dstack-mr: support edk2-stable202505 OVMF event layout

OVMF was upgraded from an untagged 2024-09 snapshot to edk2-stable202505
in commit f9f11f3 on meta-dstack. The newer firmware emits four extra
RTMR[0] events (QEMU fw_cfg BootMenu/bootorder, EV_EFI_VARIABLE_AUTHORITY,
and a second BootXXXX) and re-formats BootOrder/Boot0000 as full
UEFI_VARIABLE_DATA structs. dstack-mr was still computing the legacy
13-event log, so quote replay on 0.5.10 CVMs produced wrong RTMR[0].

Add an OvmfVariant enum in dstack-types and dispatch rtmr0_log on it.
The new variant's digests come from a 0.5.10 CVM's actual event log;
they're firmware constants for this OVMF build under the standard -kernel
boot config.

Plumbing:
- VmConfig.ovmf_variant: Option<OvmfVariant>: explicit source of truth
  for verifiers, set by VMM from image.info.ovmf_variant.
- ImageInfo.ovmf_variant: ditto in metadata.json.
- Verifier prefers vm_config.ovmf_variant; falls back to parsing the
  version suffix out of vm_config.image (e.g. "dstack-0.5.10") so
  pre-existing deployments without the field keep working.
- dstack-mr CLI adds --dstack-os-version for explicit override.

Verified end-to-end against a 0.5.10 CVM: all four measurements (MRTD,
RTMR[0-2]) match the quote exactly.

Author: kvinwang

dstack-mr/Cargo.toml

@@ -25,9 +25,9 @@ fs-err.workspace = true
 bon.workspace = true
 log.workspace = true
 scale.workspace = true
+dstack-types.workspace = true
 
 [dev-dependencies]
-dstack-types.workspace = true
 reqwest = { workspace = true, features = ["blocking"] }
 flate2.workspace = true
 tar.workspace = true

dstack-mr/cli/src/main.rs

@@ -4,7 +4,7 @@
 
 use anyhow::{Context, Result};
 use clap::{Parser, Subcommand};
-use dstack_mr::Machine;
+use dstack_mr::{Machine, OvmfVariant, ovmf_variant_for_version};
 use dstack_types::ImageInfo;
 use fs_err as fs;
 use size_parser::parse_memory_size;
@@ -78,6 +78,12 @@ struct MachineConfig {
     #[arg(long)]
     qemu_version: Option<String>,
 
+    /// dstack OS version (MAJOR.MINOR.PATCH), used to pick the OVMF measurement layout.
+    /// 0.5.10 <= ver < 0.6.0 and ver >= 0.6.1 use the edk2-stable202505 layout; everything
+    /// else uses the legacy layout. If omitted, falls back to `image_info.version`.
+    #[arg(long)]
+    dstack_os_version: Option<String>,
+
     /// Output JSON
     #[arg(long)]
     json: bool,
@@ -97,7 +103,22 @@ fn main() -> Result<()> {
             let firmware_path = parent_dir.join(&image_info.bios).display().to_string();
             let kernel_path = parent_dir.join(&image_info.kernel).display().to_string();
             let initrd_path = parent_dir.join(&image_info.initrd).display().to_string();
-            let cmdline = image_info.cmdline + " initrd=initrd";
+            let cmdline = image_info.cmdline.clone() + " initrd=initrd";
+
+            // CLI flag wins, then the explicit `ovmf_variant` in metadata.json,
+            // and finally the OS version field. Older metadata.json files may
+            // carry neither, in which case fall back to the default.
+            let ovmf_variant = if let Some(v) = config.dstack_os_version.as_deref() {
+                ovmf_variant_for_version(v)
+                    .with_context(|| format!("invalid dstack OS version: {v}"))?
+            } else if let Some(variant) = image_info.ovmf_variant {
+                variant
+            } else if !image_info.version.is_empty() {
+                ovmf_variant_for_version(&image_info.version)
+                    .with_context(|| format!("invalid dstack OS version: {}", image_info.version))?
+            } else {
+                OvmfVariant::default()
+            };
 
             let machine = Machine::builder()
                 .cpu_count(config.cpu)
@@ -116,6 +137,7 @@ fn main() -> Result<()> {
                 .hotplug_off(config.hotplug_off)
                 .root_verity(config.root_verity)
                 .maybe_qemu_version(config.qemu_version.clone())
+                .ovmf_variant(ovmf_variant)
                 .build();
 
             let measurements = machine

dstack-mr/src/lib.rs

@@ -2,9 +2,11 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 
+use anyhow::{bail, Context, Result};
 use serde::{Deserialize, Serialize};
 use serde_human_bytes as hex_bytes;
 
