%undefine _auto_set_build_flags

%define stable_version 20240223
%define tar_version    202402
%define TOOLCHAIN      GCC
%define OPENSSL_VER    3.0.9

%define build_ovmf 0
%ifarch x86_64
  %define build_ovmf 1
%endif

%global softfloat_version 20180726-gitb64af41

Summary:    UEFI firmware for 64-bit virtual machines
Name:       edk2
Version:    %{stable_version}
Release:    10%{?dist}
License:    BSD-2-Clause-Patent and OpenSSL and MIT
URL:        http://www.tianocore.org

Source0: https://github.com/tianocore/edk2/archive/refs/tags/%{name}-stable%{tar_version}.tar.gz
Source1: ovmf-whitepaper-c770f8c.txt
Source2: https://github.com/openssl/openssl/archive/refs/tags/openssl-%{OPENSSL_VER}.tar.gz

Source3: edk2-aarch64-verbose.json
Source4: edk2-aarch64.json
Source5: edk2-ovmf-sb.json
Source6: edk2-ovmf.json
Source7: edk2-ovmf-cc.json
Source8: edk2-ovmf-amdsev.json
Source9: edk2-ovmf-inteltdx.json
Source10: edk2-loongarch64-verbose.json
Source11: edk2-loongarch64.json
Source12: softfloat-%{softfloat_version}.tar.xz
# wget -O edk2-platforms-7f42d4034c8f.tar.xz https://github.com/tianocore/edk2-platforms/archive/7f42d4034c8f4266da691df69dce18234f752cb4.tar.gz
Source13: edk2-platforms-7f42d4034c8f.tar.xz

Patch0002: 0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch
Patch0003: 0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
Patch0004: 0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
Patch0005: 0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
Patch0006: 0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
Patch0007: 0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
Patch0008: 0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
Patch0009: 0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
Patch0010: 0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
Patch0011: 0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
Patch0012: 0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
Patch0013: 0013-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
Patch0014: 0014-CryptoPkg-CrtLib-add-stat.h.patch
Patch0015: 0015-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch
Patch0016: 0016-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
Patch0017: 0017-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch

# Support Hygon CSV3 guest
Patch0072: 0030-MdePkg-Add-StandardSignatureIsHygonGenuine-in-BaseCp.patch
Patch0073: 0031-UefiCpuPkg-LocalApicLib-Exclude-second-SendIpi-seque.patch
Patch0074: 0032-OvmfPkg-Add-CSV-secure-call-library-on-Hygon-CPU.patch
Patch0075: 0033-OvmfPkg-Tcg-Add-CsvLib-for-TpmMmioSevDecryptPei.patch
Patch0076: 0034-OvmfPkg-ResetVector-Support-CSV-in-ResetVector-phase.patch
Patch0077: 0035-OvmfPkg-PlatformPei-Initialize-CSV-VM-s-memory.patch
Patch0078: 0036-OvmfPkg-BaseMemcryptSevLib-update-page-status-to-Sec.patch
Patch0079: 0037-OvmfPkg-Add-CsvDxe-driver.patch
Patch0080: 0038-OvmfPkg-IoMmuDxe-Add-CsvIoMmu-protocol.patch
Patch0081: 0039-OvmfPkg-Reserve-a-CPUID-table-page-for-CSV-guest.patch
Patch0082: 0040-OvmfPkg-Use-classic-mmio-window-for-CSV-guest.patch
# Support live migration for Hygon CSV1/2/3 guests
Patch0083: 0041-OvmfPkg-BaseMemEncryptLib-Detect-SEV-live-migration-.patch
Patch0084: 0042-OvmfPkg-BaseMemEncryptLib-Hypercall-API-for-page-enc.patch
Patch0085: 0043-OvmfPkg-BaseMemEncryptLib-Invoke-page-encryption-sta.patch
Patch0086: 0044-OvmfPkg-VmgExitLib-Encryption-state-change-hypercall.patch
Patch0087: 0045-OvmfPkg-PlatformPei-Mark-SEC-GHCB-page-as-unencrypte.patch
Patch0088: 0046-OvmfPkg-AmdSevDxe-Add-support-for-SEV-live-migration.patch
Patch0089: 0047-OvmfPkg-BaseMemcryptSevLib-Correct-the-calculation-o.patch
Patch0090: 0048-OvmfPkg-BaseMemEncryptLib-Return-SUCCESS-if-not-supp.patch
# Fix mmio check in #VC Exception context
Patch0091: 0049-OvmfPkg-BaseMemEncryptLib-Save-memory-encrypt-status.patch
# Implement SetAttribute callback for CsvIoMmu
Patch0092: 0050-OvmfPkg-IoMmuDxe-Implement-SetAttribute-of-CsvIoMmu.patch

