Beat
EDK2
EDK2/OVMF firmware news
OVMF refuses Secure Boot on QEMU pflash without SMM
When UEFI variables sit in QEMU flash and Secure Boot is on, OVMF used to keep booting even if SMM was not guarding that flash. Anything that can rewrite the flash could then change Secure Boot keys. The pflash driver now stops dead on that setup.
OVMF could hang fetching the SEV-ES encryption mask
SEV-ES is AMD's guest memory encryption. OVMF used to fetch that encryption mask through a path that could turn interrupts back on during a hypervisor exit, and a CPU jump table could overwrite the same early data.
OVMF now reserves a larger default MMIO window
QEMU's UEFI firmware picks a chunk of guest physical address space for device MMIO. The default dynamic window is now a quarter of that space instead of an eighth, so a guest with several GPUs can map them.
The measured-boot confirm prompt is now a separate library
The firmware prompt that asks a person to confirm a measured-boot change used to live inside the TCG library. That prompt is now its own library so a platform can swap the UI without rewriting the TCG path.
Measured-boot logs can grow when they used to stop
Firmware that records measured-boot events used to stop writing when the event log filled. The SecurityPkg change now grows that log so a long boot with large hashes does not drop events.
EDK II's August 2026 stable is out
Tianocore tagged the quarterly EDK II snapshot that QEMU firmware and other UEFI platforms take. Out-of-tree platforms have to pick up library moves and a shared GPT parser that the tag lists as source-level breaks.