* Fri Dec 15 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20231122-1

- Rebase to edk2-stable202311 [RHEL-12323]
- Switch to OpenSSL 3.0 [RHEL-49]
- Resolves: RHEL-12323
  (Rebase EDK2 for RHEL 9.4)
- Resolves: RHEL-49
  (consume / bundle RHEL-9 OpenSSL (version 3.0.x) in RHEL-9 edk2)

.gitignore

@@ -12,3 +12,4 @@
 /DBXUpdate-20230314.x64.bin
 /DBXUpdate-20230509.x64.bin
 /*.src.rpm
+/openssl-rhel-db0287935122edceb91dcda8dfb53b4090734e22.tar.xz

0001-ignore-build-artifacts-generated-files-session-setti.patch

@@ -0,0 +1,83 @@
+From 21816395a94558c8e5c97f13adbb5ffb909656b8 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 11 Jun 2014 21:55:22 +0200
+Subject: [PATCH] ignore build artifacts, generated files, session settings etc
+ (RHEL only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- no changes
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- refresh against upstream commit 48760409ccc8 (".gitignore: Ignore python
+  compiled files, extdeps, and vscode", 2019-11-11)
+
+- add ".AutoGenIdFile.txt" to "Conf/.gitignore", in response to upstream
+  commit 373298ca0d60 ("BaseTools: Fixed issue for IgnoreAutoGen",
+  2019-09-10)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no changes
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no changes
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- Conflict resolution against upstream commit 112f4ada2e6b ("edk2: Add
+  .DS_Store to .gitignore for macOS", 2017-05-04), in the ".gitignore"
+  file.
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- no changes
+
+Notes about the 9ece15a -> c9e5618 rebase:
+
+- Upstream added .gitignore files in the meanwhile, we just need some
+  light customization. In particular the Conf/ReadMe.txt file should not
+  be ignored, it is not generated.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 3b9c914f2d6bff6274d5ed45fcf4c757ce27031b)
+(cherry picked from commit b66c3c6d11a834dc7cb3ab326f09c6a21c0b81e8)
+(cherry picked from commit c94381432988f6137de46772cbd4080d9832c9ad)
+(cherry picked from commit 730cc57005e4908fcee29109672284808b21ec1c)
+(cherry picked from commit 161184bcb55a670f8f7f8c4147825eb360b73794)
+(cherry picked from commit 4eec2bb2176f2deda2b2c44a6f2ea167c5a43433)
+(cherry picked from commit ea548c8d0c9d4cd5b8b5200eda8ff6ac220a6307)
+(cherry picked from commit 4872f69df8b0460fbbfcd75950d81fdcd213f8c0)
+---
+ Conf/.gitignore | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/Conf/.gitignore b/Conf/.gitignore
+index 5e4debcc10..8601fc0cee 100644
+--- a/Conf/.gitignore
++++ b/Conf/.gitignore
+@@ -1 +1,6 @@
+-*
++.AutoGenIdFile.txt
++.cache/
++BuildEnv.sh
++build_rule.txt
++target.txt
++tools_def.txt

0002-Remove-submodules.patch

@@ -1,7 +1,13 @@
-From a4954b2259c4be78f61127684239cb11486bc0f7 Mon Sep 17 00:00:00 2001
+From ff10592d4710f12d601dcfcdd25f28b6941c5141 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Thu, 24 Mar 2022 03:23:02 -0400
-Subject: Remove submodules
+Subject: [PATCH] Remove submodules
+
+Rebase to edk2-stable202311: removing additional submodule:
+
+- CryptoPkg/Library/MbedTlsLib/mbedtls
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 
 Rebase to edk2-stable202305: removing additional submodules:
 
@@ -50,35 +56,12 @@ remove the include path too.
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit e05e0de713c4a2b8adb6ff9809611f222bfe50ed)
 ---
- .gitmodules                                   | 34 -------------------
+ BaseTools/Source/C/GNUmakefile | 1 -
- .../ArmSoftFloatLib/berkeley-softfloat-3      |  1 -
+ CryptoPkg/.gitignore           | 1 +
- BaseTools/Source/C/BrotliCompress/brotli      |  1 -
+ MdeModulePkg/MdeModulePkg.dec  | 3 ---
- BaseTools/Source/C/GNUmakefile                |  1 -
+ MdePkg/MdePkg.dec              | 5 -----
- CryptoPkg/.gitignore                          |  1 +
+ 4 files changed, 1 insertion(+), 9 deletions(-)
- CryptoPkg/Library/OpensslLib/openssl          |  1 -
- .../Library/BrotliCustomDecompressLib/brotli  |  1 -
- MdeModulePkg/MdeModulePkg.dec                 |  3 --
- .../Universal/RegularExpressionDxe/oniguruma  |  1 -
- MdePkg/Library/BaseFdtLib/libfdt              |  1 -
- MdePkg/Library/MipiSysTLib/mipisyst           |  1 -
- MdePkg/MdePkg.dec                             |  5 ---
- RedfishPkg/Library/JsonLib/jansson            |  1 -
- UnitTestFrameworkPkg/Library/CmockaLib/cmocka |  1 -
- .../Library/GoogleTestLib/googletest          |  1 -
- .../Library/SubhookLib/subhook                |  1 -
- 16 files changed, 1 insertion(+), 54 deletions(-)
- delete mode 160000 ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3
- delete mode 160000 BaseTools/Source/C/BrotliCompress/brotli
  create mode 100644 CryptoPkg/.gitignore
- delete mode 160000 CryptoPkg/Library/OpensslLib/openssl
- delete mode 160000 MdeModulePkg/Library/BrotliCustomDecompressLib/brotli
- delete mode 160000 MdeModulePkg/Universal/RegularExpressionDxe/oniguruma
- delete mode 160000 MdePkg/Library/BaseFdtLib/libfdt
- delete mode 160000 MdePkg/Library/MipiSysTLib/mipisyst
- delete mode 160000 RedfishPkg/Library/JsonLib/jansson
- delete mode 160000 UnitTestFrameworkPkg/Library/CmockaLib/cmocka
- delete mode 160000 UnitTestFrameworkPkg/Library/GoogleTestLib/googletest
- delete mode 160000 UnitTestFrameworkPkg/Library/SubhookLib/subhook
 
 diff --git a/BaseTools/Source/C/GNUmakefile b/BaseTools/Source/C/GNUmakefile
 index 5275f657ef..39d7199753 100644
@@ -92,8 +75,15 @@ index 5275f657ef..39d7199753 100644
    VfrCompile \
    EfiRom \
    GenFfs \
+diff --git a/CryptoPkg/.gitignore b/CryptoPkg/.gitignore
+new file mode 100644
+index 0000000000..68b83272b7
+--- /dev/null
++++ b/CryptoPkg/.gitignore
+@@ -0,0 +1 @@
++Library/OpensslLib/openssl*/
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 95dd077e19..1609b6d9c2 100644
+index d2fede4f87..265dfec94f 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
 @@ -26,9 +26,6 @@
@@ -107,7 +97,7 @@ index 95dd077e19..1609b6d9c2 100644
    ##  @libraryclass  Defines a set of methods to reset whole system.
    ResetSystemLib|Include/Library/ResetSystemLib.h
 diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
-index b85614992b..57b0b5ea6f 100644
+index ac54338089..29f0a6e178 100644
 --- a/MdePkg/MdePkg.dec
 +++ b/MdePkg/MdePkg.dec
 @@ -29,7 +29,6 @@

0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch

@@ -1,8 +1,12 @@
-From 5eef1273ee036bfa0ba9da1b276e0bf130b1cfbc Mon Sep 17 00:00:00 2001
+From a531e0f3c999670f54926b2579e0721d217a49e0 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Tue, 25 Feb 2014 22:40:01 +0100
-Subject: MdeModulePkg: TerminalDxe: set xterm resolution on mode change (RH
+Subject: [PATCH] MdeModulePkg: TerminalDxe: set xterm resolution on mode
- only)
+ change (RH only)
+
+Notes for rebase to edk2-stable202311:
+
+- Minor context changes due to new PCDs (for USB Networking) being added.
 
 Notes for rebase to edk2-stable202205:
 
@@ -95,12 +99,12 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  3 files changed, 36 insertions(+)
 
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 1609b6d9c2..705fb02f66 100644
+index 265dfec94f..092a8dee2a 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
-@@ -2127,6 +2127,10 @@
+@@ -2158,6 +2158,10 @@
-   # @Prompt The shared bit mask when Intel Tdx is enabled.
+   # @Prompt The value is use for Usb Network rate limiting supported.
-   gEfiMdeModulePkgTokenSpaceGuid.PcdTdxSharedBitMask|0x0|UINT64|0x10000025
+   gEfiMdeModulePkgTokenSpaceGuid.PcdUsbNetworkRateLimitingFactor|100|UINT32|0x10000028
  
 +  ## Controls whether TerminalDxe outputs an XTerm resize sequence on terminal
 +  #  mode change.
@@ -184,6 +188,3 @@ index b2a8aeba85..96810f337c 100644
  
  # [Event]
  # # Relative timer event set by UnicodeToEfiKey(), used to be one 2 seconds input timeout.
--- 
-2.39.3
-

0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch

@@ -1,7 +1,8 @@
-From a1d4a00637d184cff886bc150cdfd8de165ed162 Mon Sep 17 00:00:00 2001
+From c53aae9d945648b7301efede1dc77bf7b7f4ee1c Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 14 Oct 2015 15:59:06 +0200
-Subject: OvmfPkg: take PcdResizeXterm from the QEMU command line (RH only)
+Subject: [PATCH] OvmfPkg: take PcdResizeXterm from the QEMU command line (RH
+ only)
 
 Notes about edk2-stable202205 rebase
 
@@ -82,10 +83,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  9 files changed, 21 insertions(+), 1 deletion(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index b32049194d..c62d6e2805 100644
+index 302c90e7c2..ef70f5f08c 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -476,6 +476,7 @@
+@@ -486,6 +486,7 @@
  [PcdsDynamicDefault]
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -94,10 +95,10 @@ index b32049194d..c62d6e2805 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc
-index 2a1139daaa..cfa4943ed4 100644
+index c23c7eaf6c..49521ba47c 100644
 --- a/OvmfPkg/CloudHv/CloudHvX64.dsc
 +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc
-@@ -575,6 +575,7 @@
+@@ -576,6 +576,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -106,10 +107,10 @@ index 2a1139daaa..cfa4943ed4 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-index d4403f11a7..e4bc192733 100644
+index 182ec3705d..fd6722499a 100644
 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
 +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-@@ -473,6 +473,7 @@
+@@ -482,6 +482,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -118,10 +119,10 @@ index d4403f11a7..e4bc192733 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
-index 5f671bc384..49d1d7ef5c 100644
+index ea1fa3e296..79f14b5c05 100644
 --- a/OvmfPkg/Microvm/MicrovmX64.dsc
 +++ b/OvmfPkg/Microvm/MicrovmX64.dsc
-@@ -572,7 +572,7 @@
+@@ -584,7 +584,7 @@
    # only set when
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@@ -131,10 +132,10 @@ index 5f671bc384..49d1d7ef5c 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index e333b8b418..b4f7334569 100644
+index ed3a19feeb..3101a3a4cf 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -595,6 +595,7 @@
+@@ -604,6 +604,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -143,10 +144,10 @@ index e333b8b418..b4f7334569 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 25974230a2..e11ccae622 100644
+index 16ca139b29..0c174947b7 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -603,6 +603,7 @@
+@@ -616,6 +616,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -155,10 +156,10 @@ index 25974230a2..e11ccae622 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index c1762ffca4..4ac6b492e2 100644
+index dc1a0942aa..a328726d55 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -626,6 +626,7 @@
+@@ -634,6 +634,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -167,7 +168,7 @@ index c1762ffca4..4ac6b492e2 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
-index c56247e294..bf5d37c1f6 100644
+index f5dc41c3a8..f244dcd24d 100644
 --- a/OvmfPkg/PlatformPei/Platform.c
 +++ b/OvmfPkg/PlatformPei/Platform.c
 @@ -41,6 +41,18 @@
@@ -189,7 +190,7 @@ index c56247e294..bf5d37c1f6 100644
  EFI_PEI_PPI_DESCRIPTOR  mPpiBootMode[] = {
    {
      EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST,
-@@ -386,6 +398,7 @@ InitializePlatform (
+@@ -355,6 +367,7 @@ InitializePlatform (
      MemTypeInfoInitialization (PlatformInfoHob);
      MemMapInitialization (PlatformInfoHob);
      NoexecDxeInitialization (PlatformInfoHob);
@@ -209,6 +210,3 @@ index 3934aeed95..d84aefee6d 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode
    gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
    gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
--- 
-2.39.3
-

0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch

@@ -1,7 +1,8 @@
-From 5b458fdeac6a656ab83e0be1662f22e293a5622a Mon Sep 17 00:00:00 2001
+From db9d61b18715590fc8956eb5da9b036afbfd9ab9 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Sun, 26 Jul 2015 08:02:50 +0000
-Subject: ArmVirtPkg: take PcdResizeXterm from the QEMU command line (RH only)
+Subject: [PATCH] ArmVirtPkg: take PcdResizeXterm from the QEMU command line
+ (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -95,10 +96,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 449e73b9e1..b6b9a7f192 100644
+index 30e3cfc8b9..7b88b7441f 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -307,6 +307,8 @@
+@@ -309,6 +309,8 @@
    gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0x0
  !endif
  
@@ -107,7 +108,7 @@ index 449e73b9e1..b6b9a7f192 100644
  [PcdsDynamicHii]
    gUefiOvmfPkgTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gOvmfVariableGuid|0x0|FALSE|NV,BS
  
-@@ -416,7 +418,10 @@
+@@ -418,7 +420,10 @@
    MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
    MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitterDxe.inf
    MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
@@ -198,6 +199,3 @@ index 0000000000..c840f6f97a
 +
 +[Pcd]
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm ## SOMETIMES_PRODUCES
--- 
-2.39.3
-

0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 23e43af54fd29691bf94a5f4e2ac3014b819e37e Mon Sep 17 00:00:00 2001
+From ccc528cc7a9d5b0029a1ca91cb592c999e9f8c5a Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:45 +0100
-Subject: OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
+Subject: [PATCH] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -65,10 +65,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index c62d6e2805..ac73229829 100644
+index ef70f5f08c..28bdc56227 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -426,7 +426,7 @@
+@@ -428,7 +428,7 @@
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -78,10 +78,10 @@ index c62d6e2805..ac73229829 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b4f7334569..0b9fc53884 100644
+index 3101a3a4cf..c4fc79a851 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -535,7 +535,7 @@
+@@ -537,7 +537,7 @@
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -91,10 +91,10 @@ index b4f7334569..0b9fc53884 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index e11ccae622..51823fb746 100644
+index 0c174947b7..1da23b5389 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -541,7 +541,7 @@
+@@ -544,7 +544,7 @@
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -104,10 +104,10 @@ index e11ccae622..51823fb746 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 4ac6b492e2..d1474b0155 100644
+index a328726d55..4f886ba644 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -562,7 +562,7 @@
+@@ -563,7 +563,7 @@
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -116,6 +116,3 @@ index 4ac6b492e2..d1474b0155 100644
  
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
--- 
-2.39.3
-

0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch

@@ -1,7 +1,7 @@
-From 13c6ac7528d5be2638f121b19432597cc529ea7c Mon Sep 17 00:00:00 2001
+From 4bb5f3b3473da371b4db99899c1128ae4ff99f6e Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:46 +0100
-Subject: OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
+Subject: [PATCH] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
  QemuVideoDxe/QemuRamfbDxe (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -76,16 +76,16 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 1355849ad97c1e4a5c430597a377165a5cc118f7)
 ---
  OvmfPkg/AmdSev/AmdSevX64.dsc | 10 ++++++++--
- OvmfPkg/OvmfPkgIa32.dsc      | 12 +++++++++---
+ OvmfPkg/OvmfPkgIa32.dsc      | 10 ++++++++--
  OvmfPkg/OvmfPkgIa32X64.dsc   | 10 ++++++++--
  OvmfPkg/OvmfPkgX64.dsc       | 10 ++++++++--
- 4 files changed, 33 insertions(+), 9 deletions(-)
+ 4 files changed, 32 insertions(+), 8 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index ac73229829..70f154b477 100644
+index 28bdc56227..cbd48af4dc 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -684,8 +684,14 @@
+@@ -694,8 +694,14 @@
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
@@ -103,21 +103,20 @@ index ac73229829..70f154b477 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 0b9fc53884..b05e010069 100644
+index c4fc79a851..75a61c88e6 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -841,9 +841,15 @@
+@@ -850,9 +850,15 @@
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
  !ifndef $(CSM_ENABLE)
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
--!endif
--  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
-+!endif
+ !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
@@ -126,10 +125,10 @@ index 0b9fc53884..b05e010069 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 51823fb746..78f97ff17e 100644
+index 1da23b5389..e5ca067d4c 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -855,9 +855,15 @@
+@@ -868,9 +868,15 @@
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
  !ifndef $(CSM_ENABLE)
@@ -148,10 +147,10 @@ index 51823fb746..78f97ff17e 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index d1474b0155..2a4829d26e 100644
+index 4f886ba644..ad314d86c6 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -929,9 +929,15 @@
+@@ -936,9 +936,15 @@
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
  !ifndef $(CSM_ENABLE)
@@ -169,6 +168,3 @@ index d1474b0155..2a4829d26e 100644
    OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
  
    #
--- 
-2.39.3
-

0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch

@@ -1,8 +1,8 @@
-From 6e76f73b1ea3bac22d248499b9c2062ca5ed020d Mon Sep 17 00:00:00 2001
+From 72830b010e7b78ef8d74cefcb5c6ad018c653ea6 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 27 Jan 2016 03:05:18 +0100
-Subject: ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in QemuRamfbDxe (RH
+Subject: [PATCH] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
- only)
+ QemuRamfbDxe (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -61,10 +61,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  2 files changed, 8 insertions(+), 2 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index b6b9a7f192..176246d683 100644
+index 7b88b7441f..fe7b7e1d64 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -544,7 +544,10 @@
+@@ -547,7 +547,10 @@
    #
    # Video support
    #
@@ -77,10 +77,10 @@ index b6b9a7f192..176246d683 100644
    OvmfPkg/PlatformDxe/Platform.inf
  
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 3cb9120e4e..18d59c2414 100644
+index b50f8e84a3..4a43892f7d 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -444,7 +444,10 @@
+@@ -447,7 +447,10 @@
    #
    # Video support
    #
@@ -92,6 +92,3 @@ index 3cb9120e4e..18d59c2414 100644
    OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
    OvmfPkg/PlatformDxe/Platform.inf
  
--- 
-2.39.3
-

0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch

@@ -1,8 +1,8 @@
-From fe859725d7da9d4452d79b65aad4b4cb3589e873 Mon Sep 17 00:00:00 2001
+From 2b84cf52f9a6f24f932bce5548202460f20ca9d0 Mon Sep 17 00:00:00 2001
 From: Philippe Mathieu-Daude <philmd@redhat.com>
 Date: Thu, 1 Aug 2019 20:43:48 +0200
-Subject: OvmfPkg: QemuRamfbDxe: Do not report DXE failure on Aarch64 silent
+Subject: [PATCH] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on Aarch64
- builds (RH only)
+ silent builds (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -90,6 +90,3 @@ index e3890b8c20..f79a4bc987 100644
    DevicePathLib
    FrameBufferBltLib
    MemoryAllocationLib
--- 
-2.39.3
-

0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch

@@ -1,8 +1,8 @@
-From 4939fadb84796923b287becaecd568d5d77fe20b Mon Sep 17 00:00:00 2001
+From 67230df28e3861c4a7a8fb064a45ed85f015209c Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:47 +0100
-Subject: OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in NvmExpressDxe (RH
+Subject: [PATCH] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in NvmExpressDxe
- only)
+ (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -63,11 +63,11 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 16 insertions(+), 4 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 70f154b477..0d30ee9526 100644
+index cbd48af4dc..a0319c1f0a 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -678,7 +678,10 @@
+@@ -688,7 +688,10 @@
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
@@ -79,11 +79,11 @@ index 70f154b477..0d30ee9526 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b05e010069..ef6362aac5 100644
+index 75a61c88e6..34ad4f2777 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -834,7 +834,10 @@
+@@ -843,7 +843,10 @@
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
@@ -95,11 +95,11 @@ index b05e010069..ef6362aac5 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 78f97ff17e..1793cc96fc 100644
+index e5ca067d4c..4278ce5e1d 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -848,7 +848,10 @@
+@@ -861,7 +861,10 @@
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
@@ -111,11 +111,11 @@ index 78f97ff17e..1793cc96fc 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 2a4829d26e..c32a36b513 100644
+index ad314d86c6..e41a1b976e 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -922,7 +922,10 @@
+@@ -929,7 +929,10 @@
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
@@ -126,6 +126,3 @@ index 2a4829d26e..c32a36b513 100644
    MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
--- 
-2.39.3
-

0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch

@@ -1,8 +1,8 @@
-From b32764469522eb1ac742a34e2ff8b513a329cc41 Mon Sep 17 00:00:00 2001
+From 9bf175beabab17dae1b5883d528ae3d9d834249b Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:31:36 +0200
-Subject: OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no "-kernel" in
+Subject: [PATCH] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no "-kernel"
- silent aa64 build (RH)
+ in silent aa64 build (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -78,6 +78,3 @@ index 7b35adb8e0..23d9f5fca1 100644
    DevicePathLib
    MemoryAllocationLib
    QemuFwCfgLib
--- 
-2.39.3
-

0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch

@@ -1,8 +1,8 @@
-From f38c073fdceec2dac64dc3632ad531f5b73fda8e Mon Sep 17 00:00:00 2001
+From d3d9a0ea8cdd6a8438a878a859ca0cd416c42ad6 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:40:09 +0200
-Subject: SecurityPkg/Tcg2Dxe: suppress error on no swtpm in silent aa64 build
+Subject: [PATCH] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in silent
- (RH)
+ aa64 build (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -77,6 +77,3 @@ index 7dc7a2683d..ae90070b36 100644
    Tpm2CommandLib
    PrintLib
    UefiLib
--- 
-2.39.3
-

0013-OvmfPkg-Remove-EbcDxe-RHEL-only.patch

@@ -1,7 +1,7 @@
-From f48037fba5ef28692e1dd1db90d4729a5fa13e84 Mon Sep 17 00:00:00 2001
+From ce3ac92a202a0b845654c05449107840edf5d2f9 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:28:49 +0200
-Subject: OvmfPkg: Remove EbcDxe (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove EbcDxe (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -29,10 +29,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  8 files changed, 8 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 0d30ee9526..2b624582c6 100644
+index a0319c1f0a..906c1a4332 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -603,7 +603,6 @@
+@@ -613,7 +613,6 @@
  !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
    }
  
@@ -41,7 +41,7 @@ index 0d30ee9526..2b624582c6 100644
    UefiCpuPkg/CpuDxe/CpuDxe.inf
    OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index fec08468d3..2c61d5fa0a 100644
+index b2ab0c7773..20d31d0e2d 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
 @@ -205,7 +205,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@@ -53,10 +53,10 @@ index fec08468d3..2c61d5fa0a 100644
  INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
  INF  OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index ef6362aac5..36ea20fb93 100644
+index 34ad4f2777..d664b42c67 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -744,7 +744,6 @@
+@@ -753,7 +753,6 @@
  !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
    }
  
@@ -65,7 +65,7 @@ index ef6362aac5..36ea20fb93 100644
    UefiCpuPkg/CpuDxe/CpuDxe.inf
  !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index c9c9384397..8135a3dc01 100644
+index 383613e54b..236680dec2 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -216,7 +216,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@@ -77,10 +77,10 @@ index c9c9384397..8135a3dc01 100644
  INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
  !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 1793cc96fc..9638e03578 100644
+index 4278ce5e1d..2e0af7698a 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -758,7 +758,6 @@
+@@ -771,7 +771,6 @@
  !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
    }
  
@@ -89,7 +89,7 @@ index 1793cc96fc..9638e03578 100644
    UefiCpuPkg/CpuDxe/CpuDxe.inf
  !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index f52219e0c2..9d6314d56e 100644
+index 3cec3d0c87..3ad2fe5eee 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -217,7 +217,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@@ -101,10 +101,10 @@ index f52219e0c2..9d6314d56e 100644
  INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
  !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index c32a36b513..7d702f3d21 100644
+index e41a1b976e..55f6760f4c 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -808,7 +808,6 @@
+@@ -816,7 +816,6 @@
  !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
    }
  
@@ -113,7 +113,7 @@ index c32a36b513..7d702f3d21 100644
  
    UefiCpuPkg/CpuDxe/CpuDxe.inf {
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 00c7f8849f..474ef5ca7e 100644
+index 9c35b6e848..da4541d747 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -239,7 +239,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@@ -124,6 +124,3 @@ index 00c7f8849f..474ef5ca7e 100644
  INF  UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
  
  INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
--- 
-2.39.3
-

0014-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 324341ee7f56c09987c16d9a7513465cb56e0dcf Mon Sep 17 00:00:00 2001
+From 536709a91fe5d9bf5bb41bc0ae56cb3e3fa0cf5a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:28:59 +0200
-Subject: OvmfPkg: Remove VirtioGpu device driver (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove VirtioGpu device driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -29,10 +29,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  8 files changed, 8 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 2b624582c6..dafdc1e67a 100644
+index 906c1a4332..52b0d1062c 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -694,7 +694,6 @@
+@@ -704,7 +704,6 @@
      <PcdsFixedAtBuild>
        gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
    }
@@ -41,10 +41,10 @@ index 2b624582c6..dafdc1e67a 100644
    #
    # ISA Support
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index 2c61d5fa0a..2bedd4bef1 100644
+index 20d31d0e2d..48cc3b00c1 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
-@@ -298,7 +298,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+@@ -300,7 +300,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
  INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
  
  INF  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
@@ -53,10 +53,10 @@ index 2c61d5fa0a..2bedd4bef1 100644
  INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
  INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 36ea20fb93..daed0cb362 100644
+index d664b42c67..d39d9e8c27 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -852,7 +852,6 @@
+@@ -861,7 +861,6 @@
      <PcdsFixedAtBuild>
        gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
    }
@@ -65,7 +65,7 @@ index 36ea20fb93..daed0cb362 100644
    #
    # ISA Support
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 8135a3dc01..f8d2385b91 100644
+index 236680dec2..381735165d 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -334,7 +334,6 @@ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
@@ -77,10 +77,10 @@ index 8135a3dc01..f8d2385b91 100644
  INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
  
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 9638e03578..c284351665 100644
+index 2e0af7698a..0e3de2ec5e 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -866,7 +866,6 @@
+@@ -879,7 +879,6 @@
      <PcdsFixedAtBuild>
        gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
    }
@@ -89,7 +89,7 @@ index 9638e03578..c284351665 100644
    #
    # ISA Support
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index 9d6314d56e..5d49c55d8a 100644
+index 3ad2fe5eee..2ca10f7c5e 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -340,7 +340,6 @@ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
@@ -101,10 +101,10 @@ index 9d6314d56e..5d49c55d8a 100644
  INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
  INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 7d702f3d21..88140034c1 100644
+index 55f6760f4c..c266686361 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -940,7 +940,6 @@
+@@ -947,7 +947,6 @@
      <PcdsFixedAtBuild>
        gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
    }
@@ -113,7 +113,7 @@ index 7d702f3d21..88140034c1 100644
    #
    # ISA Support
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 474ef5ca7e..d09bd16e2f 100644
+index da4541d747..00b3f9d0d8 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -367,7 +367,6 @@ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
@@ -124,6 +124,3 @@ index 474ef5ca7e..d09bd16e2f 100644
  INF  OvmfPkg/PlatformDxe/Platform.inf
  INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
  INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
--- 
-2.39.3
-

0015-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch

@@ -1,7 +1,7 @@
-From 4e165646d809f6ebb0ca0492b00d48ad225db81b Mon Sep 17 00:00:00 2001
+From ff214a87a99084bd91a04711e52ec1bffa911557 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:13 +0200
-Subject: OvmfPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -27,19 +27,19 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  6 files changed, 6 deletions(-)
 
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index daed0cb362..bcfd40ce66 100644
+index d39d9e8c27..12ed090eab 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -827,7 +827,6 @@
+@@ -836,7 +836,6 @@
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
    MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index f8d2385b91..410bb2893c 100644
+index 381735165d..bd69792100 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -296,7 +296,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -51,19 +51,19 @@ index f8d2385b91..410bb2893c 100644
  !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
  INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index c284351665..eced00f16a 100644
+index 0e3de2ec5e..821423cfe2 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -841,7 +841,6 @@
+@@ -854,7 +854,6 @@
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
    MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index 5d49c55d8a..cb3ea94514 100644
+index 2ca10f7c5e..4011682faf 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -75,19 +75,19 @@ index 5d49c55d8a..cb3ea94514 100644
  !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
  INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 88140034c1..9a7325a373 100644
+index c266686361..ea3f8d73bc 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -915,7 +915,6 @@
+@@ -922,7 +922,6 @@
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
    MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index d09bd16e2f..765cc46921 100644
+index 00b3f9d0d8..c53501679a 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -322,7 +322,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -98,6 +98,3 @@ index d09bd16e2f..765cc46921 100644
  
  !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
  INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
--- 
-2.39.3
-

0016-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch

@@ -1,7 +1,7 @@
-From 7894ed0cd0583d4b6d39798310bb537d64eb8e34 Mon Sep 17 00:00:00 2001
+From 7478b17347f2119448467a0ce821a5c5f865a2c8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:16 +0200
-Subject: ArmVirtPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -24,10 +24,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  3 files changed, 3 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 176246d683..8fe5926ece 100644
+index fe7b7e1d64..f0946821c6 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -462,7 +462,6 @@
+@@ -465,7 +465,6 @@
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
    MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
@@ -36,7 +36,7 @@ index 176246d683..8fe5926ece 100644
    #
    # Bds
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 8a063bac04..5da1481532 100644
+index 9b3e37d5c9..a997063751 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 @@ -84,7 +84,6 @@ READ_LOCK_STATUS   = TRUE
@@ -48,10 +48,10 @@ index 8a063bac04..5da1481532 100644
    #
    # Status Code Routing
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 18d59c2414..c76657d0c4 100644
+index 4a43892f7d..8fa801dad6 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -362,7 +362,6 @@
+@@ -365,7 +365,6 @@
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
    MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
@@ -59,6 +59,3 @@ index 18d59c2414..c76657d0c4 100644
  
    #
    # Bds
--- 
-2.39.3
-

0017-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 2b5fd3beae02e9b8cec957804440d4f80cd081b0 Mon Sep 17 00:00:00 2001
+From 42c144b94db706be6f01d5fb1537a35cc803daa8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:19 +0200
-Subject: OvmfPkg: Remove UdfDxe filesystem driver (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove UdfDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -29,22 +29,22 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  8 files changed, 8 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index dafdc1e67a..5987de6d83 100644
+index 52b0d1062c..41953c119d 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -671,7 +671,6 @@
+@@ -681,7 +681,6 @@
    MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index 2bedd4bef1..4d2f9c7248 100644
+index 48cc3b00c1..2f03c80ffd 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
-@@ -272,7 +272,6 @@ INF  OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf
+@@ -274,7 +274,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
  INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
  
  INF  FatPkg/EnhancedFatDxe/Fat.inf
@@ -53,19 +53,19 @@ index 2bedd4bef1..4d2f9c7248 100644
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
  INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index bcfd40ce66..5762871fee 100644
+index 12ed090eab..07176ad930 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -826,7 +826,6 @@
+@@ -835,7 +835,6 @@
    MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 410bb2893c..9df41eae67 100644
+index bd69792100..97c808446e 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -295,7 +295,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
@@ -77,19 +77,19 @@ index 410bb2893c..9df41eae67 100644
  !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
  INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index eced00f16a..dc5020a632 100644
+index 821423cfe2..ba7ed38412 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -840,7 +840,6 @@
+@@ -853,7 +853,6 @@
    MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index cb3ea94514..e002846515 100644
+index 4011682faf..6351ce645b 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -296,7 +296,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
@@ -101,19 +101,19 @@ index cb3ea94514..e002846515 100644
  !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
  INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 9a7325a373..e1e1df4b9d 100644
+index ea3f8d73bc..55f3315241 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -914,7 +914,6 @@
+@@ -921,7 +921,6 @@
    MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 765cc46921..e586632664 100644
+index c53501679a..558a944f20 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -321,7 +321,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
@@ -124,6 +124,3 @@ index 765cc46921..e586632664 100644
  
  !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
  INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
--- 
-2.39.3
-

0018-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 1078848167171e47d42cfaa0de2ba5dc1bad4639 Mon Sep 17 00:00:00 2001
+From 34b2ee906d0cce11a8156105777b6ecfaca5feba Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:22 +0200
-Subject: ArmVirtPkg: Remove UdfDxe filesystem driver (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove UdfDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -24,10 +24,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  3 files changed, 3 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 8fe5926ece..b1deefc2fd 100644
+index f0946821c6..68ad5877ee 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -461,7 +461,6 @@
+@@ -464,7 +464,6 @@
    MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
@@ -36,7 +36,7 @@ index 8fe5926ece..b1deefc2fd 100644
    #
    # Bds
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 5da1481532..2b17211256 100644
+index a997063751..dcb1b793d1 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 @@ -83,7 +83,6 @@ READ_LOCK_STATUS   = TRUE
@@ -48,10 +48,10 @@ index 5da1481532..2b17211256 100644
    #
    # Status Code Routing
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index c76657d0c4..afebc46a04 100644
+index 8fa801dad6..87e54e682a 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -361,7 +361,6 @@
+@@ -364,7 +364,6 @@
    MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
@@ -59,6 +59,3 @@ index c76657d0c4..afebc46a04 100644
  
    #
    # Bds
--- 
-2.39.3
-

0019-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch

@@ -1,7 +1,7 @@
-From c536b7c67fe45bfa1bc27299ba0a584af572e80d Mon Sep 17 00:00:00 2001
+From aac73e5f62e2305e6578c9b22ae557741bf6532a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:25 +0200
-Subject: OvmfPkg: Remove TftpDynamicCommand from shell (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove TftpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -27,10 +27,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  6 files changed, 15 deletions(-)
 
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 5762871fee..ed72cbf57e 100644
+index 07176ad930..0183511722 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -904,10 +904,6 @@
+@@ -913,10 +913,6 @@
  !endif
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -42,7 +42,7 @@ index 5762871fee..ed72cbf57e 100644
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 9df41eae67..1d19e20e8a 100644
+index 97c808446e..cb95c842fa 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -54,10 +54,10 @@ index 9df41eae67..1d19e20e8a 100644
  INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
  !endif
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index dc5020a632..9b97e664d7 100644
+index ba7ed38412..66554b42ed 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -918,10 +918,6 @@
+@@ -931,10 +931,6 @@
  !endif
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -69,7 +69,7 @@ index dc5020a632..9b97e664d7 100644
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index e002846515..621772963f 100644
+index 6351ce645b..592f0fed82 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -298,7 +298,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -81,10 +81,10 @@ index e002846515..621772963f 100644
  INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
  !endif
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index e1e1df4b9d..8bf848c647 100644
+index 55f3315241..6d1d2bd39b 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -992,10 +992,6 @@
+@@ -999,10 +999,6 @@
  !endif
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -96,7 +96,7 @@ index e1e1df4b9d..8bf848c647 100644
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index e586632664..b1d6c23a93 100644
+index 558a944f20..70556f8ace 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -323,7 +323,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -107,6 +107,3 @@ index e586632664..b1d6c23a93 100644
  INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
  INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
  !endif
--- 
-2.39.3
-

0020-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch

@@ -1,7 +1,7 @@
-From 2795327b7185bec84238542ce94801733a41ffe3 Mon Sep 17 00:00:00 2001
+From a3493c0945f733e395ea7444f1639a42f8a717f0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:28 +0200
-Subject: ArmVirtPkg: Remove TftpDynamicCommand from shell (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove TftpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -23,10 +23,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  2 files changed, 3 insertions(+), 5 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
-index 2443e8351c..9534d6f95a 100644
+index fe6488ee99..5677bad717 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
-@@ -375,10 +375,9 @@
+@@ -385,10 +385,9 @@
    #
    MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
  
@@ -41,17 +41,14 @@ index 2443e8351c..9534d6f95a 100644
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 2b17211256..16a073c4a1 100644
+index dcb1b793d1..b1c3fcc66d 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-@@ -98,7 +98,6 @@ READ_LOCK_STATUS   = TRUE
+@@ -99,7 +99,6 @@ READ_LOCK_STATUS   = TRUE
-   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
+   INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
  
    INF ShellPkg/Application/Shell/Shell.inf
 -  INF ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
    INF ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
+   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
    INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
- 
--- 
-2.39.3
-

0021-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch

@@ -1,11 +1,15 @@
-From 8ddd92f068c1f5f5177db1bc381201118bd2816c Mon Sep 17 00:00:00 2001
+From 873a03ce289c988d822f1bb420c1e9a0eef5ca56 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:31 +0200
-Subject: OvmfPkg: Remove HttpDynamicCommand from shell (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove HttpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
+Rebase to edk2-stable202311:
+
+Minor update, context change due to new variable policy shell command.
+
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [15/19] 1911cf04f27467ef1175b1976864c1111d93d19e
@@ -27,10 +31,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  6 files changed, 15 deletions(-)
 
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index ed72cbf57e..078eab1acc 100644
+index 0183511722..970ffbad82 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -904,10 +904,6 @@
+@@ -913,10 +913,6 @@
  !endif
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -38,11 +42,11 @@ index ed72cbf57e..078eab1acc 100644
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
-   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 1d19e20e8a..5b2265c7d1 100644
+index cb95c842fa..891e0e06ef 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -54,10 +58,10 @@ index 1d19e20e8a..5b2265c7d1 100644
  !endif
  !if $(BUILD_SHELL) == TRUE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 9b97e664d7..6779503e7e 100644
+index 66554b42ed..3127e3d18d 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -918,10 +918,6 @@
+@@ -931,10 +931,6 @@
  !endif
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -65,11 +69,11 @@ index 9b97e664d7..6779503e7e 100644
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
-   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index 621772963f..da32cf1a2f 100644
+index 592f0fed82..61a827b365 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -298,7 +298,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -81,10 +85,10 @@ index 621772963f..da32cf1a2f 100644
  !endif
  !if $(BUILD_SHELL) == TRUE
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 8bf848c647..66f267f731 100644
+index 6d1d2bd39b..6f078b5b27 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -992,10 +992,6 @@
+@@ -999,10 +999,6 @@
  !endif
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -92,11 +96,11 @@ index 8bf848c647..66f267f731 100644
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
-   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index b1d6c23a93..7bf83e266c 100644
+index 70556f8ace..d2e1c2894f 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -323,7 +323,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -107,6 +111,3 @@ index b1d6c23a93..7bf83e266c 100644
  INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
  !endif
  !if $(BUILD_SHELL) == TRUE
--- 
-2.39.3
-

