import edk2-20221207gitfff6d81270b5-9.el9_2

2023-05-09 05:17:15 +00:00 · 2023-05-09 05:17:15 +00:00 · 6c68d8ab0f
commit 6c68d8ab0f
parent 98941cf138
56 changed files with 1886 additions and 1481 deletions
--- a/.edk2.metadata
+++ b/.edk2.metadata
@ -1,2 +1,2 @@
-78e6e577d9727e549bb9fb0b1973bcc2b6ec9b3d SOURCES/edk2-16779ede2d36.tar.xz
+a1c42c2f044a95caf0c8595d351c4cc5adcfde14 SOURCES/edk2-fff6d81270b5.tar.xz
-f6b8cfc123a75525218c6588ec16b61f17cb420d SOURCES/openssl-rhel-740e53ace8f6771c205bf84780e26bcd7a3275df.tar.xz
+c0518a4102a3909928dcc2e0a2c1784a53a419c6 SOURCES/openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1,2 @@
-SOURCES/edk2-16779ede2d36.tar.xz
+SOURCES/edk2-fff6d81270b5.tar.xz
-SOURCES/openssl-rhel-740e53ace8f6771c205bf84780e26bcd7a3275df.tar.xz
+SOURCES/openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
--- a/SOURCES/0002-Remove-submodules.patch
+++ b/SOURCES/0002-Remove-submodules.patch
@ -1,4 +1,4 @@
-From 5fa2d2bbc8c9d3c9ff5a0293c3b2fa756bddd500 Mon Sep 17 00:00:00 2001
+From b7053a8abb865ff58bc92cae6e573ae1e805b602 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Thu, 24 Mar 2022 03:23:02 -0400
 Subject: Remove submodules
@ -41,7 +41,7 @@ remove the include path too.
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit e05e0de713c4a2b8adb6ff9809611f222bfe50ed)
 ---
- .gitmodules                                   | 22 -------------------
+ .gitmodules                                   | 25 -------------------
 .../ArmSoftFloatLib/berkeley-softfloat-3      |  1 -
 BaseTools/Source/C/BrotliCompress/brotli      |  1 -
 BaseTools/Source/C/GNUmakefile                |  1 -
@ -52,7 +52,7 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 .../Universal/RegularExpressionDxe/oniguruma  |  1 -
 RedfishPkg/Library/JsonLib/jansson            |  1 -
 UnitTestFrameworkPkg/Library/CmockaLib/cmocka |  1 -
- 11 files changed, 1 insertion(+), 33 deletions(-)
+ 11 files changed, 1 insertion(+), 36 deletions(-)
 delete mode 160000 ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3
 delete mode 160000 BaseTools/Source/C/BrotliCompress/brotli
 create mode 100644 CryptoPkg/.gitignore
@ -63,10 +63,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 delete mode 160000 UnitTestFrameworkPkg/Library/CmockaLib/cmocka
 diff --git a/BaseTools/Source/C/GNUmakefile b/BaseTools/Source/C/GNUmakefile
-index 8c191e0c38..3eae824a1c 100644
+index 5275f657ef..39d7199753 100644
 --- a/BaseTools/Source/C/GNUmakefile
 +++ b/BaseTools/Source/C/GNUmakefile
-@@ -48,7 +48,6 @@ all: makerootdir subdirs
+@@ -51,7 +51,6 @@ all: makerootdir subdirs
 LIBRARIES = Common
 VFRAUTOGEN = VfrCompile/VfrLexer.h
 APPLICATIONS = \
@ -75,7 +75,7 @@ index 8c191e0c38..3eae824a1c 100644
   EfiRom \
   GenFfs \
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 2bcb9f9453..f549276b80 100644
+index 58e6ab0048..775f1b27af 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
@@ -24,9 +24,6 @@
--- a/SOURCES/0003-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch
+++ b/SOURCES/0003-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch
@ -1,4 +1,4 @@
-From 83f28ee21b44c881c793bae51a9bf84dcb17304f Mon Sep 17 00:00:00 2001
+From cef6b69ea8f009aeba50b2f4b69889f9500fa585 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Tue, 25 Feb 2014 18:40:35 +0100
 Subject: MdeModulePkg: TerminalDxe: add other text resolutions (RHEL only)
@ -168,5 +168,5 @@ index e2d779c783..dfd9c96773 100644
   // New modes can be added here.
   //
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0003-OvmfPkg-increase-max-debug-message-length-to-512-RHE.patch
+++ b/SOURCES/0003-OvmfPkg-increase-max-debug-message-length-to-512-RHE.patch
@ -1,82 +0,0 @@
 From 7c341fac71b9c0530d2593da20ca2bd8cd363f2f Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Thu, 20 Feb 2014 22:54:45 +0100
 Subject: OvmfPkg: increase max debug message length to 512 (RHEL only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
 - no change
 Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
 RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
 - no change
 Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
 RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
 - trivial context difference due to upstream commit 2fe5f2f52918
  ("OvmfPkg/PlatformDebugLibIoPort: Add new APIs", 2019-04-02), resolved
  by git-cherry-pick automatically
 Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
 RHEL-8.1/20190308-89910a39dcfd rebase:
 - no changes
 Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
 RHEL-8.0/20180508-ee3198e672e2 rebase:
 - reorder the rebase changelog in the commit message so that it reads like
  a blog: place more recent entries near the top
 - no changes to the patch body
 Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
 - no changes
 Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
 - no changes
 Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
 - no changes
 Upstream prefers short debug messages (sometimes even limited to 80
 characters), but any line length under 512 characters is just unsuitable
 for effective debugging. (For example, config strings in HII routing,
 logged by the platform driver "OvmfPkg/PlatformDxe" on DEBUG_VERBOSE
 level, can be several hundred characters long.) 512 is an empirically good
 value.
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit bfe568d18dba15602604f155982e3b73add63dfb)
 (cherry picked from commit 29435a32ec9428720c74c454ce9817662e601fb6)
 (cherry picked from commit 58e1d1ebb78bfdaf05f4c6e8abf8d4908dfa038a)
 (cherry picked from commit 1df2c822c996ad767f2f45570ab2686458f7604a)
 (cherry picked from commit 22c9b4e971c70c69b4adf8eb93133824ccb6426a)
 (cherry picked from commit a1260c9122c95bcbef1efc5eebe11902767813c2)
 (cherry picked from commit e949bab1268f83f0f5815a96cd1cb9dd3b21bfb5)
 (cherry picked from commit a95cff0b9573bf23699551beb4786383f697ff1e)
 ---
 OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c b/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c
 index 4e25f198aa..640627f38b 100644
 --- a/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c
 +++ b/OvmfPkg/Library/PlatformDebugLibIoPort/DebugLib.c
@@ -21,7 +21,7 @@
 //
 // Define the maximum debug and assert message length that this library supports
 //
 -#define MAX_DEBUG_MESSAGE_LENGTH  0x100
 +#define MAX_DEBUG_MESSAGE_LENGTH  0x200
 //
 // VA_LIST can not initialize to NULL for all compiler, so we use this to
 -- 
 2.31.1
--- a/SOURCES/0004-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
+++ b/SOURCES/0004-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
@ -1,4 +1,4 @@
-From c540bfb48919613f58aa902ca30a922fd1406603 Mon Sep 17 00:00:00 2001
+From dc40fd64b7b3bc9bb53a7d4a95b3e80f8cfe5152 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Tue, 25 Feb 2014 22:40:01 +0100
 Subject: MdeModulePkg: TerminalDxe: set xterm resolution on mode change (RH
@ -95,10 +95,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 3 files changed, 36 insertions(+)
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index f549276b80..1415766054 100644
+index 775f1b27af..94f3394cef 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
-@@ -2092,6 +2092,10 @@
+@@ -2099,6 +2099,10 @@
   # @Prompt The shared bit mask when Intel Tdx is enabled.
   gEfiMdeModulePkgTokenSpaceGuid.PcdTdxSharedBitMask|0x0|UINT64|0x10000025
@ -185,5 +185,5 @@ index b2a8aeba85..eff6253465 100644
 # [Event]
 # # Relative timer event set by UnicodeToEfiKey(), used to be one 2 seconds input timeout.
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0005-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
+++ b/SOURCES/0005-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
@ -1,4 +1,4 @@
-From 4c43c025cb288c7dc2fe5043fd7601e90a4b361a Mon Sep 17 00:00:00 2001
+From e7d8bbcb71ec3b292a9f3a358ce185a315a41a1c Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 14 Oct 2015 15:59:06 +0200
 Subject: OvmfPkg: take PcdResizeXterm from the QEMU command line (RH only)
@ -82,10 +82,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 9 files changed, 21 insertions(+), 1 deletion(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index fc1fdb2e22..ae23094ffc 100644
+index 8f7cae787e..41ad97b47d 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -524,6 +524,7 @@
+@@ -475,6 +475,7 @@
 [PcdsDynamicDefault]
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -94,10 +94,10 @@ index fc1fdb2e22..ae23094ffc 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc
-index 92664f319b..4aa54e4dc3 100644
+index ce277cb239..faab59ae8d 100644
 --- a/OvmfPkg/CloudHv/CloudHvX64.dsc
 +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc
-@@ -574,6 +574,7 @@
+@@ -582,6 +582,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -106,10 +106,10 @@ index 92664f319b..4aa54e4dc3 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-index dd8d446f4a..ec1aab6f09 100644
+index 3458926515..4c4da09b90 100644
 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
 +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-@@ -461,6 +461,7 @@
+@@ -474,6 +474,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -118,10 +118,10 @@ index dd8d446f4a..ec1aab6f09 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
-index f8fc977cb2..02ce394e18 100644
+index 994a02d301..1d5ba0e810 100644
 --- a/OvmfPkg/Microvm/MicrovmX64.dsc
 +++ b/OvmfPkg/Microvm/MicrovmX64.dsc
-@@ -556,7 +556,7 @@
+@@ -579,7 +579,7 @@
   # only set when
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -131,10 +131,10 @@ index f8fc977cb2..02ce394e18 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index a9841cbfc3..b69e3c05a2 100644
+index 6f774baf90..e8a074153a 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -585,6 +585,7 @@
+@@ -601,6 +601,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -143,10 +143,10 @@ index a9841cbfc3..b69e3c05a2 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index f7949780fa..726011ec42 100644
+index c851764dec..0197997793 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -593,6 +593,7 @@
+@@ -609,6 +609,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -155,10 +155,10 @@ index f7949780fa..726011ec42 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 1448f925b7..ab2e31ea8f 100644
+index 63c3a47aea..fade13b4e8 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -612,6 +612,7 @@
+@@ -631,6 +631,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -167,7 +167,7 @@ index 1448f925b7..ab2e31ea8f 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
-index f006755d5f..b8f5690251 100644
+index b1f8140d60..e5132d95a8 100644
 --- a/OvmfPkg/PlatformPei/Platform.c
 +++ b/OvmfPkg/PlatformPei/Platform.c
@@ -41,6 +41,18 @@
@ -189,7 +189,7 @@ index f006755d5f..b8f5690251 100644
 EFI_HOB_PLATFORM_INFO  mPlatformInfoHob = { 0 };
 EFI_PEI_PPI_DESCRIPTOR  mPpiBootMode[] = {
-@@ -387,6 +399,7 @@ InitializePlatform (
+@@ -376,6 +388,7 @@ InitializePlatform (
     MemTypeInfoInitialization ();
     MemMapInitialization (&mPlatformInfoHob);
     NoexecDxeInitialization ();
@ -198,10 +198,10 @@ index f006755d5f..b8f5690251 100644
   InstallClearCacheCallback ();
 diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf
-index 00372fa0eb..2dfa357c38 100644
+index 1fadadeb55..3e28e1596d 100644
 --- a/OvmfPkg/PlatformPei/PlatformPei.inf
 +++ b/OvmfPkg/PlatformPei/PlatformPei.inf
-@@ -98,6 +98,7 @@
+@@ -99,6 +99,7 @@
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved
@ -210,5 +210,5 @@ index 00372fa0eb..2dfa357c38 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
   gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0006-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
+++ b/SOURCES/0006-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
@ -1,4 +1,4 @@
-From 70f686c8654a7c7059cac13bf89b9c61edb059ef Mon Sep 17 00:00:00 2001
+From 9a33267768684fe3034d0c15835a6ee13ad10d7b Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Sun, 26 Jul 2015 08:02:50 +0000
 Subject: ArmVirtPkg: take PcdResizeXterm from the QEMU command line (RH only)
@ -95,11 +95,11 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index aa0ce61630..7705bf3919 100644
+index f77443229e..ed66f00030 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -284,6 +284,8 @@
+@@ -299,6 +299,8 @@
-   gEfiSecurityPkgTokenSpaceGuid.PcdTpm2HashMask|0
+   gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0x0
 !endif
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
@ -107,7 +107,7 @@ index aa0ce61630..7705bf3919 100644
 [PcdsDynamicHii]
   gArmVirtTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gArmVirtVariableGuid|0x0|FALSE|NV,BS
-@@ -386,7 +388,10 @@
+@@ -413,7 +415,10 @@
   MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
   MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitterDxe.inf
   MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
@ -199,5 +199,5 @@ index 0000000000..a51dbd1670
 +[Pcd]
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm ## SOMETIMES_PRODUCES
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0007-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+++ b/SOURCES/0007-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
@ -1,4 +1,4 @@
-From f3012d4439380458fe18917c4162ed95a91102e1 Mon Sep 17 00:00:00 2001
+From eb7d7c8bbbb0d3782a1d837c293f21629336d4d5 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:45 +0100
 Subject: OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
@ -65,10 +65,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 4 files changed, 4 insertions(+), 4 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index ae23094ffc..ccc46c974b 100644
+index 41ad97b47d..53a8938965 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -476,7 +476,7 @@
+@@ -427,7 +427,7 @@
   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
@ -78,10 +78,10 @@ index ae23094ffc..ccc46c974b 100644
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b69e3c05a2..bbe4e91037 100644
+index e8a074153a..7bced89f2a 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -525,7 +525,7 @@
+@@ -541,7 +541,7 @@
   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
@ -91,10 +91,10 @@ index b69e3c05a2..bbe4e91037 100644
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 726011ec42..072f06c0a3 100644
+index 0197997793..2599facbb7 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -531,7 +531,7 @@
+@@ -547,7 +547,7 @@
   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
@ -104,10 +104,10 @@ index 726011ec42..072f06c0a3 100644
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index ab2e31ea8f..46661408f9 100644
+index fade13b4e8..7bd445ca36 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -548,7 +548,7 @@
+@@ -567,7 +567,7 @@
   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
@ -117,5 +117,5 @@ index ab2e31ea8f..46661408f9 100644
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0008-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch
+++ b/SOURCES/0008-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch
@ -1,172 +0,0 @@
 From 8c739e3281704f16973cf1e93f544d9475bcbecf Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Tue, 4 Nov 2014 23:02:53 +0100
 Subject: OvmfPkg: allow exclusion of the shell from the firmware image (RH
 only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
 - No manual / explicit code change is necessary, because the newly
  inherited OvmfPkg/AmdSev platform already has its own BUILD_SHELL
  build-time macro (feature test flag), with default value FALSE -- from
  upstream commit b261a30c900a ("OvmfPkg/AmdSev: add Grub Firmware Volume
  Package", 2020-12-14).
 - Contextual differences from new upstream commits 2d8ca4f90eae ("OvmfPkg:
  enable HttpDynamicCommand", 2020-10-01) and 5ab6a0e1c8e9 ("OvmfPkg:
  introduce VirtioFsDxe", 2020-12-21) have been auto-resolved by
  git-cherry-pick.
 - Remove obsolete commit message tags related to downstream patch
  management: Message-id, Patchwork-id, O-Subject, Acked-by
  (RHBZ#1846481).
 Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
 RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
 - context difference from upstream commit ec41733cfd10 ("OvmfPkg: add the
  'initrd' dynamic shell command", 2020-03-04) correctly auto-resolved
 Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
 RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
 - no change
 Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
 RHEL-8.1/20190308-89910a39dcfd rebase:
 - update the patch against the following upstream commits:
  - 4b888334d234 ("OvmfPkg: Remove EdkShellBinPkg in FDF", 2018-11-19)
  - 277a3958d93a ("OvmfPkg: Don't include TftpDynamicCommand in XCODE5
                  tool chain", 2018-11-27)
 Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
 RHEL-8.0/20180508-ee3198e672e2 rebase:
 - reorder the rebase changelog in the commit message so that it reads like
  a blog: place more recent entries near the top
 - no changes to the patch body
 Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
 - no change
 Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
 - no changes
 Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
 - no changes
 Bugzilla: 1147592
 When '-D EXCLUDE_SHELL_FROM_FD' is passed to 'build', exclude the shell
 binary from the firmware image.
 Peter Jones advised us that firmware vendors for physical systems disable
 the memory-mapped, firmware image-contained UEFI shell in
 SecureBoot-enabled builds. The reason being that the memory-mapped shell
 can always load, it may have direct access to various hardware in the
 system, and it can run UEFI shell scripts (which cannot be signed at all).
 Intended use of the new build option:
 - In-tree builds: don't pass '-D EXCLUDE_SHELL_FROM_FD'. The resultant
  firmware image will contain a shell binary, independently of SecureBoot
  enablement, which is flexible for interactive development. (Ie. no
  change for in-tree builds.)
 - RPM builds: pass both '-D SECURE_BOOT_ENABLE' and
  '-D EXCLUDE_SHELL_FROM_FD'. The resultant RPM will provide:
  - OVMF_CODE.fd: SecureBoot-enabled firmware, without builtin UEFI shell,
  - OVMF_VARS.fd: variable store template matching OVMF_CODE.fd,
  - UefiShell.iso: a bootable ISO image with the shell on it as default
    boot loader. The shell binary will load when SecureBoot is turned off,
    and won't load when SecureBoot is turned on (because it is not
    signed).
    UefiShell.iso is the reason we're not excluding the shell from the DSC
    files as well, only the FDF files -- when '-D EXCLUDE_SHELL_FROM_FD'
    is specified, the shell binary needs to be built the same, only it
    will be included in UefiShell.iso.
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit 9c391def70366cabae08e6008814299c3372fafd)
 (cherry picked from commit d9dd9ee42937b2611fe37183cc9ec7f62d946933)
 (cherry picked from commit 23df46ebbe7b09451d3a05034acd4d3a25e7177b)
 (cherry picked from commit f0303f71d576c51b01c4ff961b429d0e0e707245)
 (cherry picked from commit bbd64eb8658e9a33eab4227d9f4e51ad78d9f687)
 (cherry picked from commit 8628ef1b8d675ebec39d83834abbe3c8c8c42cf4)
 (cherry picked from commit 229c88dc3ded9baeaca8b87767dc5c41c05afd6e)
 (cherry picked from commit c2812d7189dee06c780f05a5880eb421c359a687)
 ---
 OvmfPkg/OvmfPkgIa32.fdf    | 2 ++
 OvmfPkg/OvmfPkgIa32X64.fdf | 2 ++
 OvmfPkg/OvmfPkgX64.fdf     | 2 ++
 3 files changed, 6 insertions(+)
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
 index 57d13b7130..69044874e2 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -298,12 +298,14 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
 +!ifndef $(EXCLUDE_SHELL_FROM_FD)
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 INF  ShellPkg/Application/Shell/Shell.inf
 +!endif
 INF MdeModulePkg/Logo/LogoDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
 index ccde366887..bf535bef42 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -299,12 +299,14 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
 +!ifndef $(EXCLUDE_SHELL_FROM_FD)
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 INF  ShellPkg/Application/Shell/Shell.inf
 +!endif
 INF MdeModulePkg/Logo/LogoDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
 index 438806fba8..21e4ce00dd 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -324,12 +324,14 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
 +!ifndef $(EXCLUDE_SHELL_FROM_FD)
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 INF  ShellPkg/Application/Shell/Shell.inf
 +!endif
 INF MdeModulePkg/Logo/LogoDxe.inf
 -- 
 2.31.1
--- a/SOURCES/0008-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+++ b/SOURCES/0008-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
@ -1,4 +1,4 @@
-From f6c7b0992ea1ffa4760ac899800220c9df3a289d Mon Sep 17 00:00:00 2001
+From 5ac6b33275b5ae82883f0aa16bcedd53efe1f2e2 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:46 +0100
 Subject: OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
@ -82,10 +82,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 4 files changed, 32 insertions(+), 8 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index ccc46c974b..c66ad3af1a 100644
+index 53a8938965..f5133a801f 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -726,8 +726,14 @@
+@@ -677,8 +677,14 @@
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
@ -103,10 +103,10 @@ index ccc46c974b..c66ad3af1a 100644
   #
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index bbe4e91037..b37a5a6da9 100644
+index 7bced89f2a..1d271a3bdc 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -830,9 +830,15 @@
+@@ -846,9 +846,15 @@
   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
 !ifndef $(CSM_ENABLE)
@ -125,10 +125,10 @@ index bbe4e91037..b37a5a6da9 100644
   #
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 072f06c0a3..b0e8c20e93 100644
+index 2599facbb7..240bc43d14 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -844,9 +844,15 @@
+@@ -860,9 +860,15 @@
   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
 !ifndef $(CSM_ENABLE)
@ -147,10 +147,10 @@ index 072f06c0a3..b0e8c20e93 100644
   #
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 46661408f9..6211d5e934 100644
+index 7bd445ca36..7c6faba950 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -909,9 +909,15 @@
+@@ -928,9 +928,15 @@
   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
 !ifndef $(CSM_ENABLE)
@ -169,5 +169,5 @@ index 46661408f9..6211d5e934 100644
   #
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0009-ArmPlatformPkg-introduce-fixed-PCD-for-early-hello-m.patch
+++ b/SOURCES/0009-ArmPlatformPkg-introduce-fixed-PCD-for-early-hello-m.patch
@ -1,93 +0,0 @@
 From 2a0ac4b748825dcd9e2957870a3c317c16c35691 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 14 Oct 2015 13:49:43 +0200
 Subject: ArmPlatformPkg: introduce fixed PCD for early hello message (RH only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
 - no change
 Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
 RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
 - no change
 Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
 RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
 - no change
 Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
 RHEL-8.1/20190308-89910a39dcfd rebase:
 - no change
 Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
 RHEL-8.0/20180508-ee3198e672e2 rebase:
 - reorder the rebase changelog in the commit message so that it reads like
  a blog: place more recent entries near the top
 - no changes to the patch body
 Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
 - no changes
 Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
 - no changes
 Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
 - no changes
 Drew has proposed that ARM|AARCH64 platform firmware (especially virtual
 machine firmware) print a reasonably early, simple hello message to the
 serial port, regardless of debug mask settings. This should inform
 interactive users, and provide some rough help in localizing boot
 problems, even with restrictive debug masks.
