public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/edk2] f43: [rebase] update patches
@ 2026-08-26 16:42 Gerd Hoffmann
0 siblings, 0 replies; only message in thread
From: Gerd Hoffmann @ 2026-08-26 16:42 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/edk2
Branch : f43
Commit : 8f9f72613d5e342336e6049171378654eb7ba416
Author : Gerd Hoffmann <kraxel@redhat.com>
Date : 2026-08-26T18:42:17+02:00
Stats : +1735/-2611 in 38 file(s)
URL : https://src.fedoraproject.org/rpms/edk2/c/8f9f72613d5e342336e6049171378654eb7ba416?branch=f43
Log:
[rebase] update patches
---
diff --git a/0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch b/0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch
index 9c477bd..3b812df 100644
--- a/0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch
+++ b/0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch
@@ -1,7 +1,7 @@
-From 244ad53f96b2f49471490ded75f2d148de0a50ad Mon Sep 17 00:00:00 2001
+From 4f75917bda3c88978bc12dc9d82be0f997de26ed Mon Sep 17 00:00:00 2001
From: Laszlo Ersek <lersek@redhat.com>
Date: Thu, 4 Jun 2020 13:34:12 +0200
-Subject: [PATCH 01/17] BaseTools: do not build BrotliCompress (RH only)
+Subject: [PATCH 01/16] BaseTools: do not build BrotliCompress (RH only)
Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -39,5 +39,5 @@ index 73f4b27eeb71..7de12940b30e 100644
EfiRom \
GenFfs \
--
-2.53.0
+2.55.0
diff --git a/0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch b/0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch
index 443b9f5..39514f7 100644
--- a/0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch
+++ b/0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch
@@ -1,7 +1,7 @@
-From 540db50d3b83fdc5e10c424fcea2b6f9f1c44956 Mon Sep 17 00:00:00 2001
+From bb4673d750638fa3a1a74ee45207fd8ad6c5edd7 Mon Sep 17 00:00:00 2001
From: Laszlo Ersek <lersek@redhat.com>
Date: Thu, 4 Jun 2020 13:39:08 +0200
-Subject: [PATCH 02/21] MdeModulePkg: remove package-private Brotli include
+Subject: [PATCH 02/16] MdeModulePkg: remove package-private Brotli include
path (RH only)
Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -28,23 +28,21 @@ remove the include path too.
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit e05e0de713c4a2b8adb6ff9809611f222bfe50ed)
---
- MdeModulePkg/MdeModulePkg.dec | 3 ---
- 1 file changed, 3 deletions(-)
+ MdeModulePkg/MdeModulePkg.dec | 1 -
+ 1 file changed, 1 deletion(-)
diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 0775aa954ad6..0d981111edd9 100644
+index f6b1a73d7091..58079050083d 100644
--- a/MdeModulePkg/MdeModulePkg.dec
+++ b/MdeModulePkg/MdeModulePkg.dec
-@@ -27,9 +27,6 @@ [Includes]
- Include
+@@ -28,7 +28,6 @@ [Includes]
Test/Mock/Include
--[Includes.Common.Private]
+ [Includes.Common.Private]
- Library/BrotliCustomDecompressLib/brotli/c/include
--
+ Core/PrivateInclude
+
[LibraryClasses]
- ## @libraryclass Defines a set of methods to reset whole system.
- ResetSystemLib|Include/Library/ResetSystemLib.h
--
-2.51.1
+2.55.0
diff --git a/0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch b/0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
deleted file mode 100644
index 98f503c..0000000
--- a/0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
+++ /dev/null
@@ -1,180 +0,0 @@
-From 1c01111c75061c462acc17410f089e2da915d98a Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Tue, 25 Feb 2014 22:40:01 +0100
-Subject: [PATCH 03/19] MdeModulePkg: TerminalDxe: set xterm resolution on mode
- change (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- Resolve harmless conflict in "MdeModulePkg/MdeModulePkg.dec",
- originating from new upstream commits
- - 45bc28172fbf ("MdeModulePkg.dec: Change PCDs for status code.",
- 2020-06-18),
- - 0785c619a58a ("MdeModulePkg/Bus/Pci/PciBusDxe: Support PCIe Resizable
- BAR Capability", 2021-01-04),
- - ef23012e5439 ("MdeModulePkg: Change default value of
- PcdPcieResizableBarSupport to FALSE", 2021-01-14).
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- Resolve trivial conflict in "MdeModulePkg/MdeModulePkg.dec", arising
- from upstream commit 166830d8f7ca ("MdeModulePkg/dec: add
- PcdTcgPfpMeasurementRevision PCD", 2020-01-06).
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- Conflict in "MdeModulePkg/MdeModulePkg.dec" due to upstream commits
- - 1103ba946aee ("MdeModulePkg: Add Capsule On Disk related definition.",
- 2019-06-26),
- - 1c7b3eb84631 ("MdeModulePkg/DxeIpl: Introduce PCD
- PcdUse5LevelPageTable", 2019-08-09),
- with easy manual resolution.
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- no change
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
- a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no change
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- Refresh downstream-only commit 2909e025db68 against "MdeModulePkg.dec"
- context change from upstream commits e043f7895b83 ("MdeModulePkg: Add
- PCD PcdPteMemoryEncryptionAddressOrMask", 2017-02-27) and 76081dfcc5b2
- ("MdeModulePkg: Add PROMPT&HELP string of pcd to UNI file", 2017-03-03).
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- refresh commit 519b9751573e against various context changes
-
-The
-
- CSI Ps ; Ps ; Ps t
-
-escape sequence serves for window manipulation. We can use the
-
- CSI 8 ; <rows> ; <columns> t
-
-sequence to adapt eg. the xterm window size to the selected console mode.
-
-Reference: <http://rtfm.etla.org/xterm/ctlseq.html>
-Contributed-under: TianoCore Contribution Agreement 1.0
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit 2909e025db6878723b49644a8a0cf160d07e6444)
-(cherry picked from commit b9c5c901f25e48d68eef6e78a4abca00e153f574)
-(cherry picked from commit b7f6115b745de8cbc5214b6ede33c9a8558beb90)
-(cherry picked from commit 67415982afdc77922aa37496c981adeb4351acdb)
-(cherry picked from commit cfccb98d13e955beb0b93b4a75a973f30c273ffc)
-(cherry picked from commit a11602f5e2ef930be5b693ddfd0c789a1bd4c60c)
-(cherry picked from commit bc2266f20de5db1636e09a07e4a72c8dbf505f5a)
----
- MdeModulePkg/MdeModulePkg.dec | 4 +++
- .../Console/TerminalDxe/TerminalDxe.inf | 2 ++
- .../Console/TerminalDxe/TerminalConOut.c | 29 +++++++++++++++++++
- 3 files changed, 35 insertions(+)
-
-diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index bdcd62b8699f..13ab41856e81 100644
---- a/MdeModulePkg/MdeModulePkg.dec
-+++ b/MdeModulePkg/MdeModulePkg.dec
-@@ -2347,6 +2347,10 @@ [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
- # @Prompt PCI CRS timeout in seconds.
- gEfiMdeModulePkgTokenSpaceGuid.PcdPciCrsTimeoutSeconds|0|UINT32|0x1000002B
-
-+ ## Controls whether TerminalDxe outputs an XTerm resize sequence on terminal
-+ # mode change.
-+ gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE|BOOLEAN|0x00010080
-+
- [PcdsPatchableInModule]
- ## Specify memory size with page number for PEI code when
- # Loading Module at Fixed Address feature is enabled.
-diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
-index b2a8aeba8510..eff625346539 100644
---- a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
-+++ b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
-@@ -55,6 +55,7 @@ [LibraryClasses]
- DebugLib
- PcdLib
- BaseLib
-+ PrintLib
-
- [Guids]
- ## SOMETIMES_PRODUCES ## Variable:L"ConInDev"
-@@ -87,6 +88,7 @@ [Protocols]
- [Pcd]
- gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType ## SOMETIMES_CONSUMES
- gEfiMdeModulePkgTokenSpaceGuid.PcdErrorCodeSetVariable ## CONSUMES
-+ gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm ## CONSUMES
-
- # [Event]
- # # Relative timer event set by UnicodeToEfiKey(), used to be one 2 seconds input timeout.
-diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
-index 10d6695397b9..748aee2a6009 100644
---- a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
-+++ b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
-@@ -9,6 +9,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
-
- **/
-
-+#include <Library/PrintLib.h>
-+
- #include "Terminal.h"
-
- //
-@@ -83,6 +85,15 @@ CHAR16 mSetCursorPositionString[] = { ESC, '[', '0', '0', '0', ';', '0', '0', '
- CHAR16 mCursorForwardString[] = { ESC, '[', '0', '0', '0', 'C', 0 };
- CHAR16 mCursorBackwardString[] = { ESC, '[', '0', '0', '0', 'D', 0 };
-
-+//
-+// Note that this is an ASCII format string, taking two INT32 arguments:
-+// rows, columns.
-+//
-+// A %d (INT32) format specification can expand to at most 11 characters.
-+//
-+CHAR8 mResizeTextAreaFormatString[] = "\x1B[8;%d;%dt";
-+#define RESIZE_SEQ_SIZE (sizeof mResizeTextAreaFormatString + 2 * (11 - 2))
-+
- //
- // Body of the ConOut functions
- //
-@@ -533,6 +544,24 @@ TerminalConOutSetMode (
- return EFI_DEVICE_ERROR;
- }
-
-+ if (PcdGetBool (PcdResizeXterm)) {
-+ CHAR16 ResizeSequence[RESIZE_SEQ_SIZE];
-+
-+ UnicodeSPrintAsciiFormat (
-+ ResizeSequence,
-+ sizeof ResizeSequence,
-+ mResizeTextAreaFormatString,
-+ (INT32)TerminalDevice->TerminalConsoleModeData[ModeNumber].Rows,
-+ (INT32)TerminalDevice->TerminalConsoleModeData[ModeNumber].Columns
-+ );
-+ TerminalDevice->OutputEscChar = TRUE;
-+ Status = This->OutputString (This, ResizeSequence);
-+ TerminalDevice->OutputEscChar = FALSE;
-+ if (EFI_ERROR (Status)) {
-+ return EFI_DEVICE_ERROR;
-+ }
-+ }
-+
- This->Mode->Mode = (INT32)ModeNumber;
-
- Status = This->ClearScreen (This);
---
-2.54.0
-
diff --git a/0003-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch b/0003-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
new file mode 100644
index 0000000..6da08e9
--- /dev/null
+++ b/0003-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
@@ -0,0 +1,107 @@
+From 6913eb000aea259d4dd4cb79e251042e40633638 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 21 Nov 2017 00:57:45 +0100
+Subject: [PATCH 03/16] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Extend the DSC change to the new OvmfPkg/AmdSev platform, which has been
+ introduced upstream in commit 30d277ed7a82 ("OvmfPkg/Amdsev: Base commit
+ to build encrypted boot specific OVMF", 2020-12-14), for TianoCore#3077.
+
+- Remove obsolete commit message tags related to downstream patch
+ management: Message-id, Patchwork-id, O-Subject, Acked-by, From
+ (RHBZ#1846481).
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- context difference from upstream commit 46bb81200742 ("OvmfPkg: Make
+ SOURCE_DEBUG_ENABLE actually need to be set to TRUE", 2019-10-22)
+ resolved automatically
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+ a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Bugzilla: 1488247
+
+Set the DEBUG_VERBOSE bit (0x00400000) in the log mask. We want detailed
+debug messages, and code in OvmfPkg logs many messages on the
+DEBUG_VERBOSE level.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(this patch was previously applied as commit 78d3ed73172b5738e32d2b0bc03f7984b9584117)
+(cherry picked from commit 7aeeaabc9871f657e65d2b99d81011b4964a1ce9)
+(cherry picked from commit a0617a6be1a80966099ddceb010f89202a79ee76)
+(cherry picked from commit 759bd3f591e2db699bdef4c7ea4e97c908e7f027)
+(cherry picked from commit 7e6d5dc4078c64be6d55d8fc3317c59a91507a50)
+(cherry picked from commit 3cb92f9ba18ac79911bd5258ff4f949cc617ae89)
+(cherry picked from commit 5ecc18badaabe774d9d0806b027ab63a30c6a2d7)
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc | 2 +-
+ OvmfPkg/OvmfPkgIa32X64.dsc | 2 +-
+ OvmfPkg/OvmfPkgX64.dsc | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index 2fbcd01ce428..becead88c48b 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -450,7 +450,7 @@ [PcdsFixedAtBuild]
+ # DEBUG_VERBOSE 0x00400000 // Detailed debug messages that may
+ # // significantly impact boot performance
+ # DEBUG_ERROR 0x80000000 // Error
+- gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+ gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index d981cc8c47e9..cc9e2c4a1d60 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -556,7 +556,7 @@ [PcdsFixedAtBuild]
+ # DEBUG_VERBOSE 0x00400000 // Detailed debug messages that may
+ # // significantly impact boot performance
+ # DEBUG_ERROR 0x80000000 // Error
+- gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+ gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index a12ea98bb784..dff5b5bceb1f 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -636,7 +636,7 @@ [PcdsFixedAtBuild]
+ # DEBUG_VERBOSE 0x00400000 // Detailed debug messages that may
+ # // significantly impact boot performance
+ # DEBUG_ERROR 0x80000000 // Error
+- gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+ gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+--
+2.55.0
+
diff --git a/0004-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch b/0004-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
new file mode 100644
index 0000000..ff427a1
--- /dev/null
+++ b/0004-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
@@ -0,0 +1,148 @@
+From 42dadb74ca0198f532d9968fddb469d6ff8b1c7e Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 21 Nov 2017 00:57:46 +0100
+Subject: [PATCH 04/16] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
+ QemuVideoDxe/QemuRamfbDxe (RH)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Extend the DSC change to the new OvmfPkg/AmdSev platform, which has been
+ introduced upstream in commit 30d277ed7a82 ("OvmfPkg/Amdsev: Base commit
+ to build encrypted boot specific OVMF", 2020-12-14), for TianoCore#3077.
+
+- Remove obsolete commit message tags related to downstream patch
+ management: Message-id, Patchwork-id, O-Subject, Acked-by, From
+ (RHBZ#1846481).
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- no change
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- Due to upstream commit 4b04d9d73604 ("OvmfPkg: Don't build in
+ QemuVideoDxe when we have CSM", 2019-06-26), the contexts of
+ "QemuVideoDxe.inf" / "QemuRamfbDxe.inf" have changed in the DSC files.
+ Resolve the conflict manually.
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- Upstream commit 1d25ff51af5c ("OvmfPkg: add QemuRamfbDxe", 2018-06-14)
+ introduced another GOP driver that consumes FrameBufferBltLib, and
+ thereby produces a large number of (mostly useless) debug messages at
+ the DEBUG_VERBOSE level. Extend the patch to suppress those messages in
+ both QemuVideoDxe and QemuRamfbDxe; update the subject accordingly.
+ QemuRamfbDxe itself doesn't log anything at the VERBOSE level (see also
+ the original commit message at the bottom of this downstream patch).
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+ a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Bugzilla: 1488247
+
+In commit 5b2291f9567a ("OvmfPkg: QemuVideoDxe uses
+MdeModulePkg/FrameBufferLib"), QemuVideoDxe was rebased to
+FrameBufferBltLib.
+
+The FrameBufferBltLib instance added in commit b1ca386074bd
+("MdeModulePkg: Add FrameBufferBltLib library instance") logs many
+messages on the VERBOSE level; for example, a normal boot with OVMF can
+produce 500+ "VideoFill" messages, dependent on the progress bar, when the
+VERBOSE bit is set in PcdDebugPrintErrorLevel.
+
+QemuVideoDxe itself doesn't log anything at the VERBOSE level, so we lose
+none of its messages this way.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(this patch was previously applied as commit 9b0d031dee7e823f6717bab73e422fbc6f0a6c52)
+(cherry picked from commit 9122d5f2e8d8d289064d1e1700cb61964d9931f3)
+(cherry picked from commit 7eb3be1d4ccafc26c11fe5afb95cc12b250ce6f0)
+(cherry picked from commit bd650684712fb840dbcda5d6eaee065bd9e91fa1)
+(cherry picked from commit b06b87f8ffd4fed4ef7eacb13689a9b6d111f850)
+(cherry picked from commit c8c3f893e7c3710afe45c46839e97954871536e4)
+(cherry picked from commit 1355849ad97c1e4a5c430597a377165a5cc118f7)
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc | 10 ++++++++--
+ OvmfPkg/OvmfPkgIa32X64.dsc | 10 ++++++++--
+ OvmfPkg/OvmfPkgX64.dsc | 10 ++++++++--
+ 3 files changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index becead88c48b..769f41783851 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -715,8 +715,14 @@ [Components]
+ MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+ MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+
+- OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
+- OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++ OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++ <PcdsFixedAtBuild>
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++ }
++ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++ <PcdsFixedAtBuild>
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++ }
+ OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+
+ #
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index cc9e2c4a1d60..48429cd0f154 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -858,8 +858,14 @@ [Components.X64]
+ MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+ MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+
+- OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
+- OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++ OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++ <PcdsFixedAtBuild>
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++ }
++ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++ <PcdsFixedAtBuild>
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++ }
+ OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ OvmfPkg/VirtHstiDxe/VirtHstiDxe.inf
+
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index dff5b5bceb1f..506564999bed 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -993,8 +993,14 @@ [Components]
+ MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+ MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf
+
+- OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
+- OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++ OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++ <PcdsFixedAtBuild>
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++ }
++ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++ <PcdsFixedAtBuild>
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++ }
+ OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ OvmfPkg/VirtHstiDxe/VirtHstiDxe.inf
+
+--
+2.55.0
+
diff --git a/0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch b/0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
deleted file mode 100644
index b51c61f..0000000
--- a/0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
+++ /dev/null
@@ -1,206 +0,0 @@
-From 8c9094798594cfbaedf42a49afa1f2486417ebd4 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Wed, 14 Oct 2015 15:59:06 +0200
-Subject: [PATCH 04/21] OvmfPkg: take PcdResizeXterm from the QEMU command line
- (RH only)
-
-edk2-stable202205 rebase
-
-- re-add UPDATE_BOOLEAN_PCD_FROM_FW_CFG
-- add microvm, cloudhw and inteltdx
-
-edk2-stable202108 rebase
-
-- resolve conflict in OvmfPkg/PlatformPei/PlatformPei.inf
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- Extend the DSC change to the new OvmfPkg/AmdSev platform, which has been
- introduced upstream in commit 30d277ed7a82 ("OvmfPkg/Amdsev: Base commit
- to build encrypted boot specific OVMF", 2020-12-14), for TianoCore#3077.
-
- We've always patched all those DSC/FDF files in OvmfPkg down-stream that
- made sense at least in theory on QEMU. (For example, we've always
- patched "OvmfPkgIa32.dsc" and "OvmfPkgIa32.fdf", even though we never
- build or ship the pure IA32 firmware platform.) Follow suit with
- "AmdSevX64.dsc".
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- Resolve contextual conflict in the DSC files, from upstream commit
- b0ed7ebdebd1 ("OvmfPkg: set fixed FlashNvStorage base addresses with -D
- SMM_REQUIRE", 2020-03-12).
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no change
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- no change
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
- a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no change
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- refresh downstream-only commit 8abc2a6ddad2 against context differences
- in the DSC files from upstream commit 5e167d7e784c
- ("OvmfPkg/PlatformPei: don't allocate reserved mem varstore if
- SMM_REQUIRE", 2017-03-12).
