From 6009e6b68ea4f8f3c162e1a7bcf4eda1531342a5 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Apr 23 2020 22:08:00 +0000
Subject: import edk2-20190829git37eef91017ad-9.el8


---

diff --git a/.edk2.metadata b/.edk2.metadata
new file mode 100644
index 0000000..c3a24af
--- /dev/null
+++ b/.edk2.metadata
@@ -0,0 +1,3 @@
+fdcb04021414cdd5a7e286058ca36aca359d323d SOURCES/RedHatSecureBootPkKek1.pem
+c7ca6a13a5f9e7fe8071010c26a11ba41548308b SOURCES/edk2-37eef91017ad.tar.xz
+cb385fc348395c187db3737e532de787ca2a17c9 SOURCES/openssl-rhel-d6c0e6e28ddc793474a3f9234eed50018f6c94ba.tar.xz
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..ccf9027
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+SOURCES/RedHatSecureBootPkKek1.pem
+SOURCES/edk2-37eef91017ad.tar.xz
+SOURCES/openssl-rhel-d6c0e6e28ddc793474a3f9234eed50018f6c94ba.tar.xz
diff --git a/SOURCES/0001-CryptoPkg-OpensslLib-Update-process_files.pl-to-gene.patch b/SOURCES/0001-CryptoPkg-OpensslLib-Update-process_files.pl-to-gene.patch
new file mode 100644
index 0000000..f7ece09
--- /dev/null
+++ b/SOURCES/0001-CryptoPkg-OpensslLib-Update-process_files.pl-to-gene.patch
@@ -0,0 +1,668 @@
+From ac1a0b44df858e53be9e8af499e80a459f0cef16 Mon Sep 17 00:00:00 2001
+From: Shenglei Zhang <shenglei.zhang@intel.com>
+Date: Tue, 29 Oct 2019 15:43:11 +0000
+Subject: CryptoPkg/OpensslLib: Update process_files.pl to generate .h files
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- New patch (cherry-picked from upstream, to be dropped at the next
+  downstream rebase).
+
+- Upstream moved to OpenSSL_1.1.1b (for TianoCore#1089) in release
+  edk2-stable201905. As part of that OpenSSL update, "OpensslLib.inf" and
+  "OpensslLibCrypto.inf" failed to list some new header files.
+
+- As a part of edk2-stable201908, commit 8906f076de35
+  ("CryptoPkg/OpensslLib: Add missing header files in INF file",
+  2019-08-16) fixed up "OpensslLib.inf" and "OpensslLibCrypto.inf" with
+  the missing header files, but did so manually.
+
+- The present patch (which is going to be released in edk2-stable201911)
+  updates "process_files.pl" to list the subject header files
+  automatically.
+
+- This patch is being backported primarily in order to keep further
+  backports for the modified files conflict-free. It might also come in
+  handy once we adopt RHEL8's own OpenSSL version (in case we have to
+  re-run "process_files.pl" ourselves).
+
+There are missing headers added into INF files at 8906f076de35b222a..
+They are now manually added but not auto-generated. So we update the
+perl script to enable this feature.
+Meanwhile, update the order of the .h files in INF files, which are
+auto-generated now.
+https://bugzilla.tianocore.org/show_bug.cgi?id=2085
+
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
+Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com>
+Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
+Reviewed-by: Xiaoyu Lu <xiaoyux.lu@intel.com>
+(cherry picked from commit 9f4fbd56d43054cc73d722c1643659f9741c0fcf)
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+---
+ CryptoPkg/Library/OpensslLib/OpensslLib.inf   | 103 +++++++++---------
+ .../Library/OpensslLib/OpensslLibCrypto.inf   |  96 ++++++++--------
+ CryptoPkg/Library/OpensslLib/process_files.pl |  28 +++++
+ 3 files changed, 129 insertions(+), 98 deletions(-)
+
+diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
+index 7432321fd4..dd873a0dcd 100644
+--- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
++++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
+@@ -34,9 +34,7 @@
+   $(OPENSSL_PATH)/crypto/aes/aes_misc.c
+   $(OPENSSL_PATH)/crypto/aes/aes_ofb.c
+   $(OPENSSL_PATH)/crypto/aes/aes_wrap.c
+-  $(OPENSSL_PATH)/crypto/aes/aes_locl.h
+   $(OPENSSL_PATH)/crypto/aria/aria.c
+-  $(OPENSSL_PATH)/crypto/arm_arch.h
+   $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c
+   $(OPENSSL_PATH)/crypto/asn1/a_d2i_fp.c
+   $(OPENSSL_PATH)/crypto/asn1/a_digest.c
+@@ -101,21 +99,12 @@
+   $(OPENSSL_PATH)/crypto/asn1/x_sig.c
+   $(OPENSSL_PATH)/crypto/asn1/x_spki.c
+   $(OPENSSL_PATH)/crypto/asn1/x_val.c
+-  $(OPENSSL_PATH)/crypto/asn1/standard_methods.h
+-  $(OPENSSL_PATH)/crypto/asn1/charmap.h
+-  $(OPENSSL_PATH)/crypto/asn1/tbl_standard.h
+-  $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.h
+-  $(OPENSSL_PATH)/crypto/asn1/asn1_locl.h
+   $(OPENSSL_PATH)/crypto/async/arch/async_null.c
+   $(OPENSSL_PATH)/crypto/async/arch/async_posix.c
+   $(OPENSSL_PATH)/crypto/async/arch/async_win.c
+   $(OPENSSL_PATH)/crypto/async/async.c
+   $(OPENSSL_PATH)/crypto/async/async_err.c
+   $(OPENSSL_PATH)/crypto/async/async_wait.c
+-  $(OPENSSL_PATH)/crypto/async/arch/async_win.h
+-  $(OPENSSL_PATH)/crypto/async/async_locl.h
+-  $(OPENSSL_PATH)/crypto/async/arch/async_posix.h
+-  $(OPENSSL_PATH)/crypto/async/arch/async_null.h
+   $(OPENSSL_PATH)/crypto/bio/b_addr.c
+   $(OPENSSL_PATH)/crypto/bio/b_dump.c
+   $(OPENSSL_PATH)/crypto/bio/b_sock.c
+@@ -138,7 +127,6 @@
+   $(OPENSSL_PATH)/crypto/bio/bss_mem.c
+   $(OPENSSL_PATH)/crypto/bio/bss_null.c
+   $(OPENSSL_PATH)/crypto/bio/bss_sock.c
+-  $(OPENSSL_PATH)/crypto/bio/bio_lcl.h
+   $(OPENSSL_PATH)/crypto/bn/bn_add.c
+   $(OPENSSL_PATH)/crypto/bn/bn_asm.c
+   $(OPENSSL_PATH)/crypto/bn/bn_blind.c
+@@ -170,9 +158,6 @@
+   $(OPENSSL_PATH)/crypto/bn/bn_srp.c
+   $(OPENSSL_PATH)/crypto/bn/bn_word.c
+   $(OPENSSL_PATH)/crypto/bn/bn_x931p.c
+-  $(OPENSSL_PATH)/crypto/bn/rsaz_exp.h
+-  $(OPENSSL_PATH)/crypto/bn/bn_prime.h
+-  $(OPENSSL_PATH)/crypto/bn/bn_lcl.h
+   $(OPENSSL_PATH)/crypto/buffer/buf_err.c
+   $(OPENSSL_PATH)/crypto/buffer/buffer.c
+   $(OPENSSL_PATH)/crypto/cmac/cm_ameth.c
+@@ -181,7 +166,6 @@
+   $(OPENSSL_PATH)/crypto/comp/c_zlib.c
+   $(OPENSSL_PATH)/crypto/comp/comp_err.c
+   $(OPENSSL_PATH)/crypto/comp/comp_lib.c
+-  $(OPENSSL_PATH)/crypto/comp/comp_lcl.h
+   $(OPENSSL_PATH)/crypto/conf/conf_api.c
+   $(OPENSSL_PATH)/crypto/conf/conf_def.c
+   $(OPENSSL_PATH)/crypto/conf/conf_err.c
+@@ -190,8 +174,6 @@
+   $(OPENSSL_PATH)/crypto/conf/conf_mod.c
+   $(OPENSSL_PATH)/crypto/conf/conf_sap.c
+   $(OPENSSL_PATH)/crypto/conf/conf_ssl.c
+-  $(OPENSSL_PATH)/crypto/conf/conf_lcl.h
+-  $(OPENSSL_PATH)/crypto/conf/conf_def.h
+   $(OPENSSL_PATH)/crypto/cpt_err.c
+   $(OPENSSL_PATH)/crypto/cryptlib.c
+   $(OPENSSL_PATH)/crypto/ctype.c
+@@ -215,8 +197,6 @@
+   $(OPENSSL_PATH)/crypto/des/set_key.c
+   $(OPENSSL_PATH)/crypto/des/str2key.c
+   $(OPENSSL_PATH)/crypto/des/xcbc_enc.c
+-  $(OPENSSL_PATH)/crypto/des/spr.h
+-  $(OPENSSL_PATH)/crypto/des/des_locl.h
+   $(OPENSSL_PATH)/crypto/dh/dh_ameth.c
+   $(OPENSSL_PATH)/crypto/dh/dh_asn1.c
+   $(OPENSSL_PATH)/crypto/dh/dh_check.c
+@@ -231,7 +211,6 @@
+   $(OPENSSL_PATH)/crypto/dh/dh_prn.c
+   $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c
+   $(OPENSSL_PATH)/crypto/dh/dh_rfc7919.c
+-  $(OPENSSL_PATH)/crypto/dh/dh_locl.h
+   $(OPENSSL_PATH)/crypto/dso/dso_dl.c
+   $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c
+   $(OPENSSL_PATH)/crypto/dso/dso_err.c
+@@ -239,7 +218,6 @@
+   $(OPENSSL_PATH)/crypto/dso/dso_openssl.c
+   $(OPENSSL_PATH)/crypto/dso/dso_vms.c
+   $(OPENSSL_PATH)/crypto/dso/dso_win32.c
+-  $(OPENSSL_PATH)/crypto/dso/dso_locl.h
+   $(OPENSSL_PATH)/crypto/ebcdic.c
+   $(OPENSSL_PATH)/crypto/err/err.c
+   $(OPENSSL_PATH)/crypto/err/err_prn.c
+@@ -304,13 +282,11 @@
+   $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c
+   $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c
+   $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c
+-  $(OPENSSL_PATH)/crypto/evp/evp_locl.h
+   $(OPENSSL_PATH)/crypto/ex_data.c
+   $(OPENSSL_PATH)/crypto/getenv.c
+   $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c
+   $(OPENSSL_PATH)/crypto/hmac/hm_pmeth.c
+   $(OPENSSL_PATH)/crypto/hmac/hmac.c
+-  $(OPENSSL_PATH)/crypto/hmac/hmac_lcl.h
+   $(OPENSSL_PATH)/crypto/init.c
+   $(OPENSSL_PATH)/crypto/kdf/hkdf.c
+   $(OPENSSL_PATH)/crypto/kdf/kdf_err.c
+@@ -318,13 +294,10 @@
+   $(OPENSSL_PATH)/crypto/kdf/tls1_prf.c
+   $(OPENSSL_PATH)/crypto/lhash/lh_stats.c
+   $(OPENSSL_PATH)/crypto/lhash/lhash.c
+-  $(OPENSSL_PATH)/crypto/lhash/lhash_lcl.h
+   $(OPENSSL_PATH)/crypto/md4/md4_dgst.c
+   $(OPENSSL_PATH)/crypto/md4/md4_one.c
+-  $(OPENSSL_PATH)/crypto/md4/md4_locl.h
+   $(OPENSSL_PATH)/crypto/md5/md5_dgst.c
+   $(OPENSSL_PATH)/crypto/md5/md5_one.c
+-  $(OPENSSL_PATH)/crypto/md5/md5_locl.h
+   $(OPENSSL_PATH)/crypto/mem.c
+   $(OPENSSL_PATH)/crypto/mem_clr.c
+   $(OPENSSL_PATH)/crypto/mem_dbg.c
+@@ -339,7 +312,6 @@
+   $(OPENSSL_PATH)/crypto/modes/ofb128.c
+   $(OPENSSL_PATH)/crypto/modes/wrap128.c
+   $(OPENSSL_PATH)/crypto/modes/xts128.c
+-  $(OPENSSL_PATH)/crypto/modes/modes_lcl.h
+   $(OPENSSL_PATH)/crypto/o_dir.c
+   $(OPENSSL_PATH)/crypto/o_fips.c
+   $(OPENSSL_PATH)/crypto/o_fopen.c
+@@ -351,9 +323,6 @@
+   $(OPENSSL_PATH)/crypto/objects/obj_err.c
+   $(OPENSSL_PATH)/crypto/objects/obj_lib.c
+   $(OPENSSL_PATH)/crypto/objects/obj_xref.c
+-  $(OPENSSL_PATH)/crypto/objects/obj_dat.h
+-  $(OPENSSL_PATH)/crypto/objects/obj_xref.h
+-  $(OPENSSL_PATH)/crypto/objects/obj_lcl.h
+   $(OPENSSL_PATH)/crypto/ocsp/ocsp_asn.c
+   $(OPENSSL_PATH)/crypto/ocsp/ocsp_cl.c
+   $(OPENSSL_PATH)/crypto/ocsp/ocsp_err.c
+@@ -364,7 +333,6 @@
+   $(OPENSSL_PATH)/crypto/ocsp/ocsp_srv.c
+   $(OPENSSL_PATH)/crypto/ocsp/ocsp_vfy.c
+   $(OPENSSL_PATH)/crypto/ocsp/v3_ocsp.c
+-  $(OPENSSL_PATH)/crypto/ocsp/ocsp_lcl.h
+   $(OPENSSL_PATH)/crypto/pem/pem_all.c
+   $(OPENSSL_PATH)/crypto/pem/pem_err.c
+   $(OPENSSL_PATH)/crypto/pem/pem_info.c
+@@ -392,7 +360,6 @@
+   $(OPENSSL_PATH)/crypto/pkcs12/p12_sbag.c
+   $(OPENSSL_PATH)/crypto/pkcs12/p12_utl.c
+   $(OPENSSL_PATH)/crypto/pkcs12/pk12err.c
+-  $(OPENSSL_PATH)/crypto/pkcs12/p12_lcl.h
+   $(OPENSSL_PATH)/crypto/pkcs7/bio_pk7.c
+   $(OPENSSL_PATH)/crypto/pkcs7/pk7_asn1.c
+   $(OPENSSL_PATH)/crypto/pkcs7/pk7_attr.c
+@@ -401,7 +368,6 @@
+   $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c
+   $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c
+   $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c
+-  $(OPENSSL_PATH)/crypto/ppc_arch.h
+   $(OPENSSL_PATH)/crypto/rand/drbg_ctr.c
+   $(OPENSSL_PATH)/crypto/rand/drbg_lib.c
+   $(OPENSSL_PATH)/crypto/rand/rand_egd.c
+@@ -410,10 +376,8 @@
+   $(OPENSSL_PATH)/crypto/rand/rand_unix.c
+   $(OPENSSL_PATH)/crypto/rand/rand_vms.c
+   $(OPENSSL_PATH)/crypto/rand/rand_win.c
+-  $(OPENSSL_PATH)/crypto/rand/rand_lcl.h
+   $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c
+   $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c
+-  $(OPENSSL_PATH)/crypto/rc4/rc4_locl.h
+   $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c
+   $(OPENSSL_PATH)/crypto/rsa/rsa_asn1.c
+   $(OPENSSL_PATH)/crypto/rsa/rsa_chk.c
+@@ -436,24 +400,18 @@
+   $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c
+   $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c
+   $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c
+-  $(OPENSSL_PATH)/crypto/rsa/rsa_locl.h
+-  $(OPENSSL_PATH)/crypto/s390x_arch.h
+   $(OPENSSL_PATH)/crypto/sha/keccak1600.c
+   $(OPENSSL_PATH)/crypto/sha/sha1_one.c
+   $(OPENSSL_PATH)/crypto/sha/sha1dgst.c
+   $(OPENSSL_PATH)/crypto/sha/sha256.c
+   $(OPENSSL_PATH)/crypto/sha/sha512.c
+-  $(OPENSSL_PATH)/crypto/sha/sha_locl.h
+   $(OPENSSL_PATH)/crypto/siphash/siphash.c
+   $(OPENSSL_PATH)/crypto/siphash/siphash_ameth.c
+   $(OPENSSL_PATH)/crypto/siphash/siphash_pmeth.c
+-  $(OPENSSL_PATH)/crypto/siphash/siphash_local.h
+   $(OPENSSL_PATH)/crypto/sm3/m_sm3.c
+   $(OPENSSL_PATH)/crypto/sm3/sm3.c
+-  $(OPENSSL_PATH)/crypto/sm3/sm3_locl.h
+   $(OPENSSL_PATH)/crypto/sm4/sm4.c
+   $(OPENSSL_PATH)/crypto/stack/stack.c
+-  $(OPENSSL_PATH)/crypto/sparc_arch.h
+   $(OPENSSL_PATH)/crypto/threads_none.c
+   $(OPENSSL_PATH)/crypto/threads_pthread.c
+   $(OPENSSL_PATH)/crypto/threads_win.c
+@@ -463,8 +421,6 @@
+   $(OPENSSL_PATH)/crypto/ui/ui_null.c
+   $(OPENSSL_PATH)/crypto/ui/ui_openssl.c
+   $(OPENSSL_PATH)/crypto/ui/ui_util.c
+-  $(OPENSSL_PATH)/crypto/ui/ui_locl.h
+-  $(OPENSSL_PATH)/crypto/vms_rms.h
+   $(OPENSSL_PATH)/crypto/uid.c
+   $(OPENSSL_PATH)/crypto/x509/by_dir.c
+   $(OPENSSL_PATH)/crypto/x509/by_file.c
+@@ -502,7 +458,6 @@
+   $(OPENSSL_PATH)/crypto/x509/x_req.c
+   $(OPENSSL_PATH)/crypto/x509/x_x509.c
+   $(OPENSSL_PATH)/crypto/x509/x_x509a.c
+-  $(OPENSSL_PATH)/crypto/x509/x509_lcl.h
+   $(OPENSSL_PATH)/crypto/x509v3/pcy_cache.c
+   $(OPENSSL_PATH)/crypto/x509v3/pcy_data.c
+   $(OPENSSL_PATH)/crypto/x509v3/pcy_lib.c
+@@ -540,11 +495,57 @@
+   $(OPENSSL_PATH)/crypto/x509v3/v3_tlsf.c
+   $(OPENSSL_PATH)/crypto/x509v3/v3_utl.c
+   $(OPENSSL_PATH)/crypto/x509v3/v3err.c
++  $(OPENSSL_PATH)/crypto/hmac/hmac_lcl.h
++  $(OPENSSL_PATH)/crypto/dh/dh_locl.h
++  $(OPENSSL_PATH)/crypto/bio/bio_lcl.h
++  $(OPENSSL_PATH)/crypto/conf/conf_def.h
++  $(OPENSSL_PATH)/crypto/conf/conf_lcl.h
++  $(OPENSSL_PATH)/crypto/lhash/lhash_lcl.h
++  $(OPENSSL_PATH)/crypto/sha/sha_locl.h
++  $(OPENSSL_PATH)/crypto/md5/md5_locl.h
++  $(OPENSSL_PATH)/crypto/store/store_locl.h
++  $(OPENSSL_PATH)/crypto/dso/dso_locl.h
++  $(OPENSSL_PATH)/crypto/pkcs12/p12_lcl.h
++  $(OPENSSL_PATH)/crypto/arm_arch.h
++  $(OPENSSL_PATH)/crypto/mips_arch.h
++  $(OPENSSL_PATH)/crypto/ppc_arch.h
++  $(OPENSSL_PATH)/crypto/s390x_arch.h
++  $(OPENSSL_PATH)/crypto/sparc_arch.h
++  $(OPENSSL_PATH)/crypto/vms_rms.h
++  $(OPENSSL_PATH)/crypto/bn/bn_lcl.h
++  $(OPENSSL_PATH)/crypto/bn/bn_prime.h
++  $(OPENSSL_PATH)/crypto/bn/rsaz_exp.h
++  $(OPENSSL_PATH)/crypto/ui/ui_locl.h
++  $(OPENSSL_PATH)/crypto/md4/md4_locl.h
++  $(OPENSSL_PATH)/crypto/rc4/rc4_locl.h
++  $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.h
++  $(OPENSSL_PATH)/crypto/asn1/asn1_locl.h
++  $(OPENSSL_PATH)/crypto/asn1/charmap.h
++  $(OPENSSL_PATH)/crypto/asn1/standard_methods.h
++  $(OPENSSL_PATH)/crypto/asn1/tbl_standard.h
++  $(OPENSSL_PATH)/crypto/evp/evp_locl.h
++  $(OPENSSL_PATH)/crypto/rand/rand_lcl.h
++  $(OPENSSL_PATH)/crypto/ocsp/ocsp_lcl.h
++  $(OPENSSL_PATH)/crypto/modes/modes_lcl.h
++  $(OPENSSL_PATH)/crypto/comp/comp_lcl.h
++  $(OPENSSL_PATH)/crypto/rsa/rsa_locl.h
++  $(OPENSSL_PATH)/crypto/x509/x509_lcl.h
++  $(OPENSSL_PATH)/crypto/async/arch/async_null.h
++  $(OPENSSL_PATH)/crypto/async/arch/async_posix.h
++  $(OPENSSL_PATH)/crypto/async/arch/async_win.h
++  $(OPENSSL_PATH)/crypto/sm3/sm3_locl.h
++  $(OPENSSL_PATH)/crypto/des/des_locl.h
++  $(OPENSSL_PATH)/crypto/des/spr.h
++  $(OPENSSL_PATH)/crypto/siphash/siphash_local.h
++  $(OPENSSL_PATH)/crypto/aes/aes_locl.h
++  $(OPENSSL_PATH)/crypto/async/async_locl.h
++  $(OPENSSL_PATH)/crypto/x509v3/ext_dat.h
+   $(OPENSSL_PATH)/crypto/x509v3/pcy_int.h
+-  $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
+   $(OPENSSL_PATH)/crypto/x509v3/standard_exts.h
+-  $(OPENSSL_PATH)/crypto/x509v3/ext_dat.h
+-  $(OPENSSL_PATH)/ms/uplink.h
++  $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
++  $(OPENSSL_PATH)/crypto/objects/obj_dat.h
++  $(OPENSSL_PATH)/crypto/objects/obj_lcl.h
++  $(OPENSSL_PATH)/crypto/objects/obj_xref.h
+   $(OPENSSL_PATH)/ssl/bio_ssl.c
+   $(OPENSSL_PATH)/ssl/d1_lib.c
+   $(OPENSSL_PATH)/ssl/d1_msg.c
+@@ -589,13 +590,13 @@
+   $(OPENSSL_PATH)/ssl/t1_trce.c
+   $(OPENSSL_PATH)/ssl/tls13_enc.c
+   $(OPENSSL_PATH)/ssl/tls_srp.c
+-  $(OPENSSL_PATH)/ssl/record/record_locl.h
+   $(OPENSSL_PATH)/ssl/statem/statem.h
+   $(OPENSSL_PATH)/ssl/statem/statem_locl.h
++  $(OPENSSL_PATH)/ssl/packet_locl.h
++  $(OPENSSL_PATH)/ssl/ssl_cert_table.h
+   $(OPENSSL_PATH)/ssl/ssl_locl.h
+   $(OPENSSL_PATH)/ssl/record/record.h
+-  $(OPENSSL_PATH)/ssl/ssl_cert_table.h
+-  $(OPENSSL_PATH)/ssl/packet_locl.h
++  $(OPENSSL_PATH)/ssl/record/record_locl.h
+ # Autogenerated files list ends here
+ 
+   ossl_store.c
+diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+index 8134b45eda..a1bb560255 100644
+--- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
++++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+@@ -33,9 +33,7 @@
+   $(OPENSSL_PATH)/crypto/aes/aes_misc.c
+   $(OPENSSL_PATH)/crypto/aes/aes_ofb.c
+   $(OPENSSL_PATH)/crypto/aes/aes_wrap.c
+-  $(OPENSSL_PATH)/crypto/aes/aes_locl.h
+   $(OPENSSL_PATH)/crypto/aria/aria.c
+-  $(OPENSSL_PATH)/crypto/arm_arch.h
+   $(OPENSSL_PATH)/crypto/asn1/a_bitstr.c
+   $(OPENSSL_PATH)/crypto/asn1/a_d2i_fp.c
+   $(OPENSSL_PATH)/crypto/asn1/a_digest.c
+@@ -100,21 +98,12 @@
+   $(OPENSSL_PATH)/crypto/asn1/x_sig.c
+   $(OPENSSL_PATH)/crypto/asn1/x_spki.c
+   $(OPENSSL_PATH)/crypto/asn1/x_val.c
+-  $(OPENSSL_PATH)/crypto/asn1/standard_methods.h
+-  $(OPENSSL_PATH)/crypto/asn1/charmap.h
+-  $(OPENSSL_PATH)/crypto/asn1/tbl_standard.h
+-  $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.h
+-  $(OPENSSL_PATH)/crypto/asn1/asn1_locl.h
+   $(OPENSSL_PATH)/crypto/async/arch/async_null.c
+   $(OPENSSL_PATH)/crypto/async/arch/async_posix.c
+   $(OPENSSL_PATH)/crypto/async/arch/async_win.c
+-  $(OPENSSL_PATH)/crypto/async/arch/async_posix.h
+-  $(OPENSSL_PATH)/crypto/async/arch/async_null.h
+-  $(OPENSSL_PATH)/crypto/async/arch/async_win.h
+   $(OPENSSL_PATH)/crypto/async/async.c
+   $(OPENSSL_PATH)/crypto/async/async_err.c
+   $(OPENSSL_PATH)/crypto/async/async_wait.c
+-  $(OPENSSL_PATH)/crypto/async/async_locl.h
+   $(OPENSSL_PATH)/crypto/bio/b_addr.c
+   $(OPENSSL_PATH)/crypto/bio/b_dump.c
+   $(OPENSSL_PATH)/crypto/bio/b_sock.c
+@@ -137,7 +126,6 @@
+   $(OPENSSL_PATH)/crypto/bio/bss_mem.c
+   $(OPENSSL_PATH)/crypto/bio/bss_null.c
+   $(OPENSSL_PATH)/crypto/bio/bss_sock.c
+-  $(OPENSSL_PATH)/crypto/bio/bio_lcl.h
+   $(OPENSSL_PATH)/crypto/bn/bn_add.c
+   $(OPENSSL_PATH)/crypto/bn/bn_asm.c
+   $(OPENSSL_PATH)/crypto/bn/bn_blind.c
+@@ -169,9 +157,6 @@
+   $(OPENSSL_PATH)/crypto/bn/bn_srp.c
+   $(OPENSSL_PATH)/crypto/bn/bn_word.c
+   $(OPENSSL_PATH)/crypto/bn/bn_x931p.c
+-  $(OPENSSL_PATH)/crypto/bn/rsaz_exp.h
+-  $(OPENSSL_PATH)/crypto/bn/bn_prime.h
+-  $(OPENSSL_PATH)/crypto/bn/bn_lcl.h
+   $(OPENSSL_PATH)/crypto/buffer/buf_err.c
+   $(OPENSSL_PATH)/crypto/buffer/buffer.c
+   $(OPENSSL_PATH)/crypto/cmac/cm_ameth.c
+@@ -180,7 +165,6 @@
+   $(OPENSSL_PATH)/crypto/comp/c_zlib.c
+   $(OPENSSL_PATH)/crypto/comp/comp_err.c
+   $(OPENSSL_PATH)/crypto/comp/comp_lib.c
+-  $(OPENSSL_PATH)/crypto/comp/comp_lcl.h
+   $(OPENSSL_PATH)/crypto/conf/conf_api.c
+   $(OPENSSL_PATH)/crypto/conf/conf_def.c
+   $(OPENSSL_PATH)/crypto/conf/conf_err.c
+@@ -189,8 +173,6 @@
+   $(OPENSSL_PATH)/crypto/conf/conf_mod.c
+   $(OPENSSL_PATH)/crypto/conf/conf_sap.c
+   $(OPENSSL_PATH)/crypto/conf/conf_ssl.c
+-  $(OPENSSL_PATH)/crypto/conf/conf_lcl.h
+-  $(OPENSSL_PATH)/crypto/conf/conf_def.h
+   $(OPENSSL_PATH)/crypto/cpt_err.c
+   $(OPENSSL_PATH)/crypto/cryptlib.c
+   $(OPENSSL_PATH)/crypto/ctype.c
+@@ -214,8 +196,6 @@
+   $(OPENSSL_PATH)/crypto/des/set_key.c
+   $(OPENSSL_PATH)/crypto/des/str2key.c
+   $(OPENSSL_PATH)/crypto/des/xcbc_enc.c
+-  $(OPENSSL_PATH)/crypto/des/spr.h
+-  $(OPENSSL_PATH)/crypto/des/des_locl.h
+   $(OPENSSL_PATH)/crypto/dh/dh_ameth.c
+   $(OPENSSL_PATH)/crypto/dh/dh_asn1.c
+   $(OPENSSL_PATH)/crypto/dh/dh_check.c
+@@ -230,7 +210,6 @@
+   $(OPENSSL_PATH)/crypto/dh/dh_prn.c
+   $(OPENSSL_PATH)/crypto/dh/dh_rfc5114.c
+   $(OPENSSL_PATH)/crypto/dh/dh_rfc7919.c
+-  $(OPENSSL_PATH)/crypto/dh/dh_locl.h
+   $(OPENSSL_PATH)/crypto/dso/dso_dl.c
+   $(OPENSSL_PATH)/crypto/dso/dso_dlfcn.c
+   $(OPENSSL_PATH)/crypto/dso/dso_err.c
+@@ -238,7 +217,6 @@
+   $(OPENSSL_PATH)/crypto/dso/dso_openssl.c
+   $(OPENSSL_PATH)/crypto/dso/dso_vms.c
+   $(OPENSSL_PATH)/crypto/dso/dso_win32.c
+-  $(OPENSSL_PATH)/crypto/dso/dso_locl.h
+   $(OPENSSL_PATH)/crypto/ebcdic.c
+   $(OPENSSL_PATH)/crypto/err/err.c
+   $(OPENSSL_PATH)/crypto/err/err_prn.c
+@@ -280,7 +258,6 @@
+   $(OPENSSL_PATH)/crypto/evp/evp_pkey.c
+   $(OPENSSL_PATH)/crypto/evp/m_md2.c
+   $(OPENSSL_PATH)/crypto/evp/m_md4.c
+-  $(OPENSSL_PATH)/crypto/md4/md4_locl.h
+   $(OPENSSL_PATH)/crypto/evp/m_md5.c
+   $(OPENSSL_PATH)/crypto/evp/m_md5_sha1.c
+   $(OPENSSL_PATH)/crypto/evp/m_mdc2.c
+@@ -304,13 +281,11 @@
+   $(OPENSSL_PATH)/crypto/evp/pmeth_fn.c
+   $(OPENSSL_PATH)/crypto/evp/pmeth_gn.c
+   $(OPENSSL_PATH)/crypto/evp/pmeth_lib.c
+-  $(OPENSSL_PATH)/crypto/evp/evp_locl.h
+   $(OPENSSL_PATH)/crypto/ex_data.c
+   $(OPENSSL_PATH)/crypto/getenv.c
+   $(OPENSSL_PATH)/crypto/hmac/hm_ameth.c
+   $(OPENSSL_PATH)/crypto/hmac/hm_pmeth.c
+   $(OPENSSL_PATH)/crypto/hmac/hmac.c
+-  $(OPENSSL_PATH)/crypto/hmac/hmac_lcl.h
+   $(OPENSSL_PATH)/crypto/init.c
+   $(OPENSSL_PATH)/crypto/kdf/hkdf.c
+   $(OPENSSL_PATH)/crypto/kdf/kdf_err.c
+@@ -318,12 +293,10 @@
+   $(OPENSSL_PATH)/crypto/kdf/tls1_prf.c
+   $(OPENSSL_PATH)/crypto/lhash/lh_stats.c
+   $(OPENSSL_PATH)/crypto/lhash/lhash.c
+-  $(OPENSSL_PATH)/crypto/lhash/lhash_lcl.h
+   $(OPENSSL_PATH)/crypto/md4/md4_dgst.c
+   $(OPENSSL_PATH)/crypto/md4/md4_one.c
+   $(OPENSSL_PATH)/crypto/md5/md5_dgst.c
+   $(OPENSSL_PATH)/crypto/md5/md5_one.c
+-  $(OPENSSL_PATH)/crypto/md5/md5_locl.h
+   $(OPENSSL_PATH)/crypto/mem.c
+   $(OPENSSL_PATH)/crypto/mem_clr.c
+   $(OPENSSL_PATH)/crypto/mem_dbg.c
+@@ -338,7 +311,6 @@
+   $(OPENSSL_PATH)/crypto/modes/ofb128.c
+   $(OPENSSL_PATH)/crypto/modes/wrap128.c
+   $(OPENSSL_PATH)/crypto/modes/xts128.c
+-  $(OPENSSL_PATH)/crypto/modes/modes_lcl.h
+   $(OPENSSL_PATH)/crypto/o_dir.c
+   $(OPENSSL_PATH)/crypto/o_fips.c
+   $(OPENSSL_PATH)/crypto/o_fopen.c
+@@ -350,9 +322,6 @@
+   $(OPENSSL_PATH)/crypto/objects/obj_err.c
+   $(OPENSSL_PATH)/crypto/objects/obj_lib.c
+   $(OPENSSL_PATH)/crypto/objects/obj_xref.c
+-  $(OPENSSL_PATH)/crypto/objects/obj_dat.h
+-  $(OPENSSL_PATH)/crypto/objects/obj_xref.h
+-  $(OPENSSL_PATH)/crypto/objects/obj_lcl.h
+   $(OPENSSL_PATH)/crypto/ocsp/ocsp_asn.c
+   $(OPENSSL_PATH)/crypto/ocsp/ocsp_cl.c
+   $(OPENSSL_PATH)/crypto/ocsp/ocsp_err.c
+@@ -363,7 +332,6 @@
+   $(OPENSSL_PATH)/crypto/ocsp/ocsp_srv.c
+   $(OPENSSL_PATH)/crypto/ocsp/ocsp_vfy.c
+   $(OPENSSL_PATH)/crypto/ocsp/v3_ocsp.c
+-  $(OPENSSL_PATH)/crypto/ocsp/ocsp_lcl.h
+   $(OPENSSL_PATH)/crypto/pem/pem_all.c
+   $(OPENSSL_PATH)/crypto/pem/pem_err.c
+   $(OPENSSL_PATH)/crypto/pem/pem_info.c
+@@ -399,8 +367,6 @@
+   $(OPENSSL_PATH)/crypto/pkcs7/pk7_mime.c
+   $(OPENSSL_PATH)/crypto/pkcs7/pk7_smime.c
+   $(OPENSSL_PATH)/crypto/pkcs7/pkcs7err.c
+-  $(OPENSSL_PATH)/crypto/pkcs12/p12_lcl.h
+-  $(OPENSSL_PATH)/crypto/ppc_arch.h
+   $(OPENSSL_PATH)/crypto/rand/drbg_ctr.c
+   $(OPENSSL_PATH)/crypto/rand/drbg_lib.c
+   $(OPENSSL_PATH)/crypto/rand/rand_egd.c
+@@ -409,10 +375,8 @@
+   $(OPENSSL_PATH)/crypto/rand/rand_unix.c
+   $(OPENSSL_PATH)/crypto/rand/rand_vms.c
+   $(OPENSSL_PATH)/crypto/rand/rand_win.c
+-  $(OPENSSL_PATH)/crypto/rand/rand_lcl.h
+   $(OPENSSL_PATH)/crypto/rc4/rc4_enc.c
+   $(OPENSSL_PATH)/crypto/rc4/rc4_skey.c
+-  $(OPENSSL_PATH)/crypto/rc4/rc4_locl.h
+   $(OPENSSL_PATH)/crypto/rsa/rsa_ameth.c
+   $(OPENSSL_PATH)/crypto/rsa/rsa_asn1.c
+   $(OPENSSL_PATH)/crypto/rsa/rsa_chk.c
+@@ -435,24 +399,18 @@
+   $(OPENSSL_PATH)/crypto/rsa/rsa_ssl.c
+   $(OPENSSL_PATH)/crypto/rsa/rsa_x931.c
+   $(OPENSSL_PATH)/crypto/rsa/rsa_x931g.c
+-  $(OPENSSL_PATH)/crypto/rsa/rsa_locl.h
+   $(OPENSSL_PATH)/crypto/sha/keccak1600.c
+   $(OPENSSL_PATH)/crypto/sha/sha1_one.c
+   $(OPENSSL_PATH)/crypto/sha/sha1dgst.c
+   $(OPENSSL_PATH)/crypto/sha/sha256.c
+   $(OPENSSL_PATH)/crypto/sha/sha512.c
+-  $(OPENSSL_PATH)/crypto/sha/sha_locl.h
+   $(OPENSSL_PATH)/crypto/siphash/siphash.c
+   $(OPENSSL_PATH)/crypto/siphash/siphash_ameth.c
+   $(OPENSSL_PATH)/crypto/siphash/siphash_pmeth.c
+-  $(OPENSSL_PATH)/crypto/siphash/siphash_local.h
+   $(OPENSSL_PATH)/crypto/sm3/m_sm3.c
+   $(OPENSSL_PATH)/crypto/sm3/sm3.c
+-  $(OPENSSL_PATH)/crypto/sm3/sm3_locl.h
+   $(OPENSSL_PATH)/crypto/sm4/sm4.c
+   $(OPENSSL_PATH)/crypto/stack/stack.c
+-  $(OPENSSL_PATH)/crypto/s390x_arch.h
+-  $(OPENSSL_PATH)/crypto/sparc_arch.h
+   $(OPENSSL_PATH)/crypto/threads_none.c
+   $(OPENSSL_PATH)/crypto/threads_pthread.c
+   $(OPENSSL_PATH)/crypto/threads_win.c
+@@ -462,9 +420,7 @@
+   $(OPENSSL_PATH)/crypto/ui/ui_null.c
+   $(OPENSSL_PATH)/crypto/ui/ui_openssl.c
+   $(OPENSSL_PATH)/crypto/ui/ui_util.c
+-  $(OPENSSL_PATH)/crypto/ui/ui_locl.h
+   $(OPENSSL_PATH)/crypto/uid.c
+-  $(OPENSSL_PATH)/crypto/vms_rms.h
+   $(OPENSSL_PATH)/crypto/x509/by_dir.c
+   $(OPENSSL_PATH)/crypto/x509/by_file.c
+   $(OPENSSL_PATH)/crypto/x509/t_crl.c
+@@ -501,7 +457,6 @@
+   $(OPENSSL_PATH)/crypto/x509/x_req.c
+   $(OPENSSL_PATH)/crypto/x509/x_x509.c
+   $(OPENSSL_PATH)/crypto/x509/x_x509a.c
+-  $(OPENSSL_PATH)/crypto/x509/x509_lcl.h
+   $(OPENSSL_PATH)/crypto/x509v3/pcy_cache.c
+   $(OPENSSL_PATH)/crypto/x509v3/pcy_data.c
+   $(OPENSSL_PATH)/crypto/x509v3/pcy_lib.c
+@@ -539,10 +494,57 @@
+   $(OPENSSL_PATH)/crypto/x509v3/v3_tlsf.c
+   $(OPENSSL_PATH)/crypto/x509v3/v3_utl.c
+   $(OPENSSL_PATH)/crypto/x509v3/v3err.c
++  $(OPENSSL_PATH)/crypto/hmac/hmac_lcl.h
++  $(OPENSSL_PATH)/crypto/dh/dh_locl.h
++  $(OPENSSL_PATH)/crypto/bio/bio_lcl.h
++  $(OPENSSL_PATH)/crypto/conf/conf_def.h
++  $(OPENSSL_PATH)/crypto/conf/conf_lcl.h
++  $(OPENSSL_PATH)/crypto/lhash/lhash_lcl.h
++  $(OPENSSL_PATH)/crypto/sha/sha_locl.h
++  $(OPENSSL_PATH)/crypto/md5/md5_locl.h
++  $(OPENSSL_PATH)/crypto/store/store_locl.h
++  $(OPENSSL_PATH)/crypto/dso/dso_locl.h
++  $(OPENSSL_PATH)/crypto/pkcs12/p12_lcl.h
++  $(OPENSSL_PATH)/crypto/arm_arch.h
++  $(OPENSSL_PATH)/crypto/mips_arch.h
++  $(OPENSSL_PATH)/crypto/ppc_arch.h
++  $(OPENSSL_PATH)/crypto/s390x_arch.h
++  $(OPENSSL_PATH)/crypto/sparc_arch.h
++  $(OPENSSL_PATH)/crypto/vms_rms.h
++  $(OPENSSL_PATH)/crypto/bn/bn_lcl.h
++  $(OPENSSL_PATH)/crypto/bn/bn_prime.h
++  $(OPENSSL_PATH)/crypto/bn/rsaz_exp.h
++  $(OPENSSL_PATH)/crypto/ui/ui_locl.h
++  $(OPENSSL_PATH)/crypto/md4/md4_locl.h
++  $(OPENSSL_PATH)/crypto/rc4/rc4_locl.h
++  $(OPENSSL_PATH)/crypto/asn1/asn1_item_list.h
++  $(OPENSSL_PATH)/crypto/asn1/asn1_locl.h
++  $(OPENSSL_PATH)/crypto/asn1/charmap.h
++  $(OPENSSL_PATH)/crypto/asn1/standard_methods.h
++  $(OPENSSL_PATH)/crypto/asn1/tbl_standard.h
++  $(OPENSSL_PATH)/crypto/evp/evp_locl.h
++  $(OPENSSL_PATH)/crypto/rand/rand_lcl.h
++  $(OPENSSL_PATH)/crypto/ocsp/ocsp_lcl.h
++  $(OPENSSL_PATH)/crypto/modes/modes_lcl.h
++  $(OPENSSL_PATH)/crypto/comp/comp_lcl.h
++  $(OPENSSL_PATH)/crypto/rsa/rsa_locl.h
++  $(OPENSSL_PATH)/crypto/x509/x509_lcl.h
++  $(OPENSSL_PATH)/crypto/async/arch/async_null.h
++  $(OPENSSL_PATH)/crypto/async/arch/async_posix.h
++  $(OPENSSL_PATH)/crypto/async/arch/async_win.h
++  $(OPENSSL_PATH)/crypto/sm3/sm3_locl.h
++  $(OPENSSL_PATH)/crypto/des/des_locl.h
++  $(OPENSSL_PATH)/crypto/des/spr.h
++  $(OPENSSL_PATH)/crypto/siphash/siphash_local.h
++  $(OPENSSL_PATH)/crypto/aes/aes_locl.h
++  $(OPENSSL_PATH)/crypto/async/async_locl.h
++  $(OPENSSL_PATH)/crypto/x509v3/ext_dat.h
+   $(OPENSSL_PATH)/crypto/x509v3/pcy_int.h
+-  $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
+   $(OPENSSL_PATH)/crypto/x509v3/standard_exts.h
+-  $(OPENSSL_PATH)/crypto/x509v3/ext_dat.h
++  $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
++  $(OPENSSL_PATH)/crypto/objects/obj_dat.h
++  $(OPENSSL_PATH)/crypto/objects/obj_lcl.h
++  $(OPENSSL_PATH)/crypto/objects/obj_xref.h
+ # Autogenerated files list ends here
+   buildinf.h
+   rand_pool_noise.h
+diff --git a/CryptoPkg/Library/OpensslLib/process_files.pl b/CryptoPkg/Library/OpensslLib/process_files.pl
+index e13c0acb4d..4fe54cd808 100755
+--- a/CryptoPkg/Library/OpensslLib/process_files.pl
++++ b/CryptoPkg/Library/OpensslLib/process_files.pl
+@@ -144,6 +144,34 @@ foreach my $product ((@{$unified_info{libraries}},
+     }
+ }
+ 
++
++#
++# Update the perl script to generate the missing header files
++#
++my @dir_list = ();
++for (keys %{$unified_info{dirinfo}}){
++  push @dir_list,$_;
++}
++
++my $dir = getcwd();
++my @files = ();
++my @headers = ();
++chdir ("openssl");
++foreach(@dir_list){
++  @files = glob($_."/*.h");
++  push @headers, @files;
++}
++chdir ($dir);
++
++foreach (@headers){
++  if(/ssl/){
++    push @sslfilelist, '  $(OPENSSL_PATH)/' . $_ . "\r\n";
++    next;
++  }
++  push @cryptofilelist, '  $(OPENSSL_PATH)/' . $_ . "\r\n";
++}
++
++
+ #
+ # Update OpensslLib.inf with autogenerated file list
+ #
+-- 
+2.18.1
+
diff --git a/SOURCES/0002-CryptoPkg-Upgrade-OpenSSL-to-1.1.1d.patch b/SOURCES/0002-CryptoPkg-Upgrade-OpenSSL-to-1.1.1d.patch
new file mode 100644
index 0000000..3838c15
--- /dev/null
+++ b/SOURCES/0002-CryptoPkg-Upgrade-OpenSSL-to-1.1.1d.patch
@@ -0,0 +1,159 @@
+From bbda3f776bfcdbcb77b82f1f7fd5dafd798d9784 Mon Sep 17 00:00:00 2001
+From: Shenglei Zhang <shenglei.zhang@intel.com>
+Date: Mon, 21 Oct 2019 15:53:42 +0800
+Subject: CryptoPkg: Upgrade OpenSSL to 1.1.1d
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- New patch (cherry-picked from upstream, to be dropped at the next
+  downstream rebase).
+
+- Upstream OpenSSL-1.1.1c contains commit 5fba3afad017 ("Rework DSO API
+  conditions and configuration option", 2019-04-10). This upstream OpenSSL
+  change requires edk2 to #define DSO_NONE explicitly.
+
+- The present patch (which is going to be released in edk2-stable201911)
+  updates "process_files.pl" to generate "dso_conf.h" with the above
+  macro, and captures the result (i.e. the actual definition of the macro)
+  in the git tree.
+
+- This patch is being backported primarily for the DSO_NONE macro (OpenSSL
+  in RHEL-8.2.0 is based on OpenSSL-1.1.1c). The patch could also come in
+  handy in case we have to re-run "process_files.pl" ourselves.
+
+Upgrade openssl from 1.1.1b to 1.1.1d.
+Something needs to be noticed is that, there is a bug existing in the
+released 1_1_1d version(894da2fb7ed5d314ee5c2fc9fd2d9b8b74111596),
+which causes build failure. So we switch the code base to a usable
+version, which is 2 commits later than the stable tag.
+Now we use the version c3656cc594daac8167721dde7220f0e59ae146fc.
+This log is to fix the build failure.
+https://bugzilla.tianocore.org/show_bug.cgi?id=2226
+
+Besides, the absense of "DSO_NONE" in dso_conf.h causes build failure
+in OvmfPkg. So update process_files.pl to generate information from
+"crypto/include/internal/dso_conf.h.in".
+
+shm.h and utsname.h are added to avoid GCC build failure.
+
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
+Cc: Liming Gao <liming.gao@intel.com>
+Signed-off-by: Shenglei Zhang <shenglei.zhang@intel.com>
+Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Tested-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 1bcc65b9a1408cf445b7b3f9499b27d9c235db71)
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+---
+ CryptoPkg/Library/Include/internal/dso_conf.h | 16 ++++++++++++++++
+ CryptoPkg/Library/Include/sys/shm.h           |  9 +++++++++
+ CryptoPkg/Library/Include/sys/utsname.h       |  9 +++++++++
+ CryptoPkg/Library/OpensslLib/openssl          |  2 +-
+ CryptoPkg/Library/OpensslLib/process_files.pl | 17 +++++++++++++++--
+ 5 files changed, 50 insertions(+), 3 deletions(-)
+ create mode 100644 CryptoPkg/Library/Include/sys/shm.h
+ create mode 100644 CryptoPkg/Library/Include/sys/utsname.h
+
+diff --git a/CryptoPkg/Library/Include/internal/dso_conf.h b/CryptoPkg/Library/Include/internal/dso_conf.h
+index e69de29bb2..43c891588b 100644
+--- a/CryptoPkg/Library/Include/internal/dso_conf.h
++++ b/CryptoPkg/Library/Include/internal/dso_conf.h
+@@ -0,0 +1,16 @@
++/* WARNING: do not edit! */
++/* Generated from crypto/include/internal/dso_conf.h.in */
++/*
++ * Copyright 2016-2019 The OpenSSL Project Authors. All Rights Reserved.
++ *
++ * Licensed under the OpenSSL license (the "License").  You may not use
++ * this file except in compliance with the License.  You can obtain a copy
++ * in the file LICENSE in the source distribution or at
++ * https://www.openssl.org/source/license.html
++ */
++
++#ifndef HEADER_DSO_CONF_H
++# define HEADER_DSO_CONF_H
++# define DSO_NONE
++# define DSO_EXTENSION ".so"
++#endif
+diff --git a/CryptoPkg/Library/Include/sys/shm.h b/CryptoPkg/Library/Include/sys/shm.h
+new file mode 100644
+index 0000000000..dc0b8e81c8
+--- /dev/null
++++ b/CryptoPkg/Library/Include/sys/shm.h
+@@ -0,0 +1,9 @@
++/** @file
++  Include file to support building the third-party cryptographic library.
++
++Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
++SPDX-License-Identifier: BSD-2-Clause-Patent
++
++**/
++
++#include <CrtLibSupport.h>
+diff --git a/CryptoPkg/Library/Include/sys/utsname.h b/CryptoPkg/Library/Include/sys/utsname.h
+new file mode 100644
+index 0000000000..dc0b8e81c8
+--- /dev/null
++++ b/CryptoPkg/Library/Include/sys/utsname.h
+@@ -0,0 +1,9 @@
++/** @file
++  Include file to support building the third-party cryptographic library.
++
++Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
++SPDX-License-Identifier: BSD-2-Clause-Patent
++
++**/
++
++#include <CrtLibSupport.h>
+diff --git a/CryptoPkg/Library/OpensslLib/process_files.pl b/CryptoPkg/Library/OpensslLib/process_files.pl
+index 4fe54cd808..bbcfa0d0e7 100755
+--- a/CryptoPkg/Library/OpensslLib/process_files.pl
++++ b/CryptoPkg/Library/OpensslLib/process_files.pl
+@@ -2,7 +2,7 @@
+ #
+ # This script runs the OpenSSL Configure script, then processes the
+ # resulting file list into our local OpensslLib[Crypto].inf and also
+-# takes a copy of opensslconf.h.
++# takes copies of opensslconf.h and dso_conf.h.
+ #
+ # This only needs to be done once by a developer when updating to a
+ # new version of OpenSSL (or changing options, etc.). Normal users
+@@ -106,6 +106,14 @@ BEGIN {
+                 ) == 0 ||
+                     die "Failed to generate opensslconf.h!\n";
+ 
++            # Generate dso_conf.h per config data
++            system(
++                "perl -I. -Mconfigdata util/dofile.pl " .
++                "crypto/include/internal/dso_conf.h.in " .
++                "> include/internal/dso_conf.h"
++                ) == 0 ||
++                    die "Failed to generate dso_conf.h!\n";
++
+             chdir($basedir) ||
+                 die "Cannot change to base directory \"" . $basedir . "\"";
+ 
+@@ -249,12 +257,17 @@ rename( $new_inf_file, $inf_file ) ||
+ print "Done!";
+ 
+ #
+-# Copy opensslconf.h generated from OpenSSL Configuration
++# Copy opensslconf.h and dso_conf.h generated from OpenSSL Configuration
+ #
+ print "\n--> Duplicating opensslconf.h into Include/openssl ... ";
+ copy($OPENSSL_PATH . "/include/openssl/opensslconf.h",
+      $OPENSSL_PATH . "/../../Include/openssl/") ||
+    die "Cannot copy opensslconf.h!";
++print "Done!";
++print "\n--> Duplicating dso_conf.h into Include/internal ... ";
++copy($OPENSSL_PATH . "/include/internal/dso_conf.h",
++     $OPENSSL_PATH . "/../../Include/internal/") ||
++   die "Cannot copy dso_conf.h!";
+ print "Done!\n";
+ 
+ print "\nProcessing Files Done!\n";
+-- 
+2.18.1
+
diff --git a/SOURCES/0006-advertise-OpenSSL-on-TianoCore-splash-screen-boot-lo.patch b/SOURCES/0006-advertise-OpenSSL-on-TianoCore-splash-screen-boot-lo.patch
new file mode 100644
index 0000000..5d691f5
--- /dev/null
+++ b/SOURCES/0006-advertise-OpenSSL-on-TianoCore-splash-screen-boot-lo.patch
@@ -0,0 +1,613 @@
+From 740d239222c2656ae8eeb2d1cc4802ce5b07f3d2 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 11 Jun 2014 23:33:33 +0200
+Subject: advertise OpenSSL on TianoCore splash screen / boot logo (RHEL only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- trivial context update (performed silently by git-cherry-pick) for
+  upstream commit 3207a872a405 ("OvmfPkg: Update DSC/FDF files to consume
+  CSM components in OvmfPkg", 2019-06-14)
+
+- A note for the future: the logo could change completely in a subsequent
+  rebase. See <https://bugzilla.tianocore.org/show_bug.cgi?id=2050> (in
+  CONFIRMED status at the time of writing).
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- Upstream edk2 removed the obsoleted network drivers in MdeModulePkg. The
+  OvmfPkg platforms were adapted in commit d2f1f6423bd1 ("OvmfPkg: Replace
+  obsoleted network drivers from platform DSC/FDF.", 2018-11-06). The
+  ArmVirtPkg platforms were adapted in commit 9a67ba261fe9 ("ArmVirtPkg:
+  Replace obsoleted network drivers from platform DSC/FDF.", 2018-12-14).
+
+  Consequently, because the NetworkPkg iSCSI driver requires OpenSSL
+  unconditionally, as explained in
+  <https://bugzilla.tianocore.org/show_bug.cgi?id=1278#c3>, this patch now
+  builds LogoOpenSSLDxe unconditionally, squashing and updating previous
+  downstream commits
+
+  - 8e8ea8811e26 advertise OpenSSL on TianoCore splash screen / boot logo
+                 (RHEL only)
+  - 02ed2c501cdd advertise OpenSSL due to IPv6 enablement too (RHEL only)
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- Adapted to upstream 25184ec33c36 ("MdeModulePkg/Logo.idf: Remove
+  incorrect comments.", 2018-02-28)
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- After picking previous downstream-only commit 32192c62e289, carry new
+  upstream commit e01e9ae28250 ("MdeModulePkg/LogoDxe: Add missing
+  dependency gEfiHiiImageExProtocolGuid", 2017-03-16) over to
+  "LogoOpenSSLDxe.inf".
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- For more fun, upstream completely changed the way logo bitmaps are
+  embedded in the firmware binary (see for example commit ab970515d2c6,
+  "OvmfPkg: Use the new LogoDxe driver", 2016-09-26). Therefore in this
+  rebase, we reimplement the previous downstream-only commit e775fb20c999,
+  as described below.
+
+- Beyond the new bitmap file (which we preserve intact from the last
+  downstream branch), we introduce:
+
+  - a new IDF (image description file) referencing the new BMP,
+
+  - a new driver INF file, referencing the new BMP and new IDF (same C
+    source code though),
+
+  - a new UNI (~description) file for the new driver INF file.
+
+- In the OVMF DSC and FDF files, we select the new driver INF for
+  inclusion if either SECURE_BOOT_ENABLE or TLS_ENABLE is set, as they
+  both make use of OpenSSL (although different subsets of it).
+
+- In the AAVMF DSC and FDF files, we only look at SECURE_BOOT_ENABLE,
+  because the ArmVirtQemu platform does not support TLS_ENABLE yet.
+
+- This patch is best displayed with "git show --find-copies-harder".
+
+Notes about the d7c0dfa -> 90bb4c5 rebase:
+
+- squash in the following downstream-only commits (made originally for
+  <https://bugzilla.redhat.com/show_bug.cgi?id=1308678>):
+
+  - eef9eb0 restore TianoCore splash logo without OpenSSL advertisment
+            (RHEL only)
+
+  - 25842f0 OvmfPkg, ArmVirtPkg: show OpenSSL-less logo without Secure
+            Boot (RH only)
+
+  The reason is that ideas keep changing when and where to include the
+  Secure Boot feature, so the logo must be controllable directly on the
+  build command line, from the RPM spec file. See the following
+  references:
+
+  - https://post-office.corp.redhat.com/mailman/private/virt-devel/2016-March/msg00253.html
+  - https://post-office.corp.redhat.com/mailman/private/virt-devel/2016-April/msg00118.html
+  - https://bugzilla.redhat.com/show_bug.cgi?id=1323363
+
+- This squashed variant should remain the final version of this patch.
+
+Notes about the c9e5618 -> b9ffeab rebase:
+- AAVMF gained Secure Boot support, therefore the logo is again modified
+  in the common location, and no FDF changes are necessary.
+
+Notes about the 9ece15a -> c9e5618 rebase:
+- Logo.bmp is no longer modified in-place; instead a modified copy is
+  created. That's because AAVMF includes the logo too, but it doesn't
+  include OpenSSL / Secure Boot, so we need the original copy too.
+
+Because we may include the OpenSSL library in our OVMF and AAVMF builds
+now, we should advertise it as required by its license. This patch takes
+the original TianoCore logo, shifts it up by 20 pixels, and adds the
+horizontally centered message
+
+  This product includes software developed by the OpenSSL Project
+  for use in the OpenSSL Toolkit (http://www.openssl.org/)
+
+below.
+
+Logo-OpenSSL.bmp: PC bitmap, Windows 3.x format, 469 x 111 x 24
+Logo.bmp:         PC bitmap, Windows 3.x format, 193 x 58 x 8
+
+Downstream only because upstream edk2 does not intend to release a
+secure-boot-enabled OVMF build. (However the advertising requirement in
+the OpenSSL license,
+"CryptoPkg/Library/OpensslLib/openssl-1.0.2*/LICENSE", has been discussed
+nonetheless, which is why I'm changing the logo.)
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 32192c62e289f261f5ce74acee48e5a94561f10b)
+(cherry picked from commit 33a710cd613c2ca7d534b8401e2f9f2178af05be)
+(cherry picked from commit 0b2d90347cb016cc71c2de62e941a2a4ab0f35a3)
+(cherry picked from commit 8e8ea8811e269cdb31103c70fcd91d2dcfb1755d)
+(cherry picked from commit 727c11ecd9f34990312e14f239e6238693619849)
+---
+ ArmVirtPkg/ArmVirtQemu.dsc           |   2 +-
+ ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc |   2 +-
+ ArmVirtPkg/ArmVirtQemuKernel.dsc     |   2 +-
+ MdeModulePkg/Logo/Logo-OpenSSL.bmp   | Bin 0 -> 156342 bytes
+ MdeModulePkg/Logo/Logo-OpenSSL.idf   |  15 +++++++
+ MdeModulePkg/Logo/LogoOpenSSLDxe.inf |  61 +++++++++++++++++++++++++++
+ MdeModulePkg/Logo/LogoOpenSSLDxe.uni |  22 ++++++++++
+ OvmfPkg/OvmfPkgIa32.dsc              |   2 +-
+ OvmfPkg/OvmfPkgIa32.fdf              |   2 +-
+ OvmfPkg/OvmfPkgIa32X64.dsc           |   2 +-
+ OvmfPkg/OvmfPkgIa32X64.fdf           |   2 +-
+ OvmfPkg/OvmfPkgX64.dsc               |   2 +-
+ OvmfPkg/OvmfPkgX64.fdf               |   2 +-
+ 13 files changed, 107 insertions(+), 9 deletions(-)
+ create mode 100644 MdeModulePkg/Logo/Logo-OpenSSL.bmp
+ create mode 100644 MdeModulePkg/Logo/Logo-OpenSSL.idf
+ create mode 100644 MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+ create mode 100644 MdeModulePkg/Logo/LogoOpenSSLDxe.uni
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index 7ae6702ac1..a3cc3f26ec 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
++++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -364,7 +364,7 @@
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DriverHealthManagerDxe/DriverHealthManagerDxe.inf
+   MdeModulePkg/Universal/BdsDxe/BdsDxe.inf
+-  MdeModulePkg/Logo/LogoDxe.inf
++  MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+   MdeModulePkg/Application/UiApp/UiApp.inf {
+     <LibraryClasses>
+       NULL|MdeModulePkg/Library/DeviceManagerUiLib/DeviceManagerUiLib.inf
+diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+index 31f615a9d0..57f2f625fe 100644
+--- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
++++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+@@ -176,7 +176,7 @@ READ_LOCK_STATUS   = TRUE
+   #
+   # TianoCore logo (splash screen)
+   #
+-  INF MdeModulePkg/Logo/LogoDxe.inf
++  INF MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+ 
+   #
+   # Ramdisk support
+diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+index 3b0f04967a..27e65b7638 100644
+--- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
++++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+@@ -348,7 +348,7 @@
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DriverHealthManagerDxe/DriverHealthManagerDxe.inf
+   MdeModulePkg/Universal/BdsDxe/BdsDxe.inf
+-  MdeModulePkg/Logo/LogoDxe.inf
++  MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+   MdeModulePkg/Application/UiApp/UiApp.inf {
+     <LibraryClasses>
+       NULL|MdeModulePkg/Library/DeviceManagerUiLib/DeviceManagerUiLib.inf
+diff --git a/MdeModulePkg/Logo/Logo-OpenSSL.bmp b/MdeModulePkg/Logo/Logo-OpenSSL.bmp
+new file mode 100644
+index 0000000000000000000000000000000000000000..4af5740232ce484a939a5852604e35711ea88a29
+GIT binary patch
+literal 156342
+zcmeI5d(>~$xW~&aw_M64<QfWz7#dP?t3($>NYZ7LkVerMIgB$pYT%5)88Oa?KguvP
+zI4QXdhfYMHh=?MQLQ0BCrP`(4zMRjyzxCbEZ>}}xTJLYa@9y1uKfkf|+RvQxna_OY
+zcg^)(&zft#YrS&!|2yzL>&^VO;olbgyJY?K);pa4*I#cF_W4_@5Lmu^`C8SVd%H7l
+zd)wQ-|NZYj=s^#f&XKk6aIEP)deoyH_4&_#{_lVP`%O39^p&rC<)truY4^x-xPS12
+zA8_cqMVXTbv=CU+PmfmLR(siwJMQ?$KmPI2kAC#jEw6otV@>bT_rCYN4}IuEk9fo*
+z9`Jw%JnwnW`{56N_@4K?r+a)K^O(n6am5v{dey7CMVXTbR1sLyPmgNHR(rvH?sK2t
+z{N^`rdefU$rRBBnaIEP)+Is7)?{~lZ`Iv68#THy*os7a;-tv}T|N7VKug`SBI`Auw
+z>$~3du0Q?hPm32XzWnmb4?g%{15l_rUji4jU;gr!cieHu#TQ?^!wx%KcinZIMHId8
+zg)jW^kAJ*q(W0AgzWJNq{N|IN{Nz{>pwXu-Zb?o%?X;&n<tedLa%?xslom<X-FfGo
+z|N7Uz;zQR$QEQ9?GD3Gi=7I|@pfCK+KmYs#4?Hjq5uDk6`|VNq*T4RC_0?DJzyJQK
+zsC})Wq6;y((@r~m>s#NVBjEGTfBy4FKl;%d-}uI8v#o%s?k`p^WRzo0Z5W`_D6$a?
