1SUMMARY = "OVMF - UEFI firmware for Qemu and KVM" 2DESCRIPTION = "OVMF is an EDK II based project to enable UEFI support for \ 3Virtual Machines. OVMF contains sample UEFI firmware for QEMU and KVM" 4HOMEPAGE = "https://github.com/tianocore/tianocore.github.io/wiki/OVMF" 5LICENSE = "BSD-2-Clause-Patent" 6LICENSE:class-target = "${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'BSD-2-Clause-Patent & OpenSSL', 'BSD-2-Clause-Patent', d)}" 7LIC_FILES_CHKSUM = "file://OvmfPkg/License.txt;md5=06357ddc23f46577c2aeaeaf7b776d65" 8 9# Enabling Secure Boot adds a dependency on OpenSSL and implies 10# compiling OVMF twice, so it is disabled by default. Distros 11# may change that default. 12PACKAGECONFIG ??= "" 13PACKAGECONFIG += "${@bb.utils.contains('MACHINE_FEATURES', 'tpm', 'tpm', '', d)}" 14PACKAGECONFIG += "${@bb.utils.contains('MACHINE_FEATURES', 'tpm2', 'tpm', '', d)}" 15PACKAGECONFIG[secureboot] = ",,," 16PACKAGECONFIG[tpm] = "-D TPM_ENABLE=TRUE,-D TPM_ENABLE=FALSE,," 17 18# GCC12 trips on it 19#see https://src.fedoraproject.org/rpms/edk2/blob/rawhide/f/0032-Basetools-turn-off-gcc12-warning.patch 20BUILD_CFLAGS += "-Wno-error=stringop-overflow" 21 22SRC_URI = "gitsm://github.com/tianocore/edk2.git;branch=master;protocol=https \ 23 file://0001-ovmf-update-path-to-native-BaseTools.patch \ 24 file://0002-BaseTools-makefile-adjust-to-build-in-under-bitbake.patch \ 25 file://0003-ovmf-Update-to-latest.patch \ 26 file://0005-debug-prefix-map.patch \ 27 file://0006-reproducible.patch \ 28 " 29 30PV = "edk2-stable202205" 31SRCREV = "16779ede2d366bfc6b702e817356ccf43425bcc8" 32UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>edk2-stable.*)" 33 34inherit deploy 35 36PARALLEL_MAKE = "" 37 38S = "${WORKDIR}/git" 39 40DEPENDS = "nasm-native acpica-native ovmf-native util-linux-native" 41 42EDK_TOOLS_DIR="edk2_basetools" 43 44# OVMF has trouble building with the default optimization of -O2. 45BUILD_OPTIMIZATION="-pipe" 46 47# OVMF supports IA only, although it could conceivably support ARM someday. 48COMPATIBLE_HOST:class-target='(i.86|x86_64).*' 49 50# Additional build flags for OVMF with Secure Boot. 51# Fedora also uses "-D SMM_REQUIRE -D EXCLUDE_SHELL_FROM_FD". 52OVMF_SECURE_BOOT_EXTRA_FLAGS ??= "" 53OVMF_SECURE_BOOT_FLAGS = "-DSECURE_BOOT_ENABLE=TRUE ${OVMF_SECURE_BOOT_EXTRA_FLAGS}" 54 55export PYTHON_COMMAND = "${HOSTTOOLS_DIR}/python3" 56 57do_patch[postfuncs] += "fix_basetools_location" 58fix_basetools_location () { 59} 60fix_basetools_location:class-target() { 61 # Replaces the fake path inserted by 0002-ovmf-update-path-to-native-BaseTools.patch. 62 # Necessary for finding the actual BaseTools from ovmf-native. 63 sed -i -e 's#BBAKE_EDK_TOOLS_PATH#${STAGING_BINDIR_NATIVE}/${EDK_TOOLS_DIR}#' ${S}/OvmfPkg/build.sh 64} 65 66do_patch[postfuncs] += "fix_iasl" 67fix_iasl() { 68} 69fix_iasl:class-native() { 70 # iasl is not installed under /usr/bin when building with OE. 71 sed -i -e 's#/usr/bin/iasl#${STAGING_BINDIR_NATIVE}/iasl#' ${S}/BaseTools/Conf/tools_def.template 72} 73 74# Inject CC and friends into the build. LINKER already is in GNUmakefile. 75# Must be idempotent and thus remove old assignments that were inserted 76# earlier. 