disable EFI_MEMORY_ATTRIBUTE_PROTO (workaround shim bug)

[skip changelog]

.gitignore

@@ -7,3 +7,5 @@
 /qemu-ovmf-secureboot-20200228-gitc3e16b3.tar.xz
 /openssl-rhel-a75722161d20fd632f8875585d3aa066ec5fea93.tar.xz
 /openssl-rhel-bdd048e929dcfcf2f046d74e812e0e3d5fc58504.tar.xz
+/openssl-rhel-740e53ace8f6771c205bf84780e26bcd7a3275df.tar.xz
+/jansson-2.13.1.tar.bz2

0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch

@@ -1,7 +1,7 @@
-From a5e7f28a51b616d79bf3e80ce185260a75c20caa Mon Sep 17 00:00:00 2001
+From 85b2dc9bb820a749e95136bf7bdd0f6c49e8389d Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Thu, 4 Jun 2020 13:34:12 +0200
-Subject: [PATCH 01/21] BaseTools: do not build BrotliCompress (RH only)
+Subject: [PATCH 01/14] BaseTools: do not build BrotliCompress (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -27,10 +27,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  1 file changed, 1 deletion(-)
 
 diff --git a/BaseTools/Source/C/GNUmakefile b/BaseTools/Source/C/GNUmakefile
-index 8c191e0c3817..3eae824a1c31 100644
+index 5275f657efe8..39d719975309 100644
 --- a/BaseTools/Source/C/GNUmakefile
 +++ b/BaseTools/Source/C/GNUmakefile
-@@ -48,7 +48,6 @@ all: makerootdir subdirs
+@@ -51,7 +51,6 @@ all: makerootdir subdirs
  LIBRARIES = Common
  VFRAUTOGEN = VfrCompile/VfrLexer.h
  APPLICATIONS = \
@@ -39,5 +39,5 @@ index 8c191e0c3817..3eae824a1c31 100644
    EfiRom \
    GenFfs \
 -- 
-2.35.3
+2.40.1
 

0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch

@@ -1,7 +1,7 @@
-From 77bc79dfc2d70a7ffe81ab4c764bb5b503e34b07 Mon Sep 17 00:00:00 2001
+From f1996ce088098f8479eec2f0739978b9de7840fc Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Thu, 4 Jun 2020 13:39:08 +0200
-Subject: [PATCH 02/21] MdeModulePkg: remove package-private Brotli include
+Subject: [PATCH 02/14] MdeModulePkg: remove package-private Brotli include
  path (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -32,12 +32,12 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  1 file changed, 3 deletions(-)
 
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 2bcb9f9453af..f549276b8061 100644
+index 95dd077e19b3..1609b6d9c29e 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
-@@ -24,9 +24,6 @@ [Defines]
- [Includes]
+@@ -26,9 +26,6 @@ [Includes]
    Include
+   Test/Mock/Include
  
 -[Includes.Common.Private]
 -  Library/BrotliCustomDecompressLib/brotli/c/include
@@ -46,5 +46,5 @@ index 2bcb9f9453af..f549276b8061 100644
    ##  @libraryclass  Defines a set of methods to reset whole system.
    ResetSystemLib|Include/Library/ResetSystemLib.h
 -- 
-2.35.3
+2.40.1
 

0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch

@@ -1,7 +1,7 @@
-From 8fd6e63635f50b2dc9e950056f17c1688107647d Mon Sep 17 00:00:00 2001
+From 212665c3bc7c480d6dfa7df52c50457e83af149a Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Tue, 25 Feb 2014 22:40:01 +0100
-Subject: [PATCH 05/21] MdeModulePkg: TerminalDxe: set xterm resolution on mode
+Subject: [PATCH 03/14] MdeModulePkg: TerminalDxe: set xterm resolution on mode
  change (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -87,10 +87,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  3 files changed, 35 insertions(+)
 
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index f549276b8061..1415766054be 100644
+index 1609b6d9c29e..c0d376bed1f0 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
-@@ -2092,6 +2092,10 @@ [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
+@@ -2127,6 +2127,10 @@ [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
    # @Prompt The shared bit mask when Intel Tdx is enabled.
    gEfiMdeModulePkgTokenSpaceGuid.PcdTdxSharedBitMask|0x0|UINT64|0x10000025
  
@@ -176,5 +176,5 @@ index 7809869e7d49..496849458db4 100644
  
    Status = This->ClearScreen (This);
 -- 
-2.35.3
+2.40.1
 

0003-OvmfPkg-increase-max-debug-message-length-to-512-RHE.patch

@@ -1,83 +0,0 @@
-From 967e66ce4fbce81338ed4cdd9131a4a25a24e461 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Thu, 20 Feb 2014 22:54:45 +0100
-Subject: [PATCH 03/21] OvmfPkg: increase max debug message length to 512 (RHEL
- only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- no change
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- trivial context difference due to upstream commit 2fe5f2f52918
-  ("OvmfPkg/PlatformDebugLibIoPort: Add new APIs", 2019-04-02), resolved
-  by git-cherry-pick automatically
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- no changes
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
-  a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no changes
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- no changes
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- no changes
-
-Upstream prefers short debug messages (sometimes even limited to 80
-characters), but any line length under 512 characters is just unsuitable
-for effective debugging. (For example, config strings in HII routing,
-logged by the platform driver "OvmfPkg/PlatformDxe" on DEBUG_VERBOSE
-level, can be several hundred characters long.) 512 is an empirically good
-value.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit bfe568d18dba15602604f155982e3b73add63dfb)
-(cherry picked from commit 29435a32ec9428720c74c454ce9817662e601fb6)
-(cherry picked from commit 58e1d1ebb78bfdaf05f4c6e8abf8d4908dfa038a)
-(cherry picked from commit 1df2c822c996ad767f2f45570ab2686458f7604a)
-(cherry picked from commit 22c9b4e971c70c69b4adf8eb93133824ccb6426a)
-(cherry picked from commit a1260c9122c95bcbef1efc5eebe11902767813c2)
-(cherry picked from commit e949bab1268f83f0f5815a96cd1cb9dd3b21bfb5)
-(cherry picked from commit a95cff0b9573bf23699551beb4786383f697ff1e)
----
- OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c b/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c
-index 4e25f198aa76..640627f38b72 100644
---- a/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c
-+++ b/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c
-@@ -21,7 +21,7 @@
- //
- // Define the maximum debug and assert message length that this library supports
- //
--#define MAX_DEBUG_MESSAGE_LENGTH  0x100
-+#define MAX_DEBUG_MESSAGE_LENGTH  0x200
- 
- //
- // VA_LIST can not initialize to NULL for all compiler, so we use this to
--- 
-2.35.3
-

0004-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch

@@ -1,169 +0,0 @@
-From 8708aff7d939989ab52932c1329c81dfe86bdc61 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Tue, 25 Feb 2014 18:40:35 +0100
-Subject: [PATCH 04/21] MdeModulePkg: TerminalDxe: add other text resolutions
- (RHEL only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- no changes
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no changes
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- no change
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
-  a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- update commit message as requested in
-  <https://bugzilla.redhat.com/show_bug.cgi?id=1503316#c0>
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- no changes
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- adapt commit 0bc77c63de03 (code and commit message) to upstream commit
-  390b95a49c14 ("MdeModulePkg/TerminalDxe: Refine
-  InitializeTerminalConsoleTextMode", 2017-01-10).
-
-When the console output is multiplexed to several devices by
-ConSplitterDxe, then ConSplitterDxe builds an intersection of text modes
-supported by all console output devices.
-
-Two notable output devices are provided by:
-(1) MdeModulePkg/Universal/Console/GraphicsConsoleDxe,
-(2) MdeModulePkg/Universal/Console/TerminalDxe.
-
-GraphicsConsoleDxe supports four modes at most -- see
-InitializeGraphicsConsoleTextMode() and "mGraphicsConsoleModeData":
-
-(1a) 80x25 (required by the UEFI spec as mode 0),
-(1b) 80x50 (not necessarily supported, but if it is, then the UEFI spec
-     requires the driver to provide it as mode 1),
-(1c) 100x31 (corresponding to graphics resolution 800x600, which the UEFI
-     spec requires from all plug-in graphics devices),
-(1d) "full screen" resolution, derived form the underlying GOP's
-     horizontal and vertical resolutions with division by EFI_GLYPH_WIDTH
-     (8) and EFI_GLYPH_HEIGHT (19), respectively.
-
-The automatic "full screen resolution" makes GraphicsConsoleDxe's
-character console very flexible. However, TerminalDxe (which runs on
-serial ports) only provides the following fixed resolutions -- see
-InitializeTerminalConsoleTextMode() and "mTerminalConsoleModeData":
-
-(2a) 80x25 (required by the UEFI spec as mode 0),
-(2b) 80x50 (since the character resolution of a serial device cannot be
-     interrogated easily, this is added unconditionally as mode 1),
-(2c) 100x31 (since the character resolution of a serial device cannot be
-     interrogated easily, this is added unconditionally as mode 2).
-
-When ConSplitterDxe combines (1) and (2), multiplexing console output to
-both video output and serial terminal, the list of commonly supported text
-modes (ie. the "intersection") comprises:
-
-(3a) 80x25, unconditionally, from (1a) and (2a),
-(3b) 80x50, if the graphics console provides at least 640x950 pixel
-     resolution, from (1b) and (2b)
-(3c) 100x31, if the graphics device is a plug-in one (because in that case
-     800x600 is a mandated pixel resolution), from (1c) and (2c).
-
-Unfortunately, the "full screen resolution" (1d) of the GOP-based text
-console is not available in general.
-
-Mitigate this problem by extending "mTerminalConsoleModeData" with a
-handful of text resolutions that are derived from widespread maximal pixel
-resolutions. This way TerminalDxe won't cause ConSplitterDxe to filter out
-the most frequent (1d) values from the intersection, and eg. the MODE
-command in the UEFI shell will offer the "best" (ie. full screen)
-resolution too.
-
-Upstreaming efforts for this patch have been discontinued; it was clear
-from the off-list thread that consensus was impossible to reach.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit 99dc3720ac86059f60156197328cc433603c536e)
-(cherry picked from commit d2066c1748f885043026c51dec1bc8d6d406ae8f)
-(cherry picked from commit 1facdd58e946c584a3dc1e5be8f2f837b5a7c621)
-(cherry picked from commit 28faeb5f94b4866b9da16cf2a1e4e0fc09a26e37)
-(cherry picked from commit 4e4e15b80a5b2103eadd495ef4a830d46dd4ed51)
-(cherry picked from commit 12cb13a1da913912bd9148ce8f2353a75be77f18)
-(cherry picked from commit 82b9edc5fef3a07227a45059bbe821af7b9abd69)
----
- .../Universal/Console/TerminalDxe/Terminal.c  | 41 +++++++++++++++++--
- 1 file changed, 38 insertions(+), 3 deletions(-)
-
-diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.c b/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.c
-index e2d779c78378..f238c4103b3d 100644
---- a/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.c
-+++ b/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.c
-@@ -112,9 +112,44 @@ TERMINAL_DEV  mTerminalDevTemplate = {
- };
- 
- TERMINAL_CONSOLE_MODE_DATA  mTerminalConsoleModeData[] = {
--  { 80,  25 },
--  { 80,  50 },
--  { 100, 31 },
-+  { 80,   25  }, // from graphics resolution  640 x  480
-+  { 80,   50  }, // from graphics resolution  640 x  960
-+  { 100,  25  }, // from graphics resolution  800 x  480
-+  { 100,  31  }, // from graphics resolution  800 x  600
-+  { 104,  32  }, // from graphics resolution  832 x  624
-+  { 120,  33  }, // from graphics resolution  960 x  640
-+  { 128,  31  }, // from graphics resolution 1024 x  600
-+  { 128,  40  }, // from graphics resolution 1024 x  768
-+  { 144,  45  }, // from graphics resolution 1152 x  864
-+  { 144,  45  }, // from graphics resolution 1152 x  870
-+  { 160,  37  }, // from graphics resolution 1280 x  720
-+  { 160,  40  }, // from graphics resolution 1280 x  760
-+  { 160,  40  }, // from graphics resolution 1280 x  768
-+  { 160,  42  }, // from graphics resolution 1280 x  800
-+  { 160,  50  }, // from graphics resolution 1280 x  960
-+  { 160,  53  }, // from graphics resolution 1280 x 1024
-+  { 170,  40  }, // from graphics resolution 1360 x  768
-+  { 170,  40  }, // from graphics resolution 1366 x  768
-+  { 175,  55  }, // from graphics resolution 1400 x 1050
-+  { 180,  47  }, // from graphics resolution 1440 x  900
-+  { 200,  47  }, // from graphics resolution 1600 x  900
-+  { 200,  63  }, // from graphics resolution 1600 x 1200
-+  { 210,  55  }, // from graphics resolution 1680 x 1050
-+  { 240,  56  }, // from graphics resolution 1920 x 1080
-+  { 240,  63  }, // from graphics resolution 1920 x 1200
-+  { 240,  75  }, // from graphics resolution 1920 x 1440
-+  { 250,  105 }, // from graphics resolution 2000 x 2000
-+  { 256,  80  }, // from graphics resolution 2048 x 1536
-+  { 256,  107 }, // from graphics resolution 2048 x 2048
-+  { 320,  75  }, // from graphics resolution 2560 x 1440
-+  { 320,  84  }, // from graphics resolution 2560 x 1600
-+  { 320,  107 }, // from graphics resolution 2560 x 2048
-+  { 350,  110 }, // from graphics resolution 2800 x 2100
-+  { 400,  126 }, // from graphics resolution 3200 x 2400
-+  { 480,  113 }, // from graphics resolution 3840 x 2160
-+  { 512,  113 }, // from graphics resolution 4096 x 2160
-+  { 960,  227 }, // from graphics resolution 7680 x 4320
-+  { 1024, 227 }, // from graphics resolution 8192 x 4320
-   //
-   // New modes can be added here.
-   //
--- 
-2.35.3
-

0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch

@@ -1,7 +1,7 @@
-From e2aa9521a02cacb0ec147667d7bd87ccde2508db Mon Sep 17 00:00:00 2001
+From 677df60b929f97fde9e7d03dfe82b4bf593d5986 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 14 Oct 2015 15:59:06 +0200
-Subject: [PATCH 06/21] OvmfPkg: take PcdResizeXterm from the QEMU command line
+Subject: [PATCH 04/14] OvmfPkg: take PcdResizeXterm from the QEMU command line
  (RH only)
 
 edk2-stable202205 rebase
@@ -88,10 +88,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  9 files changed, 21 insertions(+)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index fc1fdb2e2297..ae23094ffc27 100644
+index b32049194d39..bff9f166219e 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -524,6 +524,7 @@ [PcdsFixedAtBuild]
+@@ -476,6 +476,7 @@ [PcdsFixedAtBuild]
  [PcdsDynamicDefault]
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -100,10 +100,10 @@ index fc1fdb2e2297..ae23094ffc27 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc
-index 92664f319be2..4aa54e4dc3fb 100644
+index 2a1139daaa19..1e61af6eeff6 100644
 --- a/OvmfPkg/CloudHv/CloudHvX64.dsc
 +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc
-@@ -574,6 +574,7 @@ [PcdsDynamicDefault]
+@@ -575,6 +575,7 @@ [PcdsDynamicDefault]
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -112,10 +112,10 @@ index 92664f319be2..4aa54e4dc3fb 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-index dd8d446f4a56..ec1aab6f0939 100644
+index d4403f11a7c6..86673d06ef2e 100644
 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
 +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-@@ -461,6 +461,7 @@ [PcdsDynamicDefault]
+@@ -473,6 +473,7 @@ [PcdsDynamicDefault]
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -124,10 +124,10 @@ index dd8d446f4a56..ec1aab6f0939 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
-index f8fc977cb205..4e5ab89c8f0d 100644
+index 5f671bc3840d..02c225f6d2a7 100644
 --- a/OvmfPkg/Microvm/MicrovmX64.dsc
 +++ b/OvmfPkg/Microvm/MicrovmX64.dsc
-@@ -557,6 +557,7 @@ [PcdsDynamicDefault]
+@@ -573,6 +573,7 @@ [PcdsDynamicDefault]
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -136,10 +136,10 @@ index f8fc977cb205..4e5ab89c8f0d 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index a9841cbfc3ca..b69e3c05a281 100644
+index e333b8b41803..f5390a30fb09 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -585,6 +585,7 @@ [PcdsDynamicDefault]
+@@ -595,6 +595,7 @@ [PcdsDynamicDefault]
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -148,10 +148,10 @@ index a9841cbfc3ca..b69e3c05a281 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index f7949780fa38..726011ec42a5 100644
+index 25974230a27e..c43fb2d39910 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -593,6 +593,7 @@ [PcdsDynamicDefault]
+@@ -603,6 +603,7 @@ [PcdsDynamicDefault]
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -160,10 +160,10 @@ index f7949780fa38..726011ec42a5 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 1448f925b782..ab2e31ea8f2b 100644
+index c1762ffca445..ce49a3d3a54d 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -612,6 +612,7 @@ [PcdsDynamicDefault]
+@@ -626,6 +626,7 @@ [PcdsDynamicDefault]
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -172,10 +172,10 @@ index 1448f925b782..ab2e31ea8f2b 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf
-index 00372fa0ebb5..2dfa357c384a 100644
+index 3934aeed9514..98123ec63b3d 100644
 --- a/OvmfPkg/PlatformPei/PlatformPei.inf
 +++ b/OvmfPkg/PlatformPei/PlatformPei.inf
-@@ -98,6 +98,7 @@ [Pcd]
+@@ -100,6 +100,7 @@ [Pcd]
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved
@@ -184,7 +184,7 @@ index 00372fa0ebb5..2dfa357c384a 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
    gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
 diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
-index f006755d5fdb..b8f56902512c 100644
+index c56247e294f2..5d7f50cc5876 100644
 --- a/OvmfPkg/PlatformPei/Platform.c
 +++ b/OvmfPkg/PlatformPei/Platform.c
 @@ -41,6 +41,18 @@
@@ -203,17 +203,17 @@ index f006755d5fdb..b8f56902512c 100644
 +            }                                                       \
 +          } while (0)
 +
- EFI_HOB_PLATFORM_INFO  mPlatformInfoHob = { 0 };
- 
  EFI_PEI_PPI_DESCRIPTOR  mPpiBootMode[] = {
-@@ -387,6 +399,7 @@ InitializePlatform (
-     MemTypeInfoInitialization ();
-     MemMapInitialization (&mPlatformInfoHob);
-     NoexecDxeInitialization ();
+   {
+     EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST,
+@@ -386,6 +398,7 @@ InitializePlatform (
+     MemTypeInfoInitialization (PlatformInfoHob);
+     MemMapInitialization (PlatformInfoHob);
+     NoexecDxeInitialization (PlatformInfoHob);
 +    UPDATE_BOOLEAN_PCD_FROM_FW_CFG (PcdResizeXterm);
    }
  
