ExclusiveArch: x86_64 aarch64

%define GITDATE        20220126

%define GITCOMMIT      bb1bba3d77

%define TOOLCHAIN      GCC5

%define OPENSSL_VER    1.1.1k

%define qosb_testing 0

%ifarch x86_64

%define qosb_testing 1

%endif

%define qemu_package qemu-kvm-core >= 2.12.0-89

%define qemu_binary /usr/libexec/qemu-kvm

%define build_ovmf 0

%define build_aarch64 0

%ifarch x86_64

  %define build_ovmf 1

%endif

%ifarch aarch64

  %define build_aarch64 1

%endif

Name:       edk2

Version:    %{GITDATE}git%{GITCOMMIT}

Release:    3%{?dist}

Summary:    UEFI firmware for 64-bit virtual machines

License:    BSD-2-Clause-Patent and OpenSSL and MIT

URL:        http://www.tianocore.org

# The source tarball is created using following commands:

# COMMIT=bb1bba3d77

# git archive --format=tar --prefix=edk2-$COMMIT/ $COMMIT \

# | xz -9ev >/tmp/edk2-$COMMIT.tar.xz

Source0: http://batcave.lab.eng.brq.redhat.com/www/edk2-%{GITCOMMIT}.tar.xz

Source1: ovmf-whitepaper-c770f8c.txt

Source2: openssl-rhel-a75722161d20fd632f8875585d3aa066ec5fea93.tar.xz

Source3: ovmf-vars-generator

Source4: LICENSE.qosb

Source5: RedHatSecureBootPkKek1.pem

Source10: edk2-aarch64-verbose.json

Source11: edk2-aarch64.json

Source12: edk2-ovmf-sb.json

Source13: edk2-ovmf.json

Source14: edk2-ovmf-cc.json

Source15: edk2-ovmf-amdsev.json

Patch0008: 0008-BaseTools-do-not-build-BrotliCompress-RH-only.patch

Patch0009: 0009-MdeModulePkg-remove-package-private-Brotli-include-p.patch

Patch0010: 0010-OvmfPkg-increase-max-debug-message-length-to-512-RHE.patch

Patch0011: 0011-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch

Patch0012: 0012-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch

Patch0013: 0013-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch

Patch0014: 0014-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch

Patch0015: 0015-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch

Patch0016: 0016-ArmPlatformPkg-introduce-fixed-PCD-for-early-hello-m.patch

Patch0017: 0017-ArmPlatformPkg-PrePeiCore-write-early-hello-message-.patch

Patch0018: 0018-ArmVirtPkg-set-early-hello-message-RH-only.patch

Patch0019: 0019-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch

Patch0020: 0020-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch

Patch0021: 0021-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch

Patch0022: 0022-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch

Patch0023: 0023-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch

Patch0024: 0024-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch

Patch0025: 0025-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch

Patch0026: 0026-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch

Patch0029: 0029-OvmfPkg-Remove-PrintDxe-RHEL-only.patch

Patch0030: 0030-OvmfPkg-Remove-EbcDxe-RHEL-only.patch

Patch0031: 0031-ArmVirtPkg-Remove-EbcDxe-RHEL-only.patch

Patch0032: 0032-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch

Patch0033: 0033-OvmfPkg-Remove-QemuRamfbDxe-display-device-driver-RH.patch

Patch0034: 0034-ArmVirtPkg-Remove-QemuRamfbDxe-display-device-driver.patch

Patch0035: 0035-OvmfPkg-Remove-NvmExpressDxe-device-driver-RHEL-only.patch

Patch0036: 0036-ArmVirtPkg-Remove-NvmExpressDxe-device-driver-RHEL-o.patch

Patch0037: 0037-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch

Patch0038: 0038-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch

Patch0039: 0039-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch

Patch0040: 0040-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch

Patch0041: 0041-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch

Patch0042: 0042-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch

Patch0043: 0043-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch

Patch0044: 0044-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch

Patch0045: 0045-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch

Patch0046: 0046-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch

# For bz#1935497 - edk2  implements and/or uses the deprecated MD5 and SHA-1 algorithms by default

Patch47: edk2-OvmfPkg-remove-unused-TPM-options-from-MicrovmX64.ds.patch

# For bz#1935497 - edk2  implements and/or uses the deprecated MD5 and SHA-1 algorithms by default

Patch48: edk2-OvmfPkg-move-tcg-configuration-to-dsc-and-fdf-includ.patch

# For bz#1935497 - edk2  implements and/or uses the deprecated MD5 and SHA-1 algorithms by default

Patch49: edk2-OvmfPkg-drop-TPM_CONFIG_ENABLE.patch

# For bz#1935497 - edk2  implements and/or uses the deprecated MD5 and SHA-1 algorithms by default

Patch50: edk2-OvmfPkg-create-Tcg12ConfigPei.inf.patch

# For bz#1935497 - edk2  implements and/or uses the deprecated MD5 and SHA-1 algorithms by default

Patch51: edk2-OvmfPkg-rework-TPM-configuration.patch

# For bz#2041755 - Mark SEV launch secret area as reserved

Patch52: edk2-OvmfPkg-AmdSev-SecretPei-Mark-SEV-launch-secret-area.patch

# python3-devel and libuuid-devel are required for building tools.

# python3-devel is also needed for varstore template generation and

# verification with "ovmf-vars-generator".

BuildRequires:  python3-devel

BuildRequires:  libuuid-devel

BuildRequires:  /usr/bin/iasl

BuildRequires:  binutils gcc git gcc-c++ make

%if %{build_ovmf}

# Only OVMF includes 80x86 assembly files (*.nasm*).

BuildRequires:  nasm

# Only OVMF includes the Secure Boot feature, for which we need to separate out

# the UEFI shell.

BuildRequires:  dosfstools

BuildRequires:  mtools

BuildRequires:  xorriso

# For generating the variable store template with the default certificates

# enrolled, we need the qemu-kvm executable.

BuildRequires:  %{qemu_package}

%if %{qosb_testing}

# For verifying SB enablement in the above variable store template, we need a

# guest kernel that prints "Secure boot enabled".

BuildRequires: kernel-core >= 4.18.0-161

BuildRequires: rpmdevtools

%endif

# endif build_ovmf

%endif

%package ovmf

Summary:    UEFI firmware for x86_64 virtual machines

BuildArch:  noarch

Provides:   OVMF = %{version}-%{release}

Obsoletes:  OVMF < 20180508-100.gitee3198e672e2.el7

# OVMF includes the Secure Boot and IPv6 features; it has a builtin OpenSSL

# library.

Provides:   bundled(openssl) = %{OPENSSL_VER}

License:    BSD-2-Clause-Patent and OpenSSL

# URL taken from the Maintainers.txt file.

URL:        http://www.tianocore.org/ovmf/

%description ovmf

OVMF (Open Virtual Machine Firmware) is a project to enable UEFI support for

Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU

and KVM.

%package aarch64

Summary:    UEFI firmware for aarch64 virtual machines

BuildArch:  noarch

Provides:   AAVMF = %{version}-%{release}

Obsoletes:  AAVMF < 20180508-100.gitee3198e672e2.el7

# No Secure Boot for AAVMF yet, but we include OpenSSL for the IPv6 stack.

Provides:   bundled(openssl) = %{OPENSSL_VER}

License:    BSD-2-Clause-Patent and OpenSSL

# URL taken from the Maintainers.txt file.

URL:        https://github.com/tianocore/tianocore.github.io/wiki/ArmVirtPkg

%description aarch64

AAVMF (ARM Architecture Virtual Machine Firmware) is an EFI Development Kit II

platform that enables UEFI support for QEMU/KVM ARM Virtual Machines. This

package contains a 64-bit build.

%package tools

Summary:        EFI Development Kit II Tools

License:        BSD-2-Clause-Patent

URL:            https://github.com/tianocore/tianocore.github.io/wiki/BaseTools

%description tools

This package provides tools that are needed to

build EFI executables and ROMs using the GNU tools.

%package tools-doc

Summary:        Documentation for EFI Development Kit II Tools

BuildArch:      noarch

License:        BSD-2-Clause-Patent

URL:            https://github.com/tianocore/tianocore.github.io/wiki/BaseTools

%description tools-doc

This package documents the tools that are needed to

build EFI executables and ROMs using the GNU tools.

%description

EDK II is a modern, feature-rich, cross-platform firmware development

environment for the UEFI and PI specifications. This package contains sample

64-bit UEFI firmware builds for QEMU and KVM.

