summaryrefslogtreecommitdiffstats
path: root/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include
diff options
context:
space:
mode:
Diffstat (limited to 'src/VBox/Devices/EFI/Firmware/OvmfPkg/Include')
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/ConfidentialComputingSecret.h28
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/LinuxEfiInitrdMedia.h17
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/MicrosoftVendor.h55
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h45
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/OvmfPlatformConfig.h18
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/QemuKernelLoaderFsMedia.h18
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/QemuRamfb.h19
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/RootBridgesConnectedEventGroup.h27
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/VirtioMmioTransport.h19
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/XenBusRootDevice.h18
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/XenInfo.h36
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Bhyve.h18
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/E820.h39
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/FusionMptScsi.h160
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/I440FxPiix4.h58
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/InstructionParsing.h83
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/LegacyVgaBios.h129
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/LinuxBzimage.h158
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/LsiScsi.h105
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/PageTable.h161
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/PvScsi.h186
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Q35MchIch9.h127
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuCpuHotplug.h48
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuFwCfg.h98
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuPciBridgeCapabilities.h54
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuTpm.h63
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio.h18
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio095.h169
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio095Net.h91
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio10.h84
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio10Net.h26
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioBlk.h83
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioFs.h454
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioGpu.h210
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioNet.h16
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioScsi.h93
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/README37
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-arm/xen.h420
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/hvm/start_info.h143
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/xen-x86_32.h43
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/xen-x86_64.h43
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/xen.h96
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/event_channel.h102
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/grant_table.h428
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/hvm/hvm_op.h21
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/hvm/params.h134
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/blkif.h603
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/console.h35
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/protocols.h24
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/ring.h296
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/xenbus.h64
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/xs_wire.h133
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/memory.h101
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/xen-compat.h28
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/xen.h331
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/BhyveFwCtlLib.h47
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/LoadLinuxLib.h205
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/MemEncryptSevLib.h206
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/NvVarsFileLib.h45
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciCapLib.h423
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciCapPciIoLib.h52
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciCapPciSegmentLib.h76
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciHostBridgeUtilityLib.h185
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PlatformBmPrintScLib.h35
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PlatformFvbLib.h81
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuBootOrderLib.h99
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuFwCfgLib.h177
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuFwCfgS3Lib.h355
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuFwCfgSimpleParserLib.h128
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuLoadImageLib.h84
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/SerializeVariablesLib.h223
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/VirtioLib.h316
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/VirtioMmioDeviceLib.h60
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/XenHypercallLib.h104
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/XenIoMmioLib.h58
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/XenPlatformLib.h53
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/OvmfPlatforms.h41
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Pcd/CpuHotEjectData.h60
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/Legacy8259.h291
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/OvmfLoadedX86LinuxKernel.h32
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/VirtioDevice.h520
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/XenBus.h410
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/XenIo.h42
-rw-r--r--src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Register/QemuSmramSaveStateMap.h178
84 files changed, 10699 insertions, 0 deletions
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/ConfidentialComputingSecret.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/ConfidentialComputingSecret.h
new file mode 100644
index 00000000..23169958
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/ConfidentialComputingSecret.h
@@ -0,0 +1,28 @@
+ /** @file
+ UEFI Configuration Table for exposing the SEV Launch Secret location to UEFI
+ applications (boot loaders).
+
+ Copyright (C) 2020 James Bottomley, IBM Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+ **/
+
+#ifndef CONFIDENTIAL_COMPUTING_SECRET_H_
+#define CONFIDENTIAL_COMPUTING_SECRET_H_
+
+#include <Uefi/UefiBaseType.h>
+
+#define CONFIDENTIAL_COMPUTING_SECRET_GUID \
+ { 0xadf956ad, \
+ 0xe98c, \
+ 0x484c, \
+ { 0xae, 0x11, 0xb5, 0x1c, 0x7d, 0x33, 0x64, 0x47 }, \
+ }
+
+typedef struct {
+ UINT64 Base;
+ UINT64 Size;
+} CONFIDENTIAL_COMPUTING_SECRET_LOCATION;
+
+extern EFI_GUID gConfidentialComputingSecretGuid;
+
+#endif // SEV_LAUNCH_SECRET_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/LinuxEfiInitrdMedia.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/LinuxEfiInitrdMedia.h
new file mode 100644
index 00000000..4bfb11a7
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/LinuxEfiInitrdMedia.h
@@ -0,0 +1,17 @@
+/** @file
+ GUID definition for the Linux Initrd media device path
+
+ Copyright (c) 2020, Arm, Ltd. All rights reserved.<BR>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef LINUX_EFI_INITRD_MEDIA_GUID_H__
+#define LINUX_EFI_INITRD_MEDIA_GUID_H__
+
+#define LINUX_EFI_INITRD_MEDIA_GUID \
+ {0x5568e427, 0x68fc, 0x4f3d, {0xac, 0x74, 0xca, 0x55, 0x52, 0x31, 0xcc, 0x68}}
+
+extern EFI_GUID gLinuxEfiInitrdMediaGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/MicrosoftVendor.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/MicrosoftVendor.h
new file mode 100644
index 00000000..4cfe7969
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/MicrosoftVendor.h
@@ -0,0 +1,55 @@
+/** @file
+ Declare the GUID that is expected:
+
+ - as EFI_SIGNATURE_DATA.SignatureOwner GUID in association with X509 and
+ RSA2048 Secure Boot certificates issued by/for Microsoft,
+
+ - as UEFI variable vendor GUID in association with (unspecified)
+ Microsoft-owned variables.
+
+ Copyright (C) 2014-2019, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+ @par Specification Reference:
+ - MSDN: System.Fundamentals.Firmware at
+ <https://msdn.microsoft.com/en-us/ie/dn932805(v=vs.94)>.
+**/
+
+#ifndef MICROSOFT_VENDOR_H_
+#define MICROSOFT_VENDOR_H_
+
+#include <Uefi/UefiBaseType.h>
+
+//
+// The following test cases of the Secure Boot Logo Test in the Microsoft
+// Hardware Certification Kit:
+//
+// - Microsoft.UefiSecureBootLogo.Tests.OutOfBoxVerifyMicrosoftKEKpresent
+// - Microsoft.UefiSecureBootLogo.Tests.OutOfBoxConfirmMicrosoftSignatureInDB
+//
+// expect the EFI_SIGNATURE_DATA.SignatureOwner GUID to be
+// 77FA9ABD-0359-4D32-BD60-28F4E78F784B, when the
+// EFI_SIGNATURE_DATA.SignatureData field carries any of the following X509
+// certificates:
+//
+// - "Microsoft Corporation KEK CA 2011" (in KEK)
+// - "Microsoft Windows Production PCA 2011" (in db)
+// - "Microsoft Corporation UEFI CA 2011" (in db)
+//
+// This is despite the fact that the UEFI specification requires
+// EFI_SIGNATURE_DATA.SignatureOwner to reflect the agent (i.e., OS,
+// application or driver) that enrolled and therefore owns
+// EFI_SIGNATURE_DATA.SignatureData, and not the organization that issued
+// EFI_SIGNATURE_DATA.SignatureData.
+//
+#define MICROSOFT_VENDOR_GUID \
+ { 0x77fa9abd, \
+ 0x0359, \
+ 0x4d32, \
+ { 0xbd, 0x60, 0x28, 0xf4, 0xe7, 0x8f, 0x78, 0x4b }, \
+ }
+
+extern EFI_GUID gMicrosoftVendorGuid;
+
+#endif /* MICROSOFT_VENDOR_H_ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h
new file mode 100644
index 00000000..7007ee57
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h
@@ -0,0 +1,45 @@
+/** @file
+ Declare the application prefix string as a GUID, for locating the PK/KEK1
+ X509 certificate to enroll, in the "OEM Strings" SMBIOS table.
+
+ Copyright (C) 2019, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+ @par Specification Reference:
+ - https://git.qemu.org/?p=qemu.git;a=commit;h=2d6dcbf93fb0
+ - https://libvirt.org/formatdomain.html#elementsSysinfo
+ - https://bugs.launchpad.net/qemu/+bug/1826200
+ - https://bugzilla.tianocore.org/show_bug.cgi?id=1747
+**/
+
+#ifndef OVMF_PK_KEK1_APP_PREFIX_H_
+#define OVMF_PK_KEK1_APP_PREFIX_H_
+
+#include <Uefi/UefiBaseType.h>
+
+//
+// For the EnrollDefaultKeys application, the hypervisor is expected to add a
+// string entry to the "OEM Strings" (Type 11) SMBIOS table, with the following
+// format:
+//
+// 4e32566d-8e9e-4f52-81d3-5bb9715f9727:<Base64 X509 cert for PK and first KEK>
+//
+// The string representation of the GUID at the front is the "application
+// prefix". It is matched by EnrollDefaultKeys case-insensitively.
+//
+// The base64-encoded blob following the application prefix and the colon (:)
+// is an X509 certificate in DER representation; the hypervisor instructs
+// EnrollDefaultKeys to enroll this certificate as both Platform Key and first
+// Key Exchange Key.
+//
+#define OVMF_PK_KEK1_APP_PREFIX_GUID \
+ { 0x4e32566d, \
+ 0x8e9e, \
+ 0x4f52, \
+ { 0x81, 0xd3, 0x5b, 0xb9, 0x71, 0x5f, 0x97, 0x27 }, \
+ }
+
+extern EFI_GUID gOvmfPkKek1AppPrefixGuid;
+
+#endif /* OVMF_PK_KEK1_APP_PREFIX_H_ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/OvmfPlatformConfig.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/OvmfPlatformConfig.h
new file mode 100644
index 00000000..d1da5ed9
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/OvmfPlatformConfig.h
@@ -0,0 +1,18 @@
+/** @file
+ GUID for UEFI variables that are specific to OVMF configuration.
+
+ Copyright (C) 2014, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __OVMF_PLATFORM_CONFIG_H__
+#define __OVMF_PLATFORM_CONFIG_H__
+
+#define OVMF_PLATFORM_CONFIG_GUID \
+{0x7235c51c, 0x0c80, 0x4cab, {0x87, 0xac, 0x3b, 0x08, 0x4a, 0x63, 0x04, 0xb1}}
+
+extern EFI_GUID gOvmfPlatformConfigGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/QemuKernelLoaderFsMedia.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/QemuKernelLoaderFsMedia.h
new file mode 100644
index 00000000..dd571a4a
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/QemuKernelLoaderFsMedia.h
@@ -0,0 +1,18 @@
+/** @file
+ GUID definition for the QEMU LoaderFs media device path, containing the
+ kernel, initrd and command line as file objects
+
+ Copyright (c) 2020, Arm, Ltd. All rights reserved.<BR>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef QEMU_KERNEL_LOADER_FS_MEDIA_GUID_H__
+#define QEMU_KERNEL_LOADER_FS_MEDIA_GUID_H__
+
+#define QEMU_KERNEL_LOADER_FS_MEDIA_GUID \
+ {0x1428f772, 0xb64a, 0x441e, {0xb8, 0xc3, 0x9e, 0xbd, 0xd7, 0xf8, 0x93, 0xc7}}
+
+extern EFI_GUID gQemuKernelLoaderFsMediaGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/QemuRamfb.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/QemuRamfb.h
new file mode 100644
index 00000000..9834c6bb
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/QemuRamfb.h
@@ -0,0 +1,19 @@
+/** @file
+ Recommended GUID to be used in the Vendor Hardware device path nodes that
+ identify qemu ramfb devices.
+
+ Copyright (C) 2018, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __QEMU_RAMFB_H__
+#define __QEMU_RAMFB_H__
+
+#define QEMU_RAMFB_GUID \
+{0x557423a1, 0x63ab, 0x406c, {0xbe, 0x7e, 0x91, 0xcd, 0xbc, 0x08, 0xc4, 0x57}}
+
+extern EFI_GUID gQemuRamfbGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/RootBridgesConnectedEventGroup.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/RootBridgesConnectedEventGroup.h
new file mode 100644
index 00000000..49a9f3e5
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/RootBridgesConnectedEventGroup.h
@@ -0,0 +1,27 @@
+/** @file
+ An event group GUID with which BDS indicates that PCI root bridges have been
+ connected, and PciIo protocol instances have become available.
+
+ Note that this differs from the PCI Enumeration Complete Protocol as defined
+ in the PI 1.1 specification. That protocol is installed by the PCI bus driver
+ after enumeration and resource allocation have been completed, but before
+ PciIo protocol instances are created.
+
+ Copyright (C) 2016, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef _ROOT_BRIDGES_CONNECTED_EVENT_GROUP_H_
+#define _ROOT_BRIDGES_CONNECTED_EVENT_GROUP_H_
+
+#define ROOT_BRIDGES_CONNECTED_EVENT_GROUP_GUID \
+ { 0x24a2d66f, \
+ 0xeedd, \
+ 0x4086, \
+ { 0x90, 0x42, 0xf2, 0x6e, 0x47, 0x97, 0xee, 0x69 }, \
+ }
+
+extern EFI_GUID gRootBridgesConnectedEventGroupGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/VirtioMmioTransport.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/VirtioMmioTransport.h
new file mode 100644
index 00000000..fc790063
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/VirtioMmioTransport.h
@@ -0,0 +1,19 @@
+/** @file
+ Recommended GUID to be used in the Vendor Hardware device path nodes that
+ identify virtio-mmio transports.
+
+ Copyright (C) 2014, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __VIRTIO_MMIO_TRANSPORT_H__
+#define __VIRTIO_MMIO_TRANSPORT_H__
+
+#define VIRTIO_MMIO_TRANSPORT_GUID \
+{0x837dca9e, 0xe874, 0x4d82, {0xb2, 0x9a, 0x23, 0xfe, 0x0e, 0x23, 0xd1, 0xe2}}
+
+extern EFI_GUID gVirtioMmioTransportGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/XenBusRootDevice.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/XenBusRootDevice.h
new file mode 100644
index 00000000..7558d595
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/XenBusRootDevice.h
@@ -0,0 +1,18 @@
+/** @file
+ GUID to be used to identify the XenBus root node on non-PCI Xen guests
+
+ Copyright (C) 2015, Linaro Ltd.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __XENBUS_ROOT_DEVICE_H__
+#define __XENBUS_ROOT_DEVICE_H__
+
+#define XENBUS_ROOT_DEVICE_GUID \
+{0xa732241f, 0x383d, 0x4d9c, {0x8a, 0xe1, 0x8e, 0x09, 0x83, 0x75, 0x89, 0xd7}}
+
+extern EFI_GUID gXenBusRootDeviceGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/XenInfo.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/XenInfo.h
new file mode 100644
index 00000000..93fb89be
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Guid/XenInfo.h
@@ -0,0 +1,36 @@
+/** @file
+ XenInfo HOB passed by PEI into DXE.
+
+Copyright (c) 2011, Andrei Warkentin <andreiw@motorola.com>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __XEN_INFO_H__
+#define __XEN_INFO_H__
+
+#define EFI_XEN_INFO_GUID \
+ { 0xd3b46f3b, 0xd441, 0x1244, {0x9a, 0x12, 0x0, 0x12, 0x27, 0x3f, 0xc1, 0x4d } }
+
+typedef struct {
+ ///
+ /// Beginning of the hypercall page.
+ ///
+ VOID *HyperPages;
+ ///
+ /// Hypervisor major version.
+ ///
+ UINT16 VersionMajor;
+ ///
+ /// Hypervisor minor version.
+ ///
+ UINT16 VersionMinor;
+ ///
+ /// Pointer to the RSDP found in the hvm_start_info provided to a PVH guest
+ ///
+ VOID *RsdpPvh;
+} EFI_XEN_INFO;
+
+extern EFI_GUID gEfiXenInfoGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Bhyve.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Bhyve.h
new file mode 100644
index 00000000..2b5e93c0
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Bhyve.h
@@ -0,0 +1,18 @@
+/** @file
+ Various register numbers and value bits based on FreeBSD's bhyve
+ at r359530.
+ - https://svnweb.freebsd.org/base?view=revision&revision=359530
+
+ Copyright (C) 2020, Rebecca Cran <rebecca@bsdio.com>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __BHYVE_H__
+#define __BHYVE_H__
+
+#define BHYVE_ACPI_TIMER_IO_ADDR 0x408
+
+#define BHYVE_PM_REG 0x404
+
+#endif // __BHYVE_H__
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/E820.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/E820.h
new file mode 100644
index 00000000..fcfd4afb
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/E820.h
@@ -0,0 +1,39 @@
+/** @file
+
+Copyright (c) 2013, Citrix Systems UK Ltd.
+Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>
+
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+
+#ifndef __E820_H__
+#define __E820_H__
+
+#pragma pack(1)
+
+typedef enum {
+ EfiAcpiAddressRangeMemory = 1,
+ EfiAcpiAddressRangeReserved = 2,
+ EfiAcpiAddressRangeACPI = 3,
+ EfiAcpiAddressRangeNVS = 4
+} EFI_ACPI_MEMORY_TYPE;
+
+typedef struct {
+ UINT64 BaseAddr;
+ UINT64 Length;
+ EFI_ACPI_MEMORY_TYPE Type;
+} EFI_E820_ENTRY64;
+
+typedef struct {
+ UINT32 BassAddrLow;
+ UINT32 BaseAddrHigh;
+ UINT32 LengthLow;
+ UINT32 LengthHigh;
+ EFI_ACPI_MEMORY_TYPE Type;
+} EFI_E820_ENTRY;
+
+#pragma pack()
+
+#endif /* __E820_H__ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/FusionMptScsi.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/FusionMptScsi.h
new file mode 100644
index 00000000..d8dc4bba
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/FusionMptScsi.h
@@ -0,0 +1,160 @@
+/** @file
+
+ Macros and type definitions for LSI Fusion MPT SCSI devices.
+
+ Copyright (C) 2020, Oracle and/or its affiliates.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __FUSION_MPT_SCSI_H__
+#define __FUSION_MPT_SCSI_H__
+
+//
+// Device offsets and constants
+//
+
+#define LSI_LOGIC_PCI_VENDOR_ID 0x1000
+#define LSI_53C1030_PCI_DEVICE_ID 0x0030
+#define LSI_SAS1068_PCI_DEVICE_ID 0x0054
+#define LSI_SAS1068E_PCI_DEVICE_ID 0x0058
+
+#define MPT_REG_DOORBELL 0x00
+#define MPT_REG_WRITE_SEQ 0x04
+#define MPT_REG_HOST_DIAG 0x08
+#define MPT_REG_TEST 0x0c
+#define MPT_REG_DIAG_DATA 0x10
+#define MPT_REG_DIAG_ADDR 0x14
+#define MPT_REG_ISTATUS 0x30
+#define MPT_REG_IMASK 0x34
+#define MPT_REG_REQ_Q 0x40
+#define MPT_REG_REP_Q 0x44
+
+#define MPT_DOORBELL_RESET 0x40
+#define MPT_DOORBELL_HANDSHAKE 0x42
+
+#define MPT_IMASK_DOORBELL 0x01
+#define MPT_IMASK_REPLY 0x08
+
+#define MPT_MESSAGE_HDR_FUNCTION_SCSI_IO_REQUEST 0x00
+#define MPT_MESSAGE_HDR_FUNCTION_IOC_INIT 0x02
+
+#define MPT_SG_ENTRY_TYPE_SIMPLE 0x01
+
+#define MPT_IOC_WHOINIT_ROM_BIOS 0x02
+
+#define MPT_SCSIIO_REQUEST_CONTROL_TXDIR_NONE (0x00 << 24)
+#define MPT_SCSIIO_REQUEST_CONTROL_TXDIR_WRITE (0x01 << 24)
+#define MPT_SCSIIO_REQUEST_CONTROL_TXDIR_READ (0x02 << 24)
+
+#define MPT_SCSI_IOCSTATUS_SUCCESS 0x0000
+#define MPT_SCSI_IOCSTATUS_DEVICE_NOT_THERE 0x0043
+#define MPT_SCSI_IOCSTATUS_DATA_OVERRUN 0x0044
+#define MPT_SCSI_IOCSTATUS_DATA_UNDERRUN 0x0045
+
+//
+// Device structures
+//
+
+#pragma pack (1)
+typedef struct {
+ UINT8 WhoInit;
+ UINT8 Reserved1;
+ UINT8 ChainOffset;
+ UINT8 Function;
+ UINT8 Flags;
+ UINT8 MaxDevices;
+ UINT8 MaxBuses;
+ UINT8 MessageFlags;
+ UINT32 MessageContext;
+ UINT16 ReplyFrameSize;
+ UINT16 Reserved2;
+ UINT32 HostMfaHighAddr;
+ UINT32 SenseBufferHighAddr;
+} MPT_IO_CONTROLLER_INIT_REQUEST;
+
+typedef struct {
+ UINT8 WhoInit;
+ UINT8 Reserved1;
+ UINT8 MessageLength;
+ UINT8 Function;
+ UINT8 Flags;
+ UINT8 MaxDevices;
+ UINT8 MaxBuses;
+ UINT8 MessageFlags;
+ UINT32 MessageContext;
+ UINT16 Reserved2;
+ UINT16 IocStatus;
+ UINT32 IocLogInfo;
+} MPT_IO_CONTROLLER_INIT_REPLY;
+
+typedef struct {
+ UINT8 TargetId;
+ UINT8 Bus;
+ UINT8 ChainOffset;
+ UINT8 Function;
+ UINT8 CdbLength;
+ UINT8 SenseBufferLength;
+ UINT8 Reserved;
+ UINT8 MessageFlags;
+ UINT32 MessageContext;
+ UINT8 Lun[8];
+ UINT32 Control;
+ UINT8 Cdb[16];
+ UINT32 DataLength;
+ UINT32 SenseBufferLowAddress;
+} MPT_SCSI_IO_REQUEST;
+
+typedef struct {
+ UINT32 Length: 24;
+ UINT32 EndOfList: 1;
+ UINT32 Is64BitAddress: 1;
+ //
+ // True when the buffer contains data to be transfered. Otherwise it's the
+ // destination buffer
+ //
+ UINT32 BufferContainsData: 1;
+ UINT32 LocalAddress: 1;
+ UINT32 ElementType: 2;
+ UINT32 EndOfBuffer: 1;
+ UINT32 LastElement: 1;
+ UINT64 DataBufferAddress;
+} MPT_SG_ENTRY_SIMPLE;
+
+typedef struct {
+ UINT8 TargetId;
+ UINT8 Bus;
+ UINT8 MessageLength;
+ UINT8 Function;
+ UINT8 CdbLength;
+ UINT8 SenseBufferLength;
+ UINT8 Reserved;
+ UINT8 MessageFlags;
+ UINT32 MessageContext;
+ UINT8 ScsiStatus;
+ UINT8 ScsiState;
+ UINT16 IocStatus;
+ UINT32 IocLogInfo;
+ UINT32 TransferCount;
+ UINT32 SenseCount;
+ UINT32 ResponseInfo;
+} MPT_SCSI_IO_REPLY;
+
+typedef struct {
+ MPT_SCSI_IO_REQUEST Header;
+ MPT_SG_ENTRY_SIMPLE Sg;
+} MPT_SCSI_REQUEST_WITH_SG;
+#pragma pack ()
+
+typedef union {
+ MPT_SCSI_IO_REPLY Data;
+ UINT64 Uint64; // 8 byte alignment required by HW
+} MPT_SCSI_IO_REPLY_ALIGNED;
+
+typedef union {
+ MPT_SCSI_REQUEST_WITH_SG Data;
+ UINT64 Uint64; // 8 byte alignment required by HW
+} MPT_SCSI_REQUEST_ALIGNED;
+
+#endif // __FUSION_MPT_SCSI_H__
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/I440FxPiix4.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/I440FxPiix4.h
new file mode 100644
index 00000000..3ce8a003
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/I440FxPiix4.h
@@ -0,0 +1,58 @@
+/** @file
+ Various register numbers and value bits based on the following publications:
+ - Intel(R) datasheet 290549-001
+ - Intel(R) datasheet 290562-001
+ - Intel(R) datasheet 297654-006
+ - Intel(R) datasheet 297738-017
+
+ Copyright (C) 2015, Red Hat, Inc.
+ Copyright (c) 2014, Gabriel L. Somlo <somlo@cmu.edu>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __I440FX_PIIX4_H__
+#define __I440FX_PIIX4_H__
+
+#include <Library/PciLib.h>
+
+//
+// Host Bridge Device ID (DID) value for I440FX
+//
+#define INTEL_82441_DEVICE_ID 0x1237
+
+//
+// B/D/F/Type: 0/0/0/PCI
+//
+#define PMC_REGISTER_PIIX4(Offset) PCI_LIB_ADDRESS (0, 0, 0, (Offset))
+
+#define PIIX4_PAM0 0x59
+#define PIIX4_PAM1 0x5A
+#define PIIX4_PAM2 0x5B
+#define PIIX4_PAM3 0x5C
+#define PIIX4_PAM4 0x5D
+#define PIIX4_PAM5 0x5E
+#define PIIX4_PAM6 0x5F
+
+//
+// B/D/F/Type: 0/1/3/PCI
+//
+#ifdef VBOX
+#define POWER_MGMT_REGISTER_PIIX4(Offset) PCI_LIB_ADDRESS (0, 7, 0, (Offset))
+#else
+#define POWER_MGMT_REGISTER_PIIX4(Offset) PCI_LIB_ADDRESS (0, 1, 3, (Offset))
+#endif
+
+#define PIIX4_PMBA 0x40
+#define PIIX4_PMBA_MASK (BIT15 | BIT14 | BIT13 | BIT12 | BIT11 | \
+ BIT10 | BIT9 | BIT8 | BIT7 | BIT6)
+
+#define PIIX4_PMREGMISC 0x80
+#define PIIX4_PMREGMISC_PMIOSE BIT0
+
+//
+// IO ports
+//
+#define PIIX4_CPU_HOTPLUG_BASE 0xAF00
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/InstructionParsing.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/InstructionParsing.h
new file mode 100644
index 00000000..2e9cfa7f
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/InstructionParsing.h
@@ -0,0 +1,83 @@
+/** @file
+ Instruction parsing support definitions.
+
+ Copyright (C) 2020, Advanced Micro Devices, Inc. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __INSTRUCTION_PARSING_H__
+#define __INSTRUCTION_PARSING_H__
+
+#include <Base.h>
+#include <Uefi.h>
+
+//
+// Instruction REX prefix definition
+//
+typedef union {
+ struct {
+ UINT8 BitB:1;
+ UINT8 BitX:1;
+ UINT8 BitR:1;
+ UINT8 BitW:1;
+ UINT8 Rex:4;
+ } Bits;
+
+ UINT8 Uint8;
+} INSTRUCTION_REX_PREFIX;
+
+//
+// Instruction ModRM definition
+//
+typedef union {
+ struct {
+ UINT8 Rm:3;
+ UINT8 Reg:3;
+ UINT8 Mod:2;
+ } Bits;
+
+ UINT8 Uint8;
+} INSTRUCTION_MODRM;
+
+//
+// Instruction SIB definition
+//
+typedef union {
+ struct {
+ UINT8 Base:3;
+ UINT8 Index:3;
+ UINT8 Scale:2;
+ } Bits;
+
+ UINT8 Uint8;
+} INSTRUCTION_SIB;
+
+//
+// Legacy Instruction Prefixes
+//
+#define OVERRIDE_SEGMENT_CS 0x2E
+#define OVERRIDE_SEGMENT_DS 0x3E
+#define OVERRIDE_SEGMENT_ES 0x26
+#define OVERRIDE_SEGMENT_SS 0x36
+#define OVERRIDE_SEGMENT_FS 0x64
+#define OVERRIDE_SEGMENT_GS 0x65
+#define OVERRIDE_OPERAND_SIZE 0x66
+#define OVERRIDE_ADDRESS_SIZE 0x67
+#define LOCK_PREFIX 0xF0
+#define REPNZ_PREFIX 0xF2
+#define REPZ_PREFIX 0xF3
+
+//
+// REX Prefixes
+//
+#define REX_PREFIX_START 0x40
+#define REX_PREFIX_STOP 0x4F
+#define REX_64BIT_OPERAND_SIZE_MASK 0x08
+
+//
+// Two-byte Opcode Flag
+//
+#define TWO_BYTE_OPCODE_ESCAPE 0x0F
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/LegacyVgaBios.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/LegacyVgaBios.h
new file mode 100644
index 00000000..a22d493a
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/LegacyVgaBios.h
@@ -0,0 +1,129 @@
+/** @file
+ Type definitions related to the VBE (VESA BIOS Extension, Int10h AH=4Fh)
+ services GET INFORMATION (AL=00h) and GET MODE INFORMATION (AL=01h).
+
+ For reference, see Ralf Brown's Interrupt List:
+ <http://www.cs.cmu.edu/~ralf/files.html>
+ <http://www.ctyme.com/rbrown.htm>
+
+ Copyright (C) 2014, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __LEGACY_VGA_BIOS_H__
+#define __LEGACY_VGA_BIOS_H__
+
+#include <Base.h>
+
+#pragma pack (1)
+typedef struct {
+ UINT8 Signature[4];
+ UINT16 VesaVersion;
+ UINT32 OemNameAddress;
+ UINT32 Capabilities;
+ UINT32 ModeListAddress;
+ UINT16 VideoMem64K;
+ UINT16 OemSoftwareVersion;
+ UINT32 VendorNameAddress;
+ UINT32 ProductNameAddress;
+ UINT32 ProductRevAddress;
+} VBE_INFO_BASE;
+
+typedef struct {
+ VBE_INFO_BASE Base;
+ UINT8 Buffer[256 - sizeof (VBE_INFO_BASE)];
+} VBE_INFO;
+
+typedef struct {
+ UINT16 ModeAttr;
+ UINT8 WindowAAttr;
+ UINT8 WindowBAttr;
+ UINT16 WindowGranularityKB;
+ UINT16 WindowSizeKB;
+ UINT16 WindowAStartSegment;
+ UINT16 WindowBStartSegment;
+ UINT32 WindowPositioningAddress;
+ UINT16 BytesPerScanLine;
+
+ UINT16 Width;
+ UINT16 Height;
+ UINT8 CharCellWidth;
+ UINT8 CharCellHeight;
+ UINT8 NumPlanes;
+ UINT8 BitsPerPixel;
+ UINT8 NumBanks;
+ UINT8 MemoryModel;
+ UINT8 BankSizeKB;
+ UINT8 NumImagePagesLessOne;
+ UINT8 Vbe3;
+
+ UINT8 RedMaskSize;
+ UINT8 RedMaskPos;
+ UINT8 GreenMaskSize;
+ UINT8 GreenMaskPos;
+ UINT8 BlueMaskSize;
+ UINT8 BlueMaskPos;
+ UINT8 ReservedMaskSize;
+ UINT8 ReservedMaskPos;
+ UINT8 DirectColorModeInfo;
+
+ UINT32 LfbAddress;
+ UINT32 OffScreenAddress;
+ UINT16 OffScreenSizeKB;
+
+ UINT16 BytesPerScanLineLinear;
+ UINT8 NumImagesLessOneBanked;
+ UINT8 NumImagesLessOneLinear;
+ UINT8 RedMaskSizeLinear;
+ UINT8 RedMaskPosLinear;
+ UINT8 GreenMaskSizeLinear;
+ UINT8 GreenMaskPosLinear;
+ UINT8 BlueMaskSizeLinear;
+ UINT8 BlueMaskPosLinear;
+ UINT8 ReservedMaskSizeLinear;
+ UINT8 ReservedMaskPosLinear;
+ UINT32 MaxPixelClockHz;
+ UINT8 Reserved[190];
+} VBE_MODE_INFO;
+
+typedef struct {
+ UINT16 ModeAttr;
+ UINT8 WindowAAttr;
+ UINT8 WindowBAttr;
+ UINT16 WindowGranularityKB;
+ UINT16 WindowSizeKB;
+ UINT16 WindowAStartSegment;
+ UINT16 WindowBStartSegment;
+ UINT32 WindowPositioningAddress;
+ UINT16 BytesPerScanLine;
+
+ UINT16 Width;
+ UINT16 Height;
+ UINT8 CharCellWidth;
+ UINT8 CharCellHeight;
+ UINT8 NumPlanes;
+ UINT8 BitsPerPixel;
+ UINT8 NumBanks;
+ UINT8 MemoryModel;
+ UINT8 BankSizeKB;
+ UINT8 NumImagePagesLessOne;
+ UINT8 Vbe3;
+
+ UINT8 RedMaskSize;
+ UINT8 RedMaskPos;
+ UINT8 GreenMaskSize;
+ UINT8 GreenMaskPos;
+ UINT8 BlueMaskSize;
+ UINT8 BlueMaskPos;
+ UINT8 ReservedMaskSize;
+ UINT8 ReservedMaskPos;
+ UINT8 DirectColorModeInfo;
+
+ UINT32 LfbAddress;
+ UINT32 OffScreenAddress;
+ UINT16 OffScreenSizeKB;
+} VBE2_MODE_INFO;
+#pragma pack ()
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/LinuxBzimage.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/LinuxBzimage.h
new file mode 100644
index 00000000..764e70a0
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/LinuxBzimage.h
@@ -0,0 +1,158 @@
+/** @file
+
+ Copyright (c) 2011 - 2013, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __LINUX_BZIMAGE_H__
+#define __LINUX_BZIMAGE_H__
+
+#define BOOTSIG 0x1FE
+#define SETUP_HDR 0x53726448 /* 0x53726448 == "HdrS" */
+
+#define E820_RAM 1
+#define E820_RESERVED 2
+#define E820_ACPI 3
+#define E820_NVS 4
+#define E820_UNUSABLE 5
+
+#pragma pack(1)
+
+struct setup_header {
+ UINT8 setup_secs; /* Sectors for setup code */
+ UINT16 root_flags;
+ UINT32 sys_size;
+ UINT16 ram_size;
+ UINT16 video_mode;
+ UINT16 root_dev;
+ UINT16 signature; /* Boot signature */
+ UINT16 jump;
+ UINT32 header;
+ UINT16 version;
+ UINT16 su_switch;
+ UINT16 setup_seg;
+ UINT16 start_sys;
+ UINT16 kernel_ver;
+ UINT8 loader_id;
+ UINT8 load_flags;
+ UINT16 movesize;
+ UINT32 code32_start; /* Start of code loaded high */
+ UINT32 ramdisk_start; /* Start of initial ramdisk */
+ UINT32 ramdisk_len; /* Length of initial ramdisk */
+ UINT32 bootsect_kludge;
+ UINT16 heap_end;
+ UINT8 ext_loader_ver; /* Extended boot loader version */
+ UINT8 ext_loader_type; /* Extended boot loader ID */
+ UINT32 cmd_line_ptr; /* 32-bit pointer to the kernel command line */
+ UINT32 ramdisk_max; /* Highest legal initrd address */
+ UINT32 kernel_alignment; /* Physical addr alignment required for kernel */
+ UINT8 relocatable_kernel; /* Whether kernel is relocatable or not */
+ UINT8 min_alignment;
+ UINT16 xloadflags;
+ UINT32 cmdline_size;
+ UINT32 hardware_subarch;
+ UINT64 hardware_subarch_data;
+ UINT32 payload_offset;
+ UINT32 payload_length;
+ UINT64 setup_data;
+ UINT64 pref_address;
+ UINT32 init_size;
+ UINT32 handover_offset;
+};
+
+struct efi_info {
+ UINT32 efi_loader_signature;
+ UINT32 efi_systab;
+ UINT32 efi_memdesc_size;
+ UINT32 efi_memdesc_version;
+ UINT32 efi_memmap;
+ UINT32 efi_memmap_size;
+ UINT32 efi_systab_hi;
+ UINT32 efi_memmap_hi;
+};
+
+struct e820_entry {
+ UINT64 addr; /* start of memory segment */
+ UINT64 size; /* size of memory segment */
+ UINT32 type; /* type of memory segment */
+};
+
+struct screen_info {
+ UINT8 orig_x; /* 0x00 */
+ UINT8 orig_y; /* 0x01 */
+ UINT16 ext_mem_k; /* 0x02 */
+ UINT16 orig_video_page; /* 0x04 */
+ UINT8 orig_video_mode; /* 0x06 */
+ UINT8 orig_video_cols; /* 0x07 */
+ UINT8 flags; /* 0x08 */
+ UINT8 unused2; /* 0x09 */
+ UINT16 orig_video_ega_bx;/* 0x0a */
+ UINT16 unused3; /* 0x0c */
+ UINT8 orig_video_lines; /* 0x0e */
+ UINT8 orig_video_isVGA; /* 0x0f */
+ UINT16 orig_video_points;/* 0x10 */
+
+ /* VESA graphic mode -- linear frame buffer */
+ UINT16 lfb_width; /* 0x12 */
+ UINT16 lfb_height; /* 0x14 */
+ UINT16 lfb_depth; /* 0x16 */
+ UINT32 lfb_base; /* 0x18 */
+ UINT32 lfb_size; /* 0x1c */
+ UINT16 cl_magic, cl_offset; /* 0x20 */
+ UINT16 lfb_linelength; /* 0x24 */
+ UINT8 red_size; /* 0x26 */
+ UINT8 red_pos; /* 0x27 */
+ UINT8 green_size; /* 0x28 */
+ UINT8 green_pos; /* 0x29 */
+ UINT8 blue_size; /* 0x2a */
+ UINT8 blue_pos; /* 0x2b */
+ UINT8 rsvd_size; /* 0x2c */
+ UINT8 rsvd_pos; /* 0x2d */
+ UINT16 vesapm_seg; /* 0x2e */
+ UINT16 vesapm_off; /* 0x30 */
+ UINT16 pages; /* 0x32 */
+ UINT16 vesa_attributes; /* 0x34 */
+ UINT32 capabilities; /* 0x36 */
+ UINT8 _reserved[6]; /* 0x3a */
+};
+
+struct boot_params {
+ struct screen_info screen_info;
+ UINT8 apm_bios_info[0x14];
+ UINT8 _pad2[4];
+ UINT64 tboot_addr;
+ UINT8 ist_info[0x10];
+ UINT8 _pad3[16];
+ UINT8 hd0_info[16];
+ UINT8 hd1_info[16];
+ UINT8 sys_desc_table[0x10];
+ UINT8 olpc_ofw_header[0x10];
+ UINT8 _pad4[128];
+ UINT8 edid_info[0x80];
+ struct efi_info efi_info;
+ UINT32 alt_mem_k;
+ UINT32 scratch;
+ UINT8 e820_entries;
+ UINT8 eddbuf_entries;
+ UINT8 edd_mbr_sig_buf_entries;
+ UINT8 _pad6[6];
+ struct setup_header hdr;
+ UINT8 _pad7[0x290-0x1f1-sizeof(struct setup_header)];
+ UINT32 edd_mbr_sig_buffer[16];
+ struct e820_entry e820_map[128];
+ UINT8 _pad8[48];
+ UINT8 eddbuf[0x1ec];
+ UINT8 _pad9[276];
+};
+
+typedef struct {
+ UINT16 limit;
+ UINT64 *base;
+} dt_addr_t;
+
+#pragma pack()
+
+extern EFI_STATUS setup_graphics(struct boot_params *buf);
+
+#endif /* __LINUX_BZIMAGE_H__ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/LsiScsi.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/LsiScsi.h
new file mode 100644
index 00000000..7edff86d
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/LsiScsi.h
@@ -0,0 +1,105 @@
+/** @file
+
+ Macros and type definitions for LSI 53C895A SCSI devices.
+
+ Copyright (C) 2020, SUSE LLC.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _LSI_SCSI_H_
+#define _LSI_SCSI_H_
+
+//
+// Device ID
+//
+#define LSI_LOGIC_PCI_VENDOR_ID 0x1000
+#define LSI_53C895A_PCI_DEVICE_ID 0x0012
+
+//
+// LSI 53C895A Registers
+//
+#define LSI_REG_DSTAT 0x0C
+#define LSI_REG_ISTAT0 0x14
+#define LSI_REG_DSP 0x2C
+#define LSI_REG_SIST0 0x42
+#define LSI_REG_SIST1 0x43
+#define LSI_REG_CSBC 0xDC
+
+//
+// The status bits for DMA Status (DSTAT)
+//
+#define LSI_DSTAT_IID BIT0
+#define LSI_DSTAT_R BIT1
+#define LSI_DSTAT_SIR BIT2
+#define LSI_DSTAT_SSI BIT3
+#define LSI_DSTAT_ABRT BIT4
+#define LSI_DSTAT_BF BIT5
+#define LSI_DSTAT_MDPE BIT6
+#define LSI_DSTAT_DFE BIT7
+
+//
+// The status bits for Interrupt Status Zero (ISTAT0)
+//
+#define LSI_ISTAT0_DIP BIT0
+#define LSI_ISTAT0_SIP BIT1
+#define LSI_ISTAT0_INTF BIT2
+#define LSI_ISTAT0_CON BIT3
+#define LSI_ISTAT0_SEM BIT4
+#define LSI_ISTAT0_SIGP BIT5
+#define LSI_ISTAT0_SRST BIT6
+#define LSI_ISTAT0_ABRT BIT7
+
+//
+// The status bits for SCSI Interrupt Status Zero (SIST0)
+//
+#define LSI_SIST0_PAR BIT0
+#define LSI_SIST0_RST BIT1
+#define LSI_SIST0_UDC BIT2
+#define LSI_SIST0_SGE BIT3
+#define LSI_SIST0_RSL BIT4
+#define LSI_SIST0_SEL BIT5
+#define LSI_SIST0_CMP BIT6
+#define LSI_SIST0_MA BIT7
+
+//
+// The status bits for SCSI Interrupt Status One (SIST1)
+//
+#define LSI_SIST1_HTH BIT0
+#define LSI_SIST1_GEN BIT1
+#define LSI_SIST1_STO BIT2
+#define LSI_SIST1_R3 BIT3
+#define LSI_SIST1_SBMC BIT4
+#define LSI_SIST1_R5 BIT5
+#define LSI_SIST1_R6 BIT6
+#define LSI_SIST1_R7 BIT7
+
+//
+// LSI 53C895A Script Instructions
+//
+#define LSI_INS_TYPE_BLK 0x00000000
+#define LSI_INS_TYPE_IO BIT30
+#define LSI_INS_TYPE_TC BIT31
+
+#define LSI_INS_BLK_SCSIP_DAT_OUT 0x00000000
+#define LSI_INS_BLK_SCSIP_DAT_IN BIT24
+#define LSI_INS_BLK_SCSIP_CMD BIT25
+#define LSI_INS_BLK_SCSIP_STAT (BIT24 | BIT25)
+#define LSI_INS_BLK_SCSIP_MSG_OUT (BIT25 | BIT26)
+#define LSI_INS_BLK_SCSIP_MSG_IN (BIT24 | BIT25 | BIT26)
+
+#define LSI_INS_IO_OPC_SEL 0x00000000
+#define LSI_INS_IO_OPC_WAIT_RESEL BIT28
+
+#define LSI_INS_TC_CP BIT17
+#define LSI_INS_TC_JMP BIT19
+#define LSI_INS_TC_RA BIT23
+
+#define LSI_INS_TC_OPC_JMP 0x00000000
+#define LSI_INS_TC_OPC_INT (BIT27 | BIT28)
+
+#define LSI_INS_TC_SCSIP_DAT_OUT 0x00000000
+#define LSI_INS_TC_SCSIP_MSG_IN (BIT24 | BIT25 | BIT26)
+
+#endif // _LSI_SCSI_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/PageTable.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/PageTable.h
new file mode 100644
index 00000000..897afb8e
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/PageTable.h
@@ -0,0 +1,161 @@
+/** @file
+
+ x86_64 Page Tables structures
+
+ Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>
+ Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.<BR>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+ Code is derived from MdeModulePkg/Core/DxeIplPeim/X64/VirtualMemory.h
+
+**/
+
+#ifndef PAGE_TABLE_H_
+#define PAGE_TABLE_H_
+
+#include <Base.h>
+
+#pragma pack(1)
+
+//
+// Page-Map Level-4 Offset (PML4) and
+// Page-Directory-Pointer Offset (PDPE) entries 4K & 2MB
+//
+
+typedef union {
+ struct {
+ UINT64 Present:1; // 0 = Not present in memory,
+ // 1 = Present in memory
+ UINT64 ReadWrite:1; // 0 = Read-Only, 1= Read/Write
+ UINT64 UserSupervisor:1; // 0 = Supervisor, 1=User
+ UINT64 WriteThrough:1; // 0 = Write-Back caching,
+ // 1 = Write-Through caching
+ UINT64 CacheDisabled:1; // 0 = Cached, 1=Non-Cached
+ UINT64 Accessed:1; // 0 = Not accessed,
+ // 1 = Accessed (set by CPU)
+ UINT64 Reserved:1; // Reserved
+ UINT64 MustBeZero:2; // Must Be Zero
+ UINT64 Available:3; // Available for use by system software
+ UINT64 PageTableBaseAddress:40; // Page Table Base Address
+ UINT64 AvabilableHigh:11; // Available for use by system software
+ UINT64 Nx:1; // No Execute bit
+ } Bits;
+ UINT64 Uint64;
+} PAGE_MAP_AND_DIRECTORY_POINTER;
+
+//
+// Page Table Entry 4KB
+//
+typedef union {
+ struct {
+ UINT64 Present:1; // 0 = Not present in memory,
+ // 1 = Present in memory
+ UINT64 ReadWrite:1; // 0 = Read-Only, 1= Read/Write
+ UINT64 UserSupervisor:1; // 0 = Supervisor, 1=User
+ UINT64 WriteThrough:1; // 0 = Write-Back caching,
+ // 1 = Write-Through caching
+ UINT64 CacheDisabled:1; // 0 = Cached, 1=Non-Cached
+ UINT64 Accessed:1; // 0 = Not accessed,
+ // 1 = Accessed (set by CPU)
+ UINT64 Dirty:1; // 0 = Not Dirty, 1 = written by
+ // processor on access to page
+ UINT64 PAT:1; //
+ UINT64 Global:1; // 0 = Not global page, 1 = global page
+ // TLB not cleared on CR3 write
+ UINT64 Available:3; // Available for use by system software
+ UINT64 PageTableBaseAddress:40; // Page Table Base Address
+ UINT64 AvabilableHigh:11; // Available for use by system software
+ UINT64 Nx:1; // 0 = Execute Code,
+ // 1 = No Code Execution
+ } Bits;
+ UINT64 Uint64;
+} PAGE_TABLE_4K_ENTRY;
+
+//
+// Page Table Entry 2MB
+//
+typedef union {
+ struct {
+ UINT64 Present:1; // 0 = Not present in memory,
+ // 1 = Present in memory
+ UINT64 ReadWrite:1; // 0 = Read-Only, 1= Read/Write
+ UINT64 UserSupervisor:1; // 0 = Supervisor, 1=User
+ UINT64 WriteThrough:1; // 0 = Write-Back caching,
+ // 1=Write-Through caching
+ UINT64 CacheDisabled:1; // 0 = Cached, 1=Non-Cached
+ UINT64 Accessed:1; // 0 = Not accessed,
+ // 1 = Accessed (set by CPU)
+ UINT64 Dirty:1; // 0 = Not Dirty, 1 = written by
+ // processor on access to page
+ UINT64 MustBe1:1; // Must be 1
+ UINT64 Global:1; // 0 = Not global page, 1 = global page
+ // TLB not cleared on CR3 write
+ UINT64 Available:3; // Available for use by system software
+ UINT64 PAT:1; //
+ UINT64 MustBeZero:8; // Must be zero;
+ UINT64 PageTableBaseAddress:31; // Page Table Base Address
+ UINT64 AvabilableHigh:11; // Available for use by system software
+ UINT64 Nx:1; // 0 = Execute Code,
+ // 1 = No Code Execution
+ } Bits;
+ UINT64 Uint64;
+} PAGE_TABLE_ENTRY;
+
+//
+// Page Table Entry 1GB
+//
+typedef union {
+ struct {
+ UINT64 Present:1; // 0 = Not present in memory,
+ // 1 = Present in memory
+ UINT64 ReadWrite:1; // 0 = Read-Only, 1= Read/Write
+ UINT64 UserSupervisor:1; // 0 = Supervisor, 1=User
+ UINT64 WriteThrough:1; // 0 = Write-Back caching,
+ // 1 = Write-Through caching
+ UINT64 CacheDisabled:1; // 0 = Cached, 1=Non-Cached
+ UINT64 Accessed:1; // 0 = Not accessed,
+ // 1 = Accessed (set by CPU)
+ UINT64 Dirty:1; // 0 = Not Dirty, 1 = written by
+ // processor on access to page
+ UINT64 MustBe1:1; // Must be 1
+ UINT64 Global:1; // 0 = Not global page, 1 = global page
+ // TLB not cleared on CR3 write
+ UINT64 Available:3; // Available for use by system software
+ UINT64 PAT:1; //
+ UINT64 MustBeZero:17; // Must be zero;
+ UINT64 PageTableBaseAddress:22; // Page Table Base Address
+ UINT64 AvabilableHigh:11; // Available for use by system software
+ UINT64 Nx:1; // 0 = Execute Code,
+ // 1 = No Code Execution
+ } Bits;
+ UINT64 Uint64;
+} PAGE_TABLE_1G_ENTRY;
+
+#pragma pack()
+
+#define IA32_PG_P BIT0
+#define IA32_PG_RW BIT1
+#define IA32_PG_PS BIT7
+
+#define PAGING_PAE_INDEX_MASK 0x1FF
+
+#define PAGING_4K_ADDRESS_MASK_64 0x000FFFFFFFFFF000ull
+#define PAGING_2M_ADDRESS_MASK_64 0x000FFFFFFFE00000ull
+#define PAGING_1G_ADDRESS_MASK_64 0x000FFFFFC0000000ull
+
+#define PAGING_L1_ADDRESS_SHIFT 12
+#define PAGING_L2_ADDRESS_SHIFT 21
+#define PAGING_L3_ADDRESS_SHIFT 30
+#define PAGING_L4_ADDRESS_SHIFT 39
+
+#define PAGING_PML4E_NUMBER 4
+
+#define PAGETABLE_ENTRY_MASK ((1UL << 9) - 1)
+#define PML4_OFFSET(x) ( (x >> 39) & PAGETABLE_ENTRY_MASK)
+#define PDP_OFFSET(x) ( (x >> 30) & PAGETABLE_ENTRY_MASK)
+#define PDE_OFFSET(x) ( (x >> 21) & PAGETABLE_ENTRY_MASK)
+#define PTE_OFFSET(x) ( (x >> 12) & PAGETABLE_ENTRY_MASK)
+#define PAGING_1G_ADDRESS_MASK_64 0x000FFFFFC0000000ull
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/PvScsi.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/PvScsi.h
new file mode 100644
index 00000000..08594160
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/PvScsi.h
@@ -0,0 +1,186 @@
+/** @file
+
+ VMware PVSCSI Device specific type and macro definitions.
