From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazon11021081.outbound.protection.outlook.com [52.101.70.81]) by lore.virtuozzo.com (Postfix) with ESMTPS id B0B4C8017D for ; Mon, 2 Nov 2026 15:25:41 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=kXxuYYrGfUFtoUFvet3ircG5YQIXNFX6RmlKHMFFjzQCstoSTt3lb9L+VWpp8KFTbQk3LHqXHP1QgcIhn8uTPt53iEJd/JuhQ0mkK9xtU6ZPU6d9n+9cqvEW6UXUcbMInbpmlpACrVzU0w6PyPG9ddc23A8fxIXhYw8XGJ2MLYaDKXRLmmTqdmVEng+gcaCeFndcj8Q6gkjeJ09Ms8NEf1AF4LqOYYPL1g1Cjh866btCup3s/9ONiGbX5k4Svx4vJODzhlb5vhpt2c5KTbIgkhLY8Jsbjls/5nYRwcesN8b4+MiyXFfxErMLUMi5ZcBubaaaEhiLvNaFBMXCIUkO2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=lKflg94zgiZWOzAyB13rss7vnYy+e+U+P1iQM8gvpNk=; b=Hzla6Ss5eBFjHo75xvw1YSOp2NzjtW2YKd4t6tEC2cPvnJBHLP/ZIOlbjWFU8x7Xfmw1ZEPTTbDaWyJXebZ8PxhOWYHv31BDzEXene1qfNaKOPoFy1zIkn4pcQuBOasG+CdvTWZZYLcM/svlpRqOaExMdiKA5ijJ6Jbr6wW/fYUKsRK6AJg3L9Z75s9lqMVULKWLhx8D+e63n5UdyYXk8/vlzOHOwtfNye3BIZQ3RPZbkHgtAfUooUhhaOJzhc/lbCpjU2GwCtJirARu9LKoD8WkDc88FEooEDqOg/QpvARt/CzmPCJD2YyS5yZ7xtqrY881nxaiOwC6y4zeb2TfBQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lKflg94zgiZWOzAyB13rss7vnYy+e+U+P1iQM8gvpNk=; b=qZRlFSNGPPC0WnK+t3o1dlJVtSnFM2cUH5udVV6lNDZgTNz+iXIBC8YPWef0sKm1sSzB4HNX810MlVbMwAEw0yggOY2uuYe2Am9VTHgRJ1Iq9LsTeCjZ3moOkEx8DP4//wR9gFoFDsEUY01zPVrU9Nl4/9GfAJGHac7d6FddQYSspR8dDsx5Mb683Bq6fN/3B9tf2F1BT6vRRM+KjAplJ5QhOMEjPnpzOqNmYl5g1HwO2wTkDzi4FbgIjrrQT71+EN0Lxb5jewDxEbwFnjd3I7oKEYMBG0utbXhOP8YHq7QLzB0V0gfpdnEMSkWnfz0P5l/idQvUKNJR+lM8tCEXpA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by PR3PR08MB5788.eurprd08.prod.outlook.com (2603:10a6:102:8b::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 15:25:40 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 15:25:40 +0000 From: Andrey Drobyshev To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@openvz.org Subject: [PATCH edk2.vzspecs hci-8.1] edk2-build.vz: build firmwares from OvmfPkgX64.dsc #VSTOR-152672 #VSTOR-152405 Date: Mon, 2 Nov 2026 17:25:32 +0200 Message-ID: <20261102152532.61807-1-andrey.drobyshev@virtuozzo.com> X-Mailer: git-send-email 2.47.1 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: VI1PR06CA0149.eurprd06.prod.outlook.com (2603:10a6:803:a0::42) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|PR3PR08MB5788:EE_ X-MS-Office365-Filtering-Correlation-Id: 1c8c661c-3898-4384-98f4-08df38f58d80 