 If a platform doesn't want this feature, it should stick with the default
 empty string.
 RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1270279
 Downstream only:
 <http://thread.gmane.org/gmane.comp.bios.edk2.devel/2996/focus=3433>.
 Suggested-by: Drew Jones <drjones@redhat.com>
 Contributed-under: TianoCore Contribution Agreement 1.0
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit 7ce97b06421434c82095f01a1753a8c9c546cc30)
 (cherry picked from commit 20b1f1cbd0590aa71c6d99d35e23cf08e0707750)
 (cherry picked from commit 6734b88cf7abcaf42632e3d2fc469b2169dd2f16)
 (cherry picked from commit ef77da632559e9baa1c69869e4cbea377068ef27)
 (cherry picked from commit 58755c51d3252312d80cbcb97928d71199c2f5e1)
 (cherry picked from commit c3f07e323e76856f1b42ea7b8c598ba3201c28a2)
 (cherry picked from commit 9f756c1ad83cc81f7d892cd036d59a2b567b02dc)
 (cherry picked from commit c75aea7a738ac7fb944c0695a4bfffc3985afaa9)
 ---
 ArmPlatformPkg/ArmPlatformPkg.dec | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/ArmPlatformPkg/ArmPlatformPkg.dec b/ArmPlatformPkg/ArmPlatformPkg.dec
 index 3a25ddcdc8..b2b58553c7 100644
 --- a/ArmPlatformPkg/ArmPlatformPkg.dec
 +++ b/ArmPlatformPkg/ArmPlatformPkg.dec
@@ -121,6 +121,13 @@
   ## If set, this will swap settings for HDLCD RED_SELECT and BLUE_SELECT registers
   gArmPlatformTokenSpaceGuid.PcdArmHdLcdSwapBlueRedSelect|FALSE|BOOLEAN|0x00000045
 +  #
 +  # Early hello message (ASCII string), printed to the serial port.
 +  # If set to the empty string, nothing is printed.
 +  # Otherwise, a trailing CRLF should be specified explicitly.
 +  #
 +  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage|""|VOID*|0x00000100
 +
 [PcdsFixedAtBuild.common,PcdsDynamic.common]
   ## PL031 RealTimeClock
   gArmPlatformTokenSpaceGuid.PcdPL031RtcBase|0x0|UINT32|0x00000024
 -- 
 2.31.1
--- a/SOURCES/0009-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+++ b/SOURCES/0009-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
@ -1,4 +1,4 @@
-From ce89db0328822a99820e19c6af8bbc22cc0682fb Mon Sep 17 00:00:00 2001
+From 0493dde37b4607853470f634e48fa26457edb5b9 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 27 Jan 2016 03:05:18 +0100
 Subject: ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in QemuRamfbDxe (RH
@ -61,10 +61,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 2 files changed, 8 insertions(+), 2 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index ae35cc1800..f30c1e622c 100644
+index ed66f00030..a3d744931a 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -511,7 +511,10 @@
+@@ -537,7 +537,10 @@
   #
   # Video support
   #
@ -77,7 +77,7 @@ index ae35cc1800..f30c1e622c 100644
   OvmfPkg/PlatformDxe/Platform.inf
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 7f7d15d6ee..14f7b29991 100644
+index f5db3ac432..ff3e6c5974 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
@@ -440,7 +440,10 @@
@ -93,5 +93,5 @@ index 7f7d15d6ee..14f7b29991 100644
   OvmfPkg/PlatformDxe/Platform.inf
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0010-ArmPlatformPkg-PrePeiCore-write-early-hello-message-.patch
+++ b/SOURCES/0010-ArmPlatformPkg-PrePeiCore-write-early-hello-message-.patch
@ -1,145 +0,0 @@
 From 2963ff004a52543e54098d6eded5780db8ef6dbe Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 14 Oct 2015 13:59:20 +0200
 Subject: ArmPlatformPkg: PrePeiCore: write early hello message to the serial
 port (RH)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
 - no change
 Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
 RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
 - no change
 Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
 RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
 - no change
 Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
 RHEL-8.1/20190308-89910a39dcfd rebase:
 - no change
 Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
 RHEL-8.0/20180508-ee3198e672e2 rebase:
 - reorder the rebase changelog in the commit message so that it reads like
  a blog: place more recent entries near the top
 - no changes to the patch body
 Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
 - adapt to upstream commit 7e2a8dfe8a9a ("ArmPlatformPkg/PrePeiCore: seed
  temporary stack before entering PEI core", 2017-11-09) -- conflict
  resolution in "ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf"
 Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
 - no changes
 Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
 - no changes
 The FixedPcdGetSize() macro expands to an integer constant, therefore an
 optimizing compiler can eliminate the new code, if the platform DSC
 doesn't override the empty string (size=1) default of
 PcdEarlyHelloMessage.
 RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1270279
 Downstream only:
 <http://thread.gmane.org/gmane.comp.bios.edk2.devel/2996/focus=3433>.
 Contributed-under: TianoCore Contribution Agreement 1.0
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit b16c4c505ce0e27305235533eac9236aa66f132e)
 (cherry picked from commit 742e5bf6d5ce5a1e73879d6e5c0dd00feda7a9ac)
 (cherry picked from commit 93d69eb9393cf05af90676253875c59c1bec67fd)
 (cherry picked from commit 638594083b191f84f5d9333eb6147a31570f5a5a)
 (cherry picked from commit f4b7aae411d88b2b83f85d20ef06a4032a57e7de)
 (cherry picked from commit bb71490fdda3b38fa9f071d281b863f9b64363bf)
 (cherry picked from commit 8d5a8827aabc67cb2a046697e1a750ca8d9cc453)
 (cherry picked from commit 49fe5596cd79c94d903c4d506c563d642ccd69aa)
 ---
 ArmPlatformPkg/PrePeiCore/MainMPCore.c          | 5 +++++
 ArmPlatformPkg/PrePeiCore/MainUniCore.c         | 5 +++++
 ArmPlatformPkg/PrePeiCore/PrePeiCore.h          | 1 +
 ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf  | 2 ++
 ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf | 2 ++
 5 files changed, 15 insertions(+)
 diff --git a/ArmPlatformPkg/PrePeiCore/MainMPCore.c b/ArmPlatformPkg/PrePeiCore/MainMPCore.c
 index b5d0d3a644..5126a6dfb0 100644
 --- a/ArmPlatformPkg/PrePeiCore/MainMPCore.c
 +++ b/ArmPlatformPkg/PrePeiCore/MainMPCore.c
@@ -116,6 +116,11 @@ PrimaryMain (
   UINTN                   TemporaryRamBase;
   UINTN                   TemporaryRamSize;
 +  if (FixedPcdGetSize (PcdEarlyHelloMessage) > 1) {
 +    SerialPortWrite (FixedPcdGetPtr (PcdEarlyHelloMessage),
 +      FixedPcdGetSize (PcdEarlyHelloMessage) - 1);
 +  }
 +
   CreatePpiList (&PpiListSize, &PpiList);
   // Enable the GIC Distributor
 diff --git a/ArmPlatformPkg/PrePeiCore/MainUniCore.c b/ArmPlatformPkg/PrePeiCore/MainUniCore.c
 index 1c2580eb92..2a7580dbb4 100644
 --- a/ArmPlatformPkg/PrePeiCore/MainUniCore.c
 +++ b/ArmPlatformPkg/PrePeiCore/MainUniCore.c
@@ -29,6 +29,11 @@ PrimaryMain (
   UINTN                   TemporaryRamBase;
   UINTN                   TemporaryRamSize;
 +  if (FixedPcdGetSize (PcdEarlyHelloMessage) > 1) {
 +    SerialPortWrite (FixedPcdGetPtr (PcdEarlyHelloMessage),
 +      FixedPcdGetSize (PcdEarlyHelloMessage) - 1);
 +  }
 +
   CreatePpiList (&PpiListSize, &PpiList);
   // Adjust the Temporary Ram as the new Ppi List (Common + Platform Ppi Lists) is created at
 diff --git a/ArmPlatformPkg/PrePeiCore/PrePeiCore.h b/ArmPlatformPkg/PrePeiCore/PrePeiCore.h
 index 0345dd7bdd..ae8302becd 100644
 --- a/ArmPlatformPkg/PrePeiCore/PrePeiCore.h
 +++ b/ArmPlatformPkg/PrePeiCore/PrePeiCore.h
@@ -16,6 +16,7 @@
 #include <Library/DebugLib.h>
 #include <Library/IoLib.h>
 #include <Library/PcdLib.h>
 +#include <Library/SerialPortLib.h>
 #include <PiPei.h>
 #include <Ppi/TemporaryRamSupport.h>
 diff --git a/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf b/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf
 index a5b4722459..ea7b220bc8 100644
 --- a/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf
 +++ b/ArmPlatformPkg/PrePeiCore/PrePeiCoreMPCore.inf
@@ -66,6 +66,8 @@
   gArmPlatformTokenSpaceGuid.PcdCPUCorePrimaryStackSize
   gArmPlatformTokenSpaceGuid.PcdCPUCoreSecondaryStackSize
 +  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage
 +
   gArmTokenSpaceGuid.PcdGicDistributorBase
   gArmTokenSpaceGuid.PcdGicInterruptInterfaceBase
   gArmTokenSpaceGuid.PcdGicSgiIntId
 diff --git a/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf b/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
 index 466a2b01c3..29fb8737cb 100644
 --- a/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
 +++ b/ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
@@ -64,4 +64,6 @@
   gArmPlatformTokenSpaceGuid.PcdCPUCorePrimaryStackSize
   gArmPlatformTokenSpaceGuid.PcdCPUCoreSecondaryStackSize
 +  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage
 +
   gEfiMdeModulePkgTokenSpaceGuid.PcdInitValueInTempStack
 -- 
 2.31.1
--- a/SOURCES/0010-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+++ b/SOURCES/0010-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
@ -1,4 +1,4 @@
-From f632bade0de20d4b34eb6225e40c6e4c325bed5c Mon Sep 17 00:00:00 2001
+From 8188ba632ad933a4fe734d3dd715d67dfd12a57f Mon Sep 17 00:00:00 2001
 From: Philippe Mathieu-Daude <philmd@redhat.com>
 Date: Thu, 1 Aug 2019 20:43:48 +0200
 Subject: OvmfPkg: QemuRamfbDxe: Do not report DXE failure on Aarch64 silent
@ -91,5 +91,5 @@ index e3890b8c20..6ffee5acb2 100644
   FrameBufferBltLib
   MemoryAllocationLib
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0011-ArmVirtPkg-set-early-hello-message-RH-only.patch
+++ b/SOURCES/0011-ArmVirtPkg-set-early-hello-message-RH-only.patch
@ -1,82 +0,0 @@
 From 28f12646106e2b2451d0f204b1d24d9c38e1dbfb Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 14 Oct 2015 14:07:17 +0200
 Subject: ArmVirtPkg: set early hello message (RH only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
 - no change
 Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
 RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
 - context difference from upstream commit f5cb3767038e
  ("ArmVirtPkg/ArmVirtQemu: add ResetSystem PEIM for upcoming TPM2
  support", 2020-03-04) automatically resolved correctly
 Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
 RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
 - no change
 Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
 RHEL-8.1/20190308-89910a39dcfd rebase:
 - resolve context conflict with upstream commit eaa1e98ae31d ("ArmVirtPkg:
  don't set PcdCoreCount", 2019-02-13)
 Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
 RHEL-8.0/20180508-ee3198e672e2 rebase:
 - reorder the rebase changelog in the commit message so that it reads like
  a blog: place more recent entries near the top
 - no changes to the patch body
 Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
 - no changes
 Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
 - no changes
 Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
 - no changes
 Print a friendly banner on QEMU, regardless of debug mask settings.
 RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1270279
 Downstream only:
 <http://thread.gmane.org/gmane.comp.bios.edk2.devel/2996/focus=3433>.
 Contributed-under: TianoCore Contribution Agreement 1.0
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit 5d4a15b9019728b2d96322bc679099da49916925)
 (cherry picked from commit 179df76dbb0d199bd905236e98775b4059c6502a)
 (cherry picked from commit ce3f59d0710c24c162d5222bbf5cd7e36180c80c)
 (cherry picked from commit c201a8e6ae28d75f7ba581828b533c3b26fa7f18)
 (cherry picked from commit 2d4db6ec70e004cd9ac147615d17033bee5d3b18)
 (cherry picked from commit fb2032bbea7e02c426855cf86a323556d493fd8a)
 (cherry picked from commit ba73b99d5cb38f87c1a8f0936d515eaaefa3f04b)
 (cherry picked from commit 72550e12ae469012a505bf5b98a6543a754028d3)
 ---
 ArmVirtPkg/ArmVirtQemu.dsc | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
 index 7705bf3919..ae35cc1800 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
@@ -134,6 +134,7 @@
   gArmVirtTokenSpaceGuid.PcdTpm2SupportEnabled|$(TPM2_ENABLE)
 [PcdsFixedAtBuild.common]
 +  gArmPlatformTokenSpaceGuid.PcdEarlyHelloMessage|"UEFI firmware starting.\r\n"
 !if $(ARCH) == AARCH64
   gArmTokenSpaceGuid.PcdVFPEnabled|1
 !endif
 -- 
 2.31.1
--- a/SOURCES/0011-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+++ b/SOURCES/0011-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
@ -1,4 +1,4 @@
-From d832a41efb2d0e199af57fc1c79b750e57978cde Mon Sep 17 00:00:00 2001
+From 6e9df01fd85cfbbb7c27f2a8d31c2ec214649452 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:47 +0100
 Subject: OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in NvmExpressDxe (RH
@ -63,10 +63,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 4 files changed, 16 insertions(+), 4 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index c66ad3af1a..7df6e5c825 100644
+index f5133a801f..05908a7227 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -720,7 +720,10 @@
+@@ -671,7 +671,10 @@
   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@ -79,10 +79,10 @@ index c66ad3af1a..7df6e5c825 100644
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b37a5a6da9..ed6a820d2e 100644
+index 1d271a3bdc..9c0fb7d545 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -823,7 +823,10 @@
+@@ -839,7 +839,10 @@
   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@ -95,10 +95,10 @@ index b37a5a6da9..ed6a820d2e 100644
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index b0e8c20e93..b5be86cff3 100644
+index 240bc43d14..8b93437044 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -837,7 +837,10 @@
+@@ -853,7 +853,10 @@
   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@ -111,10 +111,10 @@ index b0e8c20e93..b5be86cff3 100644
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 6211d5e934..29b45e68e3 100644
+index 7c6faba950..8c9162db17 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -902,7 +902,10 @@
+@@ -921,7 +921,10 @@
   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@ -127,5 +127,5 @@ index 6211d5e934..29b45e68e3 100644
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0012-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
+++ b/SOURCES/0012-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
@ -1,4 +1,4 @@
-From 724b271c0cb45063c3cbe230031091186f623ba8 Mon Sep 17 00:00:00 2001
+From 87d4b94d2ea1896dec43a6e70feeae1aef7a4ce2 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Sat, 16 Nov 2019 17:11:27 +0100
 Subject: CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files in the INFs
@ -131,10 +131,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 2 files changed, 22 insertions(+)
 diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
-index c899b811b1..4a89dc82b6 100644
+index 60c6c24b0a..e446b51e66 100644
 --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
 +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
-@@ -620,6 +620,17 @@
+@@ -575,6 +575,17 @@
   $(OPENSSL_PATH)/ssl/statem/statem.h
   $(OPENSSL_PATH)/ssl/statem/statem_local.h
 # Autogenerated files list ends here
@ -153,10 +153,10 @@ index c899b811b1..4a89dc82b6 100644
   ossl_store.c
   rand_pool.c
 diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-index 0ec3724541..f1cc0aaf9f 100644
+index c4eaea888c..c207dc8f4c 100644
 --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
 +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-@@ -569,6 +569,17 @@
+@@ -525,6 +525,17 @@
   $(OPENSSL_PATH)/crypto/x509v3/standard_exts.h
   $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
 # Autogenerated files list ends here
@ -175,5 +175,5 @@ index 0ec3724541..f1cc0aaf9f 100644
   ossl_store.c
   rand_pool.c
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0013-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
+++ b/SOURCES/0013-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
@ -1,4 +1,4 @@
-From 52f3c8a18f3b38818f0371e3e7207a26dc614006 Mon Sep 17 00:00:00 2001
+From 3a69bf86e6b4a1de6385e0ce9146dc8a0e13e22f Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:31:36 +0200
 Subject: OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no "-kernel" in
@ -79,5 +79,5 @@ index 7b35adb8e0..e0331c6e2c 100644
   MemoryAllocationLib
   QemuFwCfgLib
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0014-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
+++ b/SOURCES/0014-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
@ -1,4 +1,4 @@
-From 83b201c9fa9c8c3bded3b4e8c13de797588fe7bd Mon Sep 17 00:00:00 2001
+From 37930c8079ea630535f82068b678c7ab2f9981a5 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:40:09 +0200
 Subject: SecurityPkg/Tcg2Dxe: suppress error on no swtpm in silent aa64 build
@ -78,5 +78,5 @@ index 7dc7a2683d..3bc8833931 100644
   PrintLib
   UefiLib
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0015-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
+++ b/SOURCES/0015-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
@ -1,4 +1,4 @@
-From 68367bc0cc395bd3d2c45b9d74c65638de39d2d3 Mon Sep 17 00:00:00 2001
+From a53408a224cef3260b12c969c9f8797b85b12f94 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:28:49 +0200
 Subject: OvmfPkg: Remove EbcDxe (RHEL only)
@ -29,10 +29,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 8 files changed, 8 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 7df6e5c825..02c3cf9242 100644
+index 05908a7227..8131d2fae1 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -648,7 +648,6 @@
+@@ -599,7 +599,6 @@
 !include OvmfPkg/OvmfTpmSecurityStub.dsc.inc
   }
@ -41,7 +41,7 @@ index 7df6e5c825..02c3cf9242 100644
   UefiCpuPkg/CpuDxe/CpuDxe.inf
   OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index 844ba8a116..e49125e0e8 100644
+index 4658e1d30e..67b9cdf941 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -205,7 +205,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@ -53,10 +53,10 @@ index 844ba8a116..e49125e0e8 100644
 INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
 INF  OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index ed6a820d2e..d9d9d89d45 100644
+index 9c0fb7d545..8e29e62ea9 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -734,7 +734,6 @@
+@@ -750,7 +750,6 @@
 !include OvmfPkg/OvmfTpmSecurityStub.dsc.inc
   }
@ -65,7 +65,7 @@ index ed6a820d2e..d9d9d89d45 100644
   UefiCpuPkg/CpuDxe/CpuDxe.inf
 !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 69044874e2..209a82f922 100644
+index 7023ade8ce..159995952e 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -216,7 +216,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@ -77,10 +77,10 @@ index 69044874e2..209a82f922 100644
 INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
 !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index b5be86cff3..088461cb3c 100644
+index 8b93437044..c79514e86f 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -748,7 +748,6 @@
+@@ -764,7 +764,6 @@
 !include OvmfPkg/OvmfTpmSecurityStub.dsc.inc
   }
@ -89,7 +89,7 @@ index b5be86cff3..088461cb3c 100644
   UefiCpuPkg/CpuDxe/CpuDxe.inf
 !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index bf535bef42..70eb60b370 100644
+index 80de4fa2c0..334de16a12 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -217,7 +217,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@ -101,10 +101,10 @@ index bf535bef42..70eb60b370 100644
 INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
 !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 29b45e68e3..73455fe8fe 100644
+index 8c9162db17..1daa7e6fe4 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -790,7 +790,6 @@
+@@ -809,7 +809,6 @@
 !endif
   }
@ -113,7 +113,7 @@ index 29b45e68e3..73455fe8fe 100644
   UefiCpuPkg/CpuDxe/CpuDxe.inf {
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 21e4ce00dd..f0bb39f398 100644
+index c0f5a1ef3c..dec53ecdbd 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -239,7 +239,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@ -125,5 +125,5 @@ index 21e4ce00dd..f0bb39f398 100644
 INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0016-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
+++ b/SOURCES/0016-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
@ -1,4 +1,4 @@
-From c7cf2e16a397fdcae2c4d11a706a5a15c79cc569 Mon Sep 17 00:00:00 2001
+From 8c0d639c7ab33c6b31af3c3ddbf0b3086f2f99a6 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:28:59 +0200
 Subject: OvmfPkg: Remove VirtioGpu device driver (RHEL only)
@ -29,10 +29,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 8 files changed, 8 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 02c3cf9242..df78cab21b 100644
+index 8131d2fae1..5f70b3a12f 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -736,7 +736,6 @@
+@@ -687,7 +687,6 @@
     <PcdsFixedAtBuild>
       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
   }
@ -41,7 +41,7 @@ index 02c3cf9242..df78cab21b 100644
   #
   # ISA Support
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index e49125e0e8..d653ed3419 100644
+index 67b9cdf941..7b877446e4 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -298,7 +298,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
@ -53,10 +53,10 @@ index e49125e0e8..d653ed3419 100644
 INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index d9d9d89d45..1a3dc33fbb 100644
+index 8e29e62ea9..49877b613b 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -841,7 +841,6 @@
+@@ -857,7 +857,6 @@
     <PcdsFixedAtBuild>
       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
   }
@ -65,7 +65,7 @@ index d9d9d89d45..1a3dc33fbb 100644
   #
   # ISA Support
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 209a82f922..1e7868ebab 100644
+index 159995952e..306950bd87 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -333,7 +333,6 @@ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
@ -77,10 +77,10 @@ index 209a82f922..1e7868ebab 100644
 INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 088461cb3c..13dab4fcec 100644
+index c79514e86f..d6a2300c7a 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -855,7 +855,6 @@
+@@ -871,7 +871,6 @@
     <PcdsFixedAtBuild>
       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
   }
@ -89,7 +89,7 @@ index 088461cb3c..13dab4fcec 100644
   #
   # ISA Support
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index 70eb60b370..a2f78fb182 100644
+index 334de16a12..88ea4c6b65 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -339,7 +339,6 @@ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
@ -101,10 +101,10 @@ index 70eb60b370..a2f78fb182 100644
 INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 73455fe8fe..a51a765778 100644
+index 1daa7e6fe4..2bc5ae576b 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -920,7 +920,6 @@
+@@ -939,7 +939,6 @@
     <PcdsFixedAtBuild>
       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
   }
@ -113,7 +113,7 @@ index 73455fe8fe..a51a765778 100644
