iPXE pins its 32-bit build to -march=i386 but passes no -march for x86_64,
so the EFI drivers inherit the builder's GCC default, which is x86-64-v3 on
AlmaLinux 10. The -mno-mmx -mno-sse that iPXE does pass is no protection:
BMI1/BMI2 operate on general purpose registers, and GCC emits tzcnt, andn,
shlx and bzhi anyway. ipxe-roms-qemu and ipxe-bootimgs-x86 are noarch and
shared by the x86_64 and x86_64_v2 repositories, so both ship v3 code and
fail with #UD on a v2-only CPU - the EFI half of each combined option ROM
is what OVMF loads.
No patch is needed: src/Makefile.housekeeping already does
"CFLAGS += $(WORKAROUND_CFLAGS) $(EXTRA_CFLAGS)", so passing EXTRA_CFLAGS
through the spec's make_ipxe helper is enough. It is deliberately applied
to the two bin-x86_64-efi invocations only, not inside the helper itself:
bin/undionly.kpxe and bin/*.rom are i386 targets (-m32 -march=i386) and
would fail to compile. bin-arm64-efi is unaffected.
Same root cause as the edk2 side of the issue, see autopatch/edk2.
rpms/edk2#1
ce61bbdcac