    InstallClearCacheCallback ();
 -- 
-2.36.1
+2.40.1
 

0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch

@@ -1,7 +1,7 @@
-From b991e60356f0b990792a8951f8856d6544a9cd9b Mon Sep 17 00:00:00 2001
+From ca84f8dd5a7653d2b884406f67f5e9d4bc136852 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Sun, 26 Jul 2015 08:02:50 +0000
-Subject: [PATCH 07/21] ArmVirtPkg: take PcdResizeXterm from the QEMU command
+Subject: [PATCH 05/14] ArmVirtPkg: take PcdResizeXterm from the QEMU command
  line (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -96,19 +96,19 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index aa0ce61630f7..7705bf391976 100644
+index 449e73b9e132..2ccbef41c23b 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -284,6 +284,8 @@ [PcdsDynamicDefault.common]
-   gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0
+@@ -307,6 +307,8 @@ [PcdsPatchableInModule]
+   gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0x0
  !endif
  
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
 +
  [PcdsDynamicHii]
-   gArmVirtTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gArmVirtVariableGuid|0x0|FALSE|NV,BS
+   gUefiOvmfPkgTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gOvmfVariableGuid|0x0|FALSE|NV,BS
  
-@@ -386,7 +388,10 @@ [Components.common]
+@@ -416,7 +418,10 @@ [Components.common]
    MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
    MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitterDxe.inf
    MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
@@ -200,5 +200,5 @@ index 000000000000..bfd3a6a535f9
 +  return RETURN_SUCCESS;
 +}
 -- 
-2.35.3
+2.40.1
 

0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 9fcfbf51e0a342172f316ae709311b4a6365b673 Mon Sep 17 00:00:00 2001
+From 447b5540fdc12ff4ca74dc2dd183149732075c18 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:45 +0100
-Subject: [PATCH 12/21] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
+Subject: [PATCH 06/14] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -65,10 +65,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index ae23094ffc27..ccc46c974b16 100644
+index bff9f166219e..14a5d10d2b67 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -476,7 +476,7 @@ [PcdsFixedAtBuild]
+@@ -426,7 +426,7 @@ [PcdsFixedAtBuild]
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -78,10 +78,10 @@ index ae23094ffc27..ccc46c974b16 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b69e3c05a281..bbe4e91037c2 100644
+index f5390a30fb09..62c68d99165d 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -525,7 +525,7 @@ [PcdsFixedAtBuild]
+@@ -535,7 +535,7 @@ [PcdsFixedAtBuild]
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -91,10 +91,10 @@ index b69e3c05a281..bbe4e91037c2 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 726011ec42a5..072f06c0a3ab 100644
+index c43fb2d39910..b03af9cacd2b 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -531,7 +531,7 @@ [PcdsFixedAtBuild]
+@@ -541,7 +541,7 @@ [PcdsFixedAtBuild]
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -104,10 +104,10 @@ index 726011ec42a5..072f06c0a3ab 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index ab2e31ea8f2b..46661408f97b 100644
+index ce49a3d3a54d..a9dad1b59ee8 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -548,7 +548,7 @@ [PcdsFixedAtBuild]
+@@ -562,7 +562,7 @@ [PcdsFixedAtBuild]
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -117,5 +117,5 @@ index ab2e31ea8f2b..46661408f97b 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 -- 
-2.35.3
+2.40.1
 

0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch

@@ -1,7 +1,7 @@
-From f577d3719babf7d2cf3bd8f4a404007236e19125 Mon Sep 17 00:00:00 2001
+From f0d8ef8071a0b20495a5a1dc3e6e49f8f145c503 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:46 +0100
-Subject: [PATCH 13/21] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
+Subject: [PATCH 07/14] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
  QemuVideoDxe/QemuRamfbDxe (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -82,10 +82,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 32 insertions(+), 8 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index ccc46c974b16..c66ad3af1a23 100644
+index 14a5d10d2b67..870c4bd890fe 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -726,8 +726,14 @@ [Components]
+@@ -684,8 +684,14 @@ [Components]
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
@@ -103,10 +103,10 @@ index ccc46c974b16..c66ad3af1a23 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index bbe4e91037c2..b37a5a6da948 100644
+index 62c68d99165d..d7bce8d40d26 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -830,9 +830,15 @@ [Components]
+@@ -841,9 +841,15 @@ [Components]
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
  !ifndef $(CSM_ENABLE)
@@ -125,10 +125,10 @@ index bbe4e91037c2..b37a5a6da948 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 072f06c0a3ab..b0e8c20e93d7 100644
+index b03af9cacd2b..8103d1d4882a 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -844,9 +844,15 @@ [Components.X64]
+@@ -855,9 +855,15 @@ [Components.X64]
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
  !ifndef $(CSM_ENABLE)
@@ -147,10 +147,10 @@ index 072f06c0a3ab..b0e8c20e93d7 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 46661408f97b..6211d5e934de 100644
+index a9dad1b59ee8..7fe23d9153fe 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -909,9 +909,15 @@ [Components]
+@@ -929,9 +929,15 @@ [Components]
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
  !ifndef $(CSM_ENABLE)
@@ -169,5 +169,5 @@ index 46661408f97b..6211d5e934de 100644
  
    #
 -- 
-2.35.3
+2.40.1
 

0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch

@@ -1,7 +1,7 @@
-From 4460b520c24a003b977dded58a0f62bf70a83c69 Mon Sep 17 00:00:00 2001
+From 461077f978edf909f0ef59c777c2d45ab7664526 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 27 Jan 2016 03:05:18 +0100
-Subject: [PATCH 14/21] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
+Subject: [PATCH 08/14] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
  QemuRamfbDxe (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -61,10 +61,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  2 files changed, 8 insertions(+), 2 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index ae35cc18008d..f30c1e622c30 100644
+index 2ccbef41c23b..bc097880f79f 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -511,7 +511,10 @@ [Components.common]
+@@ -544,7 +544,10 @@ [Components.common]
    #
    # Video support
    #
@@ -77,10 +77,10 @@ index ae35cc18008d..f30c1e622c30 100644
    OvmfPkg/PlatformDxe/Platform.inf
  
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 7f7d15d6eee3..14f7b29991bc 100644
+index 3cb9120e4e10..02877284bfa3 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -440,7 +440,10 @@ [Components.common]
+@@ -444,7 +444,10 @@ [Components.common]
    #
    # Video support
    #
@@ -93,5 +93,5 @@ index 7f7d15d6eee3..14f7b29991bc 100644
    OvmfPkg/PlatformDxe/Platform.inf
  
 -- 
-2.35.3
+2.40.1
 

0008-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch

@@ -1,172 +0,0 @@
-From 6c0b7391222b4d33dbcee952b0f785701031e972 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Tue, 4 Nov 2014 23:02:53 +0100
-Subject: [PATCH 08/21] OvmfPkg: allow exclusion of the shell from the firmware
- image (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- No manual / explicit code change is necessary, because the newly
-  inherited OvmfPkg/AmdSev platform already has its own BUILD_SHELL
-  build-time macro (feature test flag), with default value FALSE -- from
-  upstream commit b261a30c900a ("OvmfPkg/AmdSev: add Grub Firmware Volume
-  Package", 2020-12-14).
-
-- Contextual differences from new upstream commits 2d8ca4f90eae ("OvmfPkg:
-  enable HttpDynamicCommand", 2020-10-01) and 5ab6a0e1c8e9 ("OvmfPkg:
-  introduce VirtioFsDxe", 2020-12-21) have been auto-resolved by
-  git-cherry-pick.
-
-- Remove obsolete commit message tags related to downstream patch
-  management: Message-id, Patchwork-id, O-Subject, Acked-by
-  (RHBZ#1846481).
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- context difference from upstream commit ec41733cfd10 ("OvmfPkg: add the
-  'initrd' dynamic shell command", 2020-03-04) correctly auto-resolved
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no change
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- update the patch against the following upstream commits:
-  - 4b888334d234 ("OvmfPkg: Remove EdkShellBinPkg in FDF", 2018-11-19)
-  - 277a3958d93a ("OvmfPkg: Don't include TftpDynamicCommand in XCODE5
-                  tool chain", 2018-11-27)
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
-  a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no change
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- no changes
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- no changes
-
-Bugzilla: 1147592
-
-When '-D EXCLUDE_SHELL_FROM_FD' is passed to 'build', exclude the shell
-binary from the firmware image.
-
-Peter Jones advised us that firmware vendors for physical systems disable
-the memory-mapped, firmware image-contained UEFI shell in
-SecureBoot-enabled builds. The reason being that the memory-mapped shell
-can always load, it may have direct access to various hardware in the
-system, and it can run UEFI shell scripts (which cannot be signed at all).
-
-Intended use of the new build option:
-
-- In-tree builds: don't pass '-D EXCLUDE_SHELL_FROM_FD'. The resultant
-  firmware image will contain a shell binary, independently of SecureBoot
-  enablement, which is flexible for interactive development. (Ie. no
-  change for in-tree builds.)
-
-- RPM builds: pass both '-D SECURE_BOOT_ENABLE' and
-  '-D EXCLUDE_SHELL_FROM_FD'. The resultant RPM will provide:
-
-  - OVMF_CODE.fd: SecureBoot-enabled firmware, without builtin UEFI shell,
-
-  - OVMF_VARS.fd: variable store template matching OVMF_CODE.fd,
-
-  - UefiShell.iso: a bootable ISO image with the shell on it as default
-    boot loader. The shell binary will load when SecureBoot is turned off,
-    and won't load when SecureBoot is turned on (because it is not
-    signed).
-
-    UefiShell.iso is the reason we're not excluding the shell from the DSC
-    files as well, only the FDF files -- when '-D EXCLUDE_SHELL_FROM_FD'
-    is specified, the shell binary needs to be built the same, only it
-    will be included in UefiShell.iso.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit 9c391def70366cabae08e6008814299c3372fafd)
-(cherry picked from commit d9dd9ee42937b2611fe37183cc9ec7f62d946933)
-(cherry picked from commit 23df46ebbe7b09451d3a05034acd4d3a25e7177b)
-(cherry picked from commit f0303f71d576c51b01c4ff961b429d0e0e707245)
-(cherry picked from commit bbd64eb8658e9a33eab4227d9f4e51ad78d9f687)
-(cherry picked from commit 8628ef1b8d675ebec39d83834abbe3c8c8c42cf4)
-(cherry picked from commit 229c88dc3ded9baeaca8b87767dc5c41c05afd6e)
-(cherry picked from commit c2812d7189dee06c780f05a5880eb421c359a687)
----
- OvmfPkg/OvmfPkgIa32.fdf    | 2 ++
- OvmfPkg/OvmfPkgIa32X64.fdf | 2 ++
- OvmfPkg/OvmfPkgX64.fdf     | 2 ++
- 3 files changed, 6 insertions(+)
-
-diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 57d13b7130bc..69044874e2f7 100644
---- a/OvmfPkg/OvmfPkgIa32.fdf
-+++ b/OvmfPkg/OvmfPkgIa32.fdf
-@@ -298,12 +298,14 @@ [FV.DXEFV]
- INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
- INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
- 
-+!ifndef $(EXCLUDE_SHELL_FROM_FD)
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
- INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
- INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
- INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
- !endif
- INF  ShellPkg/Application/Shell/Shell.inf
-+!endif
- 
- INF MdeModulePkg/Logo/LogoDxe.inf
- 
-diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index ccde366887a9..bf535bef4200 100644
---- a/OvmfPkg/OvmfPkgIa32X64.fdf
-+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
-@@ -299,12 +299,14 @@ [FV.DXEFV]
- INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
- INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
- 
-+!ifndef $(EXCLUDE_SHELL_FROM_FD)
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
- INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
- INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
- INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
- !endif
- INF  ShellPkg/Application/Shell/Shell.inf
-+!endif
- 
- INF MdeModulePkg/Logo/LogoDxe.inf
- 
-diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 438806fba8f1..21e4ce00dde6 100644
---- a/OvmfPkg/OvmfPkgX64.fdf
-+++ b/OvmfPkg/OvmfPkgX64.fdf
-@@ -324,12 +324,14 @@ [FV.DXEFV]
- INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
- INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
- 
-+!ifndef $(EXCLUDE_SHELL_FROM_FD)
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
- INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
- INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
- INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
- !endif
- INF  ShellPkg/Application/Shell/Shell.inf
-+!endif
- 
- INF MdeModulePkg/Logo/LogoDxe.inf
- 
--- 
-2.35.3
-

0009-ArmPlatformPkg-introduce-fixed-PCD-for-early-hello-m.patch

@@ -1,94 +0,0 @@
-From a432c70d28e61a51047616cedc75ca54257d1558 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Wed, 14 Oct 2015 13:49:43 +0200
-Subject: [PATCH 09/21] ArmPlatformPkg: introduce fixed PCD for early hello
- message (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- no change
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no change
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- no change
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
-  a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no changes
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- no changes
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- no changes
-
-Drew has proposed that ARM|AARCH64 platform firmware (especially virtual
-machine firmware) print a reasonably early, simple hello message to the
-serial port, regardless of debug mask settings. This should inform
-interactive users, and provide some rough help in localizing boot
-problems, even with restrictive debug masks.
-
-If a platform doesn't want this feature, it should stick with the default
-empty string.
-
-RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1270279
-Downstream only:
-<http://thread.gmane.org/gmane.comp.bios.edk2.devel/2996/focus=3433>.
-
-Suggested-by: Drew Jones <drjones@redhat.com>
-Contributed-under: TianoCore Contribution Agreement 1.0
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit 7ce97b06421434c82095f01a1753a8c9c546cc30)
-(cherry picked from commit 20b1f1cbd0590aa71c6d99d35e23cf08e0707750)
-(cherry picked from commit 6734b88cf7abcaf42632e3d2fc469b2169dd2f16)
-(cherry picked from commit ef77da632559e9baa1c69869e4cbea377068ef27)
-(cherry picked from commit 58755c51d3252312d80cbcb97928d71199c2f5e1)
-(cherry picked from commit c3f07e323e76856f1b42ea7b8c598ba3201c28a2)
-(cherry picked from commit 9f756c1ad83cc81f7d892cd036d59a2b567b02dc)
-(cherry picked from commit c75aea7a738ac7fb944c0695a4bfffc3985afaa9)
----
- ArmPlatformPkg/ArmPlatformPkg.dec | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/ArmPlatformPkg/ArmPlatformPkg.dec b/ArmPlatformPkg/ArmPlatformPkg.dec
-index 3a25ddcdc8ca..b2b58553c7a6 100644
---- a/ArmPlatformPkg/ArmPlatformPkg.dec
-+++ b/ArmPlatformPkg/ArmPlatformPkg.dec
-@@ -121,6 +121,13 @@ [PcdsFixedAtBuild.common]
-   ## If set, this will swap settings for HDLCD RED_SELECT and BLUE_SELECT registers
-   gArmPlatformTokenSpaceGuid.PcdArmHdLcdSwapBlueRedSelect|FALSE|BOOLEAN|0x00000045
- 
-+  #
-+  # Early hello message (ASCII string), printed to the serial port.
-+  # If set to the empty string, nothing is printed.
-+  # Otherwise, a trailing CRLF should be specified explicitly.
-+  #
-+  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage|""|VOID*|0x00000100
-+
- [PcdsFixedAtBuild.common,PcdsDynamic.common]
-   ## PL031 RealTimeClock
-   gArmPlatformTokenSpaceGuid.PcdPL031RtcBase|0x0|UINT32|0x00000024
--- 
-2.35.3
-

0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch

@@ -1,7 +1,7 @@
-From d64349e98dac4add2813971c7e9f44d837d87880 Mon Sep 17 00:00:00 2001
+From 58b31e995b9626e3187872c5dbb4696f04374a56 Mon Sep 17 00:00:00 2001
 From: Philippe Mathieu-Daude <philmd@redhat.com>
 Date: Thu, 1 Aug 2019 20:43:48 +0200
-Subject: [PATCH 15/21] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on
+Subject: [PATCH 09/14] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on
  Aarch64 silent builds (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -59,7 +59,7 @@ index e3890b8c202f..6ffee5acb24c 100644
    FrameBufferBltLib
    MemoryAllocationLib
 diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
-index f5113fbc78a6..0295986fe0f1 100644
+index 5a1044f0dc7b..3a687901b0d2 100644
 --- a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
 +++ b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
 @@ -13,6 +13,7 @@
@@ -92,5 +92,5 @@ index f5113fbc78a6..0295986fe0f1 100644
    }
  