   #
   # ISA Support
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index f0bb39f398..1495565c05 100644
+index dec53ecdbd..608ebdd4d2 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -366,7 +366,6 @@ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
@ -125,5 +125,5 @@ index f0bb39f398..1495565c05 100644
 INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0017-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
+++ b/SOURCES/0017-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
@ -1,4 +1,4 @@
-From 8ee6f680c5c8428ae098898654917b2c88e79f73 Mon Sep 17 00:00:00 2001
+From 1ba8ead93467fad1f2583c1650f28ca039da8405 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:13 +0200
 Subject: OvmfPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
@ -27,10 +27,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 6 files changed, 6 deletions(-)
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 1a3dc33fbb..c2bbc70d25 100644
+index 49877b613b..7550113f51 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -816,7 +816,6 @@
+@@ -832,7 +832,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
@ -39,7 +39,7 @@ index 1a3dc33fbb..c2bbc70d25 100644
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 1e7868ebab..45b624d450 100644
+index 306950bd87..3efa27bbac 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -295,7 +295,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -48,13 +48,13 @@ index 1e7868ebab..45b624d450 100644
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 13dab4fcec..4fd7715442 100644
+index d6a2300c7a..2ef1368945 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -830,7 +830,6 @@
+@@ -846,7 +846,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
@ -63,7 +63,7 @@ index 13dab4fcec..4fd7715442 100644
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index a2f78fb182..449e40dfdd 100644
+index 88ea4c6b65..5b73560782 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -296,7 +296,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -72,13 +72,13 @@ index a2f78fb182..449e40dfdd 100644
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index a51a765778..002399e1ad 100644
+index 2bc5ae576b..c336aca5a6 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -895,7 +895,6 @@
+@@ -914,7 +914,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
@ -87,7 +87,7 @@ index a51a765778..002399e1ad 100644
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 1495565c05..78e7328841 100644
+index 608ebdd4d2..ad98806b32 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -321,7 +321,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -96,8 +96,8 @@ index 1495565c05..78e7328841 100644
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0018-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
+++ b/SOURCES/0018-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
@ -1,4 +1,4 @@
-From 75f939f74828f870ad92ceef9710a9fb8e5002d0 Mon Sep 17 00:00:00 2001
+From 0a0c4645939b55e67817bc2c2880b1de69537279 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:16 +0200
 Subject: ArmVirtPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
@ -24,10 +24,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 3 files changed, 3 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index f30c1e622c..3db71198c5 100644
+index a3d744931a..998d19165f 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -429,7 +429,6 @@
+@@ -455,7 +455,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
@ -36,7 +36,7 @@ index f30c1e622c..3db71198c5 100644
   #
   # Bds
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 7872861330..ddd014ac34 100644
+index e06ca74244..33797ebb95 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -84,7 +84,6 @@ READ_LOCK_STATUS   = TRUE
@ -48,7 +48,7 @@ index 7872861330..ddd014ac34 100644
   #
   # Status Code Routing
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 14f7b29991..65cc8a9aac 100644
+index ff3e6c5974..2c01efc660 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
@@ -358,7 +358,6 @@
@ -60,5 +60,5 @@ index 14f7b29991..65cc8a9aac 100644
   #
   # Bds
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0019-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
+++ b/SOURCES/0019-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
@ -1,4 +1,4 @@
-From 8629f2920b4fc035f1c5d7caed561c2f921d88cf Mon Sep 17 00:00:00 2001
+From 08cad303158596a4c817765bb56e7b9f38138570 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:19 +0200
 Subject: OvmfPkg: Remove UdfDxe filesystem driver (RHEL only)
@ -29,10 +29,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 8 files changed, 8 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index df78cab21b..0c93556798 100644
+index 5f70b3a12f..b3fa4941c5 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -713,7 +713,6 @@
+@@ -664,7 +664,6 @@
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
@ -41,7 +41,7 @@ index df78cab21b..0c93556798 100644
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index d653ed3419..998e517dfb 100644
+index 7b877446e4..1b743cc93f 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -272,7 +272,6 @@ INF  OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf
@ -53,10 +53,10 @@ index d653ed3419..998e517dfb 100644
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index c2bbc70d25..b09350104e 100644
+index 7550113f51..e6a35ba448 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -815,7 +815,6 @@
+@@ -831,7 +831,6 @@
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
@ -65,7 +65,7 @@ index c2bbc70d25..b09350104e 100644
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 45b624d450..b56c749e39 100644
+index 3efa27bbac..1a1b79a157 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -294,7 +294,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
@ -74,13 +74,13 @@ index 45b624d450..b56c749e39 100644
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 -INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 4fd7715442..5b9c221ce7 100644
+index 2ef1368945..17da49369e 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -829,7 +829,6 @@
+@@ -845,7 +845,6 @@
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
@ -89,7 +89,7 @@ index 4fd7715442..5b9c221ce7 100644
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index 449e40dfdd..1b0685bca5 100644
+index 5b73560782..f00a5f729e 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -295,7 +295,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
@ -98,13 +98,13 @@ index 449e40dfdd..1b0685bca5 100644
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 -INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 002399e1ad..11a041afb2 100644
+index c336aca5a6..721519a8e0 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -894,7 +894,6 @@
+@@ -913,7 +913,6 @@
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
@ -113,7 +113,7 @@ index 002399e1ad..11a041afb2 100644
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 78e7328841..5dc09a14fd 100644
+index ad98806b32..4967e984c1 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -320,7 +320,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
@ -122,8 +122,8 @@ index 78e7328841..5dc09a14fd 100644
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 -INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0020-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
+++ b/SOURCES/0020-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
@ -1,4 +1,4 @@
-From bf8a0e72a6916b84086fd37571f8774231104e3e Mon Sep 17 00:00:00 2001
+From 4ba0cc5f6710f7b691583997b3b6fd73b92859f3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:22 +0200
 Subject: ArmVirtPkg: Remove UdfDxe filesystem driver (RHEL only)
@ -24,10 +24,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 3 files changed, 3 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 3db71198c5..4f37a62dca 100644
+index 998d19165f..a4bd72e481 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -428,7 +428,6 @@
+@@ -454,7 +454,6 @@
   MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
@ -36,7 +36,7 @@ index 3db71198c5..4f37a62dca 100644
   #
   # Bds
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index ddd014ac34..6065f4759c 100644
+index 33797ebb95..394253fc23 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -83,7 +83,6 @@ READ_LOCK_STATUS   = TRUE
@ -48,7 +48,7 @@ index ddd014ac34..6065f4759c 100644
   #
   # Status Code Routing
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 65cc8a9aac..868e6e1e24 100644
+index 2c01efc660..7f85b0dc92 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
@@ -357,7 +357,6 @@
@ -60,5 +60,5 @@ index 65cc8a9aac..868e6e1e24 100644
   #
   # Bds
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0021-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
+++ b/SOURCES/0021-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
@ -1,4 +1,4 @@
-From b206b9f1f20b8741c184e55d97cd10475b15affa Mon Sep 17 00:00:00 2001
+From dc4ea27a1f1ceca98eb9cfce086ae03e553cd78d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:25 +0200
 Subject: OvmfPkg: Remove TftpDynamicCommand from shell (RHEL only)
@ -27,13 +27,13 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 6 files changed, 15 deletions(-)
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b09350104e..97837145b2 100644
+index e6a35ba448..b00ef51f2d 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -903,10 +903,6 @@
+@@ -909,10 +909,6 @@
 !endif
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@ -42,25 +42,25 @@ index b09350104e..97837145b2 100644
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index b56c749e39..8599834ac4 100644
+index 1a1b79a157..e4e68e2122 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
-@@ -297,7 +297,6 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
+@@ -296,7 +296,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 5b9c221ce7..699fbc8381 100644
+index 17da49369e..d129a79e33 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -917,10 +917,6 @@
+@@ -923,10 +923,6 @@
 !endif
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@ -69,25 +69,25 @@ index 5b9c221ce7..699fbc8381 100644
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index 1b0685bca5..aab5e2934a 100644
+index f00a5f729e..ef831accf1 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
-@@ -298,7 +298,6 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
+@@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 11a041afb2..3b55dbbb74 100644
+index 721519a8e0..5b40364c47 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -982,10 +982,6 @@
+@@ -991,10 +991,6 @@
 !endif
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@ -96,17 +96,17 @@ index 11a041afb2..3b55dbbb74 100644
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 5dc09a14fd..b02e35fed3 100644
+index 4967e984c1..aeae1650cd 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
-@@ -323,7 +323,6 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
+@@ -322,7 +322,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0022-ArmVirtPkg-Remove-EbcDxe-RHEL-only.patch
+++ b/SOURCES/0022-ArmVirtPkg-Remove-EbcDxe-RHEL-only.patch
@ -1,56 +0,0 @@
 From eb88cf0cc2cf381e2258c69908c6409a0967cf13 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:28:54 +0200
 Subject: ArmVirtPkg: Remove EbcDxe (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [3/19] 5ca7af1a505c16cc568a444398254aca06ca65aa
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 Remove EFI Byte Code interpreter.
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 ArmVirtPkg/ArmVirt.dsc.inc           | 5 -----
 ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 5 -----
 2 files changed, 10 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
 index f15a3f7f06..8ec1119484 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
@@ -420,8 +420,3 @@
     <LibraryClasses>
       NULL|EmbeddedPkg/Library/PlatformHasAcpiLib/PlatformHasAcpiLib.inf
   }
 -
 -  #
 -  # EBC support
 -  #
 -  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 index d4df6dede0..7872861330 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -146,11 +146,6 @@ READ_LOCK_STATUS   = TRUE
   INF MdeModulePkg/Universal/Acpi/AcpiTableDxe/AcpiTableDxe.inf
   INF MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
   INF OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf
 -
 -  #
 -  # EBC support
 -  #
 -  INF MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
 !endif
   #
 -- 
 2.31.1
--- a/SOURCES/0022-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
+++ b/SOURCES/0022-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
@ -1,4 +1,4 @@
-From 4e8100ca78aff2bbdea3614b30ccb1fc4d6759d3 Mon Sep 17 00:00:00 2001
+From a4c198675df3c47c6a7fb62af1065b9a8f9b683a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:28 +0200
 Subject: ArmVirtPkg: Remove TftpDynamicCommand from shell (RHEL only)
@ -23,10 +23,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 2 files changed, 3 insertions(+), 5 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
-index 8ec1119484..fbca3ebd8d 100644
+index 462073517a..39a569e07e 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
-@@ -374,10 +374,9 @@
+@@ -376,10 +376,9 @@
   #
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
@ -41,7 +41,7 @@ index 8ec1119484..fbca3ebd8d 100644
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 6065f4759c..ec5f4c95b1 100644
+index 394253fc23..5ef9f89464 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -98,7 +98,6 @@ READ_LOCK_STATUS   = TRUE
@ -53,5 +53,5 @@ index 6065f4759c..ec5f4c95b1 100644
   INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0023-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
+++ b/SOURCES/0023-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
@ -1,4 +1,4 @@
-From 1c1385ba38640e0c75672e327542b8ff887a4009 Mon Sep 17 00:00:00 2001
+From e99047a0422578ad3572ea12dc7edffd24baf3f3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:31 +0200
 Subject: OvmfPkg: Remove HttpDynamicCommand from shell (RHEL only)
@ -27,13 +27,13 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 6 files changed, 15 deletions(-)
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 97837145b2..4906a6635f 100644
+index b00ef51f2d..43d60df6e3 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -903,10 +903,6 @@
+@@ -909,10 +909,6 @@
 !endif
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@ -42,25 +42,25 @@ index 97837145b2..4906a6635f 100644
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 8599834ac4..edcba6ad30 100644
+index e4e68e2122..5b7c3f7687 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
-@@ -297,7 +297,6 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
+@@ -296,7 +296,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
- INF  ShellPkg/Application/Shell/Shell.inf
+ !if $(BUILD_SHELL) == TRUE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 699fbc8381..d2f37df3cb 100644
+index d129a79e33..56426672b8 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -917,10 +917,6 @@
+@@ -923,10 +923,6 @@
 !endif
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@ -69,25 +69,25 @@ index 699fbc8381..d2f37df3cb 100644
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index aab5e2934a..cb01a23a24 100644
+index ef831accf1..45f5b69171 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
-@@ -298,7 +298,6 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
+@@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
- INF  ShellPkg/Application/Shell/Shell.inf
+ !if $(BUILD_SHELL) == TRUE
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 3b55dbbb74..113aff39c7 100644
+index 5b40364c47..2b4635a71b 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -982,10 +982,6 @@
+@@ -991,10 +991,6 @@
 !endif
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@ -96,17 +96,17 @@ index 3b55dbbb74..113aff39c7 100644
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index b02e35fed3..8e2eeb22ee 100644
+index aeae1650cd..6b20e0946f 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
-@@ -323,7 +323,6 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
+@@ -322,7 +322,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
- INF  ShellPkg/Application/Shell/Shell.inf
+ !if $(BUILD_SHELL) == TRUE
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0024-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
+++ b/SOURCES/0024-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
@ -1,4 +1,4 @@
-From 2b8ed79ba959069e2e11f438dba1973ecda9114a Mon Sep 17 00:00:00 2001
+From f8e271d73e62ca932253b9461657483cc1081807 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:34 +0200
 Subject: ArmVirtPkg: Remove HttpDynamicCommand from shell (RHEL only)
@ -23,10 +23,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 2 files changed, 5 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
-index fbca3ebd8d..e65aa442c2 100644
+index 39a569e07e..49d2ef381c 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
-@@ -377,10 +377,6 @@
+@@ -379,10 +379,6 @@
   #
   # UEFI application (Shell Embedded Boot Loader)
   #
@ -38,7 +38,7 @@ index fbca3ebd8d..e65aa442c2 100644
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index ec5f4c95b1..f2298012ed 100644
+index 5ef9f89464..46978cc76c 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -98,7 +98,6 @@ READ_LOCK_STATUS   = TRUE
@ -50,5 +50,5 @@ index ec5f4c95b1..f2298012ed 100644
   #
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0025-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
+++ b/SOURCES/0025-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
@ -1,4 +1,4 @@
-From 9c6fc3adbd32e137fd6017f3b6cee3bcb822d838 Mon Sep 17 00:00:00 2001
+From ed81dfa142253a7c37824201cf525231b7efcb71 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:39 +0200
 Subject: OvmfPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
@ -34,10 +34,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 8 files changed, 20 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 0c93556798..3a65f7fe88 100644
+index b3fa4941c5..adb051ecea 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -770,10 +770,6 @@
+@@ -721,10 +721,6 @@
   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@ -49,7 +49,7 @@ index 0c93556798..3a65f7fe88 100644
   OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf
   OvmfPkg/AmdSev/Grub/Grub.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index 998e517dfb..e598414343 100644
+index 1b743cc93f..1d55c7815f 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -274,7 +274,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@ -61,86 +61,86 @@ index 998e517dfb..e598414343 100644
 INF OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf
 INF  OvmfPkg/AmdSev/Grub/Grub.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 4906a6635f..f0e398cccd 100644
+index 43d60df6e3..3b86666695 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -903,10 +903,6 @@
+@@ -909,10 +909,6 @@
 !endif
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
 !endif
 !if $(BUILD_SHELL) == TRUE
   ShellPkg/Application/Shell/Shell.inf {
     <LibraryClasses>
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index edcba6ad30..840c79788c 100644
+index 5b7c3f7687..b1f4dbacd7 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
-@@ -297,7 +297,6 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
+@@ -296,7 +296,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 !if $(BUILD_SHELL) == TRUE
 INF  ShellPkg/Application/Shell/Shell.inf
 !endif
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index d2f37df3cb..d8d820aa99 100644
+index 56426672b8..c384425723 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -917,10 +917,6 @@
+@@ -923,10 +923,6 @@
 !endif
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
 !endif
 !if $(BUILD_SHELL) == TRUE
   ShellPkg/Application/Shell/Shell.inf {
     <LibraryClasses>
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index cb01a23a24..37c4d52cc7 100644
+index 45f5b69171..c3dcda85c5 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
-@@ -298,7 +298,6 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
+@@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 !if $(BUILD_SHELL) == TRUE
 INF  ShellPkg/Application/Shell/Shell.inf
 !endif
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 113aff39c7..8781f0c9cf 100644
+index 2b4635a71b..bf372014b9 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -982,10 +982,6 @@
+@@ -991,10 +991,6 @@
 !endif
- !if $(TOOL_CHAIN_TAG) != "XCODE5"
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
 !endif
 !if $(BUILD_SHELL) == TRUE
   ShellPkg/Application/Shell/Shell.inf {
     <LibraryClasses>
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 8e2eeb22ee..fc8954f8a6 100644
+index 6b20e0946f..2fd1d5315a 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
-@@ -323,7 +323,6 @@ INF  FatPkg/EnhancedFatDxe/Fat.inf
+@@ -322,7 +322,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
- !ifndef $(EXCLUDE_SHELL_FROM_FD)
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 !if $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 !if $(BUILD_SHELL) == TRUE
 INF  ShellPkg/Application/Shell/Shell.inf
 !endif
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0026-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
+++ b/SOURCES/0026-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
@ -1,4 +1,4 @@
-From c1839d5fc8723c92bb012a654926576d11b7fa0a Mon Sep 17 00:00:00 2001
+From 2bbe51e3b55e6860d4607c6627866ed6b7c858af Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:46 +0200
 Subject: ArmVirtPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
@ -24,10 +24,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 2 files changed, 5 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
-index e65aa442c2..4cb14fa041 100644
+index 49d2ef381c..1f0f8d44cd 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
-@@ -377,10 +377,6 @@
+@@ -379,10 +379,6 @@
   #
   # UEFI application (Shell Embedded Boot Loader)
   #
@ -39,7 +39,7 @@ index e65aa442c2..4cb14fa041 100644
     <LibraryClasses>
       ShellCommandLib|ShellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.inf
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index f2298012ed..43a4eafae4 100644
+index 46978cc76c..7bcb152c7c 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -98,7 +98,6 @@ READ_LOCK_STATUS   = TRUE
@ -51,5 +51,5 @@ index f2298012ed..43a4eafae4 100644
   #
   # Bds
 -- 
-2.31.1
+2.38.1
--- a/SOURCES/0028-Revert-ArmVirtPkg-make-EFI_LOADER_DATA-non-executabl.patch
+++ b/SOURCES/0028-Revert-ArmVirtPkg-make-EFI_LOADER_DATA-non-executabl.patch
@ -0,0 +1,26 @@
 From 2f497dbe08c4374e02006edb5c2036d7216cd878 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Pawe=C5=82=20Po=C5=82awski?= <ppolawsk@redhat.com>
 Date: Wed, 7 Dec 2022 03:19:20 +0100
 Subject: Revert "ArmVirtPkg: make EFI_LOADER_DATA non-executable"
 This reverts commit 2997ae38739756ecba9b0de19e86032ebc689ef9.
