| 4 |
4 |
EAPI=8
|
| 5 |
5 |
|
| 6 |
6 |
PYTHON_REQ_USE="sqlite"
|
| 7 |
|
PYTHON_COMPAT=( python3_{12..13} )
|
|
7 |
PYTHON_COMPAT=( python3_{12..14} )
|
| 8 |
8 |
|
| 9 |
9 |
inherit edo prefix python-any-r1 readme.gentoo-r1 secureboot toolchain-funcs
|
| 10 |
10 |
|
| 11 |
11 |
DESCRIPTION="TianoCore EDK II UEFI firmware for virtual machines"
|
| 12 |
12 |
HOMEPAGE="https://github.com/tianocore/edk2"
|
| 13 |
13 |
|
| 14 |
|
DBXDATE="05092023" # MMDDYYYY
|
| 15 |
|
BUNDLED_BROTLI_SUBMODULE_SHA="f4153a09f87cbb9c826d8fc12c74642bb2d879ea"
|
|
14 |
BUNDLED_BROTLI_SUBMODULE_SHA="e230f474b87134e8c6c85b630084c612057f253e"
|
| 16 |
15 |
BUNDLED_LIBFDT_SUBMODULE_SHA="cfff805481bdea27f900c32698171286542b8d3c"
|
| 17 |
16 |
BUNDLED_LIBSPDM_SUBMODULE_SHA="98ef964e1e9a0c39c7efb67143d3a13a819432e0"
|
| 18 |
17 |
BUNDLED_MBEDTLS_SUBMODULE_SHA="8c89224991adff88d53cd380f42a2baa36f91454"
|
| 19 |
18 |
BUNDLED_MIPI_SYS_T_SUBMODULE_SHA="370b5944c046bab043dd8b133727b2135af7747a"
|
| 20 |
|
BUNDLED_OPENSSL_SUBMODULE_P="openssl-3.4.1"
|
|
19 |
BUNDLED_OPENSSL_SUBMODULE_P="openssl-3.5.1"
|
|
20 |
|
|
21 |
SBO_VER="1.6.3" # https://github.com/microsoft/secureboot_objects/releases
|
|
22 |
DBX_URI="https://github.com/microsoft/secureboot_objects/raw/refs/tags/v${SBO_VER}/PostSignedObjects/DBX/@ARCH@/DBXUpdate.bin -> @ARCH@_DBXUpdate_v${SBO_VER}.bin"
|
| 21 |
23 |
|
| 22 |
24 |
SRC_URI="
|
| 23 |
25 |
https://github.com/tianocore/${PN}/archive/${PN}-stable${PV}.tar.gz
|
| ... | ... | |
| 32 |
34 |
-> mipi-sys-t-${BUNDLED_MIPI_SYS_T_SUBMODULE_SHA}.tar.gz
|
| 33 |
35 |
https://github.com/openssl/openssl/releases/download/${BUNDLED_OPENSSL_SUBMODULE_P}/${BUNDLED_OPENSSL_SUBMODULE_P}.tar.gz
|
| 34 |
36 |
|
| 35 |
|
amd64? (
|
| 36 |
|
https://uefi.org/sites/default/files/resources/x64_DBXUpdate_${DBXDATE}.bin
|
| 37 |
|
https://uefi.org/sites/default/files/resources/x64_DBXUpdate.bin -> x64_DBXUpdate_${DBXDATE}.bin
|
| 38 |
|
)
|
|
37 |
amd64? ( ${DBX_URI//@ARCH@/amd64} )
|
|
38 |
arm64? ( ${DBX_URI//@ARCH@/arm64} )
|
| 39 |
39 |
|
| 40 |
|
arm64? (
|
| 41 |
|
https://uefi.org/sites/default/files/resources/arm64_DBXUpdate_${DBXDATE}.bin
|
| 42 |
|
https://uefi.org/sites/default/files/resources/arm64_DBXUpdate.bin -> arm64_DBXUpdate_${DBXDATE}.bin
|
|
40 |
!amd64? (
|
| 43 |
41 |
https://github.com/devicetree-org/pylibfdt/archive/${BUNDLED_LIBFDT_SUBMODULE_SHA}.tar.gz
|
| 44 |
42 |
-> pylibfdt-${BUNDLED_LIBFDT_SUBMODULE_SHA}.tar.gz
|
| 45 |
43 |
)