%prep

# We needs some special git config options that %%autosetup won't give us.

# We init the git dir ourselves, then tell %%autosetup not to blow it away.

%setup -q -n edk2-%{GITCOMMIT}

git init -q

git config core.whitespace cr-at-eol

git config am.keepcr true

# -T is passed to %%setup to not re-extract the archive

# -D is passed to %%setup to not delete the existing archive dir

%autosetup -T -D -n edk2-%{GITCOMMIT} -S git_am

cp -a -- %{SOURCE1} %{SOURCE3} .

cp -a -- %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} .

tar -C CryptoPkg/Library/OpensslLib -a -f %{SOURCE2} -x

# Format the Red Hat-issued certificate that is to be enrolled as both Platform

# Key and first Key Exchange Key, as an SMBIOS OEM String. This means stripping

# the PEM header and footer, and prepending the textual representation of the

# GUID that identifies this particular OEM String to "EnrollDefaultKeys.efi",

# plus the separator ":". For details, see

# <https://bugzilla.tianocore.org/show_bug.cgi?id=1747> comments 2, 7, 14.

sed \

  -e 's/^-----BEGIN CERTIFICATE-----$/4e32566d-8e9e-4f52-81d3-5bb9715f9727:/' \

  -e '/^-----END CERTIFICATE-----$/d' \

  %{SOURCE5} \

  > PkKek1.oemstr

# Done by %setup, but we do not use it for the auxiliary tarballs

chmod -Rf a+rX,u+w,g-w,o-w .

%build

export PYTHON_COMMAND=%{__python3}

source ./edksetup.sh

%make_build -C "$EDK_TOOLS_PATH" \

  EXTRA_OPTFLAGS="%{optflags}" \

  EXTRA_LDFLAGS="%{__global_ldflags}"

SMP_MFLAGS="%{?_smp_mflags}"

if [[ x"$SMP_MFLAGS" = x-j* ]]; then

        CC_FLAGS="$CC_FLAGS -n ${SMP_MFLAGS#-j}"

elif [ -n "%{?jobs}" ]; then

        CC_FLAGS="$CC_FLAGS -n %{?jobs}"

fi

CC_FLAGS="$CC_FLAGS --cmd-len=65536 -t %{TOOLCHAIN} -b DEBUG --hash"

CC_FLAGS="$CC_FLAGS -D NETWORK_IP6_ENABLE"

CC_FLAGS="$CC_FLAGS -D NETWORK_HTTP_BOOT_ENABLE -D NETWORK_TLS_ENABLE"

CC_FLAGS="$CC_FLAGS -D TPM2_ENABLE=TRUE"

CC_FLAGS="$CC_FLAGS -D TPM1_ENABLE=FALSE"

OVMF_FLAGS="${CC_FLAGS}"

OVMF_FLAGS="${OVMF_FLAGS} -D FD_SIZE_4MB"

OVMF_FLAGS="${OVMF_FLAGS} -D PVSCSI_ENABLE=FALSE -D MPT_SCSI_ENABLE=FALSE"

OVMF_SB_FLAGS="${OVMF_FLAGS}"

OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D SECURE_BOOT_ENABLE"

OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D SMM_REQUIRE"

OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D EXCLUDE_SHELL_FROM_FD"

build_iso() {

  dir="$1"

  UEFI_SHELL_BINARY=${dir}/Shell.efi

  ENROLLER_BINARY=${dir}/EnrollDefaultKeys.efi

  UEFI_SHELL_IMAGE=uefi_shell.img

  ISO_IMAGE=${dir}/UefiShell.iso

  UEFI_SHELL_BINARY_BNAME=$(basename -- "$UEFI_SHELL_BINARY")

  UEFI_SHELL_SIZE=$(stat --format=%s -- "$UEFI_SHELL_BINARY")

  ENROLLER_SIZE=$(stat --format=%s -- "$ENROLLER_BINARY")

  # add 1MB then 10% for metadata

  UEFI_SHELL_IMAGE_KB=$((

    (UEFI_SHELL_SIZE + ENROLLER_SIZE + 1 * 1024 * 1024) * 11 / 10 / 1024

  ))

  # create non-partitioned FAT image

  rm -f -- "$UEFI_SHELL_IMAGE"

  mkdosfs -C "$UEFI_SHELL_IMAGE" -n UEFI_SHELL -- "$UEFI_SHELL_IMAGE_KB"

  # copy the shell binary into the FAT image

  export MTOOLS_SKIP_CHECK=1

  mmd   -i "$UEFI_SHELL_IMAGE"                       ::efi

  mmd   -i "$UEFI_SHELL_IMAGE"                       ::efi/boot

  mcopy -i "$UEFI_SHELL_IMAGE"  "$UEFI_SHELL_BINARY" ::efi/boot/bootx64.efi

  mcopy -i "$UEFI_SHELL_IMAGE"  "$ENROLLER_BINARY"   ::

  mdir  -i "$UEFI_SHELL_IMAGE"  -/                   ::