 -- 
-2.35.3
+2.40.1
 

0010-ArmPlatformPkg-PrePeiCore-write-early-hello-message-.patch

@@ -1,145 +0,0 @@
-From 1492c375e52d3cc6d8c39fc4853f10ceeca2948c Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Wed, 14 Oct 2015 13:59:20 +0200
-Subject: [PATCH 10/21] ArmPlatformPkg: PrePeiCore: write early hello message
- to the serial port (RH)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- no change
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no change
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- no change
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
-  a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- adapt to upstream commit 7e2a8dfe8a9a ("ArmPlatformPkg/PrePeiCore: seed
-  temporary stack before entering PEI core", 2017-11-09) -- conflict
-  resolution in "ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf"
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- no changes
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- no changes
-
-The FixedPcdGetSize() macro expands to an integer constant, therefore an
-optimizing compiler can eliminate the new code, if the platform DSC
-doesn't override the empty string (size=1) default of
-PcdEarlyHelloMessage.
-
-RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1270279
-Downstream only:
-<http://thread.gmane.org/gmane.comp.bios.edk2.devel/2996/focus=3433>.
-
-Contributed-under: TianoCore Contribution Agreement 1.0
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit b16c4c505ce0e27305235533eac9236aa66f132e)
-(cherry picked from commit 742e5bf6d5ce5a1e73879d6e5c0dd00feda7a9ac)
-(cherry picked from commit 93d69eb9393cf05af90676253875c59c1bec67fd)
-(cherry picked from commit 638594083b191f84f5d9333eb6147a31570f5a5a)
-(cherry picked from commit f4b7aae411d88b2b83f85d20ef06a4032a57e7de)
-(cherry picked from commit bb71490fdda3b38fa9f071d281b863f9b64363bf)
-(cherry picked from commit 8d5a8827aabc67cb2a046697e1a750ca8d9cc453)
-(cherry picked from commit 49fe5596cd79c94d903c4d506c563d642ccd69aa)
----
- ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf  | 2 ++
- ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf | 2 ++
- ArmPlatformPkg/PrePeiCore/PrePeiCore.h          | 1 +
- ArmPlatformPkg/PrePeiCore/MainMPCore.c          | 5 +++++
- ArmPlatformPkg/PrePeiCore/MainUniCore.c         | 5 +++++
- 5 files changed, 15 insertions(+)
-
-diff --git a/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf b/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf
-index a5b4722459d1..ea7b220bc831 100644
---- a/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf
-+++ b/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf
-@@ -66,6 +66,8 @@ [FixedPcd]
-   gArmPlatformTokenSpaceGuid.PcdCPUCorePrimaryStackSize
-   gArmPlatformTokenSpaceGuid.PcdCPUCoreSecondaryStackSize
- 
-+  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage
-+
-   gArmTokenSpaceGuid.PcdGicDistributorBase
-   gArmTokenSpaceGuid.PcdGicInterruptInterfaceBase
-   gArmTokenSpaceGuid.PcdGicSgiIntId
-diff --git a/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf b/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
-index 466a2b01c384..29fb8737cb2f 100644
---- a/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
-+++ b/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
-@@ -64,4 +64,6 @@ [FixedPcd]
-   gArmPlatformTokenSpaceGuid.PcdCPUCorePrimaryStackSize
-   gArmPlatformTokenSpaceGuid.PcdCPUCoreSecondaryStackSize
- 
-+  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage
-+
-   gEfiMdeModulePkgTokenSpaceGuid.PcdInitValueInTempStack
-diff --git a/ArmPlatformPkg/PrePeiCore/PrePeiCore.h b/ArmPlatformPkg/PrePeiCore/PrePeiCore.h
-index 0345dd7bdd2a..ae8302becda2 100644
---- a/ArmPlatformPkg/PrePeiCore/PrePeiCore.h
-+++ b/ArmPlatformPkg/PrePeiCore/PrePeiCore.h
-@@ -16,6 +16,7 @@
- #include <Library/DebugLib.h>
- #include <Library/IoLib.h>
- #include <Library/PcdLib.h>
-+#include <Library/SerialPortLib.h>
- 
- #include <PiPei.h>
- #include <Ppi/TemporaryRamSupport.h>
-diff --git a/ArmPlatformPkg/PrePeiCore/MainMPCore.c b/ArmPlatformPkg/PrePeiCore/MainMPCore.c
-index b5d0d3a6442f..5126a6dfb0b1 100644
---- a/ArmPlatformPkg/PrePeiCore/MainMPCore.c
-+++ b/ArmPlatformPkg/PrePeiCore/MainMPCore.c
-@@ -116,6 +116,11 @@ PrimaryMain (
-   UINTN                   TemporaryRamBase;
-   UINTN                   TemporaryRamSize;
- 
-+  if (FixedPcdGetSize (PcdEarlyHelloMessage) > 1) {
-+    SerialPortWrite (FixedPcdGetPtr (PcdEarlyHelloMessage),
-+      FixedPcdGetSize (PcdEarlyHelloMessage) - 1);
-+  }
-+
-   CreatePpiList (&PpiListSize, &PpiList);
- 
-   // Enable the GIC Distributor
-diff --git a/ArmPlatformPkg/PrePeiCore/MainUniCore.c b/ArmPlatformPkg/PrePeiCore/MainUniCore.c
-index 1c2580eb923b..2a7580dbb405 100644
---- a/ArmPlatformPkg/PrePeiCore/MainUniCore.c
-+++ b/ArmPlatformPkg/PrePeiCore/MainUniCore.c
-@@ -29,6 +29,11 @@ PrimaryMain (
-   UINTN                   TemporaryRamBase;
-   UINTN                   TemporaryRamSize;
- 
-+  if (FixedPcdGetSize (PcdEarlyHelloMessage) > 1) {
-+    SerialPortWrite (FixedPcdGetPtr (PcdEarlyHelloMessage),
-+      FixedPcdGetSize (PcdEarlyHelloMessage) - 1);
-+  }
-+
-   CreatePpiList (&PpiListSize, &PpiList);
- 
-   // Adjust the Temporary Ram as the new Ppi List (Common + Platform Ppi Lists) is created at
--- 
-2.35.3
-

0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch

@@ -1,7 +1,7 @@
-From 19a991fbfc8dd21a9ccff051da77c8651ee7aa14 Mon Sep 17 00:00:00 2001
+From 88ca1daf0a9c0b6ea002f09b56cca1ab075ace9e Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:47 +0100
-Subject: [PATCH 16/21] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in
+Subject: [PATCH 10/14] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in
  NvmExpressDxe (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -63,10 +63,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 16 insertions(+), 4 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index c66ad3af1a23..7df6e5c825d7 100644
+index 870c4bd890fe..ad6e7724ee8e 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -720,7 +720,10 @@ [Components]
+@@ -678,7 +678,10 @@ [Components]
    OvmfPkg/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@@ -79,10 +79,10 @@ index c66ad3af1a23..7df6e5c825d7 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b37a5a6da948..ed6a820d2e1d 100644
+index d7bce8d40d26..b644669291ac 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -823,7 +823,10 @@ [Components]
+@@ -834,7 +834,10 @@ [Components]
    OvmfPkg/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@@ -95,10 +95,10 @@ index b37a5a6da948..ed6a820d2e1d 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index b0e8c20e93d7..b5be86cff32c 100644
+index 8103d1d4882a..e37ec97fbc7a 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -837,7 +837,10 @@ [Components.X64]
+@@ -848,7 +848,10 @@ [Components.X64]
    OvmfPkg/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@@ -111,10 +111,10 @@ index b0e8c20e93d7..b5be86cff32c 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 6211d5e934de..29b45e68e387 100644
+index 7fe23d9153fe..1f4934616ada 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -902,7 +902,10 @@ [Components]
+@@ -922,7 +922,10 @@ [Components]
    OvmfPkg/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@@ -127,5 +127,5 @@ index 6211d5e934de..29b45e68e387 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 -- 
-2.35.3
+2.40.1
 

0011-ArmVirtPkg-set-early-hello-message-RH-only.patch

@@ -1,82 +0,0 @@
-From 01ac59a696ed46ab1444bc5e15de791c0d90bad5 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Wed, 14 Oct 2015 14:07:17 +0200
-Subject: [PATCH 11/21] ArmVirtPkg: set early hello message (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- context difference from upstream commit f5cb3767038e
-  ("ArmVirtPkg/ArmVirtQemu: add ResetSystem PEIM for upcoming TPM2
-  support", 2020-03-04) automatically resolved correctly
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no change
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- resolve context conflict with upstream commit eaa1e98ae31d ("ArmVirtPkg:
-  don't set PcdCoreCount", 2019-02-13)
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
-  a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no changes
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- no changes
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- no changes
-
-Print a friendly banner on QEMU, regardless of debug mask settings.
-
-RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1270279
-Downstream only:
-<http://thread.gmane.org/gmane.comp.bios.edk2.devel/2996/focus=3433>.
-
-Contributed-under: TianoCore Contribution Agreement 1.0
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit 5d4a15b9019728b2d96322bc679099da49916925)
-(cherry picked from commit 179df76dbb0d199bd905236e98775b4059c6502a)
-(cherry picked from commit ce3f59d0710c24c162d5222bbf5cd7e36180c80c)
-(cherry picked from commit c201a8e6ae28d75f7ba581828b533c3b26fa7f18)
-(cherry picked from commit 2d4db6ec70e004cd9ac147615d17033bee5d3b18)
-(cherry picked from commit fb2032bbea7e02c426855cf86a323556d493fd8a)
-(cherry picked from commit ba73b99d5cb38f87c1a8f0936d515eaaefa3f04b)
-(cherry picked from commit 72550e12ae469012a505bf5b98a6543a754028d3)
----
- ArmVirtPkg/ArmVirtQemu.dsc | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 7705bf391976..ae35cc18008d 100644
---- a/ArmVirtPkg/ArmVirtQemu.dsc
-+++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -134,6 +134,7 @@ [PcdsFeatureFlag.common]
-   gArmVirtTokenSpaceGuid.PcdTpm2SupportEnabled|$(TPM2_ENABLE)
- 
- [PcdsFixedAtBuild.common]
-+  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage|"UEFI firmware starting.\r\n"
- !if $(ARCH) == AARCH64
-   gArmTokenSpaceGuid.PcdVFPEnabled|1
- !endif
--- 
-2.35.3
-

0011-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch

@@ -1,7 +1,7 @@
-From 85896a30011c3db49aa377c80e0ea81b7d8005f9 Mon Sep 17 00:00:00 2001
+From 5e31bb6319ba4aabb113c2fb94e133a2efd79bb0 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Sat, 16 Nov 2019 17:11:27 +0100
-Subject: [PATCH 17/21] CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files
+Subject: [PATCH 11/14] CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files
  in the INFs (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -126,19 +126,20 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit 57bd3f146590df8757865d8f2cdd1db3cf3f4d40)
 (cherry picked from commit 56c4bb81b311dfcee6a34c81d3e4feeda7f88995)
 ---
- CryptoPkg/Library/OpensslLib/OpensslLib.inf       | 11 +++++++++++
- CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 11 +++++++++++
- 2 files changed, 22 insertions(+)
+ CryptoPkg/Library/OpensslLib/OpensslLib.inf       | 12 ++++++++++++
+ CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 12 ++++++++++++
+ 2 files changed, 24 insertions(+)
 
 diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
-index c899b811b149..4a89dc82b65e 100644
+index 0f64c9fa7eca..6d49136ed75e 100644
 --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
 +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
-@@ -620,6 +620,17 @@ [Sources]
+@@ -576,6 +576,18 @@ [Sources]
    $(OPENSSL_PATH)/ssl/statem/statem.h
    $(OPENSSL_PATH)/ssl/statem/statem_local.h
  # Autogenerated files list ends here
 +# RHEL8-specific OpenSSL file list starts here
++  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
 +  $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
 +  $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
 +  $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
@@ -153,14 +154,15 @@ index c899b811b149..4a89dc82b65e 100644
    ossl_store.c
    rand_pool.c
 diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-index 0ec372454119..f1cc0aaf9fda 100644
+index 311cd1e6051a..f5ead202ec8e 100644
 --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
 +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-@@ -569,6 +569,17 @@ [Sources]
+@@ -526,6 +526,18 @@ [Sources]
    $(OPENSSL_PATH)/crypto/x509v3/standard_exts.h
    $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
  # Autogenerated files list ends here
 +# RHEL8-specific OpenSSL file list starts here
++  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
 +  $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
 +  $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
 +  $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
@@ -175,5 +177,5 @@ index 0ec372454119..f1cc0aaf9fda 100644
    ossl_store.c
    rand_pool.c
 -- 
-2.35.3
+2.40.1
 

0012-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch

@@ -1,7 +1,7 @@
-From 98e14a58d727bb2d863a7a8c3a257f3b02b15b80 Mon Sep 17 00:00:00 2001
+From 22d3b3dff458b0523fc3da5f22c96dce91e35d0c Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:31:36 +0200
-Subject: [PATCH 18/21] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no
+Subject: [PATCH 12/14] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no
  "-kernel" in silent aa64 build (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -44,7 +44,7 @@ index 7b35adb8e034..e0331c6e2cbc 100644
    MemoryAllocationLib
    QemuFwCfgLib
 diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
-index d4f3cd92255f..f007f8a6c233 100644
+index 3c12085f6c1e..e473c0b57345 100644
 --- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
 +++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
 @@ -19,6 +19,7 @@
@@ -80,5 +80,5 @@ index d4f3cd92255f..f007f8a6c233 100644
    }
  
 -- 
-2.35.3
+2.40.1
 

0013-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch

@@ -1,7 +1,7 @@
-From ee4dd84fe0d33568b1800f5d6840627103c46d8d Mon Sep 17 00:00:00 2001
+From 583e3a67563e3f177a0e61dc41077e7413f100ef Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:40:09 +0200
-Subject: [PATCH 19/21] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in
+Subject: [PATCH 13/14] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in
  silent aa64 build (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -78,5 +78,5 @@ index f6ea8b2bbf18..681eb7e08b98 100644
    }
  
 -- 
-2.35.3
+2.40.1
 

0015-OvmfPkg-PlatformPei-drop-S3Verification.patch

@@ -0,0 +1,72 @@
+From 55a09dea67c8818d1c871af825307fb3b2b0ba4b Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 23 May 2023 10:25:51 +0200
+Subject: [PATCH 15/27] OvmfPkg/PlatformPei: drop S3Verification()
+
+Not needed any more, SMM + 64-bit PEI + S3 suspend works now.
+
+Fixed by commits:
+ - 8bd2028f9ac3 ("MdeModulePkg: Supporting S3 in 64bit PEI")
+ - 6acf72901a2e ("UefiCpuPkg: Supporting S3 in 64bit PEI")
+See also https://bugzilla.tianocore.org/show_bug.cgi?id=4195
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Ray Ni <ray.ni@intel.com>
+(cherry picked from commit 098c55702318fd907de6fad7b43b5e9a6ad9ff7f)
+---
+ OvmfPkg/PlatformPei/Platform.c | 31 -------------------------------
+ 1 file changed, 31 deletions(-)
+
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index 5d7f50cc5876..ce9868d57de1 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -242,36 +242,6 @@ ReserveEmuVariableNvStore (
+   ASSERT_RETURN_ERROR (PcdStatus);
+ }
+ 
+-STATIC
+-VOID
+-S3Verification (
+-  IN EFI_HOB_PLATFORM_INFO  *PlatformInfoHob
+-  )
+-{
+- #if defined (MDE_CPU_X64)
+-  if (PlatformInfoHob->SmmSmramRequire && PlatformInfoHob->S3Supported) {
+-    DEBUG ((
+-      DEBUG_ERROR,
+-      "%a: S3Resume2Pei doesn't support X64 PEI + SMM yet.\n",
+-      __func__
+-      ));
+-    DEBUG ((
+-      DEBUG_ERROR,
+-      "%a: Please disable S3 on the QEMU command line (see the README),\n",
+-      __func__
+-      ));
+-    DEBUG ((
+-      DEBUG_ERROR,
+-      "%a: or build OVMF with \"OvmfPkgIa32X64.dsc\".\n",
+-      __func__
+-      ));
+-    ASSERT (FALSE);
+-    CpuDeadLoop ();
+-  }
+-
+- #endif
+-}
+-
+ STATIC
+ VOID
+ Q35BoardVerification (
+@@ -366,7 +336,6 @@ InitializePlatform (
+     ASSERT_EFI_ERROR (Status);
+   }
+ 
+-  S3Verification (PlatformInfoHob);
+   BootModeInitialization (PlatformInfoHob);
+ 
+   //
+-- 
+2.40.1
+