 ---
 ArmVirtPkg/ArmVirt.dsc.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
 index 1f0f8d44cd..65bfbc033f 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
@@ -368,7 +368,7 @@
   # reserved ones, with the exception of LoaderData regions, of which OS loaders
   # (i.e., GRUB) may assume that its contents are executable.
   #
 -  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD5
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdDxeNxMemoryProtectionPolicy|0xC000000000007FD1
 [Components.common]
   #
 -- 
 2.38.1
--- a/SOURCES/0032-Revert-OvmfPkg-PlatformDxe-Handle-all-requests-in-Ex.patch
+++ b/SOURCES/0032-Revert-OvmfPkg-PlatformDxe-Handle-all-requests-in-Ex.patch
@ -0,0 +1,216 @@
 From b6a0dcb7a035aef12e1466fd1017194b9430c948 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 13 Dec 2022 10:31:05 +0100
 Subject: Revert "OvmfPkg/PlatformDxe: Handle all requests in ExtractConfig and
 RouteConfig"
 This reverts commit aefcc91805fd69e4aad4bc08a9f708db11cae5f0.
 Fixes regression, patch breaks setting display resolution via ovmf
 platform config.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
 OvmfPkg/PlatformDxe/Platform.c       | 115 +--------------------------
 OvmfPkg/PlatformDxe/PlatformConfig.c |   2 +-
 OvmfPkg/PlatformDxe/PlatformConfig.h |   2 -
 3 files changed, 3 insertions(+), 116 deletions(-)
 diff --git a/OvmfPkg/PlatformDxe/Platform.c b/OvmfPkg/PlatformDxe/Platform.c
 index ac31fafbdc..4d432f18df 100644
 --- a/OvmfPkg/PlatformDxe/Platform.c
 +++ b/OvmfPkg/PlatformDxe/Platform.c
@@ -108,11 +108,6 @@ STATIC EFI_EVENT  mGopEvent;
 //
 STATIC VOID  *mGopTracker;
 -//
 -// The driver image handle, used to obtain the device path for <ConfigHdr>.
 -//
 -STATIC EFI_HANDLE  mImageHandle;
 -
 //
 // Cache the resolutions we get from the GOP.
 //
@@ -234,10 +229,6 @@ ExtractConfig (
 {
   MAIN_FORM_STATE  MainFormState;
   EFI_STATUS       Status;
 -  EFI_STRING       ConfigRequestHdr;
 -  EFI_STRING       ConfigRequest;
 -  UINTN            Size;
 -  BOOLEAN          AllocatedRequest;
   DEBUG ((DEBUG_VERBOSE, "%a: Request=\"%s\"\n", __FUNCTION__, Request));
@@ -245,73 +236,18 @@ ExtractConfig (
     return EFI_INVALID_PARAMETER;
   }
 -  ConfigRequestHdr = NULL;
 -  ConfigRequest    = NULL;
 -  Size             = 0;
 -  AllocatedRequest = FALSE;
 -
 -  //
 -  // Check if <ConfigHdr> matches the GUID and name
 -  //
 -  *Progress = Request;
 -  if ((Request != NULL) &&
 -      !HiiIsConfigHdrMatch (
 -         Request,
 -         &gOvmfPlatformConfigGuid,
 -         mVariableName
 -         )
 -      )
 -  {
 -    return EFI_NOT_FOUND;
 -  }
 -
   Status = PlatformConfigToFormState (&MainFormState);
   if (EFI_ERROR (Status)) {
 +    *Progress = Request;
     return Status;
   }
 -  if ((Request == NULL) || (StrStr (Request, L"OFFSET") == NULL)) {
 -    //
 -    // Request has no <RequestElement>, so construct full request string.
 -    // Allocate and fill a buffer large enough to hold <ConfigHdr>
 -    // followed by "&OFFSET=0&WIDTH=WWWWWWWWWWWWWWWW" followed by a
 -    // null terminator.
 -    //
 -    ConfigRequestHdr = HiiConstructConfigHdr (
 -                         &gOvmfPlatformConfigGuid,
 -                         mVariableName,
 -                         mImageHandle
 -                         );
 -    if (ConfigRequestHdr == NULL) {
 -      return EFI_OUT_OF_RESOURCES;
 -    }
 -
 -    Size             = (StrLen (ConfigRequestHdr) + 32 + 1) * sizeof (CHAR16);
 -    ConfigRequest    = AllocateZeroPool (Size);
 -    AllocatedRequest = TRUE;
 -    if (ConfigRequest == NULL) {
 -      FreePool (ConfigRequestHdr);
 -      return EFI_OUT_OF_RESOURCES;
 -    }
 -
 -    UnicodeSPrint (
 -      ConfigRequest,
 -      Size,
 -      L"%s&OFFSET=0&WIDTH=%016LX",
 -      ConfigRequestHdr,
 -      sizeof MainFormState
 -      );
 -    FreePool (ConfigRequestHdr);
 -  } else {
 -    ConfigRequest = Request;
 -  }
 -
   //
   // Answer the textual request keying off the binary form state.
   //
   Status = gHiiConfigRouting->BlockToConfig (
                                 gHiiConfigRouting,
 -                                ConfigRequest,
 +                                Request,
                                 (VOID *)&MainFormState,
                                 sizeof MainFormState,
                                 Results,
@@ -329,33 +265,6 @@ ExtractConfig (
     DEBUG ((DEBUG_VERBOSE, "%a: Results=\"%s\"\n", __FUNCTION__, *Results));
   }
 -  //
 -  // If we used a newly allocated ConfigRequest, update Progress to point to
 -  // original Request instead of ConfigRequest.
 -  //
 -  if (Request == NULL) {
 -    *Progress = NULL;
 -  } else if (StrStr (Request, L"OFFSET") == NULL) {
 -    if (EFI_ERROR (Status)) {
 -      //
 -      // Since we constructed ConfigRequest, failure can only occur if there
 -      // is not enough memory. In this case, we point Progress to the first
 -      // character of Request.
 -      //
 -      *Progress = Request;
 -    } else {
 -      //
 -      // In case of success, we point Progress to the null terminator of
 -      // Request.
 -      //
 -      *Progress = Request + StrLen (Request);
 -    }
 -  }
 -
 -  if (AllocatedRequest) {
 -    FreePool (ConfigRequest);
 -  }
 -
   return Status;
 }
@@ -439,21 +348,6 @@ RouteConfig (
     return EFI_INVALID_PARAMETER;
   }
 -  //
 -  // Check if <ConfigHdr> matches the GUID and name
 -  //
 -  *Progress = Configuration;
 -  if ((Configuration != NULL) &&
 -      !HiiIsConfigHdrMatch (
 -         Configuration,
 -         &gOvmfPlatformConfigGuid,
 -         mVariableName
 -         )
 -      )
 -  {
 -    return EFI_NOT_FOUND;
 -  }
 -
   //
   // the "read" step in RMW
   //
@@ -972,11 +866,6 @@ PlatformInit (
     return Status;
   }
 -  //
 -  // Save the driver image handle.
 -  //
 -  mImageHandle = ImageHandle;
 -
   //
   // Publish the HII package list to HII Database.
   //
 diff --git a/OvmfPkg/PlatformDxe/PlatformConfig.c b/OvmfPkg/PlatformDxe/PlatformConfig.c
 index f5ac2d0609..e202ac5b47 100644
 --- a/OvmfPkg/PlatformDxe/PlatformConfig.c
 +++ b/OvmfPkg/PlatformDxe/PlatformConfig.c
@@ -21,7 +21,7 @@
 //
 // Name of the UEFI variable that we use for persistent storage.
 //
 -CHAR16  mVariableName[] = L"PlatformConfig";
 +STATIC CHAR16  mVariableName[] = L"PlatformConfig";
 /**
   Serialize and persistently save platform configuration.
 diff --git a/OvmfPkg/PlatformDxe/PlatformConfig.h b/OvmfPkg/PlatformDxe/PlatformConfig.h
 index 5d9b457b1b..902c9b2ce0 100644
 --- a/OvmfPkg/PlatformDxe/PlatformConfig.h
 +++ b/OvmfPkg/PlatformDxe/PlatformConfig.h
@@ -50,6 +50,4 @@ PlatformConfigLoad (
 #define PLATFORM_CONFIG_F_GRAPHICS_RESOLUTION  BIT0
 #define PLATFORM_CONFIG_F_DOWNGRADE            BIT63
 -extern CHAR16  mVariableName[];
 -
 #endif // _PLATFORM_CONFIG_H_
 -- 
 2.38.1
--- a/SOURCES/0033-OvmfPkg-SmbiosPlatformDxe-use-PcdFirmware.patch
+++ b/SOURCES/0033-OvmfPkg-SmbiosPlatformDxe-use-PcdFirmware.patch
@ -0,0 +1,231 @@
 From 8b2cc30989c009ab72951022bd017143764411b2 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Mon, 28 Nov 2022 13:40:20 +0800
 Subject: OvmfPkg/SmbiosPlatformDxe: use PcdFirmware*
 Instead of using hard-coded strings ("0.0.0" for BiosVersion etc)
 which is mostly useless read the PCDs (PcdFirmwareVendor,
 PcdFirmwareVersionString and PcdFirmwareReleaseDateString) and
 build the string table dynamuically at runtime.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
 (cherry picked from commit 4cb94f20b002c99dd2b4b75f07c5495b81a34ffd)
 https://issues.redhat.com/browse/RHEL-75
 ---
 OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.c | 115 +++++++++++-------
 .../SmbiosPlatformDxe/SmbiosPlatformDxe.inf   |   6 +
 .../XenSmbiosPlatformDxe.inf                  |   9 +-
 3 files changed, 85 insertions(+), 45 deletions(-)
 diff --git a/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.c b/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.c
 index 94249d3ff1..dc1e6aed63 100644
 --- a/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.c
 +++ b/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.c
@@ -9,57 +9,43 @@
 **/
 #include <IndustryStandard/SmBios.h>          // SMBIOS_TABLE_TYPE0
 +#include <Library/BaseLib.h>
 +#include <Library/BaseMemoryLib.h>
 #include <Library/DebugLib.h>                 // ASSERT_EFI_ERROR()
 +#include <Library/MemoryAllocationLib.h>
 +#include <Library/PcdLib.h>
 #include <Library/UefiBootServicesTableLib.h> // gBS
 #include <Protocol/Smbios.h>                  // EFI_SMBIOS_PROTOCOL
 #include "SmbiosPlatformDxe.h"
 -#define TYPE0_STRINGS \
 -  "EFI Development Kit II / OVMF\0"     /* Vendor */ \
 -  "0.0.0\0"                             /* BiosVersion */ \
 -  "02/06/2015\0"                        /* BiosReleaseDate */
 -//
 -// Type definition and contents of the default Type 0 SMBIOS table.
 -//
 -#pragma pack(1)
 -typedef struct {
 -  SMBIOS_TABLE_TYPE0    Base;
 -  UINT8                 Strings[sizeof (TYPE0_STRINGS)];
 -} OVMF_TYPE0;
 -#pragma pack()
 -
 -STATIC CONST OVMF_TYPE0  mOvmfDefaultType0 = {
 +STATIC CONST SMBIOS_TABLE_TYPE0  mOvmfDefaultType0 = {
 +  // SMBIOS_STRUCTURE Hdr
   {
 -    // SMBIOS_STRUCTURE Hdr
 -    {
 -      EFI_SMBIOS_TYPE_BIOS_INFORMATION, // UINT8 Type
 -      sizeof (SMBIOS_TABLE_TYPE0),      // UINT8 Length
 -    },
 -    1,      // SMBIOS_TABLE_STRING       Vendor
 -    2,      // SMBIOS_TABLE_STRING       BiosVersion
 -    0xE800, // UINT16                    BiosSegment
 -    3,      // SMBIOS_TABLE_STRING       BiosReleaseDate
 -    0,      // UINT8                     BiosSize
 -    {      // MISC_BIOS_CHARACTERISTICS BiosCharacteristics
 -      0,   // Reserved                                      :2
 -      0,   // Unknown                                       :1
 -      1,   // BiosCharacteristicsNotSupported               :1
 -           // Remaining BiosCharacteristics bits left unset :60
 -    },
 -    {      // BIOSCharacteristicsExtensionBytes[2]
 -      0,   // BiosReserved
 -      0x1C // SystemReserved = VirtualMachineSupported |
 -           //                  UefiSpecificationSupported |
 -           //                  TargetContentDistributionEnabled
 -    },
 -    0,     // UINT8                     SystemBiosMajorRelease
 -    0,     // UINT8                     SystemBiosMinorRelease
 -    0xFF,  // UINT8                     EmbeddedControllerFirmwareMajorRelease
 -    0xFF   // UINT8                     EmbeddedControllerFirmwareMinorRelease
 +    EFI_SMBIOS_TYPE_BIOS_INFORMATION, // UINT8 Type
 +    sizeof (SMBIOS_TABLE_TYPE0),      // UINT8 Length
   },
 -  // Text strings (unformatted area)
 -  TYPE0_STRINGS
 +  1,      // SMBIOS_TABLE_STRING       Vendor
 +  2,      // SMBIOS_TABLE_STRING       BiosVersion
 +  0xE800, // UINT16                    BiosSegment
 +  3,      // SMBIOS_TABLE_STRING       BiosReleaseDate
 +  0,      // UINT8                     BiosSize
 +  {      // MISC_BIOS_CHARACTERISTICS BiosCharacteristics
 +    0,   // Reserved                                      :2
 +    0,   // Unknown                                       :1
 +    1,   // BiosCharacteristicsNotSupported               :1
 +    // Remaining BiosCharacteristics bits left unset :60
 +  },
 +  {      // BIOSCharacteristicsExtensionBytes[2]
 +    0,   // BiosReserved
 +    0x1C // SystemReserved = VirtualMachineSupported |
 +    //                  UefiSpecificationSupported |
 +    //                  TargetContentDistributionEnabled
 +  },
 +  0,     // UINT8                     SystemBiosMajorRelease
 +  0,     // UINT8                     SystemBiosMinorRelease
 +  0xFF,  // UINT8                     EmbeddedControllerFirmwareMajorRelease
 +  0xFF   // UINT8                     EmbeddedControllerFirmwareMinorRelease
 };
 /**
@@ -153,14 +139,55 @@ InstallAllStructures (
     //
     // Add OVMF default Type 0 (BIOS Information) table
     //
 +    CHAR16  *VendStr, *VersStr, *DateStr;
 +    UINTN   VendLen, VersLen, DateLen;
 +    CHAR8   *Type0;
 +
 +    VendStr = (CHAR16 *)FixedPcdGetPtr (PcdFirmwareVendor);
 +    VendLen = StrLen (VendStr);
 +    if (VendLen < 3) {
 +      VendStr = L"unknown";
 +      VendLen = StrLen (VendStr);
 +    }
 +
 +    VersStr = (CHAR16 *)FixedPcdGetPtr (PcdFirmwareVersionString);
 +    VersLen = StrLen (VersStr);
 +    if (VersLen < 3) {
 +      VersStr = L"unknown";
 +      VersLen = StrLen (VersStr);
 +    }
 +
 +    DateStr = (CHAR16 *)FixedPcdGetPtr (PcdFirmwareReleaseDateString);
 +    DateLen = StrLen (DateStr);
 +    if (DateLen < 3) {
 +      DateStr = L"unknown";
 +      DateLen = StrLen (DateStr);
 +    }
 +
 +    DEBUG ((DEBUG_INFO, "FirmwareVendor:            \"%s\" (%d chars)\n", VendStr, VendLen));
 +    DEBUG ((DEBUG_INFO, "FirmwareVersionString:     \"%s\" (%d chars)\n", VersStr, VersLen));
 +    DEBUG ((DEBUG_INFO, "FirmwareReleaseDateString: \"%s\" (%d chars)\n", DateStr, DateLen));
 +
 +    Type0 = AllocateZeroPool (sizeof (mOvmfDefaultType0) + VendLen + VersLen + DateLen + 4);
 +    if (Type0 == NULL) {
 +      return EFI_OUT_OF_RESOURCES;
 +    }
 +
 +    CopyMem (Type0, &mOvmfDefaultType0, sizeof (mOvmfDefaultType0));
 +    UnicodeStrToAsciiStrS (VendStr, Type0 + sizeof (mOvmfDefaultType0), VendLen + 1);
 +    UnicodeStrToAsciiStrS (VersStr, Type0 + sizeof (mOvmfDefaultType0) + VendLen + 1, VersLen + 1);
 +    UnicodeStrToAsciiStrS (DateStr, Type0 + sizeof (mOvmfDefaultType0) + VendLen + VersLen + 2, DateLen + 1);
 +
     SmbiosHandle = SMBIOS_HANDLE_PI_RESERVED;
     Status       = Smbios->Add (
                              Smbios,
                              NULL,
                              &SmbiosHandle,
 -                             (EFI_SMBIOS_TABLE_HEADER *)&mOvmfDefaultType0
 +                             (EFI_SMBIOS_TABLE_HEADER *)Type0
                              );
     ASSERT_EFI_ERROR (Status);
 +
 +    FreePool (Type0);
   }
   return EFI_SUCCESS;
 diff --git a/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.inf b/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.inf
 index 0066bbc922..52689c96e5 100644
 --- a/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.inf
 +++ b/OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.inf
@@ -32,9 +32,12 @@
 [Packages]
   MdePkg/MdePkg.dec
 +  MdeModulePkg/MdeModulePkg.dec
   OvmfPkg/OvmfPkg.dec
 [LibraryClasses]
 +  BaseLib
 +  BaseMemoryLib
   DebugLib
   MemoryAllocationLib
   PcdLib
@@ -45,6 +48,9 @@
 [Pcd]
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId
   gUefiOvmfPkgTokenSpaceGuid.PcdQemuSmbiosValidated
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVendor
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVersionString
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareReleaseDateString
 [Protocols]
   gEfiSmbiosProtocolGuid                      # PROTOCOL ALWAYS_CONSUMED
 diff --git a/OvmfPkg/SmbiosPlatformDxe/XenSmbiosPlatformDxe.inf b/OvmfPkg/SmbiosPlatformDxe/XenSmbiosPlatformDxe.inf
 index 7f4588e33d..e646c88741 100644
 --- a/OvmfPkg/SmbiosPlatformDxe/XenSmbiosPlatformDxe.inf
 +++ b/OvmfPkg/SmbiosPlatformDxe/XenSmbiosPlatformDxe.inf
@@ -38,19 +38,26 @@
 [Packages]
   MdePkg/MdePkg.dec
 +  MdeModulePkg/MdeModulePkg.dec
 [Packages.IA32, Packages.X64]
   OvmfPkg/OvmfPkg.dec
 [LibraryClasses]
 +  BaseLib
 +  BaseMemoryLib
   DebugLib
   UefiBootServicesTableLib
   UefiDriverEntryPoint
 [LibraryClasses.IA32, LibraryClasses.X64]
 -  BaseLib
   HobLib
 +[Pcd]
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVendor
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareVersionString
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareReleaseDateString
 +
 [Protocols]
   gEfiSmbiosProtocolGuid                      # PROTOCOL ALWAYS_CONSUMED
 -- 
 2.38.1
--- a/SOURCES/30-edk2-ovmf-x64-sb-enrolled.json
+++ b/SOURCES/30-edk2-ovmf-x64-sb-enrolled.json
@ -24,7 +24,6 @@
    ],
    "features": [
        "acpi-s3",
        "amd-sev",
        "enrolled-keys",