#CVE-2024-1298
Patch0093: CVE-2024-1298-0001-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch 

#CVE-2024-387960
Patch0094: CVE-2024-38796-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch

#CVE-2024-9143
Patch0095: CVE-2024-9143-openssl-Harden-BN_GF2m_poly2arr-against-misuse.patch

# LoongArch edk2-platforms
Patch0096: 0001-Platform-Loongson-Remove-minimium-memory-size-limita.patch
Patch0097: 0002-Platform-Loongson-Modify-loongarch-uefi-firmware-siz.patch
Patch0098: fixup-fdt-parse-error.patch

#Do not build BrotliCompress for ArmVirtPkg or OvmfPkg as its required Brotli submodule was removed in an earlier rebase.
Patch5000: 0001-BaseTools-do-not-build-BrotliCompress.patch


BuildRequires:  python3-devel
BuildRequires:  libuuid-devel
BuildRequires:  /usr/bin/iasl
BuildRequires:  binutils gcc git gcc-c++ make

%if %{build_ovmf}
BuildRequires:  nasm
BuildRequires:  dosfstools
BuildRequires:  mtools
BuildRequires:  xorriso
BuildRequires:  python3-virt-firmware
%endif

ExclusiveArch: x86_64 aarch64 loongarch64

%description
EDK II is a modern, feature-rich, cross-platform firmware development
environment for the UEFI and PI specifications. This package contains sample
64-bit UEFI firmware builds for QEMU and KVM.

%package ovmf
Summary:    UEFI firmware for x86_64 virtual machines
BuildArch:  noarch
Provides:   OVMF = %{version}-%{release}
Provides:   bundled(openssl) = %{OPENSSL_VER}
License:    BSD-2-Clause-Patent and OpenSSL

URL:        http://www.tianocore.org/ovmf/

%description ovmf
OVMF (Open Virtual Machine Firmware) is a project to enable UEFI support for
Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU
and KVM.

%ifarch aarch64
%package aarch64
Summary:    UEFI firmware for aarch64 virtual machines
BuildArch:  noarch
License:    BSD-2-Clause-Patent and OpenSSL
URL:        https://github.com/tianocore/tianocore.github.io/wiki/ArmVirtPkg
Provides:   AAVMF = %{version}-%{release}
Provides:   bundled(openssl) = %{OPENSSL_VER}

%description aarch64
AAVMF (ARM Architecture Virtual Machine Firmware) is an EFI Development Kit II
platform that enables UEFI support for QEMU/KVM ARM Virtual Machines. This
package contains a 64-bit build.
%endif

%ifarch loongarch64
%package loongarch64
Summary:    UEFI firmware for loongarch64 virtual machines
BuildArch:  noarch
License:    BSD-2-Clause-Patent and OpenSSL
URL:        https://github.com/tianocore/tianocore.github.io/wiki/LoongArchVirt
Provides:   bundled(openssl) = %{OPENSSL_VER}

%description loongarch64
LoongArch Virtual Machine Firmware is an EFI Development Kit II platform that
enables UEFI support for QEMU/KVM LoongArch Virtual Machines. This package
contains a 64-bit build.
%endif

%package tools
Summary:        EFI Development Kit II Tools
License:        BSD-2-Clause-Patent
URL:            https://github.com/tianocore/tianocore.github.io/wiki/BaseTools

%description tools
This package provides tools that are needed to
build EFI executables and ROMs using the GNU tools.

%package tools-doc
Summary:        Documentation for EFI Development Kit II Tools
BuildArch:      noarch
License:        BSD-2-Clause-Patent
URL:            https://github.com/tianocore/tianocore.github.io/wiki/BaseTools

%description tools-doc
This package documents the tools that are needed to
build EFI executables and ROMs using the GNU tools.


