Secure Boot # qemu-system-x86_64 -L /usr/share/qemu-ovmf/bios -hda fat:hda-contents/ДЄfter boot progress finished, will see UEFI shell prompt show up like following: Run qemu-system-x86_64 to launch virtual machine: usr/share/qemu-ovmf/bios/vgabios-cirrus.bin The BIOS image folder of OVMF rpm is in /usr/share/qemu-ovmf/biosВ : # openssl x509 -in DB.crt -outform DER -out DB.der # openssl x509 -in PK.crt -outform DER -out PK.der # openssl x509 -in KEK.crt -outform DER -out KEK.der ДB.crt HelloWorld.efi HelloWorld-signed.efi KEK.crt LockDown.efi LockDown-signed.efi PK.crtДue to openSUSE certificate is PEM format, we need transfer to DER format for enroll to UEFI BIOS: # cp ~/efitools/KEK.crt ~/efitools/DB.crt ~/efitools/PK.crt ~/efitools/*.efi. So, we should prepare a hda contents folder then feed it to qemu-kvm later:Д¬opy PK.crt, KEK.crt and *.efi file from efitools folder to ~/hda-contents: We will need to import PK/KEK/DB to UEFI BIOS for secure boot testing, and, also need to run some *.efi executable to verify security. HelloWorld.efi HelloWorld-signed.efi LockDown.efi LockDown-signed.efi Please make sure generated out the following. # zypper in gnu-efi help2man sbsigntools gcc make libopenssl-devel # git clone git:///pub/scm/linux/kernel/git/jejb/efitools.gitД«efore compiling it, please install the standard dev environment gnu-efi, help2man and sbsigntools as well as libopenssl-devel libraries used by efitools and finally of course you also need gcc and make: James's git have a efitools set for test UEFI secure boot. OVMF is a UEFI BIOS image build from EDK2 used by qemu-kvm, let's install: Please remember need use 64-bits openSUSE because Jeremy's efi signing tools only really do x86_64 binaries. Yes! Just use a openSUSE 12.2 DVD to install a machine. Prepare Environment Prepare a openSUSE 12.2 machine

Qemu efi