|
| ... | ... | |
| 48 |
46 |
S="${WORKDIR}/${PN}-${PN}-stable${PV}"
|
| 49 |
47 |
LICENSE="BSD-2-with-patent MIT"
|
| 50 |
48 |
SLOT="0"
|
| 51 |
|
KEYWORDS="-* amd64 ~loong ~riscv"
|
|
49 |
KEYWORDS="-* ~amd64 ~arm64 ~loong ~riscv"
|
| 52 |
50 |
|
| 53 |
51 |
BDEPEND="
|
| 54 |
52 |
${PYTHON_DEPS}
|
| ... | ... | |
| 63 |
61 |
"
|
| 64 |
62 |
|
| 65 |
63 |
PATCHES=(
|
| 66 |
|
"${FILESDIR}/${PN}-202411-werror.patch"
|
| 67 |
|
"${FILESDIR}/${PN}-202408-binutils-2.41-textrels.patch"
|
| 68 |
|
"${FILESDIR}/edk2-202502-nasm-3.patch"
|
|
64 |
"${FILESDIR}/${PN}-202511-werror.patch"
|
|
65 |
"${FILESDIR}/${PN}-202502-nasm-3.patch"
|
|
66 |
"${FILESDIR}/${PN}-202505-UninstallMemAttrProtocol.patch"
|
| 69 |
67 |
)
|
| 70 |
68 |
|
| 71 |
69 |
DISABLE_AUTOFORMATTING="true"
|
| ... | ... | |
| 89 |
87 |
arm64)
|
| 90 |
88 |
TARGET_ARCH="AARCH64"
|
| 91 |
89 |
QEMU_ARCH="aarch64"
|
| 92 |
|
ARCH_DIRS="${DIR}/ArmVirtQemu-AARCH64"
|
|
90 |
ARCH_DIRS="${DIR}/ArmVirtQemu-AArch64"
|
| 93 |
91 |
UNIT0="QEMU_EFI.qcow2"
|
| 94 |
92 |
UNIT1="QEMU_VARS.qcow2"
|
| 95 |
93 |
FMT="qcow2"
|
| ... | ... | |
| 161 |
159 |
link_mod "${WORKDIR}/${BUNDLED_OPENSSL_SUBMODULE_P}" \
|
| 162 |
160 |
CryptoPkg/Library/OpensslLib/openssl
|
| 163 |
161 |
|
| 164 |
|
use arm64 &&
|
|
162 |
[[ -e ${DISTDIR}/pylibfdt-${BUNDLED_LIBFDT_SUBMODULE_SHA}.tar.gz ]] &&
|
| 165 |
163 |
link_mod "${WORKDIR}/pylibfdt-${BUNDLED_LIBFDT_SUBMODULE_SHA}" \
|
| 166 |
164 |
MdePkg/Library/BaseFdtLib/libfdt
|
| 167 |
165 |
|
| ... | ... | |
| 171 |
169 |
hprefixify "${FILESDIR}"/descriptors/*.json
|
| 172 |
170 |
}
|
| 173 |
171 |
|
| 174 |
|
mybuild() {
|
|
172 |
my_build() {
|
| 175 |
173 |
edo build \
|
| 176 |
174 |
-t "${TOOLCHAIN}" \
|
| 177 |
175 |
-b "${BUILD_TARGET}" \
|
|
176 |
-a "${TARGET_ARCH}" \
|
| 178 |
177 |
-D NETWORK_HTTP_BOOT_ENABLE \
|
| 179 |
178 |
-D NETWORK_IP6_ENABLE \
|
| 180 |
179 |
-D NETWORK_TLS_ENABLE \
|
| ... | ... | |
| 185 |
184 |
"${@}"
|
| 186 |
185 |
}
|
| 187 |
186 |
|
|
187 |
sb_build() {
|
|
188 |
# DO NOT enable the shell with Secure Boot as it can be used as a bypass!
|
|
189 |
my_build \
|
|
190 |
-D BUILD_SHELL=FALSE \
|
|
191 |
-D SECURE_BOOT_ENABLE \
|
|
192 |
--pcd PcdDxeNxMemoryProtectionPolicy=0xC000000000007FD5 \
|
|
193 |
--pcd PcdImageProtectionPolicy=0x03 \
|
|
194 |
--pcd PcdNullPointerDetectionPropertyMask=0x03 \
|
|
195 |
--pcd PcdSetNxForStack=TRUE \
|
|
196 |
--pcd PcdUninstallMemAttrProtocol=FALSE \
|
|
197 |
"${@}"