%prep
%setup -n edk2-edk2-stable%{tar_version}

cp -a %{SOURCE1} .
cp -a %{SOURCE3} %{SOURCE4} %{SOURCE5} %{SOURCE6} .
cp -a %{SOURCE7} %{SOURCE8} %{SOURCE9} %{SOURCE10} %{SOURCE11} .
rm -rf CryptoPkg/Library/OpensslLib/openssl
tar -C CryptoPkg/Library/OpensslLib/ -a -f %{SOURCE2} -x
mv CryptoPkg/Library/OpensslLib/openssl-openssl-%{OPENSSL_VER} CryptoPkg/Library/OpensslLib/openssl

tar -xf %{SOURCE12} --strip-components=1 --directory ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3/
tar -xf %{SOURCE13} --strip-components=1 edk2-platforms-7f42d4034c8f4266da691df69dce18234f752cb4/Platform

%autopatch -p1

mkdir -p MdePkg/Library/MipiSysTLib/mipisyst/library/include
mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include
mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include/mbedtls
mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/library

%build
export PYTHON_COMMAND=%{__python3}
source ./edksetup.sh
%make_build -C "$EDK_TOOLS_PATH" \
  EXTRA_OPTFLAGS="%{optflags}" \
  EXTRA_LDFLAGS="%{__global_ldflags}"

SMP_MFLAGS="%{?_smp_mflags}"
if [[ x"$SMP_MFLAGS" = x-j* ]]; then
        CC_FLAGS="$CC_FLAGS -n ${SMP_MFLAGS#-j}"
elif [ -n "%{?jobs}" ]; then
        CC_FLAGS="$CC_FLAGS -n %{?jobs}"
fi

CC_FLAGS="$CC_FLAGS --cmd-len=65536 -t %{TOOLCHAIN} -b DEBUG --hash"
CC_FLAGS="$CC_FLAGS -D NETWORK_IP6_ENABLE"
CC_FLAGS="$CC_FLAGS -D NETWORK_HTTP_BOOT_ENABLE -D NETWORK_TLS_ENABLE"
CC_FLAGS="$CC_FLAGS -D TPM2_ENABLE"
CC_FLAGS="$CC_FLAGS -D TPM1_ENABLE"

OVMF_FLAGS="${CC_FLAGS}"
OVMF_FLAGS="${OVMF_FLAGS} -D FD_SIZE_4MB"
OVMF_FLAGS="${OVMF_FLAGS} -D PVSCSI_ENABLE=FALSE -D MPT_SCSI_ENABLE=FALSE"

OVMF_SB_FLAGS="${OVMF_FLAGS}"
OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D SECURE_BOOT_ENABLE"
OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D SMM_REQUIRE"
OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D EXCLUDE_SHELL_FROM_FD"

OVMF_4M_FLAGS=""
OVMF_4M_FLAGS="${OVMF_4M_FLAGS} -D FD_SIZE_IN_KB=4096"


build_iso() {
  dir="$1"
  UEFI_SHELL_BINARY=${dir}/Shell.efi
  ENROLLER_BINARY=${dir}/EnrollDefaultKeys.efi
  UEFI_SHELL_IMAGE=uefi_shell.img
  ISO_IMAGE=${dir}/UefiShell.iso

  UEFI_SHELL_BINARY_BNAME=$(basename -- "$UEFI_SHELL_BINARY")
  UEFI_SHELL_SIZE=$(stat --format=%s -- "$UEFI_SHELL_BINARY")
  ENROLLER_SIZE=$(stat --format=%s -- "$ENROLLER_BINARY")