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|52116014|1800799024|366016|261021123027099003|38350700014|261026121527099003|5023799004|56012099006|261009223027099003|261021121427099003|261022075727099003|261022115727099003|10067099003|261102123227099003|18002099003|6133799003|5113699003|3023799007; X-Microsoft-Antispam-Message-Info: TVVwkbHsTGvzF2OKoV+SYGj9y0q7HeY46aGU8nHpYxhWLr37tqST6d6yEb1BDAdEEDW4emY1x0DhGrNxNgK2Vi36pxrmh7qmF85vEYnrGkYr1l6iTL3Mh+BRMGftH6LbS2FJR/lJFhLIcGzErrcAxvBkAflPbt6oiweJJhfDxZ105HDLwIAe+LgQGZP8zJPloEQG0W9UJwrdRKE3pbg3Tu0L7Kshq1yBUgvT+SBkDwRgYJH0kqPM+NXQoXNh3cOLKQsn7LLqiCaE2VolXiK/EHvdyMM4/FDdKEC6DGzLYBExW2R1S2MrjtbZXaV0YpMY6lXK/SFXu61ltXGpDzQ411T/aQKsyEf1zYLqK6I7uN+uPucF/Y06xwxvDIoRzW1vCCgUfAZbqeLKzQj4bT6egPc249EFmkQV9FpqW/+9I8ZjVgA4BEvQh8nr+WKKmDW6d7SLOnu+Aqpj2AQUmzIwANOsvplq6GjlwmDAs0sKsE5f4MZDNNb9lcpfZBC011jHy8ksZQf/xPRyxDA2efrvrLs9iPZ52PNHtC7Me2QBj0Zk4R6hrTu22Fby85M3jSvtoFgOgOg2M/55OIxJQL04GP8k4kw/Y8wTAW8+rI41YnAn2BCEepJhxd7pPQhikpTW759sv6ws12fsfEbPvIL3JP9avGCCYYC1xZgbkrYR/bNYdr4H69cKZtybg8biKnjYts3XRHADZl7+bMGtxTun17w0l7JOsgHMQ2N0oKQb6fY= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(52116014)(1800799024)(366016)(261021123027099003)(38350700014)(261026121527099003)(5023799004)(56012099006)(261009223027099003)(261021121427099003)(261022075727099003)(261022115727099003)(10067099003)(261102123227099003)(18002099003)(6133799003)(5113699003)(3023799007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Ch7Dri6e5Fh/E9iA0nSJgRMX4t338eCv5SK6JUs2Uv+eFiTaZHDjcLcIr6DX?= =?us-ascii?Q?itPTHhugf9rmVjtiRNd+lkqJDEuC1u3o6YldESek7gBv8cKrr6NJ8PFWtOPM?= =?us-ascii?Q?5iax6fSTZxwYoHJMEtzHxknbrMIg/5vp6kuc0DGl5aczM/YJrnjGyVsanwmP?= =?us-ascii?Q?rswXQm9JMTYUF0TG8iVVVR+PNmLJvTOQeda2EI/DK/pdrDBJojdr2Em6CNiB?= =?us-ascii?Q?82kDMypxE7zhpYoaKSCl9tPATbGWmjwvAfmY4DR9p3PvwRrRsXnwpEd4jA7w?= =?us-ascii?Q?mGo4QDslWcD9fHtDdeWbNyuZpB/q0sg0TC12ug4lgNe6p8dpC5SJxS5Zafgi?= =?us-ascii?Q?pSCKwKvAUxpHwClbKyhMmN/j3xPkTKETrRa+wBUCzPZkPZf5gdMyEYxdNeOe?= =?us-ascii?Q?EXx3GNiuPrvVKw6HNpmqI3otTE0TEK2yPEgyLqQqcj3dA7GK/VDj5cKUly8f?= =?us-ascii?Q?IY+7yqCGyklQn4OLMHZKfDgF8vKrVy6Rp8QV8W0TfkDlADAi94qscL1hF4Ul?= =?us-ascii?Q?KEpXw+DGhYl9a++WwQK9QXr7EFDpxZgyv8EoUS3v8ezdZWVGLsVo+01fehmJ?= =?us-ascii?Q?0BwpE/4bEv86lyO4yGewLS6Amg2zuLienWndj1Mi4DQCpj53Kpsn3Ilcm7cH?= =?us-ascii?Q?CaCHMR2yj7tA4gBzZFUaJjwgA0FhQIxL1rZokHVAHeeHoUar2IXLWhOSlOqN?= =?us-ascii?Q?ekWD2lkl6wpITtuKs8C183lS5vRqZ3SDVXdL2AUpPkGlg9AVjHmChp4h5BXI?= =?us-ascii?Q?5m/T8JPQ2m0tzRM5t5vtwY3au90VB0mJ0nrPKCqPvL2bIDaJvTJIltMGg7bl?= =?us-ascii?Q?uXL/0HkUE4Yr1sPtCZYxtvI7LQ6Pwlc/cdDMFB71LeWkEtgCfa4CfCY1xl2x?= =?us-ascii?Q?g/3I+Hb6xJSPEh88mHismDjDYOukYQcGay4FjxVRy/UYYzZ90VwtlBnx4p7m?