  # build ISO with FAT image file as El Torito EFI boot image

  mkisofs -input-charset ASCII -J -rational-rock \

    -e "$UEFI_SHELL_IMAGE" -no-emul-boot \

    -o "$ISO_IMAGE" "$UEFI_SHELL_IMAGE"

}

%if %{build_ovmf}

# Build with neither SB nor SMM; include UEFI shell.

build ${OVMF_FLAGS} -a X64 \

  -p OvmfPkg/OvmfPkgX64.dsc

# Build with SB and SMM; exclude UEFI shell.

build ${OVMF_SB_FLAGS} -a IA32 -a X64 \

  -p OvmfPkg/OvmfPkgIa32X64.dsc

# Build AmdSev

touch OvmfPkg/AmdSev/Grub/grub.efi   # dummy

build ${OVMF_FLAGS} -a X64 \

  -p OvmfPkg/AmdSev/AmdSevX64.dsc

# Sanity check: the varstore templates must be identical.

cmp Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \

  Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd

# Prepare an ISO image that boots the UEFI shell.

build_iso Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64

# Enroll the default certificates in a separate variable store template.

%{__python3} ovmf-vars-generator --verbose --verbose \

  --qemu-binary        %{qemu_binary} \

  --ovmf-binary        Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \

  --ovmf-template-vars Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \

  --uefi-shell-iso     Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/UefiShell.iso \

  --oem-string         "$(< PkKek1.oemstr)" \

  --skip-testing \

  Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd

# endif build_ovmf

%endif

%if %{build_aarch64}

# Build with a verbose debug mask first, and stash the binary.

build ${CC_FLAGS} -a AARCH64 \

  -p ArmVirtPkg/ArmVirtQemu.dsc \

  -D DEBUG_PRINT_ERROR_LEVEL=0x8040004F

cp -a Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \

  Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd

# Rebuild with a silent (errors only) debug mask.

build ${CC_FLAGS} -a AARCH64 \

  -p ArmVirtPkg/ArmVirtQemu.dsc \

  -D DEBUG_PRINT_ERROR_LEVEL=0x80000000

# endif build_aarch64

%endif

%install

cp -a OvmfPkg/License.txt License.OvmfPkg.txt

cp -a CryptoPkg/Library/OpensslLib/openssl/LICENSE LICENSE.openssl

mkdir -p %{buildroot}%{_datadir}/qemu/firmware

# install the tools

mkdir -p %{buildroot}%{_bindir} \

         %{buildroot}%{_datadir}/%{name}/Conf \

         %{buildroot}%{_datadir}/%{name}/Scripts

install BaseTools/Source/C/bin/* \

        %{buildroot}%{_bindir}

install BaseTools/BinWrappers/PosixLike/LzmaF86Compress \

        %{buildroot}%{_bindir}

install BaseTools/BuildEnv \

        %{buildroot}%{_datadir}/%{name}

install BaseTools/Conf/*.template \

        %{buildroot}%{_datadir}/%{name}/Conf

install BaseTools/Scripts/GccBase.lds \

        %{buildroot}%{_datadir}/%{name}/Scripts

%if %{build_ovmf}

mkdir -p \

  %{buildroot}%{_datadir}/OVMF \

  %{buildroot}%{_datadir}/%{name}/ovmf

install -m 0644 Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \

  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd

install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \

  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.secboot.fd

install -m 0644 Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \

  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_VARS.fd

install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \

  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_VARS.secboot.fd

install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/UefiShell.iso \

  %{buildroot}%{_datadir}/%{name}/ovmf/UefiShell.iso

install -m 0644 Build/AmdSev/DEBUG_%{TOOLCHAIN}/FV/OVMF.fd \

  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF.amdsev.fd

ln -s ../%{name}/ovmf/OVMF_CODE.secboot.fd %{buildroot}%{_datadir}/OVMF/

ln -s ../%{name}/ovmf/OVMF_VARS.fd         %{buildroot}%{_datadir}/OVMF/

ln -s ../%{name}/ovmf/OVMF_VARS.secboot.fd %{buildroot}%{_datadir}/OVMF/

ln -s ../%{name}/ovmf/UefiShell.iso        %{buildroot}%{_datadir}/OVMF/

install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/Shell.efi \

  %{buildroot}%{_datadir}/%{name}/ovmf/Shell.efi

install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/EnrollDefaultKeys.efi \

