Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>

.gitignore

@@ -1,6 +1,11 @@
-/edk2-r14365.tar.xz
-/edk2-r14844.tar.xz
-/edk2-r15376.tar.xz
-/edk2-buildtools-r2649.tar.xz
-/edk2-buildtools-r2670.tar.xz
-/edk2-buildtools-r17469.tar.xz
+/openssl-*-hobbled.tar.xz
+/edk2-*.tar.xz
+/qemu-ovmf-secureboot-*.tar.gz
+/edk2-*.tar.gz
+/softfloat-20180726-gitb64af41.tar.xz
+/qemu-ovmf-secureboot-20190521-gitf158f12.tar.xz
+/qemu-ovmf-secureboot-20200228-gitc3e16b3.tar.xz
+/openssl-rhel-a75722161d20fd632f8875585d3aa066ec5fea93.tar.xz
+/openssl-rhel-bdd048e929dcfcf2f046d74e812e0e3d5fc58504.tar.xz
+/openssl-rhel-740e53ace8f6771c205bf84780e26bcd7a3275df.tar.xz
+/jansson-2.13.1.tar.bz2

0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch

@@ -0,0 +1,43 @@
+From 85b2dc9bb820a749e95136bf7bdd0f6c49e8389d Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Thu, 4 Jun 2020 13:34:12 +0200
+Subject: [PATCH 01/14] BaseTools: do not build BrotliCompress (RH only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- no change
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- New patch.
+
+BrotliCompress is not used for building ArmVirtPkg or OvmfPkg platforms.
+It depends on one of the upstream Brotli git submodules that we removed
+earlier in this rebase series. (See patch "remove upstream edk2's Brotli
+submodules (RH only").
+
+Do not attempt to build BrotliCompress.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit db8ccca337e2c5722c1d408d2541cf653d3371a2)
+---
+ BaseTools/Source/C/GNUmakefile | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/BaseTools/Source/C/GNUmakefile b/BaseTools/Source/C/GNUmakefile
+index 5275f657efe8..39d719975309 100644
+--- a/BaseTools/Source/C/GNUmakefile
++++ b/BaseTools/Source/C/GNUmakefile
+@@ -51,7 +51,6 @@ all: makerootdir subdirs
+ LIBRARIES = Common
+ VFRAUTOGEN = VfrCompile/VfrLexer.h
+ APPLICATIONS = \
+-  BrotliCompress \
+   VfrCompile \
+   EfiRom \
+   GenFfs \
+-- 
+2.40.1
+

0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch

@@ -0,0 +1,50 @@
+From f1996ce088098f8479eec2f0739978b9de7840fc Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Thu, 4 Jun 2020 13:39:08 +0200
+Subject: [PATCH 02/14] MdeModulePkg: remove package-private Brotli include
+ path (RH only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- no change
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- New patch.
+
+Originating from upstream commit 58802e02c41b
+("MdeModulePkg/BrotliCustomDecompressLib: Make brotli a submodule",
+2020-04-16), "MdeModulePkg/MdeModulePkg.dec" contains a package-internal
+include path into a Brotli submodule.
+
+The edk2 build system requires such include paths to resolve successfully,
+regardless of the firmware platform being built. Because
+BrotliCustomDecompressLib is not consumed by any OvmfPkg or ArmVirtPkg
+platforms, and we've removed the submodule earlier in this patch set,
+remove the include path too.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit e05e0de713c4a2b8adb6ff9809611f222bfe50ed)
+---
+ MdeModulePkg/MdeModulePkg.dec | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
+index 95dd077e19b3..1609b6d9c29e 100644
+--- a/MdeModulePkg/MdeModulePkg.dec
++++ b/MdeModulePkg/MdeModulePkg.dec
+@@ -26,9 +26,6 @@ [Includes]
+   Include
+   Test/Mock/Include
+ 
+-[Includes.Common.Private]
+-  Library/BrotliCustomDecompressLib/brotli/c/include
+-
+ [LibraryClasses]
+   ##  @libraryclass  Defines a set of methods to reset whole system.
+   ResetSystemLib|Include/Library/ResetSystemLib.h
+-- 
+2.40.1
+

0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch

@@ -0,0 +1,180 @@
+From 212665c3bc7c480d6dfa7df52c50457e83af149a Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Tue, 25 Feb 2014 22:40:01 +0100
+Subject: [PATCH 03/14] MdeModulePkg: TerminalDxe: set xterm resolution on mode
+ change (RH only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Resolve harmless conflict in "MdeModulePkg/MdeModulePkg.dec",
+  originating from new upstream commits
+  - 45bc28172fbf ("MdeModulePkg.dec: Change PCDs for status code.",
+                  2020-06-18),
+  - 0785c619a58a ("MdeModulePkg/Bus/Pci/PciBusDxe: Support PCIe Resizable
+                  BAR Capability", 2021-01-04),
+  - ef23012e5439 ("MdeModulePkg: Change default value of
+                  PcdPcieResizableBarSupport to FALSE", 2021-01-14).
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- Resolve trivial conflict in "MdeModulePkg/MdeModulePkg.dec", arising
+  from upstream commit 166830d8f7ca ("MdeModulePkg/dec: add
+  PcdTcgPfpMeasurementRevision PCD", 2020-01-06).
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- Conflict in "MdeModulePkg/MdeModulePkg.dec" due to upstream commits
+  - 1103ba946aee ("MdeModulePkg: Add Capsule On Disk related definition.",
+    2019-06-26),
+  - 1c7b3eb84631 ("MdeModulePkg/DxeIpl: Introduce PCD
+    PcdUse5LevelPageTable", 2019-08-09),
+  with easy manual resolution.
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no change
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- Refresh downstream-only commit 2909e025db68 against "MdeModulePkg.dec"
+  context change from upstream commits e043f7895b83 ("MdeModulePkg: Add
+  PCD PcdPteMemoryEncryptionAddressOrMask", 2017-02-27) and 76081dfcc5b2
+  ("MdeModulePkg: Add PROMPT&HELP string of pcd to UNI file", 2017-03-03).
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- refresh commit 519b9751573e against various context changes
+
+The
+
+  CSI Ps ; Ps ; Ps t
+
+escape sequence serves for window manipulation. We can use the
+
+  CSI 8 ; <rows> ; <columns> t
+
+sequence to adapt eg. the xterm window size to the selected console mode.
+
+Reference: <http://rtfm.etla.org/xterm/ctlseq.html>
+Contributed-under: TianoCore Contribution Agreement 1.0
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 2909e025db6878723b49644a8a0cf160d07e6444)
+(cherry picked from commit b9c5c901f25e48d68eef6e78a4abca00e153f574)
+(cherry picked from commit b7f6115b745de8cbc5214b6ede33c9a8558beb90)
+(cherry picked from commit 67415982afdc77922aa37496c981adeb4351acdb)
+(cherry picked from commit cfccb98d13e955beb0b93b4a75a973f30c273ffc)
+(cherry picked from commit a11602f5e2ef930be5b693ddfd0c789a1bd4c60c)
+(cherry picked from commit bc2266f20de5db1636e09a07e4a72c8dbf505f5a)
+---
+ MdeModulePkg/MdeModulePkg.dec                 |  4 +++
+ .../Console/TerminalDxe/TerminalDxe.inf       |  2 ++
+ .../Console/TerminalDxe/TerminalConOut.c      | 29 +++++++++++++++++++
+ 3 files changed, 35 insertions(+)
+
+diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
+index 1609b6d9c29e..c0d376bed1f0 100644
+--- a/MdeModulePkg/MdeModulePkg.dec
++++ b/MdeModulePkg/MdeModulePkg.dec
+@@ -2127,6 +2127,10 @@ [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
+   # @Prompt The shared bit mask when Intel Tdx is enabled.
+   gEfiMdeModulePkgTokenSpaceGuid.PcdTdxSharedBitMask|0x0|UINT64|0x10000025
+ 
++  ## Controls whether TerminalDxe outputs an XTerm resize sequence on terminal
++  #  mode change.
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE|BOOLEAN|0x00010080
++
+ [PcdsPatchableInModule]
+   ## Specify memory size with page number for PEI code when
+   #  Loading Module at Fixed Address feature is enabled.
+diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
+index b2a8aeba8510..eff625346539 100644
+--- a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
++++ b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
+@@ -55,6 +55,7 @@ [LibraryClasses]
+   DebugLib
+   PcdLib
+   BaseLib
++  PrintLib
+ 
+ [Guids]
+   ## SOMETIMES_PRODUCES ## Variable:L"ConInDev"
+@@ -87,6 +88,7 @@ [Protocols]
+ [Pcd]
+   gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType           ## SOMETIMES_CONSUMES
+   gEfiMdeModulePkgTokenSpaceGuid.PcdErrorCodeSetVariable    ## CONSUMES
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm             ## CONSUMES
+ 
+ # [Event]
+ # # Relative timer event set by UnicodeToEfiKey(), used to be one 2 seconds input timeout.
+diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
+index 7809869e7d49..496849458db4 100644
+--- a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
++++ b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
+@@ -7,6 +7,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+ 
++#include <Library/PrintLib.h>
++
+ #include "Terminal.h"
+ 
+ //
+@@ -80,6 +82,15 @@ CHAR16  mSetCursorPositionString[] = { ESC, '[', '0', '0', ';', '0', '0', 'H', 0
+ CHAR16  mCursorForwardString[]     = { ESC, '[', '0', '0', 'C', 0 };
+ CHAR16  mCursorBackwardString[]    = { ESC, '[', '0', '0', 'D', 0 };
+ 
++//
++// Note that this is an ASCII format string, taking two INT32 arguments:
++// rows, columns.
++//
++// A %d (INT32) format specification can expand to at most 11 characters.
++//
++CHAR8  mResizeTextAreaFormatString[] = "\x1B[8;%d;%dt";
++#define RESIZE_SEQ_SIZE  (sizeof mResizeTextAreaFormatString + 2 * (11 - 2))
++
+ //
+ // Body of the ConOut functions
+ //
+@@ -498,6 +509,24 @@ TerminalConOutSetMode (
+     return EFI_DEVICE_ERROR;
+   }
+ 
++  if (PcdGetBool (PcdResizeXterm)) {
++    CHAR16  ResizeSequence[RESIZE_SEQ_SIZE];
++
++    UnicodeSPrintAsciiFormat (
++      ResizeSequence,
++      sizeof ResizeSequence,
++      mResizeTextAreaFormatString,
++      (INT32)TerminalDevice->TerminalConsoleModeData[ModeNumber].Rows,
++      (INT32)TerminalDevice->TerminalConsoleModeData[ModeNumber].Columns
++      );
++    TerminalDevice->OutputEscChar = TRUE;
++    Status                        = This->OutputString (This, ResizeSequence);
++    TerminalDevice->OutputEscChar = FALSE;
++    if (EFI_ERROR (Status)) {
++      return EFI_DEVICE_ERROR;
++    }
++  }
++
+   This->Mode->Mode = (INT32)ModeNumber;
+ 
+   Status = This->ClearScreen (This);
+-- 
+2.40.1
+

0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch

@@ -0,0 +1,219 @@
+From 677df60b929f97fde9e7d03dfe82b4bf593d5986 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 14 Oct 2015 15:59:06 +0200
+Subject: [PATCH 04/14] OvmfPkg: take PcdResizeXterm from the QEMU command line
+ (RH only)
+
+edk2-stable202205 rebase
+
+- re-add UPDATE_BOOLEAN_PCD_FROM_FW_CFG
+- add microvm, cloudhw and inteltdx
+
+edk2-stable202108 rebase
+
+- resolve conflict in OvmfPkg/PlatformPei/PlatformPei.inf
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Extend the DSC change to the new OvmfPkg/AmdSev platform, which has been
+  introduced upstream in commit 30d277ed7a82 ("OvmfPkg/Amdsev: Base commit
+  to build encrypted boot specific OVMF", 2020-12-14), for TianoCore#3077.
+
+  We've always patched all those DSC/FDF files in OvmfPkg down-stream that
+  made sense at least in theory on QEMU. (For example, we've always
+  patched "OvmfPkgIa32.dsc" and "OvmfPkgIa32.fdf", even though we never
+  build or ship the pure IA32 firmware platform.) Follow suit with
+  "AmdSevX64.dsc".
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- Resolve contextual conflict in the DSC files, from upstream commit
+  b0ed7ebdebd1 ("OvmfPkg: set fixed FlashNvStorage base addresses with -D
+  SMM_REQUIRE", 2020-03-12).
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no change
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- refresh downstream-only commit 8abc2a6ddad2 against context differences
+  in the DSC files from upstream commit 5e167d7e784c
+  ("OvmfPkg/PlatformPei: don't allocate reserved mem varstore if
+  SMM_REQUIRE", 2017-03-12).
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- no changes
+
+Contributed-under: TianoCore Contribution Agreement 1.0
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 6fa0c4d67c0bb8bde2ddd6db41c19eb0c40b2721)
+(cherry picked from commit 8abc2a6ddad25af7e88dc0cf57d55dfb75fbf92d)
+(cherry picked from commit b311932d3841c017a0f0fec553edcac365cc2038)
+(cherry picked from commit 61914fb81cf624c9028d015533b400b2794e52d3)
+(cherry picked from commit 2ebf3cc2ae99275d63bb6efd3c22dec76251a853)
+(cherry picked from commit f9b73437b9b231773c1a20e0c516168817a930a2)
+(cherry picked from commit 2cc462ee963d0be119bc97bfc9c70d292a40516f)
+(cherry picked from commit 51e0de961029af84b5bdbfddcc9762b1819d500f)
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc        |  1 +
+ OvmfPkg/CloudHv/CloudHvX64.dsc      |  1 +
+ OvmfPkg/IntelTdx/IntelTdxX64.dsc    |  1 +
+ OvmfPkg/Microvm/MicrovmX64.dsc      |  1 +
+ OvmfPkg/OvmfPkgIa32.dsc             |  1 +
+ OvmfPkg/OvmfPkgIa32X64.dsc          |  1 +
+ OvmfPkg/OvmfPkgX64.dsc              |  1 +
+ OvmfPkg/PlatformPei/PlatformPei.inf |  1 +
+ OvmfPkg/PlatformPei/Platform.c      | 13 +++++++++++++
+ 9 files changed, 21 insertions(+)
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index b32049194d39..bff9f166219e 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -476,6 +476,7 @@ [PcdsFixedAtBuild]
+ [PcdsDynamicDefault]
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
+diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc
+index 2a1139daaa19..1e61af6eeff6 100644
+--- a/OvmfPkg/CloudHv/CloudHvX64.dsc
++++ b/OvmfPkg/CloudHv/CloudHvX64.dsc
+@@ -575,6 +575,7 @@ [PcdsDynamicDefault]
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+ !if $(SMM_REQUIRE) == FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
+index d4403f11a7c6..86673d06ef2e 100644
+--- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
++++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
+@@ -473,6 +473,7 @@ [PcdsDynamicDefault]
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
+diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
+index 5f671bc3840d..02c225f6d2a7 100644
+--- a/OvmfPkg/Microvm/MicrovmX64.dsc
++++ b/OvmfPkg/Microvm/MicrovmX64.dsc
+@@ -573,6 +573,7 @@ [PcdsDynamicDefault]
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index e333b8b41803..f5390a30fb09 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -595,6 +595,7 @@ [PcdsDynamicDefault]
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+ !if $(SMM_REQUIRE) == FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 25974230a27e..c43fb2d39910 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -603,6 +603,7 @@ [PcdsDynamicDefault]
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+ !if $(SMM_REQUIRE) == FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index c1762ffca445..ce49a3d3a54d 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -626,6 +626,7 @@ [PcdsDynamicDefault]
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+ !if $(SMM_REQUIRE) == FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf
+index 3934aeed9514..98123ec63b3d 100644
+--- a/OvmfPkg/PlatformPei/PlatformPei.inf
++++ b/OvmfPkg/PlatformPei/PlatformPei.inf
+@@ -100,6 +100,7 @@ [Pcd]
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm
+   gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode
+   gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
+   gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index c56247e294f2..5d7f50cc5876 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -41,6 +41,18 @@
+ 
+ #include "Platform.h"
+ 
++#define UPDATE_BOOLEAN_PCD_FROM_FW_CFG(TokenName)                   \
++          do {                                                      \
++            BOOLEAN       Setting;                                  \
++            RETURN_STATUS PcdStatus;                                \
++                                                                    \
++            if (!RETURN_ERROR (QemuFwCfgParseBool (                 \
++                              "opt/ovmf/" #TokenName, &Setting))) { \
++              PcdStatus = PcdSetBoolS (TokenName, Setting);         \
++              ASSERT_RETURN_ERROR (PcdStatus);                      \
++            }                                                       \
++          } while (0)
++
+ EFI_PEI_PPI_DESCRIPTOR  mPpiBootMode[] = {
+   {
+     EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST,
+@@ -386,6 +398,7 @@ InitializePlatform (
+     MemTypeInfoInitialization (PlatformInfoHob);
+     MemMapInitialization (PlatformInfoHob);
+     NoexecDxeInitialization (PlatformInfoHob);
++    UPDATE_BOOLEAN_PCD_FROM_FW_CFG (PcdResizeXterm);
+   }
+ 
+   InstallClearCacheCallback ();
+-- 
+2.40.1
+

0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch

@@ -0,0 +1,204 @@
+From ca84f8dd5a7653d2b884406f67f5e9d4bc136852 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Sun, 26 Jul 2015 08:02:50 +0000
+Subject: [PATCH 05/14] ArmVirtPkg: take PcdResizeXterm from the QEMU command
+ line (RH only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- no change
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- Resolve leading context divergence in "ArmVirtPkg/ArmVirtQemu.dsc",
+  arising from upstream commits:
+
+  - 82662a3b5f56 ("ArmVirtPkg/PlatformPeiLib: discover the TPM base
+                  address from the DT", 2020-03-04)
+
+  - ddd34a818315 ("ArmVirtPkg/ArmVirtQemu: enable TPM2 support in the PEI
+                  phase", 2020-03-04)
+
+  - cdc3fa54184a ("ArmVirtPkg: control PXEv4 / PXEv6 boot support from the
+                  QEMU command line", 2020-04-28)
+
+- Rework the downstream patch quite a bit, paralleling the upstream work
+  done for <https://bugzilla.tianocore.org/show_bug.cgi?id=2681> in commit
+  range 64ab457d1f21..cdc3fa54184a:
+
+  - Refresh copyright year in TerminalPcdProducerLib.{inf,c}. Also replace
+    open-coded BSDL with "SPDX-License-Identifier: BSD-2-Clause-Patent".
+
+  - Simplify LIBRARY_CLASS: this lib instance is meant to be consumed only
+    via NULL class resolution (basically: as a plugin), so use NULL for
+    LIBRARY_CLASS, not "TerminalPcdProducerLib|DXE_DRIVER".
+
+  - Sort the [Packages] section alphabetically in the INF file.
+
+  - Replace the open-coded GetNamedFwCfgBoolean() function with a call to
+    QemuFwCfgParseBool(), from QemuFwCfgSimpleParserLib.
+
+  - Add the SOMETIMES_PRODUCES usage comment in the [Pcd] section of the
+    INF file.
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no change
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- Refresh downstream-only commit d4564d39dfdb against context changes in
+  "ArmVirtPkg/ArmVirtQemu.dsc" from upstream commit 7e5f1b673870
+  ("ArmVirtPkg/PlatformHasAcpiDtDxe: allow guest level ACPI disable
+  override", 2017-03-29).
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- Adapt commit 6b97969096a3 to the fact that upstream has deprecated such
+  setter functions for dynamic PCDs that don't return a status code (such
+  as PcdSetBool()). Employ PcdSetBoolS(), and assert that it succeeds --
+  there's really no circumstance in this case when it could fail.
+
+Contributed-under: TianoCore Contribution Agreement 1.0
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit d4564d39dfdbf74e762af43314005a2c026cb262)
+(cherry picked from commit c9081ebe3bcd28e5cce4bf58bd8d4fca12f9af7c)
+(cherry picked from commit 8e92730c8e1cdb642b3b3e680e643ff774a90c65)
+(cherry picked from commit 9448b6b46267d8d807fac0c648e693171bb34806)
+(cherry picked from commit 232fcf06f6b3048b7c2ebd6931f23186b3852f04)
+(cherry picked from commit 8338545260fbb423f796d5196faaaf8ff6e1ed99)
+(cherry picked from commit a5f7a57bf390f1f340ff1d1f1884a73716817ef1)
+---
+ ArmVirtPkg/ArmVirtQemu.dsc                    |  7 +++-
+ .../TerminalPcdProducerLib.inf                | 33 ++++++++++++++++++
+ .../TerminalPcdProducerLib.c                  | 34 +++++++++++++++++++
+ 3 files changed, 73 insertions(+), 1 deletion(-)
+ create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
+ create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index 449e73b9e132..2ccbef41c23b 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
++++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -307,6 +307,8 @@ [PcdsPatchableInModule]
+   gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0x0
+ !endif
+ 
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
++
+ [PcdsDynamicHii]
+   gUefiOvmfPkgTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gOvmfVariableGuid|0x0|FALSE|NV,BS
+ 
+@@ -416,7 +418,10 @@ [Components.common]
+   MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
+   MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitterDxe.inf
+   MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
+-  MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
++  MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf {
++    <LibraryClasses>
++      NULL|ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
++  }
+   MdeModulePkg/Universal/SerialDxe/SerialDxe.inf
+ 
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+diff --git a/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
+new file mode 100644
+index 000000000000..a51dbd1670a8
+--- /dev/null
++++ b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
+@@ -0,0 +1,33 @@
++## @file
++#  Plugin library for setting up dynamic PCDs for TerminalDxe, from fw_cfg
++#
++#  Copyright (C) 2015-2020, Red Hat, Inc.
++#  Copyright (c) 2014, Linaro Ltd. All rights reserved.<BR>
++#
++#  SPDX-License-Identifier: BSD-2-Clause-Patent
++##
++
++[Defines]
++  INF_VERSION                    = 0x00010005
++  BASE_NAME                      = TerminalPcdProducerLib
++  FILE_GUID                      = 4a0c5ed7-8c42-4c01-8f4c-7bf258316a96
++  MODULE_TYPE                    = BASE
++  VERSION_STRING                 = 1.0
++  LIBRARY_CLASS                  = NULL
++  CONSTRUCTOR                    = TerminalPcdProducerLibConstructor
++
++[Sources]
++  TerminalPcdProducerLib.c
++
++[Packages]
++  MdeModulePkg/MdeModulePkg.dec
++  MdePkg/MdePkg.dec
++  OvmfPkg/OvmfPkg.dec
++
++[LibraryClasses]
++  DebugLib
++  PcdLib
++  QemuFwCfgSimpleParserLib
++
++[Pcd]
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm ## SOMETIMES_PRODUCES
+diff --git a/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
+new file mode 100644
+index 000000000000..bfd3a6a535f9
+--- /dev/null
++++ b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
+@@ -0,0 +1,34 @@
++/** @file
++*  Plugin library for setting up dynamic PCDs for TerminalDxe, from fw_cfg
++*
++*  Copyright (C) 2015-2020, Red Hat, Inc.
++*  Copyright (c) 2014, Linaro Ltd. All rights reserved.<BR>
++*
++*  SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++
++#include <Library/DebugLib.h>
++#include <Library/PcdLib.h>
++#include <Library/QemuFwCfgSimpleParserLib.h>
++
++#define UPDATE_BOOLEAN_PCD_FROM_FW_CFG(TokenName)                             \
++          do {                                                                \
++            BOOLEAN       Setting;                                            \
++            RETURN_STATUS PcdStatus;                                          \
++                                                                              \
++            if (!RETURN_ERROR (QemuFwCfgParseBool (                           \
++                    "opt/org.tianocore.edk2.aavmf/" #TokenName, &Setting))) { \
++              PcdStatus = PcdSetBoolS (TokenName, Setting);                   \
++              ASSERT_RETURN_ERROR (PcdStatus);                                \
++            }                                                                 \
++          } while (0)
++
++RETURN_STATUS
++EFIAPI
++TerminalPcdProducerLibConstructor (
++  VOID
++  )
++{
++  UPDATE_BOOLEAN_PCD_FROM_FW_CFG (PcdResizeXterm);
++  return RETURN_SUCCESS;
++}
+-- 
+2.40.1
+

