dstack-mr: derive BootOrder / Boot0000 / Boot0001 digests from first principles

The Stable202505 RTMR[0] code used to carry six hardcoded sha384 digests
captured from a single 0.5.10 CVM. For the three EV_EFI_VARIABLE_BOOT2
events that's needlessly opaque — the TCG digest is taken over the
on-the-wire variable data, which is fully derivable from a handful of
OVMF-internal constants (FV/file GUIDs, descriptions, attributes).

New uefi_var module builds:
  * BootOrder    via boot_order_bytes(&[u16])
  * Boot####     via boot_option_bytes(attrs, desc, &[device_path_node])

Stable202505 arm now hashes synthesised bytes for those three events;
GUIDs/descriptions/attributes for OVMF's BootManagerMenuApp and "EFI
Firmware Setup" entries are at the top of tdvf.rs with a comment naming
the upstream source.

The remaining two digests (bootorder fw_cfg + EV_EFI_VARIABLE_AUTHORITY)
stay captured because their payloads depend on QEMU's device topology
and OVMF-internal logic that isn't worth shadowing here. Comments now
spell out what each measures, the dstack/QEMU config they're constants
for, and the failure mode if the config changes.

Verified: synth digests match the captured values; RTMR[0] still equals
the running 0.5.10 CVM's quote exactly.

Author: kvinwang

dstack-mr/src/lib.rs

@@ -19,6 +19,7 @@ mod kernel;
 mod machine;
 mod num;
 mod tdvf;
+mod uefi_var;
 mod util;
 
 /// Pick the OVMF variant for a given dstack OS version string ("MAJOR.MINOR.PATCH").

dstack-mr/src/tdvf.rs

@@ -9,11 +9,35 @@ use sha2::{Digest, Sha384};
 
 use crate::acpi::Tables;
 use crate::num::read_le;
+use crate::uefi_var::{
+    boot_option_bytes, boot_order_bytes, fv_file_node, fv_node, END_OF_DEVICE_PATH,
+};
 use crate::{measure_log, measure_sha384, utf16_encode, Machine, OvmfVariant, RtmrLog};
 
 const PAGE_SIZE: u64 = 0x1000;
 const MR_EXTEND_GRANULARITY: usize = 0x100;
 
+// OVMF firmware-volume identifiers used by edk2-stable202505. These are baked
+// into the OVMF binary at build time; if the firmware is regenerated against a
+// different EDK2 source these constants may need refreshing.
+//
+// Each GUID is stored in the on-the-wire little-endian byte form OVMF puts in
+// the EFI_DEVICE_PATH MEDIA_FV / MEDIA_FV_FILE nodes — the first three GUID
+// fields are byte-swapped relative to the canonical string form.
+//
+// canonical: 7cb8bdc9-f8eb-4f34-aaea-3ee4af6516a1
+const OVMF_FV_GUID_LE: [u8; 16] = [
+    0xc9, 0xbd, 0xb8, 0x7c, 0xeb, 0xf8, 0x34, 0x4f, 0xaa, 0xea, 0x3e, 0xe4, 0xaf, 0x65, 0x16, 0xa1,
+];
+// canonical: eec25bdc-67f2-4d95-b1d5-f81b2039d11d  (MdeModulePkg UiApp)
+const OVMF_UIAPP_FILE_GUID_LE: [u8; 16] = [
+    0xdc, 0x5b, 0xc2, 0xee, 0xf2, 0x67, 0x95, 0x4d, 0xb1, 0xd5, 0xf8, 0x1b, 0x20, 0x39, 0xd1, 0x1d,
+];
+// canonical: 462caa21-7614-4503-836e-8ab6f4662331  (MdeModulePkg BootMaintenance / FrontPage)
+const OVMF_FRONTPAGE_FILE_GUID_LE: [u8; 16] = [
+    0x21, 0xaa, 0x2c, 0x46, 0x14, 0x76, 0x03, 0x45, 0x83, 0x6e, 0x8a, 0xb6, 0xf4, 0x66, 0x23, 0x31,
+];
+
 const ATTRIBUTE_MR_EXTEND: u32 = 0x00000001;
 const ATTRIBUTE_PAGE_AUG: u32 = 0x00000002;
 
