bump release, add changelog

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

.gitignore

@@ -7,3 +7,5 @@
 /qemu-ovmf-secureboot-20200228-gitc3e16b3.tar.xz
 /openssl-rhel-a75722161d20fd632f8875585d3aa066ec5fea93.tar.xz
 /openssl-rhel-bdd048e929dcfcf2f046d74e812e0e3d5fc58504.tar.xz
+/openssl-rhel-740e53ace8f6771c205bf84780e26bcd7a3275df.tar.xz
+/jansson-2.13.1.tar.bz2

0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch

@@ -1,7 +1,7 @@
-From a5e7f28a51b616d79bf3e80ce185260a75c20caa Mon Sep 17 00:00:00 2001
+From 7dcb09329342195068afc51f590793903af6ac0f Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Thu, 4 Jun 2020 13:34:12 +0200
-Subject: [PATCH 01/21] BaseTools: do not build BrotliCompress (RH only)
+Subject: [PATCH 01/17] BaseTools: do not build BrotliCompress (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -27,10 +27,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  1 file changed, 1 deletion(-)
 
 diff --git a/BaseTools/Source/C/GNUmakefile b/BaseTools/Source/C/GNUmakefile
-index 8c191e0c3817..3eae824a1c31 100644
+index 5275f657efe8..39d719975309 100644
 --- a/BaseTools/Source/C/GNUmakefile
 +++ b/BaseTools/Source/C/GNUmakefile
-@@ -48,7 +48,6 @@ all: makerootdir subdirs
+@@ -51,7 +51,6 @@ all: makerootdir subdirs
  LIBRARIES = Common
  VFRAUTOGEN = VfrCompile/VfrLexer.h
  APPLICATIONS = \
@@ -39,5 +39,5 @@ index 8c191e0c3817..3eae824a1c31 100644
    EfiRom \
    GenFfs \
 -- 
-2.35.3
+2.38.1
 

0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch

@@ -1,7 +1,7 @@
-From 77bc79dfc2d70a7ffe81ab4c764bb5b503e34b07 Mon Sep 17 00:00:00 2001
+From c107b4e09579df67285ee9ef4d904fada23d7c94 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Thu, 4 Jun 2020 13:39:08 +0200
-Subject: [PATCH 02/21] MdeModulePkg: remove package-private Brotli include
+Subject: [PATCH 02/17] MdeModulePkg: remove package-private Brotli include
  path (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -32,7 +32,7 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  1 file changed, 3 deletions(-)
 
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 2bcb9f9453af..f549276b8061 100644
+index 58e6ab004882..775f1b27af08 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
 @@ -24,9 +24,6 @@ [Defines]
@@ -46,5 +46,5 @@ index 2bcb9f9453af..f549276b8061 100644
    ##  @libraryclass  Defines a set of methods to reset whole system.
    ResetSystemLib|Include/Library/ResetSystemLib.h
 -- 
-2.35.3
+2.38.1
 

0003-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch

@@ -1,7 +1,7 @@
-From 8708aff7d939989ab52932c1329c81dfe86bdc61 Mon Sep 17 00:00:00 2001
+From 4f27957c6abb99d8fa59e6d1f6cc58e0769e9588 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Tue, 25 Feb 2014 18:40:35 +0100
-Subject: [PATCH 04/21] MdeModulePkg: TerminalDxe: add other text resolutions
+Subject: [PATCH 03/17] MdeModulePkg: TerminalDxe: add other text resolutions
  (RHEL only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -165,5 +165,5 @@ index e2d779c78378..f238c4103b3d 100644
    // New modes can be added here.
    //
 -- 
-2.35.3
+2.38.1
 

0003-OvmfPkg-increase-max-debug-message-length-to-512-RHE.patch

@@ -1,83 +0,0 @@
-From 967e66ce4fbce81338ed4cdd9131a4a25a24e461 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Thu, 20 Feb 2014 22:54:45 +0100
-Subject: [PATCH 03/21] OvmfPkg: increase max debug message length to 512 (RHEL
- only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- no change
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- trivial context difference due to upstream commit 2fe5f2f52918
-  ("OvmfPkg/PlatformDebugLibIoPort: Add new APIs", 2019-04-02), resolved
-  by git-cherry-pick automatically
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- no changes
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
-  a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no changes
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- no changes
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- no changes
-
-Upstream prefers short debug messages (sometimes even limited to 80
-characters), but any line length under 512 characters is just unsuitable
-for effective debugging. (For example, config strings in HII routing,
-logged by the platform driver "OvmfPkg/PlatformDxe" on DEBUG_VERBOSE
-level, can be several hundred characters long.) 512 is an empirically good
-value.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit bfe568d18dba15602604f155982e3b73add63dfb)
-(cherry picked from commit 29435a32ec9428720c74c454ce9817662e601fb6)
-(cherry picked from commit 58e1d1ebb78bfdaf05f4c6e8abf8d4908dfa038a)
-(cherry picked from commit 1df2c822c996ad767f2f45570ab2686458f7604a)
-(cherry picked from commit 22c9b4e971c70c69b4adf8eb93133824ccb6426a)
-(cherry picked from commit a1260c9122c95bcbef1efc5eebe11902767813c2)
-(cherry picked from commit e949bab1268f83f0f5815a96cd1cb9dd3b21bfb5)
-(cherry picked from commit a95cff0b9573bf23699551beb4786383f697ff1e)
----
- OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c b/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c
-index 4e25f198aa76..640627f38b72 100644
---- a/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c
-+++ b/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c
-@@ -21,7 +21,7 @@
- //
- // Define the maximum debug and assert message length that this library supports
- //
--#define MAX_DEBUG_MESSAGE_LENGTH  0x100
-+#define MAX_DEBUG_MESSAGE_LENGTH  0x200
- 
- //
- // VA_LIST can not initialize to NULL for all compiler, so we use this to
--- 
-2.35.3
-

0004-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch

@@ -1,7 +1,7 @@
-From 8fd6e63635f50b2dc9e950056f17c1688107647d Mon Sep 17 00:00:00 2001
+From 06b69358fb26eed68b2b9b99735d17ddf1013257 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Tue, 25 Feb 2014 22:40:01 +0100
-Subject: [PATCH 05/21] MdeModulePkg: TerminalDxe: set xterm resolution on mode
+Subject: [PATCH 04/17] MdeModulePkg: TerminalDxe: set xterm resolution on mode
  change (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -87,10 +87,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  3 files changed, 35 insertions(+)
 
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index f549276b8061..1415766054be 100644
+index 775f1b27af08..94f3394cef16 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
-@@ -2092,6 +2092,10 @@ [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
+@@ -2099,6 +2099,10 @@ [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
    # @Prompt The shared bit mask when Intel Tdx is enabled.
    gEfiMdeModulePkgTokenSpaceGuid.PcdTdxSharedBitMask|0x0|UINT64|0x10000025
  
@@ -176,5 +176,5 @@ index 7809869e7d49..496849458db4 100644
  
    Status = This->ClearScreen (This);
 -- 
-2.35.3
+2.38.1
 

0005-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch

@@ -1,7 +1,7 @@
-From e2aa9521a02cacb0ec147667d7bd87ccde2508db Mon Sep 17 00:00:00 2001
+From 71fa9595fe0ac39bb755eba385559bf8d7f4da5a Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 14 Oct 2015 15:59:06 +0200
-Subject: [PATCH 06/21] OvmfPkg: take PcdResizeXterm from the QEMU command line
+Subject: [PATCH 05/17] OvmfPkg: take PcdResizeXterm from the QEMU command line
  (RH only)
 
 edk2-stable202205 rebase
@@ -88,10 +88,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  9 files changed, 21 insertions(+)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index fc1fdb2e2297..ae23094ffc27 100644
+index 8f7cae787e97..41ad97b47dc9 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -524,6 +524,7 @@ [PcdsFixedAtBuild]
+@@ -475,6 +475,7 @@ [PcdsFixedAtBuild]
  [PcdsDynamicDefault]
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -100,10 +100,10 @@ index fc1fdb2e2297..ae23094ffc27 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc
-index 92664f319be2..4aa54e4dc3fb 100644
+index ce277cb2398b..faab59ae8d74 100644
 --- a/OvmfPkg/CloudHv/CloudHvX64.dsc
 +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc
-@@ -574,6 +574,7 @@ [PcdsDynamicDefault]
+@@ -582,6 +582,7 @@ [PcdsDynamicDefault]
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -112,10 +112,10 @@ index 92664f319be2..4aa54e4dc3fb 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-index dd8d446f4a56..ec1aab6f0939 100644
+index 345892651520..4c4da09b9024 100644
 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
 +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-@@ -461,6 +461,7 @@ [PcdsDynamicDefault]
+@@ -474,6 +474,7 @@ [PcdsDynamicDefault]
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -124,10 +124,10 @@ index dd8d446f4a56..ec1aab6f0939 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
-index f8fc977cb205..4e5ab89c8f0d 100644
+index 994a02d30107..3444304d0e46 100644
 --- a/OvmfPkg/Microvm/MicrovmX64.dsc
 +++ b/OvmfPkg/Microvm/MicrovmX64.dsc
-@@ -557,6 +557,7 @@ [PcdsDynamicDefault]
+@@ -580,6 +580,7 @@ [PcdsDynamicDefault]
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -136,10 +136,10 @@ index f8fc977cb205..4e5ab89c8f0d 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index a9841cbfc3ca..b69e3c05a281 100644
+index 6f774baf90f5..e8a074153a77 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -585,6 +585,7 @@ [PcdsDynamicDefault]
+@@ -601,6 +601,7 @@ [PcdsDynamicDefault]
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -148,10 +148,10 @@ index a9841cbfc3ca..b69e3c05a281 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index f7949780fa38..726011ec42a5 100644
+index c851764dec05..0197997793a9 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -593,6 +593,7 @@ [PcdsDynamicDefault]
+@@ -609,6 +609,7 @@ [PcdsDynamicDefault]
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -160,10 +160,10 @@ index f7949780fa38..726011ec42a5 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 1448f925b782..ab2e31ea8f2b 100644
+index 63c3a47aea30..fade13b4e80c 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -612,6 +612,7 @@ [PcdsDynamicDefault]
+@@ -631,6 +631,7 @@ [PcdsDynamicDefault]
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -172,10 +172,10 @@ index 1448f925b782..ab2e31ea8f2b 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf
-index 00372fa0ebb5..2dfa357c384a 100644
+index 1fadadeb5565..3e28e1596d32 100644
 --- a/OvmfPkg/PlatformPei/PlatformPei.inf
 +++ b/OvmfPkg/PlatformPei/PlatformPei.inf
-@@ -98,6 +98,7 @@ [Pcd]
+@@ -99,6 +99,7 @@ [Pcd]
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved
@@ -184,7 +184,7 @@ index 00372fa0ebb5..2dfa357c384a 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
    gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
 diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
-index f006755d5fdb..b8f56902512c 100644
+index b1f8140d6041..e5132d95a8f8 100644
 --- a/OvmfPkg/PlatformPei/Platform.c
 +++ b/OvmfPkg/PlatformPei/Platform.c
 @@ -41,6 +41,18 @@
@@ -206,7 +206,7 @@ index f006755d5fdb..b8f56902512c 100644
  EFI_HOB_PLATFORM_INFO  mPlatformInfoHob = { 0 };
  
  EFI_PEI_PPI_DESCRIPTOR  mPpiBootMode[] = {
-@@ -387,6 +399,7 @@ InitializePlatform (
+@@ -376,6 +388,7 @@ InitializePlatform (
      MemTypeInfoInitialization ();
      MemMapInitialization (&mPlatformInfoHob);
      NoexecDxeInitialization ();
@@ -215,5 +215,5 @@ index f006755d5fdb..b8f56902512c 100644
  
    InstallClearCacheCallback ();
 -- 
-2.36.1
+2.38.1
 

0006-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch

@@ -1,7 +1,7 @@
-From b991e60356f0b990792a8951f8856d6544a9cd9b Mon Sep 17 00:00:00 2001
+From 643aed66df8d427f8912f74326140b74915e73f9 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Sun, 26 Jul 2015 08:02:50 +0000
-Subject: [PATCH 07/21] ArmVirtPkg: take PcdResizeXterm from the QEMU command
+Subject: [PATCH 06/17] ArmVirtPkg: take PcdResizeXterm from the QEMU command
  line (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -96,11 +96,11 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index aa0ce61630f7..7705bf391976 100644
+index f77443229e8e..ed66f0003082 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -284,6 +284,8 @@ [PcdsDynamicDefault.common]
-   gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0
+@@ -299,6 +299,8 @@ [PcdsPatchableInModule]
+   gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0x0
  !endif
  
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
@@ -108,7 +108,7 @@ index aa0ce61630f7..7705bf391976 100644
  [PcdsDynamicHii]
    gArmVirtTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gArmVirtVariableGuid|0x0|FALSE|NV,BS
  
-@@ -386,7 +388,10 @@ [Components.common]
+@@ -413,7 +415,10 @@ [Components.common]
    MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
    MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitterDxe.inf
    MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
@@ -200,5 +200,5 @@ index 000000000000..bfd3a6a535f9
 +  return RETURN_SUCCESS;
 +}
 -- 
-2.35.3
+2.38.1
 

0007-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 9fcfbf51e0a342172f316ae709311b4a6365b673 Mon Sep 17 00:00:00 2001
+From f934be726d47dea28664f46ea2e989b5a043cb5c Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:45 +0100
-Subject: [PATCH 12/21] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
+Subject: [PATCH 07/17] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -65,10 +65,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index ae23094ffc27..ccc46c974b16 100644
+index 41ad97b47dc9..53a8938965ea 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -476,7 +476,7 @@ [PcdsFixedAtBuild]
+@@ -427,7 +427,7 @@ [PcdsFixedAtBuild]
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -78,10 +78,10 @@ index ae23094ffc27..ccc46c974b16 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b69e3c05a281..bbe4e91037c2 100644
+index e8a074153a77..7bced89f2a6b 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -525,7 +525,7 @@ [PcdsFixedAtBuild]
+@@ -541,7 +541,7 @@ [PcdsFixedAtBuild]
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -91,10 +91,10 @@ index b69e3c05a281..bbe4e91037c2 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 726011ec42a5..072f06c0a3ab 100644
+index 0197997793a9..2599facbb7cd 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -531,7 +531,7 @@ [PcdsFixedAtBuild]
+@@ -547,7 +547,7 @@ [PcdsFixedAtBuild]
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -104,10 +104,10 @@ index 726011ec42a5..072f06c0a3ab 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index ab2e31ea8f2b..46661408f97b 100644
+index fade13b4e80c..7bd445ca36f7 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -548,7 +548,7 @@ [PcdsFixedAtBuild]
+@@ -567,7 +567,7 @@ [PcdsFixedAtBuild]
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -117,5 +117,5 @@ index ab2e31ea8f2b..46661408f97b 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 -- 
-2.35.3
+2.38.1
 

0008-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch

@@ -1,172 +0,0 @@
-From 6c0b7391222b4d33dbcee952b0f785701031e972 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Tue, 4 Nov 2014 23:02:53 +0100
-Subject: [PATCH 08/21] OvmfPkg: allow exclusion of the shell from the firmware
- image (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- No manual / explicit code change is necessary, because the newly
-  inherited OvmfPkg/AmdSev platform already has its own BUILD_SHELL
-  build-time macro (feature test flag), with default value FALSE -- from
-  upstream commit b261a30c900a ("OvmfPkg/AmdSev: add Grub Firmware Volume
-  Package", 2020-12-14).
-
-- Contextual differences from new upstream commits 2d8ca4f90eae ("OvmfPkg:
-  enable HttpDynamicCommand", 2020-10-01) and 5ab6a0e1c8e9 ("OvmfPkg:
-  introduce VirtioFsDxe", 2020-12-21) have been auto-resolved by
-  git-cherry-pick.
-
-- Remove obsolete commit message tags related to downstream patch
-  management: Message-id, Patchwork-id, O-Subject, Acked-by
-  (RHBZ#1846481).
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- context difference from upstream commit ec41733cfd10 ("OvmfPkg: add the
-  'initrd' dynamic shell command", 2020-03-04) correctly auto-resolved
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no change
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- update the patch against the following upstream commits:
-  - 4b888334d234 ("OvmfPkg: Remove EdkShellBinPkg in FDF", 2018-11-19)
-  - 277a3958d93a ("OvmfPkg: Don't include TftpDynamicCommand in XCODE5
-                  tool chain", 2018-11-27)
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
-  a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no change
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- no changes
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- no changes
-
-Bugzilla: 1147592
-
-When '-D EXCLUDE_SHELL_FROM_FD' is passed to 'build', exclude the shell
-binary from the firmware image.
-
-Peter Jones advised us that firmware vendors for physical systems disable
-the memory-mapped, firmware image-contained UEFI shell in
-SecureBoot-enabled builds. The reason being that the memory-mapped shell
-can always load, it may have direct access to various hardware in the
-system, and it can run UEFI shell scripts (which cannot be signed at all).
-
-Intended use of the new build option:
-
-- In-tree builds: don't pass '-D EXCLUDE_SHELL_FROM_FD'. The resultant
-  firmware image will contain a shell binary, independently of SecureBoot
-  enablement, which is flexible for interactive development. (Ie. no
-  change for in-tree builds.)
-
-- RPM builds: pass both '-D SECURE_BOOT_ENABLE' and
-  '-D EXCLUDE_SHELL_FROM_FD'. The resultant RPM will provide:
-
-  - OVMF_CODE.fd: SecureBoot-enabled firmware, without builtin UEFI shell,
-
-  - OVMF_VARS.fd: variable store template matching OVMF_CODE.fd,
-
-  - UefiShell.iso: a bootable ISO image with the shell on it as default
-    boot loader. The shell binary will load when SecureBoot is turned off,
-    and won't load when SecureBoot is turned on (because it is not
-    signed).
-
-    UefiShell.iso is the reason we're not excluding the shell from the DSC
-    files as well, only the FDF files -- when '-D EXCLUDE_SHELL_FROM_FD'
-    is specified, the shell binary needs to be built the same, only it
-    will be included in UefiShell.iso.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit 9c391def70366cabae08e6008814299c3372fafd)
-(cherry picked from commit d9dd9ee42937b2611fe37183cc9ec7f62d946933)
-(cherry picked from commit 23df46ebbe7b09451d3a05034acd4d3a25e7177b)
-(cherry picked from commit f0303f71d576c51b01c4ff961b429d0e0e707245)
-(cherry picked from commit bbd64eb8658e9a33eab4227d9f4e51ad78d9f687)
-(cherry picked from commit 8628ef1b8d675ebec39d83834abbe3c8c8c42cf4)
-(cherry picked from commit 229c88dc3ded9baeaca8b87767dc5c41c05afd6e)
-(cherry picked from commit c2812d7189dee06c780f05a5880eb421c359a687)
----
- OvmfPkg/OvmfPkgIa32.fdf    | 2 ++
- OvmfPkg/OvmfPkgIa32X64.fdf | 2 ++
- OvmfPkg/OvmfPkgX64.fdf     | 2 ++
- 3 files changed, 6 insertions(+)
-
-diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 57d13b7130bc..69044874e2f7 100644
---- a/OvmfPkg/OvmfPkgIa32.fdf
-+++ b/OvmfPkg/OvmfPkgIa32.fdf
-@@ -298,12 +298,14 @@ [FV.DXEFV]
- INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
- INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
- 
-+!ifndef $(EXCLUDE_SHELL_FROM_FD)
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
- INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
- INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
- INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
- !endif
- INF  ShellPkg/Application/Shell/Shell.inf
-+!endif
- 
- INF MdeModulePkg/Logo/LogoDxe.inf
- 
-diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index ccde366887a9..bf535bef4200 100644
---- a/OvmfPkg/OvmfPkgIa32X64.fdf
-+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
-@@ -299,12 +299,14 @@ [FV.DXEFV]
- INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
- INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
- 
-+!ifndef $(EXCLUDE_SHELL_FROM_FD)
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
- INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
- INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
- INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
- !endif
- INF  ShellPkg/Application/Shell/Shell.inf
-+!endif
- 
- INF MdeModulePkg/Logo/LogoDxe.inf
- 
-diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 438806fba8f1..21e4ce00dde6 100644
---- a/OvmfPkg/OvmfPkgX64.fdf
-+++ b/OvmfPkg/OvmfPkgX64.fdf
-@@ -324,12 +324,14 @@ [FV.DXEFV]
- INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
- INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
- 
-+!ifndef $(EXCLUDE_SHELL_FROM_FD)
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
- INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
- INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
- INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
- !endif
- INF  ShellPkg/Application/Shell/Shell.inf
-+!endif
- 
- INF MdeModulePkg/Logo/LogoDxe.inf
- 
--- 
-2.35.3
-

0008-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch

@@ -1,7 +1,7 @@
-From f577d3719babf7d2cf3bd8f4a404007236e19125 Mon Sep 17 00:00:00 2001
+From 75e3104437472cd3a83b9be7613b935daeacfd45 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:46 +0100
-Subject: [PATCH 13/21] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
+Subject: [PATCH 08/17] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
  QemuVideoDxe/QemuRamfbDxe (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -82,10 +82,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 32 insertions(+), 8 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index ccc46c974b16..c66ad3af1a23 100644
+index 53a8938965ea..f5133a801f8f 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -726,8 +726,14 @@ [Components]
+@@ -677,8 +677,14 @@ [Components]
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
@@ -103,10 +103,10 @@ index ccc46c974b16..c66ad3af1a23 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index bbe4e91037c2..b37a5a6da948 100644
+index 7bced89f2a6b..1d271a3bdcab 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -830,9 +830,15 @@ [Components]
+@@ -846,9 +846,15 @@ [Components]
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
  !ifndef $(CSM_ENABLE)
@@ -125,10 +125,10 @@ index bbe4e91037c2..b37a5a6da948 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 072f06c0a3ab..b0e8c20e93d7 100644
+index 2599facbb7cd..240bc43d14c6 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -844,9 +844,15 @@ [Components.X64]
+@@ -860,9 +860,15 @@ [Components.X64]
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
  !ifndef $(CSM_ENABLE)
@@ -147,10 +147,10 @@ index 072f06c0a3ab..b0e8c20e93d7 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 46661408f97b..6211d5e934de 100644
+index 7bd445ca36f7..7c6faba9509b 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -909,9 +909,15 @@ [Components]
+@@ -928,9 +928,15 @@ [Components]
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
  !ifndef $(CSM_ENABLE)
@@ -169,5 +169,5 @@ index 46661408f97b..6211d5e934de 100644
  
    #
 -- 
-2.35.3
+2.38.1
 

0009-ArmPlatformPkg-introduce-fixed-PCD-for-early-hello-m.patch

@@ -1,94 +0,0 @@
-From a432c70d28e61a51047616cedc75ca54257d1558 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Wed, 14 Oct 2015 13:49:43 +0200
-Subject: [PATCH 09/21] ArmPlatformPkg: introduce fixed PCD for early hello
- message (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- no change
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no change
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- no change
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
-  a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no changes
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- no changes
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- no changes
-
-Drew has proposed that ARM|AARCH64 platform firmware (especially virtual
-machine firmware) print a reasonably early, simple hello message to the
-serial port, regardless of debug mask settings. This should inform
-interactive users, and provide some rough help in localizing boot
-problems, even with restrictive debug masks.
-
-If a platform doesn't want this feature, it should stick with the default
-empty string.
-
-RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1270279
-Downstream only:
-<http://thread.gmane.org/gmane.comp.bios.edk2.devel/2996/focus=3433>.
-
-Suggested-by: Drew Jones <drjones@redhat.com>
-Contributed-under: TianoCore Contribution Agreement 1.0
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit 7ce97b06421434c82095f01a1753a8c9c546cc30)
-(cherry picked from commit 20b1f1cbd0590aa71c6d99d35e23cf08e0707750)
-(cherry picked from commit 6734b88cf7abcaf42632e3d2fc469b2169dd2f16)
-(cherry picked from commit ef77da632559e9baa1c69869e4cbea377068ef27)
-(cherry picked from commit 58755c51d3252312d80cbcb97928d71199c2f5e1)
-(cherry picked from commit c3f07e323e76856f1b42ea7b8c598ba3201c28a2)
-(cherry picked from commit 9f756c1ad83cc81f7d892cd036d59a2b567b02dc)
-(cherry picked from commit c75aea7a738ac7fb944c0695a4bfffc3985afaa9)
----
- ArmPlatformPkg/ArmPlatformPkg.dec | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/ArmPlatformPkg/ArmPlatformPkg.dec b/ArmPlatformPkg/ArmPlatformPkg.dec
-index 3a25ddcdc8ca..b2b58553c7a6 100644
---- a/ArmPlatformPkg/ArmPlatformPkg.dec
-+++ b/ArmPlatformPkg/ArmPlatformPkg.dec
-@@ -121,6 +121,13 @@ [PcdsFixedAtBuild.common]
-   ## If set, this will swap settings for HDLCD RED_SELECT and BLUE_SELECT registers
-   gArmPlatformTokenSpaceGuid.PcdArmHdLcdSwapBlueRedSelect|FALSE|BOOLEAN|0x00000045
- 
-+  #
-+  # Early hello message (ASCII string), printed to the serial port.
-+  # If set to the empty string, nothing is printed.
-+  # Otherwise, a trailing CRLF should be specified explicitly.
-+  #
-+  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage|""|VOID*|0x00000100
-+
- [PcdsFixedAtBuild.common,PcdsDynamic.common]
-   ## PL031 RealTimeClock
-   gArmPlatformTokenSpaceGuid.PcdPL031RtcBase|0x0|UINT32|0x00000024
--- 
-2.35.3
-