+
+ Copyright (C) 2020, Oracle and/or its affiliates.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __PVSCSI_H_
+#define __PVSCSI_H_
+
+//
+// Device offsets and constants
+//
+
+#define PCI_VENDOR_ID_VMWARE (0x15ad)
+#define PCI_DEVICE_ID_VMWARE_PVSCSI (0x07c0)
+
+//
+// CDB (Command Descriptor Block) with size above this constant
+// should be considered out-of-band
+//
+#define PVSCSI_CDB_MAX_SIZE (16)
+
+typedef enum {
+ PvScsiRegOffsetCommand = 0x0,
+ PvScsiRegOffsetCommandData = 0x4,
+ PvScsiRegOffsetCommandStatus = 0x8,
+ PvScsiRegOffsetLastSts0 = 0x100,
+ PvScsiRegOffsetLastSts1 = 0x104,
+ PvScsiRegOffsetLastSts2 = 0x108,
+ PvScsiRegOffsetLastSts3 = 0x10c,
+ PvScsiRegOffsetIntrStatus = 0x100c,
+ PvScsiRegOffsetIntrMask = 0x2010,
+ PvScsiRegOffsetKickNonRwIo = 0x3014,
+ PvScsiRegOffsetDebug = 0x3018,
+ PvScsiRegOffsetKickRwIo = 0x4018,
+} PVSCSI_BAR0_OFFSETS;
+
+//
+// Define Interrupt-Status register flags
+//
+#define PVSCSI_INTR_CMPL_0 BIT0
+#define PVSCSI_INTR_CMPL_1 BIT1
+#define PVSCSI_INTR_CMPL_MASK (PVSCSI_INTR_CMPL_0 | PVSCSI_INTR_CMPL_1)
+
+typedef enum {
+ PvScsiCmdFirst = 0,
+ PvScsiCmdAdapterReset = 1,
+ PvScsiCmdIssueScsi = 2,
+ PvScsiCmdSetupRings = 3,
+ PvScsiCmdResetBus = 4,
+ PvScsiCmdResetDevice = 5,
+ PvScsiCmdAbortCmd = 6,
+ PvScsiCmdConfig = 7,
+ PvScsiCmdSetupMsgRing = 8,
+ PvScsiCmdDeviceUnplug = 9,
+ PvScsiCmdLast = 10
+} PVSCSI_COMMANDS;
+
+#define PVSCSI_SETUP_RINGS_MAX_NUM_PAGES (32)
+
+#pragma pack (1)
+typedef struct {
+ UINT32 ReqRingNumPages;
+ UINT32 CmpRingNumPages;
+ UINT64 RingsStatePPN;
+ UINT64 ReqRingPPNs[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
+ UINT64 CmpRingPPNs[PVSCSI_SETUP_RINGS_MAX_NUM_PAGES];
+} PVSCSI_CMD_DESC_SETUP_RINGS;
+#pragma pack ()
+
+#define PVSCSI_MAX_CMD_DATA_WORDS \
+ (sizeof (PVSCSI_CMD_DESC_SETUP_RINGS) / sizeof (UINT32))
+
+#pragma pack (1)
+typedef struct {
+ UINT32 ReqProdIdx;
+ UINT32 ReqConsIdx;
+ UINT32 ReqNumEntriesLog2;
+
+ UINT32 CmpProdIdx;
+ UINT32 CmpConsIdx;
+ UINT32 CmpNumEntriesLog2;
+
+ UINT8 Pad[104];
+
+ UINT32 MsgProdIdx;
+ UINT32 MsgConsIdx;
+ UINT32 MsgNumEntriesLog2;
+} PVSCSI_RINGS_STATE;
+#pragma pack ()
+
+//
+// Define PVSCSI request descriptor tags
+//
+#define PVSCSI_SIMPLE_QUEUE_TAG (0x20)
+
+//
+// Define PVSCSI request descriptor flags
+//
+#define PVSCSI_FLAG_CMD_WITH_SG_LIST BIT0
+#define PVSCSI_FLAG_CMD_OUT_OF_BAND_CDB BIT1
+#define PVSCSI_FLAG_CMD_DIR_NONE BIT2
+#define PVSCSI_FLAG_CMD_DIR_TOHOST BIT3
+#define PVSCSI_FLAG_CMD_DIR_TODEVICE BIT4
+
+#pragma pack (1)
+typedef struct {
+ UINT64 Context;
+ UINT64 DataAddr;
+ UINT64 DataLen;
+ UINT64 SenseAddr;
+ UINT32 SenseLen;
+ UINT32 Flags;
+ UINT8 Cdb[16];
+ UINT8 CdbLen;
+ UINT8 Lun[8];
+ UINT8 Tag;
+ UINT8 Bus;
+ UINT8 Target;
+ UINT8 VcpuHint;
+ UINT8 Unused[59];
+} PVSCSI_RING_REQ_DESC;
+#pragma pack ()
+
+//
+// Host adapter status/error codes
+//
+typedef enum {
+ PvScsiBtStatSuccess = 0x00, // CCB complete normally with no errors
+ PvScsiBtStatLinkedCommandCompleted = 0x0a,
+ PvScsiBtStatLinkedCommandCompletedWithFlag = 0x0b,
+ PvScsiBtStatDataUnderrun = 0x0c,
+ PvScsiBtStatSelTimeout = 0x11, // SCSI selection timeout
+ PvScsiBtStatDatarun = 0x12, // Data overrun/underrun
+ PvScsiBtStatBusFree = 0x13, // Unexpected bus free
+ PvScsiBtStatInvPhase = 0x14, //
+ // Invalid bus phase or sequence requested
+ // by target
+ //
+ PvScsiBtStatLunMismatch = 0x17, //
+ // Linked CCB has different LUN from first
+ // CCB
+ //
+ PvScsiBtStatSensFailed = 0x1b, // Auto request sense failed
+ PvScsiBtStatTagReject = 0x1c, //
+ // SCSI II tagged queueing message rejected
+ // by target
+ //
+ PvScsiBtStatBadMsg = 0x1d, //
+ // Unsupported message received by the host
+ // adapter
+ //
+ PvScsiBtStatHaHardware = 0x20, // Host adapter hardware failed
+ PvScsiBtStatNoResponse = 0x21, //
+ // Target did not respond to SCSI ATN sent
+ // a SCSI RST
+ //
+ PvScsiBtStatSentRst = 0x22, // Host adapter asserted a SCSI RST
+ PvScsiBtStatRecvRst = 0x23, // Other SCSI devices asserted a SCSI RST
+ PvScsiBtStatDisconnect = 0x24, //
+ // Target device reconnected improperly
+ // (w/o tag)
+ //
+ PvScsiBtStatBusReset = 0x25, // Host adapter issued BUS device reset
+ PvScsiBtStatAbortQueue = 0x26, // Abort queue generated
+ PvScsiBtStatHaSoftware = 0x27, // Host adapter software error
+ PvScsiBtStatHaTimeout = 0x30, // Host adapter hardware timeout error
+ PvScsiBtStatScsiParity = 0x34, // SCSI parity error detected
+} PVSCSI_HOST_BUS_ADAPTER_STATUS;
+
+#pragma pack (1)
+typedef struct {
+ UINT64 Context;
+ UINT64 DataLen;
+ UINT32 SenseLen;
+ UINT16 HostStatus;
+ UINT16 ScsiStatus;
+ UINT32 Pad[2];
+} PVSCSI_RING_CMP_DESC;
+#pragma pack ()
+
+#endif // __PVSCSI_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Q35MchIch9.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Q35MchIch9.h
new file mode 100644
index 00000000..c158c898
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Q35MchIch9.h
@@ -0,0 +1,127 @@
+/** @file
+ Various register numbers and value bits based on the following publications:
+ - Intel(R) datasheet 316966-002
+ - Intel(R) datasheet 316972-004
+
+ Copyright (C) 2015, Red Hat, Inc.
+ Copyright (c) 2014, Gabriel L. Somlo <somlo@cmu.edu>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __Q35_MCH_ICH9_H__
+#define __Q35_MCH_ICH9_H__
+
+#include <Library/PciLib.h>
+#include <Uefi/UefiBaseType.h>
+#include <Uefi/UefiSpec.h>
+#include <Protocol/PciRootBridgeIo.h>
+
+//
+// Host Bridge Device ID (DID) value for Q35/MCH
+//
+#define INTEL_Q35_MCH_DEVICE_ID 0x29C0
+
+//
+// B/D/F/Type: 0/0/0/PCI
+//
+#define DRAMC_REGISTER_Q35(Offset) PCI_LIB_ADDRESS (0, 0, 0, (Offset))
+
+#define MCH_EXT_TSEG_MB 0x50
+#define MCH_EXT_TSEG_MB_QUERY 0xFFFF
+
+#define MCH_GGC 0x52
+#define MCH_GGC_IVD BIT1
+
+#define MCH_PCIEXBAR_LOW 0x60
+#define MCH_PCIEXBAR_LOWMASK 0x0FFFFFFF
+#define MCH_PCIEXBAR_BUS_FF 0
+#define MCH_PCIEXBAR_EN BIT0
+
+#define MCH_PCIEXBAR_HIGH 0x64
+#define MCH_PCIEXBAR_HIGHMASK 0xFFFFFFF0
+
+#define MCH_PAM0 0x90
+#define MCH_PAM1 0x91
+#define MCH_PAM2 0x92
+#define MCH_PAM3 0x93
+#define MCH_PAM4 0x94
+#define MCH_PAM5 0x95
+#define MCH_PAM6 0x96
+
+#define MCH_DEFAULT_SMBASE_CTL 0x9C
+#define MCH_DEFAULT_SMBASE_QUERY 0xFF
+#define MCH_DEFAULT_SMBASE_IN_RAM 0x01
+#define MCH_DEFAULT_SMBASE_LCK 0x02
+#define MCH_DEFAULT_SMBASE_SIZE SIZE_128KB
+
+#define MCH_SMRAM 0x9D
+#define MCH_SMRAM_D_LCK BIT4
+#define MCH_SMRAM_G_SMRAME BIT3
+
+#define MCH_ESMRAMC 0x9E
+#define MCH_ESMRAMC_H_SMRAME BIT7
+#define MCH_ESMRAMC_E_SMERR BIT6
+#define MCH_ESMRAMC_SM_CACHE BIT5
+#define MCH_ESMRAMC_SM_L1 BIT4
+#define MCH_ESMRAMC_SM_L2 BIT3
+#define MCH_ESMRAMC_TSEG_EXT (BIT2 | BIT1)
+#define MCH_ESMRAMC_TSEG_8MB BIT2
+#define MCH_ESMRAMC_TSEG_2MB BIT1
+#define MCH_ESMRAMC_TSEG_1MB 0
+#define MCH_ESMRAMC_TSEG_MASK (BIT2 | BIT1)
+#define MCH_ESMRAMC_T_EN BIT0
+
+#define MCH_GBSM 0xA4
+#define MCH_GBSM_MB_SHIFT 20
+
+#define MCH_BGSM 0xA8
+#define MCH_BGSM_MB_SHIFT 20
+
+#define MCH_TSEGMB 0xAC
+#define MCH_TSEGMB_MB_SHIFT 20
+
+#define MCH_TOLUD 0xB0
+#define MCH_TOLUD_MB_SHIFT 4
+
+//
+// B/D/F/Type: 0/0x1f/0/PCI
+//
+#define POWER_MGMT_REGISTER_Q35(Offset) \
+ PCI_LIB_ADDRESS (0, 0x1f, 0, (Offset))
+
+#define POWER_MGMT_REGISTER_Q35_EFI_PCI_ADDRESS(Offset) \
+ EFI_PCI_ADDRESS (0, 0x1f, 0, (Offset))
+
+#define ICH9_PMBASE 0x40
+#define ICH9_PMBASE_MASK (BIT15 | BIT14 | BIT13 | BIT12 | BIT11 | \
+ BIT10 | BIT9 | BIT8 | BIT7)
+
+#define ICH9_ACPI_CNTL 0x44
+#define ICH9_ACPI_CNTL_ACPI_EN BIT7
+
+#define ICH9_GEN_PMCON_1 0xA0
+#define ICH9_GEN_PMCON_1_SMI_LOCK BIT4
+
+#define ICH9_RCBA 0xF0
+#define ICH9_RCBA_EN BIT0
+
+//
+// IO ports
+//
+#define ICH9_APM_CNT 0xB2
+#define ICH9_APM_CNT_CPU_HOTPLUG 0x04
+#define ICH9_APM_STS 0xB3
+
+#define ICH9_CPU_HOTPLUG_BASE 0x0CD8
+
+//
+// IO ports relative to PMBASE
+//
+#define ICH9_PMBASE_OFS_SMI_EN 0x30
+#define ICH9_SMI_EN_APMC_EN BIT5
+#define ICH9_SMI_EN_GBL_SMI_EN BIT0
+
+#define ICH9_ROOT_COMPLEX_BASE 0xFED1C000
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuCpuHotplug.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuCpuHotplug.h
new file mode 100644
index 00000000..1b0f9f6a
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuCpuHotplug.h
@@ -0,0 +1,48 @@
+/** @file
+ Macros for accessing QEMU's CPU hotplug register block.
+
+ Copyright (C) 2019, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+ @par Specification Reference:
+
+ - "docs/specs/acpi_cpu_hotplug.txt" in the QEMU source tree.
+
+ The original (now "legacy") CPU hotplug interface appeared in QEMU v1.5.0.
+ The new ("modern") hotplug interface appeared in QEMU v2.7.0.
+
+ The macros in this header file map to the minimal subset of the modern
+ interface that OVMF needs.
+**/
+
+#ifndef QEMU_CPU_HOTPLUG_H_
+#define QEMU_CPU_HOTPLUG_H_
+
+#include <Base.h>
+
+//
+// Each register offset is:
+// - relative to the board-dependent IO base address of the register block,
+// - named QEMU_CPUHP_(R|W|RW)_*, according to the possible access modes of the
+// register,
+// - followed by distinguished bitmasks or values in the register.
+//
+#define QEMU_CPUHP_R_CMD_DATA2 0x0
+
+#define QEMU_CPUHP_R_CPU_STAT 0x4
+#define QEMU_CPUHP_STAT_ENABLED BIT0
+#define QEMU_CPUHP_STAT_INSERT BIT1
+#define QEMU_CPUHP_STAT_REMOVE BIT2
+#define QEMU_CPUHP_STAT_EJECT BIT3
+#define QEMU_CPUHP_STAT_FW_REMOVE BIT4
+
+#define QEMU_CPUHP_RW_CMD_DATA 0x8
+
+#define QEMU_CPUHP_W_CPU_SEL 0x0
+
+#define QEMU_CPUHP_W_CMD 0x5
+#define QEMU_CPUHP_CMD_GET_PENDING 0x0
+#define QEMU_CPUHP_CMD_GET_ARCH_ID 0x3
+
+#endif // QEMU_CPU_HOTPLUG_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuFwCfg.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuFwCfg.h
new file mode 100644
index 00000000..7f753e82
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuFwCfg.h
@@ -0,0 +1,98 @@
+/** @file
+ Macro and type definitions corresponding to the QEMU fw_cfg interface.
+
+ Refer to "docs/specs/fw_cfg.txt" in the QEMU source directory.
+
+ Copyright (c) 2011 - 2013, Intel Corporation. All rights reserved.<BR>
+ Copyright (C) 2013 - 2017, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __FW_CFG_H__
+#define __FW_CFG_H__
+
+#include <Base.h>
+
+//
+// The size, in bytes, of names of firmware configuration files, including at
+// least one terminating NUL byte.
+//
+#define QEMU_FW_CFG_FNAME_SIZE 56
+
+//
+// If the following bit is set in the UINT32 fw_cfg revision / feature bitmap
+// -- read from key 0x0001 with the basic IO Port or MMIO method --, then the
+// DMA interface is available.
+//
+#define FW_CFG_F_DMA BIT1
+
+//
+// Macros for the FW_CFG_DMA_ACCESS.Control bitmap (in native encoding).
+//
+#define FW_CFG_DMA_CTL_ERROR BIT0
+#define FW_CFG_DMA_CTL_READ BIT1
+#define FW_CFG_DMA_CTL_SKIP BIT2
+#define FW_CFG_DMA_CTL_SELECT BIT3
+#define FW_CFG_DMA_CTL_WRITE BIT4
+
+//
+// The fw_cfg registers can be found at these IO Ports, on the IO-mapped
+// platforms (Ia32 and X64).
+//
+#define FW_CFG_IO_SELECTOR 0x510
+#define FW_CFG_IO_DATA 0x511
+#define FW_CFG_IO_DMA_ADDRESS 0x514
+
+//
+// Numerically defined keys.
+//
+typedef enum {
+ QemuFwCfgItemSignature = 0x0000,
+ QemuFwCfgItemInterfaceVersion = 0x0001,
+ QemuFwCfgItemSystemUuid = 0x0002,
+ QemuFwCfgItemRamSize = 0x0003,
+ QemuFwCfgItemGraphicsEnabled = 0x0004,
+ QemuFwCfgItemSmpCpuCount = 0x0005,
+ QemuFwCfgItemMachineId = 0x0006,
+ QemuFwCfgItemKernelAddress = 0x0007,
+ QemuFwCfgItemKernelSize = 0x0008,
+ QemuFwCfgItemKernelCommandLine = 0x0009,
+ QemuFwCfgItemInitrdAddress = 0x000a,
+ QemuFwCfgItemInitrdSize = 0x000b,
+ QemuFwCfgItemBootDevice = 0x000c,
+ QemuFwCfgItemNumaData = 0x000d,
+ QemuFwCfgItemBootMenu = 0x000e,
+ QemuFwCfgItemMaximumCpuCount = 0x000f,
+ QemuFwCfgItemKernelEntry = 0x0010,
+ QemuFwCfgItemKernelData = 0x0011,
+ QemuFwCfgItemInitrdData = 0x0012,
+ QemuFwCfgItemCommandLineAddress = 0x0013,
+ QemuFwCfgItemCommandLineSize = 0x0014,
+ QemuFwCfgItemCommandLineData = 0x0015,
+ QemuFwCfgItemKernelSetupAddress = 0x0016,
+ QemuFwCfgItemKernelSetupSize = 0x0017,
+ QemuFwCfgItemKernelSetupData = 0x0018,
+ QemuFwCfgItemFileDir = 0x0019,
+
+ QemuFwCfgItemX86AcpiTables = 0x8000,
+ QemuFwCfgItemX86SmbiosTables = 0x8001,
+ QemuFwCfgItemX86Irq0Override = 0x8002,
+ QemuFwCfgItemX86E820Table = 0x8003,
+ QemuFwCfgItemX86HpetData = 0x8004,
+
+} FIRMWARE_CONFIG_ITEM;
+
+//
+// Communication structure for the DMA access method. All fields are encoded in
+// big endian.
+//
+#pragma pack (1)
+typedef struct {
+ UINT32 Control;
+ UINT32 Length;
+ UINT64 Address;
+} FW_CFG_DMA_ACCESS;
+#pragma pack ()
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuPciBridgeCapabilities.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuPciBridgeCapabilities.h
new file mode 100644
index 00000000..2aeb51e1
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuPciBridgeCapabilities.h
@@ -0,0 +1,54 @@
+/** @file
+ Macro and type definitions for QEMU's Red Hat vendor-specific PCI
+ capabilities that provide various hints about PCI Bridges.
+
+ Refer to "docs/pcie_pci_bridge.txt" in the QEMU source directory.
+
+ Copyright (C) 2017, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __QEMU_PCI_BRIDGE_CAPABILITIES_H__
+#define __QEMU_PCI_BRIDGE_CAPABILITIES_H__
+
+#include <IndustryStandard/Pci23.h>
+
+//
+// The hints apply to PCI Bridges whose PCI_DEVICE_INDEPENDENT_REGION.VendorId
+// equals the following value.
+//
+#define QEMU_PCI_BRIDGE_VENDOR_ID_REDHAT 0x1B36
+
+//
+// Common capability header for all hints.
+//
+#pragma pack (1)
+typedef struct {
+ EFI_PCI_CAPABILITY_VENDOR_HDR VendorHdr;
+ UINT8 Type;
+} QEMU_PCI_BRIDGE_CAPABILITY_HDR;
+#pragma pack ()
+
+//
+// Values defined for QEMU_PCI_BRIDGE_CAPABILITY_HDR.Type.
+//
+#define QEMU_PCI_BRIDGE_CAPABILITY_TYPE_RESOURCE_RESERVATION 0x01
+
+//
+// PCI Resource Reservation structure for when
+// QEMU_PCI_BRIDGE_CAPABILITY_HDR.Type equals
+// QEMU_PCI_BRIDGE_CAPABILITY_TYPE_RESOURCE_RESERVATION.
+//
+#pragma pack (1)
+typedef struct {
+ QEMU_PCI_BRIDGE_CAPABILITY_HDR BridgeHdr;
+ UINT32 BusNumbers;
+ UINT64 Io;
+ UINT32 NonPrefetchable32BitMmio;
+ UINT32 Prefetchable32BitMmio;
+ UINT64 Prefetchable64BitMmio;
+} QEMU_PCI_BRIDGE_CAPABILITY_RESOURCE_RESERVATION;
+#pragma pack ()
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuTpm.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuTpm.h
new file mode 100644
index 00000000..d2900996
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/QemuTpm.h
@@ -0,0 +1,63 @@
+/** @file
+ Macro and type definitions corresponding to the QEMU TPM interface.
+
+ Refer to "docs/specs/tpm.txt" in the QEMU source directory.
+
+ Copyright (C) 2018, Red Hat, Inc.
+ Copyright (c) 2018, IBM Corporation. All rights reserved.<BR>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __QEMU_TPM_H__
+#define __QEMU_TPM_H__
+
+#include <Base.h>
+
+//
+// whether function is blocked by BIOS settings; bits 0, 1, 2
+//
+#define QEMU_TPM_PPI_FUNC_NOT_IMPLEMENTED (0 << 0)
+#define QEMU_TPM_PPI_FUNC_BIOS_ONLY (1 << 0)
+#define QEMU_TPM_PPI_FUNC_BLOCKED (2 << 0)
+#define QEMU_TPM_PPI_FUNC_ALLOWED_USR_REQ (3 << 0)
+#define QEMU_TPM_PPI_FUNC_ALLOWED_USR_NOT_REQ (4 << 0)
+#define QEMU_TPM_PPI_FUNC_MASK (7 << 0)
+
+//
+// The following structure is shared between firmware and ACPI.
+//
+#pragma pack (1)
+typedef struct {
+ UINT8 Func[256]; // func
+ UINT8 In; // ppin
+ UINT32 Ip; // ppip
+ UINT32 Response; // pprp
+ UINT32 Request; // pprq
+ UINT32 RequestParameter; // pprm
+ UINT32 LastRequest; // lppr
+ UINT32 FRet; // fret
+ UINT8 Res1[0x40]; // res1
+ UINT8 NextStep; // next_step
+} QEMU_TPM_PPI;
+#pragma pack ()
+
+//
+// The following structure is for the fw_cfg etc/tpm/config file.
+//
+#pragma pack (1)
+typedef struct {
+ UINT32 PpiAddress;
+ UINT8 TpmVersion;
+ UINT8 PpiVersion;
+} QEMU_FWCFG_TPM_CONFIG;
+#pragma pack ()
+
+#define QEMU_TPM_VERSION_UNSPEC 0
+#define QEMU_TPM_VERSION_1_2 1
+#define QEMU_TPM_VERSION_2 2
+
+#define QEMU_TPM_PPI_VERSION_NONE 0
+#define QEMU_TPM_PPI_VERSION_1_30 1
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio.h
new file mode 100644
index 00000000..8b7910f3
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio.h
@@ -0,0 +1,18 @@
+/** @file
+
+ Generic type and macro definitions corresponding to the virtio
+ specifications.
+
+ Copyright (C) 2012-2016, Red Hat, Inc.
+ Portion of Copyright (C) 2013, ARM Ltd.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _VIRTIO_H_
+#define _VIRTIO_H_
+
+#include <IndustryStandard/Virtio10.h>
+
+#endif // _VIRTIO_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio095.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio095.h
new file mode 100644
index 00000000..719d9c9d
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio095.h
@@ -0,0 +1,169 @@
+/** @file
+
+ Generic type and macro definitions corresponding to the virtio-0.9.5
+ specification.
+
+ Copyright (C) 2012-2016, Red Hat, Inc.
+ Portion of Copyright (C) 2013, ARM Ltd.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _VIRTIO_0_9_5_H_
+#define _VIRTIO_0_9_5_H_
+
+#include <Base.h>
+
+//
+// VirtIo Subsystem Device IDs
+//
+#define VIRTIO_SUBSYSTEM_NETWORK_CARD 1
+#define VIRTIO_SUBSYSTEM_BLOCK_DEVICE 2
+#define VIRTIO_SUBSYSTEM_CONSOLE 3
+#define VIRTIO_SUBSYSTEM_ENTROPY_SOURCE 4
+#define VIRTIO_SUBSYSTEM_MEMORY_BALLOONING 5
+#define VIRTIO_SUBSYSTEM_IO_MEMORY 6
+#define VIRTIO_SUBSYSTEM_RPMSG 7
+#define VIRTIO_SUBSYSTEM_SCSI_HOST 8
+#define VIRTIO_SUBSYSTEM_9P_TRANSPORT 9
+#define VIRTIO_SUBSYSTEM_MAC80211_WLAN 10
+
+//
+// Virtio IDs
+//
+#define VIRTIO_VENDOR_ID 0x1AF4
+#define VIRTIO_MMIO_MAGIC 0x74726976 // "virt"
+
+
+//
+// VirtIo Device Specific Configuration Offsets
+//
+#define VIRTIO_DEVICE_SPECIFIC_CONFIGURATION_OFFSET_PCI 20
+#define VIRTIO_DEVICE_SPECIFIC_CONFIGURATION_OFFSET_PCI_WITH_MSI_X 24
+#define VIRTIO_DEVICE_SPECIFIC_CONFIGURATION_OFFSET_MMIO 0x100
+
+//
+// PCI VirtIo Header Offsets
+//
+#define VIRTIO_PCI_OFFSET_DEVICE_FEATURES 0x00
+#define VIRTIO_PCI_OFFSET_GUEST_FEATURES 0x04
+#define VIRTIO_PCI_OFFSET_QUEUE_ADDRESS 0x08
+#define VIRTIO_PCI_OFFSET_QUEUE_SIZE 0x0C
+#define VIRTIO_PCI_OFFSET_QUEUE_SELECT 0x0E
+#define VIRTIO_PCI_OFFSET_QUEUE_NOTIFY 0x10
+#define VIRTIO_PCI_OFFSET_QUEUE_DEVICE_STATUS 0x12
+#define VIRTIO_PCI_OFFSET_QUEUE_DEVICE_ISR 0x13
+
+//
+// MMIO VirtIo Header Offsets
+//
+#define VIRTIO_MMIO_OFFSET_MAGIC 0x00
+#define VIRTIO_MMIO_OFFSET_VERSION 0x04
+#define VIRTIO_MMIO_OFFSET_DEVICE_ID 0x08
+#define VIRTIO_MMIO_OFFSET_VENDOR_ID 0x0C
+#define VIRTIO_MMIO_OFFSET_HOST_FEATURES 0x10
+#define VIRTIO_MMIO_OFFSET_HOST_FEATURES_SEL 0x14
+#define VIRTIO_MMIO_OFFSET_GUEST_FEATURES 0x20
+#define VIRTIO_MMIO_OFFSET_GUEST_FEATURES_SEL 0x24
+#define VIRTIO_MMIO_OFFSET_GUEST_PAGE_SIZE 0x28
+#define VIRTIO_MMIO_OFFSET_QUEUE_SEL 0x30
+#define VIRTIO_MMIO_OFFSET_QUEUE_NUM_MAX 0x34
+#define VIRTIO_MMIO_OFFSET_QUEUE_NUM 0x38
+#define VIRTIO_MMIO_OFFSET_QUEUE_ALIGN 0x3C
+#define VIRTIO_MMIO_OFFSET_QUEUE_PFN 0x40
+#define VIRTIO_MMIO_OFFSET_QUEUE_NOTIFY 0x50
+#define VIRTIO_MMIO_OFFSET_INTERRUPT_STATUS 0x60
+#define VIRTIO_MMIO_OFFSET_INTERRUPT_ACK 0x64
+#define VIRTIO_MMIO_OFFSET_STATUS 0x70
+
+//
+// Data in the communication area is defined as packed and accessed as
+// volatile.
+//
+// Some structures contain arrays with dynamically determined size. In such
+// cases the array and its sibling fields are replaced with pointers.
+//
+// All indices (variables and fields named *Idx) are free-running and wrap
+// around after 0xFFFF. The queue size reported by the host is always an
+// integral power of 2, not greater than 32768. Actual array indices are
+// consistently calculated by taking the remainder of a given Idx object modulo
+// QueueSize. Since 0x10000 is an integral multiple of the QueueSize, UINT16
+// wraparound is a correct wraparound modulo QueueSize too (it doesn't offset
+// the remainder class).
+//
+// virtio-0.9.5, 2.3.4 Available Ring
+//
+#define VRING_AVAIL_F_NO_INTERRUPT BIT0
+
+typedef struct {
+ volatile UINT16 *Flags;
+ volatile UINT16 *Idx;
+
+ volatile UINT16 *Ring; // QueueSize elements
+ volatile UINT16 *UsedEvent; // unused as per negotiation
+} VRING_AVAIL;
+
+
+//
+// virtio-0.9.5, 2.3.5 Used Ring
+//
+#define VRING_USED_F_NO_NOTIFY BIT0
+
+#pragma pack(1)
+typedef struct {
+ UINT32 Id;
+ UINT32 Len;
+} VRING_USED_ELEM;
+#pragma pack()
+
+typedef struct {
+ volatile UINT16 *Flags;
+ volatile UINT16 *Idx;
+ volatile VRING_USED_ELEM *UsedElem; // QueueSize elements
+ volatile UINT16 *AvailEvent; // unused as per negotiation
+} VRING_USED;
+
+
+//
+// virtio-0.9.5, 2.3.2 Descriptor Table
+//
+#define VRING_DESC_F_NEXT BIT0 // more descriptors in this request
+#define VRING_DESC_F_WRITE BIT1 // buffer to be written *by the host*
+#define VRING_DESC_F_INDIRECT BIT2 // unused
+
+#pragma pack(1)
+typedef struct {
+ UINT64 Addr;
+ UINT32 Len;
+ UINT16 Flags;
+ UINT16 Next;
+} VRING_DESC;
+#pragma pack()
+
+typedef struct {
+ UINTN NumPages;
+ VOID *Base; // deallocate only this field
+ volatile VRING_DESC *Desc; // QueueSize elements
+ VRING_AVAIL Avail;
+ VRING_USED Used;
+ UINT16 QueueSize;
+} VRING;
+
+//
+// virtio-0.9.5, 2.2.2.1 Device Status
+//
+#define VSTAT_ACK BIT0
+#define VSTAT_DRIVER BIT1
+#define VSTAT_DRIVER_OK BIT2
+#define VSTAT_FAILED BIT7
+
+//
+// virtio-0.9.5, Appendix B: Reserved (Device-Independent) Feature Bits
+//
+#define VIRTIO_F_NOTIFY_ON_EMPTY BIT24
+#define VIRTIO_F_RING_INDIRECT_DESC BIT28
+#define VIRTIO_F_RING_EVENT_IDX BIT29
+
+
+#endif // _VIRTIO_0_9_5_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio095Net.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio095Net.h
new file mode 100644
index 00000000..57b019da
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio095Net.h
@@ -0,0 +1,91 @@
+/** @file
+ Virtio Network Device specific type and macro definitions corresponding to
+ the virtio-0.9.5 specification.
+
+ Copyright (C) 2013-2016, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _VIRTIO_0_9_5_NET_H_
+#define _VIRTIO_0_9_5_NET_H_
+
+#include <IndustryStandard/Virtio095.h>
+
+//
+// virtio-0.9.5, Appendix C: Network Device
+//
+#pragma pack(1)
+typedef struct {
+ UINT8 Mac[6];
+ UINT16 LinkStatus;
+} VIRTIO_NET_CONFIG;
+#pragma pack()
+
+#define OFFSET_OF_VNET(Field) OFFSET_OF (VIRTIO_NET_CONFIG, Field)
+#define SIZE_OF_VNET(Field) (sizeof ((VIRTIO_NET_CONFIG *) 0)->Field)
+
+//
+// Queue Identifiers
+//
+#define VIRTIO_NET_Q_RX 0
+#define VIRTIO_NET_Q_TX 1
+
+//
+// Feature Bits
+//
+#define VIRTIO_NET_F_CSUM BIT0 // host to checksum outgoing packets
+#define VIRTIO_NET_F_GUEST_CSUM BIT1 // guest to checksum incoming packets
+#define VIRTIO_NET_F_MAC BIT5 // MAC available to guest
+#define VIRTIO_NET_F_GSO BIT6 // deprecated
+#define VIRTIO_NET_F_GUEST_TSO4 BIT7 // guest can receive TSOv4
+#define VIRTIO_NET_F_GUEST_TSO6 BIT8 // guest can receive TSOv6
+#define VIRTIO_NET_F_GUEST_ECN BIT9 // guest can receive TSO with ECN
+#define VIRTIO_NET_F_GUEST_UFO BIT10 // guest can receive UFO
+#define VIRTIO_NET_F_HOST_TSO4 BIT11 // host can receive TSOv4
+#define VIRTIO_NET_F_HOST_TSO6 BIT12 // host can receive TSOv6
+#define VIRTIO_NET_F_HOST_ECN BIT13 // host can receive TSO with ECN
+#define VIRTIO_NET_F_HOST_UFO BIT14 // host can receive UFO
+#define VIRTIO_NET_F_MRG_RXBUF BIT15 // guest can merge receive buffers
+#define VIRTIO_NET_F_STATUS BIT16 // link status available to guest
+#define VIRTIO_NET_F_CTRL_VQ BIT17 // control channel available
+#define VIRTIO_NET_F_CTRL_RX BIT18 // control channel RX mode support
+#define VIRTIO_NET_F_CTRL_VLAN BIT19 // control channel VLAN filtering
+#define VIRTIO_NET_F_GUEST_ANNOUNCE BIT21 // guest can send gratuitous pkts
+
+//
+// Packet Header
+//
+#pragma pack(1)
+typedef struct {
+ UINT8 Flags;
+ UINT8 GsoType;
+ UINT16 HdrLen;
+ UINT16 GsoSize;
+ UINT16 CsumStart;
+ UINT16 CsumOffset;
+} VIRTIO_NET_REQ;
+#pragma pack()
+
+//
+// Bits in VIRTIO_NET_REQ.Flags
+//
+#define VIRTIO_NET_HDR_F_NEEDS_CSUM BIT0
+
+//
+// Types/Bits for VIRTIO_NET_REQ.GsoType
+//
+#define VIRTIO_NET_HDR_GSO_NONE 0x00
+#define VIRTIO_NET_HDR_GSO_TCPV4 0x01
+#define VIRTIO_NET_HDR_GSO_UDP 0x03
+#define VIRTIO_NET_HDR_GSO_TCPV6 0x04
+#define VIRTIO_NET_HDR_GSO_ECN BIT7
+
+//
+// Link Status Bits in VIRTIO_NET_CONFIG.LinkStatus
+//
+#define VIRTIO_NET_S_LINK_UP BIT0
+#define VIRTIO_NET_S_ANNOUNCE BIT1
+
+#endif // _VIRTIO_0_9_5_NET_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio10.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio10.h
new file mode 100644
index 00000000..5e13abd9
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio10.h
@@ -0,0 +1,84 @@
+/** @file
+ Definitions from the VirtIo 1.0 specification (csprd05).
+
+ Copyright (C) 2016, Red Hat, Inc.
+ Copyright (C) 2017, AMD, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef _VIRTIO_1_0_H_
+#define _VIRTIO_1_0_H_
+
+#include <IndustryStandard/Pci23.h>
+#include <IndustryStandard/Virtio095.h>
+
+//
+// Subsystem Device IDs (to be) introduced in VirtIo 1.0
+//
+#define VIRTIO_SUBSYSTEM_GPU_DEVICE 16
+//
+// Subsystem Device IDs from the VirtIo spec at git commit 87fa6b5d8155;
+// <https://github.com/oasis-tcs/virtio-spec/tree/87fa6b5d8155>.
+//
+#define VIRTIO_SUBSYSTEM_FILESYSTEM 26
+
+//
+// Structures for parsing the VirtIo 1.0 specific PCI capabilities from the
+// config space
+//
+#pragma pack (1)
+typedef struct {
+ EFI_PCI_CAPABILITY_VENDOR_HDR VendorHdr;
+ UINT8 ConfigType; // Identifies the specific VirtIo 1.0 config structure
+ UINT8 Bar; // The BAR that contains the structure
+ UINT8 Padding[3];
+ UINT32 Offset; // Offset within Bar until the start of the structure
+ UINT32 Length; // Length of the structure
+} VIRTIO_PCI_CAP;
+#pragma pack ()
+
+//
+// Values for the VIRTIO_PCI_CAP.ConfigType field
+//
+#define VIRTIO_PCI_CAP_COMMON_CFG 1 // Common configuration
+#define VIRTIO_PCI_CAP_NOTIFY_CFG 2 // Notifications
+#define VIRTIO_PCI_CAP_DEVICE_CFG 4 // Device specific configuration
+
+//
+// Structure pointed-to by Bar and Offset in VIRTIO_PCI_CAP when ConfigType is
+// VIRTIO_PCI_CAP_COMMON_CFG
+//
+#pragma pack (1)
+typedef struct {
+ UINT32 DeviceFeatureSelect;
+ UINT32 DeviceFeature;
+ UINT32 DriverFeatureSelect;
+ UINT32 DriverFeature;
+ UINT16 MsixConfig;
+ UINT16 NumQueues;
+ UINT8 DeviceStatus;
+ UINT8 ConfigGeneration;
+ UINT16 QueueSelect;
+ UINT16 QueueSize;
+ UINT16 QueueMsixVector;
+ UINT16 QueueEnable;
+ UINT16 QueueNotifyOff;
+ UINT64 QueueDesc;
+ UINT64 QueueAvail;
+ UINT64 QueueUsed;
+} VIRTIO_PCI_COMMON_CFG;
+#pragma pack ()
+
+//
+// VirtIo 1.0 device status bits
+//
+#define VSTAT_FEATURES_OK BIT3
+
+//
+// VirtIo 1.0 reserved (device-independent) feature bits
+//
+#define VIRTIO_F_VERSION_1 BIT32
+#define VIRTIO_F_IOMMU_PLATFORM BIT33
+
+#endif // _VIRTIO_1_0_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio10Net.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio10Net.h
new file mode 100644
index 00000000..d9068cd9
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Virtio10Net.h
@@ -0,0 +1,26 @@
+/** @file
+ Definitions from the VirtIo 1.0 specification (csprd05), specifically for the
+ network device.
+
+ Copyright (C) 2016, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef _VIRTIO_1_0_NET_H_
+#define _VIRTIO_1_0_NET_H_
+
+#include <IndustryStandard/Virtio10.h>
+#include <IndustryStandard/Virtio095Net.h>
+
+//
+// VirtIo 1.0 packet header
+//
+#pragma pack (1)
+typedef struct {
+ VIRTIO_NET_REQ V0_9_5;
+ UINT16 NumBuffers;
+} VIRTIO_1_0_NET_REQ;
+#pragma pack ()
+
+#endif // _VIRTIO_1_0_NET_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioBlk.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioBlk.h
new file mode 100644
index 00000000..8c748083
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioBlk.h
@@ -0,0 +1,83 @@
+/** @file
+
+ Virtio Block Device specific type and macro definitions corresponding to the
+ virtio-0.9.5 specification.
+
+ Copyright (C) 2012, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _VIRTIO_BLK_H_
+#define _VIRTIO_BLK_H_
+
+#include <IndustryStandard/Virtio.h>
+
+
+//
+// virtio-0.9.5, Appendix D: Block Device
+//
+#pragma pack(1)
+typedef struct {
+ UINT8 PhysicalBlockExp; // # of logical blocks per physical block (log2)
+ UINT8 AlignmentOffset; // offset of first aligned logical block
+ UINT16 MinIoSize; // suggested minimum I/O size in blocks
+ UINT32 OptIoSize; // optimal (suggested maximum) I/O size in blocks
+} VIRTIO_BLK_TOPOLOGY;
+
+typedef struct {
+ UINT64 Capacity;
+ UINT32 SizeMax;
+ UINT32 SegMax;
+ UINT16 Cylinders;
+ UINT8 Heads;
+ UINT8 Sectors;
+ UINT32 BlkSize;
+ VIRTIO_BLK_TOPOLOGY Topology;
+} VIRTIO_BLK_CONFIG;
+#pragma pack()
+
+#define OFFSET_OF_VBLK(Field) OFFSET_OF (VIRTIO_BLK_CONFIG, Field)
+#define SIZE_OF_VBLK(Field) (sizeof ((VIRTIO_BLK_CONFIG *) 0)->Field)
+
+#define VIRTIO_BLK_F_BARRIER BIT0
+#define VIRTIO_BLK_F_SIZE_MAX BIT1
+#define VIRTIO_BLK_F_SEG_MAX BIT2
+#define VIRTIO_BLK_F_GEOMETRY BIT4
+#define VIRTIO_BLK_F_RO BIT5
+#define VIRTIO_BLK_F_BLK_SIZE BIT6 // treated as "logical block size" in
+ // practice; actual host side
+ // implementation negotiates "optimal"
+ // block size separately, via
+ // VIRTIO_BLK_F_TOPOLOGY
+#define VIRTIO_BLK_F_SCSI BIT7
+#define VIRTIO_BLK_F_FLUSH BIT9 // identical to "write cache enabled"
+#define VIRTIO_BLK_F_TOPOLOGY BIT10 // information on optimal I/O alignment
+
+//
+// We keep the status byte separate from the rest of the virtio-blk request
+// header. See description of historical scattering at the end of Appendix D:
+// we're going to put the status byte in a separate VRING_DESC.
+//
+#pragma pack(1)
+typedef struct {
+ UINT32 Type;
+ UINT32 IoPrio;
+ UINT64 Sector;
+} VIRTIO_BLK_REQ;
+#pragma pack()
+
+#define VIRTIO_BLK_T_IN 0x00000000
+#define VIRTIO_BLK_T_OUT 0x00000001
+#define VIRTIO_BLK_T_SCSI_CMD 0x00000002
+#define VIRTIO_BLK_T_SCSI_CMD_OUT 0x00000003
+#define VIRTIO_BLK_T_FLUSH 0x00000004
+#define VIRTIO_BLK_T_FLUSH_OUT 0x00000005
+#define VIRTIO_BLK_T_BARRIER BIT31
+
+#define VIRTIO_BLK_S_OK 0x00
+#define VIRTIO_BLK_S_IOERR 0x01
+#define VIRTIO_BLK_S_UNSUPP 0x02
+
+#endif // _VIRTIO_BLK_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioFs.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioFs.h
new file mode 100644
index 00000000..c87a32fa
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioFs.h
@@ -0,0 +1,454 @@
+/** @file
+ Type and macro definitions specific to the Virtio Filesystem device.
+
+ At the time of this writing, the latest released Virtio specification (v1.1)
+ does not include the virtio-fs device. The development version of the
+ specification defines it however; see the latest version at
+ <https://github.com/oasis-tcs/virtio-spec/blob/87fa6b5d8155/virtio-fs.tex>.
+
+ This header file is minimal, and only defines the types and macros that are
+ necessary for the OvmfPkg implementation.
+
+ Copyright (C) 2020, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef VIRTIO_FS_H_
+#define VIRTIO_FS_H_
+
+#include <IndustryStandard/Virtio.h>
+
+//
+// Lowest numbered queue for sending normal priority requests.
+//
+#define VIRTIO_FS_REQUEST_QUEUE 1
+
+//
+// Number of bytes in the "VIRTIO_FS_CONFIG.Tag" field.
+//
+#define VIRTIO_FS_TAG_BYTES 36
+
+//
+// Device configuration layout.
+//
+#pragma pack (1)
+typedef struct {
+ //
+ // The Tag field can be considered the filesystem label, or a mount point
+ // hint. It is UTF-8 encoded, and padded to full size with NUL bytes. If the
+ // encoded bytes take up the entire Tag field, then there is no NUL
+ // terminator.
+ //
+ UINT8 Tag[VIRTIO_FS_TAG_BYTES];
+ //
+ // The total number of request virtqueues exposed by the device (i.e.,
+ // excluding the "hiprio" queue).
+ //
+ UINT32 NumReqQueues;
+} VIRTIO_FS_CONFIG;
+#pragma pack ()
+
+//
+// FUSE-related definitions follow.
+//
+// From virtio-v1.1-cs01-87fa6b5d8155, 5.11 File System Device: "[...] The
+// driver acts as the FUSE client mounting the file system. The virtio file
+// system device provides the mechanism for transporting FUSE requests [...]"
+//
+// Unfortunately, the documentation of the FUSE wire protocol is lacking. The
+// Virtio spec (as of this writing) simply defers to
+// "include/uapi/linux/fuse.h" in the Linux kernel source -- see the reference
+// in virtio spec file "introduction.tex", at commit 87fa6b5d8155.
+//
+// Of course, "include/uapi/linux/fuse.h" is a moving target (the virtio spec
+// does not specify a particular FUSE interface version). The OvmfPkg code
+// targets version 7.31, because that's the lowest version that the QEMU
+// virtio-fs daemon supports at this time -- see QEMU commit 72c42e2d6551
+// ("virtiofsd: Trim out compatibility code", 2020-01-23).
+//
+// Correspondingly, Linux's "include/uapi/linux/fuse.h" is consulted as checked
+// out at commit (c6ff213fe5b8^) = d78092e4937d ("fuse: fix page dereference
+// after free", 2020-09-18); that is, right before commit c6ff213fe5b8 ("fuse:
+// add submount support to <uapi/linux/fuse.h>", 2020-09-18) introduces FUSE
+// interface version 7.32.
+//
+#define VIRTIO_FS_FUSE_MAJOR 7
+#define VIRTIO_FS_FUSE_MINOR 31
+
+//
+// The inode number of the root directory.
+//
+#define VIRTIO_FS_FUSE_ROOT_DIR_NODE_ID 1
+
+//
+// Distinguished errno values.
+//
+#define VIRTIO_FS_FUSE_ERRNO_ENOENT (-2)
+
+//
+// File mode bitmasks.
+//
+#define VIRTIO_FS_FUSE_MODE_TYPE_MASK 0170000u
+#define VIRTIO_FS_FUSE_MODE_TYPE_REG 0100000u
+#define VIRTIO_FS_FUSE_MODE_TYPE_DIR 0040000u
+#define VIRTIO_FS_FUSE_MODE_PERM_RWXU 0000700u
+#define VIRTIO_FS_FUSE_MODE_PERM_RUSR 0000400u
+#define VIRTIO_FS_FUSE_MODE_PERM_WUSR 0000200u
+#define VIRTIO_FS_FUSE_MODE_PERM_XUSR 0000100u
+#define VIRTIO_FS_FUSE_MODE_PERM_RWXG 0000070u
+#define VIRTIO_FS_FUSE_MODE_PERM_RGRP 0000040u
+#define VIRTIO_FS_FUSE_MODE_PERM_WGRP 0000020u
+#define VIRTIO_FS_FUSE_MODE_PERM_XGRP 0000010u
+#define VIRTIO_FS_FUSE_MODE_PERM_RWXO 0000007u
+#define VIRTIO_FS_FUSE_MODE_PERM_ROTH 0000004u
+#define VIRTIO_FS_FUSE_MODE_PERM_WOTH 0000002u
+#define VIRTIO_FS_FUSE_MODE_PERM_XOTH 0000001u
+
+//
+// Flags for VirtioFsFuseOpSetAttr, in the VIRTIO_FS_FUSE_SETATTR_REQUEST.Valid
+// field.
+//
+#define VIRTIO_FS_FUSE_SETATTR_REQ_F_MODE BIT0
+#define VIRTIO_FS_FUSE_SETATTR_REQ_F_SIZE BIT3
+#define VIRTIO_FS_FUSE_SETATTR_REQ_F_ATIME BIT4
+#define VIRTIO_FS_FUSE_SETATTR_REQ_F_MTIME BIT5
+
+//
+// Flags for VirtioFsFuseOpOpen.