|
|
198 |
}
|
|
199 |
|
| 188 |
200 |
# Add the MS and Red Hat Secure Boot certificates and update the revocation list
|
| 189 |
|
# for the given architecture in the given raw variables image.
|
| 190 |
|
mk_fw_vars() {
|
| 191 |
|
edo virt-fw-vars \
|
| 192 |
|
--set-dbx "${DISTDIR}/$1_DBXUpdate_${DBXDATE}.bin" \
|
| 193 |
|
--secure-boot --enroll-redhat --inplace "$2"
|
|
201 |
# in the given raw variable images.
|
|
202 |
mk_fw_vars_raw() {
|
|
203 |
local input args=() dbx="${DISTDIR}/${ARCH}_DBXUpdate_v${SBO_VER}.bin"
|
|
204 |
[[ -e ${dbx} ]] && args+=( --set-dbx "${dbx}" )
|
|
205 |
|
|
206 |
for input; do
|
|
207 |
edo virt-fw-vars --secure-boot --enroll-redhat "${args[@]}" \
|
|
208 |
--inplace "${input}"
|
|
209 |
done
|
|
210 |
}
|
|
211 |
|
|
212 |
# Write the MS and Red Hat Secure Boot certificates and the revocation list to a
|
|
213 |
# JSON file for QEMU.
|
|
214 |
mk_fw_vars_json() {
|
|
215 |
local args=() dbx="${DISTDIR}/${ARCH}_DBXUpdate_v${SBO_VER}.bin"
|
|
216 |
[[ -e ${dbx} ]] && args+=( --set-dbx "${dbx}" )
|
|
217 |
|
|
218 |
edo virt-fw-vars --secure-boot --enroll-redhat "${args[@]}" \
|
|
219 |
--output-json "${S}/${ARCH}.qemuvars.json"
|
| 194 |
220 |
}
|
| 195 |
221 |
|
| 196 |
222 |
# Convert the given images from raw to QCOW2 and resize them to the amount given
|
| ... | ... | |
| 206 |
232 |
done
|
| 207 |
233 |
}
|
| 208 |
234 |
|
| 209 |
|
nx_strict_args() {
|
| 210 |
|
"${@}" \
|
| 211 |
|
--pcd PcdDxeNxMemoryProtectionPolicy=0xC000000000007FD5 \
|
| 212 |
|
--pcd PcdImageProtectionPolicy=0x03 \
|
| 213 |
|
--pcd PcdNullPointerDetectionPropertyMask=0x03 \
|
| 214 |
|
--pcd PcdSetNxForStack=TRUE
|
| 215 |
|
}
|
| 216 |
|
|
| 217 |
235 |
src_compile() {
|
| 218 |
236 |
TOOLCHAIN="GCC5"
|
| 219 |
237 |
BUILD_TARGET="RELEASE"
|
| ... | ... | |
| 233 |
251 |
|
| 234 |
252 |
. ./edksetup.sh
|
| 235 |
253 |
|
| 236 |
|
# DO NOT enable the shell with Secure Boot as it can be used as a bypass!
|
| 237 |
|
|
| 238 |
254 |
case "${ARCH}" in
|
| 239 |
255 |
amd64)
|
| 240 |
|
BUILD_ARGS+=(
|
| 241 |
|
# shim.efi has broken MemAttr code
|
| 242 |
|
--pcd PcdUninstallMemAttrProtocol=TRUE
|
| 243 |
|
)
|
| 244 |
|
|
| 245 |
256 |
local SIZE
|
| 246 |
257 |
for SIZE in _2M _4M; do
|
| 247 |
|
nx_strict_args mybuild -a X64 -p OvmfPkg/OvmfPkgX64.dsc \
|
|
258 |
sb_build -p OvmfPkg/OvmfPkgX64.dsc \
|
| 248 |
259 |
-D FD_SIZE${SIZE}B \
|
| 249 |
|
-D BUILD_SHELL=FALSE \
|
| 250 |
|
-D SECURE_BOOT_ENABLE \
|
| 251 |
260 |
-D SMM_REQUIRE
|
| 252 |
261 |
|
| 253 |
|
mv -T Build/OvmfX64 Build/OvmfX64${SIZE}.secboot || die
|
|
262 |
mv -T Build/OvmfX64{,${SIZE}.secboot} || die
|
| 254 |
263 |
|
| 255 |
|
mybuild -a X64 -p OvmfPkg/OvmfPkgX64.dsc \
|
|
264 |
# shim.efi has broken MemAttr code
|
|
265 |
my_build -p OvmfPkg/OvmfPkgX64.dsc \
|
| 256 |
266 |
-D FD_SIZE${SIZE}B \
|
| 257 |
|
--pcd PcdDxeNxMemoryProtectionPolicy=0
|
|
267 |