  %{buildroot}%{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi

install -m 0644 edk2-ovmf-sb.json \

  %{buildroot}%{_datadir}/qemu/firmware/40-edk2-ovmf-sb.json

install -m 0644 edk2-ovmf.json \

  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf.json

install -m 0644 edk2-ovmf-cc.json \

  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf-cc.json

install -m 0644 edk2-ovmf-amdsev.json \

  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf-amdsev.json

# endif build_ovmf

%endif

%if %{build_aarch64}

mkdir -p \

  %{buildroot}%{_datadir}/AAVMF \

  %{buildroot}%{_datadir}/%{name}/aarch64

# Pad and install the verbose binary.

cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd \

  /dev/zero \

| head -c 64m \

  > %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.raw

# Pad and install the silent (default) binary.

cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \

  /dev/zero \

| head -c 64m \

  > %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.raw

# Create varstore template.

cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_VARS.fd \

  /dev/zero \

| head -c 64m \

  > %{buildroot}%{_datadir}/%{name}/aarch64/vars-template-pflash.raw

ln -s ../%{name}/aarch64/QEMU_EFI-pflash.raw \

  %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd

ln -s ../%{name}/aarch64/QEMU_EFI-silent-pflash.raw \

  %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.fd

ln -s ../%{name}/aarch64/vars-template-pflash.raw \

  %{buildroot}%{_datadir}/AAVMF/AAVMF_VARS.fd

chmod 0644 -- %{buildroot}%{_datadir}/AAVMF/AAVMF_*.fd

install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd \

  %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI.fd

install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \

  %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd

install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_VARS.fd \

  %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_VARS.fd

install -m 0644 edk2-aarch64.json \

  %{buildroot}%{_datadir}/qemu/firmware/60-edk2-aarch64.json

install -m 0644 edk2-aarch64-verbose.json \

  %{buildroot}%{_datadir}/qemu/firmware/70-edk2-aarch64-verbose.json

# endif build_aarch64

%endif

%check

%if %{qosb_testing}

# Of the installed host kernels, boot the one with the highest Version-Release

# under OVMF, and check if it prints "Secure boot enabled".

KERNEL_PKG=$(rpm -q kernel-core | rpmdev-sort | tail -n 1)

KERNEL_IMG=$(rpm -q -l $KERNEL_PKG | egrep '^/lib/modules/[^/]+/vmlinuz$')

%{__python3} ovmf-vars-generator --verbose --verbose \

  --qemu-binary        %{qemu_binary} \

  --ovmf-binary        Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \

  --ovmf-template-vars Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \

  --uefi-shell-iso     Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/UefiShell.iso \