= =?us-ascii?Q?nzFOiPFB9bIMVlEwHKBTgTo1nOB6SzDnvdeebu76t+2x/znf8p3fnYDr6QhM?= =?us-ascii?Q?9nnyCFanV6eDirnRcBh/AXdsQFCsMuE1qHyBljuJNiXDOoxSkOK5JbbTTRNr?= =?us-ascii?Q?q7UalkBYr5ifDuLspDZbeetqz1T70tRkq9t18naF0Pdtab4HzHj9sLpY+s5e?= =?us-ascii?Q?cuYNVRAWJScaL63Obqw5wJAeT2DfMGxNN+NvkzLokeMP+B2R2+mYjZHTiAJb?= =?us-ascii?Q?X/wpEweiT3fWqP9nRoKVZuCToTyGIbE2RVXfH/nRAsrhJUvHnMuV/Lv1NM9K?= =?us-ascii?Q?yKHa3qKVsAI6ArePGPn28vwDkOuFRNgwzxR3L+Y/vz/rYCW+PCIIiMrbnB5J?= =?us-ascii?Q?xDkHgA2lZDLufm+Ite0H2fCPLxkH9YlKcegcsnygYpcpEBXBbxZxyV6O3n9s?= =?us-ascii?Q?1mZAVaILJLUzPMVLOXgnDFNjxC/fAP4u0mH3JRyASrWxRm/3HBteeXYf5q2y?= =?us-ascii?Q?4EaxLSlHsuG0PVWgSH4UEVTymJqMIj8mr0v2ip4MehaGdqDXsz/aEGmyyjBj?= =?us-ascii?Q?EMWt1StTkx4nt1FJx4WeQIm9CECXpmo+NeO/7PgIkQlk7iOZrcqitoxd5C3S?= =?us-ascii?Q?wGcOqIj5JLqMK1pVRzS9mWRzWUhnEyqORYyEetNwC7yz1lO1nYg49kUvKOTg?= =?us-ascii?Q?IItb/CYSpZb/p0RhYorvPKf3d5HX92wqcmnfcN7e6/80rC6DaUQ7dfpIOd3J?= =?us-ascii?Q?yl4hNE9r5ofSyW/TfGQVu6ASyhJH294w4IkUJ2kfrfem212EBb/aI1UvbAME?= =?us-ascii?Q?80z3Ej837QyOOnhht2ro8hD0lbujA9w=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1c8c661c-3898-4384-98f4-08df38f58d80 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 15:25:40.3336 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: XqnhA4SFJEblY/zAAPnJDk94Kte+W60M6cswxUk5ZJWYwuE1AVsZuOAHVunLvLNJNLhBpgdf7gqyAMGuL2OdLW9tfpeMQ7cz0PScMCYTRQM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3PR08MB5788 Our x86_64 firmwares are built from OvmfPkgIa32X64.dsc, i.e. 32-bit PEI and 64-bit DXE, with PcdUse5LevelPageTable=TRUE on the 4MB images. The mixed-arch platform is a historical artifact: * edk2-build.vz was cloned from edk2-build.rhel-9 of rhel9-20230524 in Jan 2024, back when RHEL still built its secure-boot image from OvmfPkgIa32X64.dsc. Our PIIX builds were derived from that section; * RHEL moved the secure-boot build to OvmfPkgX64.dsc with the edk2-stable202311 rebase (rhel9-20231122-1). We imported that version in Jun 2024 but never carried the switch over into edk2-build.vz; * RHEL 10 later enabled PcdUse5LevelPageTable on top of its X64 builds. Our vz10 config picked the PCD up in Mar 2026 while staying on OvmfPkgIa32X64.dsc. That combination is wrong. In a 32-bit PEI the PCD is the only policy: DxeIpl enables 5-level paging on every CPU that has la57, regardless of the guest size. The 64-bit PEI instead runs PlatformSetupPagingLevel() (OvmfPkg/Library/PlatformInitLib/MemDetect.c, under MDE_CPU_X64), which picks the paging level per