* Wed Apr 05 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20230301gitf80f052277c8-2

- edk2-build-script-update.patch [bz#2183230]
- edk2-PcdDxeNxMemoryProtectionPolicy-update.patch [bz#2183230]
- Resolves: bz#2183230
  ([edk2] Instruction abort exception when booting a VM)

edk2-build.py

@@ -1,9 +1,13 @@
 #!/usr/bin/python3
+"""
+build helper script for edk2, see
+https://gitlab.com/kraxel/edk2-build-config
+
+"""
 import os
 import sys
-import glob
 import shutil
-import optparse
+import argparse
 import subprocess
 import configparser
 
@@ -11,18 +15,24 @@ rebase_prefix    = ""
 version_override = None
 release_date     = None
 
+# pylint: disable=unused-variable
 def check_rebase():
     """ detect 'git rebase -x edk2-build.py master' testbuilds """
     global rebase_prefix
     global version_override
+    gitdir = '.git'
 
-    if not os.path.exists('.git/rebase-merge/msgnum'):
+    if os.path.isfile(gitdir):
-        return ""
+        with open(gitdir, 'r', encoding = 'utf-8') as f:
-    with open('.git/rebase-merge/msgnum', 'r') as f:
+            (unused, gitdir) = f.read().split()
+
+    if not os.path.exists(f'{gitdir}/rebase-merge/msgnum'):
+        return
+    with open(f'{gitdir}/rebase-merge/msgnum', 'r', encoding = 'utf-8') as f:
         msgnum = int(f.read())
-    with open('.git/rebase-merge/end', 'r') as f:
+    with open(f'{gitdir}/rebase-merge/end', 'r', encoding = 'utf-8') as f:
         end = int(f.read())
-    with open('.git/rebase-merge/head-name', 'r') as f:
+    with open(f'{gitdir}/rebase-merge/head-name', 'r', encoding = 'utf-8') as f:
         head = f.read().strip().split('/')
 
     rebase_prefix = f'[ {int(msgnum/2)} / {int(end/2)} - {head[-1]} ] '
@@ -33,8 +43,14 @@ def check_rebase():
 def get_coredir(cfg):
     if cfg.has_option('global', 'core'):
         return os.path.abspath(cfg['global']['core'])
-    else:
+    return os.getcwd()
-        return os.getcwd()
+
+def get_toolchain(cfg, build):
+    if cfg.has_option(build, 'tool'):
+        return cfg[build]['tool']
+    if cfg.has_option('global', 'tool'):
+        return cfg['global']['tool']
+    return 'GCC5'
 
 def get_version(cfg):
     coredir = get_coredir(cfg)
@@ -44,15 +60,18 @@ def get_version(cfg):
         print(f'### version [override]: {version}')
         return version
     if os.environ.get('RPM_PACKAGE_NAME'):
-        version = os.environ.get('RPM_PACKAGE_NAME');
+        version = os.environ.get('RPM_PACKAGE_NAME')
-        version += '-' + os.environ.get('RPM_PACKAGE_VERSION');
+        version += '-' + os.environ.get('RPM_PACKAGE_VERSION')
-        version += '-' + os.environ.get('RPM_PACKAGE_RELEASE');
+        version += '-' + os.environ.get('RPM_PACKAGE_RELEASE')
         print('')
         print(f'### version [rpmbuild]: {version}')
         return version
     if os.path.exists(coredir + '/.git'):
-        cmdline = [ 'git', 'describe', '--tags', '--abbrev=8', '--match=edk2-stable*' ]
+        cmdline = [ 'git', 'describe', '--tags', '--abbrev=8',
-        result = subprocess.run(cmdline, stdout = subprocess.PIPE, cwd = coredir)
+                    '--match=edk2-stable*' ]
+        result = subprocess.run(cmdline, cwd = coredir,
+                                stdout = subprocess.PIPE,
+                                check = True)
         version = result.stdout.decode().strip()
         print('')
         print(f'### version [git]: {version}')
@@ -68,7 +87,7 @@ def pcd_version(cfg):
         return []
     return [ '--pcd', pcd_string('PcdFirmwareVersionString', version) ]
 
-def pcd_release_date(cfg):
+def pcd_release_date():
     if release_date is None:
         return []
     return [ '--pcd', pcd_string('PcdFirmwareReleaseDateString', release_date) ]
@@ -85,13 +104,13 @@ def build_message(line, line2 = None):
     print(f'### {rebase_prefix}{line}')
     if line2:
         print(f'### {line2}')
-    print('###')
+    print('###', flush = True)
 
 def build_run(cmdline, name, section, silent = False):
-    print(cmdline)
+    print(cmdline, flush = True)
     if silent:
         print('### building in silent mode ...', flush = True)
-        result = subprocess.run(cmdline,
+        result = subprocess.run(cmdline, check = False,
                                 stdout = subprocess.PIPE,
                                 stderr = subprocess.STDOUT)
 