77do_patch[postfuncs] += "fix_toolchain" 78fix_toolchain() { 79 sed -i \ 80 -e '/^\(CC\|CXX\|AS\|AR\|LD\|LINKER\) =/d' \ 81 -e '/^APPLICATION/a CC = ${CC}\nCXX = ${CXX}\nAS = ${AS}\nAR = ${AR}\nLD = ${LD}\nLINKER = $(CC)' \ 82 ${S}/BaseTools/Source/C/Makefiles/app.makefile 83 sed -i \ 84 -e '/^\(CC\|CXX\|AS\|AR\|LD\)/d' \ 85 -e '/^VFR_CPPFLAGS/a CC = ${CC}\nCXX = ${CXX}\nAS = ${AS}\nAR = ${AR}\nLD = ${LD}' \ 86 ${S}/BaseTools/Source/C/VfrCompile/GNUmakefile 87} 88fix_toolchain:append:class-native() { 89 # This tools_def.template is going to be used by the target ovmf and 90 # defines which compilers to use. For the GCC toolchain definitions, 91 # that will be ${HOST_PREFIX}gcc. However, "make" doesn't need that 92 # prefix. 93 # 94 # Injecting ENV(HOST_PREFIX) matches exporting that value as env 95 # variable in do_compile:class-target. 96 sed -i \ 97 -e 's#\(ENV\|DEF\)(GCC.*_PREFIX)#ENV(HOST_PREFIX)#' \ 98 -e 's#ENV(HOST_PREFIX)make#make#' \ 99 ${S}/BaseTools/Conf/tools_def.template 100 sed -i \ 101 -e '/^\(LFLAGS\|CFLAGS\) +=/d' \ 102 -e '/^LINKER/a LFLAGS += ${BUILD_LDFLAGS}\nCFLAGS += ${BUILD_CFLAGS}' \ 103 ${S}/BaseTools/Source/C/Makefiles/app.makefile \ 104 ${S}/BaseTools/Source/C/VfrCompile/GNUmakefile 105 # Linking with gold fails: 106 # internal error in do_layout, at ../../gold/object.cc:1821 107 # make: *** [.../OUTPUT/Facs.acpi] Error 1 108 # We intentionally hard-code the use of ld.bfd regardless of DISTRO_FEATURES 109 # to make ovmf-native reusable across distros. 110 sed -i \ 111 -e 's#^\(DEFINE GCC.*DLINK.*FLAGS *=\)#\1 -fuse-ld=bfd#' \ 112 -e 's#-flto#-fno-lto#g' \ 113 -e 's#-DUSING_LTO##g' \ 114 ${S}/BaseTools/Conf/tools_def.template 115} 116 117# We disable lto above since the results are not reproducible and make it hard to compare 118# binary build aretfacts to debug reproducibility problems. 119# Surprisingly, if you disable lto, you see compiler warnings which are fatal. We therefore 120# have to hack warnings overrides into GCC_PREFIX_MAP to allow it to build. 121 122# We want to pass ${DEBUG_PREFIX_MAP} to gcc commands and also pass in 123# --debug-prefix-map to nasm (we carry a patch to nasm for this). The 124# tools definitions are built by ovmf-native so we need to pass this in 125# at target build time when we know the right values. 126export NASM_PREFIX_MAP = "--debug-prefix-map=${WORKDIR}=/usr/src/debug/ovmf/${EXTENDPE}${PV}-${PR}" 127export GCC_PREFIX_MAP = "${DEBUG_PREFIX_MAP} -Wno-stringop-overflow -Wno-maybe-uninitialized" 128 129GCC_VER="$(${CC} -v 2>&1 | tail -n1 | awk '{print $3}')" 130 131fixup_target_tools() { 132 case ${1} in 133 4.4.*) 134 FIXED_GCCVER=GCC44 135 ;; 136 4.5.*) 137 FIXED_GCCVER=GCC45 138 ;; 139 4.6.*) 140 FIXED_GCCVER=GCC46 141 ;; 142 4.7.*) 143 FIXED_GCCVER=GCC47 144 ;; 145 4.8.*) 146 FIXED_GCCVER=GCC48 147 ;; 148 4.9.*) 149 FIXED_GCCVER=GCC49 150 ;; 151 *) 152 FIXED_GCCVER=GCC5 153 ;; 154 esac 155 echo ${FIXED_GCCVER} 156} 157 158do_compile:class-native() { 159 oe_runmake -C ${S}/BaseTools 160} 161 162do_compile:class-target() { 163 export LFLAGS="${LDFLAGS}" 164 PARALLEL_JOBS="${@oe.utils.parallel_make_argument(d, '-n %d')}" 165 OVMF_ARCH="X64" 166 if [ "${TARGET_ARCH}" != "x86_64" ] ; then 167 OVMF_ARCH="IA32" 168 fi 169 170 # The build for the target uses BaseTools/Conf/tools_def.template 171 # from ovmf-native to find the compiler, which depends on 172 # exporting HOST_PREFIX. 173 export HOST_PREFIX="${HOST_PREFIX}" 174 175 # BaseTools/Conf gets copied to Conf, but only if that does not 176 # exist yet. To ensure that an updated template gets used during 177 # incremental builds, we need to remove the copy before we start. 178 rm -f `ls ${S}/Conf/*.txt | grep -v ReadMe.txt` 179 180 # ${WORKDIR}/ovmf is a well-known location where do_install and 181 # do_deploy will be able to find the files. 