0009-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch

@@ -1,7 +1,7 @@
-From 4460b520c24a003b977dded58a0f62bf70a83c69 Mon Sep 17 00:00:00 2001
+From aede9477834cf0495425750cbf3ce2cefa208828 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 27 Jan 2016 03:05:18 +0100
-Subject: [PATCH 14/21] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
+Subject: [PATCH 09/17] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
  QemuRamfbDxe (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -61,10 +61,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  2 files changed, 8 insertions(+), 2 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index ae35cc18008d..f30c1e622c30 100644
+index ed66f0003082..a3d744931a15 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -511,7 +511,10 @@ [Components.common]
+@@ -537,7 +537,10 @@ [Components.common]
    #
    # Video support
    #
@@ -77,7 +77,7 @@ index ae35cc18008d..f30c1e622c30 100644
    OvmfPkg/PlatformDxe/Platform.inf
  
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 7f7d15d6eee3..14f7b29991bc 100644
+index f5db3ac432f3..ff3e6c5974b6 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
 @@ -440,7 +440,10 @@ [Components.common]
@@ -93,5 +93,5 @@ index 7f7d15d6eee3..14f7b29991bc 100644
    OvmfPkg/PlatformDxe/Platform.inf
  
 -- 
-2.35.3
+2.38.1
 

0010-ArmPlatformPkg-PrePeiCore-write-early-hello-message-.patch

@@ -1,145 +0,0 @@
-From 1492c375e52d3cc6d8c39fc4853f10ceeca2948c Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Wed, 14 Oct 2015 13:59:20 +0200
-Subject: [PATCH 10/21] ArmPlatformPkg: PrePeiCore: write early hello message
- to the serial port (RH)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- no change
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no change
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- no change
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
-  a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- adapt to upstream commit 7e2a8dfe8a9a ("ArmPlatformPkg/PrePeiCore: seed
-  temporary stack before entering PEI core", 2017-11-09) -- conflict
-  resolution in "ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf"
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- no changes
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- no changes
-
-The FixedPcdGetSize() macro expands to an integer constant, therefore an
-optimizing compiler can eliminate the new code, if the platform DSC
-doesn't override the empty string (size=1) default of
-PcdEarlyHelloMessage.
-
-RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1270279
-Downstream only:
-<http://thread.gmane.org/gmane.comp.bios.edk2.devel/2996/focus=3433>.
-
-Contributed-under: TianoCore Contribution Agreement 1.0
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit b16c4c505ce0e27305235533eac9236aa66f132e)
-(cherry picked from commit 742e5bf6d5ce5a1e73879d6e5c0dd00feda7a9ac)
-(cherry picked from commit 93d69eb9393cf05af90676253875c59c1bec67fd)
-(cherry picked from commit 638594083b191f84f5d9333eb6147a31570f5a5a)
-(cherry picked from commit f4b7aae411d88b2b83f85d20ef06a4032a57e7de)
-(cherry picked from commit bb71490fdda3b38fa9f071d281b863f9b64363bf)
-(cherry picked from commit 8d5a8827aabc67cb2a046697e1a750ca8d9cc453)
-(cherry picked from commit 49fe5596cd79c94d903c4d506c563d642ccd69aa)
----
- ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf  | 2 ++
- ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf | 2 ++
- ArmPlatformPkg/PrePeiCore/PrePeiCore.h          | 1 +
- ArmPlatformPkg/PrePeiCore/MainMPCore.c          | 5 +++++
- ArmPlatformPkg/PrePeiCore/MainUniCore.c         | 5 +++++
- 5 files changed, 15 insertions(+)
-
-diff --git a/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf b/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf
-index a5b4722459d1..ea7b220bc831 100644
---- a/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf
-+++ b/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf
-@@ -66,6 +66,8 @@ [FixedPcd]
-   gArmPlatformTokenSpaceGuid.PcdCPUCorePrimaryStackSize
-   gArmPlatformTokenSpaceGuid.PcdCPUCoreSecondaryStackSize
- 
-+  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage
-+
-   gArmTokenSpaceGuid.PcdGicDistributorBase
-   gArmTokenSpaceGuid.PcdGicInterruptInterfaceBase
-   gArmTokenSpaceGuid.PcdGicSgiIntId
-diff --git a/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf b/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
-index 466a2b01c384..29fb8737cb2f 100644
---- a/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
-+++ b/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
-@@ -64,4 +64,6 @@ [FixedPcd]
-   gArmPlatformTokenSpaceGuid.PcdCPUCorePrimaryStackSize
-   gArmPlatformTokenSpaceGuid.PcdCPUCoreSecondaryStackSize
- 
-+  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage
-+
-   gEfiMdeModulePkgTokenSpaceGuid.PcdInitValueInTempStack
-diff --git a/ArmPlatformPkg/PrePeiCore/PrePeiCore.h b/ArmPlatformPkg/PrePeiCore/PrePeiCore.h
-index 0345dd7bdd2a..ae8302becda2 100644
---- a/ArmPlatformPkg/PrePeiCore/PrePeiCore.h
-+++ b/ArmPlatformPkg/PrePeiCore/PrePeiCore.h
-@@ -16,6 +16,7 @@
- #include <Library/DebugLib.h>
- #include <Library/IoLib.h>
- #include <Library/PcdLib.h>
-+#include <Library/SerialPortLib.h>
- 
- #include <PiPei.h>
- #include <Ppi/TemporaryRamSupport.h>
-diff --git a/ArmPlatformPkg/PrePeiCore/MainMPCore.c b/ArmPlatformPkg/PrePeiCore/MainMPCore.c
-index b5d0d3a6442f..5126a6dfb0b1 100644
---- a/ArmPlatformPkg/PrePeiCore/MainMPCore.c
-+++ b/ArmPlatformPkg/PrePeiCore/MainMPCore.c
-@@ -116,6 +116,11 @@ PrimaryMain (
-   UINTN                   TemporaryRamBase;
-   UINTN                   TemporaryRamSize;
- 
-+  if (FixedPcdGetSize (PcdEarlyHelloMessage) > 1) {
-+    SerialPortWrite (FixedPcdGetPtr (PcdEarlyHelloMessage),
-+      FixedPcdGetSize (PcdEarlyHelloMessage) - 1);
-+  }
-+
-   CreatePpiList (&PpiListSize, &PpiList);
- 
-   // Enable the GIC Distributor
-diff --git a/ArmPlatformPkg/PrePeiCore/MainUniCore.c b/ArmPlatformPkg/PrePeiCore/MainUniCore.c
-index 1c2580eb923b..2a7580dbb405 100644
---- a/ArmPlatformPkg/PrePeiCore/MainUniCore.c
-+++ b/ArmPlatformPkg/PrePeiCore/MainUniCore.c
-@@ -29,6 +29,11 @@ PrimaryMain (
-   UINTN                   TemporaryRamBase;
-   UINTN                   TemporaryRamSize;
- 
-+  if (FixedPcdGetSize (PcdEarlyHelloMessage) > 1) {
-+    SerialPortWrite (FixedPcdGetPtr (PcdEarlyHelloMessage),
-+      FixedPcdGetSize (PcdEarlyHelloMessage) - 1);
-+  }
-+
-   CreatePpiList (&PpiListSize, &PpiList);
- 
-   // Adjust the Temporary Ram as the new Ppi List (Common + Platform Ppi Lists) is created at
--- 
-2.35.3
-

0010-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch

@@ -1,7 +1,7 @@
-From d64349e98dac4add2813971c7e9f44d837d87880 Mon Sep 17 00:00:00 2001
+From a8048db38e11d9b4cbcde3addf907455833be332 Mon Sep 17 00:00:00 2001
 From: Philippe Mathieu-Daude <philmd@redhat.com>
 Date: Thu, 1 Aug 2019 20:43:48 +0200
-Subject: [PATCH 15/21] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on
+Subject: [PATCH 10/17] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on
  Aarch64 silent builds (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -92,5 +92,5 @@ index f5113fbc78a6..0295986fe0f1 100644
    }
  
 -- 
-2.35.3
+2.38.1
 

0011-ArmVirtPkg-set-early-hello-message-RH-only.patch

@@ -1,82 +0,0 @@
-From 01ac59a696ed46ab1444bc5e15de791c0d90bad5 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Wed, 14 Oct 2015 14:07:17 +0200
-Subject: [PATCH 11/21] ArmVirtPkg: set early hello message (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- context difference from upstream commit f5cb3767038e
-  ("ArmVirtPkg/ArmVirtQemu: add ResetSystem PEIM for upcoming TPM2
-  support", 2020-03-04) automatically resolved correctly
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no change
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- resolve context conflict with upstream commit eaa1e98ae31d ("ArmVirtPkg:
-  don't set PcdCoreCount", 2019-02-13)
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
-  a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no changes
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- no changes
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- no changes
-
-Print a friendly banner on QEMU, regardless of debug mask settings.
-
-RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1270279
-Downstream only:
-<http://thread.gmane.org/gmane.comp.bios.edk2.devel/2996/focus=3433>.
-
-Contributed-under: TianoCore Contribution Agreement 1.0
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit 5d4a15b9019728b2d96322bc679099da49916925)
-(cherry picked from commit 179df76dbb0d199bd905236e98775b4059c6502a)
-(cherry picked from commit ce3f59d0710c24c162d5222bbf5cd7e36180c80c)
-(cherry picked from commit c201a8e6ae28d75f7ba581828b533c3b26fa7f18)
-(cherry picked from commit 2d4db6ec70e004cd9ac147615d17033bee5d3b18)
-(cherry picked from commit fb2032bbea7e02c426855cf86a323556d493fd8a)
-(cherry picked from commit ba73b99d5cb38f87c1a8f0936d515eaaefa3f04b)
-(cherry picked from commit 72550e12ae469012a505bf5b98a6543a754028d3)
----
- ArmVirtPkg/ArmVirtQemu.dsc | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 7705bf391976..ae35cc18008d 100644
---- a/ArmVirtPkg/ArmVirtQemu.dsc
-+++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -134,6 +134,7 @@ [PcdsFeatureFlag.common]
-   gArmVirtTokenSpaceGuid.PcdTpm2SupportEnabled|$(TPM2_ENABLE)
- 
- [PcdsFixedAtBuild.common]
-+  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage|"UEFI firmware starting.\r\n"
- !if $(ARCH) == AARCH64
-   gArmTokenSpaceGuid.PcdVFPEnabled|1
- !endif
--- 
-2.35.3
-

0011-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch

@@ -1,7 +1,7 @@
-From 19a991fbfc8dd21a9ccff051da77c8651ee7aa14 Mon Sep 17 00:00:00 2001
+From 7a001a5ba349a3b425f6da1df561a5a1a272a0ca Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:47 +0100
-Subject: [PATCH 16/21] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in
+Subject: [PATCH 11/17] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in
  NvmExpressDxe (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -63,10 +63,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 16 insertions(+), 4 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index c66ad3af1a23..7df6e5c825d7 100644
+index f5133a801f8f..05908a72270f 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -720,7 +720,10 @@ [Components]
+@@ -671,7 +671,10 @@ [Components]
    OvmfPkg/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@@ -79,10 +79,10 @@ index c66ad3af1a23..7df6e5c825d7 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b37a5a6da948..ed6a820d2e1d 100644
+index 1d271a3bdcab..9c0fb7d545b8 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -823,7 +823,10 @@ [Components]
+@@ -839,7 +839,10 @@ [Components]
    OvmfPkg/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@@ -95,10 +95,10 @@ index b37a5a6da948..ed6a820d2e1d 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index b0e8c20e93d7..b5be86cff32c 100644
+index 240bc43d14c6..8b93437044e7 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -837,7 +837,10 @@ [Components.X64]
+@@ -853,7 +853,10 @@ [Components.X64]
    OvmfPkg/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@@ -111,10 +111,10 @@ index b0e8c20e93d7..b5be86cff32c 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 6211d5e934de..29b45e68e387 100644
+index 7c6faba9509b..8c9162db1743 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -902,7 +902,10 @@ [Components]
+@@ -921,7 +921,10 @@ [Components]
    OvmfPkg/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@@ -127,5 +127,5 @@ index 6211d5e934de..29b45e68e387 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 -- 
-2.35.3
+2.38.1
 

0012-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch

@@ -1,7 +1,7 @@
-From 85896a30011c3db49aa377c80e0ea81b7d8005f9 Mon Sep 17 00:00:00 2001
+From 72c050576a41a14915f02a2c243cd41b22ad2384 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Sat, 16 Nov 2019 17:11:27 +0100
-Subject: [PATCH 17/21] CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files
+Subject: [PATCH 12/17] CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files
  in the INFs (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -131,10 +131,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  2 files changed, 22 insertions(+)
 
 diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
-index c899b811b149..4a89dc82b65e 100644
+index 60c6c24b0a67..e446b51e66cd 100644
 --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
 +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
-@@ -620,6 +620,17 @@ [Sources]
+@@ -575,6 +575,17 @@ [Sources]
    $(OPENSSL_PATH)/ssl/statem/statem.h
    $(OPENSSL_PATH)/ssl/statem/statem_local.h
  # Autogenerated files list ends here
@@ -153,10 +153,10 @@ index c899b811b149..4a89dc82b65e 100644
    ossl_store.c
    rand_pool.c
 diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-index 0ec372454119..f1cc0aaf9fda 100644
+index c4eaea888c1a..c207dc8f4cfd 100644
 --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
 +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-@@ -569,6 +569,17 @@ [Sources]
+@@ -525,6 +525,17 @@ [Sources]
    $(OPENSSL_PATH)/crypto/x509v3/standard_exts.h
    $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
  # Autogenerated files list ends here
@@ -175,5 +175,5 @@ index 0ec372454119..f1cc0aaf9fda 100644
    ossl_store.c
    rand_pool.c
 -- 
-2.35.3
+2.38.1
 

0013-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch

@@ -1,7 +1,7 @@
-From 98e14a58d727bb2d863a7a8c3a257f3b02b15b80 Mon Sep 17 00:00:00 2001
+From 2998ee646f22dc7acddcad7725c1b8d2de5b0130 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:31:36 +0200
-Subject: [PATCH 18/21] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no
+Subject: [PATCH 13/17] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no
  "-kernel" in silent aa64 build (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -80,5 +80,5 @@ index d4f3cd92255f..f007f8a6c233 100644
    }
  
 -- 
-2.35.3
+2.38.1
 

0014-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch

@@ -1,7 +1,7 @@
-From ee4dd84fe0d33568b1800f5d6840627103c46d8d Mon Sep 17 00:00:00 2001
+From 55492cd43586befec40b2ff13ea202db0427eb28 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:40:09 +0200
-Subject: [PATCH 19/21] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in
+Subject: [PATCH 14/17] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in
  silent aa64 build (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -78,5 +78,5 @@ index f6ea8b2bbf18..681eb7e08b98 100644
    }
  
 -- 
-2.35.3
+2.38.1
 

0015-Tweak-the-tools_def-to-support-cross-compiling.patch

@@ -1,7 +1,7 @@
-From 6b2ca6f01bb76a3b9632e902b4bf0ef9e912ce40 Mon Sep 17 00:00:00 2001
+From b1019e386b52d7d221a5349ec9c26145d9a45497 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Thu, 16 Aug 2018 15:45:47 -0400
-Subject: [PATCH 21/21] Tweak the tools_def to support cross-compiling.
+Subject: [PATCH 15/17] Tweak the tools_def to support cross-compiling.
 
 These files are meant for customization, so this is not upstream.
 
@@ -12,10 +12,10 @@ Signed-off-by: Cole Robinson <crobinso@redhat.com>
  1 file changed, 22 insertions(+), 22 deletions(-)
 
 diff --git a/BaseTools/Conf/tools_def.template b/BaseTools/Conf/tools_def.template
-index 5ed19810b727..5901d9eecb5d 100755
+index c4e4c7ded0af..f19c59039921 100755
 --- a/BaseTools/Conf/tools_def.template
 +++ b/BaseTools/Conf/tools_def.template
-@@ -2280,17 +2280,17 @@ RELEASE_GCC49_AARCH64_DLINK_XIPFLAGS = -z common-page-size=0x20
+@@ -2294,17 +2294,17 @@ RELEASE_GCC49_AARCH64_DLINK_XIPFLAGS = -z common-page-size=0x20
  ##################
  # GCC5 IA32 definitions
  ##################
@@ -44,7 +44,7 @@ index 5ed19810b727..5901d9eecb5d 100755
  
  *_GCC5_IA32_ASLCC_FLAGS          = DEF(GCC5_ASLCC_FLAGS) -m32
  *_GCC5_IA32_ASLDLINK_FLAGS       = DEF(GCC5_IA32_X64_ASLDLINK_FLAGS) -Wl,-m,elf_i386 -no-pie
-@@ -2312,17 +2312,17 @@ RELEASE_GCC5_IA32_DLINK_FLAGS    = DEF(GCC5_IA32_X64_DLINK_FLAGS) -flto -Os -Wl,
+@@ -2326,17 +2326,17 @@ RELEASE_GCC5_IA32_DLINK_FLAGS    = DEF(GCC5_IA32_X64_DLINK_FLAGS) -flto -Os -Wl,
  ##################
  # GCC5 X64 definitions
  ##################
@@ -74,5 +74,5 @@ index 5ed19810b727..5901d9eecb5d 100755
  *_GCC5_X64_ASLCC_FLAGS           = DEF(GCC5_ASLCC_FLAGS) -m64
  *_GCC5_X64_ASLDLINK_FLAGS        = DEF(GCC5_IA32_X64_ASLDLINK_FLAGS) -Wl,-m,elf_x86_64
 -- 
-2.35.3
+2.38.1
 

0016-tools_def-add-fno-omit-frame-pointer-to-GCC48_-IA32-.patch

@@ -1,7 +1,7 @@
-From 46c6d0e6a1d971edef5846e352a81a097f8d51d5 Mon Sep 17 00:00:00 2001
+From a655395cd7ed48eb70f33eaeb2637d531503fc8f Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Fri, 10 Jun 2022 07:43:15 +0200
-Subject: [PATCH 21/21] tools_def: add -fno-omit-frame-pointer to
+Subject: [PATCH 16/17] tools_def: add -fno-omit-frame-pointer to
  GCC48_{IA32,X64}_CC_FLAGS
 
 Fixes problems due to code assuming it runs with frame pointers and thus
@@ -13,10 +13,10 @@ Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/BaseTools/Conf/tools_def.template b/BaseTools/Conf/tools_def.template
-index 5901d9eecb5d..e3aa88fec31f 100755
+index f19c59039921..2e20e9b84428 100755
 --- a/BaseTools/Conf/tools_def.template
 +++ b/BaseTools/Conf/tools_def.template
-@@ -1884,8 +1884,8 @@ DEFINE GCC_DEPS_FLAGS              = -MMD -MF $@.deps
+@@ -1890,8 +1890,8 @@ DEFINE GCC_DEPS_FLAGS              = -MMD -MF $@.deps
  
  DEFINE GCC48_ALL_CC_FLAGS            = DEF(GCC_ALL_CC_FLAGS) -ffunction-sections -fdata-sections -DSTRING_ARRAY_NAME=$(BASE_NAME)Strings
  DEFINE GCC48_IA32_X64_DLINK_COMMON   = -nostdlib -Wl,-n,-q,--gc-sections -z common-page-size=0x20
@@ -28,5 +28,5 @@ index 5901d9eecb5d..e3aa88fec31f 100755
  DEFINE GCC48_IA32_X64_DLINK_FLAGS    = DEF(GCC48_IA32_X64_DLINK_COMMON) -Wl,--entry,$(IMAGE_ENTRY_POINT) -u $(IMAGE_ENTRY_POINT) -Wl,-Map,$(DEST_DIR_DEBUG)/$(BASE_NAME).map,--whole-archive
  DEFINE GCC48_IA32_DLINK2_FLAGS       = -Wl,--defsym=PECOFF_HEADER_SIZE=0x220 DEF(GCC_DLINK2_FLAGS_COMMON)
 -- 
-2.36.1
+2.38.1
 

0017-Revert-ArmVirtPkg-make-EFI_LOADER_DATA-non-executabl.patch

@@ -0,0 +1,29 @@
+From 79d7efa44192acd8b7c2a693bd8bf6e1e964f708 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 28 Nov 2022 14:30:57 +0100
+Subject: [PATCH 17/18] Revert "ArmVirtPkg: make EFI_LOADER_DATA
+ non-executable"
+
+This reverts commit 2997ae38739756ecba9b0de19e86032ebc689ef9.
+
+Fedora grub is apparently still broken ...
+---
+ ArmVirtPkg/ArmVirt.dsc.inc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
+index 462073517a22..34575585adbb 100644
+--- a/ArmVirtPkg/ArmVirt.dsc.inc
++++ b/ArmVirtPkg/ArmVirt.dsc.inc
+@@ -368,7 +368,7 @@ [PcdsFixedAtBuild.common]
+   # reserved ones, with the exception of LoaderData regions, of which OS loaders
+   # (i.e., GRUB) may assume that its contents are executable.
+   #
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD5
++  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1
+ 
+ [Components.common]
+   #
+-- 
+2.38.1
+

0018-Revert-OvmfPkg-PlatformDxe-Handle-all-requests-in-Ex.patch

@@ -0,0 +1,211 @@
+From e151560ee60af405429ca7dd7d0a914aa20213a3 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 12 Dec 2022 10:05:27 +0100
+Subject: [PATCH 18/20] Revert "OvmfPkg/PlatformDxe: Handle all requests in
+ ExtractConfig and RouteConfig"
+
+This reverts commit aefcc91805fd69e4aad4bc08a9f708db11cae5f0.
+---
+ OvmfPkg/PlatformDxe/PlatformConfig.h |   2 -
+ OvmfPkg/PlatformDxe/Platform.c       | 115 +--------------------------
+ OvmfPkg/PlatformDxe/PlatformConfig.c |   2 +-
+ 3 files changed, 3 insertions(+), 116 deletions(-)
+
+diff --git a/OvmfPkg/PlatformDxe/PlatformConfig.h b/OvmfPkg/PlatformDxe/PlatformConfig.h
+index 5d9b457b1b4b..902c9b2ce043 100644
+--- a/OvmfPkg/PlatformDxe/PlatformConfig.h
++++ b/OvmfPkg/PlatformDxe/PlatformConfig.h
+@@ -50,6 +50,4 @@ PlatformConfigLoad (
+ #define PLATFORM_CONFIG_F_GRAPHICS_RESOLUTION  BIT0
+ #define PLATFORM_CONFIG_F_DOWNGRADE            BIT63
+ 
+-extern CHAR16  mVariableName[];
+-
+ #endif // _PLATFORM_CONFIG_H_
+diff --git a/OvmfPkg/PlatformDxe/Platform.c b/OvmfPkg/PlatformDxe/Platform.c
+index ac31fafbdce3..4d432f18df37 100644
+--- a/OvmfPkg/PlatformDxe/Platform.c
++++ b/OvmfPkg/PlatformDxe/Platform.c
+@@ -108,11 +108,6 @@ STATIC EFI_EVENT  mGopEvent;
+ //
+ STATIC VOID  *mGopTracker;
+ 
+-//
+-// The driver image handle, used to obtain the device path for <ConfigHdr>.
+-//
+-STATIC EFI_HANDLE  mImageHandle;
+-
+ //
+ // Cache the resolutions we get from the GOP.
+ //
+@@ -234,10 +229,6 @@ ExtractConfig (
+ {
+   MAIN_FORM_STATE  MainFormState;
+   EFI_STATUS       Status;
+-  EFI_STRING       ConfigRequestHdr;
+-  EFI_STRING       ConfigRequest;
+-  UINTN            Size;
+-  BOOLEAN          AllocatedRequest;
+ 
+   DEBUG ((DEBUG_VERBOSE, "%a: Request=\"%s\"\n", __FUNCTION__, Request));
+ 
+@@ -245,73 +236,18 @@ ExtractConfig (
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+-  ConfigRequestHdr = NULL;
+-  ConfigRequest    = NULL;
+-  Size             = 0;
+-  AllocatedRequest = FALSE;
+-
+-  //
+-  // Check if <ConfigHdr> matches the GUID and name
+-  //
+-  *Progress = Request;
+-  if ((Request != NULL) &&
+-      !HiiIsConfigHdrMatch (
+-         Request,
+-         &gOvmfPlatformConfigGuid,
+-         mVariableName
+-         )
+-      )
+-  {
+-    return EFI_NOT_FOUND;
+-  }
+-
+   Status = PlatformConfigToFormState (&MainFormState);
+   if (EFI_ERROR (Status)) {
++    *Progress = Request;
+     return Status;
+   }
+ 
+-  if ((Request == NULL) || (StrStr (Request, L"OFFSET") == NULL)) {
+-    //
+-    // Request has no <RequestElement>, so construct full request string.
+-    // Allocate and fill a buffer large enough to hold <ConfigHdr>
+-    // followed by "&OFFSET=0&WIDTH=WWWWWWWWWWWWWWWW" followed by a
+-    // null terminator.
+-    //
+-    ConfigRequestHdr = HiiConstructConfigHdr (
+-                         &gOvmfPlatformConfigGuid,
+-                         mVariableName,
+-                         mImageHandle
+-                         );
+-    if (ConfigRequestHdr == NULL) {
+-      return EFI_OUT_OF_RESOURCES;
+-    }
+-
+-    Size             = (StrLen (ConfigRequestHdr) + 32 + 1) * sizeof (CHAR16);
+-    ConfigRequest    = AllocateZeroPool (Size);
+-    AllocatedRequest = TRUE;
+-    if (ConfigRequest == NULL) {
+-      FreePool (ConfigRequestHdr);
+-      return EFI_OUT_OF_RESOURCES;
+-    }
+-
+-    UnicodeSPrint (
+-      ConfigRequest,
+-      Size,
+-      L"%s&OFFSET=0&WIDTH=%016LX",
+-      ConfigRequestHdr,
+-      sizeof MainFormState
+-      );
+-    FreePool (ConfigRequestHdr);
+-  } else {
+-    ConfigRequest = Request;
+-  }
+-
+   //
+   // Answer the textual request keying off the binary form state.
+   //
+   Status = gHiiConfigRouting->BlockToConfig (
+                                 gHiiConfigRouting,
+-                                ConfigRequest,
++                                Request,
+                                 (VOID *)&MainFormState,
+                                 sizeof MainFormState,
+                                 Results,
+@@ -329,33 +265,6 @@ ExtractConfig (
+     DEBUG ((DEBUG_VERBOSE, "%a: Results=\"%s\"\n", __FUNCTION__, *Results));
+   }
+ 
+-  //
+-  // If we used a newly allocated ConfigRequest, update Progress to point to
+-  // original Request instead of ConfigRequest.
+-  //
+-  if (Request == NULL) {
+-    *Progress = NULL;
+-  } else if (StrStr (Request, L"OFFSET") == NULL) {
+-    if (EFI_ERROR (Status)) {
+-      //
+-      // Since we constructed ConfigRequest, failure can only occur if there
+-      // is not enough memory. In this case, we point Progress to the first
+-      // character of Request.
+-      //
+-      *Progress = Request;
+-    } else {
+-      //
+-      // In case of success, we point Progress to the null terminator of
+-      // Request.
+-      //
+-      *Progress = Request + StrLen (Request);
+-    }
+-  }
+-
+-  if (AllocatedRequest) {
+-    FreePool (ConfigRequest);
+-  }
+-
+   return Status;
+ }
+ 
+@@ -439,21 +348,6 @@ RouteConfig (
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+-  //
+-  // Check if <ConfigHdr> matches the GUID and name
+-  //
+-  *Progress = Configuration;
+-  if ((Configuration != NULL) &&
+-      !HiiIsConfigHdrMatch (
+-         Configuration,
+-         &gOvmfPlatformConfigGuid,
+-         mVariableName
+-         )
+-      )
+-  {
+-    return EFI_NOT_FOUND;
+-  }
+-
+   //
+   // the "read" step in RMW
+   //
+@@ -972,11 +866,6 @@ PlatformInit (
+     return Status;
+   }
+ 
+-  //
+-  // Save the driver image handle.
+-  //
+-  mImageHandle = ImageHandle;
+-
+   //
+   // Publish the HII package list to HII Database.
+   //
+diff --git a/OvmfPkg/PlatformDxe/PlatformConfig.c b/OvmfPkg/PlatformDxe/PlatformConfig.c
+index f5ac2d0609ff..e202ac5b4798 100644
+--- a/OvmfPkg/PlatformDxe/PlatformConfig.c
++++ b/OvmfPkg/PlatformDxe/PlatformConfig.c
+@@ -21,7 +21,7 @@
+ //
+ // Name of the UEFI variable that we use for persistent storage.
+ //
+-CHAR16  mVariableName[] = L"PlatformConfig";
++STATIC CHAR16  mVariableName[] = L"PlatformConfig";
+ 
+ /**
+   Serialize and persistently save platform configuration.
+-- 
+2.38.1
+

