Role of OVMF in QEMU and KVM UEFI Virtualization

Open Virtual Machine Firmware (OVMF) is an open-source project that brings Unified Extensible Firmware Interface (UEFI) support to virtual machines running on QEMU and KVM. Traditionally, virtual machines relied on legacy BIOS implementations like SeaBIOS, which limited boot configurations and security capabilities. This article explains what OVMF is, how it interfaces with QEMU and KVM, and why it is an essential component for running modern operating systems, configuring Secure Boot, and implementing advanced virtualization setups like GPU passthrough.

What Is OVMF?

OVMF is a sub-project of TianoCore's EDK II (EFI Development Kit II), which is the reference implementation of the UEFI specifications. While standard EDK II targets physical motherboards and hardware platforms, OVMF specifically targets virtual hardware architectures emulated by QEMU, such as the i440fx and q35 chipsets. It packages the drivers, initialization code, and runtime services necessary to boot virtual machines via UEFI instead of traditional legacy BIOS.

Replacing Legacy BIOS in QEMU

Historically, QEMU initializes guest environments using SeaBIOS. SeaBIOS boots using the legacy Master Boot Record (MBR) scheme, operates in 16-bit real mode during initialization, and lacks modern pre-boot features.

OVMF replaces SeaBIOS as the firmware binary loaded at guest boot. By doing so, it introduces:

  • GPT Partitioning Support: Native handling of the GUID Partition Table (GPT), enabling guest disks larger than 2TB.
  • 64-bit Initialization: Faster boot paths that operate directly in 64-bit mode, bypassing the archaic transitions between real mode and protected mode.
  • NVRAM Emulation: Persistent non-volatile memory storage for boot variables, boot priorities, and digital certificates.

How OVMF Works with QEMU and KVM

When QEMU launches a virtual machine, it maps system firmware into the guest's memory address space. OVMF is typically deployed using a two-file architecture to preserve system integrity across multiple virtual machines:

  1. OVMF_CODE.fd: The read-only firmware binary containing the executable UEFI code. This file is shared across multiple VMs and never written to by the guest.
  2. OVMF_VARS.fd: An empty NVRAM template file that QEMU copies on a per-VM basis. It stores guest-specific UEFI variables, such as boot order entries created by OS installers and Secure Boot keys.

KVM provides the hardware-accelerated CPU and memory execution, allowing the virtual CPU to execute OVMF routines with near-native performance. OVMF initializes virtualized devices presented by QEMU (such as VirtIO block devices, VirtIO network interfaces, and emulated graphics cards) using standard UEFI drivers.

Essential Roles and Use Cases

OVMF is a prerequisite for several core virtualization scenarios:

  • Modern Operating System Requirements: Operating systems like Windows 11 mandate UEFI firmware. OVMF fulfills this base system requirement alongside emulated TPM 2.0 (via swtpm).
  • Secure Boot Implementation: Specific OVMF builds include Microsoft-authenticated digital certificates embedded in the code. This enables UEFI Secure Boot inside the guest, verifying bootloader integrity and guarding against bootkits.
  • PCI and GPU Passthrough (VFIO): When passing physical graphics cards directly to a guest VM, modern GPUs typically require a UEFI Graphics Output Protocol (GOP) driver to initialize video during the boot process. OVMF natively supports GOP, preventing display initialization failures common with legacy virtual BIOS.