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- no changes
-
-Contributed-under: TianoCore Contribution Agreement 1.0
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit 6fa0c4d67c0bb8bde2ddd6db41c19eb0c40b2721)
-(cherry picked from commit 8abc2a6ddad25af7e88dc0cf57d55dfb75fbf92d)
-(cherry picked from commit b311932d3841c017a0f0fec553edcac365cc2038)
-(cherry picked from commit 61914fb81cf624c9028d015533b400b2794e52d3)
-(cherry picked from commit 2ebf3cc2ae99275d63bb6efd3c22dec76251a853)
-(cherry picked from commit f9b73437b9b231773c1a20e0c516168817a930a2)
-(cherry picked from commit 2cc462ee963d0be119bc97bfc9c70d292a40516f)
-(cherry picked from commit 51e0de961029af84b5bdbfddcc9762b1819d500f)
----
- OvmfPkg/AmdSev/AmdSevX64.dsc | 1 +
- OvmfPkg/CloudHv/CloudHvX64.dsc | 1 +
- OvmfPkg/IntelTdx/IntelTdxX64.dsc | 1 +
- OvmfPkg/Microvm/MicrovmX64.dsc | 1 +
- OvmfPkg/OvmfPkgIa32X64.dsc | 1 +
- OvmfPkg/OvmfPkgX64.dsc | 1 +
- OvmfPkg/PlatformPei/PlatformPei.inf | 1 +
- OvmfPkg/PlatformPei/Platform.c | 13 +++++++++++++
- 8 files changed, 20 insertions(+)
-
-diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 8e7e69da0085..e06cbc320c10 100644
---- a/OvmfPkg/AmdSev/AmdSevX64.dsc
-+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -487,6 +487,7 @@ [PcdsFixedAtBuild]
- [PcdsDynamicDefault]
- gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
-
-+ gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
-diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc
-index 157aa8e61151..73ca8d9738e8 100644
---- a/OvmfPkg/CloudHv/CloudHvX64.dsc
-+++ b/OvmfPkg/CloudHv/CloudHvX64.dsc
-@@ -601,6 +601,7 @@ [PcdsDynamicDefault]
- # ($(SMM_REQUIRE) == FALSE)
- gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
-
-+ gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
- !if $(SMM_REQUIRE) == FALSE
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
-diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-index 18fd116311e1..910a48a1ffae 100644
---- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-+++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-@@ -479,6 +479,7 @@ [PcdsDynamicDefault]
- # ($(SMM_REQUIRE) == FALSE)
- gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
-
-+ gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
-diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
-index 884d5a943259..ff5e36f0c2c8 100644
---- a/OvmfPkg/Microvm/MicrovmX64.dsc
-+++ b/OvmfPkg/Microvm/MicrovmX64.dsc
-@@ -589,6 +589,7 @@ [PcdsDynamicDefault]
- # ($(SMM_REQUIRE) == FALSE)
- gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
-
-+ gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
-diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 5b2f51e49ac6..5273113e0fce 100644
---- a/OvmfPkg/OvmfPkgIa32X64.dsc
-+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -620,6 +620,7 @@ [PcdsDynamicDefault]
- # ($(SMM_REQUIRE) == FALSE)
- gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
-
-+ gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
- !if $(SMM_REQUIRE) == FALSE
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
-diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 9180e8864536..fbbe0656b43e 100644
---- a/OvmfPkg/OvmfPkgX64.dsc
-+++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -697,6 +697,7 @@ [PcdsDynamicDefault]
- # ($(SMM_REQUIRE) == FALSE)
- gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
-
-+ gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
- !if $(SMM_REQUIRE) == FALSE
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
-diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf
-index 1f1616c569b7..69fa09e7a4d9 100644
---- a/OvmfPkg/PlatformPei/PlatformPei.inf
-+++ b/OvmfPkg/PlatformPei/PlatformPei.inf
-@@ -108,6 +108,7 @@ [Pcd]
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize
- gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved
-+ gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm
- gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode
- gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
- gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
-diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
-index a354e0641f0f..30dbd87e1120 100644
---- a/OvmfPkg/PlatformPei/Platform.c
-+++ b/OvmfPkg/PlatformPei/Platform.c
-@@ -43,6 +43,18 @@
- #include "Platform.h"
- #include "PlatformId.h"
-
-+#define UPDATE_BOOLEAN_PCD_FROM_FW_CFG(TokenName) \
-+ do { \
-+ BOOLEAN Setting; \
-+ RETURN_STATUS PcdStatus; \
-+ \
-+ if (!RETURN_ERROR (QemuFwCfgParseBool ( \
-+ "opt/ovmf/" #TokenName, &Setting))) { \
-+ PcdStatus = PcdSetBoolS (TokenName, Setting); \
-+ ASSERT_RETURN_ERROR (PcdStatus); \
-+ } \
-+ } while (0)
-+
- EFI_PEI_PPI_DESCRIPTOR mPpiBootMode[] = {
- {
- EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST,
-@@ -365,6 +377,7 @@ InitializePlatform (
- MemTypeInfoInitialization (PlatformInfoHob);
- MemMapInitialization (PlatformInfoHob);
- NoexecDxeInitialization (PlatformInfoHob);
-+ UPDATE_BOOLEAN_PCD_FROM_FW_CFG (PcdResizeXterm);
- }
-
- InstallClearCacheCallback ();
---
-2.51.1
-
diff --git a/0005-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch b/0005-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
new file mode 100644
index 0000000..93ca99e
--- /dev/null
+++ b/0005-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
@@ -0,0 +1,97 @@
+From f653f94477cd6fd53d958a4609a154f539acae92 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 27 Jan 2016 03:05:18 +0100
+Subject: [PATCH 05/16] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
+ QemuRamfbDxe (RH only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- no change
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- no change
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- The previous version of this patch (downstream commit 76b4ac28e975)
+ caused a regression (RHBZ#1714446), which was fixed up in downstream
+ commit 5a216abaa737 ("ArmVirtPkg: silence DEBUG_VERBOSE masking
+ ~0x00400000 in QemuRamfbDxe (RH only)", 2019-08-05).
+
+ Squash the fixup into the original patch. Fuse the commit messages.
+ (Acked-by tags are not preserved, lest we confuse ourselves while
+ reviewing this rebase.)
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- new patch, due to upstream commit c64688f36a8b ("ArmVirtPkg: add
+ QemuRamfbDxe", 2018-06-14)
+
+QemuRamfbDxe uses FrameBufferLib. The FrameBufferBltLib instance added in
+commit b1ca386074bd ("MdeModulePkg: Add FrameBufferBltLib library
+instance") logs many messages on the VERBOSE level; for example, a normal
+boot with ArmVirtQemu[Kernel] can produce 500+ "VideoFill" messages,
+dependent on the progress bar, when the VERBOSE bit is set in
+PcdDebugPrintErrorLevel.
+
+Clear the VERBOSE bit without touching other bits -- those other bits
+differ between the "silent" and "verbose" builds, so we can't set them as
+constants.
+
+QemuRamfbDxe itself doesn't log anything at the VERBOSE level, so we lose
+none of its messages, with the VERBOSE bit clear.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 76b4ac28e975bd63c25db903a1d42c47b38cc756)
+Reported-by: Andrew Jones <drjones@redhat.com>
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daude <philmd@redhat.com>
+(cherry picked from commit 5a216abaa737195327235e37563b18a6bf2a74dc)
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit e5b8152bced2364a1ded0926dbba4d65e23e3f84)
+(cherry picked from commit e7f57f154439c1c18ea5030b01f8d7bc492698b2)
+---
+ ArmVirtPkg/ArmVirtQemu.dsc | 5 ++++-
+ ArmVirtPkg/ArmVirtQemuKernel.dsc | 5 ++++-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index 0212be4a33d2..c90c4a98bd43 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
++++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -474,7 +474,10 @@ [Components.common]
+ #
+ # Video support
+ #
+- OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++ <PcdsFixedAtBuild>
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|($(DEBUG_PRINT_ERROR_LEVEL)) & 0xFFBFFFFF
++ }
+ OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ OvmfPkg/PlatformDxe/Platform.inf
+
+diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+index 7fdb3b55b97e..baa781d4a291 100644
+--- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
++++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+@@ -360,7 +360,10 @@ [Components.common]
+ #
+ # Video support
+ #
+- OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++ <PcdsFixedAtBuild>
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|($(DEBUG_PRINT_ERROR_LEVEL)) & 0xFFBFFFFF
++ }
+ OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ OvmfPkg/PlatformDxe/Platform.inf
+
+--
+2.55.0
+
diff --git a/0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch b/0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
deleted file mode 100644
index 50cec56..0000000
--- a/0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
+++ /dev/null
@@ -1,204 +0,0 @@
-From fff8c376681917ffda487c001cc1cc8729bae9e9 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Sun, 26 Jul 2015 08:02:50 +0000
-Subject: [PATCH 05/21] ArmVirtPkg: take PcdResizeXterm from the QEMU command
- line (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- Resolve leading context divergence in "ArmVirtPkg/ArmVirtQemu.dsc",
- arising from upstream commits:
-
- - 82662a3b5f56 ("ArmVirtPkg/PlatformPeiLib: discover the TPM base
- address from the DT", 2020-03-04)
-
- - ddd34a818315 ("ArmVirtPkg/ArmVirtQemu: enable TPM2 support in the PEI
- phase", 2020-03-04)
-
- - cdc3fa54184a ("ArmVirtPkg: control PXEv4 / PXEv6 boot support from the
- QEMU command line", 2020-04-28)
-
-- Rework the downstream patch quite a bit, paralleling the upstream work
- done for <https://bugzilla.tianocore.org/show_bug.cgi?id=2681> in commit
- range 64ab457d1f21..cdc3fa54184a:
-
- - Refresh copyright year in TerminalPcdProducerLib.{inf,c}. Also replace
- open-coded BSDL with "SPDX-License-Identifier: BSD-2-Clause-Patent".
-
- - Simplify LIBRARY_CLASS: this lib instance is meant to be consumed only
- via NULL class resolution (basically: as a plugin), so use NULL for
- LIBRARY_CLASS, not "TerminalPcdProducerLib|DXE_DRIVER".
-
- - Sort the [Packages] section alphabetically in the INF file.
-
- - Replace the open-coded GetNamedFwCfgBoolean() function with a call to
- QemuFwCfgParseBool(), from QemuFwCfgSimpleParserLib.
-
- - Add the SOMETIMES_PRODUCES usage comment in the [Pcd] section of the
- INF file.
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no change
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- no change
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
- a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no change
-
-Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
-
-- Refresh downstream-only commit d4564d39dfdb against context changes in
- "ArmVirtPkg/ArmVirtQemu.dsc" from upstream commit 7e5f1b673870
- ("ArmVirtPkg/PlatformHasAcpiDtDxe: allow guest level ACPI disable
- override", 2017-03-29).
-
-Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
-
-- Adapt commit 6b97969096a3 to the fact that upstream has deprecated such
- setter functions for dynamic PCDs that don't return a status code (such
- as PcdSetBool()). Employ PcdSetBoolS(), and assert that it succeeds --
- there's really no circumstance in this case when it could fail.
-
-Contributed-under: TianoCore Contribution Agreement 1.0
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit d4564d39dfdbf74e762af43314005a2c026cb262)
-(cherry picked from commit c9081ebe3bcd28e5cce4bf58bd8d4fca12f9af7c)
-(cherry picked from commit 8e92730c8e1cdb642b3b3e680e643ff774a90c65)
-(cherry picked from commit 9448b6b46267d8d807fac0c648e693171bb34806)
-(cherry picked from commit 232fcf06f6b3048b7c2ebd6931f23186b3852f04)
-(cherry picked from commit 8338545260fbb423f796d5196faaaf8ff6e1ed99)
-(cherry picked from commit a5f7a57bf390f1f340ff1d1f1884a73716817ef1)
----
- ArmVirtPkg/ArmVirtQemu.dsc | 7 +++-
- .../TerminalPcdProducerLib.inf | 33 ++++++++++++++++++
- .../TerminalPcdProducerLib.c | 34 +++++++++++++++++++
- 3 files changed, 73 insertions(+), 1 deletion(-)
- create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
- create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
-
-diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 4d4521e3419a..262f6fbf8d9b 100644
---- a/ArmVirtPkg/ArmVirtQemu.dsc
-+++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -317,6 +317,8 @@ [PcdsPatchableInModule]
- gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0x0
- !endif
-
-+ gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
-+
- [PcdsDynamicHii]
- gUefiOvmfPkgTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gOvmfVariableGuid|0x0|FALSE|NV,BS
-
-@@ -452,7 +454,10 @@ [Components.common]
- MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
- MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitterDxe.inf
- MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
-- MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
-+ MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf {
-+ <LibraryClasses>
-+ NULL|ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
-+ }
- MdeModulePkg/Universal/SerialDxe/SerialDxe.inf
-
- MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
-diff --git a/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
-new file mode 100644
-index 000000000000..a51dbd1670a8
---- /dev/null
-+++ b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
-@@ -0,0 +1,33 @@
-+## @file
-+# Plugin library for setting up dynamic PCDs for TerminalDxe, from fw_cfg
-+#
-+# Copyright (C) 2015-2020, Red Hat, Inc.
-+# Copyright (c) 2014, Linaro Ltd. All rights reserved.<BR>
-+#
-+# SPDX-License-Identifier: BSD-2-Clause-Patent
-+##
-+
-+[Defines]
-+ INF_VERSION = 0x00010005
-+ BASE_NAME = TerminalPcdProducerLib
-+ FILE_GUID = 4a0c5ed7-8c42-4c01-8f4c-7bf258316a96
-+ MODULE_TYPE = BASE
-+ VERSION_STRING = 1.0
-+ LIBRARY_CLASS = NULL
-+ CONSTRUCTOR = TerminalPcdProducerLibConstructor
-+
-+[Sources]
-+ TerminalPcdProducerLib.c
-+
-+[Packages]
-+ MdeModulePkg/MdeModulePkg.dec
-+ MdePkg/MdePkg.dec
-+ OvmfPkg/OvmfPkg.dec
-+
-+[LibraryClasses]
-+ DebugLib
-+ PcdLib
-+ QemuFwCfgSimpleParserLib
-+
-+[Pcd]
-+ gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm ## SOMETIMES_PRODUCES
-diff --git a/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
-new file mode 100644
-index 000000000000..bfd3a6a535f9
---- /dev/null
-+++ b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
-@@ -0,0 +1,34 @@
-+/** @file
-+* Plugin library for setting up dynamic PCDs for TerminalDxe, from fw_cfg
-+*
-+* Copyright (C) 2015-2020, Red Hat, Inc.
-+* Copyright (c) 2014, Linaro Ltd. All rights reserved.<BR>
-+*
-+* SPDX-License-Identifier: BSD-2-Clause-Patent
-+**/
-+
-+#include <Library/DebugLib.h>
-+#include <Library/PcdLib.h>
-+#include <Library/QemuFwCfgSimpleParserLib.h>
-+
-+#define UPDATE_BOOLEAN_PCD_FROM_FW_CFG(TokenName) \
-+ do { \
-+ BOOLEAN Setting; \
-+ RETURN_STATUS PcdStatus; \
-+ \
-+ if (!RETURN_ERROR (QemuFwCfgParseBool ( \
-+ "opt/org.tianocore.edk2.aavmf/" #TokenName, &Setting))) { \
-+ PcdStatus = PcdSetBoolS (TokenName, Setting); \
-+ ASSERT_RETURN_ERROR (PcdStatus); \
-+ } \
-+ } while (0)
-+
-+RETURN_STATUS
-+EFIAPI
-+TerminalPcdProducerLibConstructor (
-+ VOID
-+ )
-+{
-+ UPDATE_BOOLEAN_PCD_FROM_FW_CFG (PcdResizeXterm);
-+ return RETURN_SUCCESS;
-+}
---
-2.51.1
-
diff --git a/0006-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch b/0006-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
new file mode 100644
index 0000000..7d42003
--- /dev/null
+++ b/0006-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
@@ -0,0 +1,96 @@
+From eba8f36f6b6673f2bba6d272dda33e55c487aedd Mon Sep 17 00:00:00 2001
+From: Philippe Mathieu-Daude <philmd@redhat.com>
+Date: Thu, 1 Aug 2019 20:43:48 +0200
+Subject: [PATCH 06/16] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on
+ Aarch64 silent builds (RH only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- no change
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- no change
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- We have to carry this downstream-only patch -- committed originally as
+ aaaedc1e2cfd -- indefinitely.
+
+- To avoid confusion, remove the tags from the commit message that had
+ been added by the downstream maintainer scripts, such as: Message-id,
+ Patchwork-id, O-Subject, Acked-by. These remain available on the
+ original downstream commit. The Bugzilla line is preserved, as it
+ doesn't relate to a specific posting, but to the problem.
+
+Bugzilla: 1714446
+
+To suppress an error message on the silent build when ramfb is
+not configured, change QemuRamfbDxe to return EFI_SUCCESS even
+when it fails.
+Some memory is wasted (driver stays resident without
+any good use), but it is mostly harmless, as the memory
+is released by the OS after ExitBootServices().
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daude <philmd@redhat.com>
+(cherry picked from commit aaaedc1e2cfd55ef003fb1b5a37c73a196b26dc7)
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit aa2b66b18a62d652bdbefae7b5732297294306ca)
+(cherry picked from commit deb3451034326b75fd760aba47a5171493ff055e)
+---
+ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf | 1 +
+ OvmfPkg/QemuRamfbDxe/QemuRamfb.c | 15 +++++++++++++++
+ 2 files changed, 16 insertions(+)
+
+diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
+index e3890b8c202f..6ffee5acb24c 100644
+--- a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++++ b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
+@@ -29,6 +29,7 @@ [LibraryClasses]
+ BaseLib
+ BaseMemoryLib
+ DebugLib
++ DebugPrintErrorLevelLib
+ DevicePathLib
+ FrameBufferBltLib
+ MemoryAllocationLib
+diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
+index 5a1044f0dc7b..3a687901b0d2 100644
+--- a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
++++ b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
+@@ -13,6 +13,7 @@
+ #include <Library/BaseLib.h>
+ #include <Library/BaseMemoryLib.h>
+ #include <Library/DebugLib.h>
++#include <Library/DebugPrintErrorLevelLib.h>
+ #include <Library/DevicePathLib.h>
+ #include <Library/FrameBufferBltLib.h>
+ #include <Library/MemoryAllocationLib.h>
+@@ -259,6 +260,20 @@ InitializeQemuRamfb (
+
+ Status = QemuFwCfgFindFile ("etc/ramfb", &mRamfbFwCfgItem, &FwCfgSize);
+ if (EFI_ERROR (Status)) {
++ #if defined (MDE_CPU_AARCH64)
++ //
++ // RHBZ#1714446
++ // If no ramfb device was configured, this platform DXE driver should
++ // returns EFI_NOT_FOUND, so the DXE Core can unload it. However, even
++ // using a silent build, an error message is issued to the guest console.
++ // Since this confuse users, return success and stay resident. The wasted
++ // guest RAM still gets freed later after ExitBootServices().
++ //
++ if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
++ return EFI_SUCCESS;
++ }
++
++ #endif
+ return EFI_NOT_FOUND;
+ }
+
+--
+2.55.0
+
diff --git a/0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch b/0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
deleted file mode 100644
index fecbb45..0000000
--- a/0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 8862c26bc8d10b16ca9964fcc5828a9ba19fee25 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Tue, 21 Nov 2017 00:57:45 +0100
-Subject: [PATCH 06/21] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- Extend the DSC change to the new OvmfPkg/AmdSev platform, which has been
- introduced upstream in commit 30d277ed7a82 ("OvmfPkg/Amdsev: Base commit
- to build encrypted boot specific OVMF", 2020-12-14), for TianoCore#3077.
-
-- Remove obsolete commit message tags related to downstream patch
- management: Message-id, Patchwork-id, O-Subject, Acked-by, From
- (RHBZ#1846481).
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- context difference from upstream commit 46bb81200742 ("OvmfPkg: Make
- SOURCE_DEBUG_ENABLE actually need to be set to TRUE", 2019-10-22)
- resolved automatically
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no change
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- no change
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
- a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no changes
-
-Bugzilla: 1488247
-
-Set the DEBUG_VERBOSE bit (0x00400000) in the log mask. We want detailed
-debug messages, and code in OvmfPkg logs many messages on the
-DEBUG_VERBOSE level.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(this patch was previously applied as commit 78d3ed73172b5738e32d2b0bc03f7984b9584117)
-(cherry picked from commit 7aeeaabc9871f657e65d2b99d81011b4964a1ce9)
-(cherry picked from commit a0617a6be1a80966099ddceb010f89202a79ee76)
-(cherry picked from commit 759bd3f591e2db699bdef4c7ea4e97c908e7f027)
-(cherry picked from commit 7e6d5dc4078c64be6d55d8fc3317c59a91507a50)
-(cherry picked from commit 3cb92f9ba18ac79911bd5258ff4f949cc617ae89)
-(cherry picked from commit 5ecc18badaabe774d9d0806b027ab63a30c6a2d7)
----
- OvmfPkg/AmdSev/AmdSevX64.dsc | 2 +-
- OvmfPkg/OvmfPkgIa32X64.dsc | 2 +-
- OvmfPkg/OvmfPkgX64.dsc | 2 +-
- 3 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index e06cbc320c10..15b72ecf69ee 100644
---- a/OvmfPkg/AmdSev/AmdSevX64.dsc
-+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -432,7 +432,7 @@ [PcdsFixedAtBuild]
- # DEBUG_VERBOSE 0x00400000 // Detailed debug messages that may
- # // significantly impact boot performance
- # DEBUG_ERROR 0x80000000 // Error
-- gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
-
- !if $(SOURCE_DEBUG_ENABLE) == TRUE
- gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
-diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 5273113e0fce..db2abc7cd323 100644
---- a/OvmfPkg/OvmfPkgIa32X64.dsc
-+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -551,7 +551,7 @@ [PcdsFixedAtBuild]
- # DEBUG_VERBOSE 0x00400000 // Detailed debug messages that may
- # // significantly impact boot performance
- # DEBUG_ERROR 0x80000000 // Error
-- gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
-
- !if $(SOURCE_DEBUG_ENABLE) == TRUE
- gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
-diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index fbbe0656b43e..75768c37c66e 100644
---- a/OvmfPkg/OvmfPkgX64.dsc
-+++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -629,7 +629,7 @@ [PcdsFixedAtBuild]
- # DEBUG_VERBOSE 0x00400000 // Detailed debug messages that may
- # // significantly impact boot performance
- # DEBUG_ERROR 0x80000000 // Error
-- gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
-
- !if $(SOURCE_DEBUG_ENABLE) == TRUE
- gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
---
-2.51.1
-
diff --git a/0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch b/0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
deleted file mode 100644
index e77f4c5..0000000
--- a/0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+++ /dev/null
@@ -1,148 +0,0 @@
-From 11011b3745e3afb5fb84128d81a552130e150f05 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Tue, 21 Nov 2017 00:57:46 +0100
-Subject: [PATCH 07/17] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
- QemuVideoDxe/QemuRamfbDxe (RH)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- Extend the DSC change to the new OvmfPkg/AmdSev platform, which has been
- introduced upstream in commit 30d277ed7a82 ("OvmfPkg/Amdsev: Base commit
- to build encrypted boot specific OVMF", 2020-12-14), for TianoCore#3077.