  UEFI_SHELL_IMAGE_KB=$((
    (UEFI_SHELL_SIZE + ENROLLER_SIZE + 1 * 1024 * 1024) * 11 / 10 / 1024
  ))

  rm -f -- "$UEFI_SHELL_IMAGE"
  mkdosfs -C "$UEFI_SHELL_IMAGE" -n UEFI_SHELL -- "$UEFI_SHELL_IMAGE_KB"

  export MTOOLS_SKIP_CHECK=1
  mmd   -i "$UEFI_SHELL_IMAGE"                       ::efi
  mmd   -i "$UEFI_SHELL_IMAGE"                       ::efi/boot
  mcopy -i "$UEFI_SHELL_IMAGE"  "$UEFI_SHELL_BINARY" ::efi/boot/bootx64.efi
  mcopy -i "$UEFI_SHELL_IMAGE"  "$ENROLLER_BINARY"   ::
  mdir  -i "$UEFI_SHELL_IMAGE"  -/                   ::

  mkisofs -input-charset ASCII -J -rational-rock \
    -e "$UEFI_SHELL_IMAGE" -no-emul-boot \
    -o "$ISO_IMAGE" "$UEFI_SHELL_IMAGE"
}


%if %{build_ovmf}
build ${OVMF_FLAGS} -a X64 \
  -p OvmfPkg/OvmfPkgX64.dsc

build ${OVMF_SB_FLAGS} -a IA32 -a X64 \
  -p OvmfPkg/OvmfPkgIa32X64.dsc

touch OvmfPkg/AmdSev/Grub/grub.efi   # dummy
build ${OVMF_FLAGS} -a X64 \
  -p OvmfPkg/AmdSev/AmdSevX64.dsc
build ${OVMF_FLAGS} -a X64 \
  -p OvmfPkg/IntelTdx/IntelTdxX64.dsc

cmp Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
  Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd

build_iso Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64

virt-fw-vars --input Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
             --output Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \
             --secure-boot

%endif

%ifarch aarch64
build ${CC_FLAGS} -a AARCH64 \
  -p ArmVirtPkg/ArmVirtQemu.dsc \
  -D DEBUG_PRINT_ERROR_LEVEL=0x8040004F
cp -a Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
  Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd

build ${CC_FLAGS} -a AARCH64 \
  -p ArmVirtPkg/ArmVirtQemu.dsc \
  -D DEBUG_PRINT_ERROR_LEVEL=0x80000000
%endif

%ifarch loongarch64
build ${CC_FLAGS} -a LOONGARCH64 \
  -p Platform/Loongson/LoongArchQemuPkg/Loongson.dsc \
  -D DEBUG_PRINT_ERROR_LEVEL=0x8000004F
cp -a Build/LoongArchQemu/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
  Build/LoongArchQemu/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd

build ${CC_FLAGS} -a LOONGARCH64 \
  -p Platform/Loongson/LoongArchQemuPkg/Loongson.dsc \
  -D DEBUG_PRINT_ERROR_LEVEL=0x80000000
%endif

%install

cp -a OvmfPkg/License.txt License.OvmfPkg.txt
cp -a CryptoPkg/Library/OpensslLib/openssl/LICENSE.txt LICENSE.openssl
mkdir -p %{buildroot}%{_datadir}/qemu/firmware

mkdir -p %{buildroot}%{_bindir} \
         %{buildroot}%{_datadir}/%{name}/Conf \
         %{buildroot}%{_datadir}/%{name}/Scripts
install BaseTools/Source/C/bin/* \
        %{buildroot}%{_bindir}
install BaseTools/BinWrappers/PosixLike/LzmaF86Compress \
        %{buildroot}%{_bindir}
install BaseTools/BuildEnv \
        %{buildroot}%{_datadir}/%{name}
install BaseTools/Conf/*.template \
        %{buildroot}%{_datadir}/%{name}/Conf
install BaseTools/Scripts/GccBase.lds \
        %{buildroot}%{_datadir}/%{name}/Scripts


%if %{build_ovmf}
mkdir -p \
  %{buildroot}%{_datadir}/OVMF \
  %{buildroot}%{_datadir}/%{name}/ovmf

install -m 0644 Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.fd
install -m 0644 Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.secboot.fd

install -m 0644 Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_VARS.fd
install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \
  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_VARS.secboot.fd
install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/UefiShell.iso \
  %{buildroot}%{_datadir}/%{name}/ovmf/UefiShell.iso

install -m 0644 Build/AmdSev/DEBUG_%{TOOLCHAIN}/FV/OVMF.fd \
  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF.amdsev.fd
install -m 0644 Build/IntelTdx/DEBUG_%{TOOLCHAIN}/FV/OVMF.fd \
  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF.inteltdx.fd