0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch

@@ -0,0 +1,121 @@
+From 447b5540fdc12ff4ca74dc2dd183149732075c18 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 21 Nov 2017 00:57:45 +0100
+Subject: [PATCH 06/14] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Extend the DSC change to the new OvmfPkg/AmdSev platform, which has been
+  introduced upstream in commit 30d277ed7a82 ("OvmfPkg/Amdsev: Base commit
+  to build encrypted boot specific OVMF", 2020-12-14), for TianoCore#3077.
+
+- Remove obsolete commit message tags related to downstream patch
+  management: Message-id, Patchwork-id, O-Subject, Acked-by, From
+  (RHBZ#1846481).
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- context difference from upstream commit 46bb81200742 ("OvmfPkg: Make
+  SOURCE_DEBUG_ENABLE actually need to be set to TRUE", 2019-10-22)
+  resolved automatically
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Bugzilla: 1488247
+
+Set the DEBUG_VERBOSE bit (0x00400000) in the log mask. We want detailed
+debug messages, and code in OvmfPkg logs many messages on the
+DEBUG_VERBOSE level.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(this patch was previously applied as commit 78d3ed73172b5738e32d2b0bc03f7984b9584117)
+(cherry picked from commit 7aeeaabc9871f657e65d2b99d81011b4964a1ce9)
+(cherry picked from commit a0617a6be1a80966099ddceb010f89202a79ee76)
+(cherry picked from commit 759bd3f591e2db699bdef4c7ea4e97c908e7f027)
+(cherry picked from commit 7e6d5dc4078c64be6d55d8fc3317c59a91507a50)
+(cherry picked from commit 3cb92f9ba18ac79911bd5258ff4f949cc617ae89)
+(cherry picked from commit 5ecc18badaabe774d9d0806b027ab63a30c6a2d7)
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc | 2 +-
+ OvmfPkg/OvmfPkgIa32.dsc      | 2 +-
+ OvmfPkg/OvmfPkgIa32X64.dsc   | 2 +-
+ OvmfPkg/OvmfPkgX64.dsc       | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index bff9f166219e..14a5d10d2b67 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -426,7 +426,7 @@ [PcdsFixedAtBuild]
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+ 
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index f5390a30fb09..62c68d99165d 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -535,7 +535,7 @@ [PcdsFixedAtBuild]
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+ 
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index c43fb2d39910..b03af9cacd2b 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -541,7 +541,7 @@ [PcdsFixedAtBuild]
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+ 
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index ce49a3d3a54d..a9dad1b59ee8 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -562,7 +562,7 @@ [PcdsFixedAtBuild]
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+ 
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+-- 
+2.40.1
+

0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch

@@ -0,0 +1,173 @@
+From f0d8ef8071a0b20495a5a1dc3e6e49f8f145c503 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 21 Nov 2017 00:57:46 +0100
+Subject: [PATCH 07/14] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
+ QemuVideoDxe/QemuRamfbDxe (RH)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Extend the DSC change to the new OvmfPkg/AmdSev platform, which has been
+  introduced upstream in commit 30d277ed7a82 ("OvmfPkg/Amdsev: Base commit
+  to build encrypted boot specific OVMF", 2020-12-14), for TianoCore#3077.
+
+- Remove obsolete commit message tags related to downstream patch
+  management: Message-id, Patchwork-id, O-Subject, Acked-by, From
+  (RHBZ#1846481).
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- no change
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- Due to upstream commit 4b04d9d73604 ("OvmfPkg: Don't build in
+  QemuVideoDxe when we have CSM", 2019-06-26), the contexts of
+  "QemuVideoDxe.inf" / "QemuRamfbDxe.inf" have changed in the DSC files.
+  Resolve the conflict manually.
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- Upstream commit 1d25ff51af5c ("OvmfPkg: add QemuRamfbDxe", 2018-06-14)
+  introduced another GOP driver that consumes FrameBufferBltLib, and
+  thereby produces a large number of (mostly useless) debug messages at
+  the DEBUG_VERBOSE level. Extend the patch to suppress those messages in
+  both QemuVideoDxe and QemuRamfbDxe; update the subject accordingly.
+  QemuRamfbDxe itself doesn't log anything at the VERBOSE level (see also
+  the original commit message at the bottom of this downstream patch).
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Bugzilla: 1488247
+
+In commit 5b2291f9567a ("OvmfPkg: QemuVideoDxe uses
+MdeModulePkg/FrameBufferLib"), QemuVideoDxe was rebased to
+FrameBufferBltLib.
+
+The FrameBufferBltLib instance added in commit b1ca386074bd
+("MdeModulePkg: Add FrameBufferBltLib library instance") logs many
+messages on the VERBOSE level; for example, a normal boot with OVMF can
+produce 500+ "VideoFill" messages, dependent on the progress bar, when the
+VERBOSE bit is set in PcdDebugPrintErrorLevel.
+
+QemuVideoDxe itself doesn't log anything at the VERBOSE level, so we lose
+none of its messages this way.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(this patch was previously applied as commit 9b0d031dee7e823f6717bab73e422fbc6f0a6c52)
+(cherry picked from commit 9122d5f2e8d8d289064d1e1700cb61964d9931f3)
+(cherry picked from commit 7eb3be1d4ccafc26c11fe5afb95cc12b250ce6f0)
+(cherry picked from commit bd650684712fb840dbcda5d6eaee065bd9e91fa1)
+(cherry picked from commit b06b87f8ffd4fed4ef7eacb13689a9b6d111f850)
+(cherry picked from commit c8c3f893e7c3710afe45c46839e97954871536e4)
+(cherry picked from commit 1355849ad97c1e4a5c430597a377165a5cc118f7)
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc | 10 ++++++++--
+ OvmfPkg/OvmfPkgIa32.dsc      | 10 ++++++++--
+ OvmfPkg/OvmfPkgIa32X64.dsc   | 10 ++++++++--
+ OvmfPkg/OvmfPkgX64.dsc       | 10 ++++++++--
+ 4 files changed, 32 insertions(+), 8 deletions(-)
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index 14a5d10d2b67..870c4bd890fe 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -684,8 +684,14 @@ [Components]
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ 
+   #
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 62c68d99165d..d7bce8d40d26 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -841,9 +841,15 @@ [Components]
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+ !ifndef $(CSM_ENABLE)
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+ !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ 
+   #
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index b03af9cacd2b..8103d1d4882a 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -855,9 +855,15 @@ [Components.X64]
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+ !ifndef $(CSM_ENABLE)
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+ !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ 
+   #
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index a9dad1b59ee8..7fe23d9153fe 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -929,9 +929,15 @@ [Components]
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+ !ifndef $(CSM_ENABLE)
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+ !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ 
+   #
+-- 
+2.40.1
+

0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch

@@ -0,0 +1,97 @@
+From 461077f978edf909f0ef59c777c2d45ab7664526 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 27 Jan 2016 03:05:18 +0100
+Subject: [PATCH 08/14] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
+ QemuRamfbDxe (RH only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- no change
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- no change
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- The previous version of this patch (downstream commit 76b4ac28e975)
+  caused a regression (RHBZ#1714446), which was fixed up in downstream
+  commit 5a216abaa737 ("ArmVirtPkg: silence DEBUG_VERBOSE masking
+  ~0x00400000 in QemuRamfbDxe (RH only)", 2019-08-05).
+
+  Squash the fixup into the original patch. Fuse the commit messages.
+  (Acked-by tags are not preserved, lest we confuse ourselves while
+  reviewing this rebase.)
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- new patch, due to upstream commit c64688f36a8b ("ArmVirtPkg: add
+  QemuRamfbDxe", 2018-06-14)
+
+QemuRamfbDxe uses FrameBufferLib. The FrameBufferBltLib instance added in
+commit b1ca386074bd ("MdeModulePkg: Add FrameBufferBltLib library
+instance") logs many messages on the VERBOSE level; for example, a normal
+boot with ArmVirtQemu[Kernel] can produce 500+ "VideoFill" messages,
+dependent on the progress bar, when the VERBOSE bit is set in
+PcdDebugPrintErrorLevel.
+
+Clear the VERBOSE bit without touching other bits -- those other bits
+differ between the "silent" and "verbose" builds, so we can't set them as
+constants.
+
+QemuRamfbDxe itself doesn't log anything at the VERBOSE level, so we lose
+none of its messages, with the VERBOSE bit clear.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 76b4ac28e975bd63c25db903a1d42c47b38cc756)
+Reported-by: Andrew Jones <drjones@redhat.com>
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daude <philmd@redhat.com>
+(cherry picked from commit 5a216abaa737195327235e37563b18a6bf2a74dc)
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit e5b8152bced2364a1ded0926dbba4d65e23e3f84)
+(cherry picked from commit e7f57f154439c1c18ea5030b01f8d7bc492698b2)
+---
+ ArmVirtPkg/ArmVirtQemu.dsc       | 5 ++++-
+ ArmVirtPkg/ArmVirtQemuKernel.dsc | 5 ++++-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index 2ccbef41c23b..bc097880f79f 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
++++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -544,7 +544,10 @@ [Components.common]
+   #
+   # Video support
+   #
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|($(DEBUG_PRINT_ERROR_LEVEL)) & 0xFFBFFFFF
++  }
+   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+   OvmfPkg/PlatformDxe/Platform.inf
+ 
+diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+index 3cb9120e4e10..02877284bfa3 100644
+--- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
++++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+@@ -444,7 +444,10 @@ [Components.common]
+   #
+   # Video support
+   #
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|($(DEBUG_PRINT_ERROR_LEVEL)) & 0xFFBFFFFF
++  }
+   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+   OvmfPkg/PlatformDxe/Platform.inf
+ 
+-- 
+2.40.1
+

0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch

@@ -0,0 +1,96 @@
+From 58b31e995b9626e3187872c5dbb4696f04374a56 Mon Sep 17 00:00:00 2001
+From: Philippe Mathieu-Daude <philmd@redhat.com>
+Date: Thu, 1 Aug 2019 20:43:48 +0200
+Subject: [PATCH 09/14] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on
+ Aarch64 silent builds (RH only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- no change
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- no change
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- We have to carry this downstream-only patch -- committed originally as
+  aaaedc1e2cfd -- indefinitely.
+
+- To avoid confusion, remove the tags from the commit message that had
+  been added by the downstream maintainer scripts, such as: Message-id,
+  Patchwork-id, O-Subject, Acked-by. These remain available on the
+  original downstream commit. The Bugzilla line is preserved, as it
+  doesn't relate to a specific posting, but to the problem.
+
+Bugzilla: 1714446
+
+To suppress an error message on the silent build when ramfb is
+not configured, change QemuRamfbDxe to return EFI_SUCCESS even
+when it fails.
+Some memory is wasted (driver stays resident without
+any good use), but it is mostly harmless, as the memory
+is released by the OS after ExitBootServices().
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daude <philmd@redhat.com>
+(cherry picked from commit aaaedc1e2cfd55ef003fb1b5a37c73a196b26dc7)
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit aa2b66b18a62d652bdbefae7b5732297294306ca)
+(cherry picked from commit deb3451034326b75fd760aba47a5171493ff055e)
+---
+ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf |  1 +
+ OvmfPkg/QemuRamfbDxe/QemuRamfb.c      | 15 +++++++++++++++
+ 2 files changed, 16 insertions(+)
+
+diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
+index e3890b8c202f..6ffee5acb24c 100644
+--- a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++++ b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
+@@ -29,6 +29,7 @@ [LibraryClasses]
+   BaseLib
+   BaseMemoryLib
+   DebugLib
++  DebugPrintErrorLevelLib
+   DevicePathLib
+   FrameBufferBltLib
+   MemoryAllocationLib
+diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
+index 5a1044f0dc7b..3a687901b0d2 100644
+--- a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
++++ b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
+@@ -13,6 +13,7 @@
+ #include <Library/BaseLib.h>
+ #include <Library/BaseMemoryLib.h>
+ #include <Library/DebugLib.h>
++#include <Library/DebugPrintErrorLevelLib.h>
+ #include <Library/DevicePathLib.h>
+ #include <Library/FrameBufferBltLib.h>
+ #include <Library/MemoryAllocationLib.h>
+@@ -259,6 +260,20 @@ InitializeQemuRamfb (
+ 
+   Status = QemuFwCfgFindFile ("etc/ramfb", &mRamfbFwCfgItem, &FwCfgSize);
+   if (EFI_ERROR (Status)) {
++ #if defined (MDE_CPU_AARCH64)
++    //
++    // RHBZ#1714446
++    // If no ramfb device was configured, this platform DXE driver should
++    // returns EFI_NOT_FOUND, so the DXE Core can unload it. However, even
++    // using a silent build, an error message is issued to the guest console.
++    // Since this confuse users, return success and stay resident. The wasted
++    // guest RAM still gets freed later after ExitBootServices().
++    //
++    if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
++      return EFI_SUCCESS;
++    }
++
++ #endif
+     return EFI_NOT_FOUND;
+   }
+ 
+-- 
+2.40.1
+

0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch

@@ -0,0 +1,131 @@
+From 88ca1daf0a9c0b6ea002f09b56cca1ab075ace9e Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 21 Nov 2017 00:57:47 +0100
+Subject: [PATCH 10/14] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in
+ NvmExpressDxe (RH only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Extend the DSC change to the new OvmfPkg/AmdSev platform, which has been
+  introduced upstream in commit 30d277ed7a82 ("OvmfPkg/Amdsev: Base commit
+  to build encrypted boot specific OVMF", 2020-12-14), for TianoCore#3077.
+
+- Remove obsolete commit message tags related to downstream patch
+  management: Message-id, Patchwork-id, O-Subject, Acked-by, From
+  (RHBZ#1846481).
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- no change
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Bugzilla: 1488247
+
+NvmExpressDxe logs all BlockIo read & write calls on the EFI_D_VERBOSE
+level.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(this patch was previously applied as commit 5f432837b9c60c2929b13dda1a1b488d5c3a6d2f)
+(cherry picked from commit 33e00146eb878588ad1395d7b1ae38f401729da4)
+(cherry picked from commit bd10cabcfcb1bc9a32b05062f4ee3792e27bc2d8)
+(cherry picked from commit 5a27af700f49e00608f232f618dedd7bf5e9b3e6)
+(cherry picked from commit 58bba429b9ec7b78109940ef945d0dc93f3cd958)
+(cherry picked from commit b8d0ebded8c2cf5b266c807519e2d8ccfd66fee6)
+(cherry picked from commit ed89844b47f46cfe911f1bf2bda40e537a908502)
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc | 5 ++++-
+ OvmfPkg/OvmfPkgIa32.dsc      | 5 ++++-
+ OvmfPkg/OvmfPkgIa32X64.dsc   | 5 ++++-
+ OvmfPkg/OvmfPkgX64.dsc       | 5 ++++-
+ 4 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index 870c4bd890fe..ad6e7724ee8e 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -678,7 +678,10 @@ [Components]
+   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index d7bce8d40d26..b644669291ac 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -834,7 +834,10 @@ [Components]
+   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 8103d1d4882a..e37ec97fbc7a 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -848,7 +848,10 @@ [Components.X64]
+   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index 7fe23d9153fe..1f4934616ada 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -922,7 +922,10 @@ [Components]
+   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+-- 
+2.40.1
+

0011-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch

@@ -0,0 +1,181 @@
+From 5e31bb6319ba4aabb113c2fb94e133a2efd79bb0 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Sat, 16 Nov 2019 17:11:27 +0100
+Subject: [PATCH 11/14] CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files
+ in the INFs (RH)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1938257
+
+- Recreate the patch based on downstream commits:
+
+  - 56c4bb81b311 ("CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files
+                  in the INFs (RH)", 2020-06-05),
+  - e81751a1c303 ("CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1g",
+                  2020-11-23),
+  - 3e3fe5e62079 ("redhat: bump OpenSSL dist-git submodule to 1.1.1g+ /
+                  RHEL-8.4", 2020-11-23).
+
+  (1) At e81751a1c303, downstream edk2 was in sync with upstream edk2
+      consuming OpenSSL 1.1.1g (upstream edk2 commit 8c30327debb2
+      ("CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1g", 2020-07-25)).
+
+      Since commit 8c30327debb2, upstream edk2 modified the OpensslLib INF
+      files, namely
+
+      - CryptoPkg/Library/OpensslLib/OpensslLib.inf
+      - CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+
+      in the following commits only:
+
+      - be01087e0780 ("CryptoPkg/Library: Remove the redundant build
+        option", 2020-08-12), which did not affect the source file list at
+        all,
+
+      - b5701a4c7a0f ("CryptoPkg: OpensslLib: Use RngLib to generate
+        entropy in rand_pool", 2020-09-18), which replaced some of the
+        *edk2-specific* "rand_pool_noise" source files with an RngLib
+        dependency.
+
+      This means that the list of required, actual OpenSSL source files
+      has not changed in upstream edk2 since our downstream edk2 commit
+      e81751a1c303.
+
+  (2) At commit 3e3fe5e62079 (the direct child of e81751a1c303),
+      downstream edk2's OpenSSL dependency was satisfied with RHEL-8
+      OpenSSL at dist-git commit bdd048e929dc ("Two fixes that will be
+      shipped in RHEL-8.3.0.z", 2020-10-23).
+
+      Since commit bdd048e929dc, RHEL-8 OpenSSL dist-git advanced
+      (fast-forwarded) to commit a75722161d20 ("Update to version 1.1.1k",
+      2021-05-25), which is the current head of the rhel-8.5.0 branch.
+      (See also <https://bugzilla.redhat.com/show_bug.cgi?id=1938257#c6>.)
+
+      At both dist-git bdd048e929dc and dist-git a75722161d20, I built the
+      respective RHEL-8 OpenSSL *source* RPM, and prepped the respective
+      source tree, with "rpmbuild -bp". Subsequently I compared the
+      prepped source trees recursively.
+
+      - The following files disappeared:
+
+        - 29 backup files created by "patch",
+
+        - the assembly generator perl script called
+          "ecp_nistz256-avx2.pl", which is not used during the build.
+
+      - The following new files appeared:
+
+        - 18 files directly or indirectly under the "test" subdirectory,
+          which are not used during the build,
+
+        - 5 backup files created by "patch",
+
+        - 2 DCL scripts used when building OpenSSL on OpenVMS.
+
+      This means that the total list of RHEL-8 OpenSSL source files has
+      not changed in RHEL-8 OpenSSL dist-git since our downstream edk2
+      commit 3e3fe5e62079.
+
+  As a result, copy the "RHEL8-specific OpenSSL file list" sections
+  verbatim from the INF files, at downstream commit e81751a1c303. (I used
+  the "git checkout -p e81751a1c303 -- Library/OpensslLib/OpensslLib.inf
+  CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf" command.)
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- "OpensslLib.inf":
+
+  - Automatic leading context refresh against upstream commit c72ca4666886
+    ("CryptoPkg/OpensslLib: Add "sort" keyword to header file parsing
+    loop", 2020-03-10).
+
+  - Manual trailing context refresh against upstream commit b49a6c8f80d9
+    ("CryptoPkg/OpensslLib: improve INF file consistency", 2019-12-02).
+
+- "OpensslLibCrypto.inf":
+
+  - Automatic leading context refresh against upstream commits
+    8906f076de35 ("CryptoPkg/OpensslLib: Add missing header files in INF
+    file", 2019-08-16) and 9f4fbd56d430 ("CryptoPkg/OpensslLib: Update
+    process_files.pl to generate .h files", 2019-10-30).
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- new patch
+
+The downstream changes in RHEL8's OpenSSL package, for example in
+"openssl-1.1.1-evp-kdf.patch", introduce new files, and even move some
+preexistent code into those new files. In order to avoid undefined
+references in link editing, we have to list the new files.
+
+Note: "process_files.pl" is not re-run at this time manually, because
+
+(a) "process_files.pl" would pollute the file list (and some of the
+    auto-generated header files) with RHEL8-specific FIPS artifacts, which
+    are explicitly unwanted in edk2,
+
+(b) The RHEL OpenSSL maintainer, Tomas Mraz, identified this specific set
+    of files in <https://bugzilla.redhat.com/show_bug.cgi?id=1749693#c10>,
+    and will help with future changes too.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 57bd3f146590df8757865d8f2cdd1db3cf3f4d40)
+(cherry picked from commit 56c4bb81b311dfcee6a34c81d3e4feeda7f88995)
+---
+ CryptoPkg/Library/OpensslLib/OpensslLib.inf       | 12 ++++++++++++
+ CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 12 ++++++++++++
+ 2 files changed, 24 insertions(+)
+
+diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
+index 0f64c9fa7eca..6d49136ed75e 100644
+--- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
++++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
+@@ -576,6 +576,18 @@ [Sources]
+   $(OPENSSL_PATH)/ssl/statem/statem.h
+   $(OPENSSL_PATH)/ssl/statem/statem_local.h
+ # Autogenerated files list ends here
++# RHEL8-specific OpenSSL file list starts here
++  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
++  $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
++  $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
++  $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
++  $(OPENSSL_PATH)/crypto/kdf/kdf_local.h
++  $(OPENSSL_PATH)/crypto/kdf/kdf_util.c
++  $(OPENSSL_PATH)/crypto/kdf/krb5kdf.c
++  $(OPENSSL_PATH)/crypto/kdf/pbkdf2.c
++  $(OPENSSL_PATH)/crypto/kdf/sshkdf.c
++  $(OPENSSL_PATH)/crypto/kdf/sskdf.c
++# RHEL8-specific OpenSSL file list ends here
+   buildinf.h
+   ossl_store.c
+   rand_pool.c
+diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+index 311cd1e6051a..f5ead202ec8e 100644
+--- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
++++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+@@ -526,6 +526,18 @@ [Sources]
+   $(OPENSSL_PATH)/crypto/x509v3/standard_exts.h
+   $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
+ # Autogenerated files list ends here
++# RHEL8-specific OpenSSL file list starts here
++  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
++  $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
++  $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
++  $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
++  $(OPENSSL_PATH)/crypto/kdf/kdf_local.h
++  $(OPENSSL_PATH)/crypto/kdf/kdf_util.c
++  $(OPENSSL_PATH)/crypto/kdf/krb5kdf.c
++  $(OPENSSL_PATH)/crypto/kdf/pbkdf2.c
++  $(OPENSSL_PATH)/crypto/kdf/sshkdf.c
++  $(OPENSSL_PATH)/crypto/kdf/sskdf.c
++# RHEL8-specific OpenSSL file list ends here
+   buildinf.h
+   ossl_store.c
+   rand_pool.c
+-- 
+2.40.1
+