-
-- Remove obsolete commit message tags related to downstream patch
- management: Message-id, Patchwork-id, O-Subject, Acked-by, From
- (RHBZ#1846481).
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- no change
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- Due to upstream commit 4b04d9d73604 ("OvmfPkg: Don't build in
- QemuVideoDxe when we have CSM", 2019-06-26), the contexts of
- "QemuVideoDxe.inf" / "QemuRamfbDxe.inf" have changed in the DSC files.
- Resolve the conflict manually.
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- Upstream commit 1d25ff51af5c ("OvmfPkg: add QemuRamfbDxe", 2018-06-14)
- introduced another GOP driver that consumes FrameBufferBltLib, and
- thereby produces a large number of (mostly useless) debug messages at
- the DEBUG_VERBOSE level. Extend the patch to suppress those messages in
- both QemuVideoDxe and QemuRamfbDxe; update the subject accordingly.
- QemuRamfbDxe itself doesn't log anything at the VERBOSE level (see also
- the original commit message at the bottom of this downstream patch).
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
- a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no changes
-
-Bugzilla: 1488247
-
-In commit 5b2291f9567a ("OvmfPkg: QemuVideoDxe uses
-MdeModulePkg/FrameBufferLib"), QemuVideoDxe was rebased to
-FrameBufferBltLib.
-
-The FrameBufferBltLib instance added in commit b1ca386074bd
-("MdeModulePkg: Add FrameBufferBltLib library instance") logs many
-messages on the VERBOSE level; for example, a normal boot with OVMF can
-produce 500+ "VideoFill" messages, dependent on the progress bar, when the
-VERBOSE bit is set in PcdDebugPrintErrorLevel.
-
-QemuVideoDxe itself doesn't log anything at the VERBOSE level, so we lose
-none of its messages this way.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(this patch was previously applied as commit 9b0d031dee7e823f6717bab73e422fbc6f0a6c52)
-(cherry picked from commit 9122d5f2e8d8d289064d1e1700cb61964d9931f3)
-(cherry picked from commit 7eb3be1d4ccafc26c11fe5afb95cc12b250ce6f0)
-(cherry picked from commit bd650684712fb840dbcda5d6eaee065bd9e91fa1)
-(cherry picked from commit b06b87f8ffd4fed4ef7eacb13689a9b6d111f850)
-(cherry picked from commit c8c3f893e7c3710afe45c46839e97954871536e4)
-(cherry picked from commit 1355849ad97c1e4a5c430597a377165a5cc118f7)
----
- OvmfPkg/AmdSev/AmdSevX64.dsc | 10 ++++++++--
- OvmfPkg/OvmfPkgIa32X64.dsc | 10 ++++++++--
- OvmfPkg/OvmfPkgX64.dsc | 10 ++++++++--
- 3 files changed, 24 insertions(+), 6 deletions(-)
-
-diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 0830070d479b..ac8263c83c5b 100644
---- a/OvmfPkg/AmdSev/AmdSevX64.dsc
-+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -706,8 +706,14 @@ [Components]
- MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
- MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
-
-- OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
-- OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-+ OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
-+ <PcdsFixedAtBuild>
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
-+ }
-+ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
-+ <PcdsFixedAtBuild>
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
-+ }
- OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
-
- #
-diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index d7b896fb8d28..071095c17c7f 100644
---- a/OvmfPkg/OvmfPkgIa32X64.dsc
-+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -856,8 +856,14 @@ [Components.X64]
- MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
- MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
-
-- OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
-- OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-+ OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
-+ <PcdsFixedAtBuild>
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
-+ }
-+ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
-+ <PcdsFixedAtBuild>
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
-+ }
- OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
- OvmfPkg/VirtHstiDxe/VirtHstiDxe.inf
-
-diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index d4500588227b..92fd63704481 100644
---- a/OvmfPkg/OvmfPkgX64.dsc
-+++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -988,8 +988,14 @@ [Components]
- MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
- MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf
-
-- OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
-- OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-+ OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
-+ <PcdsFixedAtBuild>
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
-+ }
-+ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
-+ <PcdsFixedAtBuild>
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
-+ }
- OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
- OvmfPkg/VirtHstiDxe/VirtHstiDxe.inf
-
---
-2.53.0
-
diff --git a/0007-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch b/0007-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
new file mode 100644
index 0000000..04e01f4
--- /dev/null
+++ b/0007-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
@@ -0,0 +1,114 @@
+From 3c84a4253ee956afcf7f89651ef6635fa4aba037 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 21 Nov 2017 00:57:47 +0100
+Subject: [PATCH 07/16] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in
+ NvmExpressDxe (RH only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Extend the DSC change to the new OvmfPkg/AmdSev platform, which has been
+ introduced upstream in commit 30d277ed7a82 ("OvmfPkg/Amdsev: Base commit
+ to build encrypted boot specific OVMF", 2020-12-14), for TianoCore#3077.
+
+- Remove obsolete commit message tags related to downstream patch
+ management: Message-id, Patchwork-id, O-Subject, Acked-by, From
+ (RHBZ#1846481).
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- no change
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+ a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Bugzilla: 1488247
+
+NvmExpressDxe logs all BlockIo read & write calls on the EFI_D_VERBOSE
+level.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(this patch was previously applied as commit 5f432837b9c60c2929b13dda1a1b488d5c3a6d2f)
+(cherry picked from commit 33e00146eb878588ad1395d7b1ae38f401729da4)
+(cherry picked from commit bd10cabcfcb1bc9a32b05062f4ee3792e27bc2d8)
+(cherry picked from commit 5a27af700f49e00608f232f618dedd7bf5e9b3e6)
+(cherry picked from commit 58bba429b9ec7b78109940ef945d0dc93f3cd958)
+(cherry picked from commit b8d0ebded8c2cf5b266c807519e2d8ccfd66fee6)
+(cherry picked from commit ed89844b47f46cfe911f1bf2bda40e537a908502)
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc | 5 ++++-
+ OvmfPkg/OvmfPkgIa32X64.dsc | 5 ++++-
+ OvmfPkg/OvmfPkgX64.dsc | 5 ++++-
+ 3 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index 769f41783851..67473ce78a80 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -710,7 +710,10 @@ [Components]
+ MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+ MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+ MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+- MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
++ MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++ <PcdsFixedAtBuild>
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++ }
+ MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+ MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+ MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 48429cd0f154..341b12581d63 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -853,7 +853,10 @@ [Components.X64]
+ MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+ MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+ MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+- MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
++ MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++ <PcdsFixedAtBuild>
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++ }
+ MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+ MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+ MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index 506564999bed..35faa4f5ab99 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -986,7 +986,10 @@ [Components]
+ MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+ MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+ MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+- MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
++ MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++ <PcdsFixedAtBuild>
++ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++ }
+ MdeModulePkg/Bus/Pci/CxlDxe/CxlDxe.inf
+ MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+ MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+--
+2.55.0
+
diff --git a/0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch b/0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
deleted file mode 100644
index 07b5995..0000000
--- a/0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From 4c47eb76965c109d7e74598f17b0b8598d9f9734 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Wed, 27 Jan 2016 03:05:18 +0100
-Subject: [PATCH 08/21] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
- QemuRamfbDxe (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- no change
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- The previous version of this patch (downstream commit 76b4ac28e975)
- caused a regression (RHBZ#1714446), which was fixed up in downstream
- commit 5a216abaa737 ("ArmVirtPkg: silence DEBUG_VERBOSE masking
- ~0x00400000 in QemuRamfbDxe (RH only)", 2019-08-05).
-
- Squash the fixup into the original patch. Fuse the commit messages.
- (Acked-by tags are not preserved, lest we confuse ourselves while
- reviewing this rebase.)
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- new patch, due to upstream commit c64688f36a8b ("ArmVirtPkg: add
- QemuRamfbDxe", 2018-06-14)
-
-QemuRamfbDxe uses FrameBufferLib. The FrameBufferBltLib instance added in
-commit b1ca386074bd ("MdeModulePkg: Add FrameBufferBltLib library
-instance") logs many messages on the VERBOSE level; for example, a normal
-boot with ArmVirtQemu[Kernel] can produce 500+ "VideoFill" messages,
-dependent on the progress bar, when the VERBOSE bit is set in
-PcdDebugPrintErrorLevel.
-
-Clear the VERBOSE bit without touching other bits -- those other bits
-differ between the "silent" and "verbose" builds, so we can't set them as
-constants.
-
-QemuRamfbDxe itself doesn't log anything at the VERBOSE level, so we lose
-none of its messages, with the VERBOSE bit clear.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit 76b4ac28e975bd63c25db903a1d42c47b38cc756)
-Reported-by: Andrew Jones <drjones@redhat.com>
-Suggested-by: Laszlo Ersek <lersek@redhat.com>
-Signed-off-by: Philippe Mathieu-Daude <philmd@redhat.com>
-(cherry picked from commit 5a216abaa737195327235e37563b18a6bf2a74dc)
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit e5b8152bced2364a1ded0926dbba4d65e23e3f84)
-(cherry picked from commit e7f57f154439c1c18ea5030b01f8d7bc492698b2)
----
- ArmVirtPkg/ArmVirtQemu.dsc | 5 ++++-
- ArmVirtPkg/ArmVirtQemuKernel.dsc | 5 ++++-
- 2 files changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 262f6fbf8d9b..6ac186af2fd5 100644
---- a/ArmVirtPkg/ArmVirtQemu.dsc
-+++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -578,7 +578,10 @@ [Components.common]
- #
- # Video support
- #
-- OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-+ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
-+ <PcdsFixedAtBuild>
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|($(DEBUG_PRINT_ERROR_LEVEL)) & 0xFFBFFFFF
-+ }
- OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
- OvmfPkg/PlatformDxe/Platform.inf
-
-diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index d257ca45c51c..ef1d5a77b89b 100644
---- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
-+++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -462,7 +462,10 @@ [Components.common]
- #
- # Video support
- #
-- OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-+ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
-+ <PcdsFixedAtBuild>
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|($(DEBUG_PRINT_ERROR_LEVEL)) & 0xFFBFFFFF
-+ }
- OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
- OvmfPkg/PlatformDxe/Platform.inf
-
---
-2.51.1
-
diff --git a/0008-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch b/0008-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
new file mode 100644
index 0000000..362c7cd
--- /dev/null
+++ b/0008-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
@@ -0,0 +1,84 @@
+From 783cafbc75ed98d2d567dd031e14325aeedc65e4 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 24 Jun 2020 11:31:36 +0200
+Subject: [PATCH 08/16] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no
+ "-kernel" in silent aa64 build (RH)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Remove obsolete commit message tags related to downstream patch
+ management: Message-id, Patchwork-id, O-Subject, Acked-by, From,
+ RH-Acked-by, RH-Author (RHBZ#1846481).
+
+Bugzilla: 1844682
+
+If the "-kernel" QEMU option is not used, then QemuKernelLoaderFsDxe
+should return EFI_NOT_FOUND, so that the DXE Core can unload it. However,
+the associated error message, logged by the DXE Core to the serial
+console, is not desired in the silent edk2-aarch64 build, given that the
+absence of "-kernel" is nothing out of the ordinary. Therefore, return
+success and stay resident. The wasted guest RAM still gets freed after
+ExitBootServices().
+
+(Inspired by RHEL-8.1.0 commit aaaedc1e2cfd.)
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+(cherry picked from commit 9adcdf493ebbd11efb74e2905ab5f6c8996e096d)
+---
+ .../QemuKernelLoaderFsDxe.inf | 1 +
+ .../QemuKernelLoaderFsDxe.c | 18 ++++++++++++++++++
+ 2 files changed, 19 insertions(+)
+
+diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
+index d24bd17c600e..b18345555b9c 100644
+--- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
++++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
+@@ -28,6 +28,7 @@ [LibraryClasses]
+ BaseLib
+ BaseMemoryLib
+ DebugLib
++ DebugPrintErrorLevelLib
+ DevicePathLib
+ HobLib
+ MemoryAllocationLib
+diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
+index 4598233ec176..d80f1f67c78f 100644
+--- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
++++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
+@@ -20,6 +20,7 @@
+ #include <Library/BaseMemoryLib.h>
+ #include <Library/BlobVerifierLib.h>
+ #include <Library/DebugLib.h>
++#include <Library/DebugPrintErrorLevelLib.h>
+ #include <Library/DevicePathLib.h>
+ #include <Library/HobLib.h>
+ #include <Library/MemoryAllocationLib.h>
+@@ -1304,6 +1305,23 @@ QemuKernelLoaderFsDxeEntrypoint (
+ if ((Blob == NULL) && (mKernelNamedBlobCount == 0)) {
+ DEBUG ((DEBUG_INFO, "%a: no kernel and no named blobs present -> quit\n", __func__));
+ Status = EFI_NOT_FOUND;
++ #if defined (MDE_CPU_AARCH64)
++ //
++ // RHBZ#1844682
++ //
++ // If the "-kernel" QEMU option is not being used, this platform DXE driver
++ // should return EFI_NOT_FOUND, so that the DXE Core can unload it.
++ // However, the associated error message, logged by the DXE Core to the
++ // serial console, is not desired in the silent edk2-aarch64 build, given
++ // that the absence of "-kernel" is nothing out of the ordinary. Therefore,
++ // return success and stay resident. The wasted guest RAM still gets freed
++ // after ExitBootServices().
++ //
++ if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
++ Status = EFI_SUCCESS;
++ }
++
++ #endif
+ goto FreeBlobs;
+ }
+
+--
+2.55.0
+
diff --git a/0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch b/0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
deleted file mode 100644
index 04a37c2..0000000
--- a/0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 85dc8a0b0062e14db46a6820871044f00d1fae1d Mon Sep 17 00:00:00 2001
-From: Philippe Mathieu-Daude <philmd@redhat.com>
-Date: Thu, 1 Aug 2019 20:43:48 +0200
-Subject: [PATCH 09/21] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on
- Aarch64 silent builds (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- no change
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- We have to carry this downstream-only patch -- committed originally as
- aaaedc1e2cfd -- indefinitely.
-
-- To avoid confusion, remove the tags from the commit message that had
- been added by the downstream maintainer scripts, such as: Message-id,
- Patchwork-id, O-Subject, Acked-by. These remain available on the
- original downstream commit. The Bugzilla line is preserved, as it
- doesn't relate to a specific posting, but to the problem.
-
-Bugzilla: 1714446
-
-To suppress an error message on the silent build when ramfb is
-not configured, change QemuRamfbDxe to return EFI_SUCCESS even
-when it fails.
-Some memory is wasted (driver stays resident without
-any good use), but it is mostly harmless, as the memory
-is released by the OS after ExitBootServices().
-
-Suggested-by: Laszlo Ersek <lersek@redhat.com>
-Signed-off-by: Philippe Mathieu-Daude <philmd@redhat.com>
-(cherry picked from commit aaaedc1e2cfd55ef003fb1b5a37c73a196b26dc7)
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit aa2b66b18a62d652bdbefae7b5732297294306ca)
-(cherry picked from commit deb3451034326b75fd760aba47a5171493ff055e)
----
- OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf | 1 +
- OvmfPkg/QemuRamfbDxe/QemuRamfb.c | 15 +++++++++++++++
- 2 files changed, 16 insertions(+)
-
-diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-index e3890b8c202f..6ffee5acb24c 100644
---- a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-+++ b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-@@ -29,6 +29,7 @@ [LibraryClasses]
- BaseLib
- BaseMemoryLib
- DebugLib
-+ DebugPrintErrorLevelLib
- DevicePathLib
- FrameBufferBltLib
- MemoryAllocationLib
-diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
-index 5a1044f0dc7b..3a687901b0d2 100644
---- a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
-+++ b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
-@@ -13,6 +13,7 @@
- #include <Library/BaseLib.h>
- #include <Library/BaseMemoryLib.h>
- #include <Library/DebugLib.h>
-+#include <Library/DebugPrintErrorLevelLib.h>
- #include <Library/DevicePathLib.h>
- #include <Library/FrameBufferBltLib.h>
- #include <Library/MemoryAllocationLib.h>
-@@ -259,6 +260,20 @@ InitializeQemuRamfb (
-
- Status = QemuFwCfgFindFile ("etc/ramfb", &mRamfbFwCfgItem, &FwCfgSize);
- if (EFI_ERROR (Status)) {
-+ #if defined (MDE_CPU_AARCH64)
-+ //
-+ // RHBZ#1714446
-+ // If no ramfb device was configured, this platform DXE driver should
-+ // returns EFI_NOT_FOUND, so the DXE Core can unload it. However, even
-+ // using a silent build, an error message is issued to the guest console.
-+ // Since this confuse users, return success and stay resident. The wasted
-+ // guest RAM still gets freed later after ExitBootServices().
-+ //
-+ if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
-+ return EFI_SUCCESS;
-+ }
-+
-+ #endif
- return EFI_NOT_FOUND;
- }
-
---
-2.51.1
-
diff --git a/0009-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch b/0009-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
new file mode 100644
index 0000000..1bca612
--- /dev/null
+++ b/0009-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
@@ -0,0 +1,82 @@
+From d343df218d9dca05d722eeaeaa13fe917c2860ab Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 24 Jun 2020 11:40:09 +0200
+Subject: [PATCH 09/16] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in
+ silent aa64 build (RH)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- Remove obsolete commit message tags related to downstream patch
+ management: Message-id, Patchwork-id, O-Subject, Acked-by, From,
+ RH-Acked-by, RH-Author (RHBZ#1846481).
+
+Bugzilla: 1844682
+
+If swtpm / vTPM2 is not being used, Tcg2Dxe should return EFI_UNSUPPORTED,
+so that the DXE Core can unload it. However, the associated error message,
+logged by the DXE Core to the serial console, is not desired in the silent
+edk2-aarch64 build, given that the absence of swtpm / vTPM2 is nothing out
+of the ordinary. Therefore, return success and stay resident. The wasted
+guest RAM still gets freed after ExitBootServices().
+
+(Inspired by RHEL-8.1.0 commit aaaedc1e2cfd.)
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+(cherry picked from commit cbce29f7749477e271f9764fed82de94724af5df)
+---
+ SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf | 1 +
+ SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c | 17 +++++++++++++++++
+ 2 files changed, 18 insertions(+)
+
+diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
+index d291c032543a..ccc599cd2a3b 100644
+--- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
++++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
+@@ -55,6 +55,7 @@ [LibraryClasses]
+ UefiRuntimeServicesTableLib
+ BaseMemoryLib
+ DebugLib
++ DebugPrintErrorLevelLib
+ Tpm2CommandLib
+ PrintLib
+ UefiLib
+diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
+index 096e3ef6ebe8..81af833e8f78 100644
+--- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
++++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
+@@ -29,6 +29,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ #include <Protocol/ResetNotification.h>
+
+ #include <Library/DebugLib.h>
++#include <Library/DebugPrintErrorLevelLib.h>
+ #include <Library/BaseMemoryLib.h>
+ #include <Library/UefiRuntimeServicesTableLib.h>
+ #include <Library/UefiDriverEntryPoint.h>
+@@ -2783,6 +2784,22 @@ DriverEntry (
+ CompareGuid (PcdGetPtr (PcdTpmInstanceGuid), &gEfiTpmDeviceInstanceTpm12Guid))
+ {
+ DEBUG ((DEBUG_INFO, "No TPM2 instance required!\n"));
++#if defined (MDE_CPU_AARCH64)
++ //
++ // RHBZ#1844682
++ //
++ // If swtpm / vTPM2 is not being used, this driver should return
++ // EFI_UNSUPPORTED, so that the DXE Core can unload it. However, the
++ // associated error message, logged by the DXE Core to the serial console,
++ // is not desired in the silent edk2-aarch64 build, given that the absence
++ // of swtpm / vTPM2 is nothing out of the ordinary. Therefore, return
++ // success and stay resident. The wasted guest RAM still gets freed after
++ // ExitBootServices().