+zvU$J(2b_EExet8c17m)1nB4m7UiZ3R{Nfi*BE(uTSy+fksx%IV4gTQ|e{hr?Ww-vE
+z=R5~xhBrCvk;!o>!l1&Sj-5fXjcubxvmIcy6SJ0&Z_&>v*L;pTROffdA%`%YZ@cZb
+zGtWE|{#~+UiSoP1LngcKx~odp@_mG9&pr2qcDLDP8zy2n62JT1?|jZjwJsve+I;xK
+zAAazIAN<_sKKHD%&VqxabIv*Ey!XBD-EhMVIrk1f{P45SKHGJ7*<}|lfG>O5%V_KI
+zkAM6}Kl)MV#-$cwyHQ4=NV*F2hx0h2oI=gXkq*en7r*#LxRv|jhdksVSmqi7p`3W)
+ziEeb+vSmN}+0U5OqLfQL(CxO{ZYpgwWM>Lj-}=_KUVr`d?|kPwH`!#9``-7y%$@DN
+z`|iK}?Qi$mYcFXIDioIOXHAIujbYFz!m^E6AoC4xcmv_gBOm$5sDNA?CUW!x)en5&
+z1NWq6{*TsTvak@7jl&TwoN&SkhBV4Et*-cSkBlh=BJ7dh{qA?)Q#kYgpu(Vzd)LOc
+z(W5B_Snb5D<<krM8Rdr0QJ*T%G?&$9Kl|Aaedt5q{N^`bbkRjt=pxTd#b-YA8EUQl
+zKchfbq0T+_*u#B>LCly@%?cI>&^Fp=BPF>?_bNldT>4z)+u#27YhLpjCu>496=n2`
+zq%9Qrwd6<#Fw4C#mkJZQ8rook4H!=ZYf93}YhU|X`v8nwlay>URP*iUKmR$=oUKWC
+z#xtIA)m2wX9#kkS7pA(&sNWa{jUsH?hy^C{fbL08dXidnepD`;;WG1r7rY>5##*sr
+zEnhmd!x1e*1U}EBY@Jh2J@qF)`H3#H?75jc<&;xgiZG}!QU|p`Y->H5Vt~ai6ep&O
+ziu?j?sWp5q^a*LXW3%!1z3+Wi=ps)D$Ti!_YqMY!=;Vzz-e?*niA;_<AJw{W#8P-F
+zCZ+ter#+36>Zd>bsq6mZAOCpR!ye{jO^BwVjDC@{g(AO}9O(dN&p6|Zcf8{rwr>Gm
+zcFayIJX>%P5$iSAT%%;8p_*^Ryf$TlM-$gxd##d#3Wa4GsR>cPF$@|-Shf*_BaS%Y
+z#V>v_F)6o1Zqy1<*`*SIi=M{JSSwbn<x8h_IHKi^H{SS?OD<7Pl&u5c1iZic)vw55
+zPYCS8DxE<E)W+zbHi&JlM^g+iInTa(VydW{U!X0uhR=omt+(FFeX!eo+~Xc+g)Z`x
+zdj8N=)=t4F&^=~kG;gb}a*}(FCaQITC`z4#i;q6~=*up<jJqdTY_rWab6qT>7Jr_#
+zunqzWPDZ&XvQ9U@R%@gK7-TBov5$RhY(g?)l=U={X(e*v{qKMOJMX+xMU94Pz7=gT
+zK$&oWDS9shD0dYK%Z0&iGV0@SZ5T9)uxTR*oS96Nzv30Ih;3ORDn|w6yY9LR^kQbL
+z6)V>ArBgc`(K0eOF`Vtnj50aTeC9KGGQs>99pRF|-5VhxgMk|n=?^N5F(Om!2eGa7
+zXo>+=J27kdxL2Spw;Mhe`W)6csCX6^6$<28Bf(=2BeOOO5d}tDyv8E)+)SNE?coo9
+zcnyeX1RW>8{N*n*xx=HXCqD6sMO`e%SeuE?E3dq=(21rbGd`rlvoE(&)GG2xa@ttO
+zr6V1nB10!Wy0xh|N-zrvx`?j*?Qefmve6K=YCQscrpy44<v6$8atncWoEpM%TfyD5
+zOKl<QH-<r@2>UjIu+>&u@o@F|&wqYw*9uWNDj@g9zr9B=S}P1vR686+b07cs$M@cQ
+zZ)HZA9HQN?fBowS=bd-nQAZucL<BNN<e-BNlK!B=7$Y*peh}MQkER%4wG*?Jk9!5$
+za=YO(`jIg>9U`|p;R#QO1`FiZ(fF4s%Qz?d>Q}#-r%VDGuz30;xx0^0QtBkc5pOzT
+zMP`<n_i+x3u2}-%qy?KI2ieQE8H)@%t3@GJQLXK^+fEA9!X?Qg9Y7gIU_L>$;+{w6
+zH{5W8a%j}gD#>B0jui_kYBW^q5l}N;zx1Uqap~gzJqA9qIjB&8pjwT6)Nc%fMiIts
+zL;~R<E6L(oPAf#^!mHl--`*n_trZ3-svVA^Ip*035tJEaa=!3|FC2E*VF<?^cN{an
+zpZw$}k$H$uzVrtb#u$+)_Ji2gdNjoVtDTs&eB3M0mfH=V(T|M5>A-VBcb3QU(O`l6
+zIy(Q$Di$8xzvx9TA}Aw%VZuw#mk2g_!UjJ+^{G$gxsyS(5TPW~N!DpGeTFqynDq~e
+zAXJM7`Yc8PcUBaz3W6s~uYBbzZP0>Ek#qa)w{yJVBdQ#G?6LfPl+~gTtB}u)3<H!}
+zOgDezBOgJQ@<<0zX6g9rU;p~pgk<J_zx&<qN?y8jDNh()@{*U}8|xq9T7^bKwH~n|
+zXWMPJ?Y8KgL4^VYSF8z9zcvi0+bE*cMlA5;4GMOE>HMf%xC9#(>mO=IFj^}NHV#Lj
+z$@Btox_pQ-IgClIHe-zhH`?@_%%?y7>Aq1LR2XAKO|x%f+vw301FUvp*79+$KwECt
+zeC{#^7{V<qOo9rSOuO{bOX-pOULeo<hfja{(=J^*1?~;O)IW6+y5!tu#Iq31@hO~3
+zI7SRYrl&O{C>ZHYZoc{E-}%mW2voVQLYHuQRNHUA{h)X_hzVlkSY+9jx!LDA1`EGb
+zg#`eGHC15}Sv~sHr#__|W)Fy(d7O&p)Q#&m$2fqIefHUh=5WAXA%F>lD`sK7lE(`y
+z{J8MK3u%RiPAnaZ%DoLWdPG>wn!IQMnYBB|AAh_u2NjH4VWgHU^m~Va>NbjO!~#{A
+zSpxPWk316D`Q5{0$CzeeHqc3g-XmC8h{?gjVK>wY5AiqMbkjm6)bI=vrBw0ib@-RH
+z>Vpax9HXOlwXb12*rVAFu-b`P%g4O}G`rpFb1!2Mze6DWl>m3uET-nfk2AvYC~#)Q
+z#U5^JZ4<b$t--qHc9p*$iO#Qj2f3KD%!onr@|V9{>wkHy#0}}mC!ZV}nnU^RZ+|=Y
+zYqY`)8dJ|u7}r83g1LuKD}xHN?e%Q+dpm0*7JAi`SsW&7f;JaRFUuvrX05PLByDg|
+zAllk@-+iSP<-v;UltS$&%oPYmp6Hm>!3=}Bvb><}5SbEG_RcCSXus>u@z*u6a8AYz
+z7izBaM8PwE{kCWk0uRUH)jPI0Co(scOxLgqhv<*VAC~SFF?CyEOs~<Y{if>z)>P3#
+z!%lISq9!v@kf~Rp)vOg3iexm{mYHq*+~+<gohY|!t!t&VqcB%E2zeG7{rS&-E|$&A
+zRTB%*&a<BNEN1AqDOiZk)nlLW-p=>98SlwjuW6_)6kV?67iuJ#*kP`pX+h-iwYql3
+z<ZvD3hF6+V9#ePS(OC^gfeB*%0MAbg)*WoKr-?u!kO(9Ki9jNd2qXfDKq8O`Bm#**
+zB9I8o3j*^!p))T|r_psDfqQG*va*mB>-vj~g?13`Eld^&4y-;r^w2{Wh%;l|SjUgq
+zSeR08fgx~jjawGs@)w~j^p1arwm`7Cw=h{C-RF%Qyl-TII5XCbb^Mr(g(>wG7y|e1
+zxc%S<KgjCC1qR8yFA-U2{Vn`qvGClFie8IFrjr)%tnm{2=r>hrZ`6<0RHgQodrAoh
+zSgFbiHWu-)l-PgPQu`<dRrqrq-s8s$rTEic{^Z79@#o0g;&op=SNPLN_FA@n!=*+?
+zDB|xddq34N2I_`R4OKfVWC~c?-(29YpLt&li<Eg&*GVUx#G5Nv*-lcX3d@bIN#Fb0
+zQEpq{?RT^o-vc0nH9Vtx4RC7Xw(U%#3-Zc;X2wY7mi8}y`3rA*P?7iitvoODi?70Q
+zk%V}#Vs|Jlk~I(tgDi;yipIBBWO)iq3V&j<{dE;uY%5@@`z!i|LXlG>y9%`-LB*)t
+z0JfJO;vrk<L$v7JBGX9=Xf|GAZ#xK$H|j@gXg1z*&)??qN4GEne;CG_Rv;<Nsuk96
+z_I?zDn>hX;mA~d>btkWqVqn>;_z44NA{74Ak~PcLuen4MjgB<FFE9q`noa{%J1h_i
+zSlZuQ;BSZcQxUM`opT8MStqY4@S8si%Z;u@{HFs43mj<vnAm^aAe)Uw?Op?%#<*=*
+zZge5`RIgdkcTBiiGoIu7gV5yN6#O|1L=bC5IUX!`M+!07a5Y*(9{lzSI@4hi{lSQn
+zgI`w}RIsU{FEKf&Qz$fsM0CCZY>gk{AzSHT(Yy+ZOeZa@tiM7kUSc0hsS^LlI)1XD
+zu-16XJ)ss?51ZxhVqLfPQ4C%L5#O@rx(KctGrRePnv*rlR;al|6OE2EzAq5{Y(Q<b
+zsMA2z4y$63Y=3is8xgLBZjr+pt4A4~kzJb(99~t!i$vfrZfN2kST-89du?!P<F;YB
+z(FJ3LfCF)Qm&l!0GDZd7tn~i(zn}Ni#LOtW3$j)#YPcG!jQRG88kz!==xX$q36^+L
+z%bz*_{7TV!?6u@Vp)n+)^9^7J`C-C`qWNB*tYaaX=)S~0mQp3Yku!d>p|I9?%YE^}
+zI*hok1sdfQXioAP9eoWfIwRRSMNyGoOV%t~-$LOM$wo&S-xsi-ZK$PI=rmA`ep0tc
+z(oF(eLQ9I+7awKdm9>0KkF$k?%PW5P#p+R}`k1bvHXS&GicEk|{j;C_EWrzcevL-$
+zUK^a+xNTT&bm1PqX8y;4XdIcl2P^Puz~BG=_e@jpx6Zr{$@x)m7i6tg)NnOc8T0KG
+zH5A>B=W?T==xX$~`@U03=lt_4MeDKGk_&~#kciGV`a8%E6FwBp_xfZV3#dVMwXaUZ
+z2B;E&W>opzX3-i|8gIELz=^Lxh%fXhj5tY^-q)GakaeP;-TXq$$(m&=SdjggY;>gY
+zeStAh*K``FM#qZo4}NojNb{Iuj$sypfk>ygGmX}wjO9kx1d;aBfx`z$^%@;M!5Lrf
+z+-TJ9wZW;4+lJ*v7h+FwAdY8bDq4Z}&uQj?7ma@66Q6K?6x;<eqg*5#u10HPzP%#L
+zQ()3?FZ#e_HxmwX{`r-n_1L21LZLAvgn()_faOs3GEdRa-JbO3k~#P-fW}Mg?>4>S
+zKTO5P2=S8*6vcPfH{Np3Gm5CmMc8gzP@_&Vq*guth16s=KKiU#cGDILmq<1`()hl>
+z7^rJH4OAO`j``+-dZ#@M60IS}<JIU|G%^J^y!n^Qxjym7CvR!UZ{lw>YFFFf)W&VY
+za-$2er#KLe<3FBAfjbEXm_Akn+3^P3!IK$ly=N;18?Huw#(aAP{le{dE;kyYR_}R)
+zK~7|@Gz{JO`}_*6#~(K+ykd}PdUv1FI93}&LI|j0qrZdv;HGB;nx9CoNRT=BEr8-y
+zt7}9#n2J+f%pdua4HU&^);zX~Gqy})`@0yYpMHAO+;!Jo?Y0FsCxJJh*WPbbRI%qp
+zKFQt>Vbm<Ux`o0el8ugF)~`ZFGk&UL4AeE92C5A|$9!|axFPVI(;w*|iRE~_8eNM<
+zrT~ZUZ!%$LBfO}dN6$(&8g<9p;MB%#!*Zhwb`k*x;#3L49-C4iKYl>=t6%*pub_){
+zCA$l<)_b;6)NnQ0<R*s6gqR~aetU%+8l3_YYW1E+jF8pv`IQJ1UEuzkm!JLHil6$3
+zLL94&At3}*s{t%Uz06a1B0K&3O9+jX?$;cmiN;Ip?>4>SzuFu1i70ta6~A`DdXC=j
+zVqk`4D7>weC&k1#JZWL!jy<uUMxErF8jNEmD0xQD`W_yP*emNer>LuB?XwXz%QkDF
+zYqrr5PP5vlI>ta<(`lgE@N@8+3#<j?Z?p*F7|=WcW9@+^Vd--B$Tqqrh_s&q9InuO
+zW86ldW8TECWTR1cya7&a++w_8xzPnXiGXpYZWzgo=PkF~lEpbpo=D*v-}naPU}ath
+z`n9ip%}ERH0y(v_m7<2LHia<e+bgI|he_=`8vMG-ph5&8b|=ccI>4^wr`@sI7!sJZ
+zwFa<*{1Dw+X))&ZehVNrkKA~Py-jg));`(L`|f%k_;kOEA#2R>F-&>v&SO*N#SDZ6
+zsm0{}`|r=14;<iOB^)7z_z461*{#cMAoJ+84`K9LcGDKRX342_gd$=$o^&x@i%)fo
+zfx4m7MYa1;k_gL~?<w$<@03$cA?9VM@TCT(EHw#0FM5w`t!skF`&og*3*%t~F0rnT
+z%*32u>04_w9-uBbSZj=1wN<lBX`>7F69<S`8Ogv7dVc3J@g`)t#THvwlN$?i$afAx
+zJXj=aXRE3-T(wQ^$8m-+?;He<BY}?J(>NU_jq_;m>nei^@i<1$qui^bsVeoc`^}x+
+zAt9U5S_9ZFKNN>-rH9d?b9*ygx)6j_@o?%-7_>V+olDczYI`!KG(N+W{yf1l#+jPV
+zJb^P$W_x?l+g5L8Z}nPcJXou4jWBREe|v>~4Sro^P+?5R3mxu;`Kr^$KK3!bc3Q)B
+zp7K{7GJLB2)HbE_<iuQ=T@??f{)9o>`RQDmu2$QVk)=!-$B&ZC6D%X0=~bI2aOTPE
+z_%5uv1My(3x-~rK2`X_PQSi){S60inS7?;G_|^RR6>cv1OD?_>7#DK%9=JKrjE8K%
+zc<qSR@(0Y#L-BlgvWhmRt3F+=IYD%Rf0Tqi&J#HEWVZL9^tRQT*;{=~=G<Bv)8aa-
+zlTfd-hdw)=2qXfDKq8O`Bm#**B9I6q0*OE(kO(9Ki9jNd2qXfDKq8O`Bm#**B9I6q
+z0*OE(kO(9Ki9jNd2qXfDKq8O`Bm#**B9I6q0*OE(kO(9Ki9jNd2qXfDKq8O`Bm#**
+zB9I6q0*OE(kO(9Ki9jNd2qXfDKq8O`Bm#**B9I6q0*OE(kO(9Ki9jNd2qXfDKq8O`
+zBm#**B9I6q0*OE(kO(9Ki9jNd2qXfDKq8O`Bm#**B9I6q0*OE(P$0lJ{_>XytO^3f
+zh{|LlkO+)LU{y}MteXgcz}TUddWk?HP#};Dk_fCK0>y~RWFn9Vj77lb-f>49a@bDW
+zvK_w54ib*s{pCdx<x~Ir<7gg#)M1ScwTsR@`}C7e)OOZs|6@4{OP4Oa_R1?RyYPbc
+zhT5$+--ssL_19djJ;F`bU&mfKWG-E@<gUew?^tx3wma{*BMKyygEe<Kg*icB>`+U+
+zL?96;5bzlY?QXxpdau}UJ@!$syxXQ5q73aGyxmqJXzi(}&18)loO{B59Cgxv9?fRK
+zGC6E8Cd>;{dpqxp|BbSes6n+?U4Ch?snnTE?z(I7op-|2i*CK8u_ga<bby^J7Q&qT
+ziV>B`L?96ui-6BS*c0;IaijISoAXhIH_;?CZfvMU{uK+yJwdei7xpya)&%n}p|03g
+zVec{f?S)OK87d(k{zVgdCG2(Zi!3fyChT0}-(|~|8H%-D_{5<Ha3eBxHw&!B4z<)v
+z1QLM)0iT5MDWR^&*Mw_9`6v_rt|I?JzT#r&a#s9HMa_-C-Eb}>vhUWL{rld#LnSaW
+zdl(rV7+DHj1K8kV;$k8`8bucWQk^8VFrw)cWOAsE9fgM<J9r<8$mhZ!wxSe=iM!dP
+zzkCI2L+;e2U4coXRAG-AITXSB)TL3G;*tQ2m?D!L>ChaRR3Q`NWYVa52T-<54&6jk
+z&Cv=uR6zkZFhVQH*dZSr$fT4W(VQxhqq!!O$+t`R2|g(6prEYk>W&aoU2^1)_Qi<G
+zWFn9Vj77jF60B<e?S{bSU(U&q{LA^w#`!Fv*kech3sXP=jSV&Ui*ud{5GV=#y*A$j
+zvyce<i&^&Mvqy)y5fs=%A~XR{5f?98wv-~c+nt4X=mq2}@}lGDV-}V{P2@#gQ830K
+zBkEFwpR`C37D!^5e5jDtMSLW2OzyEKiCOqmb;+SojL;%7MOelZT~i0i#4&Q%C{<sO
+zvBQtLY`Dt)1AFdl9jaiHq|Cza)Wsk=>}i57aDByd`it`*14L?zOuC7O<Up?iP>`Zb
+zMM~LYoFcX8D~-GwJJeDy5l93I1au0qhakki#Jok=YdS`4B>zGjXmW1XHcBB@&gTa6
+zs!05+XpS?VO~e5&U>wSTeIObr16HCJ=3h$T8Xn3K^O7k}fl8n!+7)NPDOiU7AT<=|
+zAg0iv6iR|pQJ^_2tB8suu`CO^6X)`P8r~{yrBQUWrxs@M8M7#08Fr>RnN-mpQ<UNc
+zq=^DVi8ELrX`aOnKQTK3U7)Af!E<nsaazP}?9h<%k<Gs}ho2N-AG0)s9rUS=Sv*96
+z_!m<&jbpGj)#WgIoYW<RDl@KxUooOGnFu5TV-fIq#CawDHQN>fr!>mb@vk@wzKEOR
+zUl^giiGN`YjEEEA6vzVN5F<bqVl?a^Ll%l0QNY`odEuoq@h?SKfKwE5sxH(+5nY2{
+zsD*v<v4DLjTlypc2QFrh49#JLQZ$7gyoPZ~$su3Ni)9?ZAjWY_b@7wdQAUl6oOEaf
+zfgE&@+2fLZkg^&=4GWSXN@RS-INqwFWa_FG{*aFwvPP*Kzz$u2<*BFxs_wHVM_92(
+z2Ytwz9^sxaVb3K^K4?F7sHI*akO&kA_(bBgcjW8%*TU5E51hc-AOg!0X2rkI1QZON
+z5veIE#2{P%(ZCK+344-o4Q$9B>LCf^F!?L~r8=F3M#awb7i(l9P#3zPvj~*JI}jH6
+zvH&a53YyTC%;Eq!I3V;C|9bv`y0Dc<P_9y!4YSy!AzGmqSi?Ouu_F?MQZXVQs7^1?
+zN6mbPH8o0qb+telC(*%4O7RD5vB{o%TBIQupGHN^7^JRyhcznV8_KB3Np2~~CkKD%
+z8p`T5nV97wjVTWsgknTxG7(4w#v<SoiF3^J4@KnbB+6n65lU^38YeuO;#u}Ob+uO}
+zrL*E+g=R1UG$8_os-P0`B|uVe4L9c8M6*YRJ0v^)g{QCpPsth%u%V2@=z{<P_MslA
+z8G}?OhaW*Stb_oYlSwTlR}?O%A?O&ogbnE(eTM<9jDRu~RhMM3en3gwpcNTJUtv3$
+zw53e;Vq5k!M?=a-hiPbx$j*#)o(e9TnWGSK!@{_PGG=3sP(Y0z_^3Pbb0#ZPpHaA{
+zzu*RdGYa81cBrLZB9I6a2>3iAGIIQD!bNZhJgfN!PI&Qb?_NaASq*^_Otm-EAV*Ox
+z71_`i=aOjw!h&w#6gGH-O)`5(2Q@emuc)h1sN`<Kx(5PUL1d36lzLD0@c(#-S!%H%
+zU>V1TtIb}6UZ^3OpwW>AaE8mtNaaDbuBl=~Wik;+1jZuZ^Q{*DihtS9mVXuh#+bL@
+z;@R>q?8C{=X3m9KyurT&nC9F<fP!Zt$|Xw*&UN=wm>PkxLoM|ZfkdD{z-Jwk38Gqf
+zHpah7vXA`BO=$0i5#66E{x$h3ZiRo9qrLf;XpXS1wxOo@H_~pDMZs<UH63%W?JlP<
+zCkPZHDwByoA}|(#IXMHTH!?F*IkZi0J!`HG1jY`v)Jp^sfdT=apgiX0!48uK+ALcj
+zA7!FcG}(x7wMX!#9Mp(UiE6tWu_~F`6WF@-6xLh>iV>B`L?96ui-1pi)&}t0pQmuO
+zjkyJsVOUM<GMP{aPNG(uQqU7BO*JrM;MP-Ea}gLj)KV`INCXN5eA>gmwe@7qN10I9
+zJnQFaaaNa1)QE6v^SRD1_?K{4D-+mj;go%g0uR}&)}73yl*wXNFR*9xaw{yTA~}>Q
+z^yXO{Nm+}UZVorxR_(zZI&Klm=)3wD;a`iFUw_NQw&>0=^=5RKxw+-`m35JqR3^8{
+zrxeR<HJ#WhYSF8<OT~!FWFn9Vj77j_9rFxCzNXr)5Ff0Wd3yzHPQkx~%q;BHCK9)A
+zQGn}t5{MdWV43A`5d=ytLU>A9$jrv$M08l~3*$q$_%GvhQ_IVEC`YEO>5ms|O#*GH
+zA@<#MSL75e(kPl-$q4fcQ$-RIJm=Eod;Hh(Est8h-d+>i#s@Dy=!E5`oxgl>eR>8$
+zM1krkyE^g?$1Xqq%o*w|ezZlY+Pe6vqHrRKSz1RkS|&+b80r0u9crnU2qXdp0zRW)
+z4VIvFX*cGe+#CNEER5O|{0mEpG}#kk+p$8R2n9A4Y0!#FVNzIC)uCM}cn`xyUWQdw
+z3l@f;rKYP((H5Gr$(|rLmcp<mdN*WceBjS9dShygKx7c5d9x5qeCYIYCG^^;jy34A
+z;7VB4trSJ>6r6t4$t%^Y9|aV;zhXpXG7(4w#v<U;Y0l%{IMwSp2Md%I^AE(oS^x)&
+zwfPq{Ht5g%E27k2izosmhpPf4NTz7fi|S}dy@r3`Ww9rJBxWcq*ep6R{-qbRE;lH`
+z2v;wBhQ!sJ_Sh`?h-Iiy3~Qc6fKRnKQ>;g_pi8C^6vkSC$P`*s&}yzMDvEz)yfEm_
+z7UYXRGFxzcmx9L*wbV-l5`h8%pMLP~9LB%3=Wpg;go2x>0+)%o8vF~Zq89m=8Cd=C
+zh%$?Ne>j>DUY1daGYOG@d*ffVC6^rkGL@mInS2bQ<2aW&VtOG?S1le_8es(DS&^Xk
+zFeC9Su_qJ3Y**b-5;U4*`X`oDb(k?0LCujvDP6ka&x@(cq=c!tmw#h`jB%3jM^Y`y
+zNMWHEQJG8x5`nP@_%s{jUojMf0^?{?jOnBWY)-+yFfw#D$iGlCYHW^wp+8SPz>LgA
+zxKk3KPLxHL@UNLv{EI2rc`*KUEoNYRognNj+EU-$99$e9+{IXuxV83N3s#LmE}Hr=
+zBkX(#u{+O;T5Q5ZDS8!$I`eL$EB>Pi6EtMq{Y3^R){eiiLoM|ZfkdD{z$en+`~y)W
+z%9{V}WnN{nM~$enJ^#=f|B6^)w^_x%G{;MG9N{wOK<i8w#Q2)WYbaoUR{YBqMYY&_
+z{sGQaTM#;z83Pyv*j#-<$HWcsnd6{B!qvtvM#?B_A~;&;Wl0Q5M^x*%f*9U*`8UpK
+zK;OMT)>>c$Hz0j310?+`MpPyffka>|0zQid`L~FF3kr@&Y_87uSIrS}iWU{m5(sm_
+zfR~|it^|;>m=rY=;$ZwM{#8isTHt^wHkxpzVUz$GcE%h%7-JSj2s6#sVp|2F;#SzO
+z_ebn31?oCbZO6anda6(t)}~_IlT?l}i>Aj8wbV-l5`h8%pTqEPT<Xx3#lMaCx0rvJ
+zZTvfO{=qRROzP)v^a7gm!!+@u_b@UX%GMkIN^NldLGdq>zaT>uOf~q|a}+cx{*6-y
+z&|I9i^&uz(0##TKvO`&G(L4zNOLoIpRVO~J@vqptTM_#z8o4J%4&iUU|F<}$GMNaB
+zM!@I%$oLm#G0)ZnY{HE2X?u(F15{Z>{>1_l!5E<<Tq+<(2pX33R^wk3;8R^)jD`d{
+zsOl&<)EyuHs;>AqhNaBmwkID7H=H#8LX<@iYMn@?(6@eye;fR3%8nG=%~X!f%J}H9
+zmWqi$A~1=7&)c~bc<96*r?r1Yi|~}mZnpEk%p}10SYXp?1Oiq4EgX!@GebgS887A^
+zplJoOD0mrz9rH8-I^FqS42oN=Z$b0F3c5wy+~Y%S;x9i>v;Ihd(AE6tx!s~}q+095
+zOig9PT5<lDYXhyY;js1yY?1nHRz@ZVRHhPvL|`-mJ`b5LAhvC9DC@;KB0KgL#C=NY
+ztH8EAQWzQkcGo{(ABKfk;X8<uj&xfjD5eO7?)o$FGDSF0RP>`Z>N@_#zD%)aez~YZ
+z5<7N=$qFe%>YSQ?x$AdKia@Aa{8+&j*FV6U`iXy47lw^b&!j*|>&ruzpwW?n*q^?{
+z-{`THiitoXFo}RqBw{_Njg6ab36h;eKpBSh#I6J<;T_3@y*4{uSQY-oD<}^_giK*r
+zE(Z32Kp3w?h?ElWdfvn9e<5ELp{eC-=x`~bme@J2n&9f9Xj--4Xoto`+_4t^U{DA^
+zg<d)aMb=iH4Z;=UP{pbyQ<{k68(BWqf<q~SL)l<esF@#iBeSCqmFow~6Yx6jritP=
+zIiNC?2qXfd5%9SLahPzS+PG<L1ACOAHi)vlnfq*fjDTgx4pM`*@T67+$HcRcBeZKZ
+zswiJZ{4NW)QZy>damB9JKZs<hjwS?6U22J5DI!1CqD8uoCi$`nJFB_K%aq1m#K&U2
+zp{qO67NAAg(`<+U3zGvann1}cnuzlcu`V(di-&tsz$`^<zHD^O%GJ?hEfo`iL|_sD
+zpY8DvD<b(u8RhxoU&X(o!pL0qP=a_?+!y(m*;^(VM3>s5qfIuEVafQ{8IFHZ(DOQ1
+zL2xbpxXzOgb_Q=@TibU<H4QI=o0TO*-c;0CC=^M8Py$ah2~Hi2qC@N)X9Eg86{Qwa
+z6XsudInuQ1dOiWQZmI1n+%B9XIXR#*l?WsPqY?1wr1)2%Zsgo3qYUM>gI`Lgj(=e>
+zMU)Nx<vO9YaXjPljlX-r<pCB}%u85Gl**>~l!_3pH4%7MB!8D7Ym`!#`P^=;NZCbo
+zYOx$bt!NLA<3PMHxQa+n1P7P-kAtlc1qjqsh;qTF)Ya?(MW}frTqQq}wQSO~Vq}Qh
+z(-f*jPBe}T?|02&p|)mY^jJ&9L?98EM8M}fR1&GSE3cmU2gQ#K{<Xtx0jlLuAq36V
+zUD(j5%f*8#)Gf$*unM)>RlEdP#0v4%e#ImMtXlgq`3qxe(=<X&v&d&Ygj$U%Qb4Ch
+zyEZsEpfZ&RBm$!m@L5#M|MmvLD9=g!OGL>XJ#6JYIXtR@d=>u^LP`e(>mc9&@wKiE
+zc&HqAVc`n|ry^h7)I+R9qY#{9VVIYkI8%WpISctWdaR{lB9I77BH$Byb;iFCsAmRr
+zzpp*yt4)&zWELCVdj1!(?!C=-j~1rjIaU)fH~SDS;V>JF?D<v+=r8c!<bcXlB9I7-
+zM!@H`<KN!M7si~!`3J&VJ>c?VD+y4lwj$q2yfy#A(Q6|A(gmX6F3%RUOA>-!_~c7>
+zMvt{rOau~vNd(NlgYhpEjPjh!KVV9MEl;c1khOQTTV%Qv2e=GKpUn9EA$Mer5cK^a
+z0$zgOF7uMf$_Hj(*NETbfXY-NkO+)Mz-Ku8OK1r*D%6!w>``Ws028(CB@lz_AM`0q
+zf7)`qfCKTHn1c<ucMDcvF&WReh=>Vw*|W7Di!H#8j2>&Lm<S{SlL+{H9vT16-}+yB
+zlERvWz~q3+R3eZFj7GqxI<X{ws@vXB9;s%tDXjGfj2>&Lm<S{SlL(j{SPiDtvf8t>
+z3nA`FS~-P8zz9qZs7xgSiNI(Cd=~L6i)U-?&B`ex0!Co;SWCr3AQ6~Ez-LjxzeQ5K
+zY~>UZ0V6OupfZ&RBm$!m@L9z4LO1x0ER1aB6cPa=FnX+|Vj_?TOd{a3C{nG6SUEA@
+z$|)oQMqqM4WhxO!1V$s^v#1gOnu4vILLy)UMvt{rOau~vNd$ZrnPj`O5YDl33W<Ob
+zm>f`<N(2&t(Fph~>WzQnL<F*xQ%D4i!054-iitoXFo}TAq9XoPvdFY@3W<Obm>f`<
+zN(2&t(Fph~a{Oz~wUF}<Mk$3Z0;9)TDkcJnz$5}bog&*t+2l*6l~YIrjKJi8%2Xnd
+z2#iL+XOZJy6K+?qateun5g0wzQZW%o1SS#iS(Go<F%&7x3W3Q1m8nD^5g3iYtj@Gl
+zP6WCLj2>&Lm<S{SlL&NAr_4zNW`)4yfXY-NkO+)MU{+^ZDklP61V)dwRJ=D3_<z$H
+BLUI5A
+
+literal 0
+HcmV?d00001
+
+diff --git a/MdeModulePkg/Logo/Logo-OpenSSL.idf b/MdeModulePkg/Logo/Logo-OpenSSL.idf
+new file mode 100644
+index 0000000000..a80de29a63
+--- /dev/null
++++ b/MdeModulePkg/Logo/Logo-OpenSSL.idf
+@@ -0,0 +1,15 @@
++// /** @file
++// Platform Logo image definition file.
++//
++// Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
++//
++// This program and the accompanying materials
++// are licensed and made available under the terms and conditions of the BSD License
++// which accompanies this distribution. The full text of the license may be found at
++// http://opensource.org/licenses/bsd-license.php
++// THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
++// WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
++//
++// **/
++
++#image IMG_LOGO Logo-OpenSSL.bmp
+diff --git a/MdeModulePkg/Logo/LogoOpenSSLDxe.inf b/MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+new file mode 100644
+index 0000000000..2f79d873e2
+--- /dev/null
++++ b/MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+@@ -0,0 +1,61 @@
++## @file
++#  The default logo bitmap picture shown on setup screen.
++#
++#  Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
++#
++#  This program and the accompanying materials
++#  are licensed and made available under the terms and conditions of the BSD License
++#  which accompanies this distribution. The full text of the license may be found at
++#  http://opensource.org/licenses/bsd-license.php
++#  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
++#  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
++#
++#
++##
++
++[Defines]
++  INF_VERSION                    = 0x00010005
++  BASE_NAME                      = LogoOpenSSLDxe
++  MODULE_UNI_FILE                = LogoOpenSSLDxe.uni
++  FILE_GUID                      = 9CAE7B89-D48D-4D68-BBC4-4C0F1D48CDFF
++  MODULE_TYPE                    = DXE_DRIVER
++  VERSION_STRING                 = 1.0
++
++  ENTRY_POINT                    = InitializeLogo
++#
++#  This flag specifies whether HII resource section is generated into PE image.
++#
++  UEFI_HII_RESOURCE_SECTION      = TRUE
++
++#
++# The following information is for reference only and not required by the build tools.
++#
++#  VALID_ARCHITECTURES           = IA32 X64
++#
++
++[Sources]
++  Logo-OpenSSL.bmp
++  Logo.c
++  Logo-OpenSSL.idf
++
++[Packages]
++  MdeModulePkg/MdeModulePkg.dec
++  MdePkg/MdePkg.dec
++
++[LibraryClasses]
++  UefiBootServicesTableLib
++  UefiDriverEntryPoint
++  DebugLib
++
++[Protocols]
++  gEfiHiiDatabaseProtocolGuid        ## CONSUMES
++  gEfiHiiImageExProtocolGuid         ## CONSUMES
++  gEfiHiiPackageListProtocolGuid     ## PRODUCES CONSUMES
++  gEdkiiPlatformLogoProtocolGuid     ## PRODUCES
++
++[Depex]
++  gEfiHiiDatabaseProtocolGuid AND
++  gEfiHiiImageExProtocolGuid
++
++[UserExtensions.TianoCore."ExtraFiles"]
++  LogoDxeExtra.uni
+diff --git a/MdeModulePkg/Logo/LogoOpenSSLDxe.uni b/MdeModulePkg/Logo/LogoOpenSSLDxe.uni
+new file mode 100644
+index 0000000000..7227ac3910
+--- /dev/null
++++ b/MdeModulePkg/Logo/LogoOpenSSLDxe.uni
+@@ -0,0 +1,22 @@
++// /** @file
++// The logo bitmap picture (with OpenSSL advertisment) shown on setup screen.
++//
++// This module provides the logo bitmap picture (with OpenSSL advertisment)
++// shown on setup screen, through EDKII Platform Logo protocol.
++//
++// Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
++//
++// This program and the accompanying materials
++// are licensed and made available under the terms and conditions of the BSD License
++// which accompanies this distribution. The full text of the license may be found at
++// http://opensource.org/licenses/bsd-license.php
++// THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
++// WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
++//
++// **/
++
++
++#string STR_MODULE_ABSTRACT             #language en-US "Provides the logo bitmap picture (with OpenSSL advertisment) shown on setup screen."
++
++#string STR_MODULE_DESCRIPTION          #language en-US "This module provides the logo bitmap picture (with OpenSSL advertisment) shown on setup screen, through EDKII Platform Logo protocol."
++
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 66e944436a..044379e1ed 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -688,7 +688,7 @@
+       NULL|OvmfPkg/Csm/LegacyBootManagerLib/LegacyBootManagerLib.inf
+ !endif
+   }
+-  MdeModulePkg/Logo/LogoDxe.inf
++  MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+   MdeModulePkg/Application/UiApp/UiApp.inf {
+     <LibraryClasses>
+       NULL|MdeModulePkg/Library/DeviceManagerUiLib/DeviceManagerUiLib.inf
+diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
+index 785affeb90..326f82384e 100644
+--- a/OvmfPkg/OvmfPkgIa32.fdf
++++ b/OvmfPkg/OvmfPkgIa32.fdf
+@@ -283,7 +283,7 @@ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+ !endif
+ INF  ShellPkg/Application/Shell/Shell.inf
+ 
+-INF MdeModulePkg/Logo/LogoDxe.inf
++INF MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+ 
+ #
+ # Network modules
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 51c2bfb44f..2ff68102d3 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -701,7 +701,7 @@
+       NULL|OvmfPkg/Csm/LegacyBootManagerLib/LegacyBootManagerLib.inf
+ !endif
+   }
+-  MdeModulePkg/Logo/LogoDxe.inf
++  MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+   MdeModulePkg/Application/UiApp/UiApp.inf {
+     <LibraryClasses>
+       NULL|MdeModulePkg/Library/DeviceManagerUiLib/DeviceManagerUiLib.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
+index 7440707256..aefb6614ad 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.fdf
++++ b/OvmfPkg/OvmfPkgIa32X64.fdf
+@@ -284,7 +284,7 @@ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+ !endif
+ INF  ShellPkg/Application/Shell/Shell.inf
+ 
+-INF MdeModulePkg/Logo/LogoDxe.inf
++INF MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+ 
+ #
+ # Network modules
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index ba7a758844..3a66d4d424 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -699,7 +699,7 @@
+       NULL|OvmfPkg/Csm/LegacyBootManagerLib/LegacyBootManagerLib.inf
+ !endif
+   }
+-  MdeModulePkg/Logo/LogoDxe.inf
++  MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+   MdeModulePkg/Application/UiApp/UiApp.inf {
+     <LibraryClasses>
+       NULL|MdeModulePkg/Library/DeviceManagerUiLib/DeviceManagerUiLib.inf
+diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
+index 7440707256..aefb6614ad 100644
+--- a/OvmfPkg/OvmfPkgX64.fdf
++++ b/OvmfPkg/OvmfPkgX64.fdf
+@@ -284,7 +284,7 @@ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+ !endif
+ INF  ShellPkg/Application/Shell/Shell.inf
+ 
+-INF MdeModulePkg/Logo/LogoDxe.inf
++INF MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+ 
+ #
+ # Network modules
+-- 
+2.18.1
+
diff --git a/SOURCES/0007-OvmfPkg-increase-max-debug-message-length-to-512-RHE.patch b/SOURCES/0007-OvmfPkg-increase-max-debug-message-length-to-512-RHE.patch
new file mode 100644
index 0000000..d7ce5a8
--- /dev/null
+++ b/SOURCES/0007-OvmfPkg-increase-max-debug-message-length-to-512-RHE.patch
@@ -0,0 +1,70 @@
+From e949bab1268f83f0f5815a96cd1cb9dd3b21bfb5 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Thu, 20 Feb 2014 22:54:45 +0100
+Subject: OvmfPkg: increase max debug message length to 512 (RHEL only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- trivial context difference due to upstream commit 2fe5f2f52918
+  ("OvmfPkg/PlatformDebugLibIoPort: Add new APIs", 2019-04-02), resolved
+  by git-cherry-pick automatically
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no changes
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- no changes
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- no changes
+
+Upstream prefers short debug messages (sometimes even limited to 80
+characters), but any line length under 512 characters is just unsuitable
+for effective debugging. (For example, config strings in HII routing,
+logged by the platform driver "OvmfPkg/PlatformDxe" on DEBUG_VERBOSE
+level, can be several hundred characters long.) 512 is an empirically good
+value.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit bfe568d18dba15602604f155982e3b73add63dfb)
+(cherry picked from commit 29435a32ec9428720c74c454ce9817662e601fb6)
+(cherry picked from commit 58e1d1ebb78bfdaf05f4c6e8abf8d4908dfa038a)
+(cherry picked from commit 1df2c822c996ad767f2f45570ab2686458f7604a)
+(cherry picked from commit 22c9b4e971c70c69b4adf8eb93133824ccb6426a)
+(cherry picked from commit a1260c9122c95bcbef1efc5eebe11902767813c2)
+---
+ OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c b/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c
+index 3dfa3126c3..9451c50c70 100644
+--- a/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c
++++ b/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c
+@@ -21,7 +21,7 @@
+ //
+ // Define the maximum debug and assert message length that this library supports
+ //
+-#define MAX_DEBUG_MESSAGE_LENGTH  0x100
++#define MAX_DEBUG_MESSAGE_LENGTH  0x200
+ 
+ //
+ // VA_LIST can not initialize to NULL for all compiler, so we use this to
+-- 
+2.18.1
+
diff --git a/SOURCES/0008-OvmfPkg-QemuVideoDxe-enable-debug-messages-in-VbeShi.patch b/SOURCES/0008-OvmfPkg-QemuVideoDxe-enable-debug-messages-in-VbeShi.patch
new file mode 100644
index 0000000..3e3dc79
--- /dev/null
+++ b/SOURCES/0008-OvmfPkg-QemuVideoDxe-enable-debug-messages-in-VbeShi.patch
@@ -0,0 +1,574 @@
+From 3aa0316ea1db5416cb528179a3ba5ce37c1279b7 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Thu, 12 Jun 2014 00:17:59 +0200
+Subject: OvmfPkg: QemuVideoDxe: enable debug messages in VbeShim (RHEL only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no changes
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no changes
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- update commit message as requested in
+  <https://bugzilla.redhat.com/show_bug.cgi?id=1503316#c0>
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- no changes
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- no changes
+
+The Int10h VBE Shim is capable of emitting short debug messages when the
+win2k8r2 UEFI guest uses (emulates) the Video BIOS. In upstream the quiet
+version is preferred; for us debug messages are important as a default.
+
+For this patch, the DEBUG macro is enabled in the assembly file, and then
+the header file is regenerated from the assembly, by running
+"OvmfPkg/QemuVideoDxe/VbeShim.sh".
+
+"VbeShim.h" is not auto-generated; it is manually generated. The patch
+does not add "VbeShim.h", it just updates both "VbeShim.asm" and (the
+manually re-generated) "VbeShim.h" atomically. Doing so helps with local
+downstream builds, with bisection, and also keeps redhat/README a bit
+simpler.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit ccda46526bb2e573d9b54f0db75d27e442b4566f)
+(cherry picked from commit ed45b26dbeadd63dd8f2edf627290957d8bbb3b2)
+(cherry picked from commit 9a8a034ebc082f86fdbb54dc1303a5059508e14c)
+(cherry picked from commit 7046d6040181bb0f76a5ebd680e0dc701c895dba)
+(cherry picked from commit 4dd1cc745bc9a8c8b32b5810b40743fed1e36d7e)
+(cherry picked from commit bd264265a99c60f45cadaa4109a9db59ae218471)
+---
+ OvmfPkg/QemuVideoDxe/VbeShim.asm |   2 +-
+ OvmfPkg/QemuVideoDxe/VbeShim.h   | 481 ++++++++++++++++++++-----------
+ 2 files changed, 308 insertions(+), 175 deletions(-)
+
+diff --git a/OvmfPkg/QemuVideoDxe/VbeShim.asm b/OvmfPkg/QemuVideoDxe/VbeShim.asm
+index cb2a60d827..26fe1bcc32 100644
+--- a/OvmfPkg/QemuVideoDxe/VbeShim.asm
++++ b/OvmfPkg/QemuVideoDxe/VbeShim.asm
+@@ -12,7 +12,7 @@
+ ;------------------------------------------------------------------------------
+ 
+ ; enable this macro for debug messages
+-;%define DEBUG
++%define DEBUG
+ 
+ %macro DebugLog 1
+ %ifdef DEBUG
+diff --git a/OvmfPkg/QemuVideoDxe/VbeShim.h b/OvmfPkg/QemuVideoDxe/VbeShim.h
+index cc9b6e14cd..325d6478a1 100644
+--- a/OvmfPkg/QemuVideoDxe/VbeShim.h
++++ b/OvmfPkg/QemuVideoDxe/VbeShim.h
+@@ -517,185 +517,318 @@ STATIC CONST UINT8 mVbeShim[] = {
+   /* 000001FE nop                            */  0x90,
+   /* 000001FF nop                            */  0x90,
+   /* 00000200 cmp ax,0x4f00                  */  0x3D, 0x00, 0x4F,
+-  /* 00000203 jz 0x22d                       */  0x74, 0x28,
++  /* 00000203 jz 0x235                       */  0x74, 0x30,
+   /* 00000205 cmp ax,0x4f01                  */  0x3D, 0x01, 0x4F,
+-  /* 00000208 jz 0x245                       */  0x74, 0x3B,
++  /* 00000208 jz 0x255                       */  0x74, 0x4B,
+   /* 0000020A cmp ax,0x4f02                  */  0x3D, 0x02, 0x4F,
+-  /* 0000020D jz 0x269                       */  0x74, 0x5A,
++  /* 0000020D jz 0x289                       */  0x74, 0x7A,
+   /* 0000020F cmp ax,0x4f03                  */  0x3D, 0x03, 0x4F,
+-  /* 00000212 jz word 0x331                  */  0x0F, 0x84, 0x1B, 0x01,
++  /* 00000212 jz word 0x361                  */  0x0F, 0x84, 0x4B, 0x01,
+   /* 00000216 cmp ax,0x4f10                  */  0x3D, 0x10, 0x4F,
+-  /* 00000219 jz word 0x336                  */  0x0F, 0x84, 0x19, 0x01,
++  /* 00000219 jz word 0x36e                  */  0x0F, 0x84, 0x51, 0x01,
+   /* 0000021D cmp ax,0x4f15                  */  0x3D, 0x15, 0x4F,
+-  /* 00000220 jz word 0x338                  */  0x0F, 0x84, 0x14, 0x01,
++  /* 00000220 jz word 0x378                  */  0x0F, 0x84, 0x54, 0x01,
+   /* 00000224 cmp ah,0x0                     */  0x80, 0xFC, 0x00,
+-  /* 00000227 jz word 0x33a                  */  0x0F, 0x84, 0x0F, 0x01,
+-  /* 0000022B jmp short 0x22b                */  0xEB, 0xFE,
+-  /* 0000022D push es                        */  0x06,
+-  /* 0000022E push di                        */  0x57,
+-  /* 0000022F push ds                        */  0x1E,
+-  /* 00000230 push si                        */  0x56,
+-  /* 00000231 push cx                        */  0x51,
+-  /* 00000232 push cs                        */  0x0E,
+-  /* 00000233 pop ds                         */  0x1F,
+-  /* 00000234 mov si,0x0                     */  0xBE, 0x00, 0x00,
+-  /* 00000237 mov cx,0x100                   */  0xB9, 0x00, 0x01,
+-  /* 0000023A cld                            */  0xFC,
+-  /* 0000023B rep movsb                      */  0xF3, 0xA4,
+-  /* 0000023D pop cx                         */  0x59,
+-  /* 0000023E pop si                         */  0x5E,
+-  /* 0000023F pop ds                         */  0x1F,
+-  /* 00000240 pop di                         */  0x5F,
+-  /* 00000241 pop es                         */  0x07,
+-  /* 00000242 jmp word 0x34c                 */  0xE9, 0x07, 0x01,
+-  /* 00000245 push es                        */  0x06,
+-  /* 00000246 push di                        */  0x57,
+-  /* 00000247 push ds                        */  0x1E,
+-  /* 00000248 push si                        */  0x56,
+-  /* 00000249 push cx                        */  0x51,
+-  /* 0000024A and cx,0xbfff                  */  0x81, 0xE1, 0xFF, 0xBF,
+-  /* 0000024E cmp cx,0xf1                    */  0x81, 0xF9, 0xF1, 0x00,
+-  /* 00000252 jz 0x256                       */  0x74, 0x02,
+-  /* 00000254 jmp short 0x22b                */  0xEB, 0xD5,
+-  /* 00000256 push cs                        */  0x0E,
+-  /* 00000257 pop ds                         */  0x1F,
+-  /* 00000258 mov si,0x100                   */  0xBE, 0x00, 0x01,
+-  /* 0000025B mov cx,0x100                   */  0xB9, 0x00, 0x01,
+-  /* 0000025E cld                            */  0xFC,
+-  /* 0000025F rep movsb                      */  0xF3, 0xA4,
+-  /* 00000261 pop cx                         */  0x59,
+-  /* 00000262 pop si                         */  0x5E,
+-  /* 00000263 pop ds                         */  0x1F,
+-  /* 00000264 pop di                         */  0x5F,
+-  /* 00000265 pop es                         */  0x07,
+-  /* 00000266 jmp word 0x34c                 */  0xE9, 0xE3, 0x00,
+-  /* 00000269 push dx                        */  0x52,
+-  /* 0000026A push ax                        */  0x50,
+-  /* 0000026B cmp bx,0x40f1                  */  0x81, 0xFB, 0xF1, 0x40,
+-  /* 0000026F jz 0x273                       */  0x74, 0x02,
+-  /* 00000271 jmp short 0x22b                */  0xEB, 0xB8,
+-  /* 00000273 mov dx,0x3c0                   */  0xBA, 0xC0, 0x03,
+-  /* 00000276 mov al,0x20                    */  0xB0, 0x20,
+-  /* 00000278 out dx,al                      */  0xEE,
+-  /* 00000279 push dx                        */  0x52,
+-  /* 0000027A push ax                        */  0x50,
+-  /* 0000027B mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
+-  /* 0000027E mov ax,0x4                     */  0xB8, 0x04, 0x00,
+-  /* 00000281 out dx,ax                      */  0xEF,
+-  /* 00000282 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
+-  /* 00000285 mov ax,0x0                     */  0xB8, 0x00, 0x00,
+-  /* 00000288 out dx,ax                      */  0xEF,
+-  /* 00000289 pop ax                         */  0x58,
+-  /* 0000028A pop dx                         */  0x5A,
+-  /* 0000028B push dx                        */  0x52,
+-  /* 0000028C push ax                        */  0x50,
+-  /* 0000028D mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
+-  /* 00000290 mov ax,0x5                     */  0xB8, 0x05, 0x00,
+-  /* 00000293 out dx,ax                      */  0xEF,
+-  /* 00000294 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
+-  /* 00000297 mov ax,0x0                     */  0xB8, 0x00, 0x00,
+-  /* 0000029A out dx,ax                      */  0xEF,
+-  /* 0000029B pop ax                         */  0x58,
+-  /* 0000029C pop dx                         */  0x5A,
+-  /* 0000029D push dx                        */  0x52,
+-  /* 0000029E push ax                        */  0x50,
+-  /* 0000029F mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
+-  /* 000002A2 mov ax,0x8                     */  0xB8, 0x08, 0x00,
+-  /* 000002A5 out dx,ax                      */  0xEF,
+-  /* 000002A6 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
+-  /* 000002A9 mov ax,0x0                     */  0xB8, 0x00, 0x00,
+-  /* 000002AC out dx,ax                      */  0xEF,
+-  /* 000002AD pop ax                         */  0x58,
+-  /* 000002AE pop dx                         */  0x5A,
+-  /* 000002AF push dx                        */  0x52,
+-  /* 000002B0 push ax                        */  0x50,
+-  /* 000002B1 mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
+-  /* 000002B4 mov ax,0x9                     */  0xB8, 0x09, 0x00,
+-  /* 000002B7 out dx,ax                      */  0xEF,
+-  /* 000002B8 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
+-  /* 000002BB mov ax,0x0                     */  0xB8, 0x00, 0x00,
+-  /* 000002BE out dx,ax                      */  0xEF,
+-  /* 000002BF pop ax                         */  0x58,
+-  /* 000002C0 pop dx                         */  0x5A,
+-  /* 000002C1 push dx                        */  0x52,
+-  /* 000002C2 push ax                        */  0x50,
+-  /* 000002C3 mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
+-  /* 000002C6 mov ax,0x3                     */  0xB8, 0x03, 0x00,
+-  /* 000002C9 out dx,ax                      */  0xEF,
+-  /* 000002CA mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
+-  /* 000002CD mov ax,0x20                    */  0xB8, 0x20, 0x00,
+-  /* 000002D0 out dx,ax                      */  0xEF,
+-  /* 000002D1 pop ax                         */  0x58,
+-  /* 000002D2 pop dx                         */  0x5A,
+-  /* 000002D3 push dx                        */  0x52,
+-  /* 000002D4 push ax                        */  0x50,
+-  /* 000002D5 mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
+-  /* 000002D8 mov ax,0x1                     */  0xB8, 0x01, 0x00,
+-  /* 000002DB out dx,ax                      */  0xEF,
+-  /* 000002DC mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
+-  /* 000002DF mov ax,0x400                   */  0xB8, 0x00, 0x04,
+-  /* 000002E2 out dx,ax                      */  0xEF,
+-  /* 000002E3 pop ax                         */  0x58,
+-  /* 000002E4 pop dx                         */  0x5A,
+-  /* 000002E5 push dx                        */  0x52,
+-  /* 000002E6 push ax                        */  0x50,
+-  /* 000002E7 mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
+-  /* 000002EA mov ax,0x6                     */  0xB8, 0x06, 0x00,
+-  /* 000002ED out dx,ax                      */  0xEF,
+-  /* 000002EE mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
+-  /* 000002F1 mov ax,0x400                   */  0xB8, 0x00, 0x04,
+-  /* 000002F4 out dx,ax                      */  0xEF,
+-  /* 000002F5 pop ax                         */  0x58,
+-  /* 000002F6 pop dx                         */  0x5A,
+-  /* 000002F7 push dx                        */  0x52,
+-  /* 000002F8 push ax                        */  0x50,
+-  /* 000002F9 mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
+-  /* 000002FC mov ax,0x2                     */  0xB8, 0x02, 0x00,
+-  /* 000002FF out dx,ax                      */  0xEF,
+-  /* 00000300 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
+-  /* 00000303 mov ax,0x300                   */  0xB8, 0x00, 0x03,
+-  /* 00000306 out dx,ax                      */  0xEF,
+-  /* 00000307 pop ax                         */  0x58,
+-  /* 00000308 pop dx                         */  0x5A,
+-  /* 00000309 push dx                        */  0x52,
+-  /* 0000030A push ax                        */  0x50,
+-  /* 0000030B mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
+-  /* 0000030E mov ax,0x7                     */  0xB8, 0x07, 0x00,
+-  /* 00000311 out dx,ax                      */  0xEF,
+-  /* 00000312 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
+-  /* 00000315 mov ax,0x300                   */  0xB8, 0x00, 0x03,
+-  /* 00000318 out dx,ax                      */  0xEF,
+-  /* 00000319 pop ax                         */  0x58,
+-  /* 0000031A pop dx                         */  0x5A,
+-  /* 0000031B push dx                        */  0x52,
+-  /* 0000031C push ax                        */  0x50,
+-  /* 0000031D mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
+-  /* 00000320 mov ax,0x4                     */  0xB8, 0x04, 0x00,
+-  /* 00000323 out dx,ax                      */  0xEF,
+-  /* 00000324 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
+-  /* 00000327 mov ax,0x41                    */  0xB8, 0x41, 0x00,
+-  /* 0000032A out dx,ax                      */  0xEF,
+-  /* 0000032B pop ax                         */  0x58,
+-  /* 0000032C pop dx                         */  0x5A,
+-  /* 0000032D pop ax                         */  0x58,
+-  /* 0000032E pop dx                         */  0x5A,
+-  /* 0000032F jmp short 0x34c                */  0xEB, 0x1B,
+-  /* 00000331 mov bx,0x40f1                  */  0xBB, 0xF1, 0x40,
+-  /* 00000334 jmp short 0x34c                */  0xEB, 0x16,
+-  /* 00000336 jmp short 0x350                */  0xEB, 0x18,
+-  /* 00000338 jmp short 0x350                */  0xEB, 0x16,
+-  /* 0000033A cmp al,0x3                     */  0x3C, 0x03,
+-  /* 0000033C jz 0x345                       */  0x74, 0x07,
+-  /* 0000033E cmp al,0x12                    */  0x3C, 0x12,
+-  /* 00000340 jz 0x349                       */  0x74, 0x07,
+-  /* 00000342 jmp word 0x22b                 */  0xE9, 0xE6, 0xFE,
+-  /* 00000345 mov al,0x30                    */  0xB0, 0x30,
+-  /* 00000347 jmp short 0x34b                */  0xEB, 0x02,
+-  /* 00000349 mov al,0x20                    */  0xB0, 0x20,
+-  /* 0000034B iretw                          */  0xCF,
+-  /* 0000034C mov ax,0x4f                    */  0xB8, 0x4F, 0x00,
+-  /* 0000034F iretw                          */  0xCF,
+-  /* 00000350 mov ax,0x14f                   */  0xB8, 0x4F, 0x01,
+-  /* 00000353 iretw                          */  0xCF,
++  /* 00000227 jz word 0x382                  */  0x0F, 0x84, 0x57, 0x01,
++  /* 0000022B push si                        */  0x56,
++  /* 0000022C mov si,0x3e9                   */  0xBE, 0xE9, 0x03,
++  /* 0000022F call word 0x3c4                */  0xE8, 0x92, 0x01,
++  /* 00000232 pop si                         */  0x5E,
++  /* 00000233 jmp short 0x233                */  0xEB, 0xFE,
++  /* 00000235 push es                        */  0x06,
++  /* 00000236 push di                        */  0x57,
++  /* 00000237 push ds                        */  0x1E,
++  /* 00000238 push si                        */  0x56,
++  /* 00000239 push cx                        */  0x51,
++  /* 0000023A push si                        */  0x56,
++  /* 0000023B mov si,0x3fb                   */  0xBE, 0xFB, 0x03,
++  /* 0000023E call word 0x3c4                */  0xE8, 0x83, 0x01,
++  /* 00000241 pop si                         */  0x5E,
++  /* 00000242 push cs                        */  0x0E,
++  /* 00000243 pop ds                         */  0x1F,
++  /* 00000244 mov si,0x0                     */  0xBE, 0x00, 0x00,
++  /* 00000247 mov cx,0x100                   */  0xB9, 0x00, 0x01,
++  /* 0000024A cld                            */  0xFC,
++  /* 0000024B rep movsb                      */  0xF3, 0xA4,
++  /* 0000024D pop cx                         */  0x59,
++  /* 0000024E pop si                         */  0x5E,
++  /* 0000024F pop ds                         */  0x1F,
++  /* 00000250 pop di                         */  0x5F,
++  /* 00000251 pop es                         */  0x07,
++  /* 00000252 jmp word 0x3ac                 */  0xE9, 0x57, 0x01,
++  /* 00000255 push es                        */  0x06,
++  /* 00000256 push di                        */  0x57,
++  /* 00000257 push ds                        */  0x1E,
++  /* 00000258 push si                        */  0x56,
++  /* 00000259 push cx                        */  0x51,
++  /* 0000025A push si                        */  0x56,
++  /* 0000025B mov si,0x404                   */  0xBE, 0x04, 0x04,
++  /* 0000025E call word 0x3c4                */  0xE8, 0x63, 0x01,
++  /* 00000261 pop si                         */  0x5E,
++  /* 00000262 and cx,0xbfff                  */  0x81, 0xE1, 0xFF, 0xBF,
++  /* 00000266 cmp cx,0xf1                    */  0x81, 0xF9, 0xF1, 0x00,
++  /* 0000026A jz 0x276                       */  0x74, 0x0A,
++  /* 0000026C push si                        */  0x56,
++  /* 0000026D mov si,0x432                   */  0xBE, 0x32, 0x04,
++  /* 00000270 call word 0x3c4                */  0xE8, 0x51, 0x01,
++  /* 00000273 pop si                         */  0x5E,
++  /* 00000274 jmp short 0x233                */  0xEB, 0xBD,
++  /* 00000276 push cs                        */  0x0E,
++  /* 00000277 pop ds                         */  0x1F,
++  /* 00000278 mov si,0x100                   */  0xBE, 0x00, 0x01,
++  /* 0000027B mov cx,0x100                   */  0xB9, 0x00, 0x01,
++  /* 0000027E cld                            */  0xFC,
++  /* 0000027F rep movsb                      */  0xF3, 0xA4,
++  /* 00000281 pop cx                         */  0x59,
++  /* 00000282 pop si                         */  0x5E,
++  /* 00000283 pop ds                         */  0x1F,
++  /* 00000284 pop di                         */  0x5F,
++  /* 00000285 pop es                         */  0x07,
++  /* 00000286 jmp word 0x3ac                 */  0xE9, 0x23, 0x01,
++  /* 00000289 push dx                        */  0x52,
++  /* 0000028A push ax                        */  0x50,
++  /* 0000028B push si                        */  0x56,
++  /* 0000028C mov si,0x41a                   */  0xBE, 0x1A, 0x04,
++  /* 0000028F call word 0x3c4                */  0xE8, 0x32, 0x01,
++  /* 00000292 pop si                         */  0x5E,
++  /* 00000293 cmp bx,0x40f1                  */  0x81, 0xFB, 0xF1, 0x40,
++  /* 00000297 jz 0x2a3                       */  0x74, 0x0A,
++  /* 00000299 push si                        */  0x56,
++  /* 0000029A mov si,0x432                   */  0xBE, 0x32, 0x04,
++  /* 0000029D call word 0x3c4                */  0xE8, 0x24, 0x01,
++  /* 000002A0 pop si                         */  0x5E,
++  /* 000002A1 jmp short 0x233                */  0xEB, 0x90,
++  /* 000002A3 mov dx,0x3c0                   */  0xBA, 0xC0, 0x03,
++  /* 000002A6 mov al,0x20                    */  0xB0, 0x20,
++  /* 000002A8 out dx,al                      */  0xEE,
++  /* 000002A9 push dx                        */  0x52,
++  /* 000002AA push ax                        */  0x50,
++  /* 000002AB mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
++  /* 000002AE mov ax,0x4                     */  0xB8, 0x04, 0x00,
++  /* 000002B1 out dx,ax                      */  0xEF,
++  /* 000002B2 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
++  /* 000002B5 mov ax,0x0                     */  0xB8, 0x00, 0x00,
++  /* 000002B8 out dx,ax                      */  0xEF,
++  /* 000002B9 pop ax                         */  0x58,
++  /* 000002BA pop dx                         */  0x5A,
++  /* 000002BB push dx                        */  0x52,
++  /* 000002BC push ax                        */  0x50,
++  /* 000002BD mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
++  /* 000002C0 mov ax,0x5                     */  0xB8, 0x05, 0x00,
++  /* 000002C3 out dx,ax                      */  0xEF,
++  /* 000002C4 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
++  /* 000002C7 mov ax,0x0                     */  0xB8, 0x00, 0x00,
++  /* 000002CA out dx,ax                      */  0xEF,
++  /* 000002CB pop ax                         */  0x58,
++  /* 000002CC pop dx                         */  0x5A,
++  /* 000002CD push dx                        */  0x52,
++  /* 000002CE push ax                        */  0x50,
++  /* 000002CF mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
++  /* 000002D2 mov ax,0x8                     */  0xB8, 0x08, 0x00,
++  /* 000002D5 out dx,ax                      */  0xEF,
++  /* 000002D6 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
++  /* 000002D9 mov ax,0x0                     */  0xB8, 0x00, 0x00,
++  /* 000002DC out dx,ax                      */  0xEF,
++  /* 000002DD pop ax                         */  0x58,
++  /* 000002DE pop dx                         */  0x5A,
++  /* 000002DF push dx                        */  0x52,
++  /* 000002E0 push ax                        */  0x50,
++  /* 000002E1 mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
++  /* 000002E4 mov ax,0x9                     */  0xB8, 0x09, 0x00,
++  /* 000002E7 out dx,ax                      */  0xEF,
++  /* 000002E8 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
++  /* 000002EB mov ax,0x0                     */  0xB8, 0x00, 0x00,
++  /* 000002EE out dx,ax                      */  0xEF,
++  /* 000002EF pop ax                         */  0x58,
++  /* 000002F0 pop dx                         */  0x5A,
++  /* 000002F1 push dx                        */  0x52,
++  /* 000002F2 push ax                        */  0x50,
++  /* 000002F3 mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
++  /* 000002F6 mov ax,0x3                     */  0xB8, 0x03, 0x00,
++  /* 000002F9 out dx,ax                      */  0xEF,
++  /* 000002FA mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
++  /* 000002FD mov ax,0x20                    */  0xB8, 0x20, 0x00,
++  /* 00000300 out dx,ax                      */  0xEF,
++  /* 00000301 pop ax                         */  0x58,
++  /* 00000302 pop dx                         */  0x5A,
++  /* 00000303 push dx                        */  0x52,
++  /* 00000304 push ax                        */  0x50,
++  /* 00000305 mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
++  /* 00000308 mov ax,0x1                     */  0xB8, 0x01, 0x00,
++  /* 0000030B out dx,ax                      */  0xEF,
++  /* 0000030C mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
++  /* 0000030F mov ax,0x400                   */  0xB8, 0x00, 0x04,
++  /* 00000312 out dx,ax                      */  0xEF,
++  /* 00000313 pop ax                         */  0x58,
++  /* 00000314 pop dx                         */  0x5A,
++  /* 00000315 push dx                        */  0x52,
++  /* 00000316 push ax                        */  0x50,
++  /* 00000317 mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
++  /* 0000031A mov ax,0x6                     */  0xB8, 0x06, 0x00,
++  /* 0000031D out dx,ax                      */  0xEF,
++  /* 0000031E mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
++  /* 00000321 mov ax,0x400                   */  0xB8, 0x00, 0x04,
++  /* 00000324 out dx,ax                      */  0xEF,
++  /* 00000325 pop ax                         */  0x58,
++  /* 00000326 pop dx                         */  0x5A,
++  /* 00000327 push dx                        */  0x52,
++  /* 00000328 push ax                        */  0x50,
++  /* 00000329 mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
++  /* 0000032C mov ax,0x2                     */  0xB8, 0x02, 0x00,
++  /* 0000032F out dx,ax                      */  0xEF,
++  /* 00000330 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
++  /* 00000333 mov ax,0x300                   */  0xB8, 0x00, 0x03,
++  /* 00000336 out dx,ax                      */  0xEF,
++  /* 00000337 pop ax                         */  0x58,
++  /* 00000338 pop dx                         */  0x5A,
++  /* 00000339 push dx                        */  0x52,
++  /* 0000033A push ax                        */  0x50,
++  /* 0000033B mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
++  /* 0000033E mov ax,0x7                     */  0xB8, 0x07, 0x00,
++  /* 00000341 out dx,ax                      */  0xEF,
++  /* 00000342 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
++  /* 00000345 mov ax,0x300                   */  0xB8, 0x00, 0x03,
++  /* 00000348 out dx,ax                      */  0xEF,
++  /* 00000349 pop ax                         */  0x58,
++  /* 0000034A pop dx                         */  0x5A,
++  /* 0000034B push dx                        */  0x52,
++  /* 0000034C push ax                        */  0x50,
++  /* 0000034D mov dx,0x1ce                   */  0xBA, 0xCE, 0x01,
++  /* 00000350 mov ax,0x4                     */  0xB8, 0x04, 0x00,
++  /* 00000353 out dx,ax                      */  0xEF,
++  /* 00000354 mov dx,0x1d0                   */  0xBA, 0xD0, 0x01,
++  /* 00000357 mov ax,0x41                    */  0xB8, 0x41, 0x00,
++  /* 0000035A out dx,ax                      */  0xEF,
++  /* 0000035B pop ax                         */  0x58,
++  /* 0000035C pop dx                         */  0x5A,
++  /* 0000035D pop ax                         */  0x58,
++  /* 0000035E pop dx                         */  0x5A,
++  /* 0000035F jmp short 0x3ac                */  0xEB, 0x4B,
++  /* 00000361 push si                        */  0x56,
++  /* 00000362 mov si,0x411                   */  0xBE, 0x11, 0x04,
++  /* 00000365 call word 0x3c4                */  0xE8, 0x5C, 0x00,
++  /* 00000368 pop si                         */  0x5E,
++  /* 00000369 mov bx,0x40f1                  */  0xBB, 0xF1, 0x40,
++  /* 0000036C jmp short 0x3ac                */  0xEB, 0x3E,
++  /* 0000036E push si                        */  0x56,
++  /* 0000036F mov si,0x43f                   */  0xBE, 0x3F, 0x04,
++  /* 00000372 call word 0x3c4                */  0xE8, 0x4F, 0x00,
++  /* 00000375 pop si                         */  0x5E,
++  /* 00000376 jmp short 0x3b8                */  0xEB, 0x40,
++  /* 00000378 push si                        */  0x56,
++  /* 00000379 mov si,0x452                   */  0xBE, 0x52, 0x04,
++  /* 0000037C call word 0x3c4                */  0xE8, 0x45, 0x00,
++  /* 0000037F pop si                         */  0x5E,
++  /* 00000380 jmp short 0x3b8                */  0xEB, 0x36,
++  /* 00000382 push si                        */  0x56,
++  /* 00000383 mov si,0x423                   */  0xBE, 0x23, 0x04,
++  /* 00000386 call word 0x3c4                */  0xE8, 0x3B, 0x00,
++  /* 00000389 pop si                         */  0x5E,
++  /* 0000038A cmp al,0x3                     */  0x3C, 0x03,
++  /* 0000038C jz 0x39d                       */  0x74, 0x0F,
++  /* 0000038E cmp al,0x12                    */  0x3C, 0x12,
++  /* 00000390 jz 0x3a1                       */  0x74, 0x0F,
++  /* 00000392 push si                        */  0x56,
++  /* 00000393 mov si,0x432                   */  0xBE, 0x32, 0x04,
++  /* 00000396 call word 0x3c4                */  0xE8, 0x2B, 0x00,
++  /* 00000399 pop si                         */  0x5E,
++  /* 0000039A jmp word 0x233                 */  0xE9, 0x96, 0xFE,
++  /* 0000039D mov al,0x30                    */  0xB0, 0x30,
++  /* 0000039F jmp short 0x3a3                */  0xEB, 0x02,
++  /* 000003A1 mov al,0x20                    */  0xB0, 0x20,
++  /* 000003A3 push si                        */  0x56,
++  /* 000003A4 mov si,0x3d6                   */  0xBE, 0xD6, 0x03,
++  /* 000003A7 call word 0x3c4                */  0xE8, 0x1A, 0x00,
++  /* 000003AA pop si                         */  0x5E,
++  /* 000003AB iretw                          */  0xCF,
++  /* 000003AC push si                        */  0x56,
++  /* 000003AD mov si,0x3d6                   */  0xBE, 0xD6, 0x03,
++  /* 000003B0 call word 0x3c4                */  0xE8, 0x11, 0x00,
++  /* 000003B3 pop si                         */  0x5E,
++  /* 000003B4 mov ax,0x4f                    */  0xB8, 0x4F, 0x00,
++  /* 000003B7 iretw                          */  0xCF,
++  /* 000003B8 push si                        */  0x56,
++  /* 000003B9 mov si,0x3dc                   */  0xBE, 0xDC, 0x03,
++  /* 000003BC call word 0x3c4                */  0xE8, 0x05, 0x00,
++  /* 000003BF pop si                         */  0x5E,
++  /* 000003C0 mov ax,0x14f                   */  0xB8, 0x4F, 0x01,
++  /* 000003C3 iretw                          */  0xCF,
++  /* 000003C4 pushaw                         */  0x60,
++  /* 000003C5 push ds                        */  0x1E,
++  /* 000003C6 push cs                        */  0x0E,
++  /* 000003C7 pop ds                         */  0x1F,
++  /* 000003C8 mov dx,0x402                   */  0xBA, 0x02, 0x04,
++  /* 000003CB lodsb                          */  0xAC,
++  /* 000003CC cmp al,0x0                     */  0x3C, 0x00,
++  /* 000003CE jz 0x3d3                       */  0x74, 0x03,
++  /* 000003D0 out dx,al                      */  0xEE,
++  /* 000003D1 jmp short 0x3cb                */  0xEB, 0xF8,
++  /* 000003D3 pop ds                         */  0x1F,
++  /* 000003D4 popaw                          */  0x61,
++  /* 000003D5 ret                            */  0xC3,
++  /* 000003D6 inc bp                         */  0x45,
++  /* 000003D7 js 0x442                       */  0x78, 0x69,
++  /* 000003D9 jz 0x3e5                       */  0x74, 0x0A,
++  /* 000003DB add [di+0x6e],dl               */  0x00, 0x55, 0x6E,
++  /* 000003DE jnc 0x455                      */  0x73, 0x75,
++  /* 000003E0 jo 0x452                       */  0x70, 0x70,
++  /* 000003E2 outsw                          */  0x6F,
++  /* 000003E3 jc 0x459                       */  0x72, 0x74,
++  /* 000003E5 or al,[fs:bx+si]               */  0x65, 0x64, 0x0A, 0x00,
++  /* 000003E9 push bp                        */  0x55,
++  /* 000003EA outsb                          */  0x6E,
++  /* 000003EB imul bp,[bp+0x6f],byte +0x77   */  0x6B, 0x6E, 0x6F, 0x77,
++  /* 000003EF outsb                          */  0x6E,
++  /* 000003F0 and [bp+0x75],al               */  0x20, 0x46, 0x75,
++  /* 000003F3 outsb                          */  0x6E,
++  /* 000003F4 arpl [si+0x69],si              */  0x63, 0x74, 0x69,
++  /* 000003F7 outsw                          */  0x6F,
++  /* 000003F8 outsb                          */  0x6E,
++  /* 000003F9 or al,[bx+si]                  */  0x0A, 0x00,
++  /* 000003FB inc di                         */  0x47,
++  /* 000003FC gs jz 0x448                    */  0x65, 0x74, 0x49,
++  /* 000003FF outsb                          */  0x6E,
++  /* 00000400 outsd                          */  0x66, 0x6F,
++  /* 00000402 or al,[bx+si]                  */  0x0A, 0x00,
++  /* 00000404 inc di                         */  0x47,
++  /* 00000405 gs jz 0x455                    */  0x65, 0x74, 0x4D,
++  /* 00000408 outsw                          */  0x6F,
++  /* 00000409 gs dec cx                      */  0x64, 0x65, 0x49,
++  /* 0000040C outsb                          */  0x6E,
++  /* 0000040D outsd                          */  0x66, 0x6F,
++  /* 0000040F or al,[bx+si]                  */  0x0A, 0x00,
++  /* 00000411 inc di                         */  0x47,
++  /* 00000412 gs jz 0x462                    */  0x65, 0x74, 0x4D,
++  /* 00000415 outsw                          */  0x6F,
++  /* 00000416 or al,[gs:bx+si]               */  0x64, 0x65, 0x0A, 0x00,
++  /* 0000041A push bx                        */  0x53,
++  /* 0000041B gs jz 0x46b                    */  0x65, 0x74, 0x4D,
++  /* 0000041E outsw                          */  0x6F,
++  /* 0000041F or al,[gs:bx+si]               */  0x64, 0x65, 0x0A, 0x00,
++  /* 00000423 push bx                        */  0x53,
++  /* 00000424 gs jz 0x474                    */  0x65, 0x74, 0x4D,
++  /* 00000427 outsw                          */  0x6F,
++  /* 00000428 gs dec sp                      */  0x64, 0x65, 0x4C,
++  /* 0000042B gs a32 popaw                   */  0x65, 0x67, 0x61,
++  /* 0000042E arpl [bx+di+0xa],di            */  0x63, 0x79, 0x0A,
++  /* 00000431 add [di+0x6e],dl               */  0x00, 0x55, 0x6E,
++  /* 00000434 imul bp,[bx+0x77],byte +0x6e   */  0x6B, 0x6F, 0x77, 0x6E,
++  /* 00000438 and [di+0x6f],cl               */  0x20, 0x4D, 0x6F,
++  /* 0000043B or al,[gs:bx+si]               */  0x64, 0x65, 0x0A, 0x00,
++  /* 0000043F inc di                         */  0x47,
++  /* 00000440 gs jz 0x493                    */  0x65, 0x74, 0x50,
++  /* 00000443 insw                           */  0x6D,
++  /* 00000444 inc bx                         */  0x43,
++  /* 00000445 popaw                          */  0x61,
++  /* 00000446 jo 0x4a9                       */  0x70, 0x61,
++  /* 00000448 bound bp,[bx+di+0x6c]          */  0x62, 0x69, 0x6C,
++  /* 0000044B imul si,[si+0x69],word 0x7365  */  0x69, 0x74, 0x69, 0x65, 0x73,
++  /* 00000450 or al,[bx+si]                  */  0x0A, 0x00,
++  /* 00000452 push dx                        */  0x52,
++  /* 00000453 gs popaw                       */  0x65, 0x61,
++  /* 00000455 fs inc bp                      */  0x64, 0x45,
++  /* 00000457 fs                             */  0x64,
++  /* 00000458 db 0x69                        */  0x69,
++  /* 00000459 or al,[fs:bx+si]               */  0x64, 0x0A, 0x00,
+ };
+ #endif
+-- 
+2.18.1
+
diff --git a/SOURCES/0009-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch b/SOURCES/0009-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch
new file mode 100644
index 0000000..5b008bb
--- /dev/null
+++ b/SOURCES/0009-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch
@@ -0,0 +1,156 @@
+From 12cb13a1da913912bd9148ce8f2353a75be77f18 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Tue, 25 Feb 2014 18:40:35 +0100
+Subject: MdeModulePkg: TerminalDxe: add other text resolutions (RHEL only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no changes
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- update commit message as requested in
+  <https://bugzilla.redhat.com/show_bug.cgi?id=1503316#c0>
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- no changes
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- adapt commit 0bc77c63de03 (code and commit message) to upstream commit
+  390b95a49c14 ("MdeModulePkg/TerminalDxe: Refine
+  InitializeTerminalConsoleTextMode", 2017-01-10).