@@ -108,13 +127,14 @@ def build_run(cmdline, name, section, silent = False):
         else:
             print('### OK')
     else:
-        result = subprocess.run(cmdline)
+        result = subprocess.run(cmdline, check = False)
     if result.returncode:
-        print(f'ERROR: {cmdline[0]} exited with {result.returncode} while building {name}')
+        print(f'ERROR: {cmdline[0]} exited with {result.returncode}'
+              f' while building {name}')
         sys.exit(result.returncode)
 
-def build_copy(plat, tgt, dstdir, copy):
+def build_copy(plat, tgt, toolchain, dstdir, copy):
-    srcdir = f'Build/{plat}/{tgt}_GCC5'
+    srcdir = f'Build/{plat}/{tgt}_{toolchain}'
     names = copy.split()
     srcfile = names[0]
     if len(names) > 1:
@@ -140,72 +160,73 @@ def pad_file(dstdir, pad):
         dstdir + '/' + name,
     ]
     print(f'# padding: {dstdir} / {name}  =>  {size}')
-    subprocess.run(cmdline)
+    subprocess.run(cmdline, check = True)
 
+# pylint: disable=too-many-branches
 def build_one(cfg, build, jobs = None, silent = False):
-    cmdline  = [ 'build' ]
+    b = cfg[build]
-    cmdline += [ '-t', 'GCC5' ]
-    cmdline += [ '-p', cfg[build]['conf'] ]
 
-    if (cfg[build]['conf'].startswith('OvmfPkg/') or
+    cmdline  = [ 'build' ]
-        cfg[build]['conf'].startswith('ArmVirtPkg/')):
+    cmdline += [ '-t', get_toolchain(cfg, build) ]
+    cmdline += [ '-p', b['conf'] ]
+
+    if (b['conf'].startswith('OvmfPkg/') or
+        b['conf'].startswith('ArmVirtPkg/')):
         cmdline += pcd_version(cfg)
-        cmdline += pcd_release_date(cfg)
+        cmdline += pcd_release_date()
 
     if jobs:
         cmdline += [ '-n', jobs ]
-    for arch in cfg[build]['arch'].split():
+    for arch in b['arch'].split():
         cmdline += [ '-a', arch ]
-    if 'opts' in cfg[build]:
+    if 'opts' in b:
-        for name in cfg[build]['opts'].split():
+        for name in b['opts'].split():
             section = 'opts.' + name
             for opt in cfg[section]:
                 cmdline += [ '-D', opt + '=' + cfg[section][opt] ]
-    if 'pcds' in cfg[build]:
+    if 'pcds' in b:
-        for name in cfg[build]['pcds'].split():
+        for name in b['pcds'].split():
             section = 'pcds.' + name
             for pcd in cfg[section]:
                 cmdline += [ '--pcd', pcd + '=' + cfg[section][pcd] ]
-    if 'tgts' in cfg[build]:
+    if 'tgts' in b:
-        tgts = cfg[build]['tgts'].split()
+        tgts = b['tgts'].split()
     else:
         tgts = [ 'DEBUG' ]
     for tgt in tgts:
         desc = None
-        if 'desc' in cfg[build]:
+        if 'desc' in b:
-            desc = cfg[build]['desc']
+            desc = b['desc']
-        build_message(f'building: {cfg[build]["conf"]} ({cfg[build]["arch"]}, {tgt})',
+        build_message(f'building: {b["conf"]} ({b["arch"]}, {tgt})',
                       f'description: {desc}')
         build_run(cmdline + [ '-b', tgt ],
-                  cfg[build]['conf'],
+                  b['conf'],
                   build + '.' + tgt,
                   silent)
 
-        if 'plat' in cfg[build]:
+        if 'plat' in b:
             # copy files
-            for cpy in cfg[build]:
+            for cpy in b:
                 if not cpy.startswith('cpy'):
                     continue
-                build_copy(cfg[build]['plat'],
+                build_copy(b['plat'], tgt,
-                           tgt,
+                           get_toolchain(cfg, build),
-                           cfg[build]['dest'],
+                           b['dest'], b[cpy])
-                           cfg[build][cpy])
             # pad builds
-            for pad in cfg[build]:
+            for pad in b:
                 if not pad.startswith('pad'):
                     continue
-                pad_file(cfg[build]['dest'],
+                pad_file(b['dest'], b[pad])
-                         cfg[build][pad])
 
 def build_basetools(silent = False):
-    build_message(f'building: BaseTools')
+    build_message('building: BaseTools')
     basedir = os.environ['EDK_TOOLS_PATH']
     cmdline = [ 'make', '-C', basedir ]
     build_run(cmdline, 'BaseTools', 'build.basetools', silent)
 
 def binary_exists(name):
-    for dir in os.environ['PATH'].split(':'):
+    for pdir in os.environ['PATH'].split(':'):
-        if os.path.exists(dir + '/' + name):
+        if os.path.exists(pdir + '/' + name):
             return True
     return False
 