++ //
++ if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
++ return EFI_SUCCESS;
++ }
++#endif
+ return EFI_UNSUPPORTED;
+ }
+
+--
+2.55.0
+
diff --git a/0010-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch b/0010-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
new file mode 100644
index 0000000..6b7dcff
--- /dev/null
+++ b/0010-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
@@ -0,0 +1,71 @@
+From 64b406eee021b5c5a9a25474397e71f1df44f842 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 25 Sep 2023 09:48:46 +0200
+Subject: [PATCH 10/16] OvmfPkg: set PcdVariableStoreSize +
+ PcdMaxVolatileVariableSize unconditionally
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ OvmfPkg/OvmfPkgIa32X64.dsc | 10 ----------
+ OvmfPkg/OvmfPkgX64.dsc | 10 ----------
+ 2 files changed, 20 deletions(-)
+
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 341b12581d63..6fc0fbdac257 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -512,23 +512,13 @@ [PcdsFixedAtBuild]
+ !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
+ gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
+ gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
+-!if $(NETWORK_TLS_ENABLE) == FALSE
+- # match PcdFlashNvStorageVariableSize purely for convenience
+- gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
+-!endif
+ !endif
+ !if $(FD_SIZE_IN_KB) == 4096
+ gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
+ gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
+-!if $(NETWORK_TLS_ENABLE) == FALSE
+- # match PcdFlashNvStorageVariableSize purely for convenience
+- gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
+ !endif
+-!endif
+-!if $(NETWORK_TLS_ENABLE) == TRUE
+ gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
+ gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
+-!endif
+
+ gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
+ gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index 35faa4f5ab99..438f19f0a2a7 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -592,23 +592,13 @@ [PcdsFixedAtBuild]
+ !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
+ gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
+ gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
+-!if $(NETWORK_TLS_ENABLE) == FALSE
+- # match PcdFlashNvStorageVariableSize purely for convenience
+- gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
+-!endif
+ !endif
+ !if $(FD_SIZE_IN_KB) == 4096
+ gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
+ gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
+-!if $(NETWORK_TLS_ENABLE) == FALSE
+- # match PcdFlashNvStorageVariableSize purely for convenience
+- gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
+ !endif
+-!endif
+-!if $(NETWORK_TLS_ENABLE) == TRUE
+ gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
+ gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
+-!endif
+
+ gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
+ gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
+--
+2.55.0
+
diff --git a/0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch b/0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
deleted file mode 100644
index 6e6b3d1..0000000
--- a/0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+++ /dev/null
@@ -1,114 +0,0 @@
-From 02a6b4dfad798e33d549e667ccc5dfe70128ff2d Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Tue, 21 Nov 2017 00:57:47 +0100
-Subject: [PATCH 10/19] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in
- NvmExpressDxe (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- Extend the DSC change to the new OvmfPkg/AmdSev platform, which has been
- introduced upstream in commit 30d277ed7a82 ("OvmfPkg/Amdsev: Base commit
- to build encrypted boot specific OVMF", 2020-12-14), for TianoCore#3077.
-
-- Remove obsolete commit message tags related to downstream patch
- management: Message-id, Patchwork-id, O-Subject, Acked-by, From
- (RHBZ#1846481).
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- no change
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- no change
-
-Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
-RHEL-8.1/20190308-89910a39dcfd rebase:
-
-- no change
-
-Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
-RHEL-8.0/20180508-ee3198e672e2 rebase:
-
-- reorder the rebase changelog in the commit message so that it reads like
- a blog: place more recent entries near the top
-- no changes to the patch body
-
-Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
-
-- no changes
-
-Bugzilla: 1488247
-
-NvmExpressDxe logs all BlockIo read & write calls on the EFI_D_VERBOSE
-level.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-(this patch was previously applied as commit 5f432837b9c60c2929b13dda1a1b488d5c3a6d2f)
-(cherry picked from commit 33e00146eb878588ad1395d7b1ae38f401729da4)
-(cherry picked from commit bd10cabcfcb1bc9a32b05062f4ee3792e27bc2d8)
-(cherry picked from commit 5a27af700f49e00608f232f618dedd7bf5e9b3e6)
-(cherry picked from commit 58bba429b9ec7b78109940ef945d0dc93f3cd958)
-(cherry picked from commit b8d0ebded8c2cf5b266c807519e2d8ccfd66fee6)
-(cherry picked from commit ed89844b47f46cfe911f1bf2bda40e537a908502)
----
- OvmfPkg/AmdSev/AmdSevX64.dsc | 5 ++++-
- OvmfPkg/OvmfPkgIa32X64.dsc | 5 ++++-
- OvmfPkg/OvmfPkgX64.dsc | 5 ++++-
- 3 files changed, 12 insertions(+), 3 deletions(-)
-
-diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 971745eb80f0..d98568180f97 100644
---- a/OvmfPkg/AmdSev/AmdSevX64.dsc
-+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -710,7 +710,10 @@ [Components]
- MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
- MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
- MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
-- MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
-+ MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
-+ <PcdsFixedAtBuild>
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
-+ }
- MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
- MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
- MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
-diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 197ec16a45a2..5844377e2431 100644
---- a/OvmfPkg/OvmfPkgIa32X64.dsc
-+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -850,7 +850,10 @@ [Components.X64]
- MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
- MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
- MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
-- MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
-+ MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
-+ <PcdsFixedAtBuild>
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
-+ }
- MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
- MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
- MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
-diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 77b7a5499285..f54299f73e6a 100644
---- a/OvmfPkg/OvmfPkgX64.dsc
-+++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -983,7 +983,10 @@ [Components]
- MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
- MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
- MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
-- MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
-+ MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
-+ <PcdsFixedAtBuild>
-+ gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
-+ }
- MdeModulePkg/Bus/Pci/CxlDxe/CxlDxe.inf
- MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
- MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
---
-2.54.0
-
diff --git a/0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch b/0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
deleted file mode 100644
index 0b50b0b..0000000
--- a/0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 540f402c8707302da0ec2db436fc2c5d118f9a6b Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Wed, 24 Jun 2020 11:31:36 +0200
-Subject: [PATCH 11/21] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no
- "-kernel" in silent aa64 build (RH)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- Remove obsolete commit message tags related to downstream patch
- management: Message-id, Patchwork-id, O-Subject, Acked-by, From,
- RH-Acked-by, RH-Author (RHBZ#1846481).
-
-Bugzilla: 1844682
-
-If the "-kernel" QEMU option is not used, then QemuKernelLoaderFsDxe
-should return EFI_NOT_FOUND, so that the DXE Core can unload it. However,
-the associated error message, logged by the DXE Core to the serial
-console, is not desired in the silent edk2-aarch64 build, given that the
-absence of "-kernel" is nothing out of the ordinary. Therefore, return
-success and stay resident. The wasted guest RAM still gets freed after
-ExitBootServices().
-
-(Inspired by RHEL-8.1.0 commit aaaedc1e2cfd.)
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-(cherry picked from commit 9adcdf493ebbd11efb74e2905ab5f6c8996e096d)
----
- .../QemuKernelLoaderFsDxe.inf | 1 +
- .../QemuKernelLoaderFsDxe.c | 18 ++++++++++++++++++
- 2 files changed, 19 insertions(+)
-
-diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
-index d24bd17c600e..b18345555b9c 100644
---- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
-+++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
-@@ -28,6 +28,7 @@ [LibraryClasses]
- BaseLib
- BaseMemoryLib
- DebugLib
-+ DebugPrintErrorLevelLib
- DevicePathLib
- HobLib
- MemoryAllocationLib
-diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
-index 4598233ec176..d80f1f67c78f 100644
---- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
-+++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
-@@ -20,6 +20,7 @@
- #include <Library/BaseMemoryLib.h>
- #include <Library/BlobVerifierLib.h>
- #include <Library/DebugLib.h>
-+#include <Library/DebugPrintErrorLevelLib.h>
- #include <Library/DevicePathLib.h>
- #include <Library/HobLib.h>
- #include <Library/MemoryAllocationLib.h>
-@@ -1304,6 +1305,23 @@ QemuKernelLoaderFsDxeEntrypoint (
- if ((Blob == NULL) && (mKernelNamedBlobCount == 0)) {
- DEBUG ((DEBUG_INFO, "%a: no kernel and no named blobs present -> quit\n", __func__));
- Status = EFI_NOT_FOUND;
-+ #if defined (MDE_CPU_AARCH64)
-+ //
-+ // RHBZ#1844682
-+ //
-+ // If the "-kernel" QEMU option is not being used, this platform DXE driver
-+ // should return EFI_NOT_FOUND, so that the DXE Core can unload it.
-+ // However, the associated error message, logged by the DXE Core to the
-+ // serial console, is not desired in the silent edk2-aarch64 build, given
-+ // that the absence of "-kernel" is nothing out of the ordinary. Therefore,
-+ // return success and stay resident. The wasted guest RAM still gets freed
-+ // after ExitBootServices().
-+ //
-+ if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
-+ Status = EFI_SUCCESS;
-+ }
-+
-+ #endif
- goto FreeBlobs;
- }
-
---
-2.51.1
-
diff --git a/0011-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch b/0011-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch
new file mode 100644
index 0000000..5d1643c
--- /dev/null
+++ b/0011-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch
@@ -0,0 +1,26 @@
+From cf8b9c953d94fc1da509630047255d0c4ebdb575 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 27 Nov 2023 11:04:08 +0100
+Subject: [PATCH 11/16] silence '... has a LOAD segment with RWX permissions'
+ warning
+
+---
+ BaseTools/Conf/tools_def.template | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/BaseTools/Conf/tools_def.template b/BaseTools/Conf/tools_def.template
+index 72ca0dfa2176..b0bfb6f407d6 100644
+--- a/BaseTools/Conf/tools_def.template
++++ b/BaseTools/Conf/tools_def.template
+@@ -593,7 +593,7 @@ DEFINE GCC_LOONGARCH64_CC_FLAGS = DEF(GCC_ALL_CC_COMMON) -mabi=lp64d -fno
+ DEFINE GCC_AARCH64_CC_COMMON = DEF(GCC_ALL_CC_COMMON) -mlittle-endian -fno-short-enums -fverbose-asm -funsigned-char -ffunction-sections -fdata-sections -Wno-address -fno-asynchronous-unwind-tables -fno-unwind-tables -fno-pic -fno-pie -ffixed-x18 -mstack-protector-guard=global
+ DEFINE GCC_AARCH64_CC_XIPCOMMON = -mstrict-align -mgeneral-regs-only
+ DEFINE GCC_RISCV64_CC_XIPFLAGS = -mstrict-align -mgeneral-regs-only
+-DEFINE GCC_DLINK2_FLAGS_COMMON = -Wl,--script=$(EDK_TOOLS_PATH)/Scripts/GccBase.lds
++DEFINE GCC_DLINK2_FLAGS_COMMON = -Wl,--script=$(EDK_TOOLS_PATH)/Scripts/GccBase.lds -Wl,--no-warn-rwx-segments
+ DEFINE GCC_AARCH64_DLINK_COMMON = -Wl,--emit-relocs -nostdlib -Wl,--gc-sections -u $(IMAGE_ENTRY_POINT) -Wl,-e,$(IMAGE_ENTRY_POINT),-Map,$(DEST_DIR_DEBUG)/$(BASE_NAME).map
+ DEFINE GCC_LOONGARCH64_DLINK_COMMON = -Wl,--emit-relocs -nostdlib -Wl,--gc-sections -u $(IMAGE_ENTRY_POINT) -Wl,-e,$(IMAGE_ENTRY_POINT),-Map,$(DEST_DIR_DEBUG)/$(BASE_NAME).map -z common-page-size=0x20
+ DEFINE GCC_AARCH64_ASLDLINK_COMMON = DEF(GCC_AARCH64_DLINK_COMMON) -Wl,--entry,ReferenceAcpiTable -u $(IMAGE_ENTRY_POINT) -Wl,--defsym=PECOFF_HEADER_SIZE=0 DEF(GCC_DLINK2_FLAGS_COMMON) -z common-page-size=0x20
+--
+2.55.0
+
diff --git a/0012-OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch b/0012-OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch
new file mode 100644
index 0000000..beb545a
--- /dev/null
+++ b/0012-OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch
@@ -0,0 +1,126 @@
+From ce2ccbe03a528cb8039f52e22c35a94c241bc17d Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 16 Jan 2025 17:20:38 +0100
+Subject: [PATCH 12/16] OvmfPkg/X64: add
+ opt/org.tianocore/UninstallMemAttrProtocol support
+
+Add support for opt/org.tianocore/UninstallMemAttrProtocol, to allow
+turning off EFI_MEMORY_ATTRIBUTE_PROTOCOL, simliar to ArmVirtPkg.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ .../PlatformBootManagerLib.inf | 2 +
+ .../PlatformBootManagerLib/BdsPlatform.c | 63 +++++++++++++++++++
+ 2 files changed, 65 insertions(+)
+
+diff --git a/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+index 9675eb081f56..cc5959c370e5 100644
+--- a/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
++++ b/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+@@ -64,6 +64,7 @@ [Pcd]
+ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashVariablesEnable
+ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId
+ gUefiOvmfPkgTokenSpaceGuid.PcdBootRestrictToFirmware
++ gUefiOvmfPkgTokenSpaceGuid.PcdUninstallMemAttrProtocol
+ gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiS3Enable
+ gEfiMdePkgTokenSpaceGuid.PcdPlatformBootTimeOut
+ gEfiMdePkgTokenSpaceGuid.PcdUartDefaultBaudRate ## CONSUMES
+@@ -82,6 +83,7 @@ [Protocols]
+ gEfiDxeSmmReadyToLockProtocolGuid # PROTOCOL SOMETIMES_PRODUCED
+ gEfiLoadedImageProtocolGuid # PROTOCOL SOMETIMES_PRODUCED
+ gEfiFirmwareVolume2ProtocolGuid # PROTOCOL SOMETIMES_CONSUMED
++ gEfiMemoryAttributeProtocolGuid
+
+ [Guids]
+ gEfiEndOfDxeEventGroupGuid
+diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+index 3edb92fabcb7..35bb9d31cc67 100644
+--- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
++++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+@@ -1596,6 +1596,49 @@ SaveS3BootScript (
+ ASSERT_EFI_ERROR (Status);
+ }
+
++/**
++ Uninstall the EFI memory attribute protocol if it exists.
++**/
++STATIC
++VOID
++UninstallEfiMemoryAttributesProtocol (
++ VOID
++ )
++{
++ EFI_STATUS Status;
++ EFI_HANDLE Handle;
++ UINTN Size;
++ VOID *MemoryAttributeProtocol;
++
++ Size = sizeof (Handle);
++ Status = gBS->LocateHandle (
++ ByProtocol,
++ &gEfiMemoryAttributeProtocolGuid,
++ NULL,
++ &Size,
++ &Handle
++ );
++
++ if (EFI_ERROR (Status)) {
++ ASSERT (Status == EFI_NOT_FOUND);
++ return;
++ }
++
++ Status = gBS->HandleProtocol (
++ Handle,
++ &gEfiMemoryAttributeProtocolGuid,
++ &MemoryAttributeProtocol
++ );
++ ASSERT_EFI_ERROR (Status);
++
++ Status = gBS->UninstallProtocolInterface (
++ Handle,
++ &gEfiMemoryAttributeProtocolGuid,
++ MemoryAttributeProtocol
++ );
++ ASSERT_EFI_ERROR (Status);
++}
++
+ /**
+ Do the platform specific action after the console is ready
+
+@@ -1616,6 +1659,7 @@ PlatformBootManagerAfterConsole (
+ )
+ {
+ EFI_BOOT_MODE BootMode;
++ BOOLEAN Uninstall;
+
+ DEBUG ((DEBUG_INFO, "PlatformBootManagerAfterConsole\n"));
+
+@@ -1660,6 +1704,25 @@ PlatformBootManagerAfterConsole (
+ //
+ StoreQemuBootOrder ();
+
++ //
++ // Work around shim's terminally broken use of the EFI memory attributes
++ // protocol, by uninstalling it if requested on the QEMU command line.
++ //
++ // E.g.,
++ // -fw_cfg opt/org.tianocore/UninstallMemAttrProtocol,string=y
++ //
++ Uninstall = FixedPcdGetBool (PcdUninstallMemAttrProtocol);
++ QemuFwCfgParseBool ("opt/org.tianocore/UninstallMemAttrProtocol", &Uninstall);
++ DEBUG ((
++ DEBUG_WARN,
++ "%a: %auninstalling EFI memory protocol\n",
++ __func__,
++ Uninstall ? "" : "not "
++ ));
++ if (Uninstall) {
++ UninstallEfiMemoryAttributesProtocol ();
++ }
++
+ //
+ // Process QEMU's -kernel command line option
+ //
+--
+2.55.0
+
diff --git a/0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch b/0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
deleted file mode 100644
index 45ad86f..0000000
--- a/0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From 2fc3b220ea8270fa9b28cc7fd41e0ad2b6877bf2 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Wed, 24 Jun 2020 11:40:09 +0200
-Subject: [PATCH 12/21] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in
- silent aa64 build (RH)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- Remove obsolete commit message tags related to downstream patch
- management: Message-id, Patchwork-id, O-Subject, Acked-by, From,
- RH-Acked-by, RH-Author (RHBZ#1846481).
-
-Bugzilla: 1844682
-
-If swtpm / vTPM2 is not being used, Tcg2Dxe should return EFI_UNSUPPORTED,
-so that the DXE Core can unload it. However, the associated error message,
-logged by the DXE Core to the serial console, is not desired in the silent
-edk2-aarch64 build, given that the absence of swtpm / vTPM2 is nothing out
-of the ordinary. Therefore, return success and stay resident. The wasted
-guest RAM still gets freed after ExitBootServices().
-
-(Inspired by RHEL-8.1.0 commit aaaedc1e2cfd.)
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-(cherry picked from commit cbce29f7749477e271f9764fed82de94724af5df)
----
- SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf | 1 +
- SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c | 17 +++++++++++++++++
- 2 files changed, 18 insertions(+)
-
-diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
-index a645474bf3cd..57795bd8d512 100644
---- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
-+++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
-@@ -55,6 +55,7 @@ [LibraryClasses]
- UefiRuntimeServicesTableLib
- BaseMemoryLib
- DebugLib
-+ DebugPrintErrorLevelLib
- Tpm2CommandLib
- PrintLib
- UefiLib
-diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
-index 85a852842d50..01977018fa88 100644
---- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
-+++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
-@@ -29,6 +29,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
- #include <Protocol/ResetNotification.h>
-
- #include <Library/DebugLib.h>
-+#include <Library/DebugPrintErrorLevelLib.h>
- #include <Library/BaseMemoryLib.h>
- #include <Library/UefiRuntimeServicesTableLib.h>
- #include <Library/UefiDriverEntryPoint.h>
-@@ -2753,6 +2754,22 @@ DriverEntry (
- CompareGuid (PcdGetPtr (PcdTpmInstanceGuid), &gEfiTpmDeviceInstanceTpm12Guid))
- {
- DEBUG ((DEBUG_INFO, "No TPM2 instance required!\n"));
-+#if defined (MDE_CPU_AARCH64)
-+ //
-+ // RHBZ#1844682
-+ //
-+ // If swtpm / vTPM2 is not being used, this driver should return
-+ // EFI_UNSUPPORTED, so that the DXE Core can unload it. However, the
-+ // associated error message, logged by the DXE Core to the serial console,
-+ // is not desired in the silent edk2-aarch64 build, given that the absence
-+ // of swtpm / vTPM2 is nothing out of the ordinary. Therefore, return
-+ // success and stay resident. The wasted guest RAM still gets freed after
-+ // ExitBootServices().
-+ //
-+ if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
-+ return EFI_SUCCESS;
-+ }
-+#endif
- return EFI_UNSUPPORTED;
- }
-
---
-2.51.1
-
diff --git a/0013-OvmfPkg-PlatformDxe-register-page-fault-handler-for-.patch b/0013-OvmfPkg-PlatformDxe-register-page-fault-handler-for-.patch
new file mode 100644
index 0000000..9f5049d
--- /dev/null
+++ b/0013-OvmfPkg-PlatformDxe-register-page-fault-handler-for-.patch
@@ -0,0 +1,470 @@
+From 7bc7f077acf82f9fd30648af9c1548ad3c6875c4 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 20 Jun 2025 11:52:43 +0200
+Subject: [PATCH 13/16] OvmfPkg/PlatformDxe: register page fault handler for NX
+ fixups
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ OvmfPkg/PlatformDxe/Platform.inf | 9 +-
+ OvmfPkg/PlatformDxe/PlatformConfig.h | 5 +
+ OvmfPkg/PlatformDxe/PageFault.c | 371 +++++++++++++++++++++++++++
+ OvmfPkg/PlatformDxe/Platform.c | 1 +
+ 4 files changed, 385 insertions(+), 1 deletion(-)
+ create mode 100644 OvmfPkg/PlatformDxe/PageFault.c
+
+diff --git a/OvmfPkg/PlatformDxe/Platform.inf b/OvmfPkg/PlatformDxe/Platform.inf
+index 4b5a2557bf04..a13ef10076fb 100644
+--- a/OvmfPkg/PlatformDxe/Platform.inf
++++ b/OvmfPkg/PlatformDxe/Platform.inf
+@@ -18,6 +18,7 @@ [Defines]
+ UNLOAD_IMAGE = PlatformUnload
+
+ [Sources]
++ PageFault.c
+ Platform.c
+ Platform.h
+ Platform.uni
+@@ -33,12 +34,14 @@ [Packages]
+ [LibraryClasses]
+ BaseLib
+ BaseMemoryLib
++ CpuLib
+ DebugLib
+ DevicePathLib
+ HiiLib
+ HobLib
+ MemoryAllocationLib
+ PrintLib
++ QemuFwCfgSimpleParserLib
+ UefiBootServicesTableLib
+ UefiHiiServicesLib
+ UefiLib
+@@ -50,12 +53,15 @@ [Pcd]
+ gEfiMdeModulePkgTokenSpaceGuid.PcdVideoVerticalResolution
+ gEfiMdeModulePkgTokenSpaceGuid.PcdSetupVideoHorizontalResolution
+ gEfiMdeModulePkgTokenSpaceGuid.PcdSetupVideoVerticalResolution
++ gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy
++ gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr
+ gUefiOvmfPkgTokenSpaceGuid.PcdVideoResolutionSource
+
+ [Protocols]
+ gEfiDevicePathProtocolGuid ## PRODUCES
+ gEfiGraphicsOutputProtocolGuid ## CONSUMES
+ gEfiHiiConfigAccessProtocolGuid ## PRODUCES
++ gEfiCpuArchProtocolGuid
+
+ [Guids]
+ gEfiIfrTianoGuid
+@@ -66,4 +72,5 @@ [Depex]
+ gEfiHiiConfigRoutingProtocolGuid AND
+ gEfiHiiDatabaseProtocolGuid AND
+ gEfiVariableArchProtocolGuid AND
+- gEfiVariableWriteArchProtocolGuid
++ gEfiVariableWriteArchProtocolGuid AND
++ gEfiCpuArchProtocolGuid
+diff --git a/OvmfPkg/PlatformDxe/PlatformConfig.h b/OvmfPkg/PlatformDxe/PlatformConfig.h
+index 9ea6e5995c60..819897f88789 100644
+--- a/OvmfPkg/PlatformDxe/PlatformConfig.h
++++ b/OvmfPkg/PlatformDxe/PlatformConfig.h
+@@ -51,3 +51,8 @@ PlatformConfigLoad (
+
+ extern CHAR16 mVariableName[];
+ extern CHAR16 mHiiFormName[];
++
++VOID EFIAPI
++PageFaultInit (
++ VOID
++ );
+diff --git a/OvmfPkg/PlatformDxe/PageFault.c b/OvmfPkg/PlatformDxe/PageFault.c
+new file mode 100644
+index 000000000000..50482d0c993d
+--- /dev/null
++++ b/OvmfPkg/PlatformDxe/PageFault.c
+@@ -0,0 +1,371 @@
++/** @file
++ custom page fault handler to fixup nx faults
++
++ Copyright (C) 2025, Red Hat, Inc.