+
+When the console output is multiplexed to several devices by
+ConSplitterDxe, then ConSplitterDxe builds an intersection of text modes
+supported by all console output devices.
+
+Two notable output devices are provided by:
+(1) MdeModulePkg/Universal/Console/GraphicsConsoleDxe,
+(2) MdeModulePkg/Universal/Console/TerminalDxe.
+
+GraphicsConsoleDxe supports four modes at most -- see
+InitializeGraphicsConsoleTextMode() and "mGraphicsConsoleModeData":
+
+(1a) 80x25 (required by the UEFI spec as mode 0),
+(1b) 80x50 (not necessarily supported, but if it is, then the UEFI spec
+     requires the driver to provide it as mode 1),
+(1c) 100x31 (corresponding to graphics resolution 800x600, which the UEFI
+     spec requires from all plug-in graphics devices),
+(1d) "full screen" resolution, derived form the underlying GOP's
+     horizontal and vertical resolutions with division by EFI_GLYPH_WIDTH
+     (8) and EFI_GLYPH_HEIGHT (19), respectively.
+
+The automatic "full screen resolution" makes GraphicsConsoleDxe's
+character console very flexible. However, TerminalDxe (which runs on
+serial ports) only provides the following fixed resolutions -- see
+InitializeTerminalConsoleTextMode() and "mTerminalConsoleModeData":
+
+(2a) 80x25 (required by the UEFI spec as mode 0),
+(2b) 80x50 (since the character resolution of a serial device cannot be
+     interrogated easily, this is added unconditionally as mode 1),
+(2c) 100x31 (since the character resolution of a serial device cannot be
+     interrogated easily, this is added unconditionally as mode 2).
+
+When ConSplitterDxe combines (1) and (2), multiplexing console output to
+both video output and serial terminal, the list of commonly supported text
+modes (ie. the "intersection") comprises:
+
+(3a) 80x25, unconditionally, from (1a) and (2a),
+(3b) 80x50, if the graphics console provides at least 640x950 pixel
+     resolution, from (1b) and (2b)
+(3c) 100x31, if the graphics device is a plug-in one (because in that case
+     800x600 is a mandated pixel resolution), from (1c) and (2c).
+
+Unfortunately, the "full screen resolution" (1d) of the GOP-based text
+console is not available in general.
+
+Mitigate this problem by extending "mTerminalConsoleModeData" with a
+handful of text resolutions that are derived from widespread maximal pixel
+resolutions. This way TerminalDxe won't cause ConSplitterDxe to filter out
+the most frequent (1d) values from the intersection, and eg. the MODE
+command in the UEFI shell will offer the "best" (ie. full screen)
+resolution too.
+
+Upstreaming efforts for this patch have been discontinued; it was clear
+from the off-list thread that consensus was impossible to reach.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 99dc3720ac86059f60156197328cc433603c536e)
+(cherry picked from commit d2066c1748f885043026c51dec1bc8d6d406ae8f)
+(cherry picked from commit 1facdd58e946c584a3dc1e5be8f2f837b5a7c621)
+(cherry picked from commit 28faeb5f94b4866b9da16cf2a1e4e0fc09a26e37)
+(cherry picked from commit 4e4e15b80a5b2103eadd495ef4a830d46dd4ed51)
+---
+ .../Universal/Console/TerminalDxe/Terminal.c  | 41 +++++++++++++++++--
+ 1 file changed, 38 insertions(+), 3 deletions(-)
+
+diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.c b/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.c
+index c76b2c5100..eff9d9787f 100644
+--- a/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.c
++++ b/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.c
+@@ -107,9 +107,44 @@ TERMINAL_DEV  mTerminalDevTemplate = {
+ };
+ 
+ TERMINAL_CONSOLE_MODE_DATA mTerminalConsoleModeData[] = {
+-  {80,  25},
+-  {80,  50},
+-  {100, 31},
++  {   80,  25 }, // from graphics resolution  640 x  480
++  {   80,  50 }, // from graphics resolution  640 x  960
++  {  100,  25 }, // from graphics resolution  800 x  480
++  {  100,  31 }, // from graphics resolution  800 x  600
++  {  104,  32 }, // from graphics resolution  832 x  624
++  {  120,  33 }, // from graphics resolution  960 x  640
++  {  128,  31 }, // from graphics resolution 1024 x  600
++  {  128,  40 }, // from graphics resolution 1024 x  768
++  {  144,  45 }, // from graphics resolution 1152 x  864
++  {  144,  45 }, // from graphics resolution 1152 x  870
++  {  160,  37 }, // from graphics resolution 1280 x  720
++  {  160,  40 }, // from graphics resolution 1280 x  760
++  {  160,  40 }, // from graphics resolution 1280 x  768
++  {  160,  42 }, // from graphics resolution 1280 x  800
++  {  160,  50 }, // from graphics resolution 1280 x  960
++  {  160,  53 }, // from graphics resolution 1280 x 1024
++  {  170,  40 }, // from graphics resolution 1360 x  768
++  {  170,  40 }, // from graphics resolution 1366 x  768
++  {  175,  55 }, // from graphics resolution 1400 x 1050
++  {  180,  47 }, // from graphics resolution 1440 x  900
++  {  200,  47 }, // from graphics resolution 1600 x  900
++  {  200,  63 }, // from graphics resolution 1600 x 1200
++  {  210,  55 }, // from graphics resolution 1680 x 1050
++  {  240,  56 }, // from graphics resolution 1920 x 1080
++  {  240,  63 }, // from graphics resolution 1920 x 1200
++  {  240,  75 }, // from graphics resolution 1920 x 1440
++  {  250, 105 }, // from graphics resolution 2000 x 2000
++  {  256,  80 }, // from graphics resolution 2048 x 1536
++  {  256, 107 }, // from graphics resolution 2048 x 2048
++  {  320,  75 }, // from graphics resolution 2560 x 1440
++  {  320,  84 }, // from graphics resolution 2560 x 1600
++  {  320, 107 }, // from graphics resolution 2560 x 2048
++  {  350, 110 }, // from graphics resolution 2800 x 2100
++  {  400, 126 }, // from graphics resolution 3200 x 2400
++  {  480, 113 }, // from graphics resolution 3840 x 2160
++  {  512, 113 }, // from graphics resolution 4096 x 2160
++  {  960, 227 }, // from graphics resolution 7680 x 4320
++  { 1024, 227 }, // from graphics resolution 8192 x 4320
+   //
+   // New modes can be added here.
+   //
+-- 
+2.18.1
+
diff --git a/SOURCES/0010-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch b/SOURCES/0010-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
new file mode 100644
index 0000000..3edba86
--- /dev/null
+++ b/SOURCES/0010-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
@@ -0,0 +1,160 @@
+From a11602f5e2ef930be5b693ddfd0c789a1bd4c60c Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Tue, 25 Feb 2014 22:40:01 +0100
+Subject: MdeModulePkg: TerminalDxe: set xterm resolution on mode change (RH
+ only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- Conflict in "MdeModulePkg/MdeModulePkg.dec" due to upstream commits
+  - 1103ba946aee ("MdeModulePkg: Add Capsule On Disk related definition.",
+    2019-06-26),
+  - 1c7b3eb84631 ("MdeModulePkg/DxeIpl: Introduce PCD
+    PcdUse5LevelPageTable", 2019-08-09),
+  with easy manual resolution.
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no change
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- Refresh downstream-only commit 2909e025db68 against "MdeModulePkg.dec"
+  context change from upstream commits e043f7895b83 ("MdeModulePkg: Add
+  PCD PcdPteMemoryEncryptionAddressOrMask", 2017-02-27) and 76081dfcc5b2
+  ("MdeModulePkg: Add PROMPT&HELP string of pcd to UNI file", 2017-03-03).
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- refresh commit 519b9751573e against various context changes
+
+The
+
+  CSI Ps ; Ps ; Ps t
+
+escape sequence serves for window manipulation. We can use the
+
+  CSI 8 ; <rows> ; <columns> t
+
+sequence to adapt eg. the xterm window size to the selected console mode.
+
+Reference: <http://rtfm.etla.org/xterm/ctlseq.html>
+Contributed-under: TianoCore Contribution Agreement 1.0
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 2909e025db6878723b49644a8a0cf160d07e6444)
+(cherry picked from commit b9c5c901f25e48d68eef6e78a4abca00e153f574)
+(cherry picked from commit b7f6115b745de8cbc5214b6ede33c9a8558beb90)
+(cherry picked from commit 67415982afdc77922aa37496c981adeb4351acdb)
+(cherry picked from commit cfccb98d13e955beb0b93b4a75a973f30c273ffc)
+---
+ MdeModulePkg/MdeModulePkg.dec                 |  4 +++
+ .../Console/TerminalDxe/TerminalConOut.c      | 30 +++++++++++++++++++
+ .../Console/TerminalDxe/TerminalDxe.inf       |  2 ++
+ 3 files changed, 36 insertions(+)
+
+diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
+index 19935c88fa..5690bbd8b3 100644
+--- a/MdeModulePkg/MdeModulePkg.dec
++++ b/MdeModulePkg/MdeModulePkg.dec
+@@ -2002,6 +2002,10 @@
+   # @Prompt Capsule On Disk relocation device path.
+   gEfiMdeModulePkgTokenSpaceGuid.PcdCodRelocationDevPath|{0xFF}|VOID*|0x0000002f
+ 
++  ## Controls whether TerminalDxe outputs an XTerm resize sequence on terminal
++  #  mode change.
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE|BOOLEAN|0x00010080
++
+ [PcdsPatchableInModule]
+   ## Specify memory size with page number for PEI code when
+   #  Loading Module at Fixed Address feature is enabled.
+diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
+index 7ef655cca5..1113252df2 100644
+--- a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
++++ b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
+@@ -7,6 +7,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+ 
++#include <Library/PrintLib.h>
++
+ #include "Terminal.h"
+ 
+ //
+@@ -80,6 +82,16 @@ CHAR16 mSetCursorPositionString[]  = { ESC, '[', '0', '0', ';', '0', '0', 'H', 0
+ CHAR16 mCursorForwardString[]      = { ESC, '[', '0', '0', 'C', 0 };
+ CHAR16 mCursorBackwardString[]     = { ESC, '[', '0', '0', 'D', 0 };
+ 
++//
++// Note that this is an ASCII format string, taking two INT32 arguments:
++// rows, columns.
++//
++// A %d (INT32) format specification can expand to at most 11 characters.
++//
++CHAR8 mResizeTextAreaFormatString[] = "\x1B[8;%d;%dt";
++#define RESIZE_SEQ_SIZE (sizeof mResizeTextAreaFormatString + 2 * (11 - 2))
++
++
+ //
+ // Body of the ConOut functions
+ //
+@@ -502,6 +514,24 @@ TerminalConOutSetMode (
+     return EFI_DEVICE_ERROR;
+   }
+ 
++  if (PcdGetBool (PcdResizeXterm)) {
++    CHAR16 ResizeSequence[RESIZE_SEQ_SIZE];
++
++    UnicodeSPrintAsciiFormat (
++      ResizeSequence,
++      sizeof ResizeSequence,
++      mResizeTextAreaFormatString,
++      (INT32) TerminalDevice->TerminalConsoleModeData[ModeNumber].Rows,
++      (INT32) TerminalDevice->TerminalConsoleModeData[ModeNumber].Columns
++      );
++    TerminalDevice->OutputEscChar = TRUE;
++    Status                        = This->OutputString (This, ResizeSequence);
++    TerminalDevice->OutputEscChar = FALSE;
++    if (EFI_ERROR (Status)) {
++      return EFI_DEVICE_ERROR;
++    }
++  }
++
+   This->Mode->Mode  = (INT32) ModeNumber;
+ 
+   Status            = This->ClearScreen (This);
+diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
+index 24e164ef4d..d1160ed1c7 100644
+--- a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
++++ b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
+@@ -55,6 +55,7 @@
+   DebugLib
+   PcdLib
+   BaseLib
++  PrintLib
+ 
+ [Guids]
+   ## SOMETIMES_PRODUCES ## Variable:L"ConInDev"
+@@ -83,6 +84,7 @@
+ [Pcd]
+   gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType           ## SOMETIMES_CONSUMES
+   gEfiMdeModulePkgTokenSpaceGuid.PcdErrorCodeSetVariable    ## CONSUMES
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm             ## CONSUMES
+ 
+ # [Event]
+ # # Relative timer event set by UnicodeToEfiKey(), used to be one 2 seconds input timeout.
+-- 
+2.18.1
+
diff --git a/SOURCES/0011-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch b/SOURCES/0011-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
new file mode 100644
index 0000000..b42de25
--- /dev/null
+++ b/SOURCES/0011-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
@@ -0,0 +1,116 @@
+From 2cc462ee963d0be119bc97bfc9c70d292a40516f Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 14 Oct 2015 15:59:06 +0200
+Subject: OvmfPkg: take PcdResizeXterm from the QEMU command line (RH only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no change
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- refresh downstream-only commit 8abc2a6ddad2 against context differences
+  in the DSC files from upstream commit 5e167d7e784c
+  ("OvmfPkg/PlatformPei: don't allocate reserved mem varstore if
+  SMM_REQUIRE", 2017-03-12).
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- no changes
+
+Contributed-under: TianoCore Contribution Agreement 1.0
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 6fa0c4d67c0bb8bde2ddd6db41c19eb0c40b2721)
+(cherry picked from commit 8abc2a6ddad25af7e88dc0cf57d55dfb75fbf92d)
+(cherry picked from commit b311932d3841c017a0f0fec553edcac365cc2038)
+(cherry picked from commit 61914fb81cf624c9028d015533b400b2794e52d3)
+(cherry picked from commit 2ebf3cc2ae99275d63bb6efd3c22dec76251a853)
+(cherry picked from commit f9b73437b9b231773c1a20e0c516168817a930a2)
+---
+ OvmfPkg/OvmfPkgIa32.dsc             | 1 +
+ OvmfPkg/OvmfPkgIa32X64.dsc          | 1 +
+ OvmfPkg/OvmfPkgX64.dsc              | 1 +
+ OvmfPkg/PlatformPei/Platform.c      | 1 +
+ OvmfPkg/PlatformPei/PlatformPei.inf | 1 +
+ 5 files changed, 5 insertions(+)
+
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 044379e1ed..accf5c0211 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -525,6 +525,7 @@
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase|0
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 2ff68102d3..8812da9943 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -531,6 +531,7 @@
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase|0
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index 3a66d4d424..73e1b7824f 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -530,6 +530,7 @@
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase|0
+diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
+index 3ba2459872..bbbf1ac2a8 100644
+--- a/OvmfPkg/PlatformPei/Platform.c
++++ b/OvmfPkg/PlatformPei/Platform.c
+@@ -667,6 +667,7 @@ InitializePlatform (
+     PeiFvInitialization ();
+     MemMapInitialization ();
+     NoexecDxeInitialization ();
++    UPDATE_BOOLEAN_PCD_FROM_FW_CFG (PcdResizeXterm);
+   }
+ 
+   InstallClearCacheCallback ();
+diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf
+index d9fd9c8f05..666803916c 100644
+--- a/OvmfPkg/PlatformPei/PlatformPei.inf
++++ b/OvmfPkg/PlatformPei/PlatformPei.inf
+@@ -89,6 +89,7 @@
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved
+   gEfiMdeModulePkgTokenSpaceGuid.PcdPciDisableBusEnumeration
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm
+   gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode
+   gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
+   gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
+-- 
+2.18.1
+
diff --git a/SOURCES/0012-ArmVirtPkg-QemuFwCfgLib-allow-UEFI_DRIVER-client-mod.patch b/SOURCES/0012-ArmVirtPkg-QemuFwCfgLib-allow-UEFI_DRIVER-client-mod.patch
new file mode 100644
index 0000000..4972df3
--- /dev/null
+++ b/SOURCES/0012-ArmVirtPkg-QemuFwCfgLib-allow-UEFI_DRIVER-client-mod.patch
@@ -0,0 +1,62 @@
+From 0dd0ad0dcdfd1189ed8aa880765403d1f587cc59 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Tue, 12 Apr 2016 20:50:25 +0200
+Subject: ArmVirtPkg: QemuFwCfgLib: allow UEFI_DRIVER client modules (RH only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no change
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- no changes
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- no changes
+
+Contributed-under: TianoCore Contribution Agreement 1.0
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 8e2153358aa2bba2c91faa87a70beadcaae03fd8)
+(cherry picked from commit 5af259a93f4bbee5515ae18638068125e170f2cd)
+(cherry picked from commit 22b073005af491eef177ef5f80ffe71c1ebabb03)
+(cherry picked from commit f77f1e7dd6013f918c70e089c95b8f4166085fb9)
+(cherry picked from commit 762595334aa7ce88412cc77e136db9b41577a699)
+(cherry picked from commit f372886be5f1c41677f168be77c484bae5841361)
+---
+ ArmVirtPkg/Library/QemuFwCfgLib/QemuFwCfgLib.inf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ArmVirtPkg/Library/QemuFwCfgLib/QemuFwCfgLib.inf b/ArmVirtPkg/Library/QemuFwCfgLib/QemuFwCfgLib.inf
+index 4d27d7d30b..feceed5f93 100644
+--- a/ArmVirtPkg/Library/QemuFwCfgLib/QemuFwCfgLib.inf
++++ b/ArmVirtPkg/Library/QemuFwCfgLib/QemuFwCfgLib.inf
+@@ -15,7 +15,7 @@
+   FILE_GUID                      = B271F41F-B841-48A9-BA8D-545B4BC2E2BF
+   MODULE_TYPE                    = BASE
+   VERSION_STRING                 = 1.0
+-  LIBRARY_CLASS                  = QemuFwCfgLib|DXE_DRIVER
++  LIBRARY_CLASS                  = QemuFwCfgLib|DXE_DRIVER UEFI_DRIVER
+ 
+   CONSTRUCTOR                    = QemuFwCfgInitialize
+ 
+-- 
+2.18.1
+
diff --git a/SOURCES/0013-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch b/SOURCES/0013-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
new file mode 100644
index 0000000..8600508
--- /dev/null
+++ b/SOURCES/0013-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
@@ -0,0 +1,223 @@
+From 8338545260fbb423f796d5196faaaf8ff6e1ed99 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Sun, 26 Jul 2015 08:02:50 +0000
+Subject: ArmVirtPkg: take PcdResizeXterm from the QEMU command line (RH only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no change
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- Refresh downstream-only commit d4564d39dfdb against context changes in
+  "ArmVirtPkg/ArmVirtQemu.dsc" from upstream commit 7e5f1b673870
+  ("ArmVirtPkg/PlatformHasAcpiDtDxe: allow guest level ACPI disable
+  override", 2017-03-29).
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- Adapt commit 6b97969096a3 to the fact that upstream has deprecated such
+  setter functions for dynamic PCDs that don't return a status code (such
+  as PcdSetBool()). Employ PcdSetBoolS(), and assert that it succeeds --
+  there's really no circumstance in this case when it could fail.
+
+Contributed-under: TianoCore Contribution Agreement 1.0
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit d4564d39dfdbf74e762af43314005a2c026cb262)
+(cherry picked from commit c9081ebe3bcd28e5cce4bf58bd8d4fca12f9af7c)
+(cherry picked from commit 8e92730c8e1cdb642b3b3e680e643ff774a90c65)
+(cherry picked from commit 9448b6b46267d8d807fac0c648e693171bb34806)
+(cherry picked from commit 232fcf06f6b3048b7c2ebd6931f23186b3852f04)
+---
+ ArmVirtPkg/ArmVirtQemu.dsc                    |  7 +-
+ .../TerminalPcdProducerLib.c                  | 87 +++++++++++++++++++
+ .../TerminalPcdProducerLib.inf                | 41 +++++++++
+ 3 files changed, 134 insertions(+), 1 deletion(-)
+ create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
+ create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index a3cc3f26ec..696b0b5bcd 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
++++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -237,6 +237,8 @@
+   gEfiMdeModulePkgTokenSpaceGuid.PcdSmbiosDocRev|0x0
+   gUefiOvmfPkgTokenSpaceGuid.PcdQemuSmbiosValidated|FALSE
+ 
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
++
+ [PcdsDynamicHii]
+   gArmVirtTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gArmVirtVariableGuid|0x0|FALSE|NV,BS
+ 
+@@ -314,7 +316,10 @@
+   MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
+   MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitterDxe.inf
+   MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
+-  MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
++  MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf {
++    <LibraryClasses>
++      NULL|ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
++  }
+   MdeModulePkg/Universal/SerialDxe/SerialDxe.inf
+ 
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+diff --git a/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
+new file mode 100644
+index 0000000000..814ad48199
+--- /dev/null
++++ b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
+@@ -0,0 +1,87 @@
++/** @file
++*  Plugin library for setting up dynamic PCDs for TerminalDxe, from fw_cfg
++*
++*  Copyright (C) 2015-2016, Red Hat, Inc.
++*  Copyright (c) 2014, Linaro Ltd. All rights reserved.<BR>
++*
++*  This program and the accompanying materials are licensed and made available
++*  under the terms and conditions of the BSD License which accompanies this
++*  distribution.  The full text of the license may be found at
++*  http://opensource.org/licenses/bsd-license.php
++*
++*  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
++*  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR
++*  IMPLIED.
++*
++**/
++
++#include <Library/DebugLib.h>
++#include <Library/PcdLib.h>
++#include <Library/QemuFwCfgLib.h>
++
++STATIC
++RETURN_STATUS
++GetNamedFwCfgBoolean (
++  IN  CONST CHAR8 *FwCfgFileName,
++  OUT BOOLEAN     *Setting
++  )
++{
++  RETURN_STATUS        Status;
++  FIRMWARE_CONFIG_ITEM FwCfgItem;
++  UINTN                FwCfgSize;
++  UINT8                Value[3];
++
++  Status = QemuFwCfgFindFile (FwCfgFileName, &FwCfgItem, &FwCfgSize);
++  if (RETURN_ERROR (Status)) {
++    return Status;
++  }
++  if (FwCfgSize > sizeof Value) {
++    return RETURN_BAD_BUFFER_SIZE;
++  }
++  QemuFwCfgSelectItem (FwCfgItem);
++  QemuFwCfgReadBytes (FwCfgSize, Value);
++
++  if ((FwCfgSize == 1) ||
++      (FwCfgSize == 2 && Value[1] == '\n') ||
++      (FwCfgSize == 3 && Value[1] == '\r' && Value[2] == '\n')) {
++    switch (Value[0]) {
++      case '0':
++      case 'n':
++      case 'N':
++        *Setting = FALSE;
++        return RETURN_SUCCESS;
++
++      case '1':
++      case 'y':
++      case 'Y':
++        *Setting = TRUE;
++        return RETURN_SUCCESS;
++
++      default:
++        break;
++    }
++  }
++  return RETURN_PROTOCOL_ERROR;
++}
++
++#define UPDATE_BOOLEAN_PCD_FROM_FW_CFG(TokenName)                             \
++          do {                                                                \
++            BOOLEAN       Setting;                                            \
++            RETURN_STATUS PcdStatus;                                          \
++                                                                              \
++            if (!RETURN_ERROR (GetNamedFwCfgBoolean (                         \
++                    "opt/org.tianocore.edk2.aavmf/" #TokenName, &Setting))) { \
++              PcdStatus = PcdSetBoolS (TokenName, Setting);                   \
++              ASSERT_RETURN_ERROR (PcdStatus);                                \
++            }                                                                 \
++          } while (0)
++
++RETURN_STATUS
++EFIAPI
++TerminalPcdProducerLibConstructor (
++  VOID
++  )
++{
++  UPDATE_BOOLEAN_PCD_FROM_FW_CFG (PcdResizeXterm);
++  return RETURN_SUCCESS;
++}
+diff --git a/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
+new file mode 100644
+index 0000000000..fecb37bcdf
+--- /dev/null
++++ b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
+@@ -0,0 +1,41 @@
++## @file
++#  Plugin library for setting up dynamic PCDs for TerminalDxe, from fw_cfg
++#
++#  Copyright (C) 2015-2016, Red Hat, Inc.
++#  Copyright (c) 2014, Linaro Ltd. All rights reserved.<BR>
++#
++#  This program and the accompanying materials are licensed and made available
++#  under the terms and conditions of the BSD License which accompanies this
++#  distribution.  The full text of the license may be found at
++#  http://opensource.org/licenses/bsd-license.php
++#
++#  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
++#  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR
++#  IMPLIED.
++#
++##
++
++[Defines]
++  INF_VERSION                    = 0x00010005
++  BASE_NAME                      = TerminalPcdProducerLib
++  FILE_GUID                      = 4a0c5ed7-8c42-4c01-8f4c-7bf258316a96
++  MODULE_TYPE                    = BASE
++  VERSION_STRING                 = 1.0
++  LIBRARY_CLASS                  = TerminalPcdProducerLib|DXE_DRIVER
++  CONSTRUCTOR                    = TerminalPcdProducerLibConstructor
++
++[Sources]
++  TerminalPcdProducerLib.c
++
++[Packages]
++  MdePkg/MdePkg.dec
++  OvmfPkg/OvmfPkg.dec
++  MdeModulePkg/MdeModulePkg.dec
++
++[LibraryClasses]
++  DebugLib
++  PcdLib
++  QemuFwCfgLib
++
++[Pcd]
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm
+-- 
+2.18.1
+
diff --git a/SOURCES/0014-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch b/SOURCES/0014-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch
new file mode 100644
index 0000000..0023ba2
--- /dev/null
+++ b/SOURCES/0014-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch
@@ -0,0 +1,147 @@
+From 229c88dc3ded9baeaca8b87767dc5c41c05afd6e Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Tue, 4 Nov 2014 23:02:53 +0100
+Subject: OvmfPkg: allow exclusion of the shell from the firmware image (RH
+ only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- update the patch against the following upstream commits:
+  - 4b888334d234 ("OvmfPkg: Remove EdkShellBinPkg in FDF", 2018-11-19)
+  - 277a3958d93a ("OvmfPkg: Don't include TftpDynamicCommand in XCODE5
+                  tool chain", 2018-11-27)
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no change
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- no changes
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- no changes
+
+Message-id: <1415138578-27173-14-git-send-email-lersek@redhat.com>
+Patchwork-id: 62119
+O-Subject:  [RHEL-7.1 ovmf PATCH v2 13/18] OvmfPkg: allow exclusion of the shell
+	from the firmware image (RH only)
+Bugzilla: 1147592
+Acked-by: Andrew Jones <drjones@redhat.com>
+Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+When '-D EXCLUDE_SHELL_FROM_FD' is passed to 'build', exclude the shell
+binary from the firmware image.
+
+Peter Jones advised us that firmware vendors for physical systems disable
+the memory-mapped, firmware image-contained UEFI shell in
+SecureBoot-enabled builds. The reason being that the memory-mapped shell
+can always load, it may have direct access to various hardware in the
+system, and it can run UEFI shell scripts (which cannot be signed at all).
+
+Intended use of the new build option:
+
+- In-tree builds: don't pass '-D EXCLUDE_SHELL_FROM_FD'. The resultant
+  firmware image will contain a shell binary, independently of SecureBoot
+  enablement, which is flexible for interactive development. (Ie. no
+  change for in-tree builds.)
+
+- RPM builds: pass both '-D SECURE_BOOT_ENABLE' and
+  '-D EXCLUDE_SHELL_FROM_FD'. The resultant RPM will provide:
+
+  - OVMF_CODE.fd: SecureBoot-enabled firmware, without builtin UEFI shell,
+
+  - OVMF_VARS.fd: variable store template matching OVMF_CODE.fd,
+
+  - UefiShell.iso: a bootable ISO image with the shell on it as default
+    boot loader. The shell binary will load when SecureBoot is turned off,
+    and won't load when SecureBoot is turned on (because it is not
+    signed).
+
+    UefiShell.iso is the reason we're not excluding the shell from the DSC
+    files as well, only the FDF files -- when '-D EXCLUDE_SHELL_FROM_FD'
+    is specified, the shell binary needs to be built the same, only it
+    will be included in UefiShell.iso.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 9c391def70366cabae08e6008814299c3372fafd)
+(cherry picked from commit d9dd9ee42937b2611fe37183cc9ec7f62d946933)
+(cherry picked from commit 23df46ebbe7b09451d3a05034acd4d3a25e7177b)
+(cherry picked from commit f0303f71d576c51b01c4ff961b429d0e0e707245)
+(cherry picked from commit bbd64eb8658e9a33eab4227d9f4e51ad78d9f687)
+(cherry picked from commit 8628ef1b8d675ebec39d83834abbe3c8c8c42cf4)
+---
+ OvmfPkg/OvmfPkgIa32.fdf    | 2 ++
+ OvmfPkg/OvmfPkgIa32X64.fdf | 2 ++
+ OvmfPkg/OvmfPkgX64.fdf     | 2 ++
+ 3 files changed, 6 insertions(+)
+
+diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
+index 326f82384e..dff2fcd9f6 100644
+--- a/OvmfPkg/OvmfPkgIa32.fdf
++++ b/OvmfPkg/OvmfPkgIa32.fdf
+@@ -278,10 +278,12 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+ 
++!ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+ !endif
+ INF  ShellPkg/Application/Shell/Shell.inf
++!endif
+ 
+ INF MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+ 
+diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
+index aefb6614ad..6684a2e799 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.fdf
++++ b/OvmfPkg/OvmfPkgIa32X64.fdf
+@@ -279,10 +279,12 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+ 
++!ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+ !endif
+ INF  ShellPkg/Application/Shell/Shell.inf
++!endif
+ 
+ INF MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+ 
+diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
+index aefb6614ad..6684a2e799 100644
+--- a/OvmfPkg/OvmfPkgX64.fdf
++++ b/OvmfPkg/OvmfPkgX64.fdf
+@@ -279,10 +279,12 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+ 
++!ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+ !endif
+ INF  ShellPkg/Application/Shell/Shell.inf
++!endif
+ 
+ INF MdeModulePkg/Logo/LogoOpenSSLDxe.inf
+ 
+-- 
+2.18.1
+
diff --git a/SOURCES/0015-ArmPlatformPkg-introduce-fixed-PCD-for-early-hello-m.patch b/SOURCES/0015-ArmPlatformPkg-introduce-fixed-PCD-for-early-hello-m.patch
new file mode 100644
index 0000000..7bdb27e
--- /dev/null
+++ b/SOURCES/0015-ArmPlatformPkg-introduce-fixed-PCD-for-early-hello-m.patch
@@ -0,0 +1,81 @@
+From 9f756c1ad83cc81f7d892cd036d59a2b567b02dc Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 14 Oct 2015 13:49:43 +0200
+Subject: ArmPlatformPkg: introduce fixed PCD for early hello message (RH only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- no changes
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- no changes
+
+Drew has proposed that ARM|AARCH64 platform firmware (especially virtual
+machine firmware) print a reasonably early, simple hello message to the
+serial port, regardless of debug mask settings. This should inform
+interactive users, and provide some rough help in localizing boot
+problems, even with restrictive debug masks.
+
+If a platform doesn't want this feature, it should stick with the default
+empty string.
+
+RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1270279
+Downstream only:
+<http://thread.gmane.org/gmane.comp.bios.edk2.devel/2996/focus=3433>.
+
+Suggested-by: Drew Jones <drjones@redhat.com>
+Contributed-under: TianoCore Contribution Agreement 1.0
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 7ce97b06421434c82095f01a1753a8c9c546cc30)
+(cherry picked from commit 20b1f1cbd0590aa71c6d99d35e23cf08e0707750)
+(cherry picked from commit 6734b88cf7abcaf42632e3d2fc469b2169dd2f16)
+(cherry picked from commit ef77da632559e9baa1c69869e4cbea377068ef27)
+(cherry picked from commit 58755c51d3252312d80cbcb97928d71199c2f5e1)
+(cherry picked from commit c3f07e323e76856f1b42ea7b8c598ba3201c28a2)
+---
+ ArmPlatformPkg/ArmPlatformPkg.dec | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/ArmPlatformPkg/ArmPlatformPkg.dec b/ArmPlatformPkg/ArmPlatformPkg.dec
+index c8ea183313..bab4804a17 100644
+--- a/ArmPlatformPkg/ArmPlatformPkg.dec
++++ b/ArmPlatformPkg/ArmPlatformPkg.dec
+@@ -108,6 +108,13 @@
+   ## If set, this will swap settings for HDLCD RED_SELECT and BLUE_SELECT registers
+   gArmPlatformTokenSpaceGuid.PcdArmHdLcdSwapBlueRedSelect|FALSE|BOOLEAN|0x00000045
+ 
++  #
++  # Early hello message (ASCII string), printed to the serial port.
++  # If set to the empty string, nothing is printed.
++  # Otherwise, a trailing CRLF should be specified explicitly.
++  #
++  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage|""|VOID*|0x00000100
++
+ [PcdsFixedAtBuild.common,PcdsDynamic.common]
+   ## PL031 RealTimeClock
+   gArmPlatformTokenSpaceGuid.PcdPL031RtcBase|0x0|UINT32|0x00000024
+-- 
+2.18.1
+
diff --git a/SOURCES/0016-ArmPlatformPkg-PrePeiCore-write-early-hello-message-.patch b/SOURCES/0016-ArmPlatformPkg-PrePeiCore-write-early-hello-message-.patch
new file mode 100644
index 0000000..ed0b97b
--- /dev/null
+++ b/SOURCES/0016-ArmPlatformPkg-PrePeiCore-write-early-hello-message-.patch
@@ -0,0 +1,133 @@
+From 8d5a8827aabc67cb2a046697e1a750ca8d9cc453 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 14 Oct 2015 13:59:20 +0200
+Subject: ArmPlatformPkg: PrePeiCore: write early hello message to the serial
+ port (RH)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- adapt to upstream commit 7e2a8dfe8a9a ("ArmPlatformPkg/PrePeiCore: seed
+  temporary stack before entering PEI core", 2017-11-09) -- conflict
+  resolution in "ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf"
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- no changes
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- no changes
+
+The FixedPcdGetSize() macro expands to an integer constant, therefore an
+optimizing compiler can eliminate the new code, if the platform DSC
+doesn't override the empty string (size=1) default of
+PcdEarlyHelloMessage.
+
+RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1270279
+Downstream only:
+<http://thread.gmane.org/gmane.comp.bios.edk2.devel/2996/focus=3433>.
+
+Contributed-under: TianoCore Contribution Agreement 1.0
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit b16c4c505ce0e27305235533eac9236aa66f132e)
+(cherry picked from commit 742e5bf6d5ce5a1e73879d6e5c0dd00feda7a9ac)
+(cherry picked from commit 93d69eb9393cf05af90676253875c59c1bec67fd)
+(cherry picked from commit 638594083b191f84f5d9333eb6147a31570f5a5a)
+(cherry picked from commit f4b7aae411d88b2b83f85d20ef06a4032a57e7de)
+(cherry picked from commit bb71490fdda3b38fa9f071d281b863f9b64363bf)
+---
+ ArmPlatformPkg/PrePeiCore/MainMPCore.c          | 5 +++++
+ ArmPlatformPkg/PrePeiCore/MainUniCore.c         | 5 +++++
+ ArmPlatformPkg/PrePeiCore/PrePeiCore.h          | 1 +
+ ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf  | 2 ++
+ ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf | 2 ++
+ 5 files changed, 15 insertions(+)
+
+diff --git a/ArmPlatformPkg/PrePeiCore/MainMPCore.c b/ArmPlatformPkg/PrePeiCore/MainMPCore.c
+index d379ad8b7a..ff1672f94d 100644
+--- a/ArmPlatformPkg/PrePeiCore/MainMPCore.c
++++ b/ArmPlatformPkg/PrePeiCore/MainMPCore.c
+@@ -111,6 +111,11 @@ PrimaryMain (
+   UINTN                       TemporaryRamBase;
+   UINTN                       TemporaryRamSize;
+ 
++  if (FixedPcdGetSize (PcdEarlyHelloMessage) > 1) {
++    SerialPortWrite (FixedPcdGetPtr (PcdEarlyHelloMessage),
++      FixedPcdGetSize (PcdEarlyHelloMessage) - 1);
++  }
++
+   CreatePpiList (&PpiListSize, &PpiList);
+ 
+   // Enable the GIC Distributor
+diff --git a/ArmPlatformPkg/PrePeiCore/MainUniCore.c b/ArmPlatformPkg/PrePeiCore/MainUniCore.c
+index 1500d2bd51..5b0790beac 100644
+--- a/ArmPlatformPkg/PrePeiCore/MainUniCore.c
++++ b/ArmPlatformPkg/PrePeiCore/MainUniCore.c
+@@ -29,6 +29,11 @@ PrimaryMain (
+   UINTN                       TemporaryRamBase;
+   UINTN                       TemporaryRamSize;
+ 
++  if (FixedPcdGetSize (PcdEarlyHelloMessage) > 1) {
++    SerialPortWrite (FixedPcdGetPtr (PcdEarlyHelloMessage),
++      FixedPcdGetSize (PcdEarlyHelloMessage) - 1);
++  }
++
+   CreatePpiList (&PpiListSize, &PpiList);
+ 
+   // Adjust the Temporary Ram as the new Ppi List (Common + Platform Ppi Lists) is created at
+diff --git a/ArmPlatformPkg/PrePeiCore/PrePeiCore.h b/ArmPlatformPkg/PrePeiCore/PrePeiCore.h
+index 7140c7f5b5..1d69a2b468 100644
+--- a/ArmPlatformPkg/PrePeiCore/PrePeiCore.h
++++ b/ArmPlatformPkg/PrePeiCore/PrePeiCore.h
+@@ -15,6 +15,7 @@
+ #include <Library/DebugLib.h>
+ #include <Library/IoLib.h>
+ #include <Library/PcdLib.h>
++#include <Library/SerialPortLib.h>
+ 
+ #include <PiPei.h>
+ #include <Ppi/TemporaryRamSupport.h>
+diff --git a/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf b/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf
+index f2ac45d171..fc93fda965 100644
+--- a/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf
++++ b/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf
+@@ -67,6 +67,8 @@
+   gArmPlatformTokenSpaceGuid.PcdCPUCorePrimaryStackSize
+   gArmPlatformTokenSpaceGuid.PcdCPUCoreSecondaryStackSize
+ 
++  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage
++
+   gArmTokenSpaceGuid.PcdGicDistributorBase
+   gArmTokenSpaceGuid.PcdGicInterruptInterfaceBase
+   gArmTokenSpaceGuid.PcdGicSgiIntId
+diff --git a/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf b/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
+index 84c319c367..46d1b30978 100644
+--- a/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
++++ b/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
+@@ -65,4 +65,6 @@
+   gArmPlatformTokenSpaceGuid.PcdCPUCorePrimaryStackSize
+   gArmPlatformTokenSpaceGuid.PcdCPUCoreSecondaryStackSize
+ 
++  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage
++
+   gEfiMdeModulePkgTokenSpaceGuid.PcdInitValueInTempStack
+-- 
+2.18.1
+
diff --git a/SOURCES/0017-ArmVirtPkg-set-early-hello-message-RH-only.patch b/SOURCES/0017-ArmVirtPkg-set-early-hello-message-RH-only.patch
new file mode 100644
index 0000000..9330386
--- /dev/null
+++ b/SOURCES/0017-ArmVirtPkg-set-early-hello-message-RH-only.patch
@@ -0,0 +1,68 @@
+From ba73b99d5cb38f87c1a8f0936d515eaaefa3f04b Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 14 Oct 2015 14:07:17 +0200
+Subject: ArmVirtPkg: set early hello message (RH only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- resolve context conflict with upstream commit eaa1e98ae31d ("ArmVirtPkg:
+  don't set PcdCoreCount", 2019-02-13)
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- no changes
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- no changes
+
+Print a friendly banner on QEMU, regardless of debug mask settings.
+
+RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1270279
+Downstream only:
+<http://thread.gmane.org/gmane.comp.bios.edk2.devel/2996/focus=3433>.
+
+Contributed-under: TianoCore Contribution Agreement 1.0
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 5d4a15b9019728b2d96322bc679099da49916925)
+(cherry picked from commit 179df76dbb0d199bd905236e98775b4059c6502a)
+(cherry picked from commit ce3f59d0710c24c162d5222bbf5cd7e36180c80c)
+(cherry picked from commit c201a8e6ae28d75f7ba581828b533c3b26fa7f18)
+(cherry picked from commit 2d4db6ec70e004cd9ac147615d17033bee5d3b18)
+(cherry picked from commit fb2032bbea7e02c426855cf86a323556d493fd8a)
+---
+ ArmVirtPkg/ArmVirtQemu.dsc | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index 696b0b5bcd..08c7a36339 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
++++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -101,6 +101,7 @@
+   gEfiMdeModulePkgTokenSpaceGuid.PcdTurnOffUsbLegacySupport|TRUE
+ 
+ [PcdsFixedAtBuild.common]
++  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage|"UEFI firmware starting.\r\n"
+ !if $(ARCH) == AARCH64
+   gArmTokenSpaceGuid.PcdVFPEnabled|1
+ !endif
+-- 
+2.18.1
+
diff --git a/SOURCES/0018-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch b/SOURCES/0018-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
new file mode 100644
index 0000000..ed65592
--- /dev/null
+++ b/SOURCES/0018-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
@@ -0,0 +1,94 @@
+From 3cb92f9ba18ac79911bd5258ff4f949cc617ae89 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 21 Nov 2017 00:57:45 +0100
+Subject: OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Message-id: <20171120235748.29669-5-pbonzini@redhat.com>
+Patchwork-id: 77760
+O-Subject:  [PATCH 4/7] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
+Bugzilla: 1488247
+Acked-by: Laszlo Ersek <lersek@redhat.com>
+Acked-by: Thomas Huth <thuth@redhat.com>
+
+From: Laszlo Ersek <lersek@redhat.com>
+
+Set the DEBUG_VERBOSE bit (0x00400000) in the log mask. We want detailed
+debug messages, and code in OvmfPkg logs many messages on the
+DEBUG_VERBOSE level.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(this patch was previously applied as commit 78d3ed73172b5738e32d2b0bc03f7984b9584117)
+(cherry picked from commit 7aeeaabc9871f657e65d2b99d81011b4964a1ce9)
+(cherry picked from commit a0617a6be1a80966099ddceb010f89202a79ee76)
+(cherry picked from commit 759bd3f591e2db699bdef4c7ea4e97c908e7f027)
+(cherry picked from commit 7e6d5dc4078c64be6d55d8fc3317c59a91507a50)
+---
+ OvmfPkg/OvmfPkgIa32.dsc    | 2 +-
+ OvmfPkg/OvmfPkgIa32X64.dsc | 2 +-
+ OvmfPkg/OvmfPkgX64.dsc     | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index accf5c0211..759075a815 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -479,7 +479,7 @@
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+ 
+ !ifdef $(SOURCE_DEBUG_ENABLE)
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 8812da9943..634e20f09c 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -484,7 +484,7 @@
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+ 
+ !ifdef $(SOURCE_DEBUG_ENABLE)
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index 73e1b7824f..bc5a345a37 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -484,7 +484,7 @@
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+ 
+ !ifdef $(SOURCE_DEBUG_ENABLE)
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+-- 
+2.18.1
+
diff --git a/SOURCES/0019-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch b/SOURCES/0019-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
new file mode 100644
index 0000000..ca0d4d0
--- /dev/null
+++ b/SOURCES/0019-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
@@ -0,0 +1,141 @@
+From c8c3f893e7c3710afe45c46839e97954871536e4 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 21 Nov 2017 00:57:46 +0100
+Subject: OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
+ QemuVideoDxe/QemuRamfbDxe (RH)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- Due to upstream commit 4b04d9d73604 ("OvmfPkg: Don't build in
+  QemuVideoDxe when we have CSM", 2019-06-26), the contexts of
+  "QemuVideoDxe.inf" / "QemuRamfbDxe.inf" have changed in the DSC files.
+  Resolve the conflict manually.
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- Upstream commit 1d25ff51af5c ("OvmfPkg: add QemuRamfbDxe", 2018-06-14)
+  introduced another GOP driver that consumes FrameBufferBltLib, and
+  thereby produces a large number of (mostly useless) debug messages at
+  the DEBUG_VERBOSE level. Extend the patch to suppress those messages in
+  both QemuVideoDxe and QemuRamfbDxe; update the subject accordingly.
+  QemuRamfbDxe itself doesn't log anything at the VERBOSE level (see also
+  the original commit message at the bottom of this downstream patch).
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Message-id: <20171120235748.29669-6-pbonzini@redhat.com>
+Patchwork-id: 77761
+O-Subject:  [PATCH 5/7] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in
+	QemuVideoDxe (RH only)
+Bugzilla: 1488247
+Acked-by: Laszlo Ersek <lersek@redhat.com>
+Acked-by: Thomas Huth <thuth@redhat.com>
+
+From: Laszlo Ersek <lersek@redhat.com>
+
+In commit 5b2291f9567a ("OvmfPkg: QemuVideoDxe uses
+MdeModulePkg/FrameBufferLib"), QemuVideoDxe was rebased to
+FrameBufferBltLib.
+
+The FrameBufferBltLib instance added in commit b1ca386074bd
+("MdeModulePkg: Add FrameBufferBltLib library instance") logs many
+messages on the VERBOSE level; for example, a normal boot with OVMF can
+produce 500+ "VideoFill" messages, dependent on the progress bar, when the
+VERBOSE bit is set in PcdDebugPrintErrorLevel.
+
+QemuVideoDxe itself doesn't log anything at the VERBOSE level, so we lose
+none of its messages this way.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(this patch was previously applied as commit 9b0d031dee7e823f6717bab73e422fbc6f0a6c52)
+(cherry picked from commit 9122d5f2e8d8d289064d1e1700cb61964d9931f3)
+(cherry picked from commit 7eb3be1d4ccafc26c11fe5afb95cc12b250ce6f0)
+(cherry picked from commit bd650684712fb840dbcda5d6eaee065bd9e91fa1)
+(cherry picked from commit b06b87f8ffd4fed4ef7eacb13689a9b6d111f850)
+---
+ OvmfPkg/OvmfPkgIa32.dsc    | 10 ++++++++--
+ OvmfPkg/OvmfPkgIa32X64.dsc | 10 ++++++++--
+ OvmfPkg/OvmfPkgX64.dsc     | 10 ++++++++--
+ 3 files changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 759075a815..6a07a6af81 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -742,9 +742,15 @@
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+ !ifndef $(CSM_ENABLE)
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+ !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ 
+   #
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 634e20f09c..c7f52992e9 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -755,9 +755,15 @@
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+ !ifndef $(CSM_ENABLE)
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+ !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ 
+   #
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index bc5a345a37..594ecb5362 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -753,9 +753,15 @@
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+ !ifndef $(CSM_ENABLE)
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+ !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ 
+   #
+-- 
+2.18.1
+
diff --git a/SOURCES/0020-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch b/SOURCES/0020-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
new file mode 100644
index 0000000..efee09b
--- /dev/null
+++ b/SOURCES/0020-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
@@ -0,0 +1,85 @@
+From e5b8152bced2364a1ded0926dbba4d65e23e3f84 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 27 Jan 2016 03:05:18 +0100
+Subject: ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in QemuRamfbDxe (RH
+ only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- The previous version of this patch (downstream commit 76b4ac28e975)
+  caused a regression (RHBZ#1714446), which was fixed up in downstream
+  commit 5a216abaa737 ("ArmVirtPkg: silence DEBUG_VERBOSE masking
+  ~0x00400000 in QemuRamfbDxe (RH only)", 2019-08-05).
+
+  Squash the fixup into the original patch. Fuse the commit messages.
+  (Acked-by tags are not preserved, lest we confuse ourselves while
+  reviewing this rebase.)
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- new patch, due to upstream commit c64688f36a8b ("ArmVirtPkg: add
+  QemuRamfbDxe", 2018-06-14)
+
+QemuRamfbDxe uses FrameBufferLib. The FrameBufferBltLib instance added in
+commit b1ca386074bd ("MdeModulePkg: Add FrameBufferBltLib library
+instance") logs many messages on the VERBOSE level; for example, a normal
+boot with ArmVirtQemu[Kernel] can produce 500+ "VideoFill" messages,
+dependent on the progress bar, when the VERBOSE bit is set in
+PcdDebugPrintErrorLevel.
+
+Clear the VERBOSE bit without touching other bits -- those other bits
+differ between the "silent" and "verbose" builds, so we can't set them as
+constants.
+
+QemuRamfbDxe itself doesn't log anything at the VERBOSE level, so we lose
+none of its messages, with the VERBOSE bit clear.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 76b4ac28e975bd63c25db903a1d42c47b38cc756)
+Reported-by: Andrew Jones <drjones@redhat.com>
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daude <philmd@redhat.com>
+(cherry picked from commit 5a216abaa737195327235e37563b18a6bf2a74dc)
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+---
+ ArmVirtPkg/ArmVirtQemu.dsc       | 5 ++++-
+ ArmVirtPkg/ArmVirtQemuKernel.dsc | 5 ++++-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index 08c7a36339..b3dcdd747b 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
++++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -422,7 +422,10 @@
+   #
+   # Video support
+   #
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|($(DEBUG_PRINT_ERROR_LEVEL)) & 0xFFBFFFFF
++  }
+   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+   OvmfPkg/PlatformDxe/Platform.inf
+ 
+diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+index 27e65b7638..008181055a 100644
+--- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
++++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+@@ -400,7 +400,10 @@
+   #
+   # Video support
+   #
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|($(DEBUG_PRINT_ERROR_LEVEL)) & 0xFFBFFFFF
++  }
+   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+   OvmfPkg/PlatformDxe/Platform.inf
+ 
+-- 
+2.18.1
+
diff --git a/SOURCES/0021-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch b/SOURCES/0021-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
new file mode 100644
index 0000000..da55568
--- /dev/null
+++ b/SOURCES/0021-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
@@ -0,0 +1,83 @@
+From aa2b66b18a62d652bdbefae7b5732297294306ca Mon Sep 17 00:00:00 2001
+From: Philippe Mathieu-Daude <philmd@redhat.com>
+Date: Thu, 1 Aug 2019 20:43:48 +0200
+Subject: OvmfPkg: QemuRamfbDxe: Do not report DXE failure on Aarch64 silent
+ builds (RH only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- We have to carry this downstream-only patch -- committed originally as
+  aaaedc1e2cfd -- indefinitely.
+
+- To avoid confusion, remove the tags from the commit message that had
+  been added by the downstream maintainer scripts, such as: Message-id,
+  Patchwork-id, O-Subject, Acked-by. These remain available on the
+  original downstream commit. The Bugzilla line is preserved, as it
+  doesn't relate to a specific posting, but to the problem.
+
+Bugzilla: 1714446
+
+To suppress an error message on the silent build when ramfb is
+not configured, change QemuRamfbDxe to return EFI_SUCCESS even
+when it fails.
+Some memory is wasted (driver stays resident without
+any good use), but it is mostly harmless, as the memory
+is released by the OS after ExitBootServices().
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daude <philmd@redhat.com>
+(cherry picked from commit aaaedc1e2cfd55ef003fb1b5a37c73a196b26dc7)
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+---
+ OvmfPkg/QemuRamfbDxe/QemuRamfb.c      | 14 ++++++++++++++
+ OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf |  1 +
+ 2 files changed, 15 insertions(+)
+
+diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
+index 0d49d8bbab..dbf9bcbe16 100644
+--- a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
++++ b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
+@@ -13,6 +13,7 @@
+ #include <Library/BaseLib.h>
+ #include <Library/BaseMemoryLib.h>
+ #include <Library/DebugLib.h>
++#include <Library/DebugPrintErrorLevelLib.h>
+ #include <Library/DevicePathLib.h>
+ #include <Library/FrameBufferBltLib.h>
+ #include <Library/MemoryAllocationLib.h>
+@@ -242,6 +243,19 @@ InitializeQemuRamfb (
+ 
+   Status = QemuFwCfgFindFile ("etc/ramfb", &mRamfbFwCfgItem, &FwCfgSize);
+   if (EFI_ERROR (Status)) {
++#if defined (MDE_CPU_AARCH64)
++    //
++    // RHBZ#1714446
++    // If no ramfb device was configured, this platform DXE driver should
++    // returns EFI_NOT_FOUND, so the DXE Core can unload it. However, even
++    // using a silent build, an error message is issued to the guest console.
++    // Since this confuse users, return success and stay resident. The wasted
++    // guest RAM still gets freed later after ExitBootServices().
++    //
++    if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
++      return EFI_SUCCESS;
++    }
++#endif
+     return EFI_NOT_FOUND;
+   }
+   if (FwCfgSize != sizeof (RAMFB_CONFIG)) {
+diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
+index e3890b8c20..6ffee5acb2 100644
+--- a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++++ b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
+@@ -29,6 +29,7 @@
+   BaseLib
+   BaseMemoryLib
+   DebugLib
++  DebugPrintErrorLevelLib
+   DevicePathLib
+   FrameBufferBltLib
+   MemoryAllocationLib
+-- 
+2.18.1
+
diff --git a/SOURCES/0022-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch b/SOURCES/0022-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
new file mode 100644
index 0000000..fd79c90
--- /dev/null
+++ b/SOURCES/0022-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
@@ -0,0 +1,104 @@
+From b8d0ebded8c2cf5b266c807519e2d8ccfd66fee6 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 21 Nov 2017 00:57:47 +0100
+Subject: OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in NvmExpressDxe (RH
+ only)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no change
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no change
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Message-id: <20171120235748.29669-7-pbonzini@redhat.com>
+Patchwork-id: 77759
+O-Subject:  [PATCH 6/7] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in
+	NvmExpressDxe (RH only)
+Bugzilla: 1488247
+Acked-by: Laszlo Ersek <lersek@redhat.com>
+Acked-by: Thomas Huth <thuth@redhat.com>
+
+From: Laszlo Ersek <lersek@redhat.com>
+
+NvmExpressDxe logs all BlockIo read & write calls on the EFI_D_VERBOSE
+level.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(this patch was previously applied as commit 5f432837b9c60c2929b13dda1a1b488d5c3a6d2f)
+(cherry picked from commit 33e00146eb878588ad1395d7b1ae38f401729da4)
+(cherry picked from commit bd10cabcfcb1bc9a32b05062f4ee3792e27bc2d8)
+(cherry picked from commit 5a27af700f49e00608f232f618dedd7bf5e9b3e6)
+(cherry picked from commit 58bba429b9ec7b78109940ef945d0dc93f3cd958)
+---
+ OvmfPkg/OvmfPkgIa32.dsc    | 5 ++++-
+ OvmfPkg/OvmfPkgIa32X64.dsc | 5 ++++-
+ OvmfPkg/OvmfPkgX64.dsc     | 5 ++++-
+ 3 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 6a07a6af81..1c56e0948a 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -735,7 +735,10 @@
+   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index c7f52992e9..29e12c9dff 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -748,7 +748,10 @@
+   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index 594ecb5362..11fe9f6050 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -746,7 +746,10 @@
+   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+-- 
+2.18.1
+
diff --git a/SOURCES/0033-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch b/SOURCES/0033-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
new file mode 100644
index 0000000..da424bc
--- /dev/null
+++ b/SOURCES/0033-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
@@ -0,0 +1,79 @@
+From 57bd3f146590df8757865d8f2cdd1db3cf3f4d40 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Sat, 16 Nov 2019 17:11:27 +0100
+Subject: CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files in the INFs
+ (RH)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- new patch
+
+The downstream changes in RHEL8's OpenSSL package, for example in
+"openssl-1.1.1-evp-kdf.patch", introduce new files, and even move some
+preexistent code into those new files. In order to avoid undefined
+references in link editing, we have to list the new files.