0019-OvmfPkg-SmbiosPlatformDxe-use-PcdFirmware.patch

@@ -0,0 +1,229 @@
+From 29842668ef9c1b3d553279954c18743acdb3036c Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 28 Nov 2022 13:40:20 +0800
+Subject: [PATCH 19/20] OvmfPkg/SmbiosPlatformDxe: use PcdFirmware*
+
+Instead of using hard-coded strings ("0.0.0" for BiosVersion etc)
+which is mostly useless read the PCDs (PcdFirmwareVendor,
+PcdFirmwareVersionString and PcdFirmwareReleaseDateString) and
+build the string table dynamuically at runtime.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+(cherry picked from commit 4cb94f20b002c99dd2b4b75f07c5495b81a34ffd)
+---
+ .../SmbiosPlatformDxe/SmbiosPlatformDxe.inf   |   6 +
+ .../XenSmbiosPlatformDxe.inf                  |   9 +-
+ OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.c | 115 +++++++++++-------
+ 3 files changed, 85 insertions(+), 45 deletions(-)
+
+diff --git a/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.inf b/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.inf
+index 0066bbc9229c..52689c96e5af 100644
+--- a/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.inf
++++ b/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.inf
+@@ -32,9 +32,12 @@ [Sources]
+ 
+ [Packages]
+   MdePkg/MdePkg.dec
++  MdeModulePkg/MdeModulePkg.dec
+   OvmfPkg/OvmfPkg.dec
+ 
+ [LibraryClasses]
++  BaseLib
++  BaseMemoryLib
+   DebugLib
+   MemoryAllocationLib
+   PcdLib
+@@ -45,6 +48,9 @@ [LibraryClasses]
+ [Pcd]
+   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId
+   gUefiOvmfPkgTokenSpaceGuid.PcdQemuSmbiosValidated
++  gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVendor
++  gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVersionString
++  gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareReleaseDateString
+ 
+ [Protocols]
+   gEfiSmbiosProtocolGuid                      # PROTOCOL ALWAYS_CONSUMED
+diff --git a/OvmfPkg/SmbiosPlatformDxe/XenSmbiosPlatformDxe.inf b/OvmfPkg/SmbiosPlatformDxe/XenSmbiosPlatformDxe.inf
+index 7f4588e33d1e..e646c88741b6 100644
+--- a/OvmfPkg/SmbiosPlatformDxe/XenSmbiosPlatformDxe.inf
++++ b/OvmfPkg/SmbiosPlatformDxe/XenSmbiosPlatformDxe.inf
+@@ -38,19 +38,26 @@ [Sources.ARM, Sources.AARCH64]
+ 
+ [Packages]
+   MdePkg/MdePkg.dec
++  MdeModulePkg/MdeModulePkg.dec
+ 
+ [Packages.IA32, Packages.X64]
+   OvmfPkg/OvmfPkg.dec
+ 
+ [LibraryClasses]
++  BaseLib
++  BaseMemoryLib
+   DebugLib
+   UefiBootServicesTableLib
+   UefiDriverEntryPoint
+ 
+ [LibraryClasses.IA32, LibraryClasses.X64]
+-  BaseLib
+   HobLib
+ 
++[Pcd]
++  gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVendor
++  gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVersionString
++  gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareReleaseDateString
++
+ [Protocols]
+   gEfiSmbiosProtocolGuid                      # PROTOCOL ALWAYS_CONSUMED
+ 
+diff --git a/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.c b/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.c
+index 94249d3ff1b0..dc1e6aed634f 100644
+--- a/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.c
++++ b/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.c
+@@ -9,57 +9,43 @@
+ **/
+ 
+ #include <IndustryStandard/SmBios.h>          // SMBIOS_TABLE_TYPE0
++#include <Library/BaseLib.h>
++#include <Library/BaseMemoryLib.h>
+ #include <Library/DebugLib.h>                 // ASSERT_EFI_ERROR()
++#include <Library/MemoryAllocationLib.h>
++#include <Library/PcdLib.h>
+ #include <Library/UefiBootServicesTableLib.h> // gBS
+ #include <Protocol/Smbios.h>                  // EFI_SMBIOS_PROTOCOL
+ 
+ #include "SmbiosPlatformDxe.h"
+ 
+-#define TYPE0_STRINGS \
+-  "EFI Development Kit II / OVMF\0"     /* Vendor */ \
+-  "0.0.0\0"                             /* BiosVersion */ \
+-  "02/06/2015\0"                        /* BiosReleaseDate */
+-//
+-// Type definition and contents of the default Type 0 SMBIOS table.
+-//
+-#pragma pack(1)
+-typedef struct {
+-  SMBIOS_TABLE_TYPE0    Base;
+-  UINT8                 Strings[sizeof (TYPE0_STRINGS)];
+-} OVMF_TYPE0;
+-#pragma pack()
+-
+-STATIC CONST OVMF_TYPE0  mOvmfDefaultType0 = {
++STATIC CONST SMBIOS_TABLE_TYPE0  mOvmfDefaultType0 = {
++  // SMBIOS_STRUCTURE Hdr
+   {
+-    // SMBIOS_STRUCTURE Hdr
+-    {
+-      EFI_SMBIOS_TYPE_BIOS_INFORMATION, // UINT8 Type
+-      sizeof (SMBIOS_TABLE_TYPE0),      // UINT8 Length
+-    },
+-    1,      // SMBIOS_TABLE_STRING       Vendor
+-    2,      // SMBIOS_TABLE_STRING       BiosVersion
+-    0xE800, // UINT16                    BiosSegment
+-    3,      // SMBIOS_TABLE_STRING       BiosReleaseDate
+-    0,      // UINT8                     BiosSize
+-    {      // MISC_BIOS_CHARACTERISTICS BiosCharacteristics
+-      0,   // Reserved                                      :2
+-      0,   // Unknown                                       :1
+-      1,   // BiosCharacteristicsNotSupported               :1
+-           // Remaining BiosCharacteristics bits left unset :60
+-    },
+-    {      // BIOSCharacteristicsExtensionBytes[2]
+-      0,   // BiosReserved
+-      0x1C // SystemReserved = VirtualMachineSupported |
+-           //                  UefiSpecificationSupported |
+-           //                  TargetContentDistributionEnabled
+-    },
+-    0,     // UINT8                     SystemBiosMajorRelease
+-    0,     // UINT8                     SystemBiosMinorRelease
+-    0xFF,  // UINT8                     EmbeddedControllerFirmwareMajorRelease
+-    0xFF   // UINT8                     EmbeddedControllerFirmwareMinorRelease
++    EFI_SMBIOS_TYPE_BIOS_INFORMATION, // UINT8 Type
++    sizeof (SMBIOS_TABLE_TYPE0),      // UINT8 Length
+   },
+-  // Text strings (unformatted area)
+-  TYPE0_STRINGS
++  1,      // SMBIOS_TABLE_STRING       Vendor
++  2,      // SMBIOS_TABLE_STRING       BiosVersion
++  0xE800, // UINT16                    BiosSegment
++  3,      // SMBIOS_TABLE_STRING       BiosReleaseDate
++  0,      // UINT8                     BiosSize
++  {      // MISC_BIOS_CHARACTERISTICS BiosCharacteristics
++    0,   // Reserved                                      :2
++    0,   // Unknown                                       :1
++    1,   // BiosCharacteristicsNotSupported               :1
++    // Remaining BiosCharacteristics bits left unset :60
++  },
++  {      // BIOSCharacteristicsExtensionBytes[2]
++    0,   // BiosReserved
++    0x1C // SystemReserved = VirtualMachineSupported |
++    //                  UefiSpecificationSupported |
++    //                  TargetContentDistributionEnabled
++  },
++  0,     // UINT8                     SystemBiosMajorRelease
++  0,     // UINT8                     SystemBiosMinorRelease
++  0xFF,  // UINT8                     EmbeddedControllerFirmwareMajorRelease
++  0xFF   // UINT8                     EmbeddedControllerFirmwareMinorRelease
+ };
+ 
+ /**
+@@ -153,14 +139,55 @@ InstallAllStructures (
+     //
+     // Add OVMF default Type 0 (BIOS Information) table
+     //
++    CHAR16  *VendStr, *VersStr, *DateStr;
++    UINTN   VendLen, VersLen, DateLen;
++    CHAR8   *Type0;
++
++    VendStr = (CHAR16 *)FixedPcdGetPtr (PcdFirmwareVendor);
++    VendLen = StrLen (VendStr);
++    if (VendLen < 3) {
++      VendStr = L"unknown";
++      VendLen = StrLen (VendStr);
++    }
++
++    VersStr = (CHAR16 *)FixedPcdGetPtr (PcdFirmwareVersionString);
++    VersLen = StrLen (VersStr);
++    if (VersLen < 3) {
++      VersStr = L"unknown";
++      VersLen = StrLen (VersStr);
++    }
++
++    DateStr = (CHAR16 *)FixedPcdGetPtr (PcdFirmwareReleaseDateString);
++    DateLen = StrLen (DateStr);
++    if (DateLen < 3) {
++      DateStr = L"unknown";
++      DateLen = StrLen (DateStr);
++    }
++
++    DEBUG ((DEBUG_INFO, "FirmwareVendor:            \"%s\" (%d chars)\n", VendStr, VendLen));
++    DEBUG ((DEBUG_INFO, "FirmwareVersionString:     \"%s\" (%d chars)\n", VersStr, VersLen));
++    DEBUG ((DEBUG_INFO, "FirmwareReleaseDateString: \"%s\" (%d chars)\n", DateStr, DateLen));
++
++    Type0 = AllocateZeroPool (sizeof (mOvmfDefaultType0) + VendLen + VersLen + DateLen + 4);
++    if (Type0 == NULL) {
++      return EFI_OUT_OF_RESOURCES;
++    }
++
++    CopyMem (Type0, &mOvmfDefaultType0, sizeof (mOvmfDefaultType0));
++    UnicodeStrToAsciiStrS (VendStr, Type0 + sizeof (mOvmfDefaultType0), VendLen + 1);
++    UnicodeStrToAsciiStrS (VersStr, Type0 + sizeof (mOvmfDefaultType0) + VendLen + 1, VersLen + 1);
++    UnicodeStrToAsciiStrS (DateStr, Type0 + sizeof (mOvmfDefaultType0) + VendLen + VersLen + 2, DateLen + 1);
++
+     SmbiosHandle = SMBIOS_HANDLE_PI_RESERVED;
+     Status       = Smbios->Add (
+                              Smbios,
+                              NULL,
+                              &SmbiosHandle,
+-                             (EFI_SMBIOS_TABLE_HEADER *)&mOvmfDefaultType0
++                             (EFI_SMBIOS_TABLE_HEADER *)Type0
+                              );
+     ASSERT_EFI_ERROR (Status);
++
++    FreePool (Type0);
+   }
+ 
+   return EFI_SUCCESS;
+-- 
+2.38.1
+

0020-OvmfPkg-PlatformPei-AmdSev-stop-using-mPlatformInfoH.patch

@@ -0,0 +1,116 @@
+From 4e22a4d1c1d7b492d1e1eee4fa81c697e0d59314 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 2 Dec 2022 14:09:58 +0100
+Subject: [PATCH 20/32] OvmfPkg/PlatformPei: AmdSev: stop using
+ mPlatformInfoHob
+
+Stop using the mPlatformInfoHob global variable in AmdSevInitialize()
+and AmdSevEsInitialize() functions.  Pass a pointer to the
+PlatformInfoHob instead.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 78c373f2a5273af00b23b55d3e8c41583310cfb6)
+---
+ OvmfPkg/PlatformPei/Platform.h |  2 +-
+ OvmfPkg/PlatformPei/AmdSev.c   | 14 +++++++-------
+ OvmfPkg/PlatformPei/Platform.c |  2 +-
+ 3 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/OvmfPkg/PlatformPei/Platform.h b/OvmfPkg/PlatformPei/Platform.h
+index 29b51b2debd8..f245025fb46f 100644
+--- a/OvmfPkg/PlatformPei/Platform.h
++++ b/OvmfPkg/PlatformPei/Platform.h
+@@ -82,7 +82,7 @@ InstallClearCacheCallback (
+ 
+ VOID
+ AmdSevInitialize (
+-  VOID
++  IN EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   );
+ 
+ /**
+diff --git a/OvmfPkg/PlatformPei/AmdSev.c b/OvmfPkg/PlatformPei/AmdSev.c
+index e1b9fd9b7f68..c23fae7fcae0 100644
+--- a/OvmfPkg/PlatformPei/AmdSev.c
++++ b/OvmfPkg/PlatformPei/AmdSev.c
+@@ -201,7 +201,7 @@ GhcbRegister (
+ STATIC
+ VOID
+ AmdSevEsInitialize (
+-  VOID
++  IN EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   )
+ {
+   UINT8                *GhcbBase;
+@@ -228,7 +228,7 @@ AmdSevEsInitialize (
+   //   Since the pages must survive across the UEFI to OS transition
+   //   make them reserved.
+   //
+-  GhcbPageCount = mPlatformInfoHob.PcdCpuMaxLogicalProcessorNumber * 2;
++  GhcbPageCount = PlatformInfoHob->PcdCpuMaxLogicalProcessorNumber * 2;
+   GhcbBase      = AllocateReservedPages (GhcbPageCount);
+   ASSERT (GhcbBase != NULL);
+ 
+@@ -266,7 +266,7 @@ AmdSevEsInitialize (
+   // Allocate #VC recursion backup pages. The number of backup pages needed is
+   // one less than the maximum VC count.
+   //
+-  GhcbBackupPageCount = mPlatformInfoHob.PcdCpuMaxLogicalProcessorNumber * (VMGEXIT_MAXIMUM_VC_COUNT - 1);
++  GhcbBackupPageCount = PlatformInfoHob->PcdCpuMaxLogicalProcessorNumber * (VMGEXIT_MAXIMUM_VC_COUNT - 1);
+   GhcbBackupBase      = AllocatePages (GhcbBackupPageCount);
+   ASSERT (GhcbBackupBase != NULL);
+ 
+@@ -320,7 +320,7 @@ AmdSevEsInitialize (
+   **/
+ VOID
+ AmdSevInitialize (
+-  VOID
++  IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   )
+ {
+   UINT64         EncryptionMask;
+@@ -367,7 +367,7 @@ AmdSevInitialize (
+   // until after re-encryption, in order to prevent an information leak to the
+   // hypervisor.
+   //
+-  if (mPlatformInfoHob.SmmSmramRequire && (mPlatformInfoHob.BootMode != BOOT_ON_S3_RESUME)) {
++  if (PlatformInfoHob->SmmSmramRequire && (PlatformInfoHob->BootMode != BOOT_ON_S3_RESUME)) {
+     RETURN_STATUS  LocateMapStatus;
+     UINTN          MapPagesBase;
+     UINTN          MapPagesCount;
+@@ -378,7 +378,7 @@ AmdSevInitialize (
+                         );
+     ASSERT_RETURN_ERROR (LocateMapStatus);
+ 
+-    if (mPlatformInfoHob.Q35SmramAtDefaultSmbase) {
++    if (PlatformInfoHob->Q35SmramAtDefaultSmbase) {
+       //
+       // The initial SMRAM Save State Map has been covered as part of a larger
+       // reserved memory allocation in InitializeRamRegions().
+@@ -400,7 +400,7 @@ AmdSevInitialize (
+   //
+   // Check and perform SEV-ES initialization if required.
+   //
+-  AmdSevEsInitialize ();
++  AmdSevEsInitialize (PlatformInfoHob);
+ 
+   //
+   // Set the Confidential computing attr PCD to communicate which SEV
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index e5132d95a8f8..14a75d40c005 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -392,7 +392,7 @@ InitializePlatform (
+   }
+ 
+   InstallClearCacheCallback ();
+-  AmdSevInitialize ();
++  AmdSevInitialize (&mPlatformInfoHob);
+   if (mPlatformInfoHob.HostBridgeDevId == 0xffff) {
+     MiscInitializationForMicrovm (&mPlatformInfoHob);
+   } else {
+-- 
+2.38.1
+

0021-OvmfPkg-PlatformPei-PeiFv-stop-using-mPlatformInfoHo.patch

@@ -0,0 +1,78 @@
+From 8d45eeb9bbec1085b31b8b5ede6145bf9458566c Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 2 Dec 2022 14:09:59 +0100
+Subject: [PATCH 21/32] OvmfPkg/PlatformPei: PeiFv: stop using mPlatformInfoHob
+
+Stop using the mPlatformInfoHob global variable in PeiFvInitialization()
+function.  Pass a pointer to the PlatformInfoHob instead.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 9d9d15b42a5e13bb18729da0f608c629aa274e80)
+---
+ OvmfPkg/PlatformPei/Platform.h | 2 +-
+ OvmfPkg/PlatformPei/Fv.c       | 6 +++---
+ OvmfPkg/PlatformPei/Platform.c | 2 +-
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/OvmfPkg/PlatformPei/Platform.h b/OvmfPkg/PlatformPei/Platform.h
+index f245025fb46f..b13f45ecdb69 100644
+--- a/OvmfPkg/PlatformPei/Platform.h
++++ b/OvmfPkg/PlatformPei/Platform.h
+@@ -62,7 +62,7 @@ MaxCpuCountInitialization (
+ 
+ EFI_STATUS
+ PeiFvInitialization (
+-  VOID
++  IN EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   );
+ 
+ VOID
+diff --git a/OvmfPkg/PlatformPei/Fv.c b/OvmfPkg/PlatformPei/Fv.c
+index e40c5922206b..fcf14c88faa7 100644
+--- a/OvmfPkg/PlatformPei/Fv.c
++++ b/OvmfPkg/PlatformPei/Fv.c
+@@ -22,7 +22,7 @@
+ **/
+ EFI_STATUS
+ PeiFvInitialization (
+-  VOID
++  IN EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   )
+ {
+   BOOLEAN  SecureS3Needed;
+@@ -37,7 +37,7 @@ PeiFvInitialization (
+   BuildMemoryAllocationHob (
+     PcdGet32 (PcdOvmfPeiMemFvBase),
+     PcdGet32 (PcdOvmfPeiMemFvSize),
+-    mPlatformInfoHob.S3Supported ? EfiACPIMemoryNVS : EfiBootServicesData
++    PlatformInfoHob->S3Supported ? EfiACPIMemoryNVS : EfiBootServicesData
+     );
+ 
+   //
+@@ -45,7 +45,7 @@ PeiFvInitialization (
+   //
+   BuildFvHob (PcdGet32 (PcdOvmfDxeMemFvBase), PcdGet32 (PcdOvmfDxeMemFvSize));
+ 
+-  SecureS3Needed = mPlatformInfoHob.S3Supported && mPlatformInfoHob.SmmSmramRequire;
++  SecureS3Needed = PlatformInfoHob->S3Supported && PlatformInfoHob->SmmSmramRequire;
+ 
+   //
+   // Create a memory allocation HOB for the DXE FV.
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index 14a75d40c005..5ecd5d8b1ab6 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -384,7 +384,7 @@ InitializePlatform (
+       ReserveEmuVariableNvStore ();
+     }
+ 
+-    PeiFvInitialization ();
++    PeiFvInitialization (&mPlatformInfoHob);
+     MemTypeInfoInitialization ();
+     MemMapInitialization (&mPlatformInfoHob);
+     NoexecDxeInitialization ();
+-- 
+2.38.1
+