--pcd PcdDxeNxMemoryProtectionPolicy=0 \
|
|
268 |
--pcd PcdUninstallMemAttrProtocol=TRUE
|
| 258 |
269 |
|
| 259 |
|
mv -T Build/OvmfX64 Build/OvmfX64${SIZE} || die
|
|
270 |
mv -T Build/OvmfX64{,${SIZE}} || die
|
| 260 |
271 |
|
| 261 |
|
mk_fw_vars x64 Build/OvmfX64${SIZE}.secboot/"${BUILD_DIR}"/FV/OVMF_VARS.fd
|
|
272 |
mk_fw_vars_raw Build/OvmfX64${SIZE}.secboot/"${BUILD_DIR}"/FV/OVMF_VARS.fd
|
| 262 |
273 |
done
|
| 263 |
274 |
|
|
275 |
sb_build -p OvmfPkg/OvmfPkgX64.dsc \
|
|
276 |
-D FD_SIZE_4MB \
|
|
277 |
-D QEMU_PV_VARS
|
|
278 |
|
|
279 |
mv -T Build/OvmfX64{,.qemuvars} || die
|
|
280 |
|
| 264 |
281 |
# Fedora only converts newer images to QCOW2. 2MB images are raw.
|
| 265 |
282 |
raw_to_qcow2 0 Build/OvmfX64_4M*/"${BUILD_DIR}"/FV/OVMF_{CODE,VARS}.fd
|
|
283 |
mk_fw_vars_json
|
| 266 |
284 |
;;
|
| 267 |
285 |
arm64)
|
| 268 |
|
BUILD_ARGS+=(
|
| 269 |
|
# shim.efi has broken MemAttr code
|
| 270 |
|
--pcd PcdUninstallMemAttrProtocol=TRUE
|
| 271 |
|
)
|
|
286 |
sb_build -p ArmVirtPkg/ArmVirtQemu.dsc
|
|
287 |
mv -T Build/ArmVirtQemu-AArch64{,.secboot_INSECURE} || die
|
| 272 |
288 |
|
| 273 |
|
nx_strict_args mybuild -a AARCH64 -p ArmVirtPkg/ArmVirtQemu.dsc \
|
| 274 |
|
-D BUILD_SHELL=FALSE \
|
| 275 |
|
-D SECURE_BOOT_ENABLE
|
|
289 |
sb_build -p ArmVirtPkg/ArmVirtQemu.dsc \
|
|
290 |
-D QEMU_PV_VARS
|
| 276 |
291 |
|
| 277 |
|
mv -T Build/ArmVirtQemu-AARCH64 Build/ArmVirtQemu-AARCH64.secboot_INSECURE || die
|
|
292 |
mv -T Build/ArmVirtQemu-AArch64{,.qemuvars} || die
|
| 278 |
293 |
|
| 279 |
|
mybuild -a AARCH64 -p ArmVirtPkg/ArmVirtQemu.dsc \
|
| 280 |
|
--pcd PcdDxeNxMemoryProtectionPolicy=0xC000000000007FD1
|
|
294 |
# shim.efi has broken MemAttr code
|
|
295 |
my_build -p ArmVirtPkg/ArmVirtQemu.dsc \
|
|
296 |
--pcd PcdDxeNxMemoryProtectionPolicy=0xC000000000007FD1 \
|
|
297 |
--pcd PcdUninstallMemAttrProtocol=TRUE
|
| 281 |
298 |
|
| 282 |
|
mk_fw_vars arm64 Build/ArmVirtQemu-AARCH64.secboot_INSECURE/"${BUILD_DIR}"/FV/QEMU_VARS.fd
|
| 283 |
|
raw_to_qcow2 64m Build/ArmVirtQemu-AARCH64*/"${BUILD_DIR}"/FV/QEMU_{EFI,VARS}.fd
|
|
299 |
mk_fw_vars_raw Build/ArmVirtQemu-AArch64.secboot_INSECURE/"${BUILD_DIR}"/FV/QEMU_VARS.fd
|
|
300 |
raw_to_qcow2 64m Build/ArmVirtQemu-AArch64{,.secboot_INSECURE}/"${BUILD_DIR}"/FV/QEMU_{EFI,VARS}.fd
|
|
301 |
mk_fw_vars_json
|
| 284 |
302 |
;;
|
| 285 |
303 |
loong)
|
| 286 |
|
mybuild -a LOONGARCH64 -p OvmfPkg/LoongArchVirt/LoongArchVirtQemu.dsc
|
|
304 |
my_build -p OvmfPkg/LoongArchVirt/LoongArchVirtQemu.dsc
|
| 287 |
305 |
raw_to_qcow2 0 Build/LoongArchVirtQemu/"${BUILD_DIR}"/FV/QEMU_{EFI,VARS}.fd
|
| 288 |
306 |
;;
|
| 289 |
307 |
riscv)
|
| 290 |
|
mybuild -a RISCV64 -p OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc
|
|
308 |
my_build -p OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc
|
| 291 |
309 |
raw_to_qcow2 32m Build/RiscVVirtQemu/"${BUILD_DIR}"/FV/RISCV_VIRT_{CODE,VARS}.fd
|
| 292 |
310 |
;;