+
+Note: "process_files.pl" is not re-run at this time manually, because
+
+(a) "process_files.pl" would pollute the file list (and some of the
+    auto-generated header files) with RHEL8-specific FIPS artifacts, which
+    are explicitly unwanted in edk2,
+
+(b) The RHEL OpenSSL maintainer, Tomas Mraz, identified this specific set
+    of files in <https://bugzilla.redhat.com/show_bug.cgi?id=1749693#c10>,
+    and will help with future changes too.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+---
+ CryptoPkg/Library/OpensslLib/OpensslLib.inf       | 11 +++++++++++
+ CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 11 +++++++++++
+ 2 files changed, 22 insertions(+)
+
+diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
+index dd873a0dcd..d1c7602b87 100644
+--- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
++++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
+@@ -598,6 +598,17 @@
+   $(OPENSSL_PATH)/ssl/record/record.h
+   $(OPENSSL_PATH)/ssl/record/record_locl.h
+ # Autogenerated files list ends here
++# RHEL8-specific OpenSSL file list starts here
++  $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
++  $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
++  $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
++  $(OPENSSL_PATH)/crypto/kdf/kdf_local.h
++  $(OPENSSL_PATH)/crypto/kdf/kdf_util.c
++  $(OPENSSL_PATH)/crypto/kdf/krb5kdf.c
++  $(OPENSSL_PATH)/crypto/kdf/pbkdf2.c
++  $(OPENSSL_PATH)/crypto/kdf/sshkdf.c
++  $(OPENSSL_PATH)/crypto/kdf/sskdf.c
++# RHEL8-specific OpenSSL file list ends here
+ 
+   ossl_store.c
+   rand_pool.c
+diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+index a1bb560255..0785a421dd 100644
+--- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
++++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
+@@ -546,6 +546,17 @@
+   $(OPENSSL_PATH)/crypto/objects/obj_lcl.h
+   $(OPENSSL_PATH)/crypto/objects/obj_xref.h
+ # Autogenerated files list ends here
++# RHEL8-specific OpenSSL file list starts here
++  $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
++  $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
++  $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
++  $(OPENSSL_PATH)/crypto/kdf/kdf_local.h
++  $(OPENSSL_PATH)/crypto/kdf/kdf_util.c
++  $(OPENSSL_PATH)/crypto/kdf/krb5kdf.c
++  $(OPENSSL_PATH)/crypto/kdf/pbkdf2.c
++  $(OPENSSL_PATH)/crypto/kdf/sshkdf.c
++  $(OPENSSL_PATH)/crypto/kdf/sskdf.c
++# RHEL8-specific OpenSSL file list ends here
+   buildinf.h
+   rand_pool_noise.h
+   ossl_store.c
+-- 
+2.18.1
+
diff --git a/SOURCES/LICENSE.qosb b/SOURCES/LICENSE.qosb
new file mode 100644
index 0000000..9849381
--- /dev/null
+++ b/SOURCES/LICENSE.qosb
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 Patrick Uiterwijk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/SOURCES/edk2-CryptoPkg-Crt-import-inet_pton.c-CVE-2019-14553.patch b/SOURCES/edk2-CryptoPkg-Crt-import-inet_pton.c-CVE-2019-14553.patch
new file mode 100644
index 0000000..fba10c3
--- /dev/null
+++ b/SOURCES/edk2-CryptoPkg-Crt-import-inet_pton.c-CVE-2019-14553.patch
@@ -0,0 +1,338 @@
+From 3c9574af677c24b969c3baa6a527dabaf97f11a2 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Mon, 2 Dec 2019 12:31:53 +0100
+Subject: [PATCH 5/9] CryptoPkg/Crt: import "inet_pton.c" (CVE-2019-14553)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20191117220052.15700-6-lersek@redhat.com>
+Patchwork-id: 92461
+O-Subject: [RHEL-8.2.0 edk2 PATCH 5/9] CryptoPkg/Crt: import "inet_pton.c" (CVE-2019-14553)
+Bugzilla: 1536624
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+For TianoCore BZ#1734, StdLib has been moved from the edk2 project to the
+edk2-libc project, in commit 964f432b9b0a ("edk2: Remove AppPkg, StdLib,
+StdLibPrivateInternalFiles", 2019-04-29).
+
+We'd like to use the inet_pton() function in CryptoPkg. Resurrect the
+"inet_pton.c" file from just before the StdLib removal, as follows:
+
+  $ git show \
+      964f432b9b0a^:StdLib/BsdSocketLib/inet_pton.c \
+      > CryptoPkg/Library/BaseCryptLib/SysCall/inet_pton.c
+
+The inet_pton() function is only intended for the DXE phase at this time,
+therefore only the "BaseCryptLib" instance INF file receives the new file.
+
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiaxin Wu <jiaxin.wu@intel.com>
+Cc: Sivaraman Nainar <sivaramann@amiindia.co.in>
+Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960
+CVE: CVE-2019-14553
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
+Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
+(cherry picked from commit 8d16ef8269b2ff373d8da674e59992adfdc032d3)
+---
+ CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf    |   1 +
+ CryptoPkg/Library/BaseCryptLib/SysCall/inet_pton.c | 257 +++++++++++++++++++++
+ CryptoPkg/Library/Include/CrtLibSupport.h          |   1 +
+ 3 files changed, 259 insertions(+)
+ create mode 100644 CryptoPkg/Library/BaseCryptLib/SysCall/inet_pton.c
+
+diff --git a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+index 8d4988e..b5cfd8b 100644
+--- a/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
++++ b/CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+@@ -58,6 +58,7 @@
+   SysCall/CrtWrapper.c
+   SysCall/TimerWrapper.c
+   SysCall/BaseMemAllocation.c
++  SysCall/inet_pton.c
+ 
+ [Sources.Ia32]
+   Rand/CryptRandTsc.c
+diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/inet_pton.c b/CryptoPkg/Library/BaseCryptLib/SysCall/inet_pton.c
+new file mode 100644
+index 0000000..32e1ab8
+--- /dev/null
++++ b/CryptoPkg/Library/BaseCryptLib/SysCall/inet_pton.c
+@@ -0,0 +1,257 @@
++/* Copyright (c) 1996 by Internet Software Consortium.
++ *
++ * Permission to use, copy, modify, and distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
++ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
++ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
++ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
++ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
++ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
++ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
++ * SOFTWARE.
++ */
++
++/*
++ * Portions copyright (c) 1999, 2000
++ * Intel Corporation.
++ * All rights reserved.
++ * 
++ * Redistribution and use in source and binary forms, with or without
++ * modification, are permitted provided that the following conditions
++ * are met:
++ * 
++ * 1. Redistributions of source code must retain the above copyright
++ *    notice, this list of conditions and the following disclaimer.
++ * 
++ * 2. Redistributions in binary form must reproduce the above copyright
++ *    notice, this list of conditions and the following disclaimer in the
++ *    documentation and/or other materials provided with the distribution.
++ * 
++ * 3. All advertising materials mentioning features or use of this software
++ *    must display the following acknowledgement:
++ * 
++ *    This product includes software developed by Intel Corporation and
++ *    its contributors.
++ * 
++ * 4. Neither the name of Intel Corporation or its contributors may be
++ *    used to endorse or promote products derived from this software
++ *    without specific prior written permission.
++ * 
++ * THIS SOFTWARE IS PROVIDED BY INTEL CORPORATION AND CONTRIBUTORS ``AS IS''
++ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
++ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
++ * ARE DISCLAIMED.  IN NO EVENT SHALL INTEL CORPORATION OR CONTRIBUTORS BE
++ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
++ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
++ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
++ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
++ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
++ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
++ * THE POSSIBILITY OF SUCH DAMAGE.
++ * 
++ */
++
++#if defined(LIBC_SCCS) && !defined(lint)
++static char rcsid[] = "$Id: inet_pton.c,v 1.1.1.1 2003/11/19 01:51:30 kyu3 Exp $";
++#endif /* LIBC_SCCS and not lint */
++
++#include <sys/param.h>
++#include <sys/types.h>
++#include <sys/socket.h>
++#include <netinet/in.h>
++#include <arpa/inet.h>
++#include <arpa/nameser.h>
++#include <string.h>
++#include <errno.h>
++
++/*
++ * WARNING: Don't even consider trying to compile this on a system where
++ * sizeof(int) < 4.  sizeof(int) > 4 is fine; all the world's not a VAX.
++ */
++
++static int	inet_pton4 (const char *src, u_char *dst);
++static int	inet_pton6 (const char *src, u_char *dst);
++
++/* int
++ * inet_pton(af, src, dst)
++ *	convert from presentation format (which usually means ASCII printable)
++ *	to network format (which is usually some kind of binary format).
++ * return:
++ *	1 if the address was valid for the specified address family
++ *	0 if the address wasn't valid (`dst' is untouched in this case)
++ *	-1 if some other error occurred (`dst' is untouched in this case, too)
++ * author:
++ *	Paul Vixie, 1996.
++ */
++int
++inet_pton(
++	int af,
++	const char *src,
++	void *dst
++	)
++{
++	switch (af) {
++	case AF_INET:
++		return (inet_pton4(src, dst));
++	case AF_INET6:
++		return (inet_pton6(src, dst));
++	default:
++		errno = EAFNOSUPPORT;
++		return (-1);
++	}
++	/* NOTREACHED */
++}
++
++/* int
++ * inet_pton4(src, dst)
++ *	like inet_aton() but without all the hexadecimal and shorthand.
++ * return:
++ *	1 if `src' is a valid dotted quad, else 0.
++ * notice:
++ *	does not touch `dst' unless it's returning 1.
++ * author:
++ *	Paul Vixie, 1996.
++ */
++static int
++inet_pton4(
++	const char *src,
++	u_char *dst
++	)
++{
++	static const char digits[] = "0123456789";
++	int saw_digit, octets, ch;
++	u_char tmp[NS_INADDRSZ], *tp;
++
++	saw_digit = 0;
++	octets = 0;
++	*(tp = tmp) = 0;
++	while ((ch = *src++) != '\0') {
++		const char *pch;
++
++		if ((pch = strchr(digits, ch)) != NULL) {
++			u_int new = *tp * 10 + (u_int)(pch - digits);
++
++			if (new > 255)
++				return (0);
++			*tp = (u_char)new;
++			if (! saw_digit) {
++				if (++octets > 4)
++					return (0);
++				saw_digit = 1;
++			}
++		} else if (ch == '.' && saw_digit) {
++			if (octets == 4)
++				return (0);
++			*++tp = 0;
++			saw_digit = 0;
++		} else
++			return (0);
++	}
++	if (octets < 4)
++		return (0);
++
++	memcpy(dst, tmp, NS_INADDRSZ);
++	return (1);
++}
++
++/* int
++ * inet_pton6(src, dst)
++ *	convert presentation level address to network order binary form.
++ * return:
++ *	1 if `src' is a valid [RFC1884 2.2] address, else 0.
++ * notice:
++ *	(1) does not touch `dst' unless it's returning 1.
++ *	(2) :: in a full address is silently ignored.
++ * credit:
++ *	inspired by Mark Andrews.
++ * author:
++ *	Paul Vixie, 1996.
++ */
++static int
++inet_pton6(
++	const char *src,
++	u_char *dst
++	)
++{
++	static const char xdigits_l[] = "0123456789abcdef",
++			  xdigits_u[] = "0123456789ABCDEF";
++	u_char tmp[NS_IN6ADDRSZ], *tp, *endp, *colonp;
++	const char *xdigits, *curtok;
++	int ch, saw_xdigit;
++	u_int val;
++
++	memset((tp = tmp), '\0', NS_IN6ADDRSZ);
++	endp = tp + NS_IN6ADDRSZ;
++	colonp = NULL;
++	/* Leading :: requires some special handling. */
++	if (*src == ':')
++		if (*++src != ':')
++			return (0);
++	curtok = src;
++	saw_xdigit = 0;
++	val = 0;
++	while ((ch = *src++) != '\0') {
++		const char *pch;
++
++		if ((pch = strchr((xdigits = xdigits_l), ch)) == NULL)
++			pch = strchr((xdigits = xdigits_u), ch);
++		if (pch != NULL) {
++			val <<= 4;
++			val |= (pch - xdigits);
++			if (val > 0xffff)
++				return (0);
++			saw_xdigit = 1;
++			continue;
++		}
++		if (ch == ':') {
++			curtok = src;
++			if (!saw_xdigit) {
++				if (colonp)
++					return (0);
++				colonp = tp;
++				continue;
++			}
++			if (tp + NS_INT16SZ > endp)
++				return (0);
++			*tp++ = (u_char) (val >> 8) & 0xff;
++			*tp++ = (u_char) val & 0xff;
++			saw_xdigit = 0;
++			val = 0;
++			continue;
++		}
++		if (ch == '.' && ((tp + NS_INADDRSZ) <= endp) &&
++		    inet_pton4(curtok, tp) > 0) {
++			tp += NS_INADDRSZ;
++			saw_xdigit = 0;
++			break;	/* '\0' was seen by inet_pton4(). */
++		}
++		return (0);
++	}
++	if (saw_xdigit) {
++		if (tp + NS_INT16SZ > endp)
++			return (0);
++		*tp++ = (u_char) (val >> 8) & 0xff;
++		*tp++ = (u_char) val & 0xff;
++	}
++	if (colonp != NULL) {
++		/*
++		 * Since some memmove()'s erroneously fail to handle
++		 * overlapping regions, we'll do the shift by hand.
++		 */
++		const int n = (int)(tp - colonp);
++		int i;
++
++		for (i = 1; i <= n; i++) {
++			endp[- i] = colonp[n - i];
++			colonp[n - i] = 0;
++		}
++		tp = endp;
++	}
++	if (tp != endp)
++		return (0);
++	memcpy(dst, tmp, NS_IN6ADDRSZ);
++	return (1);
++}
+diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h b/CryptoPkg/Library/Include/CrtLibSupport.h
+index e603fad..5a20ba6 100644
+--- a/CryptoPkg/Library/Include/CrtLibSupport.h
++++ b/CryptoPkg/Library/Include/CrtLibSupport.h
+@@ -192,6 +192,7 @@ void           abort       (void) __attribute__((__noreturn__));
+ #else
+ void           abort       (void);
+ #endif
++int            inet_pton   (int, const char *, void *);
+ 
+ //
+ // Macros that directly map functions to BaseLib, BaseMemoryLib, and DebugLib functions
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-CryptoPkg-Crt-satisfy-inet_pton.c-dependencies-CVE-2.patch b/SOURCES/edk2-CryptoPkg-Crt-satisfy-inet_pton.c-dependencies-CVE-2.patch
new file mode 100644
index 0000000..e38a454
--- /dev/null
+++ b/SOURCES/edk2-CryptoPkg-Crt-satisfy-inet_pton.c-dependencies-CVE-2.patch
@@ -0,0 +1,188 @@
+From 1ab1024f94401300fe9a1d5cdce6c15a2b091e02 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Mon, 2 Dec 2019 12:31:50 +0100
+Subject: [PATCH 4/9] CryptoPkg/Crt: satisfy "inet_pton.c" dependencies
+ (CVE-2019-14553)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20191117220052.15700-5-lersek@redhat.com>
+Patchwork-id: 92453
+O-Subject: [RHEL-8.2.0 edk2 PATCH 4/9] CryptoPkg/Crt: satisfy "inet_pton.c" dependencies (CVE-2019-14553)
+Bugzilla: 1536624
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+In a later patch in this series, we're going to resurrect "inet_pton.c"
+(originally from the StdLib package). That source file has a number of
+standard C and BSD socket dependencies. Provide those dependencies here:
+
+- The header files below will simply #include <CrtLibSupport.h>:
+
+  - arpa/inet.h
+  - arpa/nameser.h
+  - netinet/in.h
+  - sys/param.h
+  - sys/socket.h
+
+- EAFNOSUPPORT comes from "StdLib/Include/errno.h", at commit
+  e2d3a25f1a31; which is the commit immediately preceding the removal of
+  StdLib from edk2 (964f432b9b0a).
+
+  Note that the other error macro, which we alread #define, namely EINVAL,
+  has a value (22) that also matches "StdLib/Include/errno.h".
+
+- The AF_INET and AF_INET6 address family macros come from
+  "StdLib/Include/sys/socket.h".
+
+- The NS_INT16SZ, NS_INADDRSZ and NS_IN6ADDRSZ macros come from
+  "StdLib/Include/arpa/nameser.h".
+
+- The "u_int" and "u_char" types come from "StdLib/Include/sys/types.h".
+
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiaxin Wu <jiaxin.wu@intel.com>
+Cc: Sivaraman Nainar <sivaramann@amiindia.co.in>
+Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960
+CVE: CVE-2019-14553
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
+Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
+(cherry picked from commit 2ac41c12c0d4b3d3ee8f905ab80da019e784de00)
+---
+ CryptoPkg/Library/Include/CrtLibSupport.h | 16 ++++++++++++++++
+ CryptoPkg/Library/Include/arpa/inet.h     |  9 +++++++++
+ CryptoPkg/Library/Include/arpa/nameser.h  |  9 +++++++++
+ CryptoPkg/Library/Include/netinet/in.h    |  9 +++++++++
+ CryptoPkg/Library/Include/sys/param.h     |  9 +++++++++
+ CryptoPkg/Library/Include/sys/socket.h    |  9 +++++++++
+ 6 files changed, 61 insertions(+)
+ create mode 100644 CryptoPkg/Library/Include/arpa/inet.h
+ create mode 100644 CryptoPkg/Library/Include/arpa/nameser.h
+ create mode 100644 CryptoPkg/Library/Include/netinet/in.h
+ create mode 100644 CryptoPkg/Library/Include/sys/param.h
+ create mode 100644 CryptoPkg/Library/Include/sys/socket.h
+
+diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h b/CryptoPkg/Library/Include/CrtLibSupport.h
+index b90da20..e603fad 100644
+--- a/CryptoPkg/Library/Include/CrtLibSupport.h
++++ b/CryptoPkg/Library/Include/CrtLibSupport.h
+@@ -74,6 +74,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ // Definitions for global constants used by CRT library routines
+ //
+ #define EINVAL       22               /* Invalid argument */
++#define EAFNOSUPPORT 47               /* Address family not supported by protocol family */
+ #define INT_MAX      0x7FFFFFFF       /* Maximum (signed) int value */
+ #define LONG_MAX     0X7FFFFFFFL      /* max value for a long */
+ #define LONG_MIN     (-LONG_MAX-1)    /* min value for a long */
+@@ -81,13 +82,28 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ #define CHAR_BIT     8                /* Number of bits in a char */
+ 
+ //
++// Address families.
++//
++#define AF_INET   2     /* internetwork: UDP, TCP, etc. */
++#define AF_INET6  24    /* IP version 6 */
++
++//
++// Define constants based on RFC0883, RFC1034, RFC 1035
++//
++#define NS_INT16SZ    2   /*%< #/bytes of data in a u_int16_t */
++#define NS_INADDRSZ   4   /*%< IPv4 T_A */
++#define NS_IN6ADDRSZ  16  /*%< IPv6 T_AAAA */
++
++//
+ // Basic types mapping
+ //
+ typedef UINTN          size_t;
++typedef UINTN          u_int;
+ typedef INTN           ssize_t;
+ typedef INT32          time_t;
+ typedef UINT8          __uint8_t;
+ typedef UINT8          sa_family_t;
++typedef UINT8          u_char;
+ typedef UINT32         uid_t;
+ typedef UINT32         gid_t;
+ 
+diff --git a/CryptoPkg/Library/Include/arpa/inet.h b/CryptoPkg/Library/Include/arpa/inet.h
+new file mode 100644
+index 0000000..988e4e0
+--- /dev/null
++++ b/CryptoPkg/Library/Include/arpa/inet.h
+@@ -0,0 +1,9 @@
++/** @file
++  Include file to support building third-party standard C / BSD sockets code.
++
++  Copyright (C) 2019, Red Hat, Inc.
++
++  SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++
++#include <CrtLibSupport.h>
+diff --git a/CryptoPkg/Library/Include/arpa/nameser.h b/CryptoPkg/Library/Include/arpa/nameser.h
+new file mode 100644
+index 0000000..988e4e0
+--- /dev/null
++++ b/CryptoPkg/Library/Include/arpa/nameser.h
+@@ -0,0 +1,9 @@
++/** @file
++  Include file to support building third-party standard C / BSD sockets code.
++
++  Copyright (C) 2019, Red Hat, Inc.
++
++  SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++
++#include <CrtLibSupport.h>
+diff --git a/CryptoPkg/Library/Include/netinet/in.h b/CryptoPkg/Library/Include/netinet/in.h
+new file mode 100644
+index 0000000..988e4e0
+--- /dev/null
++++ b/CryptoPkg/Library/Include/netinet/in.h
+@@ -0,0 +1,9 @@
++/** @file
++  Include file to support building third-party standard C / BSD sockets code.
++
++  Copyright (C) 2019, Red Hat, Inc.
++
++  SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++
++#include <CrtLibSupport.h>
+diff --git a/CryptoPkg/Library/Include/sys/param.h b/CryptoPkg/Library/Include/sys/param.h
+new file mode 100644
+index 0000000..988e4e0
+--- /dev/null
++++ b/CryptoPkg/Library/Include/sys/param.h
+@@ -0,0 +1,9 @@
++/** @file
++  Include file to support building third-party standard C / BSD sockets code.
++
++  Copyright (C) 2019, Red Hat, Inc.
++
++  SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++
++#include <CrtLibSupport.h>
+diff --git a/CryptoPkg/Library/Include/sys/socket.h b/CryptoPkg/Library/Include/sys/socket.h
+new file mode 100644
+index 0000000..988e4e0
+--- /dev/null
++++ b/CryptoPkg/Library/Include/sys/socket.h
+@@ -0,0 +1,9 @@
++/** @file
++  Include file to support building third-party standard C / BSD sockets code.
++
++  Copyright (C) 2019, Red Hat, Inc.
++
++  SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++
++#include <CrtLibSupport.h>
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-CryptoPkg-Crt-turn-strchr-into-a-function-CVE-2019-1.patch b/SOURCES/edk2-CryptoPkg-Crt-turn-strchr-into-a-function-CVE-2019-1.patch
new file mode 100644
index 0000000..3f4fd02
--- /dev/null
+++ b/SOURCES/edk2-CryptoPkg-Crt-turn-strchr-into-a-function-CVE-2019-1.patch
@@ -0,0 +1,86 @@
+From 697cb1880b624f83bc9e926c3614d070eb365f06 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Mon, 2 Dec 2019 12:31:47 +0100
+Subject: [PATCH 3/9] CryptoPkg/Crt: turn strchr() into a function
+ (CVE-2019-14553)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20191117220052.15700-4-lersek@redhat.com>
+Patchwork-id: 92458
+O-Subject: [RHEL-8.2.0 edk2 PATCH 3/9] CryptoPkg/Crt: turn strchr() into a function (CVE-2019-14553)
+Bugzilla: 1536624
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+According to the ISO C standard, strchr() is a function. We #define it as
+a macro. Unfortunately, our macro evaluates the first argument ("str")
+twice. If the expression passed for "str" has side effects, the behavior
+may be undefined.
+
+In a later patch in this series, we're going to resurrect "inet_pton.c"
+(originally from the StdLib package), which calls strchr() just like that:
+
+  strchr((xdigits = xdigits_l), ch)
+  strchr((xdigits = xdigits_u), ch)
+
+To enable this kind of function call, turn strchr() into a function.
+
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiaxin Wu <jiaxin.wu@intel.com>
+Cc: Sivaraman Nainar <sivaramann@amiindia.co.in>
+Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960
+CVE: CVE-2019-14553
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
+Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
+Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
+(cherry picked from commit eb520d94dba7369d1886cd5522d5a2c36fb02209)
+---
+ CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c | 5 +++++
+ CryptoPkg/Library/Include/CrtLibSupport.h           | 2 +-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
+index 71a2ef3..42235ab 100644
+--- a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
++++ b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
+@@ -115,6 +115,11 @@ QuickSortWorker (
+ // -- String Manipulation Routines --
+ //
+ 
++char *strchr(const char *str, int ch)
++{
++  return ScanMem8 (str, AsciiStrSize (str), (UINT8)ch);
++}
++
+ /* Scan a string for the last occurrence of a character */
+ char *strrchr (const char *str, int c)
+ {
+diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h b/CryptoPkg/Library/Include/CrtLibSupport.h
+index 5806f50..b90da20 100644
+--- a/CryptoPkg/Library/Include/CrtLibSupport.h
++++ b/CryptoPkg/Library/Include/CrtLibSupport.h
+@@ -147,6 +147,7 @@ int            isupper     (int);
+ int            tolower     (int);
+ int            strcmp      (const char *, const char *);
+ int            strncasecmp (const char *, const char *, size_t);
++char           *strchr     (const char *, int);
+ char           *strrchr    (const char *, int);
+ unsigned long  strtoul     (const char *, char **, int);
+ long           strtol      (const char *, char **, int);
+@@ -188,7 +189,6 @@ void           abort       (void);
+ #define strcpy(strDest,strSource)         AsciiStrCpyS(strDest,MAX_STRING_SIZE,strSource)
+ #define strncpy(strDest,strSource,count)  AsciiStrnCpyS(strDest,MAX_STRING_SIZE,strSource,(UINTN)count)
+ #define strcat(strDest,strSource)         AsciiStrCatS(strDest,MAX_STRING_SIZE,strSource)
+-#define strchr(str,ch)                    ScanMem8((VOID *)(str),AsciiStrSize(str),(UINT8)ch)
+ #define strncmp(string1,string2,count)    (int)(AsciiStrnCmp(string1,string2,(UINTN)(count)))
+ #define strcasecmp(str1,str2)             (int)AsciiStriCmp(str1,str2)
+ #define sprintf(buf,...)                  AsciiSPrint(buf,MAX_STRING_SIZE,__VA_ARGS__)
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-CryptoPkg-TlsLib-Add-the-new-API-TlsSetVerifyHost-CV.patch b/SOURCES/edk2-CryptoPkg-TlsLib-Add-the-new-API-TlsSetVerifyHost-CV.patch
new file mode 100644
index 0000000..bdaff30
--- /dev/null
+++ b/SOURCES/edk2-CryptoPkg-TlsLib-Add-the-new-API-TlsSetVerifyHost-CV.patch
@@ -0,0 +1,134 @@
+From 3885ce313d1d06359aa76b085668c1391d8a5f50 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Mon, 2 Dec 2019 12:31:43 +0100
+Subject: [PATCH 2/9] CryptoPkg/TlsLib: Add the new API "TlsSetVerifyHost"
+ (CVE-2019-14553)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20191117220052.15700-3-lersek@redhat.com>
+Patchwork-id: 92460
+O-Subject: [RHEL-8.2.0 edk2 PATCH 2/9] CryptoPkg/TlsLib: Add the new API "TlsSetVerifyHost" (CVE-2019-14553)
+Bugzilla: 1536624
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+From: "Wu, Jiaxin" <jiaxin.wu@intel.com>
+
+REF: https://bugzilla.tianocore.org/show_bug.cgi?id=960
+CVE: CVE-2019-14553
+In the patch, we add the new API "TlsSetVerifyHost" for the TLS
+protocol to set the specified host name that need to be verified.
+
+Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
+Reviewed-by: Ye Ting <ting.ye@intel.com>
+Reviewed-by: Long Qin <qin.long@intel.com>
+Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
+Acked-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20190927034441.3096-3-Jiaxin.wu@intel.com>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiaxin Wu <jiaxin.wu@intel.com>
+Cc: Sivaraman Nainar <sivaramann@amiindia.co.in>
+Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
+Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
+(cherry picked from commit 2ca74e1a175232cc201798e27437700adc7fb07e)
+---
+ CryptoPkg/Include/Library/TlsLib.h   | 20 +++++++++++++++++++
+ CryptoPkg/Library/TlsLib/TlsConfig.c | 38 +++++++++++++++++++++++++++++++++++-
+ 2 files changed, 57 insertions(+), 1 deletion(-)
+
+diff --git a/CryptoPkg/Include/Library/TlsLib.h b/CryptoPkg/Include/Library/TlsLib.h
+index 9875cb6..3af7d4b 100644
+--- a/CryptoPkg/Include/Library/TlsLib.h
++++ b/CryptoPkg/Include/Library/TlsLib.h
+@@ -397,6 +397,26 @@ TlsSetVerify (
+   );
+ 
+ /**
++  Set the specified host name to be verified.
++
++  @param[in]  Tls           Pointer to the TLS object.
++  @param[in]  Flags         The setting flags during the validation.
++  @param[in]  HostName      The specified host name to be verified.
++
++  @retval  EFI_SUCCESS           The HostName setting was set successfully.
++  @retval  EFI_INVALID_PARAMETER The parameter is invalid.
++  @retval  EFI_ABORTED           Invalid HostName setting.
++
++**/
++EFI_STATUS
++EFIAPI
++TlsSetVerifyHost (
++  IN     VOID                     *Tls,
++  IN     UINT32                   Flags,
++  IN     CHAR8                    *HostName
++  );
++
++/**
+   Sets a TLS/SSL session ID to be used during TLS/SSL connect.
+ 
+   This function sets a session ID to be used when the TLS/SSL connection is
+diff --git a/CryptoPkg/Library/TlsLib/TlsConfig.c b/CryptoPkg/Library/TlsLib/TlsConfig.c
+index 74b577d..2bf5aee 100644
+--- a/CryptoPkg/Library/TlsLib/TlsConfig.c
++++ b/CryptoPkg/Library/TlsLib/TlsConfig.c
+@@ -1,7 +1,7 @@
+ /** @file
+   SSL/TLS Configuration Library Wrapper Implementation over OpenSSL.
+ 
+-Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
++Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
+ (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+@@ -498,6 +498,42 @@ TlsSetVerify (
+ }
+ 
+ /**
++  Set the specified host name to be verified.
++
++  @param[in]  Tls           Pointer to the TLS object.
++  @param[in]  Flags         The setting flags during the validation.
++  @param[in]  HostName      The specified host name to be verified.
++
++  @retval  EFI_SUCCESS           The HostName setting was set successfully.
++  @retval  EFI_INVALID_PARAMETER The parameter is invalid.
++  @retval  EFI_ABORTED           Invalid HostName setting.
++
++**/
++EFI_STATUS
++EFIAPI
++TlsSetVerifyHost (
++  IN     VOID                     *Tls,
++  IN     UINT32                   Flags,
++  IN     CHAR8                    *HostName
++  )
++{
++  TLS_CONNECTION  *TlsConn;
++
++  TlsConn = (TLS_CONNECTION *) Tls;
++  if (TlsConn == NULL || TlsConn->Ssl == NULL || HostName == NULL) {
++     return EFI_INVALID_PARAMETER;
++  }
++
++  SSL_set_hostflags(TlsConn->Ssl, Flags);
++
++  if (SSL_set1_host(TlsConn->Ssl, HostName) == 0) {
++    return EFI_ABORTED;
++  }
++
++  return EFI_SUCCESS;
++}
++
++/**
+   Sets a TLS/SSL session ID to be used during TLS/SSL connect.
+ 
+   This function sets a session ID to be used when the TLS/SSL connection is
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-CryptoPkg-TlsLib-TlsSetVerifyHost-parse-IP-address-l.patch b/SOURCES/edk2-CryptoPkg-TlsLib-TlsSetVerifyHost-parse-IP-address-l.patch
new file mode 100644
index 0000000..e9fae52
--- /dev/null
+++ b/SOURCES/edk2-CryptoPkg-TlsLib-TlsSetVerifyHost-parse-IP-address-l.patch
@@ -0,0 +1,100 @@
+From 970b5f67512e00fb26765a14b4a1cb8a8a04276d Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Mon, 2 Dec 2019 12:31:57 +0100
+Subject: [PATCH 6/9] CryptoPkg/TlsLib: TlsSetVerifyHost: parse IP address
+ literals as such (CVE-2019-14553)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20191117220052.15700-7-lersek@redhat.com>
+Patchwork-id: 92452
+O-Subject: [RHEL-8.2.0 edk2 PATCH 6/9] CryptoPkg/TlsLib: TlsSetVerifyHost: parse IP address literals as such (CVE-2019-14553)
+Bugzilla: 1536624
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+Using the inet_pton() function that we imported in the previous patches,
+recognize if "HostName" is an IP address literal, and then parse it into
+binary representation. Passing the latter to OpenSSL for server
+certificate validation is important, per RFC-2818
+<https://tools.ietf.org/html/rfc2818#section-3.1>:
+
+> In some cases, the URI is specified as an IP address rather than a
+> hostname. In this case, the iPAddress subjectAltName must be present in
+> the certificate and must exactly match the IP in the URI.
+
+Note: we cannot use X509_VERIFY_PARAM_set1_ip_asc() because in the OpenSSL
+version that is currently consumed by edk2, said function depends on
+sscanf() for parsing IPv4 literals. In
+"CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c", we only provide an
+empty -- always failing -- stub for sscanf(), however.
+
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiaxin Wu <jiaxin.wu@intel.com>
+Cc: Sivaraman Nainar <sivaramann@amiindia.co.in>
+Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=960
+CVE: CVE-2019-14553
+Suggested-by: David Woodhouse <dwmw2@infradead.org>
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Acked-by: Jian J Wang <jian.j.wang@intel.com>
+Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
+(cherry picked from commit 1e72b1fb2ec597caedb5170079bb213f6d67f32a)
+---
+ CryptoPkg/Library/TlsLib/TlsConfig.c | 28 ++++++++++++++++++++++++----
+ 1 file changed, 24 insertions(+), 4 deletions(-)
+
+diff --git a/CryptoPkg/Library/TlsLib/TlsConfig.c b/CryptoPkg/Library/TlsLib/TlsConfig.c
+index 2bf5aee..307eb57 100644
+--- a/CryptoPkg/Library/TlsLib/TlsConfig.c
++++ b/CryptoPkg/Library/TlsLib/TlsConfig.c
+@@ -517,7 +517,11 @@ TlsSetVerifyHost (
+   IN     CHAR8                    *HostName
+   )
+ {
+-  TLS_CONNECTION  *TlsConn;
++  TLS_CONNECTION    *TlsConn;
++  X509_VERIFY_PARAM *VerifyParam;
++  UINTN             BinaryAddressSize;
++  UINT8             BinaryAddress[MAX (NS_INADDRSZ, NS_IN6ADDRSZ)];
++  INTN              ParamStatus;
+ 
+   TlsConn = (TLS_CONNECTION *) Tls;
+   if (TlsConn == NULL || TlsConn->Ssl == NULL || HostName == NULL) {
+@@ -526,11 +530,27 @@ TlsSetVerifyHost (
+ 
+   SSL_set_hostflags(TlsConn->Ssl, Flags);
+ 
+-  if (SSL_set1_host(TlsConn->Ssl, HostName) == 0) {
+-    return EFI_ABORTED;
++  VerifyParam = SSL_get0_param (TlsConn->Ssl);
++  ASSERT (VerifyParam != NULL);
++
++  BinaryAddressSize = 0;
++  if (inet_pton (AF_INET6, HostName, BinaryAddress) == 1) {
++    BinaryAddressSize = NS_IN6ADDRSZ;
++  } else if (inet_pton (AF_INET, HostName, BinaryAddress) == 1) {
++    BinaryAddressSize = NS_INADDRSZ;
+   }
+ 
+-  return EFI_SUCCESS;
++  if (BinaryAddressSize > 0) {
++    DEBUG ((DEBUG_VERBOSE, "%a:%a: parsed \"%a\" as an IPv%c address "
++      "literal\n", gEfiCallerBaseName, __FUNCTION__, HostName,
++      (UINTN)((BinaryAddressSize == NS_IN6ADDRSZ) ? '6' : '4')));
++    ParamStatus = X509_VERIFY_PARAM_set1_ip (VerifyParam, BinaryAddress,
++                    BinaryAddressSize);
++  } else {
++    ParamStatus = X509_VERIFY_PARAM_set1_host (VerifyParam, HostName, 0);
++  }
++
++  return (ParamStatus == 1) ? EFI_SUCCESS : EFI_ABORTED;
+ }
+ 
+ /**
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-MdeModulePkg-Enable-Disable-S3BootScript-dynamically.patch b/SOURCES/edk2-MdeModulePkg-Enable-Disable-S3BootScript-dynamically.patch
new file mode 100644
index 0000000..a635f82
--- /dev/null
+++ b/SOURCES/edk2-MdeModulePkg-Enable-Disable-S3BootScript-dynamically.patch
@@ -0,0 +1,148 @@
+From 4ef57a1e6b9411e785e00e8874bd5c67235e9134 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Tue, 11 Feb 2020 17:01:59 +0100
+Subject: [PATCH 1/2] MdeModulePkg: Enable/Disable S3BootScript dynamically.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200211170200.12389-2-lersek@redhat.com>
+Patchwork-id: 93776
+O-Subject: [RHEL-8.2.0 edk2 PATCH 1/2] MdeModulePkg: Enable/Disable S3BootScript dynamically.
+Bugzilla: 1801274
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+
+From: Chasel Chiu <chasel.chiu@intel.com>
+
+--v-- RHEL8 note start --v--
+
+This patch is cherry-picked from upstream as a contextual (not semantic /
+functional) pre-requisite for the next patch.
+
+Functionally, this patch makes no difference in OVMF, for two reasons:
+
+- Downstream, we don't enable S3 anyway (per QEMU default).
+
+- The S3-related modules that are built into OVMF (S3SaveStateDxe,
+  BootScriptExecutorDxe) already consider PcdAcpiS3Enable, and exit their
+  entry point functions with EFI_UNSUPPORTED when the PCD is FALSE. As a
+  consequence, the DESTRUCTOR function of the PiDxeS3BootScriptLib library
+  instance (which is linked into those binaries) will undo whatever the
+  CONSTRUCTOR function did; no resources will be leaked.
+
+  https://edk2.groups.io/g/devel/message/47996
+  http://mid.mail-archive.com/e43e3f56-d2db-7989-b6f1-03e1c810d908@redhat.com
+
+--^-- RHEL8 note end --^--
+
+REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2212
+
+In binary model the same binary may have to support both
+S3 enabled and disabled scenarios, however not all DXE
+drivers linking PiDxeS3BootScriptLib can return error to
+invoke library DESTRUCTOR for releasing resource.
+
+To support this usage model below PCD is used to skip
+S3BootScript functions when PCD set to FALSE:
+  gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiS3Enable
+
+Test: Verified on internal platform and S3BootScript
+      functions can be skipped by PCD during boot time.
+
+Cc: Hao A Wu <hao.a.wu@intel.com>
+Cc: Eric Dong <eric.dong@intel.com>
+Cc: Nate DeSimone <nathaniel.l.desimone@intel.com>
+Cc: Liming Gao <liming.gao@intel.com>
+Cc: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Chasel Chiu <chasel.chiu@intel.com>
+Reviewed-by: Nate DeSimone <nathaniel.l.desimone@intel.com>
+Reviewed-by: Eric Dong <eric.dong@intel.com>
+Acked-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit ed9db1b91ceba7d3a24743d4d9314c6fbe11c4b3)
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ .../Library/PiDxeS3BootScriptLib/BootScriptSave.c       | 17 ++++++++++++++++-
+ .../Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.inf |  4 ++--
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c b/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c
+index c116727..9106e7d 100644
+--- a/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c
++++ b/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c
+@@ -1,7 +1,7 @@
+ /** @file
+   Save the S3 data to S3 boot script.
+ 
+-  Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.<BR>
++  Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>
+ 
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+@@ -124,6 +124,7 @@ VOID                             *mRegistrationSmmReadyToLock = NULL;
+ BOOLEAN                          mS3BootScriptTableAllocated = FALSE;
+ BOOLEAN                          mS3BootScriptTableSmmAllocated = FALSE;
+ EFI_SMM_SYSTEM_TABLE2            *mBootScriptSmst = NULL;
++BOOLEAN                          mAcpiS3Enable = TRUE;
+ 
+ /**
+   This is an internal function to add a terminate node the entry, recalculate the table
+@@ -436,6 +437,12 @@ S3BootScriptLibInitialize (
+   BOOLEAN                        InSmm;
+   EFI_PHYSICAL_ADDRESS           Buffer;
+ 
++  if (!PcdGetBool (PcdAcpiS3Enable)) {
++    mAcpiS3Enable = FALSE;
++    DEBUG ((DEBUG_INFO, "%a: Skip S3BootScript because ACPI S3 disabled.\n", gEfiCallerBaseName));
++    return RETURN_SUCCESS;
++  }
++
+   S3TablePtr = (SCRIPT_TABLE_PRIVATE_DATA*)(UINTN)PcdGet64(PcdS3BootScriptTablePrivateDataPtr);
+   //
+   // The Boot script private data is not be initialized. create it
+@@ -562,6 +569,10 @@ S3BootScriptLibDeinitialize (
+ {
+   EFI_STATUS                Status;
+ 
++  if (!mAcpiS3Enable) {
++    return RETURN_SUCCESS;
++  }
++
+   DEBUG ((EFI_D_INFO, "%a() in %a module\n", __FUNCTION__, gEfiCallerBaseName));
+ 
+   if (mEventDxeSmmReadyToLock != NULL) {
+@@ -810,6 +821,10 @@ S3BootScriptGetEntryAddAddress (
+ {
+   UINT8*                         NewEntryPtr;
+ 
++  if (!mAcpiS3Enable) {
++    return NULL;
++  }
++
+   if (mS3BootScriptTablePtr->SmmLocked) {
+     //
+     // We need check InSmm, because after SmmReadyToLock, only SMM driver is allowed to write boot script.
+diff --git a/MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.inf b/MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.inf
+index 517ea69..2b894c9 100644
+--- a/MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.inf
++++ b/MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.inf
+@@ -1,7 +1,7 @@
+ ## @file
+ # DXE S3 boot script Library.
+ #
+-# Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>
++# Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>
+ #
+ # SPDX-License-Identifier: BSD-2-Clause-Patent
+ #
+@@ -65,4 +65,4 @@
+   ## SOMETIMES_PRODUCES
+   gEfiMdeModulePkgTokenSpaceGuid.PcdS3BootScriptTablePrivateSmmDataPtr
+   gEfiMdeModulePkgTokenSpaceGuid.PcdS3BootScriptRuntimeTableReservePageNumber   ## CONSUMES
+-
++  gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiS3Enable                                ## CONSUMES
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-MdeModulePkg-PiDxeS3BootScriptLib-Fix-potential-nume.patch b/SOURCES/edk2-MdeModulePkg-PiDxeS3BootScriptLib-Fix-potential-nume.patch
new file mode 100644
index 0000000..4899f97
--- /dev/null
+++ b/SOURCES/edk2-MdeModulePkg-PiDxeS3BootScriptLib-Fix-potential-nume.patch
@@ -0,0 +1,182 @@
+From 51d2956d480fef83f765013c8aec7f7ddc14b84d Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Tue, 11 Feb 2020 17:02:00 +0100
+Subject: [PATCH 2/2] MdeModulePkg/PiDxeS3BootScriptLib: Fix potential numeric
+ truncation (CVE-2019-14563)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200211170200.12389-3-lersek@redhat.com>
+Patchwork-id: 93777
+O-Subject: [RHEL-8.2.0 edk2 PATCH 2/2] MdeModulePkg/PiDxeS3BootScriptLib: Fix potential numeric truncation (CVE-2019-14563)
+Bugzilla: 1801274
+RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+
+From: Hao A Wu <hao.a.wu@intel.com>
+
+REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2001
+
+For S3BootScriptLib APIs:
+
+S3BootScriptSaveIoWrite
+S3BootScriptSaveMemWrite
+S3BootScriptSavePciCfgWrite
+S3BootScriptSavePciCfg2Write
+S3BootScriptSaveSmbusExecute
+S3BootScriptSaveInformation
+S3BootScriptSaveInformationAsciiString
+S3BootScriptLabel (happen in S3BootScriptLabelInternal())
+
+possible numeric truncations will happen that may lead to S3 boot script
+entry with improper size being returned to store the boot script data.
+This commit will add checks to prevent this kind of issue.
+
+Please note that the remaining S3BootScriptLib APIs:
+
+S3BootScriptSaveIoReadWrite
+S3BootScriptSaveMemReadWrite
+S3BootScriptSavePciCfgReadWrite
+S3BootScriptSavePciCfg2ReadWrite
+S3BootScriptSaveStall
+S3BootScriptSaveDispatch2
+S3BootScriptSaveDispatch
+S3BootScriptSaveMemPoll
+S3BootScriptSaveIoPoll
+S3BootScriptSavePciPoll
+S3BootScriptSavePci2Poll
+S3BootScriptCloseTable
+S3BootScriptExecute
+S3BootScriptMoveLastOpcode
+S3BootScriptCompare
+
+are not affected by such numeric truncation.
+
+Signed-off-by: Hao A Wu <hao.a.wu@intel.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Eric Dong <eric.dong@intel.com>
+Acked-by: Jian J Wang <jian.j.wang@intel.com>
+(cherry picked from commit 322ac05f8bbc1bce066af1dabd1b70ccdbe28891)
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ .../Library/PiDxeS3BootScriptLib/BootScriptSave.c  | 52 +++++++++++++++++++++-
+ 1 file changed, 51 insertions(+), 1 deletion(-)
+
+diff --git a/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c b/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c
+index 9106e7d..9315fc9 100644
+--- a/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c
++++ b/MdeModulePkg/Library/PiDxeS3BootScriptLib/BootScriptSave.c
+@@ -1,7 +1,7 @@
+ /** @file
+   Save the S3 data to S3 boot script.
+ 
+-  Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>
++  Copyright (c) 2006 - 2020, Intel Corporation. All rights reserved.<BR>
+ 
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+@@ -1006,6 +1006,14 @@ S3BootScriptSaveIoWrite (
+   EFI_BOOT_SCRIPT_IO_WRITE  ScriptIoWrite;
+ 
+   WidthInByte = (UINT8) (0x01 << (Width & 0x03));
++
++  //
++  // Truncation check
++  //
++  if ((Count > MAX_UINT8) ||
++      (WidthInByte * Count > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_IO_WRITE))) {
++    return RETURN_OUT_OF_RESOURCES;
++  }
+   Length = (UINT8)(sizeof (EFI_BOOT_SCRIPT_IO_WRITE) + (WidthInByte * Count));
+ 
+   Script = S3BootScriptGetEntryAddAddress (Length);
+@@ -1102,6 +1110,14 @@ S3BootScriptSaveMemWrite (
+   EFI_BOOT_SCRIPT_MEM_WRITE  ScriptMemWrite;
+ 
+   WidthInByte = (UINT8) (0x01 << (Width & 0x03));
++
++  //
++  // Truncation check
++  //
++  if ((Count > MAX_UINT8) ||
++      (WidthInByte * Count > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_MEM_WRITE))) {
++    return RETURN_OUT_OF_RESOURCES;
++  }
+   Length = (UINT8)(sizeof (EFI_BOOT_SCRIPT_MEM_WRITE) + (WidthInByte * Count));
+ 
+   Script = S3BootScriptGetEntryAddAddress (Length);
+@@ -1206,6 +1222,14 @@ S3BootScriptSavePciCfgWrite (
+   }
+ 
+   WidthInByte = (UINT8) (0x01 << (Width & 0x03));
++
++  //
++  // Truncation check
++  //
++  if ((Count > MAX_UINT8) ||
++      (WidthInByte * Count > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_PCI_CONFIG_WRITE))) {
++    return RETURN_OUT_OF_RESOURCES;
++  }
+   Length = (UINT8)(sizeof (EFI_BOOT_SCRIPT_PCI_CONFIG_WRITE) + (WidthInByte * Count));
+ 
+   Script = S3BootScriptGetEntryAddAddress (Length);
+@@ -1324,6 +1348,14 @@ S3BootScriptSavePciCfg2Write (
+   }
+ 
+   WidthInByte = (UINT8) (0x01 << (Width & 0x03));
++
++  //
++  // Truncation check
++  //
++  if ((Count > MAX_UINT8) ||
++      (WidthInByte * Count > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_PCI_CONFIG2_WRITE))) {
++    return RETURN_OUT_OF_RESOURCES;
++  }
+   Length = (UINT8)(sizeof (EFI_BOOT_SCRIPT_PCI_CONFIG2_WRITE) + (WidthInByte * Count));
+ 
+   Script = S3BootScriptGetEntryAddAddress (Length);
+@@ -1549,6 +1581,12 @@ S3BootScriptSaveSmbusExecute (
+     return Status;
+   }
+ 
++  //
++  // Truncation check
++  //
++  if (BufferLength > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_SMBUS_EXECUTE)) {
++    return RETURN_OUT_OF_RESOURCES;
++  }
+   DataSize = (UINT8)(sizeof (EFI_BOOT_SCRIPT_SMBUS_EXECUTE) + BufferLength);
+ 
+   Script = S3BootScriptGetEntryAddAddress (DataSize);
+@@ -1736,6 +1774,12 @@ S3BootScriptSaveInformation (
+   UINT8                 *Script;
+   EFI_BOOT_SCRIPT_INFORMATION  ScriptInformation;
+ 
++  //
++  // Truncation check
++  //
++  if (InformationLength > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_INFORMATION)) {
++    return RETURN_OUT_OF_RESOURCES;
++  }
+   Length = (UINT8)(sizeof (EFI_BOOT_SCRIPT_INFORMATION) + InformationLength);
+ 
+   Script = S3BootScriptGetEntryAddAddress (Length);
+@@ -2195,6 +2239,12 @@ S3BootScriptLabelInternal (
+   UINT8                 *Script;
+   EFI_BOOT_SCRIPT_INFORMATION  ScriptInformation;
+ 
++  //
++  // Truncation check
++  //
++  if (InformationLength > MAX_UINT8 - sizeof (EFI_BOOT_SCRIPT_INFORMATION)) {
++    return RETURN_OUT_OF_RESOURCES;
++  }
+   Length = (UINT8)(sizeof (EFI_BOOT_SCRIPT_INFORMATION) + InformationLength);
+ 
+   Script = S3BootScriptGetEntryAddAddress (Length);
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-MdeModulePkg-UefiBootManagerLib-log-reserved-mem-all.patch b/SOURCES/edk2-MdeModulePkg-UefiBootManagerLib-log-reserved-mem-all.patch
new file mode 100644
index 0000000..92bb1d4
--- /dev/null
+++ b/SOURCES/edk2-MdeModulePkg-UefiBootManagerLib-log-reserved-mem-all.patch
@@ -0,0 +1,101 @@
+From e57f49101a66663a4f5425995e9ea97ae0858e1b Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Tue, 14 Jan 2020 12:39:05 +0100
+Subject: [PATCH 1/2] MdeModulePkg/UefiBootManagerLib: log reserved mem
+ allocation failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200114123906.8547-2-lersek@redhat.com>
+Patchwork-id: 93339
+O-Subject: [RHEL-8.2.0 edk2 PATCH 1/2] MdeModulePkg/UefiBootManagerLib: log reserved mem allocation failure
+Bugzilla: 1789797
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+
+The LoadFile protocol can report such a large buffer size that we cannot
+allocate enough reserved pages for. This particularly affects HTTP(S)
+Boot, if the remote file is very large (for example, an ISO image).
+
+While the TianoCore wiki mentions this at
+<https://github.com/tianocore/tianocore.github.io/wiki/HTTP-Boot#ram-disk-image-size>:
+
+> The maximum RAM disk image size depends on how much continuous reserved
+> memory block the platform could provide.
+
+it's hard to remember; so log a DEBUG_ERROR message when the allocation
+fails.
+
+This patch produces error messages such as:
+
+> UiApp:BmExpandLoadFile: failed to allocate reserved pages:
+> BufferSize=4501536768
+> LoadFile="PciRoot(0x0)/Pci(0x3,0x0)/MAC(5254001B103E,0x1)/
+>      IPv4(0.0.0.0,TCP,DHCP,192.168.124.106,192.168.124.1,255.255.255.0)/
+>      Dns(192.168.124.1)/
+>      Uri(https://ipv4-server/RHEL-7.7-20190723.1-Server-x86_64-dvd1.iso)"
+> FilePath=""
+
+(Manually rewrapped here for keeping PatchCheck.py happy.)
+
+Cc: Hao A Wu <hao.a.wu@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Ray Ni <ray.ni@intel.com>
+Cc: Zhichao Gao <zhichao.gao@intel.com>
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
+Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
+Acked-by: Hao A Wu <hao.a.wu@intel.com>
+(cherry picked from commit a56af23f066e2816c67b7c6e64de7ddefcd70780)
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ MdeModulePkg/Library/UefiBootManagerLib/BmBoot.c | 31 ++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/MdeModulePkg/Library/UefiBootManagerLib/BmBoot.c b/MdeModulePkg/Library/UefiBootManagerLib/BmBoot.c
+index 952033f..ded9ae9 100644
+--- a/MdeModulePkg/Library/UefiBootManagerLib/BmBoot.c
++++ b/MdeModulePkg/Library/UefiBootManagerLib/BmBoot.c
+@@ -1386,6 +1386,37 @@ BmExpandLoadFile (
+   //
+   FileBuffer = AllocateReservedPages (EFI_SIZE_TO_PAGES (BufferSize));
+   if (FileBuffer == NULL) {
++    DEBUG_CODE (
++      EFI_DEVICE_PATH *LoadFilePath;
++      CHAR16          *LoadFileText;
++      CHAR16          *FileText;
++
++      LoadFilePath = DevicePathFromHandle (LoadFileHandle);
++      if (LoadFilePath == NULL) {
++        LoadFileText = NULL;
++      } else {
++        LoadFileText = ConvertDevicePathToText (LoadFilePath, FALSE, FALSE);
++      }
++      FileText = ConvertDevicePathToText (FilePath, FALSE, FALSE);
++
++      DEBUG ((
++        DEBUG_ERROR,
++        "%a:%a: failed to allocate reserved pages: "
++        "BufferSize=%Lu LoadFile=\"%s\" FilePath=\"%s\"\n",
++        gEfiCallerBaseName,
++        __FUNCTION__,
++        (UINT64)BufferSize,
++        LoadFileText,
++        FileText
++        ));
++
++      if (FileText != NULL) {
++        FreePool (FileText);
++      }
++      if (LoadFileText != NULL) {
++        FreePool (LoadFileText);
++      }
++      );
+     return NULL;
+   }
+ 
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-MdePkg-Include-Protocol-Tls.h-Add-the-data-type-of-E.patch b/SOURCES/edk2-MdePkg-Include-Protocol-Tls.h-Add-the-data-type-of-E.patch
new file mode 100644
index 0000000..f1b88d3
--- /dev/null
+++ b/SOURCES/edk2-MdePkg-Include-Protocol-Tls.h-Add-the-data-type-of-E.patch
@@ -0,0 +1,156 @@
+From 22ebe3ff84003e9256759e230ac68da35c6d77a2 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Mon, 2 Dec 2019 12:31:37 +0100
+Subject: [PATCH 1/9] MdePkg/Include/Protocol/Tls.h: Add the data type of
+ EfiTlsVerifyHost (CVE-2019-14553)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20191117220052.15700-2-lersek@redhat.com>
+Patchwork-id: 92457
+O-Subject: [RHEL-8.2.0 edk2 PATCH 1/9] MdePkg/Include/Protocol/Tls.h: Add the data type of EfiTlsVerifyHost (CVE-2019-14553)
+Bugzilla: 1536624
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+From: "Wu, Jiaxin" <jiaxin.wu@intel.com>
+
+REF: https://bugzilla.tianocore.org/show_bug.cgi?id=960
+CVE: CVE-2019-14553
+In the patch, we add the new data type named "EfiTlsVerifyHost" and
+the EFI_TLS_VERIFY_HOST_FLAG for the TLS protocol consumer (HTTP)
+to enable the host name check so as to avoid the potential
+Man-In-The-Middle attack.
+
+Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
+Reviewed-by: Ye Ting <ting.ye@intel.com>
+Reviewed-by: Long Qin <qin.long@intel.com>
+Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
+Acked-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20190927034441.3096-2-Jiaxin.wu@intel.com>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiaxin Wu <jiaxin.wu@intel.com>
+Cc: Sivaraman Nainar <sivaramann@amiindia.co.in>
+Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Liming Gao <liming.gao@intel.com>
+(cherry picked from commit 31efec82796cb950e99d1622aa9c0eb8380613a0)
+---
+ MdePkg/Include/Protocol/Tls.h | 68 ++++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 57 insertions(+), 11 deletions(-)
+
+diff --git a/MdePkg/Include/Protocol/Tls.h b/MdePkg/Include/Protocol/Tls.h
+index bf1b672..af524ae 100644
+--- a/MdePkg/Include/Protocol/Tls.h
++++ b/MdePkg/Include/Protocol/Tls.h
+@@ -42,10 +42,6 @@ typedef struct _EFI_TLS_PROTOCOL EFI_TLS_PROTOCOL;
+ ///
+ typedef enum {
+   ///
+-  /// Session Configuration
+-  ///
+-
+-  ///
+   /// TLS session Version. The corresponding Data is of type EFI_TLS_VERSION.
+   ///
+   EfiTlsVersion,
+@@ -86,11 +82,6 @@ typedef enum {
+   /// The corresponding Data is of type EFI_TLS_SESSION_STATE.
+   ///
+   EfiTlsSessionState,
+-
+-  ///
+-  /// Session information
+-  ///
+-
+   ///
+   /// TLS session data client random.
+   /// The corresponding Data is of type EFI_TLS_RANDOM.
+@@ -106,9 +97,15 @@ typedef enum {
+   /// The corresponding Data is of type EFI_TLS_MASTER_SECRET.
+   ///
+   EfiTlsKeyMaterial,
++  ///
++  /// TLS session hostname for validation which is used to verify whether the name
++  /// within the peer certificate matches a given host name.
++  /// This parameter is invalid when EfiTlsVerifyMethod is EFI_TLS_VERIFY_NONE.
++  /// The corresponding Data is of type EFI_TLS_VERIFY_HOST.
++  ///
++  EfiTlsVerifyHost,
+ 
+   EfiTlsSessionDataTypeMaximum
+-
+ } EFI_TLS_SESSION_DATA_TYPE;
+ 
+ ///
+@@ -178,7 +175,8 @@ typedef UINT32  EFI_TLS_VERIFY;
+ ///
+ #define EFI_TLS_VERIFY_PEER                  0x1
+ ///
+-/// TLS session will fail peer certificate is absent.
++/// EFI_TLS_VERIFY_FAIL_IF_NO_PEER_CERT is only meaningful in the server mode.
++/// TLS session will fail if client certificate is absent.
+ ///
+ #define EFI_TLS_VERIFY_FAIL_IF_NO_PEER_CERT  0x2
+ ///
+@@ -188,6 +186,54 @@ typedef UINT32  EFI_TLS_VERIFY;
+ #define EFI_TLS_VERIFY_CLIENT_ONCE           0x4
+ 
+ ///
++/// EFI_TLS_VERIFY_HOST_FLAG
++///
++typedef UINT32 EFI_TLS_VERIFY_HOST_FLAG;
++///
++/// There is no additional flags set for hostname validation.
++/// Wildcards are supported and they match only in the left-most label.
++///
++#define EFI_TLS_VERIFY_FLAG_NONE                    0x00
++///
++/// Always check the Subject Distinguished Name (DN) in the peer certificate even if the
++/// certificate contains Subject Alternative Name (SAN).
++///
++#define EFI_TLS_VERIFY_FLAG_ALWAYS_CHECK_SUBJECT    0x01
++///
++/// Disable the match of all wildcards.
++///
++#define EFI_TLS_VERIFY_FLAG_NO_WILDCARDS            0x02
++///
++/// Disable the "*" as wildcard in labels that have a prefix or suffix (e.g. "www*" or "*www").
++///
++#define EFI_TLS_VERIFY_FLAG_NO_PARTIAL_WILDCARDS    0x04
++///
++/// Allow the "*" to match more than one labels. Otherwise, only matches a single label.
++///
++#define EFI_TLS_VERIFY_FLAG_MULTI_LABEL_WILDCARDS   0x08
++///
++/// Restrict to only match direct child sub-domains which start with ".".
++/// For example, a name of ".example.com" would match "www.example.com" with this flag,
++/// but would not match "www.sub.example.com".
++///
++#define EFI_TLS_VERIFY_FLAG_SINGLE_LABEL_SUBDOMAINS 0x10
++///
++/// Never check the Subject Distinguished Name (DN) even there is no
++/// Subject Alternative Name (SAN) in the certificate.
++///
++#define EFI_TLS_VERIFY_FLAG_NEVER_CHECK_SUBJECT     0x20
++
++///
++/// EFI_TLS_VERIFY_HOST
++///
++#pragma pack (1)
++typedef struct {
++  EFI_TLS_VERIFY_HOST_FLAG Flags;
++  CHAR8                    *HostName;
++} EFI_TLS_VERIFY_HOST;
++#pragma pack ()
++
++///
+ /// EFI_TLS_RANDOM
+ /// Note: The definition of EFI_TLS_RANDOM is from "RFC 5246 A.4.1.
+ ///       Hello Messages".
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-NetworkPkg-HttpDxe-Set-the-HostName-for-the-verifica.patch b/SOURCES/edk2-NetworkPkg-HttpDxe-Set-the-HostName-for-the-verifica.patch
new file mode 100644
index 0000000..06caad5
--- /dev/null
+++ b/SOURCES/edk2-NetworkPkg-HttpDxe-Set-the-HostName-for-the-verifica.patch
@@ -0,0 +1,99 @@
+From d28c0053e94b8e721307ac1698d86e5dfb328e6d Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Mon, 2 Dec 2019 12:32:04 +0100
+Subject: [PATCH 8/9] NetworkPkg/HttpDxe: Set the HostName for the verification
+ (CVE-2019-14553)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20191117220052.15700-9-lersek@redhat.com>
+Patchwork-id: 92459
+O-Subject: [RHEL-8.2.0 edk2 PATCH 8/9] NetworkPkg/HttpDxe: Set the HostName for the verification (CVE-2019-14553)
+Bugzilla: 1536624
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+
+From: "Wu, Jiaxin" <jiaxin.wu@intel.com>
+
+REF: https://bugzilla.tianocore.org/show_bug.cgi?id=960
+CVE: CVE-2019-14553
+Set the HostName by consuming TLS protocol to enable the host name
+check so as to avoid the potential Man-In-The-Middle attack.