0022-OvmfPkg-PlatformPei-Q35-SMM-helpers-stop-using-mPlat.patch

@@ -0,0 +1,134 @@
+From 1f0cc9c8bbc387a3e39daea604931fc819ba1650 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 2 Dec 2022 14:10:00 +0100
+Subject: [PATCH 22/32] OvmfPkg/PlatformPei Q35 SMM helpers: stop using
+ mPlatformInfoHob
+
+Stop using the mPlatformInfoHob global variable in
+Q35TsegMbytesInitialization() and
+Q35SmramAtDefaultSmbaseInitialization() ) functions.
+Pass a pointer to the PlatformInfoHob instead.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 00743d144bc5b643e9323ad66f16cb48cf338705)
+---
+ OvmfPkg/PlatformPei/Platform.h  |  4 ++--
+ OvmfPkg/PlatformPei/MemDetect.c | 20 ++++++++++----------
+ OvmfPkg/PlatformPei/Platform.c  |  4 ++--
+ 3 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/OvmfPkg/PlatformPei/Platform.h b/OvmfPkg/PlatformPei/Platform.h
+index b13f45ecdb69..7baa5e1d289f 100644
+--- a/OvmfPkg/PlatformPei/Platform.h
++++ b/OvmfPkg/PlatformPei/Platform.h
+@@ -22,12 +22,12 @@ AddressWidthInitialization (
+ 
+ VOID
+ Q35TsegMbytesInitialization (
+-  VOID
++  IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   );
+ 
+ VOID
+ Q35SmramAtDefaultSmbaseInitialization (
+-  VOID
++  IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   );
+ 
+ EFI_STATUS
+diff --git a/OvmfPkg/PlatformPei/MemDetect.c b/OvmfPkg/PlatformPei/MemDetect.c
+index 2e47b1322990..b9207107b4d9 100644
+--- a/OvmfPkg/PlatformPei/MemDetect.c
++++ b/OvmfPkg/PlatformPei/MemDetect.c
+@@ -41,13 +41,13 @@ Module Name:
+ 
+ VOID
+ Q35TsegMbytesInitialization (
+-  VOID
++  IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   )
+ {
+   UINT16         ExtendedTsegMbytes;
+   RETURN_STATUS  PcdStatus;
+ 
+-  ASSERT (mPlatformInfoHob.HostBridgeDevId == INTEL_Q35_MCH_DEVICE_ID);
++  ASSERT (PlatformInfoHob->HostBridgeDevId == INTEL_Q35_MCH_DEVICE_ID);
+ 
+   //
+   // Check if QEMU offers an extended TSEG.
+@@ -68,7 +68,7 @@ Q35TsegMbytesInitialization (
+   PciWrite16 (DRAMC_REGISTER_Q35 (MCH_EXT_TSEG_MB), MCH_EXT_TSEG_MB_QUERY);
+   ExtendedTsegMbytes = PciRead16 (DRAMC_REGISTER_Q35 (MCH_EXT_TSEG_MB));
+   if (ExtendedTsegMbytes == MCH_EXT_TSEG_MB_QUERY) {
+-    mPlatformInfoHob.Q35TsegMbytes = PcdGet16 (PcdQ35TsegMbytes);
++    PlatformInfoHob->Q35TsegMbytes = PcdGet16 (PcdQ35TsegMbytes);
+     return;
+   }
+ 
+@@ -80,19 +80,19 @@ Q35TsegMbytesInitialization (
+     ));
+   PcdStatus = PcdSet16S (PcdQ35TsegMbytes, ExtendedTsegMbytes);
+   ASSERT_RETURN_ERROR (PcdStatus);
+-  mPlatformInfoHob.Q35TsegMbytes = ExtendedTsegMbytes;
++  PlatformInfoHob->Q35TsegMbytes = ExtendedTsegMbytes;
+ }
+ 
+ VOID
+ Q35SmramAtDefaultSmbaseInitialization (
+-  VOID
++  IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   )
+ {
+   RETURN_STATUS  PcdStatus;
+ 
+-  ASSERT (mPlatformInfoHob.HostBridgeDevId == INTEL_Q35_MCH_DEVICE_ID);
++  ASSERT (PlatformInfoHob->HostBridgeDevId == INTEL_Q35_MCH_DEVICE_ID);
+ 
+-  mPlatformInfoHob.Q35SmramAtDefaultSmbase = FALSE;
++  PlatformInfoHob->Q35SmramAtDefaultSmbase = FALSE;
+   if (FeaturePcdGet (PcdCsmEnable)) {
+     DEBUG ((
+       DEBUG_INFO,
+@@ -106,19 +106,19 @@ Q35SmramAtDefaultSmbaseInitialization (
+     CtlReg = DRAMC_REGISTER_Q35 (MCH_DEFAULT_SMBASE_CTL);
+     PciWrite8 (CtlReg, MCH_DEFAULT_SMBASE_QUERY);
+     CtlRegVal                                = PciRead8 (CtlReg);
+-    mPlatformInfoHob.Q35SmramAtDefaultSmbase = (BOOLEAN)(CtlRegVal ==
++    PlatformInfoHob->Q35SmramAtDefaultSmbase = (BOOLEAN)(CtlRegVal ==
+                                                          MCH_DEFAULT_SMBASE_IN_RAM);
+     DEBUG ((
+       DEBUG_INFO,
+       "%a: SMRAM at default SMBASE %a\n",
+       __FUNCTION__,
+-      mPlatformInfoHob.Q35SmramAtDefaultSmbase ? "found" : "not found"
++      PlatformInfoHob->Q35SmramAtDefaultSmbase ? "found" : "not found"
+       ));
+   }
+ 
+   PcdStatus = PcdSetBoolS (
+                 PcdQ35SmramAtDefaultSmbase,
+-                mPlatformInfoHob.Q35SmramAtDefaultSmbase
++                PlatformInfoHob->Q35SmramAtDefaultSmbase
+                 );
+   ASSERT_RETURN_ERROR (PcdStatus);
+ }
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index 5ecd5d8b1ab6..402b2e88461e 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -369,8 +369,8 @@ InitializePlatform (
+ 
+   if (mPlatformInfoHob.SmmSmramRequire) {
+     Q35BoardVerification ();
+-    Q35TsegMbytesInitialization ();
+-    Q35SmramAtDefaultSmbaseInitialization ();
++    Q35TsegMbytesInitialization (&mPlatformInfoHob);
++    Q35SmramAtDefaultSmbaseInitialization (&mPlatformInfoHob);
+   }
+ 
+   PublishPeiMemory ();
+-- 
+2.38.1
+

0023-OvmfPkg-PlatformPei-PeiMemory-stop-using-mPlatformIn.patch

@@ -0,0 +1,160 @@
+From 44d2137d1bc1c3768b7c75843d6c40ef7491e630 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 2 Dec 2022 14:10:01 +0100
+Subject: [PATCH 23/32] OvmfPkg/PlatformPei: PeiMemory: stop using
+ mPlatformInfoHob
+
+Stop using the mPlatformInfoHob global variable in PublishPeiMemory()
+and GetPeiMemoryCap() functions.  Pass a pointer to the PlatformInfoHob
+instead.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 27874a382c38a95d3ab613eebd35c152ca9b3897)
+---
+ OvmfPkg/PlatformPei/Platform.h  |  2 +-
+ OvmfPkg/PlatformPei/MemDetect.c | 36 ++++++++++++++++-----------------
+ OvmfPkg/PlatformPei/Platform.c  |  2 +-
+ 3 files changed, 20 insertions(+), 20 deletions(-)
+
+diff --git a/OvmfPkg/PlatformPei/Platform.h b/OvmfPkg/PlatformPei/Platform.h
+index 7baa5e1d289f..d0c673c5a346 100644
+--- a/OvmfPkg/PlatformPei/Platform.h
++++ b/OvmfPkg/PlatformPei/Platform.h
+@@ -32,7 +32,7 @@ Q35SmramAtDefaultSmbaseInitialization (
+ 
+ EFI_STATUS
+ PublishPeiMemory (
+-  VOID
++  IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   );
+ 
+ VOID
+diff --git a/OvmfPkg/PlatformPei/MemDetect.c b/OvmfPkg/PlatformPei/MemDetect.c
+index b9207107b4d9..3d8375320dcb 100644
+--- a/OvmfPkg/PlatformPei/MemDetect.c
++++ b/OvmfPkg/PlatformPei/MemDetect.c
+@@ -188,7 +188,7 @@ AddressWidthInitialization (
+ STATIC
+ UINT32
+ GetPeiMemoryCap (
+-  VOID
++  IN EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   )
+ {
+   BOOLEAN  Page1GSupport;
+@@ -225,15 +225,15 @@ GetPeiMemoryCap (
+     }
+   }
+ 
+-  if (mPlatformInfoHob.PhysMemAddressWidth <= 39) {
++  if (PlatformInfoHob->PhysMemAddressWidth <= 39) {
+     Pml4Entries = 1;
+-    PdpEntries  = 1 << (mPlatformInfoHob.PhysMemAddressWidth - 30);
++    PdpEntries  = 1 << (PlatformInfoHob->PhysMemAddressWidth - 30);
+     ASSERT (PdpEntries <= 0x200);
+   } else {
+-    if (mPlatformInfoHob.PhysMemAddressWidth > 48) {
++    if (PlatformInfoHob->PhysMemAddressWidth > 48) {
+       Pml4Entries = 0x200;
+     } else {
+-      Pml4Entries = 1 << (mPlatformInfoHob.PhysMemAddressWidth - 39);
++      Pml4Entries = 1 << (PlatformInfoHob->PhysMemAddressWidth - 39);
+     }
+ 
+     ASSERT (Pml4Entries <= 0x200);
+@@ -260,7 +260,7 @@ GetPeiMemoryCap (
+ **/
+ EFI_STATUS
+ PublishPeiMemory (
+-  VOID
++  IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   )
+ {
+   EFI_STATUS            Status;
+@@ -271,12 +271,12 @@ PublishPeiMemory (
+   UINT32                S3AcpiReservedMemoryBase;
+   UINT32                S3AcpiReservedMemorySize;
+ 
+-  LowerMemorySize = PlatformGetSystemMemorySizeBelow4gb (&mPlatformInfoHob);
+-  if (mPlatformInfoHob.SmmSmramRequire) {
++  LowerMemorySize = PlatformGetSystemMemorySizeBelow4gb (PlatformInfoHob);
++  if (PlatformInfoHob->SmmSmramRequire) {
+     //
+     // TSEG is chipped from the end of low RAM
+     //
+-    LowerMemorySize -= mPlatformInfoHob.Q35TsegMbytes * SIZE_1MB;
++    LowerMemorySize -= PlatformInfoHob->Q35TsegMbytes * SIZE_1MB;
+   }
+ 
+   S3AcpiReservedMemoryBase = 0;
+@@ -287,27 +287,27 @@ PublishPeiMemory (
+   // downwards. Its size is primarily dictated by CpuMpPei. The formula below
+   // is an approximation.
+   //
+-  if (mPlatformInfoHob.S3Supported) {
++  if (PlatformInfoHob->S3Supported) {
+     S3AcpiReservedMemorySize = SIZE_512KB +
+-                               mPlatformInfoHob.PcdCpuMaxLogicalProcessorNumber *
++                               PlatformInfoHob->PcdCpuMaxLogicalProcessorNumber *
+                                PcdGet32 (PcdCpuApStackSize);
+     S3AcpiReservedMemoryBase = LowerMemorySize - S3AcpiReservedMemorySize;
+     LowerMemorySize          = S3AcpiReservedMemoryBase;
+   }
+ 
+-  mPlatformInfoHob.S3AcpiReservedMemoryBase = S3AcpiReservedMemoryBase;
+-  mPlatformInfoHob.S3AcpiReservedMemorySize = S3AcpiReservedMemorySize;
++  PlatformInfoHob->S3AcpiReservedMemoryBase = S3AcpiReservedMemoryBase;
++  PlatformInfoHob->S3AcpiReservedMemorySize = S3AcpiReservedMemorySize;
+ 
+-  if (mPlatformInfoHob.BootMode == BOOT_ON_S3_RESUME) {
++  if (PlatformInfoHob->BootMode == BOOT_ON_S3_RESUME) {
+     MemoryBase = S3AcpiReservedMemoryBase;
+     MemorySize = S3AcpiReservedMemorySize;
+   } else {
+-    PeiMemoryCap = GetPeiMemoryCap ();
++    PeiMemoryCap = GetPeiMemoryCap (PlatformInfoHob);
+     DEBUG ((
+       DEBUG_INFO,
+       "%a: PhysMemAddressWidth=%d PeiMemoryCap=%u KB\n",
+       __FUNCTION__,
+-      mPlatformInfoHob.PhysMemAddressWidth,
++      PlatformInfoHob->PhysMemAddressWidth,
+       PeiMemoryCap >> 10
+       ));
+ 
+@@ -321,7 +321,7 @@ PublishPeiMemory (
+     // allocation HOB, and other allocations served from the permanent PEI RAM
+     // shouldn't overlap with that HOB.
+     //
+-    MemoryBase = mPlatformInfoHob.S3Supported && mPlatformInfoHob.SmmSmramRequire ?
++    MemoryBase = PlatformInfoHob->S3Supported && PlatformInfoHob->SmmSmramRequire ?
+                  PcdGet32 (PcdOvmfDecompressionScratchEnd) :
+                  PcdGet32 (PcdOvmfDxeMemFvBase) + PcdGet32 (PcdOvmfDxeMemFvSize);
+     MemorySize = LowerMemorySize - MemoryBase;
+@@ -336,7 +336,7 @@ PublishPeiMemory (
+   // normal boot permanent PEI RAM. Regarding the S3 boot path, the S3
+   // permanent PEI RAM is located even higher.
+   //
+-  if (mPlatformInfoHob.SmmSmramRequire && mPlatformInfoHob.Q35SmramAtDefaultSmbase) {
++  if (PlatformInfoHob->SmmSmramRequire && PlatformInfoHob->Q35SmramAtDefaultSmbase) {
+     ASSERT (SMM_DEFAULT_SMBASE + MCH_DEFAULT_SMBASE_SIZE <= MemoryBase);
+   }
+ 
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index 402b2e88461e..0d5ead724d3f 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -373,7 +373,7 @@ InitializePlatform (
+     Q35SmramAtDefaultSmbaseInitialization (&mPlatformInfoHob);
+   }
+ 
+-  PublishPeiMemory ();
++  PublishPeiMemory (&mPlatformInfoHob);
+ 
+   PlatformQemuUc32BaseInitialization (&mPlatformInfoHob);
+ 
+-- 
+2.38.1
+

0024-OvmfPkg-PlatformPei-MemTypeInfo-stop-using-mPlatform.patch

@@ -0,0 +1,67 @@
+From 63ce5d51b90f213ec2281b6da8c1def59f9acaf8 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 2 Dec 2022 14:10:02 +0100
+Subject: [PATCH 24/32] OvmfPkg/PlatformPei: MemTypeInfo: stop using
+ mPlatformInfoHob
+
+Stop using the mPlatformInfoHob global variable in MemTypeInfoInitialization()
+function.  Pass a pointer to the PlatformInfoHob instead.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit cc6efda7770b8cabea3ae8c6054d47c4a8e229c3)
+---
+ OvmfPkg/PlatformPei/Platform.h    | 2 +-
+ OvmfPkg/PlatformPei/MemTypeInfo.c | 4 ++--
+ OvmfPkg/PlatformPei/Platform.c    | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/OvmfPkg/PlatformPei/Platform.h b/OvmfPkg/PlatformPei/Platform.h
+index d0c673c5a346..0c0558f0626c 100644
+--- a/OvmfPkg/PlatformPei/Platform.h
++++ b/OvmfPkg/PlatformPei/Platform.h
+@@ -67,7 +67,7 @@ PeiFvInitialization (
+ 
+ VOID
+ MemTypeInfoInitialization (
+-  VOID
++  IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   );
+ 
+ VOID
+diff --git a/OvmfPkg/PlatformPei/MemTypeInfo.c b/OvmfPkg/PlatformPei/MemTypeInfo.c
+index c8fcf1732687..eb37febb31ae 100644
+--- a/OvmfPkg/PlatformPei/MemTypeInfo.c
++++ b/OvmfPkg/PlatformPei/MemTypeInfo.c
+@@ -203,12 +203,12 @@ STATIC CONST EFI_PEI_NOTIFY_DESCRIPTOR  mReadOnlyVariable2Notify = {
+ 
+ VOID
+ MemTypeInfoInitialization (
+-  VOID
++  IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   )
+ {
+   EFI_STATUS  Status;
+ 
+-  if (!mPlatformInfoHob.SmmSmramRequire) {
++  if (!PlatformInfoHob->SmmSmramRequire) {
+     //
+     // EFI_PEI_READ_ONLY_VARIABLE2_PPI will never be available; install
+     // the default memory type information HOB right away.
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index 0d5ead724d3f..c0273091326c 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -385,7 +385,7 @@ InitializePlatform (
+     }
+ 
+     PeiFvInitialization (&mPlatformInfoHob);
+-    MemTypeInfoInitialization ();
++    MemTypeInfoInitialization (&mPlatformInfoHob);
+     MemMapInitialization (&mPlatformInfoHob);
+     NoexecDxeInitialization ();
+     UPDATE_BOOLEAN_PCD_FROM_FW_CFG (PcdResizeXterm);
+-- 
+2.38.1
+

0025-OvmfPkg-PlatformPei-NoExec-stop-using-mPlatformInfoH.patch

@@ -0,0 +1,54 @@
+From 6c10dc63b0753d9e241274d1cac62c0af406256e Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 2 Dec 2022 14:10:03 +0100
+Subject: [PATCH 25/32] OvmfPkg/PlatformPei: NoExec: stop using
+ mPlatformInfoHob
+
+Stop using the mPlatformInfoHob global variable in NoexecDxeInitialization()
+function.  Pass a pointer to the PlatformInfoHob instead.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 7dbb8a24d1a3403f85d959bc1234b9f4a92bfbf0)
+---
+ OvmfPkg/PlatformPei/Platform.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index c0273091326c..8307a80617fc 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -87,16 +87,17 @@ MemMapInitialization (
+   ASSERT_RETURN_ERROR (PcdStatus);
+ }
+ 
++STATIC
+ VOID
+ NoexecDxeInitialization (
+-  VOID
++  IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   )
+ {
+   RETURN_STATUS  Status;
+ 
+-  Status = PlatformNoexecDxeInitialization (&mPlatformInfoHob);
++  Status = PlatformNoexecDxeInitialization (PlatformInfoHob);
+   if (!RETURN_ERROR (Status)) {
+-    Status = PcdSetBoolS (PcdSetNxForStack, mPlatformInfoHob.PcdSetNxForStack);
++    Status = PcdSetBoolS (PcdSetNxForStack, PlatformInfoHob->PcdSetNxForStack);
+     ASSERT_RETURN_ERROR (Status);
+   }
+ }
+@@ -387,7 +388,7 @@ InitializePlatform (
+     PeiFvInitialization (&mPlatformInfoHob);
+     MemTypeInfoInitialization (&mPlatformInfoHob);
+     MemMapInitialization (&mPlatformInfoHob);
+-    NoexecDxeInitialization ();
++    NoexecDxeInitialization (&mPlatformInfoHob);
+     UPDATE_BOOLEAN_PCD_FROM_FW_CFG (PcdResizeXterm);
+   }
+ 
+-- 
+2.38.1
+

0026-OvmfPkg-PlatformPei-Verification-stop-using-mPlatfor.patch

@@ -0,0 +1,85 @@
+From d9fb9c50028ab90b0a1b044c9d13f3143f6093aa Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 2 Dec 2022 14:10:04 +0100
+Subject: [PATCH 26/32] OvmfPkg/PlatformPei: Verification: stop using
+ mPlatformInfoHob
+
+Stop using the mPlatformInfoHob global variable in S3Verification() and
+Q35BoardVerification() functions.  Pass a pointer to the PlatformInfoHob
+instead.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 4bc2c748516e5c4a8bb86093cd5e1b80a9f35c0f)
+---
+ OvmfPkg/PlatformPei/Platform.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index 8307a80617fc..6e31c5fc1f41 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -243,13 +243,14 @@ ReserveEmuVariableNvStore (
+   ASSERT_RETURN_ERROR (PcdStatus);
+ }
+ 
++STATIC
+ VOID
+ S3Verification (
+-  VOID
++  IN EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   )
+ {
+  #if defined (MDE_CPU_X64)
+-  if (mPlatformInfoHob.SmmSmramRequire && mPlatformInfoHob.S3Supported) {
++  if (PlatformInfoHob->SmmSmramRequire && PlatformInfoHob->S3Supported) {
+     DEBUG ((
+       DEBUG_ERROR,
+       "%a: S3Resume2Pei doesn't support X64 PEI + SMM yet.\n",
+@@ -272,12 +273,13 @@ S3Verification (
+  #endif
+ }
+ 
++STATIC
+ VOID
+ Q35BoardVerification (
+-  VOID
++  IN EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   )
+ {
+-  if (mPlatformInfoHob.HostBridgeDevId == INTEL_Q35_MCH_DEVICE_ID) {
++  if (PlatformInfoHob->HostBridgeDevId == INTEL_Q35_MCH_DEVICE_ID) {
+     return;
+   }
+ 
+@@ -286,7 +288,7 @@ Q35BoardVerification (
+     "%a: no TSEG (SMRAM) on host bridge DID=0x%04x; "
+     "only DID=0x%04x (Q35) is supported\n",
+     __FUNCTION__,
+-    mPlatformInfoHob.HostBridgeDevId,
++    PlatformInfoHob->HostBridgeDevId,
+     INTEL_Q35_MCH_DEVICE_ID
+     ));
+   ASSERT (FALSE);
+@@ -357,7 +359,7 @@ InitializePlatform (
+     ASSERT_EFI_ERROR (Status);
+   }
+ 
+-  S3Verification ();
++  S3Verification (&mPlatformInfoHob);
+   BootModeInitialization (&mPlatformInfoHob);
+ 
+   //
+@@ -369,7 +371,7 @@ InitializePlatform (
+   MaxCpuCountInitialization (&mPlatformInfoHob);
+ 
+   if (mPlatformInfoHob.SmmSmramRequire) {
+-    Q35BoardVerification ();
++    Q35BoardVerification (&mPlatformInfoHob);
+     Q35TsegMbytesInitialization (&mPlatformInfoHob);
+     Q35SmramAtDefaultSmbaseInitialization (&mPlatformInfoHob);
+   }
+-- 
+2.38.1
+

0027-OvmfPkg-PlatformPei-remove-mPlatformInfoHob.patch

@@ -0,0 +1,177 @@
+From 0aa971e9b02ff1b380c5363a5a543bc4e2b9532f Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 2 Dec 2022 14:10:05 +0100
+Subject: [PATCH 27/32] OvmfPkg/PlatformPei: remove mPlatformInfoHob
+
+Stop using the mPlatformInfoHob global variable.  Let
+BuildPlatformInfoHob() allocate and return PlatformInfoHob instead.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 862614e2544997c848fab7388733774ae0ea92d8)
+---
+ OvmfPkg/PlatformPei/Platform.h |  4 +-
+ OvmfPkg/PlatformPei/Platform.c | 71 ++++++++++++++++++----------------
+ 2 files changed, 39 insertions(+), 36 deletions(-)
+
+diff --git a/OvmfPkg/PlatformPei/Platform.h b/OvmfPkg/PlatformPei/Platform.h
+index 0c0558f0626c..86f603ff649c 100644
+--- a/OvmfPkg/PlatformPei/Platform.h
++++ b/OvmfPkg/PlatformPei/Platform.h
+@@ -13,8 +13,6 @@
+ #include <Library/PlatformInitLib.h>
+ #include <IndustryStandard/IntelTdx.h>
+ 
+-extern EFI_HOB_PLATFORM_INFO  mPlatformInfoHob;
+-
+ VOID
+ AddressWidthInitialization (
+   IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+@@ -98,7 +96,7 @@ IntelTdxInitialize (
+ /**
+  * @brief Builds PlatformInfo Hob
+  */
+-VOID
++EFI_HOB_PLATFORM_INFO *
+ BuildPlatformInfoHob (
+   VOID
+   );
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index 6e31c5fc1f41..ee72b4ef24aa 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -53,8 +53,6 @@
+             }                                                       \
+           } while (0)
+ 
+-EFI_HOB_PLATFORM_INFO  mPlatformInfoHob = { 0 };
+-
+ EFI_PEI_PPI_DESCRIPTOR  mPpiBootMode[] = {
+   {
+     EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST,
+@@ -317,12 +315,18 @@ MaxCpuCountInitialization (
+ /**
+  * @brief Builds PlatformInfo Hob
+  */
+-VOID
++EFI_HOB_PLATFORM_INFO *
+ BuildPlatformInfoHob (
+   VOID
+   )
+ {
+-  BuildGuidDataHob (&gUefiOvmfPkgPlatformInfoGuid, &mPlatformInfoHob, sizeof (EFI_HOB_PLATFORM_INFO));
++  EFI_HOB_PLATFORM_INFO  PlatformInfoHob;
++  EFI_HOB_GUID_TYPE      *GuidHob;
++
++  ZeroMem (&PlatformInfoHob, sizeof PlatformInfoHob);
++  BuildGuidDataHob (&gUefiOvmfPkgPlatformInfoGuid, &PlatformInfoHob, sizeof (EFI_HOB_PLATFORM_INFO));
++  GuidHob = GetFirstGuidHob (&gUefiOvmfPkgPlatformInfoGuid);
++  return (EFI_HOB_PLATFORM_INFO *)GET_GUID_HOB_DATA (GuidHob);
+ }
+ 
+ /**
+@@ -341,70 +345,71 @@ InitializePlatform (
+   IN CONST EFI_PEI_SERVICES     **PeiServices
+   )
+ {
+-  EFI_STATUS  Status;
++  EFI_HOB_PLATFORM_INFO  *PlatformInfoHob;
++  EFI_STATUS             Status;
+ 
+   DEBUG ((DEBUG_INFO, "Platform PEIM Loaded\n"));
++  PlatformInfoHob = BuildPlatformInfoHob ();
+ 
+-  mPlatformInfoHob.SmmSmramRequire     = FeaturePcdGet (PcdSmmSmramRequire);
+-  mPlatformInfoHob.SevEsIsEnabled      = MemEncryptSevEsIsEnabled ();
+-  mPlatformInfoHob.PcdPciMmio64Size    = PcdGet64 (PcdPciMmio64Size);
+-  mPlatformInfoHob.DefaultMaxCpuNumber = PcdGet32 (PcdCpuMaxLogicalProcessorNumber);
++  PlatformInfoHob->SmmSmramRequire     = FeaturePcdGet (PcdSmmSmramRequire);
++  PlatformInfoHob->SevEsIsEnabled      = MemEncryptSevEsIsEnabled ();
++  PlatformInfoHob->PcdPciMmio64Size    = PcdGet64 (PcdPciMmio64Size);
++  PlatformInfoHob->DefaultMaxCpuNumber = PcdGet32 (PcdCpuMaxLogicalProcessorNumber);
+ 
+   PlatformDebugDumpCmos ();
+ 
+   if (QemuFwCfgS3Enabled ()) {
+     DEBUG ((DEBUG_INFO, "S3 support was detected on QEMU\n"));
+-    mPlatformInfoHob.S3Supported = TRUE;
++    PlatformInfoHob->S3Supported = TRUE;
+     Status                       = PcdSetBoolS (PcdAcpiS3Enable, TRUE);
+     ASSERT_EFI_ERROR (Status);
+   }
+ 
+-  S3Verification (&mPlatformInfoHob);
+-  BootModeInitialization (&mPlatformInfoHob);
++  S3Verification (PlatformInfoHob);
++  BootModeInitialization (PlatformInfoHob);
+ 
+   //
+   // Query Host Bridge DID
+   //
+-  mPlatformInfoHob.HostBridgeDevId = PciRead16 (OVMF_HOSTBRIDGE_DID);
+-  AddressWidthInitialization (&mPlatformInfoHob);
++  PlatformInfoHob->HostBridgeDevId = PciRead16 (OVMF_HOSTBRIDGE_DID);
++  AddressWidthInitialization (PlatformInfoHob);
+ 
+-  MaxCpuCountInitialization (&mPlatformInfoHob);
++  MaxCpuCountInitialization (PlatformInfoHob);
+ 
+-  if (mPlatformInfoHob.SmmSmramRequire) {
+-    Q35BoardVerification (&mPlatformInfoHob);
+-    Q35TsegMbytesInitialization (&mPlatformInfoHob);
+-    Q35SmramAtDefaultSmbaseInitialization (&mPlatformInfoHob);
++  if (PlatformInfoHob->SmmSmramRequire) {
++    Q35BoardVerification (PlatformInfoHob);
++    Q35TsegMbytesInitialization (PlatformInfoHob);
++    Q35SmramAtDefaultSmbaseInitialization (PlatformInfoHob);
+   }
+ 
+-  PublishPeiMemory (&mPlatformInfoHob);
++  PublishPeiMemory (PlatformInfoHob);
+ 
+-  PlatformQemuUc32BaseInitialization (&mPlatformInfoHob);
++  PlatformQemuUc32BaseInitialization (PlatformInfoHob);
+ 
+-  InitializeRamRegions (&mPlatformInfoHob);
++  InitializeRamRegions (PlatformInfoHob);
+ 
+-  if (mPlatformInfoHob.BootMode != BOOT_ON_S3_RESUME) {
+-    if (!mPlatformInfoHob.SmmSmramRequire) {
++  if (PlatformInfoHob->BootMode != BOOT_ON_S3_RESUME) {
++    if (!PlatformInfoHob->SmmSmramRequire) {
+       ReserveEmuVariableNvStore ();
+     }
+ 
+-    PeiFvInitialization (&mPlatformInfoHob);
+-    MemTypeInfoInitialization (&mPlatformInfoHob);
+-    MemMapInitialization (&mPlatformInfoHob);
+-    NoexecDxeInitialization (&mPlatformInfoHob);
++    PeiFvInitialization (PlatformInfoHob);
++    MemTypeInfoInitialization (PlatformInfoHob);
++    MemMapInitialization (PlatformInfoHob);
++    NoexecDxeInitialization (PlatformInfoHob);
+     UPDATE_BOOLEAN_PCD_FROM_FW_CFG (PcdResizeXterm);
+   }
+ 
+   InstallClearCacheCallback ();
+-  AmdSevInitialize (&mPlatformInfoHob);
+-  if (mPlatformInfoHob.HostBridgeDevId == 0xffff) {
+-    MiscInitializationForMicrovm (&mPlatformInfoHob);
++  AmdSevInitialize (PlatformInfoHob);
++  if (PlatformInfoHob->HostBridgeDevId == 0xffff) {
++    MiscInitializationForMicrovm (PlatformInfoHob);
+   } else {
+-    MiscInitialization (&mPlatformInfoHob);
++    MiscInitialization (PlatformInfoHob);
+   }
+ 
+   IntelTdxInitialize ();
+   InstallFeatureControlCallback ();
+-  BuildPlatformInfoHob ();
+ 
+   return EFI_SUCCESS;
+ }
+-- 
+2.38.1
+