0012-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch

@@ -0,0 +1,84 @@
+From 22d3b3dff458b0523fc3da5f22c96dce91e35d0c Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 24 Jun 2020 11:31:36 +0200
+Subject: [PATCH 12/14] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no
+ "-kernel" in silent aa64 build (RH)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Remove obsolete commit message tags related to downstream patch
+  management: Message-id, Patchwork-id, O-Subject, Acked-by, From,
+  RH-Acked-by, RH-Author (RHBZ#1846481).
+
+Bugzilla: 1844682
+
+If the "-kernel" QEMU option is not used, then QemuKernelLoaderFsDxe
+should return EFI_NOT_FOUND, so that the DXE Core can unload it. However,
+the associated error message, logged by the DXE Core to the serial
+console, is not desired in the silent edk2-aarch64 build, given that the
+absence of "-kernel" is nothing out of the ordinary. Therefore, return
+success and stay resident. The wasted guest RAM still gets freed after
+ExitBootServices().
+
+(Inspired by RHEL-8.1.0 commit aaaedc1e2cfd.)
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+(cherry picked from commit 9adcdf493ebbd11efb74e2905ab5f6c8996e096d)
+---
+ .../QemuKernelLoaderFsDxe.inf                  |  1 +
+ .../QemuKernelLoaderFsDxe.c                    | 18 ++++++++++++++++++
+ 2 files changed, 19 insertions(+)
+
+diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
+index 7b35adb8e034..e0331c6e2cbc 100644
+--- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
++++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
+@@ -28,6 +28,7 @@ [LibraryClasses]
+   BaseLib
+   BaseMemoryLib
+   DebugLib
++  DebugPrintErrorLevelLib
+   DevicePathLib
+   MemoryAllocationLib
+   QemuFwCfgLib
+diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
+index 3c12085f6c1e..e473c0b57345 100644
+--- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
++++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
+@@ -19,6 +19,7 @@
+ #include <Library/BaseMemoryLib.h>
+ #include <Library/BlobVerifierLib.h>
+ #include <Library/DebugLib.h>
++#include <Library/DebugPrintErrorLevelLib.h>
+ #include <Library/DevicePathLib.h>
+ #include <Library/MemoryAllocationLib.h>
+ #include <Library/QemuFwCfgLib.h>
+@@ -1081,6 +1082,23 @@ QemuKernelLoaderFsDxeEntrypoint (
+ 
+   if (KernelBlob->Data == NULL) {
+     Status = EFI_NOT_FOUND;
++ #if defined (MDE_CPU_AARCH64)
++    //
++    // RHBZ#1844682
++    //
++    // If the "-kernel" QEMU option is not being used, this platform DXE driver
++    // should return EFI_NOT_FOUND, so that the DXE Core can unload it.
++    // However, the associated error message, logged by the DXE Core to the
++    // serial console, is not desired in the silent edk2-aarch64 build, given
++    // that the absence of "-kernel" is nothing out of the ordinary. Therefore,
++    // return success and stay resident. The wasted guest RAM still gets freed
++    // after ExitBootServices().
++    //
++    if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
++      Status = EFI_SUCCESS;
++    }
++
++ #endif
+     goto FreeBlobs;
+   }
+ 
+-- 
+2.40.1
+

0013-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch

@@ -0,0 +1,82 @@
+From 583e3a67563e3f177a0e61dc41077e7413f100ef Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 24 Jun 2020 11:40:09 +0200
+Subject: [PATCH 13/14] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in
+ silent aa64 build (RH)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Remove obsolete commit message tags related to downstream patch
+  management: Message-id, Patchwork-id, O-Subject, Acked-by, From,
+  RH-Acked-by, RH-Author (RHBZ#1846481).
+
+Bugzilla: 1844682
+
+If swtpm / vTPM2 is not being used, Tcg2Dxe should return EFI_UNSUPPORTED,
+so that the DXE Core can unload it. However, the associated error message,
+logged by the DXE Core to the serial console, is not desired in the silent
+edk2-aarch64 build, given that the absence of swtpm / vTPM2 is nothing out
+of the ordinary. Therefore, return success and stay resident. The wasted
+guest RAM still gets freed after ExitBootServices().
+
+(Inspired by RHEL-8.1.0 commit aaaedc1e2cfd.)
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+(cherry picked from commit cbce29f7749477e271f9764fed82de94724af5df)
+---
+ SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf |  1 +
+ SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c   | 17 +++++++++++++++++
+ 2 files changed, 18 insertions(+)
+
+diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
+index 7dc7a2683d71..3bc88339311e 100644
+--- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
++++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
+@@ -55,6 +55,7 @@ [LibraryClasses]
+   UefiRuntimeServicesTableLib
+   BaseMemoryLib
+   DebugLib
++  DebugPrintErrorLevelLib
+   Tpm2CommandLib
+   PrintLib
+   UefiLib
+diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
+index f6ea8b2bbf18..681eb7e08b98 100644
+--- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
++++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
+@@ -28,6 +28,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ #include <Protocol/ResetNotification.h>
+ 
+ #include <Library/DebugLib.h>
++#include <Library/DebugPrintErrorLevelLib.h>
+ #include <Library/BaseMemoryLib.h>
+ #include <Library/UefiRuntimeServicesTableLib.h>
+ #include <Library/UefiDriverEntryPoint.h>
+@@ -2691,6 +2692,22 @@ DriverEntry (
+       CompareGuid (PcdGetPtr (PcdTpmInstanceGuid), &gEfiTpmDeviceInstanceTpm12Guid))
+   {
+     DEBUG ((DEBUG_INFO, "No TPM2 instance required!\n"));
++#if defined (MDE_CPU_AARCH64)
++    //
++    // RHBZ#1844682
++    //
++    // If swtpm / vTPM2 is not being used, this driver should return
++    // EFI_UNSUPPORTED, so that the DXE Core can unload it. However, the
++    // associated error message, logged by the DXE Core to the serial console,
++    // is not desired in the silent edk2-aarch64 build, given that the absence
++    // of swtpm / vTPM2 is nothing out of the ordinary. Therefore, return
++    // success and stay resident. The wasted guest RAM still gets freed after
++    // ExitBootServices().
++    //
++    if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
++      return EFI_SUCCESS;
++    }
++#endif
+     return EFI_UNSUPPORTED;
+   }
+ 
+-- 
+2.40.1
+

0015-OvmfPkg-PlatformPei-drop-S3Verification.patch

@@ -0,0 +1,72 @@
+From 55a09dea67c8818d1c871af825307fb3b2b0ba4b Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 23 May 2023 10:25:51 +0200
+Subject: [PATCH 15/27] OvmfPkg/PlatformPei: drop S3Verification()
+
+Not needed any more, SMM + 64-bit PEI + S3 suspend works now.
+
+Fixed by commits:
+ - 8bd2028f9ac3 ("MdeModulePkg: Supporting S3 in 64bit PEI")
+ - 6acf72901a2e ("UefiCpuPkg: Supporting S3 in 64bit PEI")
+See also https://bugzilla.tianocore.org/show_bug.cgi?id=4195
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Ray Ni <ray.ni@intel.com>
+(cherry picked from commit 098c55702318fd907de6fad7b43b5e9a6ad9ff7f)
+---
+ OvmfPkg/PlatformPei/Platform.c | 31 -------------------------------
+ 1 file changed, 31 deletions(-)
+
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index 5d7f50cc5876..ce9868d57de1 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -242,36 +242,6 @@ ReserveEmuVariableNvStore (
+   ASSERT_RETURN_ERROR (PcdStatus);
+ }
+ 
+-STATIC
+-VOID
+-S3Verification (
+-  IN EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+-  )
+-{
+- #if defined (MDE_CPU_X64)
+-  if (PlatformInfoHob->SmmSmramRequire && PlatformInfoHob->S3Supported) {
+-    DEBUG ((
+-      DEBUG_ERROR,
+-      "%a: S3Resume2Pei doesn't support X64 PEI + SMM yet.\n",
+-      __func__
+-      ));
+-    DEBUG ((
+-      DEBUG_ERROR,
+-      "%a: Please disable S3 on the QEMU command line (see the README),\n",
+-      __func__
+-      ));
+-    DEBUG ((
+-      DEBUG_ERROR,
+-      "%a: or build OVMF with \"OvmfPkgIa32X64.dsc\".\n",
+-      __func__
+-      ));
+-    ASSERT (FALSE);
+-    CpuDeadLoop ();
+-  }
+-
+- #endif
+-}
+-
+ STATIC
+ VOID
+ Q35BoardVerification (
+@@ -366,7 +336,6 @@ InitializePlatform (
+     ASSERT_EFI_ERROR (Status);
+   }
+ 
+-  S3Verification (PlatformInfoHob);
+   BootModeInitialization (PlatformInfoHob);
+ 
+   //
+-- 
+2.40.1
+

0016-OvmfPkg-PciHotPlugInitDxe-Do-not-reserve-IO-ports-by.patch

@@ -0,0 +1,47 @@
+From e54dd3f5c1ea0171317d9054d44b35d634ac4557 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 May 2023 11:47:58 +0200
+Subject: [PATCH 16/27] OvmfPkg/PciHotPlugInitDxe: Do not reserve IO ports by
+ default.
+
+Flip the default for IO address space reservations for PCI(e) bridges
+and root ports with hotplug support from TRUE to FALSE.
+
+PCI(e) bridges will still get IO address space assigned in case:
+
+  (a) Downstream devices actually need IO address space, or
+  (b) Explicit configuration, using "qemu -device
+      pcie-root-port,io-reserve=<size>".
+
+In case IO address space is exhausted edk2 will stop assigning resources
+to PCI(e) bridges.  This is not limited to IO resources, the affected
+bridges will not get any memory resources assigned either.
+
+This patch solves this issue by not handing out the scarce IO address
+space, which is not needed in most cases anyway.  Result is a more
+consistent PCI configuration in virtual machine configurations with many
+PCie root ports.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 27727338b2c0e3f50eb0176a1044e903fcb3c3b1)
+---
+ OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c b/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
+index 6b2b6797b3b6..69903a600981 100644
+--- a/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
++++ b/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
+@@ -589,7 +589,7 @@ GetResourcePadding (
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+-  DefaultIo       = TRUE;
++  DefaultIo       = FALSE;
+   DefaultMmio     = TRUE;
+   DefaultPrefMmio = TRUE;
+ 
+-- 
+2.40.1
+

0017-OvmfPkg-PlatformInitLib-check-PcdUse1GPageTable.patch

@@ -0,0 +1,51 @@
+From 543497088c1356c408f1bf79c06ab64b5c35be6b Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 17 May 2023 12:24:47 +0200
+Subject: [PATCH 17/27] OvmfPkg/PlatformInitLib: check PcdUse1GPageTable
+
+If PcdUse1GPageTable is not enabled restrict the physical address space
+used to 1TB, to limit the amount of memory needed for identity mapping
+page tables.
+
+The same already happens in case the processor has no support for
+gigabyte pages.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit d4d24001f78bcee965d8854fba6f08f48b4ec446)
+---
+ OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf | 1 +
+ OvmfPkg/Library/PlatformInitLib/MemDetect.c         | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
+index 86a82ad3e084..5a79d95b689c 100644
+--- a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
++++ b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
+@@ -58,6 +58,7 @@ [LibraryClasses.X64]
+ 
+ [Pcd]
+   gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress
++  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
+ 
+ [FixedPcd]
+   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase
+diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
+index acf90b4e93fd..1102b00ecbf0 100644
+--- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
++++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
+@@ -663,6 +663,11 @@ PlatformAddressWidthFromCpuid (
+       PhysBits = 40;
+     }
+ 
++    if (!FixedPcdGetBool (PcdUse1GPageTable) && (PhysBits > 40)) {
++      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 40 (PcdUse1GPageTable is false)\n", __func__));
++      PhysBits = 40;
++    }
++
+     PlatformInfoHob->PhysMemAddressWidth = PhysBits;
+     PlatformInfoHob->FirstNonAddress     = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth);
+   }
+-- 
+2.40.1
+

0018-OvmfPkg-OvmfPkgIa32X64-enable-1G-pages.patch

@@ -0,0 +1,31 @@
+From f1bbf3e4195bb21d4edfb2af8e940bceacc2ced4 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 17 May 2023 12:24:48 +0200
+Subject: [PATCH 18/27] OvmfPkg/OvmfPkgIa32X64: enable 1G pages
+
+Reduces the memory footprint and speeds up booting.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit b63e17d746aa6bab2b1101711395725005e71a02)
+---
+ OvmfPkg/OvmfPkgIa32X64.dsc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index e37ec97fbc7a..2b2f8e3e84d3 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -557,6 +557,9 @@ [PcdsFixedAtBuild]
+   # never lets the RAM below 4 GB exceed 2816 MB.
+   gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress|0xE0000000
+ 
++  # use 1G pages
++  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable|TRUE
++
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+   gEfiSourceLevelDebugPkgTokenSpaceGuid.PcdDebugLoadImageMethod|0x2
+ !endif
+-- 
+2.40.1
+

0019-OvmfPkg-MicrovmX64-enable-1G-pages.patch

@@ -0,0 +1,31 @@
+From 9c6bc52b413feda953158ad623237f6c9e7b533d Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 17 May 2023 12:24:49 +0200
+Subject: [PATCH 19/27] OvmfPkg/MicrovmX64: enable 1G pages
+
+Reduces the memory footprint and speeds up booting.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 04c5b3023e49c35d291f41d2c39b4d12a62b8f9c)
+---
+ OvmfPkg/Microvm/MicrovmX64.dsc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
+index 02c225f6d2a7..b0acab41103b 100644
+--- a/OvmfPkg/Microvm/MicrovmX64.dsc
++++ b/OvmfPkg/Microvm/MicrovmX64.dsc
+@@ -544,6 +544,9 @@ [PcdsFixedAtBuild]
+   gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesCode|0x100
+   gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesData|0x100
+ 
++  # use 1G pages
++  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable|TRUE
++
+   #
+   # Network Pcds
+   #
+-- 
+2.40.1
+

0020-OvmfPkg-VirtioSerialDxe-use-TPL_NOTIFY.patch

@@ -0,0 +1,39 @@
+From 71024b694fa3a6317ebbba1d79626f80d8dce792 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 12 May 2023 16:23:06 +0200
+Subject: [PATCH 20/27] OvmfPkg/VirtioSerialDxe: use TPL_NOTIFY
+
+Apparently TPL_CALLBACK is too low, code runs into an ASSERT
+complaining the new TPL is lower than the old TPL.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 4e5a804222415ec7b2bec90ea0300b8a9f60f131)
+---
+ OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c b/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
+index 522b25e9698c..e4a58deff162 100644
+--- a/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
++++ b/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
+@@ -158,7 +158,7 @@ VirtioSerialIoWrite (
+ 
+   VirtioSerialRingClearTx (SerialIo->Dev, PortTx (SerialIo->PortId));
+ 
+-  OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
++  OldTpl = gBS->RaiseTPL (TPL_NOTIFY);
+   if (SerialIo->WriteOffset &&
+       (SerialIo->WriteOffset + *BufferSize > PORT_TX_BUFSIZE))
+   {
+@@ -201,7 +201,7 @@ VirtioSerialIoRead (
+     goto NoData;
+   }
+ 
+-  OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
++  OldTpl = gBS->RaiseTPL (TPL_NOTIFY);
+   if (SerialIo->WriteOffset) {
+     DEBUG ((DEBUG_VERBOSE, "%a:%d: WriteFlush %d\n", __func__, __LINE__, SerialIo->WriteOffset));
+     VirtioSerialRingSendBuffer (
+-- 
+2.40.1
+

0021-OvmfPkg-QemuFlashFvbServicesRuntimeDxe-refine-flash-.patch

@@ -0,0 +1,51 @@
+From 8372a31938eb57921bd8a9a5dd5d56b838b074a2 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Jun 2023 08:08:03 +0200
+Subject: [PATCH 21/27] OvmfPkg/QemuFlashFvbServicesRuntimeDxe: refine flash
+ detection
+
+Flash can be write-protected in qemu (which is usually the case for
+code).  In case the variable store flash block is configured read-only
+ovmf wouldn't be able to store EFI variables there, so not setting up
+fvb in that case (and fallhack to emulation) is the better option.
+It'll avoid problems later due to flash writes failing.
+
+The patch tries to write back the original value read earlier, so flash
+content doesn't change in case the write succeeds.  But the status we
+read back after the attempt to write will tell us whenever flash is
+writable or not.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 578a715cfc6abc08ead8f585f096789374254b2a)
+---
+ OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c
+index 54f859de9ff9..a577aea55614 100644
+--- a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c
++++ b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c
+@@ -114,9 +114,17 @@ QemuFlashDetected (
+       DEBUG ((DEBUG_INFO, "QemuFlashDetected => FD behaves as RAM\n"));
+       *Ptr = OriginalUint8;
+     } else if (ProbeUint8 == CLEARED_ARRAY_STATUS) {
+-      DEBUG ((DEBUG_INFO, "QemuFlashDetected => FD behaves as FLASH\n"));
+-      FlashDetected = TRUE;
+-      *Ptr          = READ_ARRAY_CMD;
++      *Ptr       = WRITE_BYTE_CMD;
++      *Ptr       = OriginalUint8;
++      *Ptr       = READ_STATUS_CMD;
++      ProbeUint8 = *Ptr;
++      *Ptr       = READ_ARRAY_CMD;
++      if (ProbeUint8 & 0x10 /* programming error */) {
++        DEBUG ((DEBUG_INFO, "QemuFlashDetected => FD behaves as FLASH, write-protected\n"));
++      } else {
++        DEBUG ((DEBUG_INFO, "QemuFlashDetected => FD behaves as FLASH, writable\n"));
++        FlashDetected = TRUE;
++      }
+     }
+   }
+ 
+-- 
+2.40.1
+

0022-OvmfPkg-PlatformInitLib-limit-phys-bits-to-46.patch

@@ -0,0 +1,47 @@
+From cdb34f5003b9001d12d1841e8a4eeab9471ab928 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Jun 2023 09:57:31 +0200
+Subject: [PATCH 22/27] OvmfPkg/PlatformInitLib: limit phys-bits to 46.
+
+Older linux kernels have problems with phys-bits larger than 46,
+ubuntu 18.04 (kernel 4.15) has been reported to be affected.
+
+Reduce phys-bits limit from 47 to 46.
+
+Reported-by: Fiona Ebner <f.ebner@proxmox.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit c1e853769046b322690ad336fdb98966757e7414)
+---
+ OvmfPkg/Library/PlatformInitLib/MemDetect.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
+index 1102b00ecbf0..662e7e85bbc5 100644
+--- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
++++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
+@@ -646,16 +646,19 @@ PlatformAddressWidthFromCpuid (
+     ));
+ 
+   if (Valid) {
+-    if (PhysBits > 47) {
++    if (PhysBits > 46) {
+       /*
+        * Avoid 5-level paging altogether for now, which limits
+        * PhysBits to 48.  Also avoid using address bit 48, due to sign
+        * extension we can't identity-map these addresses (and lots of
+        * places in edk2 assume we have everything identity-mapped).
+        * So the actual limit is 47.
++       *
++       * Also some older linux kernels apparently have problems handling
++       * phys-bits > 46 correctly, so use that as limit.
+        */
+-      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 47 (avoid 5-level paging)\n", __func__));
+-      PhysBits = 47;
++      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 46 (avoid 5-level paging)\n", __func__));
++      PhysBits = 46;
+     }
+ 
+     if (!Page1GSupport && (PhysBits > 40)) {
+-- 
+2.40.1
+

0023-ArmVirt-add-VirtioSerialDxe-to-ArmVirtQemu-builds.patch

@@ -0,0 +1,53 @@
+From bc308234de0455d9448f6b841506bd1e2b04b024 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Jun 2023 13:57:10 +0200
+Subject: [PATCH 23/27] ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 6925150febb3a76d8e40c19babcc578555ca78fe)
+---
+ ArmVirtPkg/ArmVirtQemu.dsc           | 1 +
+ ArmVirtPkg/ArmVirtQemuKernel.dsc     | 1 +
+ ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index bc097880f79f..a03f5e4d43cf 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
++++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -453,6 +453,7 @@ [Components.common]
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+   OvmfPkg/VirtioNetDxe/VirtioNet.inf
+   OvmfPkg/VirtioRngDxe/VirtioRng.inf
++  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ 
+   #
+   # FAT filesystem + GPT/MBR partitioning + UDF filesystem + virtio-fs
+diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+index 02877284bfa3..e7d76a6502c7 100644
+--- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
++++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+@@ -353,6 +353,7 @@ [Components.common]
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+   OvmfPkg/VirtioNetDxe/VirtioNet.inf
+   OvmfPkg/VirtioRngDxe/VirtioRng.inf
++  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ 
+   #
+   # FAT filesystem + GPT/MBR partitioning + UDF filesystem + virtio-fs
+diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+index 8a063bac04ac..2894bc853a46 100644
+--- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
++++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+@@ -98,6 +98,7 @@ [FV.FvMain]
+   INF OvmfPkg/VirtioNetDxe/VirtioNet.inf
+   INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
++  INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ 
+   INF ShellPkg/Application/Shell/Shell.inf
+   INF ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+-- 
+2.40.1
+