++
++ SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++
++#include <Library/BaseLib.h>
++#include <Library/CpuLib.h>
++#include <Library/DebugLib.h>
++#include <Library/QemuFwCfgSimpleParserLib.h>
++#include <Library/UefiBootServicesTableLib.h>
++#include <Library/UefiLib.h>
++#include <Protocol/Cpu.h>
++#include <Protocol/MemoryAttribute.h>
++
++#include "PlatformConfig.h"
++
++/* ia32 ovmf does not have paging enabled */
++#if defined (MDE_CPU_X64)
++
++STATIC EFI_CPU_ARCH_PROTOCOL *mCpu;
++STATIC EFI_EVENT mExitBoot;
++STATIC UINTN mFixupNX;
++STATIC UINTN mFixupRW;
++
++/*
++ * X64 page table walker, find level3 page table directory.
++ */
++UINT64 *
++EFIAPI
++PageFaultGetPd3 (
++ UINT64 Page
++ )
++{
++ UINT64 Idx;
++ UINT64 Pde;
++ UINT64 *Pd3;
++ IA32_CR4 Cr4;
++
++ Pde = AsmReadCr3 ();
++ Cr4.UintN = AsmReadCr4 ();
++ DEBUG ((DEBUG_VERBOSE, "%a: cr3 0x%lx\n", __func__, Pde));
++
++ if (Cr4.Bits.LA57) {
++ Idx = Page >> (12 + 4 * 9) & 0x1ff;
++ Pde = *((UINT64 *)(Pde & ~0xfff) + Idx);
++ DEBUG ((DEBUG_VERBOSE, "%a: pd5 0x%lx\n", __func__, Pde));
++ if (!(Pde & 1)) {
++ return NULL; // not present
++ }
++ } else {
++ DEBUG ((DEBUG_VERBOSE, "%a: no pd5\n", __func__));
++ }
++
++ Idx = Page >> (12 + 3 * 9) & 0x1ff;
++ Pde = *((UINT64 *)(Pde & ~0xfff) + Idx);
++ DEBUG ((DEBUG_VERBOSE, "%a: pd4 0x%lx\n", __func__, Pde));
++ if (!(Pde & 1)) {
++ return NULL; // not present
++ }
++
++ Idx = Page >> (12 + 2 * 9) & 0x1ff;
++ Pd3 = (UINT64 *)(Pde & ~0xfff) + Idx;
++ return Pd3;
++}
++
++/*
++ * X64 page table walker, returns a pointer to the page table entry.
++ * For large pages a pointer to the large PTE is returned.
++ */
++UINT64 *
++EFIAPI
++PageFaultGetPte (
++ UINT64 Page
++ )
++{
++ UINT64 Idx;
++ UINT64 Pde;
++ UINT64 *Pd3;
++ UINT64 *Pd2;
++ UINT64 *Pte;
++
++ Pd3 = PageFaultGetPd3 (Page);
++ Pde = *Pd3;
++ DEBUG ((DEBUG_VERBOSE, "%a: pd3 0x%lx (at %p)\n", __func__, Pde, Pd3));
++ if (!(Pde & 1)) {
++ return NULL; // not present
++ }
++
++ if (Pde & 0x80) {
++ DEBUG ((DEBUG_VERBOSE, "%a: 1G page\n", __func__));
++ return Pd3; // 1G page
++ }
++
++ Idx = Page >> (12 + 1 * 9) & 0x1ff;
++ Pd2 = (UINT64 *)(Pde & ~0xfff) + Idx;
++ Pde = *Pd2;
++ DEBUG ((DEBUG_VERBOSE, "%a: pd2 0x%lx (at %p)\n", __func__, Pde, Pd2));
++ if (!(Pde & 1)) {
++ return NULL; // not present
++ }
++
++ if (Pde & 0x80) {
++ DEBUG ((DEBUG_VERBOSE, "%a: 2M page\n", __func__));
++ return Pd2; // 2M page
++ }
++
++ Idx = Page >> (12 + 0 * 9) & 0x1ff;
++ Pte = (UINT64 *)(Pde & ~0xfff) + Idx;
++ DEBUG ((DEBUG_VERBOSE, "%a: pte 0x%lx (at %p)\n", __func__, *Pte, Pte));
++
++ return Pte;
++}
++
++/*
++ * Fix page tables, clear NX, set RW, using 1G pages, lowest 512G.
++ *
++ * Background:
++ *
++ * Sometimes NX/RW faults happen with the kernel still running on the EFI page
++ * tables, but after the kernel installed its own page fault handler.
++ *
++ * Sometimes the kernel handler fails to deal with the faults -> BOOM.
++ *
++ * So lets tweak the EFI page table to allow everything if our heuristics
++ * indicate this is a good idea.
++ */
++VOID
++EFIAPI
++PageFaultFixMap (
++ CHAR8 *Reason
++ )
++{
++ UINT64 Idx;
++ UINT64 *Pd3;
++
++ if (PcdGet64 (PcdConfidentialComputingGuestAttr) != 0) {
++ /* switching to 1G pages will break things */
++ DEBUG ((DEBUG_INFO, "%a: skip global RW+NX fixup in CVM\n", __func__));
++ return;
++ }
++
++ DEBUG ((DEBUG_INFO, "%a: global RW+NX fixup (%a)\n", __func__, Reason));
++
++ Pd3 = PageFaultGetPd3 (0);
++ DEBUG ((DEBUG_VERBOSE, "%a: pd3 at 0x%lx [global RW+NX fixup]\n", __func__, Pd3));
++
++ for (Idx = 0; Idx < 512; Idx++) {
++ Pd3[Idx] = (0x40000000 * Idx) | 0x83; // use 1G page
++ if (!(Pd3[Idx] & 1)) {
++ break;
++ }
++ }
++
++ CpuFlushTlb ();
++}
++
++/*
++ * Page fault handler which fixes up NX + WR faults by flipping the PTE bits.
++ * This allows guest OSes which are not NX clean boot. The fixups needed are
++ * counted for later reporting.
++ */
++VOID
++EFIAPI
++PageFaultHandler (
++ IN EFI_EXCEPTION_TYPE ExceptionType,
++ IN EFI_SYSTEM_CONTEXT SystemContext
++ )
++{
++ STATIC BOOLEAN Running = FALSE;
++ UINT64 Page, *Pte;
++ UINT64 ExceptionData;
++
++ Page = SystemContext.SystemContextX64->Cr2 & ~(EFI_PAGE_SIZE-1);
++ ExceptionData = SystemContext.SystemContextX64->ExceptionData;
++
++ DEBUG ((
++ DEBUG_INFO,
++ "%a: CR2: %016lx - RIP: %016lx - ID:%x WR:%x P:%x [0x%x]\n",
++ __func__,
++ SystemContext.SystemContextX64->Cr2,
++ SystemContext.SystemContextX64->Rip,
++ (ExceptionData & BIT4) != 0,
++ (ExceptionData & BIT1) != 0,
++ (ExceptionData & BIT0) != 0,
++ ExceptionData
++ ));
++
++ if (Running) {
++ DEBUG ((DEBUG_INFO, "%a: nested page fault\n", __func__));
++ goto fatal;
++ }
++
++ Running = TRUE;
++
++ if (ExceptionData & BIT0) {
++ /* page present */
++
++ if (ExceptionData & BIT4) {
++ /* instruction decode (-> NX fault) */
++ Pte = PageFaultGetPte (Page);
++ if (Pte && (*Pte & BIT63)) {
++ DEBUG ((
++ DEBUG_INFO,
++ "%a: clearing NX for page 0x%lx%a\n",
++ __func__,
++ Page,
++ (*Pte & 0x80) ? " [large pte]" : ""
++ ));
++ *Pte &= ~BIT63;
++ CpuFlushTlb ();
++ mFixupNX++;
++ Running = FALSE;
++ return;
++ }
++ }
++
++ if (ExceptionData & BIT1) {
++ /* write access */
++ Pte = PageFaultGetPte (Page);
++ if (Pte && (!(*Pte & BIT1))) {
++ DEBUG ((
++ DEBUG_INFO,
++ "%a: setting RW for page 0x%lx%a\n",
++ __func__,
++ Page,
++ (*Pte & 0x80) ? " [large pte]" : ""
++ ));
++ *Pte |= BIT1;
++ CpuFlushTlb ();
++ mFixupRW++;
++ Running = FALSE;
++ return;
++ }
++ }
++ }
++
++ if (!(ExceptionData & BIT0)) {
++ /* page not present */
++ if (Page == 0) {
++ DEBUG ((DEBUG_INFO, "%a: NULL pointer dereference\n", __func__));
++ }
++ }
++
++fatal:
++ DEBUG ((DEBUG_INFO, "%a: fatal: can't handle exception -> HALT\n", __func__));
++ CpuDeadLoop ();
++}
++
++/*
++ * In case any fixups have been applies report them to the console at
++ * ExitBootService time.
++ */
++STATIC
++VOID
++EFIAPI
++PageFaultExitBoot (
++ IN EFI_EVENT Event,
++ IN VOID *Context
++ )
++{
++ STATIC EFI_GUID SHIM_LOCK_GUID = {
++ 0x605dab50, 0xe046, 0x4300, { 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 }
++ };
++ STATIC EFI_GUID SHIM_IMAGE_LOADER_GUID = {
++ 0x1f492041, 0xfadb, 0x4e59, { 0x9e, 0x57, 0x7c, 0xaf, 0xe7, 0x3a, 0x55, 0xab }
++ };
++ VOID *ShimLock = NULL;
++ VOID *ShimLoader = NULL;
++ BOOLEAN MessageWait = FALSE;
++ BOOLEAN HaveOldShim;
++
++ gBS->LocateProtocol (&SHIM_LOCK_GUID, NULL, &ShimLock);
++ gBS->LocateProtocol (&SHIM_IMAGE_LOADER_GUID, NULL, &ShimLoader);
++ HaveOldShim = (ShimLock != NULL) && (ShimLoader == NULL);
++
++ DEBUG ((
++ DEBUG_INFO,
++ "%a: shim protocols: lock=%a, loader=%a -> old-shim=%a\n",
++ __func__,
++ (ShimLock != NULL) ? "yes" : "no",
++ (ShimLoader != NULL) ? "yes" : "no",
++ (HaveOldShim) ? "yes" : "no"
++ ));
++ DEBUG ((DEBUG_INFO, "%a: fixups: %d NX, %d RW\n", __func__, mFixupNX, mFixupRW));
++
++ if (mFixupNX || mFixupRW) {
++ /* we had to fixup NX or RW faults -> broken behavior -> report it */
++ AsciiPrint (
++ "%a: Page fault fixups needed (NX: %d, RW: %d).\n"
++ "%a: The guest OS boot chain is not NX clean.\n",
++ __func__,
++ mFixupNX,
++ mFixupRW,
++ __func__
++ );
++ MessageWait = TRUE;
++ }
++
++ if (mFixupNX) {
++ /* we had to fixup NX faults -> apply global fixup as precaution + report it */
++ AsciiPrint (
++ "%a: Applying global page table fixup (saw NX faults).\n",
++ __func__
++ );
++ PageFaultFixMap ("nx-fault");
++
++ } else if (HaveOldShim) {
++ /* we detected shim older than v16 -> apply global fixup as precaution + report it */
++ AsciiPrint (
++ "%a: Applying global page table fixup (shim is older than v16).\n",
++ __func__
++ );
++ PageFaultFixMap ("old-shim");
++ }
++
++ if (MessageWait) {
++ gBS->Stall (3000000);
++ }
++}
++
++#endif
++
++VOID
++EFIAPI
++PageFaultInit (
++ VOID
++ )
++{
++ #if defined (MDE_CPU_X64)
++ EFI_STATUS Status;
++ BOOLEAN StrictNX;
++
++ if (FixedPcdGet64 (PcdDxeNxMemoryProtectionPolicy) == 0) {
++ DEBUG ((DEBUG_INFO, "%a: no NX protection in this build.\n", __func__));
++ return;
++ }
++
++ StrictNX = FALSE;
++ Status = QemuFwCfgParseBool (
++ "opt/org.tianocore/StrictNX",
++ &StrictNX
++ );
++ if (StrictNX) {
++ DEBUG ((DEBUG_INFO, "%a: StrictNX enabled\n", __func__));
++ return;
++ }
++
++ DEBUG ((DEBUG_INFO, "%a: StrictNX disabled - installing page fault handler\n", __func__));
++
++ gBS->LocateProtocol (&gEfiCpuArchProtocolGuid, NULL, (VOID **)&mCpu);
++ Status = mCpu->RegisterInterruptHandler (mCpu, EXCEPT_IA32_PAGE_FAULT, PageFaultHandler);
++ DEBUG ((DEBUG_INFO, "%a: mCpu->RegisterInterruptHandler: %r\n", __func__, Status));
++ if (Status != EFI_SUCCESS) {
++ return;
++ }
++
++ Status = gBS->CreateEvent (
++ EVT_SIGNAL_EXIT_BOOT_SERVICES,
++ TPL_CALLBACK,
++ &PageFaultExitBoot,
++ NULL,
++ &mExitBoot
++ );
++ DEBUG ((DEBUG_INFO, "%a: gBS->CreateEvent: %r\n", __func__, Status));
++ #else
++ DEBUG ((DEBUG_INFO, "%a: not supported on this architecture.\n", __func__));
++ #endif
++}
+diff --git a/OvmfPkg/PlatformDxe/Platform.c b/OvmfPkg/PlatformDxe/Platform.c
+index aee5a397b324..b768d544cc79 100644
+--- a/OvmfPkg/PlatformDxe/Platform.c
++++ b/OvmfPkg/PlatformDxe/Platform.c
+@@ -1055,6 +1055,7 @@ PlatformInit (
+ ASSERT_EFI_ERROR (Status);
+
+ MemDebugLogInstallTable ();
++ PageFaultInit ();
+
+ return EFI_SUCCESS;
+
+--
+2.55.0
+
diff --git a/0013-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch b/0013-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
deleted file mode 100644
index 66941b8..0000000
--- a/0013-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From ae22491875ce71475f0fa687eb58cfb8885f440e Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Mon, 25 Sep 2023 09:48:46 +0200
-Subject: [PATCH 13/17] OvmfPkg: set PcdVariableStoreSize +
- PcdMaxVolatileVariableSize unconditionally
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- OvmfPkg/OvmfPkgIa32X64.dsc | 10 ----------
- OvmfPkg/OvmfPkgX64.dsc | 10 ----------
- 2 files changed, 20 deletions(-)
-
-diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 33f0761e5655..7cd8038f1668 100644
---- a/OvmfPkg/OvmfPkgIa32X64.dsc
-+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -507,23 +507,13 @@ [PcdsFixedAtBuild]
- !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
- gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
- gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
--!if $(NETWORK_TLS_ENABLE) == FALSE
-- # match PcdFlashNvStorageVariableSize purely for convenience
-- gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
--!endif
- !endif
- !if $(FD_SIZE_IN_KB) == 4096
- gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
- gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
--!if $(NETWORK_TLS_ENABLE) == FALSE
-- # match PcdFlashNvStorageVariableSize purely for convenience
-- gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
- !endif
--!endif
--!if $(NETWORK_TLS_ENABLE) == TRUE
- gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
- gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
--!endif
-
- gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
- gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
-diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 748f356bfce3..84e80bcd17ab 100644
---- a/OvmfPkg/OvmfPkgX64.dsc
-+++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -585,23 +585,13 @@ [PcdsFixedAtBuild]
- !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
- gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
- gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
--!if $(NETWORK_TLS_ENABLE) == FALSE
-- # match PcdFlashNvStorageVariableSize purely for convenience
-- gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
--!endif
- !endif
- !if $(FD_SIZE_IN_KB) == 4096
- gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
- gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
--!if $(NETWORK_TLS_ENABLE) == FALSE
-- # match PcdFlashNvStorageVariableSize purely for convenience
-- gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
- !endif
--!endif
--!if $(NETWORK_TLS_ENABLE) == TRUE
- gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
- gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
--!endif
-
- gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
- gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
---
-2.53.0
-
diff --git a/0014-OvmfPkg-PlatformDxe-add-check-for-1g-page-support.patch b/0014-OvmfPkg-PlatformDxe-add-check-for-1g-page-support.patch
new file mode 100644
index 0000000..898ed42
--- /dev/null
+++ b/0014-OvmfPkg-PlatformDxe-add-check-for-1g-page-support.patch
@@ -0,0 +1,121 @@
+From 56ad611a3fa2363cb335442bf6a15db92789b9c6 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 6 Oct 2025 09:11:59 +0200
+Subject: [PATCH 14/16] OvmfPkg/PlatformDxe: add check for 1g page support
+
+---
+ OvmfPkg/PlatformDxe/PageFault.c | 72 ++++++++++++++++++++-------------
+ 1 file changed, 43 insertions(+), 29 deletions(-)
+
+diff --git a/OvmfPkg/PlatformDxe/PageFault.c b/OvmfPkg/PlatformDxe/PageFault.c
+index 50482d0c993d..ef24933d8644 100644
+--- a/OvmfPkg/PlatformDxe/PageFault.c
++++ b/OvmfPkg/PlatformDxe/PageFault.c
+@@ -130,18 +130,12 @@ PageFaultGetPte (
+ VOID
+ EFIAPI
+ PageFaultFixMap (
+- CHAR8 *Reason
++ CHAR8 *Reason
+ )
+ {
+ UINT64 Idx;
+ UINT64 *Pd3;
+
+- if (PcdGet64 (PcdConfidentialComputingGuestAttr) != 0) {
+- /* switching to 1G pages will break things */
+- DEBUG ((DEBUG_INFO, "%a: skip global RW+NX fixup in CVM\n", __func__));
+- return;
+- }
+-
+ DEBUG ((DEBUG_INFO, "%a: global RW+NX fixup (%a)\n", __func__, Reason));
+
+ Pd3 = PageFaultGetPd3 (0);
+@@ -249,6 +243,24 @@ PageFaultHandler (
+ CpuDeadLoop ();
+ }
+
++STATIC
++BOOLEAN
++PageFaultHave1GPages (
++ )
++{
++ UINT32 RegEax, RegEdx;
++
++ AsmCpuid (0x80000000, &RegEax, NULL, NULL, NULL);
++ if (RegEax >= 0x80000001) {
++ AsmCpuid (0x80000001, NULL, NULL, NULL, &RegEdx);
++ if ((RegEdx & BIT26) != 0) {
++ return TRUE;
++ }
++ }
++
++ return FALSE;
++}
++
+ /*
+ * In case any fixups have been applies report them to the console at
+ * ExitBootService time.