        "requires-smm",
        "secure-boot",
--- a/SOURCES/40-edk2-ovmf-x64-sb.json
+++ b/SOURCES/40-edk2-ovmf-x64-sb.json
@ -24,7 +24,6 @@
    ],
    "features": [
        "acpi-s3",
        "amd-sev",
        "requires-smm",
        "secure-boot",
        "verbose-dynamic"
--- a/SOURCES/50-edk2-aarch64.json
+++ b/SOURCES/50-edk2-aarch64.json
--- a/SOURCES/50-edk2-ovmf-x64-nosb.json
+++ b/SOURCES/50-edk2-ovmf-x64-nosb.json
@ -1,12 +1,12 @@
 {
-    "description": "OVMF with SEV-ES support",
+    "description": "OVMF without SB+SMM, empty varstore",
    "interface-types": [
        "uefi"
    ],
    "mapping": {
        "device": "flash",
        "executable": {
-            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.cc.fd",
+            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.fd",
            "format": "raw"
        },
        "nvram-template": {
@ -18,13 +18,12 @@
        {
            "architecture": "x86_64",
            "machines": [
-                "pc-q35-rhel8.5.0",
+                "pc-q35-*"
                "pc-q35-rhel8.6.0",
                "pc-q35-rhel9.*"
            ]
        }
    ],
    "features": [
        "acpi-s3",
        "amd-sev",
        "amd-sev-es",
        "verbose-dynamic"
--- a/SOURCES/51-edk2-aarch64-verbose.json
+++ b/SOURCES/51-edk2-aarch64-verbose.json
--- a/SOURCES/60-edk2-ovmf-x64-amdsev.json
+++ b/SOURCES/60-edk2-ovmf-x64-amdsev.json
@ -15,15 +15,14 @@
        {
            "architecture": "x86_64",
            "machines": [
-                "pc-q35-rhel8.5.0",
+                "pc-q35-*"
                "pc-q35-rhel8.6.0",
                "pc-q35-rhel9.*"
            ]
        }
    ],
    "features": [
        "amd-sev",
        "amd-sev-es",
        "amd-sev-snp",
        "verbose-dynamic"
    ],
    "tags": [
--- a/SOURCES/60-edk2-ovmf-x64-inteltdx.json
+++ b/SOURCES/60-edk2-ovmf-x64-inteltdx.json
@ -0,0 +1,29 @@
 {
    "description": "OVMF with TDX support",
    "interface-types": [
        "uefi"
    ],
    "mapping": {
        "device": "flash",
        "mode": "stateless",
        "executable": {
            "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.fd",
            "format": "raw"
        }
    },
    "targets": [
        {
            "architecture": "x86_64",
            "machines": [
                "pc-q35-*"
            ]
        }
    ],
    "features": [
        "intel-tdx",
        "verbose-dynamic"
    ],
    "tags": [
    ]
 }
--- a/SOURCES/LICENSE.qosb
+++ b/SOURCES/LICENSE.qosb
@ -1,21 +0,0 @@
 MIT License
 Copyright (c) 2017 Patrick Uiterwijk
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
--- a/SOURCES/RedHatSecureBootPkKek1.pem
+++ b/SOURCES/RedHatSecureBootPkKek1.pem
@ -1,22 +0,0 @@
 -----BEGIN CERTIFICATE-----
 MIIDoDCCAoigAwIBAgIJAP71iOjzlsDxMA0GCSqGSIb3DQEBCwUAMFExKzApBgNV
 BAMTIlJlZCBIYXQgU2VjdXJlIEJvb3QgKFBLL0tFSyBrZXkgMSkxIjAgBgkqhkiG
 9w0BCQEWE3NlY2FsZXJ0QHJlZGhhdC5jb20wHhcNMTQxMDMxMTExNTM3WhcNMzcx
 MDI1MTExNTM3WjBRMSswKQYDVQQDEyJSZWQgSGF0IFNlY3VyZSBCb290IChQSy9L
 RUsga2V5IDEpMSIwIAYJKoZIhvcNAQkBFhNzZWNhbGVydEByZWRoYXQuY29tMIIB
 IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkB+Ee42865cmgm2Iq4rJjGhw
 +d9LB7I3gwsCyGdoMJ7j8PCZSrhZV8ZB9jiL/mZMSek3N5IumAEeWxRQ5qiNJQ31
 huarMMtAFuqNixaGcEM38s7Akd9xFI6ZDom2TG0kHozkL08l0LoG+MboGRh2cx2B
 bajYBc86yHsoyDajFg0pjJmaaNyrwE2Nv1q7K6k5SwSXHPk2u8U6hgSur9SCe+Cr
 3kkFaPz2rmgabJBNVxk8ZGYD9sdSm/eUz5NqoWjJqs+Za7yqXgjnORz3+A+6Bn7x
 y+h23f4i2q06Xls06rPJ4E0EKX64YLkF77XZF1hWFmC5MDLwNkrD8nmNEkBw8wID
 AQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVy
 YXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUPOlg4/8ZoQp7o0L0jUIutNWccuww
 HwYDVR0jBBgwFoAUPOlg4/8ZoQp7o0L0jUIutNWccuwwDQYJKoZIhvcNAQELBQAD
 ggEBAFxNkoi0gl8drYsR7N8GpnqlK583VQyNbgUArbcMQYlpz9ZlBptReNKtx7+c
 3AVzf+ceORO06rYwfUB1q5xDC9+wwhu/MOD0/sDbYiGY9sWv3jtPSQrmHvmGsD8N
 1tRGN9tUdF7/EcJgxnBYxRxv7LLYbm/DvDOHOKTzRGScNDsolCZ4J58WF+g7aQol
 qXM2fp43XOzoP9uR+RKzPc7n3RXDrowFIGGbld6br/qxXBzll+fDNBGF9YonJqRw
 NuwM9oM9kPc28/nzFdSQYr5TtK/TSa/v9HPoe3bkRCo3uoGkmQw6MSRxoOTktxrL
 R+SqIs/vdWGA40O3SFdzET14m2k=
 -----END CERTIFICATE-----
--- a/SOURCES/edk2-ArmVirt-don-t-use-unaligned-CopyMem-on-NOR-flash.patch
+++ b/SOURCES/edk2-ArmVirt-don-t-use-unaligned-CopyMem-on-NOR-flash.patch
@ -0,0 +1,86 @@
 From f6d83cd74def6af6ab27ddda15112cdf59c853d5 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Mon, 16 Jan 2023 10:46:39 +0100
 Subject: [PATCH] ArmVirt: don't use unaligned CopyMem () on NOR flash
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 23: ArmVirt: don't use unaligned CopyMem () on NOR flash
 RH-Bugzilla: 2158173
 RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
 RH-Commit: [1/1] 7c8b7e5cd9c239dd8d040450bd4d479ef789114b (kraxel/centos-edk2)
 Commit 789a72328553 reclassified the NOR flash region as EFI_MEMORY_WC
 in the OS visible EFI memory map, and dropped the explicit aligned
 CopyMem() implementation, in the assumption that EFI_MEMORY_WC will be
 honored by the OS, and that the region will be mapped in a way that
 tolerates misaligned accesseses. However, Linux today uses device
 attributes for all EFI MMIO regions, in spite of the memory type
 attributes, and so using misaligned accesses is never safe.
 So instead, switch to the generic CopyMem() implementation entirely,
 just like we already did for VariableRuntimeDxe.
 Fixes: 789a72328553 ("OvmfPkg/VirtNorFlashDxe: use EFI_MEMORY_WC and drop AlignedCopyMem()")
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
 (cherry picked from commit 987cc09c7cf38d628063062483e2341fba679b0e)
 ---
 ArmVirtPkg/ArmVirtKvmTool.dsc    | 6 +++++-
 ArmVirtPkg/ArmVirtQemu.dsc       | 6 +++++-
 ArmVirtPkg/ArmVirtQemuKernel.dsc | 6 +++++-
 3 files changed, 15 insertions(+), 3 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirtKvmTool.dsc b/ArmVirtPkg/ArmVirtKvmTool.dsc
 index 2ba00bd08f..d0afe1b49e 100644
 --- a/ArmVirtPkg/ArmVirtKvmTool.dsc
 +++ b/ArmVirtPkg/ArmVirtKvmTool.dsc
@@ -296,7 +296,11 @@
       NULL|ArmVirtPkg/Library/ArmVirtTimerFdtClientLib/ArmVirtTimerFdtClientLib.inf
   }
 -  OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
 +  OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf {
 +    <LibraryClasses>
 +      # don't use unaligned CopyMem () on the UEFI varstore NOR flash region
 +      BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
 +  }
   MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
 index a4bd72e481..76389e6bd4 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
@@ -428,7 +428,11 @@
     <LibraryClasses>
       NULL|ArmVirtPkg/Library/ArmVirtTimerFdtClientLib/ArmVirtTimerFdtClientLib.inf
   }
 -  OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
 +  OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf {
 +    <LibraryClasses>
 +      # don't use unaligned CopyMem () on the UEFI varstore NOR flash region
 +      BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
 +  }
   MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
   #
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
 index 7f85b0dc92..0445a89b1c 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
@@ -331,7 +331,11 @@
     <LibraryClasses>
       NULL|ArmVirtPkg/Library/ArmVirtTimerFdtClientLib/ArmVirtTimerFdtClientLib.inf
   }
 -  OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
 +  OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf {
 +    <LibraryClasses>
 +      # don't use unaligned CopyMem () on the UEFI varstore NOR flash region
 +      BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
 +  }
   MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
   #
 -- 
 2.31.1
--- a/SOURCES/edk2-MdePkg-Remove-Itanium-leftover-data-structure-RH-onl.patch
+++ b/SOURCES/edk2-MdePkg-Remove-Itanium-leftover-data-structure-RH-onl.patch
@ -0,0 +1,97 @@
 From 0517c19dff1e3fd8e16a38533d39e4b9bd32f54e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Pawe=C5=82=20Po=C5=82awski?= <ppolawsk@redhat.com>
 Date: Tue, 15 Nov 2022 01:02:51 +0100
 Subject: [PATCH 2/2] MdePkg: Remove Itanium leftover data structure (RH only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Pawel Polawski <ppolawsk@redhat.com>
 RH-MergeRequest: 22: MdePkg: Remove Itanium leftover data structure (RH only)
 RH-Bugzilla: 1983086
 RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
 RH-Commit: [1/1] d7f46e0657016668a3c00309ed1d95aea7c55c97
 Itanium support has been removed from EDK2 aroun 2019.
 ITANIUM_HANDOFF_STATUS data structure looks to be
 some leftover from that process.
 There is also positive sidefect of this data structure removal.
 Due to HOB allocation type used in PEI stage there is a limit
 how much data about virtual CPU can be hold. This limit result
 in only 1024 vCPU can be used by VM.
 With Itanium related data structure removed more allocated space
 can be used for vCPU data and with current allocation limit
 will change from 1024 to around 8k vCPUs.
 Signed-off-by: Paweł Poławski <ppolawsk@redhat.com>
 ---
 MdePkg/Include/Ppi/SecPlatformInformation.h | 44 ---------------------
 1 file changed, 44 deletions(-)
 diff --git a/MdePkg/Include/Ppi/SecPlatformInformation.h b/MdePkg/Include/Ppi/SecPlatformInformation.h
 index 02b0711f18..fbcd205acd 100644
 --- a/MdePkg/Include/Ppi/SecPlatformInformation.h
 +++ b/MdePkg/Include/Ppi/SecPlatformInformation.h
@@ -84,49 +84,6 @@ typedef union {
 typedef EFI_HEALTH_FLAGS X64_HANDOFF_STATUS;
 typedef EFI_HEALTH_FLAGS IA32_HANDOFF_STATUS;
 -///
 -/// The hand-off status structure for Itanium architecture.
 -///
 -typedef struct {
 -  ///
 -  /// SALE_ENTRY state : 3 = Recovery_Check
 -  /// and 0 = RESET or Normal_Boot phase.
 -  ///
 -  UINT8     BootPhase;
 -  ///
 -  /// Firmware status on entry to SALE.
 -  ///
 -  UINT8     FWStatus;
 -  UINT16    Reserved1;
 -  UINT32    Reserved2;
 -  ///
 -  /// Geographically significant unique processor ID assigned by PAL.
 -  ///
 -  UINT16    ProcId;
 -  UINT16    Reserved3;
 -  UINT8     IdMask;
 -  UINT8     EidMask;
 -  UINT16    Reserved4;
 -  ///
 -  /// Address to make PAL calls.
 -  ///
 -  UINT64    PalCallAddress;
 -  ///
 -  /// If the entry state is RECOVERY_CHECK, this contains the PAL_RESET
 -  /// return address, and if entry state is RESET, this contains
 -  /// address for PAL_authentication call.
 -  ///
 -  UINT64    PalSpecialAddress;
 -  ///
 -  /// GR35 from PALE_EXIT state.
 -  ///
 -  UINT64    SelfTestStatus;
 -  ///
 -  /// GR37 from PALE_EXIT state.
 -  ///
 -  UINT64    SelfTestControl;
 -  UINT64    MemoryBufferRequired;
 -} ITANIUM_HANDOFF_STATUS;
 ///
 /// EFI_SEC_PLATFORM_INFORMATION_RECORD.
@@ -134,7 +91,6 @@ typedef struct {
 typedef union {
   IA32_HANDOFF_STATUS       IA32HealthFlags;
   X64_HANDOFF_STATUS        x64HealthFlags;
 -  ITANIUM_HANDOFF_STATUS    ItaniumHealthFlags;
 } EFI_SEC_PLATFORM_INFORMATION_RECORD;
 /**
 -- 
 2.31.1
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch
@ -0,0 +1,67 @@
 From a7e155d9d0be18b9db31dd7135e9da2bc955e6b4 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Wed, 11 Jan 2023 19:00:23 +0100
 Subject: [PATCH 1/2] OvmfPkg/VirtNorFlashDxe: map flash memory as uncacheable
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 21: OvmfPkg/VirtNorFlashDxe: map flash memory as uncacheable
 RH-Bugzilla: 2158173
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
 RH-Commit: [1/1] 819cd72096fa9f253eef7b532122183b608c0064 (kraxel/centos-edk2)
 Switching from the ArmPlatformPkg/NorFlashDxe driver to the
 OvmfPkg/VirtNorFlashDxe driver had the side effect that flash address
 space got registered as EFI_MEMORY_WC instead of EFI_MEMORY_UC.
 That confuses the linux kernel's numa code, seems this makes kernel
 consider the flash being node memory.  "lsmem" changes from ...
    RANGE                                 SIZE  STATE REMOVABLE BLOCK
    0x0000000040000000-0x000000013fffffff   4G online       yes  8-39
 ... to ...
    RANGE                                  SIZE  STATE REMOVABLE BLOCK
    0x0000000000000000-0x0000000007ffffff  128M online       yes     0
    0x0000000040000000-0x000000013fffffff    4G online       yes  8-39
 ... and in the kernel log got new error lines:
    NUMA: Warning: invalid memblk node 512 [mem 0x0000000004000000-0x0000000007ffffff]
    NUMA: Faking a node at [mem 0x0000000004000000-0x000000013fffffff]
 Changing the attributes back to EFI_MEMORY_UC fixes this.
 Fixes: b92298af8218 ("ArmVirtPkg/ArmVirtQemu: migrate to OVMF's VirtNorFlashDxe")
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
 (cherry picked from commit e5ec3ba409b5baa9cf429cc25fdf3c8d1b8dcef0)
 ---
 OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
 index ff3121af2a..f9a41f6aab 100644
 --- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
 +++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
@@ -394,14 +394,14 @@ NorFlashFvbInitialize (
                   EfiGcdMemoryTypeMemoryMappedIo,
                   Instance->DeviceBaseAddress,
                   RuntimeMmioRegionSize,
 -                  EFI_MEMORY_WC | EFI_MEMORY_RUNTIME
 +                  EFI_MEMORY_UC | EFI_MEMORY_RUNTIME
                   );
   ASSERT_EFI_ERROR (Status);
   Status = gDS->SetMemorySpaceAttributes (
                   Instance->DeviceBaseAddress,
                   RuntimeMmioRegionSize,
 -                  EFI_MEMORY_WC | EFI_MEMORY_RUNTIME
 +                  EFI_MEMORY_UC | EFI_MEMORY_RUNTIME
                   );
   ASSERT_EFI_ERROR (Status);
 -- 
 2.31.1
--- a/SOURCES/edk2-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch
+++ b/SOURCES/edk2-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch
@ -0,0 +1,33 @@
 From 5722005baa03df51b9376f05274981524e513d93 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Thu, 2 Mar 2023 12:01:36 +0100
 Subject: [PATCH] OvmfPkg: disable dynamic mmio window (rhel only)
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 29: OvmfPkg: disable dynamic mmio window (rhel only)
 RH-Bugzilla: 2174605
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [1/1] a1faf2d01025e5f5be7dbc29af1b0b57631d6230 (kraxel/centos-edk2)
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
 OvmfPkg/Library/PlatformInitLib/MemDetect.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
 index b8feae4309..55e02417e4 100644
 --- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
 +++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
@@ -617,7 +617,8 @@ PlatformDynamicMmioWindow (
   AddrSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth);
   MmioSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth - 3);
 -  if ((PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
 +  if (FALSE /* disable for RHEL-9.2, libvirt is not ready yet */ &&
 +      (PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
       (PlatformInfoHob->PcdPciMmio64Base + MmioSpace < AddrSpace))
   {
     DEBUG ((DEBUG_INFO, "%a: using dynamic mmio window\n", __func__));
 -- 
 2.39.1
--- a/SOURCES/edk2-Revert-ArmVirtPkg-ArmVirtQemu-enable-initial-ID-map-.patch
+++ b/SOURCES/edk2-Revert-ArmVirtPkg-ArmVirtQemu-enable-initial-ID-map-.patch
@ -0,0 +1,95 @@
 From fc45137e55e73a3ba59fd28868e24521a28a9a6e Mon Sep 17 00:00:00 2001
 From: Oliver Steffen <osteffen@redhat.com>
 Date: Tue, 31 Jan 2023 15:32:28 +0100
 Subject: [PATCH] Revert "ArmVirtPkg/ArmVirtQemu: enable initial ID map at
 early boot"
 RH-Author: Oliver Steffen <osteffen@redhat.com>
 RH-MergeRequest: 25: Revert "ArmVirtPkg/ArmVirtQemu: enable initial ID map at early boot"
 RH-Bugzilla: 2157656
 RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/1] b236b89984f7b7890089ba65228073ab79063b34 (osteffen/edk2)
 This reverts commit 07be1d34d95460a238fcd0f6693efb747c28b329,
 which causes the firmware to crash early on AARCH64.
 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2157656
 There is a potential fix upstream:
 https://github.com/tianocore/edk2/pull/3878/commits
 We need to reevaluate on the next rebase if the fix works and if we can
 drop this revert-comment.