+//
+#define VIRTIO_FS_FUSE_OPEN_REQ_F_RDONLY 0
+#define VIRTIO_FS_FUSE_OPEN_REQ_F_RDWR 2
+
+//
+// Flags for VirtioFsFuseOpInit.
+//
+#define VIRTIO_FS_FUSE_INIT_REQ_F_DO_READDIRPLUS BIT13
+
+/**
+ Macro for calculating the size of a directory stream entry.
+
+ The macro may evaluate Namelen multiple times.
+
+ The macro evaluates to a UINTN value that is safe to cast to UINT32.
+
+ @param[in] Namelen The size of the filename byte array that follows
+ VIRTIO_FS_FUSE_DIRENTPLUS_RESPONSE in the directory
+ stream, as reported by
+ VIRTIO_FS_FUSE_STATFS_RESPONSE.Namelen or
+ VIRTIO_FS_FUSE_DIRENTPLUS_RESPONSE.Namelen. The filename
+ byte array is not NUL-terminated.
+
+ @retval 0 Namelen was zero or greater than SIZE_4KB.
+
+ @return The number of bytes in the directory entry, including the
+ VIRTIO_FS_FUSE_DIRENTPLUS_RESPONSE header.
+**/
+#define VIRTIO_FS_FUSE_DIRENTPLUS_RESPONSE_SIZE(Namelen) \
+ ((Namelen) == 0 || (Namelen) > SIZE_4KB ? \
+ (UINTN)0 : \
+ ALIGN_VALUE ( \
+ sizeof (VIRTIO_FS_FUSE_DIRENTPLUS_RESPONSE) + (UINTN)(Namelen), \
+ sizeof (UINT64) \
+ ) \
+ )
+
+//
+// Flags for VirtioFsFuseOpRename2.
+//
+#define VIRTIO_FS_FUSE_RENAME2_REQ_F_NOREPLACE BIT0
+
+//
+// FUSE operation codes.
+//
+typedef enum {
+ VirtioFsFuseOpLookup = 1,
+ VirtioFsFuseOpForget = 2,
+ VirtioFsFuseOpGetAttr = 3,
+ VirtioFsFuseOpSetAttr = 4,
+ VirtioFsFuseOpMkDir = 9,
+ VirtioFsFuseOpUnlink = 10,
+ VirtioFsFuseOpRmDir = 11,
+ VirtioFsFuseOpOpen = 14,
+ VirtioFsFuseOpRead = 15,
+ VirtioFsFuseOpWrite = 16,
+ VirtioFsFuseOpStatFs = 17,
+ VirtioFsFuseOpRelease = 18,
+ VirtioFsFuseOpFsync = 20,
+ VirtioFsFuseOpFlush = 25,
+ VirtioFsFuseOpInit = 26,
+ VirtioFsFuseOpOpenDir = 27,
+ VirtioFsFuseOpReleaseDir = 29,
+ VirtioFsFuseOpFsyncDir = 30,
+ VirtioFsFuseOpCreate = 35,
+ VirtioFsFuseOpReadDirPlus = 44,
+ VirtioFsFuseOpRename2 = 45,
+} VIRTIO_FS_FUSE_OPCODE;
+
+#pragma pack (1)
+//
+// Request-response headers common to all request types.
+//
+typedef struct {
+ UINT32 Len;
+ UINT32 Opcode;
+ UINT64 Unique;
+ UINT64 NodeId;
+ UINT32 Uid;
+ UINT32 Gid;
+ UINT32 Pid;
+ UINT32 Padding;
+} VIRTIO_FS_FUSE_REQUEST;
+
+typedef struct {
+ UINT32 Len;
+ INT32 Error;
+ UINT64 Unique;
+} VIRTIO_FS_FUSE_RESPONSE;
+
+//
+// Structure with which the Virtio Filesystem device reports a NodeId to the
+// FUSE client (i.e., to the Virtio Filesystem driver). This structure is a
+// part of the response headers for operations that inform the FUSE client of
+// an inode.
+//
+typedef struct {
+ UINT64 NodeId;
+ UINT64 Generation;
+ UINT64 EntryValid;
+ UINT64 AttrValid;
+ UINT32 EntryValidNsec;
+ UINT32 AttrValidNsec;
+} VIRTIO_FS_FUSE_NODE_RESPONSE;
+
+//
+// Structure describing the host-side attributes of an inode. This structure is
+// a part of the response headers for operations that inform the FUSE client of
+// an inode.
+//
+typedef struct {
+ UINT64 Ino;
+ UINT64 Size;
+ UINT64 Blocks;
+ UINT64 Atime;
+ UINT64 Mtime;
+ UINT64 Ctime;
+ UINT32 AtimeNsec;
+ UINT32 MtimeNsec;
+ UINT32 CtimeNsec;
+ UINT32 Mode;
+ UINT32 Nlink;
+ UINT32 Uid;
+ UINT32 Gid;
+ UINT32 Rdev;
+ UINT32 Blksize;
+ UINT32 Padding;
+} VIRTIO_FS_FUSE_ATTRIBUTES_RESPONSE;
+
+//
+// Header for VirtioFsFuseOpForget.
+//
+typedef struct {
+ UINT64 NumberOfLookups;
+} VIRTIO_FS_FUSE_FORGET_REQUEST;
+
+//
+// Headers for VirtioFsFuseOpGetAttr (VIRTIO_FS_FUSE_GETATTR_RESPONSE is also
+// for VirtioFsFuseOpSetAttr).
+//
+typedef struct {
+ UINT32 GetAttrFlags;
+ UINT32 Dummy;
+ UINT64 FileHandle;
+} VIRTIO_FS_FUSE_GETATTR_REQUEST;
+
+typedef struct {
+ UINT64 AttrValid;
+ UINT32 AttrValidNsec;
+ UINT32 Dummy;
+} VIRTIO_FS_FUSE_GETATTR_RESPONSE;
+
+//
+// Header for VirtioFsFuseOpSetAttr.
+//
+typedef struct {
+ UINT32 Valid;
+ UINT32 Padding;
+ UINT64 FileHandle;
+ UINT64 Size;
+ UINT64 LockOwner;
+ UINT64 Atime;
+ UINT64 Mtime;
+ UINT64 Ctime;
+ UINT32 AtimeNsec;
+ UINT32 MtimeNsec;
+ UINT32 CtimeNsec;
+ UINT32 Mode;
+ UINT32 Unused4;
+ UINT32 Uid;
+ UINT32 Gid;
+ UINT32 Unused5;
+} VIRTIO_FS_FUSE_SETATTR_REQUEST;
+
+//
+// Header for VirtioFsFuseOpMkDir.
+//
+typedef struct {
+ UINT32 Mode;
+ UINT32 Umask;
+} VIRTIO_FS_FUSE_MKDIR_REQUEST;
+
+//
+// Headers for VirtioFsFuseOpOpen and VirtioFsFuseOpOpenDir.
+//
+typedef struct {
+ UINT32 Flags;
+ UINT32 Unused;
+} VIRTIO_FS_FUSE_OPEN_REQUEST;
+
+typedef struct {
+ UINT64 FileHandle;
+ UINT32 OpenFlags;
+ UINT32 Padding;
+} VIRTIO_FS_FUSE_OPEN_RESPONSE;
+
+//
+// Header for VirtioFsFuseOpRead and VirtioFsFuseOpReadDirPlus.
+//
+typedef struct {
+ UINT64 FileHandle;
+ UINT64 Offset;
+ UINT32 Size;
+ UINT32 ReadFlags;
+ UINT64 LockOwner;
+ UINT32 Flags;
+ UINT32 Padding;
+} VIRTIO_FS_FUSE_READ_REQUEST;
+
+//
+// Headers for VirtioFsFuseOpWrite.
+//
+typedef struct {
+ UINT64 FileHandle;
+ UINT64 Offset;
+ UINT32 Size;
+ UINT32 WriteFlags;
+ UINT64 LockOwner;
+ UINT32 Flags;
+ UINT32 Padding;
+} VIRTIO_FS_FUSE_WRITE_REQUEST;
+
+typedef struct {
+ UINT32 Size;
+ UINT32 Padding;
+} VIRTIO_FS_FUSE_WRITE_RESPONSE;
+
+//
+// Header for VirtioFsFuseOpStatFs.
+//
+typedef struct {
+ UINT64 Blocks;
+ UINT64 Bfree;
+ UINT64 Bavail;
+ UINT64 Files;
+ UINT64 Ffree;
+ UINT32 Bsize;
+ UINT32 Namelen;
+ UINT32 Frsize;
+ UINT32 Padding;
+ UINT32 Spare[6];
+} VIRTIO_FS_FUSE_STATFS_RESPONSE;
+
+//
+// Header for VirtioFsFuseOpRelease and VirtioFsFuseOpReleaseDir.
+//
+typedef struct {
+ UINT64 FileHandle;
+ UINT32 Flags;
+ UINT32 ReleaseFlags;
+ UINT64 LockOwner;
+} VIRTIO_FS_FUSE_RELEASE_REQUEST;
+
+//
+// Header for VirtioFsFuseOpFsync and VirtioFsFuseOpFsyncDir.
+//
+typedef struct {
+ UINT64 FileHandle;
+ UINT32 FsyncFlags;
+ UINT32 Padding;
+} VIRTIO_FS_FUSE_FSYNC_REQUEST;
+
+//
+// Header for VirtioFsFuseOpFlush.
+//
+typedef struct {
+ UINT64 FileHandle;
+ UINT32 Unused;
+ UINT32 Padding;
+ UINT64 LockOwner;
+} VIRTIO_FS_FUSE_FLUSH_REQUEST;
+
+//
+// Headers for VirtioFsFuseOpInit.
+//
+typedef struct {
+ UINT32 Major;
+ UINT32 Minor;
+ UINT32 MaxReadahead;
+ UINT32 Flags;
+} VIRTIO_FS_FUSE_INIT_REQUEST;
+
+typedef struct {
+ UINT32 Major;
+ UINT32 Minor;
+ UINT32 MaxReadahead;
+ UINT32 Flags;
+ UINT16 MaxBackground;
+ UINT16 CongestionThreshold;
+ UINT32 MaxWrite;
+ UINT32 TimeGran;
+ UINT16 MaxPages;
+ UINT16 MapAlignment;
+ UINT32 Unused[8];
+} VIRTIO_FS_FUSE_INIT_RESPONSE;
+
+//
+// Header for VirtioFsFuseOpCreate.
+//
+typedef struct {
+ UINT32 Flags;
+ UINT32 Mode;
+ UINT32 Umask;
+ UINT32 Padding;
+} VIRTIO_FS_FUSE_CREATE_REQUEST;
+
+//
+// Header for VirtioFsFuseOpReadDirPlus.
+//
+// Diverging from the rest of the headers, this structure embeds other
+// structures. The reason is that a scatter list cannot be used to receive
+// NodeResp and AttrResp separately; the record below is followed by a variable
+// size filename byte array, and then such pairs are repeated a number of
+// times. Thus, later header start offsets depend on earlier filename array
+// sizes.
+//
+typedef struct {
+ VIRTIO_FS_FUSE_NODE_RESPONSE NodeResp;
+ VIRTIO_FS_FUSE_ATTRIBUTES_RESPONSE AttrResp;
+ UINT64 NodeId;
+ UINT64 CookieForNextEntry;
+ UINT32 Namelen;
+ UINT32 Type;
+} VIRTIO_FS_FUSE_DIRENTPLUS_RESPONSE;
+
+//
+// Header for VirtioFsFuseOpRename2.
+//
+typedef struct {
+ UINT64 NewDir;
+ UINT32 Flags;
+ UINT32 Padding;
+} VIRTIO_FS_FUSE_RENAME2_REQUEST;
+#pragma pack ()
+
+#endif // VIRTIO_FS_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioGpu.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioGpu.h
new file mode 100644
index 00000000..1855b1d7
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioGpu.h
@@ -0,0 +1,210 @@
+/** @file
+
+ Virtio GPU Device specific type and macro definitions.
+
+ At the time of this writing, the Virtio 1.0 specification has not
+ incorporated the GPU device yet. The following work-in-progress specification
+ is used as basis for the implementation:
+
+ - https://lists.oasis-open.org/archives/virtio-dev/201605/msg00002.html
+ - https://www.kraxel.org/virtio/
+
+ This header file is minimal, and only defines the types and macros that are
+ necessary for the OvmfPkg implementation.
+
+ Copyright (C) 2016, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _VIRTIO_GPU_H_
+#define _VIRTIO_GPU_H_
+
+#include <IndustryStandard/Virtio.h>
+
+//
+// Queue number for sending control commands.
+//
+#define VIRTIO_GPU_CONTROL_QUEUE 0
+
+//
+// Command and response types.
+//
+typedef enum {
+ //
+ // Commands related to mode setup:
+ //
+ // - create/release a host-side 2D resource,
+ //
+ VirtioGpuCmdResourceCreate2d = 0x0101,
+ VirtioGpuCmdResourceUnref = 0x0102,
+ //
+ // - attach/detach guest RAM to/from a host-side 2D resource,
+ //
+ VirtioGpuCmdResourceAttachBacking = 0x0106,
+ VirtioGpuCmdResourceDetachBacking = 0x0107,
+ //
+ // - assign/unassign a host-side 2D resource to/from a scanout ("head").
+ //
+ VirtioGpuCmdSetScanout = 0x0103,
+
+ //
+ // Commands related to drawing:
+ //
+ // - transfer a guest RAM update to the host-side 2D resource (does not imply
+ // host display refresh),
+ //
+ VirtioGpuCmdTransferToHost2d = 0x0105,
+ //
+ // - trigger a host display refresh from the 2D resource.
+ //
+ VirtioGpuCmdResourceFlush = 0x0104,
+
+ //
+ // Success code for all of the above commands.
+ //
+ VirtioGpuRespOkNodata = 0x1100,
+} VIRTIO_GPU_CONTROL_TYPE;
+
+//
+// Common request/response header.
+//
+#define VIRTIO_GPU_FLAG_FENCE BIT0
+
+#pragma pack (1)
+typedef struct {
+ //
+ // The guest sets Type to VirtioGpuCmd* in the requests. The host sets Type
+ // to VirtioGpuResp* in the responses.
+ //
+ UINT32 Type;
+
+ //
+ // Fencing forces the host to complete the command before producing a
+ // response.
+ //
+ UINT32 Flags;
+ UINT64 FenceId;
+
+ //
+ // Unused.
+ //
+ UINT32 CtxId;
+ UINT32 Padding;
+} VIRTIO_GPU_CONTROL_HEADER;
+#pragma pack ()
+
+//
+// Rectangle structure used by several operations.
+//
+#pragma pack (1)
+typedef struct {
+ UINT32 X;
+ UINT32 Y;
+ UINT32 Width;
+ UINT32 Height;
+} VIRTIO_GPU_RECTANGLE;
+#pragma pack ()
+
+//
+// Request structure for VirtioGpuCmdResourceCreate2d.
+//
+typedef enum {
+ //
+ // 32-bit depth, BGRX component order, X component ignored.
+ //
+ VirtioGpuFormatB8G8R8X8Unorm = 2,
+} VIRTIO_GPU_FORMATS;
+
+#pragma pack (1)
+typedef struct {
+ VIRTIO_GPU_CONTROL_HEADER Header;
+ UINT32 ResourceId; // note: 0 is invalid
+ UINT32 Format; // from VIRTIO_GPU_FORMATS
+ UINT32 Width;
+ UINT32 Height;
+} VIRTIO_GPU_RESOURCE_CREATE_2D;
+#pragma pack ()
+
+//
+// Request structure for VirtioGpuCmdResourceUnref.
+//
+#pragma pack (1)
+typedef struct {
+ VIRTIO_GPU_CONTROL_HEADER Header;
+ UINT32 ResourceId;
+ UINT32 Padding;
+} VIRTIO_GPU_RESOURCE_UNREF;
+#pragma pack ()
+
+//
+// Request structure for VirtioGpuCmdResourceAttachBacking.
+//
+// The spec allows for a scatter-gather list, but for simplicity we hard-code a
+// single guest buffer.
+//
+#pragma pack (1)
+typedef struct {
+ UINT64 Addr;
+ UINT32 Length;
+ UINT32 Padding;
+} VIRTIO_GPU_MEM_ENTRY;
+
+typedef struct {
+ VIRTIO_GPU_CONTROL_HEADER Header;
+ UINT32 ResourceId;
+ UINT32 NrEntries; // number of entries: constant 1
+ VIRTIO_GPU_MEM_ENTRY Entry;
+} VIRTIO_GPU_RESOURCE_ATTACH_BACKING;
+#pragma pack ()
+
+//
+// Request structure for VirtioGpuCmdResourceDetachBacking.
+//
+#pragma pack (1)
+typedef struct {
+ VIRTIO_GPU_CONTROL_HEADER Header;
+ UINT32 ResourceId;
+ UINT32 Padding;
+} VIRTIO_GPU_RESOURCE_DETACH_BACKING;
+#pragma pack ()
+
+//
+// Request structure for VirtioGpuCmdSetScanout.
+//
+#pragma pack (1)
+typedef struct {
+ VIRTIO_GPU_CONTROL_HEADER Header;
+ VIRTIO_GPU_RECTANGLE Rectangle;
+ UINT32 ScanoutId;
+ UINT32 ResourceId;
+} VIRTIO_GPU_SET_SCANOUT;
+#pragma pack ()
+
+//
+// Request structure for VirtioGpuCmdTransferToHost2d.
+//
+#pragma pack (1)
+typedef struct {
+ VIRTIO_GPU_CONTROL_HEADER Header;
+ VIRTIO_GPU_RECTANGLE Rectangle;
+ UINT64 Offset;
+ UINT32 ResourceId;
+ UINT32 Padding;
+} VIRTIO_GPU_CMD_TRANSFER_TO_HOST_2D;
+#pragma pack ()
+
+//
+// Request structure for VirtioGpuCmdResourceFlush.
+//
+#pragma pack (1)
+typedef struct {
+ VIRTIO_GPU_CONTROL_HEADER Header;
+ VIRTIO_GPU_RECTANGLE Rectangle;
+ UINT32 ResourceId;
+ UINT32 Padding;
+} VIRTIO_GPU_RESOURCE_FLUSH;
+#pragma pack ()
+
+#endif // _VIRTIO_GPU_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioNet.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioNet.h
new file mode 100644
index 00000000..6cf6b03d
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioNet.h
@@ -0,0 +1,16 @@
+/** @file
+ Virtio Network Device specific type and macro definitions corresponding to
+ the virtio specifications.
+
+ Copyright (C) 2013-2016, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _VIRTIO_NET_H_
+#define _VIRTIO_NET_H_
+
+#include <IndustryStandard/Virtio10Net.h>
+
+#endif // _VIRTIO_NET_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioScsi.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioScsi.h
new file mode 100644
index 00000000..551e5f5c
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/VirtioScsi.h
@@ -0,0 +1,93 @@
+/** @file
+
+ Virtio SCSI Host Device specific type and macro definitions corresponding to
+ the virtio-0.9.5 specification.
+
+ Copyright (C) 2012, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _VIRTIO_SCSI_H_
+#define _VIRTIO_SCSI_H_
+
+#include <IndustryStandard/Virtio.h>
+
+
+//
+// virtio-0.9.5, Appendix I: SCSI Host Device
+//
+#pragma pack(1)
+typedef struct {
+ UINT32 NumQueues;
+ UINT32 SegMax;
+ UINT32 MaxSectors;
+ UINT32 CmdPerLun;
+ UINT32 EventInfoSize;
+ UINT32 SenseSize;
+ UINT32 CdbSize;
+ UINT16 MaxChannel;
+ UINT16 MaxTarget;
+ UINT32 MaxLun;
+} VIRTIO_SCSI_CONFIG;
+#pragma pack()
+
+#define OFFSET_OF_VSCSI(Field) OFFSET_OF (VIRTIO_SCSI_CONFIG, Field)
+#define SIZE_OF_VSCSI(Field) (sizeof ((VIRTIO_SCSI_CONFIG *) 0)->Field)
+
+#define VIRTIO_SCSI_F_INOUT BIT0
+#define VIRTIO_SCSI_F_HOTPLUG BIT1
+
+//
+// We expect these maximum sizes from the host. Also we force the CdbLength and
+// SenseDataLength parameters of EFI_EXT_SCSI_PASS_THRU_PROTOCOL.PassThru() not
+// to exceed these limits. See UEFI 2.3.1 errata C 14.7.
+//
+#define VIRTIO_SCSI_CDB_SIZE 32
+#define VIRTIO_SCSI_SENSE_SIZE 96
+
+//
+// We pass the dynamically sized buffers ("dataout", "datain") in separate ring
+// descriptors.
+//
+#pragma pack(1)
+typedef struct {
+ UINT8 Lun[8];
+ UINT64 Id;
+ UINT8 TaskAttr;
+ UINT8 Prio;
+ UINT8 Crn;
+ UINT8 Cdb[VIRTIO_SCSI_CDB_SIZE];
+} VIRTIO_SCSI_REQ;
+
+typedef struct {
+ UINT32 SenseLen;
+ UINT32 Residual;
+ UINT16 StatusQualifier;
+ UINT8 Status;
+ UINT8 Response;
+ UINT8 Sense[VIRTIO_SCSI_SENSE_SIZE];
+} VIRTIO_SCSI_RESP;
+#pragma pack()
+
+//
+// selector of first virtio queue usable for request transfer
+//
+#define VIRTIO_SCSI_REQUEST_QUEUE 2
+
+//
+// host response codes
+//
+#define VIRTIO_SCSI_S_OK 0
+#define VIRTIO_SCSI_S_OVERRUN 1
+#define VIRTIO_SCSI_S_ABORTED 2
+#define VIRTIO_SCSI_S_BAD_TARGET 3
+#define VIRTIO_SCSI_S_RESET 4
+#define VIRTIO_SCSI_S_BUSY 5
+#define VIRTIO_SCSI_S_TRANSPORT_FAILURE 6
+#define VIRTIO_SCSI_S_TARGET_FAILURE 7
+#define VIRTIO_SCSI_S_NEXUS_FAILURE 8
+#define VIRTIO_SCSI_S_FAILURE 9
+
+#endif // _VIRTIO_SCSI_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/README b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/README
new file mode 100644
index 00000000..a9a6759a
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/README
@@ -0,0 +1,37 @@
+The headers in this directory have been imported from the Xen Project with few
+modification that are described in this README.
+
+The modifications that needed to be done are:
+- Use of ZeroMem() or SetMem() instead of memset().
+- If a struct is using a 64bit field, then a #pragma(4) might be needed
+ for IA32, like in io/blkif.h.
+- Replace the types with the ones used in UEFI.
+
+
+* Command to run to change types:
+find OvmfPkg/Include/IndustryStandard/Xen -type f -name '*.h' -exec sed --regexp-extended --file=fix_type_in_xen_includes.sed --in-place {} \;
+
+$ cat fix_type_in_xen_includes.sed
+# Avoid changing the 'long' that is not a type.
+/as long as/b
+
+s/([^a-zA-Z0-9_]|^)uint8_t([^a-zA-Z0-9_]|$)/\1UINT8\2/g
+s/([^a-zA-Z0-9_]|^)uint16_t([^a-zA-Z0-9_]|$)/\1UINT16\2/g
+s/([^a-zA-Z0-9_]|^)uint32_t([^a-zA-Z0-9_]|$)/\1UINT32\2/g
+s/([^a-zA-Z0-9_]|^)uint64_t([^a-zA-Z0-9_]|$)/\1UINT64\2/g
+
+s/([^a-zA-Z0-9_]|^)int8_t([^a-zA-Z0-9_]|$)/\1INT8\2/g
+s/([^a-zA-Z0-9_]|^)int16_t([^a-zA-Z0-9_]|$)/\1INT16\2/g
+s/([^a-zA-Z0-9_]|^)int32_t([^a-zA-Z0-9_]|$)/\1INT32\2/g
+s/([^a-zA-Z0-9_]|^)int64_t([^a-zA-Z0-9_]|$)/\1INT64\2/g
+
+s/([^a-zA-Z0-9_]|^)void([^a-zA-Z0-9_]|$)/\1VOID\2/g
+s/([^a-zA-Z0-9_]|^)unsigned int([^a-zA-Z0-9_]|$)/\1UINT32\2/g
+s/([^a-zA-Z0-9_]|^)int([^a-zA-Z0-9_]|$)/\1INT32\2/g
+s/([^a-zA-Z0-9_]|^)unsigned char([^a-zA-Z0-9_]|$)/\1UINT8\2/g
+s/([^a-zA-Z0-9_]|^)char([^a-zA-Z0-9_]|$)/\1CHAR8\2/g
+s/([^a-zA-Z0-9_]|^)unsigned long([^a-zA-Z0-9_]|$)/\1UINTN\2/g
+s/([^a-zA-Z0-9_]|^)long([^a-zA-Z0-9_]|$)/\1INTN\2/g
+
+s/__i386__/MDE_CPU_IA32/g
+s/__x86_64__/MDE_CPU_X64/g
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-arm/xen.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-arm/xen.h
new file mode 100644
index 00000000..bd1e25ba
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-arm/xen.h
@@ -0,0 +1,420 @@
+/******************************************************************************
+ * arch-arm.h
+ *
+ * Guest OS interface to ARM Xen.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright 2011 (C) Citrix Systems
+ */
+
+#ifndef __XEN_PUBLIC_ARCH_ARM_H__
+#define __XEN_PUBLIC_ARCH_ARM_H__
+
+/*
+ * `incontents 50 arm_abi Hypercall Calling Convention
+ *
+ * A hypercall is issued using the ARM HVC instruction.
+ *
+ * A hypercall can take up to 5 arguments. These are passed in
+ * registers, the first argument in x0/r0 (for arm64/arm32 guests
+ * respectively irrespective of whether the underlying hypervisor is
+ * 32- or 64-bit), the second argument in x1/r1, the third in x2/r2,
+ * the forth in x3/r3 and the fifth in x4/r4.
+ *
+ * The hypercall number is passed in r12 (arm) or x16 (arm64). In both
+ * cases the relevant ARM procedure calling convention specifies this
+ * is an inter-procedure-call scratch register (e.g. for use in linker
+ * stubs). This use does not conflict with use during a hypercall.
+ *
+ * The HVC ISS must contain a Xen specific TAG: XEN_HYPERCALL_TAG.
+ *
+ * The return value is in x0/r0.
+ *
+ * The hypercall will clobber x16/r12 and the argument registers used
+ * by that hypercall (except r0 which is the return value) i.e. in
+ * addition to x16/r12 a 2 argument hypercall will clobber x1/r1 and a
+ * 4 argument hypercall will clobber x1/r1, x2/r2 and x3/r3.
+ *
+ * Parameter structs passed to hypercalls are laid out according to
+ * the Procedure Call Standard for the ARM Architecture (AAPCS, AKA
+ * EABI) and Procedure Call Standard for the ARM 64-bit Architecture
+ * (AAPCS64). Where there is a conflict the 64-bit standard should be
+ * used regardless of guest type. Structures which are passed as
+ * hypercall arguments are always little endian.
+ *
+ * All memory which is shared with other entities in the system
+ * (including the hypervisor and other guests) must reside in memory
+ * which is mapped as Normal Inner-cacheable. This applies to:
+ * - hypercall arguments passed via a pointer to guest memory.
+ * - memory shared via the grant table mechanism (including PV I/O
+ * rings etc).
+ * - memory shared with the hypervisor (struct shared_info, struct
+ * vcpu_info, the grant table, etc).
+ *
+ * Any Inner cache allocation strategy (Write-Back, Write-Through etc)
+ * is acceptable. There is no restriction on the Outer-cacheability.
+ */
+
+/*
+ * `incontents 55 arm_hcall Supported Hypercalls
+ *
+ * Xen on ARM makes extensive use of hardware facilities and therefore
+ * only a subset of the potential hypercalls are required.
+ *
+ * Since ARM uses second stage paging any machine/physical addresses
+ * passed to hypercalls are Guest Physical Addresses (Intermediate
+ * Physical Addresses) unless otherwise noted.
+ *
+ * The following hypercalls (and sub operations) are supported on the
+ * ARM platform. Other hypercalls should be considered
+ * unavailable/unsupported.
+ *
+ * HYPERVISOR_memory_op
+ * All generic sub-operations.
+ *
+ * In addition the following arch specific sub-ops:
+ * * XENMEM_add_to_physmap
+ * * XENMEM_add_to_physmap_batch
+ *
+ * HYPERVISOR_domctl
+ * All generic sub-operations, with the exception of:
+ * * XEN_DOMCTL_iomem_permission (not yet implemented)
+ * * XEN_DOMCTL_irq_permission (not yet implemented)
+ *
+ * HYPERVISOR_sched_op
+ * All generic sub-operations, with the exception of:
+ * * SCHEDOP_block -- prefer wfi hardware instruction
+ *
+ * HYPERVISOR_console_io
+ * All generic sub-operations
+ *
+ * HYPERVISOR_xen_version
+ * All generic sub-operations
+ *
+ * HYPERVISOR_event_channel_op
+ * All generic sub-operations
+ *
+ * HYPERVISOR_physdev_op
+ * No sub-operations are currently supported
+ *
+ * HYPERVISOR_sysctl
+ * All generic sub-operations, with the exception of:
+ * * XEN_SYSCTL_page_offline_op
+ * * XEN_SYSCTL_get_pmstat
+ * * XEN_SYSCTL_pm_op
+ *
+ * HYPERVISOR_hvm_op
+ * Exactly these sub-operations are supported:
+ * * HVMOP_set_param
+ * * HVMOP_get_param
+ *
+ * HYPERVISOR_grant_table_op
+ * All generic sub-operations
+ *
+ * HYPERVISOR_vcpu_op
+ * Exactly these sub-operations are supported:
+ * * VCPUOP_register_vcpu_info
+ * * VCPUOP_register_runstate_memory_area
+ *
+ *
+ * Other notes on the ARM ABI:
+ *
+ * - struct start_info is not exported to ARM guests.
+ *
+ * - struct shared_info is mapped by ARM guests using the
+ * HYPERVISOR_memory_op sub-op XENMEM_add_to_physmap, passing
+ * XENMAPSPACE_shared_info as space parameter.
+ *
+ * - All the per-cpu struct vcpu_info are mapped by ARM guests using the
+ * HYPERVISOR_vcpu_op sub-op VCPUOP_register_vcpu_info, including cpu0
+ * struct vcpu_info.
+ *
+ * - The grant table is mapped using the HYPERVISOR_memory_op sub-op
+ * XENMEM_add_to_physmap, passing XENMAPSPACE_grant_table as space
+ * parameter. The memory range specified under the Xen compatible
+ * hypervisor node on device tree can be used as target gpfn for the
+ * mapping.
+ *
+ * - Xenstore is initialized by using the two hvm_params
+ * HVM_PARAM_STORE_PFN and HVM_PARAM_STORE_EVTCHN. They can be read
+ * with the HYPERVISOR_hvm_op sub-op HVMOP_get_param.
+ *
+ * - The paravirtualized console is initialized by using the two
+ * hvm_params HVM_PARAM_CONSOLE_PFN and HVM_PARAM_CONSOLE_EVTCHN. They
+ * can be read with the HYPERVISOR_hvm_op sub-op HVMOP_get_param.
+ *
+ * - Event channel notifications are delivered using the percpu GIC
+ * interrupt specified under the Xen compatible hypervisor node on
+ * device tree.
+ *
+ * - The device tree Xen compatible node is fully described under Linux
+ * at Documentation/devicetree/bindings/arm/xen.txt.
+ */
+
+#define XEN_HYPERCALL_TAG 0xEA1
+
+#define uint64_aligned_t UINT64 __attribute__((aligned(8)))
+
+#ifndef __ASSEMBLY__
+#define ___DEFINE_XEN_GUEST_HANDLE(name, type) \
+ typedef union { type *p; unsigned long q; } \
+ __guest_handle_ ## name; \
+ typedef union { type *p; uint64_aligned_t q; } \
+ __guest_handle_64_ ## name;
+
+/*
+ * XEN_GUEST_HANDLE represents a guest pointer, when passed as a field
+ * in a struct in memory. On ARM is always 8 bytes sizes and 8 bytes
+ * aligned.
+ * XEN_GUEST_HANDLE_PARAM represent a guest pointer, when passed as an
+ * hypercall argument. It is 4 bytes on aarch and 8 bytes on aarch64.
+ */
+#define __DEFINE_XEN_GUEST_HANDLE(name, type) \
+ ___DEFINE_XEN_GUEST_HANDLE(name, type); \
+ ___DEFINE_XEN_GUEST_HANDLE(const_##name, const type)
+#define DEFINE_XEN_GUEST_HANDLE(name) __DEFINE_XEN_GUEST_HANDLE(name, name)
+#define __XEN_GUEST_HANDLE(name) __guest_handle_64_ ## name
+#define XEN_GUEST_HANDLE(name) __XEN_GUEST_HANDLE(name)
+/* this is going to be changed on 64 bit */
+#define XEN_GUEST_HANDLE_PARAM(name) __guest_handle_ ## name
+#define set_xen_guest_handle_raw(hnd, val) \
+ do { \
+ typeof(&(hnd)) _sxghr_tmp = &(hnd); \
+ _sxghr_tmp->q = 0; \
+ _sxghr_tmp->p = val; \
+ } while ( 0 )
+#ifdef __XEN_TOOLS__
+#define get_xen_guest_handle(val, hnd) do { val = (hnd).p; } while (0)
+#endif
+#define set_xen_guest_handle(hnd, val) set_xen_guest_handle_raw(hnd, val)
+
+#if defined(__GNUC__) && !defined(__STRICT_ANSI__)
+/* Anonymous union includes both 32- and 64-bit names (e.g., r0/x0). */
+# define __DECL_REG(n64, n32) union { \
+ UINT64 n64; \
+ UINT32 n32; \
+ }
+#else
+/* Non-gcc sources must always use the proper 64-bit name (e.g., x0). */
+#define __DECL_REG(n64, n32) UINT64 n64
+#endif
+
+struct vcpu_guest_core_regs
+{
+ /* Aarch64 Aarch32 */
+ __DECL_REG(x0, r0_usr);
+ __DECL_REG(x1, r1_usr);
+ __DECL_REG(x2, r2_usr);
+ __DECL_REG(x3, r3_usr);
+ __DECL_REG(x4, r4_usr);
+ __DECL_REG(x5, r5_usr);
+ __DECL_REG(x6, r6_usr);
+ __DECL_REG(x7, r7_usr);
+ __DECL_REG(x8, r8_usr);
+ __DECL_REG(x9, r9_usr);
+ __DECL_REG(x10, r10_usr);
+ __DECL_REG(x11, r11_usr);
+ __DECL_REG(x12, r12_usr);
+
+ __DECL_REG(x13, sp_usr);
+ __DECL_REG(x14, lr_usr);
+
+ __DECL_REG(x15, __unused_sp_hyp);
+
+ __DECL_REG(x16, lr_irq);
+ __DECL_REG(x17, sp_irq);
+
+ __DECL_REG(x18, lr_svc);
+ __DECL_REG(x19, sp_svc);
+
+ __DECL_REG(x20, lr_abt);
+ __DECL_REG(x21, sp_abt);
+
+ __DECL_REG(x22, lr_und);
+ __DECL_REG(x23, sp_und);
+
+ __DECL_REG(x24, r8_fiq);
+ __DECL_REG(x25, r9_fiq);
+ __DECL_REG(x26, r10_fiq);
+ __DECL_REG(x27, r11_fiq);
+ __DECL_REG(x28, r12_fiq);
+
+ __DECL_REG(x29, sp_fiq);
+ __DECL_REG(x30, lr_fiq);
+
+ /* Return address and mode */
+ __DECL_REG(pc64, pc32); /* ELR_EL2 */
+ UINT32 cpsr; /* SPSR_EL2 */
+
+ union {
+ UINT32 spsr_el1; /* AArch64 */
+ UINT32 spsr_svc; /* AArch32 */
+ };
+
+ /* AArch32 guests only */
+ UINT32 spsr_fiq, spsr_irq, spsr_und, spsr_abt;
+
+ /* AArch64 guests only */
+ UINT64 sp_el0;
+ UINT64 sp_el1, elr_el1;
+};
+typedef struct vcpu_guest_core_regs vcpu_guest_core_regs_t;
+DEFINE_XEN_GUEST_HANDLE(vcpu_guest_core_regs_t);
+
+#undef __DECL_REG
+
+typedef UINT64 xen_pfn_t;
+#define PRI_xen_pfn PRIx64
+
+/* Maximum number of virtual CPUs in legacy multi-processor guests. */
+/* Only one. All other VCPUS must use VCPUOP_register_vcpu_info */
+#define XEN_LEGACY_MAX_VCPUS 1
+
+typedef UINT64 xen_ulong_t;
+#define PRI_xen_ulong PRIx64
+
+#if defined(__XEN__) || defined(__XEN_TOOLS__)
+struct vcpu_guest_context {
+#define _VGCF_online 0
+#define VGCF_online (1<<_VGCF_online)
+ UINT32 flags; /* VGCF_* */
+
+ struct vcpu_guest_core_regs user_regs; /* Core CPU registers */
+
+ UINT32 sctlr;
+ UINT64 ttbcr, ttbr0, ttbr1;
+};
+typedef struct vcpu_guest_context vcpu_guest_context_t;
+DEFINE_XEN_GUEST_HANDLE(vcpu_guest_context_t);
+#endif
+
+struct arch_vcpu_info {
+};
+typedef struct arch_vcpu_info arch_vcpu_info_t;
+
+struct arch_shared_info {
+};
+typedef struct arch_shared_info arch_shared_info_t;
+typedef UINT64 xen_callback_t;
+
+#endif
+
+#if defined(__XEN__) || defined(__XEN_TOOLS__)
+
+/* PSR bits (CPSR, SPSR)*/
+
+#define PSR_THUMB (1<<5) /* Thumb Mode enable */
+#define PSR_FIQ_MASK (1<<6) /* Fast Interrupt mask */
+#define PSR_IRQ_MASK (1<<7) /* Interrupt mask */
+#define PSR_ABT_MASK (1<<8) /* Asynchronous Abort mask */
+#define PSR_BIG_ENDIAN (1<<9) /* arm32: Big Endian Mode */
+#define PSR_DBG_MASK (1<<9) /* arm64: Debug Exception mask */
+#define PSR_IT_MASK (0x0600fc00) /* Thumb If-Then Mask */
+#define PSR_JAZELLE (1<<24) /* Jazelle Mode */
+
+/* 32 bit modes */
+#define PSR_MODE_USR 0x10
+#define PSR_MODE_FIQ 0x11
+#define PSR_MODE_IRQ 0x12
+#define PSR_MODE_SVC 0x13
+#define PSR_MODE_MON 0x16
+#define PSR_MODE_ABT 0x17
+#define PSR_MODE_HYP 0x1a
+#define PSR_MODE_UND 0x1b
+#define PSR_MODE_SYS 0x1f
+
+/* 64 bit modes */
+#define PSR_MODE_BIT 0x10 /* Set iff AArch32 */
+#define PSR_MODE_EL3h 0x0d
+#define PSR_MODE_EL3t 0x0c
+#define PSR_MODE_EL2h 0x09
+#define PSR_MODE_EL2t 0x08
+#define PSR_MODE_EL1h 0x05
+#define PSR_MODE_EL1t 0x04
+#define PSR_MODE_EL0t 0x00
+
+#define PSR_GUEST32_INIT (PSR_ABT_MASK|PSR_FIQ_MASK|PSR_IRQ_MASK|PSR_MODE_SVC)
+#define PSR_GUEST64_INIT (PSR_ABT_MASK|PSR_FIQ_MASK|PSR_IRQ_MASK|PSR_MODE_EL1h)
+
+#define SCTLR_GUEST_INIT 0x00c50078
+
+/*
+ * Virtual machine platform (memory layout, interrupts)
+ *
+ * These are defined for consistency between the tools and the
+ * hypervisor. Guests must not rely on these hardcoded values but
+ * should instead use the FDT.
+ */
+
+/* Physical Address Space */
+
+/* vGIC mappings: Only one set of mapping is used by the guest.
+ * Therefore they can overlap.
+ */
+
+/* vGIC v2 mappings */
+#define GUEST_GICD_BASE 0x03001000ULL
+#define GUEST_GICD_SIZE 0x00001000ULL
+#define GUEST_GICC_BASE 0x03002000ULL
+#define GUEST_GICC_SIZE 0x00000100ULL
+
+/* vGIC v3 mappings */
+#define GUEST_GICV3_GICD_BASE 0x03001000ULL
+#define GUEST_GICV3_GICD_SIZE 0x00010000ULL
+
+#define GUEST_GICV3_RDIST_STRIDE 0x20000ULL
+#define GUEST_GICV3_RDIST_REGIONS 1
+
+#define GUEST_GICV3_GICR0_BASE 0x03020000ULL /* vCPU0 - vCPU7 */
+#define GUEST_GICV3_GICR0_SIZE 0x00100000ULL
+
+/* 16MB == 4096 pages reserved for guest to use as a region to map its
+ * grant table in.
+ */
+#define GUEST_GNTTAB_BASE 0x38000000ULL
+#define GUEST_GNTTAB_SIZE 0x01000000ULL
+
+#define GUEST_MAGIC_BASE 0x39000000ULL
+#define GUEST_MAGIC_SIZE 0x01000000ULL
+
+#define GUEST_RAM_BANKS 2
+
+#define GUEST_RAM0_BASE 0x40000000ULL /* 3GB of low RAM @ 1GB */
+#define GUEST_RAM0_SIZE 0xc0000000ULL
+
+#define GUEST_RAM1_BASE 0x0200000000ULL /* 1016GB of RAM @ 8GB */
+#define GUEST_RAM1_SIZE 0xfe00000000ULL
+
+#define GUEST_RAM_BASE GUEST_RAM0_BASE /* Lowest RAM address */
+/* Largest amount of actual RAM, not including holes */
+#define GUEST_RAM_MAX (GUEST_RAM0_SIZE + GUEST_RAM1_SIZE)
+/* Suitable for e.g. const uint64_t ramfoo[] = GUEST_RAM_BANK_FOOS; */
+#define GUEST_RAM_BANK_BASES { GUEST_RAM0_BASE, GUEST_RAM1_BASE }
+#define GUEST_RAM_BANK_SIZES { GUEST_RAM0_SIZE, GUEST_RAM1_SIZE }
+
+/* Interrupts */
+#define GUEST_TIMER_VIRT_PPI 27
+#define GUEST_TIMER_PHYS_S_PPI 29
+#define GUEST_TIMER_PHYS_NS_PPI 30
+#define GUEST_EVTCHN_PPI 31
+
+/* PSCI functions */
+#define PSCI_cpu_suspend 0
+#define PSCI_cpu_off 1
+#define PSCI_cpu_on 2
+#define PSCI_migrate 3
+
+#endif
+
+#endif /* __XEN_PUBLIC_ARCH_ARM_H__ */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/hvm/start_info.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/hvm/start_info.h
new file mode 100644
index 00000000..944fcad9
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/hvm/start_info.h
@@ -0,0 +1,143 @@
+/*
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2016, Citrix Systems, Inc.
+ */
+
+#ifndef __XEN_PUBLIC_ARCH_X86_HVM_START_INFO_H__
+#define __XEN_PUBLIC_ARCH_X86_HVM_START_INFO_H__
+
+/*
+ * Start of day structure passed to PVH guests and to HVM guests in %ebx.
+ *
+ * NOTE: nothing will be loaded at physical address 0, so a 0 value in any
+ * of the address fields should be treated as not present.
+ *
+ * 0 +----------------+
+ * | magic | Contains the magic value XEN_HVM_START_MAGIC_VALUE
+ * | | ("xEn3" with the 0x80 bit of the "E" set).
+ * 4 +----------------+
+ * | version | Version of this structure. Current version is 1. New
+ * | | versions are guaranteed to be backwards-compatible.
+ * 8 +----------------+
+ * | flags | SIF_xxx flags.
+ * 12 +----------------+
+ * | nr_modules | Number of modules passed to the kernel.
+ * 16 +----------------+
+ * | modlist_paddr | Physical address of an array of modules
+ * | | (layout of the structure below).
+ * 24 +----------------+
+ * | cmdline_paddr | Physical address of the command line,
+ * | | a zero-terminated ASCII string.
+ * 32 +----------------+
+ * | rsdp_paddr | Physical address of the RSDP ACPI data structure.
+ * 40 +----------------+
+ * | memmap_paddr | Physical address of the (optional) memory map. Only
+ * | | present in version 1 and newer of the structure.
+ * 48 +----------------+
+ * | memmap_entries | Number of entries in the memory map table. Zero
+ * | | if there is no memory map being provided. Only
+ * | | present in version 1 and newer of the structure.
+ * 52 +----------------+
+ * | reserved | Version 1 and newer only.
+ * 56 +----------------+
+ *
+ * The layout of each entry in the module structure is the following:
+ *
+ * 0 +----------------+
+ * | paddr | Physical address of the module.
+ * 8 +----------------+
+ * | size | Size of the module in bytes.
+ * 16 +----------------+
+ * | cmdline_paddr | Physical address of the command line,
+ * | | a zero-terminated ASCII string.
+ * 24 +----------------+
+ * | reserved |
+ * 32 +----------------+
+ *
+ * The layout of each entry in the memory map table is as follows:
+ *
+ * 0 +----------------+
+ * | addr | Base address
+ * 8 +----------------+
+ * | size | Size of mapping in bytes
+ * 16 +----------------+
+ * | type | Type of mapping as defined between the hypervisor
+ * | | and guest. See XEN_HVM_MEMMAP_TYPE_* values below.
+ * 20 +----------------|
+ * | reserved |
+ * 24 +----------------+
+ *
+ * The address and sizes are always a 64bit little endian unsigned integer.
+ *
+ * NB: Xen on x86 will always try to place all the data below the 4GiB
+ * boundary.
+ *
+ * Version numbers of the hvm_start_info structure have evolved like this:
+ *
+ * Version 0: Initial implementation.
+ *
+ * Version 1: Added the memmap_paddr/memmap_entries fields (plus 4 bytes of
+ * padding) to the end of the hvm_start_info struct. These new
+ * fields can be used to pass a memory map to the guest. The
+ * memory map is optional and so guests that understand version 1
+ * of the structure must check that memmap_entries is non-zero
+ * before trying to read the memory map.
+ */
+#define XEN_HVM_START_MAGIC_VALUE 0x336ec578
+
+/*
+ * The values used in the type field of the memory map table entries are
+ * defined below and match the Address Range Types as defined in the "System
+ * Address Map Interfaces" section of the ACPI Specification. Please refer to
+ * section 15 in version 6.2 of the ACPI spec: http://uefi.org/specifications
+ */
+#define XEN_HVM_MEMMAP_TYPE_RAM 1
+#define XEN_HVM_MEMMAP_TYPE_RESERVED 2
+#define XEN_HVM_MEMMAP_TYPE_ACPI 3
+#define XEN_HVM_MEMMAP_TYPE_NVS 4
+#define XEN_HVM_MEMMAP_TYPE_UNUSABLE 5
+#define XEN_HVM_MEMMAP_TYPE_DISABLED 6
+#define XEN_HVM_MEMMAP_TYPE_PMEM 7
+
+/*
+ * C representation of the x86/HVM start info layout.
+ *
+ * The canonical definition of this layout is above, this is just a way to
+ * represent the layout described there using C types.