+@@ -277,13 +289,13 @@ PageFaultExitBoot (
+ HaveOldShim = (ShimLock != NULL) && (ShimLoader == NULL);
+
+ DEBUG ((
+- DEBUG_INFO,
+- "%a: shim protocols: lock=%a, loader=%a -> old-shim=%a\n",
+- __func__,
+- (ShimLock != NULL) ? "yes" : "no",
+- (ShimLoader != NULL) ? "yes" : "no",
+- (HaveOldShim) ? "yes" : "no"
+- ));
++ DEBUG_INFO,
++ "%a: shim protocols: lock=%a, loader=%a -> old-shim=%a\n",
++ __func__,
++ (ShimLock != NULL) ? "yes" : "no",
++ (ShimLoader != NULL) ? "yes" : "no",
++ (HaveOldShim) ? "yes" : "no"
++ ));
+ DEBUG ((DEBUG_INFO, "%a: fixups: %d NX, %d RW\n", __func__, mFixupNX, mFixupRW));
+
+ if (mFixupNX || mFixupRW) {
+@@ -299,21 +311,23 @@ PageFaultExitBoot (
+ MessageWait = TRUE;
+ }
+
+- if (mFixupNX) {
+- /* we had to fixup NX faults -> apply global fixup as precaution + report it */
+- AsciiPrint (
+- "%a: Applying global page table fixup (saw NX faults).\n",
+- __func__
+- );
+- PageFaultFixMap ("nx-fault");
+-
+- } else if (HaveOldShim) {
+- /* we detected shim older than v16 -> apply global fixup as precaution + report it */
+- AsciiPrint (
+- "%a: Applying global page table fixup (shim is older than v16).\n",
+- __func__
+- );
+- PageFaultFixMap ("old-shim");
++ if (PageFaultHave1GPages () &&
++ PcdGet64 (PcdConfidentialComputingGuestAttr) == 0) {
++ if (mFixupNX) {
++ /* we had to fixup NX faults -> apply global fixup as precaution + report it */
++ AsciiPrint (
++ "%a: Applying global page table fixup (saw NX faults).\n",
++ __func__
++ );
++ PageFaultFixMap ("nx-fault");
++ } else if (HaveOldShim) {
++ /* we detected shim older than v16 -> apply global fixup as precaution + report it */
++ AsciiPrint (
++ "%a: Applying global page table fixup (shim is older than v16).\n",
++ __func__
++ );
++ PageFaultFixMap ("old-shim");
++ }
+ }
+
+ if (MessageWait) {
+--
+2.55.0
+
diff --git a/0014-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch b/0014-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch
deleted file mode 100644
index 6429c91..0000000
--- a/0014-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From b830587c98c16005c0dce8b12448ef53f053a125 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Mon, 27 Nov 2023 11:04:08 +0100
-Subject: [PATCH 14/19] silence '... has a LOAD segment with RWX permissions'
- warning
-
----
- BaseTools/Conf/tools_def.template | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/BaseTools/Conf/tools_def.template b/BaseTools/Conf/tools_def.template
-index eca4cb82d059..8565f9f48c28 100644
---- a/BaseTools/Conf/tools_def.template
-+++ b/BaseTools/Conf/tools_def.template
-@@ -931,7 +931,7 @@ DEFINE GCC_LOONGARCH64_CC_FLAGS = DEF(GCC_ALL_CC_COMMON) -mabi=lp64d -fno
- DEFINE GCC_AARCH64_CC_COMMON = DEF(GCC_ALL_CC_COMMON) -mlittle-endian -fno-short-enums -fverbose-asm -funsigned-char -ffunction-sections -fdata-sections -Wno-address -fno-asynchronous-unwind-tables -fno-unwind-tables -fno-pic -fno-pie -ffixed-x18 -mstack-protector-guard=global
- DEFINE GCC_AARCH64_CC_XIPCOMMON = -mstrict-align -mgeneral-regs-only
- DEFINE GCC_RISCV64_CC_XIPFLAGS = -mstrict-align -mgeneral-regs-only
--DEFINE GCC_DLINK2_FLAGS_COMMON = -Wl,--script=$(EDK_TOOLS_PATH)/Scripts/GccBase.lds
-+DEFINE GCC_DLINK2_FLAGS_COMMON = -Wl,--script=$(EDK_TOOLS_PATH)/Scripts/GccBase.lds -Wl,--no-warn-rwx-segments
- DEFINE GCC_AARCH64_DLINK_COMMON = -Wl,--emit-relocs -nostdlib -Wl,--gc-sections -u $(IMAGE_ENTRY_POINT) -Wl,-e,$(IMAGE_ENTRY_POINT),-Map,$(DEST_DIR_DEBUG)/$(BASE_NAME).map
- DEFINE GCC_LOONGARCH64_DLINK_COMMON = -Wl,--emit-relocs -nostdlib -Wl,--gc-sections -u $(IMAGE_ENTRY_POINT) -Wl,-e,$(IMAGE_ENTRY_POINT),-Map,$(DEST_DIR_DEBUG)/$(BASE_NAME).map -z common-page-size=0x20
- DEFINE GCC_AARCH64_ASLDLINK_COMMON = DEF(GCC_AARCH64_DLINK_COMMON) -Wl,--entry,ReferenceAcpiTable -u $(IMAGE_ENTRY_POINT) -Wl,--defsym=PECOFF_HEADER_SIZE=0 DEF(GCC_DLINK2_FLAGS_COMMON) -z common-page-size=0x20
---
-2.54.0
-
diff --git a/0015-OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch b/0015-OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch
deleted file mode 100644
index 50edb2b..0000000
--- a/0015-OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From 28e96c8545b949b9e039964df1e85fcb79f5706c Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 16 Jan 2025 17:20:38 +0100
-Subject: [PATCH 15/17] OvmfPkg/X64: add
- opt/org.tianocore/UninstallMemAttrProtocol support
-
-Add support for opt/org.tianocore/UninstallMemAttrProtocol, to allow
-turning off EFI_MEMORY_ATTRIBUTE_PROTOCOL, simliar to ArmVirtPkg.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- .../PlatformBootManagerLib.inf | 2 +
- .../PlatformBootManagerLib/BdsPlatform.c | 63 +++++++++++++++++++
- 2 files changed, 65 insertions(+)
-
-diff --git a/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
-index 9675eb081f56..cc5959c370e5 100644
---- a/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
-+++ b/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
-@@ -64,6 +64,7 @@ [Pcd]
- gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashVariablesEnable
- gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId
- gUefiOvmfPkgTokenSpaceGuid.PcdBootRestrictToFirmware
-+ gUefiOvmfPkgTokenSpaceGuid.PcdUninstallMemAttrProtocol
- gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiS3Enable
- gEfiMdePkgTokenSpaceGuid.PcdPlatformBootTimeOut
- gEfiMdePkgTokenSpaceGuid.PcdUartDefaultBaudRate ## CONSUMES
-@@ -82,6 +83,7 @@ [Protocols]
- gEfiDxeSmmReadyToLockProtocolGuid # PROTOCOL SOMETIMES_PRODUCED
- gEfiLoadedImageProtocolGuid # PROTOCOL SOMETIMES_PRODUCED
- gEfiFirmwareVolume2ProtocolGuid # PROTOCOL SOMETIMES_CONSUMED
-+ gEfiMemoryAttributeProtocolGuid
-
- [Guids]
- gEfiEndOfDxeEventGroupGuid
-diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
-index b696f1b3389b..9fc422c00a7b 100644
---- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
-+++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
-@@ -1596,6 +1596,49 @@ SaveS3BootScript (
- ASSERT_EFI_ERROR (Status);
- }
-
-+/**
-+ Uninstall the EFI memory attribute protocol if it exists.
-+**/
-+STATIC
-+VOID
-+UninstallEfiMemoryAttributesProtocol (
-+ VOID
-+ )
-+{
-+ EFI_STATUS Status;
-+ EFI_HANDLE Handle;
-+ UINTN Size;
-+ VOID *MemoryAttributeProtocol;
-+
-+ Size = sizeof (Handle);
-+ Status = gBS->LocateHandle (
-+ ByProtocol,
-+ &gEfiMemoryAttributeProtocolGuid,
-+ NULL,
-+ &Size,
-+ &Handle
-+ );
-+
-+ if (EFI_ERROR (Status)) {
-+ ASSERT (Status == EFI_NOT_FOUND);
-+ return;
-+ }
-+
-+ Status = gBS->HandleProtocol (
-+ Handle,
-+ &gEfiMemoryAttributeProtocolGuid,
-+ &MemoryAttributeProtocol
-+ );
-+ ASSERT_EFI_ERROR (Status);
-+
-+ Status = gBS->UninstallProtocolInterface (
-+ Handle,
-+ &gEfiMemoryAttributeProtocolGuid,
-+ MemoryAttributeProtocol
-+ );
-+ ASSERT_EFI_ERROR (Status);
-+}
-+
- /**
- Do the platform specific action after the console is ready
-
-@@ -1616,6 +1659,7 @@ PlatformBootManagerAfterConsole (
- )
- {
- EFI_BOOT_MODE BootMode;
-+ BOOLEAN Uninstall;
-
- DEBUG ((DEBUG_INFO, "PlatformBootManagerAfterConsole\n"));
-
-@@ -1660,6 +1704,25 @@ PlatformBootManagerAfterConsole (
- //
- StoreQemuBootOrder ();
-
-+ //
-+ // Work around shim's terminally broken use of the EFI memory attributes
-+ // protocol, by uninstalling it if requested on the QEMU command line.
-+ //
-+ // E.g.,
-+ // -fw_cfg opt/org.tianocore/UninstallMemAttrProtocol,string=y
-+ //
-+ Uninstall = FixedPcdGetBool (PcdUninstallMemAttrProtocol);
-+ QemuFwCfgParseBool ("opt/org.tianocore/UninstallMemAttrProtocol", &Uninstall);
-+ DEBUG ((
-+ DEBUG_WARN,
-+ "%a: %auninstalling EFI memory protocol\n",
-+ __func__,
-+ Uninstall ? "" : "not "
-+ ));
-+ if (Uninstall) {
-+ UninstallEfiMemoryAttributesProtocol ();
-+ }
-+
- //
- // Process QEMU's -kernel command line option
- //
---
-2.53.0
-
diff --git a/0015-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch b/0015-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch
new file mode 100644
index 0000000..e85a4da
--- /dev/null
+++ b/0015-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch
@@ -0,0 +1,58 @@
+From a5e46ae06e3d66f5af25cad2b0c73bfe8b3ba688 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 12 Mar 2026 11:35:23 +0100
+Subject: [PATCH 15/16] Revert "OvmfPkg/X86QemuLoadImageLib: flip default for
+ EnableLegacyLoader to false"
+
+This reverts commit d2cbaefc082294eadaa30a3d5f0fa8ba264a574a.
+---
+ .../X86QemuLoadImageLib/X86QemuLoadImageLib.c | 2 +-
+ OvmfPkg/RUNTIME_CONFIG.md | 15 ++++++---------
+ 2 files changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
+index e888ac1a97ac..4679a7b8b12d 100644
+--- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
++++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
+@@ -444,7 +444,7 @@ QemuLoadKernelImage (
+ &Enabled
+ );
+ if (EFI_ERROR (RetStatus)) {
+- Enabled = FALSE;
++ Enabled = TRUE;
+ }
+
+ if (!Enabled) {
+diff --git a/OvmfPkg/RUNTIME_CONFIG.md b/OvmfPkg/RUNTIME_CONFIG.md
+index aad3f96d6efa..e8bea12945b8 100644
+--- a/OvmfPkg/RUNTIME_CONFIG.md
++++ b/OvmfPkg/RUNTIME_CONFIG.md
+@@ -153,19 +153,16 @@ without EFI stub. If you are using kernels that old secure boot
+ support is the least of your problems though ...
+
+ The linux kernel is typically signed by the distro secure boot keys
+-and is verified by the distro `shim.efi` binary. qemu version 10.0
+-(released in April 2025) got support for passing the shim binary
++and is verified by the distro `shim.efi` binary. qemu release 10.0
++(ETA ~ March 2025) will get support for passing the shim binary
+ (additionally to kernel + initrd) to the firmware, so the usual secure
+ boot verification can work with direct kernel load too.
+
+-In edk2-stable202502 and newer the EnableLegacyLoader config option is
+-available and enabled by default.
++For now the legacy loader is enabled by default. Once the new qemu
++release is available in most linux distros the defaut will be flipped
++to disabled.
+
+-In edk2-stable202602 and newer the EnableLegacyLoader config option is
+-disabled by default.
+-
+-Here is the qemu command line for direct kernel boot with secure boot
+-verification:
++Usage (qemu 10.0+):
+
+ ```
+ qemu-system-x86_64 \
+--
+2.55.0
+
diff --git a/0016-OvmfPkg-PlatformDxe-proper-addr-masking.patch b/0016-OvmfPkg-PlatformDxe-proper-addr-masking.patch
new file mode 100644
index 0000000..c8008d4
--- /dev/null
+++ b/0016-OvmfPkg-PlatformDxe-proper-addr-masking.patch
@@ -0,0 +1,107 @@
+From 9ac54a9923d457720f54e00c63028ce29d0ea30e Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jun 2026 14:08:35 +0200
+Subject: [PATCH 16/16] OvmfPkg/PlatformDxe: proper addr masking
+
+filter out high control bits (nx, cbit).
+---
+ OvmfPkg/PlatformDxe/PageFault.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/OvmfPkg/PlatformDxe/PageFault.c b/OvmfPkg/PlatformDxe/PageFault.c
+index ef24933d8644..8aad784dfa4f 100644
+--- a/OvmfPkg/PlatformDxe/PageFault.c
++++ b/OvmfPkg/PlatformDxe/PageFault.c
+@@ -31,7 +31,8 @@ STATIC UINTN mFixupRW;
+ UINT64 *
+ EFIAPI
+ PageFaultGetPd3 (
+- UINT64 Page
++ UINT64 Page,
++ UINT64 *Msk
+ )
+ {
+ UINT64 Idx;
+@@ -44,25 +45,27 @@ PageFaultGetPd3 (
+ DEBUG ((DEBUG_VERBOSE, "%a: cr3 0x%lx\n", __func__, Pde));
+
+ if (Cr4.Bits.LA57) {
++ *Msk = 0x1fffffffffff000;
+ Idx = Page >> (12 + 4 * 9) & 0x1ff;
+- Pde = *((UINT64 *)(Pde & ~0xfff) + Idx);
++ Pde = *((UINT64 *)(Pde & *Msk) + Idx);
+ DEBUG ((DEBUG_VERBOSE, "%a: pd5 0x%lx\n", __func__, Pde));
+ if (!(Pde & 1)) {
+ return NULL; // not present
+ }
+ } else {
++ *Msk = 0xfffffffff000;
+ DEBUG ((DEBUG_VERBOSE, "%a: no pd5\n", __func__));
+ }
+
+ Idx = Page >> (12 + 3 * 9) & 0x1ff;
+- Pde = *((UINT64 *)(Pde & ~0xfff) + Idx);
++ Pde = *((UINT64 *)(Pde & *Msk) + Idx);
+ DEBUG ((DEBUG_VERBOSE, "%a: pd4 0x%lx\n", __func__, Pde));
+ if (!(Pde & 1)) {
+ return NULL; // not present
+ }
+
+ Idx = Page >> (12 + 2 * 9) & 0x1ff;
+- Pd3 = (UINT64 *)(Pde & ~0xfff) + Idx;
++ Pd3 = (UINT64 *)(Pde & *Msk) + Idx;
+ return Pd3;
+ }
+
+@@ -76,13 +79,14 @@ PageFaultGetPte (
+ UINT64 Page
+ )
+ {
++ UINT64 Msk;
+ UINT64 Idx;
+ UINT64 Pde;
+ UINT64 *Pd3;
+ UINT64 *Pd2;
+ UINT64 *Pte;
+
+- Pd3 = PageFaultGetPd3 (Page);
++ Pd3 = PageFaultGetPd3 (Page, &Msk);
+ Pde = *Pd3;
+ DEBUG ((DEBUG_VERBOSE, "%a: pd3 0x%lx (at %p)\n", __func__, Pde, Pd3));
+ if (!(Pde & 1)) {
+@@ -95,7 +99,7 @@ PageFaultGetPte (
+ }
+
+ Idx = Page >> (12 + 1 * 9) & 0x1ff;
+- Pd2 = (UINT64 *)(Pde & ~0xfff) + Idx;
++ Pd2 = (UINT64 *)(Pde & Msk) + Idx;
+ Pde = *Pd2;
+ DEBUG ((DEBUG_VERBOSE, "%a: pd2 0x%lx (at %p)\n", __func__, Pde, Pd2));
+ if (!(Pde & 1)) {
+@@ -108,7 +112,7 @@ PageFaultGetPte (
+ }
+
+ Idx = Page >> (12 + 0 * 9) & 0x1ff;
+- Pte = (UINT64 *)(Pde & ~0xfff) + Idx;
++ Pte = (UINT64 *)(Pde & Msk) + Idx;
+ DEBUG ((DEBUG_VERBOSE, "%a: pte 0x%lx (at %p)\n", __func__, *Pte, Pte));
+
+ return Pte;
+@@ -133,12 +137,13 @@ PageFaultFixMap (
+ CHAR8 *Reason
+ )
+ {
++ UINT64 Msk;
+ UINT64 Idx;
+ UINT64 *Pd3;
+
+ DEBUG ((DEBUG_INFO, "%a: global RW+NX fixup (%a)\n", __func__, Reason));
+
+- Pd3 = PageFaultGetPd3 (0);
++ Pd3 = PageFaultGetPd3 (0, &Msk);
+ DEBUG ((DEBUG_VERBOSE, "%a: pd3 at 0x%lx [global RW+NX fixup]\n", __func__, Pd3));
+
+ for (Idx = 0; Idx < 512; Idx++) {
+--
+2.55.0
+
diff --git a/0016-OvmfPkg-PlatformDxe-register-page-fault-handler-for-.patch b/0016-OvmfPkg-PlatformDxe-register-page-fault-handler-for-.patch
deleted file mode 100644
index f8ed778..0000000
--- a/0016-OvmfPkg-PlatformDxe-register-page-fault-handler-for-.patch
+++ /dev/null
@@ -1,491 +0,0 @@
-From 8d3842bd504d6a315cbab7eec8cdd9c02ee0e536 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Fri, 20 Jun 2025 11:52:43 +0200
-Subject: [PATCH 16/19] OvmfPkg/PlatformDxe: register page fault handler for NX
- fixups
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- OvmfPkg/IntelTdx/IntelTdxX64.fdf | 2 +-
- OvmfPkg/PlatformDxe/Platform.inf | 9 +-
- OvmfPkg/PlatformDxe/PlatformConfig.h | 5 +
- OvmfPkg/PlatformDxe/PageFault.c | 371 +++++++++++++++++++++++++++
- OvmfPkg/PlatformDxe/Platform.c | 1 +
- 5 files changed, 386 insertions(+), 2 deletions(-)
- create mode 100644 OvmfPkg/PlatformDxe/PageFault.c
-
-diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.fdf b/OvmfPkg/IntelTdx/IntelTdxX64.fdf
-index b49838490d54..3b91c152ff1c 100644
---- a/OvmfPkg/IntelTdx/IntelTdxX64.fdf
-+++ b/OvmfPkg/IntelTdx/IntelTdxX64.fdf
-@@ -242,6 +242,7 @@ [FV.DXEFV]
- INF OvmfPkg/TdxDxe/TdxDxe.inf
-
- INF OvmfPkg/IoMmuDxe/IoMmuDxe.inf
-+INF OvmfPkg/PlatformDxe/Platform.inf
-
- #
- # Variable driver stack (non-SMM)
-@@ -320,7 +321,6 @@ [FV.NCCFV]
-
- INF OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
- INF OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
--INF OvmfPkg/PlatformDxe/Platform.inf
-
- !include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
- !include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
-diff --git a/OvmfPkg/PlatformDxe/Platform.inf b/OvmfPkg/PlatformDxe/Platform.inf
-index 4b5a2557bf04..a13ef10076fb 100644
---- a/OvmfPkg/PlatformDxe/Platform.inf
-+++ b/OvmfPkg/PlatformDxe/Platform.inf
-@@ -18,6 +18,7 @@ [Defines]
- UNLOAD_IMAGE = PlatformUnload
-
- [Sources]
-+ PageFault.c
- Platform.c
- Platform.h
- Platform.uni
-@@ -33,12 +34,14 @@ [Packages]
- [LibraryClasses]
- BaseLib
- BaseMemoryLib
-+ CpuLib
- DebugLib
- DevicePathLib
- HiiLib
- HobLib
- MemoryAllocationLib
- PrintLib
-+ QemuFwCfgSimpleParserLib
- UefiBootServicesTableLib
- UefiHiiServicesLib
- UefiLib
-@@ -50,12 +53,15 @@ [Pcd]
- gEfiMdeModulePkgTokenSpaceGuid.PcdVideoVerticalResolution
- gEfiMdeModulePkgTokenSpaceGuid.PcdSetupVideoHorizontalResolution
- gEfiMdeModulePkgTokenSpaceGuid.PcdSetupVideoVerticalResolution
-+ gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy
-+ gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr
- gUefiOvmfPkgTokenSpaceGuid.PcdVideoResolutionSource
-
- [Protocols]
- gEfiDevicePathProtocolGuid ## PRODUCES
- gEfiGraphicsOutputProtocolGuid ## CONSUMES
- gEfiHiiConfigAccessProtocolGuid ## PRODUCES
-+ gEfiCpuArchProtocolGuid
-
- [Guids]
- gEfiIfrTianoGuid
-@@ -66,4 +72,5 @@ [Depex]
- gEfiHiiConfigRoutingProtocolGuid AND
- gEfiHiiDatabaseProtocolGuid AND
- gEfiVariableArchProtocolGuid AND
-- gEfiVariableWriteArchProtocolGuid
-+ gEfiVariableWriteArchProtocolGuid AND
-+ gEfiCpuArchProtocolGuid
-diff --git a/OvmfPkg/PlatformDxe/PlatformConfig.h b/OvmfPkg/PlatformDxe/PlatformConfig.h
-index 9ea6e5995c60..819897f88789 100644
---- a/OvmfPkg/PlatformDxe/PlatformConfig.h
-+++ b/OvmfPkg/PlatformDxe/PlatformConfig.h
-@@ -51,3 +51,8 @@ PlatformConfigLoad (
-
- extern CHAR16 mVariableName[];
- extern CHAR16 mHiiFormName[];
-+
-+VOID EFIAPI
-+PageFaultInit (
-+ VOID
-+ );
-diff --git a/OvmfPkg/PlatformDxe/PageFault.c b/OvmfPkg/PlatformDxe/PageFault.c
-new file mode 100644
-index 000000000000..50482d0c993d
---- /dev/null
-+++ b/OvmfPkg/PlatformDxe/PageFault.c
-@@ -0,0 +1,371 @@
-+/** @file
-+ custom page fault handler to fixup nx faults
-+
-+ Copyright (C) 2025, Red Hat, Inc.