ln -s ../%{name}/ovmf/OVMF_CODE.fd         %{buildroot}%{_datadir}/OVMF
ln -s ../%{name}/ovmf/OVMF_CODE.secboot.fd %{buildroot}%{_datadir}/OVMF/
ln -s ../%{name}/ovmf/OVMF_VARS.fd         %{buildroot}%{_datadir}/OVMF/
ln -s ../%{name}/ovmf/OVMF_VARS.secboot.fd %{buildroot}%{_datadir}/OVMF/
ln -s ../%{name}/ovmf/UefiShell.iso        %{buildroot}%{_datadir}/OVMF/

install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/Shell.efi \
  %{buildroot}%{_datadir}/%{name}/ovmf/Shell.efi
install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/EnrollDefaultKeys.efi \
  %{buildroot}%{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi

install -m 0644 edk2-ovmf-sb.json \
  %{buildroot}%{_datadir}/qemu/firmware/40-edk2-ovmf-sb.json
install -m 0644 edk2-ovmf.json \
  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf.json
install -m 0644 edk2-ovmf-cc.json \
  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf-cc.json
install -m 0644 edk2-ovmf-amdsev.json \
  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf-amdsev.json
install -m 0644 edk2-ovmf-inteltdx.json \
  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf-inteltdx.json
%endif

mkdir -p %{buildroot}%{_datadir}/AAVMF

%ifarch aarch64
mkdir -p %{buildroot}%{_datadir}/%{name}/aarch64

cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd \
  /dev/zero \
| head -c 64m \
  > %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.raw

cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
  /dev/zero \
| head -c 64m \
  > %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.raw

cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_VARS.fd \
  /dev/zero \
| head -c 64m \
  > %{buildroot}%{_datadir}/%{name}/aarch64/vars-template-pflash.raw

ln -s ../%{name}/aarch64/QEMU_EFI-pflash.raw \
  %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
ln -s ../%{name}/aarch64/QEMU_EFI-silent-pflash.raw \
  %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.fd
ln -s ../%{name}/aarch64/vars-template-pflash.raw \
  %{buildroot}%{_datadir}/AAVMF/AAVMF_VARS.fd

chmod 0644 -- %{buildroot}%{_datadir}/AAVMF/AAVMF_*.fd

install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd \
  %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI.fd
install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
  %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd
install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_VARS.fd \
  %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_VARS.fd

install -m 0644 edk2-aarch64.json \
  %{buildroot}%{_datadir}/qemu/firmware/60-edk2-aarch64.json
install -m 0644 edk2-aarch64-verbose.json \
  %{buildroot}%{_datadir}/qemu/firmware/70-edk2-aarch64-verbose.json
%endif

%ifarch loongarch64
mkdir -p %{buildroot}%{_datadir}/%{name}/loongarch64

cat Build/LoongArchQemu/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd \
  /dev/zero \
| head -c 16m \
  > %{buildroot}%{_datadir}/%{name}/loongarch64/QEMU_EFI-pflash.raw

cat Build/LoongArchQemu/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
  /dev/zero \
| head -c 16m \
  > %{buildroot}%{_datadir}/%{name}/loongarch64/QEMU_EFI-silent-pflash.raw

cat Build/LoongArchQemu/DEBUG_%{TOOLCHAIN}/FV/QEMU_VARS.fd \
  /dev/zero \
| head -c 16m \
  > %{buildroot}%{_datadir}/%{name}/loongarch64/vars-template-pflash.raw

install -m 0644 Build/LoongArchQemu/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd \
  %{buildroot}%{_datadir}/%{name}/loongarch64/QEMU_EFI.fd
install -m 0644 Build/LoongArchQemu/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
  %{buildroot}%{_datadir}/%{name}/loongarch64/QEMU_EFI.silent.fd
install -m 0644 Build/LoongArchQemu/DEBUG_%{TOOLCHAIN}/FV/QEMU_VARS.fd \
  %{buildroot}%{_datadir}/%{name}/loongarch64/QEMU_VARS.fd

install -m 0644 edk2-loongarch64.json \
  %{buildroot}%{_datadir}/qemu/firmware/60-edk2-loongarch64.json
install -m 0644 edk2-loongarch64-verbose.json \
  %{buildroot}%{_datadir}/qemu/firmware/70-edk2-loongarch64-verbose.json
%endif

