Merge pull request #1970 from rust-osdev/bump-ovmf

phip1611 · web-flow · commit d438f6134fc2 · 2026-06-15T09:18:51.000Z
xtask: update OVMF from EDK2-STABLE202502 to EDK2-STABLE202605
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/uefi-test-runner/src/proto/network/http.rs b/uefi-test-runner/src/proto/network/http.rs
@@ -87,17 +87,55 @@ pub fn test() {
 
         // hard to find web sites which still allow plain http these days ...
         info!("Testing HTTP");
-        fetch_http(*h, "http://example.com/").expect("http request failed: http://example.com");
-
-        // FYI: not all firmware builds support modern tls versions.
-        // request() -> ABORTED typically is a tls handshake error.
-        // check the firmware log for details.
-        info!("Testing HTTPS");
-        fetch_http(
-            *h,
-            "https://raw.githubusercontent.com/rust-osdev/uefi-rs/refs/heads/main/Cargo.toml",
-        )
-        .expect("https request failed");
+        fetch_http(*h, "http://example.com/").expect("http request to http://example.com failed");
+
+        // Since edk2-stable202511, the default OpenSSL security level has been
+        // raised from 0 to 3, which rejects older RSA-based keys. Unfortunately,
+        // the EDK2 aarch64 build forcefully disables all EC-based keys
+        // (-DEDK2_OPENSSL_NOEC=1), effectively preventing connections to most
+        // HTTPS/TLS hosts. Temporarily disable this test on aarch64 until
+        // EC-based keys are supported there.
+        //
+        // See https://github.com/rust-osdev/uefi-rs/issues/1975
+        #[cfg(not(target_arch = "aarch64"))]
+        {
+            // EDK2 uses platform-specific OpenSSL configurations, which can affect
+            // certificate compatibility with HTTPS hosts. Because both our test
+            // hosts and their certificates may change, try multiple candidates and
+            // require at least one request to succeed.
+            //
+            // Not all firmware builds support modern tls versions.
+            // request() -> ABORTED typically is a tls handshake error.
+            // check the firmware log for details.
+            let https_url_candidates = [
+                "https://example.com/",
+                "https://raw.githubusercontent.com/rust-osdev/uefi-rs/refs/heads/main/Cargo.toml",
+                "https://www.cloudflare.com/",
+                "https://www.google.com/",
+            ];
+
+            info!("Testing HTTPS");
+            let https_results = https_url_candidates
+                .iter()
+                .map(|url| (url, fetch_http(*h, url)))
+                .collect::<Vec<_>>();
+            for (url, res) in &https_results {
+                debug!(
+                    "HTTPS request to: {url}: {}",
+                    if res.is_some() { "OK" } else { "FAILED" }
+                );
+            }
+            assert!(
+                https_results.iter().any(|(_, res)| res.is_some()),
+                "No HTTPS request succeeded"
+            );
+        }
+
+        #[cfg(target_arch = "aarch64")]
+        {
+            // See https://github.com/rust-osdev/uefi-rs/issues/1975
+            warn!("Skipping HTTPS test on aarch64 (see #1975)");
+        }
 
         info!("PASSED");
     }
diff --git a/uefi/src/proto/network/http.rs b/uefi/src/proto/network/http.rs
@@ -43,6 +43,7 @@ impl Http {
     /// Configure HTTP Protocol.  Must be called before sending HTTP requests.
     pub fn configure(&mut self, config_data: &HttpConfigData) -> uefi::Result<()> {
         let status = unsafe { (self.0.configure)(&mut self.0, config_data) };
+        debug!("http raw: configure({config_data:?}) -> {status}");
         match status {
             Status::SUCCESS => Ok(()),
             _ => Err(status.into()),
@@ -52,6 +53,12 @@ impl Http {
     /// Send HTTP request.
     pub fn request(&mut self, token: &mut HttpToken) -> uefi::Result<()> {
         let status = unsafe { (self.0.request)(&mut self.0, token) };
+        debug!(
+            "http raw: request(headers={}, body_len={}) -> {status}, token.status={}",
+            unsafe { (*token.message).header_count },
+            unsafe { (*token.message).body_length },
+            token.status,
+        );
         match status {
             Status::SUCCESS => Ok(()),
             _ => Err(status.into()),
@@ -70,6 +77,11 @@ impl Http {
     /// Receive HTTP response.
     pub fn response(&mut self, token: &mut HttpToken) -> uefi::Result<()> {
         let status = unsafe { (self.0.response)(&mut self.0, token) };
+        debug!(
+            "http raw: response(body_len={}) -> {status}, token.status={}",
+            unsafe { (*token.message).body_length },
+            token.status,
+        );
         match status {
             Status::SUCCESS => Ok(()),
             _ => Err(status.into()),
@@ -211,12 +223,16 @@ impl HttpHelper {
     ) -> uefi::Result<()> {
         let url16 = uefi::CString16::try_from(url).unwrap();
 
+        let scheme = url.split(':').next().unwrap_or("<missing>");
         let Some(hostname) = url.split('/').nth(2) else {
             return Err(Status::INVALID_PARAMETER.into());
         };
         let mut c_hostname = String::from(hostname);
         c_hostname.push('\0');
-        debug!("http: host: {hostname}");
+        debug!(
+            "http: request setup: method={method:?}, scheme={scheme}, host={hostname}, body_len={}",
+            body.as_ref().map_or(0, |body| body.len())
+        );
 
         let mut tx_req = HttpRequestData {
             method,
@@ -248,12 +264,18 @@ impl HttpHelper {
         p.request(&mut tx_token)?;
         debug!("http: request sent ok");
 