0022-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch

@@ -1,11 +1,15 @@
-From a9ad729ef5a9dd474842e2e1e0c8be1166af1afa Mon Sep 17 00:00:00 2001
+From 4b212f0b5f5d2dbe595e53bc0b553abb90ee288a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:34 +0200
-Subject: ArmVirtPkg: Remove HttpDynamicCommand from shell (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove HttpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
+Rebase to edk2-stable202311:
+
+Minor update, context change due to new variable policy shell command.
+
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [16/19] 07a74f1fdcdbb9a31d25ce9760edcd852e9574c3
@@ -23,10 +27,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  2 files changed, 5 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
-index 9534d6f95a..d5ebc11ad8 100644
+index 5677bad717..d4c001e1bd 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
-@@ -378,10 +378,6 @@
+@@ -388,10 +388,6 @@
    #
    # UEFI application (Shell Embedded Boot Loader)
    #
@@ -34,21 +38,18 @@ index 9534d6f95a..d5ebc11ad8 100644
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
-   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 16a073c4a1..0a01c29722 100644
+index b1c3fcc66d..8153558686 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-@@ -98,7 +98,6 @@ READ_LOCK_STATUS   = TRUE
+@@ -99,7 +99,6 @@ READ_LOCK_STATUS   = TRUE
-   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
+   INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
  
    INF ShellPkg/Application/Shell/Shell.inf
 -  INF ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
+   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
    INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
  
-   #
--- 
-2.39.3
-

0023-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch

@@ -1,11 +1,15 @@
-From e07788f7cf34a364b770e2b979942bf1a8b659f0 Mon Sep 17 00:00:00 2001
+From 3635ecb975af26d0d4886b862f8cf812b891eb37 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:39 +0200
-Subject: OvmfPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
+Rebase to edk2-stable202311:
+
+Minor update, context change due to new variable policy shell command.
+
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [17/19] 491fe1301ea29c7cb56c20272e45614d5fcb6f14
@@ -23,21 +27,21 @@ Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- OvmfPkg/AmdSev/AmdSevX64.dsc | 4 ----
+ OvmfPkg/AmdSev/AmdSevX64.dsc |  4 ----
- OvmfPkg/AmdSev/AmdSevX64.fdf | 1 -
+ OvmfPkg/AmdSev/AmdSevX64.fdf |  1 -
- OvmfPkg/OvmfPkgIa32.dsc      | 4 ----
+ OvmfPkg/OvmfPkgIa32.dsc      | 32 ++++++++++++++------------------
- OvmfPkg/OvmfPkgIa32.fdf      | 1 -
+ OvmfPkg/OvmfPkgIa32.fdf      |  1 -
- OvmfPkg/OvmfPkgIa32X64.dsc   | 4 ----
+ OvmfPkg/OvmfPkgIa32X64.dsc   | 32 ++++++++++++++------------------
- OvmfPkg/OvmfPkgIa32X64.fdf   | 1 -
+ OvmfPkg/OvmfPkgIa32X64.fdf   |  1 -
- OvmfPkg/OvmfPkgX64.dsc       | 4 ----
+ OvmfPkg/OvmfPkgX64.dsc       | 32 ++++++++++++++------------------
- OvmfPkg/OvmfPkgX64.fdf       | 1 -
+ OvmfPkg/OvmfPkgX64.fdf       |  1 -
- 8 files changed, 20 deletions(-)
+ 8 files changed, 42 insertions(+), 62 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 5987de6d83..427df673f3 100644
+index 41953c119d..7bb6ffb3f0 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -728,10 +728,6 @@
+@@ -740,10 +740,6 @@
    MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -49,10 +53,10 @@ index 5987de6d83..427df673f3 100644
    OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf
    OvmfPkg/AmdSev/Grub/Grub.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index 4d2f9c7248..a48c93e2a5 100644
+index 2f03c80ffd..0e3d7bea2b 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
-@@ -274,7 +274,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+@@ -276,7 +276,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
  INF  FatPkg/EnhancedFatDxe/Fat.inf
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -61,13 +65,69 @@ index 4d2f9c7248..a48c93e2a5 100644
  INF OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf
  INF  OvmfPkg/AmdSev/Grub/Grub.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 078eab1acc..147774ef58 100644
+index 970ffbad82..83adecc374 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -904,10 +904,6 @@
+@@ -537,7 +537,7 @@
- !endif
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
  
- !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+@@ -604,7 +604,7 @@
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+ !if $(SMM_REQUIRE) == FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+@@ -840,25 +840,25 @@
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+ !ifndef $(CSM_ENABLE)
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+ !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+ 
+   #
+   # ISA Support
+@@ -917,10 +917,6 @@
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@@ -76,7 +136,7 @@ index 078eab1acc..147774ef58 100644
  !if $(BUILD_SHELL) == TRUE
    ShellPkg/Application/Shell/Shell.inf {
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 5b2265c7d1..56f2c45795 100644
+index 891e0e06ef..88c57ff5ff 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -88,13 +148,69 @@ index 5b2265c7d1..56f2c45795 100644
  !if $(BUILD_SHELL) == TRUE
  INF  ShellPkg/Application/Shell/Shell.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 6779503e7e..a41bc32454 100644
+index 3127e3d18d..b47cdf63e7 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -918,10 +918,6 @@
+@@ -544,7 +544,7 @@
- !endif
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
  
- !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+@@ -616,7 +616,7 @@
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+ !if $(SMM_REQUIRE) == FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+@@ -858,25 +858,25 @@
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+ !ifndef $(CSM_ENABLE)
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+ !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+ 
+   #
+   # ISA Support
+@@ -935,10 +935,6 @@
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@@ -103,7 +219,7 @@ index 6779503e7e..a41bc32454 100644
  !if $(BUILD_SHELL) == TRUE
    ShellPkg/Application/Shell/Shell.inf {
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index da32cf1a2f..9efbe6a06d 100644
+index 61a827b365..ab5a9bc306 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -298,7 +298,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -115,13 +231,69 @@ index da32cf1a2f..9efbe6a06d 100644
  !if $(BUILD_SHELL) == TRUE
  INF  ShellPkg/Application/Shell/Shell.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 66f267f731..ce363f748f 100644
+index 6f078b5b27..be3824ec1e 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -992,10 +992,6 @@
+@@ -563,7 +563,7 @@
- !endif
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
  
- !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+@@ -634,7 +634,7 @@
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+ !if $(SMM_REQUIRE) == FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+@@ -926,25 +926,25 @@
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+ !ifndef $(CSM_ENABLE)
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+ !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+ 
+   #
+   # ISA Support
+@@ -1003,10 +1003,6 @@
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@@ -130,7 +302,7 @@ index 66f267f731..ce363f748f 100644
  !if $(BUILD_SHELL) == TRUE
    ShellPkg/Application/Shell/Shell.inf {
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 7bf83e266c..404e72dc7d 100644
+index d2e1c2894f..851399888f 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -323,7 +323,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -141,6 +313,3 @@ index 7bf83e266c..404e72dc7d 100644
  !endif
  !if $(BUILD_SHELL) == TRUE
  INF  ShellPkg/Application/Shell/Shell.inf
--- 
-2.39.3
-

0024-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch

@@ -1,11 +1,15 @@
-From df6b72f26ffb68a28c45f426ad3225388e5fccff Mon Sep 17 00:00:00 2001
+From b91bdc055499a46d825b3c6a2613de5c77e3a66d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:46 +0200
-Subject: ArmVirtPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
+Rebase to edk2-stable202311:
+
+Minor update, context change due to new variable policy shell command.
+
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [18/19] 8f4e4007108462533e3d2050b84d8830073a7c0d
@@ -19,18 +23,28 @@ Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- ArmVirtPkg/ArmVirt.dsc.inc           | 4 ----
+ ArmVirtPkg/ArmVirt.dsc.inc           | 10 +++-------
- ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 -
+ ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc |  1 -
- 2 files changed, 5 deletions(-)
+ 2 files changed, 3 insertions(+), 8 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
-index d5ebc11ad8..0b2b64c1cb 100644
+index d4c001e1bd..fee6e5b17f 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
-@@ -378,10 +378,6 @@
+@@ -385,17 +385,13 @@
-   #
-   # UEFI application (Shell Embedded Boot Loader)
    #
+   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
+ 
+-  #
+-  # UEFI application (Shell Embedded Boot Loader)
+-  #
++  #
++  # UEFI application (Shell Embedded Boot Loader)
++  #
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@@ -39,17 +53,14 @@ index d5ebc11ad8..0b2b64c1cb 100644
      <LibraryClasses>
        ShellCommandLib|ShellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.inf
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 0a01c29722..4dbb77a6ca 100644
+index 8153558686..4cd53995d2 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-@@ -98,7 +98,6 @@ READ_LOCK_STATUS   = TRUE
+@@ -100,7 +100,6 @@ READ_LOCK_STATUS   = TRUE
-   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
  
    INF ShellPkg/Application/Shell/Shell.inf
+   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
 -  INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
  
    #
    # Bds
--- 
-2.39.3
-

0025-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch

@@ -1,7 +1,7 @@
-From a920227615c895522739bbbf3a5fb7f6a470de86 Mon Sep 17 00:00:00 2001
+From 41089770963055b4bc9662ba4204d8ee7907fbcd Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 28 Feb 2023 15:47:00 +0100
-Subject: [PATCH 09/12] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
+Subject: [PATCH] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
 
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 42: UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
@@ -13,15 +13,19 @@ In case the number of CPUs can in increase beyond 255
 due to CPU hotplug choose x2apic mode.
 
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+patch_name: edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
+present_in_specfile: true
+location_in_specfile: 38
 ---
  UefiCpuPkg/Library/MpInitLib/MpLib.c | 8 +++++++-
  1 file changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
-index f1f2840714..79fd8fb04d 100644
+index 9a6ec5db5c..14ecc62f2b 100644
 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
 +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
-@@ -526,7 +526,9 @@ CollectProcessorCount (
+@@ -527,7 +527,9 @@ CollectProcessorCount (
    //
    // Enable x2APIC mode if
    //  1. Number of CPU is greater than 255; or
@@ -32,7 +36,7 @@ index f1f2840714..79fd8fb04d 100644
    //
    X2Apic = FALSE;
    if (CpuMpData->CpuCount > 255) {
-@@ -534,6 +536,10 @@ CollectProcessorCount (
+@@ -535,6 +537,10 @@ CollectProcessorCount (
      // If there are more than 255 processor found, force to enable X2APIC
      //
      X2Apic = TRUE;
@@ -43,6 +47,3 @@ index f1f2840714..79fd8fb04d 100644
    } else {
      CpuInfoInHob = (CPU_INFO_IN_HOB *)(UINTN)CpuMpData->CpuInfoInHob;
      for (Index = 0; Index < CpuMpData->CpuCount; Index++) {
--- 
-2.39.3
-

0025-recreate-import-redhat-directory.patch

@@ -1,164 +0,0 @@
-From 37e0f9ed6e872224afe70065627de3965689425c Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Wed, 11 Jun 2014 20:45:26 +0200
-Subject: recreate / import "redhat/" directory
-
-This patch now unites the following downstream commits:
-
-- 18bd1193e7 .distro: simplify WORKSPACE setup
-- b00f3398c8 fix tpm build options
-- e032ab1675 spec: Centralize non-firmware %install files at the top
-- 8501863acc spec: Don't put build output in the top directory
-- e6ec0363d3 spec: Factor out OVMF_FLAGS and OVMF_SB_FLAGS
-- 596f34c8b6 spec: Use %make_build macro
-- 55169e466d spec: Replace RPM_BUILD_ROOT with %{buildroot}
-- 69c4c60920 spec: Split out build_iso() function
-- ed67da8c85 spec: Add %{qosb_testing} macro
-- 44519f5b94 spec: Move %check to between %install and %files
-- b37b334dc7 spec: Remove extra 'true' at end of %check
-- dd11149c3a spec: Add %{qemu_package} and %{qemu_binary}
-- 0f5d4ae0d5 spec: Move -D TPM_ENABLE to common CC_FLAGS
-- 84b3fd93f9 spec: Replace ifarch+else conditionals with build_XXX variables
-- e97f79e744 spec: Use %autosetup with our required git config options
-- 45a347a759 spec: don't conditionalize %package definitions
-- acfcfaea1e spec: Add BuildRequires: make
-- d917a93f6f spec: remove Group: and %defattr
-- f2d3be3ae3 redhat: build UefiShell.iso with xorriso rather than genisoimage
-- 3fb4a20f30 redhat: narrow the "qemu-kvm" BuildRequires down to "qemu-kvm-core"
-- bfb89c4ae5 redhat: drop Split tool from the edk2-tools subpackage
-- ac8be2e0ef redhat: refresh "Makefile.common" for the 8.5 rebase
-- 2bd2d18864 redhat: filter out jansson submodule removal hunks
-- f13d7899ed recreate / import "redhat/" directory
-
-Merged patches (edk2-stable202202):
-- 1a7b1c3b72 spec: adapt specfile to build option changes, disable tpm1
-- 96eb388be3 spec: build amdsev variant
-- ea34352d41 redhat: bump OpenSSL dist-git submodule to a75722161d20 / RHEL-8.5
-
-Merged patches (edk2-stable202208):
-- a60bf3fd10 Adding support for CentOS 9 build
-- d3f25d438c OvmfPkg: Update target machines config
-- d63f783930 openssl: jump to 8.7.0 branch (2022-07-22)
-- 39882ce96d qemu-ovmf-secureboot: Do not use submodule
-- 283ef4a67d ovmf-vars-generator: Use max cpu
-- b6887ef7e1 Update build target to RHEL 9.2.0
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-
-Merged patches (edk2-stable202305):
-- 5eef16bd65 remove amd-sev feature flag from secure boot builds (rh only)
-- cc9e1b6eaa build script update
-- 046c1f08e6 PcdDxeNxMemoryProtectionPolicy update
-- b9dc1b5365 add aarch64 qcow2 images
-- f4e2d6bf41 update json files
-- be03b42128 add libvirt version conflict
-- dce699b61d add dbx update blob (rh only)
-- d8b2407343 spec: apply dbx update (rh only)
-- a8a5ef95b5 dbx update, 2023-05-09, black lotus edition
-- 310e179053 json descriptors: explicitly set mode = split
-- additionally
-  - update frh.py, add new upstream submodules
-  - replace egrep with grep -E and fgrep with grep -F in downstream
-    scripts
-  - remove git commit sha from package version string
-
-Signed-off-by: Oliver Steffen <osteffen@redhat.com>
-
-drop  git sha
-
-Signed-off-by: Oliver Steffen <osteffen@redhat.com>
----
- .distro/.gitignore                            |    3 +
- .distro/DBXUpdate-20230314.x64.bin            |  Bin 0 -> 13922 bytes
- .distro/DBXUpdate-20230509.x64.bin            |  Bin 0 -> 21170 bytes
- .distro/Makefile                              |  114 +
- .distro/Makefile.common                       |   31 +
- .distro/README                                |  236 ++
- .distro/RedHatSecureBootPkKek1.pem            |   22 +
- .distro/TargetRelease                         |    4 +
- .distro/edk2-build.py                         |  391 +++
- .distro/edk2-build.rhel-9                     |  119 +
- .distro/edk2.spec.template                    | 1301 +++++++++
- .../30-edk2-ovmf-x64-sb-enrolled.json         |   36 +
- .distro/metafiles/40-edk2-ovmf-x64-sb.json    |   35 +
- .distro/metafiles/50-edk2-aarch64-qcow2.json  |   32 +
- .distro/metafiles/50-edk2-ovmf-x64-nosb.json  |   35 +
- .distro/metafiles/51-edk2-aarch64-raw.json    |   32 +
- .../52-edk2-aarch64-verbose-qcow2.json        |   32 +
- .../53-edk2-aarch64-verbose-raw.json          |   32 +
- .../metafiles/60-edk2-ovmf-x64-amdsev.json    |   31 +
- .../metafiles/60-edk2-ovmf-x64-inteltdx.json  |   29 +
- .distro/openssl-rhel                          |    1 +
- .distro/ovmf-whitepaper-c770f8c.txt           | 2422 +++++++++++++++++
- .distro/qemu-ovmf-secureboot/CONTRIBUTING     |   45 +
- .distro/qemu-ovmf-secureboot/LICENSE          |   21 +
- .distro/qemu-ovmf-secureboot/README.md        |   66 +
- .../qemu-ovmf-secureboot/ovmf-vars-generator  |  296 ++
- .distro/rpmbuild/BUILD/.gitignore             |    2 +
- .distro/rpmbuild/RPMS/.gitignore              |    2 +
- .distro/rpmbuild/SOURCES/.gitignore           |    2 +
- .distro/rpmbuild/SPECS/.gitignore             |    2 +
- .distro/rpmbuild/SRPMS/.gitignore             |    2 +
- .distro/scripts/edk2-guids                    |   85 +
- .distro/scripts/frh.py                        |   51 +
- .distro/scripts/git-backport-diff             |  327 +++
- .distro/scripts/git-compile-check             |  215 ++
- .distro/scripts/openssl-update                |   79 +
- .distro/scripts/process-patches.sh            |   75 +
- .distro/scripts/tarball_checksum.sh           |    3 +
- .gitattributes                                |   15 +
- .gitignore                                    |   16 +-
- .gitmodules                                   |    4 +
- sources                                       |    1 +
- 42 files changed, 6240 insertions(+), 7 deletions(-)
- create mode 100644 .distro/.gitignore
- create mode 100644 .distro/DBXUpdate-20230314.x64.bin
- create mode 100644 .distro/DBXUpdate-20230509.x64.bin
- create mode 100644 .distro/Makefile
- create mode 100644 .distro/Makefile.common
- create mode 100644 .distro/README
- create mode 100644 .distro/RedHatSecureBootPkKek1.pem
- create mode 100644 .distro/TargetRelease
- create mode 100755 .distro/edk2-build.py
- create mode 100644 .distro/edk2-build.rhel-9
- create mode 100644 .distro/edk2.spec.template
- create mode 100644 .distro/metafiles/30-edk2-ovmf-x64-sb-enrolled.json
- create mode 100644 .distro/metafiles/40-edk2-ovmf-x64-sb.json
- create mode 100644 .distro/metafiles/50-edk2-aarch64-qcow2.json
- create mode 100644 .distro/metafiles/50-edk2-ovmf-x64-nosb.json
- create mode 100644 .distro/metafiles/51-edk2-aarch64-raw.json
- create mode 100644 .distro/metafiles/52-edk2-aarch64-verbose-qcow2.json
- create mode 100644 .distro/metafiles/53-edk2-aarch64-verbose-raw.json
- create mode 100644 .distro/metafiles/60-edk2-ovmf-x64-amdsev.json
- create mode 100644 .distro/metafiles/60-edk2-ovmf-x64-inteltdx.json
- create mode 160000 .distro/openssl-rhel
- create mode 100644 .distro/ovmf-whitepaper-c770f8c.txt
- create mode 100644 .distro/qemu-ovmf-secureboot/CONTRIBUTING
- create mode 100644 .distro/qemu-ovmf-secureboot/LICENSE
- create mode 100644 .distro/qemu-ovmf-secureboot/README.md
- create mode 100755 .distro/qemu-ovmf-secureboot/ovmf-vars-generator
- create mode 100644 .distro/rpmbuild/BUILD/.gitignore
- create mode 100644 .distro/rpmbuild/RPMS/.gitignore
- create mode 100644 .distro/rpmbuild/SOURCES/.gitignore
- create mode 100644 .distro/rpmbuild/SPECS/.gitignore
- create mode 100644 .distro/rpmbuild/SRPMS/.gitignore
- create mode 100755 .distro/scripts/edk2-guids
- create mode 100644 .distro/scripts/frh.py
- create mode 100755 .distro/scripts/git-backport-diff
- create mode 100755 .distro/scripts/git-compile-check
- create mode 100755 .distro/scripts/openssl-update
- create mode 100755 .distro/scripts/process-patches.sh
- create mode 100755 .distro/scripts/tarball_checksum.sh
- create mode 100644 .gitattributes
- create mode 100644 sources
-
-diff --git a/sources b/sources
-new file mode 100644
-index 0000000000..ea8c8ad50b
---- /dev/null
-+++ b/sources
-@@ -0,0 +1 @@
-+SHA512 (edk2-ba91d0292e.tar.xz) = 3b21cc39671d28bfeb059da3683751cc5277c63a894b2a05bdfbd2bbe53545c34f04c229becf44f1563f89a738f37ae8f2333076d126a7e94d234bc4bb25454c
--- 
-2.39.3
-

0026-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch

@@ -1,181 +0,0 @@
-From fb3719378d7ce646c684fc2c8b52806aca0c576a Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Sat, 16 Nov 2019 17:11:27 +0100
-Subject: CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files in the INFs
- (RH)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1938257
-
-- Recreate the patch based on downstream commits:
-
-  - 56c4bb81b311 ("CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files
-                  in the INFs (RH)", 2020-06-05),
-  - e81751a1c303 ("CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1g",
-                  2020-11-23),
-  - 3e3fe5e62079 ("redhat: bump OpenSSL dist-git submodule to 1.1.1g+ /
-                  RHEL-8.4", 2020-11-23).
-
-  (1) At e81751a1c303, downstream edk2 was in sync with upstream edk2
-      consuming OpenSSL 1.1.1g (upstream edk2 commit 8c30327debb2
-      ("CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1g", 2020-07-25)).
-
-      Since commit 8c30327debb2, upstream edk2 modified the OpensslLib INF
-      files, namely
-
-      - CryptoPkg/Library/OpensslLib/OpensslLib.inf
-      - CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-
-      in the following commits only:
-
-      - be01087e0780 ("CryptoPkg/Library: Remove the redundant build
-        option", 2020-08-12), which did not affect the source file list at
-        all,
-
-      - b5701a4c7a0f ("CryptoPkg: OpensslLib: Use RngLib to generate
-        entropy in rand_pool", 2020-09-18), which replaced some of the
-        *edk2-specific* "rand_pool_noise" source files with an RngLib
-        dependency.
-
-      This means that the list of required, actual OpenSSL source files
-      has not changed in upstream edk2 since our downstream edk2 commit
-      e81751a1c303.
-
-  (2) At commit 3e3fe5e62079 (the direct child of e81751a1c303),
-      downstream edk2's OpenSSL dependency was satisfied with RHEL-8
-      OpenSSL at dist-git commit bdd048e929dc ("Two fixes that will be
-      shipped in RHEL-8.3.0.z", 2020-10-23).
-
-      Since commit bdd048e929dc, RHEL-8 OpenSSL dist-git advanced
-      (fast-forwarded) to commit a75722161d20 ("Update to version 1.1.1k",
-      2021-05-25), which is the current head of the rhel-8.5.0 branch.
-      (See also <https://bugzilla.redhat.com/show_bug.cgi?id=1938257#c6>.)
-
-      At both dist-git bdd048e929dc and dist-git a75722161d20, I built the
-      respective RHEL-8 OpenSSL *source* RPM, and prepped the respective
-      source tree, with "rpmbuild -bp". Subsequently I compared the
-      prepped source trees recursively.
-
-      - The following files disappeared:
-
-        - 29 backup files created by "patch",
-
-        - the assembly generator perl script called
-          "ecp_nistz256-avx2.pl", which is not used during the build.
-
-      - The following new files appeared:
-
-        - 18 files directly or indirectly under the "test" subdirectory,
-          which are not used during the build,
-
-        - 5 backup files created by "patch",
-
-        - 2 DCL scripts used when building OpenSSL on OpenVMS.
-
-      This means that the total list of RHEL-8 OpenSSL source files has
-      not changed in RHEL-8 OpenSSL dist-git since our downstream edk2
-      commit 3e3fe5e62079.
-
-  As a result, copy the "RHEL8-specific OpenSSL file list" sections
-  verbatim from the INF files, at downstream commit e81751a1c303. (I used
-  the "git checkout -p e81751a1c303 -- Library/OpensslLib/OpensslLib.inf
-  CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf" command.)
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- "OpensslLib.inf":
-
-  - Automatic leading context refresh against upstream commit c72ca4666886
-    ("CryptoPkg/OpensslLib: Add "sort" keyword to header file parsing
-    loop", 2020-03-10).
-
-  - Manual trailing context refresh against upstream commit b49a6c8f80d9
-    ("CryptoPkg/OpensslLib: improve INF file consistency", 2019-12-02).
-
-- "OpensslLibCrypto.inf":
-
-  - Automatic leading context refresh against upstream commits
-    8906f076de35 ("CryptoPkg/OpensslLib: Add missing header files in INF
-    file", 2019-08-16) and 9f4fbd56d430 ("CryptoPkg/OpensslLib: Update
-    process_files.pl to generate .h files", 2019-10-30).
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- new patch
-
-The downstream changes in RHEL8's OpenSSL package, for example in
-"openssl-1.1.1-evp-kdf.patch", introduce new files, and even move some
-preexistent code into those new files. In order to avoid undefined
-references in link editing, we have to list the new files.
-
-Note: "process_files.pl" is not re-run at this time manually, because
-
-(a) "process_files.pl" would pollute the file list (and some of the
-    auto-generated header files) with RHEL8-specific FIPS artifacts, which
-    are explicitly unwanted in edk2,
-
-(b) The RHEL OpenSSL maintainer, Tomas Mraz, identified this specific set
-    of files in <https://bugzilla.redhat.com/show_bug.cgi?id=1749693#c10>,
-    and will help with future changes too.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit 57bd3f146590df8757865d8f2cdd1db3cf3f4d40)
-(cherry picked from commit 56c4bb81b311dfcee6a34c81d3e4feeda7f88995)
----
- CryptoPkg/Library/OpensslLib/OpensslLib.inf       | 12 ++++++++++++
- CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 12 ++++++++++++
- 2 files changed, 24 insertions(+)
-
-diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
-index 0f64c9fa7e..1641754e4d 100644
---- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
-+++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
-@@ -576,6 +576,18 @@
-   $(OPENSSL_PATH)/ssl/statem/statem.h
-   $(OPENSSL_PATH)/ssl/statem/statem_local.h
- # Autogenerated files list ends here
-+# RHEL8-specific OpenSSL file list starts here
-+  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
-+  $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
-+  $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/kdf_local.h
-+  $(OPENSSL_PATH)/crypto/kdf/kdf_util.c
-+  $(OPENSSL_PATH)/crypto/kdf/krb5kdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/pbkdf2.c
-+  $(OPENSSL_PATH)/crypto/kdf/sshkdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/sskdf.c
-+# RHEL8-specific OpenSSL file list ends here
-   buildinf.h
-   ossl_store.c
-   rand_pool.c
-diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-index 311cd1e605..7e980a7d03 100644
---- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-+++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-@@ -526,6 +526,18 @@
-   $(OPENSSL_PATH)/crypto/x509v3/standard_exts.h
-   $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
- # Autogenerated files list ends here
-+# RHEL8-specific OpenSSL file list starts here
-+  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
-+  $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
-+  $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/kdf_local.h
-+  $(OPENSSL_PATH)/crypto/kdf/kdf_util.c
-+  $(OPENSSL_PATH)/crypto/kdf/krb5kdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/pbkdf2.c
-+  $(OPENSSL_PATH)/crypto/kdf/sshkdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/sskdf.c
-+# RHEL8-specific OpenSSL file list ends here
-   buildinf.h
-   ossl_store.c
-   rand_pool.c
--- 
-2.39.3
-

0026-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 9f0b4df867e6a2d56838e4048be245eac3fcc18e Mon Sep 17 00:00:00 2001
+From 5870362631ee204936f495b8e60eb2611bb05c3b Mon Sep 17 00:00:00 2001
 From: Oliver Steffen <osteffen@redhat.com>
 Date: Wed, 16 Aug 2023 12:09:40 +0200
-Subject: [PATCH 3/3] OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
+Subject: [PATCH] OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
 
 RH-Author: Oliver Steffen <osteffen@redhat.com>
 RH-MergeRequest: 46: OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
@@ -17,6 +17,10 @@ guest that uses shim is booted with a vtpm device present.
 BZ 2218196
 
 Signed-off-by: Oliver Steffen <osteffen@redhat.com>
+
+patch_name: edk2-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
+present_in_specfile: true
+location_in_specfile: 44
 ---
  OvmfPkg/AmdSevDxe/AmdSevDxe.c   | 42 +++++++++++++++++++++++++++++++++
  OvmfPkg/AmdSevDxe/AmdSevDxe.inf |  2 ++
@@ -115,6 +119,3 @@ index e7c7d526c9..09cbd2b0ca 100644
  
  [Pcd]
    gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId
--- 
-2.39.3
-

0027-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch

@@ -1,27 +0,0 @@
-From 218d3b32592bffe5ec7317c4838d29e92b4b86f0 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 2 Mar 2023 12:01:36 +0100
-Subject: OvmfPkg: disable dynamic mmio window (rhel only)
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- OvmfPkg/Library/PlatformInitLib/MemDetect.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-index acf90b4e93..86700fc028 100644
---- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-+++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-@@ -679,7 +679,8 @@ PlatformDynamicMmioWindow (
-   AddrSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth);
-   MmioSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth - 3);
- 
--  if ((PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
-+  if (FALSE /* disable for RHEL-9.2, libvirt is not ready yet */ &&
-+      (PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
-       (PlatformInfoHob->PcdPciMmio64Base + MmioSpace < AddrSpace))
-   {
-     DEBUG ((DEBUG_INFO, "%a: using dynamic mmio window\n", __func__));
--- 
-2.39.3
-

0027-recreate-import-.distro-directory.patch

@@ -0,0 +1,85 @@
+From 771ce5bae1eb03240b04dde05a7a40dcec3c8a10 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 11 Jun 2014 20:45:26 +0200
+Subject: [PATCH] recreate / import ".distro/" directory
+
+This patch now unites the following downstream commits:
+
+- 18bd1193e7 .distro: simplify WORKSPACE setup
+- b00f3398c8 fix tpm build options
+- e032ab1675 spec: Centralize non-firmware %install files at the top
+- 8501863acc spec: Don't put build output in the top directory
+- e6ec0363d3 spec: Factor out OVMF_FLAGS and OVMF_SB_FLAGS
+- 596f34c8b6 spec: Use %make_build macro
+- 55169e466d spec: Replace RPM_BUILD_ROOT with %{buildroot}
+- 69c4c60920 spec: Split out build_iso() function
+- ed67da8c85 spec: Add %{qosb_testing} macro
+- 44519f5b94 spec: Move %check to between %install and %files
+- b37b334dc7 spec: Remove extra 'true' at end of %check
+- dd11149c3a spec: Add %{qemu_package} and %{qemu_binary}
+- 0f5d4ae0d5 spec: Move -D TPM_ENABLE to common CC_FLAGS
+- 84b3fd93f9 spec: Replace ifarch+else conditionals with build_XXX variables
+- e97f79e744 spec: Use %autosetup with our required git config options
+- 45a347a759 spec: don't conditionalize %package definitions
+- acfcfaea1e spec: Add BuildRequires: make
+- d917a93f6f spec: remove Group: and %defattr
+- f2d3be3ae3 redhat: build UefiShell.iso with xorriso rather than genisoimage
+- 3fb4a20f30 redhat: narrow the "qemu-kvm" BuildRequires down to "qemu-kvm-core"
+- bfb89c4ae5 redhat: drop Split tool from the edk2-tools subpackage
+- ac8be2e0ef redhat: refresh "Makefile.common" for the 8.5 rebase
+- 2bd2d18864 redhat: filter out jansson submodule removal hunks
+- f13d7899ed recreate / import "redhat/" directory
+
+Merged patches (edk2-stable202202):
+- 1a7b1c3b72 spec: adapt specfile to build option changes, disable tpm1
+- 96eb388be3 spec: build amdsev variant
+- ea34352d41 redhat: bump OpenSSL dist-git submodule to a75722161d20 / RHEL-8.5
+
+Merged patches (edk2-stable202208):
+- a60bf3fd10 Adding support for CentOS 9 build
+- d3f25d438c OvmfPkg: Update target machines config
+- d63f783930 openssl: jump to 8.7.0 branch (2022-07-22)
+- 39882ce96d qemu-ovmf-secureboot: Do not use submodule
+- 283ef4a67d ovmf-vars-generator: Use max cpu
+- b6887ef7e1 Update build target to RHEL 9.2.0
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Merged patches (edk2-stable202305):
+- 5eef16bd65 remove amd-sev feature flag from secure boot builds (rh only)
+- cc9e1b6eaa build script update
+- 046c1f08e6 PcdDxeNxMemoryProtectionPolicy update
+- b9dc1b5365 add aarch64 qcow2 images
+- f4e2d6bf41 update json files
+- be03b42128 add libvirt version conflict
+- dce699b61d add dbx update blob (rh only)
+- d8b2407343 spec: apply dbx update (rh only)
+- a8a5ef95b5 dbx update, 2023-05-09, black lotus edition
+- 310e179053 json descriptors: explicitly set mode = split
+- additionally
+  - update frh.py, add new upstream submodules
+  - replace egrep with grep -E and fgrep with grep -F in downstream
+    scripts
+  - remove git commit sha from package version string
+
+Signed-off-by: Oliver Steffen <osteffen@redhat.com>
+
+Rebase to edk2-stable202311: squash commits:
+
+- 5b833f0c8d Update TargetRelease to support 9.4.0
+- 20024b4cbe Use fixed length for short hash for Makefile
+- 8618f7367e Updated TargetRelease content to support 9.4.0 only.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ sources | 1 +
+ 1 file changed, 1 insertion(+)
+ create mode 100644 sources
+
+diff --git a/sources b/sources
+new file mode 100644
+index 0000000000..ea8c8ad50b
+--- /dev/null
++++ b/sources
+@@ -0,0 +1 @@
++SHA512 (edk2-ba91d0292e.tar.xz) = 3b21cc39671d28bfeb059da3683751cc5277c63a894b2a05bdfbd2bbe53545c34f04c229becf44f1563f89a738f37ae8f2333076d126a7e94d234bc4bb25454c

0028-ArmPkg-Disable-EFI_MEMORY_ATTRIBUTE_PROTOCOL-RH-only.patch

@@ -1,76 +0,0 @@
-From 5c2e46b64824e5432181507ec0706f7fe74c3fe2 Mon Sep 17 00:00:00 2001
-From: Oliver Steffen <osteffen@redhat.com>
-Date: Mon, 19 Jun 2023 11:21:52 +0200
-Subject: ArmPkg: Disable EFI_MEMORY_ATTRIBUTE_PROTOCOL (RH only)
-
-Recent versions of shim (15.6 and 15.7) crash when the newly added
-EFI_MEMORY_ATTRIBUTE_PROTOCOL is provided by the firmware.  To allow
-existing installations to boot, provide a workaround in form of a Pcd
-that allows tuning it off at build time (defaults to 'enabled').
-Additionally, check the return code of the protocol installation calls.
-
-Disable the EFI_MEMORY_ATTRIBUTE_PROTOCOL protocol out builds.
-
-Signed-off-by: Oliver Steffen <osteffen@redhat.com>
----
- .distro/edk2-build.rhel-9        |  2 ++
- ArmPkg/ArmPkg.dec                |  3 +++
- ArmPkg/Drivers/CpuDxe/CpuDxe.c   | 13 +++++++++++--
- ArmPkg/Drivers/CpuDxe/CpuDxe.inf |  1 +
- 4 files changed, 17 insertions(+), 2 deletions(-)
-
-diff --git a/ArmPkg/ArmPkg.dec b/ArmPkg/ArmPkg.dec
-index 2444457ae5..d9e579b5fa 100644
---- a/ArmPkg/ArmPkg.dec
-+++ b/ArmPkg/ArmPkg.dec
-@@ -167,6 +167,9 @@
-   gArmTokenSpaceGuid.PcdCpuVectorBaseAddress|0xffff0000|UINT64|0x00000004
-   gArmTokenSpaceGuid.PcdCpuResetAddress|0x00000000|UINT32|0x00000005
- 
-+  # Enable/Disable EFI_MEMORY_ATTRIBUTE_PROTOCOL
-+  gArmTokenSpaceGuid.PcdEnableEfiMemoryAttributeProtocol|TRUE|BOOLEAN|0x000000EE
-+
-   #
-   # ARM Secure Firmware PCDs
-   #
-diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.c b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
-index d04958e79e..ff7d735b2b 100644
---- a/ArmPkg/Drivers/CpuDxe/CpuDxe.c
-+++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
-@@ -244,10 +244,19 @@ CpuDxeInitialize (
-                   &mCpuHandle,
-                   &gEfiCpuArchProtocolGuid,
-                   &mCpu,
--                  &gEfiMemoryAttributeProtocolGuid,
--                  &mMemoryAttribute,
-                   NULL
-                   );
-+  ASSERT_EFI_ERROR (Status);
-+
-+  if (PcdGetBool (PcdEnableEfiMemoryAttributeProtocol)) {
-+    Status = gBS->InstallMultipleProtocolInterfaces (
-+                    &mCpuHandle,
-+                    &gEfiMemoryAttributeProtocolGuid,
-+                    &mMemoryAttribute,
-+                    NULL
-+                    );
-+    ASSERT_EFI_ERROR (Status);
-+  }
- 
-   //
-   // Make sure GCD and MMU settings match. This API calls gDS->SetMemorySpaceAttributes ()
-diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.inf b/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
-index e732e21cb9..1bad4ae160 100644
---- a/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
-+++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
-@@ -64,6 +64,7 @@
- 
- [Pcd.common]
-   gArmTokenSpaceGuid.PcdVFPEnabled
-+  gArmTokenSpaceGuid.PcdEnableEfiMemoryAttributeProtocol
- 
- [FeaturePcd.common]
-   gArmTokenSpaceGuid.PcdDebuggerExceptionSupport
--- 
-2.39.3
-

0028-distro-apply-git-diff-c9s-new_c9s-by-mirek.patch

@@ -0,0 +1,27 @@
+From c0347206c55c9d4d69b46725e9edbb21448f7494 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 28 Nov 2023 12:11:55 +0100
+Subject: [PATCH] distro: apply 'git diff c9s new_c9s' by mirek
+
+Bring .distro toi latest standards for more automatic support.
+---
+ CryptoPkg/.gitignore | 1 -
+ sources              | 1 -
+ 2 files changed, 2 deletions(-)
+ delete mode 100644 CryptoPkg/.gitignore
+ delete mode 100644 sources
+
+diff --git a/CryptoPkg/.gitignore b/CryptoPkg/.gitignore
+deleted file mode 100644
+index 68b83272b7..0000000000
+--- a/CryptoPkg/.gitignore
++++ /dev/null
+@@ -1 +0,0 @@
+-Library/OpensslLib/openssl*/
+diff --git a/sources b/sources
+deleted file mode 100644
+index ea8c8ad50b..0000000000
+--- a/sources
++++ /dev/null
+@@ -1 +0,0 @@
+-SHA512 (edk2-ba91d0292e.tar.xz) = 3b21cc39671d28bfeb059da3683751cc5277c63a894b2a05bdfbd2bbe53545c34f04c229becf44f1563f89a738f37ae8f2333076d126a7e94d234bc4bb25454c

0029-CryptoPkg-CrtLib-add-stat.h-include-file.patch

@@ -0,0 +1,28 @@
+From 192cc2b49dbccc59f5731e2abc120bed3e06cc32 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 28 Aug 2023 13:11:02 +0200
+Subject: [PATCH] CryptoPkg/CrtLib: add stat.h include file.
+
+Needed by rhel downstream openssl patches.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ CryptoPkg/Library/Include/sys/stat.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+ create mode 100644 CryptoPkg/Library/Include/sys/stat.h
+
+diff --git a/CryptoPkg/Library/Include/sys/stat.h b/CryptoPkg/Library/Include/sys/stat.h
+new file mode 100644
+index 0000000000..22247bb2db
+--- /dev/null
++++ b/CryptoPkg/Library/Include/sys/stat.h
+@@ -0,0 +1,9 @@
++/** @file
++  Include file to support building the third-party cryptographic library.
++
++Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.<BR>
++SPDX-License-Identifier: BSD-2-Clause-Patent
++
++**/
++
++#include <CrtLibSupport.h>

0029-OvmfPkg-PciHotPlugInitDxe-Do-not-reserve-IO-ports-by.patch

@@ -1,46 +0,0 @@
-From 8f924bd2691789f6b0d9deae9ddb046677a0610b Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Tue, 16 May 2023 11:47:58 +0200
-Subject: OvmfPkg/PciHotPlugInitDxe: Do not reserve IO ports by default.
-
-Flip the default for IO address space reservations for PCI(e) bridges
-and root ports with hotplug support from TRUE to FALSE.
-
-PCI(e) bridges will still get IO address space assigned in case:
-
-  (a) Downstream devices actually need IO address space, or
-  (b) Explicit configuration, using "qemu -device
-      pcie-root-port,io-reserve=<size>".
-
-In case IO address space is exhausted edk2 will stop assigning resources
-to PCI(e) bridges.  This is not limited to IO resources, the affected
-bridges will not get any memory resources assigned either.
-
-This patch solves this issue by not handing out the scarce IO address
-space, which is not needed in most cases anyway.  Result is a more
-consistent PCI configuration in virtual machine configurations with many
-PCie root ports.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit 27727338b2c0e3f50eb0176a1044e903fcb3c3b1)
----
- OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c b/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
-index 6b2b6797b3..69903a6009 100644
---- a/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
-+++ b/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
-@@ -589,7 +589,7 @@ GetResourcePadding (
-     return EFI_INVALID_PARAMETER;
-   }
- 
--  DefaultIo       = TRUE;
-+  DefaultIo       = FALSE;
-   DefaultMmio     = TRUE;
-   DefaultPrefMmio = TRUE;
- 
--- 
-2.39.3
-

0030-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch

@@ -0,0 +1,139 @@
+From 09ccd0ffae512d7f0a7548cdfbc60e1482153796 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 28 Aug 2023 13:27:09 +0200
+Subject: [PATCH] CryptoPkg/CrtLib: add access/open/read/write/close syscalls
+
+Needed by rhel downstream openssl patches, they use unix syscalls
+for file access (instead of fopen + friends like the rest of the
+code base).  No actual file access is needed for edk2, so just
+add stubs to make linking work.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ .../Library/BaseCryptLib/SysCall/CrtWrapper.c | 46 +++++++++++++++++++
+ CryptoPkg/Library/Include/CrtLibSupport.h     | 41 +++++++++++++++++
+ 2 files changed, 87 insertions(+)
+
+diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
+index 37cdecc9bd..dfdb635536 100644
+--- a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
++++ b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
+@@ -550,6 +550,52 @@ fread (
+   return 0;
+ }
+ 
++int
++access(
++  const char*,
++  int
++  )
++{
++  return -1;
++}
++
++int
++open (
++  const char *,
++  int
++  )
++{
++  return -1;
++}
++
++ssize_t
++read (
++  int,
++  void*,
++  size_t
++  )
++{
++  return -1;
++}
++
++ssize_t
++write (
++  int,
++  const void*,
++  size_t
++  )
++{
++  return -1;
++}
++
++int
++close (
++  int
++  )
++{
++  return -1;
++}
++
+ uid_t
+ getuid (
+   void
+diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h b/CryptoPkg/Library/Include/CrtLibSupport.h
+index f36fe08f0c..7d98496af8 100644
+--- a/CryptoPkg/Library/Include/CrtLibSupport.h
++++ b/CryptoPkg/Library/Include/CrtLibSupport.h
+@@ -78,6 +78,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ //
+ // Definitions for global constants used by CRT library routines
+ //
++#define EINTR         4
+ #define EINVAL        22              /* Invalid argument */
+ #define EAFNOSUPPORT  47              /* Address family not supported by protocol family */
+ #define INT_MAX       0x7FFFFFFF      /* Maximum (signed) int value */
+@@ -102,6 +103,15 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ #define NS_INADDRSZ   4   /*%< IPv4 T_A */
+ #define NS_IN6ADDRSZ  16  /*%< IPv6 T_AAAA */
+ 
++#define O_RDONLY        00000000
++#define O_WRONLY        00000001
++#define O_RDWR          00000002
++
++#define R_OK  4
++#define W_OK  2
++#define X_OK  1
++#define F_OK  0
++
+ //
+ // Basic types mapping
+ //
+@@ -324,6 +334,37 @@ fprintf     (
+   ...
+   );
+ 
++int
++access(
++  const char*,
++  int
++  );
++
++int
++open (
++  const char *,
++  int
++  );
++
++ssize_t
++read (
++  int,
++  void*,
++  size_t
++  );
++
++ssize_t
++write (
++  int,
++  const void*,
++  size_t
++  );
++
++int
++close (
++  int
++  );
++
+ time_t
+ time        (
+   time_t *

0031-ArmVirtQemu-Allow-EFI-memory-attributes-protocol-to-.patch

@@ -0,0 +1,169 @@
+From 0120fb7b5877ab40537fd17e64772f53bc89cd07 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 4 Dec 2023 10:41:08 +0100
+Subject: [PATCH] ArmVirtQemu: Allow EFI memory attributes protocol to be
+ disabled
+
+Shim's PE loader uses the EFI memory attributes protocol in a way that
+results in an immediate crash when invoking the loaded image, unless the
+base and size of its executable segment are both aligned to 4k.
+
+If this is not the case, it will strip the memory allocation of its
+executable permissions, but fail to add them back for the executable
+region, resulting in non-executable code. Unfortunately, the PE loader
+does not even bother invoking the protocol in this case (as it notices
+the misalignment), making it very hard for system firmware to work
+around this by attempting to infer the intent of the caller.
+
+So let's introduce a QEMU command line option to indicate that the
+protocol should not be exposed at all, and a PCD to set the default for
+this option when it is omitted.
+
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Tested-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
+Link: https://gitlab.com/qemu-project/qemu/-/issues/1990
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit cee7ba349c0c1ce489001a338a4e28555728b573)
+---
+ ArmVirtPkg/ArmVirtPkg.dec                     |  6 ++
+ .../PlatformBootManagerLib/PlatformBm.c       | 64 +++++++++++++++++++
+ .../PlatformBootManagerLib.inf                |  3 +
+ 3 files changed, 73 insertions(+)
+
+diff --git a/ArmVirtPkg/ArmVirtPkg.dec b/ArmVirtPkg/ArmVirtPkg.dec
+index 0f2d787327..313aebda90 100644
+--- a/ArmVirtPkg/ArmVirtPkg.dec
++++ b/ArmVirtPkg/ArmVirtPkg.dec
+@@ -68,3 +68,9 @@
+   # Cloud Hypervisor has no other way to pass Rsdp address to the guest except use a PCD.
+   #
+   gArmVirtTokenSpaceGuid.PcdCloudHvAcpiRsdpBaseAddress|0x0|UINT64|0x00000005
++
++  ##
++  # Whether the EFI memory attributes protocol should be uninstalled before
++  # invoking the OS loader. This may be needed to work around problematic
++  # builds of shim that use the protocol incorrectly.
++  gArmVirtTokenSpaceGuid.PcdUninstallMemAttrProtocol|FALSE|BOOLEAN|0x00000006
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+index 85c01351b0..8e93f3cfed 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
++++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+@@ -16,6 +16,7 @@
+ #include <Library/PcdLib.h>
+ #include <Library/PlatformBmPrintScLib.h>
+ #include <Library/QemuBootOrderLib.h>
++#include <Library/QemuFwCfgSimpleParserLib.h>
+ #include <Library/TpmPlatformHierarchyLib.h>
+ #include <Library/UefiBootManagerLib.h>
+ #include <Protocol/DevicePath.h>
+@@ -1111,6 +1112,49 @@ PlatformBootManagerBeforeConsole (
+   FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciSerial, SetupVirtioSerial);
+ }
+ 
++/**
++  Uninstall the EFI memory attribute protocol if it exists.
++**/
++STATIC
++VOID
++UninstallEfiMemoryAttributesProtocol (
++  VOID
++  )
++{
++  EFI_STATUS  Status;
++  EFI_HANDLE  Handle;
++  UINTN       Size;
++  VOID        *MemoryAttributeProtocol;
++
++  Size   = sizeof (Handle);
++  Status = gBS->LocateHandle (
++                  ByProtocol,
++                  &gEfiMemoryAttributeProtocolGuid,
++                  NULL,
++                  &Size,
++                  &Handle
++                  );
++
++  if (EFI_ERROR (Status)) {
++    ASSERT (Status == EFI_NOT_FOUND);
++    return;
++  }
++
++  Status = gBS->HandleProtocol (
++                  Handle,
++                  &gEfiMemoryAttributeProtocolGuid,
++                  &MemoryAttributeProtocol
++                  );
++  ASSERT_EFI_ERROR (Status);
++
++  Status = gBS->UninstallProtocolInterface (
++                  Handle,
++                  &gEfiMemoryAttributeProtocolGuid,
++                  MemoryAttributeProtocol
++                  );
++  ASSERT_EFI_ERROR (Status);
++}
++
+ /**
+   Do the platform specific action after the console is ready
+   Possible things that can be done in PlatformBootManagerAfterConsole:
+@@ -1129,12 +1173,32 @@ PlatformBootManagerAfterConsole (
+   )
+ {
+   RETURN_STATUS  Status;
++  BOOLEAN        Uninstall;
+ 
+   //
+   // Show the splash screen.
+   //
+   BootLogoEnableLogo ();
+ 
++  //
++  // Work around shim's terminally broken use of the EFI memory attributes
++  // protocol, by uninstalling it if requested on the QEMU command line.
++  //
++  // E.g.,
++  //       -fw_cfg opt/org.tianocore/UninstallMemAttrProtocol,string=y
++  //
++  Uninstall = FixedPcdGetBool (PcdUninstallMemAttrProtocol);
++  QemuFwCfgParseBool ("opt/org.tianocore/UninstallMemAttrProtocol", &Uninstall);
++  DEBUG ((
++    DEBUG_WARN,
++    "%a: %auninstalling EFI memory protocol\n",
++    __func__,
++    Uninstall ? "" : "not "
++    ));
++  if (Uninstall) {
++    UninstallEfiMemoryAttributesProtocol ();
++  }
++
+   //
+   // Process QEMU's -kernel command line option. The kernel booted this way
+   // will receive ACPI tables: in PlatformBootManagerBeforeConsole(), we
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+index 997eb1a442..70e4ebf94a 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
++++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+@@ -46,6 +46,7 @@
+   PcdLib
+   PlatformBmPrintScLib
+   QemuBootOrderLib
++  QemuFwCfgSimpleParserLib
+   QemuLoadImageLib
+   ReportStatusCodeLib
+   TpmPlatformHierarchyLib
+@@ -55,6 +56,7 @@
+   UefiRuntimeServicesTableLib
+ 
+ [FixedPcd]
++  gArmVirtTokenSpaceGuid.PcdUninstallMemAttrProtocol
+   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultBaudRate
+   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultDataBits
+   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultParity
+@@ -73,5 +75,6 @@
+ [Protocols]
+   gEfiFirmwareVolume2ProtocolGuid
+   gEfiGraphicsOutputProtocolGuid
++  gEfiMemoryAttributeProtocolGuid
+   gEfiPciRootBridgeIoProtocolGuid
+   gVirtioDeviceProtocolGuid

60-edk2-ovmf-x64-inteltdx.json

@@ -4,12 +4,8 @@
         "uefi"
     ],
     "mapping": {
-        "device": "flash",
+        "device": "memory",
-        "mode": "stateless",
+        "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd"
-        "executable": {
-            "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.fd",
-            "format": "raw"
-        }
     },
     "targets": [
         {
@@ -20,7 +16,9 @@
         }
     ],
     "features": [
+        "enrolled-keys",
         "intel-tdx",
+        "secure-boot",
         "verbose-dynamic"
     ],
     "tags": [

README.rst

@@ -0,0 +1,18 @@
+===================
+EDK2 development
+===================
+
+EDK2 is maintained in a `source tree`_ rather than directly in dist-git
+using packit service that provides way to develope using regular source code
+structure and provides way to generate SRPM and build using koji service.
+
+Developers deliver all changes to source-git using merge request. Only maintainers
+will be pushing changes sent to source-git to dist-git.
+
+Each release in dist-git is tagged in the source repository so you can easily
+check out the source tree for a build. The tags are in the format
+name-version-release, but note release doesn't contain the dist tag since the
+source can be built in different build roots (Fedora, CentOS, etc.)
+
+.. _source tree: https://gitlab.com/redhat/centos-stream/src/edk2
+

edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtio.patch

@@ -1,74 +0,0 @@
-From 9572a0fe959277c5b57df05a32503ff83a7e93af Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 1 Jun 2023 13:57:11 +0200
-Subject: [PATCH 02/12] ArmVirt/PlatformBootManagerLib: factor out IsVirtio()
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-RH-Jira: RHEL-643
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [2/6] 553a155707eb1c878133c1d13f6422c2b70fb78d (kraxel/centos-edk2)
-
-IsVirtioRng() becomes just a thin wrapper for IsVirtio().
-This allows to add similar thin wrappers for other virtio
-devices in the future.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit a196b04926e70880334fcd649837d0ac63b0bfd5)
----
- .../PlatformBootManagerLib/PlatformBm.c       | 26 +++++++++++++++----
- 1 file changed, 21 insertions(+), 5 deletions(-)
-
-diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-index 10c815378c..5eb6f0f9c1 100644
---- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-@@ -269,15 +269,16 @@ IsPciDisplay (
- }
- 
- /**
--  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
--  the VIRTIO_DEVICE_PROTOCOL level.
-+  This function checks if a handle corresponds to the Virtio Device ID given
-+  at the VIRTIO_DEVICE_PROTOCOL level.
- **/
- STATIC
- BOOLEAN
- EFIAPI
--IsVirtioRng (
-+IsVirtio (
-   IN EFI_HANDLE    Handle,
--  IN CONST CHAR16  *ReportText
-+  IN CONST CHAR16  *ReportText,
-+  IN UINT16        VirtIoDeviceId
-   )
- {
-   EFI_STATUS              Status;
-@@ -293,7 +294,22 @@ IsVirtioRng (
-   }
- 
-   return (BOOLEAN)(VirtIo->SubSystemDeviceId ==
--                   VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
-+                   VirtIoDeviceId);
-+}
-+
-+/**
-+  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
-+  the VIRTIO_DEVICE_PROTOCOL level.
-+**/
-+STATIC
-+BOOLEAN
-+EFIAPI
-+IsVirtioRng (
-+  IN EFI_HANDLE    Handle,
-+  IN CONST CHAR16  *ReportText
-+  )
-+{
-+  return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
- }
- 
- /**
--- 
-2.39.3
-

edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtioPc.patch

@@ -1,96 +0,0 @@
-From 8545529f2b6d967946f111d79455ec8896d53311 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 1 Jun 2023 13:57:12 +0200
-Subject: [PATCH 03/12] ArmVirt/PlatformBootManagerLib: factor out
- IsVirtioPci()
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-RH-Jira: RHEL-643
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [3/6] d0000df1169e1f7b8ce3ad4942460cdc661a0ed9 (kraxel/centos-edk2)
-
-IsVirtioPciRng() becomes just a thin wrapper for IsVirtioPci().
-This allows to add similar thin wrappers for other virtio
-devices in the future.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit aaf546879ab71722c36738ccc6f0f0ab4ecf5076)
----
- .../PlatformBootManagerLib/PlatformBm.c       | 30 ++++++++++++++-----
- 1 file changed, 23 insertions(+), 7 deletions(-)
-
-diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-index 5eb6f0f9c1..ed38c42a43 100644
---- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-@@ -313,15 +313,16 @@ IsVirtioRng (
- }
- 
- /**
--  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
--  the EFI_PCI_IO_PROTOCOL level.
-+  This function checks if a handle corresponds to the Virtio Device ID given
-+  at the EFI_PCI_IO_PROTOCOL level.
- **/
- STATIC
- BOOLEAN
- EFIAPI
--IsVirtioPciRng (
-+IsVirtioPci (
-   IN EFI_HANDLE    Handle,
--  IN CONST CHAR16  *ReportText
-+  IN CONST CHAR16  *ReportText,
-+  IN UINT16        VirtIoDeviceId
-   )
- {
-   EFI_STATUS           Status;
-@@ -387,11 +388,11 @@ IsVirtioPciRng (
-   //
-   // From DeviceId and RevisionId, determine whether the device is a
-   // modern-only Virtio 1.0 device. In case of Virtio 1.0, DeviceId can
--  // immediately be restricted to VIRTIO_SUBSYSTEM_ENTROPY_SOURCE, and
-+  // immediately be restricted to VirtIoDeviceId, and
-   // SubsystemId will only play a sanity-check role. Otherwise, DeviceId can
-   // only be sanity-checked, and SubsystemId will decide.
-   //
--  if ((DeviceId == 0x1040 + VIRTIO_SUBSYSTEM_ENTROPY_SOURCE) &&
-+  if ((DeviceId == 0x1040 + VirtIoDeviceId) &&
-       (RevisionId >= 0x01))
-   {
-     Virtio10 = TRUE;
-@@ -419,7 +420,7 @@ IsVirtioPciRng (
-     return TRUE;
-   }
- 
--  if (!Virtio10 && (SubsystemId == VIRTIO_SUBSYSTEM_ENTROPY_SOURCE)) {
-+  if (!Virtio10 && (SubsystemId == VirtIoDeviceId)) {
-     return TRUE;
-   }
- 
-@@ -430,6 +431,21 @@ PciError:
-   return FALSE;
- }
- 
-+/**
-+  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
-+  the EFI_PCI_IO_PROTOCOL level.
-+**/
-+STATIC
-+BOOLEAN
-+EFIAPI
-+IsVirtioPciRng (
-+  IN EFI_HANDLE    Handle,
-+  IN CONST CHAR16  *ReportText
-+  )
-+{
-+  return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
-+}
-+
- /**
-   This CALLBACK_FUNCTION attempts to connect a handle non-recursively, asking
-   the matching driver to produce all first-level child handles.
--- 
-2.39.3
-

edk2-ArmVirt-PlatformBootManagerLib-set-up-virtio-serial-.patch

@@ -1,228 +0,0 @@
-From ad95ab2b76485458fed60ab20631b62a010c0e4d Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 1 Jun 2023 13:57:13 +0200
-Subject: [PATCH 04/12] ArmVirt/PlatformBootManagerLib: set up virtio serial as
- console
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-RH-Jira: RHEL-643
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [4/6] 46540eeb8901cfeef83cffcdcb6e1c23995b391a (kraxel/centos-edk2)
-
-In case a virtio serial device is found in the system register the first
-console port as EFI console, by updating ConIn, ConOut and ErrOut.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit 15f83fa36442eaa272300b31699b3b82ce7e07a9)
----
- .../PlatformBootManagerLib/PlatformBm.c       | 172 ++++++++++++++++++
- 1 file changed, 172 insertions(+)
-
-diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-index ed38c42a43..b92a916f7e 100644
---- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-@@ -312,6 +312,21 @@ IsVirtioRng (
-   return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
- }
- 
-+/**
-+  This FILTER_FUNCTION checks if a handle corresponds to a Virtio serial device at
-+  the VIRTIO_DEVICE_PROTOCOL level.
-+**/
-+STATIC
-+BOOLEAN
-+EFIAPI
-+IsVirtioSerial (
-+  IN EFI_HANDLE    Handle,
-+  IN CONST CHAR16  *ReportText
-+  )
-+{
-+  return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_CONSOLE);
-+}
-+
- /**
-   This function checks if a handle corresponds to the Virtio Device ID given
-   at the EFI_PCI_IO_PROTOCOL level.
-@@ -446,6 +461,21 @@ IsVirtioPciRng (
-   return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
- }
- 
-+/**
-+  This FILTER_FUNCTION checks if a handle corresponds to a Virtio serial device at
-+  the EFI_PCI_IO_PROTOCOL level.
-+**/
-+STATIC
-+BOOLEAN
-+EFIAPI
-+IsVirtioPciSerial (
-+  IN EFI_HANDLE    Handle,
-+  IN CONST CHAR16  *ReportText
-+  )
-+{
-+  return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_CONSOLE);
-+}
-+
- /**
-   This CALLBACK_FUNCTION attempts to connect a handle non-recursively, asking
-   the matching driver to produce all first-level child handles.
-@@ -534,6 +564,142 @@ AddOutput (
-     ));
- }
- 
-+/**
-+  This CALLBACK_FUNCTION retrieves the EFI_DEVICE_PATH_PROTOCOL from
-+  the handle, appends serial, uart and terminal nodes, finally updates
-+  ConIn, ConOut and ErrOut.
-+**/
-+STATIC
-+VOID
-+EFIAPI
-+SetupVirtioSerial (
-+  IN EFI_HANDLE    Handle,
-+  IN CONST CHAR16  *ReportText
-+  )
-+{
-+  STATIC CONST ACPI_HID_DEVICE_PATH  SerialNode = {
-+    {
-+      ACPI_DEVICE_PATH,
-+      ACPI_DP,
-+      {
-+        (UINT8)(sizeof (ACPI_HID_DEVICE_PATH)),
-+        (UINT8)((sizeof (ACPI_HID_DEVICE_PATH)) >> 8)
-+      },
-+    },
-+    EISA_PNP_ID (0x0501),
-+    0
-+  };
-+
-+  STATIC CONST UART_DEVICE_PATH  UartNode = {
-+    {
-+      MESSAGING_DEVICE_PATH,
-+      MSG_UART_DP,
-+      {
-+        (UINT8)(sizeof (UART_DEVICE_PATH)),
-+        (UINT8)((sizeof (UART_DEVICE_PATH)) >> 8)
-+      },
-+    },
-+    0,
-+    115200,
-+    8,
-+    1,
-+    1
-+  };
-+
-+  STATIC CONST VENDOR_DEVICE_PATH  TerminalNode = {
-+    {
-+      MESSAGING_DEVICE_PATH,
-+      MSG_VENDOR_DP,
-+      {
-+        (UINT8)(sizeof (VENDOR_DEVICE_PATH)),
-+        (UINT8)((sizeof (VENDOR_DEVICE_PATH)) >> 8)
-+      },
-+    },
-+    DEVICE_PATH_MESSAGING_VT_UTF8
-+  };
-+
-+  EFI_STATUS                Status;
-+  EFI_DEVICE_PATH_PROTOCOL  *DevicePath, *OldDevicePath;
-+
-+  DevicePath = DevicePathFromHandle (Handle);
-+
-+  if (DevicePath == NULL) {
-+    DEBUG ((
-+      DEBUG_ERROR,
-+      "%a: %s: handle %p: device path not found\n",
-+      __func__,
-+      ReportText,
-+      Handle
-+      ));
-+    return;
-+  }
-+
-+  DevicePath = AppendDevicePathNode (
-+                 DevicePath,
-+                 &SerialNode.Header
-+                 );
-+
-+  OldDevicePath = DevicePath;
-+  DevicePath    = AppendDevicePathNode (
-+                    DevicePath,
-+                    &UartNode.Header
-+                    );
-+  FreePool (OldDevicePath);
-+
-+  OldDevicePath = DevicePath;
-+  DevicePath    = AppendDevicePathNode (
-+                    DevicePath,
-+                    &TerminalNode.Header
-+                    );
-+  FreePool (OldDevicePath);
-+
-+  Status = EfiBootManagerUpdateConsoleVariable (ConIn, DevicePath, NULL);
-+  if (EFI_ERROR (Status)) {
-+    DEBUG ((
-+      DEBUG_ERROR,
-+      "%a: %s: adding to ConIn: %r\n",
-+      __func__,
-+      ReportText,
-+      Status
-+      ));
-+    return;
-+  }
-+
-+  Status = EfiBootManagerUpdateConsoleVariable (ConOut, DevicePath, NULL);
-+  if (EFI_ERROR (Status)) {
-+    DEBUG ((
-+      DEBUG_ERROR,
-+
-+      "%a: %s: adding to ConOut: %r\n",
-+      __func__,
-+      ReportText,
-+      Status
-+      ));
-+    return;
-+  }
-+
-+  Status = EfiBootManagerUpdateConsoleVariable (ErrOut, DevicePath, NULL);
-+  if (EFI_ERROR (Status)) {
-+    DEBUG ((
-+      DEBUG_ERROR,
-+      "%a: %s: adding to ErrOut: %r\n",
-+      __func__,
-+      ReportText,
-+      Status
-+      ));
-+    return;
-+  }
-+
-+  FreePool (DevicePath);
-+
-+  DEBUG ((
-+    DEBUG_VERBOSE,
-+    "%a: %s: added to ConIn, ConOut and ErrOut\n",
-+    __func__,
-+    ReportText
-+    ));
-+}
-+
- STATIC
- VOID
- PlatformRegisterFvBootOption (
-@@ -932,6 +1098,12 @@ PlatformBootManagerBeforeConsole (
-   // instances on Virtio PCI RNG devices.
-   //
-   FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciRng, Connect);
-+
-+  //
-+  // Register Virtio serial devices as console.
-+  //
-+  FilterAndProcess (&gVirtioDeviceProtocolGuid, IsVirtioSerial, SetupVirtioSerial);
-+  FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciSerial, SetupVirtioSerial);
- }
- 
- /**
--- 
-2.39.3
-

edk2-ArmVirt-add-VirtioSerialDxe-to-ArmVirtQemu-builds.patch

@@ -1,59 +0,0 @@
-From 262a607fbc608c02fc3c2a87244d033932d564bb Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 1 Jun 2023 13:57:10 +0200
-Subject: [PATCH 01/12] ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-RH-Jira: RHEL-643
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [1/6] 03b627e1fae7851fa51e6fe67253ff1b64948d0e (kraxel/centos-edk2)
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Acked-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit 6925150febb3a76d8e40c19babcc578555ca78fe)
----
- ArmVirtPkg/ArmVirtQemu.dsc           | 1 +
- ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 +
- ArmVirtPkg/ArmVirtQemuKernel.dsc     | 1 +
- 3 files changed, 3 insertions(+)
-
-diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index b1deefc2fd..5df6a89578 100644
---- a/ArmVirtPkg/ArmVirtQemu.dsc
-+++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -453,6 +453,7 @@
-   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
-   OvmfPkg/VirtioNetDxe/VirtioNet.inf
-   OvmfPkg/VirtioRngDxe/VirtioRng.inf
-+  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
- 
-   #
-   # FAT filesystem + GPT/MBR partitioning + UDF filesystem + virtio-fs
-diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 4dbb77a6ca..00ec4dd186 100644
---- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-+++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-@@ -96,6 +96,7 @@ READ_LOCK_STATUS   = TRUE
-   INF OvmfPkg/VirtioNetDxe/VirtioNet.inf
-   INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
-   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
-+  INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
- 
-   INF ShellPkg/Application/Shell/Shell.inf
- 
-diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index afebc46a04..76b7c128bb 100644
---- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
-+++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -353,6 +353,7 @@
-   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
-   OvmfPkg/VirtioNetDxe/VirtioNet.inf
-   OvmfPkg/VirtioRngDxe/VirtioRng.inf
-+  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
- 
-   #
-   # FAT filesystem + GPT/MBR partitioning + UDF filesystem + virtio-fs
--- 
-2.39.3
-

edk2-OvmfPkg-AmdSev-fix-BdsPlatform.c-assertion-failure-d.patch

@@ -1,88 +0,0 @@
-From 673ed284a598bf94d39f01f118158e55e5c04645 Mon Sep 17 00:00:00 2001
-From: Michael Roth <michael.roth@amd.com>
-Date: Wed, 16 Aug 2023 15:11:45 -0500
-Subject: [PATCH 1/3] OvmfPkg/AmdSev: fix BdsPlatform.c assertion failure
- during boot
-
-RH-Author: Gerd Hoffmann <None>
-RH-MergeRequest: 44: OvmfPkg/AmdSev: fix BdsPlatform.c assertion failure during boot
-RH-Bugzilla: 2190244
-RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
-RH-Commit: [1/1] 44f18b2324cbd4aa1840613d9a8d19f0fbec7b1b (kraxel.rh/centos-src-edk2)
-
-Booting an SEV guest with AmdSev OVMF package currently triggers the
-following assertion with QEMU:
-
-  InstallQemuFwCfgTables: installed 7 tables
-  PcRtc: Write 0x20 to CMOS location 0x32
-  [Variable]END_OF_DXE is signaled
-  Initialize variable error flag (FF)
-
-  ASSERT_EFI_ERROR (Status = Not Found)
-  ASSERT [BdsDxe] /home/VT_BUILD/ovmf/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c(1711): !(((INTN)(RETURN_STATUS)(Status)) < 0)
-
-This seems to be due to commit 81dc0d8b4c, which switched to using
-PlatformBootManagerLib instead of PlatformBootManagerLibGrub. That
-pulls in a dependency on gEfiS3SaveStateProtocolGuid provider being
-available (which is asserted for in
-BdsPlatform.c:PlatformBootManagerBeforeConsole()/SaveS3BootScript()),
-but the libraries that provide it aren't currently included in the
-build. Add them similarly to what's done for OvmfPkg.
-
-Fixes: 81dc0d8b4c ("OvmfPkg/AmdSev: stop using PlatformBootManagerLibGrub")
-Cc: Gerd Hoffmann <kraxel@redhat.com>
-Cc: Ray Ni <ray.ni@intel.com>
-Cc: Erdem Aktas <erdemaktas@google.com>
-Cc: James Bottomley <jejb@linux.ibm.com>
-Cc: Jiewen Yao <jiewen.yao@intel.com>
-Cc: Min Xu <min.m.xu@intel.com>
-Cc: Tom Lendacky <thomas.lendacky@amd.com>
-Signed-off-by: Michael Roth <michael.roth@amd.com>
-Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-ID: <20230816201146.1634348-2-michael.roth@amd.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-
-List-Archive: https://edk2.groups.io/g/devel/message/107806
----
- OvmfPkg/AmdSev/AmdSevX64.dsc | 3 +++
- OvmfPkg/AmdSev/AmdSevX64.fdf | 2 ++
- 2 files changed, 5 insertions(+)
-
-diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 427df673f3..8d165ed05a 100644
---- a/OvmfPkg/AmdSev/AmdSevX64.dsc
-+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -199,6 +199,7 @@
- 
-   SmbusLib|MdePkg/Library/BaseSmbusLibNull/BaseSmbusLibNull.inf
-   OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib/BaseOrderedCollectionRedBlackTreeLib.inf
-+  S3BootScriptLib|MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.inf
- 
- !include OvmfPkg/Include/Dsc/OvmfTpmLibs.dsc.inc
- 
-@@ -715,6 +716,8 @@
-   #
-   MdeModulePkg/Universal/Acpi/AcpiTableDxe/AcpiTableDxe.inf
-   OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf
-+  MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf
-+  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
-   MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
- 
-   #
-diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index a48c93e2a5..3e6ee61823 100644
---- a/OvmfPkg/AmdSev/AmdSevX64.fdf
-+++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
-@@ -269,6 +269,8 @@ INF  OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.inf
- 
- INF  MdeModulePkg/Universal/Acpi/AcpiTableDxe/AcpiTableDxe.inf
- INF  OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf
-+INF  MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf
-+INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
- INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
- 
- INF  FatPkg/EnhancedFatDxe/Fat.inf
--- 
-2.39.3
-

edk2-OvmfPkg-IoMmuDxe-add-locking-to-IoMmuAllocateBounceB.patch

@@ -1,79 +0,0 @@
-From 7f3f6e3088655e33600aacd886aa51d19c01c59a Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Wed, 19 Jul 2023 18:31:29 +0200
-Subject: [PATCH 2/3] OvmfPkg/IoMmuDxe: add locking to
- IoMmuAllocateBounceBuffer
-
-RH-Author: Gerd Hoffmann <None>
-RH-MergeRequest: 45: OvmfPkg/IoMmuDxe: add locking to IoMmuAllocateBounceBuffer
-RH-Bugzilla: 2211060
-RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
-RH-Commit: [1/1] c4998c57651df23342a0cd6e8982bf59f306da83 (kraxel.rh/centos-src-edk2)
-
-Searching for an unused bounce buffer in mReservedMemBitmap and
-reserving the buffer by flipping the bit is a critical section
-which must not be interrupted.  Raise the TPL level to ensure
-that.
-
-Without this fix it can happen that IoMmuDxe hands out the same
-bounce buffer twice, causing trouble down the road.  Seen happening
-in practice with VirtioNetDxe setting up the network interface (and
-calling into IoMmuDxe from a polling timer callback) in parallel with
-Boot Manager doing some disk I/O.  An ASSERT() in VirtioNet caught
-the buffer inconsistency.
-
-Full story with lots of details and discussions is available here:
-https://bugzilla.redhat.com/show_bug.cgi?id=2211060
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit a52044a9e602bc168cdf5d73a48952bfc9edb521)
----
- OvmfPkg/IoMmuDxe/IoMmuBuffer.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/OvmfPkg/IoMmuDxe/IoMmuBuffer.c b/OvmfPkg/IoMmuDxe/IoMmuBuffer.c
-index c8f6cf4818..103003cae3 100644
---- a/OvmfPkg/IoMmuDxe/IoMmuBuffer.c
-+++ b/OvmfPkg/IoMmuDxe/IoMmuBuffer.c
-@@ -367,7 +367,9 @@ IoMmuAllocateBounceBuffer (
- {
-   EFI_STATUS  Status;
-   UINT32      ReservedMemBitmap;
-+  EFI_TPL     OldTpl;
- 
-+  OldTpl            = gBS->RaiseTPL (TPL_NOTIFY);
-   ReservedMemBitmap = 0;
-   Status            = InternalAllocateBuffer (
-                         Type,
-@@ -378,6 +380,7 @@ IoMmuAllocateBounceBuffer (
-                         );
-   MapInfo->ReservedMemBitmap = ReservedMemBitmap;
-   mReservedMemBitmap        |= ReservedMemBitmap;
-+  gBS->RestoreTPL (OldTpl);
- 
-   ASSERT (Status == EFI_SUCCESS);
- 
-@@ -395,6 +398,8 @@ IoMmuFreeBounceBuffer (
-   IN OUT     MAP_INFO  *MapInfo
-   )
- {
-+  EFI_TPL  OldTpl;
-+
-   if (MapInfo->ReservedMemBitmap == 0) {
-     gBS->FreePages (MapInfo->PlainTextAddress, MapInfo->NumberOfPages);
-   } else {
-@@ -407,9 +412,11 @@ IoMmuFreeBounceBuffer (
-       mReservedMemBitmap,
-       mReservedMemBitmap & ((UINT32)(~MapInfo->ReservedMemBitmap))
-       ));
-+    OldTpl                     = gBS->RaiseTPL (TPL_NOTIFY);
-     MapInfo->PlainTextAddress  = 0;
-     mReservedMemBitmap        &= (UINT32)(~MapInfo->ReservedMemBitmap);
-     MapInfo->ReservedMemBitmap = 0;
-+    gBS->RestoreTPL (OldTpl);
-   }
- 
-   return EFI_SUCCESS;
--- 
-2.39.3
-

edk2-OvmfPkg-MicrovmX64-enable-1G-pages.patch

@@ -1,37 +0,0 @@
-From db07792f9eb095a1f7570b23b1e9dad6edca17a5 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Wed, 17 May 2023 12:24:49 +0200
-Subject: [PATCH 12/12] OvmfPkg/MicrovmX64: enable 1G pages
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 40: enable use of gigabyte pages
-RH-Jira: RHEL-644
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [3/3] 369373082e4dd0be9a4f257e5be9c827cc7de3c5 (kraxel/centos-edk2)
-
-Reduces the memory footprint and speeds up booting.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Acked-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit 04c5b3023e49c35d291f41d2c39b4d12a62b8f9c)
----
- OvmfPkg/Microvm/MicrovmX64.dsc | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
-index 49d1d7ef5c..cc8e3abc45 100644
---- a/OvmfPkg/Microvm/MicrovmX64.dsc
-+++ b/OvmfPkg/Microvm/MicrovmX64.dsc
-@@ -544,6 +544,9 @@
-   gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesCode|0x100
-   gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesData|0x100
- 
-+  # use 1G pages
-+  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable|TRUE
-+
-   #
-   # Network Pcds
-   #
--- 
-2.39.3
-

edk2-OvmfPkg-OvmfPkgIa32X64-enable-1G-pages.patch

@@ -1,37 +0,0 @@
-From 943b4994942d550bef98685d13ffb26d4b5dd665 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Wed, 17 May 2023 12:24:48 +0200
-Subject: [PATCH 11/12] OvmfPkg/OvmfPkgIa32X64: enable 1G pages
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 40: enable use of gigabyte pages
-RH-Jira: RHEL-644
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [2/3] 7385647b30e5096b356a13085a8081de79c916f8 (kraxel/centos-edk2)
-
-Reduces the memory footprint and speeds up booting.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Acked-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit b63e17d746aa6bab2b1101711395725005e71a02)
----
- OvmfPkg/OvmfPkgIa32X64.dsc | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index a41bc32454..a6714cea91 100644
---- a/OvmfPkg/OvmfPkgIa32X64.dsc
-+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -557,6 +557,9 @@
-   # never lets the RAM below 4 GB exceed 2816 MB.
-   gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress|0xE0000000
- 
-+  # use 1G pages
-+  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable|TRUE
-+
- !if $(SOURCE_DEBUG_ENABLE) == TRUE
-   gEfiSourceLevelDebugPkgTokenSpaceGuid.PcdDebugLoadImageMethod|0x2
- !endif
--- 
-2.39.3
-

edk2-OvmfPkg-PlatformInitLib-check-PcdUse1GPageTable.patch

@@ -1,57 +0,0 @@
-From f24768ae482651073db9050fdaad49afe930b127 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Wed, 17 May 2023 12:24:47 +0200
-Subject: [PATCH 10/12] OvmfPkg/PlatformInitLib: check PcdUse1GPageTable
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 40: enable use of gigabyte pages
-RH-Jira: RHEL-644
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [1/3] 5d8b87d3b6a6b8af4d1a4aabedd8f69c512bf01c (kraxel/centos-edk2)
-
-If PcdUse1GPageTable is not enabled restrict the physical address space
-used to 1TB, to limit the amount of memory needed for identity mapping
-page tables.
-
-The same already happens in case the processor has no support for
-gigabyte pages.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Acked-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit d4d24001f78bcee965d8854fba6f08f48b4ec446)
----
- OvmfPkg/Library/PlatformInitLib/MemDetect.c         | 5 +++++
- OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf | 1 +
- 2 files changed, 6 insertions(+)
-
-diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-index 0482d8906d..662e7e85bb 100644
---- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-+++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-@@ -666,6 +666,11 @@ PlatformAddressWidthFromCpuid (
-       PhysBits = 40;
-     }
- 
-+    if (!FixedPcdGetBool (PcdUse1GPageTable) && (PhysBits > 40)) {
-+      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 40 (PcdUse1GPageTable is false)\n", __func__));
-+      PhysBits = 40;
-+    }
-+
-     PlatformInfoHob->PhysMemAddressWidth = PhysBits;
-     PlatformInfoHob->FirstNonAddress     = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth);
-   }
-diff --git a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
-index 86a82ad3e0..5a79d95b68 100644
---- a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
-+++ b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
-@@ -58,6 +58,7 @@
- 
- [Pcd]
-   gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress
-+  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
- 
- [FixedPcd]
-   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase
--- 
-2.39.3
-

edk2-OvmfPkg-PlatformInitLib-limit-phys-bits-to-46.patch

@@ -1,53 +0,0 @@
-From b1643b16a4a70ea576b5f90476fd9c59750eafe8 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 1 Jun 2023 09:57:31 +0200
-Subject: [PATCH 07/12] OvmfPkg/PlatformInitLib: limit phys-bits to 46.
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 41: enable dynamic mmio window
-RH-Bugzilla: 2174749
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [1/2] d08a95b72276cba504176b3837714db67122ed66 (kraxel/centos-edk2)
-
-Older linux kernels have problems with phys-bits larger than 46,
-ubuntu 18.04 (kernel 4.15) has been reported to be affected.
-
-Reduce phys-bits limit from 47 to 46.
-
-Reported-by: Fiona Ebner <f.ebner@proxmox.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit c1e853769046b322690ad336fdb98966757e7414)
----
- OvmfPkg/Library/PlatformInitLib/MemDetect.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-index 86700fc028..aab266399f 100644
---- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-+++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-@@ -646,16 +646,19 @@ PlatformAddressWidthFromCpuid (
-     ));
- 
-   if (Valid) {
--    if (PhysBits > 47) {
-+    if (PhysBits > 46) {
-       /*
-        * Avoid 5-level paging altogether for now, which limits
-        * PhysBits to 48.  Also avoid using address bit 48, due to sign
-        * extension we can't identity-map these addresses (and lots of
-        * places in edk2 assume we have everything identity-mapped).
-        * So the actual limit is 47.
-+       *
-+       * Also some older linux kernels apparently have problems handling
-+       * phys-bits > 46 correctly, so use that as limit.
-        */
--      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 47 (avoid 5-level paging)\n", __func__));
--      PhysBits = 47;
-+      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 46 (avoid 5-level paging)\n", __func__));
-+      PhysBits = 46;
-     }
- 
-     if (!Page1GSupport && (PhysBits > 40)) {
--- 
-2.39.3
-

edk2-OvmfPkg-ResetVector-Fix-assembler-bit-test-flag-chec.patch

@@ -1,42 +0,0 @@
-From bcc2e81950016f6cda6f3c125bfa7c88a5f8ca8e Mon Sep 17 00:00:00 2001
-From: Tom Lendacky <thomas.lendacky@amd.com>
-Date: Fri, 14 Jul 2023 15:28:26 -0500
-Subject: [PATCH] OvmfPkg/ResetVector: Fix assembler bit test flag check
-
-RH-Author: Gerd Hoffmann <None>
-RH-MergeRequest: 47: OvmfPkg/ResetVector: Fix assembler bit test flag check
-RH-Jira: RHEL-9943
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [1/1] 4565e2863391eb63d598991bc1b394cabd96a466 (kraxel.rh/centos-src-edk2)
-
-Commit 63c50d3ff2854a76432b752af4f2a76f33ff1974 changed the check that is
-used to determine if SEV-ES is active. Originally, a CMP instruction with
-a supporting JZ instruction was used for the check. It was changed to use
-the BT instruction but not JZ instruction. The result of a BT instruction
-changes the the carry flag (CF) and not the zero flag (ZF). As a result,
-the wrong condition is being checked. Update the JZ to a JNC to properly
-detect if SEV-ES is active.
-
-Fixes: 63c50d3ff285 ("OvmfPkg/ResetVector: cache the SEV status MSR...")
-Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
-(cherry picked from commit e674096accc8e57cd0dd84679905e1222423251e)
----
- OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm b/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm
-index c5c683ebed..429a58c5ef 100644
---- a/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm
-+++ b/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm
-@@ -44,7 +44,7 @@ Transition32FlatTo64Flat:
- 
-     mov     ecx, 1
-     bt      [SEV_ES_WORK_AREA_STATUS_MSR], ecx
--    jz      EnablePaging
-+    jnc     EnablePaging
- 
-     ;
-     ; SEV-ES is active, perform a quick sanity check against the reported
--- 
-2.39.3
-

edk2-OvmfPkg-VirtioSerialDxe-Remove-noisy-debug-print-on-.patch

@@ -1,42 +0,0 @@
-From 60a5604388fa73872d67e9ed46a29c7fd0e4fc32 Mon Sep 17 00:00:00 2001
-From: Ard Biesheuvel <ardb@kernel.org>
-Date: Tue, 27 Jun 2023 13:14:06 +0200
-Subject: [PATCH 06/12] OvmfPkg/VirtioSerialDxe: Remove noisy debug print on
- supported() call
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-RH-Jira: RHEL-643
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [6/6] 62b611c1d82f1b87cac2a07655ca37117d438989 (kraxel/centos-edk2)
-
-The UEFI driver model invokes the supported() method on every driver
-every time a connection attempt is made on any handle, and so doing an
-unconditional DEBUG() print inside this method produced a lot of noise.
-
-So let's drop this DEBUG() call from the VirtioSerial driver's
-Supported() method.
-
-Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit ea7a3015a2404e1358218463dd25df5ae7615352)
----
- OvmfPkg/VirtioSerialDxe/VirtioSerial.c | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/OvmfPkg/VirtioSerialDxe/VirtioSerial.c b/OvmfPkg/VirtioSerialDxe/VirtioSerial.c
-index bfb2b324ea..9e27a519f4 100644
---- a/OvmfPkg/VirtioSerialDxe/VirtioSerial.c
-+++ b/OvmfPkg/VirtioSerialDxe/VirtioSerial.c
-@@ -510,8 +510,6 @@ VirtioSerialDriverBindingSupported (
-     Status = EFI_UNSUPPORTED;
-   }
- 
--  DEBUG ((DEBUG_INFO, "%a:%d: subsystem %d -> %r\n", __func__, __LINE__, VirtIo->SubSystemDeviceId, Status));
--
-   //
-   // We needed VirtIo access only transitorily, to see whether we support the
-   // device or not.
--- 
-2.39.3
-

edk2-OvmfPkg-VirtioSerialDxe-use-TPL_NOTIFY.patch

@@ -1,45 +0,0 @@
-From 2ab130462062bfcd66d3047eaa6947a151296a21 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Fri, 12 May 2023 16:23:06 +0200
-Subject: [PATCH 05/12] OvmfPkg/VirtioSerialDxe: use TPL_NOTIFY
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-RH-Jira: RHEL-643
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [5/6] 08998538804a8d62903e44e716bcafd9674d208f (kraxel/centos-edk2)
-
-Apparently TPL_CALLBACK is too low, code runs into an ASSERT
-complaining the new TPL is lower than the old TPL.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit 4e5a804222415ec7b2bec90ea0300b8a9f60f131)
----
- OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c b/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
-index 522b25e969..e4a58deff1 100644
---- a/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
-+++ b/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
-@@ -158,7 +158,7 @@ VirtioSerialIoWrite (
- 
-   VirtioSerialRingClearTx (SerialIo->Dev, PortTx (SerialIo->PortId));
- 
--  OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
-+  OldTpl = gBS->RaiseTPL (TPL_NOTIFY);
-   if (SerialIo->WriteOffset &&
-       (SerialIo->WriteOffset + *BufferSize > PORT_TX_BUFSIZE))
-   {
-@@ -201,7 +201,7 @@ VirtioSerialIoRead (
-     goto NoData;
-   }
- 
--  OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
-+  OldTpl = gBS->RaiseTPL (TPL_NOTIFY);
-   if (SerialIo->WriteOffset) {
-     DEBUG ((DEBUG_VERBOSE, "%a:%d: WriteFlush %d\n", __func__, __LINE__, SerialIo->WriteOffset));
-     VirtioSerialRingSendBuffer (
--- 
-2.39.3
-

edk2-Revert-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch

@@ -1,34 +0,0 @@
-From e4fe4b80159b7df136f419da69251f45b62f36ec Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 29 Jun 2023 13:37:33 +0200
-Subject: [PATCH 08/12] Revert "OvmfPkg: disable dynamic mmio window (rhel
- only)"
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 41: enable dynamic mmio window
-RH-Bugzilla: 2174749
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [2/2] 10ace0e012602153f82fccee3c555be40b3c6753 (kraxel/centos-edk2)
-
-This reverts commit 218d3b32592bffe5ec7317c4838d29e92b4b86f0.
----
- OvmfPkg/Library/PlatformInitLib/MemDetect.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-index aab266399f..0482d8906d 100644
---- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-+++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-@@ -682,8 +682,7 @@ PlatformDynamicMmioWindow (
-   AddrSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth);
-   MmioSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth - 3);
- 
--  if (FALSE /* disable for RHEL-9.2, libvirt is not ready yet */ &&
--      (PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
-+  if ((PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
-       (PlatformInfoHob->PcdPciMmio64Base + MmioSpace < AddrSpace))
-   {
-     DEBUG ((DEBUG_INFO, "%a: using dynamic mmio window\n", __func__));
--- 
-2.39.3
-

edk2-build.py

@@ -6,6 +6,7 @@ https://gitlab.com/kraxel/edk2-build-config
 """
 import os
 import sys
+import time
 import shutil
 import argparse
 import subprocess
@@ -52,19 +53,31 @@ def get_toolchain(cfg, build):
         return cfg['global']['tool']
     return 'GCC5'
 
-def get_version(cfg):
+def get_hostarch():
+    mach = os.uname().machine
+    if mach == 'x86_64':
+        return 'X64'
+    if mach == 'aarch64':
+        return 'AARCH64'
+    if mach == 'riscv64':
+        return 'RISCV64'
+    return 'UNKNOWN'
+
+def get_version(cfg, silent = False):
     coredir = get_coredir(cfg)
     if version_override:
         version = version_override
-        print('')
+        if not silent:
-        print(f'### version [override]: {version}')
+            print('')
+            print(f'### version [override]: {version}')
         return version
     if os.environ.get('RPM_PACKAGE_NAME'):
         version = os.environ.get('RPM_PACKAGE_NAME')
         version += '-' + os.environ.get('RPM_PACKAGE_VERSION')
         version += '-' + os.environ.get('RPM_PACKAGE_RELEASE')
-        print('')
+        if not silent:
-        print(f'### version [rpmbuild]: {version}')
+            print('')
+            print(f'### version [rpmbuild]: {version}')
         return version
     if os.path.exists(coredir + '/.git'):
         cmdline = [ 'git', 'describe', '--tags', '--abbrev=8',
@@ -73,16 +86,17 @@ def get_version(cfg):
                                 stdout = subprocess.PIPE,
                                 check = True)
         version = result.stdout.decode().strip()
-        print('')
+        if not silent:
-        print(f'### version [git]: {version}')
+            print('')
+            print(f'### version [git]: {version}')
         return version
     return None
 
 def pcd_string(name, value):
     return f'{name}=L{value}\\0'
 
-def pcd_version(cfg):
+def pcd_version(cfg, silent = False):
-    version = get_version(cfg)
+    version = get_version(cfg, silent)
     if version is None:
         return []
     return [ '--pcd', pcd_string('PcdFirmwareVersionString', version) ]
@@ -92,41 +106,50 @@ def pcd_release_date():
         return []
     return [ '--pcd', pcd_string('PcdFirmwareReleaseDateString', release_date) ]
 
-def build_message(line, line2 = None):
+def build_message(line, line2 = None, silent = False):
     if os.environ.get('TERM') in [ 'xterm', 'xterm-256color' ]:
         # setxterm  title
         start  = '\x1b]2;'
         end    = '\x07'
         print(f'{start}{rebase_prefix}{line}{end}', end = '')
 
-    print('')
-    print('###')
-    print(f'### {rebase_prefix}{line}')
-    if line2:
-        print(f'### {line2}')
-    print('###', flush = True)
-
-def build_run(cmdline, name, section, silent = False):
-    print(cmdline, flush = True)
     if silent:
-        print('### building in silent mode ...', flush = True)
+        print(f'### {rebase_prefix}{line}', flush = True)
+    else:
+        print('')
+        print('###')
+        print(f'### {rebase_prefix}{line}')
+        if line2:
+            print(f'### {line2}')
+        print('###', flush = True)
+
+def build_run(cmdline, name, section, silent = False, nologs = False):
+    if silent:
+        logfile = f'{section}.log'
+        if nologs:
+            print(f'### building in silent mode [no log] ...', flush = True)
+        else:
+            print(f'### building in silent mode [{logfile}] ...', flush = True)
+        start = time.time()
         result = subprocess.run(cmdline, check = False,
                                 stdout = subprocess.PIPE,
                                 stderr = subprocess.STDOUT)
-
+        if not nologs:
-        logfile = f'{section}.log'
+            with open(logfile, 'wb') as f:
-        print(f'### writing log to {logfile} ...')
+                f.write(result.stdout)
-        with open(logfile, 'wb') as f:
-            f.write(result.stdout)
 
         if result.returncode:
             print('### BUILD FAILURE')
+            print('### cmdline')
+            print(cmdline)
             print('### output')
             print(result.stdout.decode())
             print(f'### exit code: {result.returncode}')
         else:
-            print('### OK')
+            secs = int(time.time() - start)
+            print(f'### OK ({int(secs/60)}:{secs%60:02d})')
     else:
+        print(cmdline, flush = True)
         result = subprocess.run(cmdline, check = False)
     if result.returncode:
         print(f'ERROR: {cmdline[0]} exited with {result.returncode}'
@@ -163,7 +186,7 @@ def pad_file(dstdir, pad):
     subprocess.run(cmdline, check = True)
 
 # pylint: disable=too-many-branches
-def build_one(cfg, build, jobs = None, silent = False):
+def build_one(cfg, build, jobs = None, silent = False, nologs = False):
     b = cfg[build]
 
     cmdline  = [ 'build' ]
@@ -172,13 +195,16 @@ def build_one(cfg, build, jobs = None, silent = False):
 
     if (b['conf'].startswith('OvmfPkg/') or
         b['conf'].startswith('ArmVirtPkg/')):
-        cmdline += pcd_version(cfg)
+        cmdline += pcd_version(cfg, silent)
         cmdline += pcd_release_date()
 
     if jobs:
         cmdline += [ '-n', jobs ]
     for arch in b['arch'].split():
-        cmdline += [ '-a', arch ]
+        if arch == 'HOST':
+            cmdline += [ '-a', get_hostarch() ]
+        else:
+            cmdline += [ '-a', arch ]
     if 'opts' in b:
         for name in b['opts'].split():
             section = 'opts.' + name
@@ -198,11 +224,13 @@ def build_one(cfg, build, jobs = None, silent = False):
         if 'desc' in b:
             desc = b['desc']
         build_message(f'building: {b["conf"]} ({b["arch"]}, {tgt})',
-                      f'description: {desc}')
+                      f'description: {desc}',
+                      silent = silent)
         build_run(cmdline + [ '-b', tgt ],
                   b['conf'],
                   build + '.' + tgt,
-                  silent)
+                  silent,
+                  nologs)
 
         if 'plat' in b:
             # copy files
@@ -218,11 +246,11 @@ def build_one(cfg, build, jobs = None, silent = False):
                     continue
                 pad_file(b['dest'], b[pad])
 
-def build_basetools(silent = False):
+def build_basetools(silent = False, nologs = False):
-    build_message('building: BaseTools')
+    build_message('building: BaseTools', silent = silent)
     basedir = os.environ['EDK_TOOLS_PATH']
     cmdline = [ 'make', '-C', basedir ]
-    build_run(cmdline, 'BaseTools', 'build.basetools', silent)
+    build_run(cmdline, 'BaseTools', 'build.basetools', silent, nologs)
 
 def binary_exists(name):
     for pdir in os.environ['PATH'].split(':'):
@@ -230,7 +258,7 @@ def binary_exists(name):
             return True
     return False
 
-def prepare_env(cfg):
+def prepare_env(cfg, silent = False):
     """ mimic Conf/BuildEnv.sh """
     workspace = os.getcwd()
     packages = [ workspace, ]
@@ -260,7 +288,7 @@ def prepare_env(cfg):
     toolsdef = coredir + '/Conf/tools_def.txt'
     if not os.path.exists(toolsdef):
         os.makedirs(os.path.dirname(toolsdef), exist_ok = True)
-        build_message('running BaseTools/BuildEnv')
+        build_message('running BaseTools/BuildEnv', silent = silent)
         cmdline = [ 'bash', 'BaseTools/BuildEnv' ]
         subprocess.run(cmdline, cwd = coredir, check = True)
 
@@ -274,20 +302,32 @@ def prepare_env(cfg):
     os.environ['PYTHONHASHSEED'] = '1'
 
     # for cross builds
-    if binary_exists('arm-linux-gnu-gcc'):
+    if binary_exists('arm-linux-gnueabi-gcc'):
+        # ubuntu
+        os.environ['GCC5_ARM_PREFIX'] = 'arm-linux-gnueabi-'
+        os.environ['GCC_ARM_PREFIX'] = 'arm-linux-gnueabi-'
+    elif binary_exists('arm-linux-gnu-gcc'):
+        # fedora
         os.environ['GCC5_ARM_PREFIX'] = 'arm-linux-gnu-'
+        os.environ['GCC_ARM_PREFIX'] = 'arm-linux-gnu-'
     if binary_exists('loongarch64-linux-gnu-gcc'):
         os.environ['GCC5_LOONGARCH64_PREFIX'] = 'loongarch64-linux-gnu-'
+        os.environ['GCC_LOONGARCH64_PREFIX'] = 'loongarch64-linux-gnu-'
 
     hostarch = os.uname().machine
     if binary_exists('aarch64-linux-gnu-gcc') and hostarch != 'aarch64':
         os.environ['GCC5_AARCH64_PREFIX'] = 'aarch64-linux-gnu-'
+        os.environ['GCC_AARCH64_PREFIX'] = 'aarch64-linux-gnu-'
     if binary_exists('riscv64-linux-gnu-gcc') and hostarch != 'riscv64':
         os.environ['GCC5_RISCV64_PREFIX'] = 'riscv64-linux-gnu-'
+        os.environ['GCC_RISCV64_PREFIX'] = 'riscv64-linux-gnu-'
     if binary_exists('x86_64-linux-gnu-gcc') and hostarch != 'x86_64':
         os.environ['GCC5_IA32_PREFIX'] = 'x86_64-linux-gnu-'
         os.environ['GCC5_X64_PREFIX'] = 'x86_64-linux-gnu-'
         os.environ['GCC5_BIN'] = 'x86_64-linux-gnu-'
+        os.environ['GCC_IA32_PREFIX'] = 'x86_64-linux-gnu-'
+        os.environ['GCC_X64_PREFIX'] = 'x86_64-linux-gnu-'
+        os.environ['GCC_BIN'] = 'x86_64-linux-gnu-'
 
 def build_list(cfg):
     for build in cfg.sections():
@@ -310,10 +350,12 @@ def main():
     parser.add_argument('-j', '--jobs', dest = 'jobs', type = str,
                         help = 'allow up to JOBS parallel build jobs',
                         metavar = 'JOBS')
-    parser.add_argument('-m', '--match', dest = 'match', type = str,
+    parser.add_argument('-m', '--match', dest = 'match',
+                        type = str, action = 'append',
                         help = 'only run builds matching INCLUDE (substring)',
                         metavar = 'INCLUDE')
-    parser.add_argument('-x', '--exclude', dest = 'exclude', type = str,
+    parser.add_argument('-x', '--exclude', dest = 'exclude',
+                        type = str, action = 'append',
                         help = 'skip builds matching EXCLUDE (substring)',
                         metavar = 'EXCLUDE')
     parser.add_argument('-l', '--list', dest = 'list',
@@ -323,6 +365,9 @@ def main():
                         action = 'store_true', default = False,
                         help = 'write build output to logfiles, '
                         'write to console only on errors')
+    parser.add_argument('--no-logs', dest = 'nologs',
+                        action = 'store_true', default = False,
+                        help = 'do not write build log files (with --silent)')
     parser.add_argument('--core', dest = 'core', type = str, metavar = 'DIR',
                         help = 'location of the core edk2 repository '
                         '(i.e. where BuildTools are located)')
@@ -330,7 +375,8 @@ def main():
                         type = str, action = 'append', metavar = 'DIR',
                         help = 'location(s) of additional packages '
                         '(can be specified multiple times)')
-    parser.add_argument('-t', '--toolchain', dest = 'toolchain', type = str, metavar = 'NAME',
+    parser.add_argument('-t', '--toolchain', dest = 'toolchain',
+                        type = str, metavar = 'NAME',
                         help = 'tool chain to be used to build edk2')
     parser.add_argument('--version-override', dest = 'version_override',
                         type = str, metavar = 'VERSION',
@@ -344,7 +390,7 @@ def main():
         os.chdir(options.directory)
 
     if not os.path.exists(options.configfile):
-        print('config file "{options.configfile}" not found')
+        print(f'config file "{options.configfile}" not found')
         return 1
 
     cfg = configparser.ConfigParser()
@@ -372,18 +418,28 @@ def main():
     if options.release_date:
         release_date = options.release_date
 
-    prepare_env(cfg)
+    prepare_env(cfg, options.silent)
-    build_basetools(options.silent)
+    build_basetools(options.silent, options.nologs)
     for build in cfg.sections():
         if not build.startswith('build.'):
             continue
-        if options.match and options.match not in build:
+        if options.match:
-            print(f'# skipping "{build}" (not matching "{options.match}")')
+            matching = False
-            continue
+            for item in options.match:
-        if options.exclude and options.exclude in build:
+                if item in build:
-            print(f'# skipping "{build}" (matching "{options.exclude}")')
+                    matching = True
-            continue
+            if not matching:
-        build_one(cfg, build, options.jobs, options.silent)
+                print(f'# skipping "{build}" (not matching "{"|".join(options.match)}")')
+                continue
+        if options.exclude:
+            exclude = False
+            for item in options.exclude:
+                if item in build:
+                    print(f'# skipping "{build}" (matching "{item}")')
+                    exclude = True
+            if exclude:
+                continue
+        build_one(cfg, build, options.jobs, options.silent, options.nologs)
 
     return 0
 

edk2-build.rhel-9

@@ -21,20 +21,27 @@ EXCLUDE_SHELL_FROM_FD    = TRUE
 # new upstream
 BUILD_SHELL              = FALSE
 
+[opts.ovmf.sb.stateless]
+SECURE_BOOT_ENABLE       = TRUE
+SMM_REQUIRE              = FALSE
+
 [opts.armvirt.verbose]
 DEBUG_PRINT_ERROR_LEVEL  = 0x8040004F
 
 [opts.armvirt.silent]
 DEBUG_PRINT_ERROR_LEVEL  = 0x80000000
 
+
 [pcds.nx.strict]
 PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD5
+PcdUninstallMemAttrProtocol    = FALSE
 
-[pcds.nx.broken.grub]
+[pcds.nx.broken.shim.grub]
 # grub.efi uses EfiLoaderData for code
 PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD1
-# shim can't work with EFI_MEMORY_ATTRIBUTE_PROTOCOL
+# shim.efi has broken MemAttr code
-gArmTokenSpaceGuid.PcdEnableEfiMemoryAttributeProtocol = FALSE
+PcdUninstallMemAttrProtocol    = TRUE
+
 
 #####################################################################
 # stateful ovmf builds (with vars in flash)
@@ -52,13 +59,13 @@ cpy2 = FV/OVMF_VARS.fd
 cpy3 = X64/Shell.efi
 
 [build.ovmf.4m.sb.smm]
-desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot)
+desc = ovmf build (64-bit, 4MB, q35 only, needs smm, secure boot)
-conf = OvmfPkg/OvmfPkgIa32X64.dsc
+conf = OvmfPkg/OvmfPkgX64.dsc
-arch = IA32 X64
+arch = X64
 opts = ovmf.common
        ovmf.4m
        ovmf.sb.smm
-plat = Ovmf3264
+plat = OvmfX64
 dest = RHEL-9/ovmf
 cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
 cpy2 = X64/EnrollDefaultKeys.efi
@@ -83,6 +90,7 @@ conf = OvmfPkg/IntelTdx/IntelTdxX64.dsc
 arch = X64
 opts = ovmf.common
        ovmf.4m
+       ovmf.sb.stateless
 plat = IntelTdx
 dest = RHEL-9/ovmf
 cpy1 = FV/OVMF.fd OVMF.inteltdx.fd
@@ -97,7 +105,7 @@ conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = AARCH64
 opts = ovmf.common
        armvirt.verbose
-pcds = nx.broken.grub
+pcds = nx.broken.shim.grub
 plat = ArmVirtQemu-AARCH64
 dest = RHEL-9/aarch64
 cpy1 = FV/QEMU_EFI.fd
@@ -113,7 +121,7 @@ conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = AARCH64
 opts = ovmf.common
        armvirt.silent
-pcds = nx.broken.grub
+pcds = nx.broken.shim.grub
 plat = ArmVirtQemu-AARCH64
 dest = RHEL-9/aarch64
 cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.silent.fd

edk2.spec

@@ -1,9 +1,11 @@
 ExclusiveArch: x86_64 aarch64
 
-%define GITDATE        20230524
+%define GITDATE        20231122
-%define GITCOMMIT      ba91d0292e
+%define GITCOMMIT      8736b8fdca
 %define TOOLCHAIN      GCC5
-%define OPENSSL_VER    1.1.1k
+
+%define OPENSSL_VER    3.0.7
+%define OPENSSL_HASH   db0287935122edceb91dcda8dfb53b4090734e22
 
 %define DBXDATE        20230509
 
@@ -18,18 +20,18 @@ ExclusiveArch: x86_64 aarch64
 
 Name:       edk2
 Version:    %{GITDATE}
-Release:    4%{?dist}
+Release:    1%{?dist}
 Summary:    UEFI firmware for 64-bit virtual machines
-License:    BSD-2-Clause-Patent and OpenSSL and MIT
+License:    BSD-2-Clause-Patent and Apache-2.0 and MIT
 URL:        http://www.tianocore.org
 
 # The source tarball is created using following commands:
 # COMMIT=ba91d0292e
 # git archive --format=tar --prefix=edk2-$COMMIT/ $COMMIT \
 # | xz -9ev >/tmp/edk2-$COMMIT.tar.xz
-Source0:edk2-%{GITCOMMIT}.tar.xz
+Source0: edk2-%{GITCOMMIT}.tar.xz
 Source1: ovmf-whitepaper-c770f8c.txt
-Source2: openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
+Source2: openssl-rhel-%{OPENSSL_HASH}.tar.xz
 
 # json description files
 Source10: 50-edk2-aarch64-qcow2.json
@@ -48,68 +50,37 @@ Source80: edk2-build.py
 Source82: edk2-build.rhel-9
 
 Source90: DBXUpdate-%{DBXDATE}.x64.bin
-
+Patch1: 0001-ignore-build-artifacts-generated-files-session-setti.patch
-Patch0002: 0002-Remove-submodules.patch
+Patch2: 0002-Remove-submodules.patch
-Patch0003: 0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
+Patch3: 0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
-Patch0004: 0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
+Patch4: 0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
-Patch0005: 0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
+Patch5: 0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
-Patch0006: 0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+Patch6: 0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
-Patch0007: 0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+Patch7: 0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
-Patch0008: 0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+Patch8: 0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
-Patch0009: 0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+Patch9: 0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
-Patch0010: 0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+Patch10: 0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
-Patch0011: 0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
+Patch11: 0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
-Patch0012: 0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
+Patch12: 0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
-Patch0013: 0013-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
+Patch13: 0013-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
-Patch0014: 0014-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
+Patch14: 0014-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
-Patch0015: 0015-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
+Patch15: 0015-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
-Patch0016: 0016-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
+Patch16: 0016-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
-Patch0017: 0017-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
+Patch17: 0017-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
-Patch0018: 0018-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
+Patch18: 0018-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
-Patch0019: 0019-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
+Patch19: 0019-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
-Patch0020: 0020-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
+Patch20: 0020-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
-Patch0021: 0021-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
+Patch21: 0021-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
-Patch0022: 0022-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
+Patch22: 0022-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
-Patch0023: 0023-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
+Patch23: 0023-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
-Patch0024: 0024-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
+Patch24: 0024-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
-Patch0025: 0025-recreate-import-redhat-directory.patch
+Patch25: 0025-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
-Patch0026: 0026-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
+Patch26: 0026-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
-Patch0027: 0027-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch
+Patch27: 0027-recreate-import-.distro-directory.patch
-Patch0028: 0028-ArmPkg-Disable-EFI_MEMORY_ATTRIBUTE_PROTOCOL-RH-only.patch
+Patch28: 0028-distro-apply-git-diff-c9s-new_c9s-by-mirek.patch
-Patch0029: 0029-OvmfPkg-PciHotPlugInitDxe-Do-not-reserve-IO-ports-by.patch
+Patch29: 0029-CryptoPkg-CrtLib-add-stat.h-include-file.patch
-# For RHEL-643 - add virtio serial support to armvirt
+Patch30: 0030-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch
-Patch30: edk2-ArmVirt-add-VirtioSerialDxe-to-ArmVirtQemu-builds.patch
+Patch31: 0031-ArmVirtQemu-Allow-EFI-memory-attributes-protocol-to-.patch
-# For RHEL-643 - add virtio serial support to armvirt
-Patch31: edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtio.patch
-# For RHEL-643 - add virtio serial support to armvirt
-Patch32: edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtioPc.patch
-# For RHEL-643 - add virtio serial support to armvirt
-Patch33: edk2-ArmVirt-PlatformBootManagerLib-set-up-virtio-serial-.patch
-# For RHEL-643 - add virtio serial support to armvirt
-Patch34: edk2-OvmfPkg-VirtioSerialDxe-use-TPL_NOTIFY.patch
-# For RHEL-643 - add virtio serial support to armvirt
-Patch35: edk2-OvmfPkg-VirtioSerialDxe-Remove-noisy-debug-print-on-.patch
-# For bz#2174749 - [edk2] re-enable dynamic mmio window
-Patch36: edk2-OvmfPkg-PlatformInitLib-limit-phys-bits-to-46.patch
-# For bz#2174749 - [edk2] re-enable dynamic mmio window
-Patch37: edk2-Revert-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch
-# For bz#2124143 - ovmf must consider max cpu count not boot cpu count for apic mode [rhel-9]
-Patch38: edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
-# For RHEL-644 - enable gigabyte pages
-Patch39: edk2-OvmfPkg-PlatformInitLib-check-PcdUse1GPageTable.patch
-# For RHEL-644 - enable gigabyte pages
-Patch40: edk2-OvmfPkg-OvmfPkgIa32X64-enable-1G-pages.patch
-# For RHEL-644 - enable gigabyte pages
-Patch41: edk2-OvmfPkg-MicrovmX64-enable-1G-pages.patch
-# For bz#2190244 - [EDK2] [AMDSERVER 9.3 Bug] OVMF AP Creation Fixes
-Patch42: edk2-OvmfPkg-AmdSev-fix-BdsPlatform.c-assertion-failure-d.patch
-# For bz#2211060 - SEV-es guest randomly stuck at boot to hard drive screen from powerdown and boot again
-Patch43: edk2-OvmfPkg-IoMmuDxe-add-locking-to-IoMmuAllocateBounceB.patch
-# For bz#2218196 - Add vtpm devices with OVMF.amdsev.fd causes VM reset
-Patch44: edk2-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
-# For RHEL-9943 - [EDK2][AMDSERVER Bug] OvmfPkg/ResetVector: Fix assembler bit test flag check [rhel-9.3.0.z]
-Patch45: edk2-OvmfPkg-ResetVector-Fix-assembler-bit-test-flag-chec.patch
-
 
 # python3-devel and libuuid-devel are required for building tools.
 # python3-devel is also needed for varstore template generation and
@@ -118,6 +89,7 @@ BuildRequires:  python3-devel
 BuildRequires:  libuuid-devel
 BuildRequires:  /usr/bin/iasl
 BuildRequires:  binutils gcc git gcc-c++ make
+BuildRequires:  perl perl(JSON)
 BuildRequires:  qemu-img
 
 %if %{build_ovmf}
@@ -146,7 +118,7 @@ Obsoletes:  OVMF < 20180508-100.gitee3198e672e2.el7
 # OVMF includes the Secure Boot and IPv6 features; it has a builtin OpenSSL
 # library.
 Provides:   bundled(openssl) = %{OPENSSL_VER}
-License:    BSD-2-Clause-Patent and OpenSSL
+License:    BSD-2-Clause-Patent and Apache-2.0
 
 # URL taken from the Maintainers.txt file.
 URL:        http://www.tianocore.org/ovmf/
@@ -168,7 +140,7 @@ Conflicts:  libvirt-daemon-driver-qemu < 9.2.0
 
 # No Secure Boot for AAVMF yet, but we include OpenSSL for the IPv6 stack.
 Provides:   bundled(openssl) = %{OPENSSL_VER}
-License:    BSD-2-Clause-Patent and OpenSSL
+License:    BSD-2-Clause-Patent and Apache-2.0
 
 # URL taken from the Maintainers.txt file.
 URL:        https://github.com/tianocore/tianocore.github.io/wiki/ArmVirtPkg
@@ -263,14 +235,26 @@ export EXTRA_LDFLAGS="%{__global_ldflags}"
 export RELEASE_DATE="$(echo %{GITDATE} | sed -e 's|\(....\)\(..\)\(..\)|\2/\3/\1|')"
 
 touch OvmfPkg/AmdSev/Grub/grub.efi   # dummy
+python3 CryptoPkg/Library/OpensslLib/configure.py
+
+# include dirs of unused submodules
+mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include
+mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include/mbedtls
+mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/library
 
 %if %{build_ovmf}
 ./edk2-build.py --config edk2-build.rhel-9 -m ovmf --release-date "$RELEASE_DATE"
 build_iso RHEL-9/ovmf
+cp DBXUpdate-%{DBXDATE}.x64.bin RHEL-9/ovmf
 virt-fw-vars --input   RHEL-9/ovmf/OVMF_VARS.fd \
              --output  RHEL-9/ovmf/OVMF_VARS.secboot.fd \
              --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
              --enroll-redhat --secure-boot
+virt-fw-vars --input   RHEL-9/ovmf/OVMF.inteltdx.fd \
+             --output  RHEL-9/ovmf/OVMF.inteltdx.secboot.fd \
+             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
+             --enroll-redhat --secure-boot \
+             --set-fallback-no-reboot
 %endif
 
 %if %{build_aarch64}
@@ -284,7 +268,7 @@ done
 %install
 
 cp -a OvmfPkg/License.txt License.OvmfPkg.txt
-cp -a CryptoPkg/Library/OpensslLib/openssl/LICENSE LICENSE.openssl
+cp -a CryptoPkg/Library/OpensslLib/openssl/LICENSE.txt LICENSE.openssl
 mkdir -p %{buildroot}%{_datadir}/qemu/firmware
 
 # install the tools
@@ -367,6 +351,8 @@ install -m 0644 \
 %{_datadir}/%{name}/ovmf/OVMF_VARS.secboot.fd
 %{_datadir}/%{name}/ovmf/OVMF.amdsev.fd
 %{_datadir}/%{name}/ovmf/OVMF.inteltdx.fd
+%{_datadir}/%{name}/ovmf/OVMF.inteltdx.secboot.fd
+%{_datadir}/%{name}/ovmf/DBXUpdate*.bin
 %{_datadir}/%{name}/ovmf/UefiShell.iso
 %{_datadir}/OVMF/OVMF_CODE.secboot.fd
 %{_datadir}/OVMF/OVMF_VARS.fd
@@ -428,6 +414,14 @@ install -m 0644 \
 
 
 %changelog
+* Fri Dec 15 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20231122-1
+- Rebase to edk2-stable202311 [RHEL-12323]
+- Switch to OpenSSL 3.0 [RHEL-49]
+- Resolves: RHEL-12323
+  (Rebase EDK2 for RHEL 9.4)
+- Resolves: RHEL-49
+  (consume / bundle RHEL-9 OpenSSL (version 3.0.x) in RHEL-9 edk2)
+
 * Mon Oct 09 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20230524-4
 - edk2-OvmfPkg-ResetVector-Fix-assembler-bit-test-flag-chec.patch [RHEL-9943]
 - Resolves: RHEL-9943

sources

@@ -1,3 +1,3 @@
 SHA512 (DBXUpdate-20230509.x64.bin) = 71fb6e8cd6918126b3acd78b95651913336df372e13fdfdfdd20d5d23f0e509050c6c88c8a2c43f8ac44f987df86bd45174bb3065d5a7a8c7e3b8772fd06d624
-SHA512 (edk2-ba91d0292e.tar.xz) = 3b21cc39671d28bfeb059da3683751cc5277c63a894b2a05bdfbd2bbe53545c34f04c229becf44f1563f89a738f37ae8f2333076d126a7e94d234bc4bb25454c
+SHA512 (edk2-8736b8fdca.tar.xz) = c1573986081f54c43f848b0344b30fe7a388b6d17b87a0411028319827a6cd7a20a694cde6d51b84f6ae15f69b2b70858253396fd61f7c043624d754d14f4724
-SHA512 (openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz) = 6842e767f767fe79edcb9ba8e32ce2956e8b56f0b265f79a5b4dbd4bba51b63d9733841badee7f2ffdcca803baf82b3e9e132fd465c22027539dcfd02608e99a
+SHA512 (openssl-rhel-db0287935122edceb91dcda8dfb53b4090734e22.tar.xz) = 693f4d1d79337ed0676cc13e35efaf918f3527cf1c6f7076dcf836e5e43a18bfe16dfe97ef76407c3c014c9ae9a6f34149745f41b4b5393d85cd36de20d56d69