@@ -227,8 +248,8 @@ def prepare_env(cfg):
         packages.append(coredir)
 
     # add basetools to path
-    for dir in dirs:
+    for pdir in dirs:
-        p = coredir + '/' + dir
+        p = coredir + '/' + pdir
         if not os.path.exists(p):
             continue
         if p in path:
@@ -236,12 +257,12 @@ def prepare_env(cfg):
         path.insert(0, p)
 
     # run edksetup if needed
-    toolsdef = coredir + '/Conf/tools_def.txt';
+    toolsdef = coredir + '/Conf/tools_def.txt'
     if not os.path.exists(toolsdef):
         os.makedirs(os.path.dirname(toolsdef), exist_ok = True)
         build_message('running BaseTools/BuildEnv')
-        cmdline = [ 'sh', 'BaseTools/BuildEnv' ]
+        cmdline = [ 'bash', 'BaseTools/BuildEnv' ]
-        subprocess.run(cmdline, cwd = coredir)
+        subprocess.run(cmdline, cwd = coredir, check = True)
 
     # set variables
     os.environ['PATH'] = ':'.join(path)
@@ -255,11 +276,15 @@ def prepare_env(cfg):
     # for cross builds
     if binary_exists('arm-linux-gnu-gcc'):
         os.environ['GCC5_ARM_PREFIX'] = 'arm-linux-gnu-'
-    if binary_exists('aarch64-linux-gnu-gcc'):
+    if binary_exists('loongarch64-linux-gnu-gcc'):
+        os.environ['GCC5_LOONGARCH64_PREFIX'] = 'loongarch64-linux-gnu-'
+
+    hostarch = os.uname().machine
+    if binary_exists('aarch64-linux-gnu-gcc') and hostarch != 'aarch64':
         os.environ['GCC5_AARCH64_PREFIX'] = 'aarch64-linux-gnu-'
-    if binary_exists('riscv64-linux-gnu-gcc'):
+    if binary_exists('riscv64-linux-gnu-gcc') and hostarch != 'riscv64':
         os.environ['GCC5_RISCV64_PREFIX'] = 'riscv64-linux-gnu-'
-    if binary_exists('x86_64-linux-gnu-gcc'):
+    if binary_exists('x86_64-linux-gnu-gcc') and hostarch != 'x86_64':
         os.environ['GCC5_IA32_PREFIX'] = 'x86_64-linux-gnu-'
         os.environ['GCC5_X64_PREFIX'] = 'x86_64-linux-gnu-'
         os.environ['GCC5_BIN'] = 'x86_64-linux-gnu-'
@@ -275,30 +300,60 @@ def build_list(cfg):
         print(f'# {name:20s} - {desc}')
 
 def main():
-    parser = optparse.OptionParser()
+    parser = argparse.ArgumentParser(prog = 'edk2-build',
-    parser.add_option('-c', '--config', dest = 'configfile',
+                                     description = 'edk2 build helper script')
-                      type = 'string', default = '.edk2.builds')
+    parser.add_argument('-c', '--config', dest = 'configfile',
-    parser.add_option('-C', '--directory', dest = 'directory', type = 'string')
+                        type = str, default = '.edk2.builds', metavar = 'FILE',
-    parser.add_option('-j', '--jobs', dest = 'jobs', type = 'string')
+                        help = 'read configuration from FILE (default: .edk2.builds)')
-    parser.add_option('-m', '--match', dest = 'match', type = 'string')
+    parser.add_argument('-C', '--directory', dest = 'directory', type = str,
-    parser.add_option('-l', '--list', dest = 'list', action = 'store_true', default = False)
+                        help = 'change to DIR before building', metavar = 'DIR')
-    parser.add_option('--silent', dest = 'silent', action = 'store_true', default = False)
+    parser.add_argument('-j', '--jobs', dest = 'jobs', type = str,
-    parser.add_option('--core', dest = 'core', type = 'string')
+                        help = 'allow up to JOBS parallel build jobs',
-    parser.add_option('--pkg', '--package', dest = 'pkgs', type = 'string', action = 'append')
+                        metavar = 'JOBS')
-    parser.add_option('--version-override', dest = 'version_override', type = 'string')
+    parser.add_argument('-m', '--match', dest = 'match', type = str,
-    parser.add_option('--release-date', dest = 'release_date', type = 'string')
+                        help = 'only run builds matching INCLUDE (substring)',
-    (options, args) = parser.parse_args()
+                        metavar = 'INCLUDE')
+    parser.add_argument('-x', '--exclude', dest = 'exclude', type = str,
+                        help = 'skip builds matching EXCLUDE (substring)',
+                        metavar = 'EXCLUDE')
+    parser.add_argument('-l', '--list', dest = 'list',
+                        action = 'store_true', default = False,
+                        help = 'list build configs available')
+    parser.add_argument('--silent', dest = 'silent',
+                        action = 'store_true', default = False,
+                        help = 'write build output to logfiles, '
+                        'write to console only on errors')
+    parser.add_argument('--core', dest = 'core', type = str, metavar = 'DIR',
+                        help = 'location of the core edk2 repository '
+                        '(i.e. where BuildTools are located)')
+    parser.add_argument('--pkg', '--package', dest = 'pkgs',
+                        type = str, action = 'append', metavar = 'DIR',
+                        help = 'location(s) of additional packages '
+                        '(can be specified multiple times)')
+    parser.add_argument('-t', '--toolchain', dest = 'toolchain', type = str, metavar = 'NAME',
+                        help = 'tool chain to be used to build edk2')
+    parser.add_argument('--version-override', dest = 'version_override',
+                        type = str, metavar = 'VERSION',
+                        help = 'set firmware build version')
+    parser.add_argument('--release-date', dest = 'release_date',
+                        type = str, metavar = 'DATE',
+                        help = 'set firmware build release date (in MM/DD/YYYY format)')
+    options = parser.parse_args()
 