+ */
+struct hvm_start_info {
+ UINT32 magic; /* Contains the magic value 0x336ec578 */
+ /* ("xEn3" with the 0x80 bit of the "E" set).*/
+ UINT32 version; /* Version of this structure. */
+ UINT32 flags; /* SIF_xxx flags. */
+ UINT32 nr_modules; /* Number of modules passed to the kernel. */
+ UINT64 modlist_paddr; /* Physical address of an array of */
+ /* hvm_modlist_entry. */
+ UINT64 cmdline_paddr; /* Physical address of the command line. */
+ UINT64 rsdp_paddr; /* Physical address of the RSDP ACPI data */
+ /* structure. */
+ /* All following fields only present in version 1 and newer */
+ UINT64 memmap_paddr; /* Physical address of an array of */
+ /* hvm_memmap_table_entry. */
+ UINT32 memmap_entries; /* Number of entries in the memmap table. */
+ /* Value will be zero if there is no memory */
+ /* map being provided. */
+ UINT32 reserved; /* Must be zero. */
+};
+
+struct hvm_modlist_entry {
+ UINT64 paddr; /* Physical address of the module. */
+ UINT64 size; /* Size of the module in bytes. */
+ UINT64 cmdline_paddr; /* Physical address of the command line. */
+ UINT64 reserved;
+};
+
+struct hvm_memmap_table_entry {
+ UINT64 addr; /* Base address of the memory region */
+ UINT64 size; /* Size of the memory region in bytes */
+ UINT32 type; /* Mapping type */
+ UINT32 reserved; /* Must be zero for Version 1. */
+};
+
+#endif /* __XEN_PUBLIC_ARCH_X86_HVM_START_INFO_H__ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/xen-x86_32.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/xen-x86_32.h
new file mode 100644
index 00000000..b77d6ca4
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/xen-x86_32.h
@@ -0,0 +1,43 @@
+/******************************************************************************
+ * xen-x86_32.h
+ *
+ * Guest OS interface to x86 32-bit Xen.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2004-2007, K A Fraser
+ */
+
+#ifndef __XEN_PUBLIC_ARCH_X86_XEN_X86_32_H__
+#define __XEN_PUBLIC_ARCH_X86_XEN_X86_32_H__
+
+/*
+ * Hypercall interface:
+ * Input: %ebx, %ecx, %edx, %esi, %edi, %ebp (arguments 1-6)
+ * Output: %eax
+ * Access is via hypercall page (set up by guest loader or via a Xen MSR):
+ * call hypercall_page + hypercall-number * 32
+ * Clobbered: Argument registers (e.g., 2-arg hypercall clobbers %ebx,%ecx)
+ */
+
+#ifndef __ASSEMBLY__
+
+struct arch_vcpu_info {
+ UINTN cr2;
+ UINTN pad[5]; /* sizeof(vcpu_info_t) == 64 */
+};
+typedef struct arch_vcpu_info arch_vcpu_info_t;
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __XEN_PUBLIC_ARCH_X86_XEN_X86_32_H__ */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/xen-x86_64.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/xen-x86_64.h
new file mode 100644
index 00000000..1883ad27
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/xen-x86_64.h
@@ -0,0 +1,43 @@
+/******************************************************************************
+ * xen-x86_64.h
+ *
+ * Guest OS interface to x86 64-bit Xen.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2004-2006, K A Fraser
+ */
+
+#ifndef __XEN_PUBLIC_ARCH_X86_XEN_X86_64_H__
+#define __XEN_PUBLIC_ARCH_X86_XEN_X86_64_H__
+
+/*
+ * Hypercall interface:
+ * Input: %rdi, %rsi, %rdx, %r10, %r8, %r9 (arguments 1-6)
+ * Output: %rax
+ * Access is via hypercall page (set up by guest loader or via a Xen MSR):
+ * call hypercall_page + hypercall-number * 32
+ * Clobbered: argument registers (e.g., 2-arg hypercall clobbers %rdi,%rsi)
+ */
+
+#ifndef __ASSEMBLY__
+
+struct arch_vcpu_info {
+ UINTN cr2;
+ UINTN pad; /* sizeof(vcpu_info_t) == 64 */
+};
+typedef struct arch_vcpu_info arch_vcpu_info_t;
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __XEN_PUBLIC_ARCH_X86_XEN_X86_64_H__ */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/xen.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/xen.h
new file mode 100644
index 00000000..317f024e
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/arch-x86/xen.h
@@ -0,0 +1,96 @@
+/******************************************************************************
+ * arch-x86/xen.h
+ *
+ * Guest OS interface to x86 Xen.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2004-2006, K A Fraser
+ */
+
+#include "../xen.h"
+
+#ifndef __XEN_PUBLIC_ARCH_X86_XEN_H__
+#define __XEN_PUBLIC_ARCH_X86_XEN_H__
+
+/* Structural guest handles introduced in 0x00030201. */
+#if __XEN_INTERFACE_VERSION__ >= 0x00030201
+#define ___DEFINE_XEN_GUEST_HANDLE(name, type) \
+ typedef struct { type *p; } __guest_handle_ ## name
+#else
+#define ___DEFINE_XEN_GUEST_HANDLE(name, type) \
+ typedef type * __guest_handle_ ## name
+#endif
+
+/*
+ * XEN_GUEST_HANDLE represents a guest pointer, when passed as a field
+ * in a struct in memory.
+ * XEN_GUEST_HANDLE_PARAM represent a guest pointer, when passed as an
+ * hypercall argument.
+ * XEN_GUEST_HANDLE_PARAM and XEN_GUEST_HANDLE are the same on X86 but
+ * they might not be on other architectures.
+ */
+#define __DEFINE_XEN_GUEST_HANDLE(name, type) \
+ ___DEFINE_XEN_GUEST_HANDLE(name, type); \
+ ___DEFINE_XEN_GUEST_HANDLE(const_##name, const type)
+#define DEFINE_XEN_GUEST_HANDLE(name) __DEFINE_XEN_GUEST_HANDLE(name, name)
+#define __XEN_GUEST_HANDLE(name) __guest_handle_ ## name
+#define XEN_GUEST_HANDLE(name) __XEN_GUEST_HANDLE(name)
+#define XEN_GUEST_HANDLE_PARAM(name) XEN_GUEST_HANDLE(name)
+#define set_xen_guest_handle_raw(hnd, val) do { (hnd).p = val; } while (0)
+#ifdef __XEN_TOOLS__
+#define get_xen_guest_handle(val, hnd) do { val = (hnd).p; } while (0)
+#endif
+#define set_xen_guest_handle(hnd, val) set_xen_guest_handle_raw(hnd, val)
+
+#if defined(MDE_CPU_IA32)
+#include "xen-x86_32.h"
+#elif defined(MDE_CPU_X64)
+#include "xen-x86_64.h"
+#endif
+
+#ifndef __ASSEMBLY__
+typedef UINTN xen_pfn_t;
+#define PRI_xen_pfn "lx"
+#endif
+
+#define XEN_HAVE_PV_UPCALL_MASK 1
+
+/* Maximum number of virtual CPUs in legacy multi-processor guests. */
+#define XEN_LEGACY_MAX_VCPUS 32
+
+#ifndef __ASSEMBLY__
+
+typedef UINTN xen_ulong_t;
+#define PRI_xen_ulong "lx"
+
+typedef UINT64 tsc_timestamp_t; /* RDTSC timestamp */
+
+#ifdef MDE_CPU_IA32
+#pragma pack(4)
+#endif
+struct arch_shared_info {
+ UINTN max_pfn; /* max pfn that appears in table */
+ /* Frame containing list of mfns containing list of mfns containing p2m. */
+ xen_pfn_t pfn_to_mfn_frame_list_list;
+ UINTN nmi_reason;
+ UINT64 pad[32];
+};
+typedef struct arch_shared_info arch_shared_info_t;
+#ifdef MDE_CPU_IA32
+#pragma pack()
+#endif
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __XEN_PUBLIC_ARCH_X86_XEN_H__ */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/event_channel.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/event_channel.h
new file mode 100644
index 00000000..b3b39009
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/event_channel.h
@@ -0,0 +1,102 @@
+/******************************************************************************
+ * event_channel.h
+ *
+ * Event channels between domains.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2003-2004, K A Fraser.
+ */
+
+#ifndef __XEN_PUBLIC_EVENT_CHANNEL_H__
+#define __XEN_PUBLIC_EVENT_CHANNEL_H__
+
+#include "xen.h"
+
+/*
+ * `incontents 150 evtchn Event Channels
+ *
+ * Event channels are the basic primitive provided by Xen for event
+ * notifications. An event is the Xen equivalent of a hardware
+ * interrupt. They essentially store one bit of information, the event
+ * of interest is signalled by transitioning this bit from 0 to 1.
+ *
+ * Notifications are received by a guest via an upcall from Xen,
+ * indicating when an event arrives (setting the bit). Further
+ * notifications are masked until the bit is cleared again (therefore,
+ * guests must check the value of the bit after re-enabling event
+ * delivery to ensure no missed notifications).
+ *
+ * Event notifications can be masked by setting a flag; this is
+ * equivalent to disabling interrupts and can be used to ensure
+ * atomicity of certain operations in the guest kernel.
+ *
+ * Event channels are represented by the evtchn_* fields in
+ * struct shared_info and struct vcpu_info.
+ */
+
+/*
+ * ` enum neg_errnoval
+ * ` HYPERVISOR_event_channel_op(enum event_channel_op cmd, VOID *args)
+ * `
+ * @cmd == EVTCHNOP_* (event-channel operation).
+ * @args == struct evtchn_* Operation-specific extra arguments (NULL if none).
+ */
+
+/* ` enum event_channel_op { // EVTCHNOP_* => struct evtchn_* */
+#define EVTCHNOP_close 3
+#define EVTCHNOP_send 4
+#define EVTCHNOP_alloc_unbound 6
+/* ` } */
+
+typedef UINT32 evtchn_port_t;
+DEFINE_XEN_GUEST_HANDLE(evtchn_port_t);
+
+/*
+ * EVTCHNOP_alloc_unbound: Allocate a port in domain <dom> and mark as
+ * accepting interdomain bindings from domain <remote_dom>. A fresh port
+ * is allocated in <dom> and returned as <port>.
+ * NOTES:
+ * 1. If the caller is unprivileged then <dom> must be DOMID_SELF.
+ * 2. <rdom> may be DOMID_SELF, allowing loopback connections.
+ */
+struct evtchn_alloc_unbound {
+ /* IN parameters */
+ domid_t dom, remote_dom;
+ /* OUT parameters */
+ evtchn_port_t port;
+};
+typedef struct evtchn_alloc_unbound evtchn_alloc_unbound_t;
+
+/*
+ * EVTCHNOP_close: Close a local event channel <port>. If the channel is
+ * interdomain then the remote end is placed in the unbound state
+ * (EVTCHNSTAT_unbound), awaiting a new connection.
+ */
+struct evtchn_close {
+ /* IN parameters. */
+ evtchn_port_t port;
+};
+typedef struct evtchn_close evtchn_close_t;
+
+/*
+ * EVTCHNOP_send: Send an event to the remote end of the channel whose local
+ * endpoint is <port>.
+ */
+struct evtchn_send {
+ /* IN parameters. */
+ evtchn_port_t port;
+};
+typedef struct evtchn_send evtchn_send_t;
+
+#endif /* __XEN_PUBLIC_EVENT_CHANNEL_H__ */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/grant_table.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/grant_table.h
new file mode 100644
index 00000000..17f25c20
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/grant_table.h
@@ -0,0 +1,428 @@
+/******************************************************************************
+ * grant_table.h
+ *
+ * Interface for granting foreign access to page frames, and receiving
+ * page-ownership transfers.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2004, K A Fraser
+ */
+
+#ifndef __XEN_PUBLIC_GRANT_TABLE_H__
+#define __XEN_PUBLIC_GRANT_TABLE_H__
+
+#include "xen.h"
+
+/*
+ * `incontents 150 gnttab Grant Tables
+ *
+ * Xen's grant tables provide a generic mechanism to memory sharing
+ * between domains. This shared memory interface underpins the split
+ * device drivers for block and network IO.
+ *
+ * Each domain has its own grant table. This is a data structure that
+ * is shared with Xen; it allows the domain to tell Xen what kind of
+ * permissions other domains have on its pages. Entries in the grant
+ * table are identified by grant references. A grant reference is an
+ * integer, which indexes into the grant table. It acts as a
+ * capability which the grantee can use to perform operations on the
+ * granter's memory.
+ *
+ * This capability-based system allows shared-memory communications
+ * between unprivileged domains. A grant reference also encapsulates
+ * the details of a shared page, removing the need for a domain to
+ * know the real machine address of a page it is sharing. This makes
+ * it possible to share memory correctly with domains running in
+ * fully virtualised memory.
+ */
+
+/***********************************
+ * GRANT TABLE REPRESENTATION
+ */
+
+/* Some rough guidelines on accessing and updating grant-table entries
+ * in a concurrency-safe manner. For more information, Linux contains a
+ * reference implementation for guest OSes (drivers/xen/grant_table.c, see
+ * http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=blob;f=drivers/xen/grant-table.c;hb=HEAD
+ *
+ * NB. WMB is a no-op on current-generation x86 processors. However, a
+ * compiler barrier will still be required.
+ *
+ * Introducing a valid entry into the grant table:
+ * 1. Write ent->domid.
+ * 2. Write ent->frame:
+ * GTF_permit_access: Frame to which access is permitted.
+ * GTF_accept_transfer: Pseudo-phys frame slot being filled by new
+ * frame, or zero if none.
+ * 3. Write memory barrier (WMB).
+ * 4. Write ent->flags, inc. valid type.
+ *
+ * Invalidating an unused GTF_permit_access entry:
+ * 1. flags = ent->flags.
+ * 2. Observe that !(flags & (GTF_reading|GTF_writing)).
+ * 3. Check result of SMP-safe CMPXCHG(&ent->flags, flags, 0).
+ * NB. No need for WMB as reuse of entry is control-dependent on success of
+ * step 3, and all architectures guarantee ordering of ctrl-dep writes.
+ *
+ * Invalidating an in-use GTF_permit_access entry:
+ * This cannot be done directly. Request assistance from the domain controller
+ * which can set a timeout on the use of a grant entry and take necessary
+ * action. (NB. This is not yet implemented!).
+ *
+ * Invalidating an unused GTF_accept_transfer entry:
+ * 1. flags = ent->flags.
+ * 2. Observe that !(flags & GTF_transfer_committed). [*]
+ * 3. Check result of SMP-safe CMPXCHG(&ent->flags, flags, 0).
+ * NB. No need for WMB as reuse of entry is control-dependent on success of
+ * step 3, and all architectures guarantee ordering of ctrl-dep writes.
+ * [*] If GTF_transfer_committed is set then the grant entry is 'committed'.
+ * The guest must /not/ modify the grant entry until the address of the
+ * transferred frame is written. It is safe for the guest to spin waiting
+ * for this to occur (detect by observing GTF_transfer_completed in
+ * ent->flags).
+ *
+ * Invalidating a committed GTF_accept_transfer entry:
+ * 1. Wait for (ent->flags & GTF_transfer_completed).
+ *
+ * Changing a GTF_permit_access from writable to read-only:
+ * Use SMP-safe CMPXCHG to set GTF_readonly, while checking !GTF_writing.
+ *
+ * Changing a GTF_permit_access from read-only to writable:
+ * Use SMP-safe bit-setting instruction.
+ */
+
+/*
+ * Reference to a grant entry in a specified domain's grant table.
+ */
+typedef UINT32 grant_ref_t;
+
+/*
+ * A grant table comprises a packed array of grant entries in one or more
+ * page frames shared between Xen and a guest.
+ * [XEN]: This field is written by Xen and read by the sharing guest.
+ * [GST]: This field is written by the guest and read by Xen.
+ */
+
+/*
+ * Version 1 of the grant table entry structure is maintained purely
+ * for backwards compatibility. New guests should use version 2.
+ */
+#if __XEN_INTERFACE_VERSION__ < 0x0003020a
+#define grant_entry_v1 grant_entry
+#define grant_entry_v1_t grant_entry_t
+#endif
+struct grant_entry_v1 {
+ /* GTF_xxx: various type and flag information. [XEN,GST] */
+ UINT16 flags;
+ /* The domain being granted foreign privileges. [GST] */
+ domid_t domid;
+ /*
+ * GTF_permit_access: Frame that @domid is allowed to map and access. [GST]
+ * GTF_accept_transfer: Frame whose ownership transferred by @domid. [XEN]
+ */
+ UINT32 frame;
+};
+typedef struct grant_entry_v1 grant_entry_v1_t;
+
+/* The first few grant table entries will be preserved across grant table
+ * version changes and may be pre-populated at domain creation by tools.
+ */
+#define GNTTAB_NR_RESERVED_ENTRIES 8
+#define GNTTAB_RESERVED_CONSOLE 0
+#define GNTTAB_RESERVED_XENSTORE 1
+
+/*
+ * Type of grant entry.
+ * GTF_invalid: This grant entry grants no privileges.
+ * GTF_permit_access: Allow @domid to map/access @frame.
+ * GTF_accept_transfer: Allow @domid to transfer ownership of one page frame
+ * to this guest. Xen writes the page number to @frame.
+ * GTF_transitive: Allow @domid to transitively access a subrange of
+ * @trans_grant in @trans_domid. No mappings are allowed.
+ */
+#define GTF_invalid (0U<<0)
+#define GTF_permit_access (1U<<0)
+#define GTF_accept_transfer (2U<<0)
+#define GTF_transitive (3U<<0)
+#define GTF_type_mask (3U<<0)
+
+/*
+ * Subflags for GTF_permit_access.
+ * GTF_readonly: Restrict @domid to read-only mappings and accesses. [GST]
+ * GTF_reading: Grant entry is currently mapped for reading by @domid. [XEN]
+ * GTF_writing: Grant entry is currently mapped for writing by @domid. [XEN]
+ * GTF_PAT, GTF_PWT, GTF_PCD: (x86) cache attribute flags for the grant [GST]
+ * GTF_sub_page: Grant access to only a subrange of the page. @domid
+ * will only be allowed to copy from the grant, and not
+ * map it. [GST]
+ */
+#define _GTF_readonly (2)
+#define GTF_readonly (1U<<_GTF_readonly)
+#define _GTF_reading (3)
+#define GTF_reading (1U<<_GTF_reading)
+#define _GTF_writing (4)
+#define GTF_writing (1U<<_GTF_writing)
+#define _GTF_PWT (5)
+#define GTF_PWT (1U<<_GTF_PWT)
+#define _GTF_PCD (6)
+#define GTF_PCD (1U<<_GTF_PCD)
+#define _GTF_PAT (7)
+#define GTF_PAT (1U<<_GTF_PAT)
+#define _GTF_sub_page (8)
+#define GTF_sub_page (1U<<_GTF_sub_page)
+
+/*
+ * Subflags for GTF_accept_transfer:
+ * GTF_transfer_committed: Xen sets this flag to indicate that it is committed
+ * to transferring ownership of a page frame. When a guest sees this flag
+ * it must /not/ modify the grant entry until GTF_transfer_completed is
+ * set by Xen.
+ * GTF_transfer_completed: It is safe for the guest to spin-wait on this flag
+ * after reading GTF_transfer_committed. Xen will always write the frame
+ * address, followed by ORing this flag, in a timely manner.
+ */
+#define _GTF_transfer_committed (2)
+#define GTF_transfer_committed (1U<<_GTF_transfer_committed)
+#define _GTF_transfer_completed (3)
+#define GTF_transfer_completed (1U<<_GTF_transfer_completed)
+
+/*
+ * Version 2 grant table entries. These fulfil the same role as
+ * version 1 entries, but can represent more complicated operations.
+ * Any given domain will have either a version 1 or a version 2 table,
+ * and every entry in the table will be the same version.
+ *
+ * The interface by which domains use grant references does not depend
+ * on the grant table version in use by the other domain.
+ */
+#if __XEN_INTERFACE_VERSION__ >= 0x0003020a
+/*
+ * Version 1 and version 2 grant entries share a common prefix. The
+ * fields of the prefix are documented as part of struct
+ * grant_entry_v1.
+ */
+struct grant_entry_header {
+ UINT16 flags;
+ domid_t domid;
+};
+typedef struct grant_entry_header grant_entry_header_t;
+
+/*
+ * Version 2 of the grant entry structure.
+ */
+union grant_entry_v2 {
+ grant_entry_header_t hdr;
+
+ /*
+ * This member is used for V1-style full page grants, where either:
+ *
+ * -- hdr.type is GTF_accept_transfer, or
+ * -- hdr.type is GTF_permit_access and GTF_sub_page is not set.
+ *
+ * In that case, the frame field has the same semantics as the
+ * field of the same name in the V1 entry structure.
+ */
+ struct {
+ grant_entry_header_t hdr;
+ UINT32 pad0;
+ UINT64 frame;
+ } full_page;
+
+ /*
+ * If the grant type is GTF_grant_access and GTF_sub_page is set,
+ * @domid is allowed to access bytes [@page_off,@page_off+@length)
+ * in frame @frame.
+ */
+ struct {
+ grant_entry_header_t hdr;
+ UINT16 page_off;
+ UINT16 length;
+ UINT64 frame;
+ } sub_page;
+
+ /*
+ * If the grant is GTF_transitive, @domid is allowed to use the
+ * grant @gref in domain @trans_domid, as if it was the local
+ * domain. Obviously, the transitive access must be compatible
+ * with the original grant.
+ *
+ * The current version of Xen does not allow transitive grants
+ * to be mapped.
+ */
+ struct {
+ grant_entry_header_t hdr;
+ domid_t trans_domid;
+ UINT16 pad0;
+ grant_ref_t gref;
+ } transitive;
+
+ UINT32 __spacer[4]; /* Pad to a power of two */
+};
+typedef union grant_entry_v2 grant_entry_v2_t;
+
+typedef UINT16 grant_status_t;
+
+#endif /* __XEN_INTERFACE_VERSION__ */
+
+/***********************************
+ * GRANT TABLE QUERIES AND USES
+ */
+
+/* ` enum neg_errnoval
+ * ` HYPERVISOR_grant_table_op(enum grant_table_op cmd,
+ * ` VOID *args,
+ * ` UINT32 count)
+ * `
+ *
+ * @args points to an array of a per-command data structure. The array
+ * has @count members
+ */
+
+/* ` enum grant_table_op { // GNTTABOP_* => struct gnttab_* */
+#define GNTTABOP_map_grant_ref 0
+#define GNTTABOP_unmap_grant_ref 1
+/* ` } */
+
+/*
+ * Handle to track a mapping created via a grant reference.
+ */
+typedef UINT32 grant_handle_t;
+
+/*
+ * GNTTABOP_map_grant_ref: Map the grant entry (<dom>,<ref>) for access
+ * by devices and/or host CPUs. If successful, <handle> is a tracking number
+ * that must be presented later to destroy the mapping(s). On error, <handle>
+ * is a negative status code.
+ * NOTES:
+ * 1. If GNTMAP_device_map is specified then <dev_bus_addr> is the address
+ * via which I/O devices may access the granted frame.
+ * 2. If GNTMAP_host_map is specified then a mapping will be added at
+ * either a host virtual address in the current address space, or at
+ * a PTE at the specified machine address. The type of mapping to
+ * perform is selected through the GNTMAP_contains_pte flag, and the
+ * address is specified in <host_addr>.
+ * 3. Mappings should only be destroyed via GNTTABOP_unmap_grant_ref. If a
+ * host mapping is destroyed by other means then it is *NOT* guaranteed
+ * to be accounted to the correct grant reference!
+ */
+struct gnttab_map_grant_ref {
+ /* IN parameters. */
+ UINT64 host_addr;
+ UINT32 flags; /* GNTMAP_* */
+ grant_ref_t ref;
+ domid_t dom;
+ /* OUT parameters. */
+ INT16 status; /* => enum grant_status */
+ grant_handle_t handle;
+ UINT64 dev_bus_addr;
+};
+typedef struct gnttab_map_grant_ref gnttab_map_grant_ref_t;
+DEFINE_XEN_GUEST_HANDLE(gnttab_map_grant_ref_t);
+
+/*
+ * GNTTABOP_unmap_grant_ref: Destroy one or more grant-reference mappings
+ * tracked by <handle>. If <host_addr> or <dev_bus_addr> is zero, that
+ * field is ignored. If non-zero, they must refer to a device/host mapping
+ * that is tracked by <handle>
+ * NOTES:
+ * 1. The call may fail in an undefined manner if either mapping is not
+ * tracked by <handle>.
+ * 3. After executing a batch of unmaps, it is guaranteed that no stale
+ * mappings will remain in the device or host TLBs.
+ */
+struct gnttab_unmap_grant_ref {
+ /* IN parameters. */
+ UINT64 host_addr;
+ UINT64 dev_bus_addr;
+ grant_handle_t handle;
+ /* OUT parameters. */
+ INT16 status; /* => enum grant_status */
+};
+typedef struct gnttab_unmap_grant_ref gnttab_unmap_grant_ref_t;
+DEFINE_XEN_GUEST_HANDLE(gnttab_unmap_grant_ref_t);
+
+/*
+ * Bitfield values for gnttab_map_grant_ref.flags.
+ */
+ /* Map the grant entry for access by I/O devices. */
+#define _GNTMAP_device_map (0)
+#define GNTMAP_device_map (1<<_GNTMAP_device_map)
+ /* Map the grant entry for access by host CPUs. */
+#define _GNTMAP_host_map (1)
+#define GNTMAP_host_map (1<<_GNTMAP_host_map)
+ /* Accesses to the granted frame will be restricted to read-only access. */
+#define _GNTMAP_readonly (2)
+#define GNTMAP_readonly (1<<_GNTMAP_readonly)
+ /*
+ * GNTMAP_host_map subflag:
+ * 0 => The host mapping is usable only by the guest OS.
+ * 1 => The host mapping is usable by guest OS + current application.
+ */
+#define _GNTMAP_application_map (3)
+#define GNTMAP_application_map (1<<_GNTMAP_application_map)
+
+ /*
+ * GNTMAP_contains_pte subflag:
+ * 0 => This map request contains a host virtual address.
+ * 1 => This map request contains the machine address of the PTE to update.
+ */
+#define _GNTMAP_contains_pte (4)
+#define GNTMAP_contains_pte (1<<_GNTMAP_contains_pte)
+
+#define _GNTMAP_can_fail (5)
+#define GNTMAP_can_fail (1<<_GNTMAP_can_fail)
+
+/*
+ * Bits to be placed in guest kernel available PTE bits (architecture
+ * dependent; only supported when XENFEAT_gnttab_map_avail_bits is set).
+ */
+#define _GNTMAP_guest_avail0 (16)
+#define GNTMAP_guest_avail_mask ((UINT32)~0 << _GNTMAP_guest_avail0)
+
+/*
+ * Values for error status returns. All errors are -ve.
+ */
+/* ` enum grant_status { */
+#define GNTST_okay (0) /* Normal return. */
+#define GNTST_general_error (-1) /* General undefined error. */
+#define GNTST_bad_domain (-2) /* Unrecognised domain id. */
+#define GNTST_bad_gntref (-3) /* Unrecognised or inappropriate gntref. */
+#define GNTST_bad_handle (-4) /* Unrecognised or inappropriate handle. */
+#define GNTST_bad_virt_addr (-5) /* Inappropriate virtual address to map. */
+#define GNTST_bad_dev_addr (-6) /* Inappropriate device address to unmap.*/
+#define GNTST_no_device_space (-7) /* Out of space in I/O MMU. */
+#define GNTST_permission_denied (-8) /* Not enough privilege for operation. */
+#define GNTST_bad_page (-9) /* Specified page was invalid for op. */
+#define GNTST_bad_copy_arg (-10) /* copy arguments cross page boundary. */
+#define GNTST_address_too_big (-11) /* transfer page address too large. */
+#define GNTST_eagain (-12) /* Operation not done; try again. */
+/* ` } */
+
+#define GNTTABOP_error_msgs { \
+ "okay", \
+ "undefined error", \
+ "unrecognised domain id", \
+ "invalid grant reference", \
+ "invalid mapping handle", \
+ "invalid virtual address", \
+ "invalid device address", \
+ "no spare translation slot in the I/O MMU", \
+ "permission denied", \
+ "bad page", \
+ "copy arguments cross page boundary", \
+ "page address size too large", \
+ "operation not done; try again" \
+}
+
+#endif /* __XEN_PUBLIC_GRANT_TABLE_H__ */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/hvm/hvm_op.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/hvm/hvm_op.h
new file mode 100644
index 00000000..0b3e67dd
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/hvm/hvm_op.h
@@ -0,0 +1,21 @@
+/*
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef __XEN_PUBLIC_HVM_HVM_OP_H__
+#define __XEN_PUBLIC_HVM_HVM_OP_H__
+
+#include "../xen.h"
+
+/* Get/set subcommands: extra argument == pointer to xen_hvm_param struct. */
+#define HVMOP_set_param 0
+#define HVMOP_get_param 1
+struct xen_hvm_param {
+ domid_t domid; /* IN */
+ UINT32 index; /* IN */
+ UINT64 value; /* IN/OUT */
+};
+typedef struct xen_hvm_param xen_hvm_param_t;
+DEFINE_XEN_GUEST_HANDLE(xen_hvm_param_t);
+
+#endif /* __XEN_PUBLIC_HVM_HVM_OP_H__ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/hvm/params.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/hvm/params.h
new file mode 100644
index 00000000..a16bc4f6
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/hvm/params.h
@@ -0,0 +1,134 @@
+/*
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef __XEN_PUBLIC_HVM_PARAMS_H__
+#define __XEN_PUBLIC_HVM_PARAMS_H__
+
+#include "hvm_op.h"
+
+/*
+ * Parameter space for HVMOP_{set,get}_param.
+ */
+
+/*
+ * How should CPU0 event-channel notifications be delivered?
+ * val[63:56] == 0: val[55:0] is a delivery GSI (Global System Interrupt).
+ * val[63:56] == 1: val[55:0] is a delivery PCI INTx line, as follows:
+ * Domain = val[47:32], Bus = val[31:16],
+ * DevFn = val[15: 8], IntX = val[ 1: 0]
+ * val[63:56] == 2: val[7:0] is a vector number, check for
+ * XENFEAT_hvm_callback_vector to know if this delivery
+ * method is available.
+ * If val == 0 then CPU0 event-channel notifications are not delivered.
+ */
+#define HVM_PARAM_CALLBACK_IRQ 0
+
+/*
+ * These are not used by Xen. They are here for convenience of HVM-guest
+ * xenbus implementations.
+ */
+#define HVM_PARAM_STORE_PFN 1
+#define HVM_PARAM_STORE_EVTCHN 2
+
+#define HVM_PARAM_PAE_ENABLED 4
+
+#define HVM_PARAM_IOREQ_PFN 5
+
+#define HVM_PARAM_BUFIOREQ_PFN 6
+#define HVM_PARAM_BUFIOREQ_EVTCHN 26
+
+#if defined(MDE_CPU_IA32) || defined(MDE_CPU_X64)
+
+/* Expose Viridian interfaces to this HVM guest? */
+#define HVM_PARAM_VIRIDIAN 9
+
+#endif
+
+/*
+ * Set mode for virtual timers (currently x86 only):
+ * delay_for_missed_ticks (default):
+ * Do not advance a vcpu's time beyond the correct delivery time for
+ * interrupts that have been missed due to preemption. Deliver missed
+ * interrupts when the vcpu is rescheduled and advance the vcpu's virtual
+ * time stepwise for each one.
+ * no_delay_for_missed_ticks:
+ * As above, missed interrupts are delivered, but guest time always tracks
+ * wallclock (i.e., real) time while doing so.
+ * no_missed_ticks_pending:
+ * No missed interrupts are held pending. Instead, to ensure ticks are
+ * delivered at some non-zero rate, if we detect missed ticks then the
+ * internal tick alarm is not disabled if the VCPU is preempted during the
+ * next tick period.
+ * one_missed_tick_pending:
+ * Missed interrupts are collapsed together and delivered as one 'late tick'.
+ * Guest time always tracks wallclock (i.e., real) time.
+ */
+#define HVM_PARAM_TIMER_MODE 10
+#define HVMPTM_delay_for_missed_ticks 0
+#define HVMPTM_no_delay_for_missed_ticks 1
+#define HVMPTM_no_missed_ticks_pending 2
+#define HVMPTM_one_missed_tick_pending 3
+
+/* Boolean: Enable virtual HPET (high-precision event timer)? (x86-only) */
+#define HVM_PARAM_HPET_ENABLED 11
+
+/* Identity-map page directory used by Intel EPT when CR0.PG=0. */
+#define HVM_PARAM_IDENT_PT 12
+
+/* Device Model domain, defaults to 0. */
+#define HVM_PARAM_DM_DOMAIN 13
+
+/* ACPI S state: currently support S0 and S3 on x86. */
+#define HVM_PARAM_ACPI_S_STATE 14
+
+/* TSS used on Intel when CR0.PE=0. */
+#define HVM_PARAM_VM86_TSS 15
+
+/* Boolean: Enable aligning all periodic vpts to reduce interrupts */
+#define HVM_PARAM_VPT_ALIGN 16
+
+/* Console debug shared memory ring and event channel */
+#define HVM_PARAM_CONSOLE_PFN 17
+#define HVM_PARAM_CONSOLE_EVTCHN 18
+
+/*
+ * Select location of ACPI PM1a and TMR control blocks. Currently two locations
+ * are supported, specified by version 0 or 1 in this parameter:
+ * - 0: default, use the old addresses
+ * PM1A_EVT == 0x1f40; PM1A_CNT == 0x1f44; PM_TMR == 0x1f48
+ * - 1: use the new default qemu addresses
+ * PM1A_EVT == 0xb000; PM1A_CNT == 0xb004; PM_TMR == 0xb008
+ * You can find these address definitions in <hvm/ioreq.h>
+ */
+#define HVM_PARAM_ACPI_IOPORTS_LOCATION 19
+
+/* Enable blocking memory events, async or sync (pause vcpu until response)
+ * onchangeonly indicates messages only on a change of value */
+#define HVM_PARAM_MEMORY_EVENT_CR0 20
+#define HVM_PARAM_MEMORY_EVENT_CR3 21
+#define HVM_PARAM_MEMORY_EVENT_CR4 22
+#define HVM_PARAM_MEMORY_EVENT_INT3 23
+#define HVM_PARAM_MEMORY_EVENT_SINGLE_STEP 25
+#define HVM_PARAM_MEMORY_EVENT_MSR 30
+
+#define HVMPME_MODE_MASK (3 << 0)
+#define HVMPME_mode_disabled 0
+#define HVMPME_mode_async 1
+#define HVMPME_mode_sync 2
+#define HVMPME_onchangeonly (1 << 2)
+
+/* Boolean: Enable nestedhvm (hvm only) */
+#define HVM_PARAM_NESTEDHVM 24
+
+/* Params for the mem event rings */
+#define HVM_PARAM_PAGING_RING_PFN 27
+#define HVM_PARAM_ACCESS_RING_PFN 28
+#define HVM_PARAM_SHARING_RING_PFN 29
+
+/* SHUTDOWN_* action in case of a triple fault */
+#define HVM_PARAM_TRIPLE_FAULT_REASON 31
+
+#define HVM_NR_PARAMS 32
+
+#endif /* __XEN_PUBLIC_HVM_PARAMS_H__ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/blkif.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/blkif.h
new file mode 100644
index 00000000..9263b293
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/blkif.h
@@ -0,0 +1,603 @@
+/******************************************************************************
+ * blkif.h
+ *
+ * Unified block-device I/O interface for Xen guest OSes.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2003-2004, Keir Fraser
+ * Copyright (c) 2012, Spectra Logic Corporation
+ */
+
+#ifndef __XEN_PUBLIC_IO_BLKIF_H__
+#define __XEN_PUBLIC_IO_BLKIF_H__
+
+#include "ring.h"
+#include "../grant_table.h"
+
+/*
+ * Front->back notifications: When enqueuing a new request, sending a
+ * notification can be made conditional on req_event (i.e., the generic
+ * hold-off mechanism provided by the ring macros). Backends must set
+ * req_event appropriately (e.g., using RING_FINAL_CHECK_FOR_REQUESTS()).
+ *
+ * Back->front notifications: When enqueuing a new response, sending a
+ * notification can be made conditional on rsp_event (i.e., the generic
+ * hold-off mechanism provided by the ring macros). Frontends must set
+ * rsp_event appropriately (e.g., using RING_FINAL_CHECK_FOR_RESPONSES()).
+ */
+
+#ifndef blkif_vdev_t
+#define blkif_vdev_t UINT16
+#endif
+#define blkif_sector_t UINT64
+
+/*
+ * Feature and Parameter Negotiation
+ * =================================
+ * The two halves of a Xen block driver utilize nodes within the XenStore to
+ * communicate capabilities and to negotiate operating parameters. This
+ * section enumerates these nodes which reside in the respective front and
+ * backend portions of the XenStore, following the XenBus convention.
+ *
+ * All data in the XenStore is stored as strings. Nodes specifying numeric
+ * values are encoded in decimal. Integer value ranges listed below are
+ * expressed as fixed sized integer types capable of storing the conversion
+ * of a properly formatted node string, without loss of information.
+ *
+ * Any specified default value is in effect if the corresponding XenBus node
+ * is not present in the XenStore.
+ *
+ * XenStore nodes in sections marked "PRIVATE" are solely for use by the
+ * driver side whose XenBus tree contains them.
+ *
+ * XenStore nodes marked "DEPRECATED" in their notes section should only be
+ * used to provide interoperability with legacy implementations.
+ *
+ * See the XenBus state transition diagram below for details on when XenBus
+ * nodes must be published and when they can be queried.
+ *
+ *****************************************************************************
+ * Backend XenBus Nodes
+ *****************************************************************************
+ *
+ *------------------ Backend Device Identification (PRIVATE) ------------------
+ *
+ * mode
+ * Values: "r" (read only), "w" (writable)
+ *
+ * The read or write access permissions to the backing store to be
+ * granted to the frontend.
+ *
+ * params
+ * Values: string
+ *
+ * A free formatted string providing sufficient information for the
+ * backend driver to open the backing device. (e.g. the path to the
+ * file or block device representing the backing store.)
+ *
+ * type
+ * Values: "file", "phy", "tap"
+ *
+ * The type of the backing device/object.
+ *
+ *--------------------------------- Features ---------------------------------
+ *
+ * feature-barrier
+ * Values: 0/1 (boolean)
+ * Default Value: 0
+ *
+ * A value of "1" indicates that the backend can process requests
+ * containing the BLKIF_OP_WRITE_BARRIER request opcode. Requests
+ * of this type may still be returned at any time with the
+ * BLKIF_RSP_EOPNOTSUPP result code.
+ *
+ * feature-flush-cache
+ * Values: 0/1 (boolean)
+ * Default Value: 0
+ *
+ * A value of "1" indicates that the backend can process requests
+ * containing the BLKIF_OP_FLUSH_DISKCACHE request opcode. Requests
+ * of this type may still be returned at any time with the
+ * BLKIF_RSP_EOPNOTSUPP result code.
+ *
+ * feature-discard
+ * Values: 0/1 (boolean)
+ * Default Value: 0
+ *
+ * A value of "1" indicates that the backend can process requests
+ * containing the BLKIF_OP_DISCARD request opcode. Requests
+ * of this type may still be returned at any time with the
+ * BLKIF_RSP_EOPNOTSUPP result code.
+ *
+ * feature-persistent
+ * Values: 0/1 (boolean)
+ * Default Value: 0
+ * Notes: 7
+ *
+ * A value of "1" indicates that the backend can keep the grants used
+ * by the frontend driver mapped, so the same set of grants should be
+ * used in all transactions. The maximum number of grants the backend
+ * can map persistently depends on the implementation, but ideally it
+ * should be RING_SIZE * BLKIF_MAX_SEGMENTS_PER_REQUEST. Using this
+ * feature the backend doesn't need to unmap each grant, preventing
+ * costly TLB flushes. The backend driver should only map grants
+ * persistently if the frontend supports it. If a backend driver chooses
+ * to use the persistent protocol when the frontend doesn't support it,
+ * it will probably hit the maximum number of persistently mapped grants
+ * (due to the fact that the frontend won't be reusing the same grants),
+ * and fall back to non-persistent mode. Backend implementations may
+ * shrink or expand the number of persistently mapped grants without
+ * notifying the frontend depending on memory constraints (this might
+ * cause a performance degradation).
+ *
+ * If a backend driver wants to limit the maximum number of persistently
+ * mapped grants to a value less than RING_SIZE *
+ * BLKIF_MAX_SEGMENTS_PER_REQUEST a LRU strategy should be used to
+ * discard the grants that are less commonly used. Using a LRU in the
+ * backend driver paired with a LIFO queue in the frontend will
+ * allow us to have better performance in this scenario.
+ *
+ *----------------------- Request Transport Parameters ------------------------
+ *
+ * max-ring-page-order
+ * Values: <UINT32>
+ * Default Value: 0
+ * Notes: 1, 3
+ *
+ * The maximum supported size of the request ring buffer in units of
+ * lb(machine pages). (e.g. 0 == 1 page, 1 = 2 pages, 2 == 4 pages,
+ * etc.).
+ *
+ * max-ring-pages
+ * Values: <UINT32>
+ * Default Value: 1
+ * Notes: DEPRECATED, 2, 3
+ *
+ * The maximum supported size of the request ring buffer in units of
+ * machine pages. The value must be a power of 2.
+ *
+ *------------------------- Backend Device Properties -------------------------
+ *
+ * discard-alignment
+ * Values: <UINT32>
+ * Default Value: 0
+ * Notes: 4, 5
+ *
+ * The offset, in bytes from the beginning of the virtual block device,
+ * to the first, addressable, discard extent on the underlying device.
+ *
+ * discard-granularity
+ * Values: <UINT32>
+ * Default Value: <"sector-size">
+ * Notes: 4
+ *
+ * The size, in bytes, of the individually addressable discard extents
+ * of the underlying device.
+ *
+ * discard-secure
+ * Values: 0/1 (boolean)
+ * Default Value: 0
+ * Notes: 10
+ *
+ * A value of "1" indicates that the backend can process BLKIF_OP_DISCARD
+ * requests with the BLKIF_DISCARD_SECURE flag set.
+ *
+ * info
+ * Values: <UINT32> (bitmap)
+ *
+ * A collection of bit flags describing attributes of the backing
+ * device. The VDISK_* macros define the meaning of each bit
+ * location.
+ *
+ * sector-size
+ * Values: <UINT32>
+ *
+ * The logical sector size, in bytes, of the backend device.
+ *
+ * physical-sector-size
+ * Values: <UINT32>
+ *
+ * The physical sector size, in bytes, of the backend device.
+ *
+ * sectors
+ * Values: <UINT64>
+ *
+ * The size of the backend device, expressed in units of its logical
+ * sector size ("sector-size").
+ *
+ *****************************************************************************
+ * Frontend XenBus Nodes
+ *****************************************************************************
+ *
+ *----------------------- Request Transport Parameters -----------------------
+ *
+ * event-channel
+ * Values: <UINT32>
+ *
+ * The identifier of the Xen event channel used to signal activity
+ * in the ring buffer.
+ *
+ * ring-ref
+ * Values: <UINT32>
+ * Notes: 6
+ *
+ * The Xen grant reference granting permission for the backend to map
+ * the sole page in a single page sized ring buffer.
+ *
+ * ring-ref%u
+ * Values: <UINT32>
+ * Notes: 6
+ *
+ * For a frontend providing a multi-page ring, a "number of ring pages"
+ * sized list of nodes, each containing a Xen grant reference granting
+ * permission for the backend to map the page of the ring located
+ * at page index "%u". Page indexes are zero based.
+ *
+ * protocol
+ * Values: string (XEN_IO_PROTO_ABI_*)
+ * Default Value: XEN_IO_PROTO_ABI_NATIVE
+ *
+ * The machine ABI rules governing the format of all ring request and
+ * response structures.
+ *
+ * ring-page-order
+ * Values: <UINT32>
+ * Default Value: 0
+ * Maximum Value: MAX(ffs(max-ring-pages) - 1, max-ring-page-order)
+ * Notes: 1, 3
+ *
+ * The size of the frontend allocated request ring buffer in units
+ * of lb(machine pages). (e.g. 0 == 1 page, 1 = 2 pages, 2 == 4 pages,
+ * etc.).
+ *
+ * num-ring-pages
+ * Values: <UINT32>
+ * Default Value: 1
+ * Maximum Value: MAX(max-ring-pages,(0x1 << max-ring-page-order))
+ * Notes: DEPRECATED, 2, 3
+ *
+ * The size of the frontend allocated request ring buffer in units of
+ * machine pages. The value must be a power of 2.
+ *
+ * feature-persistent
+ * Values: 0/1 (boolean)
+ * Default Value: 0
+ * Notes: 7, 8, 9
+ *
+ * A value of "1" indicates that the frontend will reuse the same grants
+ * for all transactions, allowing the backend to map them with write
+ * access (even when it should be read-only). If the frontend hits the
+ * maximum number of allowed persistently mapped grants, it can fallback
+ * to non persistent mode. This will cause a performance degradation,
+ * since the backend driver will still try to map those grants
+ * persistently. Since the persistent grants protocol is compatible with
+ * the previous protocol, a frontend driver can choose to work in
+ * persistent mode even when the backend doesn't support it.
+ *
+ * It is recommended that the frontend driver stores the persistently
+ * mapped grants in a LIFO queue, so a subset of all persistently mapped
+ * grants gets used commonly. This is done in case the backend driver
+ * decides to limit the maximum number of persistently mapped grants
+ * to a value less than RING_SIZE * BLKIF_MAX_SEGMENTS_PER_REQUEST.
+ *
+ *------------------------- Virtual Device Properties -------------------------
+ *
+ * device-type
+ * Values: "disk", "cdrom", "floppy", etc.
+ *
+ * virtual-device
+ * Values: <UINT32>
+ *
+ * A value indicating the physical device to virtualize within the
+ * frontend's domain. (e.g. "The first ATA disk", "The third SCSI
+ * disk", etc.)
+ *
+ * See docs/misc/vbd-interface.txt for details on the format of this
+ * value.
+ *
+ * Notes
+ * -----
+ * (1) Multi-page ring buffer scheme first developed in the Citrix XenServer
+ * PV drivers.
+ * (2) Multi-page ring buffer scheme first used in some RedHat distributions
+ * including a distribution deployed on certain nodes of the Amazon
+ * EC2 cluster.
+ * (3) Support for multi-page ring buffers was implemented independently,
+ * in slightly different forms, by both Citrix and RedHat/Amazon.
+ * For full interoperability, block front and backends should publish
+ * identical ring parameters, adjusted for unit differences, to the
+ * XenStore nodes used in both schemes.
+ * (4) Devices that support discard functionality may internally allocate space
+ * (discardable extents) in units that are larger than the exported logical
+ * block size. If the backing device has such discardable extents the
+ * backend should provide both discard-granularity and discard-alignment.
+ * Providing just one of the two may be considered an error by the frontend.
+ * Backends supporting discard should include discard-granularity and
+ * discard-alignment even if it supports discarding individual sectors.
+ * Frontends should assume discard-alignment == 0 and discard-granularity
+ * == sector size if these keys are missing.
+ * (5) The discard-alignment parameter allows a physical device to be
+ * partitioned into virtual devices that do not necessarily begin or
+ * end on a discardable extent boundary.
+ * (6) When there is only a single page allocated to the request ring,
+ * 'ring-ref' is used to communicate the grant reference for this
+ * page to the backend. When using a multi-page ring, the 'ring-ref'
+ * node is not created. Instead 'ring-ref0' - 'ring-refN' are used.
+ * (7) When using persistent grants data has to be copied from/to the page
+ * where the grant is currently mapped. The overhead of doing this copy
+ * however doesn't suppress the speed improvement of not having to unmap
+ * the grants.
+ * (8) The frontend driver has to allow the backend driver to map all grants
+ * with write access, even when they should be mapped read-only, since
+ * further requests may reuse these grants and require write permissions.
+ * (9) Linux implementation doesn't have a limit on the maximum number of
+ * grants that can be persistently mapped in the frontend driver, but
+ * due to the frontent driver implementation it should never be bigger
+ * than RING_SIZE * BLKIF_MAX_SEGMENTS_PER_REQUEST.
+ *(10) The discard-secure property may be present and will be set to 1 if the
+ * backing device supports secure discard.
+ */
+
+/*
+ * STATE DIAGRAMS
+ *
+ *****************************************************************************
+ * Startup *
+ *****************************************************************************
+ *
+ * Tool stack creates front and back nodes with state XenbusStateInitialising.
+ *
+ * Front Back
+ * ================================= =====================================
+ * XenbusStateInitialising XenbusStateInitialising
+ * o Query virtual device o Query backend device identification
+ * properties. data.
+ * o Setup OS device instance. o Open and validate backend device.
+ * o Publish backend features and
+ * transport parameters.
+ * |
+ * |
+ * V
+ * XenbusStateInitWait
+ *
+ * o Query backend features and
+ * transport parameters.
+ * o Allocate and initialize the
+ * request ring.
+ * o Publish transport parameters
+ * that will be in effect during
+ * this connection.
+ * |
+ * |
+ * V
+ * XenbusStateInitialised
+ *
+ * o Query frontend transport parameters.
+ * o Connect to the request ring and
+ * event channel.
+ * o Publish backend device properties.
+ * |
+ * |
+ * V
+ * XenbusStateConnected
+ *
+ * o Query backend device properties.
+ * o Finalize OS virtual device
+ * instance.
+ * |
+ * |
+ * V
+ * XenbusStateConnected
+ *
+ * Note: Drivers that do not support any optional features, or the negotiation
+ * of transport parameters, can skip certain states in the state machine:
+ *
+ * o A frontend may transition to XenbusStateInitialised without
+ * waiting for the backend to enter XenbusStateInitWait. In this
+ * case, default transport parameters are in effect and any
+ * transport parameters published by the frontend must contain
+ * their default values.
+ *
+ * o A backend may transition to XenbusStateInitialised, bypassing
+ * XenbusStateInitWait, without waiting for the frontend to first
+ * enter the XenbusStateInitialised state. In this case, default
+ * transport parameters are in effect and any transport parameters
+ * published by the backend must contain their default values.
+ *
+ * Drivers that support optional features and/or transport parameter
+ * negotiation must tolerate these additional state transition paths.
+ * In general this means performing the work of any skipped state
+ * transition, if it has not already been performed, in addition to the
+ * work associated with entry into the current state.
+ */
+
+/*
+ * REQUEST CODES.
+ */
+#define BLKIF_OP_READ 0
+#define BLKIF_OP_WRITE 1
+/*
+ * All writes issued prior to a request with the BLKIF_OP_WRITE_BARRIER
+ * operation code ("barrier request") must be completed prior to the
+ * execution of the barrier request. All writes issued after the barrier
+ * request must not execute until after the completion of the barrier request.
+ *
+ * Optional. See "feature-barrier" XenBus node documentation above.
+ */
+#define BLKIF_OP_WRITE_BARRIER 2
+/*
+ * Commit any uncommitted contents of the backing device's volatile cache
+ * to stable storage.
+ *
+ * Optional. See "feature-flush-cache" XenBus node documentation above.
+ */
+#define BLKIF_OP_FLUSH_DISKCACHE 3
+/*
+ * Used in SLES sources for device specific command packet
+ * contained within the request. Reserved for that purpose.
+ */
+#define BLKIF_OP_RESERVED_1 4
+/*
+ * Indicate to the backend device that a region of storage is no longer in
+ * use, and may be discarded at any time without impact to the client. If
+ * the BLKIF_DISCARD_SECURE flag is set on the request, all copies of the
+ * discarded region on the device must be rendered unrecoverable before the
+ * command returns.
+ *
+ * This operation is analogous to performing a trim (ATA) or unamp (SCSI),
+ * command on a native device.