-+
-+ SPDX-License-Identifier: BSD-2-Clause-Patent
-+**/
-+
-+#include <Library/BaseLib.h>
-+#include <Library/CpuLib.h>
-+#include <Library/DebugLib.h>
-+#include <Library/QemuFwCfgSimpleParserLib.h>
-+#include <Library/UefiBootServicesTableLib.h>
-+#include <Library/UefiLib.h>
-+#include <Protocol/Cpu.h>
-+#include <Protocol/MemoryAttribute.h>
-+
-+#include "PlatformConfig.h"
-+
-+/* ia32 ovmf does not have paging enabled */
-+#if defined (MDE_CPU_X64)
-+
-+STATIC EFI_CPU_ARCH_PROTOCOL *mCpu;
-+STATIC EFI_EVENT mExitBoot;
-+STATIC UINTN mFixupNX;
-+STATIC UINTN mFixupRW;
-+
-+/*
-+ * X64 page table walker, find level3 page table directory.
-+ */
-+UINT64 *
-+EFIAPI
-+PageFaultGetPd3 (
-+ UINT64 Page
-+ )
-+{
-+ UINT64 Idx;
-+ UINT64 Pde;
-+ UINT64 *Pd3;
-+ IA32_CR4 Cr4;
-+
-+ Pde = AsmReadCr3 ();
-+ Cr4.UintN = AsmReadCr4 ();
-+ DEBUG ((DEBUG_VERBOSE, "%a: cr3 0x%lx\n", __func__, Pde));
-+
-+ if (Cr4.Bits.LA57) {
-+ Idx = Page >> (12 + 4 * 9) & 0x1ff;
-+ Pde = *((UINT64 *)(Pde & ~0xfff) + Idx);
-+ DEBUG ((DEBUG_VERBOSE, "%a: pd5 0x%lx\n", __func__, Pde));
-+ if (!(Pde & 1)) {
-+ return NULL; // not present
-+ }
-+ } else {
-+ DEBUG ((DEBUG_VERBOSE, "%a: no pd5\n", __func__));
-+ }
-+
-+ Idx = Page >> (12 + 3 * 9) & 0x1ff;
-+ Pde = *((UINT64 *)(Pde & ~0xfff) + Idx);
-+ DEBUG ((DEBUG_VERBOSE, "%a: pd4 0x%lx\n", __func__, Pde));
-+ if (!(Pde & 1)) {
-+ return NULL; // not present
-+ }
-+
-+ Idx = Page >> (12 + 2 * 9) & 0x1ff;
-+ Pd3 = (UINT64 *)(Pde & ~0xfff) + Idx;
-+ return Pd3;
-+}
-+
-+/*
-+ * X64 page table walker, returns a pointer to the page table entry.
-+ * For large pages a pointer to the large PTE is returned.
-+ */
-+UINT64 *
-+EFIAPI
-+PageFaultGetPte (
-+ UINT64 Page
-+ )
-+{
-+ UINT64 Idx;
-+ UINT64 Pde;
-+ UINT64 *Pd3;
-+ UINT64 *Pd2;
-+ UINT64 *Pte;
-+
-+ Pd3 = PageFaultGetPd3 (Page);
-+ Pde = *Pd3;
-+ DEBUG ((DEBUG_VERBOSE, "%a: pd3 0x%lx (at %p)\n", __func__, Pde, Pd3));
-+ if (!(Pde & 1)) {
-+ return NULL; // not present
-+ }
-+
-+ if (Pde & 0x80) {
-+ DEBUG ((DEBUG_VERBOSE, "%a: 1G page\n", __func__));
-+ return Pd3; // 1G page
-+ }
-+
-+ Idx = Page >> (12 + 1 * 9) & 0x1ff;
-+ Pd2 = (UINT64 *)(Pde & ~0xfff) + Idx;
-+ Pde = *Pd2;
-+ DEBUG ((DEBUG_VERBOSE, "%a: pd2 0x%lx (at %p)\n", __func__, Pde, Pd2));
-+ if (!(Pde & 1)) {
-+ return NULL; // not present
-+ }
-+
-+ if (Pde & 0x80) {
-+ DEBUG ((DEBUG_VERBOSE, "%a: 2M page\n", __func__));
-+ return Pd2; // 2M page
-+ }
-+
-+ Idx = Page >> (12 + 0 * 9) & 0x1ff;
-+ Pte = (UINT64 *)(Pde & ~0xfff) + Idx;
-+ DEBUG ((DEBUG_VERBOSE, "%a: pte 0x%lx (at %p)\n", __func__, *Pte, Pte));
-+
-+ return Pte;
-+}
-+
-+/*
-+ * Fix page tables, clear NX, set RW, using 1G pages, lowest 512G.
-+ *
-+ * Background:
-+ *
-+ * Sometimes NX/RW faults happen with the kernel still running on the EFI page
-+ * tables, but after the kernel installed its own page fault handler.
-+ *
-+ * Sometimes the kernel handler fails to deal with the faults -> BOOM.
-+ *
-+ * So lets tweak the EFI page table to allow everything if our heuristics
-+ * indicate this is a good idea.
-+ */
-+VOID
-+EFIAPI
-+PageFaultFixMap (
-+ CHAR8 *Reason
-+ )
-+{
-+ UINT64 Idx;
-+ UINT64 *Pd3;
-+
-+ if (PcdGet64 (PcdConfidentialComputingGuestAttr) != 0) {
-+ /* switching to 1G pages will break things */
-+ DEBUG ((DEBUG_INFO, "%a: skip global RW+NX fixup in CVM\n", __func__));
-+ return;
-+ }
-+
-+ DEBUG ((DEBUG_INFO, "%a: global RW+NX fixup (%a)\n", __func__, Reason));
-+
-+ Pd3 = PageFaultGetPd3 (0);
-+ DEBUG ((DEBUG_VERBOSE, "%a: pd3 at 0x%lx [global RW+NX fixup]\n", __func__, Pd3));
-+
-+ for (Idx = 0; Idx < 512; Idx++) {
-+ Pd3[Idx] = (0x40000000 * Idx) | 0x83; // use 1G page
-+ if (!(Pd3[Idx] & 1)) {
-+ break;
-+ }
-+ }
-+
-+ CpuFlushTlb ();
-+}
-+
-+/*
-+ * Page fault handler which fixes up NX + WR faults by flipping the PTE bits.
-+ * This allows guest OSes which are not NX clean boot. The fixups needed are
-+ * counted for later reporting.
-+ */
-+VOID
-+EFIAPI
-+PageFaultHandler (
-+ IN EFI_EXCEPTION_TYPE ExceptionType,
-+ IN EFI_SYSTEM_CONTEXT SystemContext
-+ )
-+{
-+ STATIC BOOLEAN Running = FALSE;
-+ UINT64 Page, *Pte;
-+ UINT64 ExceptionData;
-+
-+ Page = SystemContext.SystemContextX64->Cr2 & ~(EFI_PAGE_SIZE-1);
-+ ExceptionData = SystemContext.SystemContextX64->ExceptionData;
-+
-+ DEBUG ((
-+ DEBUG_INFO,
-+ "%a: CR2: %016lx - RIP: %016lx - ID:%x WR:%x P:%x [0x%x]\n",
-+ __func__,
-+ SystemContext.SystemContextX64->Cr2,
-+ SystemContext.SystemContextX64->Rip,
-+ (ExceptionData & BIT4) != 0,
-+ (ExceptionData & BIT1) != 0,
-+ (ExceptionData & BIT0) != 0,
-+ ExceptionData
-+ ));
-+
-+ if (Running) {
-+ DEBUG ((DEBUG_INFO, "%a: nested page fault\n", __func__));
-+ goto fatal;
-+ }
-+
-+ Running = TRUE;
-+
-+ if (ExceptionData & BIT0) {
-+ /* page present */
-+
-+ if (ExceptionData & BIT4) {
-+ /* instruction decode (-> NX fault) */
-+ Pte = PageFaultGetPte (Page);
-+ if (Pte && (*Pte & BIT63)) {
-+ DEBUG ((
-+ DEBUG_INFO,
-+ "%a: clearing NX for page 0x%lx%a\n",
-+ __func__,
-+ Page,
-+ (*Pte & 0x80) ? " [large pte]" : ""
-+ ));
-+ *Pte &= ~BIT63;
-+ CpuFlushTlb ();
-+ mFixupNX++;
-+ Running = FALSE;
-+ return;
-+ }
-+ }
-+
-+ if (ExceptionData & BIT1) {
-+ /* write access */
-+ Pte = PageFaultGetPte (Page);
-+ if (Pte && (!(*Pte & BIT1))) {
-+ DEBUG ((
-+ DEBUG_INFO,
-+ "%a: setting RW for page 0x%lx%a\n",
-+ __func__,
-+ Page,
-+ (*Pte & 0x80) ? " [large pte]" : ""
-+ ));
-+ *Pte |= BIT1;
-+ CpuFlushTlb ();
-+ mFixupRW++;
-+ Running = FALSE;
-+ return;
-+ }
-+ }
-+ }
-+
-+ if (!(ExceptionData & BIT0)) {
-+ /* page not present */
-+ if (Page == 0) {
-+ DEBUG ((DEBUG_INFO, "%a: NULL pointer dereference\n", __func__));
-+ }
-+ }
-+
-+fatal:
-+ DEBUG ((DEBUG_INFO, "%a: fatal: can't handle exception -> HALT\n", __func__));
-+ CpuDeadLoop ();
-+}
-+
-+/*
-+ * In case any fixups have been applies report them to the console at
-+ * ExitBootService time.
-+ */
-+STATIC
-+VOID
-+EFIAPI
-+PageFaultExitBoot (
-+ IN EFI_EVENT Event,
-+ IN VOID *Context
-+ )
-+{
-+ STATIC EFI_GUID SHIM_LOCK_GUID = {
-+ 0x605dab50, 0xe046, 0x4300, { 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 }
-+ };
-+ STATIC EFI_GUID SHIM_IMAGE_LOADER_GUID = {
-+ 0x1f492041, 0xfadb, 0x4e59, { 0x9e, 0x57, 0x7c, 0xaf, 0xe7, 0x3a, 0x55, 0xab }
-+ };
-+ VOID *ShimLock = NULL;
-+ VOID *ShimLoader = NULL;
-+ BOOLEAN MessageWait = FALSE;
-+ BOOLEAN HaveOldShim;
-+
-+ gBS->LocateProtocol (&SHIM_LOCK_GUID, NULL, &ShimLock);
-+ gBS->LocateProtocol (&SHIM_IMAGE_LOADER_GUID, NULL, &ShimLoader);
-+ HaveOldShim = (ShimLock != NULL) && (ShimLoader == NULL);
-+
-+ DEBUG ((
-+ DEBUG_INFO,
-+ "%a: shim protocols: lock=%a, loader=%a -> old-shim=%a\n",
-+ __func__,
-+ (ShimLock != NULL) ? "yes" : "no",
-+ (ShimLoader != NULL) ? "yes" : "no",
-+ (HaveOldShim) ? "yes" : "no"
-+ ));
-+ DEBUG ((DEBUG_INFO, "%a: fixups: %d NX, %d RW\n", __func__, mFixupNX, mFixupRW));
-+
-+ if (mFixupNX || mFixupRW) {
-+ /* we had to fixup NX or RW faults -> broken behavior -> report it */
-+ AsciiPrint (
-+ "%a: Page fault fixups needed (NX: %d, RW: %d).\n"
-+ "%a: The guest OS boot chain is not NX clean.\n",
-+ __func__,
-+ mFixupNX,
-+ mFixupRW,
-+ __func__
-+ );
-+ MessageWait = TRUE;
-+ }
-+
-+ if (mFixupNX) {
-+ /* we had to fixup NX faults -> apply global fixup as precaution + report it */
-+ AsciiPrint (
-+ "%a: Applying global page table fixup (saw NX faults).\n",
-+ __func__
-+ );
-+ PageFaultFixMap ("nx-fault");
-+
-+ } else if (HaveOldShim) {
-+ /* we detected shim older than v16 -> apply global fixup as precaution + report it */
-+ AsciiPrint (
-+ "%a: Applying global page table fixup (shim is older than v16).\n",
-+ __func__
-+ );
-+ PageFaultFixMap ("old-shim");
-+ }
-+
-+ if (MessageWait) {
-+ gBS->Stall (3000000);
-+ }
-+}
-+
-+#endif
-+
-+VOID
-+EFIAPI
-+PageFaultInit (
-+ VOID
-+ )
-+{
-+ #if defined (MDE_CPU_X64)
-+ EFI_STATUS Status;
-+ BOOLEAN StrictNX;
-+
-+ if (FixedPcdGet64 (PcdDxeNxMemoryProtectionPolicy) == 0) {
-+ DEBUG ((DEBUG_INFO, "%a: no NX protection in this build.\n", __func__));
-+ return;
-+ }
-+
-+ StrictNX = FALSE;
-+ Status = QemuFwCfgParseBool (
-+ "opt/org.tianocore/StrictNX",
-+ &StrictNX
-+ );
-+ if (StrictNX) {
-+ DEBUG ((DEBUG_INFO, "%a: StrictNX enabled\n", __func__));
-+ return;
-+ }
-+
-+ DEBUG ((DEBUG_INFO, "%a: StrictNX disabled - installing page fault handler\n", __func__));
-+
-+ gBS->LocateProtocol (&gEfiCpuArchProtocolGuid, NULL, (VOID **)&mCpu);
-+ Status = mCpu->RegisterInterruptHandler (mCpu, EXCEPT_IA32_PAGE_FAULT, PageFaultHandler);
-+ DEBUG ((DEBUG_INFO, "%a: mCpu->RegisterInterruptHandler: %r\n", __func__, Status));
-+ if (Status != EFI_SUCCESS) {
-+ return;
-+ }
-+
-+ Status = gBS->CreateEvent (
-+ EVT_SIGNAL_EXIT_BOOT_SERVICES,
-+ TPL_CALLBACK,
-+ &PageFaultExitBoot,
-+ NULL,
-+ &mExitBoot
-+ );
-+ DEBUG ((DEBUG_INFO, "%a: gBS->CreateEvent: %r\n", __func__, Status));
-+ #else
-+ DEBUG ((DEBUG_INFO, "%a: not supported on this architecture.\n", __func__));
-+ #endif
-+}
-diff --git a/OvmfPkg/PlatformDxe/Platform.c b/OvmfPkg/PlatformDxe/Platform.c
-index aee5a397b324..b768d544cc79 100644
---- a/OvmfPkg/PlatformDxe/Platform.c
-+++ b/OvmfPkg/PlatformDxe/Platform.c
-@@ -1055,6 +1055,7 @@ PlatformInit (
- ASSERT_EFI_ERROR (Status);
-
- MemDebugLogInstallTable ();
-+ PageFaultInit ();
-
- return EFI_SUCCESS;
-
---
-2.54.0
-
diff --git a/0017-OvmfPkg-PlatformDxe-add-check-for-1g-page-support.patch b/0017-OvmfPkg-PlatformDxe-add-check-for-1g-page-support.patch
deleted file mode 100644
index 3a6ce9f..0000000
--- a/0017-OvmfPkg-PlatformDxe-add-check-for-1g-page-support.patch
+++ /dev/null
@@ -1,121 +0,0 @@
-From b4e372ef11503fd8fa0cbb9b5f8c424925764944 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Mon, 6 Oct 2025 09:11:59 +0200
-Subject: [PATCH 17/17] OvmfPkg/PlatformDxe: add check for 1g page support
-
----
- OvmfPkg/PlatformDxe/PageFault.c | 72 ++++++++++++++++++++-------------
- 1 file changed, 43 insertions(+), 29 deletions(-)
-
-diff --git a/OvmfPkg/PlatformDxe/PageFault.c b/OvmfPkg/PlatformDxe/PageFault.c
-index 50482d0c993d..ef24933d8644 100644
---- a/OvmfPkg/PlatformDxe/PageFault.c
-+++ b/OvmfPkg/PlatformDxe/PageFault.c
-@@ -130,18 +130,12 @@ PageFaultGetPte (
- VOID
- EFIAPI
- PageFaultFixMap (
-- CHAR8 *Reason
-+ CHAR8 *Reason
- )
- {
- UINT64 Idx;
- UINT64 *Pd3;
-
-- if (PcdGet64 (PcdConfidentialComputingGuestAttr) != 0) {
-- /* switching to 1G pages will break things */
-- DEBUG ((DEBUG_INFO, "%a: skip global RW+NX fixup in CVM\n", __func__));
-- return;
-- }
--
- DEBUG ((DEBUG_INFO, "%a: global RW+NX fixup (%a)\n", __func__, Reason));
-
- Pd3 = PageFaultGetPd3 (0);
-@@ -249,6 +243,24 @@ PageFaultHandler (
- CpuDeadLoop ();
- }
-
-+STATIC
-+BOOLEAN
-+PageFaultHave1GPages (
-+ )
-+{
-+ UINT32 RegEax, RegEdx;
-+
-+ AsmCpuid (0x80000000, &RegEax, NULL, NULL, NULL);
-+ if (RegEax >= 0x80000001) {
-+ AsmCpuid (0x80000001, NULL, NULL, NULL, &RegEdx);
-+ if ((RegEdx & BIT26) != 0) {
-+ return TRUE;
-+ }
-+ }
-+
-+ return FALSE;
-+}
-+
- /*
- * In case any fixups have been applies report them to the console at
- * ExitBootService time.
-@@ -277,13 +289,13 @@ PageFaultExitBoot (
- HaveOldShim = (ShimLock != NULL) && (ShimLoader == NULL);
-
- DEBUG ((
-- DEBUG_INFO,
-- "%a: shim protocols: lock=%a, loader=%a -> old-shim=%a\n",
-- __func__,
-- (ShimLock != NULL) ? "yes" : "no",
-- (ShimLoader != NULL) ? "yes" : "no",
-- (HaveOldShim) ? "yes" : "no"
-- ));
-+ DEBUG_INFO,
-+ "%a: shim protocols: lock=%a, loader=%a -> old-shim=%a\n",
-+ __func__,
-+ (ShimLock != NULL) ? "yes" : "no",
-+ (ShimLoader != NULL) ? "yes" : "no",
-+ (HaveOldShim) ? "yes" : "no"
-+ ));
- DEBUG ((DEBUG_INFO, "%a: fixups: %d NX, %d RW\n", __func__, mFixupNX, mFixupRW));
-
- if (mFixupNX || mFixupRW) {
-@@ -299,21 +311,23 @@ PageFaultExitBoot (
- MessageWait = TRUE;
- }
-
-- if (mFixupNX) {
-- /* we had to fixup NX faults -> apply global fixup as precaution + report it */
-- AsciiPrint (
-- "%a: Applying global page table fixup (saw NX faults).\n",
-- __func__
-- );
-- PageFaultFixMap ("nx-fault");
--
-- } else if (HaveOldShim) {
-- /* we detected shim older than v16 -> apply global fixup as precaution + report it */
-- AsciiPrint (
-- "%a: Applying global page table fixup (shim is older than v16).\n",
-- __func__
-- );
-- PageFaultFixMap ("old-shim");
-+ if (PageFaultHave1GPages () &&
-+ PcdGet64 (PcdConfidentialComputingGuestAttr) == 0) {
-+ if (mFixupNX) {
-+ /* we had to fixup NX faults -> apply global fixup as precaution + report it */
-+ AsciiPrint (
-+ "%a: Applying global page table fixup (saw NX faults).\n",
-+ __func__
-+ );
-+ PageFaultFixMap ("nx-fault");
-+ } else if (HaveOldShim) {
-+ /* we detected shim older than v16 -> apply global fixup as precaution + report it */
-+ AsciiPrint (
-+ "%a: Applying global page table fixup (shim is older than v16).\n",
-+ __func__
-+ );
-+ PageFaultFixMap ("old-shim");
-+ }
- }
-
- if (MessageWait) {
---
-2.53.0
-
diff --git a/0018-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch b/0018-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch
deleted file mode 100644
index 58973a7..0000000
--- a/0018-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 9be89281c7c62eedd449f1e08bd57b88f9daff58 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 12 Mar 2026 11:35:23 +0100
-Subject: [PATCH 18/18] Revert "OvmfPkg/X86QemuLoadImageLib: flip default for
- EnableLegacyLoader to false"
-
-This reverts commit d2cbaefc082294eadaa30a3d5f0fa8ba264a574a.