0028-OvmfPkg-PlatformPei-remove-mFeatureControlValue.patch

@@ -0,0 +1,176 @@
+From f0d41555cc5b42bd284c8ee1f3b419c612a9a8ca Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 2 Dec 2022 14:10:06 +0100
+Subject: [PATCH 28/32] OvmfPkg/PlatformPei: remove mFeatureControlValue
+
+Use PlatformInfoHob->FeatureControlValue instead.
+OnMpServicesAvailable() will find PlatformInfoHob using
+GetFirstGuidHob() and pass a pointer to the WriteFeatureControl
+callback.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit f6a196c7eb34affff0cfe1864e126953096885e1)
+---
+ OvmfPkg/Include/Library/PlatformInitLib.h |  2 ++
+ OvmfPkg/PlatformPei/Platform.h            |  2 +-
+ OvmfPkg/PlatformPei/FeatureControl.c      | 44 ++++++++++++++++-------
+ OvmfPkg/PlatformPei/Platform.c            |  2 +-
+ 4 files changed, 36 insertions(+), 14 deletions(-)
+
+diff --git a/OvmfPkg/Include/Library/PlatformInitLib.h b/OvmfPkg/Include/Library/PlatformInitLib.h
+index c5234bf26d45..da7ed76041d2 100644
+--- a/OvmfPkg/Include/Library/PlatformInitLib.h
++++ b/OvmfPkg/Include/Library/PlatformInitLib.h
+@@ -48,6 +48,8 @@ typedef struct {
+ 
+   UINT32               S3AcpiReservedMemoryBase;
+   UINT32               S3AcpiReservedMemorySize;
++
++  UINT64               FeatureControlValue;
+ } EFI_HOB_PLATFORM_INFO;
+ #pragma pack()
+ 
+diff --git a/OvmfPkg/PlatformPei/Platform.h b/OvmfPkg/PlatformPei/Platform.h
+index 86f603ff649c..1cf44844a781 100644
+--- a/OvmfPkg/PlatformPei/Platform.h
++++ b/OvmfPkg/PlatformPei/Platform.h
+@@ -70,7 +70,7 @@ MemTypeInfoInitialization (
+ 
+ VOID
+ InstallFeatureControlCallback (
+-  VOID
++  IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   );
+ 
+ VOID
+diff --git a/OvmfPkg/PlatformPei/FeatureControl.c b/OvmfPkg/PlatformPei/FeatureControl.c
+index 5864ee0c214d..d8a398cd5565 100644
+--- a/OvmfPkg/PlatformPei/FeatureControl.c
++++ b/OvmfPkg/PlatformPei/FeatureControl.c
+@@ -8,6 +8,7 @@
+ **/
+ 
+ #include <Library/DebugLib.h>
++#include <Library/HobLib.h>
+ #include <Library/PeiServicesLib.h>
+ #include <Library/QemuFwCfgLib.h>
+ #include <Ppi/MpServices.h>
+@@ -16,11 +17,6 @@
+ 
+ #include "Platform.h"
+ 
+-//
+-// The value to be written to the Feature Control MSR, retrieved from fw_cfg.
+-//
+-STATIC UINT64  mFeatureControlValue;
+-
+ /**
+   Write the Feature Control MSR on an Application Processor or the Boot
+   Processor.
+@@ -38,10 +34,22 @@ WriteFeatureControl (
+   IN OUT VOID  *WorkSpace
+   )
+ {
++  EFI_HOB_PLATFORM_INFO  *PlatformInfoHob = WorkSpace;
++
+   if (TdIsEnabled ()) {
+-    TdVmCall (TDVMCALL_WRMSR, (UINT64)MSR_IA32_FEATURE_CONTROL, mFeatureControlValue, 0, 0, 0);
++    TdVmCall (
++      TDVMCALL_WRMSR,
++      (UINT64)MSR_IA32_FEATURE_CONTROL,
++      PlatformInfoHob->FeatureControlValue,
++      0,
++      0,
++      0
++      );
+   } else {
+-    AsmWriteMsr64 (MSR_IA32_FEATURE_CONTROL, mFeatureControlValue);
++    AsmWriteMsr64 (
++      MSR_IA32_FEATURE_CONTROL,
++      PlatformInfoHob->FeatureControlValue
++      );
+   }
+ }
+ 
+@@ -67,6 +75,15 @@ OnMpServicesAvailable (
+ {
+   EFI_PEI_MP_SERVICES_PPI  *MpServices;
+   EFI_STATUS               Status;
++  EFI_HOB_PLATFORM_INFO    *PlatformInfoHob;
++  EFI_HOB_GUID_TYPE        *GuidHob;
++
++  GuidHob = GetFirstGuidHob (&gUefiOvmfPkgPlatformInfoGuid);
++  if (GuidHob == NULL) {
++    return EFI_UNSUPPORTED;
++  }
++
++  PlatformInfoHob = (EFI_HOB_PLATFORM_INFO *)GET_GUID_HOB_DATA (GuidHob);
+ 
+   DEBUG ((DEBUG_VERBOSE, "%a: %a\n", gEfiCallerBaseName, __FUNCTION__));
+ 
+@@ -80,7 +97,7 @@ OnMpServicesAvailable (
+                              WriteFeatureControl, // Procedure
+                              FALSE,               // SingleThread
+                              0,                   // TimeoutInMicroSeconds: inf.
+-                             NULL                 // ProcedureArgument
++                             PlatformInfoHob      // ProcedureArgument
+                              );
+   if (EFI_ERROR (Status) && (Status != EFI_NOT_STARTED)) {
+     DEBUG ((DEBUG_ERROR, "%a: StartupAllAps(): %r\n", __FUNCTION__, Status));
+@@ -90,7 +107,7 @@ OnMpServicesAvailable (
+   //
+   // Now write the MSR on the BSP too.
+   //
+-  WriteFeatureControl (NULL);
++  WriteFeatureControl (PlatformInfoHob);
+   return EFI_SUCCESS;
+ }
+ 
+@@ -107,7 +124,7 @@ STATIC CONST EFI_PEI_NOTIFY_DESCRIPTOR  mMpServicesNotify = {
+ 
+ VOID
+ InstallFeatureControlCallback (
+-  VOID
++  IN OUT EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+   )
+ {
+   EFI_STATUS            Status;
+@@ -119,7 +136,7 @@ InstallFeatureControlCallback (
+              &FwCfgItem,
+              &FwCfgSize
+              );
+-  if (EFI_ERROR (Status) || (FwCfgSize != sizeof mFeatureControlValue)) {
++  if (EFI_ERROR (Status) || (FwCfgSize != sizeof (PlatformInfoHob->FeatureControlValue))) {
+     //
+     // Nothing to do.
+     //
+@@ -127,7 +144,10 @@ InstallFeatureControlCallback (
+   }
+ 
+   QemuFwCfgSelectItem (FwCfgItem);
+-  QemuFwCfgReadBytes (sizeof mFeatureControlValue, &mFeatureControlValue);
++  QemuFwCfgReadBytes (
++    sizeof (PlatformInfoHob->FeatureControlValue),
++    &(PlatformInfoHob->FeatureControlValue)
++    );
+ 
+   Status = PeiServicesNotifyPpi (&mMpServicesNotify);
+   if (EFI_ERROR (Status)) {
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index ee72b4ef24aa..d324ae95f8f5 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -409,7 +409,7 @@ InitializePlatform (
+   }
+ 
+   IntelTdxInitialize ();
+-  InstallFeatureControlCallback ();
++  InstallFeatureControlCallback (PlatformInfoHob);
+ 
+   return EFI_SUCCESS;
+ }
+-- 
+2.38.1
+

0029-OvmfPkg-DebugLibIoPort-use-Rom-version-for-PEI.patch

@@ -0,0 +1,169 @@
+From b0f503de63b9f177d5457956025567806066bfb3 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 2 Dec 2022 14:10:07 +0100
+Subject: [PATCH 29/32] OvmfPkg/DebugLibIoPort: use Rom version for PEI
+
+This variant does not use global variables.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit e59747bd8246135faeecc18879d62db66a6acfc2)
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc                                  | 4 ++--
+ OvmfPkg/Bhyve/BhyveX64.dsc                                    | 4 ++--
+ OvmfPkg/Microvm/MicrovmX64.dsc                                | 4 ++--
+ OvmfPkg/OvmfPkgIa32.dsc                                       | 4 ++--
+ OvmfPkg/OvmfPkgIa32X64.dsc                                    | 4 ++--
+ OvmfPkg/OvmfPkgX64.dsc                                        | 4 ++--
+ .../PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf      | 2 +-
+ 7 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index 05908a72270f..ea755afbab82 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -244,7 +244,7 @@ [LibraryClasses.common.PEI_CORE]
+ !ifdef $(DEBUG_ON_SERIAL_PORT)
+   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
+ !else
+-  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
++  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+ !endif
+   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+ 
+@@ -260,7 +260,7 @@ [LibraryClasses.common.PEIM]
+ !ifdef $(DEBUG_ON_SERIAL_PORT)
+   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
+ !else
+-  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
++  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+ !endif
+   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+   ResourcePublicationLib|MdePkg/Library/PeiResourcePublicationLib/PeiResourcePublicationLib.inf
+diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc
+index e3bb367b6bf6..befec670d4f3 100644
+--- a/OvmfPkg/Bhyve/BhyveX64.dsc
++++ b/OvmfPkg/Bhyve/BhyveX64.dsc
+@@ -265,7 +265,7 @@ [LibraryClasses.common.PEI_CORE]
+ !ifdef $(DEBUG_ON_SERIAL_PORT)
+   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
+ !else
+-  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
++  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+ !endif
+   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+ 
+@@ -281,7 +281,7 @@ [LibraryClasses.common.PEIM]
+ !ifdef $(DEBUG_ON_SERIAL_PORT)
+   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
+ !else
+-  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
++  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+ !endif
+   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+   ResourcePublicationLib|MdePkg/Library/PeiResourcePublicationLib/PeiResourcePublicationLib.inf
+diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
+index 3444304d0e46..97339d48a5ef 100644
+--- a/OvmfPkg/Microvm/MicrovmX64.dsc
++++ b/OvmfPkg/Microvm/MicrovmX64.dsc
+@@ -292,7 +292,7 @@ [LibraryClasses.common.PEI_CORE]
+ !ifdef $(DEBUG_ON_SERIAL_PORT)
+   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
+ !else
+-  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
++  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+ !endif
+   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+ 
+@@ -308,7 +308,7 @@ [LibraryClasses.common.PEIM]
+ !ifdef $(DEBUG_ON_SERIAL_PORT)
+   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
+ !else
+-  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
++  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+ !endif
+   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+   ResourcePublicationLib|MdePkg/Library/PeiResourcePublicationLib/PeiResourcePublicationLib.inf
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 9c0fb7d545b8..72e623a65a38 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -294,7 +294,7 @@ [LibraryClasses.common.PEI_CORE]
+ !ifdef $(DEBUG_ON_SERIAL_PORT)
+   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
+ !else
+-  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
++  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+ !endif
+   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+ 
+@@ -310,7 +310,7 @@ [LibraryClasses.common.PEIM]
+ !ifdef $(DEBUG_ON_SERIAL_PORT)
+   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
+ !else
+-  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
++  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+ !endif
+   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+   ResourcePublicationLib|MdePkg/Library/PeiResourcePublicationLib/PeiResourcePublicationLib.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 8b93437044e7..55ceb5c3420b 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -300,7 +300,7 @@ [LibraryClasses.common.PEI_CORE]
+ !ifdef $(DEBUG_ON_SERIAL_PORT)
+   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
+ !else
+-  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
++  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+ !endif
+   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+ 
+@@ -316,7 +316,7 @@ [LibraryClasses.common.PEIM]
+ !ifdef $(DEBUG_ON_SERIAL_PORT)
+   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
+ !else
+-  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
++  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+ !endif
+   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+   ResourcePublicationLib|MdePkg/Library/PeiResourcePublicationLib/PeiResourcePublicationLib.inf
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index 8c9162db1743..6cef37c10822 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -318,7 +318,7 @@ [LibraryClasses.common.PEI_CORE]
+ !ifdef $(DEBUG_ON_SERIAL_PORT)
+   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
+ !else
+-  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
++  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+ !endif
+   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+   CcProbeLib|OvmfPkg/Library/CcProbeLib/SecPeiCcProbeLib.inf
+@@ -335,7 +335,7 @@ [LibraryClasses.common.PEIM]
+ !ifdef $(DEBUG_ON_SERIAL_PORT)
+   DebugLib|MdePkg/Library/BaseDebugLibSerialPort/BaseDebugLibSerialPort.inf
+ !else
+-  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformDebugLibIoPort.inf
++  DebugLib|OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+ !endif
+   PeCoffLib|MdePkg/Library/BasePeCoffLib/BasePeCoffLib.inf
+   ResourcePublicationLib|MdePkg/Library/PeiResourcePublicationLib/PeiResourcePublicationLib.inf
+diff --git a/OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf b/OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+index 8f721d249dd5..c89b1571bad8 100644
+--- a/OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
++++ b/OvmfPkg/Library/PlatformDebugLibIoPort/PlatformRomDebugLibIoPort.inf
+@@ -16,7 +16,7 @@ [Defines]
+   FILE_GUID                      = CEB0D9D3-328F-4C24-8C02-28FA1986AE1B
+   MODULE_TYPE                    = BASE
+   VERSION_STRING                 = 1.0
+-  LIBRARY_CLASS                  = DebugLib|SEC
++  LIBRARY_CLASS                  = DebugLib|SEC PEI_CORE PEIM
+   CONSTRUCTOR                    = PlatformRomDebugLibIoPortConstructor
+ 
+ #
+-- 
+2.38.1
+

0030-OvmfPkg-QemuFwCfgLib-rewrite-fw_cfg-probe.patch

@@ -0,0 +1,183 @@
+From 64d555122ee65151008255a30173a3608006ae25 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 2 Dec 2022 14:10:08 +0100
+Subject: [PATCH 30/32] OvmfPkg/QemuFwCfgLib: rewrite fw_cfg probe
+
+Move the code to a new QemuFwCfgProbe() function.  Use direct Io*() calls
+instead of indirect QemuFwCfg*() calls to make sure we don't get
+recursive calls.  Also simplify CC guest detection.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 81bbc1452c972218f071cd4a8f5899df974b1dae)
+---
+ .../Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf  |   1 -
+ OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPei.c   | 101 +++++++-----------
+ 2 files changed, 41 insertions(+), 61 deletions(-)
+
+diff --git a/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf b/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf
+index 3910511880c9..1d7543a7d40f 100644
+--- a/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf
++++ b/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf
+@@ -41,7 +41,6 @@ [LibraryClasses]
+   DebugLib
+   IoLib
+   MemoryAllocationLib
+-  MemEncryptSevLib
+ 
+ [Pcd]
+   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase
+diff --git a/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPei.c b/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPei.c
+index 7ab7027af168..a936fd103955 100644
+--- a/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPei.c
++++ b/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPei.c
+@@ -13,7 +13,6 @@
+ #include <Library/IoLib.h>
+ #include <Library/DebugLib.h>
+ #include <Library/QemuFwCfgLib.h>
+-#include <Library/MemEncryptSevLib.h>
+ #include <WorkArea.h>
+ 
+ #include "QemuFwCfgLibInternal.h"
+@@ -27,15 +26,16 @@ STATIC BOOLEAN  mQemuFwCfgDmaSupported;
+   @retval    TRUE   It is Tdx guest
+   @retval    FALSE  It is not Tdx guest
+ **/
++STATIC
+ BOOLEAN
+-QemuFwCfgIsTdxGuest (
++QemuFwCfgIsCcGuest (
+   VOID
+   )
+ {
+   CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER  *CcWorkAreaHeader;
+ 
+   CcWorkAreaHeader = (CONFIDENTIAL_COMPUTING_WORK_AREA_HEADER *)FixedPcdGet32 (PcdOvmfWorkAreaBase);
+-  return (CcWorkAreaHeader != NULL && CcWorkAreaHeader->GuestType == CcGuestTypeIntelTdx);
++  return (CcWorkAreaHeader != NULL && CcWorkAreaHeader->GuestType != CcGuestTypeNonEncrypted);
+ }
+ 
+ /**
+@@ -57,62 +57,49 @@ QemuFwCfgIsAvailable (
+   return InternalQemuFwCfgIsAvailable ();
+ }
+ 
++STATIC
++VOID
++QemuFwCfgProbe (
++  BOOLEAN  *Supported,
++  BOOLEAN  *DmaSupported
++  )
++{
++  UINT32   Signature;
++  UINT32   Revision;
++  BOOLEAN  CcGuest;
++
++  // Use direct Io* calls for probing to avoid recursion.
++  IoWrite16 (FW_CFG_IO_SELECTOR, (UINT16)QemuFwCfgItemSignature);
++  IoReadFifo8 (FW_CFG_IO_DATA, sizeof Signature, &Signature);
++  IoWrite16 (FW_CFG_IO_SELECTOR, (UINT16)QemuFwCfgItemInterfaceVersion);
++  IoReadFifo8 (FW_CFG_IO_DATA, sizeof Revision, &Revision);
++  CcGuest = QemuFwCfgIsCcGuest ();
++
++  *Supported    = FALSE;
++  *DmaSupported = FALSE;
++  if ((Signature == SIGNATURE_32 ('Q', 'E', 'M', 'U')) && (Revision >= 1)) {
++    *Supported = TRUE;
++    if ((Revision & FW_CFG_F_DMA) && !CcGuest) {
++      *DmaSupported = TRUE;
++    }
++  }
++
++  DEBUG ((
++    DEBUG_INFO,
++    "%a: Supported %d, DMA %d\n",
++    __func__,
++    *Supported,
++    *DmaSupported
++    ));
++}
++
+ RETURN_STATUS
+ EFIAPI
+ QemuFwCfgInitialize (
+   VOID
+   )
+ {
+-  UINT32  Signature;
+-  UINT32  Revision;
+-
+-  //
+-  // Enable the access routines while probing to see if it is supported.
+-  // For probing we always use the IO Port (IoReadFifo8()) access method.
+-  //
+-  mQemuFwCfgSupported    = TRUE;
+-  mQemuFwCfgDmaSupported = FALSE;
+-
+-  QemuFwCfgSelectItem (QemuFwCfgItemSignature);
+-  Signature = QemuFwCfgRead32 ();
+-  DEBUG ((DEBUG_INFO, "FW CFG Signature: 0x%x\n", Signature));
+-  QemuFwCfgSelectItem (QemuFwCfgItemInterfaceVersion);
+-  Revision = QemuFwCfgRead32 ();
+-  DEBUG ((DEBUG_INFO, "FW CFG Revision: 0x%x\n", Revision));
+-  if ((Signature != SIGNATURE_32 ('Q', 'E', 'M', 'U')) ||
+-      (Revision < 1)
+-      )
+-  {
+-    DEBUG ((DEBUG_INFO, "QemuFwCfg interface not supported.\n"));
+-    mQemuFwCfgSupported = FALSE;
+-    return RETURN_SUCCESS;
+-  }
+-
+-  if ((Revision & FW_CFG_F_DMA) == 0) {
+-    DEBUG ((DEBUG_INFO, "QemuFwCfg interface (IO Port) is supported.\n"));
+-  } else {
+-    //
+-    // If SEV is enabled then we do not support DMA operations in PEI phase.
+-    // This is mainly because DMA in SEV guest requires using bounce buffer
+-    // (which need to allocate dynamic memory and allocating a PAGE size'd
+-    // buffer can be challenge in PEI phase)
+-    //
+-    if (MemEncryptSevIsEnabled ()) {
+-      DEBUG ((DEBUG_INFO, "SEV: QemuFwCfg fallback to IO Port interface.\n"));
+-    } else if (QemuFwCfgIsTdxGuest ()) {
+-      //
+-      // If TDX is enabled then we do not support DMA operations in PEI phase.
+-      // This is mainly because DMA in TDX guest requires using bounce buffer
+-      // (which need to allocate dynamic memory and allocating a PAGE size'd
+-      // buffer can be challenge in PEI phase)
+-      //
+-      DEBUG ((DEBUG_INFO, "TDX: QemuFwCfg fallback to IO Port interface.\n"));
+-    } else {
+-      mQemuFwCfgDmaSupported = TRUE;
+-      DEBUG ((DEBUG_INFO, "QemuFwCfg interface (DMA) is supported.\n"));
+-    }
+-  }
+-
++  QemuFwCfgProbe (&mQemuFwCfgSupported, &mQemuFwCfgDmaSupported);
+   return RETURN_SUCCESS;
+ }
+ 
+@@ -183,17 +170,11 @@ InternalQemuFwCfgDmaBytes (
+     return;
+   }
+ 
+-  //
+-  // SEV does not support DMA operations in PEI stage, we should
+-  // not have reached here.
+-  //
+-  ASSERT (!MemEncryptSevIsEnabled ());
+-
+   //
+   // TDX does not support DMA operations in PEI stage, we should
+   // not have reached here.
+   //
+-  ASSERT (!QemuFwCfgIsTdxGuest ());
++  ASSERT (!QemuFwCfgIsCcGuest ());
+ 
+   Access.Control = SwapBytes32 (Control);
+   Access.Length  = SwapBytes32 (Size);
+-- 
+2.38.1
+