+
+Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
+Reviewed-by: Ye Ting <ting.ye@intel.com>
+Reviewed-by: Long Qin <qin.long@intel.com>
+Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
+Acked-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20190927034441.3096-5-Jiaxin.wu@intel.com>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiaxin Wu <jiaxin.wu@intel.com>
+Cc: Sivaraman Nainar <sivaramann@amiindia.co.in>
+Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit e2fc50812895b17e8b23f5a9c43cde29531b200f)
+---
+ NetworkPkg/HttpDxe/HttpProto.h    |  1 +
+ NetworkPkg/HttpDxe/HttpsSupport.c | 21 +++++++++++++++++----
+ 2 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/NetworkPkg/HttpDxe/HttpProto.h b/NetworkPkg/HttpDxe/HttpProto.h
+index 6e1f517..34308e0 100644
+--- a/NetworkPkg/HttpDxe/HttpProto.h
++++ b/NetworkPkg/HttpDxe/HttpProto.h
+@@ -82,6 +82,7 @@ typedef struct {
+   EFI_TLS_VERSION               Version;
+   EFI_TLS_CONNECTION_END        ConnectionEnd;
+   EFI_TLS_VERIFY                VerifyMethod;
++  EFI_TLS_VERIFY_HOST           VerifyHost;
+   EFI_TLS_SESSION_STATE         SessionState;
+ } TLS_CONFIG_DATA;
+ 
+diff --git a/NetworkPkg/HttpDxe/HttpsSupport.c b/NetworkPkg/HttpDxe/HttpsSupport.c
+index 988bbcb..5dfb13b 100644
+--- a/NetworkPkg/HttpDxe/HttpsSupport.c
++++ b/NetworkPkg/HttpDxe/HttpsSupport.c
+@@ -623,13 +623,16 @@ TlsConfigureSession (
+   //
+   // TlsConfigData initialization
+   //
+-  HttpInstance->TlsConfigData.ConnectionEnd = EfiTlsClient;
+-  HttpInstance->TlsConfigData.VerifyMethod = EFI_TLS_VERIFY_PEER;
+-  HttpInstance->TlsConfigData.SessionState = EfiTlsSessionNotStarted;
++  HttpInstance->TlsConfigData.ConnectionEnd       = EfiTlsClient;
++  HttpInstance->TlsConfigData.VerifyMethod        = EFI_TLS_VERIFY_PEER;
++  HttpInstance->TlsConfigData.VerifyHost.Flags    = EFI_TLS_VERIFY_FLAG_NO_WILDCARDS;
++  HttpInstance->TlsConfigData.VerifyHost.HostName = HttpInstance->RemoteHost;
++  HttpInstance->TlsConfigData.SessionState        = EfiTlsSessionNotStarted;
+ 
+   //
+   // EfiTlsConnectionEnd,
+-  // EfiTlsVerifyMethod
++  // EfiTlsVerifyMethod,
++  // EfiTlsVerifyHost,
+   // EfiTlsSessionState
+   //
+   Status = HttpInstance->Tls->SetSessionData (
+@@ -654,6 +657,16 @@ TlsConfigureSession (
+ 
+   Status = HttpInstance->Tls->SetSessionData (
+                                 HttpInstance->Tls,
++                                EfiTlsVerifyHost,
++                                &HttpInstance->TlsConfigData.VerifyHost,
++                                sizeof (EFI_TLS_VERIFY_HOST)
++                                );
++  if (EFI_ERROR (Status)) {
++    return Status;
++  }
++
++  Status = HttpInstance->Tls->SetSessionData (
++                                HttpInstance->Tls,
+                                 EfiTlsSessionState,
+                                 &(HttpInstance->TlsConfigData.SessionState),
+                                 sizeof (EFI_TLS_SESSION_STATE)
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-NetworkPkg-HttpDxe-fix-32-bit-truncation-in-HTTPS-do.patch b/SOURCES/edk2-NetworkPkg-HttpDxe-fix-32-bit-truncation-in-HTTPS-do.patch
new file mode 100644
index 0000000..ec51be6
--- /dev/null
+++ b/SOURCES/edk2-NetworkPkg-HttpDxe-fix-32-bit-truncation-in-HTTPS-do.patch
@@ -0,0 +1,120 @@
+From 555d93f2daa551dc2311b15210a918aa79ed18ff Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Tue, 14 Jan 2020 12:39:06 +0100
+Subject: [PATCH 2/2] NetworkPkg/HttpDxe: fix 32-bit truncation in HTTPS
+ download
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200114123906.8547-3-lersek@redhat.com>
+Patchwork-id: 93340
+O-Subject: [RHEL-8.2.0 edk2 PATCH 2/2] NetworkPkg/HttpDxe: fix 32-bit truncation in HTTPS download
+Bugzilla: 1789797
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+
+When downloading over TLS, each TLS message ("APP packet") is returned as
+a (decrypted) fragment table by EFI_TLS_PROTOCOL.ProcessPacket().
+
+The TlsProcessMessage() function in "NetworkPkg/HttpDxe/HttpsSupport.c"
+linearizes the fragment table into a single contiguous data block. The
+resultant flat data block contains both TLS headers and data.
+
+The HttpsReceive() function parses the actual application data -- in this
+case: decrypted HTTP data -- out of the flattened TLS data block, peeling
+off the TLS headers.
+
+The HttpResponseWorker() function in "NetworkPkg/HttpDxe/HttpImpl.c"
+propagates this HTTP data outwards, implementing the
+EFI_HTTP_PROTOCOL.Response() function.
+
+Now consider the following documentation for EFI_HTTP_PROTOCOL.Response(),
+quoted from "MdePkg/Include/Protocol/Http.h":
+
+> It is the responsibility of the caller to allocate a buffer for Body and
+> specify the size in BodyLength. If the remote host provides a response
+> that contains a content body, up to BodyLength bytes will be copied from
+> the receive buffer into Body and BodyLength will be updated with the
+> amount of bytes received and copied to Body. This allows the client to
+> download a large file in chunks instead of into one contiguous block of
+> memory.
+
+Note that, if the caller-allocated buffer is larger than the
+server-provided chunk, then the transfer length is limited by the latter.
+This is in fact the dominant case when downloading a huge file (for which
+UefiBootManagerLib allocated a huge contiguous RAM Disk buffer) in small
+TLS messages.
+
+For adjusting BodyLength as described above -- i.e., to the application
+data chunk that has been extracted from the TLS message --, the
+HttpResponseWorker() function employs the following assignment:
+
+    HttpMsg->BodyLength = MIN (Fragment.Len, (UINT32) HttpMsg->BodyLength);
+
+The (UINT32) cast is motivated by the MIN() requirement -- in
+"MdePkg/Include/Base.h" -- that both arguments be of the same type.
+
+"Fragment.Len" (NET_FRAGMENT.Len) has type UINT32, and
+"HttpMsg->BodyLength" (EFI_HTTP_MESSAGE.BodyLength) has type UINTN.
+Therefore a cast is indeed necessary.
+
+Unfortunately, the cast is done in the wrong direction. Consider the
+following circumstances:
+
+- "Fragment.Len" happens to be consistently 16KiB, dictated by the HTTPS
+  Server's TLS stack,
+
+- the size of the file to download is 4GiB + N*16KiB, where N is a
+  positive integer.
+
+As the download progresses, each received 16KiB application data chunk
+brings the *next* input value of BodyLength closer down to 4GiB. The cast
+in MIN() always masks off the high-order bits from the input value of
+BodyLength, but this is no problem because the low-order bits are nonzero,
+therefore the MIN() always permits progress.
+
+However, once BodyLength reaches 4GiB exactly on input, the MIN()
+invocation produces a zero value. HttpResponseWorker() adjusts the output
+value of BodyLength to zero, and then passes it to HttpParseMessageBody().
+
+HttpParseMessageBody() (in "NetworkPkg/Library/DxeHttpLib/DxeHttpLib.c")
+rejects the zero BodyLength with EFI_INVALID_PARAMETER, which is fully
+propagated outwards, and aborts the HTTPS download. HttpBootDxe writes the
+message "Error: Unexpected network error" to the UEFI console.
+
+For example, a file with size (4GiB + 197MiB) terminates after downloading
+just 197MiB.
+
+Invert the direction of the cast: widen "Fragment.Len" to UINTN.
+
+Cc: Jiaxin Wu <jiaxin.wu@intel.com>
+Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
+Cc: Siyuan Fu <siyuan.fu@intel.com>
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
+Reviewed-by: Siyuan Fu <siyuan.fu@intel.com>
+Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
+(cherry picked from commit 4cca7923992a13f6b753782f469ee944da2db796)
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ NetworkPkg/HttpDxe/HttpImpl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/NetworkPkg/HttpDxe/HttpImpl.c b/NetworkPkg/HttpDxe/HttpImpl.c
+index 6b87731..1acbb60 100644
+--- a/NetworkPkg/HttpDxe/HttpImpl.c
++++ b/NetworkPkg/HttpDxe/HttpImpl.c
+@@ -1348,7 +1348,7 @@ HttpResponseWorker (
+     //
+     // Process the received the body packet.
+     //
+-    HttpMsg->BodyLength = MIN (Fragment.Len, (UINT32) HttpMsg->BodyLength);
++    HttpMsg->BodyLength = MIN ((UINTN) Fragment.Len, HttpMsg->BodyLength);
+ 
+     CopyMem (HttpMsg->Body, Fragment.Bulk, HttpMsg->BodyLength);
+ 
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-NetworkPkg-TlsDxe-Add-the-support-of-host-validation.patch b/SOURCES/edk2-NetworkPkg-TlsDxe-Add-the-support-of-host-validation.patch
new file mode 100644
index 0000000..3aa8efd
--- /dev/null
+++ b/SOURCES/edk2-NetworkPkg-TlsDxe-Add-the-support-of-host-validation.patch
@@ -0,0 +1,117 @@
+From 24a4a1d62ae749c197f36d72f645c7142f368e6a Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Mon, 2 Dec 2019 12:32:00 +0100
+Subject: [PATCH 7/9] NetworkPkg/TlsDxe: Add the support of host validation to
+ TlsDxe driver (CVE-2019-14553)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20191117220052.15700-8-lersek@redhat.com>
+Patchwork-id: 92456
+O-Subject: [RHEL-8.2.0 edk2 PATCH 7/9] NetworkPkg/TlsDxe: Add the support of host validation to TlsDxe driver (CVE-2019-14553)
+Bugzilla: 1536624
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+From: "Wu, Jiaxin" <jiaxin.wu@intel.com>
+
+REF: https://bugzilla.tianocore.org/show_bug.cgi?id=960
+CVE: CVE-2019-14553
+The new data type named "EfiTlsVerifyHost" and the
+EFI_TLS_VERIFY_HOST_FLAG are supported in TLS protocol.
+
+Signed-off-by: Wu Jiaxin <jiaxin.wu@intel.com>
+Reviewed-by: Ye Ting <ting.ye@intel.com>
+Reviewed-by: Long Qin <qin.long@intel.com>
+Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
+Acked-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20190927034441.3096-4-Jiaxin.wu@intel.com>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiaxin Wu <jiaxin.wu@intel.com>
+Cc: Sivaraman Nainar <sivaramann@amiindia.co.in>
+Cc: Xiaoyu Lu <xiaoyux.lu@intel.com>
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 703e7ab21ff8fda9ababf7751d59bd28ad5da947)
+---
+ NetworkPkg/TlsDxe/TlsProtocol.c | 44 ++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 41 insertions(+), 3 deletions(-)
+
+diff --git a/NetworkPkg/TlsDxe/TlsProtocol.c b/NetworkPkg/TlsDxe/TlsProtocol.c
+index a7a993f..001e540 100644
+--- a/NetworkPkg/TlsDxe/TlsProtocol.c
++++ b/NetworkPkg/TlsDxe/TlsProtocol.c
+@@ -1,7 +1,7 @@
+ /** @file
+   Implementation of EFI TLS Protocol Interfaces.
+ 
+-  Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
++  Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
+ 
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+@@ -56,12 +56,16 @@ TlsSetSessionData (
+   UINT16                    *CipherId;
+   CONST EFI_TLS_CIPHER      *TlsCipherList;
+   UINTN                     CipherCount;
++  CONST EFI_TLS_VERIFY_HOST *TlsVerifyHost;
++  EFI_TLS_VERIFY            VerifyMethod;
++  UINTN                     VerifyMethodSize;
+   UINTN                     Index;
+ 
+   EFI_TPL                   OldTpl;
+ 
+-  Status = EFI_SUCCESS;
+-  CipherId = NULL;
++  Status           = EFI_SUCCESS;
++  CipherId         = NULL;
++  VerifyMethodSize = sizeof (EFI_TLS_VERIFY);
+ 
+   if (This == NULL || Data == NULL || DataSize == 0) {
+     return EFI_INVALID_PARAMETER;
+@@ -149,6 +153,40 @@ TlsSetSessionData (
+ 
+     TlsSetVerify (Instance->TlsConn, *((UINT32 *) Data));
+     break;
++  case EfiTlsVerifyHost:
++    if (DataSize != sizeof (EFI_TLS_VERIFY_HOST)) {
++      Status = EFI_INVALID_PARAMETER;
++      goto ON_EXIT;
++    }
++
++    TlsVerifyHost = (CONST EFI_TLS_VERIFY_HOST *) Data;
++
++    if ((TlsVerifyHost->Flags & EFI_TLS_VERIFY_FLAG_ALWAYS_CHECK_SUBJECT) != 0 &&
++        (TlsVerifyHost->Flags & EFI_TLS_VERIFY_FLAG_NEVER_CHECK_SUBJECT) != 0) {
++      Status = EFI_INVALID_PARAMETER;
++      goto ON_EXIT;
++    }
++
++    if ((TlsVerifyHost->Flags & EFI_TLS_VERIFY_FLAG_NO_WILDCARDS) != 0 &&
++        ((TlsVerifyHost->Flags & EFI_TLS_VERIFY_FLAG_NO_PARTIAL_WILDCARDS) != 0 ||
++         (TlsVerifyHost->Flags & EFI_TLS_VERIFY_FLAG_MULTI_LABEL_WILDCARDS) != 0)) {
++      Status = EFI_INVALID_PARAMETER;
++      goto ON_EXIT;
++    }
++
++    Status = This->GetSessionData (This, EfiTlsVerifyMethod, &VerifyMethod, &VerifyMethodSize);
++    if (EFI_ERROR (Status)) {
++      goto ON_EXIT;
++    }
++
++    if ((VerifyMethod & EFI_TLS_VERIFY_PEER) == 0) {
++      Status = EFI_INVALID_PARAMETER;
++      goto ON_EXIT;
++    }
++
++    Status = TlsSetVerifyHost (Instance->TlsConn, TlsVerifyHost->Flags, TlsVerifyHost->HostName);
++
++    break;
+   case EfiTlsSessionID:
+     if (DataSize != sizeof (EFI_TLS_SESSION_ID)) {
+       Status = EFI_INVALID_PARAMETER;
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-OvmfPkg-QemuVideoDxe-unbreak-secondary-vga-and-bochs.patch b/SOURCES/edk2-OvmfPkg-QemuVideoDxe-unbreak-secondary-vga-and-bochs.patch
new file mode 100644
index 0000000..e8167d6
--- /dev/null
+++ b/SOURCES/edk2-OvmfPkg-QemuVideoDxe-unbreak-secondary-vga-and-bochs.patch
@@ -0,0 +1,64 @@
+From 78cfb461bedb0e0491b267528b2ebd30adc1d87c Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 27 Mar 2020 07:01:18 +0100
+Subject: [PATCH] OvmfPkg/QemuVideoDxe: unbreak "secondary-vga" and
+ "bochs-display" support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Message-id: <20200226173820.16398-2-lersek@redhat.com>
+Patchwork-id: 94054
+O-Subject: [RHEL-8.2.0 edk2 PATCH 1/1] OvmfPkg/QemuVideoDxe: unbreak "secondary-vga" and "bochs-display" support
+Bugzilla: 1806359
+RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+
+In edk2 commit 333f32ec23dd, QemuVideoDxe gained support for QEMU's
+"secondary-vga" device model (originally introduced in QEMU commit
+63e3e24db2e9).
+
+In QEMU commit 765c94290863, the "bochs-display" device was introduced,
+which would work with QemuVideoDxe out of the box, reusing the
+"secondary-vga" logic.
+
+Support for both models has been broken since edk2 commit 662bd0da7fd7.
+Said patch ended up requiring VGA IO Ports -- i.e., at least one of
+EFI_PCI_IO_ATTRIBUTE_VGA_IO and EFI_PCI_IO_ATTRIBUTE_VGA_IO_16 -- even if
+the device wasn't actually VGA compatible.
+
+Restrict the IO Ports requirement to VGA compatible devices.
+
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Gerd Hoffmann <kraxel@redhat.com>
+Cc: Jordan Justen <jordan.l.justen@intel.com>
+Cc: Marc W Chen <marc.w.chen@intel.com>
+Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
+Fixes: 662bd0da7fd77e4d2cf9ef4a78015af5cad7d9db
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2555
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20200224171741.7494-1-lersek@redhat.com>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+(cherry picked from commit edfe16a6d9f8c6830d7ad93ee7616225fe4e9c13)
+---
+ OvmfPkg/QemuVideoDxe/Driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/OvmfPkg/QemuVideoDxe/Driver.c b/OvmfPkg/QemuVideoDxe/Driver.c
+index 522110e..902dd1b 100644
+--- a/OvmfPkg/QemuVideoDxe/Driver.c
++++ b/OvmfPkg/QemuVideoDxe/Driver.c
+@@ -292,7 +292,7 @@ QemuVideoControllerDriverStart (
+   }
+ 
+   SupportedVgaIo &= (UINT64)(EFI_PCI_IO_ATTRIBUTE_VGA_IO | EFI_PCI_IO_ATTRIBUTE_VGA_IO_16);
+-  if (SupportedVgaIo == 0) {
++  if (SupportedVgaIo == 0 && IS_PCI_VGA (&Pci)) {
+     Status = EFI_UNSUPPORTED;
+     goto ClosePciIo;
+   }
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-eliminate-St.patch b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-eliminate-St.patch
new file mode 100644
index 0000000..c57efd8
--- /dev/null
+++ b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-eliminate-St.patch
@@ -0,0 +1,82 @@
+From b68d6a626977f48ac4d05396edcb70a73b12c66c Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 31 Jan 2020 12:42:45 +0100
+Subject: [PATCH 09/12] SecurityPkg/DxeImageVerificationHandler: eliminate
+ "Status" variable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200131124248.22369-10-lersek@redhat.com>
+Patchwork-id: 93619
+O-Subject: [RHEL-8.2.0 edk2 PATCH 09/12] SecurityPkg/DxeImageVerificationHandler: eliminate "Status" variable
+Bugzilla: 1751993
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+The "Status" variable is set to EFI_ACCESS_DENIED at the top of the
+function. Then it is overwritten with EFI_SECURITY_VIOLATION under the
+"Failed" (earlier: "Done") label. We finally return "Status".
+
+The above covers the complete usage of "Status" in
+DxeImageVerificationHandler(). Remove the variable, and simply return
+EFI_SECURITY_VIOLATION in the end.
+
+This patch is a no-op, regarding behavior.
+
+Cc: Chao Zhang <chao.b.zhang@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiewen Yao <jiewen.yao@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2129
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20200116190705.18816-9-lersek@redhat.com>
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+[lersek@redhat.com: push with Mike's R-b due to Chinese New Year
+ Holiday: <https://edk2.groups.io/g/devel/message/53429>; msgid
+ <d3fbb76dabed4e1987c512c328c82810@intel.com>]
+(cherry picked from commit fb02f5b2cd0b2a2d413a4f4fc41e085be2ede089)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c        | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index 51968bd..b49fe87 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -1560,7 +1560,6 @@ DxeImageVerificationHandler (
+   IN  BOOLEAN                          BootPolicy
+   )
+ {
+-  EFI_STATUS                           Status;
+   EFI_IMAGE_DOS_HEADER                 *DosHdr;
+   BOOLEAN                              IsVerified;
+   EFI_SIGNATURE_LIST                   *SignatureList;
+@@ -1588,7 +1587,6 @@ DxeImageVerificationHandler (
+   SecDataDir        = NULL;
+   PkcsCertData      = NULL;
+   Action            = EFI_IMAGE_EXECUTION_AUTH_UNTESTED;
+-  Status            = EFI_ACCESS_DENIED;
+   IsVerified        = FALSE;
+ 
+ 
+@@ -1880,13 +1878,12 @@ Failed:
+     DEBUG ((DEBUG_INFO, "The image doesn't pass verification: %s\n", NameStr));
+     FreePool(NameStr);
+   }
+-  Status = EFI_SECURITY_VIOLATION;
+ 
+   if (SignatureList != NULL) {
+     FreePool (SignatureList);
+   }
+ 
+-  return Status;
++  return EFI_SECURITY_VIOLATION;
+ }
+ 
+ /**
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-fix-defer-vs.patch b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-fix-defer-vs.patch
new file mode 100644
index 0000000..9c7a572
--- /dev/null
+++ b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-fix-defer-vs.patch
@@ -0,0 +1,103 @@
+From ff8b6134756fca6b0c55fedc76aeb5000f783875 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 31 Jan 2020 12:42:48 +0100
+Subject: [PATCH 12/12] SecurityPkg/DxeImageVerificationHandler: fix "defer"
+ vs. "deny" policies
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200131124248.22369-13-lersek@redhat.com>
+Patchwork-id: 93620
+O-Subject: [RHEL-8.2.0 edk2 PATCH 12/12] SecurityPkg/DxeImageVerificationHandler: fix "defer" vs. "deny" policies
+Bugzilla: 1751993
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+In DxeImageVerificationHandler(), we should return EFI_SECURITY_VIOLATION
+for a rejected image only if the platform sets
+DEFER_EXECUTE_ON_SECURITY_VIOLATION as the policy for the image's source.
+Otherwise, EFI_ACCESS_DENIED must be returned.
+
+Right now, EFI_SECURITY_VIOLATION is returned for all rejected images,
+which is wrong -- it causes LoadImage() to hold on to rejected images (in
+untrusted state), for further platform actions. However, if a platform
+already set DENY_EXECUTE_ON_SECURITY_VIOLATION, the platform will not
+expect the rejected image to stick around in memory (regardless of its
+untrusted state).
+
+Therefore, adhere to the platform policy in the return value of the
+DxeImageVerificationHandler() function.
+
+Furthermore, according to "32.4.2 Image Execution Information Table" in
+the UEFI v2.8 spec, and considering that edk2 only supports (AuditMode==0)
+at the moment:
+
+> When AuditMode==0, if the image's signature is not found in the
+> authorized database, or is found in the forbidden database, the image
+> will not be started and instead, information about it will be placed in
+> this table.
+
+we have to store an EFI_IMAGE_EXECUTION_INFO record in both the "defer"
+case and the "deny" case. Thus, the AddImageExeInfo() call is not being
+made conditional on (Policy == DEFER_EXECUTE_ON_SECURITY_VIOLATION); the
+documentation is updated instead.
+
+Cc: Chao Zhang <chao.b.zhang@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiewen Yao <jiewen.yao@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2129
+Fixes: 5db28a6753d307cdfb1cfdeb2f63739a9f959837
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20200116190705.18816-12-lersek@redhat.com>
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+[lersek@redhat.com: push with Mike's R-b due to Chinese New Year
+ Holiday: <https://edk2.groups.io/g/devel/message/53429>; msgid
+ <d3fbb76dabed4e1987c512c328c82810@intel.com>]
+(cherry picked from commit 8b0932c19f31cbf9da26d3b8d4e8d954bdbb5269)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index 015a5b6..dbfbfcb 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -1548,7 +1548,8 @@ Done:
+                                  execution table.
+   @retval EFI_ACCESS_DENIED      The file specified by File and FileBuffer did not
+                                  authenticate, and the platform policy dictates that the DXE
+-                                 Foundation many not use File.
++                                 Foundation may not use File. The image has
++                                 been added to the file execution table.
+ 
+ **/
+ EFI_STATUS
+@@ -1872,7 +1873,8 @@ DxeImageVerificationHandler (
+ 
+ Failed:
+   //
+-  // Policy decides to defer or reject the image; add its information in image executable information table.
++  // Policy decides to defer or reject the image; add its information in image
++  // executable information table in either case.
+   //
+   NameStr = ConvertDevicePathToText (File, FALSE, TRUE);
+   AddImageExeInfo (Action, NameStr, File, SignatureList, SignatureListSize);
+@@ -1885,7 +1887,10 @@ Failed:
+     FreePool (SignatureList);
+   }
+ 
+-  return EFI_SECURITY_VIOLATION;
++  if (Policy == DEFER_EXECUTE_ON_SECURITY_VIOLATION) {
++    return EFI_SECURITY_VIOLATION;
++  }
++  return EFI_ACCESS_DENIED;
+ }
+ 
+ /**
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-fix-imgexec-.patch b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-fix-imgexec-.patch
new file mode 100644
index 0000000..396f1c0
--- /dev/null
+++ b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-fix-imgexec-.patch
@@ -0,0 +1,87 @@
+From d9f12d175da2d203be078d03c9127293ea6fe86b Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 31 Jan 2020 12:42:47 +0100
+Subject: [PATCH 11/12] SecurityPkg/DxeImageVerificationHandler: fix imgexec
+ info on memalloc fail
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200131124248.22369-12-lersek@redhat.com>
+Patchwork-id: 93618
+O-Subject: [RHEL-8.2.0 edk2 PATCH 11/12] SecurityPkg/DxeImageVerificationHandler: fix imgexec info on memalloc fail
+Bugzilla: 1751993
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+It makes no sense to call AddImageExeInfo() with (Signature == NULL) and
+(SignatureSize > 0). AddImageExeInfo() does not crash in such a case -- it
+avoids the CopyMem() call --, but it creates an invalid
+EFI_IMAGE_EXECUTION_INFO record. Namely, the
+"EFI_IMAGE_EXECUTION_INFO.InfoSize" field includes "SignatureSize", but
+the actual signature bytes are not filled in.
+
+Document and ASSERT() this condition in AddImageExeInfo().
+
+In DxeImageVerificationHandler(), zero out "SignatureListSize" if we set
+"SignatureList" to NULL due to AllocateZeroPool() failure.
+
+(Another approach could be to avoid calling AddImageExeInfo() completely,
+in case AllocateZeroPool() fails. Unfortunately, the UEFI v2.8 spec does
+not seem to state clearly whether a signature is mandatory in
+EFI_IMAGE_EXECUTION_INFO, if the "Action" field is
+EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED or EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND.
+
+For now, the EFI_IMAGE_EXECUTION_INFO addition logic is not changed; we
+only make sure that the record we add is not malformed.)
+
+Cc: Chao Zhang <chao.b.zhang@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiewen Yao <jiewen.yao@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2129
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20200116190705.18816-11-lersek@redhat.com>
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+[lersek@redhat.com: push with Mike's R-b due to Chinese New Year
+ Holiday: <https://edk2.groups.io/g/devel/message/53429>; msgid
+ <d3fbb76dabed4e1987c512c328c82810@intel.com>]
+(cherry picked from commit 6aa31db5ebebe18b55aa5359142223a03592416f)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index c98b9e4..015a5b6 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -704,7 +704,7 @@ GetImageExeInfoTableSize (
+   @param[in]  Name            Input a null-terminated, user-friendly name.
+   @param[in]  DevicePath      Input device path pointer.
+   @param[in]  Signature       Input signature info in EFI_SIGNATURE_LIST data structure.
+-  @param[in]  SignatureSize   Size of signature.
++  @param[in]  SignatureSize   Size of signature. Must be zero if Signature is NULL.
+ 
+ **/
+ VOID
+@@ -761,6 +761,7 @@ AddImageExeInfo (
+   //
+   // Signature size can be odd. Pad after signature to ensure next EXECUTION_INFO entry align
+   //
++  ASSERT (Signature != NULL || SignatureSize == 0);
+   NewImageExeInfoEntrySize = sizeof (EFI_IMAGE_EXECUTION_INFO) + NameStringLen + DevicePathSize + SignatureSize;
+ 
+   NewImageExeInfoTable      = (EFI_IMAGE_EXECUTION_INFO_TABLE *) AllocateRuntimePool (ImageExeInfoTableSize + NewImageExeInfoEntrySize);
+@@ -1858,6 +1859,7 @@ DxeImageVerificationHandler (
+     SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + mImageDigestSize;
+     SignatureList     = (EFI_SIGNATURE_LIST *) AllocateZeroPool (SignatureListSize);
+     if (SignatureList == NULL) {
++      SignatureListSize = 0;
+       goto Failed;
+     }
+     SignatureList->SignatureHeaderSize  = 0;
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-fix-retval-f.patch b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-fix-retval-f.patch
new file mode 100644
index 0000000..926cc90
--- /dev/null
+++ b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-fix-retval-f.patch
@@ -0,0 +1,64 @@
+From e2efec69c63703c324099b987204a38fdb0d9d6f Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 31 Jan 2020 12:42:46 +0100
+Subject: [PATCH 10/12] SecurityPkg/DxeImageVerificationHandler: fix retval for
+ (FileBuffer==NULL)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200131124248.22369-11-lersek@redhat.com>
+Patchwork-id: 93613
+O-Subject: [RHEL-8.2.0 edk2 PATCH 10/12] SecurityPkg/DxeImageVerificationHandler: fix retval for (FileBuffer==NULL)
+Bugzilla: 1751993
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+"FileBuffer" is a non-optional input (pointer) parameter to
+DxeImageVerificationHandler(). Normally, when an edk2 function receives a
+NULL argument for such a parameter, we return EFI_INVALID_PARAMETER or
+RETURN_INVALID_PARAMETER. However, those don't conform to the
+SECURITY2_FILE_AUTHENTICATION_HANDLER prototype.
+
+Return EFI_ACCESS_DENIED when "FileBuffer" is NULL; it means that no image
+has been loaded.
+
+This patch does not change the control flow in the function, it only
+changes the "Status" outcome from API-incompatible error codes to
+EFI_ACCESS_DENIED, under some circumstances.
+
+Cc: Chao Zhang <chao.b.zhang@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiewen Yao <jiewen.yao@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2129
+Fixes: 570b3d1a7278df29878da87990e8366bd42d0ec5
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20200116190705.18816-10-lersek@redhat.com>
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+[lersek@redhat.com: push with Mike's R-b due to Chinese New Year
+ Holiday: <https://edk2.groups.io/g/devel/message/53429>; msgid
+ <d3fbb76dabed4e1987c512c328c82810@intel.com>]
+(cherry picked from commit 6d57592740cdd0b6868baeef7929d6e6fef7a8e3)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index b49fe87..c98b9e4 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -1655,7 +1655,7 @@ DxeImageVerificationHandler (
+   // Read the Dos header.
+   //
+   if (FileBuffer == NULL) {
+-    return EFI_INVALID_PARAMETER;
++    return EFI_ACCESS_DENIED;
+   }
+ 
+   mImageBase  = (UINT8 *) FileBuffer;
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-fix-retval-o.patch b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-fix-retval-o.patch
new file mode 100644
index 0000000..04bcd90
--- /dev/null
+++ b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-fix-retval-o.patch
@@ -0,0 +1,71 @@
+From 58902877128851f628fe644a5c71600866317fac Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 31 Jan 2020 12:42:42 +0100
+Subject: [PATCH 06/12] SecurityPkg/DxeImageVerificationHandler: fix retval on
+ memalloc failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200131124248.22369-7-lersek@redhat.com>
+Patchwork-id: 93616
+O-Subject: [RHEL-8.2.0 edk2 PATCH 06/12] SecurityPkg/DxeImageVerificationHandler: fix retval on memalloc failure
+Bugzilla: 1751993
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+A SECURITY2_FILE_AUTHENTICATION_HANDLER function is not expected to return
+EFI_OUT_OF_RESOURCES. We should only return EFI_SUCCESS,
+EFI_SECURITY_VIOLATION, or EFI_ACCESS_DENIED.
+
+In case we run out of memory while preparing "SignatureList" for
+AddImageExeInfo(), we should simply stick with the EFI_ACCESS_DENIED value
+that is already in "Status" -- from just before the "Action" condition --,
+and not suppress it with EFI_OUT_OF_RESOURCES.
+
+This patch does not change the control flow in the function, it only
+changes the "Status" outcome from API-incompatible error codes to
+EFI_ACCESS_DENIED, under some circumstances.
+
+Cc: Chao Zhang <chao.b.zhang@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiewen Yao <jiewen.yao@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2129
+Fixes: 570b3d1a7278df29878da87990e8366bd42d0ec5
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20200116190705.18816-6-lersek@redhat.com>
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+[lersek@redhat.com: push with Mike's R-b due to Chinese New Year
+ Holiday: <https://edk2.groups.io/g/devel/message/53429>; msgid
+ <d3fbb76dabed4e1987c512c328c82810@intel.com>]
+(cherry picked from commit f891b052c5ec13c1032fb9d340d5262ac1a7e7e1)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index 5cc82c1..5f09a66 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -1541,7 +1541,6 @@ Done:
+                                  and non-NULL FileBuffer did authenticate, and the platform
+                                  policy dictates that the DXE Foundation may execute the image in
+                                  FileBuffer.
+-  @retval EFI_OUT_RESOURCE       Fail to allocate memory.
+   @retval EFI_SECURITY_VIOLATION The file specified by File did not authenticate, and
+                                  the platform policy dictates that File should be placed
+                                  in the untrusted state. The image has been added to the file
+@@ -1862,7 +1861,6 @@ DxeImageVerificationHandler (
+     SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + mImageDigestSize;
+     SignatureList     = (EFI_SIGNATURE_LIST *) AllocateZeroPool (SignatureListSize);
+     if (SignatureList == NULL) {
+-      Status = EFI_OUT_OF_RESOURCES;
+       goto Done;
+     }
+     SignatureList->SignatureHeaderSize  = 0;
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-keep-PE-COFF.patch b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-keep-PE-COFF.patch
new file mode 100644
index 0000000..3719f4e
--- /dev/null
+++ b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-keep-PE-COFF.patch
@@ -0,0 +1,97 @@
+From 37b5981bf7eb94314b62810da495d724873d904a Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 31 Jan 2020 12:42:40 +0100
+Subject: [PATCH 04/12] SecurityPkg/DxeImageVerificationHandler: keep PE/COFF
+ info status internal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200131124248.22369-5-lersek@redhat.com>
+Patchwork-id: 93609
+O-Subject: [RHEL-8.2.0 edk2 PATCH 04/12] SecurityPkg/DxeImageVerificationHandler: keep PE/COFF info status internal
+Bugzilla: 1751993
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+The PeCoffLoaderGetImageInfo() function may return various error codes,
+such as RETURN_INVALID_PARAMETER and RETURN_UNSUPPORTED.
+
+Such error values should not be assigned to our "Status" variable in the
+DxeImageVerificationHandler() function, because "Status" generally stands
+for the main exit value of the function. And
+SECURITY2_FILE_AUTHENTICATION_HANDLER functions are expected to return one
+of EFI_SUCCESS, EFI_SECURITY_VIOLATION, and EFI_ACCESS_DENIED only.
+
+Introduce the "PeCoffStatus" helper variable for keeping the return value
+of PeCoffLoaderGetImageInfo() internal to the function. If
+PeCoffLoaderGetImageInfo() fails, we'll jump to the "Done" label with
+"Status" being EFI_ACCESS_DENIED, inherited from the top of the function.
+
+Note that this is consistent with the subsequent PE/COFF Signature check,
+where we jump to the "Done" label with "Status" having been re-set to
+EFI_ACCESS_DENIED.
+
+As a consequence, we can at once remove the
+
+  Status = EFI_ACCESS_DENIED;
+
+assignment right after the "PeCoffStatus" check.
+
+This patch does not change the control flow in the function, it only
+changes the "Status" outcome from API-incompatible error codes to
+EFI_ACCESS_DENIED, under some circumstances.
+
+Cc: Chao Zhang <chao.b.zhang@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiewen Yao <jiewen.yao@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2129
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20200116190705.18816-4-lersek@redhat.com>
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+[lersek@redhat.com: push with Mike's R-b due to Chinese New Year
+ Holiday: <https://edk2.groups.io/g/devel/message/53429>; msgid
+ <d3fbb76dabed4e1987c512c328c82810@intel.com>]
+(cherry picked from commit 61a9fa589a15e9005bec293f9766c78b60fbc9fc)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c      | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index 8204c9c..e6c8a54 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -1580,6 +1580,7 @@ DxeImageVerificationHandler (
+   EFI_IMAGE_DATA_DIRECTORY             *SecDataDir;
+   UINT32                               OffSet;
+   CHAR16                               *NameStr;
++  RETURN_STATUS                        PeCoffStatus;
+ 
+   SignatureList     = NULL;
+   SignatureListSize = 0;
+@@ -1669,8 +1670,8 @@ DxeImageVerificationHandler (
+   //
+   // Get information about the image being loaded
+   //
+-  Status = PeCoffLoaderGetImageInfo (&ImageContext);
+-  if (EFI_ERROR (Status)) {
++  PeCoffStatus = PeCoffLoaderGetImageInfo (&ImageContext);
++  if (RETURN_ERROR (PeCoffStatus)) {
+     //
+     // The information can't be got from the invalid PeImage
+     //
+@@ -1678,8 +1679,6 @@ DxeImageVerificationHandler (
+     goto Done;
+   }
+ 
+-  Status = EFI_ACCESS_DENIED;
+-
+   DosHdr = (EFI_IMAGE_DOS_HEADER *) mImageBase;
+   if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE) {
+     //
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-narrow-down-.patch b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-narrow-down-.patch
new file mode 100644
index 0000000..2365eb8
--- /dev/null
+++ b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-narrow-down-.patch
@@ -0,0 +1,79 @@
+From 73de814a5f30c2c6d82736082c1114a028d12115 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 31 Jan 2020 12:42:41 +0100
+Subject: [PATCH 05/12] SecurityPkg/DxeImageVerificationHandler: narrow down
+ PE/COFF hash status
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200131124248.22369-6-lersek@redhat.com>
+Patchwork-id: 93615
+O-Subject: [RHEL-8.2.0 edk2 PATCH 05/12] SecurityPkg/DxeImageVerificationHandler: narrow down PE/COFF hash status
+Bugzilla: 1751993
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+Inside the "for" loop that scans the signatures of the image, we call
+HashPeImageByType(), and assign its return value to "Status".
+
+Beyond the immediate retval check, this assignment is useless (never
+consumed). That's because a subsequent access to "Status" may only be one
+of the following:
+
+- the "Status" assignment when we call HashPeImageByType() in the next
+  iteration of the loop,
+
+- the "Status = EFI_ACCESS_DENIED" assignment right after the final
+  "IsVerified" check.
+
+To make it clear that the assignment is only useful for the immediate
+HashPeImageByType() retval check, introduce a specific helper variable,
+called "HashStatus".
+
+This patch is a no-op, functionally.
+
+Cc: Chao Zhang <chao.b.zhang@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiewen Yao <jiewen.yao@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2129
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20200116190705.18816-5-lersek@redhat.com>
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+[lersek@redhat.com: push with Mike's R-b due to Chinese New Year
+ Holiday: <https://edk2.groups.io/g/devel/message/53429>; msgid
+ <d3fbb76dabed4e1987c512c328c82810@intel.com>]
+(cherry picked from commit 47650a5cab608e07c31d66bdb9b4cc6e58bdf22f)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c        | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index e6c8a54..5cc82c1 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -1581,6 +1581,7 @@ DxeImageVerificationHandler (
+   UINT32                               OffSet;
+   CHAR16                               *NameStr;
+   RETURN_STATUS                        PeCoffStatus;
++  EFI_STATUS                           HashStatus;
+ 
+   SignatureList     = NULL;
+   SignatureListSize = 0;
+@@ -1802,8 +1803,8 @@ DxeImageVerificationHandler (
+       continue;
+     }
+ 
+-    Status = HashPeImageByType (AuthData, AuthDataSize);
+-    if (EFI_ERROR (Status)) {
++    HashStatus = HashPeImageByType (AuthData, AuthDataSize);
++    if (EFI_ERROR (HashStatus)) {
+       continue;
+     }
+ 
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-remove-else-.patch b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-remove-else-.patch
new file mode 100644
index 0000000..e48ebd5
--- /dev/null
+++ b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-remove-else-.patch
@@ -0,0 +1,142 @@
+From 5aa2d52451b7890480d31a3437a0024bfd9e1a57 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 31 Jan 2020 12:42:39 +0100
+Subject: [PATCH 03/12] SecurityPkg/DxeImageVerificationHandler: remove "else"
+ after return/break
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200131124248.22369-4-lersek@redhat.com>
+Patchwork-id: 93614
+O-Subject: [RHEL-8.2.0 edk2 PATCH 03/12] SecurityPkg/DxeImageVerificationHandler: remove "else" after return/break
+Bugzilla: 1751993
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+In the code structure
+
+  if (condition) {
+    //
+    // block1
+    //
+    return;
+  } else {
+    //
+    // block2
+    //
+  }
+
+nesting "block2" in an "else" branch is superfluous, and harms
+readability. It can be transformed to:
+
+  if (condition) {
+    //
+    // block1
+    //
+    return;
+  }
+  //
+  // block2
+  //
+
+with identical behavior, and improved readability (less nesting).
+
+The same applies to "break" (instead of "return") in a loop body.
+
+Perform these transformations on DxeImageVerificationHandler().
+
+This patch is a no-op for behavior. Use
+
+  git show -b -W
+
+for reviewing it more easily.
+
+Cc: Chao Zhang <chao.b.zhang@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiewen Yao <jiewen.yao@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2129
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20200116190705.18816-3-lersek@redhat.com>
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+[lersek@redhat.com: push with Mike's R-b due to Chinese New Year
+ Holiday: <https://edk2.groups.io/g/devel/message/53429>; msgid
+ <d3fbb76dabed4e1987c512c328c82810@intel.com>]
+(cherry picked from commit eccb856f013aec700234211e7371f03454ef9d52)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ .../DxeImageVerificationLib.c                      | 41 +++++++++++-----------
+ 1 file changed, 21 insertions(+), 20 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index 5afd723..8204c9c 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -1621,7 +1621,8 @@ DxeImageVerificationHandler (
+   //
+   if (Policy == ALWAYS_EXECUTE) {
+     return EFI_SUCCESS;
+-  } else if (Policy == NEVER_EXECUTE) {
++  }
++  if (Policy == NEVER_EXECUTE) {
+     return EFI_ACCESS_DENIED;
+   }
+ 
+@@ -1833,7 +1834,8 @@ DxeImageVerificationHandler (
+       DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is signed but %s hash of image is found in DBX.\n", mHashTypeStr));
+       IsVerified = FALSE;
+       break;
+-    } else if (!IsVerified) {
++    }
++    if (!IsVerified) {
+       if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE, mImageDigest, &mCertType, mImageDigestSize)) {
+         IsVerified = TRUE;
+       } else {
+@@ -1851,25 +1853,24 @@ DxeImageVerificationHandler (
+ 
+   if (IsVerified) {
+     return EFI_SUCCESS;
+-  } else {
+-    Status = EFI_ACCESS_DENIED;
+-    if (Action == EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED || Action == EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND) {
+-      //
+-      // Get image hash value as signature of executable.
+-      //
+-      SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + mImageDigestSize;
+-      SignatureList     = (EFI_SIGNATURE_LIST *) AllocateZeroPool (SignatureListSize);
+-      if (SignatureList == NULL) {
+-        Status = EFI_OUT_OF_RESOURCES;
+-        goto Done;
+-      }
+-      SignatureList->SignatureHeaderSize  = 0;
+-      SignatureList->SignatureListSize    = (UINT32) SignatureListSize;
+-      SignatureList->SignatureSize        = (UINT32) (sizeof (EFI_SIGNATURE_DATA) - 1 + mImageDigestSize);
+-      CopyMem (&SignatureList->SignatureType, &mCertType, sizeof (EFI_GUID));
+-      Signature = (EFI_SIGNATURE_DATA *) ((UINT8 *) SignatureList + sizeof (EFI_SIGNATURE_LIST));
+-      CopyMem (Signature->SignatureData, mImageDigest, mImageDigestSize);
++  }
++  Status = EFI_ACCESS_DENIED;
++  if (Action == EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED || Action == EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND) {
++    //
++    // Get image hash value as signature of executable.
++    //
++    SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + mImageDigestSize;
++    SignatureList     = (EFI_SIGNATURE_LIST *) AllocateZeroPool (SignatureListSize);
++    if (SignatureList == NULL) {
++      Status = EFI_OUT_OF_RESOURCES;
++      goto Done;
+     }
++    SignatureList->SignatureHeaderSize  = 0;
++    SignatureList->SignatureListSize    = (UINT32) SignatureListSize;
++    SignatureList->SignatureSize        = (UINT32) (sizeof (EFI_SIGNATURE_DATA) - 1 + mImageDigestSize);
++    CopyMem (&SignatureList->SignatureType, &mCertType, sizeof (EFI_GUID));
++    Signature = (EFI_SIGNATURE_DATA *) ((UINT8 *) SignatureList + sizeof (EFI_SIGNATURE_LIST));
++    CopyMem (Signature->SignatureData, mImageDigest, mImageDigestSize);
+   }
+ 
+ Done:
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-remove-super.patch b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-remove-super.patch
new file mode 100644
index 0000000..def2524
--- /dev/null
+++ b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-remove-super.patch
@@ -0,0 +1,55 @@
+From d25dc10aa262b33794f16b75a0ada3aad507abe7 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 31 Jan 2020 12:42:43 +0100
+Subject: [PATCH 07/12] SecurityPkg/DxeImageVerificationHandler: remove
+ superfluous Status setting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200131124248.22369-8-lersek@redhat.com>
+Patchwork-id: 93617
+O-Subject: [RHEL-8.2.0 edk2 PATCH 07/12] SecurityPkg/DxeImageVerificationHandler: remove superfluous Status setting
+Bugzilla: 1751993
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+After the final "IsVerified" check, we set "Status" to EFI_ACCESS_DENIED.
+This is superfluous, as "Status" already carries EFI_ACCESS_DENIED value
+there, from the top of the function. Remove the assignment.
+
+Functionally, this change is a no-op.
+
+Cc: Chao Zhang <chao.b.zhang@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiewen Yao <jiewen.yao@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2129
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20200116190705.18816-7-lersek@redhat.com>
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+[lersek@redhat.com: push with Mike's R-b due to Chinese New Year
+ Holiday: <https://edk2.groups.io/g/devel/message/53429>; msgid
+ <d3fbb76dabed4e1987c512c328c82810@intel.com>]
+(cherry picked from commit 12a4ef58a8b1f8610f6f7cd3ffb973f924f175fb)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index 5f09a66..6ccce1f 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -1853,7 +1853,6 @@ DxeImageVerificationHandler (
+   if (IsVerified) {
+     return EFI_SUCCESS;
+   }
+-  Status = EFI_ACCESS_DENIED;
+   if (Action == EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED || Action == EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND) {
+     //
+     // Get image hash value as signature of executable.
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-simplify-Ver.patch b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-simplify-Ver.patch
new file mode 100644
index 0000000..e045894
--- /dev/null
+++ b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-simplify-Ver.patch
@@ -0,0 +1,119 @@
+From cd4f4b384857f4295d336d66fc8693348ef08a33 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 31 Jan 2020 12:42:38 +0100
+Subject: [PATCH 02/12] SecurityPkg/DxeImageVerificationHandler: simplify
+ "VerifyStatus"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200131124248.22369-3-lersek@redhat.com>
+Patchwork-id: 93611
+O-Subject: [RHEL-8.2.0 edk2 PATCH 02/12] SecurityPkg/DxeImageVerificationHandler: simplify "VerifyStatus"
+Bugzilla: 1751993
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+In the DxeImageVerificationHandler() function, the "VerifyStatus" variable
+can only contain one of two values: EFI_SUCCESS and EFI_ACCESS_DENIED.
+Furthermore, the variable is only consumed with EFI_ERROR().
+
+Therefore, using the EFI_STATUS type for the variable is unnecessary.
+Worse, given the complex meanings of the function's return values, using
+EFI_STATUS for "VerifyStatus" is actively confusing.
+
+Rename the variable to "IsVerified", and make it a simple BOOLEAN.
+
+This patch is a no-op, regarding behavior.
+
+Cc: Chao Zhang <chao.b.zhang@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiewen Yao <jiewen.yao@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2129
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20200116190705.18816-2-lersek@redhat.com>
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+[lersek@redhat.com: push with Mike's R-b due to Chinese New Year
+ Holiday: <https://edk2.groups.io/g/devel/message/53429>; msgid
+ <d3fbb76dabed4e1987c512c328c82810@intel.com>]
+(cherry picked from commit 1e0f973b65c34841288c25fd441a37eec8a30ac7)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ .../DxeImageVerificationLib.c                        | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index a0a12b5..5afd723 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -1563,7 +1563,7 @@ DxeImageVerificationHandler (
+ {
+   EFI_STATUS                           Status;
+   EFI_IMAGE_DOS_HEADER                 *DosHdr;
+-  EFI_STATUS                           VerifyStatus;
++  BOOLEAN                              IsVerified;
+   EFI_SIGNATURE_LIST                   *SignatureList;
+   UINTN                                SignatureListSize;
+   EFI_SIGNATURE_DATA                   *Signature;
+@@ -1588,7 +1588,7 @@ DxeImageVerificationHandler (
+   PkcsCertData      = NULL;
+   Action            = EFI_IMAGE_EXECUTION_AUTH_UNTESTED;
+   Status            = EFI_ACCESS_DENIED;
+-  VerifyStatus      = EFI_ACCESS_DENIED;
++  IsVerified        = FALSE;
+ 
+ 
+   //
+@@ -1812,16 +1812,16 @@ DxeImageVerificationHandler (
+     //
+     if (IsForbiddenByDbx (AuthData, AuthDataSize)) {
+       Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED;
+-      VerifyStatus = EFI_ACCESS_DENIED;
++      IsVerified = FALSE;
+       break;
+     }
+ 
+     //
+     // Check the digital signature against the valid certificate in allowed database (db).
+     //
+-    if (EFI_ERROR (VerifyStatus)) {
++    if (!IsVerified) {
+       if (IsAllowedByDb (AuthData, AuthDataSize)) {
+-        VerifyStatus = EFI_SUCCESS;
++        IsVerified = TRUE;
+       }
+     }
+ 
+@@ -1831,11 +1831,11 @@ DxeImageVerificationHandler (
+     if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, mImageDigest, &mCertType, mImageDigestSize)) {
+       Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND;
+       DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is signed but %s hash of image is found in DBX.\n", mHashTypeStr));
+-      VerifyStatus = EFI_ACCESS_DENIED;
++      IsVerified = FALSE;
+       break;
+-    } else if (EFI_ERROR (VerifyStatus)) {
++    } else if (!IsVerified) {
+       if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE, mImageDigest, &mCertType, mImageDigestSize)) {
+-        VerifyStatus = EFI_SUCCESS;
++        IsVerified = TRUE;
+       } else {
+         DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is signed but signature is not allowed by DB and %s hash of image is not found in DB/DBX.\n", mHashTypeStr));
+       }
+@@ -1846,10 +1846,10 @@ DxeImageVerificationHandler (
+     //
+     // The Size in Certificate Table or the attribute certificate table is corrupted.
+     //
+-    VerifyStatus = EFI_ACCESS_DENIED;
++    IsVerified = FALSE;
+   }
+ 
+-  if (!EFI_ERROR (VerifyStatus)) {
++  if (IsVerified) {
+     return EFI_SUCCESS;
+   } else {
+     Status = EFI_ACCESS_DENIED;
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-unnest-AddIm.patch b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-unnest-AddIm.patch
new file mode 100644
index 0000000..ef9d48e
--- /dev/null
+++ b/SOURCES/edk2-SecurityPkg-DxeImageVerificationHandler-unnest-AddIm.patch
@@ -0,0 +1,139 @@
+From 3e06fe42d63856e48c6457dbb7e816b82416c9ca Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 31 Jan 2020 12:42:44 +0100
+Subject: [PATCH 08/12] SecurityPkg/DxeImageVerificationHandler: unnest
+ AddImageExeInfo() call
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200131124248.22369-9-lersek@redhat.com>
+Patchwork-id: 93610
+O-Subject: [RHEL-8.2.0 edk2 PATCH 08/12] SecurityPkg/DxeImageVerificationHandler: unnest AddImageExeInfo() call
+Bugzilla: 1751993
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+Before the "Done" label at the end of DxeImageVerificationHandler(), we
+now have a single access to "Status": we set "Status" to EFI_ACCESS_DENIED
+at the top of the function. Therefore, the (Status != EFI_SUCCESS)
+condition is always true under the "Done" label.
+
+Accordingly, unnest the AddImageExeInfo() call dependent on that
+condition, remove the condition, and also rename the "Done" label to
+"Failed".
+
+Functionally, this patch is a no-op. It's easier to review with:
+
+  git show -b -W
+
+Cc: Chao Zhang <chao.b.zhang@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Jiewen Yao <jiewen.yao@intel.com>
+Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2129
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20200116190705.18816-8-lersek@redhat.com>
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+[lersek@redhat.com: replace EFI_D_INFO w/ DEBUG_INFO for PatchCheck.py]
+[lersek@redhat.com: push with Mike's R-b due to Chinese New Year
+ Holiday: <https://edk2.groups.io/g/devel/message/53429>; msgid
+ <d3fbb76dabed4e1987c512c328c82810@intel.com>]
+(cherry picked from commit c602e97446a8e818bf09182f5dc9f3fa409ece95)
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ .../DxeImageVerificationLib.c                      | 34 ++++++++++------------
+ 1 file changed, 16 insertions(+), 18 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index 6ccce1f..51968bd 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -1676,7 +1676,7 @@ DxeImageVerificationHandler (
+     // The information can't be got from the invalid PeImage
+     //
+     DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: PeImage invalid. Cannot retrieve image information.\n"));
+-    goto Done;
++    goto Failed;
+   }
+ 
+   DosHdr = (EFI_IMAGE_DOS_HEADER *) mImageBase;
+@@ -1698,7 +1698,7 @@ DxeImageVerificationHandler (
+     // It is not a valid Pe/Coff file.
+     //
+     DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Not a valid PE/COFF image.\n"));
+-    goto Done;
++    goto Failed;
+   }
+ 
+   if (mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
+@@ -1729,7 +1729,7 @@ DxeImageVerificationHandler (
+     //
+     if (!HashPeImage (HASHALG_SHA256)) {
+       DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Failed to hash this image using %s.\n", mHashTypeStr));
+-      goto Done;
++      goto Failed;
+     }
+ 
+     if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, mImageDigest, &mCertType, mImageDigestSize)) {
+@@ -1737,7 +1737,7 @@ DxeImageVerificationHandler (
+       // Image Hash is in forbidden database (DBX).
+       //
+       DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is not signed and %s hash of image is forbidden by DBX.\n", mHashTypeStr));
+-      goto Done;
++      goto Failed;
+     }
+ 
+     if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE, mImageDigest, &mCertType, mImageDigestSize)) {
+@@ -1751,7 +1751,7 @@ DxeImageVerificationHandler (
+     // Image Hash is not found in both forbidden and allowed database.
+     //
+     DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is not signed and %s hash of image is not found in DB/DBX.\n", mHashTypeStr));
+-    goto Done;
++    goto Failed;
+   }
+ 
+   //
+@@ -1860,7 +1860,7 @@ DxeImageVerificationHandler (
+     SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + mImageDigestSize;
+     SignatureList     = (EFI_SIGNATURE_LIST *) AllocateZeroPool (SignatureListSize);
+     if (SignatureList == NULL) {
+-      goto Done;
++      goto Failed;
+     }
+     SignatureList->SignatureHeaderSize  = 0;
+     SignatureList->SignatureListSize    = (UINT32) SignatureListSize;
+@@ -1870,19 +1870,17 @@ DxeImageVerificationHandler (
+     CopyMem (Signature->SignatureData, mImageDigest, mImageDigestSize);
+   }
+ 
+-Done:
+-  if (Status != EFI_SUCCESS) {
+-    //
+-    // Policy decides to defer or reject the image; add its information in image executable information table.
+-    //
+-    NameStr = ConvertDevicePathToText (File, FALSE, TRUE);
+-    AddImageExeInfo (Action, NameStr, File, SignatureList, SignatureListSize);
+-    if (NameStr != NULL) {
+-      DEBUG((EFI_D_INFO, "The image doesn't pass verification: %s\n", NameStr));
+-      FreePool(NameStr);
+-    }
+-    Status = EFI_SECURITY_VIOLATION;
++Failed:
++  //
++  // Policy decides to defer or reject the image; add its information in image executable information table.
++  //
++  NameStr = ConvertDevicePathToText (File, FALSE, TRUE);
++  AddImageExeInfo (Action, NameStr, File, SignatureList, SignatureListSize);
++  if (NameStr != NULL) {
++    DEBUG ((DEBUG_INFO, "The image doesn't pass verification: %s\n", NameStr));
++    FreePool(NameStr);
+   }
++  Status = EFI_SECURITY_VIOLATION;
+ 
+   if (SignatureList != NULL) {
+     FreePool (SignatureList);
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-SecurityPkg-Fix-spelling-errors-PARTIAL-PICK.patch b/SOURCES/edk2-SecurityPkg-Fix-spelling-errors-PARTIAL-PICK.patch
new file mode 100644
index 0000000..578487c
--- /dev/null
+++ b/SOURCES/edk2-SecurityPkg-Fix-spelling-errors-PARTIAL-PICK.patch
@@ -0,0 +1,103 @@
+From 7f364d9a95905efee0a8b46e4108042aaebe7849 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 31 Jan 2020 12:42:37 +0100
+Subject: [PATCH 01/12] SecurityPkg: Fix spelling errors [PARTIAL PICK]
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200131124248.22369-2-lersek@redhat.com>
+Patchwork-id: 93612
+O-Subject: [RHEL-8.2.0 edk2 PATCH 01/12] SecurityPkg: Fix spelling errors [PARTIAL PICK]
+Bugzilla: 1751993
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+From: Sean Brogan <sean.brogan@microsoft.com>
+
+--v-- RHEL-8 note start --v--
+
+This is a partial cherry-pick, restricted to
+"SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c".
+
+The upstream patch has a super-ugly diffstat (81 files changed, 205
+insertions(+), 205 deletions(-)), fixing spelling errors all over
+SecurityPkg in one go. It doesn't apply cleanly down-stream, and I don't
+want to pick more (unrelated) SecurityPkg dependencies for this backport
+series.
+
+Thus, the only alternative to this partial cherry-pick would be resolving
+conflicts over the rest of this series. That's obviously worse than a
+partial typo fix backport. At the next rebase, we're going to drop this
+patch and the rest of the backport series alike, anyway.
+
+--^-- RHEL-8 note end --^--
+
+https://bugzilla.tianocore.org/show_bug.cgi?id=2265
+
+Cc: Jiewen Yao <jiewen.yao@intel.com>
+Cc: Jian J Wang <jian.j.wang@intel.com>
+Cc: Chao Zhang <chao.b.zhang@intel.com>
+Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
+Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
+Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
+(cherry picked from commit d6b926e76e3d639ac37610e97d33ff9e3a6281eb)
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c  | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index fe4cdcc..a0a12b5 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
++++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -745,7 +745,7 @@ AddImageExeInfo (
+   if (ImageExeInfoTable != NULL) {
+     //
+     // The table has been found!
+-    // We must enlarge the table to accomodate the new exe info entry.
++    // We must enlarge the table to accommodate the new exe info entry.
+     //
+     ImageExeInfoTableSize = GetImageExeInfoTableSize (ImageExeInfoTable);
+   } else {
+@@ -947,7 +947,7 @@ Done:
+ 
+   @param[in]  VariableName        Name of database variable that is searched in.
+   @param[in]  Signature           Pointer to signature that is searched for.
+-  @param[in]  CertType            Pointer to hash algrithom.
++  @param[in]  CertType            Pointer to hash algorithm.
+   @param[in]  SignatureSize       Size of Signature.
+ 
+   @return TRUE                    Found the signature in the variable database.
+@@ -992,7 +992,7 @@ IsSignatureFoundInDatabase (
+     goto Done;
+   }
+   //
+-  // Enumerate all signature data in SigDB to check if executable's signature exists.
++  // Enumerate all signature data in SigDB to check if signature exists for executable.
+   //
+   CertList = (EFI_SIGNATURE_LIST *) Data;
+   while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {
+@@ -1844,7 +1844,7 @@ DxeImageVerificationHandler (
+ 
+   if (OffSet != (SecDataDir->VirtualAddress + SecDataDir->Size)) {
+     //
+-    // The Size in Certificate Table or the attribute certicate table is corrupted.
++    // The Size in Certificate Table or the attribute certificate table is corrupted.
+     //
+     VerifyStatus = EFI_ACCESS_DENIED;
+   }
+@@ -1855,7 +1855,7 @@ DxeImageVerificationHandler (
+     Status = EFI_ACCESS_DENIED;
+     if (Action == EFI_IMAGE_EXECUTION_AUTH_SIG_FAILED || Action == EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND) {
+       //
+-      // Get image hash value as executable's signature.
++      // Get image hash value as signature of executable.
+       //
+       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + mImageDigestSize;
+       SignatureList     = (EFI_SIGNATURE_LIST *) AllocateZeroPool (SignatureListSize);
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-UefiCpuPkg-PiSmmCpuDxeSmm-fix-2M-4K-page-splitting-r.patch b/SOURCES/edk2-UefiCpuPkg-PiSmmCpuDxeSmm-fix-2M-4K-page-splitting-r.patch
new file mode 100644
index 0000000..627d458
--- /dev/null
+++ b/SOURCES/edk2-UefiCpuPkg-PiSmmCpuDxeSmm-fix-2M-4K-page-splitting-r.patch
@@ -0,0 +1,152 @@
+From 2613601640be75f79e9dd8d2db21ad45d227d907 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Fri, 17 Jan 2020 11:33:43 +0100
+Subject: [PATCH] UefiCpuPkg/PiSmmCpuDxeSmm: fix 2M->4K page splitting
+ regression for PDEs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Laszlo Ersek <lersek@redhat.com>
+Message-id: <20200117113343.30392-2-lersek@redhat.com>
+Patchwork-id: 93389
+O-Subject: [RHEL-8.2.0 edk2 PATCH 1/1] UefiCpuPkg/PiSmmCpuDxeSmm: fix 2M->4K page splitting regression for PDEs
+Bugzilla: 1789335
+RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+In commit 4eee0cc7cc0d ("UefiCpuPkg/PiSmmCpu: Enable 5 level paging when
+CPU supports", 2019-07-12), the Page Directory Entry setting was regressed
+(corrupted) when splitting a 2MB page to 512 4KB pages, in the
+InitPaging() function.
+
+Consider the following hunk, displayed with
+
+$ git show --function-context --ignore-space-change 4eee0cc7cc0db
+
+>            //
+>            // If it is 2M page, check IsAddressSplit()
+>            //
+>            if (((*Pd & IA32_PG_PS) != 0) && IsAddressSplit (Address)) {
+>              //
+>              // Based on current page table, create 4KB page table for split area.
+>              //
+>              ASSERT (Address == (*Pd & PHYSICAL_ADDRESS_MASK));
+>
+>              Pt = AllocatePageTableMemory (1);
+>              ASSERT (Pt != NULL);
+>
+> +            *Pd = (UINTN) Pt | IA32_PG_RW | IA32_PG_P;
+> +
+>              // Split it
+> -          for (PtIndex = 0; PtIndex < SIZE_4KB / sizeof(*Pt); PtIndex++) {
+> -            Pt[PtIndex] = Address + ((PtIndex << 12) | mAddressEncMask | PAGE_ATTRIBUTE_BITS);
+> +            for (PtIndex = 0; PtIndex < SIZE_4KB / sizeof(*Pt); PtIndex++, Pt++) {
+> +              *Pt = Address + ((PtIndex << 12) | mAddressEncMask | PAGE_ATTRIBUTE_BITS);
+>              } // end for PT
+>              *Pd = (UINT64)(UINTN)Pt | mAddressEncMask | PAGE_ATTRIBUTE_BITS;
+>            } // end if IsAddressSplit
+>          } // end for PD
+
+First, the new assignment to the Page Directory Entry (*Pd) is
+superfluous. That's because (a) we set (*Pd) after the Page Table Entry
+loop anyway, and (b) here we do not attempt to access the memory starting
+at "Address" (which is mapped by the original value of the Page Directory
+Entry).
+
+Second, appending "Pt++" to the incrementing expression of the PTE loop is
+a bug. It causes "Pt" to point *right past* the just-allocated Page Table,
+once we finish the loop. But the PDE assignment that immediately follows
+the loop assumes that "Pt" still points to the *start* of the new Page
+Table.
+
+The result is that the originally mapped 2MB page disappears from the
+processor's view. The PDE now points to a "Page Table" that is filled with
+garbage. The random entries in that "Page Table" will cause some virtual
+addresses in the original 2MB area to fault. Other virtual addresses in
+the same range will no longer have a 1:1 physical mapping, but be
+scattered over random physical page frames.
+
+The second phase of the InitPaging() function ("Go through page table and
+set several page table entries to absent or execute-disable") already
+manipulates entries in wrong Page Tables, for such PDEs that got split in
+the first phase.
+
+This issue has been caught as follows:
+
+- OVMF is started with 2001 MB of guest RAM.
+
+- This places the main SMRAM window at 0x7C10_1000.
+
+- The SMRAM management in the SMM Core links this SMRAM window into
+  "mSmmMemoryMap", with a FREE_PAGE_LIST record placed at the start of the
+  area.
+
+- At "SMM Ready To Lock" time, PiSmmCpuDxeSmm calls InitPaging(). The
+  first phase (quoted above) decides to split the 2MB page at 0x7C00_0000
+  into 512 4KB pages, and corrupts the PDE. The new Page Table is
+  allocated at 0x7CE0_D000, but the PDE is set to 0x7CE0_E000 (plus
+  attributes 0x67).
+
+- Due to the corrupted PDE, the second phase of InitPaging() already looks
+  up the PTE for Address=0x7C10_1000 in the wrong place. The second phase
+  goes on to mark bogus PTEs as "NX".
+
+- PiSmmCpuDxeSmm calls SetMemMapAttributes(). Address 0x7C10_1000 is at
+  the base of the SMRAM window, therefore it happens to be listed in the
+  SMRAM map as an EfiConventionalMemory region. SetMemMapAttributes()
+  calls SmmSetMemoryAttributes() to mark the region as XP. However,
+  GetPageTableEntry() in ConvertMemoryPageAttributes() fails -- address
+  0x7C10_1000 is no longer mapped by anything! -- and so the attribute
+  setting fails with RETURN_UNSUPPORTED. This error goes unnoticed, as
+  SetMemMapAttributes() ignores the return value of
+  SmmSetMemoryAttributes().
+
+- When SetMemMapAttributes() reaches another entry in the SMRAM map,
+  ConvertMemoryPageAttributes() decides it needs to split a 2MB page, and
+  calls SplitPage().
+
+- SplitPage() calls AllocatePageTableMemory() for the new Page Table,
+  which takes us to InternalAllocMaxAddress() in the SMM Core.
+
+- The SMM core attempts to read the FREE_PAGE_LIST record at 0x7C10_1000.
+  Because this virtual address is no longer mapped, the firmware crashes
+  in InternalAllocMaxAddress(), when accessing (Pages->NumberOfPages).
+
+Remove the useless assignment to (*Pd) from before the loop. Revert the
+loop incrementing and the PTE assignment to the known good version.
