OvmfPkg/EmuVariableFvbRuntimeDxe: strip trailing whitespace

[mirror_edk2.git] / OvmfPkg / README

diff --git a/OvmfPkg/README b/OvmfPkg/README
index 147e6e0ebf1403f68f3cf3cc0872fa28dfb446f1..304e69fbe5456d57ae1e0d4bf95800b3a91b3793 100644 (file)
--- a/OvmfPkg/README
+++ b/OvmfPkg/README
@@ -118,6 +118,58 @@ $ OvmfPkg/build.sh -a X64 qemu -cdrom /path/to/disk-image.iso
 To build a 32-bit OVMF without debug messages using GCC 4.5:\r
 $ OvmfPkg/build.sh -a IA32 -b RELEASE -t GCC45\r
 \r
+=== SMM support ===\r
+\r
+Requirements:\r
+* SMM support requires QEMU 2.5.\r
+* The minimum required QEMU machine type is "pc-q35-2.5".\r
+* SMM with KVM requires Linux 4.4 (host).\r
+\r
+OVMF is capable of utilizing SMM if the underlying QEMU or KVM hypervisor\r
+emulates SMM. SMM is put to use in the S3 suspend and resume infrastructure,\r
+and in the UEFI variable driver stack. The purpose is (virtual) hardware\r
+separation between the runtime guest OS and the firmware (OVMF), with the\r
+intent to make Secure Boot actually secure, by preventing the runtime guest OS\r
+from tampering with the variable store and S3 areas.\r
+\r
+For SMM support, OVMF must be built with the "-D SMM_REQUIRE" option. The\r
+resultant firmware binary will check if QEMU actually provides SMM emulation;\r
+if it doesn't, then OVMF will log an error and trigger an assertion failure\r
+during boot (even in RELEASE builds). Both the naming of the flag (SMM_REQUIRE,\r
+instead of SMM_ENABLE), and this behavior are consistent with the goal\r
+described above: this is supposed to be a security feature, and fallbacks are\r
+not allowed. Similarly, a pflash-backed variable store is a requirement.\r
+\r
+QEMU should be started with the options listed below (in addition to any other\r
+guest-specific flags). The command line should be gradually composed from the\r
+hints below. '\' is used to extend the command line to multiple lines, and '^'\r
+can be used on Windows.\r
+\r
+* QEMU binary and options specific to 32-bit guests:\r
+\r
+  $ qemu-system-i386 -cpu coreduo,-nx \\r
+\r
+  or\r
+\r
+  $ qemu-system-x86_64 -cpu <MODEL>,-lm,-nx \\r
+\r
+* QEMU binary for running 64-bit guests (no particular options):\r
+\r
+  $ qemu-system-x86_64 \\r
+\r
+* Flags common to all SMM scenarios (only the Q35 machine type is supported):\r
+\r
+  -machine q35,smm=on,accel=(tcg|kvm) \\r
+  -m ... \\r
+  -smp ... \\r
+  -global driver=cfi.pflash01,property=secure,value=on \\r
+  -drive if=pflash,format=raw,unit=0,file=OVMF_CODE.fd,readonly=on \\r
+  -drive if=pflash,format=raw,unit=1,file=copy_of_OVMF_VARS.fd \\r
+\r
+* In order to disable S3, add:\r
+\r
+  -global ICH9-LPC.disable_s3=1 \\r
+\r
 === Network Support ===\r
 \r
 OVMF provides a UEFI network stack by default. Its lowest level driver is the\r
@@ -179,8 +231,8 @@ longer.)
     - Install the drivers into a directory called Intel3.5 in your WORKSPACE.\r
 \r
   - Include the driver in OVMF during the build:\r
-    - Add "-D E1000_ENABLE -D FD_SIZE_2MB" to your build command,\r
-    - For example: "build -D E1000_ENABLE -D FD_SIZE_2MB".\r
+    - Add "-D E1000_ENABLE" to your build command,\r
+    - For example: "build -D E1000_ENABLE".\r
 \r
 * When a matching iPXE driver is configured for a NIC as described above, it\r
   takes priority over other drivers that could possibly drive the card too:\r
@@ -238,11 +290,11 @@ If you must use UNIXGCC, then you can override the build options for
 particular libraries and modules in the .dsc to re-enable debugging\r
 selectively. For example:\r
   [Components]\r
-  OvmfPkg/Library/PlatformBdsLib/PlatformBdsLib.inf {\r
+  OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf {\r
     <BuildOptions>\r
       GCC:*_*_*_CC_FLAGS             = -UMDEPKG_NDEBUG\r
   }\r
-  IntelFrameworkModulePkg/Universal/BdsDxe/BdsDxe.inf {\r
+  MdeModulePkg/Universal/BdsDxe/BdsDxe.inf {\r
     <BuildOptions>\r
       GCC:*_*_*_CC_FLAGS             = -UMDEPKG_NDEBUG\r
   }\r