guest: * whatever "-fw_cfg name=opt/org.tianocore/PagingLevel" says (never set in VZ downstream); * OR 4-level paging while the guest address space stays below the threshold (1TiB edk2 upstream, 16TiB VZ downstream); * OR 5-level paging above the threshold. Handing a small guest over in 5-level paging mode buys nothing, as 4-level already covers 64TiB of firmware address space, and changes what the OS sees at ExitBootServices. This might lead to problems e.g. on Windows: it boots its LA57 kernel (ntkrla57.exe), which bugchecks on AMD guests that are exposed to the ARCH_CAPABILITIES MSR (VSTOR-152405) and breaks Windows Setup. We should simply never do 5-level paging on small guests. So switch all four 4MB builds (q35 SMM, PIIX no-SMM, and both debug variants) to OvmfPkgX64.dsc, arch X64, keeping the la57 PCD, which is exactly the RHEL 10 configuration. Output file names, the VARS layout and the firmware descriptors don't change. The 2MB PIIX build stays on OvmfPkgIa32X64.dsc. It is the legacy image for old VMs; it never had the la57 PCD and therefore always runs 4-level paging. NOTE: OvmfPkgX64.dsc also compiles in the confidential-computing code which OvmfPkgIa32X64.dsc stubs out (CcExitLib, TdxDxe, MemEncrypt libraries); it is inert on ordinary guests and is what RHEL ships. Fixes: fb4eb03891fe ("Add VZ build config edk2-build.vz") Fixes: 5236bf9a1655 ("Add debug builds to edk2-build.vz") Signed-off-by: Andrey Drobyshev --- edk2-build.vz | 51 +++++++++++++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 18 deletions(-) diff --git a/edk2-build.vz b/edk2-build.vz index a25b8f3..1be0961 100644 --- a/edk2-build.vz +++ b/edk2-build.vz @@ -31,8 +31,23 @@ SECURE_BOOT_ENABLE = TRUE SMM_REQUIRE = FALSE [pcds.la57] -# Enables LA57 (5-level page tables, 57-bit virtual address space, 128 PB) -# We enable it for 4MB builds to support large-memory configurations +# Allow 5-level paging in the firmware, following RHEL downstream. +# +# Only use together with OvmfPkgX64.dsc (64-bit PEI). Its PEI picks the +# paging level per guest: +# +# * whatever is set via "-fw_cfg name=opt/org.tianocore/PagingLevel" +# setting (not used in VZ downstream); +# * OR 4-level paging below the address space threshold (1TiB edk2 +# upstream, 16TiB VZ downstream); +# * OR 5-level paging above that threshold. +# +# The 32-bit PEI of OvmfPkgIa32X64.dsc has no such policy and forces +# 5-level paging on every la57 guest, which makes Windows boot its LA57 +# kernel. That is wrong and might