%check
%if %{build_ovmf}
for file in %{buildroot}%{_datadir}/%{name}/*/*VARS.secboot.fd; do
    test -f "$file" || continue
    virt-fw-vars --input $file --print | grep "SecureBootEnable.*ON" || exit 1
done
%endif

%global common_files \
  %%license License.txt License.OvmfPkg.txt License-History.txt LICENSE.openssl \
  %%dir %%{_datadir}/%%{name}/ \
  %%dir %%{_datadir}/qemu \
  %%dir %%{_datadir}/qemu/firmware

%if %{build_ovmf}
%files ovmf
%common_files
%doc OvmfPkg/README
%doc ovmf-whitepaper-c770f8c.txt
%dir %{_datadir}/OVMF/
%dir %{_datadir}/%{name}/ovmf/
%{_datadir}/%{name}/ovmf/OVMF_CODE.fd
%{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
%{_datadir}/%{name}/ovmf/OVMF_CODE.secboot.fd
%{_datadir}/%{name}/ovmf/OVMF_VARS.fd
%{_datadir}/%{name}/ovmf/OVMF_VARS.secboot.fd
%{_datadir}/%{name}/ovmf/OVMF.amdsev.fd
%{_datadir}/%{name}/ovmf/OVMF.inteltdx.fd
%{_datadir}/%{name}/ovmf/UefiShell.iso
%{_datadir}/OVMF/OVMF_CODE.fd
%{_datadir}/OVMF/OVMF_CODE.secboot.fd
%{_datadir}/OVMF/OVMF_VARS.fd
%{_datadir}/OVMF/OVMF_VARS.secboot.fd
%{_datadir}/OVMF/UefiShell.iso
%{_datadir}/%{name}/ovmf/Shell.efi
%{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi
%{_datadir}/qemu/firmware/40-edk2-ovmf-sb.json
%{_datadir}/qemu/firmware/50-edk2-ovmf-cc.json
%{_datadir}/qemu/firmware/50-edk2-ovmf-amdsev.json
%{_datadir}/qemu/firmware/50-edk2-ovmf-inteltdx.json
%{_datadir}/qemu/firmware/50-edk2-ovmf.json
%endif

%ifarch aarch64
%files aarch64
%common_files
%dir %{_datadir}/AAVMF/
%dir %{_datadir}/%{name}/aarch64/
%{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.raw
%{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.raw
%{_datadir}/%{name}/aarch64/vars-template-pflash.raw
%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
%{_datadir}/AAVMF/AAVMF_CODE.fd
%{_datadir}/AAVMF/AAVMF_VARS.fd
%{_datadir}/%{name}/aarch64/QEMU_EFI.fd
%{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd
%{_datadir}/%{name}/aarch64/QEMU_VARS.fd
%{_datadir}/qemu/firmware/60-edk2-aarch64.json
%{_datadir}/qemu/firmware/70-edk2-aarch64-verbose.json
%endif

%ifarch loongarch64
%files loongarch64
%common_files
%dir %{_datadir}/%{name}/loongarch64/
%{_datadir}/%{name}/loongarch64/QEMU_EFI-pflash.raw
%{_datadir}/%{name}/loongarch64/QEMU_EFI-silent-pflash.raw
%{_datadir}/%{name}/loongarch64/vars-template-pflash.raw
%{_datadir}/%{name}/loongarch64/QEMU_EFI.fd
%{_datadir}/%{name}/loongarch64/QEMU_EFI.silent.fd
%{_datadir}/%{name}/loongarch64/QEMU_VARS.fd
%{_datadir}/qemu/firmware/60-edk2-loongarch64.json
%{_datadir}/qemu/firmware/70-edk2-loongarch64-verbose.json
%endif

%files tools
%license License.txt
%license License-History.txt
%{_bindir}/DevicePath
%{_bindir}/EfiRom
%{_bindir}/GenCrc32
%{_bindir}/GenFfs
%{_bindir}/GenFv
%{_bindir}/GenFw
%{_bindir}/GenSec
%{_bindir}/LzmaCompress
%{_bindir}/LzmaF86Compress
%{_bindir}/TianoCompress
%{_bindir}/VfrCompile
%{_bindir}/VolInfo
%dir %{_datadir}/%{name}
%{_datadir}/%{name}/BuildEnv
%{_datadir}/%{name}/Conf
%{_datadir}/%{name}/Scripts