----
- .../X86QemuLoadImageLib/X86QemuLoadImageLib.c | 2 +-
- OvmfPkg/RUNTIME_CONFIG.md | 15 ++++++---------
- 2 files changed, 7 insertions(+), 10 deletions(-)
-
-diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
-index f98f8ab885b4..b16bdeb47f8c 100644
---- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
-+++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
-@@ -449,7 +449,7 @@ QemuLoadKernelImage (
- &Enabled
- );
- if (EFI_ERROR (RetStatus)) {
-- Enabled = FALSE;
-+ Enabled = TRUE;
- }
-
- if (!Enabled) {
-diff --git a/OvmfPkg/RUNTIME_CONFIG.md b/OvmfPkg/RUNTIME_CONFIG.md
-index 57d0dd96111a..b75a5dacadf5 100644
---- a/OvmfPkg/RUNTIME_CONFIG.md
-+++ b/OvmfPkg/RUNTIME_CONFIG.md
-@@ -153,19 +153,16 @@ without EFI stub. If you are using kernels that old secure boot
- support is the least of your problems though ...
-
- The linux kernel is typically signed by the distro secure boot keys
--and is verified by the distro `shim.efi` binary. qemu version 10.0
--(released in April 2025) got support for passing the shim binary
-+and is verified by the distro `shim.efi` binary. qemu release 10.0
-+(ETA ~ March 2025) will get support for passing the shim binary
- (additionally to kernel + initrd) to the firmware, so the usual secure
- boot verification can work with direct kernel load too.
-
--In edk2-stable202502 and newer the EnableLegacyLoader config option is
--available and enabled by default.
-+For now the legacy loader is enabled by default. Once the new qemu
-+release is available in most linux distros the defaut will be flipped
-+to disabled.
-
--In edk2-stable202602 and newer the EnableLegacyLoader config option is
--disabled by default.
--
--Here is the qemu command line for direct kernel boot with secure boot
--verification:
-+Usage (qemu 10.0+):
-
- ```
- qemu-system-x86_64 \
---
-2.53.0
-
diff --git a/0019-CryptoPkg-TlsLib-downgrade-security-level-from-3-to-.patch b/0019-CryptoPkg-TlsLib-downgrade-security-level-from-3-to-.patch
deleted file mode 100644
index bd3f79a..0000000
--- a/0019-CryptoPkg-TlsLib-downgrade-security-level-from-3-to-.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From a9acc7675207d9cfaa056b7ceb6cb55f6b2f316d Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 23 Apr 2026 11:17:02 +0200
-Subject: [PATCH 19/19] CryptoPkg/TlsLib: downgrade security level from 3 to 2
-
-unbreak https boot.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- CryptoPkg/Library/TlsLib/TlsInit.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/CryptoPkg/Library/TlsLib/TlsInit.c b/CryptoPkg/Library/TlsLib/TlsInit.c
-index 96634cffcc89..0a94b2bb6dd1 100644
---- a/CryptoPkg/Library/TlsLib/TlsInit.c
-+++ b/CryptoPkg/Library/TlsLib/TlsInit.c
-@@ -188,7 +188,7 @@ TlsNew (
- //
- // This retains compatibility with previous version of OpenSSL.
- //
-- SSL_set_security_level (TlsConn->Ssl, 3);
-+ SSL_set_security_level (TlsConn->Ssl, 2);
-
- //
- // Initialize the created SSL Object
---
-2.53.0
-
diff --git a/0020-OvmfPkg-PlatformDxe-proper-addr-masking.patch b/0020-OvmfPkg-PlatformDxe-proper-addr-masking.patch
deleted file mode 100644
index 4aab323..0000000
--- a/0020-OvmfPkg-PlatformDxe-proper-addr-masking.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-From 02aeb9361078abf9571fb1daf04c97f2ec8fed0c Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Tue, 16 Jun 2026 14:08:35 +0200
-Subject: [PATCH 20/20] OvmfPkg/PlatformDxe: proper addr masking
-
-filter out high control bits (nx, cbit).
----
- OvmfPkg/PlatformDxe/PageFault.c | 21 +++++++++++++--------
- 1 file changed, 13 insertions(+), 8 deletions(-)
-
-diff --git a/OvmfPkg/PlatformDxe/PageFault.c b/OvmfPkg/PlatformDxe/PageFault.c
-index ef24933d8644..8aad784dfa4f 100644
---- a/OvmfPkg/PlatformDxe/PageFault.c
-+++ b/OvmfPkg/PlatformDxe/PageFault.c
-@@ -31,7 +31,8 @@ STATIC UINTN mFixupRW;
- UINT64 *
- EFIAPI
- PageFaultGetPd3 (
-- UINT64 Page
-+ UINT64 Page,
-+ UINT64 *Msk
- )
- {
- UINT64 Idx;
-@@ -44,25 +45,27 @@ PageFaultGetPd3 (
- DEBUG ((DEBUG_VERBOSE, "%a: cr3 0x%lx\n", __func__, Pde));
-
- if (Cr4.Bits.LA57) {
-+ *Msk = 0x1fffffffffff000;
- Idx = Page >> (12 + 4 * 9) & 0x1ff;
-- Pde = *((UINT64 *)(Pde & ~0xfff) + Idx);
-+ Pde = *((UINT64 *)(Pde & *Msk) + Idx);
- DEBUG ((DEBUG_VERBOSE, "%a: pd5 0x%lx\n", __func__, Pde));
- if (!(Pde & 1)) {
- return NULL; // not present
- }
- } else {
-+ *Msk = 0xfffffffff000;
- DEBUG ((DEBUG_VERBOSE, "%a: no pd5\n", __func__));
- }
-
- Idx = Page >> (12 + 3 * 9) & 0x1ff;
-- Pde = *((UINT64 *)(Pde & ~0xfff) + Idx);
-+ Pde = *((UINT64 *)(Pde & *Msk) + Idx);
- DEBUG ((DEBUG_VERBOSE, "%a: pd4 0x%lx\n", __func__, Pde));
- if (!(Pde & 1)) {
- return NULL; // not present
- }
-
- Idx = Page >> (12 + 2 * 9) & 0x1ff;
-- Pd3 = (UINT64 *)(Pde & ~0xfff) + Idx;
-+ Pd3 = (UINT64 *)(Pde & *Msk) + Idx;
- return Pd3;
- }
-
-@@ -76,13 +79,14 @@ PageFaultGetPte (
- UINT64 Page
- )
- {
-+ UINT64 Msk;
- UINT64 Idx;
- UINT64 Pde;
- UINT64 *Pd3;
- UINT64 *Pd2;
- UINT64 *Pte;
-
-- Pd3 = PageFaultGetPd3 (Page);
-+ Pd3 = PageFaultGetPd3 (Page, &Msk);
- Pde = *Pd3;
- DEBUG ((DEBUG_VERBOSE, "%a: pd3 0x%lx (at %p)\n", __func__, Pde, Pd3));
- if (!(Pde & 1)) {
-@@ -95,7 +99,7 @@ PageFaultGetPte (
- }
-
- Idx = Page >> (12 + 1 * 9) & 0x1ff;
-- Pd2 = (UINT64 *)(Pde & ~0xfff) + Idx;
-+ Pd2 = (UINT64 *)(Pde & Msk) + Idx;
- Pde = *Pd2;
- DEBUG ((DEBUG_VERBOSE, "%a: pd2 0x%lx (at %p)\n", __func__, Pde, Pd2));
- if (!(Pde & 1)) {
-@@ -108,7 +112,7 @@ PageFaultGetPte (
- }
-
- Idx = Page >> (12 + 0 * 9) & 0x1ff;
-- Pte = (UINT64 *)(Pde & ~0xfff) + Idx;
-+ Pte = (UINT64 *)(Pde & Msk) + Idx;
- DEBUG ((DEBUG_VERBOSE, "%a: pte 0x%lx (at %p)\n", __func__, *Pte, Pte));
-
- return Pte;
-@@ -133,12 +137,13 @@ PageFaultFixMap (
- CHAR8 *Reason
- )
- {
-+ UINT64 Msk;
- UINT64 Idx;
- UINT64 *Pd3;
-
- DEBUG ((DEBUG_INFO, "%a: global RW+NX fixup (%a)\n", __func__, Reason));
-
-- Pd3 = PageFaultGetPd3 (0);
-+ Pd3 = PageFaultGetPd3 (0, &Msk);
- DEBUG ((DEBUG_VERBOSE, "%a: pd3 at 0x%lx [global RW+NX fixup]\n", __func__, Pd3));
-
- for (Idx = 0; Idx < 512; Idx++) {
---
-2.54.0
-
diff --git a/0021-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch b/0021-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch
deleted file mode 100644
index 29880bd..0000000
--- a/0021-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 080fffd983af24d5f878888acfbda9d023ecc261 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 30 Jul 2026 10:44:31 +0200
-Subject: [PATCH 21/22] OvmfPkg/EmuVariableFvbRuntimeDxe: fix ValidateFvHeader
- in tdx mode
-
-In TDX mode MmioRead* functions can not access memory, so avoid that.
-See added source code comments for details.
-
-Fixes: 0917ddad2529 ("OvmfPkg/EmuVariableFvbRuntimeDxe: avoid accessing varstore header with cmp")
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf | 1 +
- OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c | 41 +++++++++++++++++++++---
- 2 files changed, 38 insertions(+), 4 deletions(-)
-
-diff --git a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf
-index 396e6028b405..da1da9e0bd50 100644
---- a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf
-+++ b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf
-@@ -63,6 +63,7 @@ [Pcd]
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64
- gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64
- gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved
-+ gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr
-
- [Depex]
- TRUE
-diff --git a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c
-index 66e3929ec819..b674ae67a3ce 100644
---- a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c
-+++ b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c
-@@ -8,6 +8,9 @@
- **/
-
- #include "PiDxe.h"
-+
-+#include <ConfidentialComputingGuestAttr.h>
-+
- #include <Guid/EventGroup.h>
- #include <Guid/SystemNvDataGuid.h>
- #include <Guid/VariableFormat.h>
-@@ -567,16 +570,46 @@ ValidateFvHeader (
- )
- {
- UINT16 Checksum;
-+ UINT8 Revision;
-+ UINT32 Signature;
-+ UINT64 FvLength;
-+ UINT16 HeaderLength;
-+
-+ if (CC_GUEST_IS_TDX (PcdGet64 (PcdConfidentialComputingGuestAttr))) {
-+ /*
-+ * When in tdx mode the varstore must be in ram not pflash, so there are no
-+ * mmio reads/writes needed. Also in tdx mode BaseIoLibIntrinsic will
-+ * translate the mmio access into TDVMCALL_MMIO calls instead of mov
-+ * instructions, so memory access with MmioRead* functions does not work.
-+ */
-+ Revision = FwVolHeader->Revision;
-+ Signature = FwVolHeader->Signature;
-+ FvLength = FwVolHeader->FvLength;
-+ HeaderLength = FwVolHeader->HeaderLength;
-+ } else {
-+ /*
-+ * In sev mode with varstore in pflash we must use MmioRead* functions so to
-+ * make sure the mov instruction used to access pflash/memory is supported
-+ * by the #VC handler instruction emulator.
-+ *
-+ * Note: Only sev + sev-es need proper pflash handling, sev-snp is like tdx
-+ * incompatible with pflash emulation.
-+ */
-+ Revision = MmioRead8 ((UINTN)(&FwVolHeader->Revision));
-+ Signature = MmioRead32 ((UINTN)(&FwVolHeader->Signature));
-+ FvLength = MmioRead64 ((UINTN)(&FwVolHeader->FvLength));
-+ HeaderLength = MmioRead16 ((UINTN)(&FwVolHeader->HeaderLength));
-+ }
-
- //
- // Verify the header revision, header signature, length
- // Length of FvBlock cannot be 2**64-1
- // HeaderLength cannot be an odd number
- //
-- if ((MmioRead8 ((UINTN)(&FwVolHeader->Revision)) != EFI_FVH_REVISION) ||
-- (MmioRead32 ((UINTN)(&FwVolHeader->Signature)) != EFI_FVH_SIGNATURE) ||
-- (MmioRead64 ((UINTN)(&FwVolHeader->FvLength)) != EMU_FVB_SIZE) ||
-- (MmioRead16 ((UINTN)(&FwVolHeader->HeaderLength)) != EMU_FV_HEADER_LENGTH)
-+ if ((Revision != EFI_FVH_REVISION) ||
-+ (Signature != EFI_FVH_SIGNATURE) ||
-+ (FvLength != EMU_FVB_SIZE) ||
-+ (HeaderLength != EMU_FV_HEADER_LENGTH)
- )
- {
- DEBUG ((DEBUG_INFO, "EMU Variable FVB: Basic FV headers were invalid\n"));
---
-2.55.0
-
diff --git a/0022-OvmfPkg-IntelTdx-Move-BootManagerMenuApp-from-NCCFV-.patch b/0022-OvmfPkg-IntelTdx-Move-BootManagerMenuApp-from-NCCFV-.patch
deleted file mode 100644
index 27c1844..0000000
--- a/0022-OvmfPkg-IntelTdx-Move-BootManagerMenuApp-from-NCCFV-.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From ea8d18fb338abc4fe2d4d87187d0969e883cbe3a Mon Sep 17 00:00:00 2001
-From: Luigi Leonardi <leonardi@redhat.com>
-Date: Mon, 22 Jun 2026 11:09:42 +0200
-Subject: [PATCH 22/22] OvmfPkg/IntelTdx: Move BootManagerMenuApp from NCCFV to
- DXEFV
-
-Commit 03a07cb0f5 moved both UiApp and BootManagerMenuApp to
-NCCFV to reduce the attack surface for TD guests. However,
-NCCFV is not discovered when TDX is enabled, which means
-that EfiBootManagerGetBootManagerMenu() fails
-to find the BootManagerMenuApp, triggering the assert:
-
-[Bds]BootManagerMenu FFS section can not be found, skip its boot option registration
-
-ASSERT_EFI_ERROR (Status = Not Found)
-ASSERT BdsPlatform.c(155): !(((RETURN_STATUS)(Status)) >= 0x8000000000000000ULL)
-
-that prevents any any boot option to work.
-
-Move BootManagerMenuApp back to DXEFV so the ASSERT is
-satisfied.
-
-Fixes: 03a07cb0f5 ("OvmfPkg/IntelTdx: only add UI to NCCFV")
-Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
----
- OvmfPkg/IntelTdx/IntelTdxX64.fdf | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.fdf b/OvmfPkg/IntelTdx/IntelTdxX64.fdf
-index 3b91c152ff1c..58d657b4a3d2 100644
---- a/OvmfPkg/IntelTdx/IntelTdxX64.fdf
-+++ b/OvmfPkg/IntelTdx/IntelTdxX64.fdf
-@@ -262,6 +262,8 @@ [FV.DXEFV]
- #
- INF MdeModulePkg/Universal/SmbiosMeasurementDxe/SmbiosMeasurementDxe.inf
-
-+INF MdeModulePkg/Application/BootManagerMenuApp/BootManagerMenuApp.inf
-+
- ################################################################################
-
- [FV.NCCFV]
-@@ -305,7 +307,6 @@ [FV.NCCFV]
- INF MdeModulePkg/Logo/LogoDxe.inf
-
- INF MdeModulePkg/Application/UiApp/UiApp.inf
--INF MdeModulePkg/Application/BootManagerMenuApp/BootManagerMenuApp.inf
-
- #
- # Usb Support
---
-2.55.0
-
diff --git a/0023-OvmfPkg-PlatformInitLib-restore-below-4G-low-memory-.patch b/0023-OvmfPkg-PlatformInitLib-restore-below-4G-low-memory-.patch
deleted file mode 100644
index 30d0bc1..0000000
--- a/0023-OvmfPkg-PlatformInitLib-restore-below-4G-low-memory-.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From c329ada8988685230cb1c56f8ad8baf34e8494f3 Mon Sep 17 00:00:00 2001
-From: Stanislaw Grams <stanislaw.grams@intel.com>
-Date: Fri, 3 Jul 2026 13:31:38 +0200
-Subject: [PATCH 23/23] OvmfPkg/PlatformInitLib: restore below-4G low memory
- detection for TDVF
-
-Commit 0a0919607c ("OvmfPkg/PlatformInitLib: redefine low memory") narrowed
-PlatformGetLowMemoryCB() to consider only the first below-4G memory block
-whose base address is zero. The change was intended to fix SVSM guests,
-where SVSM caves a chunk out of below-4G RAM and OVMF must not stray into
-that hole.
-
-TDVF, however, reports its below-4G RAM through the TdHob as two adjacent
-resource descriptors:
-
- [0, 0x800000) EFI_RESOURCE_SYSTEM_MEMORY (pre-accepted)
- [0x800000, ~4G) EFI_RESOURCE_MEMORY_UNACCEPTED
-
-PlatformScanE820Tdx() surfaces both as EfiAcpiAddressRangeMemory E820
-entries. After 0a0919607c only the first, tiny 8 MiB block is picked up,
-so PlatformInfoHob->LowMemory becomes 0x800000.
-In OvmfPkg/PlatformPei/MemDetect.c PublishPeiMemory() this drives:
-
- LowerMemorySize = 0x00800000 // LowMemory
- PeiMemoryCap = 0x04F82000 // ~81 MiB
- MemoryBase = LowerMemorySize - PeiMemoryCap // UINT32 underflow
- = 0xFB87E000
-
-Permanent PEI memory is then published at 0xFB87E000, which is not backed
-by RAM. TemporaryRamMigration()'s first CopyMem into that phantom range
-(observed as 0xFB898000 in the failing log) faults, tearing down the TD.
-
-Fold adjacent below-4G memory blocks into the low-memory span: accept an
-entry whose base equals the current LowMemory and advance LowMemory by
-its length. LowMemory starts at zero, so the first accepted block at
-address 0 still starts the sequence; non-adjacent above-4G or SVSM-carved
-blocks continue to be skipped (their base does not match LowMemory); and
-the TDVF accepted+unaccepted pair, which is contiguous, is now grouped
-correctly.
-
-Co-authored-by: Gerd Hoffmann <kraxel@redhat.com>
-Signed-off-by: Stanislaw Grams <stanislaw.grams@intel.com>
----
- OvmfPkg/Library/PlatformInitLib/MemDetect.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-index 3a2c974e087c..611cad986738 100644
---- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-+++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-@@ -164,6 +164,10 @@ PlatformGetFirstNonAddressCB (
- there are multiple memory blocks below 4G though, because SVSM caves out a
- chunk of memory for itself. Only the first of these blocks is considered
- low memory.
-+
-+ Multiple blocks without gap inbetween are grouped together.
-+ This is required for TDX which has two low memory descriptors
-+ (accepted and unaccepted).
- **/
- STATIC
- VOID
-@@ -176,12 +180,12 @@ PlatformGetLowMemoryCB (
- return;
- }
-
-- if (E820Entry->BaseAddr != 0) {
-+ if (E820Entry->BaseAddr != PlatformInfoHob->LowMemory) {
- return;
- }
-
-- DEBUG ((DEBUG_INFO, "%a: LowMemory=0x%Lx\n", __func__, E820Entry->Length));
-- PlatformInfoHob->LowMemory = (UINT32)E820Entry->Length;
-+ PlatformInfoHob->LowMemory += (UINT32)E820Entry->Length;
-+ DEBUG ((DEBUG_INFO, "%a: LowMemory=0x%Lx\n", __func__, PlatformInfoHob->LowMemory));
- }
-
- /**
---
-2.55.0
-
diff --git a/edk2.spec b/edk2.spec
index 91e2117..31e9620 100644
--- a/edk2.spec
+++ b/edk2.spec
@@ -117,29 +117,22 @@ Source92: DBXUpdate-%{DBXDATE}.aa64.bin
Patch0001: 0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch
Patch0002: 0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch
-Patch0003: 0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
-Patch0004: 0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
-Patch0005: 0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
-Patch0006: 0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
-Patch0007: 0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
-Patch0008: 0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
-Patch0009: 0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
-Patch0010: 0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
-Patch0011: 0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
-Patch0012: 0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
-Patch0013: 0013-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
+Patch0003: 0003-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+Patch0004: 0004-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+Patch0005: 0005-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+Patch0006: 0006-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+Patch0007: 0007-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+Patch0008: 0008-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
+Patch0009: 0009-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
+Patch0010: 0010-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
+Patch0011: 0011-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch
+Patch0012: 0012-OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch
+Patch0013: 0013-OvmfPkg-PlatformDxe-register-page-fault-handler-for-.patch
+Patch0014: 0014-OvmfPkg-PlatformDxe-add-check-for-1g-page-support.patch
+Patch0015: 0015-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch
+Patch0016: 0016-OvmfPkg-PlatformDxe-proper-addr-masking.patch
%if 0%{?fedora} >= 38 || 0%{?rhel} >= 10
-Patch0014: 0014-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch
-%endif
-Patch0015: 0015-OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch
-Patch0016: 0016-OvmfPkg-PlatformDxe-register-page-fault-handler-for-.patch
-Patch0017: 0017-OvmfPkg-PlatformDxe-add-check-for-1g-page-support.patch
-Patch0018: 0018-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch
-Patch0019: 0019-CryptoPkg-TlsLib-downgrade-security-level-from-3-to-.patch
-Patch0020: 0020-OvmfPkg-PlatformDxe-proper-addr-masking.patch
-Patch0021: 0021-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch
-Patch0022: 0022-OvmfPkg-IntelTdx-Move-BootManagerMenuApp-from-NCCFV-.patch
-Patch0023: 0023-OvmfPkg-PlatformInitLib-restore-below-4G-low-memory-.patch
+%endif
# needed by %prep
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-26 16:42 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-26 16:42 [rpms/edk2] f43: [rebase] update patches Gerd Hoffmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox