* Fri Dec 15 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20231122-1

- Rebase to edk2-stable202311 [RHEL-12323] - Switch to OpenSSL 3.0 [RHEL-49] - Resolves: RHEL-12323 (Rebase EDK2 for RHEL 9.4) - Resolves: RHEL-49 (consume / bundle RHEL-9 OpenSSL (version 3.0.x) in RHEL-9 edk2)
2023-12-15 03:36:21 -05:00 · 2023-12-15 03:36:21 -05:00 · 301cae1641
commit 301cae1641
parent cc7bc51783
57 changed files with 1228 additions and 1962 deletions
--- a/.gitignore
+++ b/.gitignore
@ -12,3 +12,4 @@
 /DBXUpdate-20230314.x64.bin
 /DBXUpdate-20230509.x64.bin
 /*.src.rpm
 /openssl-rhel-db0287935122edceb91dcda8dfb53b4090734e22.tar.xz
--- a/0001-ignore-build-artifacts-generated-files-session-setti.patch
+++ b/0001-ignore-build-artifacts-generated-files-session-setti.patch
@ -0,0 +1,83 @@
 From 21816395a94558c8e5c97f13adbb5ffb909656b8 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 11 Jun 2014 21:55:22 +0200
 Subject: [PATCH] ignore build artifacts, generated files, session settings etc
 (RHEL only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
 - no changes
 Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
 RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
 - refresh against upstream commit 48760409ccc8 (".gitignore: Ignore python
  compiled files, extdeps, and vscode", 2019-11-11)
 - add ".AutoGenIdFile.txt" to "Conf/.gitignore", in response to upstream
  commit 373298ca0d60 ("BaseTools: Fixed issue for IgnoreAutoGen",
  2019-09-10)
 Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
 RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
 - no changes
 Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
 RHEL-8.1/20190308-89910a39dcfd rebase:
 - no changes
 Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
 RHEL-8.0/20180508-ee3198e672e2 rebase:
 - reorder the rebase changelog in the commit message so that it reads like
  a blog: place more recent entries near the top
 - no changes to the patch body
 Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
 - no changes
 Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
 - Conflict resolution against upstream commit 112f4ada2e6b ("edk2: Add
  .DS_Store to .gitignore for macOS", 2017-05-04), in the ".gitignore"
  file.
 Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
 - no changes
 Notes about the 9ece15a -> c9e5618 rebase:
 - Upstream added .gitignore files in the meanwhile, we just need some
  light customization. In particular the Conf/ReadMe.txt file should not
  be ignored, it is not generated.
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit 3b9c914f2d6bff6274d5ed45fcf4c757ce27031b)
 (cherry picked from commit b66c3c6d11a834dc7cb3ab326f09c6a21c0b81e8)
 (cherry picked from commit c94381432988f6137de46772cbd4080d9832c9ad)
 (cherry picked from commit 730cc57005e4908fcee29109672284808b21ec1c)
 (cherry picked from commit 161184bcb55a670f8f7f8c4147825eb360b73794)
 (cherry picked from commit 4eec2bb2176f2deda2b2c44a6f2ea167c5a43433)
 (cherry picked from commit ea548c8d0c9d4cd5b8b5200eda8ff6ac220a6307)
 (cherry picked from commit 4872f69df8b0460fbbfcd75950d81fdcd213f8c0)
 ---
 Conf/.gitignore | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
 diff --git a/Conf/.gitignore b/Conf/.gitignore
 index 5e4debcc10..8601fc0cee 100644
 --- a/Conf/.gitignore
 +++ b/Conf/.gitignore
@@ -1 +1,6 @@
 -*
 +.AutoGenIdFile.txt
 +.cache/
 +BuildEnv.sh
 +build_rule.txt
 +target.txt
 +tools_def.txt
--- a/0002-Remove-submodules.patch
+++ b/0002-Remove-submodules.patch
@ -1,7 +1,13 @@
-From a4954b2259c4be78f61127684239cb11486bc0f7 Mon Sep 17 00:00:00 2001
+From ff10592d4710f12d601dcfcdd25f28b6941c5141 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Thu, 24 Mar 2022 03:23:02 -0400
-Subject: Remove submodules
+Subject: [PATCH] Remove submodules
 Rebase to edk2-stable202311: removing additional submodule:
 - CryptoPkg/Library/MbedTlsLib/mbedtls
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Rebase to edk2-stable202305: removing additional submodules:
@ -50,35 +56,12 @@ remove the include path too.
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit e05e0de713c4a2b8adb6ff9809611f222bfe50ed)
 ---
 .gitmodules                                   | 34 -------------------
 .../ArmSoftFloatLib/berkeley-softfloat-3      |  1 -
 BaseTools/Source/C/BrotliCompress/brotli      |  1 -
 BaseTools/Source/C/GNUmakefile | 1 -
 CryptoPkg/.gitignore           | 1 +
- CryptoPkg/Library/OpensslLib/openssl          |  1 -
+ MdeModulePkg/MdeModulePkg.dec  | 3 ---
- .../Library/BrotliCustomDecompressLib/brotli  |  1 -
+ MdePkg/MdePkg.dec              | 5 -----
- MdeModulePkg/MdeModulePkg.dec                 |  3 --
+ 4 files changed, 1 insertion(+), 9 deletions(-)
 .../Universal/RegularExpressionDxe/oniguruma  |  1 -
 MdePkg/Library/BaseFdtLib/libfdt              |  1 -
 MdePkg/Library/MipiSysTLib/mipisyst           |  1 -
 MdePkg/MdePkg.dec                             |  5 ---
 RedfishPkg/Library/JsonLib/jansson            |  1 -
 UnitTestFrameworkPkg/Library/CmockaLib/cmocka |  1 -
 .../Library/GoogleTestLib/googletest          |  1 -
 .../Library/SubhookLib/subhook                |  1 -
 16 files changed, 1 insertion(+), 54 deletions(-)
 delete mode 160000 ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3
 delete mode 160000 BaseTools/Source/C/BrotliCompress/brotli
 create mode 100644 CryptoPkg/.gitignore
 delete mode 160000 CryptoPkg/Library/OpensslLib/openssl
 delete mode 160000 MdeModulePkg/Library/BrotliCustomDecompressLib/brotli
 delete mode 160000 MdeModulePkg/Universal/RegularExpressionDxe/oniguruma
 delete mode 160000 MdePkg/Library/BaseFdtLib/libfdt
 delete mode 160000 MdePkg/Library/MipiSysTLib/mipisyst
 delete mode 160000 RedfishPkg/Library/JsonLib/jansson
 delete mode 160000 UnitTestFrameworkPkg/Library/CmockaLib/cmocka
 delete mode 160000 UnitTestFrameworkPkg/Library/GoogleTestLib/googletest
 delete mode 160000 UnitTestFrameworkPkg/Library/SubhookLib/subhook
 diff --git a/BaseTools/Source/C/GNUmakefile b/BaseTools/Source/C/GNUmakefile
 index 5275f657ef..39d7199753 100644
@ -92,8 +75,15 @@ index 5275f657ef..39d7199753 100644
   VfrCompile \
   EfiRom \
   GenFfs \
 diff --git a/CryptoPkg/.gitignore b/CryptoPkg/.gitignore
 new file mode 100644
 index 0000000000..68b83272b7
 --- /dev/null
 +++ b/CryptoPkg/.gitignore
@@ -0,0 +1 @@
 +Library/OpensslLib/openssl*/
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 95dd077e19..1609b6d9c2 100644
+index d2fede4f87..265dfec94f 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
@@ -26,9 +26,6 @@
@ -107,7 +97,7 @@ index 95dd077e19..1609b6d9c2 100644
   ##  @libraryclass  Defines a set of methods to reset whole system.
   ResetSystemLib|Include/Library/ResetSystemLib.h
 diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
-index b85614992b..57b0b5ea6f 100644
+index ac54338089..29f0a6e178 100644
 --- a/MdePkg/MdePkg.dec
 +++ b/MdePkg/MdePkg.dec
@@ -29,7 +29,6 @@
--- a/0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
+++ b/0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
@ -1,8 +1,12 @@
-From 5eef1273ee036bfa0ba9da1b276e0bf130b1cfbc Mon Sep 17 00:00:00 2001
+From a531e0f3c999670f54926b2579e0721d217a49e0 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Tue, 25 Feb 2014 22:40:01 +0100
-Subject: MdeModulePkg: TerminalDxe: set xterm resolution on mode change (RH
+Subject: [PATCH] MdeModulePkg: TerminalDxe: set xterm resolution on mode
- only)
+ change (RH only)
 Notes for rebase to edk2-stable202311:
 - Minor context changes due to new PCDs (for USB Networking) being added.
 Notes for rebase to edk2-stable202205:
@ -95,12 +99,12 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 3 files changed, 36 insertions(+)
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 1609b6d9c2..705fb02f66 100644
+index 265dfec94f..092a8dee2a 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
-@@ -2127,6 +2127,10 @@
+@@ -2158,6 +2158,10 @@
-   # @Prompt The shared bit mask when Intel Tdx is enabled.
+   # @Prompt The value is use for Usb Network rate limiting supported.
-   gEfiMdeModulePkgTokenSpaceGuid.PcdTdxSharedBitMask|0x0|UINT64|0x10000025
+   gEfiMdeModulePkgTokenSpaceGuid.PcdUsbNetworkRateLimitingFactor|100|UINT32|0x10000028
 +  ## Controls whether TerminalDxe outputs an XTerm resize sequence on terminal
 +  #  mode change.
@ -184,6 +188,3 @@ index b2a8aeba85..96810f337c 100644
 # [Event]
 # # Relative timer event set by UnicodeToEfiKey(), used to be one 2 seconds input timeout.
 -- 
 2.39.3
--- a/0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
+++ b/0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
@ -1,7 +1,8 @@
-From a1d4a00637d184cff886bc150cdfd8de165ed162 Mon Sep 17 00:00:00 2001
+From c53aae9d945648b7301efede1dc77bf7b7f4ee1c Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 14 Oct 2015 15:59:06 +0200
-Subject: OvmfPkg: take PcdResizeXterm from the QEMU command line (RH only)
+Subject: [PATCH] OvmfPkg: take PcdResizeXterm from the QEMU command line (RH
 only)
 Notes about edk2-stable202205 rebase
@ -82,10 +83,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 9 files changed, 21 insertions(+), 1 deletion(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index b32049194d..c62d6e2805 100644
+index 302c90e7c2..ef70f5f08c 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -476,6 +476,7 @@
+@@ -486,6 +486,7 @@
 [PcdsDynamicDefault]
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -94,10 +95,10 @@ index b32049194d..c62d6e2805 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc
-index 2a1139daaa..cfa4943ed4 100644
+index c23c7eaf6c..49521ba47c 100644
 --- a/OvmfPkg/CloudHv/CloudHvX64.dsc
 +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc
-@@ -575,6 +575,7 @@
+@@ -576,6 +576,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -106,10 +107,10 @@ index 2a1139daaa..cfa4943ed4 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-index d4403f11a7..e4bc192733 100644
+index 182ec3705d..fd6722499a 100644
 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
 +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-@@ -473,6 +473,7 @@
+@@ -482,6 +482,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -118,10 +119,10 @@ index d4403f11a7..e4bc192733 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
-index 5f671bc384..49d1d7ef5c 100644
+index ea1fa3e296..79f14b5c05 100644
 --- a/OvmfPkg/Microvm/MicrovmX64.dsc
 +++ b/OvmfPkg/Microvm/MicrovmX64.dsc
-@@ -572,7 +572,7 @@
+@@ -584,7 +584,7 @@
   # only set when
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -131,10 +132,10 @@ index 5f671bc384..49d1d7ef5c 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index e333b8b418..b4f7334569 100644
+index ed3a19feeb..3101a3a4cf 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -595,6 +595,7 @@
+@@ -604,6 +604,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -143,10 +144,10 @@ index e333b8b418..b4f7334569 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 25974230a2..e11ccae622 100644
+index 16ca139b29..0c174947b7 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -603,6 +603,7 @@
+@@ -616,6 +616,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -155,10 +156,10 @@ index 25974230a2..e11ccae622 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index c1762ffca4..4ac6b492e2 100644
+index dc1a0942aa..a328726d55 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -626,6 +626,7 @@
+@@ -634,6 +634,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -167,7 +168,7 @@ index c1762ffca4..4ac6b492e2 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
-index c56247e294..bf5d37c1f6 100644
+index f5dc41c3a8..f244dcd24d 100644
 --- a/OvmfPkg/PlatformPei/Platform.c
 +++ b/OvmfPkg/PlatformPei/Platform.c
@@ -41,6 +41,18 @@
@ -189,7 +190,7 @@ index c56247e294..bf5d37c1f6 100644
 EFI_PEI_PPI_DESCRIPTOR  mPpiBootMode[] = {
   {
     EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST,
-@@ -386,6 +398,7 @@ InitializePlatform (
+@@ -355,6 +367,7 @@ InitializePlatform (
     MemTypeInfoInitialization (PlatformInfoHob);
     MemMapInitialization (PlatformInfoHob);
     NoexecDxeInitialization (PlatformInfoHob);
@ -209,6 +210,3 @@ index 3934aeed95..d84aefee6d 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode
   gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
   gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
 -- 
 2.39.3
--- a/0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
+++ b/0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
@ -1,7 +1,8 @@
-From 5b458fdeac6a656ab83e0be1662f22e293a5622a Mon Sep 17 00:00:00 2001
+From db9d61b18715590fc8956eb5da9b036afbfd9ab9 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Sun, 26 Jul 2015 08:02:50 +0000
-Subject: ArmVirtPkg: take PcdResizeXterm from the QEMU command line (RH only)
+Subject: [PATCH] ArmVirtPkg: take PcdResizeXterm from the QEMU command line
 (RH only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -95,10 +96,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 449e73b9e1..b6b9a7f192 100644
+index 30e3cfc8b9..7b88b7441f 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -307,6 +307,8 @@
+@@ -309,6 +309,8 @@
   gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0x0
 !endif
@ -107,7 +108,7 @@ index 449e73b9e1..b6b9a7f192 100644
 [PcdsDynamicHii]
   gUefiOvmfPkgTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gOvmfVariableGuid|0x0|FALSE|NV,BS
-@@ -416,7 +418,10 @@
+@@ -418,7 +420,10 @@
   MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
   MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitterDxe.inf
   MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
@ -198,6 +199,3 @@ index 0000000000..c840f6f97a
 +
 +[Pcd]
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm ## SOMETIMES_PRODUCES
 -- 
 2.39.3
--- a/0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+++ b/0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
@ -1,7 +1,7 @@
-From 23e43af54fd29691bf94a5f4e2ac3014b819e37e Mon Sep 17 00:00:00 2001
+From ccc528cc7a9d5b0029a1ca91cb592c999e9f8c5a Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:45 +0100
-Subject: OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
+Subject: [PATCH] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -65,10 +65,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 4 files changed, 4 insertions(+), 4 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index c62d6e2805..ac73229829 100644
+index ef70f5f08c..28bdc56227 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -426,7 +426,7 @@
+@@ -428,7 +428,7 @@
   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
@ -78,10 +78,10 @@ index c62d6e2805..ac73229829 100644
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b4f7334569..0b9fc53884 100644
+index 3101a3a4cf..c4fc79a851 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -535,7 +535,7 @@
+@@ -537,7 +537,7 @@
   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
@ -91,10 +91,10 @@ index b4f7334569..0b9fc53884 100644
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index e11ccae622..51823fb746 100644
+index 0c174947b7..1da23b5389 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -541,7 +541,7 @@
+@@ -544,7 +544,7 @@
   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
@ -104,10 +104,10 @@ index e11ccae622..51823fb746 100644
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 4ac6b492e2..d1474b0155 100644
+index a328726d55..4f886ba644 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -562,7 +562,7 @@
+@@ -563,7 +563,7 @@
   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
@ -116,6 +116,3 @@ index 4ac6b492e2..d1474b0155 100644
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 -- 
 2.39.3
--- a/0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+++ b/0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
@ -1,7 +1,7 @@
-From 13c6ac7528d5be2638f121b19432597cc529ea7c Mon Sep 17 00:00:00 2001
+From 4bb5f3b3473da371b4db99899c1128ae4ff99f6e Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:46 +0100
-Subject: OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
+Subject: [PATCH] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
 QemuVideoDxe/QemuRamfbDxe (RH)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@ -76,16 +76,16 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 1355849ad97c1e4a5c430597a377165a5cc118f7)
 ---
 OvmfPkg/AmdSev/AmdSevX64.dsc | 10 ++++++++--
- OvmfPkg/OvmfPkgIa32.dsc      | 12 +++++++++---
+ OvmfPkg/OvmfPkgIa32.dsc      | 10 ++++++++--
 OvmfPkg/OvmfPkgIa32X64.dsc   | 10 ++++++++--
 OvmfPkg/OvmfPkgX64.dsc       | 10 ++++++++--
- 4 files changed, 33 insertions(+), 9 deletions(-)
+ 4 files changed, 32 insertions(+), 8 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index ac73229829..70f154b477 100644
+index 28bdc56227..cbd48af4dc 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -684,8 +684,14 @@
+@@ -694,8 +694,14 @@
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
@ -103,21 +103,20 @@ index ac73229829..70f154b477 100644
   #
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 0b9fc53884..b05e010069 100644
+index c4fc79a851..75a61c88e6 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -841,9 +841,15 @@
+@@ -850,9 +850,15 @@
   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
 !ifndef $(CSM_ENABLE)
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
 -!endif
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
-+!endif
+ !endif
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
@ -126,10 +125,10 @@ index 0b9fc53884..b05e010069 100644
   #
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 51823fb746..78f97ff17e 100644
+index 1da23b5389..e5ca067d4c 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -855,9 +855,15 @@
+@@ -868,9 +868,15 @@
   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
 !ifndef $(CSM_ENABLE)
@ -148,10 +147,10 @@ index 51823fb746..78f97ff17e 100644
   #
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index d1474b0155..2a4829d26e 100644
+index 4f886ba644..ad314d86c6 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -929,9 +929,15 @@
+@@ -936,9 +936,15 @@
   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
 !ifndef $(CSM_ENABLE)
@ -169,6 +168,3 @@ index d1474b0155..2a4829d26e 100644
   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
   #
 -- 
 2.39.3
--- a/0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+++ b/0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
@ -1,8 +1,8 @@
-From 6e76f73b1ea3bac22d248499b9c2062ca5ed020d Mon Sep 17 00:00:00 2001
+From 72830b010e7b78ef8d74cefcb5c6ad018c653ea6 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 27 Jan 2016 03:05:18 +0100
-Subject: ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in QemuRamfbDxe (RH
+Subject: [PATCH] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
- only)
+ QemuRamfbDxe (RH only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -61,10 +61,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 2 files changed, 8 insertions(+), 2 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index b6b9a7f192..176246d683 100644
+index 7b88b7441f..fe7b7e1d64 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -544,7 +544,10 @@
+@@ -547,7 +547,10 @@
   #
   # Video support
   #
@ -77,10 +77,10 @@ index b6b9a7f192..176246d683 100644
   OvmfPkg/PlatformDxe/Platform.inf
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 3cb9120e4e..18d59c2414 100644
+index b50f8e84a3..4a43892f7d 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -444,7 +444,10 @@
+@@ -447,7 +447,10 @@
   #
   # Video support
   #
@ -92,6 +92,3 @@ index 3cb9120e4e..18d59c2414 100644
   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
   OvmfPkg/PlatformDxe/Platform.inf
 -- 
 2.39.3
--- a/0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+++ b/0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
@ -1,8 +1,8 @@
-From fe859725d7da9d4452d79b65aad4b4cb3589e873 Mon Sep 17 00:00:00 2001
+From 2b84cf52f9a6f24f932bce5548202460f20ca9d0 Mon Sep 17 00:00:00 2001
 From: Philippe Mathieu-Daude <philmd@redhat.com>
 Date: Thu, 1 Aug 2019 20:43:48 +0200
-Subject: OvmfPkg: QemuRamfbDxe: Do not report DXE failure on Aarch64 silent
+Subject: [PATCH] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on Aarch64
- builds (RH only)
+ silent builds (RH only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -90,6 +90,3 @@ index e3890b8c20..f79a4bc987 100644
   DevicePathLib
   FrameBufferBltLib
   MemoryAllocationLib
 -- 
 2.39.3
--- a/0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+++ b/0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
@ -1,8 +1,8 @@
-From 4939fadb84796923b287becaecd568d5d77fe20b Mon Sep 17 00:00:00 2001
+From 67230df28e3861c4a7a8fb064a45ed85f015209c Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:47 +0100
-Subject: OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in NvmExpressDxe (RH
+Subject: [PATCH] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in NvmExpressDxe
- only)
+ (RH only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -63,11 +63,11 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 4 files changed, 16 insertions(+), 4 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 70f154b477..0d30ee9526 100644
+index cbd48af4dc..a0319c1f0a 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -678,7 +678,10 @@
+@@ -688,7 +688,10 @@
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
@ -79,11 +79,11 @@ index 70f154b477..0d30ee9526 100644
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b05e010069..ef6362aac5 100644
+index 75a61c88e6..34ad4f2777 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -834,7 +834,10 @@
+@@ -843,7 +843,10 @@
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
@ -95,11 +95,11 @@ index b05e010069..ef6362aac5 100644
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 78f97ff17e..1793cc96fc 100644
+index e5ca067d4c..4278ce5e1d 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -848,7 +848,10 @@
+@@ -861,7 +861,10 @@
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
@ -111,11 +111,11 @@ index 78f97ff17e..1793cc96fc 100644
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 2a4829d26e..c32a36b513 100644
+index ad314d86c6..e41a1b976e 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -922,7 +922,10 @@
+@@ -929,7 +929,10 @@
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
@ -126,6 +126,3 @@ index 2a4829d26e..c32a36b513 100644
   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 -- 
 2.39.3
--- a/0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
+++ b/0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
@ -1,8 +1,8 @@
-From b32764469522eb1ac742a34e2ff8b513a329cc41 Mon Sep 17 00:00:00 2001
+From 9bf175beabab17dae1b5883d528ae3d9d834249b Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:31:36 +0200
-Subject: OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no "-kernel" in
+Subject: [PATCH] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no "-kernel"
- silent aa64 build (RH)
+ in silent aa64 build (RH)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -78,6 +78,3 @@ index 7b35adb8e0..23d9f5fca1 100644
   DevicePathLib
   MemoryAllocationLib
   QemuFwCfgLib
 -- 
 2.39.3
--- a/0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
+++ b/0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
@ -1,8 +1,8 @@
-From f38c073fdceec2dac64dc3632ad531f5b73fda8e Mon Sep 17 00:00:00 2001
+From d3d9a0ea8cdd6a8438a878a859ca0cd416c42ad6 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:40:09 +0200
-Subject: SecurityPkg/Tcg2Dxe: suppress error on no swtpm in silent aa64 build
+Subject: [PATCH] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in silent
- (RH)
+ aa64 build (RH)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -77,6 +77,3 @@ index 7dc7a2683d..ae90070b36 100644
   Tpm2CommandLib
   PrintLib
   UefiLib
 -- 
 2.39.3
--- a/0013-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
+++ b/0013-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
@ -1,7 +1,7 @@
-From f48037fba5ef28692e1dd1db90d4729a5fa13e84 Mon Sep 17 00:00:00 2001
+From ce3ac92a202a0b845654c05449107840edf5d2f9 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:28:49 +0200
-Subject: OvmfPkg: Remove EbcDxe (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove EbcDxe (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@ -29,10 +29,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 8 files changed, 8 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 0d30ee9526..2b624582c6 100644
+index a0319c1f0a..906c1a4332 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -603,7 +603,6 @@
+@@ -613,7 +613,6 @@
 !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
   }
@ -41,7 +41,7 @@ index 0d30ee9526..2b624582c6 100644
   UefiCpuPkg/CpuDxe/CpuDxe.inf
   OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index fec08468d3..2c61d5fa0a 100644
+index b2ab0c7773..20d31d0e2d 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -205,7 +205,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@ -53,10 +53,10 @@ index fec08468d3..2c61d5fa0a 100644
 INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
 INF  OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index ef6362aac5..36ea20fb93 100644
+index 34ad4f2777..d664b42c67 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -744,7 +744,6 @@
+@@ -753,7 +753,6 @@
 !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
   }
@ -65,7 +65,7 @@ index ef6362aac5..36ea20fb93 100644
   UefiCpuPkg/CpuDxe/CpuDxe.inf
 !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index c9c9384397..8135a3dc01 100644
+index 383613e54b..236680dec2 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -216,7 +216,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@ -77,10 +77,10 @@ index c9c9384397..8135a3dc01 100644
 INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
 !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 1793cc96fc..9638e03578 100644
+index 4278ce5e1d..2e0af7698a 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -758,7 +758,6 @@
+@@ -771,7 +771,6 @@
 !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
   }
@ -89,7 +89,7 @@ index 1793cc96fc..9638e03578 100644
   UefiCpuPkg/CpuDxe/CpuDxe.inf
 !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index f52219e0c2..9d6314d56e 100644
+index 3cec3d0c87..3ad2fe5eee 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -217,7 +217,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@ -101,10 +101,10 @@ index f52219e0c2..9d6314d56e 100644
 INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
 !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index c32a36b513..7d702f3d21 100644
+index e41a1b976e..55f6760f4c 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -808,7 +808,6 @@
+@@ -816,7 +816,6 @@
 !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
   }
@ -113,7 +113,7 @@ index c32a36b513..7d702f3d21 100644
   UefiCpuPkg/CpuDxe/CpuDxe.inf {
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 00c7f8849f..474ef5ca7e 100644
+index 9c35b6e848..da4541d747 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -239,7 +239,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@ -124,6 +124,3 @@ index 00c7f8849f..474ef5ca7e 100644
 INF  UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
 INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
 -- 
 2.39.3
--- a/0014-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
+++ b/0014-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
@ -1,7 +1,7 @@
-From 324341ee7f56c09987c16d9a7513465cb56e0dcf Mon Sep 17 00:00:00 2001
+From 536709a91fe5d9bf5bb41bc0ae56cb3e3fa0cf5a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:28:59 +0200
-Subject: OvmfPkg: Remove VirtioGpu device driver (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove VirtioGpu device driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@ -29,10 +29,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 8 files changed, 8 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 2b624582c6..dafdc1e67a 100644
+index 906c1a4332..52b0d1062c 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -694,7 +694,6 @@
+@@ -704,7 +704,6 @@
     <PcdsFixedAtBuild>
       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
   }
@ -41,10 +41,10 @@ index 2b624582c6..dafdc1e67a 100644
   #
   # ISA Support
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index 2c61d5fa0a..2bedd4bef1 100644
+index 20d31d0e2d..48cc3b00c1 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
-@@ -298,7 +298,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+@@ -300,7 +300,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
 INF  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
@ -53,10 +53,10 @@ index 2c61d5fa0a..2bedd4bef1 100644
 INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 36ea20fb93..daed0cb362 100644
+index d664b42c67..d39d9e8c27 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -852,7 +852,6 @@
+@@ -861,7 +861,6 @@
     <PcdsFixedAtBuild>
       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
   }
@ -65,7 +65,7 @@ index 36ea20fb93..daed0cb362 100644
   #
   # ISA Support
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 8135a3dc01..f8d2385b91 100644
+index 236680dec2..381735165d 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -334,7 +334,6 @@ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
@ -77,10 +77,10 @@ index 8135a3dc01..f8d2385b91 100644
 INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 9638e03578..c284351665 100644
+index 2e0af7698a..0e3de2ec5e 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -866,7 +866,6 @@
+@@ -879,7 +879,6 @@
     <PcdsFixedAtBuild>
       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
   }
@ -89,7 +89,7 @@ index 9638e03578..c284351665 100644
   #
   # ISA Support
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index 9d6314d56e..5d49c55d8a 100644
+index 3ad2fe5eee..2ca10f7c5e 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -340,7 +340,6 @@ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
@ -101,10 +101,10 @@ index 9d6314d56e..5d49c55d8a 100644
 INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 7d702f3d21..88140034c1 100644
+index 55f6760f4c..c266686361 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -940,7 +940,6 @@
+@@ -947,7 +947,6 @@
     <PcdsFixedAtBuild>
       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
   }
@ -113,7 +113,7 @@ index 7d702f3d21..88140034c1 100644
   #
   # ISA Support
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 474ef5ca7e..d09bd16e2f 100644
+index da4541d747..00b3f9d0d8 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -367,7 +367,6 @@ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
@ -124,6 +124,3 @@ index 474ef5ca7e..d09bd16e2f 100644
 INF  OvmfPkg/PlatformDxe/Platform.inf
 INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 -- 
 2.39.3
--- a/0015-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
+++ b/0015-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
@ -1,7 +1,7 @@
-From 4e165646d809f6ebb0ca0492b00d48ad225db81b Mon Sep 17 00:00:00 2001
+From ff214a87a99084bd91a04711e52ec1bffa911557 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:13 +0200
-Subject: OvmfPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@ -27,19 +27,19 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 6 files changed, 6 deletions(-)
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index daed0cb362..bcfd40ce66 100644
+index d39d9e8c27..12ed090eab 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -827,7 +827,6 @@
+@@ -836,7 +836,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index f8d2385b91..410bb2893c 100644
+index 381735165d..bd69792100 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -296,7 +296,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -51,19 +51,19 @@ index f8d2385b91..410bb2893c 100644
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index c284351665..eced00f16a 100644
+index 0e3de2ec5e..821423cfe2 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -841,7 +841,6 @@
+@@ -854,7 +854,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index 5d49c55d8a..cb3ea94514 100644
+index 2ca10f7c5e..4011682faf 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -75,19 +75,19 @@ index 5d49c55d8a..cb3ea94514 100644
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 88140034c1..9a7325a373 100644
+index c266686361..ea3f8d73bc 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -915,7 +915,6 @@
+@@ -922,7 +922,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index d09bd16e2f..765cc46921 100644
+index 00b3f9d0d8..c53501679a 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -322,7 +322,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -98,6 +98,3 @@ index d09bd16e2f..765cc46921 100644
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 -- 
 2.39.3
--- a/0016-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
+++ b/0016-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
@ -1,7 +1,7 @@
-From 7894ed0cd0583d4b6d39798310bb537d64eb8e34 Mon Sep 17 00:00:00 2001
+From 7478b17347f2119448467a0ce821a5c5f865a2c8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:16 +0200
-Subject: ArmVirtPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@ -24,10 +24,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 3 files changed, 3 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 176246d683..8fe5926ece 100644
+index fe7b7e1d64..f0946821c6 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -462,7 +462,6 @@
+@@ -465,7 +465,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
@ -36,7 +36,7 @@ index 176246d683..8fe5926ece 100644
   #
   # Bds
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 8a063bac04..5da1481532 100644
+index 9b3e37d5c9..a997063751 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -84,7 +84,6 @@ READ_LOCK_STATUS   = TRUE
@ -48,10 +48,10 @@ index 8a063bac04..5da1481532 100644
   #
   # Status Code Routing
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 18d59c2414..c76657d0c4 100644
+index 4a43892f7d..8fa801dad6 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -362,7 +362,6 @@
+@@ -365,7 +365,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
@ -59,6 +59,3 @@ index 18d59c2414..c76657d0c4 100644
   #
   # Bds
 -- 
 2.39.3
--- a/0017-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
+++ b/0017-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
@ -1,7 +1,7 @@
-From 2b5fd3beae02e9b8cec957804440d4f80cd081b0 Mon Sep 17 00:00:00 2001
+From 42c144b94db706be6f01d5fb1537a35cc803daa8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:19 +0200
-Subject: OvmfPkg: Remove UdfDxe filesystem driver (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove UdfDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@ -29,22 +29,22 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 8 files changed, 8 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index dafdc1e67a..5987de6d83 100644
+index 52b0d1062c..41953c119d 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -671,7 +671,6 @@
+@@ -681,7 +681,6 @@
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index 2bedd4bef1..4d2f9c7248 100644
+index 48cc3b00c1..2f03c80ffd 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
-@@ -272,7 +272,6 @@ INF  OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf
+@@ -274,7 +274,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
 INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
 INF  FatPkg/EnhancedFatDxe/Fat.inf
@ -53,19 +53,19 @@ index 2bedd4bef1..4d2f9c7248 100644
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index bcfd40ce66..5762871fee 100644
+index 12ed090eab..07176ad930 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -826,7 +826,6 @@
+@@ -835,7 +835,6 @@
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 410bb2893c..9df41eae67 100644
+index bd69792100..97c808446e 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -295,7 +295,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
@ -77,19 +77,19 @@ index 410bb2893c..9df41eae67 100644
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index eced00f16a..dc5020a632 100644
+index 821423cfe2..ba7ed38412 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -840,7 +840,6 @@
+@@ -853,7 +853,6 @@
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index cb3ea94514..e002846515 100644
+index 4011682faf..6351ce645b 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -296,7 +296,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
@ -101,19 +101,19 @@ index cb3ea94514..e002846515 100644
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 9a7325a373..e1e1df4b9d 100644
+index ea3f8d73bc..55f3315241 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -914,7 +914,6 @@
+@@ -921,7 +921,6 @@
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 765cc46921..e586632664 100644
+index c53501679a..558a944f20 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -321,7 +321,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
@ -124,6 +124,3 @@ index 765cc46921..e586632664 100644
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 -- 
 2.39.3
--- a/0018-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
+++ b/0018-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
@ -1,7 +1,7 @@
-From 1078848167171e47d42cfaa0de2ba5dc1bad4639 Mon Sep 17 00:00:00 2001
+From 34b2ee906d0cce11a8156105777b6ecfaca5feba Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:22 +0200
-Subject: ArmVirtPkg: Remove UdfDxe filesystem driver (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove UdfDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@ -24,10 +24,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 3 files changed, 3 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 8fe5926ece..b1deefc2fd 100644
+index f0946821c6..68ad5877ee 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -461,7 +461,6 @@
+@@ -464,7 +464,6 @@
   MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
@ -36,7 +36,7 @@ index 8fe5926ece..b1deefc2fd 100644
   #
   # Bds
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 5da1481532..2b17211256 100644
+index a997063751..dcb1b793d1 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -83,7 +83,6 @@ READ_LOCK_STATUS   = TRUE
@ -48,10 +48,10 @@ index 5da1481532..2b17211256 100644
   #
   # Status Code Routing
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index c76657d0c4..afebc46a04 100644
+index 8fa801dad6..87e54e682a 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -361,7 +361,6 @@
+@@ -364,7 +364,6 @@
   MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
@ -59,6 +59,3 @@ index c76657d0c4..afebc46a04 100644
   #
   # Bds
 -- 
 2.39.3
--- a/0019-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
+++ b/0019-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
@ -1,7 +1,7 @@
-From c536b7c67fe45bfa1bc27299ba0a584af572e80d Mon Sep 17 00:00:00 2001
+From aac73e5f62e2305e6578c9b22ae557741bf6532a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:25 +0200
-Subject: OvmfPkg: Remove TftpDynamicCommand from shell (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove TftpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@ -27,10 +27,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 6 files changed, 15 deletions(-)
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 5762871fee..ed72cbf57e 100644
+index 07176ad930..0183511722 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -904,10 +904,6 @@
+@@ -913,10 +913,6 @@
 !endif
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@ -42,7 +42,7 @@ index 5762871fee..ed72cbf57e 100644
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 9df41eae67..1d19e20e8a 100644
+index 97c808446e..cb95c842fa 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -54,10 +54,10 @@ index 9df41eae67..1d19e20e8a 100644
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index dc5020a632..9b97e664d7 100644
+index ba7ed38412..66554b42ed 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -918,10 +918,6 @@
+@@ -931,10 +931,6 @@
 !endif
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@ -69,7 +69,7 @@ index dc5020a632..9b97e664d7 100644
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index e002846515..621772963f 100644
+index 6351ce645b..592f0fed82 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -298,7 +298,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -81,10 +81,10 @@ index e002846515..621772963f 100644
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index e1e1df4b9d..8bf848c647 100644
+index 55f3315241..6d1d2bd39b 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -992,10 +992,6 @@
+@@ -999,10 +999,6 @@
 !endif
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@ -96,7 +96,7 @@ index e1e1df4b9d..8bf848c647 100644
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index e586632664..b1d6c23a93 100644
+index 558a944f20..70556f8ace 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -323,7 +323,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -107,6 +107,3 @@ index e586632664..b1d6c23a93 100644
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 -- 
 2.39.3
--- a/0020-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
+++ b/0020-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
@ -1,7 +1,7 @@
-From 2795327b7185bec84238542ce94801733a41ffe3 Mon Sep 17 00:00:00 2001
+From a3493c0945f733e395ea7444f1639a42f8a717f0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:28 +0200
-Subject: ArmVirtPkg: Remove TftpDynamicCommand from shell (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove TftpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@ -23,10 +23,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 2 files changed, 3 insertions(+), 5 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
-index 2443e8351c..9534d6f95a 100644
+index fe6488ee99..5677bad717 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
-@@ -375,10 +375,9 @@
+@@ -385,10 +385,9 @@
   #
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
@ -41,17 +41,14 @@ index 2443e8351c..9534d6f95a 100644
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 2b17211256..16a073c4a1 100644
+index dcb1b793d1..b1c3fcc66d 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-@@ -98,7 +98,6 @@ READ_LOCK_STATUS   = TRUE
+@@ -99,7 +99,6 @@ READ_LOCK_STATUS   = TRUE
-   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
+   INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
   INF ShellPkg/Application/Shell/Shell.inf
 -  INF ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
   INF ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
   INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 -- 
 2.39.3
--- a/0021-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
+++ b/0021-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
@ -1,11 +1,15 @@
-From 8ddd92f068c1f5f5177db1bc381201118bd2816c Mon Sep 17 00:00:00 2001
+From 873a03ce289c988d822f1bb420c1e9a0eef5ca56 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:31 +0200
-Subject: OvmfPkg: Remove HttpDynamicCommand from shell (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove HttpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Rebase to edk2-stable202311:
 Minor update, context change due to new variable policy shell command.
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [15/19] 1911cf04f27467ef1175b1976864c1111d93d19e
@ -27,10 +31,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 6 files changed, 15 deletions(-)
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index ed72cbf57e..078eab1acc 100644
+index 0183511722..970ffbad82 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -904,10 +904,6 @@
+@@ -913,10 +913,6 @@
 !endif
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@ -38,11 +42,11 @@ index ed72cbf57e..078eab1acc 100644
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
-   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 1d19e20e8a..5b2265c7d1 100644
+index cb95c842fa..891e0e06ef 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -54,10 +58,10 @@ index 1d19e20e8a..5b2265c7d1 100644
 !endif
 !if $(BUILD_SHELL) == TRUE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 9b97e664d7..6779503e7e 100644
+index 66554b42ed..3127e3d18d 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -918,10 +918,6 @@
+@@ -931,10 +931,6 @@
 !endif
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@ -65,11 +69,11 @@ index 9b97e664d7..6779503e7e 100644
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
-   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index 621772963f..da32cf1a2f 100644
+index 592f0fed82..61a827b365 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -298,7 +298,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -81,10 +85,10 @@ index 621772963f..da32cf1a2f 100644
 !endif
 !if $(BUILD_SHELL) == TRUE
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 8bf848c647..66f267f731 100644
+index 6d1d2bd39b..6f078b5b27 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -992,10 +992,6 @@
+@@ -999,10 +999,6 @@
 !endif
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@ -92,11 +96,11 @@ index 8bf848c647..66f267f731 100644
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
-   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index b1d6c23a93..7bf83e266c 100644
+index 70556f8ace..d2e1c2894f 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -323,7 +323,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -107,6 +111,3 @@ index b1d6c23a93..7bf83e266c 100644
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 !if $(BUILD_SHELL) == TRUE
 -- 
 2.39.3
--- a/0022-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
+++ b/0022-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
@ -1,11 +1,15 @@
-From a9ad729ef5a9dd474842e2e1e0c8be1166af1afa Mon Sep 17 00:00:00 2001
+From 4b212f0b5f5d2dbe595e53bc0b553abb90ee288a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:34 +0200
-Subject: ArmVirtPkg: Remove HttpDynamicCommand from shell (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove HttpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Rebase to edk2-stable202311:
 Minor update, context change due to new variable policy shell command.
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [16/19] 07a74f1fdcdbb9a31d25ce9760edcd852e9574c3
@ -23,10 +27,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 2 files changed, 5 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
-index 9534d6f95a..d5ebc11ad8 100644
+index 5677bad717..d4c001e1bd 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
-@@ -378,10 +378,6 @@
+@@ -388,10 +388,6 @@
   #
   # UEFI application (Shell Embedded Boot Loader)
   #
@ -34,21 +38,18 @@ index 9534d6f95a..d5ebc11ad8 100644
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
-   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 16a073c4a1..0a01c29722 100644
+index b1c3fcc66d..8153558686 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-@@ -98,7 +98,6 @@ READ_LOCK_STATUS   = TRUE
+@@ -99,7 +99,6 @@ READ_LOCK_STATUS   = TRUE
-   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
+   INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
   INF ShellPkg/Application/Shell/Shell.inf
 -  INF ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
   INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
   #
 -- 
 2.39.3
--- a/0023-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
+++ b/0023-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
@ -1,11 +1,15 @@
-From e07788f7cf34a364b770e2b979942bf1a8b659f0 Mon Sep 17 00:00:00 2001
+From 3635ecb975af26d0d4886b862f8cf812b891eb37 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:39 +0200
-Subject: OvmfPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Rebase to edk2-stable202311:
 Minor update, context change due to new variable policy shell command.
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [17/19] 491fe1301ea29c7cb56c20272e45614d5fcb6f14
@ -25,19 +29,19 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 OvmfPkg/AmdSev/AmdSevX64.dsc |  4 ----
 OvmfPkg/AmdSev/AmdSevX64.fdf |  1 -
- OvmfPkg/OvmfPkgIa32.dsc      | 4 ----
+ OvmfPkg/OvmfPkgIa32.dsc      | 32 ++++++++++++++------------------
 OvmfPkg/OvmfPkgIa32.fdf      |  1 -
- OvmfPkg/OvmfPkgIa32X64.dsc   | 4 ----
+ OvmfPkg/OvmfPkgIa32X64.dsc   | 32 ++++++++++++++------------------
 OvmfPkg/OvmfPkgIa32X64.fdf   |  1 -
- OvmfPkg/OvmfPkgX64.dsc       | 4 ----
+ OvmfPkg/OvmfPkgX64.dsc       | 32 ++++++++++++++------------------
 OvmfPkg/OvmfPkgX64.fdf       |  1 -
- 8 files changed, 20 deletions(-)
+ 8 files changed, 42 insertions(+), 62 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 5987de6d83..427df673f3 100644
+index 41953c119d..7bb6ffb3f0 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -728,10 +728,6 @@
+@@ -740,10 +740,6 @@
   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@ -49,10 +53,10 @@ index 5987de6d83..427df673f3 100644
   OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf
   OvmfPkg/AmdSev/Grub/Grub.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index 4d2f9c7248..a48c93e2a5 100644
+index 2f03c80ffd..0e3d7bea2b 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
-@@ -274,7 +274,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+@@ -276,7 +276,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@ -61,13 +65,69 @@ index 4d2f9c7248..a48c93e2a5 100644
 INF OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf
 INF  OvmfPkg/AmdSev/Grub/Grub.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 078eab1acc..147774ef58 100644
+index 970ffbad82..83adecc374 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -904,10 +904,6 @@
+@@ -537,7 +537,7 @@
- !endif
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
 -  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
 +  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
- !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
@@ -604,7 +604,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
 -  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
 !if $(SMM_REQUIRE) == FALSE
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
@@ -840,25 +840,25 @@
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 -  }
 +  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
 !ifndef $(CSM_ENABLE)
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 -  }
 +  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
 !endif
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 -  }
 +  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
   #
   # ISA Support
@@ -917,10 +917,6 @@
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@ -76,7 +136,7 @@ index 078eab1acc..147774ef58 100644
 !if $(BUILD_SHELL) == TRUE
   ShellPkg/Application/Shell/Shell.inf {
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 5b2265c7d1..56f2c45795 100644
+index 891e0e06ef..88c57ff5ff 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -88,13 +148,69 @@ index 5b2265c7d1..56f2c45795 100644
 !if $(BUILD_SHELL) == TRUE
 INF  ShellPkg/Application/Shell/Shell.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 6779503e7e..a41bc32454 100644
+index 3127e3d18d..b47cdf63e7 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -918,10 +918,6 @@
+@@ -544,7 +544,7 @@
- !endif
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
 -  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
 +  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
- !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
@@ -616,7 +616,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
 -  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
 !if $(SMM_REQUIRE) == FALSE
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
@@ -858,25 +858,25 @@
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 -  }
 +  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
 !ifndef $(CSM_ENABLE)
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 -  }
 +  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
 !endif
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 -  }
 +  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
   #
   # ISA Support
@@ -935,10 +935,6 @@
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@ -103,7 +219,7 @@ index 6779503e7e..a41bc32454 100644
 !if $(BUILD_SHELL) == TRUE
   ShellPkg/Application/Shell/Shell.inf {
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index da32cf1a2f..9efbe6a06d 100644
+index 61a827b365..ab5a9bc306 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -298,7 +298,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -115,13 +231,69 @@ index da32cf1a2f..9efbe6a06d 100644
 !if $(BUILD_SHELL) == TRUE
 INF  ShellPkg/Application/Shell/Shell.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 66f267f731..ce363f748f 100644
+index 6f078b5b27..be3824ec1e 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -992,10 +992,6 @@
+@@ -563,7 +563,7 @@
- !endif
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
 -  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
 +  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
- !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
@@ -634,7 +634,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
 -  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
 !if $(SMM_REQUIRE) == FALSE
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
@@ -926,25 +926,25 @@
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 -  }
 +  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
 !ifndef $(CSM_ENABLE)
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 -  }
 +  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
 !endif
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 -  }
 +  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
   #
   # ISA Support
@@ -1003,10 +1003,6 @@
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@ -130,7 +302,7 @@ index 66f267f731..ce363f748f 100644
 !if $(BUILD_SHELL) == TRUE
   ShellPkg/Application/Shell/Shell.inf {
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 7bf83e266c..404e72dc7d 100644
+index d2e1c2894f..851399888f 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -323,7 +323,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -141,6 +313,3 @@ index 7bf83e266c..404e72dc7d 100644
 !endif
 !if $(BUILD_SHELL) == TRUE
 INF  ShellPkg/Application/Shell/Shell.inf
 -- 
 2.39.3
--- a/0024-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
+++ b/0024-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
@ -1,11 +1,15 @@
-From df6b72f26ffb68a28c45f426ad3225388e5fccff Mon Sep 17 00:00:00 2001
+From b91bdc055499a46d825b3c6a2613de5c77e3a66d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:46 +0200
-Subject: ArmVirtPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Rebase to edk2-stable202311:
 Minor update, context change due to new variable policy shell command.
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [18/19] 8f4e4007108462533e3d2050b84d8830073a7c0d
@ -19,18 +23,28 @@ Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- ArmVirtPkg/ArmVirt.dsc.inc           | 4 ----
+ ArmVirtPkg/ArmVirt.dsc.inc           | 10 +++-------
 ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc |  1 -
- 2 files changed, 5 deletions(-)
+ 2 files changed, 3 insertions(+), 8 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
-index d5ebc11ad8..0b2b64c1cb 100644
+index d4c001e1bd..fee6e5b17f 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
-@@ -378,10 +378,6 @@
+@@ -385,17 +385,13 @@
   #
   # UEFI application (Shell Embedded Boot Loader)
   #
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
 -  #
 -  # UEFI application (Shell Embedded Boot Loader)
 -  #
 +  #
 +  # UEFI application (Shell Embedded Boot Loader)
 +  #
   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@ -39,17 +53,14 @@ index d5ebc11ad8..0b2b64c1cb 100644
     <LibraryClasses>
       ShellCommandLib|ShellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.inf
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 0a01c29722..4dbb77a6ca 100644
+index 8153558686..4cd53995d2 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-@@ -98,7 +98,6 @@ READ_LOCK_STATUS   = TRUE
+@@ -100,7 +100,6 @@ READ_LOCK_STATUS   = TRUE
   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
   INF ShellPkg/Application/Shell/Shell.inf
   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
 -  INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
   #
   # Bds
 -- 
 2.39.3
--- a/0025-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
+++ b/0025-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
@ -1,7 +1,7 @@
-From a920227615c895522739bbbf3a5fb7f6a470de86 Mon Sep 17 00:00:00 2001
+From 41089770963055b4bc9662ba4204d8ee7907fbcd Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 28 Feb 2023 15:47:00 +0100
-Subject: [PATCH 09/12] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
+Subject: [PATCH] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 42: UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
@ -13,15 +13,19 @@ In case the number of CPUs can in increase beyond 255
 due to CPU hotplug choose x2apic mode.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 patch_name: edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
 present_in_specfile: true
 location_in_specfile: 38
 ---
 UefiCpuPkg/Library/MpInitLib/MpLib.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
 diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
-index f1f2840714..79fd8fb04d 100644
+index 9a6ec5db5c..14ecc62f2b 100644
 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
 +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
-@@ -526,7 +526,9 @@ CollectProcessorCount (
+@@ -527,7 +527,9 @@ CollectProcessorCount (
   //
   // Enable x2APIC mode if
   //  1. Number of CPU is greater than 255; or
@ -32,7 +36,7 @@ index f1f2840714..79fd8fb04d 100644
   //
   X2Apic = FALSE;
   if (CpuMpData->CpuCount > 255) {
-@@ -534,6 +536,10 @@ CollectProcessorCount (
+@@ -535,6 +537,10 @@ CollectProcessorCount (
     // If there are more than 255 processor found, force to enable X2APIC
     //
     X2Apic = TRUE;
@ -43,6 +47,3 @@ index f1f2840714..79fd8fb04d 100644
   } else {
     CpuInfoInHob = (CPU_INFO_IN_HOB *)(UINTN)CpuMpData->CpuInfoInHob;
     for (Index = 0; Index < CpuMpData->CpuCount; Index++) {
 -- 
 2.39.3
--- a/0025-recreate-import-redhat-directory.patch
+++ b/0025-recreate-import-redhat-directory.patch
@ -1,164 +0,0 @@
 From 37e0f9ed6e872224afe70065627de3965689425c Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 11 Jun 2014 20:45:26 +0200
 Subject: recreate / import "redhat/" directory
 This patch now unites the following downstream commits:
 - 18bd1193e7 .distro: simplify WORKSPACE setup
 - b00f3398c8 fix tpm build options
 - e032ab1675 spec: Centralize non-firmware %install files at the top
 - 8501863acc spec: Don't put build output in the top directory
 - e6ec0363d3 spec: Factor out OVMF_FLAGS and OVMF_SB_FLAGS
 - 596f34c8b6 spec: Use %make_build macro
 - 55169e466d spec: Replace RPM_BUILD_ROOT with %{buildroot}
 - 69c4c60920 spec: Split out build_iso() function
 - ed67da8c85 spec: Add %{qosb_testing} macro
 - 44519f5b94 spec: Move %check to between %install and %files
 - b37b334dc7 spec: Remove extra 'true' at end of %check
 - dd11149c3a spec: Add %{qemu_package} and %{qemu_binary}
 - 0f5d4ae0d5 spec: Move -D TPM_ENABLE to common CC_FLAGS
 - 84b3fd93f9 spec: Replace ifarch+else conditionals with build_XXX variables
 - e97f79e744 spec: Use %autosetup with our required git config options
 - 45a347a759 spec: don't conditionalize %package definitions
 - acfcfaea1e spec: Add BuildRequires: make
 - d917a93f6f spec: remove Group: and %defattr
 - f2d3be3ae3 redhat: build UefiShell.iso with xorriso rather than genisoimage
 - 3fb4a20f30 redhat: narrow the "qemu-kvm" BuildRequires down to "qemu-kvm-core"
 - bfb89c4ae5 redhat: drop Split tool from the edk2-tools subpackage
 - ac8be2e0ef redhat: refresh "Makefile.common" for the 8.5 rebase
 - 2bd2d18864 redhat: filter out jansson submodule removal hunks
 - f13d7899ed recreate / import "redhat/" directory
 Merged patches (edk2-stable202202):
 - 1a7b1c3b72 spec: adapt specfile to build option changes, disable tpm1
 - 96eb388be3 spec: build amdsev variant
 - ea34352d41 redhat: bump OpenSSL dist-git submodule to a75722161d20 / RHEL-8.5
 Merged patches (edk2-stable202208):
 - a60bf3fd10 Adding support for CentOS 9 build
 - d3f25d438c OvmfPkg: Update target machines config
 - d63f783930 openssl: jump to 8.7.0 branch (2022-07-22)
 - 39882ce96d qemu-ovmf-secureboot: Do not use submodule
 - 283ef4a67d ovmf-vars-generator: Use max cpu
 - b6887ef7e1 Update build target to RHEL 9.2.0
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Merged patches (edk2-stable202305):
 - 5eef16bd65 remove amd-sev feature flag from secure boot builds (rh only)
 - cc9e1b6eaa build script update
 - 046c1f08e6 PcdDxeNxMemoryProtectionPolicy update
 - b9dc1b5365 add aarch64 qcow2 images
 - f4e2d6bf41 update json files
 - be03b42128 add libvirt version conflict
 - dce699b61d add dbx update blob (rh only)
 - d8b2407343 spec: apply dbx update (rh only)
 - a8a5ef95b5 dbx update, 2023-05-09, black lotus edition
 - 310e179053 json descriptors: explicitly set mode = split
 - additionally
  - update frh.py, add new upstream submodules
  - replace egrep with grep -E and fgrep with grep -F in downstream
    scripts
  - remove git commit sha from package version string
 Signed-off-by: Oliver Steffen <osteffen@redhat.com>
 drop  git sha
 Signed-off-by: Oliver Steffen <osteffen@redhat.com>
 ---
 .distro/.gitignore                            |    3 +
 .distro/DBXUpdate-20230314.x64.bin            |  Bin 0 -> 13922 bytes
 .distro/DBXUpdate-20230509.x64.bin            |  Bin 0 -> 21170 bytes
 .distro/Makefile                              |  114 +
 .distro/Makefile.common                       |   31 +
 .distro/README                                |  236 ++
 .distro/RedHatSecureBootPkKek1.pem            |   22 +
 .distro/TargetRelease                         |    4 +
 .distro/edk2-build.py                         |  391 +++
 .distro/edk2-build.rhel-9                     |  119 +
 .distro/edk2.spec.template                    | 1301 +++++++++
 .../30-edk2-ovmf-x64-sb-enrolled.json         |   36 +
 .distro/metafiles/40-edk2-ovmf-x64-sb.json    |   35 +
 .distro/metafiles/50-edk2-aarch64-qcow2.json  |   32 +
 .distro/metafiles/50-edk2-ovmf-x64-nosb.json  |   35 +
 .distro/metafiles/51-edk2-aarch64-raw.json    |   32 +
 .../52-edk2-aarch64-verbose-qcow2.json        |   32 +
 .../53-edk2-aarch64-verbose-raw.json          |   32 +
 .../metafiles/60-edk2-ovmf-x64-amdsev.json    |   31 +
 .../metafiles/60-edk2-ovmf-x64-inteltdx.json  |   29 +
 .distro/openssl-rhel                          |    1 +
 .distro/ovmf-whitepaper-c770f8c.txt           | 2422 +++++++++++++++++
 .distro/qemu-ovmf-secureboot/CONTRIBUTING     |   45 +
 .distro/qemu-ovmf-secureboot/LICENSE          |   21 +
 .distro/qemu-ovmf-secureboot/README.md        |   66 +
 .../qemu-ovmf-secureboot/ovmf-vars-generator  |  296 ++
 .distro/rpmbuild/BUILD/.gitignore             |    2 +
 .distro/rpmbuild/RPMS/.gitignore              |    2 +
 .distro/rpmbuild/SOURCES/.gitignore           |    2 +
 .distro/rpmbuild/SPECS/.gitignore             |    2 +
 .distro/rpmbuild/SRPMS/.gitignore             |    2 +
 .distro/scripts/edk2-guids                    |   85 +
 .distro/scripts/frh.py                        |   51 +
 .distro/scripts/git-backport-diff             |  327 +++
 .distro/scripts/git-compile-check             |  215 ++
 .distro/scripts/openssl-update                |   79 +
 .distro/scripts/process-patches.sh            |   75 +
 .distro/scripts/tarball_checksum.sh           |    3 +
 .gitattributes                                |   15 +
 .gitignore                                    |   16 +-
 .gitmodules                                   |    4 +
 sources                                       |    1 +
 42 files changed, 6240 insertions(+), 7 deletions(-)
 create mode 100644 .distro/.gitignore
 create mode 100644 .distro/DBXUpdate-20230314.x64.bin
 create mode 100644 .distro/DBXUpdate-20230509.x64.bin
 create mode 100644 .distro/Makefile
 create mode 100644 .distro/Makefile.common
 create mode 100644 .distro/README
 create mode 100644 .distro/RedHatSecureBootPkKek1.pem
 create mode 100644 .distro/TargetRelease
 create mode 100755 .distro/edk2-build.py
 create mode 100644 .distro/edk2-build.rhel-9
 create mode 100644 .distro/edk2.spec.template
 create mode 100644 .distro/metafiles/30-edk2-ovmf-x64-sb-enrolled.json
 create mode 100644 .distro/metafiles/40-edk2-ovmf-x64-sb.json
 create mode 100644 .distro/metafiles/50-edk2-aarch64-qcow2.json
 create mode 100644 .distro/metafiles/50-edk2-ovmf-x64-nosb.json
 create mode 100644 .distro/metafiles/51-edk2-aarch64-raw.json
 create mode 100644 .distro/metafiles/52-edk2-aarch64-verbose-qcow2.json
 create mode 100644 .distro/metafiles/53-edk2-aarch64-verbose-raw.json
 create mode 100644 .distro/metafiles/60-edk2-ovmf-x64-amdsev.json
 create mode 100644 .distro/metafiles/60-edk2-ovmf-x64-inteltdx.json
 create mode 160000 .distro/openssl-rhel
 create mode 100644 .distro/ovmf-whitepaper-c770f8c.txt
 create mode 100644 .distro/qemu-ovmf-secureboot/CONTRIBUTING
 create mode 100644 .distro/qemu-ovmf-secureboot/LICENSE
 create mode 100644 .distro/qemu-ovmf-secureboot/README.md
 create mode 100755 .distro/qemu-ovmf-secureboot/ovmf-vars-generator
 create mode 100644 .distro/rpmbuild/BUILD/.gitignore
 create mode 100644 .distro/rpmbuild/RPMS/.gitignore
 create mode 100644 .distro/rpmbuild/SOURCES/.gitignore
 create mode 100644 .distro/rpmbuild/SPECS/.gitignore
 create mode 100644 .distro/rpmbuild/SRPMS/.gitignore
 create mode 100755 .distro/scripts/edk2-guids
 create mode 100644 .distro/scripts/frh.py
 create mode 100755 .distro/scripts/git-backport-diff
 create mode 100755 .distro/scripts/git-compile-check
 create mode 100755 .distro/scripts/openssl-update
 create mode 100755 .distro/scripts/process-patches.sh
 create mode 100755 .distro/scripts/tarball_checksum.sh
 create mode 100644 .gitattributes
 create mode 100644 sources
 diff --git a/sources b/sources
 new file mode 100644
 index 0000000000..ea8c8ad50b
 --- /dev/null
 +++ b/sources
@@ -0,0 +1 @@
 +SHA512 (edk2-ba91d0292e.tar.xz) = 3b21cc39671d28bfeb059da3683751cc5277c63a894b2a05bdfbd2bbe53545c34f04c229becf44f1563f89a738f37ae8f2333076d126a7e94d234bc4bb25454c
 -- 
 2.39.3
--- a/0026-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
+++ b/0026-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
@ -1,181 +0,0 @@
 From fb3719378d7ce646c684fc2c8b52806aca0c576a Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Sat, 16 Nov 2019 17:11:27 +0100
 Subject: CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files in the INFs
 (RH)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
 - Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1938257
 - Recreate the patch based on downstream commits:
  - 56c4bb81b311 ("CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files
                  in the INFs (RH)", 2020-06-05),
  - e81751a1c303 ("CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1g",
                  2020-11-23),
  - 3e3fe5e62079 ("redhat: bump OpenSSL dist-git submodule to 1.1.1g+ /
                  RHEL-8.4", 2020-11-23).