0024-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtio.patch

@@ -0,0 +1,68 @@
+From f0d2e5cf0f436cf48afae5e7b86bd5bd7e137751 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Jun 2023 13:57:11 +0200
+Subject: [PATCH 24/27] ArmVirt/PlatformBootManagerLib: factor out IsVirtio()
+
+IsVirtioRng() becomes just a thin wrapper for IsVirtio().
+This allows to add similar thin wrappers for other virtio
+devices in the future.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit a196b04926e70880334fcd649837d0ac63b0bfd5)
+---
+ .../PlatformBootManagerLib/PlatformBm.c       | 26 +++++++++++++++----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+index 10c815378cd5..5eb6f0f9c14a 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
++++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+@@ -269,15 +269,16 @@ IsPciDisplay (
+ }
+ 
+ /**
+-  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
+-  the VIRTIO_DEVICE_PROTOCOL level.
++  This function checks if a handle corresponds to the Virtio Device ID given
++  at the VIRTIO_DEVICE_PROTOCOL level.
+ **/
+ STATIC
+ BOOLEAN
+ EFIAPI
+-IsVirtioRng (
++IsVirtio (
+   IN EFI_HANDLE    Handle,
+-  IN CONST CHAR16  *ReportText
++  IN CONST CHAR16  *ReportText,
++  IN UINT16        VirtIoDeviceId
+   )
+ {
+   EFI_STATUS              Status;
+@@ -293,7 +294,22 @@ IsVirtioRng (
+   }
+ 
+   return (BOOLEAN)(VirtIo->SubSystemDeviceId ==
+-                   VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
++                   VirtIoDeviceId);
++}
++
++/**
++  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
++  the VIRTIO_DEVICE_PROTOCOL level.
++**/
++STATIC
++BOOLEAN
++EFIAPI
++IsVirtioRng (
++  IN EFI_HANDLE    Handle,
++  IN CONST CHAR16  *ReportText
++  )
++{
++  return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
+ }
+ 
+ /**
+-- 
+2.40.1
+

0025-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtioPc.patch

@@ -0,0 +1,90 @@
+From 7863796aacb5dc2acd852920bd33a3fec167c80b Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Jun 2023 13:57:12 +0200
+Subject: [PATCH 25/27] ArmVirt/PlatformBootManagerLib: factor out
+ IsVirtioPci()
+
+IsVirtioPciRng() becomes just a thin wrapper for IsVirtioPci().
+This allows to add similar thin wrappers for other virtio
+devices in the future.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit aaf546879ab71722c36738ccc6f0f0ab4ecf5076)
+---
+ .../PlatformBootManagerLib/PlatformBm.c       | 30 ++++++++++++++-----
+ 1 file changed, 23 insertions(+), 7 deletions(-)
+
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+index 5eb6f0f9c14a..ed38c42a43ee 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
++++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+@@ -313,15 +313,16 @@ IsVirtioRng (
+ }
+ 
+ /**
+-  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
+-  the EFI_PCI_IO_PROTOCOL level.
++  This function checks if a handle corresponds to the Virtio Device ID given
++  at the EFI_PCI_IO_PROTOCOL level.
+ **/
+ STATIC
+ BOOLEAN
+ EFIAPI
+-IsVirtioPciRng (
++IsVirtioPci (
+   IN EFI_HANDLE    Handle,
+-  IN CONST CHAR16  *ReportText
++  IN CONST CHAR16  *ReportText,
++  IN UINT16        VirtIoDeviceId
+   )
+ {
+   EFI_STATUS           Status;
+@@ -387,11 +388,11 @@ IsVirtioPciRng (
+   //
+   // From DeviceId and RevisionId, determine whether the device is a
+   // modern-only Virtio 1.0 device. In case of Virtio 1.0, DeviceId can
+-  // immediately be restricted to VIRTIO_SUBSYSTEM_ENTROPY_SOURCE, and
++  // immediately be restricted to VirtIoDeviceId, and
+   // SubsystemId will only play a sanity-check role. Otherwise, DeviceId can
+   // only be sanity-checked, and SubsystemId will decide.
+   //
+-  if ((DeviceId == 0x1040 + VIRTIO_SUBSYSTEM_ENTROPY_SOURCE) &&
++  if ((DeviceId == 0x1040 + VirtIoDeviceId) &&
+       (RevisionId >= 0x01))
+   {
+     Virtio10 = TRUE;
+@@ -419,7 +420,7 @@ IsVirtioPciRng (
+     return TRUE;
+   }
+ 
+-  if (!Virtio10 && (SubsystemId == VIRTIO_SUBSYSTEM_ENTROPY_SOURCE)) {
++  if (!Virtio10 && (SubsystemId == VirtIoDeviceId)) {
+     return TRUE;
+   }
+ 
+@@ -430,6 +431,21 @@ IsVirtioPciRng (
+   return FALSE;
+ }
+ 
++/**
++  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
++  the EFI_PCI_IO_PROTOCOL level.
++**/
++STATIC
++BOOLEAN
++EFIAPI
++IsVirtioPciRng (
++  IN EFI_HANDLE    Handle,
++  IN CONST CHAR16  *ReportText
++  )
++{
++  return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
++}
++
+ /**
+   This CALLBACK_FUNCTION attempts to connect a handle non-recursively, asking
+   the matching driver to produce all first-level child handles.
+-- 
+2.40.1
+

0026-ArmVirt-PlatformBootManagerLib-set-up-virtio-serial-.patch

@@ -0,0 +1,222 @@
+From 83a8a9dc1a51d340199587d5bea715406bbc4efa Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Jun 2023 13:57:13 +0200
+Subject: [PATCH 26/27] ArmVirt/PlatformBootManagerLib: set up virtio serial as
+ console
+
+In case a virtio serial device is found in the system register the first
+console port as EFI console, by updating ConIn, ConOut and ErrOut.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 15f83fa36442eaa272300b31699b3b82ce7e07a9)
+---
+ .../PlatformBootManagerLib/PlatformBm.c       | 172 ++++++++++++++++++
+ 1 file changed, 172 insertions(+)
+
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+index ed38c42a43ee..b92a916f7eec 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
++++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+@@ -312,6 +312,21 @@ IsVirtioRng (
+   return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
+ }
+ 
++/**
++  This FILTER_FUNCTION checks if a handle corresponds to a Virtio serial device at
++  the VIRTIO_DEVICE_PROTOCOL level.
++**/
++STATIC
++BOOLEAN
++EFIAPI
++IsVirtioSerial (
++  IN EFI_HANDLE    Handle,
++  IN CONST CHAR16  *ReportText
++  )
++{
++  return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_CONSOLE);
++}
++
+ /**
+   This function checks if a handle corresponds to the Virtio Device ID given
+   at the EFI_PCI_IO_PROTOCOL level.
+@@ -446,6 +461,21 @@ IsVirtioPciRng (
+   return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
+ }
+ 
++/**
++  This FILTER_FUNCTION checks if a handle corresponds to a Virtio serial device at
++  the EFI_PCI_IO_PROTOCOL level.
++**/
++STATIC
++BOOLEAN
++EFIAPI
++IsVirtioPciSerial (
++  IN EFI_HANDLE    Handle,
++  IN CONST CHAR16  *ReportText
++  )
++{
++  return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_CONSOLE);
++}
++
+ /**
+   This CALLBACK_FUNCTION attempts to connect a handle non-recursively, asking
+   the matching driver to produce all first-level child handles.
+@@ -534,6 +564,142 @@ AddOutput (
+     ));
+ }
+ 
++/**
++  This CALLBACK_FUNCTION retrieves the EFI_DEVICE_PATH_PROTOCOL from
++  the handle, appends serial, uart and terminal nodes, finally updates
++  ConIn, ConOut and ErrOut.
++**/
++STATIC
++VOID
++EFIAPI
++SetupVirtioSerial (
++  IN EFI_HANDLE    Handle,
++  IN CONST CHAR16  *ReportText
++  )
++{
++  STATIC CONST ACPI_HID_DEVICE_PATH  SerialNode = {
++    {
++      ACPI_DEVICE_PATH,
++      ACPI_DP,
++      {
++        (UINT8)(sizeof (ACPI_HID_DEVICE_PATH)),
++        (UINT8)((sizeof (ACPI_HID_DEVICE_PATH)) >> 8)
++      },
++    },
++    EISA_PNP_ID (0x0501),
++    0
++  };
++
++  STATIC CONST UART_DEVICE_PATH  UartNode = {
++    {
++      MESSAGING_DEVICE_PATH,
++      MSG_UART_DP,
++      {
++        (UINT8)(sizeof (UART_DEVICE_PATH)),
++        (UINT8)((sizeof (UART_DEVICE_PATH)) >> 8)
++      },
++    },
++    0,
++    115200,
++    8,
++    1,
++    1
++  };
++
++  STATIC CONST VENDOR_DEVICE_PATH  TerminalNode = {
++    {
++      MESSAGING_DEVICE_PATH,
++      MSG_VENDOR_DP,
++      {
++        (UINT8)(sizeof (VENDOR_DEVICE_PATH)),
++        (UINT8)((sizeof (VENDOR_DEVICE_PATH)) >> 8)
++      },
++    },
++    DEVICE_PATH_MESSAGING_VT_UTF8
++  };
++
++  EFI_STATUS                Status;
++  EFI_DEVICE_PATH_PROTOCOL  *DevicePath, *OldDevicePath;
++
++  DevicePath = DevicePathFromHandle (Handle);
++
++  if (DevicePath == NULL) {
++    DEBUG ((
++      DEBUG_ERROR,
++      "%a: %s: handle %p: device path not found\n",
++      __func__,
++      ReportText,
++      Handle
++      ));
++    return;
++  }
++
++  DevicePath = AppendDevicePathNode (
++                 DevicePath,
++                 &SerialNode.Header
++                 );
++
++  OldDevicePath = DevicePath;
++  DevicePath    = AppendDevicePathNode (
++                    DevicePath,
++                    &UartNode.Header
++                    );
++  FreePool (OldDevicePath);
++
++  OldDevicePath = DevicePath;
++  DevicePath    = AppendDevicePathNode (
++                    DevicePath,
++                    &TerminalNode.Header
++                    );
++  FreePool (OldDevicePath);
++
++  Status = EfiBootManagerUpdateConsoleVariable (ConIn, DevicePath, NULL);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((
++      DEBUG_ERROR,
++      "%a: %s: adding to ConIn: %r\n",
++      __func__,
++      ReportText,
++      Status
++      ));
++    return;
++  }
++
++  Status = EfiBootManagerUpdateConsoleVariable (ConOut, DevicePath, NULL);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((
++      DEBUG_ERROR,
++
++      "%a: %s: adding to ConOut: %r\n",
++      __func__,
++      ReportText,
++      Status
++      ));
++    return;
++  }
++
++  Status = EfiBootManagerUpdateConsoleVariable (ErrOut, DevicePath, NULL);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((
++      DEBUG_ERROR,
++      "%a: %s: adding to ErrOut: %r\n",
++      __func__,
++      ReportText,
++      Status
++      ));
++    return;
++  }
++
++  FreePool (DevicePath);
++
++  DEBUG ((
++    DEBUG_VERBOSE,
++    "%a: %s: added to ConIn, ConOut and ErrOut\n",
++    __func__,
++    ReportText
++    ));
++}
++
+ STATIC
+ VOID
+ PlatformRegisterFvBootOption (
+@@ -932,6 +1098,12 @@ PlatformBootManagerBeforeConsole (
+   // instances on Virtio PCI RNG devices.
+   //
+   FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciRng, Connect);
++
++  //
++  // Register Virtio serial devices as console.
++  //
++  FilterAndProcess (&gVirtioDeviceProtocolGuid, IsVirtioSerial, SetupVirtioSerial);
++  FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciSerial, SetupVirtioSerial);
+ }
+ 
+ /**
+-- 
+2.40.1
+

0027-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch

@@ -0,0 +1,42 @@
+From e2fb1116801f5725812b37f18022fe46959bd5fb Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 28 Feb 2023 15:47:00 +0100
+Subject: [PATCH 27/27] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
+
+In case the number of CPUs can in increase beyond 255
+due to CPU hotplug choose x2apic mode.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ UefiCpuPkg/Library/MpInitLib/MpLib.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
+index f1f284071441..79fd8fb04dad 100644
+--- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
++++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
+@@ -526,7 +526,9 @@ CollectProcessorCount (
+   //
+   // Enable x2APIC mode if
+   //  1. Number of CPU is greater than 255; or
+-  //  2. There are any logical processors reporting an Initial APIC ID of 255 or greater.
++  //  2. The platform exposed the exact *boot* CPU count to us in advance, and
++  //     more than 255 logical processors are possible later, with hotplug; or
++  //  3. There are any logical processors reporting an Initial APIC ID of 255 or greater.
+   //
+   X2Apic = FALSE;
+   if (CpuMpData->CpuCount > 255) {
+@@ -534,6 +536,10 @@ CollectProcessorCount (
+     // If there are more than 255 processor found, force to enable X2APIC
+     //
+     X2Apic = TRUE;
++  } else if ((PcdGet32 (PcdCpuBootLogicalProcessorNumber) > 0) &&
++             (PcdGet32 (PcdCpuMaxLogicalProcessorNumber) > 255))
++  {
++    X2Apic = TRUE;
+   } else {
+     CpuInfoInHob = (CPU_INFO_IN_HOB *)(UINTN)CpuMpData->CpuInfoInHob;
+     for (Index = 0; Index < CpuMpData->CpuCount; Index++) {
+-- 
+2.40.1
+

0028-ArmPkg-Add-Pcd-to-disable-EFI_MEMORY_ATTRIBUTE_PROTO.patch

@@ -0,0 +1,77 @@
+From 40efdacf7f4f378c0acf95a73d1dcc5e200d42d8 Mon Sep 17 00:00:00 2001
+From: Oliver Steffen <osteffen@redhat.com>
+Date: Mon, 19 Jun 2023 22:32:25 +0200
+Subject: [PATCH 28/28] ArmPkg: Add Pcd to disable
+ EFI_MEMORY_ATTRIBUTE_PROTOCOL
+
+Recent versions of shim (15.6 and 15.7) crash when the newly added
+EFI_MEMORY_ATTRIBUTE_PROTOCOL is provided by the firmware.  To allow
+existing installations to boot, provide a workaround in form of a Pcd
+that allows tuning it off at build time (defaults to 'enabled').
+
+Additionally, check the return code of the protocol installation calls.
+
+Signed-off-by: Oliver Steffen <osteffen@redhat.com>
+Message-ID: <20230619203244.228933-1-osteffen@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ ArmPkg/ArmPkg.dec                |  3 +++
+ ArmPkg/Drivers/CpuDxe/CpuDxe.inf |  1 +
+ ArmPkg/Drivers/CpuDxe/CpuDxe.c   | 13 +++++++++++--
+ 3 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/ArmPkg/ArmPkg.dec b/ArmPkg/ArmPkg.dec
+index 2444457ae58a..625e45c3e0c0 100644
+--- a/ArmPkg/ArmPkg.dec
++++ b/ArmPkg/ArmPkg.dec
+@@ -167,6 +167,9 @@ [PcdsFixedAtBuild.common]
+   gArmTokenSpaceGuid.PcdCpuVectorBaseAddress|0xffff0000|UINT64|0x00000004
+   gArmTokenSpaceGuid.PcdCpuResetAddress|0x00000000|UINT32|0x00000005
+ 
++  # Enable/Disable EFI_MEMORY_ATTRIBUTE_PROTOCOL
++  gArmTokenSpaceGuid.PcdEnableEfiMemoryAttributeProtocol|FALSE|BOOLEAN|0x000000EE
++
+   #
+   # ARM Secure Firmware PCDs
+   #
+diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.inf b/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
+index e732e21cb94a..1bad4ae160af 100644
+--- a/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
++++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
+@@ -64,6 +64,7 @@ [Guids]
+ 
+ [Pcd.common]
+   gArmTokenSpaceGuid.PcdVFPEnabled
++  gArmTokenSpaceGuid.PcdEnableEfiMemoryAttributeProtocol
+ 
+ [FeaturePcd.common]
+   gArmTokenSpaceGuid.PcdDebuggerExceptionSupport
+diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.c b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
+index d04958e79e52..ff7d735b2bde 100644
+--- a/ArmPkg/Drivers/CpuDxe/CpuDxe.c
++++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
+@@ -244,10 +244,19 @@ CpuDxeInitialize (
+                   &mCpuHandle,
+                   &gEfiCpuArchProtocolGuid,
+                   &mCpu,
+-                  &gEfiMemoryAttributeProtocolGuid,
+-                  &mMemoryAttribute,
+                   NULL
+                   );
++  ASSERT_EFI_ERROR (Status);
++
++  if (PcdGetBool (PcdEnableEfiMemoryAttributeProtocol)) {
++    Status = gBS->InstallMultipleProtocolInterfaces (
++                    &mCpuHandle,
++                    &gEfiMemoryAttributeProtocolGuid,
++                    &mMemoryAttribute,
++                    NULL
++                    );
++    ASSERT_EFI_ERROR (Status);
++  }
+ 
+   //
+   // Make sure GCD and MMU settings match. This API calls gDS->SetMemorySpaceAttributes ()
+-- 
+2.41.0
+

30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json

@@ -0,0 +1,36 @@
+{
+    "description": "OVMF with SB+SMM, SB enabled, MS certs enrolled",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2",
+            "format": "qcow2"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2",
+            "format": "qcow2"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "acpi-s3",
+        "enrolled-keys",
+        "requires-smm",
+        "secure-boot",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}

30-edk2-ovmf-ia32-sb-enrolled.json

@@ -0,0 +1,36 @@
+{
+    "description": "OVMF for i386, with SB+SMM, SB enabled, MS certs enrolled",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_CODE.secboot.fd",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_VARS.secboot.fd",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "i386",
+            "machines": [
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "acpi-s3",
+        "enrolled-keys",
+        "requires-smm",
+        "secure-boot",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}

31-edk2-ovmf-2m-raw-x64-sb-enrolled.json

@@ -0,0 +1,36 @@
+{
+    "description": "OVMF with SB+SMM, SB enabled, MS certs enrolled",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "acpi-s3",
+        "enrolled-keys",
+        "requires-smm",
+        "secure-boot",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}

40-edk2-ovmf-4m-qcow2-x64-sb.json

@@ -0,0 +1,35 @@
+{
+    "description": "OVMF with SB+SMM, empty varstore",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2",
+            "format": "qcow2"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_VARS_4M.qcow2",
+            "format": "qcow2"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "acpi-s3",
+        "requires-smm",
+        "secure-boot",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}

40-edk2-ovmf-ia32-sb.json

@@ -0,0 +1,35 @@
+{
+    "description": "OVMF for i386, with SB+SMM, empty varstore",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_CODE.secboot.fd",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_VARS.fd",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "i386",
+            "machines": [
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "acpi-s3",
+        "requires-smm",
+        "secure-boot",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}

41-edk2-ovmf-2m-raw-x64-sb.json

@@ -0,0 +1,35 @@
+{
+    "description": "OVMF with SB+SMM, empty varstore",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_VARS.fd",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "acpi-s3",
+        "requires-smm",
+        "secure-boot",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}

50-edk2-aarch64-qcow2.json

@@ -0,0 +1,32 @@
+{
+    "description": "UEFI firmware for ARM64 virtual machines",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.qcow2",
+            "format": "qcow2"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/aarch64/vars-template-pflash.qcow2",
+            "format": "qcow2"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "aarch64",
+            "machines": [
+                "virt-*"
+            ]
+        }
+    ],
+    "features": [
+
+    ],
+    "tags": [
+
+    ]
+}

50-edk2-arm-verbose.json

@@ -0,0 +1,32 @@
+{
+    "description": "UEFI firmware for arm, verbose logs",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/arm/QEMU_EFI-pflash.raw",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/arm/vars-template-pflash.raw",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "arm",
+            "machines": [
+                "virt-*"
+            ]
+        }
+    ],
+    "features": [
+        "verbose-static"
+    ],
+    "tags": [
+
+    ]
+}

50-edk2-ovmf-4m-qcow2-x64-nosb.json

@@ -0,0 +1,36 @@
+{
+    "description": "OVMF without SB+SMM, empty varstore",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_CODE_4M.qcow2",
+            "format": "qcow2"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_VARS_4M.qcow2",
+            "format": "qcow2"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "pc-i440fx-*",
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "acpi-s3",
+        "amd-sev",
+        "amd-sev-es",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}

50-edk2-ovmf-ia32-nosb.json

@@ -0,0 +1,34 @@
+{
+    "description": "OVMF for i386, without SB+SMM, empty varstore",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_CODE.fd",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_VARS.fd",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "i386",
+            "machines": [
+                "pc-i440fx-*",
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "acpi-s3",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}

50-edk2-ovmf-x64-microvm.json

@@ -0,0 +1,22 @@
+{
+    "description": "OVMF for microvm",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "memory",
+        "filename": "/usr/share/edk2/ovmf/MICROVM.fd"
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "microvm"
+            ]
+        }
+    ],
+    "features": [
+    ],
+    "tags": [
+    ]
+}

51-edk2-aarch64-raw.json

@@ -0,0 +1,32 @@
+{
+    "description": "UEFI firmware for ARM64 virtual machines",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/aarch64/vars-template-pflash.raw",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "aarch64",
+            "machines": [
+                "virt-*"
+            ]
+        }
+    ],
+    "features": [
+
+    ],
+    "tags": [
+
+    ]
+}

51-edk2-ovmf-2m-raw-x64-nosb.json

@@ -0,0 +1,36 @@
+{
+    "description": "OVMF without SB+SMM, empty varstore",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.fd",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_VARS.fd",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "pc-i440fx-*",
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "acpi-s3",
+        "amd-sev",
+        "amd-sev-es",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}