lead to problems, particularly on AMD +# guests. +# +# See VSTOR-152405, VSTOR-152672 PcdUse5LevelPageTable = TRUE [pcds.nx.compat.x64] @@ -48,15 +63,15 @@ DEBUG_PRINT_ERROR_LEVEL = 0x8040004F # stateful ovmf builds (with vars in flash) [build.ovmf.4m.sb.smm] -desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot) -conf = OvmfPkg/OvmfPkgIa32X64.dsc -arch = IA32 X64 +desc = ovmf build (64-bit, 4MB, q35 only, needs smm, secure boot) +conf = OvmfPkg/OvmfPkgX64.dsc +arch = X64 opts = ovmf.common ovmf.4m ovmf.sb.smm pcds = nx.compat.x64 la57 -plat = Ovmf3264 +plat = OvmfX64 dest = RHEL-10/ovmf cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd cpy2 = FV/OVMF_VARS.fd OVMF_VARS.secboot.fd @@ -68,16 +83,16 @@ cpy4 = X64/EnrollDefaultKeys.efi [build.ovmf.4m.sb.nosmm] # PSBM-143808 -desc = ovmf build (32/64-bit, 4MB, piix, secure boot, no smm) -conf = OvmfPkg/OvmfPkgIa32X64.dsc -arch = IA32 X64 +desc = ovmf build (64-bit, 4MB, piix, secure boot, no smm) +conf = OvmfPkg/OvmfPkgX64.dsc +arch = X64 opts = ovmf.common ovmf.noshell ovmf.4m ovmf.sb.nosmm pcds = nx.compat.x64 la57 -plat = Ovmf3264 +plat = OvmfX64 dest = RHEL-10/ovmf cpy1 = FV/OVMF_CODE.fd OVMF_CODE_4M.fd cpy2 = FV/OVMF_VARS.fd OVMF_VARS_4M.fd @@ -125,9 +140,9 @@ cpy2 = FV/OVMF_VARS.fd OVMF_VARS.fd # Same as 4m.sb.smm Q35 build, but with debug output enabled [build.ovmf.debug.4m.sb.smm] -desc = ovmf debug build (32/64-bit, 4MB, q35 only, needs smm, secure boot) -conf = OvmfPkg/OvmfPkgIa32X64.dsc -arch = IA32 X64 +desc = ovmf debug build (64-bit, 4MB, q35 only, needs smm, secure boot) +conf = OvmfPkg/OvmfPkgX64.dsc +arch = X64 tgts = DEBUG opts = ovmf.common ovmf.4m @@ -135,7 +150,7 @@ opts = ovmf.common ovmf.verbose pcds = nx.compat.x64 la57 -plat = Ovmf3264 +plat = OvmfX64 dest = RHEL-10/ovmf cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd.debug cpy2 = FV/OVMF_VARS.fd OVMF_VARS.secboot.fd @@ -145,9 +160,9 @@ cpy2 = FV/OVMF_VARS.fd OVMF_VARS.secboot.fd [build.ovmf.debug.4m.sb.nosmm] # PSBM-143808 -desc = ovmf debug build (32/64-bit, 4MB, piix, secure boot, no smm) -conf = OvmfPkg/OvmfPkgIa32X64.dsc -arch = IA32 X64 +desc = ovmf debug build (64-bit, 4MB, piix, secure boot, no smm) +conf = OvmfPkg/OvmfPkgX64.dsc +arch = X64 tgts = DEBUG opts = ovmf.common ovmf.noshell @@ -156,7 +171,7 @@ opts = ovmf.common ovmf.verbose pcds = nx.compat.x64 la57 -plat = Ovmf3264 +plat = OvmfX64 dest = RHEL-10/ovmf cpy1 = FV/OVMF_CODE.fd OVMF_CODE_4M.fd.debug cpy2 = FV/OVMF_VARS.fd OVMF_VARS_4M.fd -- 2.47.1