 Signed-off-by: Oliver Steffen <osteffen@redhat.com>
 ---
 ArmVirtPkg/ArmVirtQemu.dsc | 17 +++--------------
 ArmVirtPkg/ArmVirtQemu.fdf |  2 +-
 2 files changed, 4 insertions(+), 15 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
 index 76389e6bd4..3bf51b09aa 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
@@ -64,6 +64,8 @@
   QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFwCfgSimpleParserLib.inf
   QemuLoadImageLib|OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoadImageLib.inf
 +  ArmPlatformLib|ArmPlatformPkg/Library/ArmPlatformLibNull/ArmPlatformLibNull.inf
 +
   TimerLib|ArmPkg/Library/ArmArchTimerLib/ArmArchTimerLib.inf
   VirtNorFlashPlatformLib|ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.inf
@@ -91,12 +93,6 @@
   TpmPlatformHierarchyLib|SecurityPkg/Library/PeiDxeTpmPlatformHierarchyLibNull/PeiDxeTpmPlatformHierarchyLib.inf
 !endif
 -[LibraryClasses.AARCH64]
 -  ArmPlatformLib|ArmVirtPkg/Library/ArmPlatformLibQemu/ArmPlatformLibQemu.inf
 -
 -[LibraryClasses.ARM]
 -  ArmPlatformLib|ArmPlatformPkg/Library/ArmPlatformLibNull/ArmPlatformLibNull.inf
 -
 [LibraryClasses.common.PEIM]
   ArmVirtMemInfoLib|ArmVirtPkg/Library/QemuVirtMemInfoLib/QemuVirtMemInfoPeiLib.inf
@@ -117,8 +113,6 @@
   UefiScsiLib|MdePkg/Library/UefiScsiLib/UefiScsiLib.inf
 [BuildOptions]
 -  GCC:*_*_AARCH64_CC_XIPFLAGS ==
 -
 !include NetworkPkg/NetworkBuildOptions.dsc.inc
 ################################################################################
@@ -330,12 +324,7 @@
   ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
   MdeModulePkg/Core/Pei/PeiMain.inf
   ArmPlatformPkg/PlatformPei/PlatformPeim.inf
 -  ArmVirtPkg/MemoryInitPei/MemoryInitPeim.inf {
 -    <LibraryClasses>
 -!if $(ARCH) == AARCH64
 -      ArmMmuLib|ArmPkg/Library/ArmMmuLib/ArmMmuPeiLib.inf
 -!endif
 -  }
 +  ArmPlatformPkg/MemoryInitPei/MemoryInitPeim.inf
   ArmPkg/Drivers/CpuPei/CpuPei.inf
 !if $(TPM2_ENABLE) == TRUE
 diff --git a/ArmVirtPkg/ArmVirtQemu.fdf b/ArmVirtPkg/ArmVirtQemu.fdf
 index 764f652afd..c61ed36d89 100644
 --- a/ArmVirtPkg/ArmVirtQemu.fdf
 +++ b/ArmVirtPkg/ArmVirtQemu.fdf
@@ -107,7 +107,7 @@ READ_LOCK_STATUS   = TRUE
   INF ArmPlatformPkg/PrePeiCore/PrePeiCoreUniCore.inf
   INF MdeModulePkg/Core/Pei/PeiMain.inf
   INF ArmPlatformPkg/PlatformPei/PlatformPeim.inf
 -  INF ArmVirtPkg/MemoryInitPei/MemoryInitPeim.inf
 +  INF ArmPlatformPkg/MemoryInitPei/MemoryInitPeim.inf
   INF ArmPkg/Drivers/CpuPei/CpuPei.inf
   INF MdeModulePkg/Core/DxeIplPeim/DxeIpl.inf
 -- 
 2.31.1
--- a/SOURCES/edk2-Revert-MdeModulePkg-TerminalDxe-add-other-text-resol.patch
+++ b/SOURCES/edk2-Revert-MdeModulePkg-TerminalDxe-add-other-text-resol.patch
@ -0,0 +1,72 @@
 From ca0c903fb6d028d679e7afef22d70914ad920212 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 14 Feb 2023 12:48:06 +0100
 Subject: [PATCH] Revert "MdeModulePkg: TerminalDxe: add other text resolutions
 (RHEL only)"
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 28: Revert "MdeModulePkg: TerminalDxe: add other text resolutions (RHEL only)"
 RH-Bugzilla: 2162307
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [1/1] aa3432ccf8e01b9e9058fe82a6a22c28137b8b4c (kraxel/centos-edk2)
 This reverts commit cef6b69ea8f009aeba50b2f4b69889f9500fa585.
 ---
 .../Universal/Console/TerminalDxe/Terminal.c  | 41 ++-----------------
 1 file changed, 3 insertions(+), 38 deletions(-)
 diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.c b/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.c
 index dfd9c96773..e2d779c783 100644
 --- a/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.c
 +++ b/MdeModulePkg/Universal/Console/TerminalDxe/Terminal.c
@@ -112,44 +112,9 @@ TERMINAL_DEV  mTerminalDevTemplate = {
 };
 TERMINAL_CONSOLE_MODE_DATA  mTerminalConsoleModeData[] = {
 -  {   80,  25 }, // from graphics resolution  640 x  480
 -  {   80,  50 }, // from graphics resolution  640 x  960
 -  {  100,  25 }, // from graphics resolution  800 x  480
 -  {  100,  31 }, // from graphics resolution  800 x  600
 -  {  104,  32 }, // from graphics resolution  832 x  624
 -  {  120,  33 }, // from graphics resolution  960 x  640
 -  {  128,  31 }, // from graphics resolution 1024 x  600
 -  {  128,  40 }, // from graphics resolution 1024 x  768
 -  {  144,  45 }, // from graphics resolution 1152 x  864
 -  {  144,  45 }, // from graphics resolution 1152 x  870
 -  {  160,  37 }, // from graphics resolution 1280 x  720
 -  {  160,  40 }, // from graphics resolution 1280 x  760
 -  {  160,  40 }, // from graphics resolution 1280 x  768
 -  {  160,  42 }, // from graphics resolution 1280 x  800
 -  {  160,  50 }, // from graphics resolution 1280 x  960
 -  {  160,  53 }, // from graphics resolution 1280 x 1024
 -  {  170,  40 }, // from graphics resolution 1360 x  768
 -  {  170,  40 }, // from graphics resolution 1366 x  768
 -  {  175,  55 }, // from graphics resolution 1400 x 1050
 -  {  180,  47 }, // from graphics resolution 1440 x  900
 -  {  200,  47 }, // from graphics resolution 1600 x  900
 -  {  200,  63 }, // from graphics resolution 1600 x 1200
 -  {  210,  55 }, // from graphics resolution 1680 x 1050
 -  {  240,  56 }, // from graphics resolution 1920 x 1080
 -  {  240,  63 }, // from graphics resolution 1920 x 1200
 -  {  240,  75 }, // from graphics resolution 1920 x 1440
 -  {  250, 105 }, // from graphics resolution 2000 x 2000
 -  {  256,  80 }, // from graphics resolution 2048 x 1536
 -  {  256, 107 }, // from graphics resolution 2048 x 2048
 -  {  320,  75 }, // from graphics resolution 2560 x 1440
 -  {  320,  84 }, // from graphics resolution 2560 x 1600
 -  {  320, 107 }, // from graphics resolution 2560 x 2048
 -  {  350, 110 }, // from graphics resolution 2800 x 2100
 -  {  400, 126 }, // from graphics resolution 3200 x 2400
 -  {  480, 113 }, // from graphics resolution 3840 x 2160
 -  {  512, 113 }, // from graphics resolution 4096 x 2160
 -  {  960, 227 }, // from graphics resolution 7680 x 4320
 -  { 1024, 227 }, // from graphics resolution 8192 x 4320
 +  { 80,  25 },
 +  { 80,  50 },
 +  { 100, 31 },
   //
   // New modes can be added here.
   //
 -- 
 2.31.1
--- a/SOURCES/edk2-build.py
+++ b/SOURCES/edk2-build.py
@ -0,0 +1,329 @@
 #!/usr/bin/python3
 import os
 import sys
 import glob
 import shutil
 import optparse
 import subprocess
 import configparser
 rebase_prefix    = ""
 version_override = None
 release_date     = None
 def check_rebase():
    """ detect 'git rebase -x edk2-build.py master' testbuilds """
    global rebase_prefix
    global version_override
    if not os.path.exists('.git/rebase-merge/msgnum'):
        return ""
    with open('.git/rebase-merge/msgnum', 'r') as f:
        msgnum = int(f.read())
    with open('.git/rebase-merge/end', 'r') as f:
        end = int(f.read())
    with open('.git/rebase-merge/head-name', 'r') as f:
        head = f.read().strip().split('/')
    rebase_prefix = f'[ {int(msgnum/2)} / {int(end/2)} - {head[-1]} ] '
    if msgnum != end and not version_override:
        # fixed version speeds up builds
        version_override = "test-build-patch-series"
 def get_coredir(cfg):
    if cfg.has_option('global', 'core'):
        return os.path.abspath(cfg['global']['core'])
    else:
        return os.getcwd()
 def get_version(cfg):
    coredir = get_coredir(cfg)
    if version_override:
        version = version_override
        print('')
        print(f'### version [override]: {version}')
        return version
    if os.environ.get('RPM_PACKAGE_NAME'):
        version = os.environ.get('RPM_PACKAGE_NAME');
        version += '-' + os.environ.get('RPM_PACKAGE_VERSION');
        version += '-' + os.environ.get('RPM_PACKAGE_RELEASE');
        print('')
        print(f'### version [rpmbuild]: {version}')
        return version
    if os.path.exists(coredir + '/.git'):
        cmdline = [ 'git', 'describe', '--tags', '--abbrev=8', '--match=edk2-stable*' ]
        result = subprocess.run(cmdline, stdout = subprocess.PIPE, cwd = coredir)
        version = result.stdout.decode().strip()
        print('')
        print(f'### version [git]: {version}')
        return version
    return None
 def pcd_string(name, value):
    return f'{name}=L{value}\\0'
 def pcd_version(cfg):
    version = get_version(cfg)
    if version is None:
        return []
    return [ '--pcd', pcd_string('PcdFirmwareVersionString', version) ]
 def pcd_release_date(cfg):
    if release_date is None:
        return []
    return [ '--pcd', pcd_string('PcdFirmwareReleaseDateString', release_date) ]
 def build_message(line, line2 = None):
    if os.environ.get('TERM') in [ 'xterm', 'xterm-256color' ]:
        # setxterm  title
        start  = '\x1b]2;'
        end    = '\x07'
        print(f'{start}{rebase_prefix}{line}{end}', end = '')
    print('')
    print('###')
    print(f'### {rebase_prefix}{line}')
    if line2:
        print(f'### {line2}')
    print('###')
 def build_run(cmdline, name, section, silent = False):
    print(cmdline)
    if silent:
        print('### building in silent mode ...', flush = True)
        result = subprocess.run(cmdline,
                                stdout = subprocess.PIPE,
                                stderr = subprocess.STDOUT)
        logfile = f'{section}.log'
        print(f'### writing log to {logfile} ...')
        with open(logfile, 'wb') as f:
            f.write(result.stdout)
        if result.returncode:
            print('### BUILD FAILURE')
            print('### output')
            print(result.stdout.decode())
            print(f'### exit code: {result.returncode}')
        else:
            print('### OK')
    else:
        result = subprocess.run(cmdline)
    if result.returncode:
        print(f'ERROR: {cmdline[0]} exited with {result.returncode} while building {name}')
        sys.exit(result.returncode)
 def build_copy(plat, tgt, dstdir, copy):
    srcdir = f'Build/{plat}/{tgt}_GCC5'
    names = copy.split()
    srcfile = names[0]
    if len(names) > 1:
        dstfile = names[1]
    else:
        dstfile = os.path.basename(srcfile)
    print(f'# copy: {srcdir} / {srcfile}  =>  {dstdir} / {dstfile}')
    src = srcdir + '/' + srcfile
    dst = dstdir + '/' + dstfile
    os.makedirs(os.path.dirname(dst), exist_ok = True)
    shutil.copy(src, dst)
 def pad_file(dstdir, pad):
    args = pad.split()
    if len(args) < 2:
        raise RuntimeError(f'missing arg for pad ({args})')
    name = args[0]
    size = args[1]
    cmdline = [
        'truncate',
        '--size', size,
        dstdir + '/' + name,
    ]
    print(f'# padding: {dstdir} / {name}  =>  {size}')
    subprocess.run(cmdline)
 def build_one(cfg, build, jobs = None, silent = False):
    cmdline  = [ 'build' ]
    cmdline += [ '-t', 'GCC5' ]
    cmdline += [ '-p', cfg[build]['conf'] ]
    if (cfg[build]['conf'].startswith('OvmfPkg/') or
        cfg[build]['conf'].startswith('ArmVirtPkg/')):
        cmdline += pcd_version(cfg)
        cmdline += pcd_release_date(cfg)
    if jobs:
        cmdline += [ '-n', jobs ]
    for arch in cfg[build]['arch'].split():
        cmdline += [ '-a', arch ]
    if 'opts' in cfg[build]:
        for name in cfg[build]['opts'].split():
            section = 'opts.' + name
            for opt in cfg[section]:
                cmdline += [ '-D', opt + '=' + cfg[section][opt] ]
    if 'pcds' in cfg[build]:
        for name in cfg[build]['pcds'].split():
            section = 'pcds.' + name
            for pcd in cfg[section]:
                cmdline += [ '--pcd', pcd + '=' + cfg[section][pcd] ]
    if 'tgts' in cfg[build]:
        tgts = cfg[build]['tgts'].split()
    else:
        tgts = [ 'DEBUG' ]
    for tgt in tgts:
        desc = None
        if 'desc' in cfg[build]:
            desc = cfg[build]['desc']
        build_message(f'building: {cfg[build]["conf"]} ({cfg[build]["arch"]}, {tgt})',
                      f'description: {desc}')
        build_run(cmdline + [ '-b', tgt ],
                  cfg[build]['conf'],
                  build + '.' + tgt,
                  silent)
        if 'plat' in cfg[build]:
            # copy files
            for cpy in cfg[build]:
                if not cpy.startswith('cpy'):
                    continue
                build_copy(cfg[build]['plat'],
                           tgt,
                           cfg[build]['dest'],
                           cfg[build][cpy])
            # pad builds
            for pad in cfg[build]:
                if not pad.startswith('pad'):
                    continue
                pad_file(cfg[build]['dest'],
                         cfg[build][pad])
 def build_basetools(silent = False):
    build_message(f'building: BaseTools')
    basedir = os.environ['EDK_TOOLS_PATH']
    cmdline = [ 'make', '-C', basedir ]
    build_run(cmdline, 'BaseTools', 'build.basetools', silent)
 def binary_exists(name):
    for dir in os.environ['PATH'].split(':'):
        if os.path.exists(dir + '/' + name):
            return True
    return False
 def prepare_env(cfg):
    """ mimic Conf/BuildEnv.sh """
    workspace = os.getcwd()
    packages = [ workspace, ]
    path = os.environ['PATH'].split(':')
    dirs = [
        'BaseTools/Bin/Linux-x86_64',
        'BaseTools/BinWrappers/PosixLike'
    ]
    if cfg.has_option('global', 'pkgs'):
        for pkgdir in cfg['global']['pkgs'].split():
            packages.append(os.path.abspath(pkgdir))
    coredir = get_coredir(cfg)
    if coredir != workspace:
        packages.append(coredir)
    # add basetools to path
    for dir in dirs:
        p = coredir + '/' + dir
        if not os.path.exists(p):
            continue
        if p in path:
            continue
        path.insert(0, p)
    # run edksetup if needed
    toolsdef = coredir + '/Conf/tools_def.txt';
    if not os.path.exists(toolsdef):
        os.makedirs(os.path.dirname(toolsdef), exist_ok = True)
        build_message('running BaseTools/BuildEnv')
        cmdline = [ 'sh', 'BaseTools/BuildEnv' ]
        subprocess.run(cmdline, cwd = coredir)
    # set variables
    os.environ['PATH'] = ':'.join(path)
    os.environ['PACKAGES_PATH'] = ':'.join(packages)
    os.environ['WORKSPACE'] = workspace
    os.environ['EDK_TOOLS_PATH'] = coredir + '/BaseTools'
    os.environ['CONF_PATH'] = coredir + '/Conf'
    os.environ['PYTHON_COMMAND'] = '/usr/bin/python3'
    os.environ['PYTHONHASHSEED'] = '1'
    # for cross builds
    if binary_exists('arm-linux-gnu-gcc'):
        os.environ['GCC5_ARM_PREFIX'] = 'arm-linux-gnu-'
    if binary_exists('aarch64-linux-gnu-gcc'):
        os.environ['GCC5_AARCH64_PREFIX'] = 'aarch64-linux-gnu-'
    if binary_exists('riscv64-linux-gnu-gcc'):
        os.environ['GCC5_RISCV64_PREFIX'] = 'riscv64-linux-gnu-'
    if binary_exists('x86_64-linux-gnu-gcc'):
        os.environ['GCC5_IA32_PREFIX'] = 'x86_64-linux-gnu-'
        os.environ['GCC5_X64_PREFIX'] = 'x86_64-linux-gnu-'
        os.environ['GCC5_BIN'] = 'x86_64-linux-gnu-'
 def build_list(cfg):
    for build in cfg.sections():
        if not build.startswith('build.'):
            continue
        name = build.lstrip('build.')
        desc = 'no description'
        if 'desc' in cfg[build]:
            desc = cfg[build]['desc']
        print(f'# {name:20s} - {desc}')
 def main():
    parser = optparse.OptionParser()
    parser.add_option('-c', '--config', dest = 'configfile',
                      type = 'string', default = '.edk2.builds')
    parser.add_option('-C', '--directory', dest = 'directory', type = 'string')
    parser.add_option('-j', '--jobs', dest = 'jobs', type = 'string')
    parser.add_option('-m', '--match', dest = 'match', type = 'string')
    parser.add_option('-l', '--list', dest = 'list', action = 'store_true', default = False)
    parser.add_option('--silent', dest = 'silent', action = 'store_true', default = False)
    parser.add_option('--core', dest = 'core', type = 'string')
    parser.add_option('--pkg', '--package', dest = 'pkgs', type = 'string', action = 'append')
    parser.add_option('--version-override', dest = 'version_override', type = 'string')
    parser.add_option('--release-date', dest = 'release_date', type = 'string')
    (options, args) = parser.parse_args()
    if options.directory:
        os.chdir(options.directory)
    cfg = configparser.ConfigParser()
    cfg.optionxform = str
    cfg.read(options.configfile)
    if options.list:
        build_list(cfg)
        return
    if not cfg.has_section('global'):
        cfg.add_section('global')
    if options.core:
        cfg.set('global', 'core', options.core)
    if options.pkgs:
        cfg.set('global', 'pkgs', ' '.join(options.pkgs))
    global version_override
    global release_date
    check_rebase()
    if options.version_override:
        version_override = options.version_override
    if options.release_date:
        release_date = options.release_date
    prepare_env(cfg)
    build_basetools(options.silent)
    for build in cfg.sections():
        if not build.startswith('build.'):
            continue
        if options.match and options.match not in build:
            print(f'# skipping "{build}" (not matching "{options.match}")')
            continue
        build_one(cfg, build, options.jobs, options.silent)
 if __name__ == '__main__':
    sys.exit(main())
--- a/SOURCES/edk2-build.rhel-9
+++ b/SOURCES/edk2-build.rhel-9
@ -0,0 +1,111 @@
 [opts.ovmf.common]
 NETWORK_HTTP_BOOT_ENABLE = TRUE
 NETWORK_IP6_ENABLE       = TRUE
 NETWORK_TLS_ENABLE       = TRUE
 NETWORK_ISCSI_ENABLE     = TRUE
 NETWORK_ALLOW_HTTP_CONNECTIONS = TRUE
 TPM2_ENABLE              = TRUE
 TPM2_CONFIG_ENABLE       = TRUE
 TPM1_ENABLE              = FALSE
 CAVIUM_ERRATUM_27456     = TRUE
 [opts.ovmf.4m]
 FD_SIZE_4MB              = TRUE
 [opts.ovmf.sb.smm]
 SECURE_BOOT_ENABLE       = TRUE
 SMM_REQUIRE              = TRUE
 # old downstream
 EXCLUDE_SHELL_FROM_FD    = TRUE
 # new upstream
 BUILD_SHELL              = FALSE
 [opts.armvirt.verbose]
 DEBUG_PRINT_ERROR_LEVEL  = 0x8040004F
 [opts.armvirt.silent]
 DEBUG_PRINT_ERROR_LEVEL  = 0x80000000
 #####################################################################
 # stateful ovmf builds (with vars in flash)
 [build.ovmf.4m.default]
 desc = ovmf build (64-bit, 4MB)
 conf = OvmfPkg/OvmfPkgX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.4m
 plat = OvmfX64
 dest = RHEL-9/ovmf
 cpy1 = FV/OVMF_CODE.fd OVMF_CODE.fd
 cpy2 = FV/OVMF_VARS.fd
 cpy3 = X64/Shell.efi
 [build.ovmf.4m.sb.smm]
 desc = ovmf build (32/64-bit, 4MB, q35 only, needs smm, secure boot)
 conf = OvmfPkg/OvmfPkgIa32X64.dsc
 arch = IA32 X64
 opts = ovmf.common
       ovmf.4m
       ovmf.sb.smm
 plat = Ovmf3264
 dest = RHEL-9/ovmf
 cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
 cpy2 = X64/EnrollDefaultKeys.efi
 #####################################################################
 # stateless ovmf builds (firmware in rom or r/o flash)
 [build.ovmf.amdsev]
 desc = ovmf build for AmdSev (4MB)
 conf = OvmfPkg/AmdSev/AmdSevX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.4m
 plat = AmdSev
 dest = RHEL-9/ovmf
 cpy1 = FV/OVMF.fd OVMF.amdsev.fd
 [build.ovmf.inteltdx]
 desc = ovmf build for IntelTdx (4MB)
 conf = OvmfPkg/IntelTdx/IntelTdxX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.4m
 plat = IntelTdx
 dest = RHEL-9/ovmf
 cpy1 = FV/OVMF.fd OVMF.inteltdx.fd
 #####################################################################
 # armvirt builds
 [build.armvirt.aa64.verbose]
 desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
 conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = AARCH64
 opts = ovmf.common
       armvirt.verbose
 plat = ArmVirtQemu-AARCH64
 dest = RHEL-9/aarch64
 cpy1 = FV/QEMU_EFI.fd
 cpy2 = FV/QEMU_VARS.fd
 cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
 cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
 pad3 = QEMU_EFI-pflash.raw      64m
 pad4 = vars-template-pflash.raw 64m
 [build.armvirt.aa64.silent]
 desc = ArmVirt build for qemu, 64-bit (arm v8), silent
 conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = AARCH64
 opts = ovmf.common
       armvirt.silent
 plat = ArmVirtQemu-AARCH64
 dest = RHEL-9/aarch64
 cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.silent.fd
 cpy2 = FV/QEMU_EFI.fd  QEMU_EFI-silent-pflash.raw
 pad2 = QEMU_EFI-silent-pflash.raw 64m
--- a/SOURCES/edk2-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch
+++ b/SOURCES/edk2-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch
@ -0,0 +1,42 @@
 From dca1a100d14056865c7360d80a2a1d1ae4b0de96 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Fri, 10 Feb 2023 10:49:44 +0100
 Subject: [PATCH 5/5] rh openssl: add crypto/bn/rsa_sup_mul.c to file list
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 27: openssl update
 RH-Bugzilla: 2164534 2164550 2164565 2164583
 RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
 RH-Commit: [2/2] a097fc031b54208e9c8974173784e4c306dbf7a0 (kraxel/centos-edk2)
 ---
 CryptoPkg/Library/OpensslLib/OpensslLib.inf       | 1 +
 CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 1 +
 2 files changed, 2 insertions(+)
 diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
 index e446b51e66..7e78255467 100644
 --- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
 +++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
@@ -576,6 +576,7 @@
   $(OPENSSL_PATH)/ssl/statem/statem_local.h
 # Autogenerated files list ends here
 # RHEL8-specific OpenSSL file list starts here
 +  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
   $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
   $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
   $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
 diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
 index c207dc8f4c..1c551cb099 100644
 --- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
 +++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
@@ -526,6 +526,7 @@
   $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
 # Autogenerated files list ends here
 # RHEL8-specific OpenSSL file list starts here
 +  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
   $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
   $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
   $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
 -- 
 2.31.1
--- a/SOURCES/ovmf-vars-generator
+++ b/SOURCES/ovmf-vars-generator
@ -1,296 +0,0 @@
 #!/bin/python3
 # Copyright (C) 2017 Red Hat
 # Authors:
 # - Patrick Uiterwijk <puiterwijk@redhat.com>
 # - Kashyap Chamarthy <kchamart@redhat.com>
 #
 # Licensed under MIT License, for full text see LICENSE
 #
 # Purpose: Launch a QEMU guest and enroll ithe UEFI keys into an OVMF
 #          variables ("VARS") file.  Then boot a Linux kernel with QEMU.
 #          Finally, perform a check to verify if Secure Boot
 #          is enabled.
 from __future__ import print_function
 import argparse
 import os
 import logging
 import tempfile
 import shutil
 import string
 import subprocess
 def strip_special(line):
    return ''.join([c for c in str(line) if c in string.printable])
 def generate_qemu_cmd(args, readonly, *extra_args):
    if args.disable_smm:
        machinetype = 'pc'
    else:
        machinetype = 'q35,smm=on'
    machinetype += ',accel=%s' % ('kvm' if args.enable_kvm else 'tcg')
    if args.oem_string is None:
        oemstrings = []
    else:
        oemstring_values = [
            ",value=" + s.replace(",", ",,") for s in args.oem_string ]
        oemstrings = [
            '-smbios',
            "type=11" + ''.join(oemstring_values) ]
    return [
        args.qemu_binary,
        '-machine', machinetype,
        '-display', 'none',
        '-cpu', 'max',
        '-no-user-config',
        '-nodefaults',
        '-m', '768',
        '-smp', '2,sockets=2,cores=1,threads=1',
        '-chardev', 'pty,id=charserial1',
        '-device', 'isa-serial,chardev=charserial1,id=serial1',
        '-global', 'driver=cfi.pflash01,property=secure,value=%s' % (
            'off' if args.disable_smm else 'on'),
        '-drive',
        'file=%s,if=pflash,format=raw,unit=0,readonly=on' % (
            args.ovmf_binary),
        '-drive',
        'file=%s,if=pflash,format=raw,unit=1,readonly=%s' % (
            args.out_temp, 'on' if readonly else 'off'),
        '-serial', 'stdio'] + oemstrings + list(extra_args)
 def download(url, target, suffix, no_download):
    istemp = False
    if target and os.path.exists(target):
        return target, istemp
    if not target:
        temped = tempfile.mkstemp(prefix='qosb.', suffix='.%s' % suffix)
        os.close(temped[0])
        target = temped[1]
        istemp = True
    if no_download:
        raise Exception('%s did not exist, but downloading was disabled' %
                        target)
    import requests
    logging.debug('Downloading %s to %s', url, target)
    r = requests.get(url, stream=True)
    with open(target, 'wb') as f:
        for chunk in r.iter_content(chunk_size=1024):
            if chunk:
                f.write(chunk)
    return target, istemp
 def enroll_keys(args):
    shutil.copy(args.ovmf_template_vars, args.out_temp)
    logging.info('Starting enrollment')
    cmd = generate_qemu_cmd(
        args,
        False,
        '-drive',
        'file=%s,format=raw,if=none,media=cdrom,id=drive-cd1,'
        'readonly=on' % args.uefi_shell_iso,
        '-device',
        'ide-cd,drive=drive-cd1,id=cd1,'
        'bootindex=1')
    p = subprocess.Popen(cmd,
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
        stderr=subprocess.STDOUT)
    logging.info('Performing enrollment')
    # Wait until the UEFI shell starts (first line is printed)
    read = p.stdout.readline()
    if b'char device redirected' in read:
        read = p.stdout.readline()
    # Skip passed QEMU warnings, like the following one we see in Ubuntu:
    # qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.vmx [bit 5]
    while b'qemu-system-x86_64: warning:' in read:
        read = p.stdout.readline()
    if args.print_output:
        print(strip_special(read), end='')
        print()
    # Send the escape char to enter the UEFI shell early
    p.stdin.write(b'\x1b')
    p.stdin.flush()
    # And then run the following three commands from the UEFI shell:
    # change into the first file system device; install the default
    # keys and certificates, and reboot
    p.stdin.write(b'fs0:\r\n')
    p.stdin.write(b'EnrollDefaultKeys.efi\r\n')
    p.stdin.write(b'reset -s\r\n')
    p.stdin.flush()
    while True:
        read = p.stdout.readline()
        if args.print_output:
            print('OUT: %s' % strip_special(read), end='')
            print()
        if b'info: success' in read:
            break
    p.wait()
    if args.print_output:
        print(strip_special(p.stdout.read()), end='')
    logging.info('Finished enrollment')
 def test_keys(args):
    logging.info('Grabbing test kernel')
    kernel, kerneltemp = download(args.kernel_url, args.kernel_path,
                                  'kernel', args.no_download)
    logging.info('Starting verification')
    try:
        cmd = generate_qemu_cmd(
            args,
            True,
            '-append', 'console=tty0 console=ttyS0,115200n8',
            '-kernel', kernel)
        p = subprocess.Popen(cmd,
            stdin=subprocess.PIPE,
            stdout=subprocess.PIPE,
            stderr=subprocess.STDOUT)
        logging.info('Performing verification')
        while True:
            read = p.stdout.readline()
            if args.print_output:
                print('OUT: %s' % strip_special(read), end='')
                print()
            if b'Secure boot disabled' in read:
                raise Exception('Secure Boot was disabled')
            elif b'Secure boot enabled' in read:
                logging.info('Confirmed: Secure Boot is enabled')
                break
            elif b'Kernel is locked down from EFI secure boot' in read:
                logging.info('Confirmed: Secure Boot is enabled')
                break
        p.kill()
        if args.print_output:
            print(strip_special(p.stdout.read()), end='')
        logging.info('Finished verification')
    finally:
        if kerneltemp:
            os.remove(kernel)
 def parse_args():
    parser = argparse.ArgumentParser()
    parser.add_argument('output', help='Filename for output vars file')
    parser.add_argument('--out-temp', help=argparse.SUPPRESS)
    parser.add_argument('--force', help='Overwrite existing output file',
                        action='store_true')
    parser.add_argument('--print-output', help='Print the QEMU guest output',
                        action='store_true')
    parser.add_argument('--verbose', '-v', help='Increase verbosity',
                        action='count')
    parser.add_argument('--quiet', '-q', help='Decrease verbosity',
                        action='count')
    parser.add_argument('--qemu-binary', help='QEMU binary path',
                        default='/usr/bin/qemu-system-x86_64')
    parser.add_argument('--enable-kvm', help='Enable KVM acceleration',
                        action='store_true')
    parser.add_argument('--ovmf-binary', help='OVMF secureboot code file',
                        default='/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd')
    parser.add_argument('--ovmf-template-vars', help='OVMF empty vars file',
                        default='/usr/share/edk2/ovmf/OVMF_VARS.fd')
    parser.add_argument('--uefi-shell-iso', help='Path to uefi shell iso',
                        default='/usr/share/edk2/ovmf/UefiShell.iso')
    parser.add_argument('--skip-enrollment',
                        help='Skip enrollment, only test', action='store_true')
    parser.add_argument('--skip-testing',
                        help='Skip testing generated "VARS" file',
                        action='store_true')
    parser.add_argument('--kernel-path',
                        help='Specify a consistent path for kernel')
    parser.add_argument('--no-download', action='store_true',
                        help='Never download a kernel')
    parser.add_argument('--fedora-version',
                        help='Fedora version to get kernel for checking',
                        default='27')
    parser.add_argument('--kernel-url', help='Kernel URL',
                        default='https://download.fedoraproject.org/pub/fedora'
                                '/linux/releases/%(version)s/Everything/x86_64'
                                '/os/images/pxeboot/vmlinuz')
    parser.add_argument('--disable-smm',
                        help=('Don\'t restrict varstore pflash writes to '
                              'guest code that executes in SMM. Use this '
                              'option only if your OVMF binary doesn\'t have '
                              'the edk2 SMM driver stack built into it '
                              '(possibly because your QEMU binary lacks SMM '
                              'emulation). Note that without restricting '
                              'varstore pflash writes to guest code that '
                              'executes in SMM, a malicious guest kernel, '
                              'used for testing, could undermine Secure '
                              'Boot.'),
                        action='store_true')
    parser.add_argument('--oem-string',
                        help=('Pass the argument to the guest as a string in '
                              'the SMBIOS Type 11 (OEM Strings) table. '
                              'Multiple occurrences of this option are '
                              'collected into a single SMBIOS Type 11 table. '
                              'A pure ASCII string argument is strongly '
                              'suggested.'),
                        action='append')
    args = parser.parse_args()
    args.kernel_url = args.kernel_url % {'version': args.fedora_version}
    validate_args(args)
    return args
 def validate_args(args):
    if (os.path.exists(args.output)
            and not args.force
            and not args.skip_enrollment):
        raise Exception('%s already exists' % args.output)
    if args.skip_enrollment and not os.path.exists(args.output):
        raise Exception('%s does not yet exist' % args.output)
    verbosity = (args.verbose or 1) - (args.quiet or 0)
    if verbosity >= 2:
        logging.basicConfig(level=logging.DEBUG)
    elif verbosity == 1:
        logging.basicConfig(level=logging.INFO)
    elif verbosity < 0:
        logging.basicConfig(level=logging.ERROR)
    else:
        logging.basicConfig(level=logging.WARN)
    if args.skip_enrollment:
        args.out_temp = args.output
    else:
        temped = tempfile.mkstemp(prefix='qosb.', suffix='.vars')
        os.close(temped[0])
        args.out_temp = temped[1]
        logging.debug('Temp output: %s', args.out_temp)
 def move_to_dest(args):
    shutil.copy(args.out_temp, args.output)
    os.remove(args.out_temp)
 def main():
    args = parse_args()
    if not args.skip_enrollment:
        enroll_keys(args)
    if not args.skip_testing:
        test_keys(args)
    if not args.skip_enrollment:
        move_to_dest(args)
        if args.skip_testing:
            logging.info('Created %s' % args.output)
        else:
            logging.info('Created and verified %s' % args.output)
    else:
        logging.info('Verified %s', args.output)
 if __name__ == '__main__':
    main()
--- a/SPECS/edk2.spec
+++ b/SPECS/edk2.spec
@ -1,18 +1,10 @@
 ExclusiveArch: x86_64 aarch64
-%define GITDATE        20220526
+%define GITDATE        20221207
-%define GITCOMMIT      16779ede2d36
+%define GITCOMMIT      fff6d81270b5
 %define TOOLCHAIN      GCC5
 %define OPENSSL_VER    1.1.1k
 %define qosb_testing 0
 %ifarch x86_64
 %define qosb_testing 1
 %endif
 %define qemu_package qemu-kvm-core >= 2.12.0-89
 %define qemu_binary /usr/libexec/qemu-kvm
 %define build_ovmf 0
 %define build_aarch64 0
 %ifarch x86_64
@ -24,60 +16,78 @@ ExclusiveArch: x86_64 aarch64
 Name:       edk2
 Version:    %{GITDATE}git%{GITCOMMIT}
-Release:    3%{?dist}
+Release:    9%{?dist}
 Summary:    UEFI firmware for 64-bit virtual machines
 License:    BSD-2-Clause-Patent and OpenSSL and MIT
 URL:        http://www.tianocore.org
 # The source tarball is created using following commands:
-# COMMIT=16779ede2d36
+# COMMIT=fff6d81270b5
 # git archive --format=tar --prefix=edk2-$COMMIT/ $COMMIT \
 # | xz -9ev >/tmp/edk2-$COMMIT.tar.xz
 Source0:edk2-%{GITCOMMIT}.tar.xz
 Source1: ovmf-whitepaper-c770f8c.txt
-Source2: openssl-rhel-740e53ace8f6771c205bf84780e26bcd7a3275df.tar.xz
+Source2: openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
 Source3: ovmf-vars-generator
 Source4: LICENSE.qosb
 Source5: RedHatSecureBootPkKek1.pem
-Source10: edk2-aarch64-verbose.json
+# json description files
-Source11: edk2-aarch64.json
+Source10: 50-edk2-aarch64.json
-Source12: edk2-ovmf-sb.json
+Source11: 51-edk2-aarch64-verbose.json
-Source13: edk2-ovmf.json
+
-Source14: edk2-ovmf-cc.json
+Source40: 30-edk2-ovmf-x64-sb-enrolled.json
-Source15: edk2-ovmf-amdsev.json
+Source41: 40-edk2-ovmf-x64-sb.json
 Source43: 50-edk2-ovmf-x64-nosb.json
 Source44: 60-edk2-ovmf-x64-amdsev.json
 Source45: 60-edk2-ovmf-x64-inteltdx.json
 # https://gitlab.com/kraxel/edk2-build-config
 Source80: edk2-build.py
 Source82: edk2-build.rhel-9
 Patch0002: 0002-Remove-submodules.patch
-Patch0003: 0003-OvmfPkg-increase-max-debug-message-length-to-512-RHE.patch
+Patch0003: 0003-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch
-Patch0004: 0004-MdeModulePkg-TerminalDxe-add-other-text-resolutions-.patch
+Patch0004: 0004-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
-Patch0005: 0005-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
+Patch0005: 0005-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
-Patch0006: 0006-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
+Patch0006: 0006-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
-Patch0007: 0007-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
+Patch0007: 0007-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
-Patch0008: 0008-OvmfPkg-allow-exclusion-of-the-shell-from-the-firmwa.patch
+Patch0008: 0008-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
-Patch0009: 0009-ArmPlatformPkg-introduce-fixed-PCD-for-early-hello-m.patch
+Patch0009: 0009-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
-Patch0010: 0010-ArmPlatformPkg-PrePeiCore-write-early-hello-message-.patch
+Patch0010: 0010-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
-Patch0011: 0011-ArmVirtPkg-set-early-hello-message-RH-only.patch
+Patch0011: 0011-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
-Patch0012: 0012-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+Patch0012: 0012-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
-Patch0013: 0013-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+Patch0013: 0013-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
-Patch0014: 0014-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+Patch0014: 0014-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
-Patch0015: 0015-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+Patch0015: 0015-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
-Patch0016: 0016-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+Patch0016: 0016-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
-Patch0017: 0017-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch
+Patch0017: 0017-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
-Patch0018: 0018-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
+Patch0018: 0018-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
-Patch0019: 0019-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
+Patch0019: 0019-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
-Patch0021: 0021-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
+Patch0020: 0020-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
-Patch0022: 0022-ArmVirtPkg-Remove-EbcDxe-RHEL-only.patch
+Patch0021: 0021-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
-Patch0023: 0023-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
+Patch0022: 0022-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
-Patch0024: 0024-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
+Patch0023: 0023-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
-Patch0025: 0025-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
+Patch0024: 0024-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
-Patch0026: 0026-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
+Patch0025: 0025-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
-Patch0027: 0027-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
+Patch0026: 0026-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
-Patch0028: 0028-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
+Patch0028: 0028-Revert-ArmVirtPkg-make-EFI_LOADER_DATA-non-executabl.patch
-Patch0029: 0029-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
+Patch0032: 0032-Revert-OvmfPkg-PlatformDxe-Handle-all-requests-in-Ex.patch
-Patch0030: 0030-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
+Patch0033: 0033-OvmfPkg-SmbiosPlatformDxe-use-PcdFirmware.patch
-Patch0031: 0031-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
+# For bz#2158173 - [aarch64][numa] Failed to create 2 numa nodes in some hardwares
-Patch0032: 0032-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
+Patch34: edk2-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch
-Patch0033: 0033-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
+# For bz#1983086 - Assertion failure when creating 1024 VCPU VM: [...]UefiCpuPkg/CpuMpPei/CpuBist.c(186): !EFI_ERROR (Status)
 Patch35: edk2-MdePkg-Remove-Itanium-leftover-data-structure-RH-onl.patch
 # For bz#2158173 - [aarch64][numa] Failed to create 2 numa nodes in some hardwares
 Patch36: edk2-ArmVirt-don-t-use-unaligned-CopyMem-on-NOR-flash.patch
 # For bz#2157656 - [edk2] [aarch64] Unable to initialize EFI firmware when using edk2-aarch64-20221207gitfff6d81270b5-1.el9 in some hardwares
 Patch37: edk2-Revert-ArmVirtPkg-ArmVirtQemu-enable-initial-ID-map-.patch
 # For bz#2164534 - CVE-2023-0286 edk2: openssl: X.400 address type confusion in X.509 GeneralName [rhel-9]
 # For bz#2164550 - CVE-2022-4304 edk2: openssl: timing attack in RSA Decryption implementation [rhel-9]
 # For bz#2164565 - CVE-2023-0215 edk2: openssl: use-after-free following BIO_new_NDEF [rhel-9]
 # For bz#2164583 - CVE-2022-4450 edk2: openssl: double free after calling PEM_read_bio_ex [rhel-9]
 Patch38: edk2-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch
 # For bz#2162307 - Broken GRUB output on a serial console
 Patch39: edk2-Revert-MdeModulePkg-TerminalDxe-add-other-text-resol.patch
 # For bz#2174605 - [EDK2] disable dynamic mmio window
 Patch40: edk2-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch
 # python3-devel and libuuid-devel are required for building tools.
@ -98,16 +108,8 @@ BuildRequires:  dosfstools
 BuildRequires:  mtools
 BuildRequires:  xorriso
-# For generating the variable store template with the default certificates
+# secure boot enrollment
-# enrolled, we need the qemu-kvm executable.
+BuildRequires:  python3dist(virt-firmware)
 BuildRequires:  %{qemu_package}
 %if %{qosb_testing}
 # For verifying SB enablement in the above variable store template, we need a
 # guest kernel that prints "Secure boot enabled".
 BuildRequires: kernel-core >= 4.18.0-161
 BuildRequires: rpmdevtools
 %endif
 # endif build_ovmf
 %endif
@ -185,54 +187,16 @@ git config am.keepcr true
 # -D is passed to %%setup to not delete the existing archive dir
 %autosetup -T -D -n edk2-%{GITCOMMIT} -S git_am
-cp -a -- %{SOURCE1} %{SOURCE3} .