0031-OvmfPkg-QemuFwCfgLib-remove-mQemuFwCfgSupported-mQem.patch

@@ -0,0 +1,144 @@
+From ed22693f4fc4d780c19280a7a26438b7c9d84ecd Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 2 Dec 2022 14:10:09 +0100
+Subject: [PATCH 31/32] OvmfPkg/QemuFwCfgLib: remove mQemuFwCfgSupported +
+ mQemuFwCfgDmaSupported
+
+Remove global variables, store the state in PlatformInfoHob instead.
+Probing for fw_cfg happens on first use, at library initialization
+time the Hob might not be present yet.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit cda98df16228970dcf9a4ce2af5368219711b4b0)
+---
+ .../Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf  |  4 ++
+ OvmfPkg/Include/Library/PlatformInitLib.h     |  4 ++
+ OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPei.c   | 44 ++++++++++++++++---
+ 3 files changed, 45 insertions(+), 7 deletions(-)
+
+diff --git a/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf b/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf
+index 1d7543a7d40f..b1f548febcf7 100644
+--- a/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf
++++ b/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf
+@@ -39,8 +39,12 @@ [LibraryClasses]
+   BaseLib
+   BaseMemoryLib
+   DebugLib
++  HobLib
+   IoLib
+   MemoryAllocationLib
+ 
++[Guids]
++  gUefiOvmfPkgPlatformInfoGuid
++
+ [Pcd]
+   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase
+diff --git a/OvmfPkg/Include/Library/PlatformInitLib.h b/OvmfPkg/Include/Library/PlatformInitLib.h
+index da7ed76041d2..bf6f90a5761c 100644
+--- a/OvmfPkg/Include/Library/PlatformInitLib.h
++++ b/OvmfPkg/Include/Library/PlatformInitLib.h
+@@ -50,6 +50,10 @@ typedef struct {
+   UINT32               S3AcpiReservedMemorySize;
+ 
+   UINT64               FeatureControlValue;
++
++  BOOLEAN              QemuFwCfgChecked;
++  BOOLEAN              QemuFwCfgSupported;
++  BOOLEAN              QemuFwCfgDmaSupported;
+ } EFI_HOB_PLATFORM_INFO;
+ #pragma pack()
+ 
+diff --git a/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPei.c b/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPei.c
+index a936fd103955..da86a3c84c02 100644
+--- a/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPei.c
++++ b/OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPei.c
+@@ -9,17 +9,17 @@
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ **/
+ 
++#include <PiPei.h>
+ #include <Library/BaseLib.h>
+-#include <Library/IoLib.h>
+ #include <Library/DebugLib.h>
++#include <Library/HobLib.h>
++#include <Library/IoLib.h>
++#include <Library/PlatformInitLib.h>
+ #include <Library/QemuFwCfgLib.h>
+ #include <WorkArea.h>
+ 
+ #include "QemuFwCfgLibInternal.h"
+ 
+-STATIC BOOLEAN  mQemuFwCfgSupported = FALSE;
+-STATIC BOOLEAN  mQemuFwCfgDmaSupported;
+-
+ /**
+   Check if it is Tdx guest
+ 
+@@ -93,13 +93,39 @@ QemuFwCfgProbe (
+     ));
+ }
+ 
++STATIC
++EFI_HOB_PLATFORM_INFO *
++QemuFwCfgGetPlatformInfo (
++  VOID
++  )
++{
++  EFI_HOB_PLATFORM_INFO  *PlatformInfoHob;
++  EFI_HOB_GUID_TYPE      *GuidHob;
++
++  GuidHob = GetFirstGuidHob (&gUefiOvmfPkgPlatformInfoGuid);
++  if (GuidHob == NULL) {
++    return NULL;
++  }
++
++  PlatformInfoHob = (EFI_HOB_PLATFORM_INFO *)GET_GUID_HOB_DATA (GuidHob);
++
++  if (!PlatformInfoHob->QemuFwCfgChecked) {
++    QemuFwCfgProbe (
++      &PlatformInfoHob->QemuFwCfgSupported,
++      &PlatformInfoHob->QemuFwCfgDmaSupported
++      );
++    PlatformInfoHob->QemuFwCfgChecked = TRUE;
++  }
++
++  return PlatformInfoHob;
++}
++
+ RETURN_STATUS
+ EFIAPI
+ QemuFwCfgInitialize (
+   VOID
+   )
+ {
+-  QemuFwCfgProbe (&mQemuFwCfgSupported, &mQemuFwCfgDmaSupported);
+   return RETURN_SUCCESS;
+ }
+ 
+@@ -117,7 +143,9 @@ InternalQemuFwCfgIsAvailable (
+   VOID
+   )
+ {
+-  return mQemuFwCfgSupported;
++  EFI_HOB_PLATFORM_INFO  *PlatformInfoHob = QemuFwCfgGetPlatformInfo ();
++
++  return PlatformInfoHob->QemuFwCfgSupported;
+ }
+ 
+ /**
+@@ -132,7 +160,9 @@ InternalQemuFwCfgDmaIsAvailable (
+   VOID
+   )
+ {
+-  return mQemuFwCfgDmaSupported;
++  EFI_HOB_PLATFORM_INFO  *PlatformInfoHob = QemuFwCfgGetPlatformInfo ();
++
++  return PlatformInfoHob->QemuFwCfgDmaSupported;
+ }
+ 
+ /**
+-- 
+2.38.1
+

0032-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch

@@ -0,0 +1,61 @@
+From c5c9385ffa28b9989a53c3a51ce3f8b4ef40aa41 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 11 Jan 2023 19:00:23 +0100
+Subject: [PATCH 32/34] OvmfPkg/VirtNorFlashDxe: map flash memory as
+ uncacheable
+
+Switching from the ArmPlatformPkg/NorFlashDxe driver to the
+OvmfPkg/VirtNorFlashDxe driver had the side effect that flash address
+space got registered as EFI_MEMORY_WC instead of EFI_MEMORY_UC.
+
+That confuses the linux kernel's numa code, seems this makes kernel
+consider the flash being node memory.  "lsmem" changes from ...
+
+    RANGE                                 SIZE  STATE REMOVABLE BLOCK
+    0x0000000040000000-0x000000013fffffff   4G online       yes  8-39
+
+... to ...
+
+    RANGE                                  SIZE  STATE REMOVABLE BLOCK
+    0x0000000000000000-0x0000000007ffffff  128M online       yes     0
+    0x0000000040000000-0x000000013fffffff    4G online       yes  8-39
+
+... and in the kernel log got new error lines:
+
+    NUMA: Warning: invalid memblk node 512 [mem 0x0000000004000000-0x0000000007ffffff]
+    NUMA: Faking a node at [mem 0x0000000004000000-0x000000013fffffff]
+
+Changing the attributes back to EFI_MEMORY_UC fixes this.
+
+Fixes: b92298af8218 ("ArmVirtPkg/ArmVirtQemu: migrate to OVMF's VirtNorFlashDxe")
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit e5ec3ba409b5baa9cf429cc25fdf3c8d1b8dcef0)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+index ff3121af2a40..f9a41f6aab0f 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
++++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+@@ -394,14 +394,14 @@ NorFlashFvbInitialize (
+                   EfiGcdMemoryTypeMemoryMappedIo,
+                   Instance->DeviceBaseAddress,
+                   RuntimeMmioRegionSize,
+-                  EFI_MEMORY_WC | EFI_MEMORY_RUNTIME
++                  EFI_MEMORY_UC | EFI_MEMORY_RUNTIME
+                   );
+   ASSERT_EFI_ERROR (Status);
+ 
+   Status = gDS->SetMemorySpaceAttributes (
+                   Instance->DeviceBaseAddress,
+                   RuntimeMmioRegionSize,
+-                  EFI_MEMORY_WC | EFI_MEMORY_RUNTIME
++                  EFI_MEMORY_UC | EFI_MEMORY_RUNTIME
+                   );
+   ASSERT_EFI_ERROR (Status);
+ 
+-- 
+2.39.0
+

0033-ArmVirtPkg-ArmVirtQemu-Avoid-early-ID-map-on-Thunder.patch

@@ -0,0 +1,82 @@
+From 4cab22343b32fec515813584a2620d6dafe0b1c2 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Wed, 4 Jan 2023 16:51:35 +0100
+Subject: [PATCH 33/34] ArmVirtPkg/ArmVirtQemu: Avoid early ID map on ThunderX
+
+The early ID map used by ArmVirtQemu uses ASID scoped non-global
+mappings, as this allows us to switch to the permanent ID map seamlessly
+without the need for explicit TLB maintenance.
+
+However, this triggers a known erratum on ThunderX, which does not
+tolerate non-global mappings that are executable at EL1, as this appears
+to result in I-cache corruption. (Linux disables the KPTI based Meltdown
+mitigation on ThunderX for the same reason)
+
+So work around this, by detecting the CPU implementor and part number,
+and proceeding without the early ID map if a ThunderX CPU is detected.
+
+Note that this requires the C code to be built with strict alignment
+again, as we may end up executing it with the MMU and caches off.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Acked-by: Laszlo Ersek <lersek@redhat.com>
+Tested-by: dann frazier <dann.frazier@canonical.com>
+(cherry picked from commit ec54ce1f1ab41b92782b37ae59e752fff0ef9c41)
+---
+ ArmVirtPkg/ArmVirtQemu.dsc                        |  5 +++++
+ .../AArch64/ArmPlatformHelper.S                   | 15 +++++++++++++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index a3d744931a15..6b4dc213a7f7 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
++++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -31,6 +31,7 @@ [Defines]
+   DEFINE SECURE_BOOT_ENABLE      = FALSE
+   DEFINE TPM2_ENABLE             = FALSE
+   DEFINE TPM2_CONFIG_ENABLE      = FALSE
++  DEFINE CAVIUM_ERRATUM_27456    = FALSE
+ 
+   #
+   # Network definition
+@@ -117,7 +118,11 @@ [LibraryClasses.common.UEFI_DRIVER]
+   UefiScsiLib|MdePkg/Library/UefiScsiLib/UefiScsiLib.inf
+ 
+ [BuildOptions]
++!if $(CAVIUM_ERRATUM_27456) == TRUE
++  GCC:*_*_AARCH64_PP_FLAGS = -DCAVIUM_ERRATUM_27456
++!else
+   GCC:*_*_AARCH64_CC_XIPFLAGS ==
++!endif
+ 
+ !include NetworkPkg/NetworkBuildOptions.dsc.inc
+ 
+diff --git a/ArmVirtPkg/Library/ArmPlatformLibQemu/AArch64/ArmPlatformHelper.S b/ArmVirtPkg/Library/ArmPlatformLibQemu/AArch64/ArmPlatformHelper.S
+index 05ccc7f9f043..1c0022c1efd9 100644
+--- a/ArmVirtPkg/Library/ArmPlatformLibQemu/AArch64/ArmPlatformHelper.S
++++ b/ArmVirtPkg/Library/ArmPlatformLibQemu/AArch64/ArmPlatformHelper.S
+@@ -44,6 +44,21 @@
+ 
+ 
+ ASM_FUNC(ArmPlatformPeiBootAction)
++#ifdef CAVIUM_ERRATUM_27456
++  /*
++   * On Cavium ThunderX, using non-global mappings that are executable at EL1
++   * results in I-cache corruption. So just avoid the early ID mapping there.
++   *
++   * MIDR implementor   0x43
++   * MIDR part numbers  0xA1 0xA2 (but not 0xAF)
++   */
++  mrs    x0, midr_el1            // read the MIDR into X0
++  ubfx   x1, x0, #24, #8         // grab implementor id
++  ubfx   x0, x0, #7, #9          // grab part number bits [11:3]
++  cmp    x1, #0x43               // compare implementor id
++  ccmp   x0, #0xA0 >> 3, #0, eq  // compare part# bits [11:3]
++  b.eq   0f
++#endif
+   mrs    x0, CurrentEL           // check current exception level
+   tbz    x0, #3, 0f              // bail if above EL1
+   ret
+-- 
+2.39.0
+

0034-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch

@@ -0,0 +1,37 @@
+From 630fa990847e14507354a4d921143a8bfb255194 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 10 Feb 2023 10:49:44 +0100
+Subject: [PATCH 34/34] rh openssl: add crypto/bn/rsa_sup_mul.c to file list
+
+---
+ CryptoPkg/Library/OpensslLib/OpensslLib.inf       | 1 +
+ CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
+index e446b51e66cd..7e78255467b1 100644
+--- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
++++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
+@@ -576,6 +576,7 @@ [Sources]
+   $(OPENSSL_PATH)/ssl/statem/statem_local.h
+ # Autogenerated files list ends here
+ # RHEL8-specific OpenSSL file list starts here
++  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
+   $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
+   $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
+   $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
+diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+index c207dc8f4cfd..1c551cb0990c 100644
+--- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
++++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+@@ -526,6 +526,7 @@ [Sources]
+   $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
+ # Autogenerated files list ends here
+ # RHEL8-specific OpenSSL file list starts here
++  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
+   $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
+   $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
+   $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
+-- 
+2.39.1
+

50-edk2-ovmf-ia32-nosb.json

@@ -1,5 +1,5 @@
 {
-    "description": "OVMF for i386, without SB, without SMM, with empty varstore",
+    "description": "OVMF for i386, without SB+SMM, empty varstore",
     "interface-types": [
         "uefi"
     ],

50-edk2-ovmf-x64-nosb.json

@@ -1,5 +1,5 @@
 {
-    "description": "OVMF for x86_64, without SB, without SMM, with empty varstore",
+    "description": "OVMF without SB+SMM, empty varstore",
     "interface-types": [
         "uefi"
     ],
@@ -26,6 +26,7 @@
     "features": [
         "acpi-s3",
         "amd-sev",
+        "amd-sev-es",
         "verbose-dynamic"
     ],
     "tags": [

60-edk2-ovmf-x64-amdsev.json

@@ -22,6 +22,7 @@
     "features": [
         "amd-sev",
         "amd-sev-es",
+        "amd-sev-snp",
         "verbose-dynamic"
     ],
     "tags": [

edk2-build.fedora

@@ -0,0 +1,254 @@
+
+[opts.ovmf.common]
+NETWORK_HTTP_BOOT_ENABLE = TRUE
+NETWORK_IP6_ENABLE       = TRUE
+NETWORK_TLS_ENABLE       = TRUE
+NETWORK_ISCSI_ENABLE     = TRUE
+NETWORK_ALLOW_HTTP_CONNECTIONS = TRUE
+TPM2_ENABLE              = TRUE
+TPM2_CONFIG_ENABLE       = TRUE
+TPM1_ENABLE              = TRUE
+CAVIUM_ERRATUM_27456     = TRUE
+
+[opts.ovmf.4m]
+FD_SIZE_4MB              = TRUE
+
+[opts.ovmf.2m]
+FD_SIZE_2MB              = TRUE
+NETWORK_ISCSI_ENABLE     = FALSE
+
+[opts.ovmf.sb.smm]
+SECURE_BOOT_ENABLE       = TRUE
+SMM_REQUIRE              = TRUE
+# old downstream
+EXCLUDE_SHELL_FROM_FD    = TRUE
+# new upstream
+BUILD_SHELL              = FALSE
+
+# requires edk2 2022-11 or newer
+[opts.ovmf.sb.stateless]
+SECURE_BOOT_ENABLE       = TRUE
+SMM_REQUIRE              = FALSE
+
+[opts.armvirt.verbose]
+DEBUG_PRINT_ERROR_LEVEL  = 0x8040004F
+
+[opts.armvirt.silent]
+DEBUG_PRINT_ERROR_LEVEL  = 0x80000000
+
+
+[pcds.nx.strict]
+PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD5
+
+[pcds.nx.broken.grub]
+# grub.efi uses EfiLoaderData for code
+PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD1
+
+
+#####################################################################
+# stateful ovmf builds (with vars in flash)
+
+[build.ovmf.2m.default]
+desc = ovmf build (64-bit, 2MB)
+conf = OvmfPkg/OvmfPkgX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.2m
+plat = OvmfX64
+dest = Fedora/ovmf
+cpy1 = FV/OVMF_CODE.fd
+cpy2 = FV/OVMF_VARS.fd
+cpy3 = X64/Shell.efi
+
+[build.ovmf.4m.default]
+desc = ovmf build (64-bit, 4MB)
+conf = OvmfPkg/OvmfPkgX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+plat = OvmfX64
+dest = Fedora/ovmf-4m
+cpy1 = FV/OVMF_CODE.fd
+cpy2 = FV/OVMF_VARS.fd
+
+[build.ovmf.2m.sb.smm]
+desc = ovmf build (32/64-bit, 2MB, q35 only, needs smm, secure boot)
+conf = OvmfPkg/OvmfPkgIa32X64.dsc
+arch = IA32 X64
+opts = ovmf.common
+       ovmf.2m
+       ovmf.sb.smm
+plat = Ovmf3264
+dest = Fedora/ovmf
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
+cpy2 = X64/EnrollDefaultKeys.efi
+
+[build.ovmf.4m.sb.smm]
+desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot)
+conf = OvmfPkg/OvmfPkgIa32X64.dsc
+arch = IA32 X64
+opts = ovmf.common
+       ovmf.4m
+       ovmf.sb.smm
+plat = Ovmf3264
+dest = Fedora/ovmf-4m
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
+
+
+#####################################################################
+# stateless ovmf builds (firmware in rom or r/o flash)
+
+[build.ovmf.microvm]
+desc = ovmf build for qemu microvm (2MB)
+conf = OvmfPkg/Microvm/MicrovmX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.2m
+plat = MicrovmX64
+dest = Fedora/ovmf
+cpy1 = FV/MICROVM.fd
+
+[build.ovmf.xen]
+desc = ovmf build for Xen
+conf = OvmfPkg/OvmfXen.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.2m
+plat = OvmfXen
+dest = Fedora/xen
+cpy1 = FV/OVMF.fd
+
+[build.ovmf.amdsev]
+desc = ovmf build for AmdSev (2MB)
+conf = OvmfPkg/AmdSev/AmdSevX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.2m
+plat = AmdSev
+dest = Fedora/ovmf
+cpy1 = FV/OVMF.fd OVMF.amdsev.fd
+
+[build.ovmf.inteltdx]
+desc = ovmf build for IntelTdx (2MB)
+conf = OvmfPkg/IntelTdx/IntelTdxX64.dsc
+arch = X64
+opts = ovmf.common ovmf.2m
+plat = IntelTdx
+dest = Fedora/ovmf
+cpy1 = FV/OVMF.fd OVMF.inteltdx.fd
+
+
+#####################################################################
+# armvirt builds
+
+[build.armvirt.aa64.verbose]
+desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.verbose
+pcds = nx.broken.grub
+plat = ArmVirtQemu-AARCH64
+dest = Fedora/aarch64
+cpy1 = FV/QEMU_EFI.fd
+cpy2 = FV/QEMU_VARS.fd
+cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
+cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
+pad3 = QEMU_EFI-pflash.raw      64m
+pad4 = vars-template-pflash.raw 64m
+
+[build.armvirt.aa64.silent]
+desc = ArmVirt build for qemu, 64-bit (arm v8), silent
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.silent
+pcds = nx.broken.grub
+plat = ArmVirtQemu-AARCH64
+dest = Fedora/aarch64
+cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.silent.fd
+cpy2 = FV/QEMU_EFI.fd  QEMU_EFI-silent-pflash.raw
+pad2 = QEMU_EFI-silent-pflash.raw 64m
+
+
+#####################################################################
+# 32-bit builds
+
+[build.ovmf.ia32.default]
+desc = ovmf build (32-bit, 2MB)
+conf = OvmfPkg/OvmfPkgIa32.dsc
+arch = IA32
+opts = ovmf.common
+       ovmf.2m
+plat = OvmfIa32
+dest = Fedora/ovmf-ia32
+cpy1 = FV/OVMF_CODE.fd
+cpy2 = FV/OVMF_VARS.fd
+cpy3 = IA32/Shell.efi
+
+[build.ovmf.ia32.sb.smm]
+desc = ovmf build (32-bit, 2MB, q35 only, needs smm, secure boot)
+conf = OvmfPkg/OvmfPkgIa32.dsc
+arch = IA32
+opts = ovmf.common
+       ovmf.2m
+       ovmf.sb.smm
+plat = OvmfIa32
+dest = Fedora/ovmf-ia32
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
+cpy2 = IA32/EnrollDefaultKeys.efi
+
+[build.armvirt.arm]
+desc = ArmVirt build for qemu, 32-bit (arm v7)
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = ARM
+opts = ovmf.common
+pcds = nx.broken.grub
+plat = ArmVirtQemu-ARM
+dest = Fedora/arm
+cpy1 = FV/QEMU_EFI.fd
+cpy2 = FV/QEMU_VARS.fd
+cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
+cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
+pad3 = QEMU_EFI-pflash.raw      64m
+pad4 = vars-template-pflash.raw 64m
+
+
+#####################################################################
+# experimental builds
+
+[build.ovmf.sb.stateless]
+desc = ovmf build (64-bit, stateless secure boot)
+conf = OvmfPkg/OvmfPkgX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+       ovmf.sb.stateless
+plat = OvmfX64
+dest = Fedora/experimental
+cpy1 = FV/OVMF.fd OVMF.stateless.fd
+
+[build.ovmf.strict.nx]
+desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot, strict nx)
+conf = OvmfPkg/OvmfPkgIa32X64.dsc
+arch = IA32 X64
+opts = ovmf.common
+       ovmf.4m
+       ovmf.sb.smm
+pcds = nx.strict
+plat = Ovmf3264
+dest = Fedora/experimental
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.4m.secboot.strictnx.fd
+
+[build.armvirt.aa64.strict.nx]
+desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.verbose
+pcds = nx.strict
+plat = ArmVirtQemu-AARCH64
+dest = Fedora/experimental
+cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.strictnx.fd
+cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-strictnx-pflash.raw
+pad3 = QEMU_EFI-strictnx-pflash.raw  64m

edk2-build.fedora.platforms

@@ -0,0 +1,28 @@
+
+#####################################################################
+# ext4 driver
+
+[build.ext4.x64]
+desc = ext4 driver
+conf = Features/Ext4Pkg/Ext4Pkg.dsc
+arch = X64
+plat = Ext4Pkg
+dest = Fedora/drivers
+cpy1 = X64/Ext4Dxe.efi ext4x64.efi
+
+[build.ext4.aa64]
+desc = ext4 driver
+conf = Features/Ext4Pkg/Ext4Pkg.dsc
+arch = AARCH64
+plat = Ext4Pkg
+dest = Fedora/drivers
+cpy1 = AARCH64/Ext4Dxe.efi ext4aa64.efi
+
+
+#####################################################################
+# loongarch builds
+
+[build.loongarch]
+desc = Loongarch build
+conf = Platform/Loongson/LoongArchQemuPkg/Loongson.dsc
+arch = LOONGARCH64

edk2-build.py

@@ -0,0 +1,335 @@
+#!/usr/bin/python3
+import os
+import sys
+import glob
+import shutil
+import optparse
+import subprocess
+import configparser
+
+rebase_prefix    = ""
+version_override = None
+release_date     = None
+
+def check_rebase():
+    """ detect 'git rebase -x edk2-build.py master' testbuilds """
+    global rebase_prefix
+    global version_override
+
+    if not os.path.exists('.git/rebase-merge/msgnum'):
+        return ""
+    with open('.git/rebase-merge/msgnum', 'r') as f:
+        msgnum = int(f.read())
+    with open('.git/rebase-merge/end', 'r') as f:
+        end = int(f.read())
+    with open('.git/rebase-merge/head-name', 'r') as f:
+        head = f.read().strip().split('/')
+
+    rebase_prefix = f'[ {int(msgnum/2)} / {int(end/2)} - {head[-1]} ] '
+    if msgnum != end and not version_override:
+        # fixed version speeds up builds
+        version_override = "test-build-patch-series"
+
+def get_coredir(cfg):
+    if cfg.has_option('global', 'core'):
+        return os.path.abspath(cfg['global']['core'])
+    else:
+        return os.getcwd()
+
+def get_version(cfg):
+    coredir = get_coredir(cfg)
+    if version_override:
+        version = version_override
+        print('')
+        print(f'### version [override]: {version}')
+        return version
+    if os.environ.get('RPM_PACKAGE_NAME'):
+        version = os.environ.get('RPM_PACKAGE_NAME');
+        version += '-' + os.environ.get('RPM_PACKAGE_VERSION');
+        version += '-' + os.environ.get('RPM_PACKAGE_RELEASE');
+        print('')
+        print(f'### version [rpmbuild]: {version}')
+        return version
+    if os.path.exists(coredir + '/.git'):
+        cmdline = [ 'git', 'describe', '--tags', '--abbrev=8', '--match=edk2-stable*' ]
+        result = subprocess.run(cmdline, stdout = subprocess.PIPE, cwd = coredir)
+        version = result.stdout.decode().strip()
+        print('')
+        print(f'### version [git]: {version}')
+        return version
+    return None
+
+def pcd_string(name, value):
+    return f'{name}=L{value}\\0'
+
+def pcd_version(cfg):
+    version = get_version(cfg)
+    if version is None:
+        return []
+    return [ '--pcd', pcd_string('PcdFirmwareVersionString', version) ]
+
+def pcd_release_date(cfg):
+    if release_date is None:
+        return []
+    return [ '--pcd', pcd_string('PcdFirmwareReleaseDateString', release_date) ]
+
+def build_message(line, line2 = None):
+    if os.environ.get('TERM') in [ 'xterm', 'xterm-256color' ]:
+        # setxterm  title
+        start  = '\x1b]2;'
+        end    = '\x07'
+        print(f'{start}{rebase_prefix}{line}{end}', end = '')
+
+    print('')
+    print('###')
+    print(f'### {rebase_prefix}{line}')
+    if line2:
+        print(f'### {line2}')
+    print('###')
+
+def build_run(cmdline, name, section, silent = False):
+    print(cmdline)
+    if silent:
+        print('### building in silent mode ...', flush = True)
+        result = subprocess.run(cmdline,
+                                stdout = subprocess.PIPE,
+                                stderr = subprocess.STDOUT)
+
+        logfile = f'{section}.log'
+        print(f'### writing log to {logfile} ...')
+        with open(logfile, 'wb') as f:
+            f.write(result.stdout)
+
+        if result.returncode:
+            print('### BUILD FAILURE')
+            print('### output')
+            print(result.stdout.decode())
+            print(f'### exit code: {result.returncode}')
+        else:
+            print('### OK')
+    else:
+        result = subprocess.run(cmdline)
+    if result.returncode:
+        print(f'ERROR: {cmdline[0]} exited with {result.returncode} while building {name}')
+        sys.exit(result.returncode)
+
+def build_copy(plat, tgt, dstdir, copy):
+    srcdir = f'Build/{plat}/{tgt}_GCC5'
+    names = copy.split()
+    srcfile = names[0]
+    if len(names) > 1:
+        dstfile = names[1]
+    else:
+        dstfile = os.path.basename(srcfile)
+    print(f'# copy: {srcdir} / {srcfile}  =>  {dstdir} / {dstfile}')
+
+    src = srcdir + '/' + srcfile
+    dst = dstdir + '/' + dstfile
+    os.makedirs(os.path.dirname(dst), exist_ok = True)
+    shutil.copy(src, dst)
+
+def pad_file(dstdir, pad):
+    args = pad.split()
+    if len(args) < 2:
+        raise RuntimeError(f'missing arg for pad ({args})')
+    name = args[0]
+    size = args[1]
+    cmdline = [
+        'truncate',
+        '--size', size,
+        dstdir + '/' + name,
+    ]
+    print(f'# padding: {dstdir} / {name}  =>  {size}')
+    subprocess.run(cmdline)
+
+def build_one(cfg, build, jobs = None, silent = False):
+    cmdline  = [ 'build' ]
+    cmdline += [ '-t', 'GCC5' ]
+    cmdline += [ '-p', cfg[build]['conf'] ]
+
+    if (cfg[build]['conf'].startswith('OvmfPkg/') or
+        cfg[build]['conf'].startswith('ArmVirtPkg/')):
+        cmdline += pcd_version(cfg)
+        cmdline += pcd_release_date(cfg)
+
+    if jobs:
+        cmdline += [ '-n', jobs ]
+    for arch in cfg[build]['arch'].split():
+        cmdline += [ '-a', arch ]
+    if 'opts' in cfg[build]:
+        for name in cfg[build]['opts'].split():
+            section = 'opts.' + name
+            for opt in cfg[section]:
+                cmdline += [ '-D', opt + '=' + cfg[section][opt] ]
+    if 'pcds' in cfg[build]:
+        for name in cfg[build]['pcds'].split():
+            section = 'pcds.' + name
+            for pcd in cfg[section]:
+                cmdline += [ '--pcd', pcd + '=' + cfg[section][pcd] ]
+    if 'tgts' in cfg[build]:
+        tgts = cfg[build]['tgts'].split()
+    else:
+        tgts = [ 'DEBUG' ]
+    for tgt in tgts:
+        desc = None
+        if 'desc' in cfg[build]:
+            desc = cfg[build]['desc']
+        build_message(f'building: {cfg[build]["conf"]} ({cfg[build]["arch"]}, {tgt})',
+                      f'description: {desc}')
+        build_run(cmdline + [ '-b', tgt ],
+                  cfg[build]['conf'],
+                  build + '.' + tgt,
+                  silent)
+
+        if 'plat' in cfg[build]:
+            # copy files
+            for cpy in cfg[build]:
+                if not cpy.startswith('cpy'):
+                    continue
+                build_copy(cfg[build]['plat'],
+                           tgt,
+                           cfg[build]['dest'],
+                           cfg[build][cpy])
+            # pad builds
+            for pad in cfg[build]:
+                if not pad.startswith('pad'):
+                    continue
+                pad_file(cfg[build]['dest'],
+                         cfg[build][pad])
+
+def build_basetools(silent = False):
+    build_message(f'building: BaseTools')
+    basedir = os.environ['EDK_TOOLS_PATH']
+    cmdline = [ 'make', '-C', basedir ]
+    build_run(cmdline, 'BaseTools', 'build.basetools', silent)
+
+def binary_exists(name):
+    for dir in os.environ['PATH'].split(':'):
+        if os.path.exists(dir + '/' + name):
+            return True
+    return False
+
+def prepare_env(cfg):
+    """ mimic Conf/BuildEnv.sh """
+    workspace = os.getcwd()
+    packages = [ workspace, ]
+    path = os.environ['PATH'].split(':')
+    dirs = [
+        'BaseTools/Bin/Linux-x86_64',
+        'BaseTools/BinWrappers/PosixLike'
+    ]
+
+    if cfg.has_option('global', 'pkgs'):
+        for pkgdir in cfg['global']['pkgs'].split():
+            packages.append(os.path.abspath(pkgdir))
+    coredir = get_coredir(cfg)
+    if coredir != workspace:
+        packages.append(coredir)
+
+    # add basetools to path
+    for dir in dirs:
+        p = coredir + '/' + dir
+        if not os.path.exists(p):
+            continue
+        if p in path:
+            continue
+        path.insert(0, p)
+
+    # run edksetup if needed
+    toolsdef = coredir + '/Conf/tools_def.txt';
+    if not os.path.exists(toolsdef):
+        os.makedirs(os.path.dirname(toolsdef), exist_ok = True)
+        build_message('running BaseTools/BuildEnv')
+        cmdline = [ 'sh', 'BaseTools/BuildEnv' ]
+        subprocess.run(cmdline, cwd = coredir)
+
+    # set variables
+    os.environ['PATH'] = ':'.join(path)
+    os.environ['PACKAGES_PATH'] = ':'.join(packages)
+    os.environ['WORKSPACE'] = workspace
+    os.environ['EDK_TOOLS_PATH'] = coredir + '/BaseTools'
+    os.environ['CONF_PATH'] = coredir + '/Conf'
+    os.environ['PYTHON_COMMAND'] = '/usr/bin/python3'
+    os.environ['PYTHONHASHSEED'] = '1'
+
+    # for cross builds
+    if binary_exists('arm-linux-gnu-gcc'):
+        os.environ['GCC5_ARM_PREFIX'] = 'arm-linux-gnu-'
+    if binary_exists('aarch64-linux-gnu-gcc'):
+        os.environ['GCC5_AARCH64_PREFIX'] = 'aarch64-linux-gnu-'
+    if binary_exists('riscv64-linux-gnu-gcc'):
+        os.environ['GCC5_RISCV64_PREFIX'] = 'riscv64-linux-gnu-'
+    if binary_exists('loongarch64-linux-gnu-gcc'):
+        os.environ['GCC5_LOONGARCH64_PREFIX'] = 'loongarch64-linux-gnu-'
+    if binary_exists('x86_64-linux-gnu-gcc'):
+        os.environ['GCC5_IA32_PREFIX'] = 'x86_64-linux-gnu-'
+        os.environ['GCC5_X64_PREFIX'] = 'x86_64-linux-gnu-'
+        os.environ['GCC5_BIN'] = 'x86_64-linux-gnu-'
+
+def build_list(cfg):
+    for build in cfg.sections():
+        if not build.startswith('build.'):
+            continue
+        name = build.lstrip('build.')
+        desc = 'no description'
+        if 'desc' in cfg[build]:
+            desc = cfg[build]['desc']
+        print(f'# {name:20s} - {desc}')
+    
+def main():
+    parser = optparse.OptionParser()
+    parser.add_option('-c', '--config', dest = 'configfile',
+                      type = 'string', default = '.edk2.builds')
+    parser.add_option('-C', '--directory', dest = 'directory', type = 'string')
+    parser.add_option('-j', '--jobs', dest = 'jobs', type = 'string')
+    parser.add_option('-m', '--match', dest = 'match', type = 'string')
+    parser.add_option('-x', '--exclude', dest = 'exclude', type = 'string')
+    parser.add_option('-l', '--list', dest = 'list', action = 'store_true', default = False)
+    parser.add_option('--silent', dest = 'silent', action = 'store_true', default = False)
+    parser.add_option('--core', dest = 'core', type = 'string')
+    parser.add_option('--pkg', '--package', dest = 'pkgs', type = 'string', action = 'append')
+    parser.add_option('--version-override', dest = 'version_override', type = 'string')
+    parser.add_option('--release-date', dest = 'release_date', type = 'string')
+    (options, args) = parser.parse_args()
+
+    if options.directory:
+        os.chdir(options.directory)
+
+    cfg = configparser.ConfigParser()
+    cfg.optionxform = str
+    cfg.read(options.configfile)
+
+    if options.list:
+        build_list(cfg)
+        return
+
+    if not cfg.has_section('global'):
+        cfg.add_section('global')
+    if options.core:
+        cfg.set('global', 'core', options.core)
+    if options.pkgs:
+        cfg.set('global', 'pkgs', ' '.join(options.pkgs))
+
+    global version_override
+    global release_date
+    check_rebase()
+    if options.version_override:
+        version_override = options.version_override
+    if options.release_date:
+        release_date = options.release_date
+
+    prepare_env(cfg)
+    build_basetools(options.silent)
+    for build in cfg.sections():
+        if not build.startswith('build.'):
+            continue
+        if options.match and options.match not in build:
+            print(f'# skipping "{build}" (not matching "{options.match}")')
+            continue
+        if options.exclude and options.exclude in build:
+            print(f'# skipping "{build}" (matching "{options.exclude}")')
+            continue
+        build_one(cfg, build, options.jobs, options.silent)
+
+if __name__ == '__main__':
+    sys.exit(main())

edk2-build.rhel-9

@@ -0,0 +1,111 @@
+
+[opts.ovmf.common]
+NETWORK_HTTP_BOOT_ENABLE = TRUE
+NETWORK_IP6_ENABLE       = TRUE
+NETWORK_TLS_ENABLE       = TRUE
+NETWORK_ISCSI_ENABLE     = TRUE
+NETWORK_ALLOW_HTTP_CONNECTIONS = TRUE
+TPM2_ENABLE              = TRUE
+TPM2_CONFIG_ENABLE       = TRUE
+TPM1_ENABLE              = FALSE
+CAVIUM_ERRATUM_27456     = TRUE
+
+[opts.ovmf.4m]
+FD_SIZE_4MB              = TRUE
+
+[opts.ovmf.sb.smm]
+SECURE_BOOT_ENABLE       = TRUE
+SMM_REQUIRE              = TRUE
+# old downstream
+EXCLUDE_SHELL_FROM_FD    = TRUE
+# new upstream
+BUILD_SHELL              = FALSE
+
+[opts.armvirt.verbose]
+DEBUG_PRINT_ERROR_LEVEL  = 0x8040004F
+
+[opts.armvirt.silent]
+DEBUG_PRINT_ERROR_LEVEL  = 0x80000000
+
+
+#####################################################################
+# stateful ovmf builds (with vars in flash)
+
+[build.ovmf.4m.default]
+desc = ovmf build (64-bit, 4MB)
+conf = OvmfPkg/OvmfPkgX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+plat = OvmfX64
+dest = RHEL-9/ovmf
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.fd
+cpy2 = FV/OVMF_VARS.fd
+cpy3 = X64/Shell.efi
+
+[build.ovmf.4m.sb.smm]
+desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot)
+conf = OvmfPkg/OvmfPkgIa32X64.dsc
+arch = IA32 X64
+opts = ovmf.common
+       ovmf.4m
+       ovmf.sb.smm
+plat = Ovmf3264
+dest = RHEL-9/ovmf
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
+cpy2 = X64/EnrollDefaultKeys.efi
+
+
+#####################################################################
+# stateless ovmf builds (firmware in rom or r/o flash)
+
+[build.ovmf.amdsev]
+desc = ovmf build for AmdSev (4MB)
+conf = OvmfPkg/AmdSev/AmdSevX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+plat = AmdSev
+dest = RHEL-9/ovmf
+cpy1 = FV/OVMF.fd OVMF.amdsev.fd
+
+[build.ovmf.inteltdx]
+desc = ovmf build for IntelTdx (4MB)
+conf = OvmfPkg/IntelTdx/IntelTdxX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+plat = IntelTdx
+dest = RHEL-9/ovmf
+cpy1 = FV/OVMF.fd OVMF.inteltdx.fd
+
+
+#####################################################################
+# armvirt builds
+
+[build.armvirt.aa64.verbose]
+desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.verbose
+plat = ArmVirtQemu-AARCH64
+dest = RHEL-9/aarch64
+cpy1 = FV/QEMU_EFI.fd
+cpy2 = FV/QEMU_VARS.fd
+cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
+cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
+pad3 = QEMU_EFI-pflash.raw      64m
+pad4 = vars-template-pflash.raw 64m
+
+[build.armvirt.aa64.silent]
+desc = ArmVirt build for qemu, 64-bit (arm v8), silent
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.silent
+plat = ArmVirtQemu-AARCH64
+dest = RHEL-9/aarch64
+cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.silent.fd
+cpy2 = FV/QEMU_EFI.fd  QEMU_EFI-silent-pflash.raw
+pad2 = QEMU_EFI-silent-pflash.raw 64m

edk2-ovmf-cc.json

@@ -1,33 +0,0 @@
-{
-    "description": "OVMF with SEV-ES support",
-    "interface-types": [
-        "uefi"
-    ],
-    "mapping": {
-        "device": "flash",
-        "executable": {
-            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.cc.fd",
-            "format": "raw"
-        },
-        "nvram-template": {
-            "filename": "/usr/share/edk2/ovmf/OVMF_VARS.fd",
-            "format": "raw"
-        }
-    },
-    "targets": [
-        {
-            "architecture": "x86_64",
-            "machines": [
-                "pc-q35-*"
-            ]
-        }
-    ],
-    "features": [
-        "amd-sev",
-        "amd-sev-es",
-        "verbose-dynamic"
-    ],
-    "tags": [
-
-    ]
-}

edk2.spec

@@ -8,9 +8,9 @@
 # (such as ppc), so lets limit things to the known-good ones.
 ExclusiveArch: x86_64 aarch64
 
-# edk2-stable202205
-%define GITDATE        20220526
-%define GITCOMMIT      16779ede2d36
+# edk2-stable202211
+%define GITDATE        20221117
+%define GITCOMMIT      fff6d81270b5
 %define TOOLCHAIN      GCC5
 %define OPENSSL_VER    1.1.1k
 
@@ -35,7 +35,7 @@ ExclusiveArch: x86_64 aarch64
 
 Name:       edk2
 Version:    %{GITDATE}git%{GITCOMMIT}
-Release:    3%{?dist}
+Release:    14%{?dist}
 Summary:    UEFI firmware for 64-bit virtual machines
 License:    BSD-2-Clause-Patent and OpenSSL and MIT
 URL:        http://www.tianocore.org
@@ -46,46 +46,71 @@ URL:        http://www.tianocore.org
 # | xz -9ev >/tmp/edk2-$COMMIT.tar.xz
 Source0: edk2-%{GITCOMMIT}.tar.xz
 Source1: ovmf-whitepaper-c770f8c.txt
-Source2: openssl-rhel-bdd048e929dcfcf2f046d74e812e0e3d5fc58504.tar.xz
+Source2: openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
+Source3: softfloat-%{softfloat_version}.tar.xz
+Source4: edk2-platforms-b36fe8bc9b68.tar.xz
+Source5: jansson-2.13.1.tar.bz2
 
-Source10: edk2-aarch64-verbose.json
-Source11: edk2-aarch64.json
-Source12: edk2-ovmf-sb.json
-Source13: edk2-ovmf.json
-Source14: edk2-ovmf-cc.json
-Source15: edk2-ovmf-amdsev.json
-Source16: edk2-ovmf-inteltdx.json
+# json description files
+Source10: 50-edk2-aarch64.json
+Source11: 51-edk2-aarch64-verbose.json
 
-# Fedora specific sources
-Source50: softfloat-%{softfloat_version}.tar.xz
-Source55: 40-edk2-ovmf-ia32-sb-enrolled.json
-Source56: 50-edk2-ovmf-ia32-sb.json
-Source57: 60-edk2-ovmf-ia32.json
-Source58: edk2-ovmf-nosb.json
-Source59: 70-edk2-arm-verbose.json
-Source60: edk2-microvm.json
+Source20: 50-edk2-arm-verbose.json
+
+Source30: 30-edk2-ovmf-ia32-sb-enrolled.json
+Source31: 40-edk2-ovmf-ia32-sb.json
+Source32: 50-edk2-ovmf-ia32-nosb.json
+
+Source40: 30-edk2-ovmf-x64-sb-enrolled.json
+Source41: 40-edk2-ovmf-x64-sb.json
+Source42: 50-edk2-ovmf-x64-microvm.json
+Source43: 50-edk2-ovmf-x64-nosb.json
+Source44: 60-edk2-ovmf-x64-amdsev.json
+Source45: 60-edk2-ovmf-x64-inteltdx.json
+
+# https://gitlab.com/kraxel/edk2-build-config
+Source80: edk2-build.py
+Source81: edk2-build.fedora
+Source82: edk2-build.fedora.platforms
+Source83: edk2-build.rhel-9
+
+Source90: DBXUpdate-20200729.x64.bin
 
 Patch0001: 0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch
 Patch0002: 0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch
-Patch0003: 0003-OvmfPkg-increase-max-debug-message-length-to-512-RHE.patch
-Patch0004: 0004-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch
-Patch0005: 0005-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
-Patch0006: 0006-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
-Patch0007: 0007-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
-Patch0008: 0008-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch
-Patch0009: 0009-ArmPlatformPkg-introduce-fixed-PCD-for-early-hello-m.patch
-Patch0010: 0010-ArmPlatformPkg-PrePeiCore-write-early-hello-message-.patch
-Patch0011: 0011-ArmVirtPkg-set-early-hello-message-RH-only.patch
-Patch0012: 0012-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
-Patch0013: 0013-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
-Patch0014: 0014-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
-Patch0015: 0015-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
-Patch0016: 0016-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
-Patch0017: 0017-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
-Patch0018: 0018-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
-Patch0019: 0019-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
-Patch0020: 0020-Tweak-the-tools_def-to-support-cross-compiling.patch
-Patch0021: 0021-tools_def-add-fno-omit-frame-pointer-to-GCC48_-IA32-.patch
+#Patch0003: 0003-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch
+Patch0004: 0004-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
+Patch0005: 0005-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
+Patch0006: 0006-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
+Patch0007: 0007-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+Patch0008: 0008-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+Patch0009: 0009-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+Patch0010: 0010-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+Patch0011: 0011-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+Patch0012: 0012-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
+Patch0013: 0013-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
+Patch0014: 0014-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
+Patch0015: 0015-Tweak-the-tools_def-to-support-cross-compiling.patch
+Patch0016: 0016-tools_def-add-fno-omit-frame-pointer-to-GCC48_-IA32-.patch
+Patch0017: 0017-Revert-ArmVirtPkg-make-EFI_LOADER_DATA-non-executabl.patch
+Patch0018: 0018-Revert-OvmfPkg-PlatformDxe-Handle-all-requests-in-Ex.patch
+Patch0019: 0019-OvmfPkg-SmbiosPlatformDxe-use-PcdFirmware.patch
+Patch0020: 0020-OvmfPkg-PlatformPei-AmdSev-stop-using-mPlatformInfoH.patch
+Patch0021: 0021-OvmfPkg-PlatformPei-PeiFv-stop-using-mPlatformInfoHo.patch
+Patch0022: 0022-OvmfPkg-PlatformPei-Q35-SMM-helpers-stop-using-mPlat.patch
+Patch0023: 0023-OvmfPkg-PlatformPei-PeiMemory-stop-using-mPlatformIn.patch
+Patch0024: 0024-OvmfPkg-PlatformPei-MemTypeInfo-stop-using-mPlatform.patch
+Patch0025: 0025-OvmfPkg-PlatformPei-NoExec-stop-using-mPlatformInfoH.patch
+Patch0026: 0026-OvmfPkg-PlatformPei-Verification-stop-using-mPlatfor.patch
+Patch0027: 0027-OvmfPkg-PlatformPei-remove-mPlatformInfoHob.patch
+Patch0028: 0028-OvmfPkg-PlatformPei-remove-mFeatureControlValue.patch
+Patch0029: 0029-OvmfPkg-DebugLibIoPort-use-Rom-version-for-PEI.patch
+Patch0030: 0030-OvmfPkg-QemuFwCfgLib-rewrite-fw_cfg-probe.patch
+Patch0031: 0031-OvmfPkg-QemuFwCfgLib-remove-mQemuFwCfgSupported-mQem.patch
+Patch0032: 0032-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch
+Patch0033: 0033-ArmVirtPkg-ArmVirtQemu-Avoid-early-ID-map-on-Thunder.patch
+Patch0034: 0034-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch
+
 
 # python3-devel and libuuid-devel are required for building tools.
 # python3-devel is also needed for varstore template generation and
@@ -94,6 +119,7 @@ BuildRequires:  python3-devel
 BuildRequires:  libuuid-devel
 BuildRequires:  /usr/bin/iasl
 BuildRequires:  binutils gcc git gcc-c++ make
+BuildRequires:  qemu-img
 
 %if %{build_ovmf}
 # Only OVMF includes 80x86 assembly files (*.nasm*).
@@ -107,7 +133,7 @@ BuildRequires:  xorriso
 
 # For generating the variable store template with the default certificates
 # enrolled.
-BuildRequires:  python3-virt-firmware
+BuildRequires:  python3-virt-firmware >= 1.7
 
 # endif build_ovmf
 %endif
@@ -192,6 +218,24 @@ BuildArch:      noarch
 EFI Development Kit II
 Open Virtual Machine Firmware (ia32)
 
+%package ovmf-xen
+Summary:        Open Virtual Machine Firmware, Xen build
+License:        BSD-2-Clause-Patent and OpenSSL
+Provides:       bundled(openssl)
+BuildArch:      noarch
+%description ovmf-xen
+EFI Development Kit II
+Open Virtual Machine Firmware (Xen build)
+
+%package ovmf-experimental
+Summary:        Open Virtual Machine Firmware, experimental builds
+License:        BSD-2-Clause-Patent and OpenSSL
+Provides:       bundled(openssl)
+BuildArch:      noarch
+%description ovmf-experimental
+EFI Development Kit II
+Open Virtual Machine Firmware (experimental builds)
+
 %package arm
 Summary:        ARM Virtual Machine Firmware
 BuildArch:      noarch
@@ -200,6 +244,14 @@ License:        BSD-2-Clause-Patent and OpenSSL
 EFI Development Kit II
 ARMv7 UEFI Firmware
 
+%package ext4
+Summary:        Ext4 filesystem driver
+License:        BSD-2-Clause-Patent and OpenSSL
+BuildArch:      noarch
+%description ext4
+EFI Development Kit II
+Ext4 filesystem driver
+
 %package tools-python
 Summary:        EFI Development Kit II Tools
 Requires:       python3
@@ -226,61 +278,25 @@ git config am.keepcr true
 %autosetup -T -D -n edk2-%{GITCOMMIT} -S git_am
 
 cp -a -- %{SOURCE1} .
-cp -a -- %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} .
-cp -a -- %{SOURCE14} %{SOURCE15} %{SOURCE16} .
 tar -C CryptoPkg/Library/OpensslLib -a -f %{SOURCE2} -x
+# extract softfloat into place
+tar -xf %{SOURCE3} --strip-components=1 --directory ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3/
+tar -xf %{SOURCE4} --strip-components=1 "*/Drivers" "*/Features" "*/Platform" "*/Silicon"
+tar -xf %{SOURCE5} --strip-components=1 --directory RedfishPkg/Library/JsonLib/jansson
 
 # Done by %setup, but we do not use it for the auxiliary tarballs
 chmod -Rf a+rX,u+w,g-w,o-w .
 
-# extract softfloat into place
-tar -xf %{SOURCE50} --strip-components=1 --directory ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3/
-
+cp -a -- \
+   %{SOURCE10} %{SOURCE11} \
+   %{SOURCE20} \
+   %{SOURCE30} %{SOURCE31} %{SOURCE32} \
+   %{SOURCE40} %{SOURCE41} %{SOURCE42} %{SOURCE43} %{SOURCE44} %{SOURCE45} \
+   %{SOURCE80} %{SOURCE81} %{SOURCE82} %{SOURCE83} \
+   %{SOURCE90} \
+   .
 
