Blame SOURCES/0015-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch

0e3eb6
From e8e12cb7d3a47e5823cf2cb12c9bfe5901d3b100 Mon Sep 17 00:00:00 2001
7fdf80
From: Laszlo Ersek <lersek@redhat.com>
7fdf80
Date: Tue, 4 Nov 2014 23:02:53 +0100
7fdf80
Subject: OvmfPkg: allow exclusion of the shell from the firmware image (RH
7fdf80
 only)
7fdf80
b6c182
Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
b6c182
RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
b6c182
b6c182
- No manual / explicit code change is necessary, because the newly
b6c182
  inherited OvmfPkg/AmdSev platform already has its own BUILD_SHELL
b6c182
  build-time macro (feature test flag), with default value FALSE -- from
b6c182
  upstream commit b261a30c900a ("OvmfPkg/AmdSev: add Grub Firmware Volume
b6c182
  Package", 2020-12-14).
b6c182
b6c182
- Contextual differences from new upstream commits 2d8ca4f90eae ("OvmfPkg:
b6c182
  enable HttpDynamicCommand", 2020-10-01) and 5ab6a0e1c8e9 ("OvmfPkg:
b6c182
  introduce VirtioFsDxe", 2020-12-21) have been auto-resolved by
b6c182
  git-cherry-pick.
b6c182
b6c182
- Remove obsolete commit message tags related to downstream patch
b6c182
  management: Message-id, Patchwork-id, O-Subject, Acked-by
b6c182
  (RHBZ#1846481).
b6c182
1d2c45
Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
1d2c45
RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
1d2c45
1d2c45
- context difference from upstream commit ec41733cfd10 ("OvmfPkg: add the
1d2c45
  'initrd' dynamic shell command", 2020-03-04) correctly auto-resolved
1d2c45
1dc609
Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
1dc609
RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
1dc609
1dc609
- no change
1dc609
7fdf80
Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
7fdf80
RHEL-8.1/20190308-89910a39dcfd rebase:
7fdf80
7fdf80
- update the patch against the following upstream commits:
7fdf80
  - 4b888334d234 ("OvmfPkg: Remove EdkShellBinPkg in FDF", 2018-11-19)
7fdf80
  - 277a3958d93a ("OvmfPkg: Don't include TftpDynamicCommand in XCODE5
7fdf80
                  tool chain", 2018-11-27)
7fdf80
7fdf80
Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
7fdf80
RHEL-8.0/20180508-ee3198e672e2 rebase:
7fdf80
7fdf80
- reorder the rebase changelog in the commit message so that it reads like
7fdf80
  a blog: place more recent entries near the top
7fdf80
- no changes to the patch body
7fdf80
7fdf80
Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
7fdf80
7fdf80
- no change
7fdf80
7fdf80
Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
7fdf80
7fdf80
- no changes
7fdf80
7fdf80
Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
7fdf80
7fdf80
- no changes
7fdf80
7fdf80
Bugzilla: 1147592
7fdf80
7fdf80
When '-D EXCLUDE_SHELL_FROM_FD' is passed to 'build', exclude the shell
7fdf80
binary from the firmware image.
7fdf80
7fdf80
Peter Jones advised us that firmware vendors for physical systems disable
7fdf80
the memory-mapped, firmware image-contained UEFI shell in
7fdf80
SecureBoot-enabled builds. The reason being that the memory-mapped shell
7fdf80
can always load, it may have direct access to various hardware in the
7fdf80
system, and it can run UEFI shell scripts (which cannot be signed at all).
7fdf80
7fdf80
Intended use of the new build option:
7fdf80
7fdf80
- In-tree builds: don't pass '-D EXCLUDE_SHELL_FROM_FD'. The resultant
7fdf80
  firmware image will contain a shell binary, independently of SecureBoot
7fdf80
  enablement, which is flexible for interactive development. (Ie. no
7fdf80
  change for in-tree builds.)
7fdf80
7fdf80
- RPM builds: pass both '-D SECURE_BOOT_ENABLE' and
7fdf80
  '-D EXCLUDE_SHELL_FROM_FD'. The resultant RPM will provide:
7fdf80
7fdf80
  - OVMF_CODE.fd: SecureBoot-enabled firmware, without builtin UEFI shell,
7fdf80
7fdf80
  - OVMF_VARS.fd: variable store template matching OVMF_CODE.fd,
7fdf80
7fdf80
  - UefiShell.iso: a bootable ISO image with the shell on it as default
7fdf80
    boot loader. The shell binary will load when SecureBoot is turned off,
7fdf80
    and won't load when SecureBoot is turned on (because it is not
7fdf80
    signed).
7fdf80
7fdf80
    UefiShell.iso is the reason we're not excluding the shell from the DSC
7fdf80
    files as well, only the FDF files -- when '-D EXCLUDE_SHELL_FROM_FD'
7fdf80
    is specified, the shell binary needs to be built the same, only it
7fdf80
    will be included in UefiShell.iso.
7fdf80
7fdf80
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
7fdf80
(cherry picked from commit 9c391def70366cabae08e6008814299c3372fafd)
7fdf80
(cherry picked from commit d9dd9ee42937b2611fe37183cc9ec7f62d946933)
7fdf80
(cherry picked from commit 23df46ebbe7b09451d3a05034acd4d3a25e7177b)
7fdf80
(cherry picked from commit f0303f71d576c51b01c4ff961b429d0e0e707245)
7fdf80
(cherry picked from commit bbd64eb8658e9a33eab4227d9f4e51ad78d9f687)
1dc609
(cherry picked from commit 8628ef1b8d675ebec39d83834abbe3c8c8c42cf4)
1d2c45
(cherry picked from commit 229c88dc3ded9baeaca8b87767dc5c41c05afd6e)
b6c182
(cherry picked from commit c2812d7189dee06c780f05a5880eb421c359a687)
7fdf80
---
7fdf80
 OvmfPkg/OvmfPkgIa32.fdf    | 2 ++
7fdf80
 OvmfPkg/OvmfPkgIa32X64.fdf | 2 ++
7fdf80
 OvmfPkg/OvmfPkgX64.fdf     | 2 ++
7fdf80
 3 files changed, 6 insertions(+)
7fdf80
7fdf80
diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
0e3eb6
index 775ea2d710..00ea14adf0 100644
7fdf80
--- a/OvmfPkg/OvmfPkgIa32.fdf
7fdf80
+++ b/OvmfPkg/OvmfPkgIa32.fdf
0e3eb6
@@ -290,12 +290,14 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
7fdf80
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
b6c182
 INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
7fdf80
 