+ *
+ * More information about trim/unmap operations can be found at:
+ * http://t13.org/Documents/UploadedDocuments/docs2008/
+ * e07154r6-Data_Set_Management_Proposal_for_ATA-ACS2.doc
+ * http://www.seagate.com/staticfiles/support/disc/manuals/
+ * Interface%20manuals/100293068c.pdf
+ *
+ * Optional. See "feature-discard", "discard-alignment",
+ * "discard-granularity", and "discard-secure" in the XenBus node
+ * documentation above.
+ */
+#define BLKIF_OP_DISCARD 5
+
+/*
+ * Recognized if "feature-max-indirect-segments" in present in the backend
+ * xenbus info. The "feature-max-indirect-segments" node contains the maximum
+ * number of segments allowed by the backend per request. If the node is
+ * present, the frontend might use blkif_request_indirect structs in order to
+ * issue requests with more than BLKIF_MAX_SEGMENTS_PER_REQUEST (11). The
+ * maximum number of indirect segments is fixed by the backend, but the
+ * frontend can issue requests with any number of indirect segments as long as
+ * it's less than the number provided by the backend. The indirect_grefs field
+ * in blkif_request_indirect should be filled by the frontend with the
+ * grant references of the pages that are holding the indirect segments.
+ * These pages are filled with an array of blkif_request_segment that hold the
+ * information about the segments. The number of indirect pages to use is
+ * determined by the number of segments an indirect request contains. Every
+ * indirect page can contain a maximum of
+ * (PAGE_SIZE / sizeof(struct blkif_request_segment)) segments, so to
+ * calculate the number of indirect pages to use we have to do
+ * ceil(indirect_segments / (PAGE_SIZE / sizeof(struct blkif_request_segment))).
+ *
+ * If a backend does not recognize BLKIF_OP_INDIRECT, it should *not*
+ * create the "feature-max-indirect-segments" node!
+ */
+#define BLKIF_OP_INDIRECT 6
+
+/*
+ * Maximum scatter/gather segments per request.
+ * This is carefully chosen so that sizeof(blkif_ring_t) <= PAGE_SIZE.
+ * NB. This could be 12 if the ring indexes weren't stored in the same page.
+ */
+#define BLKIF_MAX_SEGMENTS_PER_REQUEST 11
+
+/*
+ * Maximum number of indirect pages to use per request.
+ */
+#define BLKIF_MAX_INDIRECT_PAGES_PER_REQUEST 8
+
+/*
+ * NB. first_sect and last_sect in blkif_request_segment, as well as
+ * sector_number in blkif_request, are always expressed in 512-byte units.
+ * However they must be properly aligned to the real sector size of the
+ * physical disk, which is reported in the "physical-sector-size" node in
+ * the backend xenbus info. Also the xenbus "sectors" node is expressed in
+ * 512-byte units.
+ */
+struct blkif_request_segment {
+ grant_ref_t gref; /* reference to I/O buffer frame */
+ /* @first_sect: first sector in frame to transfer (inclusive). */
+ /* @last_sect: last sector in frame to transfer (inclusive). */
+ UINT8 first_sect, last_sect;
+};
+
+/*
+ * Starting ring element for any I/O request.
+ */
+#if defined(MDE_CPU_IA32)
+//
+// pack(4) is necessary when these structs are compiled for Ia32.
+// Without it, the struct will have a different alignment than the one
+// a backend expect for a 32bit guest.
+//
+#pragma pack(4)
+#endif
+struct blkif_request {
+ UINT8 operation; /* BLKIF_OP_??? */
+ UINT8 nr_segments; /* number of segments */
+ blkif_vdev_t handle; /* only for read/write requests */
+ UINT64 id; /* private guest value, echoed in resp */
+ blkif_sector_t sector_number;/* start sector idx on disk (r/w only) */
+ struct blkif_request_segment seg[BLKIF_MAX_SEGMENTS_PER_REQUEST];
+};
+typedef struct blkif_request blkif_request_t;
+
+/*
+ * Cast to this structure when blkif_request.operation == BLKIF_OP_DISCARD
+ * sizeof(struct blkif_request_discard) <= sizeof(struct blkif_request)
+ */
+struct blkif_request_discard {
+ UINT8 operation; /* BLKIF_OP_DISCARD */
+ UINT8 flag; /* BLKIF_DISCARD_SECURE or zero */
+#define BLKIF_DISCARD_SECURE (1<<0) /* ignored if discard-secure=0 */
+ blkif_vdev_t handle; /* same as for read/write requests */
+ UINT64 id; /* private guest value, echoed in resp */
+ blkif_sector_t sector_number;/* start sector idx on disk */
+ UINT64 nr_sectors; /* number of contiguous sectors to discard*/
+};
+typedef struct blkif_request_discard blkif_request_discard_t;
+
+struct blkif_request_indirect {
+ UINT8 operation; /* BLKIF_OP_INDIRECT */
+ UINT8 indirect_op; /* BLKIF_OP_{READ/WRITE} */
+ UINT16 nr_segments; /* number of segments */
+ UINT64 id; /* private guest value, echoed in resp */
+ blkif_sector_t sector_number;/* start sector idx on disk (r/w only) */
+ blkif_vdev_t handle; /* same as for read/write requests */
+ grant_ref_t indirect_grefs[BLKIF_MAX_INDIRECT_PAGES_PER_REQUEST];
+#ifdef MDE_CPU_IA32
+ UINT64 pad; /* Make it 64 byte aligned on i386 */
+#endif
+};
+typedef struct blkif_request_indirect blkif_request_indirect_t;
+
+struct blkif_response {
+ UINT64 id; /* copied from request */
+ UINT8 operation; /* copied from request */
+ INT16 status; /* BLKIF_RSP_??? */
+};
+typedef struct blkif_response blkif_response_t;
+#if defined(MDE_CPU_IA32)
+#pragma pack()
+#endif
+
+/*
+ * STATUS RETURN CODES.
+ */
+ /* Operation not supported (only happens on barrier writes). */
+#define BLKIF_RSP_EOPNOTSUPP -2
+ /* Operation failed for some unspecified reason (-EIO). */
+#define BLKIF_RSP_ERROR -1
+ /* Operation completed successfully. */
+#define BLKIF_RSP_OKAY 0
+
+/*
+ * Generate blkif ring structures and types.
+ */
+DEFINE_RING_TYPES(blkif, struct blkif_request, struct blkif_response);
+
+#define VDISK_CDROM 0x1
+#define VDISK_REMOVABLE 0x2
+#define VDISK_READONLY 0x4
+
+#endif /* __XEN_PUBLIC_IO_BLKIF_H__ */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/console.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/console.h
new file mode 100644
index 00000000..6a23b80d
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/console.h
@@ -0,0 +1,35 @@
+/******************************************************************************
+ * console.h
+ *
+ * Console I/O interface for Xen guest OSes.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2005, Keir Fraser
+ */
+
+#ifndef __XEN_PUBLIC_IO_CONSOLE_H__
+#define __XEN_PUBLIC_IO_CONSOLE_H__
+
+typedef UINT32 XENCONS_RING_IDX;
+
+#define MASK_XENCONS_IDX(idx, ring) ((idx) & (sizeof(ring)-1))
+
+struct xencons_interface {
+ char in[1024];
+ char out[2048];
+ XENCONS_RING_IDX in_cons, in_prod;
+ XENCONS_RING_IDX out_cons, out_prod;
+};
+
+#endif /* __XEN_PUBLIC_IO_CONSOLE_H__ */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/protocols.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/protocols.h
new file mode 100644
index 00000000..837a7952
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/protocols.h
@@ -0,0 +1,24 @@
+/******************************************************************************
+ * protocols.h
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#ifndef __XEN_PROTOCOLS_H__
+#define __XEN_PROTOCOLS_H__
+
+#define XEN_IO_PROTO_ABI_X86_32 "x86_32-abi"
+#define XEN_IO_PROTO_ABI_X86_64 "x86_64-abi"
+#define XEN_IO_PROTO_ABI_ARM "arm-abi"
+
+#if defined(MDE_CPU_IA32)
+# define XEN_IO_PROTO_ABI_NATIVE XEN_IO_PROTO_ABI_X86_32
+#elif defined(MDE_CPU_X64)
+# define XEN_IO_PROTO_ABI_NATIVE XEN_IO_PROTO_ABI_X86_64
+#elif defined(__arm__) || defined(__aarch64__)
+# define XEN_IO_PROTO_ABI_NATIVE XEN_IO_PROTO_ABI_ARM
+#else
+# error arch fixup needed here
+#endif
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/ring.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/ring.h
new file mode 100644
index 00000000..31a3a2dc
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/ring.h
@@ -0,0 +1,296 @@
+/******************************************************************************
+ * ring.h
+ *
+ * Shared producer-consumer ring macros.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Tim Deegan and Andrew Warfield November 2004.
+ */
+
+#ifndef __XEN_PUBLIC_IO_RING_H__
+#define __XEN_PUBLIC_IO_RING_H__
+
+#include "../xen-compat.h"
+
+#if __XEN_INTERFACE_VERSION__ < 0x00030208
+#define xen_mb() mb()
+#define xen_rmb() rmb()
+#define xen_wmb() wmb()
+#endif
+
+typedef UINT32 RING_IDX;
+
+/* Round a 32-bit unsigned constant down to the nearest power of two. */
+#define __RD2(_x) (((_x) & 0x00000002) ? 0x2 : ((_x) & 0x1))
+#define __RD4(_x) (((_x) & 0x0000000c) ? __RD2((_x)>>2)<<2 : __RD2(_x))
+#define __RD8(_x) (((_x) & 0x000000f0) ? __RD4((_x)>>4)<<4 : __RD4(_x))
+#define __RD16(_x) (((_x) & 0x0000ff00) ? __RD8((_x)>>8)<<8 : __RD8(_x))
+#define __RD32(_x) (((_x) & 0xffff0000) ? __RD16((_x)>>16)<<16 : __RD16(_x))
+
+/*
+ * Calculate size of a shared ring, given the total available space for the
+ * ring and indexes (_sz), and the name tag of the request/response structure.
+ * A ring contains as many entries as will fit, rounded down to the nearest
+ * power of two (so we can mask with (size-1) to loop around).
+ */
+#define __CONST_RING_SIZE(_s, _sz) \
+ (__RD32(((_sz) - offsetof(struct _s##_sring, ring)) / \
+ sizeof(((struct _s##_sring *)0)->ring[0])))
+/*
+ * The same for passing in an actual pointer instead of a name tag.
+ */
+#define __RING_SIZE(_s, _sz) \
+ (__RD32(((_sz) - (INTN)(_s)->ring + (INTN)(_s)) / sizeof((_s)->ring[0])))
+
+/*
+ * Macros to make the correct C datatypes for a new kind of ring.
+ *
+ * To make a new ring datatype, you need to have two message structures,
+ * let's say request_t, and response_t already defined.
+ *
+ * In a header where you want the ring datatype declared, you then do:
+ *
+ * DEFINE_RING_TYPES(mytag, request_t, response_t);
+ *
+ * These expand out to give you a set of types, as you can see below.
+ * The most important of these are:
+ *
+ * mytag_sring_t - The shared ring.
+ * mytag_front_ring_t - The 'front' half of the ring.
+ * mytag_back_ring_t - The 'back' half of the ring.
+ *
+ * To initialize a ring in your code you need to know the location and size
+ * of the shared memory area (PAGE_SIZE, for instance). To initialise
+ * the front half:
+ *
+ * mytag_front_ring_t front_ring;
+ * SHARED_RING_INIT((mytag_sring_t *)shared_page);
+ * FRONT_RING_INIT(&front_ring, (mytag_sring_t *)shared_page, PAGE_SIZE);
+ *
+ * Initializing the back follows similarly (note that only the front
+ * initializes the shared ring):
+ *
+ * mytag_back_ring_t back_ring;
+ * BACK_RING_INIT(&back_ring, (mytag_sring_t *)shared_page, PAGE_SIZE);
+ */
+
+#define DEFINE_RING_TYPES(__name, __req_t, __rsp_t) \
+ \
+/* Shared ring entry */ \
+union __name##_sring_entry { \
+ __req_t req; \
+ __rsp_t rsp; \
+}; \
+ \
+/* Shared ring page */ \
+struct __name##_sring { \
+ RING_IDX req_prod, req_event; \
+ RING_IDX rsp_prod, rsp_event; \
+ union { \
+ struct { \
+ UINT8 smartpoll_active; \
+ } netif; \
+ struct { \
+ UINT8 msg; \
+ } tapif_user; \
+ UINT8 pvt_pad[4]; \
+ } private; \
+ UINT8 __pad[44]; \
+ union __name##_sring_entry ring[1]; /* variable-length */ \
+}; \
+ \
+/* "Front" end's private variables */ \
+struct __name##_front_ring { \
+ RING_IDX req_prod_pvt; \
+ RING_IDX rsp_cons; \
+ UINT32 nr_ents; \
+ struct __name##_sring *sring; \
+}; \
+ \
+/* "Back" end's private variables */ \
+struct __name##_back_ring { \
+ RING_IDX rsp_prod_pvt; \
+ RING_IDX req_cons; \
+ UINT32 nr_ents; \
+ struct __name##_sring *sring; \
+}; \
+ \
+/* Syntactic sugar */ \
+typedef struct __name##_sring __name##_sring_t; \
+typedef struct __name##_front_ring __name##_front_ring_t; \
+typedef struct __name##_back_ring __name##_back_ring_t
+
+/*
+ * Macros for manipulating rings.
+ *
+ * FRONT_RING_whatever works on the "front end" of a ring: here
+ * requests are pushed on to the ring and responses taken off it.
+ *
+ * BACK_RING_whatever works on the "back end" of a ring: here
+ * requests are taken off the ring and responses put on.
+ *
+ * N.B. these macros do NO INTERLOCKS OR FLOW CONTROL.
+ * This is OK in 1-for-1 request-response situations where the
+ * requestor (front end) never has more than RING_SIZE()-1
+ * outstanding requests.
+ */
+
+/* Initialising empty rings */
+#define SHARED_RING_INIT(_s) do { \
+ (_s)->req_prod = (_s)->rsp_prod = 0; \
+ (_s)->req_event = (_s)->rsp_event = 1; \
+ (VOID)ZeroMem((_s)->private.pvt_pad, sizeof((_s)->private.pvt_pad)); \
+ (VOID)ZeroMem((_s)->__pad, sizeof((_s)->__pad)); \
+} while(0)
+
+#define FRONT_RING_INIT(_r, _s, __size) do { \
+ (_r)->req_prod_pvt = 0; \
+ (_r)->rsp_cons = 0; \
+ (_r)->nr_ents = __RING_SIZE(_s, __size); \
+ (_r)->sring = (_s); \
+} while (0)
+
+#define BACK_RING_INIT(_r, _s, __size) do { \
+ (_r)->rsp_prod_pvt = 0; \
+ (_r)->req_cons = 0; \
+ (_r)->nr_ents = __RING_SIZE(_s, __size); \
+ (_r)->sring = (_s); \
+} while (0)
+
+/* How big is this ring? */
+#define RING_SIZE(_r) \
+ ((_r)->nr_ents)
+
+/* Number of free requests (for use on front side only). */
+#define RING_FREE_REQUESTS(_r) \
+ (RING_SIZE(_r) - ((_r)->req_prod_pvt - (_r)->rsp_cons))
+
+/* Test if there is an empty slot available on the front ring.
+ * (This is only meaningful from the front. )
+ */
+#define RING_FULL(_r) \
+ (RING_FREE_REQUESTS(_r) == 0)
+
+/* Test if there are outstanding messages to be processed on a ring. */
+#define RING_HAS_UNCONSUMED_RESPONSES(_r) \
+ ((_r)->sring->rsp_prod - (_r)->rsp_cons)
+
+#ifdef __GNUC__
+#define RING_HAS_UNCONSUMED_REQUESTS(_r) ({ \
+ UINT32 req = (_r)->sring->req_prod - (_r)->req_cons; \
+ UINT32 rsp = RING_SIZE(_r) - \
+ ((_r)->req_cons - (_r)->rsp_prod_pvt); \
+ req < rsp ? req : rsp; \
+})
+#else
+/* Same as above, but without the nice GCC ({ ... }) syntax. */
+#define RING_HAS_UNCONSUMED_REQUESTS(_r) \
+ ((((_r)->sring->req_prod - (_r)->req_cons) < \
+ (RING_SIZE(_r) - ((_r)->req_cons - (_r)->rsp_prod_pvt))) ? \
+ ((_r)->sring->req_prod - (_r)->req_cons) : \
+ (RING_SIZE(_r) - ((_r)->req_cons - (_r)->rsp_prod_pvt)))
+#endif
+
+/* Direct access to individual ring elements, by index. */
+#define RING_GET_REQUEST(_r, _idx) \
+ (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].req))
+
+#define RING_GET_RESPONSE(_r, _idx) \
+ (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp))
+
+/* Loop termination condition: Would the specified index overflow the ring? */
+#define RING_REQUEST_CONS_OVERFLOW(_r, _cons) \
+ (((_cons) - (_r)->rsp_prod_pvt) >= RING_SIZE(_r))
+
+/* Ill-behaved frontend determination: Can there be this many requests? */
+#define RING_REQUEST_PROD_OVERFLOW(_r, _prod) \
+ (((_prod) - (_r)->rsp_prod_pvt) > RING_SIZE(_r))
+
+#define RING_PUSH_REQUESTS(_r) do { \
+ xen_wmb(); /* back sees requests /before/ updated producer index */ \
+ (_r)->sring->req_prod = (_r)->req_prod_pvt; \
+} while (0)
+
+#define RING_PUSH_RESPONSES(_r) do { \
+ xen_wmb(); /* front sees resps /before/ updated producer index */ \
+ (_r)->sring->rsp_prod = (_r)->rsp_prod_pvt; \
+} while (0)
+
+/*
+ * Notification hold-off (req_event and rsp_event):
+ *
+ * When queueing requests or responses on a shared ring, it may not always be
+ * necessary to notify the remote end. For example, if requests are in flight
+ * in a backend, the front may be able to queue further requests without
+ * notifying the back (if the back checks for new requests when it queues
+ * responses).
+ *
+ * When enqueuing requests or responses:
+ *
+ * Use RING_PUSH_{REQUESTS,RESPONSES}_AND_CHECK_NOTIFY(). The second argument
+ * is a boolean return value. True indicates that the receiver requires an
+ * asynchronous notification.
+ *
+ * After dequeuing requests or responses (before sleeping the connection):
+ *
+ * Use RING_FINAL_CHECK_FOR_REQUESTS() or RING_FINAL_CHECK_FOR_RESPONSES().
+ * The second argument is a boolean return value. True indicates that there
+ * are pending messages on the ring (i.e., the connection should not be put
+ * to sleep).
+ *
+ * These macros will set the req_event/rsp_event field to trigger a
+ * notification on the very next message that is enqueued. If you want to
+ * create batches of work (i.e., only receive a notification after several
+ * messages have been enqueued) then you will need to create a customised
+ * version of the FINAL_CHECK macro in your own code, which sets the event
+ * field appropriately.
+ */
+
+#define RING_PUSH_REQUESTS_AND_CHECK_NOTIFY(_r, _notify) do { \
+ RING_IDX __old = (_r)->sring->req_prod; \
+ RING_IDX __new = (_r)->req_prod_pvt; \
+ xen_wmb(); /* back sees requests /before/ updated producer index */ \
+ (_r)->sring->req_prod = __new; \
+ xen_mb(); /* back sees new requests /before/ we check req_event */ \
+ (_notify) = ((RING_IDX)(__new - (_r)->sring->req_event) < \
+ (RING_IDX)(__new - __old)); \
+} while (0)
+
+#define RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(_r, _notify) do { \
+ RING_IDX __old = (_r)->sring->rsp_prod; \
+ RING_IDX __new = (_r)->rsp_prod_pvt; \
+ xen_wmb(); /* front sees resps /before/ updated producer index */ \
+ (_r)->sring->rsp_prod = __new; \
+ xen_mb(); /* front sees new resps /before/ we check rsp_event */ \
+ (_notify) = ((RING_IDX)(__new - (_r)->sring->rsp_event) < \
+ (RING_IDX)(__new - __old)); \
+} while (0)
+
+#define RING_FINAL_CHECK_FOR_REQUESTS(_r, _work_to_do) do { \
+ (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \
+ if (_work_to_do) break; \
+ (_r)->sring->req_event = (_r)->req_cons + 1; \
+ xen_mb(); \
+ (_work_to_do) = RING_HAS_UNCONSUMED_REQUESTS(_r); \
+} while (0)
+
+#define RING_FINAL_CHECK_FOR_RESPONSES(_r, _work_to_do) do { \
+ (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \
+ if (_work_to_do) break; \
+ (_r)->sring->rsp_event = (_r)->rsp_cons + 1; \
+ xen_mb(); \
+ (_work_to_do) = RING_HAS_UNCONSUMED_RESPONSES(_r); \
+} while (0)
+
+#endif /* __XEN_PUBLIC_IO_RING_H__ */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/xenbus.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/xenbus.h
new file mode 100644
index 00000000..0aafdb15
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/xenbus.h
@@ -0,0 +1,64 @@
+/*****************************************************************************
+ * xenbus.h
+ *
+ * Xenbus protocol details.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (C) 2005 XenSource Ltd.
+ */
+
+#ifndef _XEN_PUBLIC_IO_XENBUS_H
+#define _XEN_PUBLIC_IO_XENBUS_H
+
+/*
+ * The state of either end of the Xenbus, i.e. the current communication
+ * status of initialisation across the bus. States here imply nothing about
+ * the state of the connection between the driver and the kernel's device
+ * layers.
+ */
+enum xenbus_state {
+ XenbusStateUnknown = 0,
+
+ XenbusStateInitialising = 1,
+
+ /*
+ * InitWait: Finished early initialisation but waiting for information
+ * from the peer or hotplug scripts.
+ */
+ XenbusStateInitWait = 2,
+
+ /*
+ * Initialised: Waiting for a connection from the peer.
+ */
+ XenbusStateInitialised = 3,
+
+ XenbusStateConnected = 4,
+
+ /*
+ * Closing: The device is being closed due to an error or an unplug event.
+ */
+ XenbusStateClosing = 5,
+
+ XenbusStateClosed = 6,
+
+ /*
+ * Reconfiguring: The device is being reconfigured.
+ */
+ XenbusStateReconfiguring = 7,
+
+ XenbusStateReconfigured = 8
+};
+typedef enum xenbus_state XenbusState;
+
+#endif /* _XEN_PUBLIC_IO_XENBUS_H */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/xs_wire.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/xs_wire.h
new file mode 100644
index 00000000..0c3148ee
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/io/xs_wire.h
@@ -0,0 +1,133 @@
+/*
+ * Details of the "wire" protocol between Xen Store Daemon and client
+ * library or guest kernel.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (C) 2005 Rusty Russell IBM Corporation
+ */
+
+#ifndef _XS_WIRE_H
+#define _XS_WIRE_H
+
+enum xsd_sockmsg_type
+{
+ XS_DEBUG,
+ XS_DIRECTORY,
+ XS_READ,
+ XS_GET_PERMS,
+ XS_WATCH,
+ XS_UNWATCH,
+ XS_TRANSACTION_START,
+ XS_TRANSACTION_END,
+ XS_INTRODUCE,
+ XS_RELEASE,
+ XS_GET_DOMAIN_PATH,
+ XS_WRITE,
+ XS_MKDIR,
+ XS_RM,
+ XS_SET_PERMS,
+ XS_WATCH_EVENT,
+ XS_ERROR,
+ XS_IS_DOMAIN_INTRODUCED,
+ XS_RESUME,
+ XS_SET_TARGET,
+ XS_RESTRICT,
+ XS_RESET_WATCHES,
+
+ XS_INVALID = 0xffff /* Guaranteed to remain an invalid type */
+};
+
+#define XS_WRITE_NONE "NONE"
+#define XS_WRITE_CREATE "CREATE"
+#define XS_WRITE_CREATE_EXCL "CREATE|EXCL"
+
+/* We hand errors as strings, for portability. */
+struct xsd_errors
+{
+ INT32 errnum;
+ const CHAR8 *errstring;
+};
+#ifdef EINVAL
+#define XSD_ERROR(x) { x, #x }
+/* LINTED: static unused */
+static struct xsd_errors xsd_errors[]
+#if defined(__GNUC__)
+__attribute__((unused))
+#endif
+ = {
+ XSD_ERROR(EINVAL),
+ XSD_ERROR(EACCES),
+ XSD_ERROR(EEXIST),
+ XSD_ERROR(EISDIR),
+ XSD_ERROR(ENOENT),
+ XSD_ERROR(ENOMEM),
+ XSD_ERROR(ENOSPC),
+ XSD_ERROR(EIO),
+ XSD_ERROR(ENOTEMPTY),
+ XSD_ERROR(ENOSYS),
+ XSD_ERROR(EROFS),
+ XSD_ERROR(EBUSY),
+ XSD_ERROR(EAGAIN),
+ XSD_ERROR(EISCONN),
+ XSD_ERROR(E2BIG)
+};
+#endif
+
+struct xsd_sockmsg
+{
+ UINT32 type; /* XS_??? */
+ UINT32 req_id;/* Request identifier, echoed in daemon's response. */
+ UINT32 tx_id; /* Transaction id (0 if not related to a transaction). */
+ UINT32 len; /* Length of data following this. */
+
+ /* Generally followed by nul-terminated string(s). */
+};
+
+enum xs_watch_type
+{
+ XS_WATCH_PATH = 0,
+ XS_WATCH_TOKEN
+};
+
+/*
+ * `incontents 150 xenstore_struct XenStore wire protocol.
+ *
+ * Inter-domain shared memory communications. */
+#define XENSTORE_RING_SIZE 1024
+typedef UINT32 XENSTORE_RING_IDX;
+#define MASK_XENSTORE_IDX(idx) ((idx) & (XENSTORE_RING_SIZE-1))
+struct xenstore_domain_interface {
+ CHAR8 req[XENSTORE_RING_SIZE]; /* Requests to xenstore daemon. */
+ CHAR8 rsp[XENSTORE_RING_SIZE]; /* Replies and async watch events. */
+ XENSTORE_RING_IDX req_cons, req_prod;
+ XENSTORE_RING_IDX rsp_cons, rsp_prod;
+ UINT32 server_features; /* Bitmap of features supported by the server */
+ UINT32 connection;
+};
+
+/* Violating this is very bad. See docs/misc/xenstore.txt. */
+#define XENSTORE_PAYLOAD_MAX 4096
+
+/* Violating these just gets you an error back */
+#define XENSTORE_ABS_PATH_MAX 3072
+#define XENSTORE_REL_PATH_MAX 2048
+
+/* The ability to reconnect a ring */
+#define XENSTORE_SERVER_FEATURE_RECONNECTION 1
+
+/* Valid values for the connection field */
+#define XENSTORE_CONNECTED 0 /* the steady-state */
+#define XENSTORE_RECONNECT 1 /* guest has initiated a reconnect */
+
+#endif /* _XS_WIRE_H */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/memory.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/memory.h
new file mode 100644
index 00000000..1df10f05
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/memory.h
@@ -0,0 +1,101 @@
+/******************************************************************************
+ * memory.h
+ *
+ * Memory reservation and information.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2005, Keir Fraser <keir@xensource.com>
+ */
+
+#ifndef __XEN_PUBLIC_MEMORY_H__
+#define __XEN_PUBLIC_MEMORY_H__
+
+#include "xen.h"
+
+/* Source mapping space. */
+/* ` enum phys_map_space { */
+#define XENMAPSPACE_shared_info 0 /* shared info page */
+#define XENMAPSPACE_grant_table 1 /* grant table page */
+#define XENMAPSPACE_gmfn 2 /* GMFN */
+#define XENMAPSPACE_gmfn_range 3 /* GMFN range, XENMEM_add_to_physmap only. */
+#define XENMAPSPACE_gmfn_foreign 4 /* GMFN from another dom,
+ * XENMEM_add_to_physmap_batch only. */
+/* ` } */
+
+/*
+ * Sets the GPFN at which a particular page appears in the specified guest's
+ * pseudophysical address space.
+ * arg == addr of xen_add_to_physmap_t.
+ */
+#define XENMEM_add_to_physmap 7
+struct xen_add_to_physmap {
+ /* Which domain to change the mapping for. */
+ domid_t domid;
+
+ /* Number of pages to go through for gmfn_range */
+ UINT16 size;
+
+ UINT32 space; /* => enum phys_map_space */
+
+#define XENMAPIDX_grant_table_status 0x80000000
+
+ /* Index into space being mapped. */
+ xen_ulong_t idx;
+
+ /* GPFN in domid where the source mapping page should appear. */
+ xen_pfn_t gpfn;
+};
+typedef struct xen_add_to_physmap xen_add_to_physmap_t;
+DEFINE_XEN_GUEST_HANDLE(xen_add_to_physmap_t);
+
+/*
+ * Unmaps the page appearing at a particular GPFN from the specified guest's
+ * pseudophysical address space.
+ * arg == addr of xen_remove_from_physmap_t.
+ */
+#define XENMEM_remove_from_physmap 15
+struct xen_remove_from_physmap {
+ /* Which domain to change the mapping for. */
+ domid_t domid;
+
+ /* GPFN of the current mapping of the page. */
+ xen_pfn_t gpfn;
+};
+typedef struct xen_remove_from_physmap xen_remove_from_physmap_t;
+DEFINE_XEN_GUEST_HANDLE(xen_remove_from_physmap_t);
+
+/*
+ * Returns the pseudo-physical memory map as it was when the domain
+ * was started (specified by XENMEM_set_memory_map).
+ * arg == addr of xen_memory_map_t.
+ */
+#define XENMEM_memory_map 9
+struct xen_memory_map {
+ /*
+ * On call the number of entries which can be stored in buffer. On
+ * return the number of entries which have been stored in
+ * buffer.
+ */
+ UINT32 nr_entries;
+
+ /*
+ * Entries in the buffer are in the same format as returned by the
+ * BIOS INT 0x15 EAX=0xE820 call.
+ */
+ XEN_GUEST_HANDLE(void) buffer;
+};
+typedef struct xen_memory_map xen_memory_map_t;
+DEFINE_XEN_GUEST_HANDLE(xen_memory_map_t);
+
+#endif /* __XEN_PUBLIC_MEMORY_H__ */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/xen-compat.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/xen-compat.h
new file mode 100644
index 00000000..706024a9
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/xen-compat.h
@@ -0,0 +1,28 @@
+/******************************************************************************
+ * xen-compat.h
+ *
+ * Guest OS interface to Xen. Compatibility layer.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2006, Christian Limpach
+ */
+
+#ifndef __XEN_PUBLIC_XEN_COMPAT_H__
+#define __XEN_PUBLIC_XEN_COMPAT_H__
+
+#define __XEN_LATEST_INTERFACE_VERSION__ 0x00040400
+
+#if defined(__XEN__) || defined(__XEN_TOOLS__)
+/* Xen is built with matching headers and implements the latest interface. */
+#define __XEN_INTERFACE_VERSION__ __XEN_LATEST_INTERFACE_VERSION__
+#elif !defined(__XEN_INTERFACE_VERSION__)
+/* Guests which do not specify a version get the legacy interface. */
+#define __XEN_INTERFACE_VERSION__ 0x00000000
+#endif
+
+#if __XEN_INTERFACE_VERSION__ > __XEN_LATEST_INTERFACE_VERSION__
+#error "These header files do not support the requested interface version."
+#endif
+
+#endif /* __XEN_PUBLIC_XEN_COMPAT_H__ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/xen.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/xen.h
new file mode 100644
index 00000000..2f158b04
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/IndustryStandard/Xen/xen.h
@@ -0,0 +1,331 @@
+/******************************************************************************
+ * xen.h
+ *
+ * Guest OS interface to Xen.
+ *
+ * SPDX-License-Identifier: MIT
+ *
+ * Copyright (c) 2004, K A Fraser
+ */
+
+#ifndef __XEN_PUBLIC_XEN_H__
+#define __XEN_PUBLIC_XEN_H__
+
+//
+// Xen interface version used by Tianocore
+//
+#define __XEN_INTERFACE_VERSION__ 0x00040400
+
+#include "xen-compat.h"
+
+#if defined(MDE_CPU_IA32) || defined(MDE_CPU_X64)
+#include "arch-x86/xen.h"
+#elif defined(__arm__) || defined (__aarch64__)
+#include "arch-arm/xen.h"
+#else
+#error "Unsupported architecture"
+#endif
+
+#ifndef __ASSEMBLY__
+/* Guest handles for primitive C types. */
+DEFINE_XEN_GUEST_HANDLE(CHAR8);
+__DEFINE_XEN_GUEST_HANDLE(uchar, UINT8);
+DEFINE_XEN_GUEST_HANDLE(INT32);
+__DEFINE_XEN_GUEST_HANDLE(uint, UINT32);
+#if __XEN_INTERFACE_VERSION__ < 0x00040300
+DEFINE_XEN_GUEST_HANDLE(INTN);
+__DEFINE_XEN_GUEST_HANDLE(ulong, UINTN);
+#endif
+DEFINE_XEN_GUEST_HANDLE(VOID);
+
+DEFINE_XEN_GUEST_HANDLE(UINT64);
+DEFINE_XEN_GUEST_HANDLE(xen_pfn_t);
+DEFINE_XEN_GUEST_HANDLE(xen_ulong_t);
+#endif
+
+/*
+ * HYPERCALLS
+ */
+
+/* `incontents 100 hcalls List of hypercalls
+ * ` enum hypercall_num { // __HYPERVISOR_* => HYPERVISOR_*()
+ */
+
+#define __HYPERVISOR_set_trap_table 0
+#define __HYPERVISOR_mmu_update 1
+#define __HYPERVISOR_set_gdt 2
+#define __HYPERVISOR_stack_switch 3
+#define __HYPERVISOR_set_callbacks 4
+#define __HYPERVISOR_fpu_taskswitch 5
+#define __HYPERVISOR_sched_op_compat 6 /* compat since 0x00030101 */
+#define __HYPERVISOR_platform_op 7
+#define __HYPERVISOR_set_debugreg 8
+#define __HYPERVISOR_get_debugreg 9
+#define __HYPERVISOR_update_descriptor 10
+#define __HYPERVISOR_memory_op 12
+#define __HYPERVISOR_multicall 13
+#define __HYPERVISOR_update_va_mapping 14
+#define __HYPERVISOR_set_timer_op 15
+#define __HYPERVISOR_event_channel_op_compat 16 /* compat since 0x00030202 */
+#define __HYPERVISOR_xen_version 17
+#define __HYPERVISOR_console_io 18
+#define __HYPERVISOR_physdev_op_compat 19 /* compat since 0x00030202 */
+#define __HYPERVISOR_grant_table_op 20
+#define __HYPERVISOR_vm_assist 21
+#define __HYPERVISOR_update_va_mapping_otherdomain 22
+#define __HYPERVISOR_iret 23 /* x86 only */
+#define __HYPERVISOR_vcpu_op 24
+#define __HYPERVISOR_set_segment_base 25 /* x86/64 only */
+#define __HYPERVISOR_mmuext_op 26
+#define __HYPERVISOR_xsm_op 27
+#define __HYPERVISOR_nmi_op 28
+#define __HYPERVISOR_sched_op 29
+#define __HYPERVISOR_callback_op 30
+#define __HYPERVISOR_xenoprof_op 31
+#define __HYPERVISOR_event_channel_op 32
+#define __HYPERVISOR_physdev_op 33
+#define __HYPERVISOR_hvm_op 34
+#define __HYPERVISOR_sysctl 35
+#define __HYPERVISOR_domctl 36
+#define __HYPERVISOR_kexec_op 37
+#define __HYPERVISOR_tmem_op 38
+#define __HYPERVISOR_xc_reserved_op 39 /* reserved for XenClient */
+
+/* Architecture-specific hypercall definitions. */
+#define __HYPERVISOR_arch_0 48
+#define __HYPERVISOR_arch_1 49
+#define __HYPERVISOR_arch_2 50
+#define __HYPERVISOR_arch_3 51
+#define __HYPERVISOR_arch_4 52
+#define __HYPERVISOR_arch_5 53
+#define __HYPERVISOR_arch_6 54
+#define __HYPERVISOR_arch_7 55
+
+/* ` } */
+
+/*
+ * HYPERCALL COMPATIBILITY.
+ */
+
+/* New sched_op hypercall introduced in 0x00030101. */
+#if __XEN_INTERFACE_VERSION__ < 0x00030101
+#undef __HYPERVISOR_sched_op
+#define __HYPERVISOR_sched_op __HYPERVISOR_sched_op_compat
+#endif
+
+/* New event-channel and physdev hypercalls introduced in 0x00030202. */
+#if __XEN_INTERFACE_VERSION__ < 0x00030202
+#undef __HYPERVISOR_event_channel_op
+#define __HYPERVISOR_event_channel_op __HYPERVISOR_event_channel_op_compat
+#undef __HYPERVISOR_physdev_op
+#define __HYPERVISOR_physdev_op __HYPERVISOR_physdev_op_compat
+#endif
+
+/* New platform_op hypercall introduced in 0x00030204. */
+#if __XEN_INTERFACE_VERSION__ < 0x00030204
+#define __HYPERVISOR_dom0_op __HYPERVISOR_platform_op
+#endif
+
+#ifndef __ASSEMBLY__
+
+typedef UINT16 domid_t;
+
+/* Domain ids >= DOMID_FIRST_RESERVED cannot be used for ordinary domains. */
+#define DOMID_FIRST_RESERVED (0x7FF0U)
+
+/* DOMID_SELF is used in certain contexts to refer to oneself. */
+#define DOMID_SELF (0x7FF0U)
+
+/*
+ * DOMID_IO is used to restrict page-table updates to mapping I/O memory.
+ * Although no Foreign Domain need be specified to map I/O pages, DOMID_IO
+ * is useful to ensure that no mappings to the OS's own heap are accidentally
+ * installed. (e.g., in Linux this could cause havoc as reference counts
+ * aren't adjusted on the I/O-mapping code path).
+ * This only makes sense in MMUEXT_SET_FOREIGNDOM, but in that context can
+ * be specified by any calling domain.
+ */
+#define DOMID_IO (0x7FF1U)
+
+/*
+ * DOMID_XEN is used to allow privileged domains to map restricted parts of
+ * Xen's heap space (e.g., the machine_to_phys table).
+ * This only makes sense in MMUEXT_SET_FOREIGNDOM, and is only permitted if
+ * the caller is privileged.
+ */
+#define DOMID_XEN (0x7FF2U)
+
+/*
+ * DOMID_COW is used as the owner of sharable pages */
+#define DOMID_COW (0x7FF3U)
+
+/* DOMID_INVALID is used to identify pages with unknown owner. */
+#define DOMID_INVALID (0x7FF4U)
+
+/* Idle domain. */
+#define DOMID_IDLE (0x7FFFU)
+
+#if __XEN_INTERFACE_VERSION__ < 0x00040400
+/*
+ * Event channel endpoints per domain (when using the 2-level ABI):
+ * 1024 if a INTN is 32 bits; 4096 if a INTN is 64 bits.
+ */
+#define NR_EVENT_CHANNELS EVTCHN_2L_NR_CHANNELS
+#endif
+
+struct vcpu_time_info {
+ /*
+ * Updates to the following values are preceded and followed by an
+ * increment of 'version'. The guest can therefore detect updates by
+ * looking for changes to 'version'. If the least-significant bit of
+ * the version number is set then an update is in progress and the guest
+ * must wait to read a consistent set of values.
+ * The correct way to interact with the version number is similar to
+ * Linux's seqlock: see the implementations of read_seqbegin/read_seqretry.
+ */
+ UINT32 Version;
+ UINT32 pad0;
+ UINT64 TscTimestamp; /* TSC at last update of time vals. */
+ UINT64 SystemTime; /* Time, in nanosecs, since boot. */
+ /*
+ * Current system time:
+ * system_time +
+ * ((((tsc - tsc_timestamp) << tsc_shift) * tsc_to_system_mul) >> 32)
+ * CPU frequency (Hz):
+ * ((10^9 << 32) / tsc_to_system_mul) >> tsc_shift
+ */
+ UINT32 TscToSystemMultiplier;
+ INT8 TscShift;
+ INT8 pad1[3];
+}; /* 32 bytes */
+typedef struct vcpu_time_info XEN_VCPU_TIME_INFO;
+
+struct vcpu_info {
+ /*
+ * 'evtchn_upcall_pending' is written non-zero by Xen to indicate
+ * a pending notification for a particular VCPU. It is then cleared
+ * by the guest OS /before/ checking for pending work, thus avoiding
+ * a set-and-check race. Note that the mask is only accessed by Xen
+ * on the CPU that is currently hosting the VCPU. This means that the
+ * pending and mask flags can be updated by the guest without special
+ * synchronisation (i.e., no need for the x86 LOCK prefix).
+ * This may seem suboptimal because if the pending flag is set by
+ * a different CPU then an IPI may be scheduled even when the mask
+ * is set. However, note:
+ * 1. The task of 'interrupt holdoff' is covered by the per-event-
+ * channel mask bits. A 'noisy' event that is continually being
+ * triggered can be masked at source at this very precise
+ * granularity.
+ * 2. The main purpose of the per-VCPU mask is therefore to restrict
+ * reentrant execution: whether for concurrency control, or to
+ * prevent unbounded stack usage. Whatever the purpose, we expect
+ * that the mask will be asserted only for short periods at a time,
+ * and so the likelihood of a 'spurious' IPI is suitably small.
+ * The mask is read before making an event upcall to the guest: a
+ * non-zero mask therefore guarantees that the VCPU will not receive
+ * an upcall activation. The mask is cleared when the VCPU requests
+ * to block: this avoids wakeup-waiting races.
+ */
+ UINT8 evtchn_upcall_pending;
+#ifdef XEN_HAVE_PV_UPCALL_MASK
+ UINT8 evtchn_upcall_mask;
+#else /* XEN_HAVE_PV_UPCALL_MASK */
+ UINT8 pad0;
+#endif /* XEN_HAVE_PV_UPCALL_MASK */
+ xen_ulong_t evtchn_pending_sel;
+ struct arch_vcpu_info arch;
+ struct vcpu_time_info Time;
+}; /* 64 bytes (x86) */
+#ifndef __XEN__
+typedef struct vcpu_info vcpu_info_t;
+#endif
+
+/*
+ * `incontents 200 startofday_shared Start-of-day shared data structure
+ * Xen/kernel shared data -- pointer provided in start_info.
+ *
+ * This structure is defined to be both smaller than a page, and the
+ * only data on the shared page, but may vary in actual size even within
+ * compatible Xen versions; guests should not rely on the size
+ * of this structure remaining constant.
+ */
+struct shared_info {
+ struct vcpu_info VcpuInfo[XEN_LEGACY_MAX_VCPUS];
+
+ /*
+ * A domain can create "event channels" on which it can send and receive
+ * asynchronous event notifications. There are three classes of event that
+ * are delivered by this mechanism:
+ * 1. Bi-directional inter- and intra-domain connections. Domains must
+ * arrange out-of-band to set up a connection (usually by allocating
+ * an unbound 'listener' port and avertising that via a storage service
+ * such as xenstore).
+ * 2. Physical interrupts. A domain with suitable hardware-access
+ * privileges can bind an event-channel port to a physical interrupt
+ * source.
+ * 3. Virtual interrupts ('events'). A domain can bind an event-channel
+ * port to a virtual interrupt source, such as the virtual-timer
+ * device or the emergency console.
+ *
+ * Event channels are addressed by a "port index". Each channel is
+ * associated with two bits of information:
+ * 1. PENDING -- notifies the domain that there is a pending notification
+ * to be processed. This bit is cleared by the guest.
+ * 2. MASK -- if this bit is clear then a 0->1 transition of PENDING
+ * will cause an asynchronous upcall to be scheduled. This bit is only
+ * updated by the guest. It is read-only within Xen. If a channel
+ * becomes pending while the channel is masked then the 'edge' is lost
+ * (i.e., when the channel is unmasked, the guest must manually handle
+ * pending notifications as no upcall will be scheduled by Xen).
+ *
+ * To expedite scanning of pending notifications, any 0->1 pending
+ * transition on an unmasked channel causes a corresponding bit in a
+ * per-vcpu selector word to be set. Each bit in the selector covers a
+ * 'C INTN' in the PENDING bitfield array.
+ */
+ xen_ulong_t evtchn_pending[sizeof(xen_ulong_t) * 8];
+ xen_ulong_t evtchn_mask[sizeof(xen_ulong_t) * 8];
+
+ /*
+ * Wallclock time: updated only by control software. Guests should base
+ * their gettimeofday() syscall on this wallclock-base value.
+ */
+ UINT32 wc_version; /* Version counter: see vcpu_time_info_t. */
+ UINT32 wc_sec; /* Secs 00:00:00 UTC, Jan 1, 1970. */
+ UINT32 wc_nsec; /* Nsecs 00:00:00 UTC, Jan 1, 1970. */
+
+ struct arch_shared_info arch;
+
+};
+#ifndef __XEN__
+typedef struct shared_info shared_info_t;
+typedef struct shared_info XEN_SHARED_INFO;
+#endif
+
+/* Turn a plain number into a C UINTN constant. */
+#define __mk_unsigned_long(x) x ## UL
+#define mk_unsigned_long(x) __mk_unsigned_long(x)
+
+__DEFINE_XEN_GUEST_HANDLE(uint8, UINT8);
+__DEFINE_XEN_GUEST_HANDLE(uint16, UINT16);
+__DEFINE_XEN_GUEST_HANDLE(uint32, UINT32);
+__DEFINE_XEN_GUEST_HANDLE(uint64, UINT64);
+
+#else /* __ASSEMBLY__ */
+
+/* In assembly code we cannot use C numeric constant suffixes. */
+#define mk_unsigned_long(x) x
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __XEN_PUBLIC_XEN_H__ */
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/BhyveFwCtlLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/BhyveFwCtlLib.h
new file mode 100644
index 00000000..9a22cf65
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/BhyveFwCtlLib.h
@@ -0,0 +1,47 @@
+/** @file
+ bhyve firmware configuration access
+
+ Copyright (c) 2020, Rebecca Cran <rebecca@bsdio.com>
+ Copyright (c) 2015 Nahanni Systems
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _BHYVE_FW_CTL_LIB_
+#define _BHYVE_FW_CTL_LIB_
+
+/**
+ Sysctl-like interface to read host information via a dot-separated
+ ASCII OID.
+
+ The information is copied into the buffer specified by Item. The
+ size of the buffer is given by the location specified by Size
+ before the call, and that location gives the amount of data copied
+ after a successfull call, and after a call that returns a truncated
+ value with an error return of RETURN_BUFFER_TOO_SMALL.
+
+ The size of the available data can be determined by passing a NULL
+ argument for Item. The size will be returned in the location pointed
+ to by Size.
+
+ @param[] Name - ASCII OID name
+ @param[] Data - return buffer pointer
+ @param[] Size - pointer to length
+
+ @return RETURN_SUCCESS Valid data/len returned.
+ RETURN_UNSUPPORTED f/w interface not present.
+ RETURN_NOT_FOUND OID not found.
+ RETURN_BUFFER_TOO_SMALL Return message truncated.
+ RETURN_INVALID_PARAMETER Buffer too large.
+ RETURN_PROTOCOL_ERROR Unknown error from host.
+ **/
+RETURN_STATUS
+EFIAPI
+BhyveFwCtlGet (
+ IN CONST CHAR8 *Name,
+ OUT VOID *Item,
+ IN OUT UINTN *Size
+ );
+
+#endif /* _BHYVE_FW_CTL_LIB_ */
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/LoadLinuxLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/LoadLinuxLib.h
new file mode 100644
index 00000000..d2c7f2d6
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/LoadLinuxLib.h
@@ -0,0 +1,205 @@
+/** @file
+ Load/boot UEFI Linux.
+
+ Copyright (c) 2011 - 2013, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __LOAD_LINUX_LIB__
+#define __LOAD_LINUX_LIB__
+
+
+/**
+ Verifies that the kernel setup image is valid and supported.
+ The kernel setup image should be checked before using other library
+ routines which take the kernel setup as an input.
+
+ @param[in] KernelSetup - The kernel setup image
+ @param[in] KernelSetupSize - The kernel setup size
+
+ @retval EFI_SUCCESS - The Linux kernel setup is valid and supported
+ @retval EFI_INVALID_PARAMETER - KernelSetup was NULL
+ @retval EFI_UNSUPPORTED - The Linux kernel is not supported
+
+**/
+EFI_STATUS
+EFIAPI
+LoadLinuxCheckKernelSetup (
+ IN VOID *KernelSetup,
+ IN UINTN KernelSetupSize
+ );
+
+
+/**
+ Gets the initial runtime size of the Linux kernel image by examining
+ the kernel setup image.
+
+ @param[in] KernelSetup - The kernel setup image
+ @param[in] KernelSize - The kernel size on disk.
+
+ @retval 0 An error occurred
+ @retval !0 The initial size required by the kernel to
+ begin execution.
+
+**/
+UINTN
+EFIAPI
+LoadLinuxGetKernelSize (
+ IN VOID *KernelSetup,
+ IN UINTN KernelSize
+ );
+
+
+/**
+ Loads and boots UEFI Linux.
+
+ Note: If successful, then this routine will not return
+
+ @param[in] Kernel - The main kernel image
+ @param[in,out] KernelSetup - The kernel setup image
+
+ @retval EFI_NOT_FOUND - The Linux kernel was not found
+ @retval EFI_INVALID_PARAMETER - Kernel or KernelSetup was NULL
+ @retval EFI_UNSUPPORTED - The Linux kernel version is not supported
+
+**/
+EFI_STATUS
+EFIAPI
+LoadLinux (
+ IN VOID *Kernel,
+ IN OUT VOID *KernelSetup
+ );
+
+
+/**
+ Allocates pages for the kernel setup image.
+
+ @param[in] Pages - The number of pages
+
+ @retval NULL - Unable to allocate pages
+ @retval !NULL - The address of the pages allocated
+
+**/
+VOID*
+EFIAPI
+LoadLinuxAllocateKernelSetupPages (
+ IN UINTN Pages
+ );
+
+
+/**
+ Clears the uninitialised space before and after the struct setup_header
+ in the kernel setup image. The kernel requires that these be zeroed
+ unless explicitly initialised, so this function should be called after
+ the setup_header has been copied in from a bzImage, before setting up
+ anything else.
+
+ @param[in] KernelSetup - The kernel setup image
+
+ @retval EFI_SUCCESS - The Linux kernel setup was successfully initialized
+ @retval EFI_INVALID_PARAMETER - KernelSetup was NULL
+ @retval EFI_UNSUPPORTED - The Linux kernel is not supported
+
+**/
+EFI_STATUS
+EFIAPI
+LoadLinuxInitializeKernelSetup (
+ IN VOID *KernelSetup
+ );
+
+/**
+ Allocates pages for the kernel.
+
+ @param[in] KernelSetup - The kernel setup image
+ @param[in] Pages - The number of pages. (It is recommended to use the
+ size returned from LoadLinuxGetKernelSize.)
+
+ @retval NULL - Unable to allocate pages
+ @retval !NULL - The address of the pages allocated
+
+**/
+VOID*
+EFIAPI
+LoadLinuxAllocateKernelPages (
+ IN VOID *KernelSetup,
+ IN UINTN Pages
+ );
+
+
+/**
+ Allocates pages for the kernel command line.
+
+ @param[in] Pages - The number of pages.
+
+ @retval NULL - Unable to allocate pages
+ @retval !NULL - The address of the pages allocated
+
+**/
+VOID*
+EFIAPI
+LoadLinuxAllocateCommandLinePages (
+ IN UINTN Pages
+ );
+
+
+/**
+ Allocates pages for the initrd image.
+
+ @param[in,out] KernelSetup - The kernel setup image
+ @param[in] Pages - The number of pages.
+
+ @retval NULL - Unable to allocate pages
+ @retval !NULL - The address of the pages allocated
+
+**/
+VOID*
+EFIAPI
+LoadLinuxAllocateInitrdPages (
+ IN VOID *KernelSetup,
+ IN UINTN Pages
+ );
+
+
+/**
+ Sets the kernel command line parameter within the setup image.
+
+ @param[in,out] KernelSetup - The kernel setup image
+ @param[in] CommandLine - The kernel command line
+
+ @retval EFI_SUCCESS - The Linux kernel setup is valid and supported
+ @retval EFI_INVALID_PARAMETER - KernelSetup was NULL
+ @retval EFI_UNSUPPORTED - The Linux kernel is not supported
+
+**/
+EFI_STATUS
+EFIAPI
+LoadLinuxSetCommandLine (
+ IN OUT VOID *KernelSetup,
+ IN CHAR8 *CommandLine
+ );
+
+
+/**
+ Sets the kernel initial ram disk pointer within the setup image.
+
+ @param[in,out] KernelSetup - The kernel setup image
+ @param[in] Initrd - Pointer to the initial ram disk
+ @param[in] InitrdSize - The initial ram disk image size
+
+ @retval EFI_SUCCESS - The Linux kernel setup is valid and supported
+ @retval EFI_INVALID_PARAMETER - KernelSetup was NULL
+ @retval EFI_UNSUPPORTED - The Linux kernel is not supported
+
+**/
+EFI_STATUS
+EFIAPI
+LoadLinuxSetInitrd (
+ IN OUT VOID *KernelSetup,
+ IN VOID *Initrd,
+ IN UINTN InitrdSize
+ );
+
+
+#endif
+
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/MemEncryptSevLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/MemEncryptSevLib.h
new file mode 100644
index 00000000..ca1981e4
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/MemEncryptSevLib.h
@@ -0,0 +1,206 @@
+/** @file
+
+ Define Secure Encrypted Virtualization (SEV) base library helper function
+
+ Copyright (c) 2017 - 2020, AMD Incorporated. All rights reserved.<BR>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _MEM_ENCRYPT_SEV_LIB_H_
+#define _MEM_ENCRYPT_SEV_LIB_H_
+
+#include <Base.h>
+
+//
+// Define the maximum number of #VCs allowed (e.g. the level of nesting
+// that is allowed => 2 allows for 1 nested #VCs). I this value is changed,
+// be sure to increase the size of
+// gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupSize
+// in any FDF file using this PCD.
+//
+#define VMGEXIT_MAXIMUM_VC_COUNT 2
+
+//
+// Per-CPU data mapping structure
+// Use UINT32 for cached indicators and compare to a specific value
+// so that the hypervisor can't indicate a value is cached by just
+// writing random data to that area.
+//
+typedef struct {
+ UINT32 Dr7Cached;
+ UINT64 Dr7;
+
+ UINTN VcCount;
+ VOID *GhcbBackupPages;
+} SEV_ES_PER_CPU_DATA;
+
+//
+// Internal structure for holding SEV-ES information needed during SEC phase
+// and valid only during SEC phase and early PEI during platform
+// initialization.
+//
+// This structure is also used by assembler files:
+// OvmfPkg/ResetVector/ResetVector.nasmb
+// OvmfPkg/ResetVector/Ia32/PageTables64.asm
+// OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm
+// any changes must stay in sync with its usage.
+//
+typedef struct _SEC_SEV_ES_WORK_AREA {
+ UINT8 SevEsEnabled;
+ UINT8 Reserved1[7];
+
+ UINT64 RandomData;
+
+ UINT64 EncryptionMask;
+} SEC_SEV_ES_WORK_AREA;
+
+//
+// Memory encryption address range states.
+//
+typedef enum {
+ MemEncryptSevAddressRangeUnencrypted,
+ MemEncryptSevAddressRangeEncrypted,
+ MemEncryptSevAddressRangeMixed,
+ MemEncryptSevAddressRangeError,
+} MEM_ENCRYPT_SEV_ADDRESS_RANGE_STATE;
+
+/**
+ Returns a boolean to indicate whether SEV-ES is enabled.
+
+ @retval TRUE SEV-ES is enabled
+ @retval FALSE SEV-ES is not enabled
+**/
+BOOLEAN
+EFIAPI
+MemEncryptSevEsIsEnabled (
+ VOID
+ );
+
+/**
+ Returns a boolean to indicate whether SEV is enabled
+
+ @retval TRUE SEV is enabled
+ @retval FALSE SEV is not enabled
+**/
+BOOLEAN
+EFIAPI
+MemEncryptSevIsEnabled (
+ VOID
+ );
+
+/**
+ This function clears memory encryption bit for the memory region specified by
+ BaseAddress and NumPages from the current page table context.
+
+ @param[in] Cr3BaseAddress Cr3 Base Address (if zero then use
+ current CR3)
+ @param[in] BaseAddress The physical address that is the start
+ address of a memory region.
+ @param[in] NumPages The number of pages from start memory
+ region.
+ @param[in] Flush Flush the caches before clearing the bit
+ (mostly TRUE except MMIO addresses)
+
+ @retval RETURN_SUCCESS The attributes were cleared for the
+ memory region.
+ @retval RETURN_INVALID_PARAMETER Number of pages is zero.
+ @retval RETURN_UNSUPPORTED Clearing the memory encryption attribute
+ is not supported
+**/
+RETURN_STATUS
+EFIAPI
+MemEncryptSevClearPageEncMask (
+ IN PHYSICAL_ADDRESS Cr3BaseAddress,
+ IN PHYSICAL_ADDRESS BaseAddress,
+ IN UINTN NumPages,
+ IN BOOLEAN Flush
+ );
+
+/**
+ This function sets memory encryption bit for the memory region specified by
+ BaseAddress and NumPages from the current page table context.
+
+ @param[in] Cr3BaseAddress Cr3 Base Address (if zero then use
+ current CR3)
+ @param[in] BaseAddress The physical address that is the start
+ address of a memory region.
+ @param[in] NumPages The number of pages from start memory
+ region.
+ @param[in] Flush Flush the caches before setting the bit
+ (mostly TRUE except MMIO addresses)
+
+ @retval RETURN_SUCCESS The attributes were set for the memory
+ region.
+ @retval RETURN_INVALID_PARAMETER Number of pages is zero.
+ @retval RETURN_UNSUPPORTED Setting the memory encryption attribute
+ is not supported
+**/
+RETURN_STATUS
+EFIAPI
+MemEncryptSevSetPageEncMask (
+ IN PHYSICAL_ADDRESS Cr3BaseAddress,
+ IN PHYSICAL_ADDRESS BaseAddress,
+ IN UINTN NumPages,
+ IN BOOLEAN Flush
+ );
+
+
+/**
+ Locate the page range that covers the initial (pre-SMBASE-relocation) SMRAM
+ Save State Map.
+
+ @param[out] BaseAddress The base address of the lowest-address page that
+ covers the initial SMRAM Save State Map.
+
+ @param[out] NumberOfPages The number of pages in the page range that covers
+ the initial SMRAM Save State Map.
+
+ @retval RETURN_SUCCESS BaseAddress and NumberOfPages have been set on
+ output.
+
+ @retval RETURN_UNSUPPORTED SMM is unavailable.
+**/
+RETURN_STATUS
+EFIAPI
+MemEncryptSevLocateInitialSmramSaveStateMapPages (
+ OUT UINTN *BaseAddress,
+ OUT UINTN *NumberOfPages
+ );
+
+/**
+ Returns the SEV encryption mask.
+
+ @return The SEV pagetable encryption mask
+**/
+UINT64
+EFIAPI
+MemEncryptSevGetEncryptionMask (
+ VOID
+ );
+
+/**
+ Returns the encryption state of the specified virtual address range.
+
+ @param[in] Cr3BaseAddress Cr3 Base Address (if zero then use
+ current CR3)
+ @param[in] BaseAddress Base address to check
+ @param[in] Length Length of virtual address range
+
+ @retval MemEncryptSevAddressRangeUnencrypted Address range is mapped
+ unencrypted
+ @retval MemEncryptSevAddressRangeEncrypted Address range is mapped
+ encrypted
+ @retval MemEncryptSevAddressRangeMixed Address range is mapped mixed
+ @retval MemEncryptSevAddressRangeError Address range is not mapped
+**/
+MEM_ENCRYPT_SEV_ADDRESS_RANGE_STATE
+EFIAPI
+MemEncryptSevGetAddressRangeState (
+ IN PHYSICAL_ADDRESS Cr3BaseAddress,
+ IN PHYSICAL_ADDRESS BaseAddress,
+ IN UINTN Length
+ );
+
+#endif // _MEM_ENCRYPT_SEV_LIB_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/NvVarsFileLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/NvVarsFileLib.h
new file mode 100644
index 00000000..1250f18d
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/NvVarsFileLib.h
@@ -0,0 +1,45 @@
+/** @file
+ Provides functions to save and restore NV variables in a file.
+
+ Copyright (c) 2009, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __NV_VARS_FILE_LIB__
+#define __NV_VARS_FILE_LIB__
+
+/**
+ Attempts to connect the NvVarsFileLib to the specified file system.
+
+ @param[in] FsHandle - Handle for a gEfiSimpleFileSystemProtocolGuid instance
+
+ @return The EFI_STATUS while attempting to connect the NvVarsFileLib
+ to the file system instance.
+ @retval EFI_SUCCESS - The given file system was connected successfully
+
+**/
+EFI_STATUS
+EFIAPI
+ConnectNvVarsToFileSystem (
+ IN EFI_HANDLE FsHandle
+ );
+
+
+/**
+ Update non-volatile variables stored on the file system.
+
+ @return The EFI_STATUS while attempting to update the variable on
+ the connected file system.
+ @retval EFI_SUCCESS - The non-volatile variables were saved to the disk
+ @retval EFI_NOT_STARTED - A file system has not been connected
+
+**/
+EFI_STATUS
+EFIAPI
+UpdateNvVarsOnFileSystem (
+ );
+
+
+#endif
+
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciCapLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciCapLib.h
new file mode 100644
index 00000000..799e41fd
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciCapLib.h
@@ -0,0 +1,423 @@
+/** @file
+ Library class to work with PCI capabilities in PCI config space.
+
+ Provides functions to parse capabilities lists, and to locate, describe, read
+ and write capabilities. PCI config space access is abstracted away.
+
+ Copyright (C) 2018, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __PCI_CAP_LIB_H__
+#define __PCI_CAP_LIB_H__
+
+#include <Uefi/UefiBaseType.h>
+
+//
+// Base structure for representing a PCI device -- down to the PCI function
+// level -- for the purposes of this library class. This is a forward
+// declaration that is completed below. Concrete implementations are supposed
+// to inherit and extend this type.
+//
+typedef struct PCI_CAP_DEV PCI_CAP_DEV;
+
+/**
+ Read the config space of a given PCI device (both normal and extended).
+
+ PCI_CAP_DEV_READ_CONFIG performs as few config space accesses as possible
+ (without attempting 64-bit wide accesses).
+
+ PCI_CAP_DEV_READ_CONFIG returns an unspecified error if accessing Size bytes
+ from SourceOffset exceeds the config space limit of the PCI device. Fewer
+ than Size bytes may have been read in this case.
+
+ @param[in] PciDevice Implementation-specific unique representation
+ of the PCI device in the PCI hierarchy.
+
+ @param[in] SourceOffset Source offset in the config space of the PCI
+ device to start reading from.
+
+ @param[out] DestinationBuffer Buffer to store the read data to.
+
+ @param[in] Size The number of bytes to transfer.
+
+ @retval RETURN_SUCCESS Size bytes have been transferred from config space to
+ DestinationBuffer.
+
+ @return Unspecified error codes. Fewer than Size bytes may
+ have been read.
+**/
+typedef
+RETURN_STATUS
+(EFIAPI *PCI_CAP_DEV_READ_CONFIG) (
+ IN PCI_CAP_DEV *PciDevice,
+ IN UINT16 SourceOffset,
+ OUT VOID *DestinationBuffer,
+ IN UINT16 Size
+ );
+
+/**
+ Write the config space of a given PCI device (both normal and extended).
+
+ PCI_CAP_DEV_WRITE_CONFIG performs as few config space accesses as possible
+ (without attempting 64-bit wide accesses).
+
+ PCI_CAP_DEV_WRITE_CONFIG returns an unspecified error if accessing Size bytes
+ at DestinationOffset exceeds the config space limit of the PCI device. Fewer
+ than Size bytes may have been written in this case.
+
+ @param[in] PciDevice Implementation-specific unique representation
+ of the PCI device in the PCI hierarchy.
+
+ @param[in] DestinationOffset Destination offset in the config space of the
+ PCI device to start writing at.
+
+ @param[in] SourceBuffer Buffer to read the data to be stored from.
+
+ @param[in] Size The number of bytes to transfer.
+
+ @retval RETURN_SUCCESS Size bytes have been transferred from SourceBuffer to
+ config space.
+
+ @return Unspecified error codes. Fewer than Size bytes may
+ have been written.
+**/
+typedef
+RETURN_STATUS
+(EFIAPI *PCI_CAP_DEV_WRITE_CONFIG) (
+ IN PCI_CAP_DEV *PciDevice,
+ IN UINT16 DestinationOffset,
+ IN VOID *SourceBuffer,
+ IN UINT16 Size
+ );
+
+//
+// Complete the PCI_CAP_DEV type here. The base abstraction only requires
+// config space accessors.
+//
+struct PCI_CAP_DEV {
+ PCI_CAP_DEV_READ_CONFIG ReadConfig;
+ PCI_CAP_DEV_WRITE_CONFIG WriteConfig;
+};
+
+//
+// Opaque data structure representing parsed PCI Capabilities Lists.
+//
+typedef struct PCI_CAP_LIST PCI_CAP_LIST;
+
+//
+// Opaque data structure representing a PCI Capability in a parsed Capability
+// List.
+//
+typedef struct PCI_CAP PCI_CAP;
+
+//
+// Distinguishes whether a Capability ID is 8-bit wide and interpreted in
+// normal config space, or 16-bit wide and interpreted in extended config
+// space. Capability ID definitions are relative to domain.
+//
+typedef enum {
+ PciCapNormal,
+ PciCapExtended
+} PCI_CAP_DOMAIN;
+
+//
+// Public data structure that PciCapGetInfo() fills in about a PCI_CAP object.
+//
+typedef struct {
+ PCI_CAP_DOMAIN Domain;
+ UINT16 CapId;
+ //
+ // The capability identified by Domain and CapId may have multiple instances
+ // in config space. NumInstances provides the total count of occurrences of
+ // the capability. It is always positive.
+ //
+ UINT16 NumInstances;
+ //
+ // Instance is the serial number, in capabilities list traversal order (not
+ // necessarily config space offset order), of the one capability instance
+ // that PciCapGetInfo() is reporting about. Instance is always smaller than
+ // NumInstances.
+ //
+ UINT16 Instance;
+ //
+ // The offset in config space at which the capability header of the
+ // capability instance starts.
+ //
+ UINT16 Offset;
+ //
+ // The deduced maximum size of the capability instance, including the
+ // capability header. This hint is an upper bound, calculated -- without
+ // regard to the internal structure of the capability -- from (a) the next
+ // lowest offset in configuration space that is known to be used by another
+ // capability, and (b) from the end of the config space identified by Domain,
+ // whichever is lower.
+ //
+ UINT16 MaxSizeHint;
+ //
+ // The version number of the capability instance. Always zero when Domain is
+ // PciCapNormal.
+ //
+ UINT8 Version;
+} PCI_CAP_INFO;
+
+
+/**
+ Parse the capabilities lists (both normal and extended, as applicable) of a
+ PCI device.
+
+ If the PCI device has no capabilities, that per se will not fail
+ PciCapListInit(); an empty capabilities list will be represented.
+
+ If the PCI device is found to be PCI Express, then an attempt will be made to
+ parse the extended capabilities list as well. If the first extended config
+ space access -- via PciDevice->ReadConfig() with SourceOffset=0x100 and
+ Size=4 -- fails, that per se will not fail PciCapListInit(); the device will
+ be assumed to have no extended capabilities.
+
+ @param[in] PciDevice Implementation-specific unique representation of the
+ PCI device in the PCI hierarchy.
+
+ @param[out] CapList Opaque data structure that holds an in-memory
+ representation of the parsed capabilities lists of
+ PciDevice.
+
+ @retval RETURN_SUCCESS The capabilities lists have been parsed from
+ config space.
+
+ @retval RETURN_OUT_OF_RESOURCES Memory allocation failed.
+
+ @retval RETURN_DEVICE_ERROR A loop or some other kind of invalid pointer
+ was detected in the capabilities lists of
+ PciDevice.
+
+ @return Error codes propagated from
+ PciDevice->ReadConfig().
+**/
+RETURN_STATUS
+EFIAPI
+PciCapListInit (
+ IN PCI_CAP_DEV *PciDevice,
+ OUT PCI_CAP_LIST **CapList
+ );
+
+
+/**
+ Free the resources used by CapList.
+
+ @param[in] CapList The PCI_CAP_LIST object to free, originally produced by
+ PciCapListInit().
+**/
+VOID
+EFIAPI
+PciCapListUninit (
+ IN PCI_CAP_LIST *CapList
+ );
+
+
+/**
+ Locate a capability instance in the parsed capabilities lists.
+
+ @param[in] CapList The PCI_CAP_LIST object produced by PciCapListInit().
+
+ @param[in] Domain Distinguishes whether CapId is 8-bit wide and
+ interpreted in normal config space, or 16-bit wide and
+ interpreted in extended config space. Capability ID
+ definitions are relative to domain.
+
+ @param[in] CapId Capability identifier to look up.
+
+ @param[in] Instance Domain and CapId may identify a multi-instance
+ capability. When Instance is zero, the first instance of
+ the capability is located (in list traversal order --
+ which may not mean increasing config space offset
+ order). Higher Instance values locate subsequent
+ instances of the same capability (in list traversal
+ order).
+
+ @param[out] Cap The capability instance that matches the search
+ criteria. Cap is owned by CapList and becomes invalid
+ when CapList is freed with PciCapListUninit().
+ PciCapListFindCap() may be called with Cap set to NULL,
+ in order to test the existence of a specific capability
+ instance.
+
+ @retval RETURN_SUCCESS The capability instance identified by (Domain,
+ CapId, Instance) has been found.
+
+ @retval RETURN_NOT_FOUND The requested (Domain, CapId, Instance) capability
+ instance does not exist.
+**/
+RETURN_STATUS
+EFIAPI
+PciCapListFindCap (
+ IN PCI_CAP_LIST *CapList,
+ IN PCI_CAP_DOMAIN Domain,
+ IN UINT16 CapId,
+ IN UINT16 Instance,
+ OUT PCI_CAP **Cap OPTIONAL
+ );
+
+
+/**
+ Locate the first instance of the capability given by (Domain, CapId) such
+ that the instance's Version is greater than or equal to MinVersion.
+
+ This is a convenience function that may save client code calls to
+ PciCapListFindCap() and PciCapGetInfo().
+
+ @param[in] CapList The PCI_CAP_LIST object produced by PciCapListInit().
+
+ @param[in] Domain Distinguishes whether CapId is 8-bit wide and
+ interpreted in normal config space, or 16-bit wide and
+ interpreted in extended config space. Capability ID
+ definitions are relative to domain.
+
+ @param[in] CapId Capability identifier to look up.
+
+ @param[in] MinVersion The minimum version that the capability instance is
+ required to have. Note that all capability instances
+ in Domain=PciCapNormal have Version=0.
+
+ @param[out] Cap The first capability instance that matches the search
+ criteria. Cap is owned by CapList and becomes invalid
+ when CapList is freed with PciCapListUninit().
+ PciCapListFindCapVersion() may be called with Cap set
+ to NULL, in order just to test whether the search
+ criteria are satisfiable.
+
+ @retval RETURN_SUCCESS The first capability instance matching (Domain,
+ CapId, MinVersion) has been located.
+
+ @retval RETURN_NOT_FOUND No capability instance matches (Domain, CapId,
+ MinVersion).
+**/
+RETURN_STATUS
+EFIAPI
+PciCapListFindCapVersion (
+ IN PCI_CAP_LIST *CapList,
+ IN PCI_CAP_DOMAIN Domain,
+ IN UINT16 CapId,
+ IN UINT8 MinVersion,
+ OUT PCI_CAP **Cap OPTIONAL
+ );
+
+
+/**
+ Get information about a PCI Capability instance.
+
+ @param[in] Cap The capability instance to get info about, located with
+ PciCapListFindCap*().
+
+ @param[out] Info A PCI_CAP_INFO structure that describes the properties of
+ Cap.
+
+ @retval RETURN_SUCCESS Fields of Info have been set.
+
+ @return Unspecified error codes, if filling in Info failed
+ for some reason.
+**/
+RETURN_STATUS
+EFIAPI
+PciCapGetInfo (
+ IN PCI_CAP *Cap,
+ OUT PCI_CAP_INFO *Info
+ );
+
+
+/**
+ Read a slice of a capability instance.
+
+ The function performs as few config space accesses as possible (without
+ attempting 64-bit wide accesses). PciCapRead() performs bounds checking on
+ SourceOffsetInCap and Size, and only invokes PciDevice->ReadConfig() if the
+ requested transfer falls within Cap.
+
+ @param[in] PciDevice Implementation-specific unique representation
+ of the PCI device in the PCI hierarchy.
+
+ @param[in] Cap The capability instance to read, located with
+ PciCapListFindCap*().
+
+ @param[in] SourceOffsetInCap Source offset relative to the capability
+ header to start reading from. A zero value
+ refers to the first byte of the capability
+ header.
+
+ @param[out] DestinationBuffer Buffer to store the read data to.
+
+ @param[in] Size The number of bytes to transfer.
+
+ @retval RETURN_SUCCESS Size bytes have been transferred from Cap to
+ DestinationBuffer.
+
+ @retval RETURN_BAD_BUFFER_SIZE Reading Size bytes starting from
+ SourceOffsetInCap would not (entirely) be
+ contained within Cap, as suggested by
+ PCI_CAP_INFO.MaxSizeHint. No bytes have been
+ read.
+
+ @return Error codes propagated from
+ PciDevice->ReadConfig(). Fewer than Size
+ bytes may have been read.
+**/
+RETURN_STATUS
+EFIAPI
+PciCapRead (
+ IN PCI_CAP_DEV *PciDevice,
+ IN PCI_CAP *Cap,
+ IN UINT16 SourceOffsetInCap,
+ OUT VOID *DestinationBuffer,
+ IN UINT16 Size
+ );
+
+
+/**
+ Write a slice of a capability instance.
+
+ The function performs as few config space accesses as possible (without
+ attempting 64-bit wide accesses). PciCapWrite() performs bounds checking on
+ DestinationOffsetInCap and Size, and only invokes PciDevice->WriteConfig() if
+ the requested transfer falls within Cap.
+
+ @param[in] PciDevice Implementation-specific unique
+ representation of the PCI device in the
+ PCI hierarchy.
+
+ @param[in] Cap The capability instance to write, located
+ with PciCapListFindCap*().
+
+ @param[in] DestinationOffsetInCap Destination offset relative to the
+ capability header to start writing at. A
+ zero value refers to the first byte of the
+ capability header.
+
+ @param[in] SourceBuffer Buffer to read the data to be stored from.
+
+ @param[in] Size The number of bytes to transfer.
+
+ @retval RETURN_SUCCESS Size bytes have been transferred from
+ SourceBuffer to Cap.
+
+ @retval RETURN_BAD_BUFFER_SIZE Writing Size bytes starting at
+ DestinationOffsetInCap would not (entirely)
+ be contained within Cap, as suggested by
+ PCI_CAP_INFO.MaxSizeHint. No bytes have been
+ written.
+
+ @return Error codes propagated from
+ PciDevice->WriteConfig(). Fewer than Size
+ bytes may have been written.
+**/
+RETURN_STATUS
+EFIAPI
+PciCapWrite (
+ IN PCI_CAP_DEV *PciDevice,
+ IN PCI_CAP *Cap,
+ IN UINT16 DestinationOffsetInCap,
+ IN VOID *SourceBuffer,
+ IN UINT16 Size
+ );
+
+#endif // __PCI_CAP_LIB_H__
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciCapPciIoLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciCapPciIoLib.h
new file mode 100644
index 00000000..4a76314f
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciCapPciIoLib.h
@@ -0,0 +1,52 @@
+/** @file
+ Library class layered on top of PciCapLib that allows clients to plug an
+ EFI_PCI_IO_PROTOCOL backend into PciCapLib, for config space access.
+
+ Copyright (C) 2018, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __PCI_CAP_PCI_IO_LIB_H__
+#define __PCI_CAP_PCI_IO_LIB_H__
+
+#include <Protocol/PciIo.h>
+
+#include <Library/PciCapLib.h>
+
+
+/**
+ Create a PCI_CAP_DEV object from an EFI_PCI_IO_PROTOCOL instance. The config
+ space accessors are based upon EFI_PCI_IO_PROTOCOL.Pci.Read() and
+ EFI_PCI_IO_PROTOCOL.Pci.Write().
+
+ @param[in] PciIo EFI_PCI_IO_PROTOCOL representation of the PCI device.
+
+ @param[out] PciDevice The PCI_CAP_DEV object constructed as described above.
+ PciDevice can be passed to the PciCapLib APIs.
+
+ @retval EFI_SUCCESS PciDevice has been constructed and output.
+
+ @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
+**/
+EFI_STATUS
+EFIAPI
+PciCapPciIoDeviceInit (
+ IN EFI_PCI_IO_PROTOCOL *PciIo,
+ OUT PCI_CAP_DEV **PciDevice
+ );
+
+
+/**
+ Free the resources used by PciDevice.
+
+ @param[in] PciDevice The PCI_CAP_DEV object to free, originally produced by
+ PciCapPciIoDeviceInit().
+**/
+VOID
+EFIAPI
+PciCapPciIoDeviceUninit (
+ IN PCI_CAP_DEV *PciDevice
+ );
+
+#endif // __PCI_CAP_PCI_IO_LIB_H__
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciCapPciSegmentLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciCapPciSegmentLib.h
new file mode 100644
index 00000000..6aa546e9
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciCapPciSegmentLib.h
@@ -0,0 +1,76 @@
+/** @file
+ Library class layered on top of PciCapLib that allows clients to plug a
+ PciSegmentLib backend into PciCapLib, for config space access.
+
+ Copyright (C) 2018, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __PCI_CAP_PCI_SEGMENT_LIB_H__
+#define __PCI_CAP_PCI_SEGMENT_LIB_H__
+
+#include <Library/PciCapLib.h>
+
+
+/**
+ Create a PCI_CAP_DEV object from the PCI Segment:Bus:Device.Function
+ quadruplet. The config space accessors are based upon PciSegmentLib.
+
+ @param[in] MaxDomain If MaxDomain is PciCapExtended, then
+ PciDevice->ReadConfig() and PciDevice->WriteConfig()
+ will delegate extended config space accesses too to
+ PciSegmentReadBuffer() and PciSegmentWriteBuffer(),
+ respectively. Otherwise, PciDevice->ReadConfig() and
+ PciDevice->WriteConfig() will reject accesses to
+ extended config space with RETURN_UNSUPPORTED, without
+ calling PciSegmentReadBuffer() or
+ PciSegmentWriteBuffer(). By setting MaxDomain to
+ PciCapNormal, the platform can prevent undefined
+ PciSegmentLib behavior when the PCI root bridge under
+ the PCI device at Segment:Bus:Device.Function doesn't
+ support extended config space.
+
+ @param[in] Segment 16-bit wide segment number.
+
+ @param[in] Bus 8-bit wide bus number.
+
+ @param[in] Device 5-bit wide device number.
+
+ @param[in] Function 3-bit wide function number.
+
+ @param[out] PciDevice The PCI_CAP_DEV object constructed as described above.
+ PciDevice can be passed to the PciCapLib APIs.
+
+ @retval RETURN_SUCCESS PciDevice has been constructed and output.
+
+ @retval RETURN_INVALID_PARAMETER Device or Function does not fit in the
+ permitted number of bits.
+
+ @retval RETURN_OUT_OF_RESOURCES Memory allocation failed.
+**/
+RETURN_STATUS
+EFIAPI
+PciCapPciSegmentDeviceInit (
+ IN PCI_CAP_DOMAIN MaxDomain,
+ IN UINT16 Segment,
+ IN UINT8 Bus,
+ IN UINT8 Device,
+ IN UINT8 Function,
+ OUT PCI_CAP_DEV **PciDevice
+ );
+
+
+/**
+ Free the resources used by PciDevice.
+
+ @param[in] PciDevice The PCI_CAP_DEV object to free, originally produced by
+ PciCapPciSegmentDeviceInit().
+**/
+VOID
+EFIAPI
+PciCapPciSegmentDeviceUninit (
+ IN PCI_CAP_DEV *PciDevice
+ );
+
+#endif // __PCI_CAP_PCI_SEGMENT_LIB_H__
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciHostBridgeUtilityLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciHostBridgeUtilityLib.h
new file mode 100644
index 00000000..c0da372a
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PciHostBridgeUtilityLib.h
@@ -0,0 +1,185 @@
+/** @file
+ Provide common utility functions to PciHostBridgeLib instances in
+ ArmVirtPkg and OvmfPkg.
+
+ Copyright (C) 2016, Red Hat, Inc.
+ Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
+ Copyright (c) 2020, Huawei Corporation. All rights reserved.<BR>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __PCI_HOST_BRIDGE_UTILITY_LIB_H__
+#define __PCI_HOST_BRIDGE_UTILITY_LIB_H__
+
+
+#include <Library/PciHostBridgeLib.h>
+
+
+/**
+ Utility function to initialize a PCI_ROOT_BRIDGE structure.
+
+ @param[in] Supports Supported attributes.
+
+ @param[in] Attributes Initial attributes.
+
+ @param[in] AllocAttributes Allocation attributes.
+
+ @param[in] DmaAbove4G DMA above 4GB memory.
+
+ @param[in] NoExtendedConfigSpace No Extended Config Space.
+
+ @param[in] RootBusNumber The bus number to store in RootBus.
+
+ @param[in] MaxSubBusNumber The inclusive maximum bus number that can
+ be assigned to any subordinate bus found
+ behind any PCI bridge hanging off this
+ root bus.
+
+ The caller is repsonsible for ensuring
+ that RootBusNumber <= MaxSubBusNumber. If
+ RootBusNumber equals MaxSubBusNumber, then
+ the root bus has no room for subordinate
+ buses.
+
+ @param[in] Io IO aperture.
+
+ @param[in] Mem MMIO aperture.
+
+ @param[in] MemAbove4G MMIO aperture above 4G.
+
+ @param[in] PMem Prefetchable MMIO aperture.
+
+ @param[in] PMemAbove4G Prefetchable MMIO aperture above 4G.
+
+ @param[out] RootBus The PCI_ROOT_BRIDGE structure (allocated
+ by the caller) that should be filled in by
+ this function.
+
+ @retval EFI_SUCCESS Initialization successful. A device path
+ consisting of an ACPI device path node,
+ with UID = RootBusNumber, has been
+ allocated and linked into RootBus.
+
+ @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
+**/
+EFI_STATUS
+EFIAPI
+PciHostBridgeUtilityInitRootBridge (
+ IN UINT64 Supports,
+ IN UINT64 Attributes,
+ IN UINT64 AllocAttributes,
+ IN BOOLEAN DmaAbove4G,
+ IN BOOLEAN NoExtendedConfigSpace,
+ IN UINT8 RootBusNumber,
+ IN UINT8 MaxSubBusNumber,
+ IN PCI_ROOT_BRIDGE_APERTURE *Io,
+ IN PCI_ROOT_BRIDGE_APERTURE *Mem,
+ IN PCI_ROOT_BRIDGE_APERTURE *MemAbove4G,
+ IN PCI_ROOT_BRIDGE_APERTURE *PMem,
+ IN PCI_ROOT_BRIDGE_APERTURE *PMemAbove4G,
+ OUT PCI_ROOT_BRIDGE *RootBus
+ );
+
+
+/**
+ Utility function to uninitialize a PCI_ROOT_BRIDGE structure set up with
+ PciHostBridgeUtilityInitRootBridge().
+
+ @param[in] RootBus The PCI_ROOT_BRIDGE structure, allocated by the caller and
+ initialized with PciHostBridgeUtilityInitRootBridge(),
+ that should be uninitialized. This function doesn't free
+ RootBus.
+**/
+VOID
+EFIAPI
+PciHostBridgeUtilityUninitRootBridge (
+ IN PCI_ROOT_BRIDGE *RootBus
+ );
+
+
+/**
+ Utility function to return all the root bridge instances in an array.
+
+ @param[out] Count The number of root bridge instances.
+
+ @param[in] Attributes Initial attributes.
+
+ @param[in] AllocAttributes Allocation attributes.
+
+ @param[in] DmaAbove4G DMA above 4GB memory.
+
+ @param[in] NoExtendedConfigSpace No Extended Config Space.
+
+ @param[in] BusMin Minimum Bus number, inclusive.
+
+ @param[in] BusMax Maximum Bus number, inclusive.
+
+ @param[in] Io IO aperture.
+
+ @param[in] Mem MMIO aperture.
+
+ @param[in] MemAbove4G MMIO aperture above 4G.
+
+ @param[in] PMem Prefetchable MMIO aperture.
+
+ @param[in] PMemAbove4G Prefetchable MMIO aperture above 4G.
+
+ @return All the root bridge instances in an array.
+**/
+PCI_ROOT_BRIDGE *
+EFIAPI
+PciHostBridgeUtilityGetRootBridges (
+ OUT UINTN *Count,
+ IN UINT64 Attributes,
+ IN UINT64 AllocationAttributes,
+ IN BOOLEAN DmaAbove4G,
+ IN BOOLEAN NoExtendedConfigSpace,
+ IN UINTN BusMin,
+ IN UINTN BusMax,
+ IN PCI_ROOT_BRIDGE_APERTURE *Io,
+ IN PCI_ROOT_BRIDGE_APERTURE *Mem,
+ IN PCI_ROOT_BRIDGE_APERTURE *MemAbove4G,
+ IN PCI_ROOT_BRIDGE_APERTURE *PMem,
+ IN PCI_ROOT_BRIDGE_APERTURE *PMemAbove4G
+ );
+
+
+/**
+ Utility function to free root bridge instances array from
+ PciHostBridgeUtilityGetRootBridges().
+
+ @param[in] Bridges The root bridge instances array.
+ @param[in] Count The count of the array.
+**/
+VOID
+EFIAPI
+PciHostBridgeUtilityFreeRootBridges (
+ IN PCI_ROOT_BRIDGE *Bridges,
+ IN UINTN Count
+ );
+
+
+/**
+ Utility function to inform the platform that the resource conflict happens.
+
+ @param[in] Configuration Pointer to PCI I/O and PCI memory resource
+ descriptors. The Configuration contains the
+ resources for all the root bridges. The resource
+ for each root bridge is terminated with END
+ descriptor and an additional END is appended
+ indicating the end of the entire resources. The
+ resource descriptor field values follow the
+ description in
+ EFI_PCI_HOST_BRIDGE_RESOURCE_ALLOCATION_PROTOCOL
+ .SubmitResources().
+**/
+VOID
+EFIAPI
+PciHostBridgeUtilityResourceConflict (
+ IN VOID *Configuration
+ );
+
+
+#endif // __PCI_HOST_BRIDGE_UTILITY_LIB_H__
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PlatformBmPrintScLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PlatformBmPrintScLib.h
new file mode 100644
index 00000000..b258e139
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PlatformBmPrintScLib.h
@@ -0,0 +1,35 @@
+/** @file
+ Register a status code handler for printing the Boot Manager's LoadImage()
+ and StartImage() preparations, and return codes, to the UEFI console.
+
+ This feature enables users that are not accustomed to analyzing the firmware
+ log to glean some information about UEFI boot option processing (loading and
+ starting).
+
+ Copyright (C) 2019, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __PLATFORM_BM_PRINT_SC_LIB__
+#define __PLATFORM_BM_PRINT_SC_LIB__
+
+#include <Uefi/UefiBaseType.h>
+
+/**
+ Register a status code handler for printing the Boot Manager's LoadImage()
+ and StartImage() preparations, and return codes, to the UEFI console.
+
+ @retval EFI_SUCCESS The status code handler has been successfully
+ registered.
+
+ @return Error codes propagated from boot services and from
+ EFI_RSC_HANDLER_PROTOCOL.
+**/
+EFI_STATUS
+EFIAPI
+PlatformBmPrintScRegisterHandler (
+ VOID
+ );
+
+#endif // __PLATFORM_BM_PRINT_SC_LIB__
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PlatformFvbLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PlatformFvbLib.h
new file mode 100644
index 00000000..5dd1b4a8
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/PlatformFvbLib.h
@@ -0,0 +1,81 @@
+/** @file
+ Library to define platform customization functions for a
+ Firmare Volume Block driver.
+
+ Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __PLATFORM_FVB_LIB__
+#define __PLATFORM_FVB_LIB__
+
+#include <Protocol/FirmwareVolumeBlock.h>
+
+/**
+ This function will be called following a call to the
+ EFI_FIRMWARE_VOLUME_BLOCK2_PROTOCOL Read function.
+
+ @param[in] This The EFI_FIRMWARE_VOLUME_BLOCK2_PROTOCOL instance.
+ @param[in] Lba The starting logical block index
+ from which to read.
+ @param[in] Offset Offset into the block at which to begin reading.
+ @param[in] NumBytes The number of bytes read.
+ @param[in] Buffer Pointer to the buffer that was read, and will be
+ returned to the caller.
+
+**/
+VOID
+EFIAPI
+PlatformFvbDataRead (
+ IN CONST EFI_FIRMWARE_VOLUME_BLOCK2_PROTOCOL *This,
+ IN EFI_LBA Lba,
+ IN UINTN Offset,
+ IN UINTN NumBytes,
+ IN UINT8 *Buffer
+ );
+
+
+/**
+ This function will be called following a call to the
+ EFI_FIRMWARE_VOLUME_BLOCK2_PROTOCOL Write function.
+
+ @param[in] This EFI_FIRMWARE_VOLUME_BLOCK2_PROTOCOL instance.
+ @param[in] Lba The starting logical block index to written to.
+ @param[in] Offset Offset into the block at which to begin writing.
+ @param[in] NumBytes The number of bytes written.
+ @param[in] Buffer Pointer to the buffer that was written.
+
+**/
+VOID
+EFIAPI
+PlatformFvbDataWritten (
+ IN CONST EFI_FIRMWARE_VOLUME_BLOCK2_PROTOCOL *This,
+ IN EFI_LBA Lba,
+ IN UINTN Offset,
+ IN UINTN NumBytes,
+ IN UINT8 *Buffer
+ );
+
+
+/**
+ This function will be called following a call to the
+ EFI_FIRMWARE_VOLUME_BLOCK2_PROTOCOL Erase function.
+
+ @param This Indicates the EFI_FIRMWARE_VOLUME_BLOCK2_PROTOCOL
+ instance.
+ @param List The variable argument list as documented for
+ the EFI_FIRMWARE_VOLUME_BLOCK2_PROTOCOL Erase
+ function.
+
+**/
+VOID
+EFIAPI
+PlatformFvbBlocksErased (
+ IN CONST EFI_FIRMWARE_VOLUME_BLOCK2_PROTOCOL *This,
+ IN VA_LIST List
+ );
+
+
+#endif
+
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuBootOrderLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuBootOrderLib.h
new file mode 100644
index 00000000..befc63ae
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuBootOrderLib.h
@@ -0,0 +1,99 @@
+/** @file
+ Rewrite the BootOrder NvVar based on QEMU's "bootorder" fw_cfg file --
+ include file.
+
+ Copyright (C) 2012-2014, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __QEMU_BOOT_ORDER_LIB_H__
+#define __QEMU_BOOT_ORDER_LIB_H__
+
+#include <Uefi/UefiBaseType.h>
+#include <Base.h>
+
+
+/**
+ Connect devices based on the boot order retrieved from QEMU.
+
+ Attempt to retrieve the "bootorder" fw_cfg file from QEMU. Translate the
+ OpenFirmware device paths therein to UEFI device path fragments. Connect the
+ devices identified by the UEFI devpath prefixes as narrowly as possible, then
+ connect all their child devices, recursively.
+
+ If this function fails, then platform BDS should fall back to
+ EfiBootManagerConnectAll(), or some other method for connecting any expected
+ boot devices.
+
+ @retval RETURN_SUCCESS The "bootorder" fw_cfg file has been
+ parsed, and the referenced device-subtrees
+ have been connected.
+
+ @retval RETURN_UNSUPPORTED QEMU's fw_cfg is not supported.
+
+ @retval RETURN_NOT_FOUND Empty or nonexistent "bootorder" fw_cfg
+ file.
+
+ @retval RETURN_INVALID_PARAMETER Parse error in the "bootorder" fw_cfg file.
+
+ @retval RETURN_OUT_OF_RESOURCES Memory allocation failed.
+
+ @return Error statuses propagated from underlying
+ functions.
+**/
+RETURN_STATUS
+EFIAPI
+ConnectDevicesFromQemu (
+ VOID
+ );
+
+
+/**
+
+ Set the boot order based on configuration retrieved from QEMU.
+
+ Attempt to retrieve the "bootorder" fw_cfg file from QEMU. Translate the
+ OpenFirmware device paths therein to UEFI device path fragments. Match the
+ translated fragments against the current list of boot options, and rewrite
+ the BootOrder NvVar so that it corresponds to the order described in fw_cfg.
+
+ Platform BDS should call this function after connecting any expected boot
+ devices and calling EfiBootManagerRefreshAllBootOption ().
+
+ @retval RETURN_SUCCESS BootOrder NvVar rewritten.
+
+ @retval RETURN_UNSUPPORTED QEMU's fw_cfg is not supported.
+
+ @retval RETURN_NOT_FOUND Empty or nonexistent "bootorder" fw_cfg
+ file, or no match found between the
+ "bootorder" fw_cfg file and BootOptionList.
+
+ @retval RETURN_INVALID_PARAMETER Parse error in the "bootorder" fw_cfg file.
+
+ @retval RETURN_OUT_OF_RESOURCES Memory allocation failed.
+
+ @return Values returned by gBS->LocateProtocol ()
+ or gRT->SetVariable ().
+
+**/
+RETURN_STATUS
+EFIAPI
+SetBootOrderFromQemu (
+ VOID
+ );
+
+
+/**
+ Calculate the number of seconds we should be showing the FrontPage progress
+ bar for.
+
+ @return The TimeoutDefault argument for PlatformBdsEnterFrontPage().
+**/
+UINT16
+EFIAPI
+GetFrontPageTimeoutFromQemu (
+ VOID
+ );
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuFwCfgLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuFwCfgLib.h
new file mode 100644
index 00000000..13134bab
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuFwCfgLib.h
@@ -0,0 +1,177 @@
+/** @file
+ QEMU/KVM Firmware Configuration access
+
+ Copyright (c) 2011 - 2013, Intel Corporation. All rights reserved.<BR>
+ Copyright (C) 2013, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __FW_CFG_LIB__
+#define __FW_CFG_LIB__
+
+#include <IndustryStandard/QemuFwCfg.h>
+
+/**
+ Returns a boolean indicating if the firmware configuration interface
+ is available or not.
+
+ This function may change fw_cfg state.
+
+ @retval TRUE The interface is available
+ @retval FALSE The interface is not available
+
+**/
+BOOLEAN
+EFIAPI
+QemuFwCfgIsAvailable (
+ VOID
+ );
+
+
+/**
+ Selects a firmware configuration item for reading.
+
+ Following this call, any data read from this item will start from
+ the beginning of the configuration item's data.
+
+ @param[in] QemuFwCfgItem - Firmware Configuration item to read
+
+**/
+VOID
+EFIAPI
+QemuFwCfgSelectItem (
+ IN FIRMWARE_CONFIG_ITEM QemuFwCfgItem
+ );
+
+
+/**
+ Reads firmware configuration bytes into a buffer
+
+ If called multiple times, then the data read will
+ continue at the offset of the firmware configuration
+ item where the previous read ended.
+
+ @param[in] Size - Size in bytes to read
+ @param[in] Buffer - Buffer to store data into
+
+**/
+VOID
+EFIAPI
+QemuFwCfgReadBytes (
+ IN UINTN Size,
+ IN VOID *Buffer OPTIONAL
+ );
+
+
+/**
+ Writes firmware configuration bytes from a buffer
+
+ If called multiple times, then the data written will
+ continue at the offset of the firmware configuration
+ item where the previous write ended.
+
+ @param[in] Size - Size in bytes to write
+ @param[in] Buffer - Buffer to read data from
+
+**/
+VOID
+EFIAPI
+QemuFwCfgWriteBytes (
+ IN UINTN Size,
+ IN VOID *Buffer
+ );
+
+
+/**
+ Skip bytes in the firmware configuration item.
+
+ Increase the offset of the firmware configuration item without transferring
+ bytes between the item and a caller-provided buffer. Subsequent read, write
+ or skip operations will commence at the increased offset.
+
+ @param[in] Size Number of bytes to skip.
+**/
+VOID
+EFIAPI
+QemuFwCfgSkipBytes (
+ IN UINTN Size
+ );
+
+
+/**
+ Reads a UINT8 firmware configuration value
+
+ @return Value of Firmware Configuration item read
+
+**/
+UINT8
+EFIAPI
+QemuFwCfgRead8 (
+ VOID
+ );
+
+
+/**
+ Reads a UINT16 firmware configuration value
+
+ @return Value of Firmware Configuration item read
+
+**/
+UINT16
+EFIAPI
+QemuFwCfgRead16 (
+ VOID
+ );
+
+
+/**
+ Reads a UINT32 firmware configuration value
+
+ @return Value of Firmware Configuration item read
+
+**/
+UINT32
+EFIAPI
+QemuFwCfgRead32 (
+ VOID
+ );
+
+
+/**
+ Reads a UINT64 firmware configuration value
+
+ @return Value of Firmware Configuration item read
+
+**/
+UINT64
+EFIAPI
+QemuFwCfgRead64 (
+ VOID
+ );
+
+
+/**
+ Find the configuration item corresponding to the firmware configuration file.
+
+ @param[in] Name - Name of file to look up.
+ @param[out] Item - Configuration item corresponding to the file, to be passed
+ to QemuFwCfgSelectItem ().
+ @param[out] Size - Number of bytes in the file.
+
+ @return RETURN_SUCCESS If file is found.
+ RETURN_NOT_FOUND If file is not found.
+ RETURN_UNSUPPORTED If firmware configuration is unavailable.
+
+**/
+RETURN_STATUS
+EFIAPI
+QemuFwCfgFindFile (
+ IN CONST CHAR8 *Name,
+ OUT FIRMWARE_CONFIG_ITEM *Item,
+ OUT UINTN *Size
+ );
+
+#endif
+
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuFwCfgS3Lib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuFwCfgS3Lib.h
new file mode 100644
index 00000000..24022196
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuFwCfgS3Lib.h
@@ -0,0 +1,355 @@
+/** @file
+ S3 support for QEMU fw_cfg
+
+ This library class enables driver modules (a) to query whether S3 support was
+ enabled on the QEMU command line, (b) to produce fw_cfg DMA operations that
+ are to be replayed at S3 resume time.