 %build
-export PYTHON_COMMAND=%{__python3}
-source ./edksetup.sh
-%make_build -C "$EDK_TOOLS_PATH" \
-  EXTRA_OPTFLAGS="%{optflags}" \
-  EXTRA_LDFLAGS="%{__global_ldflags}"
-
-SMP_MFLAGS="%{?_smp_mflags}"
-if [[ x"$SMP_MFLAGS" = x-j* ]]; then
-        CC_FLAGS="$CC_FLAGS -n ${SMP_MFLAGS#-j}"
-elif [ -n "%{?jobs}" ]; then
-        CC_FLAGS="$CC_FLAGS -n %{?jobs}"
-fi
-
-CC_FLAGS="$CC_FLAGS --cmd-len=65536 -t %{TOOLCHAIN} -b DEBUG --hash"
-CC_FLAGS="$CC_FLAGS -D NETWORK_IP6_ENABLE"
-CC_FLAGS="$CC_FLAGS -D NETWORK_HTTP_BOOT_ENABLE -D NETWORK_TLS_ENABLE"
-CC_FLAGS="$CC_FLAGS -D TPM2_ENABLE"
-CC_FLAGS="$CC_FLAGS -D TPM1_ENABLE"
-
-OVMF_FLAGS="${CC_FLAGS}"
-%if %{defined rhel}
-OVMF_FLAGS="${OVMF_FLAGS} -D FD_SIZE_4MB"
-OVMF_FLAGS="${OVMF_FLAGS} -D PVSCSI_ENABLE=FALSE -D MPT_SCSI_ENABLE=FALSE"
-%else
-OVMF_FLAGS="${OVMF_FLAGS} -D FD_SIZE_2MB"
-%endif
-
-OVMF_SB_FLAGS="${OVMF_FLAGS}"
-OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D SECURE_BOOT_ENABLE"
-OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D SMM_REQUIRE"
-OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D EXCLUDE_SHELL_FROM_FD"
-
-%if %{disable_werror}
-sed -i -e 's/-Werror//' Conf/tools_def.txt
-%endif
-
-
-%if %{cross}
-export GCC5_IA32_PREFIX="x86_64-linux-gnu-"
-export GCC5_X64_PREFIX="x86_64-linux-gnu-"
-export GCC5_AARCH64_PREFIX="aarch64-linux-gnu-"
-export GCC5_ARM_PREFIX="arm-linux-gnu-"
-%endif
 
 build_iso() {
   dir="$1"
@@ -316,90 +332,63 @@ build_iso() {
     -o "$ISO_IMAGE" "$UEFI_SHELL_IMAGE"
 }
 
+export EXTRA_OPTFLAGS="%{optflags}"
+export EXTRA_LDFLAGS="%{__global_ldflags}"
+export RELEASE_DATE="$(echo %{GITDATE} | sed -e 's|\(....\)\(..\)\(..\)|\2/\3/\1|')"
+
+touch OvmfPkg/AmdSev/Grub/grub.efi   # dummy
 
 %if %{build_ovmf}
-# Build with neither SB nor SMM; include UEFI shell.
-build ${OVMF_FLAGS} -a X64 \
-  -p OvmfPkg/OvmfPkgX64.dsc
+%if %{defined rhel}
 
-# Build with SB and SMM; exclude UEFI shell.
-build ${OVMF_SB_FLAGS} -a IA32 -a X64 \
-  -p OvmfPkg/OvmfPkgIa32X64.dsc
+./edk2-build.py --config edk2-build.rhel-9 --silent --release-date "$RELEASE_DATE" -m ovmf
+virt-fw-vars --input   RHEL-9/ovmf/OVMF_VARS.fd \
+             --output  RHEL-9/ovmf/OVMF_VARS.secboot.fd \
+             --set-dbx DBXUpdate-20200729.x64.bin \
+             --enroll-redhat --secure-boot
+build_iso RHEL-9/ovmf
 
-# Build AmdSev and IntelTdx variants
-touch OvmfPkg/AmdSev/Grub/grub.efi   # dummy
-build ${OVMF_FLAGS} -a X64 \
-  -p OvmfPkg/AmdSev/AmdSevX64.dsc
-build ${OVMF_FLAGS} -a X64 \
-  -p OvmfPkg/IntelTdx/IntelTdxX64.dsc
+%else
 
-# Sanity check: the varstore templates must be identical.
-cmp Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
-  Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd
+./edk2-build.py --config edk2-build.fedora --silent --release-date "$RELEASE_DATE" -m ovmf
+./edk2-build.py --config edk2-build.fedora.platforms --silent -m x64
+virt-fw-vars --input   Fedora/ovmf/OVMF_VARS.fd \
+             --output  Fedora/ovmf/OVMF_VARS.secboot.fd \
+             --set-dbx DBXUpdate-20200729.x64.bin \
+             --enroll-redhat --secure-boot
+virt-fw-vars --input   Fedora/ovmf-4m/OVMF_VARS.fd \
+             --output  Fedora/ovmf-4m/OVMF_VARS.secboot.fd \
+             --set-dbx DBXUpdate-20200729.x64.bin \
+             --enroll-redhat --secure-boot
+virt-fw-vars --input   Fedora/ovmf-ia32/OVMF_VARS.fd \
+             --output  Fedora/ovmf-ia32/OVMF_VARS.secboot.fd \
+             --set-dbx DBXUpdate-20200729.x64.bin \
+             --enroll-redhat --secure-boot
+build_iso Fedora/ovmf
+build_iso Fedora/ovmf-ia32
 
-# Prepare an ISO image that boots the UEFI shell.
-build_iso Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64
-
-virt-fw-vars --input Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
-             --output Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \
+# experimental stateless builds
+virt-fw-vars --input   Fedora/experimental/OVMF.stateless.fd \
+             --output  Fedora/experimental/OVMF.stateless.secboot.fd \
+             --set-dbx DBXUpdate-20200729.x64.bin \
              --enroll-redhat --secure-boot
 
-# endif build_ovmf
+%endif
 %endif
 
 %if %{build_aarch64}
-# Build with a verbose debug mask first, and stash the binary.
-build ${CC_FLAGS} -a AARCH64 \
-  -p ArmVirtPkg/ArmVirtQemu.dsc \
-  -D DEBUG_PRINT_ERROR_LEVEL=0x8040004F
-cp -a Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
-  Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd
-
-# Rebuild with a silent (errors only) debug mask.
-build ${CC_FLAGS} -a AARCH64 \
-  -p ArmVirtPkg/ArmVirtQemu.dsc \
-  -D DEBUG_PRINT_ERROR_LEVEL=0x80000000
-# endif build_aarch64
+%if %{defined rhel}
+./edk2-build.py --config edk2-build.rhel-9 --silent --release-date "$RELEASE_DATE" -m armvirt
+%else
+./edk2-build.py --config edk2-build.fedora --silent --release-date "$RELEASE_DATE" -m armvirt
+./edk2-build.py --config edk2-build.fedora.platforms --silent -m aa64
 %endif
-
-
-%if %{defined fedora}
-%if %{build_ovmf}
-# build microvm
-build ${OVMF_FLAGS} -a X64 -p OvmfPkg/Microvm/MicrovmX64.dsc
-
-# build ovmf-ia32
-mkdir -p ovmf-ia32
-build ${OVMF_FLAGS} -a IA32 -p OvmfPkg/OvmfPkgIa32.dsc
-cp Build/OvmfIa32/*/FV/OVMF_CODE*.fd ovmf-ia32/
-# cp VARS files from from ovmf/, which are all we need
-cp -a Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS*.fd ovmf-ia32
-rm -rf Build/OvmfIa32
-
-# build ovmf-ia32 with secure boot
-build ${OVMF_SB_FLAGS} -a IA32 -p OvmfPkg/OvmfPkgIa32.dsc
-cp Build/OvmfIa32/*/FV/OVMF_CODE.fd ovmf-ia32/OVMF_CODE.secboot.fd
-
-# build ovmf-ia32 shell iso with EnrollDefaultKeys
-build_iso Build/OvmfIa32/DEBUG_%{TOOLCHAIN}/IA32
-mv Build/OvmfIa32/DEBUG_%{TOOLCHAIN}/IA32/UefiShell.iso ovmf-ia32
-cp -a Build/OvmfIa32/DEBUG_%{TOOLCHAIN}/IA32/Shell.efi ovmf-ia32
-cp -a Build/OvmfIa32/DEBUG_%{TOOLCHAIN}/IA32/EnrollDefaultKeys.efi ovmf-ia32
-# endif build_ovmf
+for raw in */aarch64/*.raw; do
+    qcow2="${raw%.raw}.qcow2"
+    qemu-img convert -f raw -O qcow2 -o cluster_size=4096 -S 4096 "$raw" "$qcow2"
+done
 %endif
 
-# build ARMv7 firmware
-mkdir -p arm
-build ${CC_FLAGS} -a ARM -p ArmVirtPkg/ArmVirtQemu.dsc
-cp Build/ArmVirtQemu-ARM/DEBUG_*/FV/*.fd arm
-dd of="arm/QEMU_EFI-pflash.raw" if="/dev/zero" bs=1M count=64
-dd of="arm/QEMU_EFI-pflash.raw" if="arm/QEMU_EFI.fd" conv=notrunc
-dd of="arm/vars-template-pflash.raw" if="/dev/zero" bs=1M count=64
-
-# endif defined fedora
-%endif
-
-
 
 %install
 
@@ -422,131 +411,77 @@ install BaseTools/Conf/*.template \
 install BaseTools/Scripts/GccBase.lds \
         %{buildroot}%{_datadir}/%{name}/Scripts
 
+# install firmware images
+mkdir -p %{buildroot}%{_datadir}/%{name}
+%if %{defined rhel}
+cp -av RHEL-9/* %{buildroot}%{_datadir}/%{name}
+%else
+cp -av Fedora/* %{buildroot}%{_datadir}/%{name}
+%endif
+
 
 %if %{build_ovmf}
-mkdir -p \
-  %{buildroot}%{_datadir}/OVMF \
-  %{buildroot}%{_datadir}/%{name}/ovmf
 
-install -m 0644 Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
-  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.fd
-install -m 0644 Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
-  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
-install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
-  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.secboot.fd
-
-install -m 0644 Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
-  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_VARS.fd
-install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \
-  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_VARS.secboot.fd
-install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/UefiShell.iso \
-  %{buildroot}%{_datadir}/%{name}/ovmf/UefiShell.iso
-
-install -m 0644 Build/AmdSev/DEBUG_%{TOOLCHAIN}/FV/OVMF.fd \
-  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF.amdsev.fd
-install -m 0644 Build/IntelTdx/DEBUG_%{TOOLCHAIN}/FV/OVMF.fd \
-  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF.inteltdx.fd
-
-ln -s ../%{name}/ovmf/OVMF_CODE.fd         %{buildroot}%{_datadir}/OVMF
+# compat symlinks
+mkdir -p %{buildroot}%{_datadir}/OVMF
+ln -s ../%{name}/ovmf/OVMF_CODE.fd         %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/OVMF_CODE.secboot.fd %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/OVMF_VARS.fd         %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/OVMF_VARS.secboot.fd %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/UefiShell.iso        %{buildroot}%{_datadir}/OVMF/
+ln -s OVMF_CODE.fd %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
 
-install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/Shell.efi \
-  %{buildroot}%{_datadir}/%{name}/ovmf/Shell.efi
-install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/EnrollDefaultKeys.efi \
-  %{buildroot}%{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi
+# json description files
+mkdir -p %{buildroot}%{_datadir}/qemu/firmware
+install -m 0644 \
+        30-edk2-ovmf-x64-sb-enrolled.json \
+        40-edk2-ovmf-x64-sb.json \
+        50-edk2-ovmf-x64-nosb.json \
+        60-edk2-ovmf-x64-amdsev.json \
+        60-edk2-ovmf-x64-inteltdx.json \
+        %{buildroot}%{_datadir}/qemu/firmware
+%if %{defined fedora}
+install -m 0644 \
+        50-edk2-ovmf-x64-microvm.json \
+        30-edk2-ovmf-ia32-sb-enrolled.json \
+        40-edk2-ovmf-ia32-sb.json \
+        50-edk2-ovmf-ia32-nosb.json \
+        %{buildroot}%{_datadir}/qemu/firmware
+%endif
 
-install -m 0644 edk2-ovmf-sb.json \
-  %{buildroot}%{_datadir}/qemu/firmware/40-edk2-ovmf-sb.json
-install -m 0644 edk2-ovmf.json \
-  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf.json
-install -m 0644 edk2-ovmf-cc.json \
-  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf-cc.json
-install -m 0644 edk2-ovmf-amdsev.json \
-  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf-amdsev.json
-install -m 0644 edk2-ovmf-inteltdx.json \
-  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf-inteltdx.json
 # endif build_ovmf
 %endif
 
-mkdir -p %{buildroot}%{_datadir}/AAVMF
 %if %{build_aarch64}
-mkdir -p %{buildroot}%{_datadir}/%{name}/aarch64
-
-# Pad and install the verbose binary.
-cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd \
-  /dev/zero \
-| head -c 64m \
-  > %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.raw
-
-# Pad and install the silent (default) binary.
-cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
-  /dev/zero \
-| head -c 64m \
-  > %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.raw
-
-# Create varstore template.
-cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_VARS.fd \
-  /dev/zero \
-| head -c 64m \
-  > %{buildroot}%{_datadir}/%{name}/aarch64/vars-template-pflash.raw
 
+# compat symlinks
+mkdir -p %{buildroot}%{_datadir}/AAVMF
 ln -s ../%{name}/aarch64/QEMU_EFI-pflash.raw \
   %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
 ln -s ../%{name}/aarch64/QEMU_EFI-silent-pflash.raw \
   %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.fd
 ln -s ../%{name}/aarch64/vars-template-pflash.raw \
   %{buildroot}%{_datadir}/AAVMF/AAVMF_VARS.fd
+%if %{defined fedora}
+ln -s ../%{name}/arm/QEMU_EFI-pflash.raw \
+   %{buildroot}%{_datadir}/AAVMF/AAVMF32_CODE.fd
+%endif
 
-chmod 0644 -- %{buildroot}%{_datadir}/AAVMF/AAVMF_*.fd
+# json description files
+install -m 0644 \
+        50-edk2-aarch64.json \
+        51-edk2-aarch64-verbose.json \
+        %{buildroot}%{_datadir}/qemu/firmware
+%if %{defined fedora}
+install -m 0644 \
+        50-edk2-arm-verbose.json \
+        %{buildroot}%{_datadir}/qemu/firmware
+%endif
 
-install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd \
-  %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI.fd
-install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
-  %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd
-install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_VARS.fd \
-  %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_VARS.fd
-
-install -m 0644 edk2-aarch64.json \
-  %{buildroot}%{_datadir}/qemu/firmware/60-edk2-aarch64.json
-install -m 0644 edk2-aarch64-verbose.json \
-  %{buildroot}%{_datadir}/qemu/firmware/70-edk2-aarch64-verbose.json
 # endif build_aarch64
 %endif
 
-
 %if %{defined fedora}
-%if %{build_ovmf}
-# install microvm
-install -m 0644 Build/MicrovmX64/DEBUG_%{TOOLCHAIN}/FV/MICROVM.fd \
-  %{buildroot}%{_datadir}/%{name}/ovmf/MICROVM.fd
-install -p -m 0644 %{_sourcedir}/edk2-microvm.json \
-  %{buildroot}%{_datadir}/qemu/firmware/60-edk2-ovmf-microvm.json
-
-# Install extra x86_64 json files
-install -p -m 0644 %{_sourcedir}/edk2-ovmf-nosb.json \
-  %{buildroot}%{_datadir}/qemu/firmware/60-edk2-ovmf-nosb.json
-
-
-# install ia32
-cp -a ovmf-ia32 %{buildroot}%{_datadir}/%{name}
-
-for f in %{_sourcedir}/*edk2-ovmf-ia32*.json; do
-    install -pm 644 $f %{buildroot}/%{_datadir}/qemu/firmware
-done
-# endif build_ovmf
-%endif
-
-# install arm32
-cp -a arm %{buildroot}%{_datadir}/%{name}
-ln -sf ../%{name}/arm/QEMU_EFI-pflash.raw          %{buildroot}%{_datadir}/AAVMF/AAVMF32_CODE.fd
-
-for f in %{_sourcedir}/*edk2-arm-*.json; do
-    install -pm 644 $f %{buildroot}/%{_datadir}/qemu/firmware
-done
-
 
 # edk2-tools-python install
 cp -R BaseTools/Source/Python %{buildroot}%{_datadir}/%{name}/Python
@@ -562,17 +497,13 @@ done
 %py_byte_compile %{python3} %{buildroot}%{_datadir}/edk2/Python
 %endif
 
-# endif defined fedora
 %endif
 
-
-
 %check
-%if %{build_ovmf}
-virt-fw-vars --input Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \
-             --print | grep "SecureBootEnable.*ON"
-# endif build_ovmf
-%endif
+for file in %{buildroot}%{_datadir}/%{name}/*/*VARS.secboot*; do
+    test -f "$file" || continue
+    virt-fw-vars --input $file --print | grep "SecureBootEnable.*ON" || exit 1
+done
 
 %global common_files \
   %%license License.txt License.OvmfPkg.txt License-History.txt LICENSE.openssl \
@@ -586,6 +517,11 @@ virt-fw-vars --input Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \
 %doc OvmfPkg/README
 %doc ovmf-whitepaper-c770f8c.txt
 %dir %{_datadir}/OVMF/
+%{_datadir}/OVMF/OVMF_CODE.fd
+%{_datadir}/OVMF/OVMF_CODE.secboot.fd
+%{_datadir}/OVMF/OVMF_VARS.fd
+%{_datadir}/OVMF/OVMF_VARS.secboot.fd
+%{_datadir}/OVMF/UefiShell.iso
 %dir %{_datadir}/%{name}/ovmf/
 %{_datadir}/%{name}/ovmf/OVMF_CODE.fd
 %{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
@@ -595,22 +531,21 @@ virt-fw-vars --input Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \
 %{_datadir}/%{name}/ovmf/OVMF.amdsev.fd
 %{_datadir}/%{name}/ovmf/OVMF.inteltdx.fd
 %{_datadir}/%{name}/ovmf/UefiShell.iso
-%{_datadir}/OVMF/OVMF_CODE.fd
-%{_datadir}/OVMF/OVMF_CODE.secboot.fd
-%{_datadir}/OVMF/OVMF_VARS.fd
-%{_datadir}/OVMF/OVMF_VARS.secboot.fd
-%{_datadir}/OVMF/UefiShell.iso
 %{_datadir}/%{name}/ovmf/Shell.efi
 %{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi
-%{_datadir}/qemu/firmware/40-edk2-ovmf-sb.json
-%{_datadir}/qemu/firmware/50-edk2-ovmf-cc.json
-%{_datadir}/qemu/firmware/50-edk2-ovmf-amdsev.json
-%{_datadir}/qemu/firmware/50-edk2-ovmf-inteltdx.json
-%{_datadir}/qemu/firmware/50-edk2-ovmf.json
+%{_datadir}/qemu/firmware/30-edk2-ovmf-x64-sb-enrolled.json
+%{_datadir}/qemu/firmware/40-edk2-ovmf-x64-sb.json
+%{_datadir}/qemu/firmware/50-edk2-ovmf-x64-nosb.json
+%{_datadir}/qemu/firmware/60-edk2-ovmf-x64-amdsev.json
+%{_datadir}/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
 %if %{defined fedora}
 %{_datadir}/%{name}/ovmf/MICROVM.fd
-%{_datadir}/qemu/firmware/60-edk2-ovmf-nosb.json
-%{_datadir}/qemu/firmware/60-edk2-ovmf-microvm.json
+%{_datadir}/qemu/firmware/50-edk2-ovmf-x64-microvm.json
+%dir %{_datadir}/%{name}/ovmf-4m/
+%{_datadir}/%{name}/ovmf-4m/OVMF_CODE.fd
+%{_datadir}/%{name}/ovmf-4m/OVMF_CODE.secboot.fd
+%{_datadir}/%{name}/ovmf-4m/OVMF_VARS.fd
+%{_datadir}/%{name}/ovmf-4m/OVMF_VARS.secboot.fd
 %endif
 # endif build_ovmf
 %endif
@@ -619,18 +554,18 @@ virt-fw-vars --input Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \
 %files aarch64
 %common_files
 %dir %{_datadir}/AAVMF/
-%dir %{_datadir}/%{name}/aarch64/
-%{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.raw
-%{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.raw
-%{_datadir}/%{name}/aarch64/vars-template-pflash.raw
 %{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
 %{_datadir}/AAVMF/AAVMF_CODE.fd
 %{_datadir}/AAVMF/AAVMF_VARS.fd
+%dir %{_datadir}/%{name}/aarch64/
+%{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.*
+%{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.*
+%{_datadir}/%{name}/aarch64/vars-template-pflash.*
 %{_datadir}/%{name}/aarch64/QEMU_EFI.fd
 %{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd
 %{_datadir}/%{name}/aarch64/QEMU_VARS.fd
-%{_datadir}/qemu/firmware/60-edk2-aarch64.json
-%{_datadir}/qemu/firmware/70-edk2-aarch64-verbose.json
+%{_datadir}/qemu/firmware/50-edk2-aarch64.json
+%{_datadir}/qemu/firmware/51-edk2-aarch64-verbose.json
 # endif build_aarch64
 %endif
 
@@ -663,7 +598,6 @@ virt-fw-vars --input Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \
 %files ovmf-ia32
 %common_files
 %dir %{_datadir}/%{name}/ovmf-ia32
-%{_datadir}/%{name}/ovmf-ia32
 %{_datadir}/%{name}/ovmf-ia32/EnrollDefaultKeys.efi
 %{_datadir}/%{name}/ovmf-ia32/OVMF_CODE.fd
 %{_datadir}/%{name}/ovmf-ia32/OVMF_CODE.secboot.fd
@@ -671,21 +605,37 @@ virt-fw-vars --input Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \
 %{_datadir}/%{name}/ovmf-ia32/OVMF_VARS.secboot.fd
 %{_datadir}/%{name}/ovmf-ia32/Shell.efi
 %{_datadir}/%{name}/ovmf-ia32/UefiShell.iso
-%{_datadir}/qemu/firmware/40-edk2-ovmf-ia32-sb-enrolled.json
-%{_datadir}/qemu/firmware/50-edk2-ovmf-ia32-sb.json
-%{_datadir}/qemu/firmware/60-edk2-ovmf-ia32.json
+%{_datadir}/qemu/firmware/30-edk2-ovmf-ia32-sb-enrolled.json
+%{_datadir}/qemu/firmware/40-edk2-ovmf-ia32-sb.json
+%{_datadir}/qemu/firmware/50-edk2-ovmf-ia32-nosb.json
+
+%files ovmf-experimental
+%common_files
+%dir %{_datadir}/%{name}/experimental
+%{_datadir}/%{name}/experimental/*.fd
+%{_datadir}/%{name}/experimental/*.raw
+
+%files ovmf-xen
+%common_files
+%dir %{_datadir}/%{name}/xen
+%{_datadir}/%{name}/xen/*.fd
 %endif
 
 %files arm
 %common_files
-%dir %{_datadir}/%{name}/arm
+%dir %{_datadir}/AAVMF/
 %{_datadir}/AAVMF/AAVMF32_CODE.fd
-%{_datadir}/%{name}/arm
+%dir %{_datadir}/%{name}/arm
 %{_datadir}/%{name}/arm/QEMU_EFI-pflash.raw
 %{_datadir}/%{name}/arm/QEMU_EFI.fd
 %{_datadir}/%{name}/arm/QEMU_VARS.fd
 %{_datadir}/%{name}/arm/vars-template-pflash.raw
-%{_datadir}/qemu/firmware/70-edk2-arm-verbose.json
+%{_datadir}/qemu/firmware/50-edk2-arm-verbose.json
+
+%files ext4
+%common_files
+%dir %{_datadir}/%{name}/drivers
+%{_datadir}/%{name}/drivers/ext4*.efi
 
 
 %files tools-python
@@ -707,6 +657,57 @@ virt-fw-vars --input Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \
 
 
 %changelog
+* Fri Feb 17 2023 Gerd Hoffmann <kraxel@redhat.com>
+- add sub-package with xen build (resolves: rhbz#2170730)
+
+* Sat Feb 11 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-13
+- update openssl (CVE-2023-0286, CVE-2023-0215, CVE-2022-4450, CVE-2022-4304).
+
+* Wed Feb 08 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-12
+- cherry-pick aarch64 bugfixes.
+- set firmware build release date.
+- add ext4 sub-package.
+
+* Fri Jan 06 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-10
+- add experimental builds with strict nx checking.
+
+* Mon Jan 02 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-9
+- revert 'make files sparse again' (resolves: rhbz#2155673).
+- pick up compiler + linker flags from rpm
+
+* Tue Dec 20 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-8
+- make files sparse again
+
+* Thu Dec 15 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-7
+- backport https://github.com/tianocore/edk2/pull/3770
+
+* Mon Dec 12 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-6
+- fix ovmf platform config (revert broken commit).
+- show version information in smbios (backport).
+
+* Mon Dec 05 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-5
+- rename *.json files to be more consistent.
+- build script update
+
+* Fri Dec 02 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-4
+- apply dbx updates
+
+* Tue Nov 29 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-3
+- fix build script
+
+* Mon Nov 28 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-2
+- add workaround for broken grub
+
+* Tue Sep 20 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220826gitba0e0e4c6a17-1
+- update edk2 to 2022-08 stable tag.
+- update openssl bundle to rhel-8.7 level.
+- add stdvga fix.
+- add 4MB firmware builds.
+
+* Thu Aug 18 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-4
+- comment out patch #4 (bug 2116534 workaround)
+- comment out patch #12 (bug 2114858 workaround)
+
 * Fri Jun 10 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-3
 - swap stack fix patch.
 

make-tarball.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# args
+repo="${1%/}"
+ref="${2-HEAD}"
+
+# check
+if test ! -d "${repo}/.git"; then
+    echo "usage: $0 <repodir> [ <ref> ]"
+    exit 1
+fi
+
+# get + print info
+commit=$(cd $repo; git show --pretty='format:%h' $ref | head -1)
+date=$(cd $repo; git show --pretty='format:%cs' $ref | head -1 | tr -d '-')
+echo "# $repo $ref  ->  commit $commit - date $date"
+
+# create tarball
+name="${repo##*/}"
+file="${name}-${commit}.tar.xz"
+(cd $repo; git archive --format=tar --prefix=${name}-${commit}/ ${commit}) \
+    | xz -9ev > "$file"
+echo "# $file written"

sources

@@ -1,3 +1,5 @@
 SHA512 (softfloat-20180726-gitb64af41.tar.xz) = f079debd1bfcc0fe64329a8947b0689ef49246793edcdd28a2879f6550c652b0cf0f53ac4f6f5ab61ac4f7933972e0019d0ab63eb9931b6884c2909f3a5ead30
-SHA512 (openssl-rhel-bdd048e929dcfcf2f046d74e812e0e3d5fc58504.tar.xz) = d6c0be28cefaa7993f479aecf45f5523e10aab388a92c3e4add55d6ff8483cc01fba367be62f6e9a23bfad7b46986befd3eca0d0e89b984049719645e37d52df
-SHA512 (edk2-16779ede2d36.tar.xz) = ab4fe5208506d93796db45cdcc63b95d99ebeb34e4783ede9b4bb411befe0dd09adf64b2cdf390180bc5c007ac5cde3b9692d4bf4c536261631ecccf0e2778c9
+SHA512 (edk2-fff6d81270b5.tar.xz) = 3b215ae200c6be355aa937ef933cc636867416a24e159a83852d7972b7b70f712df3773c429ed5ac5cc6e300fd6f733d6a5bc1b54a06fc0bc3f98ea14d7cb068
+SHA512 (edk2-platforms-b36fe8bc9b68.tar.xz) = 5d10c72700cf6b63e6b59ca8951fb343881fb01b97ec054804fd33385fe837df80a725fe73336d93cc6957414d865e1648a5daaea8f31891b5f2b217d1da774b
+SHA512 (jansson-2.13.1.tar.bz2) = 057f0eda43e4162569888d739f4d78d1d02fce8359400d8f66fdc6e440b0405cb457e1126820dc8ce51e9c4a7f4b7effc640caf1d54307c78c0c47c3fc093011
+SHA512 (openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz) = 418f8476e80c79e76ba2225670075f95ae75065b23cad9180daac5149e02f11deaa6551e1f70d04fe4b275b0e5f2756f890738693516a737d6f84ee8cd839019