0016-OvmfPkg-PciHotPlugInitDxe-Do-not-reserve-IO-ports-by.patch

@@ -0,0 +1,47 @@
+From e54dd3f5c1ea0171317d9054d44b35d634ac4557 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 May 2023 11:47:58 +0200
+Subject: [PATCH 16/27] OvmfPkg/PciHotPlugInitDxe: Do not reserve IO ports by
+ default.
+
+Flip the default for IO address space reservations for PCI(e) bridges
+and root ports with hotplug support from TRUE to FALSE.
+
+PCI(e) bridges will still get IO address space assigned in case:
+
+  (a) Downstream devices actually need IO address space, or
+  (b) Explicit configuration, using "qemu -device
+      pcie-root-port,io-reserve=<size>".
+
+In case IO address space is exhausted edk2 will stop assigning resources
+to PCI(e) bridges.  This is not limited to IO resources, the affected
+bridges will not get any memory resources assigned either.
+
+This patch solves this issue by not handing out the scarce IO address
+space, which is not needed in most cases anyway.  Result is a more
+consistent PCI configuration in virtual machine configurations with many
+PCie root ports.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 27727338b2c0e3f50eb0176a1044e903fcb3c3b1)
+---
+ OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c b/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
+index 6b2b6797b3b6..69903a600981 100644
+--- a/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
++++ b/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
+@@ -589,7 +589,7 @@ GetResourcePadding (
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+-  DefaultIo       = TRUE;
++  DefaultIo       = FALSE;
+   DefaultMmio     = TRUE;
+   DefaultPrefMmio = TRUE;
+ 
+-- 
+2.40.1
+

0017-OvmfPkg-PlatformInitLib-check-PcdUse1GPageTable.patch

@@ -0,0 +1,51 @@
+From 543497088c1356c408f1bf79c06ab64b5c35be6b Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 17 May 2023 12:24:47 +0200
+Subject: [PATCH 17/27] OvmfPkg/PlatformInitLib: check PcdUse1GPageTable
+
+If PcdUse1GPageTable is not enabled restrict the physical address space
+used to 1TB, to limit the amount of memory needed for identity mapping
+page tables.
+
+The same already happens in case the processor has no support for
+gigabyte pages.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit d4d24001f78bcee965d8854fba6f08f48b4ec446)
+---
+ OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf | 1 +
+ OvmfPkg/Library/PlatformInitLib/MemDetect.c         | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
+index 86a82ad3e084..5a79d95b689c 100644
+--- a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
++++ b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
+@@ -58,6 +58,7 @@ [LibraryClasses.X64]
+ 
+ [Pcd]
+   gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress
++  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
+ 
+ [FixedPcd]
+   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase
+diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
+index acf90b4e93fd..1102b00ecbf0 100644
+--- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
++++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
+@@ -663,6 +663,11 @@ PlatformAddressWidthFromCpuid (
+       PhysBits = 40;
+     }
+ 
++    if (!FixedPcdGetBool (PcdUse1GPageTable) && (PhysBits > 40)) {
++      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 40 (PcdUse1GPageTable is false)\n", __func__));
++      PhysBits = 40;
++    }
++
+     PlatformInfoHob->PhysMemAddressWidth = PhysBits;
+     PlatformInfoHob->FirstNonAddress     = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth);
+   }
+-- 
+2.40.1
+

0018-OvmfPkg-OvmfPkgIa32X64-enable-1G-pages.patch

@@ -0,0 +1,31 @@
+From f1bbf3e4195bb21d4edfb2af8e940bceacc2ced4 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 17 May 2023 12:24:48 +0200
+Subject: [PATCH 18/27] OvmfPkg/OvmfPkgIa32X64: enable 1G pages
+
+Reduces the memory footprint and speeds up booting.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit b63e17d746aa6bab2b1101711395725005e71a02)
+---
+ OvmfPkg/OvmfPkgIa32X64.dsc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index e37ec97fbc7a..2b2f8e3e84d3 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -557,6 +557,9 @@ [PcdsFixedAtBuild]
+   # never lets the RAM below 4 GB exceed 2816 MB.
+   gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress|0xE0000000
+ 
++  # use 1G pages
++  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable|TRUE
++
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+   gEfiSourceLevelDebugPkgTokenSpaceGuid.PcdDebugLoadImageMethod|0x2
+ !endif
+-- 
+2.40.1
+

0019-OvmfPkg-MicrovmX64-enable-1G-pages.patch

@@ -0,0 +1,31 @@
+From 9c6bc52b413feda953158ad623237f6c9e7b533d Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 17 May 2023 12:24:49 +0200
+Subject: [PATCH 19/27] OvmfPkg/MicrovmX64: enable 1G pages
+
+Reduces the memory footprint and speeds up booting.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 04c5b3023e49c35d291f41d2c39b4d12a62b8f9c)
+---
+ OvmfPkg/Microvm/MicrovmX64.dsc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
+index 02c225f6d2a7..b0acab41103b 100644
+--- a/OvmfPkg/Microvm/MicrovmX64.dsc
++++ b/OvmfPkg/Microvm/MicrovmX64.dsc
+@@ -544,6 +544,9 @@ [PcdsFixedAtBuild]
+   gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesCode|0x100
+   gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesData|0x100
+ 
++  # use 1G pages
++  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable|TRUE
++
+   #
+   # Network Pcds
+   #
+-- 
+2.40.1
+

0020-OvmfPkg-VirtioSerialDxe-use-TPL_NOTIFY.patch

@@ -0,0 +1,39 @@
+From 71024b694fa3a6317ebbba1d79626f80d8dce792 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 12 May 2023 16:23:06 +0200
+Subject: [PATCH 20/27] OvmfPkg/VirtioSerialDxe: use TPL_NOTIFY
+
+Apparently TPL_CALLBACK is too low, code runs into an ASSERT
+complaining the new TPL is lower than the old TPL.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 4e5a804222415ec7b2bec90ea0300b8a9f60f131)
+---
+ OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c b/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
+index 522b25e9698c..e4a58deff162 100644
+--- a/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
++++ b/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
+@@ -158,7 +158,7 @@ VirtioSerialIoWrite (
+ 
+   VirtioSerialRingClearTx (SerialIo->Dev, PortTx (SerialIo->PortId));
+ 
+-  OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
++  OldTpl = gBS->RaiseTPL (TPL_NOTIFY);
+   if (SerialIo->WriteOffset &&
+       (SerialIo->WriteOffset + *BufferSize > PORT_TX_BUFSIZE))
+   {
+@@ -201,7 +201,7 @@ VirtioSerialIoRead (
+     goto NoData;
+   }
+ 
+-  OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
++  OldTpl = gBS->RaiseTPL (TPL_NOTIFY);
+   if (SerialIo->WriteOffset) {
+     DEBUG ((DEBUG_VERBOSE, "%a:%d: WriteFlush %d\n", __func__, __LINE__, SerialIo->WriteOffset));
+     VirtioSerialRingSendBuffer (
+-- 
+2.40.1
+

0020-Tweak-the-tools_def-to-support-cross-compiling.patch

@@ -1,78 +0,0 @@
-From 6b2ca6f01bb76a3b9632e902b4bf0ef9e912ce40 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Thu, 16 Aug 2018 15:45:47 -0400
-Subject: [PATCH 21/21] Tweak the tools_def to support cross-compiling.
-
-These files are meant for customization, so this is not upstream.
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: Cole Robinson <crobinso@redhat.com>
----
- BaseTools/Conf/tools_def.template | 44 +++++++++++++++----------------
- 1 file changed, 22 insertions(+), 22 deletions(-)
-
-diff --git a/BaseTools/Conf/tools_def.template b/BaseTools/Conf/tools_def.template
-index 5ed19810b727..5901d9eecb5d 100755
---- a/BaseTools/Conf/tools_def.template
-+++ b/BaseTools/Conf/tools_def.template
-@@ -2280,17 +2280,17 @@ RELEASE_GCC49_AARCH64_DLINK_XIPFLAGS = -z common-page-size=0x20
- ##################
- # GCC5 IA32 definitions
- ##################
--*_GCC5_IA32_OBJCOPY_PATH         = DEF(GCC5_IA32_PREFIX)objcopy
--*_GCC5_IA32_CC_PATH              = DEF(GCC5_IA32_PREFIX)gcc
--*_GCC5_IA32_SLINK_PATH           = DEF(GCC5_IA32_PREFIX)gcc-ar
--*_GCC5_IA32_DLINK_PATH           = DEF(GCC5_IA32_PREFIX)gcc
--*_GCC5_IA32_ASLDLINK_PATH        = DEF(GCC5_IA32_PREFIX)gcc
--*_GCC5_IA32_ASM_PATH             = DEF(GCC5_IA32_PREFIX)gcc
--*_GCC5_IA32_PP_PATH              = DEF(GCC5_IA32_PREFIX)gcc
--*_GCC5_IA32_VFRPP_PATH           = DEF(GCC5_IA32_PREFIX)gcc
--*_GCC5_IA32_ASLCC_PATH           = DEF(GCC5_IA32_PREFIX)gcc
--*_GCC5_IA32_ASLPP_PATH           = DEF(GCC5_IA32_PREFIX)gcc
--*_GCC5_IA32_RC_PATH              = DEF(GCC5_IA32_PREFIX)objcopy
-+*_GCC5_IA32_OBJCOPY_PATH         = ENV(GCC5_IA32_PREFIX)objcopy
-+*_GCC5_IA32_CC_PATH              = ENV(GCC5_IA32_PREFIX)gcc
-+*_GCC5_IA32_SLINK_PATH           = ENV(GCC5_IA32_PREFIX)gcc-ar
-+*_GCC5_IA32_DLINK_PATH           = ENV(GCC5_IA32_PREFIX)gcc
-+*_GCC5_IA32_ASLDLINK_PATH        = ENV(GCC5_IA32_PREFIX)gcc
-+*_GCC5_IA32_ASM_PATH             = ENV(GCC5_IA32_PREFIX)gcc
-+*_GCC5_IA32_PP_PATH              = ENV(GCC5_IA32_PREFIX)gcc
-+*_GCC5_IA32_VFRPP_PATH           = ENV(GCC5_IA32_PREFIX)gcc
-+*_GCC5_IA32_ASLCC_PATH           = ENV(GCC5_IA32_PREFIX)gcc
-+*_GCC5_IA32_ASLPP_PATH           = ENV(GCC5_IA32_PREFIX)gcc
-+*_GCC5_IA32_RC_PATH              = ENV(GCC5_IA32_PREFIX)objcopy
- 
- *_GCC5_IA32_ASLCC_FLAGS          = DEF(GCC5_ASLCC_FLAGS) -m32
- *_GCC5_IA32_ASLDLINK_FLAGS       = DEF(GCC5_IA32_X64_ASLDLINK_FLAGS) -Wl,-m,elf_i386 -no-pie
-@@ -2312,17 +2312,17 @@ RELEASE_GCC5_IA32_DLINK_FLAGS    = DEF(GCC5_IA32_X64_DLINK_FLAGS) -flto -Os -Wl,
- ##################
- # GCC5 X64 definitions
- ##################
--*_GCC5_X64_OBJCOPY_PATH          = DEF(GCC5_X64_PREFIX)objcopy
--*_GCC5_X64_CC_PATH               = DEF(GCC5_X64_PREFIX)gcc
--*_GCC5_X64_SLINK_PATH            = DEF(GCC5_X64_PREFIX)gcc-ar
--*_GCC5_X64_DLINK_PATH            = DEF(GCC5_X64_PREFIX)gcc
--*_GCC5_X64_ASLDLINK_PATH         = DEF(GCC5_X64_PREFIX)gcc
--*_GCC5_X64_ASM_PATH              = DEF(GCC5_X64_PREFIX)gcc
--*_GCC5_X64_PP_PATH               = DEF(GCC5_X64_PREFIX)gcc
--*_GCC5_X64_VFRPP_PATH            = DEF(GCC5_X64_PREFIX)gcc
--*_GCC5_X64_ASLCC_PATH            = DEF(GCC5_X64_PREFIX)gcc
--*_GCC5_X64_ASLPP_PATH            = DEF(GCC5_X64_PREFIX)gcc
--*_GCC5_X64_RC_PATH               = DEF(GCC5_X64_PREFIX)objcopy
-+*_GCC5_X64_OBJCOPY_PATH          = ENV(GCC5_X64_PREFIX)objcopy
-+*_GCC5_X64_CC_PATH               = ENV(GCC5_X64_PREFIX)gcc
-+*_GCC5_X64_SLINK_PATH            = ENV(GCC5_X64_PREFIX)gcc-ar
-+*_GCC5_X64_DLINK_PATH            = ENV(GCC5_X64_PREFIX)gcc
-+*_GCC5_X64_ASLDLINK_PATH         = ENV(GCC5_X64_PREFIX)gcc
-+*_GCC5_X64_ASM_PATH              = ENV(GCC5_X64_PREFIX)gcc
-+*_GCC5_X64_PP_PATH               = ENV(GCC5_X64_PREFIX)gcc
-+*_GCC5_X64_VFRPP_PATH            = ENV(GCC5_X64_PREFIX)gcc
-+*_GCC5_X64_ASLCC_PATH            = ENV(GCC5_X64_PREFIX)gcc
-+*_GCC5_X64_ASLPP_PATH            = ENV(GCC5_X64_PREFIX)gcc
-+*_GCC5_X64_RC_PATH               = ENV(GCC5_X64_PREFIX)objcopy
- 
- *_GCC5_X64_ASLCC_FLAGS           = DEF(GCC5_ASLCC_FLAGS) -m64
- *_GCC5_X64_ASLDLINK_FLAGS        = DEF(GCC5_IA32_X64_ASLDLINK_FLAGS) -Wl,-m,elf_x86_64
--- 
-2.35.3
-

0021-OvmfPkg-QemuFlashFvbServicesRuntimeDxe-refine-flash-.patch

@@ -0,0 +1,51 @@
+From 8372a31938eb57921bd8a9a5dd5d56b838b074a2 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Jun 2023 08:08:03 +0200
+Subject: [PATCH 21/27] OvmfPkg/QemuFlashFvbServicesRuntimeDxe: refine flash
+ detection
+
+Flash can be write-protected in qemu (which is usually the case for
+code).  In case the variable store flash block is configured read-only
+ovmf wouldn't be able to store EFI variables there, so not setting up
+fvb in that case (and fallhack to emulation) is the better option.
+It'll avoid problems later due to flash writes failing.
+
+The patch tries to write back the original value read earlier, so flash
+content doesn't change in case the write succeeds.  But the status we
+read back after the attempt to write will tell us whenever flash is
+writable or not.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 578a715cfc6abc08ead8f585f096789374254b2a)
+---
+ OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c
+index 54f859de9ff9..a577aea55614 100644
+--- a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c
++++ b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c
+@@ -114,9 +114,17 @@ QemuFlashDetected (
+       DEBUG ((DEBUG_INFO, "QemuFlashDetected => FD behaves as RAM\n"));
+       *Ptr = OriginalUint8;
+     } else if (ProbeUint8 == CLEARED_ARRAY_STATUS) {
+-      DEBUG ((DEBUG_INFO, "QemuFlashDetected => FD behaves as FLASH\n"));
+-      FlashDetected = TRUE;
+-      *Ptr          = READ_ARRAY_CMD;
++      *Ptr       = WRITE_BYTE_CMD;
++      *Ptr       = OriginalUint8;
++      *Ptr       = READ_STATUS_CMD;
++      ProbeUint8 = *Ptr;
++      *Ptr       = READ_ARRAY_CMD;
++      if (ProbeUint8 & 0x10 /* programming error */) {
++        DEBUG ((DEBUG_INFO, "QemuFlashDetected => FD behaves as FLASH, write-protected\n"));
++      } else {
++        DEBUG ((DEBUG_INFO, "QemuFlashDetected => FD behaves as FLASH, writable\n"));
++        FlashDetected = TRUE;
++      }
+     }
+   }
+ 
+-- 
+2.40.1
+

0021-tools_def-add-fno-omit-frame-pointer-to-GCC48_-IA32-.patch

@@ -1,32 +0,0 @@
-From 46c6d0e6a1d971edef5846e352a81a097f8d51d5 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Fri, 10 Jun 2022 07:43:15 +0200
-Subject: [PATCH 21/21] tools_def: add -fno-omit-frame-pointer to
- GCC48_{IA32,X64}_CC_FLAGS
-
-Fixes problems due to code assuming it runs with frame pointers and thus
-updates rbp / ebp registers when switching stacks.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- BaseTools/Conf/tools_def.template | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/BaseTools/Conf/tools_def.template b/BaseTools/Conf/tools_def.template
-index 5901d9eecb5d..e3aa88fec31f 100755
---- a/BaseTools/Conf/tools_def.template
-+++ b/BaseTools/Conf/tools_def.template
-@@ -1884,8 +1884,8 @@ DEFINE GCC_DEPS_FLAGS              = -MMD -MF $@.deps
- 
- DEFINE GCC48_ALL_CC_FLAGS            = DEF(GCC_ALL_CC_FLAGS) -ffunction-sections -fdata-sections -DSTRING_ARRAY_NAME=$(BASE_NAME)Strings
- DEFINE GCC48_IA32_X64_DLINK_COMMON   = -nostdlib -Wl,-n,-q,--gc-sections -z common-page-size=0x20
--DEFINE GCC48_IA32_CC_FLAGS           = DEF(GCC48_ALL_CC_FLAGS) -m32 -march=i586 -malign-double -fno-stack-protector -D EFI32 -fno-asynchronous-unwind-tables -Wno-address
--DEFINE GCC48_X64_CC_FLAGS            = DEF(GCC48_ALL_CC_FLAGS) -m64 -fno-stack-protector "-DEFIAPI=__attribute__((ms_abi))" -maccumulate-outgoing-args -mno-red-zone -Wno-address -mcmodel=small -fpie -fno-asynchronous-unwind-tables -Wno-address
-+DEFINE GCC48_IA32_CC_FLAGS           = DEF(GCC48_ALL_CC_FLAGS) -m32 -march=i586 -malign-double -fno-stack-protector -D EFI32 -fno-asynchronous-unwind-tables -Wno-address -fno-omit-frame-pointer
-+DEFINE GCC48_X64_CC_FLAGS            = DEF(GCC48_ALL_CC_FLAGS) -m64 -fno-stack-protector "-DEFIAPI=__attribute__((ms_abi))" -maccumulate-outgoing-args -mno-red-zone -Wno-address -mcmodel=small -fpie -fno-asynchronous-unwind-tables -Wno-address  -fno-omit-frame-pointer
- DEFINE GCC48_IA32_X64_ASLDLINK_FLAGS = DEF(GCC48_IA32_X64_DLINK_COMMON) -Wl,--entry,ReferenceAcpiTable -u ReferenceAcpiTable
- DEFINE GCC48_IA32_X64_DLINK_FLAGS    = DEF(GCC48_IA32_X64_DLINK_COMMON) -Wl,--entry,$(IMAGE_ENTRY_POINT) -u $(IMAGE_ENTRY_POINT) -Wl,-Map,$(DEST_DIR_DEBUG)/$(BASE_NAME).map,--whole-archive
- DEFINE GCC48_IA32_DLINK2_FLAGS       = -Wl,--defsym=PECOFF_HEADER_SIZE=0x220 DEF(GCC_DLINK2_FLAGS_COMMON)
--- 
-2.36.1
-