  (1) At e81751a1c303, downstream edk2 was in sync with upstream edk2
      consuming OpenSSL 1.1.1g (upstream edk2 commit 8c30327debb2
      ("CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1g", 2020-07-25)).
      Since commit 8c30327debb2, upstream edk2 modified the OpensslLib INF
      files, namely
      - CryptoPkg/Library/OpensslLib/OpensslLib.inf
      - CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
      in the following commits only:
      - be01087e0780 ("CryptoPkg/Library: Remove the redundant build
        option", 2020-08-12), which did not affect the source file list at
        all,
      - b5701a4c7a0f ("CryptoPkg: OpensslLib: Use RngLib to generate
        entropy in rand_pool", 2020-09-18), which replaced some of the
        *edk2-specific* "rand_pool_noise" source files with an RngLib
        dependency.
      This means that the list of required, actual OpenSSL source files
      has not changed in upstream edk2 since our downstream edk2 commit
      e81751a1c303.
  (2) At commit 3e3fe5e62079 (the direct child of e81751a1c303),
      downstream edk2's OpenSSL dependency was satisfied with RHEL-8
      OpenSSL at dist-git commit bdd048e929dc ("Two fixes that will be
      shipped in RHEL-8.3.0.z", 2020-10-23).
      Since commit bdd048e929dc, RHEL-8 OpenSSL dist-git advanced
      (fast-forwarded) to commit a75722161d20 ("Update to version 1.1.1k",
      2021-05-25), which is the current head of the rhel-8.5.0 branch.
      (See also <https://bugzilla.redhat.com/show_bug.cgi?id=1938257#c6>.)
      At both dist-git bdd048e929dc and dist-git a75722161d20, I built the
      respective RHEL-8 OpenSSL *source* RPM, and prepped the respective
      source tree, with "rpmbuild -bp". Subsequently I compared the
      prepped source trees recursively.
      - The following files disappeared:
        - 29 backup files created by "patch",
        - the assembly generator perl script called
          "ecp_nistz256-avx2.pl", which is not used during the build.
      - The following new files appeared:
        - 18 files directly or indirectly under the "test" subdirectory,
          which are not used during the build,
        - 5 backup files created by "patch",
        - 2 DCL scripts used when building OpenSSL on OpenVMS.
      This means that the total list of RHEL-8 OpenSSL source files has
      not changed in RHEL-8 OpenSSL dist-git since our downstream edk2
      commit 3e3fe5e62079.
  As a result, copy the "RHEL8-specific OpenSSL file list" sections
  verbatim from the INF files, at downstream commit e81751a1c303. (I used
  the "git checkout -p e81751a1c303 -- Library/OpensslLib/OpensslLib.inf
  CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf" command.)
 Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
 RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
 - "OpensslLib.inf":
  - Automatic leading context refresh against upstream commit c72ca4666886
    ("CryptoPkg/OpensslLib: Add "sort" keyword to header file parsing
    loop", 2020-03-10).
  - Manual trailing context refresh against upstream commit b49a6c8f80d9
    ("CryptoPkg/OpensslLib: improve INF file consistency", 2019-12-02).
 - "OpensslLibCrypto.inf":
  - Automatic leading context refresh against upstream commits
    8906f076de35 ("CryptoPkg/OpensslLib: Add missing header files in INF
    file", 2019-08-16) and 9f4fbd56d430 ("CryptoPkg/OpensslLib: Update
    process_files.pl to generate .h files", 2019-10-30).
 Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
 RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
 - new patch
 The downstream changes in RHEL8's OpenSSL package, for example in
 "openssl-1.1.1-evp-kdf.patch", introduce new files, and even move some
 preexistent code into those new files. In order to avoid undefined
 references in link editing, we have to list the new files.
 Note: "process_files.pl" is not re-run at this time manually, because
 (a) "process_files.pl" would pollute the file list (and some of the
    auto-generated header files) with RHEL8-specific FIPS artifacts, which
    are explicitly unwanted in edk2,
 (b) The RHEL OpenSSL maintainer, Tomas Mraz, identified this specific set
    of files in <https://bugzilla.redhat.com/show_bug.cgi?id=1749693#c10>,
    and will help with future changes too.
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit 57bd3f146590df8757865d8f2cdd1db3cf3f4d40)
 (cherry picked from commit 56c4bb81b311dfcee6a34c81d3e4feeda7f88995)
 ---
 CryptoPkg/Library/OpensslLib/OpensslLib.inf       | 12 ++++++++++++
 CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 12 ++++++++++++
 2 files changed, 24 insertions(+)
 diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
 index 0f64c9fa7e..1641754e4d 100644
 --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
 +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
@@ -576,6 +576,18 @@
   $(OPENSSL_PATH)/ssl/statem/statem.h
   $(OPENSSL_PATH)/ssl/statem/statem_local.h
 # Autogenerated files list ends here
 +# RHEL8-specific OpenSSL file list starts here
 +  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
 +  $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
 +  $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
 +  $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
 +  $(OPENSSL_PATH)/crypto/kdf/kdf_local.h
 +  $(OPENSSL_PATH)/crypto/kdf/kdf_util.c
 +  $(OPENSSL_PATH)/crypto/kdf/krb5kdf.c
 +  $(OPENSSL_PATH)/crypto/kdf/pbkdf2.c
 +  $(OPENSSL_PATH)/crypto/kdf/sshkdf.c
 +  $(OPENSSL_PATH)/crypto/kdf/sskdf.c
 +# RHEL8-specific OpenSSL file list ends here
   buildinf.h
   ossl_store.c
   rand_pool.c
 diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
 index 311cd1e605..7e980a7d03 100644
 --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
 +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
@@ -526,6 +526,18 @@
   $(OPENSSL_PATH)/crypto/x509v3/standard_exts.h
   $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
 # Autogenerated files list ends here
 +# RHEL8-specific OpenSSL file list starts here
 +  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
 +  $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
 +  $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
 +  $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
 +  $(OPENSSL_PATH)/crypto/kdf/kdf_local.h
 +  $(OPENSSL_PATH)/crypto/kdf/kdf_util.c
 +  $(OPENSSL_PATH)/crypto/kdf/krb5kdf.c
 +  $(OPENSSL_PATH)/crypto/kdf/pbkdf2.c
 +  $(OPENSSL_PATH)/crypto/kdf/sshkdf.c
 +  $(OPENSSL_PATH)/crypto/kdf/sskdf.c
 +# RHEL8-specific OpenSSL file list ends here
   buildinf.h
   ossl_store.c
   rand_pool.c
 -- 
 2.39.3
--- a/0026-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
+++ b/0026-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
@ -1,7 +1,7 @@
-From 9f0b4df867e6a2d56838e4048be245eac3fcc18e Mon Sep 17 00:00:00 2001
+From 5870362631ee204936f495b8e60eb2611bb05c3b Mon Sep 17 00:00:00 2001
 From: Oliver Steffen <osteffen@redhat.com>
 Date: Wed, 16 Aug 2023 12:09:40 +0200
-Subject: [PATCH 3/3] OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
+Subject: [PATCH] OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
 RH-Author: Oliver Steffen <osteffen@redhat.com>
 RH-MergeRequest: 46: OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
@ -17,6 +17,10 @@ guest that uses shim is booted with a vtpm device present.
 BZ 2218196
 Signed-off-by: Oliver Steffen <osteffen@redhat.com>
 patch_name: edk2-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
 present_in_specfile: true
 location_in_specfile: 44
 ---
 OvmfPkg/AmdSevDxe/AmdSevDxe.c   | 42 +++++++++++++++++++++++++++++++++
 OvmfPkg/AmdSevDxe/AmdSevDxe.inf |  2 ++
@ -115,6 +119,3 @@ index e7c7d526c9..09cbd2b0ca 100644
 [Pcd]
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId
 -- 
 2.39.3
--- a/0027-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch
+++ b/0027-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch
@ -1,27 +0,0 @@
 From 218d3b32592bffe5ec7317c4838d29e92b4b86f0 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Thu, 2 Mar 2023 12:01:36 +0100
 Subject: OvmfPkg: disable dynamic mmio window (rhel only)
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
 OvmfPkg/Library/PlatformInitLib/MemDetect.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
 index acf90b4e93..86700fc028 100644
 --- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
 +++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
@@ -679,7 +679,8 @@ PlatformDynamicMmioWindow (
   AddrSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth);
   MmioSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth - 3);
 -  if ((PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
 +  if (FALSE /* disable for RHEL-9.2, libvirt is not ready yet */ &&
 +      (PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
       (PlatformInfoHob->PcdPciMmio64Base + MmioSpace < AddrSpace))
   {
     DEBUG ((DEBUG_INFO, "%a: using dynamic mmio window\n", __func__));
 -- 
 2.39.3
--- a/0027-recreate-import-.distro-directory.patch
+++ b/0027-recreate-import-.distro-directory.patch
@ -0,0 +1,85 @@
 From 771ce5bae1eb03240b04dde05a7a40dcec3c8a10 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 11 Jun 2014 20:45:26 +0200
 Subject: [PATCH] recreate / import ".distro/" directory
 This patch now unites the following downstream commits:
 - 18bd1193e7 .distro: simplify WORKSPACE setup
 - b00f3398c8 fix tpm build options
 - e032ab1675 spec: Centralize non-firmware %install files at the top
 - 8501863acc spec: Don't put build output in the top directory
 - e6ec0363d3 spec: Factor out OVMF_FLAGS and OVMF_SB_FLAGS
 - 596f34c8b6 spec: Use %make_build macro
 - 55169e466d spec: Replace RPM_BUILD_ROOT with %{buildroot}
 - 69c4c60920 spec: Split out build_iso() function
 - ed67da8c85 spec: Add %{qosb_testing} macro
 - 44519f5b94 spec: Move %check to between %install and %files
 - b37b334dc7 spec: Remove extra 'true' at end of %check
 - dd11149c3a spec: Add %{qemu_package} and %{qemu_binary}
 - 0f5d4ae0d5 spec: Move -D TPM_ENABLE to common CC_FLAGS
 - 84b3fd93f9 spec: Replace ifarch+else conditionals with build_XXX variables
 - e97f79e744 spec: Use %autosetup with our required git config options
 - 45a347a759 spec: don't conditionalize %package definitions
 - acfcfaea1e spec: Add BuildRequires: make
 - d917a93f6f spec: remove Group: and %defattr
 - f2d3be3ae3 redhat: build UefiShell.iso with xorriso rather than genisoimage
 - 3fb4a20f30 redhat: narrow the "qemu-kvm" BuildRequires down to "qemu-kvm-core"
 - bfb89c4ae5 redhat: drop Split tool from the edk2-tools subpackage
 - ac8be2e0ef redhat: refresh "Makefile.common" for the 8.5 rebase
 - 2bd2d18864 redhat: filter out jansson submodule removal hunks
 - f13d7899ed recreate / import "redhat/" directory
 Merged patches (edk2-stable202202):
 - 1a7b1c3b72 spec: adapt specfile to build option changes, disable tpm1
 - 96eb388be3 spec: build amdsev variant
 - ea34352d41 redhat: bump OpenSSL dist-git submodule to a75722161d20 / RHEL-8.5
 Merged patches (edk2-stable202208):
 - a60bf3fd10 Adding support for CentOS 9 build
 - d3f25d438c OvmfPkg: Update target machines config
 - d63f783930 openssl: jump to 8.7.0 branch (2022-07-22)
 - 39882ce96d qemu-ovmf-secureboot: Do not use submodule
 - 283ef4a67d ovmf-vars-generator: Use max cpu
 - b6887ef7e1 Update build target to RHEL 9.2.0
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 Merged patches (edk2-stable202305):
 - 5eef16bd65 remove amd-sev feature flag from secure boot builds (rh only)
 - cc9e1b6eaa build script update
 - 046c1f08e6 PcdDxeNxMemoryProtectionPolicy update
 - b9dc1b5365 add aarch64 qcow2 images
 - f4e2d6bf41 update json files
 - be03b42128 add libvirt version conflict
 - dce699b61d add dbx update blob (rh only)
 - d8b2407343 spec: apply dbx update (rh only)
 - a8a5ef95b5 dbx update, 2023-05-09, black lotus edition
 - 310e179053 json descriptors: explicitly set mode = split
 - additionally
  - update frh.py, add new upstream submodules
  - replace egrep with grep -E and fgrep with grep -F in downstream
    scripts
  - remove git commit sha from package version string
 Signed-off-by: Oliver Steffen <osteffen@redhat.com>
 Rebase to edk2-stable202311: squash commits:
 - 5b833f0c8d Update TargetRelease to support 9.4.0
 - 20024b4cbe Use fixed length for short hash for Makefile
 - 8618f7367e Updated TargetRelease content to support 9.4.0 only.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
 sources | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 sources
 diff --git a/sources b/sources
 new file mode 100644
 index 0000000000..ea8c8ad50b
 --- /dev/null
 +++ b/sources
@@ -0,0 +1 @@
 +SHA512 (edk2-ba91d0292e.tar.xz) = 3b21cc39671d28bfeb059da3683751cc5277c63a894b2a05bdfbd2bbe53545c34f04c229becf44f1563f89a738f37ae8f2333076d126a7e94d234bc4bb25454c
--- a/0028-ArmPkg-Disable-EFI_MEMORY_ATTRIBUTE_PROTOCOL-RH-only.patch
+++ b/0028-ArmPkg-Disable-EFI_MEMORY_ATTRIBUTE_PROTOCOL-RH-only.patch
@ -1,76 +0,0 @@
 From 5c2e46b64824e5432181507ec0706f7fe74c3fe2 Mon Sep 17 00:00:00 2001
 From: Oliver Steffen <osteffen@redhat.com>
 Date: Mon, 19 Jun 2023 11:21:52 +0200
 Subject: ArmPkg: Disable EFI_MEMORY_ATTRIBUTE_PROTOCOL (RH only)
 Recent versions of shim (15.6 and 15.7) crash when the newly added
 EFI_MEMORY_ATTRIBUTE_PROTOCOL is provided by the firmware.  To allow
 existing installations to boot, provide a workaround in form of a Pcd
 that allows tuning it off at build time (defaults to 'enabled').
 Additionally, check the return code of the protocol installation calls.
 Disable the EFI_MEMORY_ATTRIBUTE_PROTOCOL protocol out builds.
 Signed-off-by: Oliver Steffen <osteffen@redhat.com>
 ---
 .distro/edk2-build.rhel-9        |  2 ++
 ArmPkg/ArmPkg.dec                |  3 +++
 ArmPkg/Drivers/CpuDxe/CpuDxe.c   | 13 +++++++++++--
 ArmPkg/Drivers/CpuDxe/CpuDxe.inf |  1 +
 4 files changed, 17 insertions(+), 2 deletions(-)
 diff --git a/ArmPkg/ArmPkg.dec b/ArmPkg/ArmPkg.dec
 index 2444457ae5..d9e579b5fa 100644
 --- a/ArmPkg/ArmPkg.dec
 +++ b/ArmPkg/ArmPkg.dec
@@ -167,6 +167,9 @@
   gArmTokenSpaceGuid.PcdCpuVectorBaseAddress|0xffff0000|UINT64|0x00000004
   gArmTokenSpaceGuid.PcdCpuResetAddress|0x00000000|UINT32|0x00000005
 +  # Enable/Disable EFI_MEMORY_ATTRIBUTE_PROTOCOL
 +  gArmTokenSpaceGuid.PcdEnableEfiMemoryAttributeProtocol|TRUE|BOOLEAN|0x000000EE
 +
   #
   # ARM Secure Firmware PCDs
   #
 diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.c b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
 index d04958e79e..ff7d735b2b 100644
 --- a/ArmPkg/Drivers/CpuDxe/CpuDxe.c
 +++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
@@ -244,10 +244,19 @@ CpuDxeInitialize (
                   &mCpuHandle,
                   &gEfiCpuArchProtocolGuid,
                   &mCpu,
 -                  &gEfiMemoryAttributeProtocolGuid,
 -                  &mMemoryAttribute,
                   NULL
                   );
 +  ASSERT_EFI_ERROR (Status);
 +
 +  if (PcdGetBool (PcdEnableEfiMemoryAttributeProtocol)) {
 +    Status = gBS->InstallMultipleProtocolInterfaces (
 +                    &mCpuHandle,
 +                    &gEfiMemoryAttributeProtocolGuid,
 +                    &mMemoryAttribute,
 +                    NULL
 +                    );
 +    ASSERT_EFI_ERROR (Status);
 +  }
   //
   // Make sure GCD and MMU settings match. This API calls gDS->SetMemorySpaceAttributes ()
 diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.inf b/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
 index e732e21cb9..1bad4ae160 100644
 --- a/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
 +++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
@@ -64,6 +64,7 @@
 [Pcd.common]
   gArmTokenSpaceGuid.PcdVFPEnabled
 +  gArmTokenSpaceGuid.PcdEnableEfiMemoryAttributeProtocol
 [FeaturePcd.common]
   gArmTokenSpaceGuid.PcdDebuggerExceptionSupport
 -- 
 2.39.3
--- a/0028-distro-apply-git-diff-c9s-new_c9s-by-mirek.patch
+++ b/0028-distro-apply-git-diff-c9s-new_c9s-by-mirek.patch
@ -0,0 +1,27 @@
 From c0347206c55c9d4d69b46725e9edbb21448f7494 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 28 Nov 2023 12:11:55 +0100
 Subject: [PATCH] distro: apply 'git diff c9s new_c9s' by mirek
 Bring .distro toi latest standards for more automatic support.
 ---
 CryptoPkg/.gitignore | 1 -
 sources              | 1 -
 2 files changed, 2 deletions(-)
 delete mode 100644 CryptoPkg/.gitignore
 delete mode 100644 sources
 diff --git a/CryptoPkg/.gitignore b/CryptoPkg/.gitignore
 deleted file mode 100644
 index 68b83272b7..0000000000
 --- a/CryptoPkg/.gitignore
 +++ /dev/null
@@ -1 +0,0 @@
 -Library/OpensslLib/openssl*/
 diff --git a/sources b/sources
 deleted file mode 100644
 index ea8c8ad50b..0000000000
 --- a/sources
 +++ /dev/null
@@ -1 +0,0 @@
 -SHA512 (edk2-ba91d0292e.tar.xz) = 3b21cc39671d28bfeb059da3683751cc5277c63a894b2a05bdfbd2bbe53545c34f04c229becf44f1563f89a738f37ae8f2333076d126a7e94d234bc4bb25454c
--- a/0029-CryptoPkg-CrtLib-add-stat.h-include-file.patch
+++ b/0029-CryptoPkg-CrtLib-add-stat.h-include-file.patch
@ -0,0 +1,28 @@
 From 192cc2b49dbccc59f5731e2abc120bed3e06cc32 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Mon, 28 Aug 2023 13:11:02 +0200
 Subject: [PATCH] CryptoPkg/CrtLib: add stat.h include file.
 Needed by rhel downstream openssl patches.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
 CryptoPkg/Library/Include/sys/stat.h | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 CryptoPkg/Library/Include/sys/stat.h
 diff --git a/CryptoPkg/Library/Include/sys/stat.h b/CryptoPkg/Library/Include/sys/stat.h
 new file mode 100644
 index 0000000000..22247bb2db
 --- /dev/null
 +++ b/CryptoPkg/Library/Include/sys/stat.h
@@ -0,0 +1,9 @@
 +/** @file
 +  Include file to support building the third-party cryptographic library.
 +
 +Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.<BR>
 +SPDX-License-Identifier: BSD-2-Clause-Patent
 +
 +**/
 +
 +#include <CrtLibSupport.h>
--- a/0029-OvmfPkg-PciHotPlugInitDxe-Do-not-reserve-IO-ports-by.patch
+++ b/0029-OvmfPkg-PciHotPlugInitDxe-Do-not-reserve-IO-ports-by.patch
@ -1,46 +0,0 @@
 From 8f924bd2691789f6b0d9deae9ddb046677a0610b Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 16 May 2023 11:47:58 +0200
 Subject: OvmfPkg/PciHotPlugInitDxe: Do not reserve IO ports by default.
 Flip the default for IO address space reservations for PCI(e) bridges
 and root ports with hotplug support from TRUE to FALSE.
 PCI(e) bridges will still get IO address space assigned in case:
  (a) Downstream devices actually need IO address space, or
  (b) Explicit configuration, using "qemu -device
      pcie-root-port,io-reserve=<size>".
 In case IO address space is exhausted edk2 will stop assigning resources
 to PCI(e) bridges.  This is not limited to IO resources, the affected
 bridges will not get any memory resources assigned either.
 This patch solves this issue by not handing out the scarce IO address
 space, which is not needed in most cases anyway.  Result is a more
 consistent PCI configuration in virtual machine configurations with many
 PCie root ports.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
 (cherry picked from commit 27727338b2c0e3f50eb0176a1044e903fcb3c3b1)
 ---
 OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c b/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
 index 6b2b6797b3..69903a6009 100644
 --- a/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
 +++ b/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
@@ -589,7 +589,7 @@ GetResourcePadding (
     return EFI_INVALID_PARAMETER;
   }
 -  DefaultIo       = TRUE;
 +  DefaultIo       = FALSE;
   DefaultMmio     = TRUE;
   DefaultPrefMmio = TRUE;
 -- 
 2.39.3
--- a/0030-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch
+++ b/0030-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch
@ -0,0 +1,139 @@
 From 09ccd0ffae512d7f0a7548cdfbc60e1482153796 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Mon, 28 Aug 2023 13:27:09 +0200
 Subject: [PATCH] CryptoPkg/CrtLib: add access/open/read/write/close syscalls
 Needed by rhel downstream openssl patches, they use unix syscalls
 for file access (instead of fopen + friends like the rest of the
 code base).  No actual file access is needed for edk2, so just
 add stubs to make linking work.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
 .../Library/BaseCryptLib/SysCall/CrtWrapper.c | 46 +++++++++++++++++++
 CryptoPkg/Library/Include/CrtLibSupport.h     | 41 +++++++++++++++++
 2 files changed, 87 insertions(+)
 diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
 index 37cdecc9bd..dfdb635536 100644
 --- a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
 +++ b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
@@ -550,6 +550,52 @@ fread (
   return 0;
 }
 +int
 +access(
 +  const char*,
 +  int
 +  )
 +{
 +  return -1;
 +}
 +
 +int
 +open (
 +  const char *,
 +  int
 +  )
 +{
 +  return -1;
 +}
 +
 +ssize_t
 +read (
 +  int,
 +  void*,
 +  size_t
 +  )
 +{
 +  return -1;
 +}
 +
 +ssize_t
 +write (
 +  int,
 +  const void*,
 +  size_t
 +  )
 +{
 +  return -1;
 +}
 +
 +int
 +close (
 +  int
 +  )
 +{
 +  return -1;
 +}
 +
 uid_t
 getuid (
   void
 diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h b/CryptoPkg/Library/Include/CrtLibSupport.h
 index f36fe08f0c..7d98496af8 100644
 --- a/CryptoPkg/Library/Include/CrtLibSupport.h
 +++ b/CryptoPkg/Library/Include/CrtLibSupport.h
@@ -78,6 +78,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 //
 // Definitions for global constants used by CRT library routines
 //
 +#define EINTR         4
 #define EINVAL        22              /* Invalid argument */
 #define EAFNOSUPPORT  47              /* Address family not supported by protocol family */
 #define INT_MAX       0x7FFFFFFF      /* Maximum (signed) int value */
@@ -102,6 +103,15 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #define NS_INADDRSZ   4   /*%< IPv4 T_A */
 #define NS_IN6ADDRSZ  16  /*%< IPv6 T_AAAA */
 +#define O_RDONLY        00000000
 +#define O_WRONLY        00000001
 +#define O_RDWR          00000002
 +
 +#define R_OK  4
 +#define W_OK  2
 +#define X_OK  1
 +#define F_OK  0
 +
 //
 // Basic types mapping
 //
@@ -324,6 +334,37 @@ fprintf     (
   ...
   );
 +int
 +access(
 +  const char*,
 +  int
 +  );
 +
 +int
 +open (
 +  const char *,
 +  int
 +  );
 +
 +ssize_t
 +read (
 +  int,
 +  void*,
 +  size_t
 +  );
 +
 +ssize_t
 +write (
 +  int,
 +  const void*,
 +  size_t
 +  );
 +
 +int
 +close (
 +  int
 +  );
 +
 time_t
 time        (
   time_t *
--- a/0031-ArmVirtQemu-Allow-EFI-memory-attributes-protocol-to-.patch
+++ b/0031-ArmVirtQemu-Allow-EFI-memory-attributes-protocol-to-.patch
@ -0,0 +1,169 @@
 From 0120fb7b5877ab40537fd17e64772f53bc89cd07 Mon Sep 17 00:00:00 2001
 From: Ard Biesheuvel <ardb@kernel.org>
 Date: Mon, 4 Dec 2023 10:41:08 +0100
 Subject: [PATCH] ArmVirtQemu: Allow EFI memory attributes protocol to be
 disabled
 Shim's PE loader uses the EFI memory attributes protocol in a way that
 results in an immediate crash when invoking the loaded image, unless the
 base and size of its executable segment are both aligned to 4k.
 If this is not the case, it will strip the memory allocation of its
 executable permissions, but fail to add them back for the executable
 region, resulting in non-executable code. Unfortunately, the PE loader
 does not even bother invoking the protocol in this case (as it notices
 the misalignment), making it very hard for system firmware to work
 around this by attempting to infer the intent of the caller.
 So let's introduce a QEMU command line option to indicate that the
 protocol should not be exposed at all, and a PCD to set the default for
 this option when it is omitted.
 Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 Tested-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
 Link: https://gitlab.com/qemu-project/qemu/-/issues/1990
 Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
 (cherry picked from commit cee7ba349c0c1ce489001a338a4e28555728b573)
 ---
 ArmVirtPkg/ArmVirtPkg.dec                     |  6 ++
 .../PlatformBootManagerLib/PlatformBm.c       | 64 +++++++++++++++++++
 .../PlatformBootManagerLib.inf                |  3 +
 3 files changed, 73 insertions(+)
 diff --git a/ArmVirtPkg/ArmVirtPkg.dec b/ArmVirtPkg/ArmVirtPkg.dec
 index 0f2d787327..313aebda90 100644
 --- a/ArmVirtPkg/ArmVirtPkg.dec
 +++ b/ArmVirtPkg/ArmVirtPkg.dec
@@ -68,3 +68,9 @@
   # Cloud Hypervisor has no other way to pass Rsdp address to the guest except use a PCD.
   #
   gArmVirtTokenSpaceGuid.PcdCloudHvAcpiRsdpBaseAddress|0x0|UINT64|0x00000005
 +
 +  ##
 +  # Whether the EFI memory attributes protocol should be uninstalled before
 +  # invoking the OS loader. This may be needed to work around problematic
 +  # builds of shim that use the protocol incorrectly.
 +  gArmVirtTokenSpaceGuid.PcdUninstallMemAttrProtocol|FALSE|BOOLEAN|0x00000006
 diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
 index 85c01351b0..8e93f3cfed 100644
 --- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
 +++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
@@ -16,6 +16,7 @@
 #include <Library/PcdLib.h>
 #include <Library/PlatformBmPrintScLib.h>
 #include <Library/QemuBootOrderLib.h>
 +#include <Library/QemuFwCfgSimpleParserLib.h>
 #include <Library/TpmPlatformHierarchyLib.h>
 #include <Library/UefiBootManagerLib.h>
 #include <Protocol/DevicePath.h>
@@ -1111,6 +1112,49 @@ PlatformBootManagerBeforeConsole (
   FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciSerial, SetupVirtioSerial);
 }
 +/**
 +  Uninstall the EFI memory attribute protocol if it exists.
 +**/
 +STATIC
 +VOID
 +UninstallEfiMemoryAttributesProtocol (
 +  VOID
 +  )
 +{
 +  EFI_STATUS  Status;
 +  EFI_HANDLE  Handle;
 +  UINTN       Size;
 +  VOID        *MemoryAttributeProtocol;
 +
 +  Size   = sizeof (Handle);
 +  Status = gBS->LocateHandle (
 +                  ByProtocol,
 +                  &gEfiMemoryAttributeProtocolGuid,
 +                  NULL,
 +                  &Size,
 +                  &Handle
 +                  );
 +
 +  if (EFI_ERROR (Status)) {
 +    ASSERT (Status == EFI_NOT_FOUND);
 +    return;
 +  }
 +
 +  Status = gBS->HandleProtocol (
 +                  Handle,
 +                  &gEfiMemoryAttributeProtocolGuid,
 +                  &MemoryAttributeProtocol
 +                  );
 +  ASSERT_EFI_ERROR (Status);
 +
 +  Status = gBS->UninstallProtocolInterface (
 +                  Handle,
 +                  &gEfiMemoryAttributeProtocolGuid,
 +                  MemoryAttributeProtocol
 +                  );
 +  ASSERT_EFI_ERROR (Status);
 +}
 +
 /**
   Do the platform specific action after the console is ready
   Possible things that can be done in PlatformBootManagerAfterConsole:
@@ -1129,12 +1173,32 @@ PlatformBootManagerAfterConsole (
   )
 {
   RETURN_STATUS  Status;
 +  BOOLEAN        Uninstall;
   //
   // Show the splash screen.
   //
   BootLogoEnableLogo ();
 +  //
 +  // Work around shim's terminally broken use of the EFI memory attributes
 +  // protocol, by uninstalling it if requested on the QEMU command line.
 +  //
 +  // E.g.,
 +  //       -fw_cfg opt/org.tianocore/UninstallMemAttrProtocol,string=y
 +  //
 +  Uninstall = FixedPcdGetBool (PcdUninstallMemAttrProtocol);
 +  QemuFwCfgParseBool ("opt/org.tianocore/UninstallMemAttrProtocol", &Uninstall);
 +  DEBUG ((
 +    DEBUG_WARN,
 +    "%a: %auninstalling EFI memory protocol\n",
 +    __func__,
 +    Uninstall ? "" : "not "
 +    ));
 +  if (Uninstall) {
 +    UninstallEfiMemoryAttributesProtocol ();
 +  }
 +
   //
   // Process QEMU's -kernel command line option. The kernel booted this way
   // will receive ACPI tables: in PlatformBootManagerBeforeConsole(), we
 diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
 index 997eb1a442..70e4ebf94a 100644
 --- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
 +++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
@@ -46,6 +46,7 @@
   PcdLib
   PlatformBmPrintScLib
   QemuBootOrderLib
 +  QemuFwCfgSimpleParserLib
   QemuLoadImageLib
   ReportStatusCodeLib
   TpmPlatformHierarchyLib
@@ -55,6 +56,7 @@
   UefiRuntimeServicesTableLib
 [FixedPcd]
 +  gArmVirtTokenSpaceGuid.PcdUninstallMemAttrProtocol
   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultBaudRate
   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultDataBits
   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultParity
@@ -73,5 +75,6 @@
 [Protocols]
   gEfiFirmwareVolume2ProtocolGuid
   gEfiGraphicsOutputProtocolGuid
 +  gEfiMemoryAttributeProtocolGuid
   gEfiPciRootBridgeIoProtocolGuid
   gVirtioDeviceProtocolGuid
--- a/60-edk2-ovmf-x64-inteltdx.json
+++ b/60-edk2-ovmf-x64-inteltdx.json
@ -4,12 +4,8 @@
        "uefi"
    ],
    "mapping": {
-        "device": "flash",
+        "device": "memory",
-        "mode": "stateless",
+        "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd"
        "executable": {
            "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.fd",
            "format": "raw"
        }
    },
    "targets": [
        {
@ -20,7 +16,9 @@
        }
    ],
    "features": [
        "enrolled-keys",
        "intel-tdx",
        "secure-boot",
        "verbose-dynamic"
    ],
    "tags": [
--- a/README.rst
+++ b/README.rst
@ -0,0 +1,18 @@
 ===================
 EDK2 development
 ===================
 EDK2 is maintained in a `source tree`_ rather than directly in dist-git
 using packit service that provides way to develope using regular source code
 structure and provides way to generate SRPM and build using koji service.
 Developers deliver all changes to source-git using merge request. Only maintainers
 will be pushing changes sent to source-git to dist-git.
 Each release in dist-git is tagged in the source repository so you can easily
 check out the source tree for a build. The tags are in the format
 name-version-release, but note release doesn't contain the dist tag since the
 source can be built in different build roots (Fedora, CentOS, etc.)
 .. _source tree: https://gitlab.com/redhat/centos-stream/src/edk2
--- a/edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtio.patch
+++ b/edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtio.patch
@ -1,74 +0,0 @@
 From 9572a0fe959277c5b57df05a32503ff83a7e93af Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Thu, 1 Jun 2023 13:57:11 +0200
 Subject: [PATCH 02/12] ArmVirt/PlatformBootManagerLib: factor out IsVirtio()
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
 RH-Jira: RHEL-643
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [2/6] 553a155707eb1c878133c1d13f6422c2b70fb78d (kraxel/centos-edk2)
 IsVirtioRng() becomes just a thin wrapper for IsVirtio().
 This allows to add similar thin wrappers for other virtio
 devices in the future.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
 (cherry picked from commit a196b04926e70880334fcd649837d0ac63b0bfd5)
 ---
 .../PlatformBootManagerLib/PlatformBm.c       | 26 +++++++++++++++----
 1 file changed, 21 insertions(+), 5 deletions(-)
 diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
 index 10c815378c..5eb6f0f9c1 100644
 --- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
 +++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
@@ -269,15 +269,16 @@ IsPciDisplay (
 }
 /**
 -  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
 -  the VIRTIO_DEVICE_PROTOCOL level.
 +  This function checks if a handle corresponds to the Virtio Device ID given
 +  at the VIRTIO_DEVICE_PROTOCOL level.
 **/
 STATIC
 BOOLEAN
 EFIAPI
 -IsVirtioRng (
 +IsVirtio (
   IN EFI_HANDLE    Handle,
 -  IN CONST CHAR16  *ReportText
 +  IN CONST CHAR16  *ReportText,
 +  IN UINT16        VirtIoDeviceId
   )
 {
   EFI_STATUS              Status;
@@ -293,7 +294,22 @@ IsVirtioRng (
   }
   return (BOOLEAN)(VirtIo->SubSystemDeviceId ==
 -                   VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
 +                   VirtIoDeviceId);
 +}
 +
 +/**
 +  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
 +  the VIRTIO_DEVICE_PROTOCOL level.
 +**/
 +STATIC
 +BOOLEAN
 +EFIAPI
 +IsVirtioRng (
 +  IN EFI_HANDLE    Handle,
 +  IN CONST CHAR16  *ReportText
 +  )
 +{
 +  return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
 }
 /**
 -- 
 2.39.3
--- a/edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtioPc.patch
+++ b/edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtioPc.patch
@ -1,96 +0,0 @@
 From 8545529f2b6d967946f111d79455ec8896d53311 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Thu, 1 Jun 2023 13:57:12 +0200
 Subject: [PATCH 03/12] ArmVirt/PlatformBootManagerLib: factor out
 IsVirtioPci()
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
 RH-Jira: RHEL-643
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [3/6] d0000df1169e1f7b8ce3ad4942460cdc661a0ed9 (kraxel/centos-edk2)
 IsVirtioPciRng() becomes just a thin wrapper for IsVirtioPci().
 This allows to add similar thin wrappers for other virtio
 devices in the future.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
 (cherry picked from commit aaf546879ab71722c36738ccc6f0f0ab4ecf5076)
 ---
 .../PlatformBootManagerLib/PlatformBm.c       | 30 ++++++++++++++-----
 1 file changed, 23 insertions(+), 7 deletions(-)
 diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
 index 5eb6f0f9c1..ed38c42a43 100644
 --- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
 +++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
@@ -313,15 +313,16 @@ IsVirtioRng (
 }
 /**
 -  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
 -  the EFI_PCI_IO_PROTOCOL level.
 +  This function checks if a handle corresponds to the Virtio Device ID given
 +  at the EFI_PCI_IO_PROTOCOL level.
 **/
 STATIC
 BOOLEAN
 EFIAPI
 -IsVirtioPciRng (
 +IsVirtioPci (
   IN EFI_HANDLE    Handle,
 -  IN CONST CHAR16  *ReportText
 +  IN CONST CHAR16  *ReportText,
 +  IN UINT16        VirtIoDeviceId
   )
 {
   EFI_STATUS           Status;
@@ -387,11 +388,11 @@ IsVirtioPciRng (
   //
   // From DeviceId and RevisionId, determine whether the device is a
   // modern-only Virtio 1.0 device. In case of Virtio 1.0, DeviceId can
 -  // immediately be restricted to VIRTIO_SUBSYSTEM_ENTROPY_SOURCE, and
 +  // immediately be restricted to VirtIoDeviceId, and
   // SubsystemId will only play a sanity-check role. Otherwise, DeviceId can
   // only be sanity-checked, and SubsystemId will decide.
   //
 -  if ((DeviceId == 0x1040 + VIRTIO_SUBSYSTEM_ENTROPY_SOURCE) &&
 +  if ((DeviceId == 0x1040 + VirtIoDeviceId) &&
       (RevisionId >= 0x01))
   {
     Virtio10 = TRUE;
@@ -419,7 +420,7 @@ IsVirtioPciRng (
     return TRUE;
   }
 -  if (!Virtio10 && (SubsystemId == VIRTIO_SUBSYSTEM_ENTROPY_SOURCE)) {
 +  if (!Virtio10 && (SubsystemId == VirtIoDeviceId)) {
     return TRUE;
   }
@@ -430,6 +431,21 @@ PciError:
   return FALSE;
 }
 +/**
 +  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
 +  the EFI_PCI_IO_PROTOCOL level.