52-edk2-aarch64-verbose-qcow2.json

@@ -0,0 +1,32 @@
+{
+    "description": "UEFI firmware for ARM64 virtual machines, verbose logs",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/aarch64/QEMU_EFI-pflash.qcow2",
+            "format": "qcow2"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/aarch64/vars-template-pflash.qcow2",
+            "format": "qcow2"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "aarch64",
+            "machines": [
+                "virt-*"
+            ]
+        }
+    ],
+    "features": [
+        "verbose-static"
+    ],
+    "tags": [
+
+    ]
+}

53-edk2-aarch64-verbose-raw.json

@@ -0,0 +1,32 @@
+{
+    "description": "UEFI firmware for ARM64 virtual machines, verbose logs",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode" : "split",
+        "executable": {
+            "filename": "/usr/share/edk2/aarch64/QEMU_EFI-pflash.raw",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/aarch64/vars-template-pflash.raw",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "aarch64",
+            "machines": [
+                "virt-*"
+            ]
+        }
+    ],
+    "features": [
+        "verbose-static"
+    ],
+    "tags": [
+
+    ]
+}

60-edk2-ovmf-x64-amdsev.json

@@ -0,0 +1,31 @@
+{
+    "description": "OVMF with SEV-ES support",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode": "stateless",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf/OVMF.amdsev.fd",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "amd-sev",
+        "amd-sev-es",
+        "amd-sev-snp",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}

60-edk2-ovmf-x64-inteltdx.json

@@ -0,0 +1,29 @@
+{
+    "description": "OVMF with TDX support",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode": "stateless",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.fd",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "intel-tdx",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}

basetools-arm.patch

@@ -1,14 +0,0 @@
-diff --git a/Source/C/GNUmakefile b/Source/C/GNUmakefile
-index e0dde3e..bee0059 100644
---- a/Source/C/GNUmakefile
-+++ b/Source/C/GNUmakefile
-@@ -22,6 +22,9 @@ ifndef ARCH
-   ifneq (,$(strip $(filter $(uname_m), x86_64 amd64)))
-     ARCH=X64
-   endif
-+  ifeq ($(patsubst arm%,ARM,$(uname_m)),ARM)
-+    ARCH=ARM
-+  endif
-   ifeq ($(patsubst i%86,IA32,$(uname_m)),IA32)
-     ARCH=IA32
-   endif

changelog

@@ -0,0 +1,369 @@
+* Thu Apr 27 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-4
+- fix tpm detection.
+
+* Thu Apr 13 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-2
+- add StandaloneMM and ArmVirtQemuKernel builds.
+- add json files for qcow2 images.
+- update dbx files to 2023-03.
+
+* Mon Mar 06 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-1
+- update to edk2-stable202302
+- update dbx database to 20220812
+- add riscv64 sub-rpm
+
+* Fri Feb 17 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-14
+- add sub-package with xen build (resolves: rhbz#2170730)
+
+* Sat Feb 11 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-13
+- update openssl (CVE-2023-0286, CVE-2023-0215, CVE-2022-4450, CVE-2022-4304).
+
+* Wed Feb 08 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-12
+- cherry-pick aarch64 bugfixes.
+- set firmware build release date.
+- add ext4 sub-package.
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 20221117gitfff6d81270b5-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Fri Jan 06 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-10
+- add experimental builds with strict nx checking.
+
+* Mon Jan 02 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-9
+- revert 'make files sparse again' (resolves: rhbz#2155673).
+- pick up compiler + linker flags from rpm
+
+* Tue Dec 20 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-8
+- make files sparse again
+
+* Thu Dec 15 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-7
+- backport https://github.com/tianocore/edk2/pull/3770
+
+* Mon Dec 12 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-6
+- fix ovmf platform config (revert broken commit).
+- show version information in smbios (backport).
+
+* Mon Dec 05 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-5
+- rename *.json files to be more consistent.
+- build script update
+
+* Fri Dec 02 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-4
+- apply dbx updates
+
+* Tue Nov 29 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-3
+- fix build script
+
+* Mon Nov 28 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-2
+- add workaround for broken grub
+
+* Tue Sep 20 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220826gitba0e0e4c6a17-1
+- update edk2 to 2022-08 stable tag.
+- update openssl bundle to rhel-8.7 level.
+- add stdvga fix.
+- add 4MB firmware builds.
+
+* Thu Aug 18 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-5
+- comment out patch #4 (bug 2116534 workaround)
+- comment out patch #12 (bug 2114858 workaround)
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 20220526git16779ede2d36-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Fri Jun 10 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-3
+- swap stack fix patch.
+
+* Wed Jun 08 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-2
+- fix PcdResizeXterm patch.
+- minor specfile cleanup.
+- add 0021-OvmfPkg-Sec-fix-stack-switch.patch
+- Resolves rhbz#2093745
+
+* Tue May 31 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-1
+- update to new edk2 stable tag (2022-05), refresh patches.
+- add amdsev and inteltdx builds
+- drop qosb
+
+* Tue Apr 19 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220221gitb24306f15daa-4
+- switch to virt-firmware for secure boot key enrollment
+- Stop builds on armv7 too (iasl missing).
+
+* Thu Apr 07 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220221gitb24306f15daa-3
+- Fix TPM build options.
+- Stop builds on i686 (iasl missing).
+- Resolves rhbz#2072827
+
+* Wed Mar 23 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220221gitb24306f15daa-1
+- Update to edk2-stable202202
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 20211126gitbb1bba3d7767-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Mon Dec 6 2021 Gerd Hoffmann <kraxel@redhat.com> - 20211126gitbb1bba3d7767-1
+- Update to edk2-stable202111
+- Resolves rhbz#1978966
+- Resolves rhbz#2026744
+
+* Mon Dec  6 2021 Daniel P. Berrangé <berrange@redhat.com> - 20210527gite1999b264f1f-5
+- Drop glibc strcmp workaround
+
+* Mon Nov 29 2021 Daniel P. Berrangé <berrange@redhat.com> - 20210527gite1999b264f1f-4
+- Drop customized splash screen boot logo
+- Temporary workaround for suspected glibc strcmp bug breaking builds in koji
+
+* Wed Sep  1 2021 Daniel P. Berrangé <berrange@redhat.com> - 20210527gite1999b264f1f-3
+- Fix qemu packaging conditionals for ELN builds
+
+* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 20210527gite1999b264f1f-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Tue Jul 20 2021 Cole Robinson <crobinso@redhat.com> - 20210527gite1999b264f1f-1
+- Update to git snapshot
+- Sync with c9s packaging
+
+* Mon Jun 14 2021 Jiri Kucera <jkucera@redhat.com> - 20200801stable-5
+- Replace genisoimage with xorriso
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 20200801stable-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Thu Dec 03 2020 Cole Robinson <aintdiscole@gmail.com> - 20200801stable-3
+- Really fix TPM breakage (bz 1897367)
+
+* Tue Nov 24 2020 Cole Robinson <aintdiscole@gmail.com> - 20200801stable-2
+- Fix openssl usage, unbreak TPM (bz 1897367)
+
+* Wed Sep 16 2020 Cole Robinson <crobinso@redhat.com> - 20200801stable-1
+- Update to edk2 stable 202008
+
+* Sat Sep 12 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 20200201stable-6
+- Tweaks for aarch64/ARMv7 builds
+- Minor cleanups
+
+* Tue Aug 04 2020 Cole Robinson <aintdiscole@gmail.com> - 20200201stable-5
+- Fix build failures on rawhide
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 20200201stable-4
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 20200201stable-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Jul 13 2020 Tom Stellard <tstellar@redhat.com> - 20200201stable-2
+- Use make macros
+- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
+
+* Mon Apr 13 2020 Cole Robinson <aintdiscole@gmail.com> - 20200201stable-1
+- Update to stable-202002
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 20190501stable-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Fri Sep 06 2019 Patrick Uiterwijk <puiterwijk@redhat.com> - 20190501stable-4
+- Updated HTTP_BOOT option to new upstream value
+
+* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 20190501stable-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Mon Jul 15 2019 Cole Robinson <aintdiscole@gmail.com> - 20190501stable-2
+- License is now BSD-2-Clause-Patent
+- Re-enable secureboot enrollment
+- Use qemu-ovmf-secureboot from git
+
+* Thu Jul 11 2019 Cole Robinson <crobinso@redhat.com> - 20190501stable-1
+- Update to stable-201905
+- Update to openssl-1.1.1b
+- Ship VARS file for ovmf-ia32 (bug 1688596)
+- Ship Fedora-variant JSON "firmware descriptor files"
+- Resolves rhbz#1728652
+
+* Mon Mar 18 2019 Cole Robinson <aintdiscole@gmail.com> - 20190308stable-1
+- Use YYYYMMDD versioning to fix upgrade path
+
+* Fri Mar 15 2019 Cole Robinson <aintdiscole@gmail.com> - 201903stable-1
+- Update to stable-201903
+- Update to openssl-1.1.0j
+- Move to python3 deps
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 20180815gitcb5f4f45ce-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Wed Nov 14 2018 Patrick Uiterwijk <puiterwijk@redhat.com> - 20180815gitcb5f4f45ce-5
+- Add -qosb dependency on python3
+
+* Fri Nov 9 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180815gitcb5f4f45ce-4
+- Fix network boot via grub (bz 1648476)
+
+* Wed Sep 12 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180815gitcb5f4f45ce-3
+- Explicitly compile the scripts using py_byte_compile
+
+* Fri Aug 31 2018 Cole Robinson <crobinso@redhat.com> - 20180815gitcb5f4f45ce-2
+- Fix passing through RPM build flags (bz 1540244)
+
+* Tue Aug 21 2018 Cole Robinson <crobinso@redhat.com> - 20180815gitcb5f4f45ce-1
+- Update to edk2 git cb5f4f45ce, edk2-stable201808
+- Update to qemu-ovmf-secureboot-1.1.3
+- Enable TPM2 support
+
+* Mon Jul 23 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-5
+- Fixes for AMD SEV on OVMF_CODE.fd
+- Add Provides for bundled OpenSSL
+
+* Wed Jul 18 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-4
+- Enable IPv6
+
+* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 20180529gitee3198e672e2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Wed Jun 20 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-2
+- Backport two bug fixes from RHEL: connect again virtio-rng devices, and
+  connect consoles unconditionally in OVMF (ARM firmware already did it)
+
+* Tue May 29 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-1
+- Rebase to ee3198e672e2
+
+* Tue May 01 2018 Cole Robinson <crobinso@redhat.com> - 20171011git92d07e4-7
+- Bump release for new build
+
+* Fri Mar 30 2018 Patrick Uiterwijk <puiterwijk@redhat.com> - 20171011git92d07e4-6
+- Add qemu-ovmf-secureboot (qosb)
+- Generate pre-enrolled Secure Boot OVMF VARS files
+
+* Wed Mar 07 2018 Paolo Bonzini <pbonzini@redhat.com> - 20171011git92d07e4-5
+- Fix GCC 8 compilation
+- Replace dosfstools and mtools with qemu-img vvfat
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 20171011git92d07e4-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Fri Jan 19 2018 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-3
+- Add OpenSSL patches from Fedora
+- Enable TLS_MODE
+
+* Fri Nov 17 2017 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-2
+- Backport patches 19-21 from RHEL
+- Add patches 22-24 to fix SEV slowness
+- Add fedora conditionals
+
+* Tue Nov 14 2017 Paolo Bonzini <pbonzini@redhat.com> - 20171011git92d07e4-1
+- Import source and patches from RHEL version
+- Update OpenSSL to 1.1.0e
+- Refresh 0099-Tweak-the-tools_def-to-support-cross-compiling.patch
+
+* Mon Nov 13 2017 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-6
+- Allow non-cross builds
+- Install /usr/share/OVMF and /usr/share/AAVMF
+
+* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20170209git296153c5-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20170209git296153c5-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Wed Mar 15 2017 Cole Robinson <crobinso@redhat.com> - 20170209git296153c5-3
+- Ship ovmf-ia32 package (bz 1424722)
+
+* Thu Feb 16 2017 Cole Robinson <crobinso@redhat.com> - 20170209git296153c5-2
+- Update EnrollDefaultKeys patch (bz #1398743)
+
+* Mon Feb 13 2017 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-1
+- Rebase to git master
+- New patch 0010 fixes failure to build from source.
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20161105git3b25ca8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Sun Nov 06 2016 Cole Robinson <crobinso@redhat.com> - 20161105git3b25ca8-1
+- Rebase to git master
+
+* Fri Sep  9 2016 Tom Callaway <spot@fedoraproject.org> - 20160418gita8c39ba-5
+- replace legally problematic openssl source with "hobbled" tarball
+
+* Thu Jul 21 2016 Gerd Hoffmann <kraxel@redhat.com> - 20160418gita8c39ba-4
+- Also build for armv7.
+
+* Tue Jul 19 2016 Gerd Hoffmann <kraxel@redhat.com> 20160418gita8c39ba-3
+- Update EnrollDefaultKeys patch.
+
+* Fri Jul 8 2016 Paolo Bonzini <pbonzini@redhat.com> - 20160418gita8c39ba-2
+- Distribute edk2-ovmf on aarch64
+
+* Sat May 21 2016 Cole Robinson <crobinso@redhat.com> - 20160418gita8c39ba-1
+- Distribute edk2-aarch64 on x86 (bz #1338027)
+
+* Mon Apr 18 2016 Gerd Hoffmann <kraxel@redhat.com> 20160418gita8c39ba-0
+- Update to latest git.
+- Add firmware builds (FatPkg is free now).
+
+* Mon Feb 15 2016 Cole Robinson <crobinso@redhat.com> 20151127svn18975-3
+- Fix FTBFS gcc warning (bz 1307439)
+
+* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 20151127svn18975-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Fri Nov 27 2015 Paolo Bonzini <pbonzini@redhat.com> - 20151127svn18975-1
+- Rebase to 20151127svn18975-1
+- Linker script renamed to GccBase.lds
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20150519svn17469-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Tue May 19 2015 Paolo Bonzini <pbonzini@redhat.com> - 20150519svn17469-1
+- Rebase to 20150519svn17469-1
+- edk2-remove-tree-check.patch now upstream
+
+* Sat May 02 2015 Kalev Lember <kalevlember@gmail.com> - 20140724svn2670-6
+- Rebuilt for GCC 5 C++11 ABI change
+
+* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20140724svn2670-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Thu Jul 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140724svn2670-1
+- Rebase to 20140724svn2670-1
+
+* Tue Jun 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140624svn2649-1
+- Use standalone .tar.xz from buildtools repo
+
+* Tue Jun 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140328svn15376-4
+- Install BuildTools/BaseEnv
+
+* Mon Jun 23 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140328svn15376-3
+- Rebase to get GCC48 configuration
+- Package EDK_TOOLS_PATH as /usr/share/edk2
+- Package "build" and LzmaF86Compress too, as well as the new
+  tools Ecc and TianoCompress.
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20131114svn14844-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Thu Nov 14 2013 Paolo Bonzini <pbonzini@redhat.com> - 20131114svn14844-1
+- Upgrade to r14844.
+- Remove upstreamed parts of patch 1.
+
+* Fri Nov 8 2013 Paolo Bonzini <pbonzini@redhat.com> - 20130515svn14365-7
+- Make BaseTools compile on ARM.
+
+* Fri Aug 30 2013 Paolo Bonzini <pbonzini@redhat.com> - 20130515svn14365-6
+- Revert previous change; firmware packages should be noarch, and building
+  BaseTools twice is simply wrong.
+
+* Mon Aug 19 2013 Kay Sievers <kay@redhat.com> - 20130515svn14365-5
+- Add sub-package with EFI shell
+
+* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20130515svn14365-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Thu May 23 2013 Dan Horák <dan[at]danny.cz> 20130515svn14365-3
+- set ExclusiveArch
+
+* Thu May 16 2013 Paolo Bonzini <pbonzini@redhat.com> 20130515svn14365-2
+- Fix edk2-tools-python Requires
+
+* Wed May 15 2013 Paolo Bonzini <pbonzini@redhat.com> 20130515svn14365-1
+- Split edk2-tools-doc and edk2-tools-python
+- Fix Python BuildRequires
+- Remove FatBinPkg at package creation time.
+- Use fully versioned dependency.
+- Add comment on how to generate the sources.
+
+* Thu May 2 2013 Paolo Bonzini <pbonzini@redhat.com> 20130502.g732d199-1
+- Create.

edk2-build.fedora

@@ -0,0 +1,283 @@
+
+[opts.ovmf.common]
+NETWORK_HTTP_BOOT_ENABLE = TRUE
+NETWORK_IP6_ENABLE       = TRUE
+NETWORK_TLS_ENABLE       = TRUE
+NETWORK_ISCSI_ENABLE     = TRUE
+NETWORK_ALLOW_HTTP_CONNECTIONS = TRUE
+TPM2_ENABLE              = TRUE
+TPM2_CONFIG_ENABLE       = TRUE
+TPM1_ENABLE              = TRUE
+CAVIUM_ERRATUM_27456     = TRUE
+
+[opts.ovmf.4m]
+FD_SIZE_4MB              = TRUE
+
+[opts.ovmf.2m]
+FD_SIZE_2MB              = TRUE
+NETWORK_ISCSI_ENABLE     = FALSE
+
+[opts.ovmf.sb.smm]
+SECURE_BOOT_ENABLE       = TRUE
+SMM_REQUIRE              = TRUE
+# old downstream
+EXCLUDE_SHELL_FROM_FD    = TRUE
+# new upstream
+BUILD_SHELL              = FALSE
+
+# requires edk2 2022-11 or newer
+[opts.ovmf.sb.stateless]
+SECURE_BOOT_ENABLE       = TRUE
+SMM_REQUIRE              = FALSE
+
+[opts.armvirt.verbose]
+DEBUG_PRINT_ERROR_LEVEL  = 0x8040004F
+
+[opts.armvirt.silent]
+DEBUG_PRINT_ERROR_LEVEL  = 0x80000000
+
+[opts.armvirt.kernel]
+TPM2_ENABLE              = FALSE
+TPM2_CONFIG_ENABLE       = FALSE
+
+
+[pcds.nx.strict]
+PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD5
+
+[pcds.nx.broken.grub]
+# grub.efi uses EfiLoaderData for code
+PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD1
+
+
+#####################################################################
+# stateful ovmf builds (with vars in flash)
+
+[build.ovmf.2m.default]
+desc = ovmf build (64-bit, 2MB)
+conf = OvmfPkg/OvmfPkgX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.2m
+plat = OvmfX64
+dest = Fedora/ovmf
+cpy1 = FV/OVMF_CODE.fd
+cpy2 = FV/OVMF_VARS.fd
+cpy3 = X64/Shell.efi
+
+[build.ovmf.4m.default]
+desc = ovmf build (64-bit, 4MB)
+conf = OvmfPkg/OvmfPkgX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+plat = OvmfX64
+dest = Fedora/ovmf
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE_4M.fd
+cpy2 = FV/OVMF_VARS.fd OVMF_VARS_4M.fd
+
+[build.ovmf.2m.sb.smm]
+desc = ovmf build (32/64-bit, 2MB, q35 only, needs smm, secure boot)
+conf = OvmfPkg/OvmfPkgIa32X64.dsc
+arch = IA32 X64
+opts = ovmf.common
+       ovmf.2m
+       ovmf.sb.smm
+plat = Ovmf3264
+dest = Fedora/ovmf
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
+cpy2 = X64/EnrollDefaultKeys.efi
+
+[build.ovmf.4m.sb.smm]
+desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot)
+conf = OvmfPkg/OvmfPkgIa32X64.dsc
+arch = IA32 X64
+opts = ovmf.common
+       ovmf.4m
+       ovmf.sb.smm
+plat = Ovmf3264
+dest = Fedora/ovmf
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE_4M.secboot.fd
+
+
+#####################################################################
+# stateless ovmf builds (firmware in rom or r/o flash)
+
+[build.ovmf.microvm]
+desc = ovmf build for qemu microvm (2MB)
+conf = OvmfPkg/Microvm/MicrovmX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.2m
+plat = MicrovmX64
+dest = Fedora/ovmf
+cpy1 = FV/MICROVM.fd
+
+[build.ovmf.xen]
+desc = ovmf build for Xen
+conf = OvmfPkg/OvmfXen.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.2m
+plat = OvmfXen
+dest = Fedora/xen
+cpy1 = FV/OVMF.fd
+
+[build.ovmf.amdsev]
+desc = ovmf build for AmdSev (2MB)
+conf = OvmfPkg/AmdSev/AmdSevX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.2m
+plat = AmdSev
+dest = Fedora/ovmf
+cpy1 = FV/OVMF.fd OVMF.amdsev.fd
+
+[build.ovmf.inteltdx]
+desc = ovmf build for IntelTdx (2MB)
+conf = OvmfPkg/IntelTdx/IntelTdxX64.dsc
+arch = X64
+opts = ovmf.common ovmf.2m
+plat = IntelTdx
+dest = Fedora/ovmf
+cpy1 = FV/OVMF.fd OVMF.inteltdx.fd
+
+
+#####################################################################
+# armvirt builds
+
+[build.armvirt.aa64.verbose]
+desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.verbose
+pcds = nx.broken.grub
+plat = ArmVirtQemu-AARCH64
+dest = Fedora/aarch64
+cpy1 = FV/QEMU_EFI.fd
+cpy2 = FV/QEMU_VARS.fd
+cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
+cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
+pad3 = QEMU_EFI-pflash.raw      64m
+pad4 = vars-template-pflash.raw 64m
+
+[build.armvirt.aa64.silent]
+desc = ArmVirt build for qemu, 64-bit (arm v8), silent
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.silent
+pcds = nx.broken.grub
+plat = ArmVirtQemu-AARCH64
+dest = Fedora/aarch64
+cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.silent.fd
+cpy2 = FV/QEMU_EFI.fd  QEMU_EFI-silent-pflash.raw
+pad2 = QEMU_EFI-silent-pflash.raw 64m
+
+[build.armvirt.aa64.kernel]
+desc = ArmVirt build for qemu, 64-bit (arm v8)
+conf = ArmVirtPkg/ArmVirtQemuKernel.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.silent
+       armvirt.kernel
+pcds = nx.broken.grub
+plat = ArmVirtQemuKernel-AARCH64
+dest = Fedora/aarch64
+cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.kernel.fd
+
+
+#####################################################################
+# riscv
+
+[build.riscv.qemu]
+conf = OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc
+arch = RISCV64
+plat = RiscVVirtQemu
+dest = Fedora/riscv
+cpy1 = FV/RISCV_VIRT.fd
+cpy2 = FV/RISCV_VIRT.fd RISCV_VIRT.raw
+pad1 = RISCV_VIRT.raw 32m
+
+
+#####################################################################
+# 32-bit builds
+
+[build.ovmf.ia32.default]
+desc = ovmf build (32-bit, 2MB)
+conf = OvmfPkg/OvmfPkgIa32.dsc
+arch = IA32
+opts = ovmf.common
+       ovmf.2m
+plat = OvmfIa32
+dest = Fedora/ovmf-ia32
+cpy1 = FV/OVMF_CODE.fd
+cpy2 = FV/OVMF_VARS.fd
+cpy3 = IA32/Shell.efi
+
+[build.ovmf.ia32.sb.smm]
+desc = ovmf build (32-bit, 2MB, q35 only, needs smm, secure boot)
+conf = OvmfPkg/OvmfPkgIa32.dsc
+arch = IA32
+opts = ovmf.common
+       ovmf.2m
+       ovmf.sb.smm
+plat = OvmfIa32
+dest = Fedora/ovmf-ia32
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
+cpy2 = IA32/EnrollDefaultKeys.efi
+
+[build.armvirt.arm]
+desc = ArmVirt build for qemu, 32-bit (arm v7)
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = ARM
+opts = ovmf.common
+pcds = nx.broken.grub
+plat = ArmVirtQemu-ARM
+dest = Fedora/arm
+cpy1 = FV/QEMU_EFI.fd
+cpy2 = FV/QEMU_VARS.fd
+cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
+cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
+pad3 = QEMU_EFI-pflash.raw      64m
+pad4 = vars-template-pflash.raw 64m
+
+
+#####################################################################
+# experimental builds
+
+[build.ovmf.sb.stateless]
+desc = ovmf build (64-bit, stateless secure boot)
+conf = OvmfPkg/OvmfPkgX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+       ovmf.sb.stateless
+plat = OvmfX64
+dest = Fedora/experimental
+cpy1 = FV/OVMF.fd OVMF.stateless.fd
+
+[build.ovmf.strict.nx]
+desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot, strict nx)
+conf = OvmfPkg/OvmfPkgIa32X64.dsc
+arch = IA32 X64
+opts = ovmf.common
+       ovmf.4m
+       ovmf.sb.smm
+pcds = nx.strict
+plat = Ovmf3264
+dest = Fedora/experimental
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.4m.secboot.strictnx.fd
+
+[build.armvirt.aa64.strict.nx]
+desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.verbose
+pcds = nx.strict
+plat = ArmVirtQemu-AARCH64
+dest = Fedora/experimental
+cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.strictnx.fd
+cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-strictnx-pflash.raw
+pad3 = QEMU_EFI-strictnx-pflash.raw  64m