+        let mut polls = 0;
         loop {
             if tx_token.status != Status::NOT_READY {
                 break;
             }
+            polls += 1;
             p.poll()?;
         }
+        debug!(
+            "http: request token completed after {polls} polls with {}",
+            tx_token.status
+        );
 
         if tx_token.status != Status::SUCCESS {
             return Err(tx_token.status.into());
diff --git a/xtask/Cargo.toml b/xtask/Cargo.toml
@@ -15,7 +15,7 @@ itertools = "0.14.0"
 log.workspace = true
 mbrman = "0.6.0"
 nix = { version = "0.31.0", default-features = false, features = ["fs"] }
-ovmf-prebuilt = "0.2.3"
+ovmf-prebuilt = "0.2.9"
 proc-macro2 = { version = "1.0.46", features = ["span-locations"] }
 quote = "1.0.21"
 regex = "1.10.2"
diff --git a/xtask/src/qemu.rs b/xtask/src/qemu.rs
@@ -21,11 +21,25 @@ use tempfile::TempDir;
 use {std::fs::Permissions, std::os::unix::fs::PermissionsExt};
 
 /// Name of the ovmf-prebuilt release to use by default.
-const OVMF_PREBUILT_SOURCE: Source = Source::EDK2_STABLE202502_R2;
+///
+/// This is typically the latest stable release.
+const OVMF_PREBUILT_SOURCE: Source = Source::EDK2_STABLE202605_R1;
+
+/// Name of the ovmf-prebuilt release to use for IA32.
+///
+/// After EDK2_STABLE202508_R1, IA32 support was dropped in edk2.
+const OVMF_PREBUILT_IA32_SOURCE: Source = Source::EDK2_STABLE202508_R1;
 
 /// Directory into which the prebuilts will be download (relative to the repo root).
 const OVMF_PREBUILT_DIR: &str = "target/ovmf";
 
+fn ovmf_prebuilt_source(arch: UefiArch) -> Source {
+    match arch {
+        UefiArch::IA32 => OVMF_PREBUILT_IA32_SOURCE,
+        UefiArch::AArch64 | UefiArch::X86_64 => OVMF_PREBUILT_SOURCE,
+    }
+}
+
 impl From<UefiArch> for ovmf_prebuilt::Arch {
     fn from(arch: UefiArch) -> Self {
         match arch {
@@ -52,6 +66,7 @@ struct OvmfPaths {
     code: PathBuf,
     vars: PathBuf,
     shell: PathBuf,
+    prebuilt_source_tag: &'static str,
 }
 
 impl OvmfPaths {
@@ -62,7 +77,12 @@ impl OvmfPaths {
     /// 1. Command-line arg
     /// 2. Environment variable
     /// 3. Prebuilt file (automatically downloaded)
-    fn find_ovmf_file(file_type: FileType, opt: &QemuOpt, arch: UefiArch) -> Result<PathBuf> {
+    fn find_ovmf_file(
+        file_type: FileType,
+        opt: &QemuOpt,
+        arch: UefiArch,
+        prebuilt: &Prebuilt,
+    ) -> Result<PathBuf> {
         if let Some(path) = get_user_provided_path(file_type, opt) {
             // The user provided an exact path to use; verify that it
             // exists.
@@ -76,20 +96,42 @@ impl OvmfPaths {
                 );
             }
         } else {
-            let prebuilt = Prebuilt::fetch(OVMF_PREBUILT_SOURCE, OVMF_PREBUILT_DIR)?;
-
             Ok(prebuilt.get_file(arch.into(), file_type))
         }
     }
 
     /// Find path to OVMF files by the strategy documented for
     /// [`Self::find_ovmf_file`].
     fn find(opt: &QemuOpt, arch: UefiArch) -> Result<Self> {
-        let code = Self::find_ovmf_file(FileType::Code, opt, arch)?;
-        let vars = Self::find_ovmf_file(FileType::Vars, opt, arch)?;
-        let shell = Self::find_ovmf_file(FileType::Shell, opt, arch)?;
+        let prebuilt_source = ovmf_prebuilt_source(arch);
+        let prebuilt = Prebuilt::fetch(prebuilt_source.clone(), OVMF_PREBUILT_DIR)?;
+        let code = Self::find_ovmf_file(FileType::Code, opt, arch, &prebuilt)?;
+        let vars = Self::find_ovmf_file(FileType::Vars, opt, arch, &prebuilt)?;
+        let shell = Self::find_ovmf_file(FileType::Shell, opt, arch, &prebuilt)?;
+
+        Ok(Self {
+            code,
+            vars,
+            shell,
+            prebuilt_source_tag: prebuilt_source.tag,
+        })
+    }
 
-        Ok(Self { code, vars, shell })
+    fn log(&self, arch: UefiArch) {
+        eprintln!("OVMF:");
+        eprintln!("  version: {}", self.prebuilt_source_tag);
+        if arch == UefiArch::IA32 {
+            // https://github.com/tianocore/edk2/commit/1fb88ffe284782cc79e306306b8d19829b6248b7
+            eprintln!(
+                "{leftpadding}note: using this instead of {} as it is the last \
+                 release with IA32 support in edk2",
+                OVMF_PREBUILT_SOURCE.tag,
+                leftpadding = " ".repeat(11)
+            );
+        }
+        eprintln!("  code   : {}", self.code.display());
+        eprintln!("  vars   : {}", self.vars.display());
+        eprintln!("  shell  : {}", self.shell.display());
     }
 }
 
@@ -422,6 +464,7 @@ pub fn run_qemu(arch: UefiArch, opt: &QemuOpt) -> Result<()> {
 
     // Set up OVMF.
     let ovmf_paths = OvmfPaths::find(opt, arch)?;
+    ovmf_paths.log(arch);
 
     // Make a copy of the OVMF vars file so that it can be used
     // read+write without modifying the original. Under AArch64, some