+pub use dstack_types::OvmfVariant;
 pub use machine::{Machine, TdxMeasurementDetails};
 
 use util::{measure_log, measure_sha384, utf16_encode};
@@ -19,6 +21,155 @@ mod num;
 mod tdvf;
 mod util;
 
+/// Pick the OVMF variant for a given dstack OS version string ("MAJOR.MINOR.PATCH").
+///
+/// Treats `0.5.10 <= v < 0.6.0` and `v >= 0.6.1` as `Stable202505`, everything else as
+/// `Pre202505`. Used as a fallback when `VmConfig::ovmf_variant` is absent.
+pub fn ovmf_variant_for_version(version: &str) -> Result<OvmfVariant> {
+    let parts: Vec<u32> = version
+        .split('.')
+        .map(|p| {
+            p.parse::<u32>()
+                .with_context(|| format!("invalid version component: {p}"))
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+    if parts.len() != 3 {
+        bail!("expected MAJOR.MINOR.PATCH, got {version}");
+    }
+    let v = (parts[0], parts[1], parts[2]);
+    let stable = ((0, 5, 10)..(0, 6, 0)).contains(&v) || v >= (0, 6, 1);
+    Ok(if stable {
+        OvmfVariant::Stable202505
+    } else {
+        OvmfVariant::Pre202505
+    })
+}
+
+/// Extract a dotted version suffix (e.g. "0.5.10") from a dstack image name like
+/// `dstack-0.5.10`, `dstack-dev-0.5.10`, or `dstack-nvidia-0.5.10`.
+///
+/// Returns `None` when the image name does not end with a recognisable
+/// `MAJOR.MINOR.PATCH` segment.
+pub fn extract_version_from_image_name(image: &str) -> Option<&str> {
+    let tail = image.rsplit('-').next()?;
+    let parts: Vec<&str> = tail.split('.').collect();
+    if parts.len() == 3
+        && parts
+            .iter()
+            .all(|p| !p.is_empty() && p.parse::<u32>().is_ok())
+    {
+        Some(tail)
+    } else {
+        None
+    }
+}
+
+/// Pick the OVMF variant from an image name like `dstack-0.5.10`.
+///
+/// Falls back to `OvmfVariant::default()` (= `Pre202505`) when the image name is
+/// missing or doesn't carry a parseable version suffix. Use this only as a
+/// fallback for images that pre-date `VmConfig::ovmf_variant`.
+pub fn ovmf_variant_for_image(image: Option<&str>) -> OvmfVariant {
+    image
+        .and_then(extract_version_from_image_name)
+        .and_then(|v| ovmf_variant_for_version(v).ok())
+        .unwrap_or_default()
+}
+
+#[cfg(test)]
+mod ovmf_variant_tests {
+    use super::*;
+
+    #[test]
+    fn pre_202505_for_old_versions() {
+        for v in ["0.4.99", "0.5.7", "0.5.8", "0.5.9", "0.6.0"] {
+            assert_eq!(
+                ovmf_variant_for_version(v).unwrap(),
+                OvmfVariant::Pre202505,
+                "{v}"
+            );
+        }
+    }
+
+    #[test]
+    fn stable_202505_for_new_versions() {
+        for v in ["0.5.10", "0.5.99", "0.6.1", "0.6.2", "0.7.0", "1.0.0"] {
+            assert_eq!(
+                ovmf_variant_for_version(v).unwrap(),
+                OvmfVariant::Stable202505,
+                "{v}"
+            );
+        }
+    }
+
+    #[test]
+    fn rejects_malformed_version() {
+        assert!(ovmf_variant_for_version("0.5").is_err());
+        assert!(ovmf_variant_for_version("0.5.10-dev").is_err());
+        assert!(ovmf_variant_for_version("v0.5.10").is_err());
+    }
+
+    #[test]
+    fn parses_version_from_image_name() {
+        assert_eq!(
+            extract_version_from_image_name("dstack-0.5.10"),
+            Some("0.5.10")
+        );
+        assert_eq!(
+            extract_version_from_image_name("dstack-dev-0.5.10"),
+            Some("0.5.10")
+        );
+        assert_eq!(
+            extract_version_from_image_name("dstack-nvidia-0.5.10"),
+            Some("0.5.10")
+        );
+        assert_eq!(
+            extract_version_from_image_name("dstack-nvidia-dev-0.6.1"),
+            Some("0.6.1")
+        );
+        assert_eq!(extract_version_from_image_name("dstack"), None);
+        assert_eq!(extract_version_from_image_name("dstack-rc1"), None);
+        assert_eq!(extract_version_from_image_name("dstack-0.5"), None);
+    }
+
+    #[test]
+    fn ovmf_variant_for_image_handles_missing_and_unknown() {
+        assert_eq!(ovmf_variant_for_image(None), OvmfVariant::Pre202505);
+        assert_eq!(
+            ovmf_variant_for_image(Some("dstack")),
+            OvmfVariant::Pre202505
+        );
+        assert_eq!(
+            ovmf_variant_for_image(Some("dstack-0.5.9")),
+            OvmfVariant::Pre202505
+        );
+        assert_eq!(
+            ovmf_variant_for_image(Some("dstack-0.5.10")),
+            OvmfVariant::Stable202505
+        );
+        assert_eq!(
+            ovmf_variant_for_image(Some("dstack-nvidia-dev-0.6.1")),
+            OvmfVariant::Stable202505
+        );
+    }
+
+    #[test]
+    fn serializes_with_snake_case() {
+        assert_eq!(
+            serde_json::to_string(&OvmfVariant::Pre202505).unwrap(),
+            "\"pre202505\""
+        );
+        assert_eq!(
+            serde_json::to_string(&OvmfVariant::Stable202505).unwrap(),
+            "\"stable202505\""
+        );
+        assert_eq!(
+            serde_json::from_str::<OvmfVariant>("\"stable202505\"").unwrap(),
+            OvmfVariant::Stable202505
+        );
+    }
+}
+
 /// Contains all the measurement values for TDX.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct TdxMeasurements {