+
+ Copyright (C) 2017, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __FW_CFG_S3_LIB__
+#define __FW_CFG_S3_LIB__
+
+#include <Base.h>
+
+/**
+ Determine if S3 support is explicitly enabled.
+
+ @retval TRUE If S3 support is explicitly enabled. Other functions in this
+ library may be called (subject to their individual
+ restrictions).
+
+ FALSE Otherwise. This includes unavailability of the firmware
+ configuration interface. No other function in this library
+ must be called.
+**/
+BOOLEAN
+EFIAPI
+QemuFwCfgS3Enabled (
+ VOID
+ );
+
+
+/**
+ Prototype for the callback function that the client module provides.
+
+ In the callback function, the client module calls the
+ QemuFwCfgS3ScriptWriteBytes(), QemuFwCfgS3ScriptReadBytes(),
+ QemuFwCfgS3ScriptSkipBytes(), and QemuFwCfgS3ScriptCheckValue() functions.
+ Those functions produce ACPI S3 Boot Script opcodes that will perform fw_cfg
+ DMA operations, and will check any desired values that were read, during S3
+ resume.
+
+ The callback function is invoked when the production of ACPI S3 Boot Script
+ opcodes becomes possible. This may occur directly on the call stack of
+ QemuFwCfgS3CallWhenBootScriptReady() (see below), or after
+ QemuFwCfgS3CallWhenBootScriptReady() has successfully returned.
+
+ The callback function must not return if it fails -- in the general case,
+ there is noone to propagate any errors to. Therefore, on error, an error
+ message should be logged, and CpuDeadLoop() must be called.
+
+ @param[in,out] Context Carries information from the client module
+ itself (i.e., from the invocation of
+ QemuFwCfgS3CallWhenBootScriptReady()) to the
+ callback function.
+
+ If Context points to dynamically allocated
+ storage, then the callback function must
+ release it.
+
+ @param[in,out] ScratchBuffer Points to reserved memory, allocated by
+ QemuFwCfgS3CallWhenBootScriptReady()
+ internally.
+
+ ScratchBuffer is typed and sized by the client
+ module when it calls
+ QemuFwCfgS3CallWhenBootScriptReady(). The
+ client module defines a union type of
+ structures for ScratchBuffer such that the
+ union can hold client data for any desired
+ fw_cfg DMA read and write operations, and value
+ checking.
+
+ The callback function casts ScratchBuffer to
+ the union type described above. It passes union
+ member sizes as NumberOfBytes to
+ QemuFwCfgS3ScriptReadBytes() and
+ QemuFwCfgS3ScriptWriteBytes(). It passes field
+ addresses and sizes in structures in the union
+ as ScratchData and ValueSize to
+ QemuFwCfgS3ScriptCheckValue().
+
+ ScratchBuffer is aligned at 8 bytes.
+**/
+typedef
+VOID (EFIAPI FW_CFG_BOOT_SCRIPT_CALLBACK_FUNCTION) (
+ IN OUT VOID *Context, OPTIONAL
+ IN OUT VOID *ScratchBuffer
+ );
+
+
+/**
+ Install the client module's FW_CFG_BOOT_SCRIPT_CALLBACK_FUNCTION callback for
+ when the production of ACPI S3 Boot Script opcodes becomes possible.
+
+ Take ownership of the client-provided Context, and pass it to the callback
+ function, when the latter is invoked.
+
+ Allocate scratch space for those ACPI S3 Boot Script opcodes to work upon
+ that the client will produce in the callback function.
+
+ @param[in] Callback FW_CFG_BOOT_SCRIPT_CALLBACK_FUNCTION to invoke
+ when the production of ACPI S3 Boot Script
+ opcodes becomes possible. Callback() may be
+ called immediately from
+ QemuFwCfgS3CallWhenBootScriptReady().
+
+ @param[in,out] Context Client-provided data structure for the
+ Callback() callback function to consume.
+
+ If Context points to dynamically allocated
+ memory, then Callback() must release it.
+
+ If Context points to dynamically allocated
+ memory, and
+ QemuFwCfgS3CallWhenBootScriptReady() returns
+ successfully, then the caller of
+ QemuFwCfgS3CallWhenBootScriptReady() must
+ neither dereference nor even evaluate Context
+ any longer, as ownership of the referenced area
+ has been transferred to Callback().
+
+ @param[in] ScratchBufferSize The size of the scratch buffer that will hold,
+ in reserved memory, all client data read,
+ written, and checked by the ACPI S3 Boot Script
+ opcodes produced by Callback().
+
+ @retval RETURN_UNSUPPORTED The library instance does not support this
+ function.
+
+ @retval RETURN_NOT_FOUND The fw_cfg DMA interface to QEMU is
+ unavailable.
+
+ @retval RETURN_BAD_BUFFER_SIZE ScratchBufferSize is too large.
+
+ @retval RETURN_OUT_OF_RESOURCES Memory allocation failed.
+
+ @retval RETURN_SUCCESS Callback() has been installed, and the
+ ownership of Context has been transferred.
+ Reserved memory has been allocated for the
+ scratch buffer.
+
+ A successful invocation of
+ QemuFwCfgS3CallWhenBootScriptReady() cannot
+ be rolled back.
+
+ @return Error codes from underlying functions.
+**/
+RETURN_STATUS
+EFIAPI
+QemuFwCfgS3CallWhenBootScriptReady (
+ IN FW_CFG_BOOT_SCRIPT_CALLBACK_FUNCTION *Callback,
+ IN OUT VOID *Context, OPTIONAL
+ IN UINTN ScratchBufferSize
+ );
+
+
+/**
+ Produce ACPI S3 Boot Script opcodes that (optionally) select an fw_cfg item,
+ and transfer data to it.
+
+ The opcodes produced by QemuFwCfgS3ScriptWriteBytes() will first restore
+ NumberOfBytes bytes in ScratchBuffer in-place, in reserved memory, then write
+ them to fw_cfg using DMA.
+
+ If the operation fails during S3 resume, the boot script will hang.
+
+ This function may only be called from the client module's
+ FW_CFG_BOOT_SCRIPT_CALLBACK_FUNCTION, which was passed to
+ QemuFwCfgS3CallWhenBootScriptReady() as Callback.
+
+ @param[in] FirmwareConfigItem The UINT16 selector key of the firmware config
+ item to write, expressed as INT32. If
+ FirmwareConfigItem is -1, no selection is
+ made, the write will occur to the currently
+ selected item, at its currently selected
+ offset. Otherwise, the specified item will be
+ selected, and the write will occur at offset
+ 0.
+
+ @param[in] NumberOfBytes Size of the data to restore in ScratchBuffer,
+ and to write from ScratchBuffer, during S3
+ resume. NumberOfBytes must not exceed
+ ScratchBufferSize, which was passed to
+ QemuFwCfgS3CallWhenBootScriptReady().
+
+ @retval RETURN_SUCCESS The opcodes were appended to the ACPI S3
+ Boot Script successfully. There is no way
+ to undo this action.
+
+ @retval RETURN_INVALID_PARAMETER FirmwareConfigItem is invalid.
+
+ @retval RETURN_BAD_BUFFER_SIZE NumberOfBytes is larger than
+ ScratchBufferSize.
+
+ @return Error codes from underlying functions.
+**/
+RETURN_STATUS
+EFIAPI
+QemuFwCfgS3ScriptWriteBytes (
+ IN INT32 FirmwareConfigItem,
+ IN UINTN NumberOfBytes
+ );
+
+
+/**
+ Produce ACPI S3 Boot Script opcodes that (optionally) select an fw_cfg item,
+ and transfer data from it.
+
+ The opcodes produced by QemuFwCfgS3ScriptReadBytes() will read NumberOfBytes
+ bytes from fw_cfg using DMA, storing the result in ScratchBuffer, in reserved
+ memory.
+
+ If the operation fails during S3 resume, the boot script will hang.
+
+ This function may only be called from the client module's
+ FW_CFG_BOOT_SCRIPT_CALLBACK_FUNCTION, which was passed to
+ QemuFwCfgS3CallWhenBootScriptReady() as Callback.
+
+ @param[in] FirmwareConfigItem The UINT16 selector key of the firmware config
+ item to read, expressed as INT32. If
+ FirmwareConfigItem is -1, no selection is
+ made, the read will occur from the currently
+ selected item, from its currently selected
+ offset. Otherwise, the specified item will be
+ selected, and the read will occur from offset
+ 0.
+
+ @param[in] NumberOfBytes Size of the data to read during S3 resume.
+ NumberOfBytes must not exceed
+ ScratchBufferSize, which was passed to
+ QemuFwCfgS3CallWhenBootScriptReady().
+
+ @retval RETURN_SUCCESS The opcodes were appended to the ACPI S3
+ Boot Script successfully. There is no way
+ to undo this action.
+
+ @retval RETURN_INVALID_PARAMETER FirmwareConfigItem is invalid.
+
+ @retval RETURN_BAD_BUFFER_SIZE NumberOfBytes is larger than
+ ScratchBufferSize.
+
+ @return Error codes from underlying functions.
+**/
+RETURN_STATUS
+EFIAPI
+QemuFwCfgS3ScriptReadBytes (
+ IN INT32 FirmwareConfigItem,
+ IN UINTN NumberOfBytes
+ );
+
+
+/**
+ Produce ACPI S3 Boot Script opcodes that (optionally) select an fw_cfg item,
+ and increase its offset.
+
+ If the operation fails during S3 resume, the boot script will hang.
+
+ This function may only be called from the client module's
+ FW_CFG_BOOT_SCRIPT_CALLBACK_FUNCTION, which was passed to
+ QemuFwCfgS3CallWhenBootScriptReady() as Callback.
+
+ @param[in] FirmwareConfigItem The UINT16 selector key of the firmware config
+ item to advance the offset of, expressed as
+ INT32. If FirmwareConfigItem is -1, no
+ selection is made, and the offset for the
+ currently selected item is increased.
+ Otherwise, the specified item will be
+ selected, and the offset increment will occur
+ from offset 0.
+
+ @param[in] NumberOfBytes The number of bytes to skip in the subject
+ fw_cfg item.
+
+ @retval RETURN_SUCCESS The opcodes were appended to the ACPI S3
+ Boot Script successfully. There is no way
+ to undo this action.
+
+ @retval RETURN_INVALID_PARAMETER FirmwareConfigItem is invalid.
+
+ @retval RETURN_BAD_BUFFER_SIZE NumberOfBytes is too large.
+
+ @return Error codes from underlying functions.
+**/
+RETURN_STATUS
+EFIAPI
+QemuFwCfgS3ScriptSkipBytes (
+ IN INT32 FirmwareConfigItem,
+ IN UINTN NumberOfBytes
+ );
+
+
+/**
+ Produce ACPI S3 Boot Script opcodes that check a value in ScratchBuffer.
+
+ If the check fails during S3 resume, the boot script will hang.
+
+ This function may only be called from the client module's
+ FW_CFG_BOOT_SCRIPT_CALLBACK_FUNCTION, which was passed to
+ QemuFwCfgS3CallWhenBootScriptReady() as Callback.
+
+ @param[in] ScratchData Pointer to the UINT8, UINT16, UINT32 or UINT64 field
+ in ScratchBuffer that should be checked. The caller
+ is responsible for populating the field during S3
+ resume, by calling QemuFwCfgS3ScriptReadBytes() ahead
+ of QemuFwCfgS3ScriptCheckValue().
+
+ ScratchData must point into ScratchBuffer, which was
+ allocated, and passed to Callback(), by
+ QemuFwCfgS3CallWhenBootScriptReady().
+
+ ScratchData must be aligned at ValueSize bytes.
+
+ @param[in] ValueSize One of 1, 2, 4 or 8, specifying the size of the field
+ to check.
+
+ @param[in] ValueMask The value read from ScratchData is binarily AND-ed
+ with ValueMask, and the result is compared against
+ Value. If the masked data equals Value, the check
+ passes, and the boot script can proceed. Otherwise,
+ the check fails, and the boot script hangs.
+
+ @param[in] Value Refer to ValueMask.
+
+ @retval RETURN_SUCCESS The opcodes were appended to the ACPI S3
+ Boot Script successfully. There is no way
+ to undo this action.
+
+ @retval RETURN_INVALID_PARAMETER ValueSize is invalid.
+
+ @retval RETURN_INVALID_PARAMETER ValueMask or Value cannot be represented in
+ ValueSize bytes.
+
+ @retval RETURN_INVALID_PARAMETER ScratchData is not aligned at ValueSize
+ bytes.
+
+ @retval RETURN_BAD_BUFFER_SIZE The ValueSize bytes at ScratchData aren't
+ wholly contained in the ScratchBufferSize
+ bytes at ScratchBuffer.
+
+ @return Error codes from underlying functions.
+**/
+RETURN_STATUS
+EFIAPI
+QemuFwCfgS3ScriptCheckValue (
+ IN VOID *ScratchData,
+ IN UINT8 ValueSize,
+ IN UINT64 ValueMask,
+ IN UINT64 Value
+ );
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuFwCfgSimpleParserLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuFwCfgSimpleParserLib.h
new file mode 100644
index 00000000..7c7703b6
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuFwCfgSimpleParserLib.h
@@ -0,0 +1,128 @@
+/** @file
+ Parse the contents of named fw_cfg files as simple (scalar) data types.
+
+ Copyright (C) 2020, Red Hat, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef QEMU_FW_CFG_SIMPLE_PARSER_LIB_H_
+#define QEMU_FW_CFG_SIMPLE_PARSER_LIB_H_
+
+#include <Base.h>
+
+/**
+ Look up FileName with QemuFwCfgFindFile() from QemuFwCfgLib. Read the fw_cfg
+ file into a small array with automatic storage duration. Parse the array as
+ the textual representation of a BOOLEAN.
+
+ @param[in] FileName The name of the fw_cfg file to look up and parse.
+
+ @param[out] Value On success, Value is TRUE if the contents of the fw_cfg
+ file case-insensitively match "true", "yes", "y",
+ "enable", "enabled", "1".
+
+ On success, Value is FALSE if the contents of the fw_cfg
+ file case-insensitively match "false", "no", "n",
+ "disable", "disabled", "0".
+
+ On failure, Value is not changed.
+
+ @retval RETURN_SUCCESS Parsing successful. Value has been set.
+
+ @retval RETURN_UNSUPPORTED Firmware configuration is unavailable.
+
+ @retval RETURN_PROTOCOL_ERROR Parsing failed. Value has not been changed.
+
+ @return Error codes propagated from
+ QemuFwCfgFindFile(). Value has not been
+ changed.
+**/
+RETURN_STATUS
+EFIAPI
+QemuFwCfgParseBool (
+ IN CONST CHAR8 *FileName,
+ OUT BOOLEAN *Value
+ );
+
+/**
+ Look up FileName with QemuFwCfgFindFile() from QemuFwCfgLib. Read the fw_cfg
+ file into a small array with automatic storage duration. Parse the array as
+ the textual representation of a UINT8.
+
+ @param[in] FileName The name of the fw_cfg file to look up and parse.
+
+ @param[in] ParseAsHex If TRUE, call BaseLib's AsciiStrHexToUint64S() for
+ parsing the fw_cfg file.
+
+ If FALSE, call BaseLib's AsciiStrDecimalToUint64S()
+ for parsing the fw_cfg file.
+
+ @param[out] Value On success, Value has been parsed with the BaseLib
+ function determined by ParseAsHex, and also
+ range-checked for [0, MAX_UINT8].
+
+ On failure, Value is not changed.
+
+ @retval RETURN_SUCCESS Parsing successful. Value has been set.
+
+ @retval RETURN_UNSUPPORTED Firmware configuration is unavailable.
+
+ @retval RETURN_PROTOCOL_ERROR Parsing failed. Value has not been changed.
+
+ @retval RETURN_PROTOCOL_ERROR Parsing succeeded, but the result does not fit
+ in the [0, MAX_UINT8] range. Value has not
+ been changed.
+
+ @return Error codes propagated from
+ QemuFwCfgFindFile() and from the BaseLib
+ function selected by ParseAsHex. Value has not
+ been changed.
+**/
+RETURN_STATUS
+EFIAPI
+QemuFwCfgParseUint8 (
+ IN CONST CHAR8 *FileName,
+ IN BOOLEAN ParseAsHex,
+ OUT UINT8 *Value
+ );
+
+//
+// The following functions behave identically to QemuFwCfgParseUint8(),
+// only their range checks use MAX_UINT16, MAX_UINT32, MAX_UINT64, MAX_UINTN,
+// respectively.
+//
+
+RETURN_STATUS
+EFIAPI
+QemuFwCfgParseUint16 (
+ IN CONST CHAR8 *FileName,
+ IN BOOLEAN ParseAsHex,
+ OUT UINT16 *Value
+ );
+
+RETURN_STATUS
+EFIAPI
+QemuFwCfgParseUint32 (
+ IN CONST CHAR8 *FileName,
+ IN BOOLEAN ParseAsHex,
+ OUT UINT32 *Value
+ );
+
+RETURN_STATUS
+EFIAPI
+QemuFwCfgParseUint64 (
+ IN CONST CHAR8 *FileName,
+ IN BOOLEAN ParseAsHex,
+ OUT UINT64 *Value
+ );
+
+RETURN_STATUS
+EFIAPI
+QemuFwCfgParseUintn (
+ IN CONST CHAR8 *FileName,
+ IN BOOLEAN ParseAsHex,
+ OUT UINTN *Value
+ );
+
+#endif // QEMU_FW_CFG_SIMPLE_PARSER_LIB_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuLoadImageLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuLoadImageLib.h
new file mode 100644
index 00000000..5aa4b0d8
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/QemuLoadImageLib.h
@@ -0,0 +1,84 @@
+/** @file
+ Load a kernel image and command line passed to QEMU via
+ the command line
+
+ Copyright (C) 2020, Arm, Limited.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef QEMU_LOAD_IMAGE_LIB_H__
+#define QEMU_LOAD_IMAGE_LIB_H__
+
+#include <Uefi/UefiBaseType.h>
+#include <Base.h>
+
+#include <Protocol/LoadedImage.h>
+
+/**
+ Download the kernel, the initial ramdisk, and the kernel command line from
+ QEMU's fw_cfg. The kernel will be instructed via its command line to load
+ the initrd from the same Simple FileSystem where the kernel was loaded from.
+
+ @param[out] ImageHandle The image handle that was allocated for
+ loading the image
+
+ @retval EFI_SUCCESS The image was loaded successfully.
+ @retval EFI_NOT_FOUND Kernel image was not found.
+ @retval EFI_OUT_OF_RESOURCES Memory allocation failed.
+ @retval EFI_PROTOCOL_ERROR Unterminated kernel command line.
+ @retval EFI_ACCESS_DENIED The underlying LoadImage boot service call
+ returned EFI_SECURITY_VIOLATION, and the image
+ was unloaded again.
+
+ @return Error codes from any of the underlying
+ functions.
+**/
+EFI_STATUS
+EFIAPI
+QemuLoadKernelImage (
+ OUT EFI_HANDLE *ImageHandle
+ );
+
+/**
+ Transfer control to a kernel image loaded with QemuLoadKernelImage ()
+
+ @param[in,out] ImageHandle Handle of image to be started. May assume a
+ different value on return if the image was
+ reloaded.
+
+ @retval EFI_INVALID_PARAMETER ImageHandle is either an invalid image handle
+ or the image has already been initialized with
+ StartImage
+ @retval EFI_SECURITY_VIOLATION The current platform policy specifies that the
+ image should not be started.
+
+ @return Error codes returned by the started image.
+ On success, the function doesn't return.
+**/
+EFI_STATUS
+EFIAPI
+QemuStartKernelImage (
+ IN OUT EFI_HANDLE *ImageHandle
+ );
+
+/**
+ Unloads an image loaded with QemuLoadKernelImage ().
+
+ @param ImageHandle Handle that identifies the image to be
+ unloaded.
+
+ @retval EFI_SUCCESS The image has been unloaded.
+ @retval EFI_UNSUPPORTED The image has been started, and does not
+ support unload.
+ @retval EFI_INVALID_PARAMETER ImageHandle is not a valid image handle.
+
+ @return Exit code from the image's unload function.
+**/
+EFI_STATUS
+EFIAPI
+QemuUnloadKernelImage (
+ IN EFI_HANDLE ImageHandle
+ );
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/SerializeVariablesLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/SerializeVariablesLib.h
new file mode 100644
index 00000000..047ddf3a
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/SerializeVariablesLib.h
@@ -0,0 +1,223 @@
+/** @file
+ Serialize & Deserialize UEFI Variables
+
+ Copyright (c) 2011, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __SERIALIZE_VARIABLES_LIB__
+#define __SERIALIZE_VARIABLES_LIB__
+
+
+/**
+ Callback function for each variable
+
+ @param[in] Context - Context as sent to the iteration function
+ @param[in] VariableName - Refer to RuntimeServices GetNextVariableName
+ @param[in] VendorGuid - Refer to RuntimeServices GetNextVariableName
+ @param[in] Attributes - Refer to RuntimeServices GetVariable
+ @param[in] DataSize - Refer to RuntimeServices GetVariable
+ @param[in] Data - Refer to RuntimeServices GetVariable
+
+ @retval RETURN_SUCCESS Continue iterating through the variables
+ @return Any RETURN_ERROR Stop iterating through the variables
+
+**/
+typedef
+RETURN_STATUS
+(EFIAPI *VARIABLE_SERIALIZATION_ITERATION_CALLBACK)(
+ IN VOID *Context,
+ IN CHAR16 *VariableName,
+ IN EFI_GUID *VendorGuid,
+ IN UINT32 Attributes,
+ IN UINTN DataSize,
+ IN VOID *Data
+ );
+
+
+/**
+ Creates a new variable serialization instance
+
+ @param[out] Handle - Handle for a variable serialization instance
+
+ @retval RETURN_SUCCESS - The variable serialization instance was
+ successfully created.
+ @retval RETURN_OUT_OF_RESOURCES - There we not enough resources to
+ create the variable serialization instance.
+
+**/
+RETURN_STATUS
+EFIAPI
+SerializeVariablesNewInstance (
+ OUT EFI_HANDLE *Handle
+ );
+
+
+/**
+ Free memory associated with a variable serialization instance
+
+ @param[in] Handle - Handle for a variable serialization instance
+
+ @retval RETURN_SUCCESS - The variable serialization instance was
+ successfully freed.
+ @retval RETURN_INVALID_PARAMETER - Handle was not a valid
+ variable serialization instance.
+
+**/
+RETURN_STATUS
+EFIAPI
+SerializeVariablesFreeInstance (
+ IN EFI_HANDLE Handle
+ );
+
+
+/**
+ Creates a new variable serialization instance using the given
+ binary representation of the variables to fill the new instance
+
+ @param[out] Handle - Handle for a variable serialization instance
+ @param[in] Buffer - A buffer with the serialized representation
+ of the variables. Must be the same format as produced
+ by SerializeVariablesToBuffer.
+ @param[in] Size - This is the size of the binary representation
+ of the variables.
+
+ @retval RETURN_SUCCESS - The binary representation was successfully
+ imported into a new variable serialization instance
+ @retval RETURN_OUT_OF_RESOURCES - There we not enough resources to
+ create the new variable serialization instance
+
+**/
+RETURN_STATUS
+EFIAPI
+SerializeVariablesNewInstanceFromBuffer (
+ OUT EFI_HANDLE *Handle,
+ IN VOID *Buffer,
+ IN UINTN Size
+ );
+
+
+/**
+ Iterates all variables found with RuntimeServices GetNextVariableName
+
+ @param[in] CallbackFunction - Function called for each variable instance
+ @param[in] Context - Passed to each call of CallbackFunction
+
+ @retval RETURN_SUCCESS - All variables were iterated without the
+ CallbackFunction returning an error
+ @retval RETURN_OUT_OF_RESOURCES - There we not enough resources to
+ iterate through the variables
+ @return Any of RETURN_ERROR indicates an error reading the variable
+ or an error was returned from CallbackFunction
+
+**/
+RETURN_STATUS
+EFIAPI
+SerializeVariablesIterateSystemVariables (
+ IN VARIABLE_SERIALIZATION_ITERATION_CALLBACK CallbackFunction,
+ IN VOID *Context
+ );
+
+
+/**
+ Iterates all variables found in the variable serialization instance
+
+ @param[in] Handle - Handle for a variable serialization instance
+ @param[in] CallbackFunction - Function called for each variable instance
+ @param[in] Context - Passed to each call of CallbackFunction
+
+ @retval RETURN_SUCCESS - All variables were iterated without the
+ CallbackFunction returning an error
+ @retval RETURN_OUT_OF_RESOURCES - There we not enough resources to
+ iterate through the variables
+ @return Any of RETURN_ERROR indicates an error reading the variable
+ or an error was returned from CallbackFunction
+
+**/
+RETURN_STATUS
+EFIAPI
+SerializeVariablesIterateInstanceVariables (
+ IN EFI_HANDLE Handle,
+ IN VARIABLE_SERIALIZATION_ITERATION_CALLBACK CallbackFunction,
+ IN VOID *Context
+ );
+
+
+/**
+ Sets all variables found in the variable serialization instance
+
+ @param[in] Handle - Handle for a variable serialization instance
+
+ @retval RETURN_SUCCESS - All variables were set successfully
+ @retval RETURN_OUT_OF_RESOURCES - There we not enough resources to
+ set all the variables
+ @return Any of RETURN_ERROR indicates an error reading the variables
+ or in attempting to set a variable
+
+**/
+RETURN_STATUS
+EFIAPI
+SerializeVariablesSetSerializedVariables (
+ IN EFI_HANDLE Handle
+ );
+
+
+/**
+ Adds a variable to the variable serialization instance
+
+ @param[in] Handle - Handle for a variable serialization instance
+ @param[in] VariableName - Refer to RuntimeServices GetVariable
+ @param[in] VendorGuid - Refer to RuntimeServices GetVariable
+ @param[in] Attributes - Refer to RuntimeServices GetVariable
+ @param[in] DataSize - Refer to RuntimeServices GetVariable
+ @param[in] Data - Refer to RuntimeServices GetVariable
+
+ @retval RETURN_SUCCESS - All variables were set successfully
+ @retval RETURN_OUT_OF_RESOURCES - There we not enough resources to
+ add the variable
+
+**/
+RETURN_STATUS
+EFIAPI
+SerializeVariablesAddVariable (
+ IN EFI_HANDLE Handle,
+ IN CHAR16 *VariableName,
+ IN EFI_GUID *VendorGuid,
+ IN UINT32 Attributes,
+ IN UINTN DataSize,
+ IN VOID *Data
+ );
+
+
+/**
+ Serializes the variables known to this instance into the
+ provided buffer.
+
+ @param[in] Handle - Handle for a variable serialization instance
+ @param[out] Buffer - A buffer to store the binary representation
+ of the variables.
+ @param[in,out] Size - On input this is the size of the buffer.
+ On output this is the size of the binary representation
+ of the variables.
+
+ @retval RETURN_SUCCESS - The binary representation was successfully
+ completed and returned in the buffer.
+ @retval RETURN_OUT_OF_RESOURCES - There we not enough resources to
+ save the variables to the buffer.
+ @retval RETURN_INVALID_PARAMETER - Handle was not a valid
+ variable serialization instance or
+ Size or Buffer were NULL.
+
+**/
+RETURN_STATUS
+EFIAPI
+SerializeVariablesToBuffer (
+ IN EFI_HANDLE Handle,
+ OUT VOID *Buffer,
+ IN OUT UINTN *Size
+ );
+
+
+#endif
+
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/VirtioLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/VirtioLib.h
new file mode 100644
index 00000000..2ede10f9
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/VirtioLib.h
@@ -0,0 +1,316 @@
+/** @file
+
+ Declarations of utility functions used by virtio device drivers.
+
+ Copyright (C) 2012-2016, Red Hat, Inc.
+ Copyright (C) 2017, AMD Inc, All rights reserved.<BR>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _VIRTIO_LIB_H_
+#define _VIRTIO_LIB_H_
+
+#include <Protocol/VirtioDevice.h>
+
+#include <IndustryStandard/Virtio.h>
+
+
+/**
+
+ Configure a virtio ring.
+
+ This function sets up internal storage (the guest-host communication area)
+ and lays out several "navigation" (ie. no-ownership) pointers to parts of
+ that storage.
+
+ Relevant sections from the virtio-0.9.5 spec:
+ - 1.1 Virtqueues,
+ - 2.3 Virtqueue Configuration.
+
+ @param[in] VirtIo The virtio device which will use the ring.
+
+ @param[in] The number of descriptors to allocate for the
+ virtio ring, as requested by the host.
+
+ @param[out] Ring The virtio ring to set up.
+
+ @return Status codes propagated from
+ VirtIo->AllocateSharedPages().
+
+ @retval EFI_SUCCESS Allocation and setup successful. Ring->Base
+ (and nothing else) is responsible for
+ deallocation.
+
+**/
+EFI_STATUS
+EFIAPI
+VirtioRingInit (
+ IN VIRTIO_DEVICE_PROTOCOL *VirtIo,
+ IN UINT16 QueueSize,
+ OUT VRING *Ring
+ );
+
+
+/**
+
+ Map the ring buffer so that it can be accessed equally by both guest
+ and hypervisor.
+
+ @param[in] VirtIo The virtio device instance.
+
+ @param[in] Ring The virtio ring to map.
+
+ @param[out] RingBaseShift A resulting translation offset, to be
+ passed to VirtIo->SetQueueAddress().
+
+ @param[out] Mapping A resulting token to pass to
+ VirtIo->UnmapSharedBuffer().
+
+ @return Status code from VirtIo->MapSharedBuffer()
+**/
+EFI_STATUS
+EFIAPI
+VirtioRingMap (
+ IN VIRTIO_DEVICE_PROTOCOL *VirtIo,
+ IN VRING *Ring,
+ OUT UINT64 *RingBaseShift,
+ OUT VOID **Mapping
+ );
+
+/**
+
+ Tear down the internal resources of a configured virtio ring.
+
+ The caller is responsible to stop the host from using this ring before
+ invoking this function: the VSTAT_DRIVER_OK bit must be clear in
+ VhdrDeviceStatus.
+
+ @param[in] VirtIo The virtio device which was using the ring.
+
+ @param[out] Ring The virtio ring to clean up.
+
+**/
+VOID
+EFIAPI
+VirtioRingUninit (
+ IN VIRTIO_DEVICE_PROTOCOL *VirtIo,
+ IN OUT VRING *Ring
+ );
+
+
+//
+// Internal use structure for tracking the submission of a multi-descriptor
+// request.
+//
+typedef struct {
+ UINT16 HeadDescIdx;
+ UINT16 NextDescIdx;
+} DESC_INDICES;
+
+
+/**
+
+ Turn off interrupt notifications from the host, and prepare for appending
+ multiple descriptors to the virtio ring.
+
+ The calling driver must be in VSTAT_DRIVER_OK state.
+
+ @param[in,out] Ring The virtio ring we intend to append descriptors to.
+
+ @param[out] Indices The DESC_INDICES structure to initialize.
+
+**/
+VOID
+EFIAPI
+VirtioPrepare (
+ IN OUT VRING *Ring,
+ OUT DESC_INDICES *Indices
+ );
+
+
+/**
+
+ Append a contiguous buffer for transmission / reception via the virtio ring.
+
+ This function implements the following section from virtio-0.9.5:
+ - 2.4.1.1 Placing Buffers into the Descriptor Table
+
+ Free space is taken as granted, since the individual drivers support only
+ synchronous requests and host side status is processed in lock-step with
+ request submission. It is the calling driver's responsibility to verify the
+ ring size in advance.
+
+ The caller is responsible for initializing *Indices with VirtioPrepare()
+ first.
+
+ @param[in,out] Ring The virtio ring to append the buffer to,
+ as a descriptor.
+
+ @param[in] BufferDeviceAddress (Bus master device) start address of the
+ transmit / receive buffer.
+
+ @param[in] BufferSize Number of bytes to transmit or receive.
+
+ @param[in] Flags A bitmask of VRING_DESC_F_* flags. The
+ caller computes this mask dependent on
+ further buffers to append and transfer
+ direction. VRING_DESC_F_INDIRECT is
+ unsupported. The VRING_DESC.Next field is
+ always set, but the host only interprets
+ it dependent on VRING_DESC_F_NEXT.
+
+ @param[in,out] Indices Indices->HeadDescIdx is not accessed.
+ On input, Indices->NextDescIdx identifies
+ the next descriptor to carry the buffer.
+ On output, Indices->NextDescIdx is
+ incremented by one, modulo 2^16.
+
+**/
+VOID
+EFIAPI
+VirtioAppendDesc (
+ IN OUT VRING *Ring,
+ IN UINT64 BufferDeviceAddress,
+ IN UINT32 BufferSize,
+ IN UINT16 Flags,
+ IN OUT DESC_INDICES *Indices
+ );
+
+
+/**
+
+ Notify the host about the descriptor chain just built, and wait until the
+ host processes it.
+
+ @param[in] VirtIo The target virtio device to notify.
+
+ @param[in] VirtQueueId Identifies the queue for the target device.
+
+ @param[in,out] Ring The virtio ring with descriptors to submit.
+
+ @param[in] Indices Indices->NextDescIdx is not accessed.
+ Indices->HeadDescIdx identifies the head descriptor
+ of the descriptor chain.
+
+ @param[out] UsedLen On success, the total number of bytes, consecutively
+ across the buffers linked by the descriptor chain,
+ that the host wrote. May be NULL if the caller
+ doesn't care, or can compute the same information
+ from device-specific request structures linked by the
+ descriptor chain.
+
+ @return Error code from VirtIo->SetQueueNotify() if it fails.
+
+ @retval EFI_SUCCESS Otherwise, the host processed all descriptors.
+
+**/
+EFI_STATUS
+EFIAPI
+VirtioFlush (
+ IN VIRTIO_DEVICE_PROTOCOL *VirtIo,
+ IN UINT16 VirtQueueId,
+ IN OUT VRING *Ring,
+ IN DESC_INDICES *Indices,
+ OUT UINT32 *UsedLen OPTIONAL
+ );
+
+
+/**
+
+ Report the feature bits to the VirtIo 1.0 device that the VirtIo 1.0 driver
+ understands.
+
+ In VirtIo 1.0, a device can reject a self-inconsistent feature bitmap through
+ the new VSTAT_FEATURES_OK status bit. (For example if the driver requests a
+ higher level feature but clears a prerequisite feature.) This function is a
+ small wrapper around VIRTIO_DEVICE_PROTOCOL.SetGuestFeatures() that also
+ verifies if the VirtIo 1.0 device accepts the feature bitmap.
+
+ @param[in] VirtIo Report feature bits to this device.
+
+ @param[in] Features The set of feature bits that the driver wishes
+ to report. The caller is responsible to perform
+ any masking before calling this function; the
+ value is directly written with
+ VIRTIO_DEVICE_PROTOCOL.SetGuestFeatures().
+
+ @param[in,out] DeviceStatus On input, the status byte most recently written
+ to the device's status register. On output (even
+ on error), DeviceStatus will be updated so that
+ it is suitable for further status bit
+ manipulation and writing to the device's status
+ register.
+
+ @retval EFI_SUCCESS The device accepted the configuration in Features.
+
+ @return EFI_UNSUPPORTED The device rejected the configuration in Features.
+
+ @retval EFI_UNSUPPORTED VirtIo->Revision is smaller than 1.0.0.
+
+ @return Error codes from the SetGuestFeatures(),
+ SetDeviceStatus(), GetDeviceStatus() member
+ functions.
+
+**/
+EFI_STATUS
+EFIAPI
+Virtio10WriteFeatures (
+ IN VIRTIO_DEVICE_PROTOCOL *VirtIo,
+ IN UINT64 Features,
+ IN OUT UINT8 *DeviceStatus
+ );
+
+/**
+ Provides the virtio device address required to access system memory from a
+ DMA bus master.
+
+ The interface follows the same usage pattern as defined in UEFI spec 2.6
+ (Section 13.2 PCI Root Bridge I/O Protocol)
+
+ The VirtioMapAllBytesInSharedBuffer() is similar to VIRTIO_MAP_SHARED
+ with exception that NumberOfBytes is IN-only parameter. The function
+ maps all the bytes specified in NumberOfBytes param in one consecutive
+ range.
+
+ @param[in] VirtIo The virtio device for which the mapping is
+ requested.
+
+ @param[in] Operation Indicates if the bus master is going to
+ read or write to system memory.
+
+ @param[in] HostAddress The system memory address to map to shared
+ buffer address.
+
+ @param[in] NumberOfBytes Number of bytes to map.
+
+ @param[out] DeviceAddress The resulting shared map address for the
+ bus master to access the hosts HostAddress.
+
+ @param[out] Mapping A resulting token to pass to
+ VIRTIO_UNMAP_SHARED.
+
+
+ @retval EFI_SUCCESS The NumberOfBytes is successfully mapped.
+ @retval EFI_UNSUPPORTED The HostAddress cannot be mapped as a
+ common buffer.
+ @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+ @retval EFI_OUT_OF_RESOURCES The request could not be completed due to
+ a lack of resources. This includes the case
+ when NumberOfBytes bytes cannot be mapped
+ in one consecutive range.
+ @retval EFI_DEVICE_ERROR The system hardware could not map the
+ requested address.
+**/
+EFI_STATUS
+EFIAPI
+VirtioMapAllBytesInSharedBuffer (
+ IN VIRTIO_DEVICE_PROTOCOL *VirtIo,
+ IN VIRTIO_MAP_OPERATION Operation,
+ IN VOID *HostAddress,
+ IN UINTN NumberOfBytes,
+ OUT EFI_PHYSICAL_ADDRESS *DeviceAddress,
+ OUT VOID **Mapping
+ );
+#endif // _VIRTIO_LIB_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/VirtioMmioDeviceLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/VirtioMmioDeviceLib.h
new file mode 100644
index 00000000..81ffa861
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/VirtioMmioDeviceLib.h
@@ -0,0 +1,60 @@
+/** @file
+
+ Definitions for the VirtIo MMIO Device Library
+
+ Copyright (C) 2013, ARM Ltd
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _VIRTIO_MMIO_DEVICE_LIB_H_
+#define _VIRTIO_MMIO_DEVICE_LIB_H_
+
+/**
+
+ Initialize VirtIo Device and Install VIRTIO_DEVICE_PROTOCOL protocol
+
+ @param[in] BaseAddress Base Address of the VirtIo MMIO Device
+
+ @param[in] Handle Handle of the device the driver should be attached
+ to.
+
+ @retval EFI_SUCCESS The VirtIo Device has been installed
+ successfully.
+
+ @retval EFI_OUT_OF_RESOURCES The function failed to allocate memory required
+ by the Virtio MMIO device initialization.
+
+ @retval EFI_UNSUPPORTED BaseAddress does not point to a VirtIo MMIO
+ device.
+
+ @return Status code returned by InstallProtocolInterface
+ Boot Service function.
+
+**/
+EFI_STATUS
+VirtioMmioInstallDevice (
+ IN PHYSICAL_ADDRESS BaseAddress,
+ IN EFI_HANDLE Handle
+ );
+
+/**
+
+ Uninstall the VirtIo Device
+
+ @param[in] Handle Handle of the device where the VirtIo Device protocol
+ should have been installed.
+
+ @retval EFI_SUCCESS The device has been un-initialized successfully.
+
+ @return Status code returned by UninstallProtocolInterface
+ Boot Service function.
+
+**/
+EFI_STATUS
+VirtioMmioUninstallDevice (
+ IN EFI_HANDLE Handle
+ );
+
+#endif // _VIRTIO_MMIO_DEVICE_LIB_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/XenHypercallLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/XenHypercallLib.h
new file mode 100644
index 00000000..67f17406
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/XenHypercallLib.h
@@ -0,0 +1,104 @@
+/** @file
+ Functions declarations to make Xen hypercalls.
+
+ Copyright (C) 2014, Citrix Ltd.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __XEN_HYPERCALL_LIB_H__
+#define __XEN_HYPERCALL_LIB_H__
+
+/**
+ To call when the gEfiXenInfoGuid HOB became available after the library init
+ function has already been executed.
+
+ This allow to make hypercall in the PEIM stage.
+**/
+RETURN_STATUS
+EFIAPI
+XenHypercallLibInit (
+ VOID
+ );
+
+/**
+ Check if the Xen Hypercall library is able to make calls to the Xen
+ hypervisor.
+
+ Client code should call further functions in this library only if, and after,
+ this function returns TRUE.
+
+ @retval TRUE Hypercalls are available.
+ @retval FALSE Hypercalls are not available.
+**/
+BOOLEAN
+EFIAPI
+XenHypercallIsAvailable (
+ VOID
+ );
+
+/**
+ This function will put the two arguments in the right place (registers) and
+ invoke the hypercall identified by HypercallID.
+
+ @param HypercallID The symbolic ID of the hypercall to be invoked
+ @param Arg1 First argument.
+ @param Arg2 Second argument.
+
+ @return Return 0 if success otherwise it return an errno.
+**/
+INTN
+EFIAPI
+XenHypercall2 (
+ IN UINTN HypercallID,
+ IN OUT INTN Arg1,
+ IN OUT INTN Arg2
+ );
+
+/**
+ Return the value of the HVM parameter Index.
+
+ @param Index The parameter to get, e.g. HVM_PARAM_STORE_EVTCHN.
+
+ @return The value of the asked parameter or 0 in case of error.
+**/
+UINT64
+EFIAPI
+XenHypercallHvmGetParam (
+ UINT32 Index
+ );
+
+/**
+ Hypercall to do different operation on the memory.
+
+ @param Operation The operation number, e.g. XENMEM_add_to_physmap.
+ @param Arguments The arguments associated to the operation.
+
+ @return Return the return value from the hypercall, 0 in case of success
+ otherwise, an error code.
+**/
+INTN
+EFIAPI
+XenHypercallMemoryOp (
+ IN UINTN Operation,
+ IN OUT VOID *Arguments
+ );
+
+/**
+ Do an operation on the event channels.
+
+ @param Operation The operation number, e.g. EVTCHNOP_send.
+ @param Arguments The argument associated to the operation.
+
+ @return Return the return value from the hypercall, 0 in case of success
+ otherwise, an error code.
+**/
+INTN
+EFIAPI
+XenHypercallEventChannelOp (
+ IN INTN Operation,
+ IN OUT VOID *Arguments
+ );
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/XenIoMmioLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/XenIoMmioLib.h
new file mode 100644
index 00000000..5338ef9a
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/XenIoMmioLib.h
@@ -0,0 +1,58 @@
+/** @file
+* Manage XenBus device path and I/O handles
+*
+* Copyright (c) 2015, Linaro Ltd. All rights reserved.<BR>
+*
+* SPDX-License-Identifier: BSD-2-Clause-Patent
+*
+**/
+
+#ifndef _XENIO_MMIO_DEVICE_LIB_H_
+#define _XENIO_MMIO_DEVICE_LIB_H_
+
+/**
+
+ Install the XENBUS_ROOT_DEVICE_PATH and XENIO_PROTOCOL protocols on
+ the handle pointed to by @Handle, or on a new handle if it points to
+ NULL
+
+ @param Handle Pointer to the handle to install the protocols
+ on, may point to a NULL handle.
+
+ @param GrantTableAddress The address of the Xen grant table
+
+ @retval EFI_SUCCESS Protocols were installed successfully
+
+ @retval EFI_OUT_OF_RESOURCES The function failed to allocate memory required
+ by the XenIo MMIO and device path protocols
+
+ @return Status code returned by the boot service
+ InstallMultipleProtocolInterfaces ()
+
+**/
+EFI_STATUS
+XenIoMmioInstall (
+ IN OUT EFI_HANDLE *Handle,
+ IN EFI_PHYSICAL_ADDRESS GrantTableAddress
+ );
+
+
+/**
+
+ Uninstall the XENBUS_ROOT_DEVICE_PATH and XENIO_PROTOCOL protocols
+
+ @param Handle Handle onto which the protocols have been installed
+ earlier by XenIoMmioInstall ()
+
+ @retval EFI_SUCCESS Protocols were uninstalled successfully
+
+ @return Status code returned by the boot service
+ UninstallMultipleProtocolInterfaces ()
+
+**/
+EFI_STATUS
+XenIoMmioUninstall (
+ IN EFI_HANDLE Handle
+ );
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/XenPlatformLib.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/XenPlatformLib.h
new file mode 100644
index 00000000..11a49aaf
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Library/XenPlatformLib.h
@@ -0,0 +1,53 @@
+/** @file
+ Get information about Xen
+
+ This library simply allow to find out if OVMF is running under Xen and
+ allow to get more information when it is the case.
+
+ Copyright (c) 2019, Citrix Systems, Inc.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef _XEN_PLATFORM_LIB_H_
+#define _XEN_PLATFORM_LIB_H_
+
+#include <Guid/XenInfo.h>
+
+/**
+ This function detects if OVMF is running on Xen.
+
+ @retval TRUE OVMF is running on Xen
+ @retval FALSE Xen has not been detected
+**/
+BOOLEAN
+EFIAPI
+XenDetected (
+ VOID
+ );
+
+/**
+ This function detect if OVMF have started via the PVH entry point.
+
+ @retval TRUE PVH entry point as been used
+ @retval FALSE OVMF have started via the HVM route
+**/
+BOOLEAN
+EFIAPI
+XenPvhDetected (
+ VOID
+ );
+
+/**
+ This function return a pointer to the XenInfo HOB.
+
+ @return XenInfo pointer or NULL if not available
+**/
+EFI_XEN_INFO *
+EFIAPI
+XenGetInfoHOB (
+ VOID
+ );
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/OvmfPlatforms.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/OvmfPlatforms.h
new file mode 100644
index 00000000..588e061e
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/OvmfPlatforms.h
@@ -0,0 +1,41 @@
+/** @file
+ OVMF Platform definitions
+
+ Copyright (C) 2015, Red Hat, Inc.
+ Copyright (c) 2014, Gabriel L. Somlo <somlo@cmu.edu>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __OVMF_PLATFORMS_H__
+#define __OVMF_PLATFORMS_H__
+
+#include <Library/PciLib.h>
+#include <IndustryStandard/Pci22.h>
+#include <IndustryStandard/Q35MchIch9.h>
+#include <IndustryStandard/I440FxPiix4.h>
+#include <IndustryStandard/Bhyve.h>
+
+//
+// OVMF Host Bridge DID Address
+//
+#define OVMF_HOSTBRIDGE_DID \
+ PCI_LIB_ADDRESS (0, 0, 0, PCI_DEVICE_ID_OFFSET)
+
+//
+// Values we program into the PM base address registers
+//
+#define PIIX4_PMBA_VALUE 0xB000
+#define ICH9_PMBASE_VALUE 0x0600
+
+//
+// Common bits in same-purpose registers
+//
+#define PMBA_RTE BIT0
+
+//
+// Common IO ports relative to the Power Management Base Address
+//
+#define ACPI_TIMER_OFFSET 0x8
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Pcd/CpuHotEjectData.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Pcd/CpuHotEjectData.h
new file mode 100644
index 00000000..01d7c8a9
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Pcd/CpuHotEjectData.h
@@ -0,0 +1,60 @@
+/** @file
+ Definition for the CPU_HOT_EJECT_DATA structure, which shares
+ CPU hot-eject state between OVMF's SmmCpuFeaturesLib instance in
+ PiSmmCpuDxeSmm, and CpuHotplugSmm.
+
+ CPU_HOT_EJECT_DATA is allocated in SMRAM, and pointed-to by
+ PcdCpuHotEjectDataAddress.
+
+ PcdCpuHotEjectDataAddress is valid when SMM_REQUIRE is TRUE
+ and PcdCpuMaxLogicalProcessorNumber > 1.
+
+ Copyright (C) 2021, Oracle Corporation.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef CPU_HOT_EJECT_DATA_H_
+#define CPU_HOT_EJECT_DATA_H_
+
+/**
+ CPU Hot-eject handler, called from SmmCpuFeaturesRendezvousExit()
+ on each CPU at exit from SMM.
+
+ @param[in] ProcessorNum ProcessorNum denotes the CPU exiting SMM,
+ and will be used as an index into
+ CPU_HOT_EJECT_DATA->QemuSelectorMap. It is
+ identical to the processor handle in
+ EFI_SMM_CPU_SERVICE_PROTOCOL.
+**/
+typedef
+VOID
+(EFIAPI *CPU_HOT_EJECT_HANDLER) (
+ IN UINTN ProcessorNum
+ );
+
+//
+// CPU_EJECT_QEMU_SELECTOR_INVALID marks CPUs not being ejected in
+// CPU_HOT_EJECT_DATA->QemuSelectorMap.
+//
+// QEMU CPU Selector is UINT32, so we choose an invalid value larger
+// than that type.
+//
+#define CPU_EJECT_QEMU_SELECTOR_INVALID (MAX_UINT64)
+
+typedef struct {
+ //
+ // Maps ProcessorNum -> QemuSelector for pending hot-ejects
+ //
+ volatile UINT64 *QemuSelectorMap;
+ //
+ // Handler to do the CPU ejection
+ //
+ volatile CPU_HOT_EJECT_HANDLER Handler;
+ //
+ // Entries in the QemuSelectorMap
+ //
+ UINT32 ArrayLength;
+} CPU_HOT_EJECT_DATA;
+
+#endif // CPU_HOT_EJECT_DATA_H_
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/Legacy8259.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/Legacy8259.h
new file mode 100644
index 00000000..65444086
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/Legacy8259.h
@@ -0,0 +1,291 @@
+/** @file
+ This protocol abstracts the 8259 interrupt controller. This includes
+ PCI IRQ routing needed to program the PCI Interrupt Line register.
+
+Copyright (c) 2007 - 2018, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+ @par Revision Reference:
+ This protocol is defined in Framework for EFI Compatibility Support Module spec
+ Version 0.97.