182 rm -rf ${WORKDIR}/ovmf 183 mkdir ${WORKDIR}/ovmf 184 OVMF_DIR_SUFFIX="X64" 185 if [ "${TARGET_ARCH}" != "x86_64" ] ; then 186 OVMF_DIR_SUFFIX="Ia32" # Note the different capitalization 187 fi 188 FIXED_GCCVER=$(fixup_target_tools ${GCC_VER}) 189 bbnote FIXED_GCCVER is ${FIXED_GCCVER} 190 build_dir="${S}/Build/Ovmf$OVMF_DIR_SUFFIX/RELEASE_${FIXED_GCCVER}" 191 192 bbnote "Building without Secure Boot." 193 rm -rf ${S}/Build/Ovmf$OVMF_DIR_SUFFIX 194 ${S}/OvmfPkg/build.sh $PARALLEL_JOBS -a $OVMF_ARCH -b RELEASE -t ${FIXED_GCCVER} ${PACKAGECONFIG_CONFARGS} 195 ln ${build_dir}/FV/OVMF.fd ${WORKDIR}/ovmf/ovmf.fd 196 ln ${build_dir}/FV/OVMF_CODE.fd ${WORKDIR}/ovmf/ovmf.code.fd 197 ln ${build_dir}/FV/OVMF_VARS.fd ${WORKDIR}/ovmf/ovmf.vars.fd 198 ln ${build_dir}/${OVMF_ARCH}/Shell.efi ${WORKDIR}/ovmf/ 199 200 if ${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'true', 'false', d)}; then 201 # Repeat build with the Secure Boot flags. 202 bbnote "Building with Secure Boot." 203 rm -rf ${S}/Build/Ovmf$OVMF_DIR_SUFFIX 204 ${S}/OvmfPkg/build.sh $PARALLEL_JOBS -a $OVMF_ARCH -b RELEASE -t ${FIXED_GCCVER} ${PACKAGECONFIG_CONFARGS} ${OVMF_SECURE_BOOT_FLAGS} 205 ln ${build_dir}/FV/OVMF.fd ${WORKDIR}/ovmf/ovmf.secboot.fd 206 ln ${build_dir}/FV/OVMF_CODE.fd ${WORKDIR}/ovmf/ovmf.secboot.code.fd 207 ln ${build_dir}/${OVMF_ARCH}/EnrollDefaultKeys.efi ${WORKDIR}/ovmf/ 208 fi 209} 210 211do_install:class-native() { 212 install -d ${D}/${bindir}/edk2_basetools 213 cp -r ${S}/BaseTools ${D}/${bindir}/${EDK_TOOLS_DIR} 214} 215 216do_install:class-target() { 217 # Content for UEFI shell iso. We install the EFI shell as 218 # bootx64/ia32.efi because then it can be started even when the 219 # firmware itself does not contain it. 220 install -d ${D}/efi/boot 221 install ${WORKDIR}/ovmf/Shell.efi ${D}/efi/boot/boot${@ "ia32" if "${TARGET_ARCH}" != "x86_64" else "x64"}.efi 222 if ${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'true', 'false', d)}; then 223 install ${WORKDIR}/ovmf/EnrollDefaultKeys.efi ${D} 224 fi 225} 226 227# This always gets packaged because ovmf-shell-image depends on it. 228# This allows testing that recipe in all configurations because it 229# can always be part of a world build. 230# 231# However, EnrollDefaultKeys.efi is only included when Secure Boot is enabled. 232PACKAGES =+ "ovmf-shell-efi" 233FILES:ovmf-shell-efi = " \ 234 EnrollDefaultKeys.efi \ 235 efi/ \ 236" 237 238DEPLOYDEP = "" 239DEPLOYDEP:class-target = "qemu-system-native:do_populate_sysroot" 240DEPLOYDEP:class-target += " ${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'openssl-native:do_populate_sysroot', '', d)}" 241do_deploy[depends] += "${DEPLOYDEP}" 242 243do_deploy() { 244} 245do_deploy:class-target() { 246 # For use with "runqemu ovmf". 247 for i in \ 248 ovmf \ 249 ovmf.code \ 250 ovmf.vars \ 251 ${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'ovmf.secboot ovmf.secboot.code', '', d)} \ 252 ; do 253 qemu-img convert -f raw -O qcow2 ${WORKDIR}/ovmf/$i.fd ${DEPLOYDIR}/$i.qcow2 254 done 255 256 if ${@bb.utils.contains('PACKAGECONFIG', 'secureboot', 'true', 'false', d)}; then 257 # Create a test Platform Key and first Key Exchange Key to use with EnrollDefaultKeys 258 openssl req -new -x509 -newkey rsa:2048 -keyout ${DEPLOYDIR}/OvmfPkKek1.key \ 259 -out ${DEPLOYDIR}/OvmfPkKek1.crt -nodes -days 20 -subj "/CN=OVMFSecBootTest" 260 openssl x509 -in ${DEPLOYDIR}/OvmfPkKek1.crt -out ${DEPLOYDIR}/OvmfPkKek1.pem -outform PEM 261 fi 262} 263addtask do_deploy after do_compile before do_build 264 265BBCLASSEXTEND = "native" 266TOOLCHAIN = "gcc" 267