%files tools-doc
%doc BaseTools/UserManuals/*.rtf


%changelog
* Tue Nov 26 2024 Xiaotian Wu <wuxiaotian@loongson.cn> - 20240223-10
- Update LoongArch virtual machine to fix fdt parse error

* Tue Nov 19 2024 Xiaotian Wu <wuxiaotian@loongson.cn> - 20240223-9
- Update LoongArch virtual machine

* Tue Oct 29 2024 Chunsheng Luo <luffyluo@tencent.com> - 20240223-8
- Fix OpenSSL CVE-2024-9143

* Thu Oct 10 2024 Chunsheng Luo <luffyluo@tencent.com> - 20240223-7
- Fix CVE-2024-38796 edk2: Integer overflows in PeCoffLoaderRelocateImage

* Thu Sep 26 2024 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 20240223-6
- Rebuilt for clarifying the packages requirement in BaseOS and AppStream

* Fri Aug 16 2024 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 20240223-5
- Rebuilt for loongarch release

* Tue Aug 06 2024 Xiaotian Wu <wuxiaotian@loongson.cn> - 20240223-4
- Change the size of LoongArch64 UEFI firmware to 16m

* Thu Jun 06 2024 Chunsheng Luo <luffyluo@tencent.com> - 20240223-3
- Fix CVE-2024-1298

* Thu Jun 06 2024 Xiaotian Wu <wuxiaotian@loongson.cn> - 20240223-2
- Support to create UEFI firmware for loongarch64 virtual machines

* Mon Jun 03 2024 cunshunxia <cunshunxia@tencent.com> - 20240223-1
- Upgrade to version edk2-stable202402
- Support Hygon CSV3 feature, support live migration for Hygon CSV1/2/3 guests, by hanliyang@hygon.cn

* Fri May 17 2024 Liyang Han <hanliyang@hygon.cn> - 20230524gitba91d0292e-7
- Add support for live migration of Hygon CSV1/2/3 guests, fix nesting #VC

* Thu May 16 2024 Liyang Han <hanliyang@hygon.cn> - 20230524gitba91d0292e-6
- Add support for Hygon CSV3 feature

* Thu May 09 2024 Huang Yang <huangyang@loongson.cn> - 20230524gitba91d0292e-5
- add loongarch64 in ExclusiveArch

* Tue Mar 12 2024 Chunsheng Luo <luffyluo@tencent.com> - 20230524gitba91d0292e-4
- fix CVE-2023-45229 CVE-2023-45230 CVE-2023-45231 CVE-2023-45232 CVE-2023-45233 CVE-2023-45234 CVE-2023-45235

* Mon Mar 11 2024 Chunsheng Luo <luffyluo@tencent.com> - 20230524gitba91d0292e-3
- fix CVE-2022-36763 CVE-2022-36764 CVE-2022-36765

* Fri Sep 08 2023 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 20230524gitba91d0292e-2
- Rebuilt for OpenCloudOS Stream 23.09

* Thu Jul 20 2023 cunshunxia <cunshunxia@tencent.com> - 20230524gitba91d0292e-1
- upgrade to 20230524gitba91d0292e.

* Wed Jul 19 2023 cunshunxia <cunshunxia@tencent.com> - 20220826gitba0e0e4c6a17-6
- Rebuilt for httpd 2.4.57

* Fri Apr 28 2023 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 20220826gitba0e0e4c6a17-5
- Rebuilt for OpenCloudOS Stream 23.05

* Thu Apr 13 2023 cunshunxia <cunshunxia@tencent.com> - 20220826gitba0e0e4c6a17-4
- build aarch64 subpkg only on arm.

-* Fri Mar 31 2023 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 20220826gitba0e0e4c6a17-3
-- Rebuilt for OpenCloudOS Stream 23

* Tue Jan 10 2023 cunshunxia <cunshunxia@tencent.com> - 20220826gitba0e0e4c6a17-2
- remove unused option

* Mon Dec 26 2022 cunshunxia <cunshunxia@tencent.com> - 20220826gitba0e0e4c6a17-1
- initial build