setting up a sabotage linux kvm guest with kernel efi stub

efi | syslinux-efi | kernel efi stub

kvm guest | with efi

assuming the kvm host is up and running already

warning // lessons learnedwarning // lessons learned

https://station.eciton.net/booting-a-full-system-with-ovmf.html

the efibootmgr -u flag doesn’t work with qemu+ovmf (as noted at the very bottom of the that page)

todo - but it might be just fine on bare-metal

requirementsrequirements

you need GPT partition table and the EFI firmware to be loaded into the kvm guest skeleton

# debian/ubuntu
apt install ovmf fdisk gdisk

ls -lkF /sbin/cfdisk
ls -lkF /sbin/gdisk
ls -lkF /usr/share/OVMF/OVMF_CODE.fd

prepare vdiskprepare vdisk

same as guest-sabotage but this differs

guest=sabotage-efi

manual partitioning (GPT table required for once)

cfdisk $device

gpt

new 23G     linux filesystem (default)
new 1G      linux swap
new ~1G     efi system (ESP)

write

prepare systemprepare system

same as guest-sabotage but this differs

create filesystems and swap space

mkfs.vfat ${device}p3
mkdir -p lala/boot/efi/
mount -t vfat ${device}p3 lala/boot/efi/

vi lala/etc/fstab

/dev/vda3         /boot/efi     vfat      defaults      0      0

linux boot with efi stublinux boot with efi stub

same as guest-sabotage but this differs

efi binary instead of boot code – here directly the linux kernel

grep CONFIG_EFI_STUB 6.1.49.domU.config

mv -i 6.1.49.domU.config lala/boot/efi/vmlinuz.config
mv -i 6.1.49.domU.vmlinuz lala/boot/efi/vmlinuz

efi setup instead of boot blocks

gdisk -l $device
efibootmgr --create --disk $device --part 3 --loader \\vmlinuz --label EFISTUB \
    -u "root=/dev/vda1 ro console=tty1 console=ttyS0,115200n8 mitigations=off"

efibootmgr -v --disk $device

ready to goready to go

same as guest-sabotage but this differs

  <os>
    <loader readonly='yes' type='pflash'>/usr/share/OVMF/OVMF_CODE.fd</loader>
    <type arch='x86_64' machine='q35'>hvm</type>
    <boot dev='hd'/>
  </os>

  <features>
    <acpi/>
  </features>
  <pm>
    <suspend-to-disk enabled='yes'/>
    <suspend-to-mem enabled='yes'/>
  </pm>

need to load the efi binary manually on qemu+ovmf (no auto-boot there)

fs0:
vmlinuz root=/dev/vda1 ro console=tty1 console=ttyS0,115200n8 mitigations=off

resourcesresources

https://station.eciton.net/booting-a-full-system-with-ovmf.html

https://mricher.fr/post/boot-from-an-efi-shell/