7fdf80
+!ifndef $(EXCLUDE_SHELL_FROM_FD)
7fdf80
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
7fdf80
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
b6c182
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
1d2c45
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
7fdf80
 !endif
7fdf80
 INF  ShellPkg/Application/Shell/Shell.inf
7fdf80
+!endif
7fdf80
 
0e3eb6
 INF MdeModulePkg/Logo/LogoDxe.inf
7fdf80
 
7fdf80
diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
0e3eb6
index 9d8695922f..e33a40c44e 100644
7fdf80
--- a/OvmfPkg/OvmfPkgIa32X64.fdf
7fdf80
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
b6c182
@@ -294,12 +294,14 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
7fdf80
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
b6c182
 INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
7fdf80
 
7fdf80
+!ifndef $(EXCLUDE_SHELL_FROM_FD)
7fdf80
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
7fdf80
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
b6c182
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
1d2c45
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
7fdf80
 !endif
7fdf80
 INF  ShellPkg/Application/Shell/Shell.inf
7fdf80
+!endif
7fdf80
 
0e3eb6
 INF MdeModulePkg/Logo/LogoDxe.inf
7fdf80
 
7fdf80
diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
0e3eb6
index b6cc3cabdd..85b4b23857 100644
7fdf80
--- a/OvmfPkg/OvmfPkgX64.fdf
7fdf80
+++ b/OvmfPkg/OvmfPkgX64.fdf
0e3eb6
@@ -310,12 +310,14 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
7fdf80
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
b6c182
 INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
7fdf80
 
7fdf80
+!ifndef $(EXCLUDE_SHELL_FROM_FD)
7fdf80
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
7fdf80
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
b6c182
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
1d2c45
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
7fdf80
 !endif
7fdf80
 INF  ShellPkg/Application/Shell/Shell.inf
7fdf80
+!endif
7fdf80
 
0e3eb6
 INF MdeModulePkg/Logo/LogoDxe.inf
7fdf80
 
7fdf80
-- 
b6c182
2.27.0
7fdf80