+
+Cc: Eric Dong <eric.dong@intel.com>
+Cc: Ray Ni <ray.ni@intel.com>
+Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1789335
+Fixes: 4eee0cc7cc0db74489b99c19eba056b53eda6358
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
+Reviewed-by: Ray Ni <ray.ni@intel.com>
+(cherry picked from commit a5235562444021e9c5aff08f45daa6b5b7952c7a)
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c
+index c513152..c47b557 100644
+--- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c
++++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c
+@@ -657,11 +657,9 @@ InitPaging (
+             Pt = AllocatePageTableMemory (1);
+             ASSERT (Pt != NULL);
+ 
+-            *Pd = (UINTN) Pt | IA32_PG_RW | IA32_PG_P;
+-
+             // Split it
+-            for (PtIndex = 0; PtIndex < SIZE_4KB / sizeof(*Pt); PtIndex++, Pt++) {
+-              *Pt = Address + ((PtIndex << 12) | mAddressEncMask | PAGE_ATTRIBUTE_BITS);
++            for (PtIndex = 0; PtIndex < SIZE_4KB / sizeof(*Pt); PtIndex++) {
++              Pt[PtIndex] = Address + ((PtIndex << 12) | mAddressEncMask | PAGE_ATTRIBUTE_BITS);
+             } // end for PT
+             *Pd = (UINT64)(UINTN)Pt | mAddressEncMask | PAGE_ATTRIBUTE_BITS;
+           } // end if IsAddressSplit
+-- 
+1.8.3.1
+
diff --git a/SOURCES/edk2-aarch64-verbose.json b/SOURCES/edk2-aarch64-verbose.json
new file mode 100644
index 0000000..ceec878
--- /dev/null
+++ b/SOURCES/edk2-aarch64-verbose.json
@@ -0,0 +1,31 @@
+{
+    "description": "UEFI firmware for ARM64 virtual machines, verbose logs",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "executable": {
+            "filename": "/usr/share/edk2/aarch64/QEMU_EFI-pflash.raw",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/aarch64/vars-template-pflash.raw",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "aarch64",
+            "machines": [
+                "virt-*"
+            ]
+        }
+    ],
+    "features": [
+        "verbose-static"
+    ],
+    "tags": [
+
+    ]
+}
diff --git a/SOURCES/edk2-aarch64.json b/SOURCES/edk2-aarch64.json
new file mode 100644
index 0000000..c5a73cb
--- /dev/null
+++ b/SOURCES/edk2-aarch64.json
@@ -0,0 +1,31 @@
+{
+    "description": "UEFI firmware for ARM64 virtual machines",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "executable": {
+            "filename": "/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/aarch64/vars-template-pflash.raw",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "aarch64",
+            "machines": [
+                "virt-*"
+            ]
+        }
+    ],
+    "features": [
+
+    ],
+    "tags": [
+
+    ]
+}
diff --git a/SOURCES/edk2-ovmf-sb.json b/SOURCES/edk2-ovmf-sb.json
new file mode 100644
index 0000000..a0203e8
--- /dev/null
+++ b/SOURCES/edk2-ovmf-sb.json
@@ -0,0 +1,36 @@
+{
+    "description": "OVMF with SB+SMM, SB enabled, MS certs enrolled",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "acpi-s3",
+        "amd-sev",
+        "enrolled-keys",
+        "requires-smm",
+        "secure-boot",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}
diff --git a/SOURCES/edk2-ovmf.json b/SOURCES/edk2-ovmf.json
new file mode 100644
index 0000000..74d00e3
--- /dev/null
+++ b/SOURCES/edk2-ovmf.json
@@ -0,0 +1,35 @@
+{
+    "description": "OVMF with SB+SMM, empty varstore",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_VARS.fd",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "acpi-s3",
+        "amd-sev",
+        "requires-smm",
+        "secure-boot",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}
diff --git a/SOURCES/ovmf-vars-generator b/SOURCES/ovmf-vars-generator
new file mode 100755
index 0000000..111e438
--- /dev/null
+++ b/SOURCES/ovmf-vars-generator
@@ -0,0 +1,295 @@
+#!/bin/python3
+# Copyright (C) 2017 Red Hat
+# Authors:
+# - Patrick Uiterwijk <puiterwijk@redhat.com>
+# - Kashyap Chamarthy <kchamart@redhat.com>
+#
+# Licensed under MIT License, for full text see LICENSE
+#
+# Purpose: Launch a QEMU guest and enroll ithe UEFI keys into an OVMF
+#          variables ("VARS") file.  Then boot a Linux kernel with QEMU.
+#          Finally, perform a check to verify if Secure Boot
+#          is enabled.
+
+from __future__ import print_function
+
+import argparse
+import os
+import logging
+import tempfile
+import shutil
+import string
+import subprocess
+
+
+def strip_special(line):
+    return ''.join([c for c in str(line) if c in string.printable])
+
+
+def generate_qemu_cmd(args, readonly, *extra_args):
+    if args.disable_smm:
+        machinetype = 'pc'
+    else:
+        machinetype = 'q35,smm=on'
+    machinetype += ',accel=%s' % ('kvm' if args.enable_kvm else 'tcg')
+
+    if args.oem_string is None:
+        oemstrings = []
+    else:
+        oemstring_values = [
+            ",value=" + s.replace(",", ",,") for s in args.oem_string ]
+        oemstrings = [
+            '-smbios',
+            "type=11" + ''.join(oemstring_values) ]
+
+    return [
+        args.qemu_binary,
+        '-machine', machinetype,
+        '-display', 'none',
+        '-no-user-config',
+        '-nodefaults',
+        '-m', '768',
+        '-smp', '2,sockets=2,cores=1,threads=1',
+        '-chardev', 'pty,id=charserial1',
+        '-device', 'isa-serial,chardev=charserial1,id=serial1',
+        '-global', 'driver=cfi.pflash01,property=secure,value=%s' % (
+            'off' if args.disable_smm else 'on'),
+        '-drive',
+        'file=%s,if=pflash,format=raw,unit=0,readonly=on' % (
+            args.ovmf_binary),
+        '-drive',
+        'file=%s,if=pflash,format=raw,unit=1,readonly=%s' % (
+            args.out_temp, 'on' if readonly else 'off'),
+        '-serial', 'stdio'] + oemstrings + list(extra_args)
+
+
+def download(url, target, suffix, no_download):
+    istemp = False
+    if target and os.path.exists(target):
+        return target, istemp
+    if not target:
+        temped = tempfile.mkstemp(prefix='qosb.', suffix='.%s' % suffix)
+        os.close(temped[0])
+        target = temped[1]
+        istemp = True
+    if no_download:
+        raise Exception('%s did not exist, but downloading was disabled' %
+                        target)
+    import requests
+    logging.debug('Downloading %s to %s', url, target)
+    r = requests.get(url, stream=True)
+    with open(target, 'wb') as f:
+        for chunk in r.iter_content(chunk_size=1024):
+            if chunk:
+                f.write(chunk)
+    return target, istemp
+
+
+def enroll_keys(args):
+    shutil.copy(args.ovmf_template_vars, args.out_temp)
+
+    logging.info('Starting enrollment')
+
+    cmd = generate_qemu_cmd(
+        args,
+        False,
+        '-drive',
+        'file=%s,format=raw,if=none,media=cdrom,id=drive-cd1,'
+        'readonly=on' % args.uefi_shell_iso,
+        '-device',
+        'ide-cd,drive=drive-cd1,id=cd1,'
+        'bootindex=1')
+    p = subprocess.Popen(cmd,
+        stdin=subprocess.PIPE,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT)
+    logging.info('Performing enrollment')
+    # Wait until the UEFI shell starts (first line is printed)
+    read = p.stdout.readline()
+    if b'char device redirected' in read:
+        read = p.stdout.readline()
+    # Skip passed QEMU warnings, like the following one we see in Ubuntu:
+    # qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.vmx [bit 5]
+    while b'qemu-system-x86_64: warning:' in read:
+        read = p.stdout.readline()
+    if args.print_output:
+        print(strip_special(read), end='')
+        print()
+    # Send the escape char to enter the UEFI shell early
+    p.stdin.write(b'\x1b')
+    p.stdin.flush()
+    # And then run the following three commands from the UEFI shell:
+    # change into the first file system device; install the default
+    # keys and certificates, and reboot
+    p.stdin.write(b'fs0:\r\n')
+    p.stdin.write(b'EnrollDefaultKeys.efi\r\n')
+    p.stdin.write(b'reset -s\r\n')
+    p.stdin.flush()
+    while True:
+        read = p.stdout.readline()
+        if args.print_output:
+            print('OUT: %s' % strip_special(read), end='')
+            print()
+        if b'info: success' in read:
+            break
+    p.wait()
+    if args.print_output:
+        print(strip_special(p.stdout.read()), end='')
+    logging.info('Finished enrollment')
+
+
+def test_keys(args):
+    logging.info('Grabbing test kernel')
+    kernel, kerneltemp = download(args.kernel_url, args.kernel_path,
+                                  'kernel', args.no_download)
+
+    logging.info('Starting verification')
+    try:
+        cmd = generate_qemu_cmd(
+            args,
+            True,
+            '-append', 'console=tty0 console=ttyS0,115200n8',
+            '-kernel', kernel)
+        p = subprocess.Popen(cmd,
+            stdin=subprocess.PIPE,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT)
+        logging.info('Performing verification')
+        while True:
+            read = p.stdout.readline()
+            if args.print_output:
+                print('OUT: %s' % strip_special(read), end='')
+                print()
+            if b'Secure boot disabled' in read:
+                raise Exception('Secure Boot was disabled')
+            elif b'Secure boot enabled' in read:
+                logging.info('Confirmed: Secure Boot is enabled')
+                break
+            elif b'Kernel is locked down from EFI secure boot' in read:
+                logging.info('Confirmed: Secure Boot is enabled')
+                break
+        p.kill()
+        if args.print_output:
+            print(strip_special(p.stdout.read()), end='')
+        logging.info('Finished verification')
+    finally:
+        if kerneltemp:
+            os.remove(kernel)
+
+
+def parse_args():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('output', help='Filename for output vars file')
+    parser.add_argument('--out-temp', help=argparse.SUPPRESS)
+    parser.add_argument('--force', help='Overwrite existing output file',
+                        action='store_true')
+    parser.add_argument('--print-output', help='Print the QEMU guest output',
+                        action='store_true')
+    parser.add_argument('--verbose', '-v', help='Increase verbosity',
+                        action='count')
+    parser.add_argument('--quiet', '-q', help='Decrease verbosity',
+                        action='count')
+    parser.add_argument('--qemu-binary', help='QEMU binary path',
+                        default='/usr/bin/qemu-system-x86_64')
+    parser.add_argument('--enable-kvm', help='Enable KVM acceleration',
+                        action='store_true')
+    parser.add_argument('--ovmf-binary', help='OVMF secureboot code file',
+                        default='/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd')
+    parser.add_argument('--ovmf-template-vars', help='OVMF empty vars file',
+                        default='/usr/share/edk2/ovmf/OVMF_VARS.fd')
+    parser.add_argument('--uefi-shell-iso', help='Path to uefi shell iso',
+                        default='/usr/share/edk2/ovmf/UefiShell.iso')
+    parser.add_argument('--skip-enrollment',
+                        help='Skip enrollment, only test', action='store_true')
+    parser.add_argument('--skip-testing',
+                        help='Skip testing generated "VARS" file',
+                        action='store_true')
+    parser.add_argument('--kernel-path',
+                        help='Specify a consistent path for kernel')
+    parser.add_argument('--no-download', action='store_true',
+                        help='Never download a kernel')
+    parser.add_argument('--fedora-version',
+                        help='Fedora version to get kernel for checking',
+                        default='27')
+    parser.add_argument('--kernel-url', help='Kernel URL',
+                        default='https://download.fedoraproject.org/pub/fedora'
+                                '/linux/releases/%(version)s/Everything/x86_64'
+                                '/os/images/pxeboot/vmlinuz')
+    parser.add_argument('--disable-smm',
+                        help=('Don\'t restrict varstore pflash writes to '
+                              'guest code that executes in SMM. Use this '
+                              'option only if your OVMF binary doesn\'t have '
+                              'the edk2 SMM driver stack built into it '
+                              '(possibly because your QEMU binary lacks SMM '
+                              'emulation). Note that without restricting '
+                              'varstore pflash writes to guest code that '
+                              'executes in SMM, a malicious guest kernel, '
+                              'used for testing, could undermine Secure '
+                              'Boot.'),
+                        action='store_true')
+    parser.add_argument('--oem-string',
+                        help=('Pass the argument to the guest as a string in '
+                              'the SMBIOS Type 11 (OEM Strings) table. '
+                              'Multiple occurrences of this option are '
+                              'collected into a single SMBIOS Type 11 table. '
+                              'A pure ASCII string argument is strongly '
+                              'suggested.'),
+                        action='append')
+    args = parser.parse_args()
+    args.kernel_url = args.kernel_url % {'version': args.fedora_version}
+
+    validate_args(args)
+    return args
+
+
+def validate_args(args):
+    if (os.path.exists(args.output)
+            and not args.force
+            and not args.skip_enrollment):
+        raise Exception('%s already exists' % args.output)
+
+    if args.skip_enrollment and not os.path.exists(args.output):
+        raise Exception('%s does not yet exist' % args.output)
+
+    verbosity = (args.verbose or 1) - (args.quiet or 0)
+    if verbosity >= 2:
+        logging.basicConfig(level=logging.DEBUG)
+    elif verbosity == 1:
+        logging.basicConfig(level=logging.INFO)
+    elif verbosity < 0:
+        logging.basicConfig(level=logging.ERROR)
+    else:
+        logging.basicConfig(level=logging.WARN)
+
+    if args.skip_enrollment:
+        args.out_temp = args.output
+    else:
+        temped = tempfile.mkstemp(prefix='qosb.', suffix='.vars')
+        os.close(temped[0])
+        args.out_temp = temped[1]
+        logging.debug('Temp output: %s', args.out_temp)
+
+
+def move_to_dest(args):
+    shutil.copy(args.out_temp, args.output)
+    os.remove(args.out_temp)
+
+
+def main():
+    args = parse_args()
+    if not args.skip_enrollment:
+        enroll_keys(args)
+    if not args.skip_testing:
+        test_keys(args)
+    if not args.skip_enrollment:
+        move_to_dest(args)
+        if args.skip_testing:
+            logging.info('Created %s' % args.output)
+        else:
+            logging.info('Created and verified %s' % args.output)
+    else:
+        logging.info('Verified %s', args.output)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/SOURCES/ovmf-whitepaper-c770f8c.txt b/SOURCES/ovmf-whitepaper-c770f8c.txt
new file mode 100644
index 0000000..ba727b4
--- /dev/null
+++ b/SOURCES/ovmf-whitepaper-c770f8c.txt
@@ -0,0 +1,2422 @@
+Open Virtual Machine Firmware (OVMF) Status Report
+July 2014 (with updates in August 2014 - January 2015)
+
+Author: Laszlo Ersek <lersek@redhat.com>
+Copyright (C) 2014-2015, Red Hat, Inc.
+CC BY-SA 4.0 <http://creativecommons.org/licenses/by-sa/4.0/>
+
+Abstract
+--------
+
+The Unified Extensible Firmware Interface (UEFI) is a specification that
+defines a software interface between an operating system and platform firmware.
+UEFI is designed to replace the Basic Input/Output System (BIOS) firmware
+interface.
+
+Hardware platform vendors have been increasingly adopting the UEFI
+Specification to govern their boot firmware developments. OVMF (Open Virtual
+Machine Firmware), a sub-project of Intel's EFI Development Kit II (edk2),
+enables UEFI support for Ia32 and X64 Virtual Machines.
+
+This paper reports on the status of the OVMF project, treats features and
+limitations, gives end-user hints, and examines some areas in-depth.
+
+Keywords: ACPI, boot options, CSM, edk2, firmware, flash, fw_cfg, KVM, memory
+map, non-volatile variables, OVMF, PCD, QEMU, reset vector, S3, Secure Boot,
+Smbios, SMM, TianoCore, UEFI, VBE shim, Virtio
+
+Table of Contents
+-----------------
+
+- Motivation
+- Scope
+- Example qemu invocation
+- Installation of OVMF guests with virt-manager and virt-install
+- Supported guest operating systems
+- Compatibility Support Module (CSM)
+- Phases of the boot process
+- Project structure
+- Platform Configuration Database (PCD)
+- Firmware image structure
+- S3 (suspend to RAM and resume)
+- A comprehensive memory map of OVMF
+- Known Secure Boot limitations
+- Variable store and LockBox in SMRAM
+- Select features
+  - X64-specific reset vector for OVMF
+  - Client library for QEMU's firmware configuration interface
+  - Guest ACPI tables
+  - Guest SMBIOS tables
+  - Platform-specific boot policy
+  - Virtio drivers
+  - Platform Driver
+  - Video driver
+- Afterword
+
+Motivation
+----------
+
+OVMF extends the usual benefits of virtualization to UEFI. Reasons to use OVMF
+include:
+
+- Legacy-free guests. A UEFI-based environment eliminates dependencies on
+  legacy address spaces and devices. This is especially beneficial when used
+  with physically assigned devices where the legacy operating mode is
+  troublesome to support, ex. assigned graphics cards operating in legacy-free,
+  non-VGA mode in the guest.
+
+- Future proof guests. The x86 market is steadily moving towards a legacy-free
+  platform and guest operating systems may eventually require a UEFI
+  environment. OVMF provides that next generation firmware support for such
+  applications.
+
+- GUID partition tables (GPTs). MBR partition tables represent partition
+  offsets and sizes with 32-bit integers, in units of 512 byte sectors. This
+  limits the addressable portion of the disk to 2 TB. GPT represents logical
+  block addresses with 64 bits.
+
+- Liberating boot loader binaries from residing in contested and poorly defined
+  space between the partition table and the partitions.
+
+- Support for booting off disks (eg. pass-through physical SCSI devices) with a
+  4kB physical and logical sector size, i.e. which don't have 512-byte block
+  emulation.
+
+- Development and testing of Secure Boot-related features in guest operating
+  systems. Although OVMF's Secure Boot implementation is currently not secure
+  against malicious UEFI drivers, UEFI applications, and guest kernels,
+  trusted guest code that only uses standard UEFI interfaces will find a valid
+  Secure Boot environment under OVMF, with working key enrollment and signature
+  validation. This enables development and testing of portable, Secure
+  Boot-related guest code.
+
+- Presence of non-volatile UEFI variables. This furthers development and
+  testing of OS installers, UEFI boot loaders, and unique, dependent guest OS
+  features. For example, an efivars-backed pstore (persistent storage)
+  file system works under Linux.
+
+- Altogether, a near production-level UEFI environment for virtual machines
+  when Secure Boot is not required.
+
+Scope
+-----
+
+UEFI and especially Secure Boot have been topics fraught with controversy and
+political activism. This paper sidesteps these aspects and strives to focus on
+use cases, hands-on information for end users, and technical details.
+
+Unless stated otherwise, the expression "X supports Y" means "X is technically
+compatible with interfaces provided or required by Y". It does not imply
+support as an activity performed by natural persons or companies.
+
+We discuss the status of OVMF at a state no earlier than edk2 SVN revision
+16158. The paper concentrates on upstream projects and communities, but
+occasionally it pans out about OVMF as it is planned to be shipped (as
+Technical Preview) in Red Hat Enterprise Linux 7.1. Such digressions are marked
+with the [RHEL] margin notation.
+
+Although other VMMs and accelerators are known to support (or plan to support)
+OVMF to various degrees -- for example, VirtualBox, Xen, BHyVe --, we'll
+emphasize OVMF on qemu/KVM, because QEMU and KVM have always been Red Hat's
+focus wrt. OVMF.
+
+The recommended upstream QEMU version is 2.1+. The recommended host Linux
+kernel (KVM) version is 3.10+. The recommended QEMU machine type is
+"qemu-system-x86_64 -M pc-i440fx-2.1" or later.
+
+The term "TianoCore" is used interchangeably with "edk2" in this paper.
+
+Example qemu invocation
+-----------------------
+
+The following commands give a quick foretaste of installing a UEFI operating
+system on OVMF, relying only on upstream edk2 and qemu.
+
+- Clone and build OVMF:
+
+  git clone https://github.com/tianocore/edk2.git
+  cd edk2
+  nice OvmfPkg/build.sh -a X64 -n $(getconf _NPROCESSORS_ONLN)
+
+  (Note that this ad-hoc build will not include the Secure Boot feature.)
+
+- The build output file, "OVMF.fd", includes not only the executable firmware
+  code, but the non-volatile variable store as well. For this reason, make a
+  VM-specific copy of the build output (the variable store should be private to
+  the virtual machine):
+
+  cp Build/OvmfX64/DEBUG_GCC4?/FV/OVMF.fd fedora.flash
+
+  (The variable store and the firmware executable are also available in the
+  build output as separate files: "OVMF_VARS.fd" and "OVMF_CODE.fd". This
+  enables central management and updates of the firmware executable, while each
+  virtual machine can retain its own variable store.)
+
+- Download a Fedora LiveCD:
+
+  wget https://dl.fedoraproject.org/pub/fedora/linux/releases/20/Live/x86_64/Fedora-Live-Xfce-x86_64-20-1.iso
+
+- Create a virtual disk (qcow2 format, 20 GB in size):
+
+  qemu-img create -f qcow2 fedora.img 20G
+
+- Create the following qemu wrapper script under the name "fedora.sh":
+
+  # Basic virtual machine properties: a recent i440fx machine type, KVM
+  # acceleration, 2048 MB RAM, two VCPUs.
+  OPTS="-M pc-i440fx-2.1 -enable-kvm -m 2048 -smp 2"
+
+  # The OVMF binary, including the non-volatile variable store, appears as a
+  # "normal" qemu drive on the host side, and it is exposed to the guest as a
+  # persistent flash device.
+  OPTS="$OPTS -drive if=pflash,format=raw,file=fedora.flash"
+
+  # The hard disk is exposed to the guest as a virtio-block device. OVMF has a
+  # driver stack that supports such a disk. We specify this disk as first boot
+  # option. OVMF recognizes the boot order specification.
+  OPTS="$OPTS -drive id=disk0,if=none,format=qcow2,file=fedora.img"
+  OPTS="$OPTS -device virtio-blk-pci,drive=disk0,bootindex=0"
+
+  # The Fedora installer disk appears as an IDE CD-ROM in the guest. This is
+  # the 2nd boot option.
+  OPTS="$OPTS -drive id=cd0,if=none,format=raw,readonly"
+  OPTS="$OPTS,file=Fedora-Live-Xfce-x86_64-20-1.iso"
+  OPTS="$OPTS -device ide-cd,bus=ide.1,drive=cd0,bootindex=1"
+
+  # The following setting enables S3 (suspend to RAM). OVMF supports S3
+  # suspend/resume.
+  OPTS="$OPTS -global PIIX4_PM.disable_s3=0"
+
+  # OVMF emits a number of info / debug messages to the QEMU debug console, at
+  # ioport 0x402. We configure qemu so that the debug console is indeed
+  # available at that ioport. We redirect the host side of the debug console to
+  # a file.
+  OPTS="$OPTS -global isa-debugcon.iobase=0x402 -debugcon file:fedora.ovmf.log"
+
+  # QEMU accepts various commands and queries from the user on the monitor
+  # interface. Connect the monitor with the qemu process's standard input and
+  # output.
+  OPTS="$OPTS -monitor stdio"
+
+  # A USB tablet device in the guest allows for accurate pointer tracking
+  # between the host and the guest.
+  OPTS="$OPTS -device piix3-usb-uhci -device usb-tablet"
+
+  # Provide the guest with a virtual network card (virtio-net).
+  #
+  # Normally, qemu provides the guest with a UEFI-conformant network driver
+  # from the iPXE project, in the form of a PCI expansion ROM. For this test,
+  # we disable the expansion ROM and allow OVMF's built-in virtio-net driver to
+  # take effect.
+  #
+  # On the host side, we use the SLIRP ("user") network backend, which has
+  # relatively low performance, but it doesn't require extra privileges from
+  # the user executing qemu.
+  OPTS="$OPTS -netdev id=net0,type=user"
+  OPTS="$OPTS -device virtio-net-pci,netdev=net0,romfile="
+
+  # A Spice QXL GPU is recommended as the primary VGA-compatible display
+  # device. It is a full-featured virtual video card, with great operating
+  # system driver support. OVMF supports it too.
+  OPTS="$OPTS -device qxl-vga"
+
+  qemu-system-x86_64 $OPTS
+
+- Start the Fedora guest:
+
+  sh fedora.sh
+
+- The above command can be used for both installation and later boots of the
+  Fedora guest.
+
+- In order to verify basic OVMF network connectivity:
+
+  - Assuming that the non-privileged user running qemu belongs to group G
+    (where G is a numeric identifier), ensure as root on the host that the
+    group range in file "/proc/sys/net/ipv4/ping_group_range" includes G.
+
+  - As the non-privileged user, boot the guest as usual.
+
+  - On the TianoCore splash screen, press ESC.
+
+  - Navigate to Boot Manager | EFI Internal Shell
+
+  - In the UEFI Shell, issue the following commands:
+
+    ifconfig -s eth0 dhcp
+    ping A.B.C.D
+
+    where A.B.C.D is a public IPv4 address in dotted decimal notation that your
+    host can reach.
+
+  - Type "quit" at the (qemu) monitor prompt.
+
+Installation of OVMF guests with virt-manager and virt-install
+--------------------------------------------------------------
+
+(1) Assuming OVMF has been installed on the host with the following files:
+    - /usr/share/OVMF/OVMF_CODE.fd
+    - /usr/share/OVMF/OVMF_VARS.fd
+
+    locate the "nvram" stanza in "/etc/libvirt/qemu.conf", and edit it as
+    follows:
+
+    nvram = [ "/usr/share/OVMF/OVMF_CODE.fd:/usr/share/OVMF/OVMF_VARS.fd" ]
+
+(2) Restart libvirtd with your Linux distribution's service management tool;
+    for example,
+
+    systemctl restart libvirtd
+
+(3) In virt-manager, proceed with the guest installation as usual:
+    - select File | New Virtual Machine,
+    - advance to Step 5 of 5,
+    - in Step 5, check "Customize configuration before install",
+    - click Finish;
+    - in the customization dialog, select Overview | Firmware, and choose UEFI,
+    - click Apply and Begin Installation.
+
+(4) With virt-install:
+
+    LDR="loader=/usr/share/OVMF/OVMF_CODE.fd,loader_ro=yes,loader_type=pflash"
+    virt-install \
+      --name fedora20 \
+      --memory 2048 \
+      --vcpus 2 \
+      --os-variant fedora20 \
+      --boot hd,cdrom,$LDR \
+      --disk size=20 \
+      --disk path=Fedora-Live-Xfce-x86_64-20-1.iso,device=cdrom,bus=scsi
+
+(5) A popular, distribution-independent, bleeding-edge OVMF package is
+    available under <https://www.kraxel.org/repos/>, courtesy of Gerd Hoffmann.
+
+    The "edk2.git-ovmf-x64" package provides the following files, among others:
+    - /usr/share/edk2.git/ovmf-x64/OVMF_CODE-pure-efi.fd
+    - /usr/share/edk2.git/ovmf-x64/OVMF_VARS-pure-efi.fd
+
+    When using this package, adapt steps (1) and (4) accordingly.
+
+(6) Additionally, the "edk2.git-ovmf-x64" package seeks to simplify the
+    enablement of Secure Boot in a virtual machine (strictly for development
+    and testing purposes).
+
+    - Boot the virtual machine off the CD-ROM image called
+      "/usr/share/edk2.git/ovmf-x64/UefiShell.iso"; before or after installing
+      the main guest operating system.
+
+    - When the UEFI shell appears, issue the following commands:
+
+      EnrollDefaultKeys.efi
+      reset -s
+
+    - The EnrollDefaultKeys.efi utility enrolls the following keys:
+
+      - A static example X.509 certificate (CN=TestCommonName) as Platform Key
+        and first Key Exchange Key.
+
+        The private key matching this certificate has been destroyed (but you
+        shouldn't trust this statement).
+
+      - "Microsoft Corporation KEK CA 2011" as second Key Exchange Key
+        (SHA1: 31:59:0b:fd:89:c9:d7:4e:d0:87:df:ac:66:33:4b:39:31:25:4b:30).
+
+      - "Microsoft Windows Production PCA 2011" as first DB entry
+        (SHA1: 58:0a:6f:4c:c4:e4:b6:69:b9:eb:dc:1b:2b:3e:08:7b:80:d0:67:8d).
+
+      - "Microsoft Corporation UEFI CA 2011" as second DB entry
+        (SHA1: 46:de:f6:3b:5c:e6:1c:f8:ba:0d:e2:e6:63:9c:10:19:d0:ed:14:f3).
+
+      These keys suffice to boot released versions of popular Linux
+      distributions (through the shim.efi utility), and Windows 8 and Windows
+      Server 2012 R2, in Secure Boot mode.
+
+Supported guest operating systems
+---------------------------------
+
+Upstream OVMF does not favor some guest operating systems over others for
+political or ideological reasons. However, some operating systems are harder to
+obtain and/or technically more difficult to support. The general expectation is
+that recent UEFI OSes should just work. Please consult the "OvmfPkg/README"
+file.
+
+The following guest OSes were tested with OVMF:
+- Red Hat Enterprise Linux 6
+- Red Hat Enterprise Linux 7
+- Fedora 18
+- Fedora 19
+- Fedora 20
+- Windows Server 2008 R2 SP1
+- Windows Server 2012
+- Windows 8
+
+Notes about Windows Server 2008 R2 (paraphrasing the "OvmfPkg/README" file):
+
+- QEMU should be started with one of the "-device qxl-vga" and "-device VGA"
+  options.
+
+- Only one video mode, 1024x768x32, is supported at OS runtime.
+
+  Please refer to the section about QemuVideoDxe (OVMF's built-in video driver)
+  for more details on this limitation.
+
+- The qxl-vga video card is recommended ("-device qxl-vga"). After booting the
+  installed guest OS, select the video card in Device Manager, and upgrade the
+  video driver to the QXL XDDM one.
+
+  The QXL XDDM driver can be downloaded from
+  <http://www.spice-space.org/download.html>, under Guest | Windows binaries.
+
+  This driver enables additional graphics resolutions at OS runtime, and
+  provides S3 (suspend/resume) capability.
+
+Notes about Windows Server 2012 and Windows 8:
+
+- QEMU should be started with the "-device qxl-vga,revision=4" option (or a
+  later revision, if available).
+
+- The guest OS's builtin video driver inherits the video mode / frame buffer
+  from OVMF. There's no way to change the resolution at OS runtime.
+
+  For this reason, a platform driver has been developed for OVMF, which allows
+  users to change the preferred video mode in the firmware. Please refer to the
+  section about PlatformDxe for details.
+
+- It is recommended to upgrade the guest OS's video driver to the QXL WDDM one,
+  via Device Manager.
+
+  Binaries for the QXL WDDM driver can be found at
+  <http://people.redhat.com/~vrozenfe/qxlwddm> (pick a version greater than or
+  equal to 0.6), while the source code resides at
+  <https://github.com/vrozenfe/qxl-dod>.
+
+  This driver enables additional graphics resolutions at OS runtime, and
+  provides S3 (suspend/resume) capability.
+
+Compatibility Support Module (CSM)
+----------------------------------
+
+Collaboration between SeaBIOS and OVMF developers has enabled SeaBIOS to be
+built as a Compatibility Support Module, and OVMF to embed and use it.
+
+Benefits of a SeaBIOS CSM include:
+
+- The ability to boot legacy (non-UEFI) operating systems, such as legacy Linux
+  systems, Windows 7, OpenBSD 5.2, FreeBSD 8/9, NetBSD, DragonflyBSD, Solaris
+  10/11.
+
+- Legacy (non-UEFI-compliant) PCI expansion ROMs, such as a VGA BIOS, mapped by
+  QEMU in emulated devices' ROM BARs, are loaded and executed by OVMF.
+
+  For example, this grants the Windows Server 2008 R2 SP1 guest's native,
+  legacy video driver access to all modes of all QEMU video cards.
+
+Building the CSM target of the SeaBIOS source tree is out of scope for this
+report. Additionally, upstream OVMF does not enable the CSM by default.
+
+Interested users and developers should look for OVMF's "-D CSM_ENABLE"
+build-time option, and check out the <https://www.kraxel.org/repos/> continuous
+integration repository, which provides CSM-enabled OVMF builds.
+
+[RHEL] The "OVMF_CODE.fd" firmware image made available on the Red Hat
+       Enterprise Linux 7.1 host does not include a Compatibility Support
+       Module, for the following reasons:
+
+       - Virtual machines running officially supported, legacy guest operating
+         systems should just use the standalone SeaBIOS firmware. Firmware
+         selection is flexible in virtualization, see eg. "Installation of OVMF
+         guests with virt-manager and virt-install" above.
+
+       - The 16-bit thunking interface between OVMF and SeaBIOS is very complex
+         and presents a large debugging and support burden, based on past
+         experience.
+
+       - Secure Boot is incompatible with CSM.
+
+       - Inter-project dependencies should be minimized whenever possible.
+
+       - Using the default QXL video card, the Windows 2008 R2 SP1 guest can be
+         installed with its built-in, legacy video driver. Said driver will
+         select the only available video mode, 1024x768x32. After installation,
+         the video driver can be upgraded to the full-featured QXL XDDM driver.
+
+Phases of the boot process
+--------------------------
+
+The PI and UEFI specifications, and Intel's UEFI and EDK II Learning and
+Development materials provide ample information on PI and UEFI concepts. The
+following is an absolutely minimal, rough glossary that is included only to
+help readers new to PI and UEFI understand references in later, OVMF-specific
+sections. We defer heavily to the official specifications and the training
+materials, and frequently quote them below.
+
+A central concept to mention early is the GUID -- globally unique identifier. A
+GUID is a 128-bit number, written as XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX,
+where each X stands for a hexadecimal nibble. GUIDs are used to name everything
+in PI and in UEFI. Programmers introduce new GUIDs with the "uuidgen" utility,
+and standards bodies standardize well-known services by positing their GUIDs.
+
+The boot process is roughly divided in the following phases:
+
+- Reset vector code.
+
+- SEC: Security phase. This phase is the root of firmware integrity.
+
+- PEI: Pre-EFI Initialization. This phase performs "minimal processor, chipset
+  and platform configuration for the purpose of discovering memory". Modules in
+  PEI collectively save their findings about the platform in a list of HOBs
+  (hand-off blocks).
+
+  When developing PEI code, the Platform Initialization (PI) specification
+  should be consulted.
+
+- DXE: Driver eXecution Environment, pronounced as "Dixie". This "is the phase
+  where the bulk of the booting occurs: devices are enumerated and initialized,
+  UEFI services are supported, and protocols and drivers are implemented. Also,
+  the tables that create the UEFI interface are produced".
+
+  On the PEI/DXE boundary, the HOBs produced by PEI are consumed. For example,
+  this is how the memory space map is configured initially.
+
+- BDS: Boot Device Selection. It is "responsible for determining how and where
+  you want to boot the operating system".
+
+  When developing DXE and BDS code, it is mainly the UEFI specification that
+  should be consulted. When speaking about DXE, BDS is frequently considered to
+  be a part of it.
+
+The following concepts are tied to specific boot process phases:
+
+- PEIM: a PEI Module (pronounced "PIM"). A binary module running in the PEI
+  phase, consuming some PPIs and producing other PPIs, and producing HOBs.
+
+- PPI: PEIM-to-PEIM interface. A structure of function pointers and related
+  data members that establishes a PEI service, or an instance of a PEI service.
+  PPIs are identified by GUID.
+
+  An example is EFI_PEI_S3_RESUME2_PPI (6D582DBC-DB85-4514-8FCC-5ADF6227B147).
+
+- DXE driver: a binary module running in the DXE and BDS phases, consuming some
+  protocols and producing other protocols.
+
+- Protocol: A structure of function pointers and related data members that
+  establishes a DXE service, or an instance of a DXE service. Protocols are
+  identified by GUID.
+
+  An example is EFI_BLOCK_IO_PROTOCOL (964E5B21-6459-11D2-8E39-00A0C969723B).
+
+- Architectural protocols: a set of standard protocols that are foundational to
+  the working of a UEFI system. Each architectural protocol has at most one
+  instance. Architectural protocols are implemented by a subset of DXE drivers.
+  DXE drivers explicitly list the set of protocols (including architectural
+  protocols) that they need to work. UEFI drivers can only be loaded once all
+  architectural protocols have become available during the DXE phase.
+
+  An example is EFI_VARIABLE_WRITE_ARCH_PROTOCOL
+  (6441F818-6362-4E44-B570-7DBA31DD2453).
+
+Project structure
+-----------------
+
+The term "OVMF" usually denotes the project (community and development effort)
+that provide and maintain the subject matter UEFI firmware for virtual
+machines. However the term is also frequently applied to the firmware binary
+proper that a virtual machine executes.
+
+OVMF emerges as a compilation of several modules from the edk2 source
+repository. "edk2" stands for EFI Development Kit II; it is a "modern,
+feature-rich, cross-platform firmware development environment for the UEFI and
+PI specifications".
+
+The composition of OVMF is dictated by the following build control files:
+
+  OvmfPkg/OvmfPkgIa32.dsc
+  OvmfPkg/OvmfPkgIa32.fdf
+
+  OvmfPkg/OvmfPkgIa32X64.dsc
+  OvmfPkg/OvmfPkgIa32X64.fdf
+
+  OvmfPkg/OvmfPkgX64.dsc
+  OvmfPkg/OvmfPkgX64.fdf
+
+The format of these files is described in the edk2 DSC and FDF specifications.
+Roughly, the DSC file determines:
+- library instance resolutions for library class requirements presented by the
+  modules to be compiled,
+- the set of modules to compile.
+
+The FDF file roughly determines:
+- what binary modules (compilation output files, precompiled binaries, graphics
+  image files, verbatim binary sections) to include in the firmware image,
+- how to lay out the firmware image.
+
+The Ia32 flavor of these files builds a firmware where both PEI and DXE phases
+are 32-bit. The Ia32X64 flavor builds a firmware where the PEI phase consists
+of 32-bit modules, and the DXE phase is 64-bit. The X64 flavor builds a purely
+64-bit firmware.
+
+The word size of the DXE phase must match the word size of the runtime OS -- a
+32-bit DXE can't cooperate with a 64-bit OS, and a 64-bit DXE can't work a
+32-bit OS.
+
+OVMF pulls together modules from across the edk2 tree. For example:
+
+- common drivers and libraries that are platform independent are usually
+  located under MdeModulePkg and MdePkg,
+
+- common but hardware-specific drivers and libraries that match QEMU's
+  pc-i440fx-* machine type are pulled in from IntelFrameworkModulePkg,
+  PcAtChipsetPkg and UefiCpuPkg,
+
+- the platform independent UEFI Shell is built from ShellPkg,
+
+- OvmfPkg includes drivers and libraries that are useful for virtual machines
+  and may or may not be specific to QEMU's pc-i440fx-* machine type.
+
+Platform Configuration Database (PCD)
+-------------------------------------
+
+Like the "Phases of the boot process" section, this one introduces a concept in
+very raw form. We defer to the PCD related edk2 specifications, and we won't
+discuss implementation details here. Our purpose is only to offer the reader a
+usable (albeit possibly inaccurate) definition, so that we can refer to PCDs
+later on.
+
+Colloquially, when we say "PCD", we actually mean "PCD entry"; that is, an
+entry stored in the Platform Configuration Database.
+
+The Platform Configuration Database is
+- a firmware-wide
+- name-value store
+- of scalars and buffers
+- where each entry may be
+  - build-time constant, or
+  - run-time dynamic, or
+  - theoretically, a middle option: patchable in the firmware file itself,
+    using a dedicated tool. (OVMF does not utilize externally patchable
+    entries.)
+
+A PCD entry is declared in the DEC file of the edk2 top-level Package directory
+whose modules (drivers and libraries) are the primary consumers of the PCD
+entry. (See for example OvmfPkg/OvmfPkg.dec). Basically, a PCD in a DEC file
+exposes a simple customization point.
+
+Interest in a PCD entry is communicated to the build system by naming the PCD
+entry in the INF file of the interested module (application, driver or
+library). The module may read and -- dependent on the PCD entry's category --
+write the PCD entry.
+
+Let's investigate the characteristics of the Database and the PCD entries.
+
+- Firmware-wide: technically, all modules may access all entries they are
+  interested in, assuming they advertise their interest in their INF files.
+  With careful design, PCDs enable inter-driver propagation of (simple) system
+  configuration. PCDs are available in both PEI and DXE.
+
+  (UEFI drivers meant to be portable (ie. from third party vendors) are not
+  supposed to use PCDs, since PCDs qualify internal to the specific edk2
+  firmware in question.)
+
+- Name-value store of scalars and buffers: each PCD has a symbolic name, and a
+  fixed scalar type (UINT16, UINT32 etc), or VOID* for buffers. Each PCD entry
+  belongs to a namespace, where a namespace is (obviously) a GUID, defined in
+  the DEC file.
+
+- A DEC file can permit several categories for a PCD:
+  - build-time constant ("FixedAtBuild"),
+  - patchable in the firmware image ("PatchableInModule", unused in OVMF),
+  - runtime modifiable ("Dynamic").
+
+The platform description file (DSC) of a top-level Package directory may choose
+the exact category for a given PCD entry that its modules wish to use, and
+assign a default (or constant) initial value to it.
+
+In addition, the edk2 build system too can initialize PCD entries to values
+that it calculates while laying out the flash device image. Such PCD
+assignments are described in the FDF control file.
+
+Firmware image structure
+------------------------
+
+(We assume the common X64 choice for both PEI and DXE, and the default DEBUG
+build target.)
+
+The OvmfPkg/OvmfPkgX64.fdf file defines the following layout for the flash
+device image "OVMF.fd":
+
+  Description                     Compression type        Size
+  ------------------------------  ----------------------  -------
+  Non-volatile data storage       open-coded binary data   128 KB
+    Variable store                                          56 KB
+    Event log                                                4 KB
+    Working block                                            4 KB
+    Spare area                                              64 KB
+
+  FVMAIN_COMPACT                  uncompressed            1712 KB
+    FV Firmware File System file  LZMA compressed
+      PEIFV                       uncompressed             896 KB
+        individual PEI modules    uncompressed
+      DXEFV                       uncompressed            8192 KB
+        individual DXE modules    uncompressed
+
+  SECFV                           uncompressed             208 KB
+    SEC driver
+    reset vector code
+
+The top-level image consists of three regions (three firmware volumes):
+- non-volatile data store (128 KB),
+- main firmware volume (FVMAIN_COMPACT, 1712 KB),
+- firmware volume containing the reset vector code and the SEC phase code (208
+  KB).
+
+In total, the OVMF.fd file has size 128 KB + 1712 KB + 208 KB == 2 MB.
+
+(1) The firmware volume with non-volatile data store (128 KB) has the following
+    internal structure, in blocks of 4 KB:
+
+            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  L: event log
+       LIVE | varstore                  |L|W|  W: working block
+            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+      SPARE |                               |
+            +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+
+    The first half of this firmware volume is "live", while the second half is
+    "spare". The spare half is important when the variable driver reclaims
+    unused storage and reorganizes the variable store.
+
+    The live half dedicates 14 blocks (56 KB) to the variable store itself. On
+    top of those, one block is set aside for an event log, and one block is
+    used as the working block of the fault tolerant write protocol. Fault
+    tolerant writes are used to recover from an occasional (virtual) power loss
+    during variable updates.
+
+    The blocks in this firmware volume are accessed, in stacking order from
+    least abstract to most abstract, by:
+
+    - EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL (provided by
+      OvmfPkg/QemuFlashFvbServicesRuntimeDxe),
+
+    - EFI_FAULT_TOLERANT_WRITE_PROTOCOL (provided by
+      MdeModulePkg/Universal/FaultTolerantWriteDxe),
+
+    - architectural protocols instrumental to the runtime UEFI variable
+      services:
+      - EFI_VARIABLE_ARCH_PROTOCOL,
+      - EFI_VARIABLE_WRITE_ARCH_PROTOCOL.
+
+      In a non-secure boot build, the DXE driver providing these architectural
+      protocols is MdeModulePkg/Universal/Variable/RuntimeDxe. In a secure boot
+      build, where authenticated variables are available, the DXE driver
+      offering these protocols is SecurityPkg/VariableAuthenticated/RuntimeDxe.
+
+(2) The main firmware volume (FVMAIN_COMPACT, 1712 KB) embeds further firmware
+    volumes. The outermost layer is a Firmware File System (FFS), carrying a
+    single file. This file holds an LZMA-compressed section, which embeds two
+    firmware volumes: PEIFV (896 KB) with PEIMs, and DXEFV (8192 KB) with DXE
+    and UEFI drivers.
+
+    This scheme enables us to build 896 KB worth of PEI drivers and 8192 KB
+    worth of DXE and UEFI drivers, compress them all with LZMA in one go, and
+    store the compressed result in 1712 KB, saving room in the flash device.
+
+(3) The SECFV firmware volume (208 KB) is not compressed. It carries the
+    "volume top file" with the reset vector code, to end at 4 GB in
+    guest-physical address space, and the SEC phase driver (OvmfPkg/Sec).
+
+    The last 16 bytes of the volume top file (mapped directly under 4 GB)
+    contain a NOP slide and a jump instruction. This is where QEMU starts
+    executing the firmware, at address 0xFFFF_FFF0. The reset vector and the
+    SEC driver run from flash directly.
+
+    The SEC driver locates FVMAIN_COMPACT in the flash, and decompresses the
+    main firmware image to RAM. The rest of OVMF (PEI, DXE, BDS phases) run
+    from RAM.
+
+As already mentioned, the OVMF.fd file is mapped by qemu's
+"hw/block/pflash_cfi01.c" device just under 4 GB in guest-physical address
+space, according to the command line option
+
+  -drive if=pflash,format=raw,file=fedora.flash
+
+(refer to the Example qemu invocation). This is a "ROMD device", which can
+switch out of "ROMD mode" and back into it.
+
+Namely, in the default ROMD mode, the guest-physical address range backed by
+the flash device reads and executes as ROM (it does not trap from KVM to QEMU).
+The first write access in this mode traps to QEMU, and flips the device out of
+ROMD mode.
+
+In non-ROMD mode, the flash chip is programmed by storing CFI (Common Flash
+Interface) command values at the flash-covered addresses; both reads and writes
+trap to QEMU, and the flash contents are modified and synchronized to the
+host-side file. A special CFI command flips the flash device back to ROMD mode.
+
+Qemu implements the above based on the KVM_CAP_READONLY_MEM / KVM_MEM_READONLY
+KVM features, and OVMF puts it to use in its EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL
+implementation, under "OvmfPkg/QemuFlashFvbServicesRuntimeDxe".
+
+IMPORTANT: Never pass OVMF.fd to qemu with the -bios option. That option maps
+the firmware image as ROM into the guest's address space, and forces OVMF to
+emulate non-volatile variables with a fallback driver that is bound to have
+insufficient and confusing semantics.
+
+The 128 KB firmware volume with the variable store, discussed under (1), is
+also built as a separate host-side file, named "OVMF_VARS.fd". The "rest" is
+built into a third file, "OVMF_CODE.fd", which is only 1920 KB in size. The
+variable store is mapped into its usual location, at 4 GB - 2 MB = 0xFFE0_0000,
+through the following qemu options:
+
+  -drive if=pflash,format=raw,readonly,file=OVMF_CODE.fd   \
+  -drive if=pflash,format=raw,file=fedora.varstore.fd
+
+This way qemu configures two flash chips consecutively, with start addresses
+growing downwards, which is transparent to OVMF.
+
+[RHEL] Red Hat Enterprise Linux 7.1 ships a Secure Boot-enabled, X64, DEBUG
+       firmware only. Furthermore, only the split files ("OVMF_VARS.fd" and
+       "OVMF_CODE.fd") are available.
+
+S3 (suspend to RAM and resume)
+------------------------------
+
+As noted in Example qemu invocation, the
+
+  -global PIIX4_PM.disable_s3=0
+
+command line option tells qemu and OVMF if the user would like to enable S3
+support. (This is corresponds to the /domain/pm/suspend-to-mem/@enabled libvirt
+domain XML attribute.)
+
+Implementing / orchestrating S3 was a considerable community effort in OVMF. A
+detailed description exceeds the scope of this report; we only make a few
+statements.
+
+(1) S3-related PPIs and protocols are well documented in the PI specification.
+
+(2) Edk2 contains most modules that are needed to implement S3 on a given
+    platform. One abstraction that is central to the porting / extending of the
+    S3-related modules to a new platform is the LockBox library interface,
+    which a specific platform can fill in by implementing its own LockBox
+    library instance.
+
+    The LockBox library provides a privileged name-value store (to be addressed
+    by GUIDs). The privilege separation stretches between the firmware and the
+    operating system. That is, the S3-related machinery of the firmware saves
+    some items in the LockBox securely, under well-known GUIDs, before booting
+    the operating system. During resume (which is a form of warm reset), the
+    firmware is activated again, and retrieves items from the LockBox. Before
+    jumping to the OS's resume vector, the LockBox is secured again.
+
+    We'll return to this later when we separately discuss SMRAM and SMM.
+
+(3) During resume, the DXE and later phases are never reached; only the reset
+    vector, and the SEC and PEI phases of the firmware run. The platform is
+    supposed to detect a resume in progress during PEI, and to store that fact
+    in the BootMode field of the Phase Handoff Information Table (PHIT) HOB.
+    OVMF keys this off the CMOS, see OvmfPkg/PlatformPei.
+
+    At the end of PEI, the DXE IPL PEIM (Initial Program Load PEI Module, see
+    MdeModulePkg/Core/DxeIplPeim) examines the Boot Mode, and if it says "S3
+    resume in progress", then the IPL branches to the PEIM that exports
+    EFI_PEI_S3_RESUME2_PPI (provided by UefiCpuPkg/Universal/Acpi/S3Resume2Pei)
+    rather than loading the DXE core.
+
+    S3Resume2Pei executes the technical steps of the resumption, relying on the
+    contents of the LockBox.
+
+(4) During first boot (or after a normal platform reset), when DXE does run,
+    hardware drivers in the DXE phase are encouraged to "stash" their hardware
+    configuration steps (eg. accesses to PCI config space, I/O ports, memory
+    mapped addresses, and so on) in a centrally maintained, so called "S3 boot
+    script". Hardware accesses are represented with opcodes of a special binary
+    script language.
+
+    This boot script is to be replayed during resume, by S3Resume2Pei. The
+    general goal is to bring back hardware devices -- which have been powered
+    off during suspend -- to their original after-first-boot state, and in
+    particular, to do so quickly.
+
+    At the moment, OVMF saves only one opcode in the S3 resume boot script: an
+    INFORMATION opcode, with contents 0xDEADBEEF (in network byte order). The
+    consensus between Linux developers seems to be that boot firmware is only
+    responsible for restoring basic chipset state, which OVMF does during PEI
+    anyway, independently of S3 vs. normal reset. (One example is the power
+    management registers of the i440fx chipset.) Device and peripheral state is
+    the responsibility of the runtime operating system.
+
+    Although an experimental OVMF S3 boot script was at one point captured for
+    the virtual Cirrus VGA card, such a boot script cannot follow eg. video
+    mode changes effected by the OS. Hence the operating system can never avoid
+    restoring device state, and most Linux display drivers (eg. stdvga, QXL)
+    already cover S3 resume fully.
+
+    The XDDM and WDDM driver models used under Windows OSes seem to recognize
+    this notion of runtime OS responsibility as well. (See the list of OSes
+    supported by OVMF in a separate section.)
+
+(5) The S3 suspend/resume data flow in OVMF is included here tersely, for
+    interested developers.
+
+    (a) BdsLibBootViaBootOption()
+          EFI_ACPI_S3_SAVE_PROTOCOL [AcpiS3SaveDxe]
+          - saves ACPI S3 Context to LockBox  ---------------------+
+            (including FACS address -- FACS ACPI table             |
+            contains OS waking vector)                             |
+                                                                   |
+          - prepares boot script:                                  |
+            EFI_S3_SAVE_STATE_PROTOCOL.Write() [S3SaveStateDxe]    |
+              S3BootScriptLib [PiDxeS3BootScriptLib]               |
+              - opcodes & arguments are saved in NVS.  --+         |
+                                                         |         |
+          - issues a notification by installing          |         |
+            EFI_DXE_SMM_READY_TO_LOCK_PROTOCOL           |         |
+                                                         |         |
+    (b) EFI_S3_SAVE_STATE_PROTOCOL [S3SaveStateDxe]      |         |
+          S3BootScriptLib [PiDxeS3BootScriptLib]         |         |
+          - closes script with special opcode  <---------+         |
+          - script is available in non-volatile memory             |
+            via PcdS3BootScriptTablePrivateDataPtr  --+            |
+                                                      |            |
+        BootScriptExecutorDxe                         |            |
+          S3BootScriptLib [PiDxeS3BootScriptLib]      |            |
+          - Knows about boot script location by  <----+            |
+            synchronizing with the other library                   |
+            instance via                                           |
+            PcdS3BootScriptTablePrivateDataPtr.                    |
+          - Copies relocated image of itself to                    |
+            reserved memory. --------------------------------+     |
+          - Saved image contains pointer to boot script.  ---|--+  |
+                                                             |  |  |
+    Runtime:                                                 |  |  |
+                                                             |  |  |
+    (c) OS is booted, writes OS waking vector to FACS,       |  |  |
+        suspends machine                                     |  |  |
+                                                             |  |  |
+    S3 Resume (PEI):                                         |  |  |
+                                                             |  |  |
+    (d) PlatformPei sets S3 Boot Mode based on CMOS          |  |  |
+                                                             |  |  |
+    (e) DXE core is skipped and EFI_PEI_S3_RESUME2 is        |  |  |
+        called as last step of PEI                           |  |  |
+                                                             |  |  |
+    (f) S3Resume2Pei retrieves from LockBox:                 |  |  |
+        - ACPI S3 Context (path to FACS)  <------------------|--|--+
+                                          |                  |  |
+                                          +------------------|--|--+
+        - Boot Script Executor Image  <----------------------+  |  |
+                                                                |  |
+    (g) BootScriptExecutorDxe                                   |  |
+          S3BootScriptLib [PiDxeS3BootScriptLib]                |  |
+          - executes boot script  <-----------------------------+  |
+                                                                   |
+    (h) OS waking vector available from ACPI S3 Context / FACS  <--+
+        is called
+
+A comprehensive memory map of OVMF
+----------------------------------
+
+The following section gives a detailed analysis of memory ranges below 4 GB
+that OVMF statically uses.
+
+In the rightmost column, the PCD entry is identified by which the source refers
+to the address or size in question.
+
+The flash-covered range has been discussed previously in "Firmware image
+structure", therefore we include it only for completeness. Due to the fact that
+this range is always backed by a memory mapped device (and never RAM), it is
+unaffected by S3 (suspend to RAM and resume).
+
++--------------------------+ 4194304 KB
+|                          |
+|          SECFV           | size: 208 KB
+|                          |
++--------------------------+ 4194096 KB
+|                          |
+|      FVMAIN_COMPACT      | size: 1712 KB
+|                          |
++--------------------------+ 4192384 KB
+|                          |
+|      variable store      | size: 64 KB   PcdFlashNvStorageFtwSpareSize
+|        spare area        |
+|                          |
++--------------------------+ 4192320 KB    PcdOvmfFlashNvStorageFtwSpareBase
+|                          |
+|    FTW working block     | size: 4 KB    PcdFlashNvStorageFtwWorkingSize
+|                          |
++--------------------------+ 4192316 KB    PcdOvmfFlashNvStorageFtwWorkingBase
+|                          |
+|       Event log of       | size: 4 KB    PcdOvmfFlashNvStorageEventLogSize
+|   non-volatile storage   |
+|                          |
++--------------------------+ 4192312 KB    PcdOvmfFlashNvStorageEventLogBase
+|                          |
+|      variable store      | size: 56 KB   PcdFlashNvStorageVariableSize
+|                          |
++--------------------------+ 4192256 KB    PcdOvmfFlashNvStorageVariableBase
+
+The flash-mapped image of OVMF.fd covers the entire structure above (2048 KB).
+
+When using the split files, the address 4192384 KB
+(PcdOvmfFlashNvStorageFtwSpareBase + PcdFlashNvStorageFtwSpareSize) is the
+boundary between the mapped images of OVMF_VARS.fd (56 KB + 4 KB + 4 KB + 64 KB
+= 128 KB) and OVMF_CODE.fd (1712 KB + 208 KB = 1920 KB).
+
+With regard to RAM that is statically used by OVMF, S3 (suspend to RAM and
+resume) complicates matters. Many ranges have been introduced only to support
+S3, hence for all ranges below, the following questions will be audited:
+
+(a) when and how a given range is initialized after first boot of the VM,
+(b) how it is protected from memory allocations during DXE,
+(c) how it is protected from the OS,
+(d) how it is accessed on the S3 resume path,
+(e) how it is accessed on the warm reset path.
+
+Importantly, the term "protected" is meant as protection against inadvertent
+reallocations and overwrites by co-operating DXE and OS modules. It does not
+imply security against malicious code.
+
++--------------------------+ 17408 KB
+|                          |
+|DXEFV from FVMAIN_COMPACT | size: 8192 KB PcdOvmfDxeMemFvSize
+|  decompressed firmware   |
+| volume with DXE modules  |
+|                          |
++--------------------------+ 9216 KB       PcdOvmfDxeMemFvBase
+|                          |
+|PEIFV from FVMAIN_COMPACT | size: 896 KB  PcdOvmfPeiMemFvSize
+|  decompressed firmware   |
+| volume with PEI modules  |
+|                          |
++--------------------------+ 8320 KB       PcdOvmfPeiMemFvBase
+|                          |
+| permanent PEI memory for | size: 32 KB   PcdS3AcpiReservedMemorySize
+|   the S3 resume path     |
+|                          |
++--------------------------+ 8288 KB       PcdS3AcpiReservedMemoryBase
+|                          |
+|  temporary SEC/PEI heap  | size: 32 KB   PcdOvmfSecPeiTempRamSize
+|         and stack        |
+|                          |
++--------------------------+ 8256 KB       PcdOvmfSecPeiTempRamBase
+|                          |
+|          unused          | size: 32 KB
+|                          |
++--------------------------+ 8224 KB
+|                          |
+|      SEC's table of      | size: 4 KB    PcdGuidedExtractHandlerTableSize
+| GUIDed section handlers  |
+|                          |
++--------------------------+ 8220 KB       PcdGuidedExtractHandlerTableAddress
+|                          |
+|     LockBox storage      | size: 4 KB    PcdOvmfLockBoxStorageSize
+|                          |
++--------------------------+ 8216 KB       PcdOvmfLockBoxStorageBase
+|                          |
+| early page tables on X64 | size: 24 KB   PcdOvmfSecPageTablesSize
+|                          |
++--------------------------+ 8192 KB       PcdOvmfSecPageTablesBase
+
+(1) Early page tables on X64:
+
+  (a) when and how it is initialized after first boot of the VM
+
+    The range is filled in during the SEC phase
+    [OvmfPkg/ResetVector/Ia32/PageTables64.asm]. The CR3 register is verified
+    against the base address in SecCoreStartupWithStack()
+    [OvmfPkg/Sec/SecMain.c].
+
+  (b) how it is protected from memory allocations during DXE
+
+    If S3 was enabled on the QEMU command line (see "-global
+    PIIX4_PM.disable_s3=0" earlier), then InitializeRamRegions()
+    [OvmfPkg/PlatformPei/MemDetect.c] protects the range with an AcpiNVS memory
+    allocation HOB, in PEI.
+
+    If S3 was disabled, then this range is not protected. DXE's own page tables
+    are first built while still in PEI (see HandOffToDxeCore()
+    [MdeModulePkg/Core/DxeIplPeim/X64/DxeLoadFunc.c]). Those tables are located
+    in permanent PEI memory. After CR3 is switched over to them (which occurs
+    before jumping to the DXE core entry point), we don't have to preserve the
+    initial tables.
+
+  (c) how it is protected from the OS
+
+    If S3 is enabled, then (1b) reserves it from the OS too.
+
+    If S3 is disabled, then the range needs no protection.
+
+  (d) how it is accessed on the S3 resume path
+
+    It is rewritten same as in (1a), which is fine because (1c) reserved it.
+
+  (e) how it is accessed on the warm reset path
+
+    It is rewritten same as in (1a).
+
+(2) LockBox storage:
+
+  (a) when and how it is initialized after first boot of the VM
+
+    InitializeRamRegions() [OvmfPkg/PlatformPei/MemDetect.c] zeroes out the
+    area during PEI. This is correct but not strictly necessary, since on first
+    boot the area is zero-filled anyway.
+
+    The LockBox signature of the area is filled in by the PEI module or DXE
+    driver that has been linked against OVMF's LockBoxLib and is run first. The
+    signature is written in LockBoxLibInitialize()
+    [OvmfPkg/Library/LockBoxLib/LockBoxLib.c].
+
+    Any module calling SaveLockBox() [OvmfPkg/Library/LockBoxLib/LockBoxLib.c]
+    will co-populate this area.
+
+  (b) how it is protected from memory allocations during DXE
+
+    If S3 is enabled, then InitializeRamRegions()
+    [OvmfPkg/PlatformPei/MemDetect.c] protects the range as AcpiNVS.
+
+    Otherwise, the range is covered with a BootServicesData memory allocation
+    HOB.
+
+  (c) how it is protected from the OS
+
+    If S3 is enabled, then (2b) protects it sufficiently.
+
+    Otherwise the range requires no runtime protection, and the
+    BootServicesData allocation type from (2b) ensures that the range will be
+    released to the OS.
+
+  (d) how it is accessed on the S3 resume path
+
+    The S3 Resume PEIM restores data from the LockBox, which has been correctly
+    protected in (2c).
+
+  (e) how it is accessed on the warm reset path
+
+    InitializeRamRegions() [OvmfPkg/PlatformPei/MemDetect.c] zeroes out the
+    range during PEI, effectively emptying the LockBox. Modules will
+    re-populate the LockBox as described in (2a).
+
+(3) SEC's table of GUIDed section handlers
+
+  (a) when and how it is initialized after first boot of the VM
+
+    The following two library instances are linked into SecMain:
+    - IntelFrameworkModulePkg/Library/LzmaCustomDecompressLib,
+    - MdePkg/Library/BaseExtractGuidedSectionLib.
+
+    The first library registers its LZMA decompressor plugin (which is a called
+    a "section handler") by calling the second library:
+
+    LzmaDecompressLibConstructor() [GuidedSectionExtraction.c]
+      ExtractGuidedSectionRegisterHandlers() [BaseExtractGuidedSectionLib.c]
+
+    The second library maintains its table of registered "section handlers", to
+    be indexed by GUID, in this fixed memory area, independently of S3
+    enablement.
+
+    (The decompression of FVMAIN_COMPACT's FFS file section that contains the
+    PEIFV and DXEFV firmware volumes occurs with the LZMA decompressor
+    registered above. See (6) and (7) below.)
+
+  (b) how it is protected from memory allocations during DXE
+
+    There is no need to protect this area from DXE: because nothing else in
+    OVMF links against BaseExtractGuidedSectionLib, the area loses its
+    significance as soon as OVMF progresses from SEC to PEI, therefore DXE is
+    allowed to overwrite the region.
+
+  (c) how it is protected from the OS
+
+    When S3 is enabled, we cover the range with an AcpiNVS memory allocation
+    HOB in InitializeRamRegions().
+
+    When S3 is disabled, the range is not protected.
+
+  (d) how it is accessed on the S3 resume path
+
+    The table of registered section handlers is again managed by
+    BaseExtractGuidedSectionLib linked into SecMain exclusively. Section
+    handler registrations update the table in-place (based on GUID matches).
+
+  (e) how it is accessed on the warm reset path
+
+    If S3 is enabled, then the OS won't damage the table (due to (3c)), thus
+    see (3d).
+
+    If S3 is disabled, then the OS has most probably overwritten the range with
+    its own data, hence (3a) -- complete reinitialization -- will come into
+    effect, based on the table signature check in BaseExtractGuidedSectionLib.
+
+(4) temporary SEC/PEI heap and stack
+
+  (a) when and how it is initialized after first boot of the VM
+
+    The range is configured in [OvmfPkg/Sec/X64/SecEntry.S] and
+    SecCoreStartupWithStack() [OvmfPkg/Sec/SecMain.c]. The stack half is read &
+    written by the CPU transparently. The heap half is used for memory
+    allocations during PEI.
+
+    Data is migrated out (to permanent PEI stack & memory) in (or soon after)
+    PublishPeiMemory() [OvmfPkg/PlatformPei/MemDetect.c].
+
+  (b) how it is protected from memory allocations during DXE
+
+    It is not necessary to protect this range during DXE because its use ends
+    still in PEI.
+
+  (c) how it is protected from the OS
+
+    If S3 is enabled, then InitializeRamRegions()
+    [OvmfPkg/PlatformPei/MemDetect.c] reserves it as AcpiNVS.
+
+    If S3 is disabled, then the range doesn't require protection.
+
+  (d) how it is accessed on the S3 resume path
+
+    Same as in (4a), except the target area of the migration triggered by
+    PublishPeiMemory() [OvmfPkg/PlatformPei/MemDetect.c] is different -- see
+    (5).
+
+  (e) how it is accessed on the warm reset path
+
+    Same as in (4a). The stack and heap halves both may contain garbage, but it
+    doesn't matter.
+
+(5) permanent PEI memory for the S3 resume path
+
+  (a) when and how it is initialized after first boot of the VM
+
+    No particular initialization or use.
+
+  (b) how it is protected from memory allocations during DXE
+
+    We don't need to protect this area during DXE.
+
+  (c) how it is protected from the OS
+
+    When S3 is enabled, InitializeRamRegions()
+    [OvmfPkg/PlatformPei/MemDetect.c] makes sure the OS stays away by covering
+    the range with an AcpiNVS memory allocation HOB.