0022-OvmfPkg-PlatformInitLib-limit-phys-bits-to-46.patch

@@ -0,0 +1,47 @@
+From cdb34f5003b9001d12d1841e8a4eeab9471ab928 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Jun 2023 09:57:31 +0200
+Subject: [PATCH 22/27] OvmfPkg/PlatformInitLib: limit phys-bits to 46.
+
+Older linux kernels have problems with phys-bits larger than 46,
+ubuntu 18.04 (kernel 4.15) has been reported to be affected.
+
+Reduce phys-bits limit from 47 to 46.
+
+Reported-by: Fiona Ebner <f.ebner@proxmox.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit c1e853769046b322690ad336fdb98966757e7414)
+---
+ OvmfPkg/Library/PlatformInitLib/MemDetect.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
+index 1102b00ecbf0..662e7e85bbc5 100644
+--- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
++++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
+@@ -646,16 +646,19 @@ PlatformAddressWidthFromCpuid (
+     ));
+ 
+   if (Valid) {
+-    if (PhysBits > 47) {
++    if (PhysBits > 46) {
+       /*
+        * Avoid 5-level paging altogether for now, which limits
+        * PhysBits to 48.  Also avoid using address bit 48, due to sign
+        * extension we can't identity-map these addresses (and lots of
+        * places in edk2 assume we have everything identity-mapped).
+        * So the actual limit is 47.
++       *
++       * Also some older linux kernels apparently have problems handling
++       * phys-bits > 46 correctly, so use that as limit.
+        */
+-      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 47 (avoid 5-level paging)\n", __func__));
+-      PhysBits = 47;
++      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 46 (avoid 5-level paging)\n", __func__));
++      PhysBits = 46;
+     }
+ 
+     if (!Page1GSupport && (PhysBits > 40)) {
+-- 
+2.40.1
+

0023-ArmVirt-add-VirtioSerialDxe-to-ArmVirtQemu-builds.patch

@@ -0,0 +1,53 @@
+From bc308234de0455d9448f6b841506bd1e2b04b024 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Jun 2023 13:57:10 +0200
+Subject: [PATCH 23/27] ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit 6925150febb3a76d8e40c19babcc578555ca78fe)
+---
+ ArmVirtPkg/ArmVirtQemu.dsc           | 1 +
+ ArmVirtPkg/ArmVirtQemuKernel.dsc     | 1 +
+ ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index bc097880f79f..a03f5e4d43cf 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
++++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -453,6 +453,7 @@ [Components.common]
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+   OvmfPkg/VirtioNetDxe/VirtioNet.inf
+   OvmfPkg/VirtioRngDxe/VirtioRng.inf
++  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ 
+   #
+   # FAT filesystem + GPT/MBR partitioning + UDF filesystem + virtio-fs
+diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+index 02877284bfa3..e7d76a6502c7 100644
+--- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
++++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+@@ -353,6 +353,7 @@ [Components.common]
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+   OvmfPkg/VirtioNetDxe/VirtioNet.inf
+   OvmfPkg/VirtioRngDxe/VirtioRng.inf
++  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ 
+   #
+   # FAT filesystem + GPT/MBR partitioning + UDF filesystem + virtio-fs
+diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+index 8a063bac04ac..2894bc853a46 100644
+--- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
++++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+@@ -98,6 +98,7 @@ [FV.FvMain]
+   INF OvmfPkg/VirtioNetDxe/VirtioNet.inf
+   INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
++  INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ 
+   INF ShellPkg/Application/Shell/Shell.inf
+   INF ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+-- 
+2.40.1
+

0024-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtio.patch

@@ -0,0 +1,68 @@
+From f0d2e5cf0f436cf48afae5e7b86bd5bd7e137751 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Jun 2023 13:57:11 +0200
+Subject: [PATCH 24/27] ArmVirt/PlatformBootManagerLib: factor out IsVirtio()
+
+IsVirtioRng() becomes just a thin wrapper for IsVirtio().
+This allows to add similar thin wrappers for other virtio
+devices in the future.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit a196b04926e70880334fcd649837d0ac63b0bfd5)
+---
+ .../PlatformBootManagerLib/PlatformBm.c       | 26 +++++++++++++++----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+index 10c815378cd5..5eb6f0f9c14a 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
++++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+@@ -269,15 +269,16 @@ IsPciDisplay (
+ }
+ 
+ /**
+-  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
+-  the VIRTIO_DEVICE_PROTOCOL level.
++  This function checks if a handle corresponds to the Virtio Device ID given
++  at the VIRTIO_DEVICE_PROTOCOL level.
+ **/
+ STATIC
+ BOOLEAN
+ EFIAPI
+-IsVirtioRng (
++IsVirtio (
+   IN EFI_HANDLE    Handle,
+-  IN CONST CHAR16  *ReportText
++  IN CONST CHAR16  *ReportText,
++  IN UINT16        VirtIoDeviceId
+   )
+ {
+   EFI_STATUS              Status;
+@@ -293,7 +294,22 @@ IsVirtioRng (
+   }
+ 
+   return (BOOLEAN)(VirtIo->SubSystemDeviceId ==
+-                   VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
++                   VirtIoDeviceId);
++}
++
++/**
++  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
++  the VIRTIO_DEVICE_PROTOCOL level.
++**/
++STATIC
++BOOLEAN
++EFIAPI
++IsVirtioRng (
++  IN EFI_HANDLE    Handle,
++  IN CONST CHAR16  *ReportText
++  )
++{
++  return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
+ }
+ 
+ /**
+-- 
+2.40.1
+

0025-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtioPc.patch

@@ -0,0 +1,90 @@
+From 7863796aacb5dc2acd852920bd33a3fec167c80b Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Jun 2023 13:57:12 +0200
+Subject: [PATCH 25/27] ArmVirt/PlatformBootManagerLib: factor out
+ IsVirtioPci()
+
+IsVirtioPciRng() becomes just a thin wrapper for IsVirtioPci().
+This allows to add similar thin wrappers for other virtio
+devices in the future.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit aaf546879ab71722c36738ccc6f0f0ab4ecf5076)
+---
+ .../PlatformBootManagerLib/PlatformBm.c       | 30 ++++++++++++++-----
+ 1 file changed, 23 insertions(+), 7 deletions(-)
+
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+index 5eb6f0f9c14a..ed38c42a43ee 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
++++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+@@ -313,15 +313,16 @@ IsVirtioRng (
+ }
+ 
+ /**
+-  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
+-  the EFI_PCI_IO_PROTOCOL level.
++  This function checks if a handle corresponds to the Virtio Device ID given
++  at the EFI_PCI_IO_PROTOCOL level.
+ **/
+ STATIC
+ BOOLEAN
+ EFIAPI
+-IsVirtioPciRng (
++IsVirtioPci (
+   IN EFI_HANDLE    Handle,
+-  IN CONST CHAR16  *ReportText
++  IN CONST CHAR16  *ReportText,
++  IN UINT16        VirtIoDeviceId
+   )
+ {
+   EFI_STATUS           Status;
+@@ -387,11 +388,11 @@ IsVirtioPciRng (
+   //
+   // From DeviceId and RevisionId, determine whether the device is a
+   // modern-only Virtio 1.0 device. In case of Virtio 1.0, DeviceId can
+-  // immediately be restricted to VIRTIO_SUBSYSTEM_ENTROPY_SOURCE, and
++  // immediately be restricted to VirtIoDeviceId, and
+   // SubsystemId will only play a sanity-check role. Otherwise, DeviceId can
+   // only be sanity-checked, and SubsystemId will decide.
+   //
+-  if ((DeviceId == 0x1040 + VIRTIO_SUBSYSTEM_ENTROPY_SOURCE) &&
++  if ((DeviceId == 0x1040 + VirtIoDeviceId) &&
+       (RevisionId >= 0x01))
+   {
+     Virtio10 = TRUE;
+@@ -419,7 +420,7 @@ IsVirtioPciRng (
+     return TRUE;
+   }
+ 
+-  if (!Virtio10 && (SubsystemId == VIRTIO_SUBSYSTEM_ENTROPY_SOURCE)) {
++  if (!Virtio10 && (SubsystemId == VirtIoDeviceId)) {
+     return TRUE;
+   }
+ 
+@@ -430,6 +431,21 @@ IsVirtioPciRng (
+   return FALSE;
+ }
+ 
++/**
++  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
++  the EFI_PCI_IO_PROTOCOL level.
++**/
++STATIC
++BOOLEAN
++EFIAPI
++IsVirtioPciRng (
++  IN EFI_HANDLE    Handle,
++  IN CONST CHAR16  *ReportText
++  )
++{
++  return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
++}
++
+ /**
+   This CALLBACK_FUNCTION attempts to connect a handle non-recursively, asking
+   the matching driver to produce all first-level child handles.
+-- 
+2.40.1
+

0026-ArmVirt-PlatformBootManagerLib-set-up-virtio-serial-.patch

@@ -0,0 +1,222 @@
+From 83a8a9dc1a51d340199587d5bea715406bbc4efa Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 1 Jun 2023 13:57:13 +0200
+Subject: [PATCH 26/27] ArmVirt/PlatformBootManagerLib: set up virtio serial as
+ console
+
+In case a virtio serial device is found in the system register the first
+console port as EFI console, by updating ConIn, ConOut and ErrOut.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit 15f83fa36442eaa272300b31699b3b82ce7e07a9)
+---
+ .../PlatformBootManagerLib/PlatformBm.c       | 172 ++++++++++++++++++
+ 1 file changed, 172 insertions(+)
+
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+index ed38c42a43ee..b92a916f7eec 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
++++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+@@ -312,6 +312,21 @@ IsVirtioRng (
+   return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
+ }
+ 
++/**
++  This FILTER_FUNCTION checks if a handle corresponds to a Virtio serial device at
++  the VIRTIO_DEVICE_PROTOCOL level.
++**/
++STATIC
++BOOLEAN
++EFIAPI
++IsVirtioSerial (
++  IN EFI_HANDLE    Handle,
++  IN CONST CHAR16  *ReportText
++  )
++{
++  return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_CONSOLE);
++}
++
+ /**
+   This function checks if a handle corresponds to the Virtio Device ID given
+   at the EFI_PCI_IO_PROTOCOL level.
+@@ -446,6 +461,21 @@ IsVirtioPciRng (
+   return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
+ }
+ 
++/**
++  This FILTER_FUNCTION checks if a handle corresponds to a Virtio serial device at
++  the EFI_PCI_IO_PROTOCOL level.
++**/
++STATIC
++BOOLEAN
++EFIAPI
++IsVirtioPciSerial (
++  IN EFI_HANDLE    Handle,
++  IN CONST CHAR16  *ReportText
++  )
++{
++  return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_CONSOLE);
++}
++
+ /**
+   This CALLBACK_FUNCTION attempts to connect a handle non-recursively, asking
+   the matching driver to produce all first-level child handles.
+@@ -534,6 +564,142 @@ AddOutput (
+     ));
+ }
+ 
++/**
++  This CALLBACK_FUNCTION retrieves the EFI_DEVICE_PATH_PROTOCOL from
++  the handle, appends serial, uart and terminal nodes, finally updates
++  ConIn, ConOut and ErrOut.
++**/
++STATIC
++VOID
++EFIAPI
++SetupVirtioSerial (
++  IN EFI_HANDLE    Handle,
++  IN CONST CHAR16  *ReportText
++  )
++{
++  STATIC CONST ACPI_HID_DEVICE_PATH  SerialNode = {
++    {
++      ACPI_DEVICE_PATH,
++      ACPI_DP,
++      {
++        (UINT8)(sizeof (ACPI_HID_DEVICE_PATH)),
++        (UINT8)((sizeof (ACPI_HID_DEVICE_PATH)) >> 8)
++      },
++    },
++    EISA_PNP_ID (0x0501),
++    0
++  };
++
++  STATIC CONST UART_DEVICE_PATH  UartNode = {
++    {
++      MESSAGING_DEVICE_PATH,
++      MSG_UART_DP,
++      {
++        (UINT8)(sizeof (UART_DEVICE_PATH)),
++        (UINT8)((sizeof (UART_DEVICE_PATH)) >> 8)
++      },
++    },
++    0,
++    115200,
++    8,
++    1,
++    1
++  };
++
++  STATIC CONST VENDOR_DEVICE_PATH  TerminalNode = {
++    {
++      MESSAGING_DEVICE_PATH,
++      MSG_VENDOR_DP,
++      {
++        (UINT8)(sizeof (VENDOR_DEVICE_PATH)),
++        (UINT8)((sizeof (VENDOR_DEVICE_PATH)) >> 8)
++      },
++    },
++    DEVICE_PATH_MESSAGING_VT_UTF8
++  };
++
++  EFI_STATUS                Status;
++  EFI_DEVICE_PATH_PROTOCOL  *DevicePath, *OldDevicePath;
++
++  DevicePath = DevicePathFromHandle (Handle);
++
++  if (DevicePath == NULL) {
++    DEBUG ((
++      DEBUG_ERROR,
++      "%a: %s: handle %p: device path not found\n",
++      __func__,
++      ReportText,
++      Handle
++      ));
++    return;
++  }
++
++  DevicePath = AppendDevicePathNode (
++                 DevicePath,
++                 &SerialNode.Header
++                 );
++
++  OldDevicePath = DevicePath;
++  DevicePath    = AppendDevicePathNode (
++                    DevicePath,
++                    &UartNode.Header
++                    );
++  FreePool (OldDevicePath);
++
++  OldDevicePath = DevicePath;
++  DevicePath    = AppendDevicePathNode (
++                    DevicePath,
++                    &TerminalNode.Header
++                    );
++  FreePool (OldDevicePath);
++
++  Status = EfiBootManagerUpdateConsoleVariable (ConIn, DevicePath, NULL);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((
++      DEBUG_ERROR,
++      "%a: %s: adding to ConIn: %r\n",
++      __func__,
++      ReportText,
++      Status
++      ));
++    return;
++  }
++
++  Status = EfiBootManagerUpdateConsoleVariable (ConOut, DevicePath, NULL);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((
++      DEBUG_ERROR,
++
++      "%a: %s: adding to ConOut: %r\n",
++      __func__,
++      ReportText,
++      Status
++      ));
++    return;
++  }
++
++  Status = EfiBootManagerUpdateConsoleVariable (ErrOut, DevicePath, NULL);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((
++      DEBUG_ERROR,
++      "%a: %s: adding to ErrOut: %r\n",
++      __func__,
++      ReportText,
++      Status
++      ));
++    return;
++  }
++
++  FreePool (DevicePath);
++
++  DEBUG ((
++    DEBUG_VERBOSE,
++    "%a: %s: added to ConIn, ConOut and ErrOut\n",
++    __func__,
++    ReportText
++    ));
++}
++
+ STATIC
+ VOID
+ PlatformRegisterFvBootOption (
+@@ -932,6 +1098,12 @@ PlatformBootManagerBeforeConsole (
+   // instances on Virtio PCI RNG devices.
+   //
+   FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciRng, Connect);
++
++  //
++  // Register Virtio serial devices as console.
++  //
++  FilterAndProcess (&gVirtioDeviceProtocolGuid, IsVirtioSerial, SetupVirtioSerial);
++  FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciSerial, SetupVirtioSerial);
+ }
+ 
+ /**
+-- 
+2.40.1
+

0027-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch

@@ -0,0 +1,42 @@
+From e2fb1116801f5725812b37f18022fe46959bd5fb Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 28 Feb 2023 15:47:00 +0100
+Subject: [PATCH 27/27] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
+
+In case the number of CPUs can in increase beyond 255
+due to CPU hotplug choose x2apic mode.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ UefiCpuPkg/Library/MpInitLib/MpLib.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
+index f1f284071441..79fd8fb04dad 100644
+--- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
++++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
+@@ -526,7 +526,9 @@ CollectProcessorCount (
+   //
+   // Enable x2APIC mode if
+   //  1. Number of CPU is greater than 255; or
+-  //  2. There are any logical processors reporting an Initial APIC ID of 255 or greater.
++  //  2. The platform exposed the exact *boot* CPU count to us in advance, and
++  //     more than 255 logical processors are possible later, with hotplug; or
++  //  3. There are any logical processors reporting an Initial APIC ID of 255 or greater.
+   //
+   X2Apic = FALSE;
+   if (CpuMpData->CpuCount > 255) {
+@@ -534,6 +536,10 @@ CollectProcessorCount (
+     // If there are more than 255 processor found, force to enable X2APIC
+     //
+     X2Apic = TRUE;
++  } else if ((PcdGet32 (PcdCpuBootLogicalProcessorNumber) > 0) &&
++             (PcdGet32 (PcdCpuMaxLogicalProcessorNumber) > 255))
++  {
++    X2Apic = TRUE;
+   } else {
+     CpuInfoInHob = (CPU_INFO_IN_HOB *)(UINTN)CpuMpData->CpuInfoInHob;
+     for (Index = 0; Index < CpuMpData->CpuCount; Index++) {
+-- 
+2.40.1
+