+
+**/
+
+#ifndef _EFI_LEGACY_8259_H_
+#define _EFI_LEGACY_8259_H_
+
+
+#define EFI_LEGACY_8259_PROTOCOL_GUID \
+ { \
+ 0x38321dba, 0x4fe0, 0x4e17, {0x8a, 0xec, 0x41, 0x30, 0x55, 0xea, 0xed, 0xc1 } \
+ }
+
+typedef struct _EFI_LEGACY_8259_PROTOCOL EFI_LEGACY_8259_PROTOCOL;
+
+typedef enum {
+ Efi8259Irq0,
+ Efi8259Irq1,
+ Efi8259Irq2,
+ Efi8259Irq3,
+ Efi8259Irq4,
+ Efi8259Irq5,
+ Efi8259Irq6,
+ Efi8259Irq7,
+ Efi8259Irq8,
+ Efi8259Irq9,
+ Efi8259Irq10,
+ Efi8259Irq11,
+ Efi8259Irq12,
+ Efi8259Irq13,
+ Efi8259Irq14,
+ Efi8259Irq15,
+ Efi8259IrqMax
+} EFI_8259_IRQ;
+
+typedef enum {
+ Efi8259LegacyMode,
+ Efi8259ProtectedMode,
+ Efi8259MaxMode
+} EFI_8259_MODE;
+
+/**
+ Get the 8259 interrupt masks for Irq0 - Irq15. A different mask exists for
+ the legacy mode mask and the protected mode mask. The base address for the 8259
+ is different for legacy and protected mode, so two masks are required.
+
+ @param This The protocol instance pointer.
+ @param MasterBase The base vector for the Master PIC in the 8259 controller.
+ @param SlaveBase The base vector for the Slave PIC in the 8259 controller.
+
+ @retval EFI_SUCCESS The new bases were programmed.
+ @retval EFI_DEVICE_ERROR A device error occurred programming the vector bases.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LEGACY_8259_SET_VECTOR_BASE)(
+ IN EFI_LEGACY_8259_PROTOCOL *This,
+ IN UINT8 MasterBase,
+ IN UINT8 SlaveBase
+ );
+
+/**
+ Get the 8259 interrupt masks for Irq0 - Irq15. A different mask exists for
+ the legacy mode mask and the protected mode mask. The base address for the 8259
+ is different for legacy and protected mode, so two masks are required.
+
+ @param This The protocol instance pointer.
+ @param LegacyMask Bit 0 is Irq0 - Bit 15 is Irq15.
+ @param LegacyEdgeLevel Bit 0 is Irq0 - Bit 15 is Irq15.
+ @param ProtectedMask Bit 0 is Irq0 - Bit 15 is Irq15.
+ @param ProtectedEdgeLevel Bit 0 is Irq0 - Bit 15 is Irq15.
+
+ @retval EFI_SUCCESS 8259 status returned.
+ @retval EFI_DEVICE_ERROR Error reading 8259.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LEGACY_8259_GET_MASK)(
+ IN EFI_LEGACY_8259_PROTOCOL *This,
+ OUT UINT16 *LegacyMask, OPTIONAL
+ OUT UINT16 *LegacyEdgeLevel, OPTIONAL
+ OUT UINT16 *ProtectedMask, OPTIONAL
+ OUT UINT16 *ProtectedEdgeLevel OPTIONAL
+ );
+
+/**
+ Set the 8259 interrupt masks for Irq0 - Irq15. A different mask exists for
+ the legacy mode mask and the protected mode mask. The base address for the 8259
+ is different for legacy and protected mode, so two masks are required.
+ Also set the edge/level masks.
+
+ @param This The protocol instance pointer.
+ @param LegacyMask Bit 0 is Irq0 - Bit 15 is Irq15.
+ @param LegacyEdgeLevel Bit 0 is Irq0 - Bit 15 is Irq15.
+ @param ProtectedMask Bit 0 is Irq0 - Bit 15 is Irq15.
+ @param ProtectedEdgeLevel Bit 0 is Irq0 - Bit 15 is Irq15.
+
+ @retval EFI_SUCCESS 8259 status returned.
+ @retval EFI_DEVICE_ERROR Error writing 8259.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LEGACY_8259_SET_MASK)(
+ IN EFI_LEGACY_8259_PROTOCOL *This,
+ IN UINT16 *LegacyMask, OPTIONAL
+ IN UINT16 *LegacyEdgeLevel, OPTIONAL
+ IN UINT16 *ProtectedMask, OPTIONAL
+ IN UINT16 *ProtectedEdgeLevel OPTIONAL
+ );
+
+/**
+ Set the 8259 mode of operation. The base address for the 8259 is different for
+ legacy and protected mode. The legacy mode requires the master 8259 to have a
+ master base of 0x08 and the slave base of 0x70. The protected mode base locations
+ are not defined. Interrupts must be masked by the caller before this function
+ is called. The interrupt mask from the current mode is saved. The interrupt
+ mask for the new mode is Mask, or if Mask does not exist the previously saved
+ mask is used.
+
+ @param This The protocol instance pointer.
+ @param Mode The mode of operation. i.e. the real mode or protected mode.
+ @param Mask Optional interupt mask for the new mode.
+ @param EdgeLevel Optional trigger mask for the new mode.
+
+ @retval EFI_SUCCESS 8259 programmed.
+ @retval EFI_DEVICE_ERROR Error writing to 8259.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LEGACY_8259_SET_MODE)(
+ IN EFI_LEGACY_8259_PROTOCOL *This,
+ IN EFI_8259_MODE Mode,
+ IN UINT16 *Mask, OPTIONAL
+ IN UINT16 *EdgeLevel OPTIONAL
+ );
+
+/**
+ Convert from IRQ to processor interrupt vector number.
+
+ @param This The protocol instance pointer.
+ @param Irq 8259 IRQ0 - IRQ15.
+ @param Vector The processor vector number that matches an Irq.
+
+ @retval EFI_SUCCESS The Vector matching Irq is returned.
+ @retval EFI_INVALID_PARAMETER The Irq not valid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LEGACY_8259_GET_VECTOR)(
+ IN EFI_LEGACY_8259_PROTOCOL *This,
+ IN EFI_8259_IRQ Irq,
+ OUT UINT8 *Vector
+ );
+
+/**
+ Enable Irq by unmasking interrupt in 8259
+
+ @param This The protocol instance pointer.
+ @param Irq 8259 IRQ0 - IRQ15.
+ @param LevelTriggered TRUE if level triggered. FALSE if edge triggered.
+
+ @retval EFI_SUCCESS The Irq was enabled on 8259.
+ @retval EFI_INVALID_PARAMETER The Irq is not valid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LEGACY_8259_ENABLE_IRQ)(
+ IN EFI_LEGACY_8259_PROTOCOL *This,
+ IN EFI_8259_IRQ Irq,
+ IN BOOLEAN LevelTriggered
+ );
+
+/**
+ Disable Irq by masking interrupt in 8259
+
+ @param This The protocol instance pointer.
+ @param Irq 8259 IRQ0 - IRQ15.
+
+ @retval EFI_SUCCESS The Irq was disabled on 8259.
+ @retval EFI_INVALID_PARAMETER The Irq is not valid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LEGACY_8259_DISABLE_IRQ)(
+ IN EFI_LEGACY_8259_PROTOCOL *This,
+ IN EFI_8259_IRQ Irq
+ );
+
+/**
+ PciHandle represents a PCI config space of a PCI function. Vector
+ represents Interrupt Pin (from PCI config space) and it is the data
+ that is programmed into the Interrupt Line (from the PCI config space)
+ register.
+
+ @param This The protocol instance pointer.
+ @param PciHandle The PCI function to return the vector for.
+ @param Vector The vector for the function it matches.
+
+ @retval EFI_SUCCESS A valid Vector was returned.
+ @retval EFI_INVALID_PARAMETER PciHandle not valid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LEGACY_8259_GET_INTERRUPT_LINE)(
+ IN EFI_LEGACY_8259_PROTOCOL *This,
+ IN EFI_HANDLE PciHandle,
+ OUT UINT8 *Vector
+ );
+
+/**
+ Send an EOI to 8259
+
+ @param This The protocol instance pointer.
+ @param Irq 8259 IRQ0 - IRQ15.
+
+ @retval EFI_SUCCESS EOI was successfully sent to 8259.
+ @retval EFI_INVALID_PARAMETER The Irq isnot valid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_LEGACY_8259_END_OF_INTERRUPT)(
+ IN EFI_LEGACY_8259_PROTOCOL *This,
+ IN EFI_8259_IRQ Irq
+ );
+
+/**
+ @par Protocol Description:
+ Abstracts the 8259 and APIC hardware control between EFI usage and
+ Compatibility16 usage.
+
+ @param SetVectorBase
+ Sets the vector bases for master and slave PICs.
+
+ @param GetMask
+ Gets IRQ and edge/level masks for 16-bit real mode and 32-bit protected mode.
+
+ @param SetMask
+ Sets the IRQ and edge\level masks for 16-bit real mode and 32-bit protected mode.
+
+ @param SetMode
+ Sets PIC mode to 16-bit real mode or 32-bit protected mode.
+
+ @param GetVector
+ Gets the base vector assigned to an IRQ.
+
+ @param EnableIrq
+ Enables an IRQ.
+
+ @param DisableIrq
+ Disables an IRQ.
+
+ @param GetInterruptLine
+ Gets an IRQ that is assigned to a PCI device.
+
+ @param EndOfInterrupt
+ Issues the end of interrupt command.
+
+**/
+struct _EFI_LEGACY_8259_PROTOCOL {
+ EFI_LEGACY_8259_SET_VECTOR_BASE SetVectorBase;
+ EFI_LEGACY_8259_GET_MASK GetMask;
+ EFI_LEGACY_8259_SET_MASK SetMask;
+ EFI_LEGACY_8259_SET_MODE SetMode;
+ EFI_LEGACY_8259_GET_VECTOR GetVector;
+ EFI_LEGACY_8259_ENABLE_IRQ EnableIrq;
+ EFI_LEGACY_8259_DISABLE_IRQ DisableIrq;
+ EFI_LEGACY_8259_GET_INTERRUPT_LINE GetInterruptLine;
+ EFI_LEGACY_8259_END_OF_INTERRUPT EndOfInterrupt;
+};
+
+extern EFI_GUID gEfiLegacy8259ProtocolGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/OvmfLoadedX86LinuxKernel.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/OvmfLoadedX86LinuxKernel.h
new file mode 100644
index 00000000..ae9ed32f
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/OvmfLoadedX86LinuxKernel.h
@@ -0,0 +1,32 @@
+/** @file
+ Protocol/GUID definition to describe a x86 Linux kernel image loaded
+ into memory.
+
+ Note that this protocol is considered internal ABI, and may be change
+ structure at any time without regard for backward compatibility.
+
+ Copyright (c) 2020, Arm, Ltd. All rights reserved.<BR>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef OVMF_LOADED_X86_LINUX_KERNEL_H__
+#define OVMF_LOADED_X86_LINUX_KERNEL_H__
+
+#define OVMF_LOADED_X86_LINUX_KERNEL_PROTOCOL_GUID \
+ {0xa3edc05d, 0xb618, 0x4ff6, {0x95, 0x52, 0x76, 0xd7, 0x88, 0x63, 0x43, 0xc8}}
+
+typedef struct {
+ VOID *SetupBuf;
+ VOID *KernelBuf;
+ CHAR8 *CommandLine;
+ VOID *InitrdData;
+ UINTN SetupSize;
+ UINTN KernelInitialSize;
+ UINTN InitrdSize;
+ UINTN CommandLineSize;
+} OVMF_LOADED_X86_LINUX_KERNEL;
+
+extern EFI_GUID gOvmfLoadedX86LinuxKernelProtocolGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/VirtioDevice.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/VirtioDevice.h
new file mode 100644
index 00000000..d026fe03
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/VirtioDevice.h
@@ -0,0 +1,520 @@
+/** @file
+ Virtio Device
+
+ DISCLAIMER: the VIRTIO_DEVICE_PROTOCOL introduced here is a work in progress,
+ and should not be used outside of the EDK II tree.
+
+ Copyright (c) 2013, ARM Ltd. All rights reserved.<BR>
+ Copyright (c) 2017, AMD Inc, All rights reserved.<BR>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __VIRTIO_DEVICE_H__
+#define __VIRTIO_DEVICE_H__
+
+#include <IndustryStandard/Virtio.h>
+
+//
+// VirtIo Specification Revision: Major[31:24].Minor[23:16].Revision[15:0]
+//
+#define VIRTIO_SPEC_REVISION(major,minor,revision) \
+ ((((major) & 0xFF) << 24) | (((minor) & 0xFF) << 16) | ((revision) & 0xFFFF))
+
+#define VIRTIO_DEVICE_PROTOCOL_GUID { \
+ 0xfa920010, 0x6785, 0x4941, {0xb6, 0xec, 0x49, 0x8c, 0x57, 0x9f, 0x16, 0x0a }\
+ }
+
+typedef struct _VIRTIO_DEVICE_PROTOCOL VIRTIO_DEVICE_PROTOCOL;
+
+//
+// VIRTIO Operation for VIRTIO_MAP_SHARED
+//
+typedef enum {
+ //
+ // A read operation from system memory by a bus master
+ //
+ VirtioOperationBusMasterRead,
+ //
+ // A write operation to system memory by a bus master
+ //
+ VirtioOperationBusMasterWrite,
+ //
+ // Provides both read and write access to system memory by both the
+ // processor and a bus master
+ //
+ VirtioOperationBusMasterCommonBuffer,
+} VIRTIO_MAP_OPERATION;
+
+/**
+
+ Read a word from the device-specific I/O region of the Virtio Header.
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[in] FieldOffset Source offset.
+
+ @param[in] FieldSize Source field size in bytes, must be in {1, 2, 4, 8}.
+
+ @param[in] BufferSize Number of bytes available in the target buffer. Must
+ equal FieldSize.
+
+ @param[out] Buffer Target buffer.
+
+ @retval EFI_SUCCESS The data was read successfully.
+ @retval EFI_UNSUPPORTED The underlying IO device doesn't support the
+ provided address offset and read size.
+ @retval EFI_OUT_OF_RESOURCES The request could not be completed due to a
+ lack of resources.
+ @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_DEVICE_READ) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN UINTN FieldOffset,
+ IN UINTN FieldSize,
+ IN UINTN BufferSize,
+ OUT VOID *Buffer
+ );
+
+/**
+
+ Write a word to the device-specific I/O region of the Virtio Header.
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[in] FieldOffset Destination offset.
+
+ @param[in] FieldSize Destination field size in bytes,
+ must be in {1, 2, 4, 8}.
+
+ @param[out] Value Value to write.
+
+ @retval EFI_SUCCESS The data was written successfully.
+ @retval EFI_UNSUPPORTED The underlying IO device doesn't support the
+ provided address offset and write size.
+ @retval EFI_OUT_OF_RESOURCES The request could not be completed due to a
+ lack of resources.
+ @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_DEVICE_WRITE) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN UINTN FieldOffset,
+ IN UINTN FieldSize,
+ IN UINT64 Value
+ );
+
+/**
+ Read the device features field from the Virtio Header.
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[out] DeviceFeatures The device features field.
+
+ @retval EFI_SUCCESS The data was read successfully.
+ @retval EFI_UNSUPPORTED The underlying IO device doesn't support the
+ provided address offset and read size.
+ @retval EFI_INVALID_PARAMETER DeviceFeatures is NULL
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_GET_DEVICE_FEATURES) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ OUT UINT64 *DeviceFeatures
+ );
+
+/**
+ Write the guest features field in the Virtio Header.
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[in] Features The guest features field
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_SET_GUEST_FEATURES) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN UINT64 Features
+ );
+
+/**
+ Write the queue address field(s) in the Virtio Header.
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[in] Ring The initialized VRING object to take the
+ addresses from. The caller is responsible for
+ ensuring that on input, all Ring->NumPages pages,
+ starting at Ring->Base, have been successfully
+ mapped with a single call to
+ This->MapSharedBuffer() for CommonBuffer bus
+ master operation.
+
+ @param[in] RingBaseShift Adding this value using UINT64 arithmetic to the
+ addresses found in Ring translates them from
+ system memory to bus addresses. The caller shall
+ calculate RingBaseShift as
+ (DeviceAddress - (UINT64)(UINTN)HostAddress),
+ where DeviceAddress and HostAddress (i.e.,
+ Ring->Base) were output and input parameters of
+ This->MapSharedBuffer(), respectively.
+
+ @retval EFI_SUCCESS The data was written successfully.
+ @retval EFI_UNSUPPORTED The underlying IO device doesn't support the
+ provided address offset and write size.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_SET_QUEUE_ADDRESS) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN VRING *Ring,
+ IN UINT64 RingBaseShift
+ );
+
+/**
+
+ Write the queue select field in the Virtio Header.
+
+ Writing to the queue select field sets the index of the queue to which
+ operations such as SetQueueAlign and GetQueueNumMax apply.
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[in] Index The index of the queue to select
+
+ @retval EFI_SUCCESS The data was written successfully.
+ @retval EFI_UNSUPPORTED The underlying IO device doesn't support the
+ provided address offset and write size.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_SET_QUEUE_SEL) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN UINT16 Index
+ );
+
+/**
+
+ Write the queue notify field in the Virtio Header.
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[in] Address The 32-bit Queue Notify field
+
+ @retval EFI_SUCCESS The data was written successfully.
+ @retval EFI_UNSUPPORTED The underlying IO device doesn't support the
+ provided address offset and write size.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_SET_QUEUE_NOTIFY) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN UINT16 Index
+ );
+
+/**
+ Write the queue alignment field in the Virtio Header.
+
+ The queue to which the alignment applies is selected by the Queue Select
+ field.
+
+ Note: This operation is not implemented by the VirtIo over PCI. The PCI
+ implementation of this protocol returns EFI_SUCCESS.
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[in] Alignment The alignment boundary of the Used Ring in bytes.
+ Must be a power of 2.
+
+ @retval EFI_SUCCESS The data was written successfully.
+ @retval EFI_UNSUPPORTED The underlying IO device doesn't support the
+ provided address offset and write size.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_SET_QUEUE_ALIGN) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN UINT32 Alignment
+ );
+
+/**
+ Write the guest page size.
+
+ Note: This operation is not implemented by the VirtIo over PCI. The PCI
+ implementation of this protocol returns EFI_SUCCESS.
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[in] PageSize Size of the Guest page in bytes.
+ Must be a power of 2.
+
+ @retval EFI_SUCCESS The data was written successfully.
+ @retval EFI_UNSUPPORTED The underlying IO device doesn't support the
+ provided address offset and write size.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_SET_PAGE_SIZE) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN UINT32 PageSize
+ );
+
+/**
+
+ Get the size of the virtqueue selected by the queue select field.
+
+ See Virtio spec Section 2.3
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[out] QueueNumMax The size of the virtqueue in bytes.
+ Always a power of 2.
+
+ @retval EFI_SUCCESS The data was read successfully.
+ @retval EFI_UNSUPPORTED The underlying IO device doesn't support the
+ provided address offset and read size.
+ @retval EFI_INVALID_PARAMETER QueueNumMax is NULL
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_GET_QUEUE_NUM_MAX) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ OUT UINT16 *QueueNumMax
+ );
+
+/**
+
+ Write to the QueueNum field in the Virtio Header.
+
+ This function only applies to Virtio-MMIO and may be a stub for other
+ implementations. See Virtio Spec appendix X.
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[in] QueueSize The number of elements in the queue.
+
+ @retval EFI_SUCCESS The data was written successfully.
+ @retval EFI_UNSUPPORTED The underlying IO device doesn't support the
+ provided address offset and write size.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_SET_QUEUE_NUM) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN UINT16 QueueSize
+ );
+
+/**
+
+ Get the DeviceStatus field from the Virtio Header.
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[out] DeviceStatus The 8-bit value for the Device status field
+
+ @retval EFI_SUCCESS The data was read successfully.
+ @retval EFI_UNSUPPORTED The underlying IO device doesn't support the
+ provided address offset and read size.
+ @retval EFI_INVALID_PARAMETER DeviceStatus is NULL
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_GET_DEVICE_STATUS) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ OUT UINT8 *DeviceStatus
+ );
+
+/**
+
+ Write the DeviceStatus field in the Virtio Header.
+
+ @param[in] This This instance of VIRTIO_DEVICE_PROTOCOL
+
+ @param[in] DeviceStatus The 8-bit value for the Device status field
+
+ @retval EFI_SUCCESS The data was written successfully.
+ @retval EFI_UNSUPPORTED The underlying IO device doesn't support the
+ provided address offset and write size.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_SET_DEVICE_STATUS) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN UINT8 DeviceStatus
+ );
+
+/**
+
+ Allocates pages that are suitable for an VirtioOperationBusMasterCommonBuffer
+ mapping. This means that the buffer allocated by this function supports
+ simultaneous access by both the processor and the bus master. The device
+ address that the bus master uses to access the buffer must be retrieved with
+ a call to VIRTIO_MAP_SHARED.
+
+ @param[in] This The protocol instance pointer.
+
+ @param[in] Pages The number of pages to allocate.
+
+ @param[in,out] HostAddress A pointer to store the system memory base
+ address of the allocated range.
+
+ @retval EFI_SUCCESS The requested memory pages were allocated.
+ @retval EFI_OUT_OF_RESOURCES The memory pages could not be allocated.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_ALLOCATE_SHARED)(
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN UINTN Pages,
+ IN OUT VOID **HostAddress
+ );
+
+/**
+ Frees memory that was allocated with VIRTIO_ALLOCATE_SHARED.
+
+ @param[in] This The protocol instance pointer.
+
+ @param[in] Pages The number of pages to free.
+
+ @param[in] HostAddress The system memory base address of the allocated
+ range.
+
+**/
+typedef
+VOID
+(EFIAPI *VIRTIO_FREE_SHARED)(
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN UINTN Pages,
+ IN VOID *HostAddress
+ );
+
+/**
+ Provides the virtio device address required to access system memory from a
+ DMA bus master.
+
+ The interface follows the same usage pattern as defined in UEFI spec 2.6
+ (Section 13.2 PCI Root Bridge I/O Protocol)
+
+ @param[in] This The protocol instance pointer.
+
+ @param[in] Operation Indicates if the bus master is going to
+ read or write to system memory.
+
+ @param[in] HostAddress The system memory address to map to shared
+ buffer address.
+
+ @param[in,out] NumberOfBytes On input the number of bytes to map.
+ On output the number of bytes that were
+ mapped.
+
+ @param[out] DeviceAddress The resulting shared map address for the
+ bus master to access the hosts HostAddress.
+
+ @param[out] Mapping A resulting token to pass to
+ VIRTIO_UNMAP_SHARED.
+
+ @retval EFI_SUCCESS The range was mapped for the returned
+ NumberOfBytes.
+ @retval EFI_UNSUPPORTED The HostAddress cannot be mapped as a
+ common buffer.
+ @retval EFI_INVALID_PARAMETER One or more parameters are invalid.
+ @retval EFI_OUT_OF_RESOURCES The request could not be completed due to
+ a lack of resources.
+ @retval EFI_DEVICE_ERROR The system hardware could not map the
+ requested address.
+**/
+
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_MAP_SHARED) (
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN VIRTIO_MAP_OPERATION Operation,
+ IN VOID *HostAddress,
+ IN OUT UINTN *NumberOfBytes,
+ OUT EFI_PHYSICAL_ADDRESS *DeviceAddress,
+ OUT VOID **Mapping
+ );
+
+/**
+ Completes the VIRTIO_MAP_SHARED operation and releases any corresponding
+ resources.
+
+ @param[in] This The protocol instance pointer.
+
+ @param[in] Mapping The mapping token returned from
+ VIRTIO_MAP_SHARED.
+
+ @retval EFI_SUCCESS The range was unmapped.
+ @retval EFI_INVALID_PARAMETER Mapping is not a value that was returned by
+ VIRTIO_MAP_SHARED. Passing an invalid Mapping
+ token can cause undefined behavior.
+ @retval EFI_DEVICE_ERROR The data was not committed to the target
+ system memory.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *VIRTIO_UNMAP_SHARED)(
+ IN VIRTIO_DEVICE_PROTOCOL *This,
+ IN VOID *Mapping
+ );
+
+///
+/// This protocol provides an abstraction over the VirtIo transport layer
+///
+/// DISCLAIMER: this protocol is a work in progress, and should not be used
+/// outside of the EDK II tree.
+///
+struct _VIRTIO_DEVICE_PROTOCOL {
+ //
+ // VirtIo Specification Revision encoded with VIRTIO_SPEC_REVISION()
+ //
+ UINT32 Revision;
+ //
+ // From the Virtio Spec
+ //
+ INT32 SubSystemDeviceId;
+
+ VIRTIO_GET_DEVICE_FEATURES GetDeviceFeatures;
+ VIRTIO_SET_GUEST_FEATURES SetGuestFeatures;
+
+ VIRTIO_SET_QUEUE_ADDRESS SetQueueAddress;
+
+ VIRTIO_SET_QUEUE_SEL SetQueueSel;
+
+ VIRTIO_SET_QUEUE_NOTIFY SetQueueNotify;
+
+ VIRTIO_SET_QUEUE_ALIGN SetQueueAlign;
+ VIRTIO_SET_PAGE_SIZE SetPageSize;
+
+ VIRTIO_GET_QUEUE_NUM_MAX GetQueueNumMax;
+ VIRTIO_SET_QUEUE_NUM SetQueueNum;
+
+ VIRTIO_GET_DEVICE_STATUS GetDeviceStatus;
+ VIRTIO_SET_DEVICE_STATUS SetDeviceStatus;
+
+ //
+ // Functions to read/write Device Specific headers
+ //
+ VIRTIO_DEVICE_WRITE WriteDevice;
+ VIRTIO_DEVICE_READ ReadDevice;
+
+ //
+ // Functions to allocate, free, map and unmap shared buffer
+ //
+ VIRTIO_ALLOCATE_SHARED AllocateSharedPages;
+ VIRTIO_FREE_SHARED FreeSharedPages;
+ VIRTIO_MAP_SHARED MapSharedBuffer;
+ VIRTIO_UNMAP_SHARED UnmapSharedBuffer;
+};
+
+extern EFI_GUID gVirtioDeviceProtocolGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/XenBus.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/XenBus.h
new file mode 100644
index 00000000..4e166e30
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/XenBus.h
@@ -0,0 +1,410 @@
+
+/** @file
+ XenBus protocol to be used between the XenBus bus driver and Xen PV devices.
+
+ DISCLAIMER: the XENBUS_PROTOCOL introduced here is a work in progress, and
+ should not be used outside of the EDK II tree.
+
+ This protocol provide the necessary for a Xen PV driver frontend to
+ communicate with the bus driver, and perform several task to
+ initialize/shutdown a PV device and perform IO with a PV backend.
+
+ Copyright (C) 2014, Citrix Ltd.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __PROTOCOL_XENBUS_H__
+#define __PROTOCOL_XENBUS_H__
+
+#define XENBUS_PROTOCOL_GUID \
+ {0x3d3ca290, 0xb9a5, 0x11e3, {0xb7, 0x5d, 0xb8, 0xac, 0x6f, 0x7d, 0x65, 0xe6}}
+
+///
+/// Forward declaration
+///
+typedef struct _XENBUS_PROTOCOL XENBUS_PROTOCOL;
+
+typedef enum xenbus_state XenBusState;
+
+typedef struct
+{
+ UINT32 Id;
+} XENSTORE_TRANSACTION;
+
+#define XST_NIL ((XENSTORE_TRANSACTION *) NULL)
+
+typedef enum {
+ XENSTORE_STATUS_SUCCESS = 0,
+ XENSTORE_STATUS_FAIL,
+ XENSTORE_STATUS_EINVAL,
+ XENSTORE_STATUS_EACCES,
+ XENSTORE_STATUS_EEXIST,
+ XENSTORE_STATUS_EISDIR,
+ XENSTORE_STATUS_ENOENT,
+ XENSTORE_STATUS_ENOMEM,
+ XENSTORE_STATUS_ENOSPC,
+ XENSTORE_STATUS_EIO,
+ XENSTORE_STATUS_ENOTEMPTY,
+ XENSTORE_STATUS_ENOSYS,
+ XENSTORE_STATUS_EROFS,
+ XENSTORE_STATUS_EBUSY,
+ XENSTORE_STATUS_EAGAIN,
+ XENSTORE_STATUS_EISCONN,
+ XENSTORE_STATUS_E2BIG
+} XENSTORE_STATUS;
+
+
+#include <IndustryStandard/Xen/grant_table.h>
+#include <IndustryStandard/Xen/event_channel.h>
+
+///
+/// Function prototypes
+///
+
+/**
+ Get the contents of the node Node of the PV device. Returns the contents in
+ *Result which should be freed after use.
+
+ @param This A pointer to XENBUS_PROTOCOL instance.
+ @param Transaction The XenStore transaction covering this request.
+ @param Node The basename of the file to read.
+ @param Result The returned contents from this file.
+
+ @return On success, XENSTORE_STATUS_SUCCESS. Otherwise an errno value
+ indicating the type of failure.
+
+ @note The results buffer is malloced and should be free'd by the
+ caller.
+**/
+typedef
+XENSTORE_STATUS
+(EFIAPI *XENBUS_XS_READ)(
+ IN XENBUS_PROTOCOL *This,
+ IN CONST XENSTORE_TRANSACTION *Transaction,
+ IN CONST CHAR8 *Node,
+ OUT VOID **Result
+ );
+
+/**
+ Get the contents of the node Node of the PV device's backend. Returns the
+ contents in *Result which should be freed after use.
+
+ @param This A pointer to XENBUS_PROTOCOL instance.
+ @param Transaction The XenStore transaction covering this request.
+ @param Node The basename of the file to read.
+ @param Result The returned contents from this file.
+
+ @return On success, XENSTORE_STATUS_SUCCESS. Otherwise an errno value
+ indicating the type of failure.
+
+ @note The results buffer is malloced and should be free'd by the
+ caller.
+**/
+typedef
+XENSTORE_STATUS
+(EFIAPI *XENBUS_XS_BACKEND_READ)(
+ IN XENBUS_PROTOCOL *This,
+ IN CONST XENSTORE_TRANSACTION *Transaction,
+ IN CONST CHAR8 *Node,
+ OUT VOID **Result
+ );
+
+/**
+ Print formatted write to a XenStore node.
+
+ @param This A pointer to XENBUS_PROTOCOL instance.
+ @param Transaction The XenStore transaction covering this request.
+ @param Directory The dirname of the path to read.
+ @param Node The basename of the path to read.
+ @param Format AsciiSPrint format string followed by a variable number
+ of arguments.
+
+ @return On success, XENSTORE_STATUS_SUCCESS. Otherwise an errno value
+ indicating the type of write failure.
+**/
+typedef
+XENSTORE_STATUS
+(EFIAPI *XENBUS_XS_PRINTF) (
+ IN XENBUS_PROTOCOL *This,
+ IN CONST XENSTORE_TRANSACTION *Transaction,
+ IN CONST CHAR8 *Directory,
+ IN CONST CHAR8 *Node,
+ IN CONST CHAR8 *Format,
+ ...
+ );
+
+/**
+ Remove a node or directory (directories must be empty) of the PV driver's
+ subdirectory.
+
+ @param This A pointer to XENBUS_PROTOCOL instance.
+ @param Transaction The XenStore transaction covering this request.
+ @param Node The basename of the node to remove.
+
+ @return On success, XENSTORE_STATUS_SUCCESS. Otherwise an errno value
+ indicating the type of failure.
+**/
+typedef
+XENSTORE_STATUS
+(EFIAPI *XENBUS_XS_REMOVE) (
+ IN XENBUS_PROTOCOL *This,
+ IN CONST XENSTORE_TRANSACTION *Transaction,
+ IN CONST CHAR8 *Node
+ );
+
+/**
+ Start a transaction.
+
+ Changes by others will not be seen during the lifetime of this
+ transaction, and changes will not be visible to others until it
+ is committed (XsTransactionEnd).
+
+ @param This A pointer to XENBUS_PROTOCOL instance.
+ @param Transaction The returned transaction.
+
+ @return On success, XENSTORE_STATUS_SUCCESS. Otherwise an errno value
+ indicating the type of failure.
+**/
+typedef
+XENSTORE_STATUS
+(EFIAPI *XENBUS_XS_TRANSACTION_START)(
+ IN XENBUS_PROTOCOL *This,
+ OUT XENSTORE_TRANSACTION *Transaction
+ );
+
+/**
+ End a transaction.
+
+ @param This A pointer to XENBUS_PROTOCOL instance.
+ @param Transaction The transaction to end/commit.
+ @param Abort If TRUE, the transaction is discarded
+ instead of committed.
+
+ @return On success, XENSTORE_STATUS_SUCCESS. Otherwise an errno value
+ indicating the type of failure.
+**/
+typedef
+XENSTORE_STATUS
+(EFIAPI *XENBUS_XS_TRANSACTION_END) (
+ IN XENBUS_PROTOCOL *This,
+ IN CONST XENSTORE_TRANSACTION *Transaction,
+ IN BOOLEAN Abort
+ );
+
+/**
+ Set a new state for the frontend of the PV driver.
+
+ @param This A pointer to XENBUS_PROTOCOL instance.
+ @param Transaction The transaction to end/commit.
+ @param State The new state to apply.
+
+ @return On success, XENSTORE_STATUS_SUCCESS. Otherwise an errno value
+ indicating the type of failure.
+**/
+typedef
+XENSTORE_STATUS
+(EFIAPI *XENBUS_SET_STATE)(
+ IN XENBUS_PROTOCOL *This,
+ IN CONST XENSTORE_TRANSACTION *Transaction,
+ IN XenBusState State
+ );
+
+/**
+ Grant access to the page Frame to the domain DomainId.
+
+ @param This A pointer to XENBUS_PROTOCOL instance.
+ @param DomainId ID of the domain to grant access to.
+ @param Frame Frame Number of the page to grant access to.
+ @param ReadOnly Provide read-only or read-write access.
+ @param RefPtr Reference number of the grant will be written to this pointer.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *XENBUS_GRANT_ACCESS)(
+ IN XENBUS_PROTOCOL *This,
+ IN domid_t DomainId,
+ IN UINTN Frame,
+ IN BOOLEAN ReadOnly,
+ OUT grant_ref_t *refp
+ );
+
+/**
+ End access to grant Ref, previously return by XenBusGrantAccess.
+
+ @param This A pointer to XENBUS_PROTOCOL instance.
+ @param Ref Reference numeber of a grant previously returned by
+ XenBusGrantAccess.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *XENBUS_GRANT_END_ACCESS)(
+ IN XENBUS_PROTOCOL *This,
+ IN grant_ref_t Ref
+ );
+
+/**
+ Allocate a port that can be bind from domain DomainId.
+
+ @param This A pointer to the XENBUS_PROTOCOL.
+ @param DomainId The domain ID that can bind the newly allocated port.
+ @param Port A pointer to a evtchn_port_t that will contain the newly
+ allocated port.
+
+ @retval UINT32 The return value from the hypercall, 0 if success.
+**/
+typedef
+UINT32
+(EFIAPI *XENBUS_EVENT_CHANNEL_ALLOCATE) (
+ IN XENBUS_PROTOCOL *This,
+ IN domid_t DomainId,
+ OUT evtchn_port_t *Port
+ );
+
+/**
+ Send an event to the remote end of the channel whose local endpoint is Port.
+
+ @param This A pointer to the XENBUS_PROTOCOL.
+ @param Port Local port to the event from.
+
+ @retval UINT32 The return value from the hypercall, 0 if success.
+**/
+typedef
+UINT32
+(EFIAPI *XENBUS_EVENT_CHANNEL_NOTIFY) (
+ IN XENBUS_PROTOCOL *This,
+ IN evtchn_port_t Port
+ );
+
+/**
+ Close a local event channel Port.
+
+ @param This A pointer to the XENBUS_PROTOCOL.
+ @param Port The event channel to close.
+
+ @retval UINT32 The return value from the hypercall, 0 if success.
+**/
+typedef
+UINT32
+(EFIAPI *XENBUS_EVENT_CHANNEL_CLOSE) (
+ IN XENBUS_PROTOCOL *This,
+ IN evtchn_port_t Port
+ );
+
+/**
+ Register a XenStore watch.
+
+ XenStore watches allow a client to wait for changes to an object in the
+ XenStore.
+
+ @param This A pointer to the XENBUS_PROTOCOL.
+ @param Node The basename of the path to watch.
+ @param Token A token.
+
+ @return On success, XENSTORE_STATUS_SUCCESS. Otherwise an errno value
+ indicating the type of write failure. EEXIST errors from the
+ XenStore are suppressed, allowing multiple, physically different,
+ xenbus_watch objects, to watch the same path in the XenStore.
+**/
+typedef
+XENSTORE_STATUS
+(EFIAPI *XENBUS_REGISTER_WATCH) (
+ IN XENBUS_PROTOCOL *This,
+ IN CONST CHAR8 *Node,
+ OUT VOID **Token
+ );
+
+/**
+ Register a XenStore watch on a backend's node.
+
+ XenStore watches allow a client to wait for changes to an object in the
+ XenStore.
+
+ @param This A pointer to the XENBUS_PROTOCOL.
+ @param Node The basename of the path to watch.
+ @param Token A token.
+
+ @return On success, XENSTORE_STATUS_SUCCESS. Otherwise an errno value
+ indicating the type of write failure. EEXIST errors from the
+ XenStore are suppressed, allowing multiple, physically different,
+ xenbus_watch objects, to watch the same path in the XenStore.
+**/
+typedef
+XENSTORE_STATUS
+(EFIAPI *XENBUS_REGISTER_WATCH_BACKEND) (
+ IN XENBUS_PROTOCOL *This,
+ IN CONST CHAR8 *Node,
+ OUT VOID **Token
+ );
+
+/**
+ Unregister a XenStore watch.
+
+ @param This A pointer to the XENBUS_PROTOCOL.
+ @param Token An token previously returned by a successful
+ call to RegisterWatch ().
+**/
+typedef
+VOID
+(EFIAPI *XENBUS_UNREGISTER_WATCH) (
+ IN XENBUS_PROTOCOL *This,
+ IN VOID *Token
+ );
+
+/**
+ Block until the node watch by Token change.
+
+ @param This A pointer to the XENBUS_PROTOCOL.
+ @param Token An token previously returned by a successful
+ call to RegisterWatch or RegisterWatchBackend.
+
+ @return On success, XENSTORE_STATUS_SUCCESS. Otherwise an errno value
+ indicating the type of failure.
+**/
+typedef
+XENSTORE_STATUS
+(EFIAPI *XENBUS_WAIT_FOR_WATCH) (
+ IN XENBUS_PROTOCOL *This,
+ IN VOID *Token
+ );
+
+
+///
+/// Protocol structure
+///
+/// DISCLAIMER: the XENBUS_PROTOCOL introduced here is a work in progress, and
+/// should not be used outside of the EDK II tree.
+///
+struct _XENBUS_PROTOCOL {
+ XENBUS_XS_READ XsRead;
+ XENBUS_XS_BACKEND_READ XsBackendRead;
+ XENBUS_XS_PRINTF XsPrintf;
+ XENBUS_XS_REMOVE XsRemove;
+ XENBUS_XS_TRANSACTION_START XsTransactionStart;
+ XENBUS_XS_TRANSACTION_END XsTransactionEnd;
+ XENBUS_SET_STATE SetState;
+
+ XENBUS_GRANT_ACCESS GrantAccess;
+ XENBUS_GRANT_END_ACCESS GrantEndAccess;
+
+ XENBUS_EVENT_CHANNEL_ALLOCATE EventChannelAllocate;
+ XENBUS_EVENT_CHANNEL_NOTIFY EventChannelNotify;
+ XENBUS_EVENT_CHANNEL_CLOSE EventChannelClose;
+
+ XENBUS_REGISTER_WATCH RegisterWatch;
+ XENBUS_REGISTER_WATCH_BACKEND RegisterWatchBackend;
+ XENBUS_UNREGISTER_WATCH UnregisterWatch;
+ XENBUS_WAIT_FOR_WATCH WaitForWatch;
+ //
+ // Protocol data fields
+ //
+ CONST CHAR8 *Type;
+ UINT16 DeviceId;
+ CONST CHAR8 *Node;
+ CONST CHAR8 *Backend;
+};
+
+extern EFI_GUID gXenBusProtocolGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/XenIo.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/XenIo.h
new file mode 100644
index 00000000..e73822be
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Protocol/XenIo.h
@@ -0,0 +1,42 @@
+/** @file
+ XenIo protocol to abstract arch specific details
+
+ The Xen implementations for the Intel and ARM architectures differ in the way
+ the base address of the grant table is communicated to the guest. The former
+ uses a virtual PCI device, while the latter uses a device tree node.
+ In order to allow the XenBusDxe UEFI driver to be reused for the non-PCI
+ Xen implementation, this abstract protocol can be installed on a handle
+ with the appropriate base address.
+
+ Copyright (C) 2014, Linaro Ltd.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __PROTOCOL_XENIO_H__
+#define __PROTOCOL_XENIO_H__
+
+#include <IndustryStandard/Xen/xen.h>
+
+#define XENIO_PROTOCOL_GUID \
+ {0x6efac84f, 0x0ab0, 0x4747, {0x81, 0xbe, 0x85, 0x55, 0x62, 0x59, 0x04, 0x49}}
+
+///
+/// Forward declaration
+///
+typedef struct _XENIO_PROTOCOL XENIO_PROTOCOL;
+
+///
+/// Protocol structure
+///
+struct _XENIO_PROTOCOL {
+ //
+ // Protocol data fields
+ //
+ EFI_PHYSICAL_ADDRESS GrantTableAddress;
+};
+
+extern EFI_GUID gXenIoProtocolGuid;
+
+#endif
diff --git a/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Register/QemuSmramSaveStateMap.h b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Register/QemuSmramSaveStateMap.h
new file mode 100644
index 00000000..dc457c51
--- /dev/null
+++ b/src/VBox/Devices/EFI/Firmware/OvmfPkg/Include/Register/QemuSmramSaveStateMap.h
@@ -0,0 +1,178 @@
+/** @file
+SMRAM Save State Map Definitions.
+
+SMRAM Save State Map definitions based on contents of the
+Intel(R) 64 and IA-32 Architectures Software Developer's Manual
+ Volume 3C, Section 34.4 SMRAM
+ Volume 3C, Section 34.5 SMI Handler Execution Environment
+ Volume 3C, Section 34.7 Managing Synchronous and Asynchronous SMIs
+
+and the AMD64 Architecture Programmer's Manual
+ Volume 2, Section 10.2 SMM Resources
+
+Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2015, Red Hat, Inc.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef __QEMU_SMRAM_SAVE_STATE_MAP_H__
+#define __QEMU_SMRAM_SAVE_STATE_MAP_H__
+
+#pragma pack (1)
+
+///
+/// 32-bit SMRAM Save State Map
+///
+typedef struct {
+ UINT8 Reserved0[0x200]; // 7c00h
+ UINT8 Reserved1[0xf8]; // 7e00h
+ UINT32 SMBASE; // 7ef8h
+ UINT32 SMMRevId; // 7efch
+ UINT16 IORestart; // 7f00h
+ UINT16 AutoHALTRestart; // 7f02h
+ UINT8 Reserved2[0x9C]; // 7f08h
+ UINT32 IOMemAddr; // 7fa0h
+ UINT32 IOMisc; // 7fa4h
+ UINT32 _ES; // 7fa8h
+ UINT32 _CS; // 7fach
+ UINT32 _SS; // 7fb0h
+ UINT32 _DS; // 7fb4h
+ UINT32 _FS; // 7fb8h
+ UINT32 _GS; // 7fbch
+ UINT32 Reserved3; // 7fc0h
+ UINT32 _TR; // 7fc4h
+ UINT32 _DR7; // 7fc8h
+ UINT32 _DR6; // 7fcch
+ UINT32 _EAX; // 7fd0h
+ UINT32 _ECX; // 7fd4h
+ UINT32 _EDX; // 7fd8h
+ UINT32 _EBX; // 7fdch
+ UINT32 _ESP; // 7fe0h
+ UINT32 _EBP; // 7fe4h
+ UINT32 _ESI; // 7fe8h
+ UINT32 _EDI; // 7fech
+ UINT32 _EIP; // 7ff0h
+ UINT32 _EFLAGS; // 7ff4h
+ UINT32 _CR3; // 7ff8h
+ UINT32 _CR0; // 7ffch
+} QEMU_SMRAM_SAVE_STATE_MAP32;
+
+///
+/// 64-bit SMRAM Save State Map
+///
+typedef struct {
+ UINT8 Reserved0[0x200]; // 7c00h
+
+ UINT16 _ES; // 7e00h
+ UINT16 _ESAccessRights; // 7e02h
+ UINT32 _ESLimit; // 7e04h
+ UINT64 _ESBase; // 7e08h
+
+ UINT16 _CS; // 7e10h
+ UINT16 _CSAccessRights; // 7e12h
+ UINT32 _CSLimit; // 7e14h
+ UINT64 _CSBase; // 7e18h
+
+ UINT16 _SS; // 7e20h
+ UINT16 _SSAccessRights; // 7e22h
+ UINT32 _SSLimit; // 7e24h
+ UINT64 _SSBase; // 7e28h
+
+ UINT16 _DS; // 7e30h
+ UINT16 _DSAccessRights; // 7e32h
+ UINT32 _DSLimit; // 7e34h
+ UINT64 _DSBase; // 7e38h
+
+ UINT16 _FS; // 7e40h
+ UINT16 _FSAccessRights; // 7e42h
+ UINT32 _FSLimit; // 7e44h
+ UINT64 _FSBase; // 7e48h
+
+ UINT16 _GS; // 7e50h
+ UINT16 _GSAccessRights; // 7e52h
+ UINT32 _GSLimit; // 7e54h
+ UINT64 _GSBase; // 7e58h
+
+ UINT32 _GDTRReserved1; // 7e60h
+ UINT16 _GDTRLimit; // 7e64h
+ UINT16 _GDTRReserved2; // 7e66h
+ UINT64 _GDTRBase; // 7e68h
+
+ UINT16 _LDTR; // 7e70h
+ UINT16 _LDTRAccessRights; // 7e72h
+ UINT32 _LDTRLimit; // 7e74h
+ UINT64 _LDTRBase; // 7e78h
+
+ UINT32 _IDTRReserved1; // 7e80h
+ UINT16 _IDTRLimit; // 7e84h
+ UINT16 _IDTRReserved2; // 7e86h
+ UINT64 _IDTRBase; // 7e88h
+
+ UINT16 _TR; // 7e90h
+ UINT16 _TRAccessRights; // 7e92h
+ UINT32 _TRLimit; // 7e94h
+ UINT64 _TRBase; // 7e98h
+
+ UINT64 IO_RIP; // 7ea0h
+ UINT64 IO_RCX; // 7ea8h
+ UINT64 IO_RSI; // 7eb0h
+ UINT64 IO_RDI; // 7eb8h
+ UINT32 IO_DWord; // 7ec0h
+ UINT8 Reserved1[0x04]; // 7ec4h
+ UINT8 IORestart; // 7ec8h
+ UINT8 AutoHALTRestart; // 7ec9h
+ UINT8 Reserved2[0x06]; // 7ecah
+
+ UINT64 IA32_EFER; // 7ed0h
+ UINT64 SVM_Guest; // 7ed8h
+ UINT64 SVM_GuestVMCB; // 7ee0h
+ UINT64 SVM_GuestVIntr; // 7ee8h
+ UINT8 Reserved3[0x0c]; // 7ef0h
+
+ UINT32 SMMRevId; // 7efch
+ UINT32 SMBASE; // 7f00h
+
+ UINT8 Reserved4[0x1c]; // 7f04h
+ UINT64 SVM_GuestPAT; // 7f20h
+ UINT64 SVM_HostIA32_EFER; // 7f28h
+ UINT64 SVM_HostCR4; // 7f30h
+ UINT64 SVM_HostCR3; // 7f38h
+ UINT64 SVM_HostCR0; // 7f40h
+
+ UINT64 _CR4; // 7f48h
+ UINT64 _CR3; // 7f50h
+ UINT64 _CR0; // 7f58h
+ UINT64 _DR7; // 7f60h
+ UINT64 _DR6; // 7f68h
+ UINT64 _RFLAGS; // 7f70h
+ UINT64 _RIP; // 7f78h
+ UINT64 _R15; // 7f80h
+ UINT64 _R14; // 7f88h
+ UINT64 _R13; // 7f90h
+ UINT64 _R12; // 7f98h
+ UINT64 _R11; // 7fa0h
+ UINT64 _R10; // 7fa8h
+ UINT64 _R9; // 7fb0h
+ UINT64 _R8; // 7fb8h
+ UINT64 _RDI; // 7fc0h
+ UINT64 _RSI; // 7fc8h
+ UINT64 _RBP; // 7fd0h
+ UINT64 _RSP; // 7fd8h
+ UINT64 _RBX; // 7fe0h
+ UINT64 _RDX; // 7fe8h
+ UINT64 _RCX; // 7ff0h
+ UINT64 _RAX; // 7ff8h
+} QEMU_SMRAM_SAVE_STATE_MAP64;
+
+///
+/// Union of 32-bit and 64-bit SMRAM Save State Maps
+///
+typedef union {
+ QEMU_SMRAM_SAVE_STATE_MAP32 x86;
+ QEMU_SMRAM_SAVE_STATE_MAP64 x64;
+} QEMU_SMRAM_SAVE_STATE_MAP;
+
+#pragma pack ()
+
+#endif