dstack-mr/src/machine.rs

@@ -5,7 +5,7 @@
 use crate::acpi::Tables;
 use crate::tdvf::Tdvf;
 use crate::util::debug_print_log;
-use crate::{kernel, RtmrLogs, TdxMeasurements};
+use crate::{kernel, OvmfVariant, RtmrLogs, TdxMeasurements};
 use crate::{measure_log, measure_sha384};
 use anyhow::{bail, Context, Result};
 use fs_err as fs;
@@ -32,6 +32,10 @@ pub struct Machine<'a> {
     pub root_verity: bool,
     #[builder(default)]
     pub host_share_mode: String,
+    /// Selects which OVMF measurement event layout to expect.
+    /// Defaults to the pre-edk2-stable202505 layout for backwards compatibility.
+    #[builder(default)]
+    pub ovmf_variant: OvmfVariant,
 }
 
 fn parse_version_tuple(v: &str) -> Result<(u32, u32, u32)> {

dstack-mr/src/tdvf.rs

@@ -9,7 +9,7 @@ use sha2::{Digest, Sha384};
 
 use crate::acpi::Tables;
 use crate::num::read_le;
-use crate::{measure_log, measure_sha384, utf16_encode, Machine, RtmrLog};
+use crate::{measure_log, measure_sha384, utf16_encode, Machine, OvmfVariant, RtmrLog};
 
 const PAGE_SIZE: u64 = 0x1000;
 const MR_EXTEND_GRANULARITY: usize = 0x100;
@@ -275,33 +275,79 @@ impl<'a> Tdvf<'a> {
     pub fn rtmr0_log(&self, machine: &Machine) -> Result<(RtmrLog, Tables)> {
         let td_hob_hash = self.measure_td_hob(machine.memory_size)?;
         let cfv_image_hash = hex!("344BC51C980BA621AAA00DA3ED7436F7D6E549197DFE699515DFA2C6583D95E6412AF21C097D473155875FFD561D6790");
-        let boot000_hash = hex!("23ADA07F5261F12F34A0BD8E46760962D6B4D576A416F1FEA1C64BC656B1D28EACF7047AE6E967C58FD2A98BFA74C298");
 
         let tables = machine.build_tables()?;
         let acpi_tables_hash = measure_sha384(&tables.tables);
         let acpi_rsdp_hash = measure_sha384(&tables.rsdp);
         let acpi_loader_hash = measure_sha384(&tables.loader);
 
-        // RTMR0 calculation
-
-        Ok((
-            vec![
-                td_hob_hash,
-                cfv_image_hash.to_vec(),
-                measure_tdx_efi_variable("8BE4DF61-93CA-11D2-AA0D-00E098032B8C", "SecureBoot")?,
-                measure_tdx_efi_variable("8BE4DF61-93CA-11D2-AA0D-00E098032B8C", "PK")?,
-                measure_tdx_efi_variable("8BE4DF61-93CA-11D2-AA0D-00E098032B8C", "KEK")?,
-                measure_tdx_efi_variable("D719B2CB-3D3A-4596-A3BC-DAD00E67656F", "db")?,
-                measure_tdx_efi_variable("D719B2CB-3D3A-4596-A3BC-DAD00E67656F", "dbx")?,
-                measure_sha384(&[0x00, 0x00, 0x00, 0x00]), // Separator
-                acpi_loader_hash,
-                acpi_rsdp_hash,
-                acpi_tables_hash,
-                measure_sha384(&[0x00, 0x00]), // BootOrder
-                boot000_hash.to_vec(),
-            ],
-            tables,
-        ))
+        let secureboot_hash =
+            measure_tdx_efi_variable("8BE4DF61-93CA-11D2-AA0D-00E098032B8C", "SecureBoot")?;
+        let pk_hash = measure_tdx_efi_variable("8BE4DF61-93CA-11D2-AA0D-00E098032B8C", "PK")?;
+        let kek_hash = measure_tdx_efi_variable("8BE4DF61-93CA-11D2-AA0D-00E098032B8C", "KEK")?;
+        let db_hash = measure_tdx_efi_variable("D719B2CB-3D3A-4596-A3BC-DAD00E67656F", "db")?;
+        let dbx_hash = measure_tdx_efi_variable("D719B2CB-3D3A-4596-A3BC-DAD00E67656F", "dbx")?;
+        let separator_hash = measure_sha384(&[0x00, 0x00, 0x00, 0x00]);
+
+        let log = match machine.ovmf_variant {
+            OvmfVariant::Pre202505 => {
+                // Boot0000 = OVMF UiApp (fixed digest for pre-202505 firmware).
+                let boot000_hash = hex!("23ADA07F5261F12F34A0BD8E46760962D6B4D576A416F1FEA1C64BC656B1D28EACF7047AE6E967C58FD2A98BFA74C298");
+                vec![
+                    td_hob_hash,
+                    cfv_image_hash.to_vec(),
+                    secureboot_hash,
+                    pk_hash,
+                    kek_hash,
+                    db_hash,
+                    dbx_hash,
+                    separator_hash,
+                    acpi_loader_hash,
+                    acpi_rsdp_hash,
+                    acpi_tables_hash,
+                    measure_sha384(&[0x00, 0x00]), // BootOrder (raw 2 bytes in legacy OVMF)
+                    boot000_hash.to_vec(),
+                ]
+            }
+            OvmfVariant::Stable202505 => {
+                // edk2-stable202505 adds 4 new events and re-formats BootOrder/Boot0000
+                // in RTMR[0]. Digests captured from a 0.5.10 dstack CVM running the
+                // standard -kernel boot config (9p host_share_mode); they are firmware
+                // constants for this OVMF build.
+                let bootmenu_fwcfg_hash = measure_sha384(&[0x00, 0x00]); // BootMenu fw_cfg = 0x0000
+                let bootorder_fwcfg_hash =
+                    hex!("53D3DBC00691328371E74C1B1C77BDF1BF4FF79DD1B55222B694FE8341CD8B0ADB3A9AB9286552C681272883B9B0FC1D");
+                let variable_authority_hash =
+                    hex!("FB66919801F1DFC9C4C273B6A739380790CB0FD3CB706A42F6AC050510EBC8618E7FBA53A1564522F5C6F0DC9E1F41A6");
+                let boot_order_var_hash =
+                    hex!("52B9A02DE946B947364B57D8210C63113B9058996E2A3BA7CEAD54AF11AE0873B085D1E52BC01E4FEBE57CA05CA1332B");
+                let boot0000_hash =
+                    hex!("5068E6A9DED2A1C3A8EBB5D26004410EA8670742D8F444C5C3D161B76C66FA23A7B1D2FB3F9840570B675384B5818F2D");
+                let boot0001_hash =
+                    hex!("DD424F2EEB35F3E8A2C2F50F6CC87FF90B7577E92CE63E13A22869D07D104FD5EA9800E6E4F12C5058FC4EAA78374F20");
+                vec![
+                    td_hob_hash,
+                    cfv_image_hash.to_vec(),
+                    bootmenu_fwcfg_hash,
+                    bootorder_fwcfg_hash.to_vec(),
+                    secureboot_hash,
+                    pk_hash,
+                    kek_hash,
+                    db_hash,
+                    dbx_hash,
+                    separator_hash,
+                    acpi_loader_hash,
+                    acpi_rsdp_hash,
+                    acpi_tables_hash,
+                    variable_authority_hash.to_vec(),
+                    boot_order_var_hash.to_vec(),
+                    boot0000_hash.to_vec(),
+                    boot0001_hash.to_vec(),
+                ]
+            }
+        };
+
+        Ok((log, tables))
     }
 
     fn measure_td_hob(&self, memory_size: u64) -> Result<Vec<u8>> {