+
+    When S3 is disabled, the range needs no protection.
+
+  (d) how it is accessed on the S3 resume path
+
+    PublishPeiMemory() installs the range as permanent RAM for PEI. The range
+    will serve as stack and will satisfy allocation requests during the rest of
+    PEI. OS data won't overlap due to (5c).
+
+  (e) how it is accessed on the warm reset path
+
+    Same as (5a).
+
+(6) PEIFV -- decompressed firmware volume with PEI modules
+
+  (a) when and how it is initialized after first boot of the VM
+
+    DecompressMemFvs() [OvmfPkg/Sec/SecMain.c] populates the area, by
+    decompressing the flash-mapped FVMAIN_COMPACT volume's contents. (Refer to
+    "Firmware image structure".)
+
+  (b) how it is protected from memory allocations during DXE
+
+    When S3 is disabled, PeiFvInitialization() [OvmfPkg/PlatformPei/Fv.c]
+    covers the range with a BootServicesData memory allocation HOB.
+
+    When S3 is enabled, the same is coverage is ensured, just with the stronger
+    AcpiNVS memory allocation type.
+
+  (c) how it is protected from the OS
+
+    When S3 is disabled, it is not necessary to keep the range from the OS.
+
+    Otherwise the AcpiNVS type allocation from (6b) provides coverage.
+
+  (d) how it is accessed on the S3 resume path
+
+    Rather than decompressing it again from FVMAIN_COMPACT, GetS3ResumePeiFv()
+    [OvmfPkg/Sec/SecMain.c] reuses the protected area for parsing / execution
+    from (6c).
+
+  (e) how it is accessed on the warm reset path
+
+    Same as (6a).
+
+(7) DXEFV -- decompressed firmware volume with DXE modules
+
+  (a) when and how it is initialized after first boot of the VM
+
+    Same as (6a).
+
+  (b) how it is protected from memory allocations during DXE
+
+    PeiFvInitialization() [OvmfPkg/PlatformPei/Fv.c] covers the range with a
+    BootServicesData memory allocation HOB.
+
+  (c) how it is protected from the OS
+
+    The OS is allowed to release and reuse this range.
+
+  (d) how it is accessed on the S3 resume path
+
+    It's not; DXE never runs during S3 resume.
+
+  (e) how it is accessed on the warm reset path
+
+    Same as in (7a).
+
+Known Secure Boot limitations
+-----------------------------
+
+Under "Motivation" we've mentioned that OVMF's Secure Boot implementation is
+not suitable for production use yet -- it's only good for development and
+testing of standards-conformant, non-malicious guest code (UEFI and operating
+system alike).
+
+Now that we've examined the persistent flash device, the workings of S3, and
+the memory map, we can discuss two currently known shortcomings of OVMF's
+Secure Boot that in fact make it insecure. (Clearly problems other than these
+two might exist; the set of issues considered here is not meant to be
+exhaustive.)
+
+One trait of Secure Boot is tamper-evidence. Secure Boot may not prevent
+malicious modification of software components (for example, operating system
+drivers), but by being the root of integrity on a platform, it can catch (or
+indirectly contribute to catching) unauthorized changes, by way of signature
+and certificate checks at the earliest phases of boot.
+
+If an attacker can tamper with key material stored in authenticated and/or
+boot-time only persistent variables (for example, PK, KEK, db, dbt, dbx), then
+the intended security of this scheme is compromised. The UEFI 2.4A
+specification says
+
+- in section 28.3.4:
+
+  Platform Keys:
+
+    The public key must be stored in non-volatile storage which is tamper and
+    delete resistant.
+
+  Key Exchange Keys:
+
+    The public key must be stored in non-volatile storage which is tamper
+    resistant.
+
+- in section 28.6.1:
+
+  The signature database variables db, dbt, and dbx must be stored in
+  tamper-resistant non-volatile storage.
+
+(1) The combination of QEMU, KVM, and OVMF does not provide this kind of
+    resistance. The variable store in the emulated flash chip is directly
+    accessible to, and reprogrammable by, UEFI drivers, applications, and
+    operating systems.
+
+(2) Under "S3 (suspend to RAM and resume)" we pointed out that the LockBox
+    storage must be similarly secure and tamper-resistant.
+
+    On the S3 resume path, the PEIM providing EFI_PEI_S3_RESUME2_PPI
+    (UefiCpuPkg/Universal/Acpi/S3Resume2Pei) restores and interprets data from
+    the LockBox that has been saved there during boot. This PEIM, being part of
+    the firmware, has full access to the platform. If an operating system can
+    tamper with the contents of the LockBox, then at the next resume the
+    platform's integrity might be subverted.
+
+    OVMF stores the LockBox in normal guest RAM (refer to the memory map
+    section above). Operating systems and third party UEFI drivers and UEFI
+    applications that respect the UEFI memory map will not inadvertently
+    overwrite the LockBox storage, but there's nothing to prevent eg. a
+    malicious kernel from modifying the LockBox.
+
+One means to address these issues is SMM and SMRAM (System Management Mode and
+System Management RAM).
+
+During boot and resume, the firmware can enter and leave SMM and access SMRAM.
+Before the DXE phase is left, and control is transferred to the BDS phase (when
+third party UEFI drivers and applications can be loaded, and an operating
+system can be loaded), SMRAM is locked in hardware, and subsequent modules
+cannot access it directly. (See EFI_DXE_SMM_READY_TO_LOCK_PROTOCOL.)
+
+Once SMRAM has been locked, UEFI drivers and the operating system can enter SMM
+by raising a System Management Interrupt (SMI), at which point trusted code
+(part of the platform firmware) takes control. SMRAM is also unlocked by
+platform reset, at which point the boot firmware takes control again.
+
+Variable store and LockBox in SMRAM
+-----------------------------------
+
+Edk2 provides almost all components to implement the variable store and the
+LockBox in SMRAM. In this section we summarize ideas for utilizing those
+facilities.
+
+The SMRAM and SMM infrastructure in edk2 is built up as follows:
+
+(1) The platform hardware provides SMM / SMI / SMRAM.
+
+    Qemu/KVM doesn't support these features currently and should implement them
+    in the longer term.
+
+(2) The platform vendor (in this case, OVMF developers) implement device
+    drivers for the platform's System Management Mode:
+
+    - EFI_SMM_CONTROL2_PROTOCOL: for raising a synchronous (and/or) periodic
+      SMI(s); that is, for entering SMM.
+
+    - EFI_SMM_ACCESS2_PROTOCOL: for describing and accessing SMRAM.
+
+    These protocols are documented in the PI Specification, Volume 4.
+
+(3) The platform DSC file is to include the following platform-independent
+    modules:
+
+    - MdeModulePkg/Core/PiSmmCore/PiSmmIpl.inf: SMM Initial Program Load
+    - MdeModulePkg/Core/PiSmmCore/PiSmmCore.inf: SMM Core
+
+(4) At this point, modules of type DXE_SMM_DRIVER can be loaded.
+
+    Such drivers are privileged. They run in SMM, have access to SMRAM, and are
+    separated and switched from other drivers through SMIs. Secure
+    communication between unprivileged (non-SMM) and privileged (SMM) drivers
+    happens through EFI_SMM_COMMUNICATION_PROTOCOL (implemented by the SMM
+    Core, see (3)).
+
+    DXE_SMM_DRIVER modules must sanitize their input (coming from unprivileged
+    drivers) carefully.
+
+(5) The authenticated runtime variable services driver (for Secure Boot builds)
+    is located under "SecurityPkg/VariableAuthenticated/RuntimeDxe". OVMF
+    currently builds the driver (a DXE_RUNTIME_DRIVER module) with the
+    "VariableRuntimeDxe.inf" control file (refer to "OvmfPkg/OvmfPkgX64.dsc"),
+    which does not use SMM.
+
+    The directory includes two more INF files:
+
+    - VariableSmm.inf -- module type: DXE_SMM_DRIVER. A privileged driver that
+      runs in SMM and has access to SMRAM.
+
+    - VariableSmmRuntimeDxe.inf -- module type: DXE_RUNTIME_DRIVER. A
+      non-privileged driver that implements the variable runtime services
+      (replacing the current "VariableRuntimeDxe.inf" file) by communicating
+      with the above privileged SMM half via EFI_SMM_COMMUNICATION_PROTOCOL.
+
+(6) An SMRAM-based LockBox implementation needs to be discussed in two parts,
+    because the LockBox is accessed in both PEI and DXE.
+
+    (a) During DXE, drivers save data in the LockBox. A save operation is
+        layered as follows:
+
+        - The unprivileged driver wishing to store data in the LockBox links
+          against the "MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxDxeLib.inf"
+          library instance.
+
+          The library allows the unprivileged driver to format requests for the
+          privileged SMM LockBox driver (see below), and to parse responses.
+
+        - The privileged SMM LockBox driver is built from
+          "MdeModulePkg/Universal/LockBox/SmmLockBox/SmmLockBox.inf". This
+          driver has module type DXE_SMM_DRIVER and can access SMRAM.
+
+          The driver delegates command parsing and response formatting to
+          "MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxSmmLib.inf".
+
+        - The above two halves (unprivileged and privileged) mirror what we've
+          seen in case of the variable service drivers, under (5).
+
+    (b) In PEI, the S3 Resume PEIM (UefiCpuPkg/Universal/Acpi/S3Resume2Pei)
+        retrieves data from the LockBox.
+
+        Presumably, S3Resume2Pei should be considered an "unprivileged PEIM",
+        and the SMRAM access should be layered as seen in DXE. Unfortunately,
+        edk2 does not implement all of the layers in PEI -- the code either
+        doesn't exist, or it is not open source:
+
+  role         | DXE: protocol/module           | PEI: PPI/module
+  -------------+--------------------------------+------------------------------
+  unprivileged | any                            | S3Resume2Pei.inf
+  driver       |                                |
+  -------------+--------------------------------+------------------------------
+  command      | LIBRARY_CLASS = LockBoxLib     | LIBRARY_CLASS = LockBoxLib
+  formatting   |                                |
+  and response | SmmLockBoxDxeLib.inf           | SmmLockBoxPeiLib.inf
+  parsing      |                                |
+  -------------+--------------------------------+------------------------------
+  privilege    | EFI_SMM_COMMUNICATION_PROTOCOL | EFI_PEI_SMM_COMMUNICATION_PPI
+  separation   |                                |
+               | PiSmmCore.inf                  | missing!
+  -------------+--------------------------------+------------------------------
+  platform SMM | EFI_SMM_CONTROL2_PROTOCOL      | PEI_SMM_CONTROL_PPI
+  and SMRAM    | EFI_SMM_ACCESS2_PROTOCOL       | PEI_SMM_ACCESS_PPI
+  access       |                                |
+               | to be done in OVMF             | to be done in OVMF
+  -------------+--------------------------------+------------------------------
+  command      | LIBRARY_CLASS = LockBoxLib     | LIBRARY_CLASS = LockBoxLib
+  parsing and  |                                |
+  response     | SmmLockBoxSmmLib.inf           | missing!
+  formatting   |                                |
+  -------------+--------------------------------+------------------------------
+  privileged   | SmmLockBox.inf                 | missing!
+  LockBox      |                                |
+  driver       |                                |
+
+        Alternatively, in the future OVMF might be able to provide a LockBoxLib
+        instance (an SmmLockBoxPeiLib substitute) for S3Resume2Pei that
+        accesses SMRAM directly, eliminating the need for deeper layers in the
+        stack (that is, EFI_PEI_SMM_COMMUNICATION_PPI and deeper).
+
+        In fact, a "thin" EFI_PEI_SMM_COMMUNICATION_PPI implementation whose
+        sole Communicate() member invariably returns EFI_NOT_STARTED would
+        cause the current SmmLockBoxPeiLib library instance to directly perform
+        full-depth SMRAM access and LockBox search, obviating the "missing"
+        cells. (With reference to A Tour Beyond BIOS: Implementing S3 Resume
+        with EDK2, by Jiewen Yao and Vincent Zimmer, October 2014.)
+
+Select features
+---------------
+
+In this section we'll browse the top-level "OvmfPkg" package directory, and
+discuss the more interesting drivers and libraries that have not been mentioned
+thus far.
+
+X64-specific reset vector for OVMF
+..................................
+
+The "OvmfPkg/ResetVector" directory customizes the reset vector (found in
+"UefiCpuPkg/ResetVector/Vtf0") for "OvmfPkgX64.fdf", that is, when the SEC/PEI
+phases run in 64-bit (ie. long) mode.
+
+The reset vector's control flow looks roughly like:
+
+  resetVector                               [Ia16/ResetVectorVtf0.asm]
+  EarlyBspInitReal16                        [Ia16/Init16.asm]
+  Main16                                    [Main.asm]
+    EarlyInit16                             [Ia16/Init16.asm]
+
+    ; Transition the processor from
+    ; 16-bit real mode to 32-bit flat mode
+    TransitionFromReal16To32BitFlat         [Ia16/Real16ToFlat32.asm]
+
+    ; Search for the
+    ; Boot Firmware Volume (BFV)
+    Flat32SearchForBfvBase                  [Ia32/SearchForBfvBase.asm]
+
+    ; Search for the SEC entry point
+    Flat32SearchForSecEntryPoint            [Ia32/SearchForSecEntry.asm]
+
+    %ifdef ARCH_IA32
+      ; Jump to the 32-bit SEC entry point
+    %else
+      ; Transition the processor
+      ; from 32-bit flat mode
+      ; to 64-bit flat mode
+      Transition32FlatTo64Flat              [Ia32/Flat32ToFlat64.asm]
+
+        SetCr3ForPageTables64               [Ia32/PageTables64.asm]
+          ; set CR3 to page tables
+          ; built into the ROM image
+
+        ; enable PAE
+        ; set LME
+        ; enable paging
+
+      ; Jump to the 64-bit SEC entry point
+    %endif
+
+On physical platforms, the initial page tables referenced by
+SetCr3ForPageTables64 are built statically into the flash device image, and are
+present in ROM at runtime. This is fine on physical platforms because the
+pre-built page table entries have the Accessed and Dirty bits set from the
+start.
+
+Accordingly, for OVMF running in long mode on qemu/KVM, the initial page tables
+were mapped as a KVM_MEM_READONLY slot, as part of QEMU's pflash device (refer
+to "Firmware image structure" above).
+
+In spite of the Accessed and Dirty bits being pre-set in the read-only,
+in-flash PTEs, in a virtual machine attempts are made to update said PTE bits,
+differently from physical hardware. The component attempting to update the
+read-only PTEs can be one of the following:
+
+- The processor itself, if it supports nested paging, and the user enables that
+  processor feature,
+
+- KVM code implementing shadow paging, otherwise.
+
+The first case presents no user-visible symptoms, but the second case (KVM,
+shadow paging) used to cause a triple fault, prior to Linux commit ba6a354
+("KVM: mmu: allow page tables to be in read-only slots").
+
+For compatibility with earlier KVM versions, the OvmfPkg/ResetVector directory
+adapts the generic reset vector code as follows:
+
+      Transition32FlatTo64Flat         [UefiCpuPkg/.../Ia32/Flat32ToFlat64.asm]
+
+        SetCr3ForPageTables64       [OvmfPkg/ResetVector/Ia32/PageTables64.asm]
+
+          ; dynamically build the initial page tables in RAM, at address
+          ; PcdOvmfSecPageTablesBase (refer to the memory map above),
+          ; identity-mapping the first 4 GB of address space
+
+          ; set CR3 to PcdOvmfSecPageTablesBase
+
+        ; enable PAE
+        ; set LME
+        ; enable paging
+
+This way the PTEs that earlier KVM versions try to update (during shadow
+paging) are located in a read-write memory slot, and the write attempts
+succeed.
+
+Client library for QEMU's firmware configuration interface
+..........................................................
+
+QEMU provides a write-only, 16-bit wide control port, and a read-write, 8-bit
+wide data port for exchanging configuration elements with the firmware.
+
+The firmware writes a selector (a key) to the control port (0x510), and then
+reads the corresponding configuration data (produced by QEMU) from the data
+port (0x511).
+
+If the selected entry is writable, the firmware may overwrite it. If QEMU has
+associated a callback with the entry, then when the entry is completely
+rewritten, QEMU runs the callback. (OVMF does not rewrite any entries at the
+moment.)
+
+A number of selector values (keys) are predefined. In particular, key 0x19
+selects (returns) a directory of { name, selector, size } triplets, roughly
+speaking.
+
+The firmware can request configuration elements by well-known name as well, by
+looking up the selector value first in the directory, by name, and then writing
+the selector to the control port. The number of bytes to read subsequently from
+the data port is known from the directory entry's "size" field.
+
+By convention, directory entries (well-known symbolic names of configuration
+elements) are formatted as POSIX pathnames. For example, the array selected by
+the "etc/system-states" name indicates (among other things) whether the user
+enabled S3 support in QEMU.
+
+The above interface is called "fw_cfg".
+
+The binary data associated with a symbolic name is called an "fw_cfg file".
+
+OVMF's fw_cfg client library is found in "OvmfPkg/Library/QemuFwCfgLib". OVMF
+discovers many aspects of the virtual system with it; we refer to a few
+examples below.
+
+Guest ACPI tables
+.................
+
+An operating system discovers a good amount of its hardware by parsing ACPI
+tables, and by interpreting ACPI objects and methods. On physical hardware, the
+platform vendor's firmware installs ACPI tables in memory that match both the
+hardware present in the system and the user's firmware configuration ("BIOS
+setup").
+
+Under qemu/KVM, the owner of the (virtual) hardware configuration is QEMU.
+Hardware can easily be reconfigured on the command line. Furthermore, features
+like CPU hotplug, PCI hotplug, memory hotplug are continuously developed for
+QEMU, and operating systems need direct ACPI support to exploit these features.
+
+For this reason, QEMU builds its own ACPI tables dynamically, in a
+self-descriptive manner, and exports them to the firmware through a complex,
+multi-file fw_cfg interface. It is rooted in the "etc/table-loader" fw_cfg
+file. (Further details of this interface are out of scope for this report.)
+
+OVMF's AcpiPlatformDxe driver fetches the ACPI tables, and installs them for
+the guest OS with the EFI_ACPI_TABLE_PROTOCOL (which is in turn provided by the
+generic "MdeModulePkg/Universal/Acpi/AcpiTableDxe" driver).
+
+For earlier QEMU versions and machine types (which we generally don't recommend
+for OVMF; see "Scope"), the "OvmfPkg/AcpiTables" directory contains a few
+static ACPI table templates. When the "etc/table-loader" fw_cfg file is
+unavailable, AcpiPlatformDxe installs these default tables (with a little bit
+of dynamic patching).
+
+When OVMF runs in a Xen domU, AcpiTableDxe also installs ACPI tables that
+originate from the hypervisor's environment.
+
+Guest SMBIOS tables
+...................
+
+Quoting the SMBIOS Reference Specification,
+
+  [...] the System Management BIOS Reference Specification addresses how
+  motherboard and system vendors present management information about their
+  products in a standard format [...]
+
+In practice SMBIOS tables are just another set of tables that the platform
+vendor's firmware installs in RAM for the operating system, and, importantly,
+for management applications running on the OS. Without rehashing the "Guest
+ACPI tables" section in full, let's map the OVMF roles seen there from ACPI to
+SMBIOS:
+
+  role                     | ACPI                    | SMBIOS
+  -------------------------+-------------------------+-------------------------
+  fw_cfg file              | etc/table-loader        | etc/smbios/smbios-tables
+  -------------------------+-------------------------+-------------------------
+  OVMF driver              | AcpiPlatformDxe         | SmbiosPlatformDxe
+  under "OvmfPkg"          |                         |
+  -------------------------+-------------------------+-------------------------
+  Underlying protocol,     | EFI_ACPI_TABLE_PROTOCOL | EFI_SMBIOS_PROTOCOL
+  implemented by generic   |                         |
+  driver under             | Acpi/AcpiTableDxe       | SmbiosDxe
+  "MdeModulePkg/Universal" |                         |
+  -------------------------+-------------------------+-------------------------
+  default tables available | yes                     | [RHEL] yes, Type0 and
+  for earlier QEMU machine |                         |        Type1 tables
+  types, with hot-patching |                         |
+  -------------------------+-------------------------+-------------------------
+  tables fetched in Xen    | yes                     | yes
+  domUs                    |                         |
+
+Platform-specific boot policy
+.............................
+
+OVMF's BDS (Boot Device Selection) phase is implemented by
+IntelFrameworkModulePkg/Universal/BdsDxe. Roughly speaking, this large driver:
+
+- provides the EFI BDS architectural protocol (which DXE transfers control to
+  after dispatching all DXE drivers),
+
+- connects drivers to devices,
+
+- enumerates boot devices,
+
+- auto-generates boot options,
+
+- provides "BIOS setup" screens, such as:
+
+  - Boot Manager, for booting an option,
+
+  - Boot Maintenance Manager, for adding, deleting, and reordering boot
+    options, changing console properties etc,
+
+  - Device Manager, where devices can register configuration forms, including
+
+    - Secure Boot configuration forms,
+
+    - OVMF's Platform Driver form (see under PlatformDxe).
+
+Firmware that includes the "IntelFrameworkModulePkg/Universal/BdsDxe" driver
+can customize its behavior by providing an instance of the PlatformBdsLib
+library class. The driver links against this platform library, and the
+platform library can call Intel's BDS utility functions from
+"IntelFrameworkModulePkg/Library/GenericBdsLib".
+
+OVMF's PlatformBdsLib instance can be found in
+"OvmfPkg/Library/PlatformBdsLib". The main function where the BdsDxe driver
+enters the library is PlatformBdsPolicyBehavior(). We mention two OVMF
+particulars here.
+
+(1) OVMF is capable of loading kernel images directly from fw_cfg, matching
+    QEMU's -kernel, -initrd, and -append command line options. This feature is
+    useful for rapid, repeated Linux kernel testing, and is implemented in the
+    following call tree:
+
+    PlatformBdsPolicyBehavior() [OvmfPkg/Library/PlatformBdsLib/BdsPlatform.c]
+      TryRunningQemuKernel() [OvmfPkg/Library/PlatformBdsLib/QemuKernel.c]
+        LoadLinux*() [OvmfPkg/Library/LoadLinuxLib/Linux.c]
+
+    OvmfPkg/Library/LoadLinuxLib ports the efilinux bootloader project into
+    OvmfPkg.
+
+(2) OVMF seeks to comply with the boot order specification passed down by QEMU
+    over fw_cfg.
+
+    (a) About Boot Modes
+
+      During the PEI phase, OVMF determines and stores the Boot Mode in the
+      PHIT HOB (already mentioned in "S3 (suspend to RAM and resume)"). The
+      boot mode is supposed to influence the rest of the system, for example it
+      distinguishes S3 resume (BOOT_ON_S3_RESUME) from a "normal" boot.
+
+      In general, "normal" boots can be further differentiated from each other;
+      for example for speed reasons. When the firmware can tell during PEI that
+      the chassis has not been opened since last power-up, then it might want
+      to save time by not connecting all devices and not enumerating all boot
+      options from scratch; it could just rely on the stored results of the
+      last enumeration. The matching BootMode value, to be set during PEI,
+      would be BOOT_ASSUMING_NO_CONFIGURATION_CHANGES.
+
+      OVMF only sets one of the following two boot modes, based on CMOS
+      contents:
+      - BOOT_ON_S3_RESUME,
+      - BOOT_WITH_FULL_CONFIGURATION.
+
+      For BOOT_ON_S3_RESUME, please refer to "S3 (suspend to RAM and resume)".
+      The other boot mode supported by OVMF, BOOT_WITH_FULL_CONFIGURATION, is
+      an appropriate "catch-all" for a virtual machine, where hardware can
+      easily change from boot to boot.
+
+    (b) Auto-generation of boot options
+
+      Accordingly, when not resuming from S3 sleep (*), OVMF always connects
+      all devices, and enumerates all bootable devices as new boot options
+      (non-volatile variables called Boot####).
+
+      (*) During S3 resume, DXE is not reached, hence BDS isn't either.
+
+      The auto-enumerated boot options are stored in the BootOrder non-volatile
+      variable after any preexistent options. (Boot options may exist before
+      auto-enumeration eg. because the user added them manually with the Boot
+      Maintenance Manager or the efibootmgr utility. They could also originate
+      from an earlier auto-enumeration.)
+
+      PlatformBdsPolicyBehavior()                   [OvmfPkg/.../BdsPlatform.c]
+        TryRunningQemuKernel()                       [OvmfPkg/.../QemuKernel.c]
+        BdsLibConnectAll()           [IntelFrameworkModulePkg/.../BdsConnect.c]
+        BdsLibEnumerateAllBootOption()  [IntelFrameworkModulePkg/.../BdsBoot.c]
+          BdsLibBuildOptionFromHandle() [IntelFrameworkModulePkg/.../BdsBoot.c]
+            BdsLibRegisterNewOption()   [IntelFrameworkModulePkg/.../BdsMisc.c]
+              //
+              // Append the new option number to the original option order
+              //
+
+    (c) Relative UEFI device paths in boot options
+
+      The handling of relative ("short-form") UEFI device paths is best
+      demonstrated through an example, and by quoting the UEFI 2.4A
+      specification.
+
+      A short-form hard drive UEFI device path could be (displaying each device
+      path node on a separate line for readability):
+
+        HD(1,GPT,14DD1CC5-D576-4BBF-8858-BAF877C8DF61,0x800,0x64000)/
+        \EFI\fedora\shim.efi
+
+      This device path lacks prefix nodes (eg. hardware or messaging type
+      nodes) that would lead to the hard drive. During load option processing,
+      the above short-form or relative device path could be matched against the
+      following absolute device path:
+
+        PciRoot(0x0)/
+        Pci(0x4,0x0)/
+        HD(1,GPT,14DD1CC5-D576-4BBF-8858-BAF877C8DF61,0x800,0x64000)/
+        \EFI\fedora\shim.efi
+
+      The motivation for this type of device path matching / completion is to
+      allow the user to move around the hard drive (for example, to plug a
+      controller in a different PCI slot, or to expose the block device on a
+      different iSCSI path) and still enable the firmware to find the hard
+      drive.
+
+      The UEFI specification says,
+
+        9.3.6 Media Device Path
+        9.3.6.1 Hard Drive
+
+          [...] Section 3.1.2 defines special rules for processing the Hard
+          Drive Media Device Path. These special rules enable a disk's location
+          to change and still have the system boot from the disk. [...]
+
+        3.1.2 Load Option Processing
+
+          [...] The boot manager must [...] support booting from a short-form
+          device path that starts with the first element being a hard drive
+          media device path [...]. The boot manager must use the GUID or
+          signature and partition number in the hard drive device path to match
+          it to a device in the system. If the drive supports the GPT
+          partitioning scheme the GUID in the hard drive media device path is
+          compared with the UniquePartitionGuid field of the GUID Partition
+          Entry [...]. If the drive supports the PC-AT MBR scheme the signature
+          in the hard drive media device path is compared with the
+          UniqueMBRSignature in the Legacy Master Boot Record [...]. If a
+          signature match is made, then the partition number must also be
+          matched. The hard drive device path can be appended to the matching
+          hardware device path and normal boot behavior can then be used. If
+          more than one device matches the hard drive device path, the boot
+          manager will pick one arbitrarily. Thus the operating system must
+          ensure the uniqueness of the signatures on hard drives to guarantee
+          deterministic boot behavior.
+
+      Edk2 implements and exposes the device path completion logic in the
+      already referenced "IntelFrameworkModulePkg/Library/GenericBdsLib"
+      library, in the BdsExpandPartitionPartialDevicePathToFull() function.
+
+    (d) Filtering and reordering the boot options based on fw_cfg
+
+      Once we have an "all-inclusive", partly preexistent, partly freshly
+      auto-generated boot option list from bullet (b), OVMF loads QEMU's
+      requested boot order from fw_cfg, and filters and reorders the list from
+      (b) with it:
+
+      PlatformBdsPolicyBehavior()                   [OvmfPkg/.../BdsPlatform.c]
+        TryRunningQemuKernel()                       [OvmfPkg/.../QemuKernel.c]
+        BdsLibConnectAll()           [IntelFrameworkModulePkg/.../BdsConnect.c]
+        BdsLibEnumerateAllBootOption()  [IntelFrameworkModulePkg/.../BdsBoot.c]
+        SetBootOrderFromQemu()                    [OvmfPkg/.../QemuBootOrder.c]
+
+      According to the (preferred) "-device ...,bootindex=N" and the (legacy)
+      '-boot order=drives' command line options, QEMU requests a boot order
+      from the firmware through the "bootorder" fw_cfg file. (For a bootindex
+      example, refer to the "Example qemu invocation" section.)
+
+      This fw_cfg file consists of OpenFirmware (OFW) device paths -- note: not
+      UEFI device paths! --, one per line. An example list is:
+
+        /pci@i0cf8/scsi@4/disk@0,0
+        /pci@i0cf8/ide@1,1/drive@1/disk@0
+        /pci@i0cf8/ethernet@3/ethernet-phy@0
+
+      OVMF filters and reorders the boot option list from bullet (b) with the
+      following nested loops algorithm:
+
+        new_uefi_order := <empty>
+        for each qemu_ofw_path in QEMU's OpenFirmware device path list:
+          qemu_uefi_path_prefix := translate(qemu_ofw_path)
+
+          for each boot_option in current_uefi_order:
+            full_boot_option := complete(boot_option)
+
+            if match(qemu_uefi_path_prefix, full_boot_option):
+              append(new_uefi_order, boot_option)
+              break
+
+        for each unmatched boot_option in current_uefi_order:
+          if survives(boot_option):
+            append(new_uefi_order, boot_option)
+
+        current_uefi_order := new_uefi_order
+
+      OVMF iterates over QEMU's OFW device paths in order, translates each to a
+      UEFI device path prefix, tries to match the translated prefix against the
+      UEFI boot options (which are completed from relative form to absolute
+      form for the purpose of prefix matching), and if there's a match, the
+      matching boot option is appended to the new boot order (which starts out
+      empty).
+
+      (We elaborate on the translate() function under bullet (e). The
+      complete() function has been explained in bullet (c).)
+
+      In addition, UEFI boot options that remain unmatched after filtering and
+      reordering are post-processed, and some of them "survive". Due to the
+      fact that OpenFirmware device paths have less expressive power than their
+      UEFI counterparts, some UEFI boot options are simply inexpressible (hence
+      unmatchable) by the nested loops algorithm.
+
+      An important example is the memory-mapped UEFI shell, whose UEFI device
+      path is inexpressible by QEMU's OFW device paths:
+
+        MemoryMapped(0xB,0x900000,0x10FFFFF)/
+        FvFile(7C04A583-9E3E-4F1C-AD65-E05268D0B4D1)
+
+      (Side remark: notice that the address range visible in the MemoryMapped()
+      node corresponds to DXEFV under "comprehensive memory map of OVMF"! In
+      addition, the FvFile() node's GUID originates from the FILE_GUID entry of
+      "ShellPkg/Application/Shell/Shell.inf".)
+
+      The UEFI shell can be booted by pressing ESC in OVMF on the TianoCore
+      splash screen, and navigating to Boot Manager | EFI Internal Shell. If
+      the "survival policy" was not implemented, the UEFI shell's boot option
+      would always be filtered out.
+
+      The current "survival policy" preserves all boot options that start with
+      neither PciRoot() nor HD().
+
+    (e) Translating QEMU's OpenFirmware device paths to UEFI device path
+        prefixes
+
+      In this section we list the (strictly heuristical) mappings currently
+      performed by OVMF.
+
+      The "prefix only" nature of the translation output is rooted minimally in
+      the fact that QEMU's OpenFirmware device paths cannot carry pathnames
+      within filesystems. There's no way to specify eg.
+
+        \EFI\fedora\shim.efi
+
+      in an OFW device path, therefore a UEFI device path translated from an
+      OFW device path can at best be a prefix (not a full match) of a UEFI
+      device path that ends with "\EFI\fedora\shim.efi".
+
+      - IDE disk, IDE CD-ROM:
+
+        OpenFirmware device path:
+
+          /pci@i0cf8/ide@1,1/drive@0/disk@0
+               ^         ^ ^       ^      ^
+               |         | |       |      master or slave
+               |         | |       primary or secondary
+               |         PCI slot & function holding IDE controller
+               PCI root at system bus port, PIO
+
+        UEFI device path prefix:
+
+          PciRoot(0x0)/Pci(0x1,0x1)/Ata(Primary,Master,0x0)
+                                                       ^
+                                                       fixed LUN
+
+      - Floppy disk:
+
+        OpenFirmware device path:
+
+          /pci@i0cf8/isa@1/fdc@03f0/floppy@0
+               ^         ^     ^           ^
+               |         |     |           A: or B:
+               |         |     ISA controller io-port (hex)
+               |         PCI slot holding ISA controller
+               PCI root at system bus port, PIO
+
+        UEFI device path prefix:
+
+          PciRoot(0x0)/Pci(0x1,0x0)/Floppy(0x0)
+                                           ^
+                                           ACPI UID (A: or B:)
+
+      - Virtio-block disk:
+
+        OpenFirmware device path:
+
+          /pci@i0cf8/scsi@6[,3]/disk@0,0
+               ^          ^  ^       ^ ^
+               |          |  |       fixed
+               |          |  PCI function corresponding to disk (optional)
+               |          PCI slot holding disk
+               PCI root at system bus port, PIO
+
+        UEFI device path prefixes (dependent on the presence of a nonzero PCI
+        function in the OFW device path):
+
+          PciRoot(0x0)/Pci(0x6,0x0)/HD(
+          PciRoot(0x0)/Pci(0x6,0x3)/HD(
+
+      - Virtio-scsi disk and virtio-scsi passthrough:
+
+        OpenFirmware device path:
+
+          /pci@i0cf8/scsi@7[,3]/channel@0/disk@2,3
+               ^          ^             ^      ^ ^
+               |          |             |      | LUN
+               |          |             |      target
+               |          |             channel (unused, fixed 0)
+               |          PCI slot[, function] holding SCSI controller
+               PCI root at system bus port, PIO
+
+        UEFI device path prefixes (dependent on the presence of a nonzero PCI
+        function in the OFW device path):
+
+          PciRoot(0x0)/Pci(0x7,0x0)/Scsi(0x2,0x3)
+          PciRoot(0x0)/Pci(0x7,0x3)/Scsi(0x2,0x3)
+
+      - Emulated and passed-through (physical) network cards:
+
+        OpenFirmware device path:
+
+          /pci@i0cf8/ethernet@3[,2]
+               ^              ^
+               |              PCI slot[, function] holding Ethernet card
+               PCI root at system bus port, PIO
+
+        UEFI device path prefixes (dependent on the presence of a nonzero PCI
+        function in the OFW device path):
+
+          PciRoot(0x0)/Pci(0x3,0x0)
+          PciRoot(0x0)/Pci(0x3,0x2)
+
+Virtio drivers
+..............
+
+UEFI abstracts various types of hardware resources into protocols, and allows
+firmware developers to implement those protocols in device drivers. The Virtio
+Specification defines various types of virtual hardware for virtual machines.
+Connecting the two specifications, OVMF provides UEFI drivers for QEMU's
+virtio-block, virtio-scsi, and virtio-net devices.
+
+The following diagram presents the protocol and driver stack related to Virtio
+devices in edk2 and OVMF. Each node in the graph identifies a protocol and/or
+the edk2 driver that produces it. Nodes on the top are more abstract.
+
+  EFI_BLOCK_IO_PROTOCOL                             EFI_SIMPLE_NETWORK_PROTOCOL
+  [OvmfPkg/VirtioBlkDxe]                              [OvmfPkg/VirtioNetDxe]
+             |                                                   |
+             |         EFI_EXT_SCSI_PASS_THRU_PROTOCOL           |
+             |             [OvmfPkg/VirtioScsiDxe]               |
+             |                        |                          |
+             +------------------------+--------------------------+
+                                      |
+                           VIRTIO_DEVICE_PROTOCOL
+                                      |
+                +---------------------+---------------------+
+                |                                           |
+  [OvmfPkg/VirtioPciDeviceDxe]                  [custom platform drivers]
+                |                                           |
+                |                                           |
+       EFI_PCI_IO_PROTOCOL                [OvmfPkg/Library/VirtioMmioDeviceLib]
+ [MdeModulePkg/Bus/Pci/PciBusDxe]              direct MMIO register access
+
+The top three drivers produce standard UEFI abstractions: the Block IO
+Protocol, the Extended SCSI Pass Thru Protocol, and the Simple Network
+Protocol, for virtio-block, virtio-scsi, and virtio-net devices, respectively.
+
+Comparing these device-specific virtio drivers to each other, we can determine:
+
+- They all conform to the UEFI Driver Model. This means that their entry point
+  functions don't immediately start to search for devices and to drive them,
+  they only register instances of the EFI_DRIVER_BINDING_PROTOCOL. The UEFI
+  Driver Model then enumerates devices and chains matching drivers
+  automatically.
+
+- They are as minimal as possible, while remaining correct (refer to source
+  code comments for details). For example, VirtioBlkDxe and VirtioScsiDxe both
+  support only one request in flight.
+
+  In theory, VirtioBlkDxe could implement EFI_BLOCK_IO2_PROTOCOL, which allows
+  queueing. Similarly, VirtioScsiDxe does not support the non-blocking mode of
+  EFI_EXT_SCSI_PASS_THRU_PROTOCOL.PassThru(). (Which is permitted by the UEFI
+  specification.) Both VirtioBlkDxe and VirtioScsiDxe delegate synchronous
+  request handling to "OvmfPkg/Library/VirtioLib". This limitation helps keep
+  the implementation simple, and testing thus far seems to imply satisfactory
+  performance, for a virtual boot firmware.
+
+  VirtioNetDxe cannot avoid queueing, because EFI_SIMPLE_NETWORK_PROTOCOL
+  requires it on the interface level. Consequently, VirtioNetDxe is
+  significantly more complex than VirtioBlkDxe and VirtioScsiDxe. Technical
+  notes are provided in "OvmfPkg/VirtioNetDxe/TechNotes.txt".
+
+- None of these drivers access hardware directly. Instead, the Virtio Device
+  Protocol (OvmfPkg/Include/Protocol/VirtioDevice.h) collects / extracts virtio
+  operations defined in the Virtio Specification, and these backend-independent
+  virtio device drivers go through the abstract VIRTIO_DEVICE_PROTOCOL.
+
+  IMPORTANT: the VIRTIO_DEVICE_PROTOCOL is not a standard UEFI protocol. It is
+  internal to edk2 and not described in the UEFI specification. It should only
+  be used by drivers and applications that live inside the edk2 source tree.
+
+Currently two providers exist for VIRTIO_DEVICE_PROTOCOL:
+
+- The first one is the "more traditional" virtio-pci backend, implemented by
+  OvmfPkg/VirtioPciDeviceDxe. This driver also complies with the UEFI Driver
+  Model. It consumes an instance of the EFI_PCI_IO_PROTOCOL, and, if the PCI
+  device/function under probing appears to be a virtio device, it produces a
+  Virtio Device Protocol instance for it. The driver translates abstract virtio
+  operations to PCI accesses.
+
+- The second provider, the virtio-mmio backend, is a library, not a driver,
+  living in OvmfPkg/Library/VirtioMmioDeviceLib. This library translates
+  abstract virtio operations to MMIO accesses.
+
+  The virtio-mmio backend is only a library -- rather than a standalone, UEFI
+  Driver Model-compliant driver -- because the type of resource it consumes, an
+  MMIO register block base address, is not enumerable.
+
+  In other words, while the PCI root bridge driver and the PCI bus driver
+  produce instances of EFI_PCI_IO_PROTOCOL automatically, thereby enabling the
+  UEFI Driver Model to probe devices and stack up drivers automatically, no
+  such enumeration exists for MMIO register blocks.
+
+  For this reason, VirtioMmioDeviceLib needs to be linked into thin, custom
+  platform drivers that dispose over this kind of information. As soon as a
+  driver knows about the MMIO register block base addresses, it can pass each
+  to the library, and then the VIRTIO_DEVICE_PROTOCOL will be instantiated
+  (assuming a valid virtio-mmio register block of course). From that point on
+  the UEFI Driver Model again takes care of the chaining.
+
+  Typically, such a custom driver does not conform to the UEFI Driver Model
+  (because that would presuppose auto-enumeration for MMIO register blocks).
+  Hence it has the following responsibilities:
+
+  - it shall behave as a "wrapper" UEFI driver around the library,
+
+  - it shall know virtio-mmio base addresses,
+
+  - in its entry point function, it shall create a new UEFI handle with an
+    instance of the EFI_DEVICE_PATH_PROTOCOL for each virtio-mmio device it
+    knows the base address for,
+
+  - it shall call VirtioMmioInstallDevice() on those handles, with the
+    corresponding base addresses.
+
+  OVMF itself does not employ VirtioMmioDeviceLib. However, the library is used
+  (or has been tested as Proof-of-Concept) in the following 64-bit and 32-bit
+  ARM emulator setups:
+
+  - in "RTSM_VE_FOUNDATIONV8_EFI.fd" and "FVP_AARCH64_EFI.fd", on ARM Holdings'
+    ARM(R) v8-A Foundation Model and ARM(R) AEMv8-A Base Platform FVP
+    emulators, respectively:
+
+                           EFI_BLOCK_IO_PROTOCOL
+                           [OvmfPkg/VirtioBlkDxe]
+                                      |
+                           VIRTIO_DEVICE_PROTOCOL
+        [ArmPlatformPkg/ArmVExpressPkg/ArmVExpressDxe/ArmFvpDxe.inf]
+                                      |
+                    [OvmfPkg/Library/VirtioMmioDeviceLib]
+                         direct MMIO register access
+
+  - in "RTSM_VE_CORTEX-A15_EFI.fd" and "RTSM_VE_CORTEX-A15_MPCORE_EFI.fd", on
+    "qemu-system-arm -M vexpress-a15":
+
+        EFI_BLOCK_IO_PROTOCOL            EFI_SIMPLE_NETWORK_PROTOCOL
+        [OvmfPkg/VirtioBlkDxe]             [OvmfPkg/VirtioNetDxe]
+                   |                                  |
+                   +------------------+---------------+
+                                      |
+                           VIRTIO_DEVICE_PROTOCOL
+        [ArmPlatformPkg/ArmVExpressPkg/ArmVExpressDxe/ArmFvpDxe.inf]
+                                      |
+                    [OvmfPkg/Library/VirtioMmioDeviceLib]
+                         direct MMIO register access
+
+  In the above ARM / VirtioMmioDeviceLib configurations, VirtioBlkDxe was
+  tested with booting Linux distributions, while VirtioNetDxe was tested with
+  pinging public IPv4 addresses from the UEFI shell.
+
+Platform Driver
+...............
+
+Sometimes, elements of persistent firmware configuration are best exposed to
+the user in a friendly way. OVMF's platform driver (OvmfPkg/PlatformDxe)
+presents such settings on the "OVMF Platform Configuration" dialog:
+
+- Press ESC on the TianoCore splash screen,
+- Navigate to Device Manager | OVMF Platform Configuration.
+
+At the moment, OVMF's platform driver handles only one setting: the preferred
+graphics resolution. This is useful for two purposes:
+
+- Some UEFI shell commands, like DRIVERS and DEVICES, benefit from a wide
+  display. Using the MODE shell command, the user can switch to a larger text
+  resolution (limited by the graphics resolution), and see the command output
+  in a more easily consumable way.
+
+  [RHEL] The list of text modes available to the MODE command is also limited
+         by ConSplitterDxe (found under MdeModulePkg/Universal/Console).
+         ConSplitterDxe builds an intersection of text modes that are
+         simultaneously supported by all consoles that ConSplitterDxe
+         multiplexes console output to.
+
+         In practice, the strongest text mode restriction comes from
+         TerminalDxe, which provides console I/O on serial ports. TerminalDxe
+         has a very limited built-in list of text modes, heavily pruning the
+         intersection built by ConSplitterDxe, and made available to the MODE
+         command.
+
+         On the Red Hat Enterprise Linux 7.1 host, TerminalDxe's list of modes
+         has been extended with text resolutions that match the Spice QXL GPU's
+         common graphics resolutions. This way a "full screen" text mode should
+         always be available in the MODE command.
+
+- The other advantage of controlling the graphics resolution lies with UEFI
+  operating systems that don't (yet) have a native driver for QEMU's virtual
+  video cards  -- eg. the Spice QXL GPU. Such OSes may choose to inherit the
+  properties of OVMF's EFI_GRAPHICS_OUTPUT_PROTOCOL (provided by
+  OvmfPkg/QemuVideoDxe, see later).
+
+  Although the display can be used at runtime in such cases, by direct
+  framebuffer access, its properties, for example, the resolution, cannot be
+  modified. The platform driver allows the user to select the preferred GOP
+  resolution, reboot, and let the guest OS inherit that preferred resolution.
+
+The platform driver has three access points: the "normal" driver entry point, a
+set of HII callbacks, and a GOP installation callback.
+
+(1) Driver entry point: the PlatformInit() function.
+
+    (a) First, this function loads any available settings, and makes them take
+        effect. For the preferred graphics resolution in particular, this means
+        setting the following PCDs:
+
+          gEfiMdeModulePkgTokenSpaceGuid.PcdVideoHorizontalResolution
+          gEfiMdeModulePkgTokenSpaceGuid.PcdVideoVerticalResolution
+
+        These PCDs influence the GraphicsConsoleDxe driver (located under
+        MdeModulePkg/Universal/Console), which switches to the preferred
+        graphics mode, and produces EFI_SIMPLE_TEXT_OUTPUT_PROTOCOLs on GOPs:
+
+                    EFI_SIMPLE_TEXT_OUTPUT_PROTOCOL
+          [MdeModulePkg/Universal/Console/GraphicsConsoleDxe]
+                                   |
+                      EFI_GRAPHICS_OUTPUT_PROTOCOL
+                         [OvmfPkg/QemuVideoDxe]
+                                   |
+                          EFI_PCI_IO_PROTOCOL
+                   [MdeModulePkg/Bus/Pci/PciBusDxe]
+
+  (b) Second, the driver entry point registers the user interface, including
+      HII callbacks.
+
+  (c) Third, the driver entry point registers a GOP installation callback.
+
+(2) HII callbacks and the user interface.
+
+    The Human Interface Infrastructure (HII) "is a set of protocols that allow
+    a UEFI driver to provide the ability to register user interface and
+    configuration content with the platform firmware".
+
+    OVMF's platform driver:
+
+    - provides a static, basic, visual form (PlatformForms.vfr), written in the
+      Visual Forms Representation language,
+
+    - includes a UCS-16 encoded message catalog (Platform.uni),
+
+    - includes source code that dynamically populates parts of the form, with
+      the help of MdeModulePkg/Library/UefiHiiLib -- this library simplifies
+      the handling of IFR (Internal Forms Representation) opcodes,
+
+    - processes form actions that the user takes (Callback() function),
+
+    - loads and saves platform configuration in a private, non-volatile
+      variable (ExtractConfig() and RouteConfig() functions).
+
+    The ExtractConfig() HII callback implements the following stack of
+    conversions, for loading configuration and presenting it to the user:
+
+          MultiConfigAltResp       -- form engine / HII communication
+                  ^
+                  |
+           [BlockToConfig]
+                  |
+           MAIN_FORM_STATE         -- binary representation of form/widget
+                  ^                   state
+                  |
+      [PlatformConfigToFormState]
+                  |
+           PLATFORM_CONFIG         -- accessible to DXE and UEFI drivers
+                  ^
+                  |
+         [PlatformConfigLoad]
+                  |
+        UEFI non-volatile variable -- accessible to external utilities
+
+    The layers are very similar for the reverse direction, ie. when taking
+    input from the user, and saving the configuration (RouteConfig() HII
+    callback):
+
+             ConfigResp            -- form engine / HII communication
+                  |
+           [ConfigToBlock]
+                  |
+                  v
+           MAIN_FORM_STATE         -- binary representation of form/widget
+                  |                   state
+      [FormStateToPlatformConfig]
+                  |
+                  v
+           PLATFORM_CONFIG         -- accessible to DXE and UEFI drivers
+                  |
+         [PlatformConfigSave]
+                  |
+                  v
+        UEFI non-volatile variable -- accessible to external utilities
+
+(3) When the platform driver starts, a GOP may not be available yet. Thus the
+    driver entry point registers a callback (the GopInstalled() function) for
+    GOP installations.
+
+    When the first GOP is produced (usually by QemuVideoDxe, or potentially by
+    a third party video driver), PlatformDxe retrieves the list of graphics
+    modes the GOP supports, and dynamically populates the drop-down list of
+    available resolutions on the form. The GOP installation callback is then
+    removed.
+
+Video driver
+............
+
+OvmfPkg/QemuVideoDxe is OVMF's built-in video driver. We can divide its
+services in two parts: graphics output protocol (primary), and Int10h (VBE)
+shim (secondary).
+
+(1) QemuVideoDxe conforms to the UEFI Driver Model; it produces an instance of
+    the EFI_GRAPHICS_OUTPUT_PROTOCOL (GOP) on each PCI display that it supports
+    and is connected to:
+
+                      EFI_GRAPHICS_OUTPUT_PROTOCOL
+                         [OvmfPkg/QemuVideoDxe]
+                                   |
+                          EFI_PCI_IO_PROTOCOL
+                   [MdeModulePkg/Bus/Pci/PciBusDxe]
+
+    It supports the following QEMU video cards:
+
+    - Cirrus 5430 ("-device cirrus-vga"),
+    - Standard VGA ("-device VGA"),
+    - QXL VGA ("-device qxl-vga", "-device qxl").
+
+    For Cirrus the following resolutions and color depths are available:
+    640x480x32, 800x600x32, 1024x768x24. On stdvga and QXL a long list of
+    resolutions is available. The list is filtered against the frame buffer
+    size during initialization.
+
+    The size of the QXL VGA compatibility framebuffer can be changed with the
+
+      -device qxl-vga,vgamem_mb=$NUM_MB
+
+    QEMU option. If $NUM_MB exceeds 32, then the following is necessary
+    instead:
+
+      -device qxl-vga,vgamem_mb=$NUM_MB,ram_size_mb=$((NUM_MB*2))
+
+    because the compatibility framebuffer can't cover more than half of PCI BAR
+    #0. The latter defaults to 64MB in size, and is controlled by the
+    "ram_size_mb" property.
+
+(2) When QemuVideoDxe binds the first Standard VGA or QXL VGA device, and there
+    is no real VGA BIOS present in the C to F segments (which could originate
+    from a legacy PCI option ROM -- refer to "Compatibility Support Module
+    (CSM)"), then QemuVideoDxe installs a minimal, "fake" VGA BIOS -- an Int10h
+    (VBE) "shim".
+
+    The shim is implemented in 16-bit assembly in
+    "OvmfPkg/QemuVideoDxe/VbeShim.asm". The "VbeShim.sh" shell script assembles
+    it and formats it as a C array ("VbeShim.h") with the help of the "nasm"
+    utility. The driver's InstallVbeShim() function copies the shim in place
+    (the C segment), and fills in the VBE Info and VBE Mode Info structures.
+    The real-mode 10h interrupt vector is pointed to the shim's handler.
+
+    The shim is (correctly) irrelevant and invisible for all UEFI operating
+    systems we know about -- except Windows Server 2008 R2 and other Windows
+    operating systems in that family.
+
+    Namely, the Windows 2008 R2 SP1 (and Windows 7) UEFI guest's default video
+    driver dereferences the real mode Int10h vector, loads the pointed-to
+    handler code, and executes what it thinks to be VGA BIOS services in an
+    internal real-mode emulator. Consequently, video mode switching used not to
+    work in Windows 2008 R2 SP1 when it ran on the "pure UEFI" build of OVMF,
+    making the guest uninstallable. Hence the (otherwise optional, non-default)
+    Compatibility Support Module (CSM) ended up a requirement for running such
+    guests.
+
+    The hard dependency on the sophisticated SeaBIOS CSM and the complex
+    supporting edk2 infrastructure, for enabling this family of guests, was
+    considered suboptimal by some members of the upstream community,
+
+    [RHEL] and was certainly considered a serious maintenance disadvantage for
+           Red Hat Enterprise Linux 7.1 hosts.
+
+    Thus, the shim has been collaboratively developed for the Windows 7 /
+    Windows Server 2008 R2 family. The shim provides a real stdvga / QXL
+    implementation for the few services that are in fact necessary for the
+    Windows 2008 R2 SP1 (and Windows 7) UEFI guest, plus some "fakes" that the
+    guest invokes but whose effect is not important. The only supported mode is
+    1024x768x32, which is enough to install the guest and then upgrade its
+    video driver to the full-featured QXL XDDM one.
+
+    The C segment is not present in the UEFI memory map prepared by OVMF.
+    Memory space that would cover it is never added (either in PEI, in the form
+    of memory resource descriptor HOBs, or in DXE, via gDS->AddMemorySpace()).
+    This way the handler body is invisible to all other UEFI guests, and the
+    rest of edk2.
+
+    The Int10h real-mode IVT entry is covered with a Boot Services Code page,
+    making that too inaccessible to the rest of edk2. Due to the allocation
+    type, UEFI guest OSes different from the Windows Server 2008 family can
+    reclaim the page at zero. (The Windows 2008 family accesses that page
+    regardless of the allocation type.)
+
+Afterword
+---------
+
+After the bulk of this document was written in July 2014, OVMF development has
+not stopped. To name two significant code contributions from the community: in
+January 2015, OVMF runs on the "q35" machine type of QEMU, and it features a
+driver for Xen paravirtual block devices (and another for the underlying Xen
+bus).
+
+Furthermore, a dedicated virtualization platform has been contributed to
+ArmPlatformPkg that plays a role parallel to OvmfPkg's. It targets the "virt"
+machine type of qemu-system-arm and qemu-system-aarch64. Parts of OvmfPkg are
+being refactored and modularized so they can be reused in
+"ArmPlatformPkg/ArmVirtualizationPkg/ArmVirtualizationQemu.dsc".
diff --git a/SPECS/edk2.spec b/SPECS/edk2.spec
new file mode 100644
index 0000000..562882d
--- /dev/null
+++ b/SPECS/edk2.spec
@@ -0,0 +1,1177 @@
+ExclusiveArch: x86_64 aarch64
+
+%define GITDATE        20190829
+%define GITCOMMIT      37eef91017ad
+%define TOOLCHAIN      GCC5
+%define OPENSSL_VER    1.1.1c
+
+Name:       edk2
+Version:    %{GITDATE}git%{GITCOMMIT}
+Release:    9%{?dist}
+Summary:    UEFI firmware for 64-bit virtual machines
+Group:      Applications/Emulators
+License:    BSD-2-Clause-Patent and OpenSSL and MIT
+URL:        http://www.tianocore.org
+
+# The source tarball is created using following commands:
+# COMMIT=%{GITCOMMIT}
+# git archive --format=tar --prefix=edk2-$COMMIT/ $COMMIT \
+# | xz -9ev >/tmp/edk2-$COMMIT.tar.xz
+Source0: http://batcave.lab.eng.brq.redhat.com/www/edk2-%{GITCOMMIT}.tar.xz
+Source1: ovmf-whitepaper-c770f8c.txt
+Source2: openssl-rhel-d6c0e6e28ddc793474a3f9234eed50018f6c94ba.tar.xz
+Source3: ovmf-vars-generator
+Source4: LICENSE.qosb
+Source5: RedHatSecureBootPkKek1.pem
+
+Source10: edk2-aarch64-verbose.json
+Source11: edk2-aarch64.json
+Source12: edk2-ovmf-sb.json
+Source13: edk2-ovmf.json
+
+Patch0001: 0001-CryptoPkg-OpensslLib-Update-process_files.pl-to-gene.patch
+Patch0002: 0002-CryptoPkg-Upgrade-OpenSSL-to-1.1.1d.patch
+Patch0006: 0006-advertise-OpenSSL-on-TianoCore-splash-screen-boot-lo.patch
+Patch0007: 0007-OvmfPkg-increase-max-debug-message-length-to-512-RHE.patch
+Patch0008: 0008-OvmfPkg-QemuVideoDxe-enable-debug-messages-in-VbeShi.patch
+Patch0009: 0009-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch
+Patch0010: 0010-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
+Patch0011: 0011-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
+Patch0012: 0012-ArmVirtPkg-QemuFwCfgLib-allow-UEFI_DRIVER-client-mod.patch
+Patch0013: 0013-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
+Patch0014: 0014-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch
+Patch0015: 0015-ArmPlatformPkg-introduce-fixed-PCD-for-early-hello-m.patch
+Patch0016: 0016-ArmPlatformPkg-PrePeiCore-write-early-hello-message-.patch
+Patch0017: 0017-ArmVirtPkg-set-early-hello-message-RH-only.patch
+Patch0018: 0018-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+Patch0019: 0019-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+Patch0020: 0020-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+Patch0021: 0021-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+Patch0022: 0022-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+Patch0033: 0033-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
+# For bz#1536624 - HTTPS enablement in OVMF
+Patch34: edk2-MdePkg-Include-Protocol-Tls.h-Add-the-data-type-of-E.patch
+# For bz#1536624 - HTTPS enablement in OVMF
+Patch35: edk2-CryptoPkg-TlsLib-Add-the-new-API-TlsSetVerifyHost-CV.patch
+# For bz#1536624 - HTTPS enablement in OVMF
+Patch36: edk2-CryptoPkg-Crt-turn-strchr-into-a-function-CVE-2019-1.patch
+# For bz#1536624 - HTTPS enablement in OVMF
+Patch37: edk2-CryptoPkg-Crt-satisfy-inet_pton.c-dependencies-CVE-2.patch
+# For bz#1536624 - HTTPS enablement in OVMF
+Patch38: edk2-CryptoPkg-Crt-import-inet_pton.c-CVE-2019-14553.patch
+# For bz#1536624 - HTTPS enablement in OVMF
+Patch39: edk2-CryptoPkg-TlsLib-TlsSetVerifyHost-parse-IP-address-l.patch
+# For bz#1536624 - HTTPS enablement in OVMF
+Patch40: edk2-NetworkPkg-TlsDxe-Add-the-support-of-host-validation.patch
+# For bz#1536624 - HTTPS enablement in OVMF
+Patch41: edk2-NetworkPkg-HttpDxe-Set-the-HostName-for-the-verifica.patch
+# For bz#1789797 - Backport upstream patch series: "UefiBootManagerLib, HttpDxe: tweaks for large HTTP(S) downloads" to improve HTTP(S) Boot experience with large (4GiB+) files
+Patch42: edk2-MdeModulePkg-UefiBootManagerLib-log-reserved-mem-all.patch
+# For bz#1789797 - Backport upstream patch series: "UefiBootManagerLib, HttpDxe: tweaks for large HTTP(S) downloads" to improve HTTP(S) Boot experience with large (4GiB+) files
+Patch43: edk2-NetworkPkg-HttpDxe-fix-32-bit-truncation-in-HTTPS-do.patch
+# For bz#1789335 - VM with edk2 can't boot when setting memory with '-m 2001'
+Patch44: edk2-UefiCpuPkg-PiSmmCpuDxeSmm-fix-2M-4K-page-splitting-r.patch
+# For bz#1751993 - DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8]
+Patch45: edk2-SecurityPkg-Fix-spelling-errors-PARTIAL-PICK.patch
+# For bz#1751993 - DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8]
+Patch46: edk2-SecurityPkg-DxeImageVerificationHandler-simplify-Ver.patch
+# For bz#1751993 - DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8]
+Patch47: edk2-SecurityPkg-DxeImageVerificationHandler-remove-else-.patch
+# For bz#1751993 - DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8]
+Patch48: edk2-SecurityPkg-DxeImageVerificationHandler-keep-PE-COFF.patch
+# For bz#1751993 - DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8]
+Patch49: edk2-SecurityPkg-DxeImageVerificationHandler-narrow-down-.patch
+# For bz#1751993 - DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8]
+Patch50: edk2-SecurityPkg-DxeImageVerificationHandler-fix-retval-o.patch
+# For bz#1751993 - DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8]
+Patch51: edk2-SecurityPkg-DxeImageVerificationHandler-remove-super.patch
+# For bz#1751993 - DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8]
+Patch52: edk2-SecurityPkg-DxeImageVerificationHandler-unnest-AddIm.patch
+# For bz#1751993 - DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8]
+Patch53: edk2-SecurityPkg-DxeImageVerificationHandler-eliminate-St.patch
+# For bz#1751993 - DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8]
+Patch54: edk2-SecurityPkg-DxeImageVerificationHandler-fix-retval-f.patch
+# For bz#1751993 - DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8]
+Patch55: edk2-SecurityPkg-DxeImageVerificationHandler-fix-imgexec-.patch
+# For bz#1751993 - DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8]
+Patch56: edk2-SecurityPkg-DxeImageVerificationHandler-fix-defer-vs.patch
+# For bz#1801274 - CVE-2019-14563 edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib [rhel-8]
+Patch57: edk2-MdeModulePkg-Enable-Disable-S3BootScript-dynamically.patch
+# For bz#1801274 - CVE-2019-14563 edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib [rhel-8]
+Patch58: edk2-MdeModulePkg-PiDxeS3BootScriptLib-Fix-potential-nume.patch
+# For bz#1806359 - bochs-display cannot show graphic wihout driver attach
+Patch59: edk2-OvmfPkg-QemuVideoDxe-unbreak-secondary-vga-and-bochs.patch
+
+
+# python3-devel and libuuid-devel are required for building tools.
+# python3-devel is also needed for varstore template generation and
+# verification with "ovmf-vars-generator".
+BuildRequires:  python3-devel
+BuildRequires:  libuuid-devel
+BuildRequires:  /usr/bin/iasl
+BuildRequires:  binutils gcc git
+
+%ifarch x86_64
+# Only OVMF includes 80x86 assembly files (*.nasm*).
+BuildRequires:  nasm
+
+# Only OVMF includes the Secure Boot feature, for which we need to separate out
+# the UEFI shell.
+BuildRequires:  dosfstools
+BuildRequires:  mtools
+BuildRequires:  genisoimage
+
+# For generating the variable store template with the default certificates
+# enrolled, we need qemu-kvm.
+BuildRequires:  qemu-kvm >= 2.12.0-89
+
+# For verifying SB enablement in the above variable store template, we need a
+# guest kernel that prints "Secure boot enabled".
+BuildRequires: kernel-core >= 4.18.0-161
+BuildRequires: rpmdevtools
+
+%package ovmf
+Summary:    UEFI firmware for x86_64 virtual machines
+BuildArch:  noarch
+Provides:   OVMF = %{version}-%{release}
+Obsoletes:  OVMF < 20180508-100.gitee3198e672e2.el7
+
+# OVMF includes the Secure Boot and IPv6 features; it has a builtin OpenSSL
+# library.
+Provides:   bundled(openssl) = %{OPENSSL_VER}
+License:    BSD-2-Clause-Patent and OpenSSL
+
+# URL taken from the Maintainers.txt file.
+URL:        http://www.tianocore.org/ovmf/
+
+%description ovmf
+OVMF (Open Virtual Machine Firmware) is a project to enable UEFI support for
+Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU
+and KVM.
+
+%else
+%package aarch64
+Summary:    UEFI firmware for aarch64 virtual machines
+BuildArch:  noarch
+Provides:   AAVMF = %{version}-%{release}
+Obsoletes:  AAVMF < 20180508-100.gitee3198e672e2.el7
+
+# No Secure Boot for AAVMF yet, but we include OpenSSL for the IPv6 stack.
+Provides:   bundled(openssl) = %{OPENSSL_VER}
+License:    BSD-2-Clause-Patent and OpenSSL
+
+# URL taken from the Maintainers.txt file.
+URL:        https://github.com/tianocore/tianocore.github.io/wiki/ArmVirtPkg
+
+%description aarch64
+AAVMF (ARM Architecture Virtual Machine Firmware) is an EFI Development Kit II
+platform that enables UEFI support for QEMU/KVM ARM Virtual Machines. This
+package contains a 64-bit build.
+%endif
+
+%package tools
+Summary:        EFI Development Kit II Tools
+Group:          Development/Tools
+License:        BSD-2-Clause-Patent
+URL:            https://github.com/tianocore/tianocore.github.io/wiki/BaseTools
+%description tools
+This package provides tools that are needed to
+build EFI executables and ROMs using the GNU tools.
+
+%package tools-doc
+Summary:        Documentation for EFI Development Kit II Tools
+Group:          Development/Tools
+BuildArch:      noarch
+License:        BSD-2-Clause-Patent
+URL:            https://github.com/tianocore/tianocore.github.io/wiki/BaseTools
+%description tools-doc
+This package documents the tools that are needed to
+build EFI executables and ROMs using the GNU tools.
+
+%description
+EDK II is a modern, feature-rich, cross-platform firmware development
+environment for the UEFI and PI specifications. This package contains sample
+64-bit UEFI firmware builds for QEMU and KVM.
+
+%prep
+%setup -q -n edk2-%{GITCOMMIT}
+
+%{lua:
+    tmp = os.tmpname();
+    f = io.open(tmp, "w+");
+    count = 0;
+    for i, p in ipairs(patches) do
+        f:write(p.."\n");
+        count = count + 1;
+    end;
+    f:close();
+    print("PATCHCOUNT="..count.."\n")
+    print("PATCHLIST="..tmp.."\n")
+}
+
+git init -q
+git config user.name rpm-build
+git config user.email rpm-build
+git config core.whitespace cr-at-eol
+git config am.keepcr true
+git add -A .