0028-ArmPkg-Add-Pcd-to-disable-EFI_MEMORY_ATTRIBUTE_PROTO.patch

@@ -0,0 +1,77 @@
+From 40efdacf7f4f378c0acf95a73d1dcc5e200d42d8 Mon Sep 17 00:00:00 2001
+From: Oliver Steffen <osteffen@redhat.com>
+Date: Mon, 19 Jun 2023 22:32:25 +0200
+Subject: [PATCH 28/28] ArmPkg: Add Pcd to disable
+ EFI_MEMORY_ATTRIBUTE_PROTOCOL
+
+Recent versions of shim (15.6 and 15.7) crash when the newly added
+EFI_MEMORY_ATTRIBUTE_PROTOCOL is provided by the firmware.  To allow
+existing installations to boot, provide a workaround in form of a Pcd
+that allows tuning it off at build time (defaults to 'enabled').
+
+Additionally, check the return code of the protocol installation calls.
+
+Signed-off-by: Oliver Steffen <osteffen@redhat.com>
+Message-ID: <20230619203244.228933-1-osteffen@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ ArmPkg/ArmPkg.dec                |  3 +++
+ ArmPkg/Drivers/CpuDxe/CpuDxe.inf |  1 +
+ ArmPkg/Drivers/CpuDxe/CpuDxe.c   | 13 +++++++++++--
+ 3 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/ArmPkg/ArmPkg.dec b/ArmPkg/ArmPkg.dec
+index 2444457ae58a..625e45c3e0c0 100644
+--- a/ArmPkg/ArmPkg.dec
++++ b/ArmPkg/ArmPkg.dec
+@@ -167,6 +167,9 @@ [PcdsFixedAtBuild.common]
+   gArmTokenSpaceGuid.PcdCpuVectorBaseAddress|0xffff0000|UINT64|0x00000004
+   gArmTokenSpaceGuid.PcdCpuResetAddress|0x00000000|UINT32|0x00000005
+ 
++  # Enable/Disable EFI_MEMORY_ATTRIBUTE_PROTOCOL
++  gArmTokenSpaceGuid.PcdEnableEfiMemoryAttributeProtocol|FALSE|BOOLEAN|0x000000EE
++
+   #
+   # ARM Secure Firmware PCDs
+   #
+diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.inf b/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
+index e732e21cb94a..1bad4ae160af 100644
+--- a/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
++++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
+@@ -64,6 +64,7 @@ [Guids]
+ 
+ [Pcd.common]
+   gArmTokenSpaceGuid.PcdVFPEnabled
++  gArmTokenSpaceGuid.PcdEnableEfiMemoryAttributeProtocol
+ 
+ [FeaturePcd.common]
+   gArmTokenSpaceGuid.PcdDebuggerExceptionSupport
+diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.c b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
+index d04958e79e52..ff7d735b2bde 100644
+--- a/ArmPkg/Drivers/CpuDxe/CpuDxe.c
++++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
+@@ -244,10 +244,19 @@ CpuDxeInitialize (
+                   &mCpuHandle,
+                   &gEfiCpuArchProtocolGuid,
+                   &mCpu,
+-                  &gEfiMemoryAttributeProtocolGuid,
+-                  &mMemoryAttribute,
+                   NULL
+                   );
++  ASSERT_EFI_ERROR (Status);
++
++  if (PcdGetBool (PcdEnableEfiMemoryAttributeProtocol)) {
++    Status = gBS->InstallMultipleProtocolInterfaces (
++                    &mCpuHandle,
++                    &gEfiMemoryAttributeProtocolGuid,
++                    &mMemoryAttribute,
++                    NULL
++                    );
++    ASSERT_EFI_ERROR (Status);
++  }
+ 
+   //
+   // Make sure GCD and MMU settings match. This API calls gDS->SetMemorySpaceAttributes ()
+-- 
+2.41.0
+

30-edk2-ovmf-x64-sb-enrolled.json

@@ -24,7 +24,6 @@
     ],
     "features": [
         "acpi-s3",
-        "amd-sev",
         "enrolled-keys",
         "requires-smm",
         "secure-boot",

40-edk2-ovmf-x64-sb.json

@@ -24,7 +24,6 @@
     ],
     "features": [
         "acpi-s3",
-        "amd-sev",
         "requires-smm",
         "secure-boot",
         "verbose-dynamic"

50-edk2-ovmf-ia32-nosb.json

@@ -1,5 +1,5 @@
 {
-    "description": "OVMF for i386, without SB, without SMM, with empty varstore",
+    "description": "OVMF for i386, without SB+SMM, empty varstore",
     "interface-types": [
         "uefi"
     ],

50-edk2-ovmf-x64-nosb.json

@@ -1,5 +1,5 @@
 {
-    "description": "OVMF for x86_64, without SB, without SMM, with empty varstore",
+    "description": "OVMF without SB+SMM, empty varstore",
     "interface-types": [
         "uefi"
     ],
@@ -26,6 +26,7 @@
     "features": [
         "acpi-s3",
         "amd-sev",
+        "amd-sev-es",
         "verbose-dynamic"
     ],
     "tags": [

60-edk2-ovmf-x64-amdsev.json

@@ -22,6 +22,7 @@
     "features": [
         "amd-sev",
         "amd-sev-es",
+        "amd-sev-snp",
         "verbose-dynamic"
     ],
     "tags": [

changelog

@@ -0,0 +1,370 @@
+* Fri May 05 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-4
+- drop ASSERT from NestedInterruptTplLib (rhbz#2183336).
+- add tpm probe fixes.
+
+* Mon Apr 17 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-3
+- revert: add json files for qcow2 images.
+
+* Thu Apr 13 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-2
+- add StandaloneMM and ArmVirtQemuKernel builds.
+- add json files for qcow2 images.
+- update dbx files to 2023-03.
+
+* Mon Mar 06 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-1
+- update to edk2-stable202302
+- update dbx database to 20220812
+- add riscv64 sub-rpm
+
+* Fri Feb 17 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-14
+- add sub-package with xen build (resolves: rhbz#2170730)
+
+* Sat Feb 11 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-13
+- update openssl (CVE-2023-0286, CVE-2023-0215, CVE-2022-4450, CVE-2022-4304).
+
+* Wed Feb 08 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-12
+- cherry-pick aarch64 bugfixes.
+- set firmware build release date.
+- add ext4 sub-package.
+
+* Fri Jan 06 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-10
+- add experimental builds with strict nx checking.
+
+* Mon Jan 02 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-9
+- revert 'make files sparse again' (resolves: rhbz#2155673).
+- pick up compiler + linker flags from rpm
+
+* Tue Dec 20 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-8
+- make files sparse again
+
+* Thu Dec 15 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-7
+- backport https://github.com/tianocore/edk2/pull/3770
+
+* Mon Dec 12 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-6
+- fix ovmf platform config (revert broken commit).
+- show version information in smbios (backport).
+
+* Mon Dec 05 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-5
+- rename *.json files to be more consistent.
+- build script update
+
+* Fri Dec 02 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-4
+- apply dbx updates
+
+* Tue Nov 29 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-3
+- fix build script
+
+* Mon Nov 28 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-2
+- add workaround for broken grub
+
+* Tue Sep 20 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220826gitba0e0e4c6a17-1
+- update edk2 to 2022-08 stable tag.
+- update openssl bundle to rhel-8.7 level.
+- add stdvga fix.
+- add 4MB firmware builds.
+
+* Thu Aug 18 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-5
+- comment out patch #4 (bug 2116534 workaround)
+- comment out patch #12 (bug 2114858 workaround)
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 20220526git16779ede2d36-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Fri Jun 10 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-3
+- swap stack fix patch.
+
+* Wed Jun 08 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-2
+- fix PcdResizeXterm patch.
+- minor specfile cleanup.
+- add 0021-OvmfPkg-Sec-fix-stack-switch.patch
+- Resolves rhbz#2093745
+
+* Tue May 31 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-1
+- update to new edk2 stable tag (2022-05), refresh patches.
+- add amdsev and inteltdx builds
+- drop qosb
+
+* Tue Apr 19 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220221gitb24306f15daa-4
+- switch to virt-firmware for secure boot key enrollment
+- Stop builds on armv7 too (iasl missing).
+
+* Thu Apr 07 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220221gitb24306f15daa-3
+- Fix TPM build options.
+- Stop builds on i686 (iasl missing).
+- Resolves rhbz#2072827
+
+* Wed Mar 23 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220221gitb24306f15daa-1
+- Update to edk2-stable202202
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 20211126gitbb1bba3d7767-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Mon Dec 6 2021 Gerd Hoffmann <kraxel@redhat.com> - 20211126gitbb1bba3d7767-1
+- Update to edk2-stable202111
+- Resolves rhbz#1978966
+- Resolves rhbz#2026744
+
+* Mon Dec  6 2021 Daniel P. Berrangé <berrange@redhat.com> - 20210527gite1999b264f1f-5
+- Drop glibc strcmp workaround
+
+* Mon Nov 29 2021 Daniel P. Berrangé <berrange@redhat.com> - 20210527gite1999b264f1f-4
+- Drop customized splash screen boot logo
+- Temporary workaround for suspected glibc strcmp bug breaking builds in koji
+
+* Wed Sep  1 2021 Daniel P. Berrangé <berrange@redhat.com> - 20210527gite1999b264f1f-3
+- Fix qemu packaging conditionals for ELN builds
+
+* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 20210527gite1999b264f1f-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Tue Jul 20 2021 Cole Robinson <crobinso@redhat.com> - 20210527gite1999b264f1f-1
+- Update to git snapshot
+- Sync with c9s packaging
+
+* Mon Jun 14 2021 Jiri Kucera <jkucera@redhat.com> - 20200801stable-5
+- Replace genisoimage with xorriso
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 20200801stable-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Thu Dec 03 2020 Cole Robinson <aintdiscole@gmail.com> - 20200801stable-3
+- Really fix TPM breakage (bz 1897367)
+
+* Tue Nov 24 2020 Cole Robinson <aintdiscole@gmail.com> - 20200801stable-2
+- Fix openssl usage, unbreak TPM (bz 1897367)
+
+* Wed Sep 16 2020 Cole Robinson <crobinso@redhat.com> - 20200801stable-1
+- Update to edk2 stable 202008
+
+* Sat Sep 12 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 20200201stable-6
+- Tweaks for aarch64/ARMv7 builds
+- Minor cleanups
+
+* Tue Aug 04 2020 Cole Robinson <aintdiscole@gmail.com> - 20200201stable-5
+- Fix build failures on rawhide
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 20200201stable-4
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 20200201stable-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Jul 13 2020 Tom Stellard <tstellar@redhat.com> - 20200201stable-2
+- Use make macros
+- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
+
+* Mon Apr 13 2020 Cole Robinson <aintdiscole@gmail.com> - 20200201stable-1
+- Update to stable-202002
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 20190501stable-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Fri Sep 06 2019 Patrick Uiterwijk <puiterwijk@redhat.com> - 20190501stable-4
+- Updated HTTP_BOOT option to new upstream value
+
+* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 20190501stable-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Mon Jul 15 2019 Cole Robinson <aintdiscole@gmail.com> - 20190501stable-2
+- License is now BSD-2-Clause-Patent
+- Re-enable secureboot enrollment
+- Use qemu-ovmf-secureboot from git
+
+* Thu Jul 11 2019 Cole Robinson <crobinso@redhat.com> - 20190501stable-1
+- Update to stable-201905
+- Update to openssl-1.1.1b
+- Ship VARS file for ovmf-ia32 (bug 1688596)
+- Ship Fedora-variant JSON "firmware descriptor files"
+- Resolves rhbz#1728652
+
+* Mon Mar 18 2019 Cole Robinson <aintdiscole@gmail.com> - 20190308stable-1
+- Use YYYYMMDD versioning to fix upgrade path
+
+* Fri Mar 15 2019 Cole Robinson <aintdiscole@gmail.com> - 201903stable-1
+- Update to stable-201903
+- Update to openssl-1.1.0j
+- Move to python3 deps
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 20180815gitcb5f4f45ce-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Wed Nov 14 2018 Patrick Uiterwijk <puiterwijk@redhat.com> - 20180815gitcb5f4f45ce-5
+- Add -qosb dependency on python3
+
+* Fri Nov 9 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180815gitcb5f4f45ce-4
+- Fix network boot via grub (bz 1648476)
+
+* Wed Sep 12 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180815gitcb5f4f45ce-3
+- Explicitly compile the scripts using py_byte_compile
+
+* Fri Aug 31 2018 Cole Robinson <crobinso@redhat.com> - 20180815gitcb5f4f45ce-2
+- Fix passing through RPM build flags (bz 1540244)
+
+* Tue Aug 21 2018 Cole Robinson <crobinso@redhat.com> - 20180815gitcb5f4f45ce-1
+- Update to edk2 git cb5f4f45ce, edk2-stable201808
+- Update to qemu-ovmf-secureboot-1.1.3
+- Enable TPM2 support
+
+* Mon Jul 23 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-5
+- Fixes for AMD SEV on OVMF_CODE.fd
+- Add Provides for bundled OpenSSL
+
+* Wed Jul 18 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-4
+- Enable IPv6
+
+* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 20180529gitee3198e672e2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Wed Jun 20 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-2
+- Backport two bug fixes from RHEL: connect again virtio-rng devices, and
+  connect consoles unconditionally in OVMF (ARM firmware already did it)
+
+* Tue May 29 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-1
+- Rebase to ee3198e672e2
+
+* Tue May 01 2018 Cole Robinson <crobinso@redhat.com> - 20171011git92d07e4-7
+- Bump release for new build
+
+* Fri Mar 30 2018 Patrick Uiterwijk <puiterwijk@redhat.com> - 20171011git92d07e4-6
+- Add qemu-ovmf-secureboot (qosb)
+- Generate pre-enrolled Secure Boot OVMF VARS files
+
+* Wed Mar 07 2018 Paolo Bonzini <pbonzini@redhat.com> - 20171011git92d07e4-5
+- Fix GCC 8 compilation
+- Replace dosfstools and mtools with qemu-img vvfat
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 20171011git92d07e4-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Fri Jan 19 2018 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-3
+- Add OpenSSL patches from Fedora
+- Enable TLS_MODE
+
+* Fri Nov 17 2017 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-2
+- Backport patches 19-21 from RHEL
+- Add patches 22-24 to fix SEV slowness
+- Add fedora conditionals
+
+* Tue Nov 14 2017 Paolo Bonzini <pbonzini@redhat.com> - 20171011git92d07e4-1
+- Import source and patches from RHEL version
+- Update OpenSSL to 1.1.0e
+- Refresh 0099-Tweak-the-tools_def-to-support-cross-compiling.patch
+
+* Mon Nov 13 2017 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-6
+- Allow non-cross builds
+- Install /usr/share/OVMF and /usr/share/AAVMF
+
+* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20170209git296153c5-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20170209git296153c5-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Wed Mar 15 2017 Cole Robinson <crobinso@redhat.com> - 20170209git296153c5-3
+- Ship ovmf-ia32 package (bz 1424722)
+
+* Thu Feb 16 2017 Cole Robinson <crobinso@redhat.com> - 20170209git296153c5-2
+- Update EnrollDefaultKeys patch (bz #1398743)
+
+* Mon Feb 13 2017 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-1
+- Rebase to git master
+- New patch 0010 fixes failure to build from source.
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20161105git3b25ca8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Sun Nov 06 2016 Cole Robinson <crobinso@redhat.com> - 20161105git3b25ca8-1
+- Rebase to git master
+
+* Fri Sep  9 2016 Tom Callaway <spot@fedoraproject.org> - 20160418gita8c39ba-5
+- replace legally problematic openssl source with "hobbled" tarball
+
+* Thu Jul 21 2016 Gerd Hoffmann <kraxel@redhat.com> - 20160418gita8c39ba-4
+- Also build for armv7.
+
+* Tue Jul 19 2016 Gerd Hoffmann <kraxel@redhat.com> 20160418gita8c39ba-3
+- Update EnrollDefaultKeys patch.
+
+* Fri Jul 8 2016 Paolo Bonzini <pbonzini@redhat.com> - 20160418gita8c39ba-2
+- Distribute edk2-ovmf on aarch64
+
+* Sat May 21 2016 Cole Robinson <crobinso@redhat.com> - 20160418gita8c39ba-1
+- Distribute edk2-aarch64 on x86 (bz #1338027)
+
+* Mon Apr 18 2016 Gerd Hoffmann <kraxel@redhat.com> 20160418gita8c39ba-0
+- Update to latest git.
+- Add firmware builds (FatPkg is free now).
+
+* Mon Feb 15 2016 Cole Robinson <crobinso@redhat.com> 20151127svn18975-3
+- Fix FTBFS gcc warning (bz 1307439)
+
+* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 20151127svn18975-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Fri Nov 27 2015 Paolo Bonzini <pbonzini@redhat.com> - 20151127svn18975-1
+- Rebase to 20151127svn18975-1
+- Linker script renamed to GccBase.lds
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20150519svn17469-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Tue May 19 2015 Paolo Bonzini <pbonzini@redhat.com> - 20150519svn17469-1
+- Rebase to 20150519svn17469-1
+- edk2-remove-tree-check.patch now upstream
+
+* Sat May 02 2015 Kalev Lember <kalevlember@gmail.com> - 20140724svn2670-6
+- Rebuilt for GCC 5 C++11 ABI change
+
+* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20140724svn2670-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Thu Jul 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140724svn2670-1
+- Rebase to 20140724svn2670-1
+
+* Tue Jun 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140624svn2649-1
+- Use standalone .tar.xz from buildtools repo
+
+* Tue Jun 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140328svn15376-4
+- Install BuildTools/BaseEnv
+
+* Mon Jun 23 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140328svn15376-3
+- Rebase to get GCC48 configuration
+- Package EDK_TOOLS_PATH as /usr/share/edk2
+- Package "build" and LzmaF86Compress too, as well as the new
+  tools Ecc and TianoCompress.
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20131114svn14844-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Thu Nov 14 2013 Paolo Bonzini <pbonzini@redhat.com> - 20131114svn14844-1
+- Upgrade to r14844.
+- Remove upstreamed parts of patch 1.
+
+* Fri Nov 8 2013 Paolo Bonzini <pbonzini@redhat.com> - 20130515svn14365-7
+- Make BaseTools compile on ARM.
+
+* Fri Aug 30 2013 Paolo Bonzini <pbonzini@redhat.com> - 20130515svn14365-6
+- Revert previous change; firmware packages should be noarch, and building
+  BaseTools twice is simply wrong.
+
+* Mon Aug 19 2013 Kay Sievers <kay@redhat.com> - 20130515svn14365-5
+- Add sub-package with EFI shell
+
+* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20130515svn14365-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Thu May 23 2013 Dan Horák <dan[at]danny.cz> 20130515svn14365-3
+- set ExclusiveArch
+
+* Thu May 16 2013 Paolo Bonzini <pbonzini@redhat.com> 20130515svn14365-2
+- Fix edk2-tools-python Requires
+
+* Wed May 15 2013 Paolo Bonzini <pbonzini@redhat.com> 20130515svn14365-1
+- Split edk2-tools-doc and edk2-tools-python
+- Fix Python BuildRequires
+- Remove FatBinPkg at package creation time.
+- Use fully versioned dependency.
+- Add comment on how to generate the sources.
+
+* Thu May 2 2013 Paolo Bonzini <pbonzini@redhat.com> 20130502.g732d199-1
+- Create.

