Run Secure boot (UKI) on QEMU arm64ļƒ

We need TPM to run the UKI secure boot images on QEMU arm64. QEMU can provide a TPM implementation via Software TPM

On Debian/Ubuntu swtpm can be installed and run as follows:

sudo apt install swtpm swtpm-tools

mkdir /tmp/mytpm1

swtpm socket --tpmstate dir=/tmp/mytpm1 \
    --ctrl type=unixio,path=/tmp/mytpm1/swtpm-sock \
    --log level=20 --tpm2 -t -d

Now run the qemu-system-aarch64 using following files from deployed image files.

  • bios: - flash.bin-qemu

    • This file is UEFI Secure Boot firmware image file created by lsqemuarm64-uki-secureboot build

  • file: - lightspeed-uki-lsqemuarm64-uki-secureboot.rootfs.wic

    • This is a wic image created by lsqemuarm64-uki-secureboot build.

qemu-system-aarch64 -m 2048 -smp 2 -nographic -cpu cortex-a57 \
    -bios flash.bin-qemu -machine virt,secure=on \
    -drive id=os,if=none,file=lightspeed-uki-lsqemuarm64-uki-secureboot.rootfs.wic \
    -device virtio-blk-device,drive=os \
    -chardev socket,id=chrtpm,path=/tmp/mytpm1/swtpm-sock \
    -tpmdev emulator,id=tpm0,chardev=chrtpm \
    -device tpm-tis-device,tpmdev=tpm0

Following one-time efidebug commands can be issues by interrupting the u-boot.

=> efidebug boot add -b 1 Lightspeed virtio 0:1 efi/boot/bootaa64.efi
=> efidebug boot order 1
=> bootefi bootmgr