 +**/
 +STATIC
 +BOOLEAN
 +EFIAPI
 +IsVirtioPciRng (
 +  IN EFI_HANDLE    Handle,
 +  IN CONST CHAR16  *ReportText
 +  )
 +{
 +  return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
 +}
 +
 /**
   This CALLBACK_FUNCTION attempts to connect a handle non-recursively, asking
   the matching driver to produce all first-level child handles.
 -- 
 2.39.3
--- a/edk2-ArmVirt-PlatformBootManagerLib-set-up-virtio-serial-.patch
+++ b/edk2-ArmVirt-PlatformBootManagerLib-set-up-virtio-serial-.patch
@ -1,228 +0,0 @@
 From ad95ab2b76485458fed60ab20631b62a010c0e4d Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Thu, 1 Jun 2023 13:57:13 +0200
 Subject: [PATCH 04/12] ArmVirt/PlatformBootManagerLib: set up virtio serial as
 console
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
 RH-Jira: RHEL-643
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [4/6] 46540eeb8901cfeef83cffcdcb6e1c23995b391a (kraxel/centos-edk2)
 In case a virtio serial device is found in the system register the first
 console port as EFI console, by updating ConIn, ConOut and ErrOut.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 (cherry picked from commit 15f83fa36442eaa272300b31699b3b82ce7e07a9)
 ---
 .../PlatformBootManagerLib/PlatformBm.c       | 172 ++++++++++++++++++
 1 file changed, 172 insertions(+)
 diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
 index ed38c42a43..b92a916f7e 100644
 --- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
 +++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
@@ -312,6 +312,21 @@ IsVirtioRng (
   return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
 }
 +/**
 +  This FILTER_FUNCTION checks if a handle corresponds to a Virtio serial device at
 +  the VIRTIO_DEVICE_PROTOCOL level.
 +**/
 +STATIC
 +BOOLEAN
 +EFIAPI
 +IsVirtioSerial (
 +  IN EFI_HANDLE    Handle,
 +  IN CONST CHAR16  *ReportText
 +  )
 +{
 +  return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_CONSOLE);
 +}
 +
 /**
   This function checks if a handle corresponds to the Virtio Device ID given
   at the EFI_PCI_IO_PROTOCOL level.
@@ -446,6 +461,21 @@ IsVirtioPciRng (
   return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
 }
 +/**
 +  This FILTER_FUNCTION checks if a handle corresponds to a Virtio serial device at
 +  the EFI_PCI_IO_PROTOCOL level.
 +**/
 +STATIC
 +BOOLEAN
 +EFIAPI
 +IsVirtioPciSerial (
 +  IN EFI_HANDLE    Handle,
 +  IN CONST CHAR16  *ReportText
 +  )
 +{
 +  return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_CONSOLE);
 +}
 +
 /**
   This CALLBACK_FUNCTION attempts to connect a handle non-recursively, asking
   the matching driver to produce all first-level child handles.
@@ -534,6 +564,142 @@ AddOutput (
     ));
 }
 +/**
 +  This CALLBACK_FUNCTION retrieves the EFI_DEVICE_PATH_PROTOCOL from
 +  the handle, appends serial, uart and terminal nodes, finally updates
 +  ConIn, ConOut and ErrOut.
 +**/
 +STATIC
 +VOID
 +EFIAPI
 +SetupVirtioSerial (
 +  IN EFI_HANDLE    Handle,
 +  IN CONST CHAR16  *ReportText
 +  )
 +{
 +  STATIC CONST ACPI_HID_DEVICE_PATH  SerialNode = {
 +    {
 +      ACPI_DEVICE_PATH,
 +      ACPI_DP,
 +      {
 +        (UINT8)(sizeof (ACPI_HID_DEVICE_PATH)),
 +        (UINT8)((sizeof (ACPI_HID_DEVICE_PATH)) >> 8)
 +      },
 +    },
 +    EISA_PNP_ID (0x0501),
 +    0
 +  };
 +
 +  STATIC CONST UART_DEVICE_PATH  UartNode = {
 +    {
 +      MESSAGING_DEVICE_PATH,
 +      MSG_UART_DP,
 +      {
 +        (UINT8)(sizeof (UART_DEVICE_PATH)),
 +        (UINT8)((sizeof (UART_DEVICE_PATH)) >> 8)
 +      },
 +    },
 +    0,
 +    115200,
 +    8,
 +    1,
 +    1
 +  };
 +
 +  STATIC CONST VENDOR_DEVICE_PATH  TerminalNode = {
 +    {
 +      MESSAGING_DEVICE_PATH,
 +      MSG_VENDOR_DP,
 +      {
 +        (UINT8)(sizeof (VENDOR_DEVICE_PATH)),
 +        (UINT8)((sizeof (VENDOR_DEVICE_PATH)) >> 8)
 +      },
 +    },
 +    DEVICE_PATH_MESSAGING_VT_UTF8
 +  };
 +
 +  EFI_STATUS                Status;
 +  EFI_DEVICE_PATH_PROTOCOL  *DevicePath, *OldDevicePath;
 +
 +  DevicePath = DevicePathFromHandle (Handle);
 +
 +  if (DevicePath == NULL) {
 +    DEBUG ((
 +      DEBUG_ERROR,
 +      "%a: %s: handle %p: device path not found\n",
 +      __func__,
 +      ReportText,
 +      Handle
 +      ));
 +    return;
 +  }
 +
 +  DevicePath = AppendDevicePathNode (
 +                 DevicePath,
 +                 &SerialNode.Header
 +                 );
 +
 +  OldDevicePath = DevicePath;
 +  DevicePath    = AppendDevicePathNode (
 +                    DevicePath,
 +                    &UartNode.Header
 +                    );
 +  FreePool (OldDevicePath);
 +
 +  OldDevicePath = DevicePath;
 +  DevicePath    = AppendDevicePathNode (
 +                    DevicePath,
 +                    &TerminalNode.Header
 +                    );
 +  FreePool (OldDevicePath);
 +
 +  Status = EfiBootManagerUpdateConsoleVariable (ConIn, DevicePath, NULL);
 +  if (EFI_ERROR (Status)) {
 +    DEBUG ((
 +      DEBUG_ERROR,
 +      "%a: %s: adding to ConIn: %r\n",
 +      __func__,
 +      ReportText,
 +      Status
 +      ));
 +    return;
 +  }
 +
 +  Status = EfiBootManagerUpdateConsoleVariable (ConOut, DevicePath, NULL);
 +  if (EFI_ERROR (Status)) {
 +    DEBUG ((
 +      DEBUG_ERROR,
 +
 +      "%a: %s: adding to ConOut: %r\n",
 +      __func__,
 +      ReportText,
 +      Status
 +      ));
 +    return;
 +  }
 +
 +  Status = EfiBootManagerUpdateConsoleVariable (ErrOut, DevicePath, NULL);
 +  if (EFI_ERROR (Status)) {
 +    DEBUG ((
 +      DEBUG_ERROR,
 +      "%a: %s: adding to ErrOut: %r\n",
 +      __func__,
 +      ReportText,
 +      Status
 +      ));
 +    return;
 +  }
 +
 +  FreePool (DevicePath);
 +
 +  DEBUG ((
 +    DEBUG_VERBOSE,
 +    "%a: %s: added to ConIn, ConOut and ErrOut\n",
 +    __func__,
 +    ReportText
 +    ));
 +}
 +
 STATIC
 VOID
 PlatformRegisterFvBootOption (
@@ -932,6 +1098,12 @@ PlatformBootManagerBeforeConsole (
   // instances on Virtio PCI RNG devices.
   //
   FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciRng, Connect);
 +
 +  //
 +  // Register Virtio serial devices as console.
 +  //
 +  FilterAndProcess (&gVirtioDeviceProtocolGuid, IsVirtioSerial, SetupVirtioSerial);
 +  FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciSerial, SetupVirtioSerial);
 }
 /**
 -- 
 2.39.3
--- a/edk2-ArmVirt-add-VirtioSerialDxe-to-ArmVirtQemu-builds.patch
+++ b/edk2-ArmVirt-add-VirtioSerialDxe-to-ArmVirtQemu-builds.patch
@ -1,59 +0,0 @@
 From 262a607fbc608c02fc3c2a87244d033932d564bb Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Thu, 1 Jun 2023 13:57:10 +0200
 Subject: [PATCH 01/12] ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
 RH-Jira: RHEL-643
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [1/6] 03b627e1fae7851fa51e6fe67253ff1b64948d0e (kraxel/centos-edk2)
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Acked-by: Ard Biesheuvel <ardb@kernel.org>
 (cherry picked from commit 6925150febb3a76d8e40c19babcc578555ca78fe)
 ---
 ArmVirtPkg/ArmVirtQemu.dsc           | 1 +
 ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 +
 ArmVirtPkg/ArmVirtQemuKernel.dsc     | 1 +
 3 files changed, 3 insertions(+)
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
 index b1deefc2fd..5df6a89578 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
@@ -453,6 +453,7 @@
   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
   OvmfPkg/VirtioNetDxe/VirtioNet.inf
   OvmfPkg/VirtioRngDxe/VirtioRng.inf
 +  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
   #
   # FAT filesystem + GPT/MBR partitioning + UDF filesystem + virtio-fs
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 index 4dbb77a6ca..00ec4dd186 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -96,6 +96,7 @@ READ_LOCK_STATUS   = TRUE
   INF OvmfPkg/VirtioNetDxe/VirtioNet.inf
   INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
 +  INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
   INF ShellPkg/Application/Shell/Shell.inf
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
 index afebc46a04..76b7c128bb 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
@@ -353,6 +353,7 @@
   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
   OvmfPkg/VirtioNetDxe/VirtioNet.inf
   OvmfPkg/VirtioRngDxe/VirtioRng.inf
 +  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
   #
   # FAT filesystem + GPT/MBR partitioning + UDF filesystem + virtio-fs
 -- 
 2.39.3
--- a/edk2-OvmfPkg-AmdSev-fix-BdsPlatform.c-assertion-failure-d.patch
+++ b/edk2-OvmfPkg-AmdSev-fix-BdsPlatform.c-assertion-failure-d.patch
@ -1,88 +0,0 @@
 From 673ed284a598bf94d39f01f118158e55e5c04645 Mon Sep 17 00:00:00 2001
 From: Michael Roth <michael.roth@amd.com>
 Date: Wed, 16 Aug 2023 15:11:45 -0500
 Subject: [PATCH 1/3] OvmfPkg/AmdSev: fix BdsPlatform.c assertion failure
 during boot
 RH-Author: Gerd Hoffmann <None>
 RH-MergeRequest: 44: OvmfPkg/AmdSev: fix BdsPlatform.c assertion failure during boot
 RH-Bugzilla: 2190244
 RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
 RH-Commit: [1/1] 44f18b2324cbd4aa1840613d9a8d19f0fbec7b1b (kraxel.rh/centos-src-edk2)
 Booting an SEV guest with AmdSev OVMF package currently triggers the
 following assertion with QEMU:
  InstallQemuFwCfgTables: installed 7 tables
  PcRtc: Write 0x20 to CMOS location 0x32
  [Variable]END_OF_DXE is signaled
  Initialize variable error flag (FF)
  ASSERT_EFI_ERROR (Status = Not Found)
  ASSERT [BdsDxe] /home/VT_BUILD/ovmf/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c(1711): !(((INTN)(RETURN_STATUS)(Status)) < 0)
 This seems to be due to commit 81dc0d8b4c, which switched to using
 PlatformBootManagerLib instead of PlatformBootManagerLibGrub. That
 pulls in a dependency on gEfiS3SaveStateProtocolGuid provider being
 available (which is asserted for in
 BdsPlatform.c:PlatformBootManagerBeforeConsole()/SaveS3BootScript()),
 but the libraries that provide it aren't currently included in the
 build. Add them similarly to what's done for OvmfPkg.
 Fixes: 81dc0d8b4c ("OvmfPkg/AmdSev: stop using PlatformBootManagerLibGrub")
 Cc: Gerd Hoffmann <kraxel@redhat.com>
 Cc: Ray Ni <ray.ni@intel.com>
 Cc: Erdem Aktas <erdemaktas@google.com>
 Cc: James Bottomley <jejb@linux.ibm.com>
 Cc: Jiewen Yao <jiewen.yao@intel.com>
 Cc: Min Xu <min.m.xu@intel.com>
 Cc: Tom Lendacky <thomas.lendacky@amd.com>
 Signed-off-by: Michael Roth <michael.roth@amd.com>
 Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 Message-ID: <20230816201146.1634348-2-michael.roth@amd.com>
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 List-Archive: https://edk2.groups.io/g/devel/message/107806
 ---
 OvmfPkg/AmdSev/AmdSevX64.dsc | 3 +++
 OvmfPkg/AmdSev/AmdSevX64.fdf | 2 ++
 2 files changed, 5 insertions(+)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
 index 427df673f3..8d165ed05a 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
@@ -199,6 +199,7 @@
   SmbusLib|MdePkg/Library/BaseSmbusLibNull/BaseSmbusLibNull.inf
   OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib/BaseOrderedCollectionRedBlackTreeLib.inf
 +  S3BootScriptLib|MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.inf
 !include OvmfPkg/Include/Dsc/OvmfTpmLibs.dsc.inc
@@ -715,6 +716,8 @@
   #
   MdeModulePkg/Universal/Acpi/AcpiTableDxe/AcpiTableDxe.inf
   OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf
 +  MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf
 +  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
   MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
   #
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
 index a48c93e2a5..3e6ee61823 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -269,6 +269,8 @@ INF  OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.inf
 INF  MdeModulePkg/Universal/Acpi/AcpiTableDxe/AcpiTableDxe.inf
 INF  OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf
 +INF  MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf
 +INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
 INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 -- 
 2.39.3
--- a/edk2-OvmfPkg-IoMmuDxe-add-locking-to-IoMmuAllocateBounceB.patch
+++ b/edk2-OvmfPkg-IoMmuDxe-add-locking-to-IoMmuAllocateBounceB.patch
@ -1,79 +0,0 @@
 From 7f3f6e3088655e33600aacd886aa51d19c01c59a Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Wed, 19 Jul 2023 18:31:29 +0200
 Subject: [PATCH 2/3] OvmfPkg/IoMmuDxe: add locking to
 IoMmuAllocateBounceBuffer
 RH-Author: Gerd Hoffmann <None>
 RH-MergeRequest: 45: OvmfPkg/IoMmuDxe: add locking to IoMmuAllocateBounceBuffer
 RH-Bugzilla: 2211060
 RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
 RH-Commit: [1/1] c4998c57651df23342a0cd6e8982bf59f306da83 (kraxel.rh/centos-src-edk2)
 Searching for an unused bounce buffer in mReservedMemBitmap and
 reserving the buffer by flipping the bit is a critical section
 which must not be interrupted.  Raise the TPL level to ensure
 that.
 Without this fix it can happen that IoMmuDxe hands out the same
 bounce buffer twice, causing trouble down the road.  Seen happening
 in practice with VirtioNetDxe setting up the network interface (and
 calling into IoMmuDxe from a polling timer callback) in parallel with
 Boot Manager doing some disk I/O.  An ASSERT() in VirtioNet caught
 the buffer inconsistency.
 Full story with lots of details and discussions is available here:
 https://bugzilla.redhat.com/show_bug.cgi?id=2211060
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 (cherry picked from commit a52044a9e602bc168cdf5d73a48952bfc9edb521)
 ---
 OvmfPkg/IoMmuDxe/IoMmuBuffer.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/OvmfPkg/IoMmuDxe/IoMmuBuffer.c b/OvmfPkg/IoMmuDxe/IoMmuBuffer.c
 index c8f6cf4818..103003cae3 100644
 --- a/OvmfPkg/IoMmuDxe/IoMmuBuffer.c
 +++ b/OvmfPkg/IoMmuDxe/IoMmuBuffer.c
@@ -367,7 +367,9 @@ IoMmuAllocateBounceBuffer (
 {
   EFI_STATUS  Status;
   UINT32      ReservedMemBitmap;
 +  EFI_TPL     OldTpl;
 +  OldTpl            = gBS->RaiseTPL (TPL_NOTIFY);
   ReservedMemBitmap = 0;
   Status            = InternalAllocateBuffer (
                         Type,
@@ -378,6 +380,7 @@ IoMmuAllocateBounceBuffer (
                         );
   MapInfo->ReservedMemBitmap = ReservedMemBitmap;
   mReservedMemBitmap        |= ReservedMemBitmap;
 +  gBS->RestoreTPL (OldTpl);
   ASSERT (Status == EFI_SUCCESS);
@@ -395,6 +398,8 @@ IoMmuFreeBounceBuffer (
   IN OUT     MAP_INFO  *MapInfo
   )
 {
 +  EFI_TPL  OldTpl;
 +
   if (MapInfo->ReservedMemBitmap == 0) {
     gBS->FreePages (MapInfo->PlainTextAddress, MapInfo->NumberOfPages);
   } else {
@@ -407,9 +412,11 @@ IoMmuFreeBounceBuffer (
       mReservedMemBitmap,
       mReservedMemBitmap & ((UINT32)(~MapInfo->ReservedMemBitmap))
       ));
 +    OldTpl                     = gBS->RaiseTPL (TPL_NOTIFY);
     MapInfo->PlainTextAddress  = 0;
     mReservedMemBitmap        &= (UINT32)(~MapInfo->ReservedMemBitmap);
     MapInfo->ReservedMemBitmap = 0;
 +    gBS->RestoreTPL (OldTpl);
   }
   return EFI_SUCCESS;
 -- 
 2.39.3
--- a/edk2-OvmfPkg-MicrovmX64-enable-1G-pages.patch
+++ b/edk2-OvmfPkg-MicrovmX64-enable-1G-pages.patch
@ -1,37 +0,0 @@
 From db07792f9eb095a1f7570b23b1e9dad6edca17a5 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Wed, 17 May 2023 12:24:49 +0200
 Subject: [PATCH 12/12] OvmfPkg/MicrovmX64: enable 1G pages
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 40: enable use of gigabyte pages
 RH-Jira: RHEL-644
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [3/3] 369373082e4dd0be9a4f257e5be9c827cc7de3c5 (kraxel/centos-edk2)
 Reduces the memory footprint and speeds up booting.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Acked-by: Ard Biesheuvel <ardb@kernel.org>
 (cherry picked from commit 04c5b3023e49c35d291f41d2c39b4d12a62b8f9c)
 ---
 OvmfPkg/Microvm/MicrovmX64.dsc | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
 index 49d1d7ef5c..cc8e3abc45 100644
 --- a/OvmfPkg/Microvm/MicrovmX64.dsc
 +++ b/OvmfPkg/Microvm/MicrovmX64.dsc
@@ -544,6 +544,9 @@
   gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesCode|0x100
   gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesData|0x100
 +  # use 1G pages
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable|TRUE
 +
   #
   # Network Pcds
   #
 -- 
 2.39.3
--- a/edk2-OvmfPkg-OvmfPkgIa32X64-enable-1G-pages.patch
+++ b/edk2-OvmfPkg-OvmfPkgIa32X64-enable-1G-pages.patch
@ -1,37 +0,0 @@
 From 943b4994942d550bef98685d13ffb26d4b5dd665 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Wed, 17 May 2023 12:24:48 +0200
 Subject: [PATCH 11/12] OvmfPkg/OvmfPkgIa32X64: enable 1G pages
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 40: enable use of gigabyte pages
 RH-Jira: RHEL-644
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [2/3] 7385647b30e5096b356a13085a8081de79c916f8 (kraxel/centos-edk2)
 Reduces the memory footprint and speeds up booting.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Acked-by: Ard Biesheuvel <ardb@kernel.org>
 (cherry picked from commit b63e17d746aa6bab2b1101711395725005e71a02)
 ---
 OvmfPkg/OvmfPkgIa32X64.dsc | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
 index a41bc32454..a6714cea91 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -557,6 +557,9 @@
   # never lets the RAM below 4 GB exceed 2816 MB.
   gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress|0xE0000000
 +  # use 1G pages
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable|TRUE
 +
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiSourceLevelDebugPkgTokenSpaceGuid.PcdDebugLoadImageMethod|0x2
 !endif
 -- 
 2.39.3
--- a/edk2-OvmfPkg-PlatformInitLib-check-PcdUse1GPageTable.patch
+++ b/edk2-OvmfPkg-PlatformInitLib-check-PcdUse1GPageTable.patch
@ -1,57 +0,0 @@
 From f24768ae482651073db9050fdaad49afe930b127 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Wed, 17 May 2023 12:24:47 +0200
 Subject: [PATCH 10/12] OvmfPkg/PlatformInitLib: check PcdUse1GPageTable
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 40: enable use of gigabyte pages
 RH-Jira: RHEL-644
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [1/3] 5d8b87d3b6a6b8af4d1a4aabedd8f69c512bf01c (kraxel/centos-edk2)
 If PcdUse1GPageTable is not enabled restrict the physical address space
 used to 1TB, to limit the amount of memory needed for identity mapping
 page tables.