edk2-build.fedora

@@ -0,0 +1,283 @@
+
+[opts.ovmf.common]
+NETWORK_HTTP_BOOT_ENABLE = TRUE
+NETWORK_IP6_ENABLE       = TRUE
+NETWORK_TLS_ENABLE       = TRUE
+NETWORK_ISCSI_ENABLE     = TRUE
+NETWORK_ALLOW_HTTP_CONNECTIONS = TRUE
+TPM2_ENABLE              = TRUE
+TPM2_CONFIG_ENABLE       = TRUE
+TPM1_ENABLE              = TRUE
+CAVIUM_ERRATUM_27456     = TRUE
+
+[opts.ovmf.4m]
+FD_SIZE_4MB              = TRUE
+
+[opts.ovmf.2m]
+FD_SIZE_2MB              = TRUE
+NETWORK_ISCSI_ENABLE     = FALSE
+
+[opts.ovmf.sb.smm]
+SECURE_BOOT_ENABLE       = TRUE
+SMM_REQUIRE              = TRUE
+# old downstream
+EXCLUDE_SHELL_FROM_FD    = TRUE
+# new upstream
+BUILD_SHELL              = FALSE
+
+# requires edk2 2022-11 or newer
+[opts.ovmf.sb.stateless]
+SECURE_BOOT_ENABLE       = TRUE
+SMM_REQUIRE              = FALSE
+
+[opts.armvirt.verbose]
+DEBUG_PRINT_ERROR_LEVEL  = 0x8040004F
+
+[opts.armvirt.silent]
+DEBUG_PRINT_ERROR_LEVEL  = 0x80000000
+
+[opts.armvirt.kernel]
+TPM2_ENABLE              = FALSE
+TPM2_CONFIG_ENABLE       = FALSE
+
+
+[pcds.nx.strict]
+PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD5
+
+[pcds.nx.broken.grub]
+# grub.efi uses EfiLoaderData for code
+PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD1
+
+
+#####################################################################
+# stateful ovmf builds (with vars in flash)
+
+[build.ovmf.2m.default]
+desc = ovmf build (64-bit, 2MB)
+conf = OvmfPkg/OvmfPkgX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.2m
+plat = OvmfX64
+dest = Fedora/ovmf
+cpy1 = FV/OVMF_CODE.fd
+cpy2 = FV/OVMF_VARS.fd
+cpy3 = X64/Shell.efi
+
+[build.ovmf.4m.default]
+desc = ovmf build (64-bit, 4MB)
+conf = OvmfPkg/OvmfPkgX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+plat = OvmfX64
+dest = Fedora/ovmf-4m
+cpy1 = FV/OVMF_CODE.fd
+cpy2 = FV/OVMF_VARS.fd
+
+[build.ovmf.2m.sb.smm]
+desc = ovmf build (32/64-bit, 2MB, q35 only, needs smm, secure boot)
+conf = OvmfPkg/OvmfPkgIa32X64.dsc
+arch = IA32 X64
+opts = ovmf.common
+       ovmf.2m
+       ovmf.sb.smm
+plat = Ovmf3264
+dest = Fedora/ovmf
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
+cpy2 = X64/EnrollDefaultKeys.efi
+
+[build.ovmf.4m.sb.smm]
+desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot)
+conf = OvmfPkg/OvmfPkgIa32X64.dsc
+arch = IA32 X64
+opts = ovmf.common
+       ovmf.4m
+       ovmf.sb.smm
+plat = Ovmf3264
+dest = Fedora/ovmf-4m
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
+
+
+#####################################################################
+# stateless ovmf builds (firmware in rom or r/o flash)
+
+[build.ovmf.microvm]
+desc = ovmf build for qemu microvm (2MB)
+conf = OvmfPkg/Microvm/MicrovmX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.2m
+plat = MicrovmX64
+dest = Fedora/ovmf
+cpy1 = FV/MICROVM.fd
+
+[build.ovmf.xen]
+desc = ovmf build for Xen
+conf = OvmfPkg/OvmfXen.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.2m
+plat = OvmfXen
+dest = Fedora/xen
+cpy1 = FV/OVMF.fd
+
+[build.ovmf.amdsev]
+desc = ovmf build for AmdSev (2MB)
+conf = OvmfPkg/AmdSev/AmdSevX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.2m
+plat = AmdSev
+dest = Fedora/ovmf
+cpy1 = FV/OVMF.fd OVMF.amdsev.fd
+
+[build.ovmf.inteltdx]
+desc = ovmf build for IntelTdx (2MB)
+conf = OvmfPkg/IntelTdx/IntelTdxX64.dsc
+arch = X64
+opts = ovmf.common ovmf.2m
+plat = IntelTdx
+dest = Fedora/ovmf
+cpy1 = FV/OVMF.fd OVMF.inteltdx.fd
+
+
+#####################################################################
+# armvirt builds
+
+[build.armvirt.aa64.verbose]
+desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.verbose
+pcds = nx.broken.grub
+plat = ArmVirtQemu-AARCH64
+dest = Fedora/aarch64
+cpy1 = FV/QEMU_EFI.fd
+cpy2 = FV/QEMU_VARS.fd
+cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
+cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
+pad3 = QEMU_EFI-pflash.raw      64m
+pad4 = vars-template-pflash.raw 64m
+
+[build.armvirt.aa64.silent]
+desc = ArmVirt build for qemu, 64-bit (arm v8), silent
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.silent
+pcds = nx.broken.grub
+plat = ArmVirtQemu-AARCH64
+dest = Fedora/aarch64
+cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.silent.fd
+cpy2 = FV/QEMU_EFI.fd  QEMU_EFI-silent-pflash.raw
+pad2 = QEMU_EFI-silent-pflash.raw 64m
+
+[build.armvirt.aa64.kernel]
+desc = ArmVirt build for qemu, 64-bit (arm v8)
+conf = ArmVirtPkg/ArmVirtQemuKernel.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.silent
+       armvirt.kernel
+pcds = nx.broken.grub
+plat = ArmVirtQemuKernel-AARCH64
+dest = Fedora/aarch64
+cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.kernel.fd
+
+
+#####################################################################
+# riscv
+
+[build.riscv.qemu]
+conf = OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc
+arch = RISCV64
+plat = RiscVVirtQemu
+dest = Fedora/riscv
+cpy1 = FV/RISCV_VIRT.fd
+cpy2 = FV/RISCV_VIRT.fd RISCV_VIRT.raw
+pad1 = RISCV_VIRT.raw 32m
+
+
+#####################################################################
+# 32-bit builds
+
+[build.ovmf.ia32.default]
+desc = ovmf build (32-bit, 2MB)
+conf = OvmfPkg/OvmfPkgIa32.dsc
+arch = IA32
+opts = ovmf.common
+       ovmf.2m
+plat = OvmfIa32
+dest = Fedora/ovmf-ia32
+cpy1 = FV/OVMF_CODE.fd
+cpy2 = FV/OVMF_VARS.fd
+cpy3 = IA32/Shell.efi
+
+[build.ovmf.ia32.sb.smm]
+desc = ovmf build (32-bit, 2MB, q35 only, needs smm, secure boot)
+conf = OvmfPkg/OvmfPkgIa32.dsc
+arch = IA32
+opts = ovmf.common
+       ovmf.2m
+       ovmf.sb.smm
+plat = OvmfIa32
+dest = Fedora/ovmf-ia32
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
+cpy2 = IA32/EnrollDefaultKeys.efi
+
+[build.armvirt.arm]
+desc = ArmVirt build for qemu, 32-bit (arm v7)
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = ARM
+opts = ovmf.common
+pcds = nx.broken.grub
+plat = ArmVirtQemu-ARM
+dest = Fedora/arm
+cpy1 = FV/QEMU_EFI.fd
+cpy2 = FV/QEMU_VARS.fd
+cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
+cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
+pad3 = QEMU_EFI-pflash.raw      64m
+pad4 = vars-template-pflash.raw 64m
+
+
+#####################################################################
+# experimental builds
+
+[build.ovmf.sb.stateless]
+desc = ovmf build (64-bit, stateless secure boot)
+conf = OvmfPkg/OvmfPkgX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+       ovmf.sb.stateless
+plat = OvmfX64
+dest = Fedora/experimental
+cpy1 = FV/OVMF.fd OVMF.stateless.fd
+
+[build.ovmf.strict.nx]
+desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot, strict nx)
+conf = OvmfPkg/OvmfPkgIa32X64.dsc
+arch = IA32 X64
+opts = ovmf.common
+       ovmf.4m
+       ovmf.sb.smm
+pcds = nx.strict
+plat = Ovmf3264
+dest = Fedora/experimental
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.4m.secboot.strictnx.fd
+
+[build.armvirt.aa64.strict.nx]
+desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.verbose
+pcds = nx.strict
+plat = ArmVirtQemu-AARCH64
+dest = Fedora/experimental
+cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.strictnx.fd
+cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-strictnx-pflash.raw
+pad3 = QEMU_EFI-strictnx-pflash.raw  64m

edk2-build.fedora.platforms

@@ -0,0 +1,47 @@
+
+#####################################################################
+# ext4 driver
+
+[build.ext4.x64]
+desc = ext4 driver
+conf = Features/Ext4Pkg/Ext4Pkg.dsc
+arch = X64
+plat = Ext4Pkg
+dest = Fedora/drivers
+cpy1 = X64/Ext4Dxe.efi ext4x64.efi
+
+[build.ext4.aa64]
+desc = ext4 driver
+conf = Features/Ext4Pkg/Ext4Pkg.dsc
+arch = AARCH64
+plat = Ext4Pkg
+dest = Fedora/drivers
+cpy1 = AARCH64/Ext4Dxe.efi ext4aa64.efi
+
+[build.ext4.riscv64]
+desc = ext4 driver
+conf = Features/Ext4Pkg/Ext4Pkg.dsc
+arch = RISCV64
+plat = Ext4Pkg
+dest = Fedora/drivers
+cpy1 = RISCV64/Ext4Dxe.efi ext4riscv64.efi
+
+
+#####################################################################
+# arm standalone mm
+
+[build.standalone.mm.aa64]
+conf = Platform/StandaloneMm/PlatformStandaloneMmPkg/PlatformStandaloneMmRpmb.dsc
+arch = AARCH64
+plat = MmStandaloneRpmb
+dest = Fedora/aarch64
+cpy1 = FV/BL32_AP_MM.fd
+
+
+#####################################################################
+# loongarch builds
+
+[build.loongarch]
+desc = Loongarch build
+conf = Platform/Loongson/LoongArchQemuPkg/Loongson.dsc
+arch = LOONGARCH64