edk2-build.fedora.platforms

@@ -0,0 +1,47 @@
+
+#####################################################################
+# ext4 driver
+
+[build.ext4.x64]
+desc = ext4 driver
+conf = Features/Ext4Pkg/Ext4Pkg.dsc
+arch = X64
+plat = Ext4Pkg
+dest = Fedora/drivers
+cpy1 = X64/Ext4Dxe.efi ext4x64.efi
+
+[build.ext4.aa64]
+desc = ext4 driver
+conf = Features/Ext4Pkg/Ext4Pkg.dsc
+arch = AARCH64
+plat = Ext4Pkg
+dest = Fedora/drivers
+cpy1 = AARCH64/Ext4Dxe.efi ext4aa64.efi
+
+[build.ext4.riscv64]
+desc = ext4 driver
+conf = Features/Ext4Pkg/Ext4Pkg.dsc
+arch = RISCV64
+plat = Ext4Pkg
+dest = Fedora/drivers
+cpy1 = RISCV64/Ext4Dxe.efi ext4riscv64.efi
+
+
+#####################################################################
+# arm standalone mm
+
+[build.standalone.mm.aa64]
+conf = Platform/StandaloneMm/PlatformStandaloneMmPkg/PlatformStandaloneMmRpmb.dsc
+arch = AARCH64
+plat = MmStandaloneRpmb
+dest = Fedora/aarch64
+cpy1 = FV/BL32_AP_MM.fd
+
+
+#####################################################################
+# loongarch builds
+
+[build.loongarch]
+desc = Loongarch build
+conf = Platform/Loongson/LoongArchQemuPkg/Loongson.dsc
+arch = LOONGARCH64

edk2-build.py

@@ -0,0 +1,427 @@
+#!/usr/bin/python3
+"""
+build helper script for edk2, see
+https://gitlab.com/kraxel/edk2-build-config
+
+"""
+import os
+import sys
+import time
+import shutil
+import argparse
+import subprocess
+import configparser
+
+rebase_prefix    = ""
+version_override = None
+release_date     = None
+
+# pylint: disable=unused-variable
+def check_rebase():
+    """ detect 'git rebase -x edk2-build.py master' testbuilds """
+    global rebase_prefix
+    global version_override
+    gitdir = '.git'
+
+    if os.path.isfile(gitdir):
+        with open(gitdir, 'r', encoding = 'utf-8') as f:
+            (unused, gitdir) = f.read().split()
+
+    if not os.path.exists(f'{gitdir}/rebase-merge/msgnum'):
+        return
+    with open(f'{gitdir}/rebase-merge/msgnum', 'r', encoding = 'utf-8') as f:
+        msgnum = int(f.read())
+    with open(f'{gitdir}/rebase-merge/end', 'r', encoding = 'utf-8') as f:
+        end = int(f.read())
+    with open(f'{gitdir}/rebase-merge/head-name', 'r', encoding = 'utf-8') as f:
+        head = f.read().strip().split('/')
+
+    rebase_prefix = f'[ {int(msgnum/2)} / {int(end/2)} - {head[-1]} ] '
+    if msgnum != end and not version_override:
+        # fixed version speeds up builds
+        version_override = "test-build-patch-series"
+
+def get_coredir(cfg):
+    if cfg.has_option('global', 'core'):
+        return os.path.abspath(cfg['global']['core'])
+    return os.getcwd()
+
+def get_toolchain(cfg, build):
+    if cfg.has_option(build, 'tool'):
+        return cfg[build]['tool']
+    if cfg.has_option('global', 'tool'):
+        return cfg['global']['tool']
+    return 'GCC5'
+
+def get_version(cfg, silent = False):
+    coredir = get_coredir(cfg)
+    if version_override:
+        version = version_override
+        if not silent:
+            print('')
+            print(f'### version [override]: {version}')
+        return version
+    if os.environ.get('RPM_PACKAGE_NAME'):
+        version = os.environ.get('RPM_PACKAGE_NAME')
+        version += '-' + os.environ.get('RPM_PACKAGE_VERSION')
+        version += '-' + os.environ.get('RPM_PACKAGE_RELEASE')
+        if not silent:
+            print('')
+            print(f'### version [rpmbuild]: {version}')
+        return version
+    if os.path.exists(coredir + '/.git'):
+        cmdline = [ 'git', 'describe', '--tags', '--abbrev=8',
+                    '--match=edk2-stable*' ]
+        result = subprocess.run(cmdline, cwd = coredir,
+                                stdout = subprocess.PIPE,
+                                check = True)
+        version = result.stdout.decode().strip()
+        if not silent:
+            print('')
+            print(f'### version [git]: {version}')
+        return version
+    return None
+
+def pcd_string(name, value):
+    return f'{name}=L{value}\\0'
+
+def pcd_version(cfg, silent = False):
+    version = get_version(cfg, silent)
+    if version is None:
+        return []
+    return [ '--pcd', pcd_string('PcdFirmwareVersionString', version) ]
+
+def pcd_release_date():
+    if release_date is None:
+        return []
+    return [ '--pcd', pcd_string('PcdFirmwareReleaseDateString', release_date) ]
+
+def build_message(line, line2 = None, silent = False):
+    if os.environ.get('TERM') in [ 'xterm', 'xterm-256color' ]:
+        # setxterm  title
+        start  = '\x1b]2;'
+        end    = '\x07'
+        print(f'{start}{rebase_prefix}{line}{end}', end = '')
+
+    if silent:
+        print(f'### {rebase_prefix}{line}', flush = True)
+    else:
+        print('')
+        print('###')
+        print(f'### {rebase_prefix}{line}')
+        if line2:
+            print(f'### {line2}')
+        print('###', flush = True)
+
+def build_run(cmdline, name, section, silent = False, nologs = False):
+    if silent:
+        logfile = f'{section}.log'
+        if nologs:
+            print(f'### building in silent mode [no log] ...', flush = True)
+        else:
+            print(f'### building in silent mode [{logfile}] ...', flush = True)
+        start = time.time()
+        result = subprocess.run(cmdline, check = False,
+                                stdout = subprocess.PIPE,
+                                stderr = subprocess.STDOUT)
+        if not nologs:
+            with open(logfile, 'wb') as f:
+                f.write(result.stdout)
+
+        if result.returncode:
+            print('### BUILD FAILURE')
+            print('### cmdline')
+            print(cmdline)
+            print('### output')
+            print(result.stdout.decode())
+            print(f'### exit code: {result.returncode}')
+        else:
+            secs = int(time.time() - start)
+            print(f'### OK ({int(secs/60)}:{secs%60:02d})')
+    else:
+        print(cmdline, flush = True)
+        result = subprocess.run(cmdline, check = False)
+    if result.returncode:
+        print(f'ERROR: {cmdline[0]} exited with {result.returncode}'
+              f' while building {name}')
+        sys.exit(result.returncode)
+
+def build_copy(plat, tgt, toolchain, dstdir, copy):
+    srcdir = f'Build/{plat}/{tgt}_{toolchain}'
+    names = copy.split()
+    srcfile = names[0]
+    if len(names) > 1:
+        dstfile = names[1]
+    else:
+        dstfile = os.path.basename(srcfile)
+    print(f'# copy: {srcdir} / {srcfile}  =>  {dstdir} / {dstfile}')
+
+    src = srcdir + '/' + srcfile
+    dst = dstdir + '/' + dstfile
+    os.makedirs(os.path.dirname(dst), exist_ok = True)
+    shutil.copy(src, dst)
+
+def pad_file(dstdir, pad):
+    args = pad.split()
+    if len(args) < 2:
+        raise RuntimeError(f'missing arg for pad ({args})')
+    name = args[0]
+    size = args[1]
+    cmdline = [
+        'truncate',
+        '--size', size,
+        dstdir + '/' + name,
+    ]
+    print(f'# padding: {dstdir} / {name}  =>  {size}')
+    subprocess.run(cmdline, check = True)
+
+# pylint: disable=too-many-branches
+def build_one(cfg, build, jobs = None, silent = False, nologs = False):
+    b = cfg[build]
+
+    cmdline  = [ 'build' ]
+    cmdline += [ '-t', get_toolchain(cfg, build) ]
+    cmdline += [ '-p', b['conf'] ]
+
+    if (b['conf'].startswith('OvmfPkg/') or
+        b['conf'].startswith('ArmVirtPkg/')):
+        cmdline += pcd_version(cfg, silent)
+        cmdline += pcd_release_date()
+
+    if jobs:
+        cmdline += [ '-n', jobs ]
+    for arch in b['arch'].split():
+        cmdline += [ '-a', arch ]
+    if 'opts' in b:
+        for name in b['opts'].split():
+            section = 'opts.' + name
+            for opt in cfg[section]:
+                cmdline += [ '-D', opt + '=' + cfg[section][opt] ]
+    if 'pcds' in b:
+        for name in b['pcds'].split():
+            section = 'pcds.' + name
+            for pcd in cfg[section]:
+                cmdline += [ '--pcd', pcd + '=' + cfg[section][pcd] ]
+    if 'tgts' in b:
+        tgts = b['tgts'].split()
+    else:
+        tgts = [ 'DEBUG' ]
+    for tgt in tgts:
+        desc = None
+        if 'desc' in b:
+            desc = b['desc']
+        build_message(f'building: {b["conf"]} ({b["arch"]}, {tgt})',
+                      f'description: {desc}',
+                      silent = silent)
+        build_run(cmdline + [ '-b', tgt ],
+                  b['conf'],
+                  build + '.' + tgt,
+                  silent,
+                  nologs)
+
+        if 'plat' in b:
+            # copy files
+            for cpy in b:
+                if not cpy.startswith('cpy'):
+                    continue
+                build_copy(b['plat'], tgt,
+                           get_toolchain(cfg, build),
+                           b['dest'], b[cpy])
+            # pad builds
+            for pad in b:
+                if not pad.startswith('pad'):
+                    continue
+                pad_file(b['dest'], b[pad])
+
+def build_basetools(silent = False, nologs = False):
+    build_message('building: BaseTools', silent = silent)
+    basedir = os.environ['EDK_TOOLS_PATH']
+    cmdline = [ 'make', '-C', basedir ]
+    build_run(cmdline, 'BaseTools', 'build.basetools', silent, nologs)
+
+def binary_exists(name):
+    for pdir in os.environ['PATH'].split(':'):
+        if os.path.exists(pdir + '/' + name):
+            return True
+    return False
+
+def prepare_env(cfg, silent = False):
+    """ mimic Conf/BuildEnv.sh """
+    workspace = os.getcwd()
+    packages = [ workspace, ]
+    path = os.environ['PATH'].split(':')
+    dirs = [
+        'BaseTools/Bin/Linux-x86_64',
+        'BaseTools/BinWrappers/PosixLike'
+    ]
+
+    if cfg.has_option('global', 'pkgs'):
+        for pkgdir in cfg['global']['pkgs'].split():
+            packages.append(os.path.abspath(pkgdir))
+    coredir = get_coredir(cfg)
+    if coredir != workspace:
+        packages.append(coredir)
+
+    # add basetools to path
+    for pdir in dirs:
+        p = coredir + '/' + pdir
+        if not os.path.exists(p):
+            continue
+        if p in path:
+            continue
+        path.insert(0, p)
+
+    # run edksetup if needed
+    toolsdef = coredir + '/Conf/tools_def.txt'
+    if not os.path.exists(toolsdef):
+        os.makedirs(os.path.dirname(toolsdef), exist_ok = True)
+        build_message('running BaseTools/BuildEnv', silent = silent)
+        cmdline = [ 'bash', 'BaseTools/BuildEnv' ]
+        subprocess.run(cmdline, cwd = coredir, check = True)
+
+    # set variables
+    os.environ['PATH'] = ':'.join(path)
+    os.environ['PACKAGES_PATH'] = ':'.join(packages)
+    os.environ['WORKSPACE'] = workspace
+    os.environ['EDK_TOOLS_PATH'] = coredir + '/BaseTools'
+    os.environ['CONF_PATH'] = coredir + '/Conf'
+    os.environ['PYTHON_COMMAND'] = '/usr/bin/python3'
+    os.environ['PYTHONHASHSEED'] = '1'
+
+    # for cross builds
+    if binary_exists('arm-linux-gnueabi-gcc'):
+        # ubuntu
+        os.environ['GCC5_ARM_PREFIX'] = 'arm-linux-gnueabi-'
+        os.environ['GCC_ARM_PREFIX'] = 'arm-linux-gnueabi-'
+    elif binary_exists('arm-linux-gnu-gcc'):
+        # fedora
+        os.environ['GCC5_ARM_PREFIX'] = 'arm-linux-gnu-'
+        os.environ['GCC_ARM_PREFIX'] = 'arm-linux-gnu-'
+    if binary_exists('loongarch64-linux-gnu-gcc'):
+        os.environ['GCC5_LOONGARCH64_PREFIX'] = 'loongarch64-linux-gnu-'
+        os.environ['GCC_LOONGARCH64_PREFIX'] = 'loongarch64-linux-gnu-'
+
+    hostarch = os.uname().machine
+    if binary_exists('aarch64-linux-gnu-gcc') and hostarch != 'aarch64':
+        os.environ['GCC5_AARCH64_PREFIX'] = 'aarch64-linux-gnu-'
+        os.environ['GCC_AARCH64_PREFIX'] = 'aarch64-linux-gnu-'
+    if binary_exists('riscv64-linux-gnu-gcc') and hostarch != 'riscv64':
+        os.environ['GCC5_RISCV64_PREFIX'] = 'riscv64-linux-gnu-'
+        os.environ['GCC_RISCV64_PREFIX'] = 'riscv64-linux-gnu-'
+    if binary_exists('x86_64-linux-gnu-gcc') and hostarch != 'x86_64':
+        os.environ['GCC5_IA32_PREFIX'] = 'x86_64-linux-gnu-'
+        os.environ['GCC5_X64_PREFIX'] = 'x86_64-linux-gnu-'
+        os.environ['GCC5_BIN'] = 'x86_64-linux-gnu-'
+        os.environ['GCC_IA32_PREFIX'] = 'x86_64-linux-gnu-'
+        os.environ['GCC_X64_PREFIX'] = 'x86_64-linux-gnu-'
+        os.environ['GCC_BIN'] = 'x86_64-linux-gnu-'
+
+def build_list(cfg):
+    for build in cfg.sections():
+        if not build.startswith('build.'):
+            continue
+        name = build.lstrip('build.')
+        desc = 'no description'
+        if 'desc' in cfg[build]:
+            desc = cfg[build]['desc']
+        print(f'# {name:20s} - {desc}')
+
+def main():
+    parser = argparse.ArgumentParser(prog = 'edk2-build',
+                                     description = 'edk2 build helper script')
+    parser.add_argument('-c', '--config', dest = 'configfile',
+                        type = str, default = '.edk2.builds', metavar = 'FILE',
+                        help = 'read configuration from FILE (default: .edk2.builds)')
+    parser.add_argument('-C', '--directory', dest = 'directory', type = str,
+                        help = 'change to DIR before building', metavar = 'DIR')
+    parser.add_argument('-j', '--jobs', dest = 'jobs', type = str,
+                        help = 'allow up to JOBS parallel build jobs',
+                        metavar = 'JOBS')
+    parser.add_argument('-m', '--match', dest = 'match', type = str,
+                        help = 'only run builds matching INCLUDE (substring)',
+                        metavar = 'INCLUDE')
+    parser.add_argument('-x', '--exclude', dest = 'exclude',
+                        type = str, action = 'append',
+                        help = 'skip builds matching EXCLUDE (substring)',
+                        metavar = 'EXCLUDE')
+    parser.add_argument('-l', '--list', dest = 'list',
+                        action = 'store_true', default = False,
+                        help = 'list build configs available')
+    parser.add_argument('--silent', dest = 'silent',
+                        action = 'store_true', default = False,
+                        help = 'write build output to logfiles, '
+                        'write to console only on errors')
+    parser.add_argument('--no-logs', dest = 'nologs',
+                        action = 'store_true', default = False,
+                        help = 'do not write build log files (with --silent)')
+    parser.add_argument('--core', dest = 'core', type = str, metavar = 'DIR',
+                        help = 'location of the core edk2 repository '
+                        '(i.e. where BuildTools are located)')
+    parser.add_argument('--pkg', '--package', dest = 'pkgs',
+                        type = str, action = 'append', metavar = 'DIR',
+                        help = 'location(s) of additional packages '
+                        '(can be specified multiple times)')
+    parser.add_argument('-t', '--toolchain', dest = 'toolchain', type = str, metavar = 'NAME',
+                        help = 'tool chain to be used to build edk2')
+    parser.add_argument('--version-override', dest = 'version_override',
+                        type = str, metavar = 'VERSION',
+                        help = 'set firmware build version')
+    parser.add_argument('--release-date', dest = 'release_date',
+                        type = str, metavar = 'DATE',
+                        help = 'set firmware build release date (in MM/DD/YYYY format)')
+    options = parser.parse_args()
+
+    if options.directory:
+        os.chdir(options.directory)
+
+    if not os.path.exists(options.configfile):
+        print(f'config file "{options.configfile}" not found')
+        return 1
+
+    cfg = configparser.ConfigParser()
+    cfg.optionxform = str
+    cfg.read(options.configfile)
+
+    if options.list:
+        build_list(cfg)
+        return 0
+
+    if not cfg.has_section('global'):
+        cfg.add_section('global')
+    if options.core:
+        cfg.set('global', 'core', options.core)
+    if options.pkgs:
+        cfg.set('global', 'pkgs', ' '.join(options.pkgs))
+    if options.toolchain:
+        cfg.set('global', 'tool', options.toolchain)
+
+    global version_override
+    global release_date
+    check_rebase()
+    if options.version_override:
+        version_override = options.version_override
+    if options.release_date:
+        release_date = options.release_date
+
+    prepare_env(cfg, options.silent)
+    build_basetools(options.silent, options.nologs)
+    for build in cfg.sections():
+        if not build.startswith('build.'):
+            continue
+        if options.match and options.match not in build:
+            print(f'# skipping "{build}" (not matching "{options.match}")')
+            continue
+        if options.exclude:
+            exclude = False
+            for item in options.exclude:
+                if item in build:
+                    print(f'# skipping "{build}" (matching "{item}")')
+                    exclude = True
+            if exclude:
+                continue
+        build_one(cfg, build, options.jobs, options.silent, options.nologs)
+
+    return 0
+
+if __name__ == '__main__':
+    sys.exit(main())

edk2-build.rhel-9

@@ -0,0 +1,119 @@
+
+[opts.ovmf.common]
+NETWORK_HTTP_BOOT_ENABLE = TRUE
+NETWORK_IP6_ENABLE       = TRUE
+NETWORK_TLS_ENABLE       = TRUE
+NETWORK_ISCSI_ENABLE     = TRUE
+NETWORK_ALLOW_HTTP_CONNECTIONS = TRUE
+TPM2_ENABLE              = TRUE
+TPM2_CONFIG_ENABLE       = TRUE
+TPM1_ENABLE              = FALSE
+CAVIUM_ERRATUM_27456     = TRUE
+
+[opts.ovmf.4m]
+FD_SIZE_4MB              = TRUE
+
+[opts.ovmf.sb.smm]
+SECURE_BOOT_ENABLE       = TRUE
+SMM_REQUIRE              = TRUE
+# old downstream
+EXCLUDE_SHELL_FROM_FD    = TRUE
+# new upstream
+BUILD_SHELL              = FALSE
+
+[opts.armvirt.verbose]
+DEBUG_PRINT_ERROR_LEVEL  = 0x8040004F
+
+[opts.armvirt.silent]
+DEBUG_PRINT_ERROR_LEVEL  = 0x80000000
+
+[pcds.nx.strict]
+PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD5
+
+[pcds.nx.broken.grub]
+# grub.efi uses EfiLoaderData for code
+PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD1
+
+#####################################################################
+# stateful ovmf builds (with vars in flash)
+
+[build.ovmf.4m.default]
+desc = ovmf build (64-bit, 4MB)
+conf = OvmfPkg/OvmfPkgX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+plat = OvmfX64
+dest = RHEL-9/ovmf
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.fd
+cpy2 = FV/OVMF_VARS.fd
+cpy3 = X64/Shell.efi
+
+[build.ovmf.4m.sb.smm]
+desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot)
+conf = OvmfPkg/OvmfPkgIa32X64.dsc
+arch = IA32 X64
+opts = ovmf.common
+       ovmf.4m
+       ovmf.sb.smm
+plat = Ovmf3264
+dest = RHEL-9/ovmf
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
+cpy2 = X64/EnrollDefaultKeys.efi
+
+
+#####################################################################
+# stateless ovmf builds (firmware in rom or r/o flash)
+
+[build.ovmf.amdsev]
+desc = ovmf build for AmdSev (4MB)
+conf = OvmfPkg/AmdSev/AmdSevX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+plat = AmdSev
+dest = RHEL-9/ovmf
+cpy1 = FV/OVMF.fd OVMF.amdsev.fd
+
+[build.ovmf.inteltdx]
+desc = ovmf build for IntelTdx (4MB)
+conf = OvmfPkg/IntelTdx/IntelTdxX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+plat = IntelTdx
+dest = RHEL-9/ovmf
+cpy1 = FV/OVMF.fd OVMF.inteltdx.fd
+
+
+#####################################################################
+# armvirt builds
+
+[build.armvirt.aa64.verbose]
+desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.verbose
+pcds = nx.broken.grub
+plat = ArmVirtQemu-AARCH64
+dest = RHEL-9/aarch64
+cpy1 = FV/QEMU_EFI.fd
+cpy2 = FV/QEMU_VARS.fd
+cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
+cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
+pad3 = QEMU_EFI-pflash.raw      64m
+pad4 = vars-template-pflash.raw 64m
+
+[build.armvirt.aa64.silent]
+desc = ArmVirt build for qemu, 64-bit (arm v8), silent
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.silent
+pcds = nx.broken.grub
+plat = ArmVirtQemu-AARCH64
+dest = RHEL-9/aarch64
+cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.silent.fd
+cpy2 = FV/QEMU_EFI.fd  QEMU_EFI-silent-pflash.raw
+pad2 = QEMU_EFI-silent-pflash.raw 64m

edk2.spec

@@ -1,154 +1,706 @@
-%define SVNDATE   20150519
-%define SVNREV    17469
+# https://fedoraproject.org/wiki/Changes/SetBuildFlagsBuildCheck
+# breaks cross-building
+%undefine _auto_set_build_flags
 
