Skip to content

ovmf: pin to edk2-stable202502 to fix RTMR0 mismatch on CVMs with memory > 2G #63

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kvinwang merged 2 commits into from
May 26, 2026
Merged

ovmf: pin to edk2-stable202502 to fix RTMR0 mismatch on CVMs with memory > 2G #63

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4693c29
ovmf: pin to edk2-stable202502 and stamp ovmf_variant into metadata
kvinwang May 26, 2026
716729c
mkimage: drop tail -n1 from OVMF_VARIANT lookup
kvinwang May 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion meta-dstack/recipes-core/dstack-ovmf/dstack-ovmf/0003-Debug-prefix-map.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ index cca699c4a8..e758bd8b4e 100755
-DEFINE GCC_PP_FLAGS = -E -x assembler-with-cpp -include AutoGen.h
+DEFINE GCC_ASM_FLAGS = -c -x assembler -imacros AutoGen.h ENV(GCC_PREFIX_MAP)
+DEFINE GCC_PP_FLAGS = -E -x assembler-with-cpp -include AutoGen.h ENV(GCC_PREFIX_MAP)
DEFINE GCC_VFRPP_FLAGS = -x c -E -DVFRCOMPILE --include $(MODULE_NAME)StrDefs.h
DEFINE GCC_VFRPP_FLAGS = -x c -E -P -DVFRCOMPILE --include $(MODULE_NAME)StrDefs.h
DEFINE GCC_ASLPP_FLAGS = -x c -E -include AutoGen.h
DEFINE GCC_ASLCC_FLAGS = -x c
@@ -1095,7 +1095,7 @@ DEFINE GCC5_LOONGARCH64_PP_FLAGS = -mabi=lp64d -march=loongarch64 DEF(
Expand Down
25 changes: 23 additions & 2 deletions meta-dstack/recipes-core/dstack-ovmf/dstack-ovmf_git.bb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,31 @@ SRC_URI = "gitsm://github.com/tianocore/edk2.git;branch=master;protocol=https \
file://0005-Declare-ProcessLibraryConstructorList.patch \
"

PV = "edk2-stable202505"
SRCREV = "6951dfe7d59d144a3a980bd7eda699db2d8554ac"
# Pinned to edk2-stable202502 (Feb 2025) instead of the latest stable202505.
# Between these two tags, six commits land in OvmfPkg / MdeModulePkg that
# rewrite the boot-time RTMR[0] event chain:
# fb56dc78ef QemuFwCfgLib: cache + measurement (adds fw_cfg BootMenu, bootorder)
# 45a56d7505 OvmfPkg: add BootManagerMenuApp to dependencies
# 9d9e3a2ba8 OvmfPkg: use BootManagerMenuApp as BootManagerMenu (Boot0000 hash changes)
# d433b4c8e4 PlatformBootManagerLib: register UiApp as optional boot option (new Boot0001)
# dd5cce3e53 PlatformBootManagerCommonLib: set UiApp as an optional boot option
# cd76265f1a OvmfPkg: Enable Smbios measurement (adds EV_EFI_HANDOFF_TABLES whose
# digest is sha384(filtered QEMU SMBIOS table) — varies with -m / -cpu /
# -smbios type=1 and so cannot be precomputed from VmConfig alone)
# stable202502 contains none of them and so produces the same 13-event RTMR[0]
# layout as the legacy 3a3b12cb snapshot dstack used pre-upgrade, while still
# carrying 5 months of post-Sep-2024 EDK2 fixes (incl. CVEs).
PV = "edk2-stable202502"
SRCREV = "fbe0805b2091393406952e84724188f8c1941837"
UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>edk2-stable.*)"

# Tag identifying the OVMF boot-time RTMR[0] event layout this build produces.
# Consumed by mkimage.sh to stamp `ovmf_variant` into the image metadata.json so
# verifiers can pick the matching dstack-mr code path without parsing PV.
# Keep this in sync with the OvmfVariant enum in dstack/dstack-types when
# bumping PV.
OVMF_VARIANT = "pre202505"

CVE_PRODUCT = "edk2"
CVE_VERSION = "${@d.getVar('PV').split('-')[1]}"

Expand Down
15 changes: 13 additions & 2 deletions mkimage.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,17 @@ $Q cp $OVMF_FIRMWARE ${OUTPUT_DIR}/
$Q cp $ROOTFS_IMAGE ${OUTPUT_DIR}/rootfs.img.verity

GIT_REVISION=$(git rev-parse HEAD 2>/dev/null || echo "<unknown>")
echo "Generating metadata.json to ${OUTPUT_DIR}/metadata.json"

# Lift the OVMF variant tag straight out of the dstack-ovmf recipe so verifiers
# know which RTMR[0] event layout to expect. Required: the recipe must declare
# OVMF_VARIANT alongside PV.
OVMF_VARIANT=$(bitbake-getvar --value OVMF_VARIANT -r dstack-ovmf)
if [ -z "$OVMF_VARIANT" ]; then
echo "Error: dstack-ovmf recipe is missing OVMF_VARIANT" >&2
exit 1
fi
Comment thread
kvinwang marked this conversation as resolved.

echo "Generating metadata.json to ${OUTPUT_DIR}/metadata.json (ovmf_variant=$OVMF_VARIANT)"

KARG0="console=ttyS0 init=/init panic=1 net.ifnames=0 biosdevname=0"
KARG1="mce=off oops=panic pci=noearly pci=nommconf random.trust_cpu=y random.trust_bootloader=n tsc=reliable no-kvmclock"
Expand All @@ -81,7 +91,8 @@ cat <<EOF > ${OUTPUT_DIR}/metadata.json
"version": "$DSTACK_VERSION",
"git_revision": "$GIT_REVISION",
"shared_ro": true,
"is_dev": ${IS_DEV}
"is_dev": ${IS_DEV},
"ovmf_variant": "$OVMF_VARIANT"
}
EOF

Expand Down