@@ -310,21 +334,68 @@ impl<'a> Tdvf<'a> {
                 ]
             }
             OvmfVariant::Stable202505 => {
-                // edk2-stable202505 adds 4 new events and re-formats BootOrder/Boot0000
-                // in RTMR[0]. Digests captured from a 0.5.10 dstack CVM running the
-                // standard -kernel boot config (9p host_share_mode); they are firmware
-                // constants for this OVMF build.
-                let bootmenu_fwcfg_hash = measure_sha384(&[0x00, 0x00]); // BootMenu fw_cfg = 0x0000
+                // edk2-stable202505 emits 17 RTMR[0] events instead of 13. The
+                // boot-option set is fully derivable from OVMF-internal
+                // constants (FV and file GUIDs, descriptions, attributes); the
+                // remaining two — the bootorder fw_cfg measurement and
+                // EV_EFI_VARIABLE_AUTHORITY — stay as captured digests because
+                // their content depends on QEMU's emitted device list and on
+                // OVMF-internal logic that's not worth shadowing here.
+
+                // fw_cfg `BootMenu` is a u16; dstack doesn't pass `-boot
+                // menu=on`, so it defaults to 0x0000.
+                let bootmenu_fwcfg_hash = measure_sha384(&[0x00, 0x00]);
+
+                // fw_cfg `bootorder` is QEMU's generated bootorder string for
+                // the current device topology. dstack-vmm's QEMU command (9p +
+                // virtio-blk + vhost-vsock, no `-boot order=` / `bootindex=`)
+                // is fixed, so this is a constant. If the QEMU command line is
+                // ever changed (different host_share_mode, GPU passthrough,
+                // extra bootable devices) this digest will need re-capturing.
                 let bootorder_fwcfg_hash =
                     hex!("53D3DBC00691328371E74C1B1C77BDF1BF4FF79DD1B55222B694FE8341CD8B0ADB3A9AB9286552C681272883B9B0FC1D");
+
+                // EV_EFI_VARIABLE_AUTHORITY: OVMF emits this once during BDS
+                // even when Secure Boot is disabled. The 32-byte event blob in
+                // the log is a sentinel; the actual measured payload is
+                // OVMF-internal. Captured digest is a constant for the
+                // edk2-stable202505 build dstack ships.
                 let variable_authority_hash =
                     hex!("FB66919801F1DFC9C4C273B6A739380790CB0FD3CB706A42F6AC050510EBC8618E7FBA53A1564522F5C6F0DC9E1F41A6");
-                let boot_order_var_hash =
-                    hex!("52B9A02DE946B947364B57D8210C63113B9058996E2A3BA7CEAD54AF11AE0873B085D1E52BC01E4FEBE57CA05CA1332B");
-                let boot0000_hash =
-                    hex!("5068E6A9DED2A1C3A8EBB5D26004410EA8670742D8F444C5C3D161B76C66FA23A7B1D2FB3F9840570B675384B5818F2D");
-                let boot0001_hash =
-                    hex!("DD424F2EEB35F3E8A2C2F50F6CC87FF90B7577E92CE63E13A22869D07D104FD5EA9800E6E4F12C5058FC4EAA78374F20");
+
+                // BootOrder UEFI variable holds [0x0000, 0x0001] — the two
+                // boot options OVMF's BDS publishes (UiApp and FrontPage).
+                // The TCG digest for `EV_EFI_VARIABLE_BOOT2` is over the raw
+                // variable data, NOT a UEFI_VARIABLE_DATA wrapper.
+                let boot_order_var_hash = measure_sha384(&boot_order_bytes(&[0x0000, 0x0001]));
+
+                // Boot0000 = OVMF's BootManagerMenuApp; Boot0001 = "EFI
+                // Firmware Setup" (FrontPage). Both live in the OVMF FV and
+                // are baked into the firmware at build time. The attribute
+                // bits and descriptions come from MdeModulePkg's
+                // BdsBootManagerLib in edk2-stable202505.
+                //   0x101 = LOAD_OPTION_ACTIVE | LOAD_OPTION_CATEGORY_APP
+                //   0x109 = + LOAD_OPTION_HIDDEN
+                let boot0000_hash = measure_sha384(&boot_option_bytes(
+                    0x0000_0109,
+                    "BootManagerMenuApp",
+                    &[
+                        fv_node(&OVMF_FV_GUID_LE),
+                        fv_file_node(&OVMF_UIAPP_FILE_GUID_LE),
+                        END_OF_DEVICE_PATH,
+                    ],
+                    &[],
+                ));
+                let boot0001_hash = measure_sha384(&boot_option_bytes(
+                    0x0000_0101,
+                    "EFI Firmware Setup",
+                    &[
+                        fv_node(&OVMF_FV_GUID_LE),
+                        fv_file_node(&OVMF_FRONTPAGE_FILE_GUID_LE),
+                        END_OF_DEVICE_PATH,
+                    ],
+                    &[],
+                ));
                 vec![
                     td_hob_hash,
                     cfv_image_hash.to_vec(),
@@ -340,9 +411,9 @@ impl<'a> Tdvf<'a> {
                     acpi_rsdp_hash,
                     acpi_tables_hash,
                     variable_authority_hash.to_vec(),
-                    boot_order_var_hash.to_vec(),
-                    boot0000_hash.to_vec(),
-                    boot0001_hash.to_vec(),
+                    boot_order_var_hash,
+                    boot0000_hash,
+                    boot0001_hash,
                 ]
             }
         };

dstack-mr/src/uefi_var.rs

@@ -0,0 +1,135 @@
+// SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
+//
+// SPDX-License-Identifier: Apache-2.0
+
+//! Helpers for synthesising the UEFI variable byte blobs that OVMF measures
+//! into RTMR[0] as `EV_EFI_VARIABLE_BOOT2` events.
+//!
+//! For the BootOrder / Boot####  variables the TCG PFP spec digest is taken
+//! over the *variable data* portion only (not the full `UEFI_VARIABLE_DATA`
+//! struct), so we just build the on-the-wire variable contents here.
+
+use crate::utf16_encode;
+
+/// Build the raw bytes of a `BootOrder` UEFI variable from a sequence of boot
+/// option numbers — each entry is a little-endian `u16` referring to a
+/// `Boot####` variable.
+pub fn boot_order_bytes(entries: &[u16]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(entries.len() * 2);
+    for &entry in entries {
+        out.extend_from_slice(&entry.to_le_bytes());
+    }
+    out
+}
+
+/// An `EFI_DEVICE_PATH_PROTOCOL` node.
+#[derive(Clone, Copy)]
+pub struct DevicePathNode<'a> {
+    pub r#type: u8,
+    pub subtype: u8,
+    pub data: &'a [u8],
+}
+
+impl DevicePathNode<'_> {
+    fn write_to(self, buf: &mut Vec<u8>) {
+        let len = 4 + self.data.len();
+        buf.push(self.r#type);
+        buf.push(self.subtype);
+        buf.extend_from_slice(&(len as u16).to_le_bytes());
+        buf.extend_from_slice(self.data);
+    }
+}
+
+/// `END_ENTIRE_DEVICE_PATH` terminator.
+pub const END_OF_DEVICE_PATH: DevicePathNode<'static> = DevicePathNode {
+    r#type: 0x7f,
+    subtype: 0xff,
+    data: &[],
+};
+
+/// `MEDIA_DEVICE_PATH / Firmware Volume` node (`type=4, subtype=7`).
+pub fn fv_node(guid_le: &[u8; 16]) -> DevicePathNode<'_> {
+    DevicePathNode {
+        r#type: 0x04,
+        subtype: 0x07,
+        data: guid_le,
+    }
+}
+
+/// `MEDIA_DEVICE_PATH / Firmware File` node (`type=4, subtype=6`).
+pub fn fv_file_node(guid_le: &[u8; 16]) -> DevicePathNode<'_> {
+    DevicePathNode {
+        r#type: 0x04,
+        subtype: 0x06,
+        data: guid_le,
+    }
+}
+
+/// Build the raw bytes of a `Boot####` UEFI variable — the on-the-wire form of
+/// `EFI_LOAD_OPTION { Attributes, FilePathListLength, Description, FilePathList,
+/// OptionalData }`.
+///
+/// The description is automatically NUL-terminated in UTF-16LE.
+pub fn boot_option_bytes(
+    attributes: u32,
+    description: &str,
+    file_path_nodes: &[DevicePathNode<'_>],
+    optional_data: &[u8],
+) -> Vec<u8> {
+    // Serialise the device-path list first so we know its length.
+    let mut file_path = Vec::new();
+    for node in file_path_nodes {
+        node.write_to(&mut file_path);
+    }
+
+    let mut desc = utf16_encode(description);
+    desc.extend_from_slice(&[0x00, 0x00]); // NUL terminator
+
+    let mut out = Vec::with_capacity(4 + 2 + desc.len() + file_path.len() + optional_data.len());
+    out.extend_from_slice(&attributes.to_le_bytes());
+    out.extend_from_slice(&(file_path.len() as u16).to_le_bytes());
+    out.extend_from_slice(&desc);
+    out.extend_from_slice(&file_path);
+    out.extend_from_slice(optional_data);
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use sha2::{Digest, Sha384};
+
+    fn sha384(bytes: &[u8]) -> String {
+        hex::encode(Sha384::new_with_prefix(bytes).finalize())
+    }
+
+    #[test]
+    fn boot_option_round_trip_sample() {
+        // Trivial sanity check: a load option with one MEDIA_FV_FILE node and
+        // an empty description should serialise to a 4 (Attrs) + 2 (FpLen) +
+        // 2 (NUL) + (4 + 16) (FV_FILE) + 4 (END) = 32 byte blob, and
+        // round-tripping the descriptive string survives.
+        let blob = boot_option_bytes(1, "", &[fv_file_node(&[0; 16]), END_OF_DEVICE_PATH], &[]);
+        assert_eq!(blob.len(), 4 + 2 + 2 + 20 + 4);
+        assert_eq!(&blob[0..4], &[0x01, 0x00, 0x00, 0x00]);
+        assert_eq!(&blob[4..6], &[0x18, 0x00]); // FilePathListLength = 24
+                                                // Description is just a NUL terminator (two bytes of 0).
+        assert_eq!(&blob[6..8], &[0x00, 0x00]);
+    }
+
+    #[test]
+    fn boot_order_encodes_u16_le_entries() {
+        assert_eq!(
+            boot_order_bytes(&[0x0000, 0x0001]),
+            vec![0x00, 0x00, 0x01, 0x00]
+        );
+        assert_eq!(
+            boot_order_bytes(&[0x1234, 0xabcd]),
+            vec![0x34, 0x12, 0xcd, 0xab]
+        );
+        assert_eq!(
+            sha384(&boot_order_bytes(&[0x0000, 0x0001])),
+            "52b9a02de946b947364b57d8210c63113b9058996e2a3ba7cead54af11ae0873b085d1e52bc01e4febe57ca05ca1332b"
+        );
+    }
+}