+git commit -q -a --author 'rpm-build <rpm-build>' \
+           -m '%{name}-%{GITCOMMIT} base'
+
+COUNT=$(grep '\.patch$' $PATCHLIST | wc -l)
+if [ $COUNT -ne $PATCHCOUNT ]; then
+    echo "Found $COUNT patches in $PATCHLIST, expected $PATCHCOUNT"
+    exit 1
+fi
+if [ $COUNT -gt 0 ]; then
+    for pf in `cat $PATCHLIST`; do
+      git am $pf
+    done
+fi
+echo "Applied $COUNT patches"
+rm -f $PATCHLIST
+
+cp -a -- %{SOURCE1} %{SOURCE3} .
+cp -a -- %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} .
+tar -C CryptoPkg/Library/OpensslLib -a -f %{SOURCE2} -x
+
+# Format the Red Hat-issued certificate that is to be enrolled as both Platform
+# Key and first Key Exchange Key, as an SMBIOS OEM String. This means stripping
+# the PEM header and footer, and prepending the textual representation of the
+# GUID that identifies this particular OEM String to "EnrollDefaultKeys.efi",
+# plus the separator ":". For details, see
+# <https://bugzilla.tianocore.org/show_bug.cgi?id=1747> comments 2, 7, 14.
+sed \
+  -e 's/^-----BEGIN CERTIFICATE-----$/4e32566d-8e9e-4f52-81d3-5bb9715f9727:/' \
+  -e '/^-----END CERTIFICATE-----$/d' \
+  %{SOURCE5} \
+  > PkKek1.oemstr
+
+# Done by %setup, but we do not use it for the auxiliary tarballs
+chmod -Rf a+rX,u+w,g-w,o-w .
+
+%build
+export PYTHON_COMMAND=%{__python3}
+source ./edksetup.sh
+make -C "$EDK_TOOLS_PATH" \
+  EXTRA_OPTFLAGS="%{optflags}" \
+  EXTRA_LDFLAGS="%{__global_ldflags}"
+
+SMP_MFLAGS="%{?_smp_mflags}"
+if [[ x"$SMP_MFLAGS" = x-j* ]]; then
+        CC_FLAGS="$CC_FLAGS -n ${SMP_MFLAGS#-j}"
+elif [ -n "%{?jobs}" ]; then
+        CC_FLAGS="$CC_FLAGS -n %{?jobs}"
+fi
+
+CC_FLAGS="$CC_FLAGS --cmd-len=65536 -t %{TOOLCHAIN} -b DEBUG --hash"
+CC_FLAGS="$CC_FLAGS -D NETWORK_IP6_ENABLE"
+CC_FLAGS="$CC_FLAGS -D NETWORK_HTTP_BOOT_ENABLE -D NETWORK_TLS_ENABLE"
+
+%ifarch x86_64
+# Build with neither SB nor SMM; include UEFI shell.
+build ${CC_FLAGS} -D TPM2_ENABLE -D FD_SIZE_4MB -a X64 \
+  -p OvmfPkg/OvmfPkgX64.dsc
+
+# Build with SB and SMM; exclude UEFI shell.
+build -D SECURE_BOOT_ENABLE -D EXCLUDE_SHELL_FROM_FD ${CC_FLAGS} \
+  -a IA32 -a X64 -p OvmfPkg/OvmfPkgIa32X64.dsc -D SMM_REQUIRE \
+  -D TPM2_ENABLE -D FD_SIZE_4MB
+
+# Sanity check: the varstore templates must be identical.
+cmp Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
+  Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd
+
+# Prepare an ISO image that boots the UEFI shell.
+(
+  UEFI_SHELL_BINARY=Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/Shell.efi
+  ENROLLER_BINARY=Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/EnrollDefaultKeys.efi
+  UEFI_SHELL_IMAGE=uefi_shell.img
+  ISO_IMAGE=UefiShell.iso
+
+  UEFI_SHELL_BINARY_BNAME=$(basename -- "$UEFI_SHELL_BINARY")
+  UEFI_SHELL_SIZE=$(stat --format=%s -- "$UEFI_SHELL_BINARY")
+  ENROLLER_SIZE=$(stat --format=%s -- "$ENROLLER_BINARY")
+
+  # add 1MB then 10% for metadata
+  UEFI_SHELL_IMAGE_KB=$((
+    (UEFI_SHELL_SIZE + ENROLLER_SIZE + 1 * 1024 * 1024) * 11 / 10 / 1024
+  ))
+
+  # create non-partitioned FAT image
+  rm -f -- "$UEFI_SHELL_IMAGE"
+  mkdosfs -C "$UEFI_SHELL_IMAGE" -n UEFI_SHELL -- "$UEFI_SHELL_IMAGE_KB"
+
+  # copy the shell binary into the FAT image
+  export MTOOLS_SKIP_CHECK=1
+  mmd   -i "$UEFI_SHELL_IMAGE"                       ::efi
+  mmd   -i "$UEFI_SHELL_IMAGE"                       ::efi/boot
+  mcopy -i "$UEFI_SHELL_IMAGE"  "$UEFI_SHELL_BINARY" ::efi/boot/bootx64.efi
+  mcopy -i "$UEFI_SHELL_IMAGE"  "$ENROLLER_BINARY"   ::
+  mdir  -i "$UEFI_SHELL_IMAGE"  -/                   ::
+
+  # build ISO with FAT image file as El Torito EFI boot image
+  genisoimage -input-charset ASCII -J -rational-rock \
+    -efi-boot "$UEFI_SHELL_IMAGE" -no-emul-boot \
+    -o "$ISO_IMAGE" -- "$UEFI_SHELL_IMAGE"
+)
+
+# Enroll the default certificates in a separate variable store template.
+%{__python3} ovmf-vars-generator --verbose --verbose \
+  --qemu-binary        /usr/libexec/qemu-kvm \
+  --ovmf-binary        Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
+  --ovmf-template-vars Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
+  --uefi-shell-iso     UefiShell.iso \
+  --oem-string         "$(< PkKek1.oemstr)" \
+  --skip-testing \
+  OVMF_VARS.secboot.fd
+
+%else
+# Build with a verbose debug mask first, and stash the binary.
+build ${CC_FLAGS} -a AARCH64 \
+  -p ArmVirtPkg/ArmVirtQemu.dsc \
+  -D DEBUG_PRINT_ERROR_LEVEL=0x8040004F
+cp -a Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
+  QEMU_EFI.verbose.fd
+
+# Rebuild with a silent (errors only) debug mask.
+build ${CC_FLAGS} -a AARCH64 \
+  -p ArmVirtPkg/ArmVirtQemu.dsc \
+  -D DEBUG_PRINT_ERROR_LEVEL=0x80000000
+%endif
+
+%install
+
+cp -a OvmfPkg/License.txt License.OvmfPkg.txt
+mkdir -p $RPM_BUILD_ROOT%{_datadir}/qemu/firmware
+
+%ifarch x86_64
+mkdir -p \
+  $RPM_BUILD_ROOT%{_datadir}/OVMF \
+  $RPM_BUILD_ROOT%{_datadir}/%{name}/ovmf
+
+# We don't ship the SB-less, SMM-less binary.
+%if 0
+install -m 0644 Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
+  $RPM_BUILD_ROOT%{_datadir}/%{name}/ovmf/OVMF_CODE.fd
+ln -s ../%{name}/ovmf/OVMF_CODE.fd         $RPM_BUILD_ROOT%{_datadir}/OVMF/
+%endif
+install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
+  $RPM_BUILD_ROOT%{_datadir}/%{name}/ovmf/OVMF_CODE.secboot.fd
+
+install -m 0644 Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
+  $RPM_BUILD_ROOT%{_datadir}/%{name}/ovmf/OVMF_VARS.fd
+install -m 0644 OVMF_VARS.secboot.fd \
+  $RPM_BUILD_ROOT%{_datadir}/%{name}/ovmf/OVMF_VARS.secboot.fd
+install -m 0644 UefiShell.iso \
+  $RPM_BUILD_ROOT%{_datadir}/%{name}/ovmf/UefiShell.iso
+
+ln -s ../%{name}/ovmf/OVMF_CODE.secboot.fd $RPM_BUILD_ROOT%{_datadir}/OVMF/
+ln -s ../%{name}/ovmf/OVMF_VARS.fd         $RPM_BUILD_ROOT%{_datadir}/OVMF/
+ln -s ../%{name}/ovmf/OVMF_VARS.secboot.fd $RPM_BUILD_ROOT%{_datadir}/OVMF/
+ln -s ../%{name}/ovmf/UefiShell.iso        $RPM_BUILD_ROOT%{_datadir}/OVMF/
+
+install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/Shell.efi \
+  $RPM_BUILD_ROOT%{_datadir}/%{name}/ovmf/Shell.efi
+install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/EnrollDefaultKeys.efi \
+  $RPM_BUILD_ROOT%{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi
+
+install -m 0644 edk2-ovmf-sb.json \
+  $RPM_BUILD_ROOT%{_datadir}/qemu/firmware/40-edk2-ovmf-sb.json
+install -m 0644 edk2-ovmf.json \
+  $RPM_BUILD_ROOT%{_datadir}/qemu/firmware/50-edk2-ovmf.json
+
+%else
+mkdir -p \
+  $RPM_BUILD_ROOT%{_datadir}/AAVMF \
+  $RPM_BUILD_ROOT%{_datadir}/%{name}/aarch64
+
+# Pad and install the verbose binary.
+cat QEMU_EFI.verbose.fd \
+  /dev/zero \
+| head -c 64m \
+  > $RPM_BUILD_ROOT%{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.raw
+
+# Pad and install the silent (default) binary.
+cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
+  /dev/zero \
+| head -c 64m \
+  > $RPM_BUILD_ROOT%{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.raw
+
+# Create varstore template.
+cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_VARS.fd \
+  /dev/zero \
+| head -c 64m \
+  > $RPM_BUILD_ROOT%{_datadir}/%{name}/aarch64/vars-template-pflash.raw
+
+ln -s ../%{name}/aarch64/QEMU_EFI-pflash.raw \
+  $RPM_BUILD_ROOT%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
+ln -s ../%{name}/aarch64/QEMU_EFI-silent-pflash.raw \
+  $RPM_BUILD_ROOT%{_datadir}/AAVMF/AAVMF_CODE.fd
+ln -s ../%{name}/aarch64/vars-template-pflash.raw \
+  $RPM_BUILD_ROOT%{_datadir}/AAVMF/AAVMF_VARS.fd
+
+chmod 0644 -- $RPM_BUILD_ROOT%{_datadir}/AAVMF/AAVMF_*.fd
+
+install -m 0644 QEMU_EFI.verbose.fd \
+  $RPM_BUILD_ROOT%{_datadir}/%{name}/aarch64/QEMU_EFI.fd
+install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
+  $RPM_BUILD_ROOT%{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd
+install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_VARS.fd \
+  $RPM_BUILD_ROOT%{_datadir}/%{name}/aarch64/QEMU_VARS.fd
+
+install -m 0644 edk2-aarch64.json \
+  $RPM_BUILD_ROOT%{_datadir}/qemu/firmware/60-edk2-aarch64.json
+install -m 0644 edk2-aarch64-verbose.json \
+  $RPM_BUILD_ROOT%{_datadir}/qemu/firmware/70-edk2-aarch64-verbose.json
+
+%endif
+
+cp -a CryptoPkg/Library/OpensslLib/openssl/LICENSE LICENSE.openssl
+
+# install the tools
+mkdir -p %{buildroot}%{_bindir} \
+         %{buildroot}%{_datadir}/%{name}/Conf \
+         %{buildroot}%{_datadir}/%{name}/Scripts
+install BaseTools/Source/C/bin/* \
+        %{buildroot}%{_bindir}
+install BaseTools/BinWrappers/PosixLike/LzmaF86Compress \
+        %{buildroot}%{_bindir}
+install BaseTools/BuildEnv \
+        %{buildroot}%{_datadir}/%{name}
+install BaseTools/Conf/*.template \
+        %{buildroot}%{_datadir}/%{name}/Conf
+install BaseTools/Scripts/GccBase.lds \
+        %{buildroot}%{_datadir}/%{name}/Scripts
+
+%ifarch x86_64
+%files ovmf
+%else
+%files aarch64
+%endif
+
+%defattr(-,root,root,-)
+%license License.txt
+%license License.OvmfPkg.txt
+%license License-History.txt
+%license LICENSE.openssl
+%dir %{_datadir}/%{name}/
+%dir %{_datadir}/qemu
+%dir %{_datadir}/qemu/firmware
+
+%ifarch x86_64
+%doc OvmfPkg/README
+%doc ovmf-whitepaper-c770f8c.txt
+%dir %{_datadir}/OVMF/
+%dir %{_datadir}/%{name}/ovmf/
+%if 0
+%{_datadir}/%{name}/ovmf/OVMF_CODE.fd
+%{_datadir}/OVMF/OVMF_CODE.fd
+%endif
+%{_datadir}/%{name}/ovmf/OVMF_CODE.secboot.fd
+%{_datadir}/%{name}/ovmf/OVMF_VARS.fd
+%{_datadir}/%{name}/ovmf/OVMF_VARS.secboot.fd
+%{_datadir}/%{name}/ovmf/UefiShell.iso
+%{_datadir}/OVMF/OVMF_CODE.secboot.fd
+%{_datadir}/OVMF/OVMF_VARS.fd
+%{_datadir}/OVMF/OVMF_VARS.secboot.fd
+%{_datadir}/OVMF/UefiShell.iso
+%{_datadir}/%{name}/ovmf/Shell.efi
+%{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi
+%{_datadir}/qemu/firmware/40-edk2-ovmf-sb.json
+%{_datadir}/qemu/firmware/50-edk2-ovmf.json
+
+%else
+%dir %{_datadir}/AAVMF/
+%dir %{_datadir}/%{name}/aarch64/
+%{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.raw
+%{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.raw
+%{_datadir}/%{name}/aarch64/vars-template-pflash.raw
+%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
+%{_datadir}/AAVMF/AAVMF_CODE.fd
+%{_datadir}/AAVMF/AAVMF_VARS.fd
+%{_datadir}/%{name}/aarch64/QEMU_EFI.fd
+%{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd
+%{_datadir}/%{name}/aarch64/QEMU_VARS.fd
+%{_datadir}/qemu/firmware/60-edk2-aarch64.json
+%{_datadir}/qemu/firmware/70-edk2-aarch64-verbose.json
+%endif
+
+%files tools
+%license License.txt
+%license License-History.txt
+%{_bindir}/Brotli
+%{_bindir}/DevicePath
+%{_bindir}/EfiRom
+%{_bindir}/GenCrc32
+%{_bindir}/GenFfs
+%{_bindir}/GenFv
+%{_bindir}/GenFw
+%{_bindir}/GenSec
+%{_bindir}/LzmaCompress
+%{_bindir}/LzmaF86Compress
+%{_bindir}/Split
+%{_bindir}/TianoCompress
+%{_bindir}/VfrCompile
+%{_bindir}/VolInfo
+%dir %{_datadir}/%{name}
+%{_datadir}/%{name}/BuildEnv
+%{_datadir}/%{name}/Conf
+%{_datadir}/%{name}/Scripts
+
+%files tools-doc
+%doc BaseTools/UserManuals/*.rtf
+
+%check
+
+%ifarch x86_64
+# Of the installed host kernels, boot the one with the highest Version-Release
+# under OVMF, and check if it prints "Secure boot enabled".
+KERNEL_PKG=$(rpm -q kernel-core | rpmdev-sort | tail -n 1)
+KERNEL_IMG=$(rpm -q -l $KERNEL_PKG | egrep '^/lib/modules/[^/]+/vmlinuz$')
+
+%{__python3} ovmf-vars-generator --verbose --verbose \
+  --qemu-binary        /usr/libexec/qemu-kvm \
+  --ovmf-binary        Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
+  --ovmf-template-vars Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
+  --uefi-shell-iso     UefiShell.iso \
+  --kernel-path        $KERNEL_IMG \
+  --skip-enrollment \
+  --no-download \
+  OVMF_VARS.secboot.fd
+
+%else
+true
+
+%endif
+
+%changelog
+* Fri Mar 27 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-9.el8
+- edk2-OvmfPkg-QemuVideoDxe-unbreak-secondary-vga-and-bochs.patch [bz#1806359]
+- Resolves: bz#1806359
+  (bochs-display cannot show graphic wihout driver attach)
+
+* Tue Feb 18 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-8.el8
+- edk2-MdeModulePkg-Enable-Disable-S3BootScript-dynamically.patch [bz#1801274]
+- edk2-MdeModulePkg-PiDxeS3BootScriptLib-Fix-potential-nume.patch [bz#1801274]
+- Resolves: bz#1801274
+  (CVE-2019-14563 edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib [rhel-8])
+
+* Tue Feb 11 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-7.el8
+- edk2-SecurityPkg-Fix-spelling-errors-PARTIAL-PICK.patch [bz#1751993]
+- edk2-SecurityPkg-DxeImageVerificationHandler-simplify-Ver.patch [bz#1751993]
+- edk2-SecurityPkg-DxeImageVerificationHandler-remove-else-.patch [bz#1751993]
+- edk2-SecurityPkg-DxeImageVerificationHandler-keep-PE-COFF.patch [bz#1751993]
+- edk2-SecurityPkg-DxeImageVerificationHandler-narrow-down-.patch [bz#1751993]
+- edk2-SecurityPkg-DxeImageVerificationHandler-fix-retval-o.patch [bz#1751993]
+- edk2-SecurityPkg-DxeImageVerificationHandler-remove-super.patch [bz#1751993]
+- edk2-SecurityPkg-DxeImageVerificationHandler-unnest-AddIm.patch [bz#1751993]
+- edk2-SecurityPkg-DxeImageVerificationHandler-eliminate-St.patch [bz#1751993]
+- edk2-SecurityPkg-DxeImageVerificationHandler-fix-retval-f.patch [bz#1751993]
+- edk2-SecurityPkg-DxeImageVerificationHandler-fix-imgexec-.patch [bz#1751993]
+- edk2-SecurityPkg-DxeImageVerificationHandler-fix-defer-vs.patch [bz#1751993]
+- Resolves: bz#1751993
+  (DxeImageVerificationLib handles "DENY execute on security violation" like "DEFER execute on security violation" [rhel8])
+
+* Tue Jan 21 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-6.el8
+- edk2-UefiCpuPkg-PiSmmCpuDxeSmm-fix-2M-4K-page-splitting-r.patch [bz#1789335]
+- Resolves: bz#1789335
+  (VM with edk2 can't boot when setting memory with '-m 2001')
+
+* Thu Jan 16 2020 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-5.el8
+- edk2-MdeModulePkg-UefiBootManagerLib-log-reserved-mem-all.patch [bz#1789797]
+- edk2-NetworkPkg-HttpDxe-fix-32-bit-truncation-in-HTTPS-do.patch [bz#1789797]
+- Resolves: bz#1789797
+  (Backport upstream patch series: "UefiBootManagerLib, HttpDxe: tweaks for large HTTP(S) downloads" to improve HTTP(S) Boot experience with large (4GiB+) files)
+
+* Wed Dec 11 2019 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-4.el8
+- edk2-redhat-set-guest-RAM-size-to-768M-for-SB-varstore-te.patch [bz#1778301]
+- edk2-redhat-re-enable-Secure-Boot-varstore-template-verif.patch [bz#1778301]
+- Resolves: bz#1778301
+  (re-enable Secure Boot (varstore template) verification in %check)
+
+* Thu Dec 05 2019 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-3.el8
+- Update used openssl version [bz#1616029]
+- Resolves: bz#1616029
+  (rebuild edk2 against the final RHEL-8.2.0 version of OpenSSL-1.1.1)
+
+* Mon Dec 02 2019 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-2.el8
+- edk2-MdePkg-Include-Protocol-Tls.h-Add-the-data-type-of-E.patch [bz#1536624]
+- edk2-CryptoPkg-TlsLib-Add-the-new-API-TlsSetVerifyHost-CV.patch [bz#1536624]
+- edk2-CryptoPkg-Crt-turn-strchr-into-a-function-CVE-2019-1.patch [bz#1536624]
+- edk2-CryptoPkg-Crt-satisfy-inet_pton.c-dependencies-CVE-2.patch [bz#1536624]
+- edk2-CryptoPkg-Crt-import-inet_pton.c-CVE-2019-14553.patch [bz#1536624]
+- edk2-CryptoPkg-TlsLib-TlsSetVerifyHost-parse-IP-address-l.patch [bz#1536624]
+- edk2-NetworkPkg-TlsDxe-Add-the-support-of-host-validation.patch [bz#1536624]
+- edk2-NetworkPkg-HttpDxe-Set-the-HostName-for-the-verifica.patch [bz#1536624]
+- edk2-redhat-enable-HTTPS-Boot.patch [bz#1536624]
+- Resolves: bz#1536624
+  (HTTPS enablement in OVMF)
+
+* Fri Nov 29 2019 Miroslav Rezanina <mrezanin@redhat.com> - 20190829git37eef91017ad-1.el8
+- Rebase to edk2-stable201908 [bz#1748180]
+- Resolves: bz#1748180
+  ((edk2-rebase-rhel-8.2) - rebase edk2 to upstream tag edk2-stable201908 for RHEL-8.2)
+
+* Mon Aug 05 2019 Miroslav Rezanina <mrezanin@redhat.com> - 20190308git89910a39dcfd-6.el8
+- edk2-ArmVirtPkg-silence-DEBUG_VERBOSE-masking-0x00400000-.patch [bz#1714446]
+- edk2-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch [bz#1714446]
+- edk2-ArmPkg-DebugPeCoffExtraActionLib-debugger-commands-a.patch [bz#1714446]
+- Resolves: bz#1714446
+  (edk2-aarch64 silent build is not silent enough)
+
+* Tue Jul 02 2019 Miroslav Rezanina <mrezanin@redhat.com> - 20190308git89910a39dcfd-5.el8
+- edk2-redhat-add-D-TPM2_ENABLE-to-the-edk2-ovmf-build-flag.patch [bz#1693205]
+- Resolves: bz#1693205
+  (edk2: Enable TPM2 support)
+
+* Tue Jun 11 2019 Miroslav Rezanina <mrezanin@redhat.com> - 20190308git89910a39dcfd-4.el8
+- edk2-OvmfPkg-raise-the-PCIEXBAR-base-to-2816-MB-on-Q35.patch [bz#1666941]
+- edk2-OvmfPkg-PlatformPei-set-32-bit-UC-area-at-PciBase-Pc.patch [bz#1666941]
+- Resolves: bz#1666941
+  (UEFI guest cannot boot into os when setting some special memory size)
+
+* Tue Apr 09 2019 Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 20190308git89910a39dcfd-2.el8
+- edk2-redhat-provide-firmware-descriptor-meta-files.patch [bz#1600230]
+- Resolves: bz#1600230
+  ([RHEL 8.1] RFE: provide firmware descriptor meta-files for the edk2-ovmf and edk2-aarch64 firmware images)
+
+* Mon Apr 08 2019 Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 20190308git89910a39dcfd-1.el8
+- Rebase to edk2-20190308git89910a39dcfd
+
+* Mon Jan 21 2019 Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 20180508gitee3198e672e2-9.el8
+- edk2-BaseTools-Fix-UEFI-and-Tiano-Decompression-logic-iss.patch [bz#1662184]
+- edk2-MdePkg-BaseUefiDecompressLib-Fix-UEFI-Decompression-.patch [bz#1662184]
+- edk2-IntelFrameworkModulePkg-Fix-UEFI-and-Tiano-Decompres.patch [bz#1662184]
+- edk2-git-Use-HTTPS-support.patch []
+- Resolves: bz#1662184
+  (backport fix for (theoretical?) regression introduced by earlier CVE fixes)
+
+* Wed Nov 21 2018 Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 20180508gitee3198e672e2-8.el8
+- edk2-NetworkPkg-UefiPxeBcDxe-Add-EXCLUSIVE-attribute-when.patch [bz#1643377]
+- Resolves: bz#1643377
+  (Exception when grubx64.efi used for UEFI netboot)
+
+* Tue Nov 06 2018 Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 20180508gitee3198e672e2-5.el8
+- edk2-MdeModulePkg-Variable-Fix-Timestamp-zeroing-issue-on.patch [bz#1641436]
+- edk2-MdePkg-Add-more-checker-in-UefiDecompressLib-to-acce.patch [bz#1641449 bz#1641453 bz#1641464 bz#1641469]
+- edk2-IntelFrameworkModulePkg-Add-more-checker-in-UefiTian.patch [bz#1641453 bz#1641464 bz#1641469]
+- edk2-BaseTools-Add-more-checker-in-Decompress-algorithm-t.patch [bz#1641445 bz#1641453 bz#1641464 bz#1641469]
+- Resolves: bz#1641436
+  (CVE-2018-3613 edk2: Logic error in MdeModulePkg in EDK II firmware allows for privilege escalation by authenticated users [rhel-8])
+- Resolves: bz#1641445
+  (CVE-2017-5731 edk2: Privilege escalation via processing of malformed files in TianoCompress.c [rhel-8])
+- Resolves: bz#1641449
+  (CVE-2017-5732 edk2: Privilege escalation via processing of malformed files in BaseUefiDecompressLib.c [rhel-8])
+- Resolves: bz#1641453
+  (CVE-2017-5733 edk2: Privilege escalation via heap-based buffer overflow in MakeTable() function [rhel-8])
+- Resolves: bz#1641464
+  (CVE-2017-5734 edk2: Privilege escalation via stack-based buffer overflow in MakeTable() function [rhel-8])
+- Resolves: bz#1641469
+  (CVE-2017-5735 edk2: Privilege escalation via heap-based buffer overflow in Decode() function [rhel-8])
+
+* Tue Sep 04 2018 Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 20180508gitee3198e672e2-5.el8
+- edk2-BaseTools-footer.makefile-expand-BUILD_CFLAGS-last-f.patch [bz#1607906]
+- edk2-BaseTools-header.makefile-remove-c-from-BUILD_CFLAGS.patch [bz#1607906]
+- edk2-BaseTools-Source-C-split-O2-to-BUILD_OPTFLAGS.patch [bz#1607906]
+- edk2-BaseTools-Source-C-take-EXTRA_OPTFLAGS-from-the-call.patch [bz#1607906]
+- edk2-BaseTools-Source-C-take-EXTRA_LDFLAGS-from-the-calle.patch [bz#1607906]
+- edk2-BaseTools-VfrCompile-honor-EXTRA_LDFLAGS.patch [bz#1607906]
+- edk2-redhat-inject-the-RPM-compile-and-link-options-to-th.patch [bz#1607906]
+- Resolves: bz#1607906
+  (edk2-tools: Does not use RPM build flags)
+
+* Wed Aug 08 2018 Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 20180508gitee3198e672e2-4.el8
+- edk2-redhat-provide-virtual-bundled-OpenSSL-in-edk2-ovmf-.patch [bz#1607801]
+- Resolves: bz#1607801
+  (add 'Provides: bundled(openssl) = 1.1.0h' to the spec file)
+
+* Tue Jul 24 2018 Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 20180508gitee3198e672e2-3.el8
+- edk2-redhat-Provide-and-Obsolete-OVMF-and-AAVMF.patch [bz#1596148]
+- edk2-ArmVirtPkg-unify-HttpLib-resolutions-in-ArmVirt.dsc..patch [bz#1536627]
+- edk2-ArmVirtPkg-ArmVirtQemu-enable-the-IPv6-stack.patch [bz#1536627]
+- edk2-advertise-OpenSSL-due-to-IPv6-enablement-too-RHEL-on.patch [bz#1536627]
+- edk2-redhat-add-D-NETWORK_IP6_ENABLE-to-the-build-flags.patch [bz#1536627]
+- edk2-redhat-update-license-fields-and-files-in-the-spec-f.patch [bz#1536627]
+- Resolves: bz#1536627
+  (IPv6 enablement in OVMF)
+- Resolves: bz#1596148
+  (restore Provides/Obsoletes macros for OVMF and AAVMF, from RHEL-8 Alpha)
+
+* Tue Jul 10 2018 Danilo C. L. de Paula <ddepaula@redhat.com> - 20180508gitee3198e672e2-2.el8
+- Rebase edk2 on top of 20180508gitee3198e672e2
+
+* Fri Jun 08 2018 Miroslav Rezanina <mrezanin@redhat.com> - 20180508-2.gitee3198e672e2
+- OvmfPkg/PlatformBootManagerLib: connect consoles unconditionally [bz#1577546]
+- build OVMF varstore template with SB enabled / certs enrolled [bz#1561128]
+- connect Virtio RNG devices again [bz#1579518]
+- Resolves: bz#1577546
+  (no input consoles connected under certain circumstances)
+- Resolves: bz#1561128
+  (OVMF Secure boot enablement (enrollment of default keys))
+- Resolves: bz#1579518
+  (EFI_RNG_PROTOCOL no longer produced for virtio-rng)
+* Wed Dec 06 2017 Miroslav Rezanina <mrezanin@redhat.com> - 20171011-4.git92d07e48907f.el7
+- ovmf-MdeModulePkg-Core-Dxe-log-informative-memprotect-msg.patch [bz#1520485]
+- ovmf-MdeModulePkg-BdsDxe-fall-back-to-a-Boot-Manager-Menu.patch [bz#1515418]
+- Resolves: bz#1515418
+  (RFE: Provide diagnostics for failed boot)
+- Resolves: bz#1520485
+  (AAVMF: two new messages with silent build)
+
+* Fri Dec 01 2017 Miroslav Rezanina <mrezanin@redhat.com> - 20171011-3.git92d07e48907f.el7
+- ovmf-UefiCpuPkg-CpuDxe-Fix-multiple-entries-of-RT_CODE-in.patch [bz#1518308]
+- ovmf-MdeModulePkg-DxeCore-Filter-out-all-paging-capabilit.patch [bz#1518308]
+- ovmf-MdeModulePkg-Core-Merge-memory-map-after-filtering-p.patch [bz#1518308]
+- Resolves: bz#1518308
+  (UEFI memory map regression (runtime code entry splitting) introduced by c1cab54ce57c)
+
+* Mon Nov 27 2017 Miroslav Rezanina <mrezanin@redhat.com> - 20171011-2.git92d07e48907f.el7
+- ovmf-MdeModulePkg-Bds-Remove-assertion-in-BmCharToUint.patch [bz#1513632]
+- ovmf-MdeModulePkg-Bds-Check-variable-name-even-if-OptionN.patch [bz#1513632]
+- ovmf-MdeModulePkg-PciBus-Fix-bug-that-PCI-BUS-claims-too-.patch [bz#1514105]
+- ovmf-OvmfPkg-make-it-a-proper-BASE-library.patch [bz#1488247]
+- ovmf-OvmfPkg-create-a-separate-PlatformDebugLibIoPort-ins.patch [bz#1488247]
+- ovmf-OvmfPkg-save-on-I-O-port-accesses-when-the-debug-por.patch [bz#1488247]
+- ovmf-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch [bz#1488247]
+- ovmf-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-QemuVide.patch [bz#1488247]
+- ovmf-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch [bz#1488247]
+- ovmf-Revert-redhat-introduce-separate-silent-and-verbose-.patch [bz#1488247]
+- Resolves: bz#1488247
+  (make debug logging no-op unless a debug console is active)
+- Resolves: bz#1513632
+  ([RHEL-ALT 7.5] AAVMF fails to boot after setting BootNext)
+- Resolves: bz#1514105
+  (backport edk2 commit 6e3287442774 so that PciBusDxe not over-claim resources)
+
+* Wed Oct 18 2017 Miroslav Rezanina <mrezanin@redhat.com> - 20171011-1.git92d07e48907f.el7
+- Rebase to 92d07e48907f [bz#1469787]
+- Resolves: bz#1469787
+  ((ovmf-rebase-rhel-7.5) Rebase OVMF for RHEL-7.5)
+- Resolves: bz#1434740
+  (OvmfPkg/PciHotPlugInitDxe: don't reserve IO space when IO support is disabled)
+- Resolves: bz#1434747
+  ([Q35] code12 error when hotplug x710 device in win2016)
+- Resolves: bz#1447027
+  (Guest cannot boot with 240 or above vcpus when using ovmf)
+- Resolves: bz#1458192
+  ([Q35] recognize "usb-storage" devices in XHCI ports)
+- Resolves: bz#1468526
+  (>1TB RAM support)
+- Resolves: bz#1488247
+  (provide "OVMF_CODE.secboot.verbose.fd" for log capturing; silence "OVMF_CODE.secboot.fd")
+- Resolves: bz#1496170
+  (Inconsistent MOR control variables exposed by OVMF, breaks Windows Device Guard)
+
+* Fri May 12 2017 Miroslav Rezanina <mrezanin@redhat.com> - 20170228-5.gitc325e41585e3.el7
+- ovmf-OvmfPkg-EnrollDefaultKeys-update-SignatureOwner-GUID.patch [bz#1443351]
+- ovmf-OvmfPkg-EnrollDefaultKeys-expose-CertType-parameter-.patch [bz#1443351]
+- ovmf-OvmfPkg-EnrollDefaultKeys-blacklist-empty-file-in-db.patch [bz#1443351]
+- ovmf-OvmfPkg-introduce-the-FD_SIZE_IN_KB-macro-build-flag.patch [bz#1443351]
+- ovmf-OvmfPkg-OvmfPkg.fdf.inc-extract-VARS_LIVE_SIZE-and-V.patch [bz#1443351]
+- ovmf-OvmfPkg-introduce-4MB-flash-image-mainly-for-Windows.patch [bz#1443351]
+- ovmf-OvmfPkg-raise-max-variable-size-auth-non-auth-to-33K.patch [bz#1443351]
+- ovmf-OvmfPkg-PlatformPei-handle-non-power-of-two-spare-si.patch [bz#1443351]
+- ovmf-redhat-update-local-build-instructions-with-D-FD_SIZ.patch [bz#1443351]
+- ovmf-redhat-update-OVMF-build-commands-with-D-FD_SIZE_4MB.patch [bz#1443351]
+- Resolves: bz#1443351
+  ([svvp][ovmf] job "Secure Boot Logo Test" failed  with q35&ovmf)
+
+* Fri Apr 28 2017 Miroslav Rezanina <mrezanin@redhat.com> - 20170228-4.gitc325e41585e3.el7
+- ovmf-ShellPkg-Shell-clean-up-bogus-member-types-in-SPLIT_.patch [bz#1442908]
+- ovmf-ShellPkg-Shell-eliminate-double-free-in-RunSplitComm.patch [bz#1442908]
+- Resolves: bz#1442908
+  (Guest hang when running a wrong command in Uefishell)
+
+* Tue Apr 04 2017 Miroslav Rezanina <mrezanin@redhat.com> - 20170228-3.gitc325e41585e3.el7
+- ovmf-ArmVirtPkg-FdtClientDxe-supplement-missing-EFIAPI-ca.patch [bz#1430262]
+- ovmf-ArmVirtPkg-ArmVirtPL031FdtClientLib-unconditionally-.patch [bz#1430262]
+- ovmf-MdeModulePkg-RamDiskDxe-fix-C-string-literal-catenat.patch [bz#1430262]
+- ovmf-EmbeddedPkg-introduce-EDKII-Platform-Has-ACPI-GUID.patch [bz#1430262]
+- ovmf-EmbeddedPkg-introduce-PlatformHasAcpiLib.patch [bz#1430262]
+- ovmf-EmbeddedPkg-introduce-EDKII-Platform-Has-Device-Tree.patch [bz#1430262]
+- ovmf-ArmVirtPkg-add-PlatformHasAcpiDtDxe.patch [bz#1430262]
+- ovmf-ArmVirtPkg-enable-AcpiTableDxe-and-EFI_ACPI_TABLE_PR.patch [bz#1430262]
+- ovmf-ArmVirtPkg-FdtClientDxe-install-DT-as-sysconfig-tabl.patch [bz#1430262]
+- ovmf-ArmVirtPkg-PlatformHasAcpiDtDxe-don-t-expose-DT-if-Q.patch [bz#1430262]
+- ovmf-ArmVirtPkg-remove-PURE_ACPI_BOOT_ENABLE-and-PcdPureA.patch [bz#1430262]
+- Resolves: bz#1430262
+  (AAVMF: forward QEMU's DT to the guest OS only if ACPI payload is unavailable)
+
+* Mon Mar 27 2017 Miroslav Rezanina <mrezanin@redhat.com> - 20170228-2.gitc325e41585e3.el7
+- ovmf-MdeModulePkg-Core-Dxe-downgrade-CodeSegmentCount-is-.patch [bz#1433428]
+- Resolves: bz#1433428
+  (AAVMF: Fix error message during ARM guest VM installation)
+
+* Wed Mar 08 2017 Laszlo Ersek <lersek@redhat.com> - ovmf-20170228-1.gitc325e41585e3.el7
+- Rebase to upstream c325e41585e3 [bz#1416919]
+- Resolves: bz#1373812
+  (guest boot from network even set 'boot order=1' for virtio disk with OVMF)
+- Resolves: bz#1380282
+  (Update OVMF to openssl-1.0.2k-hobbled)
+- Resolves: bz#1412313
+  (select broadcast SMI if available)
+- Resolves: bz#1416919
+  (Rebase OVMF for RHEL-7.4)
+- Resolves: bz#1426330
+  (disable libssl in CryptoPkg)
+
+* Mon Sep 12 2016 Laszlo Ersek <lersek@redhat.com> - ovmf-20160608b-1.git988715a.el7
+- rework downstream-only commit dde83a75b566 "setup the tree for the secure
+  boot feature (RHEL only)", excluding patent-encumbered files from the
+  upstream OpenSSL 1.0.2g tarball [bz#1374710]
+- rework downstream-only commit dfc3ca1ee509 "CryptoPkg/OpensslLib: Upgrade
+  OpenSSL version to 1.0.2h", excluding patent-encumbered files from the
+  upstream OpenSSL 1.0.2h tarball [bz#1374710]
+
+* Thu Aug 04 2016 Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20160608-3.git988715a.el7
+- ovmf-MdePkg-PCI-Add-missing-PCI-PCIE-definitions.patch [bz#1332408]
+- ovmf-ArmPlatformPkg-NorFlashDxe-accept-both-non-secure-an.patch [bz#1353494]
+- ovmf-ArmVirtPkg-ArmVirtQemu-switch-secure-boot-build-to-N.patch [bz#1353494]
+- ovmf-ArmPlatformPkg-NorFlashAuthenticatedDxe-remove-this-.patch [bz#1353494]
+- ovmf-ArmVirtPkg-add-FDF-definition-for-empty-varstore.patch [bz#1353494]
+- ovmf-redhat-package-the-varstore-template-produced-by-the.patch [bz#1353494]
+- ovmf-ArmVirtPkg-Re-add-the-Driver-Health-Manager.patch [bz#1353494]
+- ovmf-ArmVirtPkg-HighMemDxe-allow-patchable-PCD-for-PcdSys.patch [bz#1353494]
+- ovmf-ArmVirtPkg-ArmVirtQemuKernel-make-ACPI-support-AARCH.patch [bz#1353494]
+- ovmf-ArmVirtPkg-align-ArmVirtQemuKernel-with-ArmVirtQemu.patch [bz#1353494]
+- ovmf-ArmVirtPkg-ArmVirtQemu-factor-out-shared-FV.FvMain-d.patch [bz#1353494]
+- ovmf-ArmVirtPkg-factor-out-Rules-FDF-section.patch [bz#1353494]
+- ovmf-ArmVirtPkg-add-name-GUIDs-to-FvMain-instances.patch [bz#1353494]
+- ovmf-OvmfPkg-add-a-Name-GUID-to-each-Firmware-Volume.patch [bz#1353494]
+- ovmf-OvmfPkg-PlatformBootManagerLib-remove-stale-FvFile-b.patch [bz#1353494]
+- ovmf-MdePkg-IndustryStandard-introduce-EFI_PCI_CAPABILITY.patch [bz#1332408]
+- ovmf-MdeModulePkg-PciBusDxe-look-for-the-right-capability.patch [bz#1332408]
+- ovmf-MdeModulePkg-PciBusDxe-recognize-hotplug-capable-PCI.patch [bz#1332408]
+- ovmf-OvmfPkg-add-PciHotPlugInitDxe.patch [bz#1332408]
+- ovmf-ArmPkg-ArmGicLib-manage-GICv3-SPI-state-at-the-distr.patch [bz#1356655]
+- ovmf-ArmVirtPkg-PlatformBootManagerLib-remove-stale-FvFil.patch [bz#1353494]
+- ovmf-OvmfPkg-EnrollDefaultKeys-assign-Status-before-readi.patch [bz#1356913]
+- ovmf-OvmfPkg-EnrollDefaultKeys-silence-VS2015x86-warning-.patch [bz#1356913]
+- ovmf-CryptoPkg-update-openssl-to-ignore-RVCT-3079.patch [bz#1356184]
+- ovmf-CryptoPkg-Fix-typos-in-comments.patch [bz#1356184]
+- ovmf-CryptoPkg-BaseCryptLib-Avoid-passing-NULL-ptr-to-fun.patch [bz#1356184]
+- ovmf-CryptoPkg-BaseCryptLib-Init-the-content-of-struct-Ce.patch [bz#1356184]
+- ovmf-CryptoPkg-OpensslLib-Upgrade-OpenSSL-version-to-1.0..patch [bz#1356184]
+- Resolves: bz#1332408
+  (Q35 machine can not hot-plug scsi controller under switch)
+- Resolves: bz#1353494
+  ([OVMF] "EFI Internal Shell" should be removed from "Boot Manager")
+- Resolves: bz#1356184
+  (refresh embedded OpenSSL to 1.0.2h)
+- Resolves: bz#1356655
+  (AAVMF: stop accessing unmapped gicv3 registers)
+- Resolves: bz#1356913
+  (fix use-without-initialization in EnrollDefaultKeys.efi)
+
+* Tue Jul 12 2016 Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20160608-2.git988715a.el7
+- ovmf-ArmPkg-ArmGicV3Dxe-configure-all-interrupts-as-non-s.patch [bz#1349407]
+- ovmf-ArmVirtPkg-PlatformBootManagerLib-Postpone-the-shell.patch [bz#1353689]
+- Resolves: bz#1349407
+  (AArch64: backport fix to run over gicv3 emulation)
+- Resolves: bz#1353689
+  (AAVMF: Drops to shell with uninitialized NVRAM file)
+
+* Thu Jun 9 2016 Laszlo Ersek <lersek@redhat.com> - ovmf-20160608-1.git988715a.el7
+- Resolves: bz#1341733
+  (prevent SMM stack overflow in OVMF while enrolling certificates in "db")
+- Resolves: bz#1257882
+  (FEAT: support to boot from virtio 1.0 modern devices)
+- Resolves: bz#1333238
+  (Q35 machine can not boot up successfully with more than 3 virtio-scsi
+  storage controller under switch)
+- Resolves: bz#1330955
+  (VM can not be booted up from hard disk successfully when with a passthrough
+  USB stick)
+
+* Thu May 19 2016 Laszlo Ersek <lersek@redhat.com> - ovmf-20160419-2.git90bb4c5.el7
+- Submit scratch builds from the exploded tree again to
+  supp-rhel-7.3-candidate, despite FatPkg being OSS at this point; see
+  bz#1329559.
+
+* Wed Apr 20 2016 Laszlo Ersek <lersek@redhat.com> - ovmf-20160419-1.git90bb4c5.el7
+- FatPkg is under the 2-clause BSDL now; "ovmf" has become OSS
+- upgrade to openssl-1.0.2g
+- Resolves: bz#1323363
+  (remove "-D SECURE_BOOT_ENABLE" from AAVMF)
+- Resolves: bz#1257882
+  (FEAT: support to boot from virtio 1.0 modern devices)
+- Resolves: bz#1308678
+  (clearly separate SB-less, SMM-less OVMF binary from SB+SMM OVMF binary)
+
+* Fri Feb 19 2016 Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20160202-2.gitd7c0dfa.el7
+- ovmf-restore-TianoCore-splash-logo-without-OpenSSL-advert.patch [bz#1308678]
+- ovmf-OvmfPkg-ArmVirtPkg-show-OpenSSL-less-logo-without-Se.patch [bz#1308678]
+- ovmf-OvmfPkg-simplify-VARIABLE_STORE_HEADER-generation.patch [bz#1308678]
+- ovmf-redhat-bring-back-OVMF_CODE.fd-but-without-SB-and-wi.patch [bz#1308678]
+- ovmf-redhat-rename-OVMF_CODE.smm.fd-to-OVMF_CODE.secboot..patch [bz#1308678]
+
+* Tue Feb 2 2016 Laszlo Ersek <lersek@redhat.com> - ovmf-20160202-1.gitd7c0dfa.el7
+- rebase to upstream d7c0dfa
+- update OpenSSL to 1.0.2e (upstream)
+- update FatPkg to SVN r97 (upstream)
+- drive NVMe devices (upstream)
+- resize xterm on serial console mode change, when requested with
+  -fw_cfg name=opt/(ovmf|aavmf)/PcdResizeXterm,string=y
+  (downstream)
+- Resolves: bz#1259395
+  (revert / roll back AAVMF fix for BZ 1188054)
+- Resolves: bz#1202819
+  (OVMF: secure boot limitations)
+- Resolves: bz#1182495
+  (OVMF rejects iPXE oprom when Secure Boot is enabled)
+
+* Thu Nov 5 2015 Laszlo Ersek <lersek@redhat.com> - ovmf-20151104-1.gitb9ffeab.el7
+- rebase to upstream b9ffeab
+- Resolves: bz#1207554
+  ([AAVMF] AArch64: populate SMBIOS)
+- Resolves: bz#1270279
+  (AAVMF: output improvements)
+
+* Thu Jun 25 2015 Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20150414-2.gitc9e5618.el7
+- ovmf-OvmfPkg-PlatformPei-set-SMBIOS-entry-point-version-d.patch [bz#1232876]
+- Resolves: bz#1232876
+  (OVMF should install a version 2.8 SMBIOS entry point)
+
+* Sat Apr 18 2015 Laszlo Ersek <lersek@redhat.com> - 20150414-1.gitc9e5618.el7
+- rebase from upstream 9ece15a to c9e5618
+- adapt .gitignore files
+- update to openssl-0.9.8zf
+- create Logo-OpenSSL.bmp rather than modifying Logo.bmp in-place
+- update to FatPkg SVN r93 (git 8ff136aa)
+- drop the following downstream-only patches (obviated by upstream
+  counterparts):
+  "tools_def.template: use forward slash with --add-gnu-debuglink (RHEL only)"
+  "tools_def.template: take GCC48 prefixes from environment (RHEL only)"
+  "OvmfPkg: set video resolution of text setup to 640x480 (RHEL only)"
+  "OvmfPkg: resolve OrderedCollectionLib with base red-black tree instance"
+  "OvmfPkg: AcpiPlatformDxe: actualize QemuLoader.h comments"
+  "OvmfPkg: AcpiPlatformDxe: remove current ACPI table loader"
+  "OvmfPkg: AcpiPlatformDxe: implement QEMU's full ACPI table loader interface"
+  "OvmfPkg: QemuVideoDxe: fix querying of QXL's drawable buffer size"
+  "OvmfPkg: disable stale fork of SecureBootConfigDxe"
+  "OvmfPkg: SecureBootConfigDxe: remove stale fork"
+  "Try to read key strike even when ..."
+  "OvmfPkg: BDS: remove dead call to PlatformBdsEnterFrontPage()"
+  "OvmfPkg: BDS: drop useless return statement"
+  "OvmfPkg: BDS: don't overwrite the BDS Front Page timeout"
+  "OvmfPkg: BDS: optimize second argument in PlatformBdsEnterFrontPage() call"
+  'OvmfPkg: BDS: drop superfluous "connect first boot option" logic'
+  "OvmfPkg: BDS: drop custom boot timeout, revert to IntelFrameworkModulePkg's"
+  "Add comments to clarify mPubKeyStore buffer MemCopy. ..."
+  "MdeModulePkg/SecurityPkg Variable: Add boundary check..."
+  "OvmfPkg: AcpiPlatformDxe: make dependency on PCI enumeration explicit"
+  "MdePkg: UefiScsiLib: do not encode LUN in CDB for READ and WRITE"
+  "MdePkg: UefiScsiLib: do not encode LUN in CDB for other SCSI commands"
+- merge downstream AAVMF patch "adapt packaging to Arm64", which forces us to
+  rename the main package from "OVMF" to "ovmf"
+- drop the following ARM BDS specific tweaks (we'll only build the Intel BDS):
+  "ArmPlatformPkg/Bds: generate ESP Image boot option if user pref is unset
+   (Acadia)"
+  "ArmPlatformPkg/Bds: check for other defaults too if user pref is unset
+   (Acadia)"
+  "ArmPlatformPkg/ArmVirtualizationPkg: auto-detect boot path (Acadia)"
+  "ArmPlatformPkg/Bds: initialize ConIn/ConOut/ErrOut before connecting
+   terminals"
+  "ArmPlatformPkg/Bds: let FindCandidate() search all filesystems"
+  "ArmPlatformPkg/Bds: FindCandidateOnHandle(): log full device path"
+  "ArmPlatformPkg/Bds: fall back to Boot Menu when no default option was found"
+  "ArmPlatformPkg/Bds: always connect drivers before looking at boot options"
+- drop patch "ArmPlatformPkg/ArmVirtualizationPkg: enable DEBUG_VERBOSE (Acadia
+  only)", obsoleted by fixed bug 1197141
+- tweak patch "write up build instructions (for interactive, local development)
+  (RHELSA)". The defaults in "BaseTools/Conf/target.template", ie.
+  ACTIVE_PLATFORM and TARGET_ARCH, are set for OVMF / X64. The AAVMF build
+  instructions now spell out the necessary override options (-p and -a,
+  respectively).
+- extend patch "build FAT driver from source (RHELSA)" to the Xen build as well
+  (only for consistency; we don't build for Xen).
+- drop the following downstream-only AAVMF patches, due to the 77d5dac ->
+  c9e5618 AAVMF rebase & join:
+  "redhat/process-rh-specific.sh: fix check for hunk-less filtered patches"
+  "redhat/process-rh-specific.sh: suppress missing files in final 'rm'"
+  "ArmVirtualizationQemu: build UEFI shell from source (Acadia only)"
+  "MdePkg: UefiScsiLib: do not encode LUN in CDB for READ and WRITE"
+  "MdePkg: UefiScsiLib: do not encode LUN in CDB for other SCSI commands"
+  "ArmVirtualizationPkg: work around cache incoherence on KVM affecting DTB"
+  "Changed build target to supp-rhel-7.1-candidate"
+  "ArmVirtualizationPkg: VirtFdtDxe: forward FwCfg addresses from DTB to PCDs"
+  "ArmVirtualizationPkg: introduce QemuFwCfgLib instance for DXE drivers"
+  "ArmVirtualizationPkg: clone PlatformIntelBdsLib from ArmPlatformPkg"
+  "ArmVirtualizationPkg: PlatformIntelBdsLib: add basic policy"
+  "OvmfPkg: extract QemuBootOrderLib"
+  "OvmfPkg: QemuBootOrderLib: featurize PCI-like device path translation"
+  "OvmfPkg: introduce VIRTIO_MMIO_TRANSPORT_GUID"
+  "ArmVirtualizationPkg: VirtFdtDxe: use dedicated VIRTIO_MMIO_TRANSPORT_GUID"
+  "OvmfPkg: QemuBootOrderLib: widen ParseUnitAddressHexList() to UINT64"
+  "OvmfPkg: QemuBootOrderLib: OFW-to-UEFI translation for virtio-mmio"
+  "ArmVirtualizationPkg: PlatformIntelBdsLib: adhere to QEMU's boot order"
+  "ArmVirtualizationPkg: identify "new shell" as builtin shell for Intel BDS"
+  "ArmVirtualizationPkg: Intel BDS: load EFI-stubbed Linux kernel from fw_cfg"
+  'Revert "ArmVirtualizationPkg: work around cache incoherence on KVM affecting
+   DTB"'
+  "OvmfPkg: QemuBootOrderLib: expose QEMU's "-boot menu=on[, splash-time=N]""
+  "OvmfPkg: PlatformBdsLib: get front page timeout from QEMU"
+  "ArmVirtualizationPkg: PlatformIntelBdsLib: get front page timeout from QEMU"
+  "ArmPkg: ArmArchTimerLib: clean up comments"
+  "ArmPkg: ArmArchTimerLib: use edk2-conformant (UINT64 * UINT32) / UINT32"
+  "ArmPkg: ArmArchTimerLib: conditionally rebase to actual timer frequency"
+  "ArmVirtualizationQemu: ask the hardware for the timer frequency"
+  "ArmPkg: DebugPeCoffExtraActionLib: debugger commands are not errors"
+  "ArmPlatformPkg: PEIM startup is not an error"
+  "ArmVirtualizationPkg: PlatformIntelBdsLib: lack of QEMU kernel is no error"
+  "ArmVirtualizationPkg: expose debug message bitmask on build command line"
+- tweak patch "rebase to upstream 77d5dac (Acadia only)": update spec changelog
+  only
+- tweak patch "spec: build AAVMF with the Intel BDS driver (RHELSA only)":
+  apply "-D INTEL_BDS" to manual build instructions in redhat/README too
+- tweak patch "spec: build and install verbose and silent (default) AAVMF
+  binaries": apply DEBUG_PRINT_ERROR_LEVEL setting to interactive build
+  instructions in redhat/README too
+- install OVMF whitepaper as part of the OVMF build's documentation
+- Resolves: bz#1211337
+  (merge AAVMF into OVMF)
+- Resolves: bz#1206523
+  ([AAVMF] fix missing cache maintenance)
+
+* Fri Mar 06 2015 Miroslav Rezanina <mrezanin@redhat.com> - AAVMF-20141113-5.git77d5dac.el7_1
+- aavmf-ArmPkg-DebugPeCoffExtraActionLib-debugger-commands-a.patch [bz#1197141]
+- aavmf-ArmPlatformPkg-PEIM-startup-is-not-an-error.patch [bz#1197141]
+- aavmf-ArmVirtualizationPkg-PlatformIntelBdsLib-lack-of-QEM.patch [bz#1197141]
+- aavmf-ArmVirtualizationPkg-expose-debug-message-bitmask-on.patch [bz#1197141]
+- aavmf-spec-build-and-install-verbose-and-silent-default-AA.patch [bz#1197141]
+- Resolves: bz#1197141
+  (create silent & verbose builds)
+
+* Tue Feb 10 2015 Miroslav Rezanina <mrezanin@redhat.com> - AAVMF-20141113-4.git77d5dac.el7
+- aavmf-ArmPkg-ArmArchTimerLib-clean-up-comments.patch [bz#1188247]
+- aavmf-ArmPkg-ArmArchTimerLib-use-edk2-conformant-UINT64-UI.patch [bz#1188247]
+- aavmf-ArmPkg-ArmArchTimerLib-conditionally-rebase-to-actua.patch [bz#1188247]
+- aavmf-ArmVirtualizationQemu-ask-the-hardware-for-the-timer.patch [bz#1188247]
+- aavmf-ArmPkg-TimerDxe-smack-down-spurious-timer-interrupt-.patch [bz#1188054]
+- Resolves: bz#1188054
+  (guest reboot (asked from within AAVMF) regressed in 3.19.0-0.rc5.58.aa7a host kernel)
+- Resolves: bz#1188247
+  (backport "fix gBS->Stall()" series)
+
+* Mon Jan 19 2015 Miroslav Rezanina <mrezanin@redhat.com> - AAVMF-20141113-3.git77d5dac.el7
+- aavmf-OvmfPkg-QemuBootOrderLib-expose-QEMU-s-boot-menu-on-.patch [bz#1172756]
+- aavmf-OvmfPkg-PlatformBdsLib-get-front-page-timeout-from-Q.patch [bz#1172756]
+- aavmf-ArmVirtualizationPkg-PlatformIntelBdsLib-get-front-p.patch [bz#1172756]
+- Resolves: bz#1172756
+  ([RFE]Expose boot-menu shortcut to domain via AAVMF)
+
+* Wed Jan 14 2015 Miroslav Rezanina <mrezanin@redhat.com> - AAVMF-20141113-2.git77d5dac.el7
+- aavmf-ArmVirtualizationPkg-VirtFdtDxe-forward-FwCfg-addres.patch [bz#1172749]
+- aavmf-ArmVirtualizationPkg-introduce-QemuFwCfgLib-instance.patch [bz#1172749]
+- aavmf-ArmVirtualizationPkg-clone-PlatformIntelBdsLib-from-.patch [bz#1172749]
+- aavmf-ArmVirtualizationPkg-PlatformIntelBdsLib-add-basic-p.patch [bz#1172749]
+- aavmf-OvmfPkg-extract-QemuBootOrderLib.patch [bz#1172749]
+- aavmf-OvmfPkg-QemuBootOrderLib-featurize-PCI-like-device-p.patch [bz#1172749]
+- aavmf-OvmfPkg-introduce-VIRTIO_MMIO_TRANSPORT_GUID.patch [bz#1172749]
+- aavmf-ArmVirtualizationPkg-VirtFdtDxe-use-dedicated-VIRTIO.patch [bz#1172749]
+- aavmf-OvmfPkg-QemuBootOrderLib-widen-ParseUnitAddressHexLi.patch [bz#1172749]
+- aavmf-OvmfPkg-QemuBootOrderLib-OFW-to-UEFI-translation-for.patch [bz#1172749]
+- aavmf-ArmVirtualizationPkg-PlatformIntelBdsLib-adhere-to-Q.patch [bz#1172749]
+- aavmf-ArmVirtualizationPkg-identify-new-shell-as-builtin-s.patch [bz#1172749]
+- aavmf-ArmVirtualizationPkg-Intel-BDS-load-EFI-stubbed-Linu.patch [bz#1172749]
+- aavmf-spec-build-AAVMF-with-the-Intel-BDS-driver-RHELSA-on.patch [bz#1172749]
+- aavmf-Revert-ArmVirtualizationPkg-work-around-cache-incohe.patch [bz#1172910]
+- Resolves: bz#1172749
+  (implement fw_cfg, boot order handling, and -kernel booting in ArmVirtualizationQemu)
+- Resolves: bz#1172910
+  (revert Acadia-only workaround (commit df7bca4e) once Acadia host kernel (KVM) is fixed)
+
+* Fri Dec 05 2014 Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20140822-7.git9ece15a.el7
+- ovmf-MdePkg-UefiScsiLib-do-not-encode-LUN-in-CDB-for-READ.patch [bz#1166971]
+- ovmf-MdePkg-UefiScsiLib-do-not-encode-LUN-in-CDB-for-othe.patch [bz#1166971]
+- Resolves: bz#1166971
+  (virtio-scsi disks and cd-roms with nonzero LUN are rejected with errors)
+
+* Tue Nov 25 2014 Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20140822-6.git9ece15a.el7
+- ovmf-OvmfPkg-AcpiPlatformDxe-make-dependency-on-PCI-enume.patch [bz#1166027]
+- Resolves: bz#1166027
+  (backport "OvmfPkg: AcpiPlatformDxe: make dependency on PCI enumeration explicit")
+
+* Tue Nov 18 2014 Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20140822-4.git9ece15a.el7
+- ovmf-Add-comments-to-clarify-mPubKeyStore-buffer-MemCopy.patch [bz#1162314]
+- ovmf-MdeModulePkg-SecurityPkg-Variable-Add-boundary-check.patch [bz#1162314]
+- Resolves: bz#1162314
+ (EMBARGOED OVMF: uefi: INTEL-TA-201410-001 && INTEL-TA-201410-002 [rhel-7.1])
+
+* Thu Nov 13 2014 Laszlo Ersek <lersek@redhat.com> - AAVMF-20141113-1.git77d5dac
+- rebased to upstream 77d5dac
+  <https://bugzilla.redhat.com/show_bug.cgi?id=1162314#c1>
+- patch "ArmVirtualizationPkg: FdtPL011SerialPortLib: support UEFI_APPLICATION"
+  is now upstream (SVN r16219, git edb5073)
+
+* Thu Nov 13 2014 Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20140822-3.git9ece15a.el7
+- ovmf-Revert-OvmfPkg-set-video-resolution-of-text-setup-to.patch [bz#1153927]
+- ovmf-Try-to-read-key-strike-even-when-the-TimeOuts-value-.patch [bz#1153927]
+- ovmf-OvmfPkg-BDS-remove-dead-call-to-PlatformBdsEnterFron.patch [bz#1153927]
+- ovmf-OvmfPkg-BDS-drop-useless-return-statement.patch [bz#1153927]
+- ovmf-OvmfPkg-BDS-don-t-overwrite-the-BDS-Front-Page-timeo.patch [bz#1153927]
+- ovmf-OvmfPkg-BDS-optimize-second-argument-in-PlatformBdsE.patch [bz#1153927]
+- ovmf-OvmfPkg-BDS-drop-superfluous-connect-first-boot-opti.patch [bz#1153927]
+- ovmf-OvmfPkg-BDS-drop-custom-boot-timeout-revert-to-Intel.patch [bz#1153927]
+- ovmf-OvmfPkg-set-video-resolution-of-text-setup-to-640x48.patch [bz#1153927]
+- Resolves: bz#1153927
+  (set NEXTBOOT to uefi setting failed from Windows Recovery console)
+
+* Tue Nov 11 2014 Miroslav Rezanina <mrezanin@redhat.com> - OVMF-20140822-2.git9ece15a
+- ovmf-redhat-process-rh-specific.sh-suppress-missing-files.patch [bz#1145784]
+- ovmf-Revert-RH-only-OvmfPkg-QemuVideoDxe-fix-querying-of-.patch [bz#1145784]
+- ovmf-Revert-RH-only-OvmfPkg-AcpiPlatformDxe-implement-QEM.patch [bz#1145784]
+- ovmf-Revert-RH-only-OvmfPkg-AcpiPlatformDxe-remove-curren.patch [bz#1145784]
+- ovmf-Revert-RH-only-OvmfPkg-AcpiPlatformDxe-actualize-Qem.patch [bz#1145784]
+- ovmf-Revert-RH-only-OvmfPkg-resolve-OrderedCollectionLib-.patch [bz#1145784]
+- ovmf-OvmfPkg-QemuVideoDxe-work-around-misreported-QXL-fra.patch [bz#1145784]
+- ovmf-OvmfPkg-resolve-OrderedCollectionLib-with-base-red-b.patch [bz#1145784]
+- ovmf-OvmfPkg-AcpiPlatformDxe-actualize-QemuLoader.h-comme.patch [bz#1145784]
+- ovmf-OvmfPkg-AcpiPlatformDxe-remove-current-ACPI-table-lo.patch [bz#1145784]
+- ovmf-OvmfPkg-AcpiPlatformDxe-implement-QEMU-s-full-ACPI-t.patch [bz#1145784]
+- ovmf-spec-build-small-bootable-ISO-with-standalone-UEFI-s.patch [bz#1147592]
+- ovmf-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch [bz#1147592]
+- ovmf-spec-exclude-the-UEFI-shell-from-the-SecureBoot-enab.patch [bz#1147592]
+- ovmf-OvmfPkg-EnrollDefaultKeys-application-for-enrolling-.patch [bz#1148296]
+- ovmf-spec-package-EnrollDefaultKeys.efi-on-UefiShell.iso-.patch [bz#1148296]
+- ovmf-OvmfPkg-disable-stale-fork-of-SecureBootConfigDxe.patch [bz#1148294]
+- ovmf-OvmfPkg-SecureBootConfigDxe-remove-stale-fork.patch [bz#1148294]
+- Resolves: bz#1145784
+  (OVMF sync with QXL and ACPI patches up to edk2 7a9612ce)
+- Resolves: bz#1147592
+  (the binary RPM should include a small ISO file with a directly bootable UEFI shell binary)
+- Resolves: bz#1148294
+  (drop OvmfPkg's stale fork of SecureBootConfigDxe)
+- Resolves: bz#1148296
+  (provide a non-interactive way to auto-enroll important SecureBoot certificates)
+
+* Wed Oct 15 2014 Laszlo Ersek <lersek@redhat.com> - AAVMF-20141015-1.gitc373687
+- ported packaging to aarch64 / AAVMF
+
+* Fri Aug 22 2014 Laszlo Ersek <lersek@redhat.com> - 20140822-1.git9ece15a.el7
+- rebase from upstream 3facc08 to 9ece15a
+- update to openssl-0.9.8zb
+- update to FatPkg SVN r86 (git 2355ea2c)
+- the following patches of Paolo Bonzini have been merged in upstream; drop the
+  downstream-only copies:
+  7bc1421 edksetup.sh: Look for BuildEnv under EDK_TOOLS_PATH
+  d549344 edksetup.sh: Ensure that WORKSPACE points to the top of an edk2
+          checkout
+  1c023eb BuildEnv: remove useless check before setting $WORKSPACE
+- include the following patches that have been pending review on the upstream
+  list for a long time:
+  [PATCH 0/4] OvmfPkg: complete client for QEMU's ACPI loader interface
+  http://thread.gmane.org/gmane.comp.bios.tianocore.devel/8369
+  [PATCH] OvmfPkg: QemuVideoDxe: fix querying of QXL's drawable buffer size
+  http://thread.gmane.org/gmane.comp.bios.tianocore.devel/8515
+- nasm is a build-time dependency now because upstream BuildTools has started
+  to call it directly
+
+* Wed Jul 23 2014 Laszlo Ersek <lersek@redhat.com> - 20140723-1.git3facc08.el7
+- rebase from upstream a618eaa to 3facc08
+- update to openssl-0.9.8za
+- drop downstream-only split varstore patch, rely on upstream's
+
+* Tue Jun 24 2014 Miroslav Rezanina <mrezanin@redhat.com> - 20140619-1.gita618eaa.el7
+- Initial version