     if options.directory:
         os.chdir(options.directory)
 
+    if not os.path.exists(options.configfile):
+        print('config file "{options.configfile}" not found')
+        return 1
+
     cfg = configparser.ConfigParser()
     cfg.optionxform = str
     cfg.read(options.configfile)
 
     if options.list:
         build_list(cfg)
-        return
+        return 0
 
     if not cfg.has_section('global'):
         cfg.add_section('global')
@@ -306,6 +361,8 @@ def main():
         cfg.set('global', 'core', options.core)
     if options.pkgs:
         cfg.set('global', 'pkgs', ' '.join(options.pkgs))
+    if options.toolchain:
+        cfg.set('global', 'tool', options.toolchain)
 
     global version_override
     global release_date
@@ -323,7 +380,12 @@ def main():
         if options.match and options.match not in build:
             print(f'# skipping "{build}" (not matching "{options.match}")')
             continue
+        if options.exclude and options.exclude in build:
+            print(f'# skipping "{build}" (matching "{options.exclude}")')
+            continue
         build_one(cfg, build, options.jobs, options.silent)
 
+    return 0
+
 if __name__ == '__main__':
     sys.exit(main())

edk2-build.rhel-9

@@ -27,6 +27,12 @@ DEBUG_PRINT_ERROR_LEVEL  = 0x8040004F
 [opts.armvirt.silent]
 DEBUG_PRINT_ERROR_LEVEL  = 0x80000000
 
+[pcds.nx.strict]
+PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD5
+
+[pcds.nx.broken.grub]
+# grub.efi uses EfiLoaderData for code
+PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD1
 
 #####################################################################
 # stateful ovmf builds (with vars in flash)
@@ -89,6 +95,7 @@ conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = AARCH64
 opts = ovmf.common
        armvirt.verbose
+pcds = nx.broken.grub
 plat = ArmVirtQemu-AARCH64
 dest = RHEL-9/aarch64
 cpy1 = FV/QEMU_EFI.fd
@@ -104,6 +111,7 @@ conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = AARCH64
 opts = ovmf.common
        armvirt.silent
+pcds = nx.broken.grub
 plat = ArmVirtQemu-AARCH64
 dest = RHEL-9/aarch64
 cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.silent.fd

edk2.spec

@@ -16,7 +16,7 @@ ExclusiveArch: x86_64 aarch64
 
 Name:       edk2
 Version:    %{GITDATE}git%{GITCOMMIT}
-Release:    1%{?dist}
+Release:    2%{?dist}
 Summary:    UEFI firmware for 64-bit virtual machines
 License:    BSD-2-Clause-Patent and OpenSSL and MIT
 URL:        http://www.tianocore.org
@@ -375,6 +375,12 @@ install -m 0644 \
 
 
 %changelog
+* Wed Apr 05 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20230301gitf80f052277c8-2
+- edk2-build-script-update.patch [bz#2183230]
+- edk2-PcdDxeNxMemoryProtectionPolicy-update.patch [bz#2183230]
+- Resolves: bz#2183230
+  ([edk2] Instruction abort exception when booting a VM)
+
 * Wed Mar 22 2023 Miroslav Rezanina <mrezanin@redaht.com> - 20230301gitf80f052277c8-1
 - Rebase to edk2-stable202302 [RHEL-266]
   Resolves: RHEL-266