-Name:		edk2
-Version:	%{SVNDATE}svn%{SVNREV}
-Release:	1%{?dist}
-Summary:	EFI Development Kit II
+# actual firmware builds support cross-compiling.  edk2-tools
+# in theory should build everywhere without much trouble, but
+# in practice the edk2 build system barfs on archs it doesn't know
+# (such as ppc), so lets limit things to the known-good ones.
+ExclusiveArch: x86_64 aarch64
 
-# There are no formal releases from upstream.
-# Tarballs are created with:
+# edk2-stable202302
+%define GITDATE        20230524
+%define GITCOMMIT      ba91d0292e59
+%define TOOLCHAIN      GCC5
+%define OPENSSL_VER    1.1.1k
 
-# svn export -r ${SVNREV} \
-#     https://svn.code.sf.net/p/edk2/code/trunk/edk2/BaseTools edk2-buildtools-r${SVNREV}
-# rm -rf edk2-buildtools-r${SVNREV}/Bin
-# tar -cv edk2-buildtools-r${SVNREV} | xz -6 > edk2-buildtools-r${SVNREV}.tar.xz
-Source0:	edk2-buildtools-r%{SVNREV}.tar.xz
-Patch1:		basetools-arm.patch
+%define DBXDATE        20230509
 
-License:	BSD
-Group:		Applications/Emulators
-URL:		http://sourceforge.net/apps/mediawiki/tianocore/index.php?title=EDK2
+%if %{defined rhel}
+%define build_ovmf 0
+%define build_aarch64 0
+%ifarch x86_64
+  %define build_ovmf 1
+%endif
+%ifarch aarch64
+  %define build_aarch64 1
+%endif
+%define build_riscv64 0
+%else
+%define build_ovmf 1
+%define build_aarch64 1
+%define build_riscv64 1
+%endif
 
-# We need to build tools everywhere, but how is still an open question
-# https://bugzilla.redhat.com/show_bug.cgi?id=992180
-ExclusiveArch:	%{ix86} x86_64 %{arm}
+%global softfloat_version 20180726-gitb64af41
+%define cross %{defined fedora}
+%define disable_werror %{defined fedora}
 
-BuildRequires:	python2-devel
-BuildRequires:	libuuid-devel
 
-Requires:	edk2-tools%{?_isa} = %{version}-%{release}
-Requires:	edk2-tools-doc%{?_isa} = %{version}-%{release}
+Name:       edk2
+Version:    %{GITDATE}
+Release:    %autorelease
+Summary:    UEFI firmware for 64-bit virtual machines
+License:    BSD-2-Clause-Patent and OpenSSL and MIT
+URL:        http://www.tianocore.org
+
+# The source tarball is created using following commands:
+# COMMIT=bb1bba3d7767
+# git archive --format=tar --prefix=edk2-$COMMIT/ $COMMIT \
+# | xz -9ev >/tmp/edk2-$COMMIT.tar.xz
+Source0: edk2-%{GITCOMMIT}.tar.xz
+Source1: ovmf-whitepaper-c770f8c.txt
+Source2: openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
+Source3: softfloat-%{softfloat_version}.tar.xz
+Source4: edk2-platforms-7880b92e2a04.tar.xz
+Source5: jansson-2.13.1.tar.bz2
+
+# json description files
+Source10: 50-edk2-aarch64-qcow2.json
+Source11: 51-edk2-aarch64-raw.json
+Source12: 52-edk2-aarch64-verbose-qcow2.json
+Source13: 53-edk2-aarch64-verbose-raw.json
+
+Source20: 50-edk2-arm-verbose.json
+
+Source30: 30-edk2-ovmf-ia32-sb-enrolled.json
+Source31: 40-edk2-ovmf-ia32-sb.json
+Source32: 50-edk2-ovmf-ia32-nosb.json
+
+Source40: 30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json
+Source41: 31-edk2-ovmf-2m-raw-x64-sb-enrolled.json
+Source42: 40-edk2-ovmf-4m-qcow2-x64-sb.json
+Source43: 41-edk2-ovmf-2m-raw-x64-sb.json
+Source44: 50-edk2-ovmf-x64-microvm.json
+Source45: 50-edk2-ovmf-4m-qcow2-x64-nosb.json
+Source46: 51-edk2-ovmf-2m-raw-x64-nosb.json
+Source47: 60-edk2-ovmf-x64-amdsev.json
+Source48: 60-edk2-ovmf-x64-inteltdx.json
+
+# https://gitlab.com/kraxel/edk2-build-config
+Source80: edk2-build.py
+Source81: edk2-build.fedora
+Source82: edk2-build.fedora.platforms
+Source83: edk2-build.rhel-9
+
+Source90: DBXUpdate-%{DBXDATE}.x64.bin
+Source91: DBXUpdate-%{DBXDATE}.ia32.bin
+
+Patch0001: 0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch
+Patch0002: 0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch
+Patch0003: 0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
+Patch0004: 0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
+Patch0005: 0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
+Patch0006: 0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+Patch0007: 0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+Patch0008: 0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+Patch0009: 0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+Patch0010: 0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+Patch0011: 0011-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
+Patch0012: 0012-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
+Patch0013: 0013-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
+Patch0015: 0015-OvmfPkg-PlatformPei-drop-S3Verification.patch
+Patch0016: 0016-OvmfPkg-PciHotPlugInitDxe-Do-not-reserve-IO-ports-by.patch
+Patch0017: 0017-OvmfPkg-PlatformInitLib-check-PcdUse1GPageTable.patch
+Patch0018: 0018-OvmfPkg-OvmfPkgIa32X64-enable-1G-pages.patch
+Patch0019: 0019-OvmfPkg-MicrovmX64-enable-1G-pages.patch
+Patch0020: 0020-OvmfPkg-VirtioSerialDxe-use-TPL_NOTIFY.patch
+Patch0021: 0021-OvmfPkg-QemuFlashFvbServicesRuntimeDxe-refine-flash-.patch
+Patch0022: 0022-OvmfPkg-PlatformInitLib-limit-phys-bits-to-46.patch
+Patch0023: 0023-ArmVirt-add-VirtioSerialDxe-to-ArmVirtQemu-builds.patch
+Patch0024: 0024-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtio.patch
+Patch0025: 0025-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtioPc.patch
+Patch0026: 0026-ArmVirt-PlatformBootManagerLib-set-up-virtio-serial-.patch
+Patch0027: 0027-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
+Patch0028: 0028-ArmPkg-Add-Pcd-to-disable-EFI_MEMORY_ATTRIBUTE_PROTO.patch
+
+
+# python3-devel and libuuid-devel are required for building tools.
+# python3-devel is also needed for varstore template generation and
+# verification with "ovmf-vars-generator".
+BuildRequires:  python3-devel
+BuildRequires:  libuuid-devel
+BuildRequires:  /usr/bin/iasl
+BuildRequires:  binutils gcc git gcc-c++ make
+BuildRequires:  qemu-img
+
+%if %{build_ovmf}
+# Only OVMF includes 80x86 assembly files (*.nasm*).
+BuildRequires:  nasm
+
+# Only OVMF includes the Secure Boot feature, for which we need to separate out
+# the UEFI shell.
+BuildRequires:  dosfstools
+BuildRequires:  mtools
+BuildRequires:  xorriso
+
+# For generating the variable store template with the default certificates
+# enrolled.
+BuildRequires:  python3-virt-firmware >= 23.5
+
+# endif build_ovmf
+%endif
+
+%if %{cross}
+BuildRequires:  gcc-aarch64-linux-gnu
+BuildRequires:  gcc-arm-linux-gnu
+BuildRequires:  gcc-x86_64-linux-gnu
+BuildRequires:  gcc-riscv64-linux-gnu
+%endif
+
+
+
+%package ovmf
+Summary:    UEFI firmware for x86_64 virtual machines
+BuildArch:  noarch
+Provides:   OVMF = %{version}-%{release}
+Obsoletes:  OVMF < 20180508-100.gitee3198e672e2.el7
+
+# OVMF includes the Secure Boot and IPv6 features; it has a builtin OpenSSL
+# library.
+Provides:   bundled(openssl) = %{OPENSSL_VER}
+License:    BSD-2-Clause-Patent and OpenSSL
+
+# URL taken from the Maintainers.txt file.
+URL:        http://www.tianocore.org/ovmf/
+
+%description ovmf
+OVMF (Open Virtual Machine Firmware) is a project to enable UEFI support for
+Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU
+and KVM.
+
+
+%package aarch64
+Summary:    UEFI firmware for aarch64 virtual machines
+BuildArch:  noarch
+Provides:   AAVMF = %{version}-%{release}
+Obsoletes:  AAVMF < 20180508-100.gitee3198e672e2.el7
+
+# need libvirt version with qcow2 support
+Conflicts:  libvirt-daemon-driver-qemu < 9.2.0
+
+# No Secure Boot for AAVMF yet, but we include OpenSSL for the IPv6 stack.
+Provides:   bundled(openssl) = %{OPENSSL_VER}
+License:    BSD-2-Clause-Patent and OpenSSL
+
+# URL taken from the Maintainers.txt file.
+URL:        https://github.com/tianocore/tianocore.github.io/wiki/ArmVirtPkg
+
+%description aarch64
+AAVMF (ARM Architecture Virtual Machine Firmware) is an EFI Development Kit II
+platform that enables UEFI support for QEMU/KVM ARM Virtual Machines. This
+package contains a 64-bit build.
 
-%description
-EDK II is a development code base for creating UEFI drivers, applications
-and firmware images.
 
 %package tools
-Summary:	EFI Development Kit II Tools
-Group:		Development/Tools
-Requires:	edk2-tools-python = %{version}-%{release}
-
+Summary:        EFI Development Kit II Tools
+License:        BSD-2-Clause-Patent
+URL:            https://github.com/tianocore/tianocore.github.io/wiki/BaseTools
 %description tools
 This package provides tools that are needed to
 build EFI executables and ROMs using the GNU tools.
 
+%package tools-doc
+Summary:        Documentation for EFI Development Kit II Tools
+BuildArch:      noarch
+License:        BSD-2-Clause-Patent
+URL:            https://github.com/tianocore/tianocore.github.io/wiki/BaseTools
+%description tools-doc
+This package documents the tools that are needed to
+build EFI executables and ROMs using the GNU tools.
+
+%description
+EDK II is a modern, feature-rich, cross-platform firmware development
+environment for the UEFI and PI specifications. This package contains sample
+64-bit UEFI firmware builds for QEMU and KVM.
+
+
+%if %{defined fedora}
+%package ovmf-ia32
+Summary:        Open Virtual Machine Firmware
+License:        BSD-2-Clause-Patent and OpenSSL
+Provides:       bundled(openssl)
+BuildArch:      noarch
+%description ovmf-ia32
+EFI Development Kit II
+Open Virtual Machine Firmware (ia32)
+
+%package ovmf-xen
+Summary:        Open Virtual Machine Firmware, Xen build
+License:        BSD-2-Clause-Patent and OpenSSL
+Provides:       bundled(openssl)
+BuildArch:      noarch
+%description ovmf-xen
+EFI Development Kit II
+Open Virtual Machine Firmware (Xen build)
+
+%package ovmf-experimental
+Summary:        Open Virtual Machine Firmware, experimental builds
+License:        BSD-2-Clause-Patent and OpenSSL
+Provides:       bundled(openssl)
+BuildArch:      noarch
+%description ovmf-experimental
+EFI Development Kit II
+Open Virtual Machine Firmware (experimental builds)
+
+%package arm
+Summary:        ARM Virtual Machine Firmware
+BuildArch:      noarch
+License:        BSD-2-Clause-Patent and OpenSSL
+%description arm
+EFI Development Kit II
+ARMv7 UEFI Firmware
+
+%package riscv64
+Summary:        RISC-V Virtual Machine Firmware
+BuildArch:      noarch
+License:        BSD-2-Clause-Patent and OpenSSL
+%description riscv64
+EFI Development Kit II
+RISC-V UEFI Firmware
+
+%package ext4
+Summary:        Ext4 filesystem driver
+License:        BSD-2-Clause-Patent and OpenSSL
+BuildArch:      noarch
+%description ext4
+EFI Development Kit II
+Ext4 filesystem driver
+
 %package tools-python
-Summary:	EFI Development Kit II Tools
-Group:		Development/Tools
-Requires:	python
+Summary:        EFI Development Kit II Tools
+Requires:       python3
 BuildArch:      noarch
 
 %description tools-python
 This package provides tools that are needed to build EFI executables
 and ROMs using the GNU tools.  You do not need to install this package;
 you probably want to install edk2-tools only.
+# endif fedora
+%endif
 
-%package tools-doc
-Summary:	Documentation for EFI Development Kit II Tools
-Group:		Development/Tools
 
-%description tools-doc
-This package documents the tools that are needed to
-build EFI executables and ROMs using the GNU tools.
 
 %prep
-%setup -q -n edk2-buildtools-r%{SVNREV}
-%patch1 -p1
+# We needs some special git config options that %%autosetup won't give us.
+# We init the git dir ourselves, then tell %%autosetup not to blow it away.
+%setup -q -n edk2-%{GITCOMMIT}
+git init -q
+git config core.whitespace cr-at-eol
+git config am.keepcr true
+# -T is passed to %%setup to not re-extract the archive
+# -D is passed to %%setup to not delete the existing archive dir
+%autosetup -T -D -n edk2-%{GITCOMMIT} -S git_am
+
+cp -a -- %{SOURCE1} .
+tar -C CryptoPkg/Library/OpensslLib -a -f %{SOURCE2} -x
+# extract softfloat into place
+tar -xf %{SOURCE3} --strip-components=1 --directory ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3/
+tar -xf %{SOURCE4} --strip-components=1 "*/Drivers" "*/Features" "*/Platform" "*/Silicon"
+tar -xf %{SOURCE5} --strip-components=1 --directory RedfishPkg/Library/JsonLib/jansson
+# include paths pointing to unused submodules
+mkdir -p MdePkg/Library/MipiSysTLib/mipisyst/library/include
+
+# Done by %setup, but we do not use it for the auxiliary tarballs
+chmod -Rf a+rX,u+w,g-w,o-w .
+
+cp -a -- \
+   %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} \
+   %{SOURCE20} \
+   %{SOURCE30} %{SOURCE31} %{SOURCE32} \
+   %{SOURCE40} %{SOURCE41} %{SOURCE42} %{SOURCE43} %{SOURCE44} \
+   %{SOURCE45} %{SOURCE46} %{SOURCE47} %{SOURCE48} \
+   %{SOURCE80} %{SOURCE81} %{SOURCE82} %{SOURCE83} \
+   %{SOURCE90} %{SOURCE91} \
+   .
 
 %build
-export WORKSPACE=`pwd`
 
-# Build is broken if MAKEFLAGS contains -j option.
-unset MAKEFLAGS
-make
+build_iso() {
+  dir="$1"
+  UEFI_SHELL_BINARY=${dir}/Shell.efi
+  ENROLLER_BINARY=${dir}/EnrollDefaultKeys.efi
+  UEFI_SHELL_IMAGE=uefi_shell.img
+  ISO_IMAGE=${dir}/UefiShell.iso
+
+  UEFI_SHELL_BINARY_BNAME=$(basename -- "$UEFI_SHELL_BINARY")
+  UEFI_SHELL_SIZE=$(stat --format=%s -- "$UEFI_SHELL_BINARY")
+  ENROLLER_SIZE=$(stat --format=%s -- "$ENROLLER_BINARY")
+
+  # add 1MB then 10% for metadata
+  UEFI_SHELL_IMAGE_KB=$((
+    (UEFI_SHELL_SIZE + ENROLLER_SIZE + 1 * 1024 * 1024) * 11 / 10 / 1024
+  ))
+
+  # create non-partitioned FAT image
+  rm -f -- "$UEFI_SHELL_IMAGE"
+  mkdosfs -C "$UEFI_SHELL_IMAGE" -n UEFI_SHELL -- "$UEFI_SHELL_IMAGE_KB"
+
+  # copy the shell binary into the FAT image
+  export MTOOLS_SKIP_CHECK=1
+  mmd   -i "$UEFI_SHELL_IMAGE"                       ::efi
+  mmd   -i "$UEFI_SHELL_IMAGE"                       ::efi/boot
+  mcopy -i "$UEFI_SHELL_IMAGE"  "$UEFI_SHELL_BINARY" ::efi/boot/bootx64.efi
+  mcopy -i "$UEFI_SHELL_IMAGE"  "$ENROLLER_BINARY"   ::
+  mdir  -i "$UEFI_SHELL_IMAGE"  -/                   ::
+
+  # build ISO with FAT image file as El Torito EFI boot image
+  mkisofs -input-charset ASCII -J -rational-rock \
+    -e "$UEFI_SHELL_IMAGE" -no-emul-boot \
+    -o "$ISO_IMAGE" "$UEFI_SHELL_IMAGE"
+}
+
+export EXTRA_OPTFLAGS="%{optflags}"
+export EXTRA_LDFLAGS="%{__global_ldflags}"
+export RELEASE_DATE="$(echo %{GITDATE} | sed -e 's|\(....\)\(..\)\(..\)|\2/\3/\1|')"
+
+touch OvmfPkg/AmdSev/Grub/grub.efi   # dummy
+
+%if %{build_ovmf}
+%if %{defined rhel}
+
+./edk2-build.py --config edk2-build.rhel-9 --silent --release-date "$RELEASE_DATE" -m ovmf
+virt-fw-vars --input   RHEL-9/ovmf/OVMF_VARS.fd \
+             --output  RHEL-9/ovmf/OVMF_VARS.secboot.fd \
+             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
+             --enroll-redhat --secure-boot
+build_iso RHEL-9/ovmf
+
+%else
+
+./edk2-build.py --config edk2-build.fedora --silent --release-date "$RELEASE_DATE" -m ovmf
+./edk2-build.py --config edk2-build.fedora.platforms --silent -m x64
+virt-fw-vars --input   Fedora/ovmf/OVMF_VARS.fd \
+             --output  Fedora/ovmf/OVMF_VARS.secboot.fd \
+             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
+             --enroll-redhat --secure-boot
+virt-fw-vars --input   Fedora/ovmf/OVMF_VARS_4M.fd \
+             --output  Fedora/ovmf/OVMF_VARS_4M.secboot.fd \
+             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
+             --enroll-redhat --secure-boot
+virt-fw-vars --input   Fedora/ovmf-ia32/OVMF_VARS.fd \
+             --output  Fedora/ovmf-ia32/OVMF_VARS.secboot.fd \
+             --set-dbx DBXUpdate-%{DBXDATE}.ia32.bin \
+             --enroll-redhat --secure-boot
+build_iso Fedora/ovmf
+build_iso Fedora/ovmf-ia32
+
+for raw in */ovmf/*_4M*.fd; do
+    qcow2="${raw%.fd}.qcow2"
+    qemu-img convert -f raw -O qcow2 -o cluster_size=4096 -S 4096 "$raw" "$qcow2"
+    rm -f "$raw"
+done
+
+# experimental stateless builds
+virt-fw-vars --input   Fedora/experimental/OVMF.stateless.fd \
+             --output  Fedora/experimental/OVMF.stateless.secboot.fd \
+             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
+             --enroll-redhat --secure-boot
+
+for image in \
+	Fedora/ovmf/OVMF_CODE.secboot.fd \
+	Fedora/ovmf/OVMF_CODE_4M.secboot.qcow2 \
+	Fedora/experimental/OVMF.stateless.secboot.fd \
+; do
+	pcr="${image}"
+	pcr="${pcr%.fd}"
+	pcr="${pcr%.qcow2}"
+	pcr="${pcr}.pcr"
+	python3 /usr/share/doc/python3-virt-firmware/experimental/measure.py \
+		--image "$image" \
+		--version "%{name}-%{version}-%{release}" \
+                --no-shim \
+		> "$pcr"
+done
+
+%endif
+%endif
+
+%if %{build_aarch64}
+%if %{defined rhel}
+./edk2-build.py --config edk2-build.rhel-9 --silent --release-date "$RELEASE_DATE" -m armvirt
+%else
+./edk2-build.py --config edk2-build.fedora --silent --release-date "$RELEASE_DATE" -m armvirt
+./edk2-build.py --config edk2-build.fedora.platforms --silent -m aa64
+%endif
+for raw in */aarch64/*.raw; do
+    qcow2="${raw%.raw}.qcow2"
+    qemu-img convert -f raw -O qcow2 -o cluster_size=4096 -S 4096 "$raw" "$qcow2"
+done
+%endif
+
+%if %{build_riscv64}
+./edk2-build.py --config edk2-build.fedora --silent --release-date "$RELEASE_DATE" -m riscv
+./edk2-build.py --config edk2-build.fedora.platforms --silent -m riscv
+%endif
 