edk2-build.py

@@ -0,0 +1,391 @@
+#!/usr/bin/python3
+"""
+build helper script for edk2, see
+https://gitlab.com/kraxel/edk2-build-config
+
+"""
+import os
+import sys
+import shutil
+import argparse
+import subprocess
+import configparser
+
+rebase_prefix    = ""
+version_override = None
+release_date     = None
+
+# pylint: disable=unused-variable
+def check_rebase():
+    """ detect 'git rebase -x edk2-build.py master' testbuilds """
+    global rebase_prefix
+    global version_override
+    gitdir = '.git'
+
+    if os.path.isfile(gitdir):
+        with open(gitdir, 'r', encoding = 'utf-8') as f:
+            (unused, gitdir) = f.read().split()
+
+    if not os.path.exists(f'{gitdir}/rebase-merge/msgnum'):
+        return
+    with open(f'{gitdir}/rebase-merge/msgnum', 'r', encoding = 'utf-8') as f:
+        msgnum = int(f.read())
+    with open(f'{gitdir}/rebase-merge/end', 'r', encoding = 'utf-8') as f:
+        end = int(f.read())
+    with open(f'{gitdir}/rebase-merge/head-name', 'r', encoding = 'utf-8') as f:
+        head = f.read().strip().split('/')
+
+    rebase_prefix = f'[ {int(msgnum/2)} / {int(end/2)} - {head[-1]} ] '
+    if msgnum != end and not version_override:
+        # fixed version speeds up builds
+        version_override = "test-build-patch-series"
+
+def get_coredir(cfg):
+    if cfg.has_option('global', 'core'):
+        return os.path.abspath(cfg['global']['core'])
+    return os.getcwd()
+
+def get_toolchain(cfg, build):
+    if cfg.has_option(build, 'tool'):
+        return cfg[build]['tool']
+    if cfg.has_option('global', 'tool'):
+        return cfg['global']['tool']
+    return 'GCC5'
+
+def get_version(cfg):
+    coredir = get_coredir(cfg)
+    if version_override:
+        version = version_override
+        print('')
+        print(f'### version [override]: {version}')
+        return version
+    if os.environ.get('RPM_PACKAGE_NAME'):
+        version = os.environ.get('RPM_PACKAGE_NAME')
+        version += '-' + os.environ.get('RPM_PACKAGE_VERSION')
+        version += '-' + os.environ.get('RPM_PACKAGE_RELEASE')
+        print('')
+        print(f'### version [rpmbuild]: {version}')
+        return version
+    if os.path.exists(coredir + '/.git'):
+        cmdline = [ 'git', 'describe', '--tags', '--abbrev=8',
+                    '--match=edk2-stable*' ]
+        result = subprocess.run(cmdline, cwd = coredir,
+                                stdout = subprocess.PIPE,
+                                check = True)
+        version = result.stdout.decode().strip()
+        print('')
+        print(f'### version [git]: {version}')
+        return version
+    return None
+
+def pcd_string(name, value):
+    return f'{name}=L{value}\\0'
+
+def pcd_version(cfg):
+    version = get_version(cfg)
+    if version is None:
+        return []
+    return [ '--pcd', pcd_string('PcdFirmwareVersionString', version) ]
+
+def pcd_release_date():
+    if release_date is None:
+        return []
+    return [ '--pcd', pcd_string('PcdFirmwareReleaseDateString', release_date) ]
+
+def build_message(line, line2 = None):
+    if os.environ.get('TERM') in [ 'xterm', 'xterm-256color' ]:
+        # setxterm  title
+        start  = '\x1b]2;'
+        end    = '\x07'
+        print(f'{start}{rebase_prefix}{line}{end}', end = '')
+
+    print('')
+    print('###')
+    print(f'### {rebase_prefix}{line}')
+    if line2:
+        print(f'### {line2}')
+    print('###', flush = True)
+
+def build_run(cmdline, name, section, silent = False):
+    print(cmdline, flush = True)
+    if silent:
+        print('### building in silent mode ...', flush = True)
+        result = subprocess.run(cmdline, check = False,
+                                stdout = subprocess.PIPE,
+                                stderr = subprocess.STDOUT)
+
+        logfile = f'{section}.log'
+        print(f'### writing log to {logfile} ...')
+        with open(logfile, 'wb') as f:
+            f.write(result.stdout)
+
+        if result.returncode:
+            print('### BUILD FAILURE')
+            print('### output')
+            print(result.stdout.decode())
+            print(f'### exit code: {result.returncode}')
+        else:
+            print('### OK')
+    else:
+        result = subprocess.run(cmdline, check = False)
+    if result.returncode:
+        print(f'ERROR: {cmdline[0]} exited with {result.returncode}'
+              f' while building {name}')
+        sys.exit(result.returncode)
+
+def build_copy(plat, tgt, toolchain, dstdir, copy):
+    srcdir = f'Build/{plat}/{tgt}_{toolchain}'
+    names = copy.split()
+    srcfile = names[0]
+    if len(names) > 1:
+        dstfile = names[1]
+    else:
+        dstfile = os.path.basename(srcfile)
+    print(f'# copy: {srcdir} / {srcfile}  =>  {dstdir} / {dstfile}')
+
+    src = srcdir + '/' + srcfile
+    dst = dstdir + '/' + dstfile
+    os.makedirs(os.path.dirname(dst), exist_ok = True)
+    shutil.copy(src, dst)
+
+def pad_file(dstdir, pad):
+    args = pad.split()
+    if len(args) < 2:
+        raise RuntimeError(f'missing arg for pad ({args})')
+    name = args[0]
+    size = args[1]
+    cmdline = [
+        'truncate',
+        '--size', size,
+        dstdir + '/' + name,
+    ]
+    print(f'# padding: {dstdir} / {name}  =>  {size}')
+    subprocess.run(cmdline, check = True)
+
+# pylint: disable=too-many-branches
+def build_one(cfg, build, jobs = None, silent = False):
+    b = cfg[build]
+
+    cmdline  = [ 'build' ]
+    cmdline += [ '-t', get_toolchain(cfg, build) ]
+    cmdline += [ '-p', b['conf'] ]
+
+    if (b['conf'].startswith('OvmfPkg/') or
+        b['conf'].startswith('ArmVirtPkg/')):
+        cmdline += pcd_version(cfg)
+        cmdline += pcd_release_date()
+
+    if jobs:
+        cmdline += [ '-n', jobs ]
+    for arch in b['arch'].split():
+        cmdline += [ '-a', arch ]
+    if 'opts' in b:
+        for name in b['opts'].split():
+            section = 'opts.' + name
+            for opt in cfg[section]:
+                cmdline += [ '-D', opt + '=' + cfg[section][opt] ]
+    if 'pcds' in b:
+        for name in b['pcds'].split():
+            section = 'pcds.' + name
+            for pcd in cfg[section]:
+                cmdline += [ '--pcd', pcd + '=' + cfg[section][pcd] ]
+    if 'tgts' in b:
+        tgts = b['tgts'].split()
+    else:
+        tgts = [ 'DEBUG' ]
+    for tgt in tgts:
+        desc = None
+        if 'desc' in b:
+            desc = b['desc']
+        build_message(f'building: {b["conf"]} ({b["arch"]}, {tgt})',
+                      f'description: {desc}')
+        build_run(cmdline + [ '-b', tgt ],
+                  b['conf'],
+                  build + '.' + tgt,
+                  silent)
+
+        if 'plat' in b:
+            # copy files
+            for cpy in b:
+                if not cpy.startswith('cpy'):
+                    continue
+                build_copy(b['plat'], tgt,
+                           get_toolchain(cfg, build),
+                           b['dest'], b[cpy])
+            # pad builds
+            for pad in b:
+                if not pad.startswith('pad'):
+                    continue
+                pad_file(b['dest'], b[pad])
+
+def build_basetools(silent = False):
+    build_message('building: BaseTools')
+    basedir = os.environ['EDK_TOOLS_PATH']
+    cmdline = [ 'make', '-C', basedir ]
+    build_run(cmdline, 'BaseTools', 'build.basetools', silent)
+
+def binary_exists(name):
+    for pdir in os.environ['PATH'].split(':'):
+        if os.path.exists(pdir + '/' + name):
+            return True
+    return False
+
+def prepare_env(cfg):
+    """ mimic Conf/BuildEnv.sh """
+    workspace = os.getcwd()
+    packages = [ workspace, ]
+    path = os.environ['PATH'].split(':')
+    dirs = [
+        'BaseTools/Bin/Linux-x86_64',
+        'BaseTools/BinWrappers/PosixLike'
+    ]
+
+    if cfg.has_option('global', 'pkgs'):
+        for pkgdir in cfg['global']['pkgs'].split():
+            packages.append(os.path.abspath(pkgdir))
+    coredir = get_coredir(cfg)
+    if coredir != workspace:
+        packages.append(coredir)
+
+    # add basetools to path
+    for pdir in dirs:
+        p = coredir + '/' + pdir
+        if not os.path.exists(p):
+            continue
+        if p in path:
+            continue
+        path.insert(0, p)
+
+    # run edksetup if needed
+    toolsdef = coredir + '/Conf/tools_def.txt'
+    if not os.path.exists(toolsdef):
+        os.makedirs(os.path.dirname(toolsdef), exist_ok = True)
+        build_message('running BaseTools/BuildEnv')
+        cmdline = [ 'bash', 'BaseTools/BuildEnv' ]
+        subprocess.run(cmdline, cwd = coredir, check = True)
+
+    # set variables
+    os.environ['PATH'] = ':'.join(path)
+    os.environ['PACKAGES_PATH'] = ':'.join(packages)
+    os.environ['WORKSPACE'] = workspace
+    os.environ['EDK_TOOLS_PATH'] = coredir + '/BaseTools'
+    os.environ['CONF_PATH'] = coredir + '/Conf'
+    os.environ['PYTHON_COMMAND'] = '/usr/bin/python3'
+    os.environ['PYTHONHASHSEED'] = '1'
+
+    # for cross builds
+    if binary_exists('arm-linux-gnu-gcc'):
+        os.environ['GCC5_ARM_PREFIX'] = 'arm-linux-gnu-'
+    if binary_exists('loongarch64-linux-gnu-gcc'):
+        os.environ['GCC5_LOONGARCH64_PREFIX'] = 'loongarch64-linux-gnu-'
+
+    hostarch = os.uname().machine
+    if binary_exists('aarch64-linux-gnu-gcc') and hostarch != 'aarch64':
+        os.environ['GCC5_AARCH64_PREFIX'] = 'aarch64-linux-gnu-'
+    if binary_exists('riscv64-linux-gnu-gcc') and hostarch != 'riscv64':
+        os.environ['GCC5_RISCV64_PREFIX'] = 'riscv64-linux-gnu-'
+    if binary_exists('x86_64-linux-gnu-gcc') and hostarch != 'x86_64':
+        os.environ['GCC5_IA32_PREFIX'] = 'x86_64-linux-gnu-'
+        os.environ['GCC5_X64_PREFIX'] = 'x86_64-linux-gnu-'
+        os.environ['GCC5_BIN'] = 'x86_64-linux-gnu-'
+
+def build_list(cfg):
+    for build in cfg.sections():
+        if not build.startswith('build.'):
+            continue
+        name = build.lstrip('build.')
+        desc = 'no description'
+        if 'desc' in cfg[build]:
+            desc = cfg[build]['desc']
+        print(f'# {name:20s} - {desc}')
+
+def main():
+    parser = argparse.ArgumentParser(prog = 'edk2-build',
+                                     description = 'edk2 build helper script')
+    parser.add_argument('-c', '--config', dest = 'configfile',
+                        type = str, default = '.edk2.builds', metavar = 'FILE',
+                        help = 'read configuration from FILE (default: .edk2.builds)')
+    parser.add_argument('-C', '--directory', dest = 'directory', type = str,
+                        help = 'change to DIR before building', metavar = 'DIR')
+    parser.add_argument('-j', '--jobs', dest = 'jobs', type = str,
+                        help = 'allow up to JOBS parallel build jobs',
+                        metavar = 'JOBS')
+    parser.add_argument('-m', '--match', dest = 'match', type = str,
+                        help = 'only run builds matching INCLUDE (substring)',
+                        metavar = 'INCLUDE')
+    parser.add_argument('-x', '--exclude', dest = 'exclude', type = str,
+                        help = 'skip builds matching EXCLUDE (substring)',
+                        metavar = 'EXCLUDE')
+    parser.add_argument('-l', '--list', dest = 'list',
+                        action = 'store_true', default = False,
+                        help = 'list build configs available')
+    parser.add_argument('--silent', dest = 'silent',
+                        action = 'store_true', default = False,
+                        help = 'write build output to logfiles, '
+                        'write to console only on errors')
+    parser.add_argument('--core', dest = 'core', type = str, metavar = 'DIR',
+                        help = 'location of the core edk2 repository '
+                        '(i.e. where BuildTools are located)')
+    parser.add_argument('--pkg', '--package', dest = 'pkgs',
+                        type = str, action = 'append', metavar = 'DIR',
+                        help = 'location(s) of additional packages '
+                        '(can be specified multiple times)')
+    parser.add_argument('-t', '--toolchain', dest = 'toolchain', type = str, metavar = 'NAME',
+                        help = 'tool chain to be used to build edk2')
+    parser.add_argument('--version-override', dest = 'version_override',
+                        type = str, metavar = 'VERSION',
+                        help = 'set firmware build version')
+    parser.add_argument('--release-date', dest = 'release_date',
+                        type = str, metavar = 'DATE',
+                        help = 'set firmware build release date (in MM/DD/YYYY format)')
+    options = parser.parse_args()
+
+    if options.directory:
+        os.chdir(options.directory)
+
+    if not os.path.exists(options.configfile):
+        print('config file "{options.configfile}" not found')
+        return 1
+
+    cfg = configparser.ConfigParser()
+    cfg.optionxform = str
+    cfg.read(options.configfile)
+
+    if options.list:
+        build_list(cfg)
+        return 0
+
+    if not cfg.has_section('global'):
+        cfg.add_section('global')
+    if options.core:
+        cfg.set('global', 'core', options.core)
+    if options.pkgs:
+        cfg.set('global', 'pkgs', ' '.join(options.pkgs))
+    if options.toolchain:
+        cfg.set('global', 'tool', options.toolchain)
+
+    global version_override
+    global release_date
+    check_rebase()
+    if options.version_override:
+        version_override = options.version_override
+    if options.release_date:
+        release_date = options.release_date
+
+    prepare_env(cfg)
+    build_basetools(options.silent)
+    for build in cfg.sections():
+        if not build.startswith('build.'):
+            continue
+        if options.match and options.match not in build:
+            print(f'# skipping "{build}" (not matching "{options.match}")')
+            continue
+        if options.exclude and options.exclude in build:
+            print(f'# skipping "{build}" (matching "{options.exclude}")')
+            continue
+        build_one(cfg, build, options.jobs, options.silent)
+
+    return 0
+
+if __name__ == '__main__':
+    sys.exit(main())

edk2-build.rhel-9

@@ -0,0 +1,119 @@
+
+[opts.ovmf.common]
+NETWORK_HTTP_BOOT_ENABLE = TRUE
+NETWORK_IP6_ENABLE       = TRUE
+NETWORK_TLS_ENABLE       = TRUE
+NETWORK_ISCSI_ENABLE     = TRUE
+NETWORK_ALLOW_HTTP_CONNECTIONS = TRUE
+TPM2_ENABLE              = TRUE
+TPM2_CONFIG_ENABLE       = TRUE
+TPM1_ENABLE              = FALSE
+CAVIUM_ERRATUM_27456     = TRUE
+
+[opts.ovmf.4m]
+FD_SIZE_4MB              = TRUE
+
+[opts.ovmf.sb.smm]
+SECURE_BOOT_ENABLE       = TRUE
+SMM_REQUIRE              = TRUE
+# old downstream
+EXCLUDE_SHELL_FROM_FD    = TRUE
+# new upstream
+BUILD_SHELL              = FALSE
+
+[opts.armvirt.verbose]
+DEBUG_PRINT_ERROR_LEVEL  = 0x8040004F
+
+[opts.armvirt.silent]
+DEBUG_PRINT_ERROR_LEVEL  = 0x80000000
+
+[pcds.nx.strict]
+PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD5
+
+[pcds.nx.broken.grub]
+# grub.efi uses EfiLoaderData for code
+PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD1
+
+#####################################################################
+# stateful ovmf builds (with vars in flash)
+
+[build.ovmf.4m.default]
+desc = ovmf build (64-bit, 4MB)
+conf = OvmfPkg/OvmfPkgX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+plat = OvmfX64
+dest = RHEL-9/ovmf
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.fd
+cpy2 = FV/OVMF_VARS.fd
+cpy3 = X64/Shell.efi
+
+[build.ovmf.4m.sb.smm]
+desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot)
+conf = OvmfPkg/OvmfPkgIa32X64.dsc
+arch = IA32 X64
+opts = ovmf.common
+       ovmf.4m
+       ovmf.sb.smm
+plat = Ovmf3264
+dest = RHEL-9/ovmf
+cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
+cpy2 = X64/EnrollDefaultKeys.efi
+
+
+#####################################################################
+# stateless ovmf builds (firmware in rom or r/o flash)
+
+[build.ovmf.amdsev]
+desc = ovmf build for AmdSev (4MB)
+conf = OvmfPkg/AmdSev/AmdSevX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+plat = AmdSev
+dest = RHEL-9/ovmf
+cpy1 = FV/OVMF.fd OVMF.amdsev.fd
+
+[build.ovmf.inteltdx]
+desc = ovmf build for IntelTdx (4MB)
+conf = OvmfPkg/IntelTdx/IntelTdxX64.dsc
+arch = X64
+opts = ovmf.common
+       ovmf.4m
+plat = IntelTdx
+dest = RHEL-9/ovmf
+cpy1 = FV/OVMF.fd OVMF.inteltdx.fd
+
+
+#####################################################################
+# armvirt builds
+
+[build.armvirt.aa64.verbose]
+desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.verbose
+pcds = nx.broken.grub
+plat = ArmVirtQemu-AARCH64
+dest = RHEL-9/aarch64
+cpy1 = FV/QEMU_EFI.fd
+cpy2 = FV/QEMU_VARS.fd
+cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
+cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
+pad3 = QEMU_EFI-pflash.raw      64m
+pad4 = vars-template-pflash.raw 64m
+
+[build.armvirt.aa64.silent]
+desc = ArmVirt build for qemu, 64-bit (arm v8), silent
+conf = ArmVirtPkg/ArmVirtQemu.dsc
+arch = AARCH64
+opts = ovmf.common
+       armvirt.silent
+pcds = nx.broken.grub
+plat = ArmVirtQemu-AARCH64
+dest = RHEL-9/aarch64
+cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.silent.fd
+cpy2 = FV/QEMU_EFI.fd  QEMU_EFI-silent-pflash.raw
+pad2 = QEMU_EFI-silent-pflash.raw 64m

edk2-ovmf-cc.json

@@ -1,33 +0,0 @@
-{
-    "description": "OVMF with SEV-ES support",
-    "interface-types": [
-        "uefi"
-    ],
-    "mapping": {
-        "device": "flash",
-        "executable": {
-            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.cc.fd",
-            "format": "raw"
-        },
-        "nvram-template": {
-            "filename": "/usr/share/edk2/ovmf/OVMF_VARS.fd",
-            "format": "raw"
-        }
-    },
-    "targets": [
-        {
-            "architecture": "x86_64",
-            "machines": [
-                "pc-q35-*"
-            ]
-        }
-    ],
-    "features": [
-        "amd-sev",
-        "amd-sev-es",
-        "verbose-dynamic"
-    ],
-    "tags": [
-
-    ]
-}

make-tarball.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# args
+repo="${1%/}"
+ref="${2-HEAD}"
+
+# check
+if test ! -d "${repo}/.git"; then
+    echo "usage: $0 <repodir> [ <ref> ]"
+    exit 1
+fi
+
+# get + print info
+commit=$(cd $repo; git show --pretty='format:%h' $ref | head -1)
+date=$(cd $repo; git show --pretty='format:%cs' $ref | head -1 | tr -d '-')
+echo "# $repo $ref  ->  commit $commit - date $date"
+
+# create tarball
+name="${repo##*/}"
+file="${name}-${commit}.tar.xz"
+(cd $repo; git archive --format=tar --prefix=${name}-${commit}/ ${commit}) \
+    | xz -9ev > "$file"
+echo "# $file written"

sources

@@ -1,3 +1,5 @@
 SHA512 (softfloat-20180726-gitb64af41.tar.xz) = f079debd1bfcc0fe64329a8947b0689ef49246793edcdd28a2879f6550c652b0cf0f53ac4f6f5ab61ac4f7933972e0019d0ab63eb9931b6884c2909f3a5ead30
-SHA512 (openssl-rhel-bdd048e929dcfcf2f046d74e812e0e3d5fc58504.tar.xz) = d6c0be28cefaa7993f479aecf45f5523e10aab388a92c3e4add55d6ff8483cc01fba367be62f6e9a23bfad7b46986befd3eca0d0e89b984049719645e37d52df
-SHA512 (edk2-16779ede2d36.tar.xz) = ab4fe5208506d93796db45cdcc63b95d99ebeb34e4783ede9b4bb411befe0dd09adf64b2cdf390180bc5c007ac5cde3b9692d4bf4c536261631ecccf0e2778c9
+SHA512 (jansson-2.13.1.tar.bz2) = 057f0eda43e4162569888d739f4d78d1d02fce8359400d8f66fdc6e440b0405cb457e1126820dc8ce51e9c4a7f4b7effc640caf1d54307c78c0c47c3fc093011
+SHA512 (openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz) = 418f8476e80c79e76ba2225670075f95ae75065b23cad9180daac5149e02f11deaa6551e1f70d04fe4b275b0e5f2756f890738693516a737d6f84ee8cd839019
+SHA512 (edk2-ba91d0292e59.tar.xz) = bbf1c45a168528f057b8e1b43b7bec8eba68238b07ec9cff08a0478cb7f6599c233c18c45fea1044892bb600435070b205e01e108c745274fdd5954109968974
+SHA512 (edk2-platforms-7880b92e2a04.tar.xz) = 054cff28dd9ffa634067a9572570bd397dad892c056f174166f2d2acad52d3623b5768dac99d0a836e44b4a90fce965acc75a59446c9a48b7042b9d62439c7fb