  --kernel-path        $KERNEL_IMG \

  --skip-enrollment \

  --no-download \

  Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd

# endif qosb_testing

%endif

%global common_files \

  %%license License.txt License.OvmfPkg.txt License-History.txt LICENSE.openssl \

  %%dir %%{_datadir}/%%{name}/ \

  %%dir %%{_datadir}/qemu \

  %%dir %%{_datadir}/qemu/firmware

%if %{build_ovmf}

%files ovmf

%common_files

%doc OvmfPkg/README

%doc ovmf-whitepaper-c770f8c.txt

%dir %{_datadir}/OVMF/

%dir %{_datadir}/%{name}/ovmf/

%{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd

%{_datadir}/%{name}/ovmf/OVMF_CODE.secboot.fd

%{_datadir}/%{name}/ovmf/OVMF_VARS.fd

%{_datadir}/%{name}/ovmf/OVMF_VARS.secboot.fd

%{_datadir}/%{name}/ovmf/OVMF.amdsev.fd

%{_datadir}/%{name}/ovmf/UefiShell.iso

%{_datadir}/OVMF/OVMF_CODE.secboot.fd

%{_datadir}/OVMF/OVMF_VARS.fd

%{_datadir}/OVMF/OVMF_VARS.secboot.fd

%{_datadir}/OVMF/UefiShell.iso

%{_datadir}/%{name}/ovmf/Shell.efi

%{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi

%{_datadir}/qemu/firmware/40-edk2-ovmf-sb.json

%{_datadir}/qemu/firmware/50-edk2-ovmf-cc.json

%{_datadir}/qemu/firmware/50-edk2-ovmf-amdsev.json

%{_datadir}/qemu/firmware/50-edk2-ovmf.json

# endif build_ovmf

%endif

%if %{build_aarch64}

%files aarch64

%common_files

%dir %{_datadir}/AAVMF/

%dir %{_datadir}/%{name}/aarch64/

%{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.raw

%{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.raw

%{_datadir}/%{name}/aarch64/vars-template-pflash.raw

%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd

%{_datadir}/AAVMF/AAVMF_CODE.fd

%{_datadir}/AAVMF/AAVMF_VARS.fd

%{_datadir}/%{name}/aarch64/QEMU_EFI.fd

%{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd

%{_datadir}/%{name}/aarch64/QEMU_VARS.fd

%{_datadir}/qemu/firmware/60-edk2-aarch64.json

%{_datadir}/qemu/firmware/70-edk2-aarch64-verbose.json

# endif build_aarch64

%endif

%files tools

%license License.txt

%license License-History.txt

%{_bindir}/DevicePath

%{_bindir}/EfiRom

%{_bindir}/GenCrc32

%{_bindir}/GenFfs

%{_bindir}/GenFv

%{_bindir}/GenFw

%{_bindir}/GenSec

%{_bindir}/LzmaCompress

%{_bindir}/LzmaF86Compress

%{_bindir}/TianoCompress

%{_bindir}/VfrCompile

%{_bindir}/VolInfo

%dir %{_datadir}/%{name}

%{_datadir}/%{name}/BuildEnv

%{_datadir}/%{name}/Conf

%{_datadir}/%{name}/Scripts

%files tools-doc

%doc BaseTools/UserManuals/*.rtf

%changelog

* Wed Feb 23 2022 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-3

- edk2-spec-build-amdsev-variant.patch [bz#2054661]

- edk2-OvmfPkg-AmdSev-SecretPei-Mark-SEV-launch-secret-area.patch [bz#2041755]

- Resolves: bz#2054661

  (RFE:  Support measured AMD SEV boot with kernel/initrd/cmdline in OVMF)

- Resolves: bz#2041755

  (Mark SEV launch secret area as reserved)

* Tue Feb 08 2022 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-2

- edk2-OvmfPkg-remove-unused-TPM-options-from-MicrovmX64.ds.patch [bz#1935497]

- edk2-OvmfPkg-move-tcg-configuration-to-dsc-and-fdf-includ.patch [bz#1935497]

- edk2-OvmfPkg-drop-TPM_CONFIG_ENABLE.patch [bz#1935497]

- edk2-OvmfPkg-create-Tcg12ConfigPei.inf.patch [bz#1935497]

- edk2-OvmfPkg-rework-TPM-configuration.patch [bz#1935497]

- edk2-spec-adapt-specfile-to-build-option-changes-disable-.patch [bz#1935497]

- Resolves: bz#1935497

  (edk2  implements and/or uses the deprecated MD5 and SHA-1 algorithms by default)

* Tue Feb 01 2022 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-1

- Rebase to latest upstream release [bz#2018388]

- Resolves: bz#2018388

  ([rebase] update edk2 to nov '21 release (edk2-stable202111xx))

* Fri Jan 14 2022 Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-8

- edk2-Revert-advertise-OpenSSL-on-TianoCore-splash-screen-.patch [bz#2027286]

- Resolves: bz#2027286

  (Remove the customized boot splash logo patch)

* Mon Nov 01 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-7

- edk2-fix-tpm-build-options.patch [bz#2000396]

- Resolves: bz#2000396

  ([aarch64][RHEL9] The lack of TPMFinalLog in efi causes the tpm self-test in the guest to fail)

* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 20210527gite1999b264f1f-6

- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags

  Related: rhbz#1991688

* Fri Aug 06 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-5

- edk2-MdeModulePkg-PartitionDxe-Ignore-PMBR-BootIndicator-.patch [bz#1988760]

- Resolves: bz#1988760

  (edk2 does not ignore PMBR protective record BootIndicator as required by UEFI spec)

* Fri Jul 30 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-4

- edk2-spec-remove-Group-and-defattr.patch [bz#1983789]

- edk2-spec-Add-BuildRequires-make.patch [bz#1983789]

- edk2-spec-don-t-conditionalize-package-definitions.patch [bz#1983789]

- edk2-spec-Use-autosetup-with-our-required-git-config-opti.patch [bz#1983789]

- edk2-spec-Replace-ifarch-else-conditionals-with-build_XXX.patch [bz#1983789]

- edk2-spec-Move-D-TPM_ENABLE-to-common-CC_FLAGS.patch [bz#1983789]

- edk2-spec-Add-qemu_package-and-qemu_binary.patch [bz#1983789]

- edk2-spec-Remove-extra-true-at-end-of-check.patch [bz#1983789]