 %install
-mkdir -p %{buildroot}%{_bindir}
-install	\
-	Source/C/bin/BootSectImage \
-	Source/C/bin/EfiLdrImage \
-	Source/C/bin/EfiRom \
-	Source/C/bin/GenCrc32 \
-	Source/C/bin/GenFfs \
-	Source/C/bin/GenFv \
-	Source/C/bin/GenFw \
-	Source/C/bin/GenPage \
-	Source/C/bin/GenSec \
-	Source/C/bin/GenVtf \
-	Source/C/bin/GnuGenBootSector \
-	Source/C/bin/LzmaCompress \
-	BinWrappers/PosixLike/LzmaF86Compress \
-	Source/C/bin/Split \
-	Source/C/bin/TianoCompress \
-	Source/C/bin/VfrCompile \
-	Source/C/bin/VolInfo \
-	%{buildroot}%{_bindir}
 
-ln -f %{buildroot}%{_bindir}/GnuGenBootSector \
-	%{buildroot}%{_bindir}/GenBootSector
+cp -a OvmfPkg/License.txt License.OvmfPkg.txt
+cp -a CryptoPkg/Library/OpensslLib/openssl/LICENSE LICENSE.openssl
+mkdir -p %{buildroot}%{_datadir}/qemu/firmware
 
-mkdir -p %{buildroot}%{_datadir}/%{name}
-install \
-        BuildEnv \
+# install the tools
+mkdir -p %{buildroot}%{_bindir} \
+         %{buildroot}%{_datadir}/%{name}/Conf \
+         %{buildroot}%{_datadir}/%{name}/Scripts
+install BaseTools/Source/C/bin/* \
+        %{buildroot}%{_bindir}
+install BaseTools/BinWrappers/PosixLike/LzmaF86Compress \
+        %{buildroot}%{_bindir}
+install BaseTools/BuildEnv \
         %{buildroot}%{_datadir}/%{name}
-
-mkdir -p %{buildroot}%{_datadir}/%{name}/Conf
-install \
-        Conf/build_rule.template \
-        Conf/tools_def.template \
-        Conf/target.template \
+install BaseTools/Conf/*.template \
         %{buildroot}%{_datadir}/%{name}/Conf
-
-mkdir -p %{buildroot}%{_datadir}/%{name}/Scripts
-install \
-        Scripts/gcc4.4-ld-script \
+install BaseTools/Scripts/GccBase.lds \
         %{buildroot}%{_datadir}/%{name}/Scripts
 
-cp -R Source/Python %{buildroot}%{_datadir}/%{name}/Python
+# install firmware images
+mkdir -p %{buildroot}%{_datadir}/%{name}
+%if %{defined rhel}
+cp -av RHEL-9/* %{buildroot}%{_datadir}/%{name}
+%else
+cp -av Fedora/* %{buildroot}%{_datadir}/%{name}
+%endif
 
-find %{buildroot}%{_datadir}/%{name}/Python -name "*.pyd" | xargs rm
 
+%if %{build_ovmf}
+
+# compat symlinks
+mkdir -p %{buildroot}%{_datadir}/OVMF
+ln -s ../%{name}/ovmf/OVMF_CODE.fd         %{buildroot}%{_datadir}/OVMF/
+ln -s ../%{name}/ovmf/OVMF_CODE.secboot.fd %{buildroot}%{_datadir}/OVMF/
+ln -s ../%{name}/ovmf/OVMF_VARS.fd         %{buildroot}%{_datadir}/OVMF/
+ln -s ../%{name}/ovmf/OVMF_VARS.secboot.fd %{buildroot}%{_datadir}/OVMF/
+ln -s ../%{name}/ovmf/UefiShell.iso        %{buildroot}%{_datadir}/OVMF/
+ln -s OVMF_CODE.fd %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
+
+# json description files
+mkdir -p %{buildroot}%{_datadir}/qemu/firmware
+install -m 0644 \
+        30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json \
+        31-edk2-ovmf-2m-raw-x64-sb-enrolled.json \
+        40-edk2-ovmf-4m-qcow2-x64-sb.json \
+        41-edk2-ovmf-2m-raw-x64-sb.json \
+        50-edk2-ovmf-4m-qcow2-x64-nosb.json \
+        51-edk2-ovmf-2m-raw-x64-nosb.json \
+        60-edk2-ovmf-x64-amdsev.json \
+        60-edk2-ovmf-x64-inteltdx.json \
+        %{buildroot}%{_datadir}/qemu/firmware
+%if %{defined fedora}
+install -m 0644 \
+        50-edk2-ovmf-x64-microvm.json \
+        30-edk2-ovmf-ia32-sb-enrolled.json \
+        40-edk2-ovmf-ia32-sb.json \
+        50-edk2-ovmf-ia32-nosb.json \
+        %{buildroot}%{_datadir}/qemu/firmware
+%endif
+
+# endif build_ovmf
+%endif
+
+%if %{build_aarch64}
+
+# compat symlinks
+mkdir -p %{buildroot}%{_datadir}/AAVMF
+ln -s ../%{name}/aarch64/QEMU_EFI-pflash.raw \
+  %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
+ln -s ../%{name}/aarch64/QEMU_EFI-silent-pflash.raw \
+  %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.fd
+ln -s ../%{name}/aarch64/vars-template-pflash.raw \
+  %{buildroot}%{_datadir}/AAVMF/AAVMF_VARS.fd
+%if %{defined fedora}
+ln -s ../%{name}/arm/QEMU_EFI-pflash.raw \
+   %{buildroot}%{_datadir}/AAVMF/AAVMF32_CODE.fd
+%endif
+
+# json description files
+install -m 0644 \
+        50-edk2-aarch64-qcow2.json \
+        51-edk2-aarch64-raw.json \
+        52-edk2-aarch64-verbose-qcow2.json \
+        53-edk2-aarch64-verbose-raw.json \
+        %{buildroot}%{_datadir}/qemu/firmware
+%if %{defined fedora}
+install -m 0644 \
+        50-edk2-arm-verbose.json \
+        %{buildroot}%{_datadir}/qemu/firmware
+%endif
+
+# endif build_aarch64
+%endif
+
+%if %{defined fedora}
+
+# edk2-tools-python install
+cp -R BaseTools/Source/Python %{buildroot}%{_datadir}/%{name}/Python
 for i in build BPDG Ecc GenDepex GenFds GenPatchPcdTable PatchPcdValue TargetTool Trim UPT; do
-  echo '#!/bin/sh
-PYTHONPATH=%{_datadir}/%{name}/Python
-export PYTHONPATH
-exec python '%{_datadir}/%{name}/Python/$i/$i.py' "$@"' > %{buildroot}%{_bindir}/$i
+echo '#!/bin/sh
+export PYTHONPATH=%{_datadir}/%{name}/Python
+exec python3 '%{_datadir}/%{name}/Python/$i/$i.py' "$@"' > %{buildroot}%{_bindir}/$i
   chmod +x %{buildroot}%{_bindir}/$i
 done
 
+%if 0%{?py_byte_compile:1}
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/Python_Appendix/#manual-bytecompilation
+%py_byte_compile %{python3} %{buildroot}%{_datadir}/edk2/Python
+%endif
+
+%endif
+
+%check
+for file in %{buildroot}%{_datadir}/%{name}/*/*VARS.secboot.fd; do
+    test -f "$file" || continue
+    virt-fw-vars --input $file --print | grep "SecureBootEnable.*ON" || exit 1
+done
+
+%global common_files \
+  %%license License.txt License.OvmfPkg.txt License-History.txt LICENSE.openssl \
+  %%dir %%{_datadir}/%%{name}/ \
+  %%dir %%{_datadir}/qemu \
+  %%dir %%{_datadir}/qemu/firmware
+
+%if %{build_ovmf}
+%files ovmf
+%common_files
+%doc OvmfPkg/README
+%doc ovmf-whitepaper-c770f8c.txt
+%dir %{_datadir}/OVMF/
+%{_datadir}/OVMF/OVMF_CODE.fd
+%{_datadir}/OVMF/OVMF_CODE.secboot.fd
+%{_datadir}/OVMF/OVMF_VARS.fd
+%{_datadir}/OVMF/OVMF_VARS.secboot.fd
+%{_datadir}/OVMF/UefiShell.iso
+%dir %{_datadir}/%{name}/ovmf/
+%{_datadir}/%{name}/ovmf/OVMF_CODE.fd
+%{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
+%{_datadir}/%{name}/ovmf/OVMF_CODE.secboot.fd
+%{_datadir}/%{name}/ovmf/OVMF_VARS.fd
+%{_datadir}/%{name}/ovmf/OVMF_VARS.secboot.fd
+%{_datadir}/%{name}/ovmf/OVMF.amdsev.fd
+%{_datadir}/%{name}/ovmf/OVMF.inteltdx.fd
+%{_datadir}/%{name}/ovmf/UefiShell.iso
+%{_datadir}/%{name}/ovmf/Shell.efi
+%{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi
+%{_datadir}/qemu/firmware/30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json
+%{_datadir}/qemu/firmware/31-edk2-ovmf-2m-raw-x64-sb-enrolled.json
+%{_datadir}/qemu/firmware/40-edk2-ovmf-4m-qcow2-x64-sb.json
+%{_datadir}/qemu/firmware/41-edk2-ovmf-2m-raw-x64-sb.json
+%{_datadir}/qemu/firmware/50-edk2-ovmf-4m-qcow2-x64-nosb.json
+%{_datadir}/qemu/firmware/51-edk2-ovmf-2m-raw-x64-nosb.json
+%{_datadir}/qemu/firmware/60-edk2-ovmf-x64-amdsev.json
+%{_datadir}/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
+%if %{defined fedora}
+%{_datadir}/%{name}/ovmf/MICROVM.fd
+%{_datadir}/qemu/firmware/50-edk2-ovmf-x64-microvm.json
+%{_datadir}/%{name}/ovmf/OVMF_CODE_4M.qcow2
+%{_datadir}/%{name}/ovmf/OVMF_CODE_4M.secboot.qcow2
+%{_datadir}/%{name}/ovmf/OVMF_VARS_4M.qcow2
+%{_datadir}/%{name}/ovmf/OVMF_VARS_4M.secboot.qcow2
+%{_datadir}/%{name}/ovmf/*.pcr
+%endif
+# endif build_ovmf
+%endif
+
+%if %{build_aarch64}
+%files aarch64
+%common_files
+%dir %{_datadir}/AAVMF/
+%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
+%{_datadir}/AAVMF/AAVMF_CODE.fd
+%{_datadir}/AAVMF/AAVMF_VARS.fd
+%dir %{_datadir}/%{name}/aarch64/
+%{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.*
+%{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.*
+%{_datadir}/%{name}/aarch64/vars-template-pflash.*
+%{_datadir}/%{name}/aarch64/QEMU_EFI.fd
+%{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd
+%{_datadir}/%{name}/aarch64/QEMU_VARS.fd
+%if %{defined fedora}
+%{_datadir}/%{name}/aarch64/BL32_AP_MM.fd
+%{_datadir}/%{name}/aarch64/QEMU_EFI.kernel.fd
+%endif
+%{_datadir}/qemu/firmware/50-edk2-aarch64-qcow2.json
+%{_datadir}/qemu/firmware/51-edk2-aarch64-raw.json
+%{_datadir}/qemu/firmware/52-edk2-aarch64-verbose-qcow2.json
+%{_datadir}/qemu/firmware/53-edk2-aarch64-verbose-raw.json
+# endif build_aarch64
+%endif
+
 %files tools
-%{_bindir}/BootSectImage
-%{_bindir}/EfiLdrImage
+%license License.txt
+%license License-History.txt
+%{_bindir}/DevicePath
 %{_bindir}/EfiRom
-%{_bindir}/GenBootSector
 %{_bindir}/GenCrc32
 %{_bindir}/GenFfs
 %{_bindir}/GenFv
 %{_bindir}/GenFw
-%{_bindir}/GenPage
 %{_bindir}/GenSec
-%{_bindir}/GenVtf
-%{_bindir}/GnuGenBootSector
 %{_bindir}/LzmaCompress
 %{_bindir}/LzmaF86Compress
-%{_bindir}/Split
 %{_bindir}/TianoCompress
 %{_bindir}/VfrCompile
 %{_bindir}/VolInfo
+%dir %{_datadir}/%{name}
 %{_datadir}/%{name}/BuildEnv
-%{_datadir}/%{name}/Conf/
-%{_datadir}/%{name}/Scripts/
+%{_datadir}/%{name}/Conf
+%{_datadir}/%{name}/Scripts
+
+%files tools-doc
+%doc BaseTools/UserManuals/*.rtf
+
+
+%if %{defined fedora}
+%if %{build_ovmf}
+%files ovmf-ia32
+%common_files
+%dir %{_datadir}/%{name}/ovmf-ia32
+%{_datadir}/%{name}/ovmf-ia32/EnrollDefaultKeys.efi
+%{_datadir}/%{name}/ovmf-ia32/OVMF_CODE.fd
+%{_datadir}/%{name}/ovmf-ia32/OVMF_CODE.secboot.fd
+%{_datadir}/%{name}/ovmf-ia32/OVMF_VARS.fd
+%{_datadir}/%{name}/ovmf-ia32/OVMF_VARS.secboot.fd
+%{_datadir}/%{name}/ovmf-ia32/Shell.efi
+%{_datadir}/%{name}/ovmf-ia32/UefiShell.iso
+%{_datadir}/qemu/firmware/30-edk2-ovmf-ia32-sb-enrolled.json
+%{_datadir}/qemu/firmware/40-edk2-ovmf-ia32-sb.json
+%{_datadir}/qemu/firmware/50-edk2-ovmf-ia32-nosb.json
+
+%files ovmf-experimental
+%common_files
+%dir %{_datadir}/%{name}/experimental
+%{_datadir}/%{name}/experimental/*.fd
+%{_datadir}/%{name}/experimental/*.raw
+%{_datadir}/%{name}/experimental/*.pcr
+
+%files ovmf-xen
+%common_files
+%dir %{_datadir}/%{name}/xen
+%{_datadir}/%{name}/xen/*.fd
+%endif
+
+%files arm
+%common_files
+%dir %{_datadir}/AAVMF/
+%{_datadir}/AAVMF/AAVMF32_CODE.fd
+%dir %{_datadir}/%{name}/arm
+%{_datadir}/%{name}/arm/QEMU_EFI-pflash.raw
+%{_datadir}/%{name}/arm/QEMU_EFI.fd
+%{_datadir}/%{name}/arm/QEMU_VARS.fd
+%{_datadir}/%{name}/arm/vars-template-pflash.raw
+%{_datadir}/qemu/firmware/50-edk2-arm-verbose.json
+
+%files riscv64
+%common_files
+%{_datadir}/%{name}/riscv/*.fd
+%{_datadir}/%{name}/riscv/*.raw
+
+%files ext4
+%common_files
+%dir %{_datadir}/%{name}/drivers
+%{_datadir}/%{name}/drivers/ext4*.efi
+
 
 %files tools-python
 %{_bindir}/build
@@ -161,91 +713,12 @@ done
 %{_bindir}/TargetTool
 %{_bindir}/Trim
 %{_bindir}/UPT
-%{_datadir}/%{name}/Python/
+%dir %{_datadir}/%{name}
+%{_datadir}/%{name}/Python
+
+# endif fedora
+%endif
 
-%files tools-doc
-%doc UserManuals/BootSectImage_Utility_Man_Page.rtf
-%doc UserManuals/Build_Utility_Man_Page.rtf
-%doc UserManuals/EfiLdrImage_Utility_Man_Page.rtf
-%doc UserManuals/EfiRom_Utility_Man_Page.rtf
-%doc UserManuals/GenBootSector_Utility_Man_Page.rtf
-%doc UserManuals/GenCrc32_Utility_Man_Page.rtf
-%doc UserManuals/GenDepex_Utility_Man_Page.rtf
-%doc UserManuals/GenFds_Utility_Man_Page.rtf
-%doc UserManuals/GenFfs_Utility_Man_Page.rtf
-%doc UserManuals/GenFv_Utility_Man_Page.rtf
-%doc UserManuals/GenFw_Utility_Man_Page.rtf
-%doc UserManuals/GenPage_Utility_Man_Page.rtf
-%doc UserManuals/GenPatchPcdTable_Utility_Man_Page.rtf
-%doc UserManuals/GenSec_Utility_Man_Page.rtf
-%doc UserManuals/GenVtf_Utility_Man_Page.rtf
-%doc UserManuals/LzmaCompress_Utility_Man_Page.rtf
-%doc UserManuals/PatchPcdValue_Utility_Man_Page.rtf
-%doc UserManuals/SplitFile_Utility_Man_Page.rtf
-%doc UserManuals/TargetTool_Utility_Man_Page.rtf
-%doc UserManuals/TianoCompress_Utility_Man_Page.rtf
-%doc UserManuals/Trim_Utility_Man_Page.rtf
-%doc UserManuals/VfrCompiler_Utility_Man_Page.rtf
-%doc UserManuals/VolInfo_Utility_Man_Page.rtf
 
 %changelog
-* Tue May 19 2015 Bonzini <pbonzini@redhat.com> - 20150519svn17469-1
-- Rebase to 20150519svn17469-1
-- edk2-remove-tree-check.patch now upstream
-
-* Sat May 02 2015 Kalev Lember <kalevlember@gmail.com> - 20140724svn2670-6
-- Rebuilt for GCC 5 C++11 ABI change
-
-* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20140724svn2670-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
-
-* Thu Jul 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140724svn2670-1
-- Rebase to 20140724svn2670-1
-
-* Tue Jun 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140624svn2649-1
-- Use standalone .tar.xz from buildtools repo
-
-* Tue Jun 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140328svn15376-4
-- Install BuildTools/BaseEnv
-
-* Mon Jun 23 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140328svn15376-3
-- Rebase to get GCC48 configuration
-- Package EDK_TOOLS_PATH as /usr/share/edk2
-- Package "build" and LzmaF86Compress too, as well as the new
-  tools Ecc and TianoCompress.
-
-* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20131114svn14844-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
-
-* Thu Nov 14 2013 Paolo Bonzini <pbonzini@redhat.com> - 20131114svn14844-1
-- Upgrade to r14844.
-- Remove upstreamed parts of patch 1.
-
-* Fri Nov 8 2013 Paolo Bonzini <pbonzini@redhat.com> - 20130515svn14365-7
-- Make BaseTools compile on ARM.
-
-* Fri Aug 30 2013 Paolo Bonzini <pbonzini@redhat.com> - 20130515svn14365-6
-- Revert previous change; firmware packages should be noarch, and building
-  BaseTools twice is simply wrong.
-
-* Mon Aug 19 2013 Kay Sievers <kay@redhat.com> - 20130515svn14365-5
-- Add sub-package with EFI shell
-
-* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20130515svn14365-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
-
-* Thu May 23 2013 Dan Horák <dan[at]danny.cz> 20130515svn14365-3
-- set ExclusiveArch
-
-* Thu May 16 2013 Paolo Bonzini <pbonzini@redhat.com> 20130515svn14365-2
-- Fix edk2-tools-python Requires
-
-* Wed May 15 2013 Paolo Bonzini <pbonzini@redhat.com> 20130515svn14365-1
-- Split edk2-tools-doc and edk2-tools-python
-- Fix Python BuildRequires
-- Remove FatBinPkg at package creation time.
-- Use fully versioned dependency.
-- Add comment on how to generate the sources.
-
-* Thu May 2 2013 Paolo Bonzini <pbonzini@redhat.com> 20130502.g732d199-1
-- Create.
+%autochangelog

make-tarball.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# args
+repo="${1%/}"
+ref="${2-HEAD}"
+
+# check
+if test ! -d "${repo}/.git"; then
+    echo "usage: $0 <repodir> [ <ref> ]"
+    exit 1
+fi
+
+# get + print info
+commit=$(cd $repo; git show --pretty='format:%h' $ref | head -1)
+date=$(cd $repo; git show --pretty='format:%cs' $ref | head -1 | tr -d '-')
+echo "# $repo $ref  ->  commit $commit - date $date"
+
+# create tarball
+name="${repo##*/}"
+file="${name}-${commit}.tar.xz"
+(cd $repo; git archive --format=tar --prefix=${name}-${commit}/ ${commit}) \
+    | xz -9ev > "$file"
+echo "# $file written"

sources

@@ -1 +1,5 @@
-1c685de1403f4116d93e79f6074ea0e3  edk2-buildtools-r17469.tar.xz
+SHA512 (softfloat-20180726-gitb64af41.tar.xz) = f079debd1bfcc0fe64329a8947b0689ef49246793edcdd28a2879f6550c652b0cf0f53ac4f6f5ab61ac4f7933972e0019d0ab63eb9931b6884c2909f3a5ead30
+SHA512 (jansson-2.13.1.tar.bz2) = 057f0eda43e4162569888d739f4d78d1d02fce8359400d8f66fdc6e440b0405cb457e1126820dc8ce51e9c4a7f4b7effc640caf1d54307c78c0c47c3fc093011
+SHA512 (openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz) = 418f8476e80c79e76ba2225670075f95ae75065b23cad9180daac5149e02f11deaa6551e1f70d04fe4b275b0e5f2756f890738693516a737d6f84ee8cd839019
+SHA512 (edk2-ba91d0292e59.tar.xz) = bbf1c45a168528f057b8e1b43b7bec8eba68238b07ec9cff08a0478cb7f6599c233c18c45fea1044892bb600435070b205e01e108c745274fdd5954109968974
+SHA512 (edk2-platforms-7880b92e2a04.tar.xz) = 054cff28dd9ffa634067a9572570bd397dad892c056f174166f2d2acad52d3623b5768dac99d0a836e44b4a90fce965acc75a59446c9a48b7042b9d62439c7fb