|
| 293 |
311 |
esac
|
|
312 |
|
|
313 |
# The standalone shell is safe so always build it.
|
|
314 |
my_build -p ShellPkg/ShellPkg.dsc
|
| 294 |
315 |
}
|
| 295 |
316 |
|
| 296 |
317 |
src_install() {
|
| ... | ... | |
| 299 |
320 |
case "${ARCH}" in
|
| 300 |
321 |
amd64)
|
| 301 |
322 |
insinto ${DIR}/OvmfX64
|
| 302 |
|
doins Build/OvmfX64_2M/"${BUILD_DIR}"/X64/Shell.efi
|
| 303 |
323 |
|
| 304 |
324 |
for SIZE in _2M _4M; do
|
| 305 |
325 |
for TYPE in "" .secboot; do
|
| ... | ... | |
| 309 |
329 |
done
|
| 310 |
330 |
done
|
| 311 |
331 |
|
|
332 |
newins Build/OvmfX64.qemuvars/"${BUILD_DIR}"/FV/OVMF_CODE.fd OVMF_CODE.qemuvars.fd
|
|
333 |
newins amd64.qemuvars.json OVMF_VARS.qemuvars.json
|
|
334 |
|
| 312 |
335 |
# Compatibility with older package versions.
|
| 313 |
336 |
dosym ${PN}/OvmfX64 /usr/share/edk2-ovmf
|
| 314 |
337 |
;;
|
| ... | ... | |
| 316 |
339 |
insinto ${DIR}/ArmVirtQemu-AARCH64
|
| 317 |
340 |
|
| 318 |
341 |
for TYPE in "" .secboot_INSECURE; do
|
| 319 |
|
newins Build/ArmVirtQemu-AARCH64${TYPE}/"${BUILD_DIR}"/FV/QEMU_EFI.qcow2 QEMU_EFI${TYPE}.qcow2
|
| 320 |
|
newins Build/ArmVirtQemu-AARCH64${TYPE}/"${BUILD_DIR}"/FV/QEMU_VARS.qcow2 QEMU_VARS${TYPE}.qcow2
|
|
342 |
newins Build/ArmVirtQemu-AArch64${TYPE}/"${BUILD_DIR}"/FV/QEMU_EFI.qcow2 QEMU_EFI${TYPE}.qcow2
|
|
343 |
newins Build/ArmVirtQemu-AArch64${TYPE}/"${BUILD_DIR}"/FV/QEMU_VARS.qcow2 QEMU_VARS${TYPE}.qcow2
|
| 321 |
344 |
done
|
|
345 |
|
|
346 |
newins Build/ArmVirtQemu-AArch64.qemuvars/"${BUILD_DIR}"/FV/QEMU_EFI.fd QEMU_EFI.qemuvars.fd
|
|
347 |
newins arm64.qemuvars.json QEMU_VARS.qemuvars.json
|
| 322 |
348 |
;;
|
| 323 |
349 |
loong)
|
| 324 |
350 |
insinto ${DIR}/LoongArchVirtQemu
|
| ... | ... | |
| 330 |
356 |
;;
|
| 331 |
357 |
esac
|
| 332 |
358 |
|
|
359 |
newins Build/Shell/"${BUILD_DIR}/${TARGET_ARCH}"/Shell_EA4BB293-2D7F-4456-A681-1F22F42CD0BC.efi Shell.efi
|
|
360 |
|
| 333 |
361 |
insinto /usr/share/qemu/firmware
|
| 334 |
362 |
doins "${FILESDIR}"/descriptors/*"${TARGET_ARCH,,}"*.json
|
| 335 |
363 |
|