- edk2-spec-Move-check-to-between-install-and-files.patch [bz#1983789]

- edk2-spec-Add-qosb_testing-macro.patch [bz#1983789]

- edk2-spec-Split-out-build_iso-function.patch [bz#1983789]

- edk2-spec-Replace-RPM_BUILD_ROOT-with-buildroot.patch [bz#1983789]

- edk2-spec-Use-make_build-macro.patch [bz#1983789]

- edk2-spec-Factor-out-OVMF_FLAGS-and-OVMF_SB_FLAGS.patch [bz#1983789]

- edk2-spec-Don-t-put-build-output-in-the-top-directory.patch [bz#1983789]

- edk2-spec-Centralize-non-firmware-install-files-at-the-to.patch [bz#1983789]

- Resolves: bz#1983789

  (Make spec easier to share with Fedora)

* Mon Jul 12 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-3

- edk2-OvmfPkg-Remove-PrintDxe-RHEL-only.patch [bz#1967747]

- edk2-OvmfPkg-Remove-EbcDxe-RHEL-only.patch [bz#1967747]

- edk2-ArmVirtPkg-Remove-EbcDxe-RHEL-only.patch [bz#1967747]

- edk2-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch [bz#1967747]

- edk2-OvmfPkg-Remove-QemuRamfbDxe-display-device-driver-RH.patch [bz#1967747]

- edk2-ArmVirtPkg-Remove-QemuRamfbDxe-display-device-driver.patch [bz#1967747]

- edk2-OvmfPkg-Remove-NvmExpressDxe-device-driver-RHEL-only.patch [bz#1967747]

- edk2-ArmVirtPkg-Remove-NvmExpressDxe-device-driver-RHEL-o.patch [bz#1967747]

- edk2-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch [bz#1967747]

- edk2-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch [bz#1967747]

- edk2-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch [bz#1967747]

- edk2-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch [bz#1967747]

- edk2-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch [bz#1967747]

- edk2-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch [bz#1967747]

- edk2-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch [bz#1967747]

- edk2-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch [bz#1967747]

- edk2-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch [bz#1967747]

- edk2-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch [bz#1967747]

- edk2-OvmfPkg-Remove-Xen-Drivers-RHEL-only.patch [bz#1967747]

- Resolves: bz#1967747

  (edk2: review features and drivers shipped in RHEL)

* Fri Jul 02 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-2

- edk2-NetworkPkg-IScsiDxe-wrap-IScsiCHAP-source-files-to-8.patch [bz#1961100]

- edk2-NetworkPkg-IScsiDxe-simplify-ISCSI_CHAP_AUTH_DATA.In.patch [bz#1961100]

- edk2-NetworkPkg-IScsiDxe-clean-up-ISCSI_CHAP_AUTH_DATA.Ou.patch [bz#1961100]

- edk2-NetworkPkg-IScsiDxe-clean-up-library-class-dependenc.patch [bz#1961100]

- edk2-NetworkPkg-IScsiDxe-fix-potential-integer-overflow-i.patch [bz#1961100]

- edk2-NetworkPkg-IScsiDxe-assert-that-IScsiBinToHex-always.patch [bz#1961100]

- edk2-NetworkPkg-IScsiDxe-reformat-IScsiHexToBin-leading-c.patch [bz#1961100]

- edk2-NetworkPkg-IScsiDxe-fix-IScsiHexToBin-hex-parsing.patch [bz#1961100]

- edk2-NetworkPkg-IScsiDxe-fix-IScsiHexToBin-buffer-overflo.patch [bz#1961100]

- edk2-NetworkPkg-IScsiDxe-check-IScsiHexToBin-return-value.patch [bz#1961100]

- edk2-redhat-build-UefiShell.iso-with-xorriso-rather-than-.patch [bz#1971840]

- Resolves: bz#1961100

  (edk2: remote buffer overflow in IScsiHexToBin function in NetworkPkg/IScsiDxe [rhel-9.0])

- Resolves: bz#1971840

  (Please replace genisoimage with xorriso)

* Wed Jun 23 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-1

- Rebase to edk2-stable202105 [bz#1938254]

- Sync edk2-MdeModulePkg-LzmaCustomDecompressLib-catch-4GB-uncom.patch from RHEL-8

- Sync edk2-redhat-add-OVMF-binary-that-will-support-SEV-ES.patch from RHEL-8

- Resolves: bz#1938254

  ((edk2-rebase-rhel-9.0) - rebase edk2 to edk2-stable202105 for RHEL-9-Beta)

* Fri Jan 08 2021 Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-1.el9

- Include fixes to build in RHEL 9 environment (bz#1906468)

- Resolves: bz#1906468

  ([RHEL9][FTBFS] edk2 FTBFS on Red Hat Enterprise Linux 9.0.0 Alpha)

* Mon Nov 23 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-4.el8

- edk2-OvmfPkg-SmmControl2Dxe-negotiate-ICH9_LPC_SMI_F_CPU_.patch [bz#1849177]

- edk2-OvmfPkg-CpuHotplugSmm-fix-CPU-hotplug-race-just-befo.patch [bz#1849177]

- edk2-OvmfPkg-CpuHotplugSmm-fix-CPU-hotplug-race-just-afte.patch [bz#1849177]

- edk2-CryptoPkg-OpensslLib-Upgrade-OpenSSL-to-1.1.1g.patch [bz#1893806]

- edk2-redhat-bump-OpenSSL-dist-git-submodule-to-1.1.1g-RHE.patch [bz#1893806]

- Resolves: bz#1849177

  (OVMF: negotiate "SMI on VCPU hotplug" with QEMU)

- Resolves: bz#1893806

  (attempt advancing RHEL8 edk2's OpenSSL submodule to RHEL8 OpenSSL 1.1.1g (or later))

* Mon Aug 10 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-3.el8

- edk2-UefiCpuPkg-PiSmmCpuDxeSmm-pause-in-WaitForSemaphore-.patch [bz#1861718]

- Resolves: bz#1861718

  (Very slow boot when overcommitting CPU)

* Wed Jun 24 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-2.el8

- edk2-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch [bz#1844682]

- edk2-OvmfPkg-GenericQemuLoadImageLib-log-Not-Found-at-INF.patch [bz#1844682]

- edk2-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch [bz#1844682]

- Resolves: bz#1844682

  (silent build of edk2-aarch64 logs DEBUG_ERROR messages that don't actually report serious errors)

* Sat Jun 13 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-1.el8

- Rebase to edk2-stable202005 [bz#1817035]

- Resolves: bz#1817035

  ((edk2-rebase-rhel-8.3) - rebase edk2 to upstream tag edk2-stable202005 for RHEL-8.3)

* Fri Mar 27 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-9.el8

- edk2-OvmfPkg-QemuVideoDxe-unbreak-secondary-vga-and-bochs.patch [bz#1806359]

- Resolves: bz#1806359

  (bochs-display cannot show graphic wihout driver attach)

* Tue Feb 18 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-8.el8

- edk2-MdeModulePkg-Enable-Disable-S3BootScript-dynamically.patch [bz#1801274]

- edk2-MdeModulePkg-PiDxeS3BootScriptLib-Fix-potential-nume.patch [bz#1801274]

- Resolves: bz#1801274

  (CVE-2019-14563 edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib [rhel-8])

* Tue Feb 11 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-7.el8

- edk2-SecurityPkg-Fix-spelling-errors-PARTIAL-PICK.patch [bz#1751993]

- edk2-SecurityPkg-DxeImageVerificationHandler-simplify-Ver.patch [bz#1751993]

- edk2-SecurityPkg-DxeImageVerificationHandler-remove-else-.patch [bz#1751993]

- edk2-SecurityPkg-DxeImageVerificationHandler-keep-PE-COFF.patch [bz#1751993]

- edk2-SecurityPkg-DxeImageVerificationHandler-narrow-down-.patch [bz#1751993]

- edk2-SecurityPkg-DxeImageVerificationHandler-fix-retval-o.patch [bz#1751993]

- edk2-SecurityPkg-DxeImageVerificationHandler-remove-super.patch [bz#1751993]

- edk2-SecurityPkg-DxeImageVerificationHandler-unnest-AddIm.patch [bz#1751993]

- edk2-SecurityPkg-DxeImageVerificationHandler-eliminate-St.patch [bz#1751993]

- edk2-SecurityPkg-DxeImageVerificationHandler-fix-retval-f.patch [bz#1751993]

- edk2-SecurityPkg-DxeImageVerificationHandler-fix-imgexec-.patch [bz#1751993]

- edk2-SecurityPkg-DxeImageVerificationHandler-fix-defer-vs.patch [bz#1751993]

- Resolves: bz#1751993

  (DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8])

* Tue Jan 21 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-6.el8

- edk2-UefiCpuPkg-PiSmmCpuDxeSmm-fix-2M-4K-page-splitting-r.patch [bz#1789335]

- Resolves: bz#1789335