 The same already happens in case the processor has no support for
 gigabyte pages.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Acked-by: Ard Biesheuvel <ardb@kernel.org>
 (cherry picked from commit d4d24001f78bcee965d8854fba6f08f48b4ec446)
 ---
 OvmfPkg/Library/PlatformInitLib/MemDetect.c         | 5 +++++
 OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf | 1 +
 2 files changed, 6 insertions(+)
 diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
 index 0482d8906d..662e7e85bb 100644
 --- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
 +++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
@@ -666,6 +666,11 @@ PlatformAddressWidthFromCpuid (
       PhysBits = 40;
     }
 +    if (!FixedPcdGetBool (PcdUse1GPageTable) && (PhysBits > 40)) {
 +      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 40 (PcdUse1GPageTable is false)\n", __func__));
 +      PhysBits = 40;
 +    }
 +
     PlatformInfoHob->PhysMemAddressWidth = PhysBits;
     PlatformInfoHob->FirstNonAddress     = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth);
   }
 diff --git a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
 index 86a82ad3e0..5a79d95b68 100644
 --- a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
 +++ b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
@@ -58,6 +58,7 @@
 [Pcd]
   gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
 [FixedPcd]
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase
 -- 
 2.39.3
--- a/edk2-OvmfPkg-PlatformInitLib-limit-phys-bits-to-46.patch
+++ b/edk2-OvmfPkg-PlatformInitLib-limit-phys-bits-to-46.patch
@ -1,53 +0,0 @@
 From b1643b16a4a70ea576b5f90476fd9c59750eafe8 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Thu, 1 Jun 2023 09:57:31 +0200
 Subject: [PATCH 07/12] OvmfPkg/PlatformInitLib: limit phys-bits to 46.
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 41: enable dynamic mmio window
 RH-Bugzilla: 2174749
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [1/2] d08a95b72276cba504176b3837714db67122ed66 (kraxel/centos-edk2)
 Older linux kernels have problems with phys-bits larger than 46,
 ubuntu 18.04 (kernel 4.15) has been reported to be affected.
 Reduce phys-bits limit from 47 to 46.
 Reported-by: Fiona Ebner <f.ebner@proxmox.com>
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 (cherry picked from commit c1e853769046b322690ad336fdb98966757e7414)
 ---
 OvmfPkg/Library/PlatformInitLib/MemDetect.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)
 diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
 index 86700fc028..aab266399f 100644
 --- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
 +++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
@@ -646,16 +646,19 @@ PlatformAddressWidthFromCpuid (
     ));
   if (Valid) {
 -    if (PhysBits > 47) {
 +    if (PhysBits > 46) {
       /*
        * Avoid 5-level paging altogether for now, which limits
        * PhysBits to 48.  Also avoid using address bit 48, due to sign
        * extension we can't identity-map these addresses (and lots of
        * places in edk2 assume we have everything identity-mapped).
        * So the actual limit is 47.
 +       *
 +       * Also some older linux kernels apparently have problems handling
 +       * phys-bits > 46 correctly, so use that as limit.
        */
 -      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 47 (avoid 5-level paging)\n", __func__));
 -      PhysBits = 47;
 +      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 46 (avoid 5-level paging)\n", __func__));
 +      PhysBits = 46;
     }
     if (!Page1GSupport && (PhysBits > 40)) {
 -- 
 2.39.3
--- a/edk2-OvmfPkg-ResetVector-Fix-assembler-bit-test-flag-chec.patch
+++ b/edk2-OvmfPkg-ResetVector-Fix-assembler-bit-test-flag-chec.patch
@ -1,42 +0,0 @@
 From bcc2e81950016f6cda6f3c125bfa7c88a5f8ca8e Mon Sep 17 00:00:00 2001
 From: Tom Lendacky <thomas.lendacky@amd.com>
 Date: Fri, 14 Jul 2023 15:28:26 -0500
 Subject: [PATCH] OvmfPkg/ResetVector: Fix assembler bit test flag check
 RH-Author: Gerd Hoffmann <None>
 RH-MergeRequest: 47: OvmfPkg/ResetVector: Fix assembler bit test flag check
 RH-Jira: RHEL-9943
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [1/1] 4565e2863391eb63d598991bc1b394cabd96a466 (kraxel.rh/centos-src-edk2)
 Commit 63c50d3ff2854a76432b752af4f2a76f33ff1974 changed the check that is
 used to determine if SEV-ES is active. Originally, a CMP instruction with
 a supporting JZ instruction was used for the check. It was changed to use
 the BT instruction but not JZ instruction. The result of a BT instruction
 changes the the carry flag (CF) and not the zero flag (ZF). As a result,
 the wrong condition is being checked. Update the JZ to a JNC to properly
 detect if SEV-ES is active.
 Fixes: 63c50d3ff285 ("OvmfPkg/ResetVector: cache the SEV status MSR...")
 Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
 (cherry picked from commit e674096accc8e57cd0dd84679905e1222423251e)
 ---
 OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm b/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm
 index c5c683ebed..429a58c5ef 100644
 --- a/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm
 +++ b/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm
@@ -44,7 +44,7 @@ Transition32FlatTo64Flat:
     mov     ecx, 1
     bt      [SEV_ES_WORK_AREA_STATUS_MSR], ecx
 -    jz      EnablePaging
 +    jnc     EnablePaging
     ;
     ; SEV-ES is active, perform a quick sanity check against the reported
 -- 
 2.39.3
--- a/edk2-OvmfPkg-VirtioSerialDxe-Remove-noisy-debug-print-on-.patch
+++ b/edk2-OvmfPkg-VirtioSerialDxe-Remove-noisy-debug-print-on-.patch
@ -1,42 +0,0 @@
 From 60a5604388fa73872d67e9ed46a29c7fd0e4fc32 Mon Sep 17 00:00:00 2001
 From: Ard Biesheuvel <ardb@kernel.org>
 Date: Tue, 27 Jun 2023 13:14:06 +0200
 Subject: [PATCH 06/12] OvmfPkg/VirtioSerialDxe: Remove noisy debug print on
 supported() call
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
 RH-Jira: RHEL-643
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [6/6] 62b611c1d82f1b87cac2a07655ca37117d438989 (kraxel/centos-edk2)
 The UEFI driver model invokes the supported() method on every driver
 every time a connection attempt is made on any handle, and so doing an
 unconditional DEBUG() print inside this method produced a lot of noise.
 So let's drop this DEBUG() call from the VirtioSerial driver's
 Supported() method.
 Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
 Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 (cherry picked from commit ea7a3015a2404e1358218463dd25df5ae7615352)
 ---
 OvmfPkg/VirtioSerialDxe/VirtioSerial.c | 2 --
 1 file changed, 2 deletions(-)
 diff --git a/OvmfPkg/VirtioSerialDxe/VirtioSerial.c b/OvmfPkg/VirtioSerialDxe/VirtioSerial.c
 index bfb2b324ea..9e27a519f4 100644
 --- a/OvmfPkg/VirtioSerialDxe/VirtioSerial.c
 +++ b/OvmfPkg/VirtioSerialDxe/VirtioSerial.c
@@ -510,8 +510,6 @@ VirtioSerialDriverBindingSupported (
     Status = EFI_UNSUPPORTED;
   }
 -  DEBUG ((DEBUG_INFO, "%a:%d: subsystem %d -> %r\n", __func__, __LINE__, VirtIo->SubSystemDeviceId, Status));
 -
   //
   // We needed VirtIo access only transitorily, to see whether we support the
   // device or not.
 -- 
 2.39.3
--- a/edk2-OvmfPkg-VirtioSerialDxe-use-TPL_NOTIFY.patch
+++ b/edk2-OvmfPkg-VirtioSerialDxe-use-TPL_NOTIFY.patch
@ -1,45 +0,0 @@
 From 2ab130462062bfcd66d3047eaa6947a151296a21 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Fri, 12 May 2023 16:23:06 +0200
 Subject: [PATCH 05/12] OvmfPkg/VirtioSerialDxe: use TPL_NOTIFY
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
 RH-Jira: RHEL-643
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [5/6] 08998538804a8d62903e44e716bcafd9674d208f (kraxel/centos-edk2)
 Apparently TPL_CALLBACK is too low, code runs into an ASSERT
 complaining the new TPL is lower than the old TPL.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 (cherry picked from commit 4e5a804222415ec7b2bec90ea0300b8a9f60f131)
 ---
 OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c b/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
 index 522b25e969..e4a58deff1 100644
 --- a/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
 +++ b/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
@@ -158,7 +158,7 @@ VirtioSerialIoWrite (
   VirtioSerialRingClearTx (SerialIo->Dev, PortTx (SerialIo->PortId));
 -  OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
 +  OldTpl = gBS->RaiseTPL (TPL_NOTIFY);
   if (SerialIo->WriteOffset &&
       (SerialIo->WriteOffset + *BufferSize > PORT_TX_BUFSIZE))
   {
@@ -201,7 +201,7 @@ VirtioSerialIoRead (
     goto NoData;
   }
 -  OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
 +  OldTpl = gBS->RaiseTPL (TPL_NOTIFY);
   if (SerialIo->WriteOffset) {
     DEBUG ((DEBUG_VERBOSE, "%a:%d: WriteFlush %d\n", __func__, __LINE__, SerialIo->WriteOffset));
     VirtioSerialRingSendBuffer (
 -- 
 2.39.3
--- a/edk2-Revert-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch
+++ b/edk2-Revert-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch
@ -1,34 +0,0 @@
 From e4fe4b80159b7df136f419da69251f45b62f36ec Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Thu, 29 Jun 2023 13:37:33 +0200
 Subject: [PATCH 08/12] Revert "OvmfPkg: disable dynamic mmio window (rhel
 only)"
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 41: enable dynamic mmio window
 RH-Bugzilla: 2174749
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [2/2] 10ace0e012602153f82fccee3c555be40b3c6753 (kraxel/centos-edk2)
 This reverts commit 218d3b32592bffe5ec7317c4838d29e92b4b86f0.
 ---
 OvmfPkg/Library/PlatformInitLib/MemDetect.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
 diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
 index aab266399f..0482d8906d 100644
 --- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
 +++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
@@ -682,8 +682,7 @@ PlatformDynamicMmioWindow (
   AddrSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth);
   MmioSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth - 3);
 -  if (FALSE /* disable for RHEL-9.2, libvirt is not ready yet */ &&
 -      (PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
 +  if ((PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
       (PlatformInfoHob->PcdPciMmio64Base + MmioSpace < AddrSpace))
   {
     DEBUG ((DEBUG_INFO, "%a: using dynamic mmio window\n", __func__));
 -- 
 2.39.3
--- a/edk2-build.py
+++ b/edk2-build.py
@ -6,6 +6,7 @@ https://gitlab.com/kraxel/edk2-build-config
 """
 import os
 import sys
 import time
 import shutil
 import argparse
 import subprocess
@ -52,10 +53,21 @@ def get_toolchain(cfg, build):
        return cfg['global']['tool']
    return 'GCC5'
-def get_version(cfg):
+def get_hostarch():
    mach = os.uname().machine
    if mach == 'x86_64':
        return 'X64'
    if mach == 'aarch64':
        return 'AARCH64'
    if mach == 'riscv64':
        return 'RISCV64'
    return 'UNKNOWN'
 def get_version(cfg, silent = False):
    coredir = get_coredir(cfg)
    if version_override:
        version = version_override
        if not silent:
            print('')
            print(f'### version [override]: {version}')
        return version
@ -63,6 +75,7 @@ def get_version(cfg):
        version = os.environ.get('RPM_PACKAGE_NAME')
        version += '-' + os.environ.get('RPM_PACKAGE_VERSION')
        version += '-' + os.environ.get('RPM_PACKAGE_RELEASE')
        if not silent:
            print('')
            print(f'### version [rpmbuild]: {version}')
        return version
@ -73,6 +86,7 @@ def get_version(cfg):
                                stdout = subprocess.PIPE,
                                check = True)
        version = result.stdout.decode().strip()
        if not silent:
            print('')
            print(f'### version [git]: {version}')
        return version
@ -81,8 +95,8 @@ def get_version(cfg):
 def pcd_string(name, value):
    return f'{name}=L{value}\\0'
-def pcd_version(cfg):
+def pcd_version(cfg, silent = False):
-    version = get_version(cfg)
+    version = get_version(cfg, silent)
    if version is None:
        return []
    return [ '--pcd', pcd_string('PcdFirmwareVersionString', version) ]
@ -92,13 +106,16 @@ def pcd_release_date():
        return []
    return [ '--pcd', pcd_string('PcdFirmwareReleaseDateString', release_date) ]
-def build_message(line, line2 = None):
+def build_message(line, line2 = None, silent = False):
    if os.environ.get('TERM') in [ 'xterm', 'xterm-256color' ]:
        # setxterm  title
        start  = '\x1b]2;'
        end    = '\x07'
        print(f'{start}{rebase_prefix}{line}{end}', end = '')
    if silent:
        print(f'### {rebase_prefix}{line}', flush = True)
    else:
        print('')
        print('###')
        print(f'### {rebase_prefix}{line}')
@ -106,27 +123,33 @@ def build_message(line, line2 = None):
            print(f'### {line2}')
        print('###', flush = True)
-def build_run(cmdline, name, section, silent = False):
+def build_run(cmdline, name, section, silent = False, nologs = False):
    print(cmdline, flush = True)
    if silent:
-        print('### building in silent mode ...', flush = True)
+        logfile = f'{section}.log'
        if nologs:
            print(f'### building in silent mode [no log] ...', flush = True)
        else:
            print(f'### building in silent mode [{logfile}] ...', flush = True)
        start = time.time()
        result = subprocess.run(cmdline, check = False,
                                stdout = subprocess.PIPE,
                                stderr = subprocess.STDOUT)
-
+        if not nologs:
        logfile = f'{section}.log'
        print(f'### writing log to {logfile} ...')
            with open(logfile, 'wb') as f:
                f.write(result.stdout)
        if result.returncode:
            print('### BUILD FAILURE')
            print('### cmdline')
            print(cmdline)
            print('### output')
            print(result.stdout.decode())
            print(f'### exit code: {result.returncode}')
        else:
-            print('### OK')
+            secs = int(time.time() - start)
            print(f'### OK ({int(secs/60)}:{secs%60:02d})')
    else:
        print(cmdline, flush = True)
        result = subprocess.run(cmdline, check = False)
    if result.returncode:
        print(f'ERROR: {cmdline[0]} exited with {result.returncode}'
@ -163,7 +186,7 @@ def pad_file(dstdir, pad):
    subprocess.run(cmdline, check = True)
 # pylint: disable=too-many-branches
-def build_one(cfg, build, jobs = None, silent = False):
+def build_one(cfg, build, jobs = None, silent = False, nologs = False):
    b = cfg[build]
    cmdline  = [ 'build' ]
@ -172,12 +195,15 @@ def build_one(cfg, build, jobs = None, silent = False):
    if (b['conf'].startswith('OvmfPkg/') or
        b['conf'].startswith('ArmVirtPkg/')):
-        cmdline += pcd_version(cfg)
+        cmdline += pcd_version(cfg, silent)
        cmdline += pcd_release_date()
    if jobs:
        cmdline += [ '-n', jobs ]
    for arch in b['arch'].split():
        if arch == 'HOST':
            cmdline += [ '-a', get_hostarch() ]
        else:
            cmdline += [ '-a', arch ]
    if 'opts' in b:
        for name in b['opts'].split():
@ -198,11 +224,13 @@ def build_one(cfg, build, jobs = None, silent = False):
        if 'desc' in b:
            desc = b['desc']
        build_message(f'building: {b["conf"]} ({b["arch"]}, {tgt})',
-                      f'description: {desc}')
+                      f'description: {desc}',
                      silent = silent)
        build_run(cmdline + [ '-b', tgt ],
                  b['conf'],
                  build + '.' + tgt,
-                  silent)
+                  silent,
                  nologs)
        if 'plat' in b:
            # copy files
@ -218,11 +246,11 @@ def build_one(cfg, build, jobs = None, silent = False):
                    continue
                pad_file(b['dest'], b[pad])
-def build_basetools(silent = False):
+def build_basetools(silent = False, nologs = False):
-    build_message('building: BaseTools')
+    build_message('building: BaseTools', silent = silent)
    basedir = os.environ['EDK_TOOLS_PATH']
    cmdline = [ 'make', '-C', basedir ]
-    build_run(cmdline, 'BaseTools', 'build.basetools', silent)
+    build_run(cmdline, 'BaseTools', 'build.basetools', silent, nologs)
 def binary_exists(name):
    for pdir in os.environ['PATH'].split(':'):
@ -230,7 +258,7 @@ def binary_exists(name):
            return True
    return False
-def prepare_env(cfg):
+def prepare_env(cfg, silent = False):
    """ mimic Conf/BuildEnv.sh """
    workspace = os.getcwd()
    packages = [ workspace, ]
@ -260,7 +288,7 @@ def prepare_env(cfg):
    toolsdef = coredir + '/Conf/tools_def.txt'
    if not os.path.exists(toolsdef):
        os.makedirs(os.path.dirname(toolsdef), exist_ok = True)
-        build_message('running BaseTools/BuildEnv')
+        build_message('running BaseTools/BuildEnv', silent = silent)
        cmdline = [ 'bash', 'BaseTools/BuildEnv' ]
        subprocess.run(cmdline, cwd = coredir, check = True)
@ -274,20 +302,32 @@ def prepare_env(cfg):
    os.environ['PYTHONHASHSEED'] = '1'
    # for cross builds
-    if binary_exists('arm-linux-gnu-gcc'):
+    if binary_exists('arm-linux-gnueabi-gcc'):
        # ubuntu
        os.environ['GCC5_ARM_PREFIX'] = 'arm-linux-gnueabi-'
        os.environ['GCC_ARM_PREFIX'] = 'arm-linux-gnueabi-'
    elif binary_exists('arm-linux-gnu-gcc'):
        # fedora
        os.environ['GCC5_ARM_PREFIX'] = 'arm-linux-gnu-'
        os.environ['GCC_ARM_PREFIX'] = 'arm-linux-gnu-'
    if binary_exists('loongarch64-linux-gnu-gcc'):
        os.environ['GCC5_LOONGARCH64_PREFIX'] = 'loongarch64-linux-gnu-'
        os.environ['GCC_LOONGARCH64_PREFIX'] = 'loongarch64-linux-gnu-'
    hostarch = os.uname().machine
    if binary_exists('aarch64-linux-gnu-gcc') and hostarch != 'aarch64':
        os.environ['GCC5_AARCH64_PREFIX'] = 'aarch64-linux-gnu-'
        os.environ['GCC_AARCH64_PREFIX'] = 'aarch64-linux-gnu-'
    if binary_exists('riscv64-linux-gnu-gcc') and hostarch != 'riscv64':
        os.environ['GCC5_RISCV64_PREFIX'] = 'riscv64-linux-gnu-'
        os.environ['GCC_RISCV64_PREFIX'] = 'riscv64-linux-gnu-'
    if binary_exists('x86_64-linux-gnu-gcc') and hostarch != 'x86_64':
        os.environ['GCC5_IA32_PREFIX'] = 'x86_64-linux-gnu-'
        os.environ['GCC5_X64_PREFIX'] = 'x86_64-linux-gnu-'
        os.environ['GCC5_BIN'] = 'x86_64-linux-gnu-'
        os.environ['GCC_IA32_PREFIX'] = 'x86_64-linux-gnu-'
        os.environ['GCC_X64_PREFIX'] = 'x86_64-linux-gnu-'
        os.environ['GCC_BIN'] = 'x86_64-linux-gnu-'
 def build_list(cfg):
    for build in cfg.sections():
@ -310,10 +350,12 @@ def main():
    parser.add_argument('-j', '--jobs', dest = 'jobs', type = str,
                        help = 'allow up to JOBS parallel build jobs',
                        metavar = 'JOBS')
-    parser.add_argument('-m', '--match', dest = 'match', type = str,
+    parser.add_argument('-m', '--match', dest = 'match',
                        type = str, action = 'append',
                        help = 'only run builds matching INCLUDE (substring)',
                        metavar = 'INCLUDE')
-    parser.add_argument('-x', '--exclude', dest = 'exclude', type = str,
+    parser.add_argument('-x', '--exclude', dest = 'exclude',
                        type = str, action = 'append',
                        help = 'skip builds matching EXCLUDE (substring)',
                        metavar = 'EXCLUDE')
    parser.add_argument('-l', '--list', dest = 'list',
@ -323,6 +365,9 @@ def main():
                        action = 'store_true', default = False,
                        help = 'write build output to logfiles, '
                        'write to console only on errors')
    parser.add_argument('--no-logs', dest = 'nologs',
                        action = 'store_true', default = False,
                        help = 'do not write build log files (with --silent)')
    parser.add_argument('--core', dest = 'core', type = str, metavar = 'DIR',
                        help = 'location of the core edk2 repository '
                        '(i.e. where BuildTools are located)')
@ -330,7 +375,8 @@ def main():
                        type = str, action = 'append', metavar = 'DIR',
                        help = 'location(s) of additional packages '
                        '(can be specified multiple times)')
-    parser.add_argument('-t', '--toolchain', dest = 'toolchain', type = str, metavar = 'NAME',
+    parser.add_argument('-t', '--toolchain', dest = 'toolchain',
                        type = str, metavar = 'NAME',
                        help = 'tool chain to be used to build edk2')
    parser.add_argument('--version-override', dest = 'version_override',
                        type = str, metavar = 'VERSION',
@ -344,7 +390,7 @@ def main():
        os.chdir(options.directory)
    if not os.path.exists(options.configfile):
-        print('config file "{options.configfile}" not found')
+        print(f'config file "{options.configfile}" not found')
        return 1
    cfg = configparser.ConfigParser()
@ -372,18 +418,28 @@ def main():
    if options.release_date:
        release_date = options.release_date
-    prepare_env(cfg)
+    prepare_env(cfg, options.silent)
-    build_basetools(options.silent)
+    build_basetools(options.silent, options.nologs)
    for build in cfg.sections():
        if not build.startswith('build.'):
            continue
-        if options.match and options.match not in build:
+        if options.match:
-            print(f'# skipping "{build}" (not matching "{options.match}")')
+            matching = False
            for item in options.match:
                if item in build:
                    matching = True
            if not matching:
                print(f'# skipping "{build}" (not matching "{"|".join(options.match)}")')
                continue
-        if options.exclude and options.exclude in build:
+        if options.exclude:
-            print(f'# skipping "{build}" (matching "{options.exclude}")')
+            exclude = False
            for item in options.exclude:
                if item in build:
                    print(f'# skipping "{build}" (matching "{item}")')
                    exclude = True
            if exclude:
                continue
-        build_one(cfg, build, options.jobs, options.silent)
+        build_one(cfg, build, options.jobs, options.silent, options.nologs)
    return 0
--- a/edk2-build.rhel-9
+++ b/edk2-build.rhel-9
@ -21,20 +21,27 @@ EXCLUDE_SHELL_FROM_FD    = TRUE
 # new upstream
 BUILD_SHELL              = FALSE
 [opts.ovmf.sb.stateless]
 SECURE_BOOT_ENABLE       = TRUE
 SMM_REQUIRE              = FALSE
 [opts.armvirt.verbose]
 DEBUG_PRINT_ERROR_LEVEL  = 0x8040004F
 [opts.armvirt.silent]
 DEBUG_PRINT_ERROR_LEVEL  = 0x80000000
 [pcds.nx.strict]
 PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD5
 PcdUninstallMemAttrProtocol    = FALSE
-[pcds.nx.broken.grub]
+[pcds.nx.broken.shim.grub]
 # grub.efi uses EfiLoaderData for code
 PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD1
-# shim can't work with EFI_MEMORY_ATTRIBUTE_PROTOCOL
+# shim.efi has broken MemAttr code
-gArmTokenSpaceGuid.PcdEnableEfiMemoryAttributeProtocol = FALSE
+PcdUninstallMemAttrProtocol    = TRUE
 #####################################################################
 # stateful ovmf builds (with vars in flash)
@ -52,13 +59,13 @@ cpy2 = FV/OVMF_VARS.fd
 cpy3 = X64/Shell.efi
 [build.ovmf.4m.sb.smm]
-desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot)
+desc = ovmf build (64-bit, 4MB, q35 only, needs smm, secure boot)
-conf = OvmfPkg/OvmfPkgIa32X64.dsc
+conf = OvmfPkg/OvmfPkgX64.dsc
-arch = IA32 X64
+arch = X64
 opts = ovmf.common
       ovmf.4m
       ovmf.sb.smm
-plat = Ovmf3264
+plat = OvmfX64
 dest = RHEL-9/ovmf
 cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
 cpy2 = X64/EnrollDefaultKeys.efi
@ -83,6 +90,7 @@ conf = OvmfPkg/IntelTdx/IntelTdxX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.4m
       ovmf.sb.stateless
 plat = IntelTdx
 dest = RHEL-9/ovmf
 cpy1 = FV/OVMF.fd OVMF.inteltdx.fd
@ -97,7 +105,7 @@ conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = AARCH64
 opts = ovmf.common
       armvirt.verbose
-pcds = nx.broken.grub
+pcds = nx.broken.shim.grub
 plat = ArmVirtQemu-AARCH64
 dest = RHEL-9/aarch64
 cpy1 = FV/QEMU_EFI.fd
@ -113,7 +121,7 @@ conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = AARCH64
 opts = ovmf.common
       armvirt.silent
-pcds = nx.broken.grub
+pcds = nx.broken.shim.grub
 plat = ArmVirtQemu-AARCH64
 dest = RHEL-9/aarch64
 cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.silent.fd
--- a/edk2.spec
+++ b/edk2.spec
@ -1,9 +1,11 @@
 ExclusiveArch: x86_64 aarch64
-%define GITDATE        20230524
+%define GITDATE        20231122
-%define GITCOMMIT      ba91d0292e
+%define GITCOMMIT      8736b8fdca
 %define TOOLCHAIN      GCC5
-%define OPENSSL_VER    1.1.1k
+
 %define OPENSSL_VER    3.0.7
 %define OPENSSL_HASH   db0287935122edceb91dcda8dfb53b4090734e22
 %define DBXDATE        20230509
@ -18,18 +20,18 @@ ExclusiveArch: x86_64 aarch64
 Name:       edk2
 Version:    %{GITDATE}
-Release:    4%{?dist}
+Release:    1%{?dist}
 Summary:    UEFI firmware for 64-bit virtual machines
-License:    BSD-2-Clause-Patent and OpenSSL and MIT
+License:    BSD-2-Clause-Patent and Apache-2.0 and MIT
 URL:        http://www.tianocore.org
 # The source tarball is created using following commands:
 # COMMIT=ba91d0292e
 # git archive --format=tar --prefix=edk2-$COMMIT/ $COMMIT \
 # | xz -9ev >/tmp/edk2-$COMMIT.tar.xz
-Source0:edk2-%{GITCOMMIT}.tar.xz
+Source0: edk2-%{GITCOMMIT}.tar.xz
 Source1: ovmf-whitepaper-c770f8c.txt
-Source2: openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
+Source2: openssl-rhel-%{OPENSSL_HASH}.tar.xz
 # json description files
 Source10: 50-edk2-aarch64-qcow2.json
@ -48,68 +50,37 @@ Source80: edk2-build.py
 Source82: edk2-build.rhel-9
 Source90: DBXUpdate-%{DBXDATE}.x64.bin
-
+Patch1: 0001-ignore-build-artifacts-generated-files-session-setti.patch
-Patch0002: 0002-Remove-submodules.patch
+Patch2: 0002-Remove-submodules.patch
-Patch0003: 0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
+Patch3: 0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
-Patch0004: 0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
+Patch4: 0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
-Patch0005: 0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
+Patch5: 0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
-Patch0006: 0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+Patch6: 0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
-Patch0007: 0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+Patch7: 0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
-Patch0008: 0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+Patch8: 0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
-Patch0009: 0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+Patch9: 0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
-Patch0010: 0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+Patch10: 0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
-Patch0011: 0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
+Patch11: 0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
-Patch0012: 0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
+Patch12: 0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
-Patch0013: 0013-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
+Patch13: 0013-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
-Patch0014: 0014-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
+Patch14: 0014-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
-Patch0015: 0015-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
+Patch15: 0015-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
-Patch0016: 0016-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
+Patch16: 0016-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
-Patch0017: 0017-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
+Patch17: 0017-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
-Patch0018: 0018-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
+Patch18: 0018-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
-Patch0019: 0019-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
+Patch19: 0019-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
-Patch0020: 0020-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
+Patch20: 0020-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
-Patch0021: 0021-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
+Patch21: 0021-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
-Patch0022: 0022-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
+Patch22: 0022-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
-Patch0023: 0023-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
+Patch23: 0023-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
-Patch0024: 0024-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
+Patch24: 0024-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
-Patch0025: 0025-recreate-import-redhat-directory.patch
+Patch25: 0025-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
-Patch0026: 0026-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
+Patch26: 0026-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
-Patch0027: 0027-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch
+Patch27: 0027-recreate-import-.distro-directory.patch
-Patch0028: 0028-ArmPkg-Disable-EFI_MEMORY_ATTRIBUTE_PROTOCOL-RH-only.patch
+Patch28: 0028-distro-apply-git-diff-c9s-new_c9s-by-mirek.patch
-Patch0029: 0029-OvmfPkg-PciHotPlugInitDxe-Do-not-reserve-IO-ports-by.patch
+Patch29: 0029-CryptoPkg-CrtLib-add-stat.h-include-file.patch
-# For RHEL-643 - add virtio serial support to armvirt
+Patch30: 0030-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch
-Patch30: edk2-ArmVirt-add-VirtioSerialDxe-to-ArmVirtQemu-builds.patch
+Patch31: 0031-ArmVirtQemu-Allow-EFI-memory-attributes-protocol-to-.patch
 # For RHEL-643 - add virtio serial support to armvirt
 Patch31: edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtio.patch
 # For RHEL-643 - add virtio serial support to armvirt
 Patch32: edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtioPc.patch
 # For RHEL-643 - add virtio serial support to armvirt
 Patch33: edk2-ArmVirt-PlatformBootManagerLib-set-up-virtio-serial-.patch
 # For RHEL-643 - add virtio serial support to armvirt
 Patch34: edk2-OvmfPkg-VirtioSerialDxe-use-TPL_NOTIFY.patch
 # For RHEL-643 - add virtio serial support to armvirt
 Patch35: edk2-OvmfPkg-VirtioSerialDxe-Remove-noisy-debug-print-on-.patch
 # For bz#2174749 - [edk2] re-enable dynamic mmio window
 Patch36: edk2-OvmfPkg-PlatformInitLib-limit-phys-bits-to-46.patch
 # For bz#2174749 - [edk2] re-enable dynamic mmio window
 Patch37: edk2-Revert-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch
 # For bz#2124143 - ovmf must consider max cpu count not boot cpu count for apic mode [rhel-9]
 Patch38: edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
 # For RHEL-644 - enable gigabyte pages
 Patch39: edk2-OvmfPkg-PlatformInitLib-check-PcdUse1GPageTable.patch
 # For RHEL-644 - enable gigabyte pages
 Patch40: edk2-OvmfPkg-OvmfPkgIa32X64-enable-1G-pages.patch
 # For RHEL-644 - enable gigabyte pages
 Patch41: edk2-OvmfPkg-MicrovmX64-enable-1G-pages.patch
 # For bz#2190244 - [EDK2] [AMDSERVER 9.3 Bug] OVMF AP Creation Fixes
 Patch42: edk2-OvmfPkg-AmdSev-fix-BdsPlatform.c-assertion-failure-d.patch
 # For bz#2211060 - SEV-es guest randomly stuck at boot to hard drive screen from powerdown and boot again
 Patch43: edk2-OvmfPkg-IoMmuDxe-add-locking-to-IoMmuAllocateBounceB.patch
 # For bz#2218196 - Add vtpm devices with OVMF.amdsev.fd causes VM reset
 Patch44: edk2-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
 # For RHEL-9943 - [EDK2][AMDSERVER Bug] OvmfPkg/ResetVector: Fix assembler bit test flag check [rhel-9.3.0.z]
 Patch45: edk2-OvmfPkg-ResetVector-Fix-assembler-bit-test-flag-chec.patch
 # python3-devel and libuuid-devel are required for building tools.
 # python3-devel is also needed for varstore template generation and
@ -118,6 +89,7 @@ BuildRequires:  python3-devel
 BuildRequires:  libuuid-devel
 BuildRequires:  /usr/bin/iasl
 BuildRequires:  binutils gcc git gcc-c++ make
 BuildRequires:  perl perl(JSON)
 BuildRequires:  qemu-img
 %if %{build_ovmf}
@ -146,7 +118,7 @@ Obsoletes:  OVMF < 20180508-100.gitee3198e672e2.el7
 # OVMF includes the Secure Boot and IPv6 features; it has a builtin OpenSSL
 # library.
 Provides:   bundled(openssl) = %{OPENSSL_VER}
-License:    BSD-2-Clause-Patent and OpenSSL
+License:    BSD-2-Clause-Patent and Apache-2.0
 # URL taken from the Maintainers.txt file.
 URL:        http://www.tianocore.org/ovmf/
@ -168,7 +140,7 @@ Conflicts:  libvirt-daemon-driver-qemu < 9.2.0
 # No Secure Boot for AAVMF yet, but we include OpenSSL for the IPv6 stack.
 Provides:   bundled(openssl) = %{OPENSSL_VER}
-License:    BSD-2-Clause-Patent and OpenSSL
+License:    BSD-2-Clause-Patent and Apache-2.0
 # URL taken from the Maintainers.txt file.
 URL:        https://github.com/tianocore/tianocore.github.io/wiki/ArmVirtPkg
@ -263,14 +235,26 @@ export EXTRA_LDFLAGS="%{__global_ldflags}"
 export RELEASE_DATE="$(echo %{GITDATE} | sed -e 's|\(....\)\(..\)\(..\)|\2/\3/\1|')"
 touch OvmfPkg/AmdSev/Grub/grub.efi   # dummy
 python3 CryptoPkg/Library/OpensslLib/configure.py
 # include dirs of unused submodules
 mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include
 mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include/mbedtls
 mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/library
 %if %{build_ovmf}
 ./edk2-build.py --config edk2-build.rhel-9 -m ovmf --release-date "$RELEASE_DATE"
 build_iso RHEL-9/ovmf
 cp DBXUpdate-%{DBXDATE}.x64.bin RHEL-9/ovmf
 virt-fw-vars --input   RHEL-9/ovmf/OVMF_VARS.fd \
             --output  RHEL-9/ovmf/OVMF_VARS.secboot.fd \
             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
             --enroll-redhat --secure-boot
 virt-fw-vars --input   RHEL-9/ovmf/OVMF.inteltdx.fd \
             --output  RHEL-9/ovmf/OVMF.inteltdx.secboot.fd \
             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
             --enroll-redhat --secure-boot \
             --set-fallback-no-reboot
 %endif
 %if %{build_aarch64}
@ -284,7 +268,7 @@ done
 %install
 cp -a OvmfPkg/License.txt License.OvmfPkg.txt
-cp -a CryptoPkg/Library/OpensslLib/openssl/LICENSE LICENSE.openssl
+cp -a CryptoPkg/Library/OpensslLib/openssl/LICENSE.txt LICENSE.openssl
 mkdir -p %{buildroot}%{_datadir}/qemu/firmware
 # install the tools
@ -367,6 +351,8 @@ install -m 0644 \
 %{_datadir}/%{name}/ovmf/OVMF_VARS.secboot.fd
 %{_datadir}/%{name}/ovmf/OVMF.amdsev.fd
 %{_datadir}/%{name}/ovmf/OVMF.inteltdx.fd
 %{_datadir}/%{name}/ovmf/OVMF.inteltdx.secboot.fd
 %{_datadir}/%{name}/ovmf/DBXUpdate*.bin
 %{_datadir}/%{name}/ovmf/UefiShell.iso
 %{_datadir}/OVMF/OVMF_CODE.secboot.fd
 %{_datadir}/OVMF/OVMF_VARS.fd
@ -428,6 +414,14 @@ install -m 0644 \
 %changelog
 * Fri Dec 15 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20231122-1
 - Rebase to edk2-stable202311 [RHEL-12323]
 - Switch to OpenSSL 3.0 [RHEL-49]
 - Resolves: RHEL-12323
  (Rebase EDK2 for RHEL 9.4)
 - Resolves: RHEL-49
  (consume / bundle RHEL-9 OpenSSL (version 3.0.x) in RHEL-9 edk2)
 * Mon Oct 09 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20230524-4
 - edk2-OvmfPkg-ResetVector-Fix-assembler-bit-test-flag-chec.patch [RHEL-9943]
 - Resolves: RHEL-9943
--- a/4
+++ b/4
@ -1,3 +1,3 @@
 SHA512 (DBXUpdate-20230509.x64.bin) = 71fb6e8cd6918126b3acd78b95651913336df372e13fdfdfdd20d5d23f0e509050c6c88c8a2c43f8ac44f987df86bd45174bb3065d5a7a8c7e3b8772fd06d624
-SHA512 (edk2-ba91d0292e.tar.xz) = 3b21cc39671d28bfeb059da3683751cc5277c63a894b2a05bdfbd2bbe53545c34f04c229becf44f1563f89a738f37ae8f2333076d126a7e94d234bc4bb25454c
+SHA512 (edk2-8736b8fdca.tar.xz) = c1573986081f54c43f848b0344b30fe7a388b6d17b87a0411028319827a6cd7a20a694cde6d51b84f6ae15f69b2b70858253396fd61f7c043624d754d14f4724
-SHA512 (openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz) = 6842e767f767fe79edcb9ba8e32ce2956e8b56f0b265f79a5b4dbd4bba51b63d9733841badee7f2ffdcca803baf82b3e9e132fd465c22027539dcfd02608e99a
+SHA512 (openssl-rhel-db0287935122edceb91dcda8dfb53b4090734e22.tar.xz) = 693f4d1d79337ed0676cc13e35efaf918f3527cf1c6f7076dcf836e5e43a18bfe16dfe97ef76407c3c014c9ae9a6f34149745f41b4b5393d85cd36de20d56d69