+cp -a -- %{SOURCE1} .
-cp -a -- %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15} .
+cp -a -- %{SOURCE10} %{SOURCE11} .
 cp -a -- %{SOURCE40} %{SOURCE41} %{SOURCE43} %{SOURCE44} %{SOURCE45} .
 cp -a -- %{SOURCE80} %{SOURCE82} .
 tar -C CryptoPkg/Library/OpensslLib -a -f %{SOURCE2} -x
 # Format the Red Hat-issued certificate that is to be enrolled as both Platform
 # Key and first Key Exchange Key, as an SMBIOS OEM String. This means stripping
 # the PEM header and footer, and prepending the textual representation of the
 # GUID that identifies this particular OEM String to "EnrollDefaultKeys.efi",
 # plus the separator ":". For details, see
 # <https://bugzilla.tianocore.org/show_bug.cgi?id=1747> comments 2, 7, 14.
 sed \
  -e 's/^-----BEGIN CERTIFICATE-----$/4e32566d-8e9e-4f52-81d3-5bb9715f9727:/' \
  -e '/^-----END CERTIFICATE-----$/d' \
  %{SOURCE5} \
  > PkKek1.oemstr
 # Done by %setup, but we do not use it for the auxiliary tarballs
 chmod -Rf a+rX,u+w,g-w,o-w .
 %build
 export PYTHON_COMMAND=%{__python3}
 source ./edksetup.sh
 %make_build -C "$EDK_TOOLS_PATH" \
  EXTRA_OPTFLAGS="%{optflags}" \
  EXTRA_LDFLAGS="%{__global_ldflags}"
 SMP_MFLAGS="%{?_smp_mflags}"
 if [[ x"$SMP_MFLAGS" = x-j* ]]; then
        CC_FLAGS="$CC_FLAGS -n ${SMP_MFLAGS#-j}"
 elif [ -n "%{?jobs}" ]; then
        CC_FLAGS="$CC_FLAGS -n %{?jobs}"
 fi
 CC_FLAGS="$CC_FLAGS --cmd-len=65536 -t %{TOOLCHAIN} -b DEBUG --hash"
 CC_FLAGS="$CC_FLAGS -D NETWORK_IP6_ENABLE"
 CC_FLAGS="$CC_FLAGS -D NETWORK_HTTP_BOOT_ENABLE -D NETWORK_TLS_ENABLE"
 CC_FLAGS="$CC_FLAGS -D TPM2_ENABLE=TRUE"
 CC_FLAGS="$CC_FLAGS -D TPM1_ENABLE=FALSE"
 OVMF_FLAGS="${CC_FLAGS}"
 OVMF_FLAGS="${OVMF_FLAGS} -D FD_SIZE_4MB"
 OVMF_FLAGS="${OVMF_FLAGS} -D PVSCSI_ENABLE=FALSE -D MPT_SCSI_ENABLE=FALSE"
 OVMF_SB_FLAGS="${OVMF_FLAGS}"
 OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D SECURE_BOOT_ENABLE"
 OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D SMM_REQUIRE"
 OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D EXCLUDE_SHELL_FROM_FD"
 build_iso() {
  dir="$1"
@ -268,57 +232,24 @@ build_iso() {
    -o "$ISO_IMAGE" "$UEFI_SHELL_IMAGE"
 }
 export EXTRA_OPTFLAGS="%{optflags}"
 export EXTRA_LDFLAGS="%{__global_ldflags}"
 export RELEASE_DATE="$(echo %{GITDATE} | sed -e 's|\(....\)\(..\)\(..\)|\2/\3/\1|')"
 touch OvmfPkg/AmdSev/Grub/grub.efi   # dummy
 %if %{build_ovmf}
-# Build with neither SB nor SMM; include UEFI shell.
+./edk2-build.py --config edk2-build.rhel-9 -m ovmf --release-date "$RELEASE_DATE"
-build ${OVMF_FLAGS} -a X64 \
+build_iso RHEL-9/ovmf
-  -p OvmfPkg/OvmfPkgX64.dsc
+virt-fw-vars --input   RHEL-9/ovmf/OVMF_VARS.fd \
-
+             --output  RHEL-9/ovmf/OVMF_VARS.secboot.fd \
-# Build with SB and SMM; exclude UEFI shell.
+             --enroll-redhat --secure-boot
 build ${OVMF_SB_FLAGS} -a IA32 -a X64 \
  -p OvmfPkg/OvmfPkgIa32X64.dsc
 # Build AmdSev
 touch OvmfPkg/AmdSev/Grub/grub.efi   # dummy
 build ${OVMF_FLAGS} -a X64 \
  -p OvmfPkg/AmdSev/AmdSevX64.dsc
 # Sanity check: the varstore templates must be identical.
 cmp Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
  Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd
 # Prepare an ISO image that boots the UEFI shell.
 build_iso Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64
 # Enroll the default certificates in a separate variable store template.
 %{__python3} ovmf-vars-generator --verbose --verbose \
  --qemu-binary        %{qemu_binary} \
  --ovmf-binary        Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
  --ovmf-template-vars Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
  --uefi-shell-iso     Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/UefiShell.iso \
  --oem-string         "$(< PkKek1.oemstr)" \
  --skip-testing \
  Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd
 # endif build_ovmf
 %endif
 %if %{build_aarch64}
-# Build with a verbose debug mask first, and stash the binary.
+./edk2-build.py --config edk2-build.rhel-9 -m armvirt --release-date "$RELEASE_DATE"
 build ${CC_FLAGS} -a AARCH64 \
  -p ArmVirtPkg/ArmVirtQemu.dsc \
  -D DEBUG_PRINT_ERROR_LEVEL=0x8040004F
 cp -a Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
  Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd
 # Rebuild with a silent (errors only) debug mask.
 build ${CC_FLAGS} -a AARCH64 \
  -p ArmVirtPkg/ArmVirtQemu.dsc \
  -D DEBUG_PRINT_ERROR_LEVEL=0x80000000
 # endif build_aarch64
 %endif
 %install
 cp -a OvmfPkg/License.txt License.OvmfPkg.txt
@ -340,71 +271,31 @@ install BaseTools/Conf/*.template \
 install BaseTools/Scripts/GccBase.lds \
        %{buildroot}%{_datadir}/%{name}/Scripts
 mkdir -p %{buildroot}%{_datadir}/%{name}
 cp -av RHEL-9/* %{buildroot}%{_datadir}/%{name}
 %if %{build_ovmf}
-mkdir -p \
+mkdir -p %{buildroot}%{_datadir}/OVMF
  %{buildroot}%{_datadir}/OVMF \
  %{buildroot}%{_datadir}/%{name}/ovmf
 install -m 0644 Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
 install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.secboot.fd
 install -m 0644 Build/OvmfX64/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_VARS.fd
 install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd \
  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_VARS.secboot.fd
 install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/UefiShell.iso \
  %{buildroot}%{_datadir}/%{name}/ovmf/UefiShell.iso
 install -m 0644 Build/AmdSev/DEBUG_%{TOOLCHAIN}/FV/OVMF.fd \
  %{buildroot}%{_datadir}/%{name}/ovmf/OVMF.amdsev.fd
 ln -s ../%{name}/ovmf/OVMF_CODE.secboot.fd %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/OVMF_VARS.fd         %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/OVMF_VARS.secboot.fd %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/UefiShell.iso        %{buildroot}%{_datadir}/OVMF/
 ln -s OVMF_CODE.fd %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
-install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/Shell.efi \
+install -m 0644 \
-  %{buildroot}%{_datadir}/%{name}/ovmf/Shell.efi
+        30-edk2-ovmf-x64-sb-enrolled.json \
-install -m 0644 Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/EnrollDefaultKeys.efi \
+        40-edk2-ovmf-x64-sb.json \
-  %{buildroot}%{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi
+        50-edk2-ovmf-x64-nosb.json \
-
+        60-edk2-ovmf-x64-amdsev.json \
-install -m 0644 edk2-ovmf-sb.json \
+        60-edk2-ovmf-x64-inteltdx.json \
-  %{buildroot}%{_datadir}/qemu/firmware/40-edk2-ovmf-sb.json
+        %{buildroot}%{_datadir}/qemu/firmware
 install -m 0644 edk2-ovmf.json \
  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf.json
 install -m 0644 edk2-ovmf-cc.json \
  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf-cc.json
 install -m 0644 edk2-ovmf-amdsev.json \
  %{buildroot}%{_datadir}/qemu/firmware/50-edk2-ovmf-amdsev.json
 # endif build_ovmf
 %endif
 %if %{build_aarch64}
-mkdir -p \
+mkdir -p %{buildroot}%{_datadir}/AAVMF
  %{buildroot}%{_datadir}/AAVMF \
  %{buildroot}%{_datadir}/%{name}/aarch64
 # Pad and install the verbose binary.
 cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd \
  /dev/zero \
 | head -c 64m \
  > %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.raw
 # Pad and install the silent (default) binary.
 cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
  /dev/zero \
 | head -c 64m \
  > %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.raw
 # Create varstore template.
 cat Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_VARS.fd \
  /dev/zero \
 | head -c 64m \
  > %{buildroot}%{_datadir}/%{name}/aarch64/vars-template-pflash.raw
 ln -s ../%{name}/aarch64/QEMU_EFI-pflash.raw \
  %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
@ -413,45 +304,16 @@ ln -s ../%{name}/aarch64/QEMU_EFI-silent-pflash.raw \
 ln -s ../%{name}/aarch64/vars-template-pflash.raw \
  %{buildroot}%{_datadir}/AAVMF/AAVMF_VARS.fd
-chmod 0644 -- %{buildroot}%{_datadir}/AAVMF/AAVMF_*.fd
+install -m 0644 \
        50-edk2-aarch64.json \
        51-edk2-aarch64-verbose.json \
        %{buildroot}%{_datadir}/qemu/firmware
 install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.verbose.fd \
  %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI.fd
 install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_EFI.fd \
  %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd
 install -m 0644 Build/ArmVirtQemu-AARCH64/DEBUG_%{TOOLCHAIN}/FV/QEMU_VARS.fd \
  %{buildroot}%{_datadir}/%{name}/aarch64/QEMU_VARS.fd
 install -m 0644 edk2-aarch64.json \
  %{buildroot}%{_datadir}/qemu/firmware/60-edk2-aarch64.json
 install -m 0644 edk2-aarch64-verbose.json \
  %{buildroot}%{_datadir}/qemu/firmware/70-edk2-aarch64-verbose.json
 # endif build_aarch64
 %endif
 %check
 %if %{qosb_testing}
 # Of the installed host kernels, boot the one with the highest Version-Release
 # under OVMF, and check if it prints "Secure boot enabled".
 KERNEL_PKG=$(rpm -q kernel-core | rpmdev-sort | tail -n 1)
 KERNEL_IMG=$(rpm -q -l $KERNEL_PKG | egrep '^/lib/modules/[^/]+/vmlinuz$')
 %{__python3} ovmf-vars-generator --verbose --verbose \
  --qemu-binary        %{qemu_binary} \
  --ovmf-binary        Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_CODE.fd \
  --ovmf-template-vars Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.fd \
  --uefi-shell-iso     Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/X64/UefiShell.iso \
  --kernel-path        $KERNEL_IMG \
  --skip-enrollment \
  --no-download \
  Build/Ovmf3264/DEBUG_%{TOOLCHAIN}/FV/OVMF_VARS.secboot.fd
 # endif qosb_testing
 %endif
 %global common_files \
  %%license License.txt License.OvmfPkg.txt License-History.txt LICENSE.openssl \
  %%dir %%{_datadir}/%%{name}/ \
@ -465,11 +327,13 @@ KERNEL_IMG=$(rpm -q -l $KERNEL_PKG | egrep '^/lib/modules/[^/]+/vmlinuz$')
 %doc ovmf-whitepaper-c770f8c.txt
 %dir %{_datadir}/OVMF/
 %dir %{_datadir}/%{name}/ovmf/
 %{_datadir}/%{name}/ovmf/OVMF_CODE.fd
 %{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
 %{_datadir}/%{name}/ovmf/OVMF_CODE.secboot.fd
 %{_datadir}/%{name}/ovmf/OVMF_VARS.fd
 %{_datadir}/%{name}/ovmf/OVMF_VARS.secboot.fd
 %{_datadir}/%{name}/ovmf/OVMF.amdsev.fd
 %{_datadir}/%{name}/ovmf/OVMF.inteltdx.fd
 %{_datadir}/%{name}/ovmf/UefiShell.iso
 %{_datadir}/OVMF/OVMF_CODE.secboot.fd
 %{_datadir}/OVMF/OVMF_VARS.fd
@ -477,10 +341,11 @@ KERNEL_IMG=$(rpm -q -l $KERNEL_PKG | egrep '^/lib/modules/[^/]+/vmlinuz$')
 %{_datadir}/OVMF/UefiShell.iso
 %{_datadir}/%{name}/ovmf/Shell.efi
 %{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi
-%{_datadir}/qemu/firmware/40-edk2-ovmf-sb.json
+%{_datadir}/qemu/firmware/30-edk2-ovmf-x64-sb-enrolled.json
-%{_datadir}/qemu/firmware/50-edk2-ovmf-cc.json
+%{_datadir}/qemu/firmware/40-edk2-ovmf-x64-sb.json
-%{_datadir}/qemu/firmware/50-edk2-ovmf-amdsev.json
+%{_datadir}/qemu/firmware/50-edk2-ovmf-x64-nosb.json
-%{_datadir}/qemu/firmware/50-edk2-ovmf.json
+%{_datadir}/qemu/firmware/60-edk2-ovmf-x64-amdsev.json
 %{_datadir}/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
 # endif build_ovmf
 %endif
@ -498,8 +363,8 @@ KERNEL_IMG=$(rpm -q -l $KERNEL_PKG | egrep '^/lib/modules/[^/]+/vmlinuz$')
 %{_datadir}/%{name}/aarch64/QEMU_EFI.fd
 %{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd
 %{_datadir}/%{name}/aarch64/QEMU_VARS.fd
-%{_datadir}/qemu/firmware/60-edk2-aarch64.json
+%{_datadir}/qemu/firmware/50-edk2-aarch64.json
-%{_datadir}/qemu/firmware/70-edk2-aarch64-verbose.json
+%{_datadir}/qemu/firmware/51-edk2-aarch64-verbose.json
 # endif build_aarch64
 %endif
@ -528,6 +393,85 @@ KERNEL_IMG=$(rpm -q -l $KERNEL_PKG | egrep '^/lib/modules/[^/]+/vmlinuz$')
 %changelog
 * Fri Mar 17 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20221207gitfff6d81270b5-9
 - edk2-remove-amd-sev-feature-flag-from-secure-boot-builds-.patch [bz#2169247]
 - Resolves: bz#2169247
  ([edk2] Install a sev guest with enrolled secure boot failed)
 * Fri Mar 10 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20221207gitfff6d81270b5-8
 - edk2-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch [bz#2174605]
 - Resolves: bz#2174605
  ([EDK2] disable dynamic mmio window)
 * Tue Feb 21 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20221207gitfff6d81270b5-7
 - edk2-Revert-MdeModulePkg-TerminalDxe-add-other-text-resol.patch [bz#2162307]
 - Resolves: bz#2162307
  (Broken GRUB output on a serial console)
 * Mon Feb 13 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20221207gitfff6d81270b5-6
 - edk2-update-build-script-rhel-only.patch [bz#2168046]
 - edk2-update-build-config-rhel-only.patch [bz#2168046]
 - edk2-add-release-date-to-builds-rh-only.patch [bz#2168046]
 - edk2-openssl-update.patch [bz#2164534 bz#2164550 bz#2164565 bz#2164583]
 - edk2-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch [bz#2164534 bz#2164550 bz#2164565 bz#2164583]
 - Resolves: bz#2168046
  ([SVVP] job 'Check SMBIOS Table Specific Requirements' failed on win2022)
 - Resolves: bz#2164534
  (CVE-2023-0286 edk2: openssl: X.400 address type confusion in X.509 GeneralName [rhel-9])
 - Resolves: bz#2164550
  (CVE-2022-4304 edk2: openssl: timing attack in RSA Decryption implementation [rhel-9])
 - Resolves: bz#2164565
  (CVE-2023-0215 edk2: openssl: use-after-free following BIO_new_NDEF [rhel-9])
 - Resolves: bz#2164583
  (CVE-2022-4450 edk2: openssl: double free after calling PEM_read_bio_ex [rhel-9])
 * Mon Feb 06 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20221207gitfff6d81270b5-5
 - edk2-Revert-ArmVirtPkg-ArmVirtQemu-enable-initial-ID-map-.patch [bz#2157656]
 - Resolves: bz#2157656
  ([edk2] [aarch64] Unable to initialize EFI firmware when using edk2-aarch64-20221207gitfff6d81270b5-1.el9 in some hardwares)
 * Wed Jan 18 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20221207gitfff6d81270b5-4
 - edk2-ArmVirt-don-t-use-unaligned-CopyMem-on-NOR-flash.patch [bz#2158173]
 - Resolves: bz#2158173
  ([aarch64][numa] Failed to create 2 numa nodes in some hardwares)
 * Mon Jan 16 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20221207gitfff6d81270b5-3
 - edk2-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch [bz#2158173]
 - edk2-MdePkg-Remove-Itanium-leftover-data-structure-RH-onl.patch [bz#1983086]
 - Resolves: bz#2158173
  ([aarch64][numa] Failed to create 2 numa nodes in some hardwares)
 - Resolves: bz#1983086
  (Assertion failure when creating 1024 VCPU VM: [...]UefiCpuPkg/CpuMpPei/CpuBist.c(186): !EFI_ERROR (Status))
 * Thu Jan 05 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20221207gitfff6d81270b5-2
 - edk2-use-rpm-build-flags-rh-only.patch [RHEL-177]
 - Resolves: RHEL-177
  (Enable GNU_RELRO security protection)
 * Thu Dec 15 2022 Camilla Conte <cconte@redhat.com> - 20221207gitfff6d81270b5-1
 - Rebase to edk2-stable202211 tag
  Resolves: RHEL-119
  (rebase edk2 to edk2-stable202211)
 - Resolves: RHEL-75
  (edk2 builds should show the build version)
 - Resolves: bz#2132951
  (edk2: Sort traditional virtualization builds before Confidential Computing builds)
 * Mon Nov 21 2022 Miroslav Rezanina <mrezanin@redhat.com> - 20220826gitba0e0e4c6a-2
 - edk2-MdeModulePkg-PiSmmCore-SmmEntryPoint-underflow-CVE-2.patch [bz#1989857]
 - Resolves: bz#1989857
  (CVE-2021-38578 edk2: integer underflow in SmmEntryPoint function leads to potential SMM privilege escalation [rhel-9.0])
 * Tue Oct 11 2022 Miroslav Rezanina <mrezanin@redhat.com> -  0220826gitba0e0e4c6a-1
 - Rebase to edk2-stable202208 tag [RHELX-59]
  Resolves: RHELX-59
  (rebase edk2 to 2022-08 stable tag)
 * Fri Sep 16 2022 Miroslav Rezanina <mrezanin@redhat.com> - 20220526git16779ede2d36-4
 - edk2-OvmfPkg-QemuVideoDxe-fix-bochs-mode-init.patch [RHELX-58]
 - Resolves: RHELX-58
  (Guest console turns black with uefi rhel guests and stdvga)
 * Mon Aug 01 2022 Miroslav Rezanina <mrezanin@redhat.com> - 20220526git16779ede2d36-3
 - edk2-openssl-jump-to-8.7.0-branch-2022-07-22.patch [bz#2074843]
 - edk2-ovmf-vars-generator-Use-max-cpu.patch [bz#2111567]
`@ -1,2 +1,2 @@`
	`78e6e577d9727e549bb9fb0b1973bcc2b6ec9b3d SOURCES/edk2-16779ede2d36.tar.xz`	`a1c42c2f044a95caf0c8595d351c4cc5adcfde14 SOURCES/edk2-fff6d81270b5.tar.xz`
	`f6b8cfc123a75525218c6588ec16b61f17cb420d SOURCES/openssl-rhel-740e53ace8f6771c205bf84780e26bcd7a3275df.tar.xz`	`c0518a4102a3909928dcc2e0a2c1784a53a419c6 SOURCES/openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz`
`@ -1,2 +1,2 @@`
	`SOURCES/edk2-16779ede2d36.tar.xz`	`SOURCES/edk2-fff6d81270b5.tar.xz`
	`SOURCES/openssl-rhel-740e53ace8f6771c205bf84780e26bcd7a3275df.tar.xz`	`SOURCES/openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz`