* Tue Apr 02 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20240214-1

- Imported edk2-202402 from RHEL 9
- Resolves: RHEL-30180

0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch

@@ -1,43 +0,0 @@
-From bdb3ed312b939fc5f0c7b9b56c2395dada7c689c Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Thu, 4 Jun 2020 13:34:12 +0200
-Subject: [PATCH 01/14] BaseTools: do not build BrotliCompress (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- New patch.
-
-BrotliCompress is not used for building ArmVirtPkg or OvmfPkg platforms.
-It depends on one of the upstream Brotli git submodules that we removed
-earlier in this rebase series. (See patch "remove upstream edk2's Brotli
-submodules (RH only").
-
-Do not attempt to build BrotliCompress.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit db8ccca337e2c5722c1d408d2541cf653d3371a2)
----
- BaseTools/Source/C/GNUmakefile | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/BaseTools/Source/C/GNUmakefile b/BaseTools/Source/C/GNUmakefile
-index 5275f657efe8..39d719975309 100644
---- a/BaseTools/Source/C/GNUmakefile
-+++ b/BaseTools/Source/C/GNUmakefile
-@@ -51,7 +51,6 @@ all: makerootdir subdirs
- LIBRARIES = Common
- VFRAUTOGEN = VfrCompile/VfrLexer.h
- APPLICATIONS = \
--  BrotliCompress \
-   VfrCompile \
-   EfiRom \
-   GenFfs \
--- 
-2.41.0
-

0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch

@@ -1,50 +0,0 @@
-From d42cd3199b6a33ec9811e5cc42a6ef0647d6a597 Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Thu, 4 Jun 2020 13:39:08 +0200
-Subject: [PATCH 02/14] MdeModulePkg: remove package-private Brotli include
- path (RH only)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- no change
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- New patch.
-
-Originating from upstream commit 58802e02c41b
-("MdeModulePkg/BrotliCustomDecompressLib: Make brotli a submodule",
-2020-04-16), "MdeModulePkg/MdeModulePkg.dec" contains a package-internal
-include path into a Brotli submodule.
-
-The edk2 build system requires such include paths to resolve successfully,
-regardless of the firmware platform being built. Because
-BrotliCustomDecompressLib is not consumed by any OvmfPkg or ArmVirtPkg
-platforms, and we've removed the submodule earlier in this patch set,
-remove the include path too.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit e05e0de713c4a2b8adb6ff9809611f222bfe50ed)
----
- MdeModulePkg/MdeModulePkg.dec | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 0ff058b0a9da..2f8e49f87bcc 100644
---- a/MdeModulePkg/MdeModulePkg.dec
-+++ b/MdeModulePkg/MdeModulePkg.dec
-@@ -26,9 +26,6 @@ [Includes]
-   Include
-   Test/Mock/Include
- 
--[Includes.Common.Private]
--  Library/BrotliCustomDecompressLib/brotli/c/include
--
- [LibraryClasses]
-   ##  @libraryclass  Defines a set of methods to reset whole system.
-   ResetSystemLib|Include/Library/ResetSystemLib.h
--- 
-2.41.0
-

0003-Remove-paths-leading-to-submodules.patch

@@ -0,0 +1,65 @@
+From 3ab8a3e323e1bafb82266c0728e60a42d173764f Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Thu, 24 Mar 2022 03:23:02 -0400
+Subject: [PATCH] Remove paths leading to submodules
+
+We removed submodules used upstream. However, edk2 build system requires
+such include paths to resolve successfully, regardless of the firmware
+platform being built.
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ BaseTools/Source/C/GNUmakefile | 1 -
+ MdeModulePkg/MdeModulePkg.dec  | 3 ---
+ MdePkg/MdePkg.dec              | 5 -----
+ 3 files changed, 9 deletions(-)
+
+diff --git a/BaseTools/Source/C/GNUmakefile b/BaseTools/Source/C/GNUmakefile
+index 5275f657ef..39d7199753 100644
+--- a/BaseTools/Source/C/GNUmakefile
++++ b/BaseTools/Source/C/GNUmakefile
+@@ -51,7 +51,6 @@ all: makerootdir subdirs
+ LIBRARIES = Common
+ VFRAUTOGEN = VfrCompile/VfrLexer.h
+ APPLICATIONS = \
+-  BrotliCompress \
+   VfrCompile \
+   EfiRom \
+   GenFfs \
+diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
+index a2cd83345f..98b3acb703 100644
+--- a/MdeModulePkg/MdeModulePkg.dec
++++ b/MdeModulePkg/MdeModulePkg.dec
+@@ -26,9 +26,6 @@
+   Include
+   Test/Mock/Include
+ 
+-[Includes.Common.Private]
+-  Library/BrotliCustomDecompressLib/brotli/c/include
+-
+ [LibraryClasses]
+   ##  @libraryclass  Defines a set of methods to reset whole system.
+   ResetSystemLib|Include/Library/ResetSystemLib.h
+diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
+index 0459418906..bb347547f8 100644
+--- a/MdePkg/MdePkg.dec
++++ b/MdePkg/MdePkg.dec
+@@ -29,7 +29,6 @@
+   Include
+   Test/UnitTest/Include
+   Test/Mock/Include
+-  Library/MipiSysTLib/mipisyst/library/include
+ 
+ [Includes.IA32]
+   Include/Ia32
+@@ -295,10 +294,6 @@
+   #
+   FdtLib|Include/Library/FdtLib.h
+ 
+-  ##  @libraryclass  Provides general mipi sys-T services.
+-  #
+-  MipiSysTLib|Include/Library/MipiSysTLib.h
+-
+   ##  @libraryclass  Provides API to output Trace Hub debug message.
+   #
+   TraceHubDebugSysTLib|Include/Library/TraceHubDebugSysTLib.h

0004-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch

@@ -1,9 +1,21 @@
-From e88e9ee342a168114a27c0fa09e807161bf54490 Mon Sep 17 00:00:00 2001
+From 1a8cccb3be265d0c423bbb42511b1d9111b076e0 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Tue, 25 Feb 2014 22:40:01 +0100
-Subject: [PATCH 03/14] MdeModulePkg: TerminalDxe: set xterm resolution on mode
+Subject: [PATCH] MdeModulePkg: TerminalDxe: set xterm resolution on mode
  change (RH only)
 
+Notes for rebase to edk2-stable202311:
+
+- Minor context changes due to new PCDs (for USB Networking) being added.
+
+Notes for rebase to edk2-stable202205:
+
+- Minor context changes due to fd306d1dbc MdeModulePkg: Add PcdTdxSharedBitMask
+
+Notes for rebase to edk2-stable202202:
+
+- Minor context changes due to 1436aea4d MdeModulePkg: Apply uncrustify changes
+
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
 
@@ -82,15 +94,15 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit bc2266f20de5db1636e09a07e4a72c8dbf505f5a)
 ---
  MdeModulePkg/MdeModulePkg.dec                 |  4 +++
+ .../Console/TerminalDxe/TerminalConOut.c      | 30 +++++++++++++++++++
  .../Console/TerminalDxe/TerminalDxe.inf       |  2 ++
- .../Console/TerminalDxe/TerminalConOut.c      | 29 +++++++++++++++++++
+ 3 files changed, 36 insertions(+)
- 3 files changed, 35 insertions(+)
 
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 2f8e49f87bcc..c1b10b38ef1d 100644
+index 98b3acb703..71a2967646 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
-@@ -2148,6 +2148,10 @@ [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
+@@ -2164,6 +2164,10 @@
    # @Prompt The value is use for Usb Network rate limiting supported.
    gEfiMdeModulePkgTokenSpaceGuid.PcdUsbNetworkRateLimitingFactor|100|UINT32|0x10000028
  
@@ -101,28 +113,8 @@ index 2f8e49f87bcc..c1b10b38ef1d 100644
  [PcdsPatchableInModule]
    ## Specify memory size with page number for PEI code when
    #  Loading Module at Fixed Address feature is enabled.
-diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
-index b2a8aeba8510..eff625346539 100644
---- a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
-+++ b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
-@@ -55,6 +55,7 @@ [LibraryClasses]
-   DebugLib
-   PcdLib
-   BaseLib
-+  PrintLib
- 
- [Guids]
-   ## SOMETIMES_PRODUCES ## Variable:L"ConInDev"
-@@ -87,6 +88,7 @@ [Protocols]
- [Pcd]
-   gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType           ## SOMETIMES_CONSUMES
-   gEfiMdeModulePkgTokenSpaceGuid.PcdErrorCodeSetVariable    ## CONSUMES
-+  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm             ## CONSUMES
- 
- # [Event]
- # # Relative timer event set by UnicodeToEfiKey(), used to be one 2 seconds input timeout.
 diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
-index 7809869e7d49..496849458db4 100644
+index 7809869e7d..3be801039b 100644
 --- a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
 +++ b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
 @@ -7,6 +7,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
@@ -134,7 +126,7 @@ index 7809869e7d49..496849458db4 100644
  #include "Terminal.h"
  
  //
-@@ -80,6 +82,15 @@ CHAR16  mSetCursorPositionString[] = { ESC, '[', '0', '0', ';', '0', '0', 'H', 0
+@@ -80,6 +82,16 @@ CHAR16  mSetCursorPositionString[] = { ESC, '[', '0', '0', ';', '0', '0', 'H', 0
  CHAR16  mCursorForwardString[]     = { ESC, '[', '0', '0', 'C', 0 };
  CHAR16  mCursorBackwardString[]    = { ESC, '[', '0', '0', 'D', 0 };
  
@@ -146,11 +138,12 @@ index 7809869e7d49..496849458db4 100644
 +//
 +CHAR8 mResizeTextAreaFormatString[] = "\x1B[8;%d;%dt";
 +#define RESIZE_SEQ_SIZE (sizeof mResizeTextAreaFormatString + 2 * (11 - 2))
++
 +
  //
  // Body of the ConOut functions
  //
-@@ -498,6 +509,24 @@ TerminalConOutSetMode (
+@@ -498,6 +510,24 @@ TerminalConOutSetMode (
      return EFI_DEVICE_ERROR;
    }
  
@@ -175,6 +168,23 @@ index 7809869e7d49..496849458db4 100644
    This->Mode->Mode = (INT32)ModeNumber;
  
    Status = This->ClearScreen (This);
--- 
+diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
-2.41.0
+index b2a8aeba85..96810f337c 100644
+--- a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
++++ b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
+@@ -55,6 +55,7 @@
+   DebugLib
+   PcdLib
+   BaseLib
++  PrintLib
  
+ [Guids]
+   ## SOMETIMES_PRODUCES ## Variable:L"ConInDev"
+@@ -87,6 +88,7 @@
+ [Pcd]
+   gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType           ## SOMETIMES_CONSUMES
+   gEfiMdeModulePkgTokenSpaceGuid.PcdErrorCodeSetVariable    ## CONSUMES
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm             ## CONSUMES
+ 
+ # [Event]
+ # # Relative timer event set by UnicodeToEfiKey(), used to be one 2 seconds input timeout.

0005-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch

@@ -1,17 +1,12 @@
-From 20ba2d80413888bfcb1f5e5ba914b5c67fc4ced2 Mon Sep 17 00:00:00 2001
+From cf04a1c13e796013f0cb06447127cf5cf35eb0a0 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 14 Oct 2015 15:59:06 +0200
-Subject: [PATCH 04/14] OvmfPkg: take PcdResizeXterm from the QEMU command line
+Subject: [PATCH] OvmfPkg: take PcdResizeXterm from the QEMU command line (RH
- (RH only)
+ only)
 
-edk2-stable202205 rebase
+Notes about edk2-stable202205 rebase
 
-- re-add UPDATE_BOOLEAN_PCD_FROM_FW_CFG
+- Necessary minor fixes for upstream changes
-- add microvm, cloudhw and inteltdx
-
-edk2-stable202108 rebase
-
-- resolve conflict in OvmfPkg/PlatformPei/PlatformPei.inf
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -79,19 +74,19 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  OvmfPkg/AmdSev/AmdSevX64.dsc        |  1 +
  OvmfPkg/CloudHv/CloudHvX64.dsc      |  1 +
  OvmfPkg/IntelTdx/IntelTdxX64.dsc    |  1 +
- OvmfPkg/Microvm/MicrovmX64.dsc      |  1 +
+ OvmfPkg/Microvm/MicrovmX64.dsc      |  2 +-
  OvmfPkg/OvmfPkgIa32.dsc             |  1 +
  OvmfPkg/OvmfPkgIa32X64.dsc          |  1 +
  OvmfPkg/OvmfPkgX64.dsc              |  1 +
- OvmfPkg/PlatformPei/PlatformPei.inf |  1 +
  OvmfPkg/PlatformPei/Platform.c      | 13 +++++++++++++
- 9 files changed, 21 insertions(+)
+ OvmfPkg/PlatformPei/PlatformPei.inf |  1 +
+ 9 files changed, 21 insertions(+), 1 deletion(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 2c6ed7c9745f..cf81a86c67dd 100644
+index a31a89344a..d6bfc43fe5 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -477,6 +477,7 @@ [PcdsFixedAtBuild]
+@@ -484,6 +484,7 @@
  [PcdsDynamicDefault]
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -100,10 +95,10 @@ index 2c6ed7c9745f..cf81a86c67dd 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc
-index e000deed9e4d..7a167bd4d039 100644
+index b522fa1059..c5fd84027f 100644
 --- a/OvmfPkg/CloudHv/CloudHvX64.dsc
 +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc
-@@ -576,6 +576,7 @@ [PcdsDynamicDefault]
+@@ -579,6 +579,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -112,10 +107,10 @@ index e000deed9e4d..7a167bd4d039 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-index 193657ff2d61..bfcd486976cf 100644
+index 82e3e41cfc..6d72b80dc9 100644
 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
 +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-@@ -474,6 +474,7 @@ [PcdsDynamicDefault]
+@@ -477,6 +477,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -124,22 +119,23 @@ index 193657ff2d61..bfcd486976cf 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
-index 2f7585639374..023b7b0fe959 100644
+index 063324cd05..53222d80be 100644
 --- a/OvmfPkg/Microvm/MicrovmX64.dsc
 +++ b/OvmfPkg/Microvm/MicrovmX64.dsc
-@@ -577,6 +577,7 @@ [PcdsDynamicDefault]
+@@ -582,7 +582,7 @@
+   # only set when
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
- 
+-
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 80d8e370095d..2395bcf6b8dc 100644
+index 28379961a7..4f6dfedc2c 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -604,6 +604,7 @@ [PcdsDynamicDefault]
+@@ -599,6 +599,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -148,10 +144,10 @@ index 80d8e370095d..2395bcf6b8dc 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index d9757149e359..9bf5ac0d143c 100644
+index 5e9eee628a..923e187942 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -616,6 +616,7 @@ [PcdsDynamicDefault]
+@@ -611,6 +611,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -160,10 +156,10 @@ index d9757149e359..9bf5ac0d143c 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index b12d874daa0a..69deaf8e08ec 100644
+index bf4c7906c4..06b38b1715 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -634,6 +634,7 @@ [PcdsDynamicDefault]
+@@ -629,6 +629,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -171,20 +167,8 @@ index b12d874daa0a..69deaf8e08ec 100644
  !if $(SMM_REQUIRE) == FALSE
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
-diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf
-index 3934aeed9514..98123ec63b3d 100644
---- a/OvmfPkg/PlatformPei/PlatformPei.inf
-+++ b/OvmfPkg/PlatformPei/PlatformPei.inf
-@@ -100,6 +100,7 @@ [Pcd]
-   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
-   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize
-   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved
-+  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm
-   gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode
-   gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
-   gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
 diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
-index f5dc41c3a8c4..ce9868d57de1 100644
+index f5dc41c3a8..f244dcd24d 100644
 --- a/OvmfPkg/PlatformPei/Platform.c
 +++ b/OvmfPkg/PlatformPei/Platform.c
 @@ -41,6 +41,18 @@
@@ -214,6 +198,15 @@ index f5dc41c3a8c4..ce9868d57de1 100644
    }
  
    InstallClearCacheCallback ();
--- 
+diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf
-2.41.0
+index ad52be3065..d7d688284b 100644
-
+--- a/OvmfPkg/PlatformPei/PlatformPei.inf
++++ b/OvmfPkg/PlatformPei/PlatformPei.inf
+@@ -100,6 +100,7 @@
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm
+   gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode
+   gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
+   gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack

0006-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch

@@ -1,8 +1,8 @@
-From 5b56419459e64d33cd92b4b98ef954bca8f9f344 Mon Sep 17 00:00:00 2001
+From 65e47dac7f0c2cc4d5fa2513f4a217a060c9da3c Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Sun, 26 Jul 2015 08:02:50 +0000
-Subject: [PATCH 05/14] ArmVirtPkg: take PcdResizeXterm from the QEMU command
+Subject: [PATCH] ArmVirtPkg: take PcdResizeXterm from the QEMU command line
- line (RH only)
+ (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -89,17 +89,17 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit a5f7a57bf390f1f340ff1d1f1884a73716817ef1)
 ---
  ArmVirtPkg/ArmVirtQemu.dsc                    |  7 +++-
- .../TerminalPcdProducerLib.inf                | 33 ++++++++++++++++++
  .../TerminalPcdProducerLib.c                  | 34 +++++++++++++++++++
+ .../TerminalPcdProducerLib.inf                | 33 ++++++++++++++++++
  3 files changed, 73 insertions(+), 1 deletion(-)
- create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
  create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
+ create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 1e0225951aef..9f52eb44a1fd 100644
+index e48c75b5e9..181265057e 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -308,6 +308,8 @@ [PcdsPatchableInModule]
+@@ -309,6 +309,8 @@
    gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0x0
  !endif
  
@@ -108,7 +108,7 @@ index 1e0225951aef..9f52eb44a1fd 100644
  [PcdsDynamicHii]
    gUefiOvmfPkgTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gOvmfVariableGuid|0x0|FALSE|NV,BS
  
-@@ -417,7 +419,10 @@ [Components.common]
+@@ -418,7 +420,10 @@
    MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
    MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitterDxe.inf
    MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
@@ -120,48 +120,9 @@ index 1e0225951aef..9f52eb44a1fd 100644
    MdeModulePkg/Universal/SerialDxe/SerialDxe.inf
  
    MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
-diff --git a/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
-new file mode 100644
-index 000000000000..a51dbd1670a8
---- /dev/null
-+++ b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
-@@ -0,0 +1,33 @@
-+## @file
-+#  Plugin library for setting up dynamic PCDs for TerminalDxe, from fw_cfg
-+#
-+#  Copyright (C) 2015-2020, Red Hat, Inc.
-+#  Copyright (c) 2014, Linaro Ltd. All rights reserved.<BR>
-+#
-+#  SPDX-License-Identifier: BSD-2-Clause-Patent
-+##
-+
-+[Defines]
-+  INF_VERSION                    = 0x00010005
-+  BASE_NAME                      = TerminalPcdProducerLib
-+  FILE_GUID                      = 4a0c5ed7-8c42-4c01-8f4c-7bf258316a96
-+  MODULE_TYPE                    = BASE
-+  VERSION_STRING                 = 1.0
-+  LIBRARY_CLASS                  = NULL
-+  CONSTRUCTOR                    = TerminalPcdProducerLibConstructor
-+
-+[Sources]
-+  TerminalPcdProducerLib.c
-+
-+[Packages]
-+  MdeModulePkg/MdeModulePkg.dec
-+  MdePkg/MdePkg.dec
-+  OvmfPkg/OvmfPkg.dec
-+
-+[LibraryClasses]
-+  DebugLib
-+  PcdLib
-+  QemuFwCfgSimpleParserLib
-+
-+[Pcd]
-+  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm ## SOMETIMES_PRODUCES
 diff --git a/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
 new file mode 100644
-index 000000000000..bfd3a6a535f9
+index 0000000000..37f71c5e4c
 --- /dev/null
 +++ b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
 @@ -0,0 +1,34 @@
@@ -199,6 +160,42 @@ index 000000000000..bfd3a6a535f9
 +  UPDATE_BOOLEAN_PCD_FROM_FW_CFG (PcdResizeXterm);
 +  return RETURN_SUCCESS;
 +}
--- 
+diff --git a/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
-2.41.0
+new file mode 100644
-
+index 0000000000..c840f6f97a
+--- /dev/null
++++ b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
+@@ -0,0 +1,33 @@
++## @file
++#  Plugin library for setting up dynamic PCDs for TerminalDxe, from fw_cfg
++#
++#  Copyright (C) 2015-2020, Red Hat, Inc.
++#  Copyright (c) 2014, Linaro Ltd. All rights reserved.<BR>
++#
++#  SPDX-License-Identifier: BSD-2-Clause-Patent
++##
++
++[Defines]
++  INF_VERSION                    = 0x00010005
++  BASE_NAME                      = TerminalPcdProducerLib
++  FILE_GUID                      = 4a0c5ed7-8c42-4c01-8f4c-7bf258316a96
++  MODULE_TYPE                    = BASE
++  VERSION_STRING                 = 1.0
++  LIBRARY_CLASS                  = NULL
++  CONSTRUCTOR                    = TerminalPcdProducerLibConstructor
++
++[Sources]
++  TerminalPcdProducerLib.c
++
++[Packages]
++  MdeModulePkg/MdeModulePkg.dec
++  MdePkg/MdePkg.dec
++  OvmfPkg/OvmfPkg.dec
++
++[LibraryClasses]
++  DebugLib
++  PcdLib
++  QemuFwCfgSimpleParserLib
++
++[Pcd]
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm ## SOMETIMES_PRODUCES

0007-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 6f1c7583bce90e89193ae40042923f16c6e16ca7 Mon Sep 17 00:00:00 2001
+From cf51a0c4a259a505f58c1cf626864f41cf3f27ef Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:45 +0100
-Subject: [PATCH 06/14] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
+Subject: [PATCH] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -65,10 +65,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index cf81a86c67dd..d8b1c4d9e8af 100644
+index d6bfc43fe5..2b4c551773 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -427,7 +427,7 @@ [PcdsFixedAtBuild]
+@@ -429,7 +429,7 @@
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -78,10 +78,10 @@ index cf81a86c67dd..d8b1c4d9e8af 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 2395bcf6b8dc..21118b11f6b3 100644
+index 4f6dfedc2c..ae3b446ff2 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -537,7 +537,7 @@ [PcdsFixedAtBuild]
+@@ -535,7 +535,7 @@
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -91,10 +91,10 @@ index 2395bcf6b8dc..21118b11f6b3 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 9bf5ac0d143c..afb1afcceb61 100644
+index 923e187942..4a547f28c0 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -544,7 +544,7 @@ [PcdsFixedAtBuild]
+@@ -542,7 +542,7 @@
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -104,10 +104,10 @@ index 9bf5ac0d143c..afb1afcceb61 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 69deaf8e08ec..45e0658e2b4a 100644
+index 06b38b1715..68bd1f6dcb 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -563,7 +563,7 @@ [PcdsFixedAtBuild]
+@@ -561,7 +561,7 @@
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -116,6 +116,3 @@ index 69deaf8e08ec..45e0658e2b4a 100644
  
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
--- 
-2.41.0
-

0008-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch

@@ -1,9 +1,13 @@
-From eaf1ac5c40d16705219e5021d4878e52904467ba Mon Sep 17 00:00:00 2001
+From 3ece2f792aec743c42c415809846ea1ac1f0aedf Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:46 +0100
-Subject: [PATCH 07/14] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
+Subject: [PATCH] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
  QemuVideoDxe/QemuRamfbDxe (RH)
 
+edk2-stable202402 rebase:
+
+- context changes due to CSM support removal.
+
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
 
@@ -82,12 +86,12 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 32 insertions(+), 8 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index d8b1c4d9e8af..b3b70b600139 100644
+index 2b4c551773..f81a0ac375 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -685,8 +685,14 @@ [Components]
+@@ -691,8 +691,14 @@
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
-   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
@@ -103,20 +107,19 @@ index d8b1c4d9e8af..b3b70b600139 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 21118b11f6b3..8686da30008f 100644
+index ae3b446ff2..7e07fbfd46 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -850,9 +850,15 @@ [Components]
+@@ -828,8 +828,14 @@
-   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
  
- !ifndef $(CSM_ENABLE)
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
- !endif
--  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
@@ -125,20 +128,19 @@ index 21118b11f6b3..8686da30008f 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index afb1afcceb61..4b9c0b312532 100644
+index 4a547f28c0..f28c71a7a8 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -868,9 +868,15 @@ [Components.X64]
+@@ -842,8 +842,14 @@
-   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
  
- !ifndef $(CSM_ENABLE)
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
- !endif
--  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
@@ -147,20 +149,19 @@ index afb1afcceb61..4b9c0b312532 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 45e0658e2b4a..9b83e51ba3c1 100644
+index 68bd1f6dcb..680bdb5f4c 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -936,9 +936,15 @@ [Components]
+@@ -910,8 +910,14 @@
-   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
  
- !ifndef $(CSM_ENABLE)
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
- !endif
--  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
@@ -168,6 +169,3 @@ index 45e0658e2b4a..9b83e51ba3c1 100644
    OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
  
    #
--- 
-2.41.0
-

0009-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch

@@ -1,7 +1,7 @@
-From 298ab8d033dac6298239b70a6494eb2de472e54f Mon Sep 17 00:00:00 2001
+From 33b60bfb25647368c761ae9d875c481086e147ce Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 27 Jan 2016 03:05:18 +0100
-Subject: [PATCH 08/14] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
+Subject: [PATCH] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
  QemuRamfbDxe (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -61,10 +61,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  2 files changed, 8 insertions(+), 2 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 9f52eb44a1fd..8b44fadeeb39 100644
+index 181265057e..216b5a09cc 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -546,7 +546,10 @@ [Components.common]
+@@ -547,7 +547,10 @@
    #
    # Video support
    #
@@ -77,10 +77,10 @@ index 9f52eb44a1fd..8b44fadeeb39 100644
    OvmfPkg/PlatformDxe/Platform.inf
  
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 8ef5927b53ff..2503cdb79c27 100644
+index 668a65ba64..5f07ed4dcc 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -446,7 +446,10 @@ [Components.common]
+@@ -447,7 +447,10 @@
    #
    # Video support
    #
@@ -92,6 +92,3 @@ index 8ef5927b53ff..2503cdb79c27 100644
    OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
    OvmfPkg/PlatformDxe/Platform.inf
  
--- 
-2.41.0
-

0010-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch

@@ -1,8 +1,8 @@
-From ad5e6471ec1d395c6395d0e9775a88e239570884 Mon Sep 17 00:00:00 2001
+From d4be04b114213cc9b8ee4ce86a91a1c7e2c3928a Mon Sep 17 00:00:00 2001
 From: Philippe Mathieu-Daude <philmd@redhat.com>
 Date: Thu, 1 Aug 2019 20:43:48 +0200
-Subject: [PATCH 09/14] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on
+Subject: [PATCH] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on Aarch64
- Aarch64 silent builds (RH only)
+ silent builds (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -42,24 +42,12 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit aa2b66b18a62d652bdbefae7b5732297294306ca)
 (cherry picked from commit deb3451034326b75fd760aba47a5171493ff055e)
 ---
+ OvmfPkg/QemuRamfbDxe/QemuRamfb.c      | 14 ++++++++++++++
  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf |  1 +
- OvmfPkg/QemuRamfbDxe/QemuRamfb.c      | 15 +++++++++++++++
+ 2 files changed, 15 insertions(+)
- 2 files changed, 16 insertions(+)
 
-diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-index e3890b8c202f..6ffee5acb24c 100644
---- a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-+++ b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-@@ -29,6 +29,7 @@ [LibraryClasses]
-   BaseLib
-   BaseMemoryLib
-   DebugLib
-+  DebugPrintErrorLevelLib
-   DevicePathLib
-   FrameBufferBltLib
-   MemoryAllocationLib
 diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
-index 5a1044f0dc7b..3a687901b0d2 100644
+index 5a1044f0dc..83c6d26c74 100644
 --- a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
 +++ b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
 @@ -13,6 +13,7 @@
@@ -70,7 +58,7 @@ index 5a1044f0dc7b..3a687901b0d2 100644
  #include <Library/DevicePathLib.h>
  #include <Library/FrameBufferBltLib.h>
  #include <Library/MemoryAllocationLib.h>
-@@ -259,6 +260,20 @@ InitializeQemuRamfb (
+@@ -259,6 +260,19 @@ InitializeQemuRamfb (
  
    Status = QemuFwCfgFindFile ("etc/ramfb", &mRamfbFwCfgItem, &FwCfgSize);
    if (EFI_ERROR (Status)) {
@@ -86,11 +74,19 @@ index 5a1044f0dc7b..3a687901b0d2 100644
 +    if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
 +      return EFI_SUCCESS;
 +    }
-+
 +#endif
      return EFI_NOT_FOUND;
    }
  
--- 
+diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-2.41.0
+index e3890b8c20..f79a4bc987 100644
-
+--- a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
++++ b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
+@@ -29,6 +29,7 @@
+   BaseLib
+   BaseMemoryLib
+   DebugLib
++  DebugPrintErrorLevelLib
+   DevicePathLib
+   FrameBufferBltLib
+   MemoryAllocationLib

0011-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch

@@ -1,8 +1,8 @@
-From a5c8a37b20394f8b2595c0e520955667b4c17527 Mon Sep 17 00:00:00 2001
+From e76b481430fc3ef2398cdbe4d21ce002050aa12b Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:47 +0100
-Subject: [PATCH 10/14] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in
+Subject: [PATCH] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in NvmExpressDxe
- NvmExpressDxe (RH only)
+ (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -63,10 +63,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 16 insertions(+), 4 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index b3b70b600139..865d150a2871 100644
+index f81a0ac375..bdb786d10d 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -679,7 +679,10 @@ [Components]
+@@ -686,7 +686,10 @@
    MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@@ -79,10 +79,10 @@ index b3b70b600139..865d150a2871 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 8686da30008f..9cd981ae7be8 100644
+index 7e07fbfd46..8a8c7a0b37 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -843,7 +843,10 @@ [Components]
+@@ -823,7 +823,10 @@
    MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@@ -95,10 +95,10 @@ index 8686da30008f..9cd981ae7be8 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 4b9c0b312532..9186ab2ba83b 100644
+index f28c71a7a8..4bde14a05a 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -861,7 +861,10 @@ [Components.X64]
+@@ -837,7 +837,10 @@
    MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@@ -111,10 +111,10 @@ index 4b9c0b312532..9186ab2ba83b 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 9b83e51ba3c1..a059f143f5be 100644
+index 680bdb5f4c..a43352ede4 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -929,7 +929,10 @@ [Components]
+@@ -905,7 +905,10 @@
    MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@@ -126,6 +126,3 @@ index 9b83e51ba3c1..a059f143f5be 100644
    MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
--- 
-2.41.0
-

0012-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch

@@ -1,8 +1,8 @@
-From 8cc002364f8c51114a39782737088331a7c6c5c3 Mon Sep 17 00:00:00 2001
+From 47ad6974185793994d69620d989f6d695f513c9c Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:31:36 +0200
-Subject: [PATCH 11/14] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no
+Subject: [PATCH] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no "-kernel"
- "-kernel" in silent aa64 build (RH)
+ in silent aa64 build (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -27,24 +27,12 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 (cherry picked from commit 9adcdf493ebbd11efb74e2905ab5f6c8996e096d)
 ---
+ .../QemuKernelLoaderFsDxe.c                     | 17 +++++++++++++++++
  .../QemuKernelLoaderFsDxe.inf                   |  1 +
- .../QemuKernelLoaderFsDxe.c                    | 18 ++++++++++++++++++
+ 2 files changed, 18 insertions(+)
- 2 files changed, 19 insertions(+)
 
-diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
-index 7b35adb8e034..e0331c6e2cbc 100644
---- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
-+++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
-@@ -28,6 +28,7 @@ [LibraryClasses]
-   BaseLib
-   BaseMemoryLib
-   DebugLib
-+  DebugPrintErrorLevelLib
-   DevicePathLib
-   MemoryAllocationLib
-   QemuFwCfgLib
 diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
-index 3c12085f6c1e..e473c0b57345 100644
+index 3c12085f6c..e192809198 100644
 --- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
 +++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
 @@ -19,6 +19,7 @@
@@ -55,7 +43,7 @@ index 3c12085f6c1e..e473c0b57345 100644
  #include <Library/DevicePathLib.h>
  #include <Library/MemoryAllocationLib.h>
  #include <Library/QemuFwCfgLib.h>
-@@ -1081,6 +1082,23 @@ QemuKernelLoaderFsDxeEntrypoint (
+@@ -1081,6 +1082,22 @@ QemuKernelLoaderFsDxeEntrypoint (
  
    if (KernelBlob->Data == NULL) {
      Status = EFI_NOT_FOUND;
@@ -74,11 +62,19 @@ index 3c12085f6c1e..e473c0b57345 100644
 +    if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
 +      Status = EFI_SUCCESS;
 +    }
-+
 +#endif
      goto FreeBlobs;
    }
  
--- 
+diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
-2.41.0
+index 7b35adb8e0..23d9f5fca1 100644
-
+--- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
++++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
+@@ -28,6 +28,7 @@
+   BaseLib
+   BaseMemoryLib
+   DebugLib
++  DebugPrintErrorLevelLib
+   DevicePathLib
+   MemoryAllocationLib
+   QemuFwCfgLib

0013-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch

@@ -1,8 +1,8 @@
-From 14b635b6d18976cc9661001ce0a5fa3d5eec786f Mon Sep 17 00:00:00 2001
+From 26a8f215a1cee1b876105127ad22c68a7c07c6a8 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:40:09 +0200
-Subject: [PATCH 12/14] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in
+Subject: [PATCH] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in silent
- silent aa64 build (RH)
+ aa64 build (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -26,24 +26,12 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 (cherry picked from commit cbce29f7749477e271f9764fed82de94724af5df)
 ---
- SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf |  1 +
  SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c   | 17 +++++++++++++++++
+ SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf |  1 +
  2 files changed, 18 insertions(+)
 
-diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
-index 7dc7a2683d71..3bc88339311e 100644
---- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
-+++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
-@@ -55,6 +55,7 @@ [LibraryClasses]
-   UefiRuntimeServicesTableLib
-   BaseMemoryLib
-   DebugLib
-+  DebugPrintErrorLevelLib
-   Tpm2CommandLib
-   PrintLib
-   UefiLib
 diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
-index f6ea8b2bbf18..681eb7e08b98 100644
+index f6ea8b2bbf..1fd5e187fb 100644
 --- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
 +++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
 @@ -28,6 +28,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
@@ -77,6 +65,15 @@ index f6ea8b2bbf18..681eb7e08b98 100644
      return EFI_UNSUPPORTED;
    }
  
--- 
+diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
-2.41.0
+index 7dc7a2683d..ae90070b36 100644
-
+--- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
++++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
+@@ -55,6 +55,7 @@
+   UefiRuntimeServicesTableLib
+   BaseMemoryLib
+   DebugLib
++  DebugPrintErrorLevelLib
+   Tpm2CommandLib
+   PrintLib
+   UefiLib

0014-OvmfPkg-Remove-EbcDxe-RHEL-only.patch

@@ -0,0 +1,126 @@
+From 14feac56ff842b1a9940f370ebc624846841faec Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Thu, 1 Jul 2021 20:28:49 +0200
+Subject: [PATCH] OvmfPkg: Remove EbcDxe (RHEL only)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-MergeRequest: 3: Disable features for RHEL9
+RH-Commit: [2/19] 6777c3dc453e4aecddc20216f783ba2a5acccaa0
+RH-Bugzilla: 1967747
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+Remove EFI Byte Code interpreter.
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc | 1 -
+ OvmfPkg/AmdSev/AmdSevX64.fdf | 1 -
+ OvmfPkg/OvmfPkgIa32.dsc      | 1 -
+ OvmfPkg/OvmfPkgIa32.fdf      | 1 -
+ OvmfPkg/OvmfPkgIa32X64.dsc   | 1 -
+ OvmfPkg/OvmfPkgIa32X64.fdf   | 1 -
+ OvmfPkg/OvmfPkgX64.dsc       | 1 -
+ OvmfPkg/OvmfPkgX64.fdf       | 1 -
+ 8 files changed, 8 deletions(-)
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index bdb786d10d..e565430e6c 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -611,7 +611,6 @@
+ !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
+   }
+ 
+-  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
+   UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
+   UefiCpuPkg/CpuDxe/CpuDxe.inf
+   OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
+index 9dd4095967..78b4e1d528 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.fdf
++++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
+@@ -206,7 +206,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
+ 
+ INF  MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
+ INF  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
+-INF  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
+ INF  UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
+ INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
+ INF  OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 8a8c7a0b37..ee8da63252 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -746,7 +746,6 @@
+ !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
+   }
+ 
+-  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
+   UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
+   UefiCpuPkg/CpuDxe/CpuDxe.inf
+   OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
+index 501b4de469..5e0bc9d2c5 100644
+--- a/OvmfPkg/OvmfPkgIa32.fdf
++++ b/OvmfPkg/OvmfPkgIa32.fdf
+@@ -216,7 +216,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
+ 
+ INF  MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
+ INF  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
+-INF  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
+ INF  UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
+ INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
+ INF  OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 4bde14a05a..1c7b55a430 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -760,7 +760,6 @@
+ !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
+   }
+ 
+-  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
+   UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
+   UefiCpuPkg/CpuDxe/CpuDxe.inf
+   OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
+index 74cfb58f06..ed33c906f3 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.fdf
++++ b/OvmfPkg/OvmfPkgIa32X64.fdf
+@@ -217,7 +217,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
+ 
+ INF  MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
+ INF  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
+-INF  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
+ INF  UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
+ INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
+ INF  OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index a43352ede4..9807c0a6b4 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -805,7 +805,6 @@
+ !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
+   }
+ 
+-  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
+   UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
+ 
+   UefiCpuPkg/CpuDxe/CpuDxe.inf {
+diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
+index f47ab1727e..feb3228ae2 100644
+--- a/OvmfPkg/OvmfPkgX64.fdf
++++ b/OvmfPkg/OvmfPkgX64.fdf
+@@ -239,7 +239,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
+ 
+ INF  MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
+ INF  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
+-INF  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
+ INF  UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
+ 
+ INF  UefiCpuPkg/CpuDxe/CpuDxe.inf

0015-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch

@@ -0,0 +1,126 @@
+From 94f1e0809390547cbfb0ed0e650a773c24b553ed Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Thu, 1 Jul 2021 20:28:59 +0200
+Subject: [PATCH] OvmfPkg: Remove VirtioGpu device driver (RHEL only)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-MergeRequest: 3: Disable features for RHEL9
+RH-Commit: [4/19] f0a41317291f2e9e3b5bd3125149c3866f23ab08
+RH-Bugzilla: 1967747
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+QemuVideoDxe binds virtio-vga, so VirtioGpu is not needed.
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc | 1 -
+ OvmfPkg/AmdSev/AmdSevX64.fdf | 1 -
+ OvmfPkg/OvmfPkgIa32.dsc      | 1 -
+ OvmfPkg/OvmfPkgIa32.fdf      | 1 -
+ OvmfPkg/OvmfPkgIa32X64.dsc   | 1 -
+ OvmfPkg/OvmfPkgIa32X64.fdf   | 1 -
+ OvmfPkg/OvmfPkgX64.dsc       | 1 -
+ OvmfPkg/OvmfPkgX64.fdf       | 1 -
+ 8 files changed, 8 deletions(-)
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index e565430e6c..c000cc8de8 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -701,7 +701,6 @@
+     <PcdsFixedAtBuild>
+       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+   }
+-  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ 
+   #
+   # ISA Support
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
+index 78b4e1d528..d6f785c205 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.fdf
++++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
+@@ -300,7 +300,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
+ 
+ INF  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
+-INF  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ INF  OvmfPkg/PlatformDxe/Platform.inf
+ INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
+ INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index ee8da63252..254d9f13f3 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -838,7 +838,6 @@
+     <PcdsFixedAtBuild>
+       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+   }
+-  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ 
+   #
+   # ISA Support
+diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
+index 5e0bc9d2c5..dec1258714 100644
+--- a/OvmfPkg/OvmfPkgIa32.fdf
++++ b/OvmfPkg/OvmfPkgIa32.fdf
+@@ -321,7 +321,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
+ INF  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
+-INF  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ INF  OvmfPkg/PlatformDxe/Platform.inf
+ INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
+ 
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 1c7b55a430..a3a753bd8b 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -852,7 +852,6 @@
+     <PcdsFixedAtBuild>
+       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+   }
+-  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ 
+   #
+   # ISA Support
+diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
+index ed33c906f3..00bd49c89d 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.fdf
++++ b/OvmfPkg/OvmfPkgIa32X64.fdf
+@@ -327,7 +327,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
+ INF  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
+-INF  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ INF  OvmfPkg/PlatformDxe/Platform.inf
+ INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
+ INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index 9807c0a6b4..17cc17cbde 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -920,7 +920,6 @@
+     <PcdsFixedAtBuild>
+       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+   }
+-  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ 
+   #
+   # ISA Support
+diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
+index feb3228ae2..bee30d8b4f 100644
+--- a/OvmfPkg/OvmfPkgX64.fdf
++++ b/OvmfPkg/OvmfPkgX64.fdf
+@@ -354,7 +354,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
+ INF  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
+-INF  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ INF  OvmfPkg/PlatformDxe/Platform.inf
+ INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
+ INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf

0016-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch

@@ -0,0 +1,100 @@
+From 0a61aba4d91c63ca263f628093331f6178728ad1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Thu, 1 Jul 2021 20:29:13 +0200
+Subject: [PATCH] OvmfPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-MergeRequest: 3: Disable features for RHEL9
+RH-Commit: [9/19] b40d8a6b9c38568a74fb922b12bbae9f0e721f95
+RH-Bugzilla: 1967747
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+Remove the virtio-fs driver.
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ OvmfPkg/OvmfPkgIa32.dsc    | 1 -
+ OvmfPkg/OvmfPkgIa32.fdf    | 1 -
+ OvmfPkg/OvmfPkgIa32X64.dsc | 1 -
+ OvmfPkg/OvmfPkgIa32X64.fdf | 1 -
+ OvmfPkg/OvmfPkgX64.dsc     | 1 -
+ OvmfPkg/OvmfPkgX64.fdf     | 1 -
+ 6 files changed, 6 deletions(-)
+
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 254d9f13f3..ca07b40857 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -816,7 +816,6 @@
+   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+   FatPkg/EnhancedFatDxe/Fat.inf
+   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+-  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
+index dec1258714..55d0f1ae5f 100644
+--- a/OvmfPkg/OvmfPkgIa32.fdf
++++ b/OvmfPkg/OvmfPkgIa32.fdf
+@@ -290,7 +290,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ 
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+-INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index a3a753bd8b..a5322783e5 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -830,7 +830,6 @@
+   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+   FatPkg/EnhancedFatDxe/Fat.inf
+   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+-  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
+index 00bd49c89d..fba268521b 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.fdf
++++ b/OvmfPkg/OvmfPkgIa32X64.fdf
+@@ -291,7 +291,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ 
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+-INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index 17cc17cbde..190431b6fa 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -898,7 +898,6 @@
+   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+   FatPkg/EnhancedFatDxe/Fat.inf
+   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+-  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
+index bee30d8b4f..cea0e87cbf 100644
+--- a/OvmfPkg/OvmfPkgX64.fdf
++++ b/OvmfPkg/OvmfPkgX64.fdf
+@@ -316,7 +316,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ 
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+-INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf

0017-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch

@@ -0,0 +1,61 @@
+From 068776b4d85587427fbceebf0e79938eea33f68e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Thu, 1 Jul 2021 20:29:16 +0200
+Subject: [PATCH] ArmVirtPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-MergeRequest: 3: Disable features for RHEL9
+RH-Commit: [10/19] 808ad4385c24fbf34fb0ba359808e6d364e1d030
+RH-Bugzilla: 1967747
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+Remove the virtio-fs driver.
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ ArmVirtPkg/ArmVirtQemu.dsc           | 1 -
+ ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 -
+ ArmVirtPkg/ArmVirtQemuKernel.dsc     | 1 -
+ 3 files changed, 3 deletions(-)
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index 216b5a09cc..1e6c76795b 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
++++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -465,7 +465,6 @@
+   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+   FatPkg/EnhancedFatDxe/Fat.inf
+   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+-  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
+ 
+   #
+   # Bds
+diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+index c5d097ffb9..a814653dc4 100644
+--- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
++++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+@@ -84,7 +84,6 @@ READ_LOCK_STATUS   = TRUE
+   INF FatPkg/EnhancedFatDxe/Fat.inf
+   INF MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+   INF MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+-  INF OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
+ 
+   #
+   # Status Code Routing
+diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+index 5f07ed4dcc..e48bdf8deb 100644
+--- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
++++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+@@ -365,7 +365,6 @@
+   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+   FatPkg/EnhancedFatDxe/Fat.inf
+   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+-  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
+ 
+   #
+   # Bds

0017-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch

@@ -1,100 +0,0 @@
-From d33fa1e334e7dc75a3cd43728e1c825acd52f5c3 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Mon, 25 Sep 2023 09:48:46 +0200
-Subject: [PATCH 17/17] OvmfPkg: set PcdVariableStoreSize +
- PcdMaxVolatileVariableSize unconditionally
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- OvmfPkg/OvmfPkgIa32.dsc    | 10 ----------
- OvmfPkg/OvmfPkgIa32X64.dsc | 10 ----------
- OvmfPkg/OvmfPkgX64.dsc     | 10 ----------
- 3 files changed, 30 deletions(-)
-
-diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index d20afa771c36..1c3437e7437c 100644
---- a/OvmfPkg/OvmfPkgIa32.dsc
-+++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -493,23 +493,13 @@ [PcdsFixedAtBuild]
- !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
--!if $(NETWORK_TLS_ENABLE) == FALSE
--  # match PcdFlashNvStorageVariableSize purely for convenience
--  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
--!endif
- !endif
- !if $(FD_SIZE_IN_KB) == 4096
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
--!if $(NETWORK_TLS_ENABLE) == FALSE
--  # match PcdFlashNvStorageVariableSize purely for convenience
--  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
- !endif
--!endif
--!if $(NETWORK_TLS_ENABLE) == TRUE
-   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
--!endif
- 
-   gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
-   gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
-diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 52a8ac2a5592..87067f468285 100644
---- a/OvmfPkg/OvmfPkgIa32X64.dsc
-+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -500,23 +500,13 @@ [PcdsFixedAtBuild]
- !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
--!if $(NETWORK_TLS_ENABLE) == FALSE
--  # match PcdFlashNvStorageVariableSize purely for convenience
--  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
--!endif
- !endif
- !if $(FD_SIZE_IN_KB) == 4096
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
--!if $(NETWORK_TLS_ENABLE) == FALSE
--  # match PcdFlashNvStorageVariableSize purely for convenience
--  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
- !endif
--!endif
--!if $(NETWORK_TLS_ENABLE) == TRUE
-   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
--!endif
- 
-   gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
-   gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
-diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 4e2459d34e2e..a625399d8246 100644
---- a/OvmfPkg/OvmfPkgX64.dsc
-+++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -519,23 +519,13 @@ [PcdsFixedAtBuild]
- !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
--!if $(NETWORK_TLS_ENABLE) == FALSE
--  # match PcdFlashNvStorageVariableSize purely for convenience
--  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
--!endif
- !endif
- !if $(FD_SIZE_IN_KB) == 4096
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
--!if $(NETWORK_TLS_ENABLE) == FALSE
--  # match PcdFlashNvStorageVariableSize purely for convenience
--  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
- !endif
--!endif
--!if $(NETWORK_TLS_ENABLE) == TRUE
-   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
-   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
--!endif
- 
-   gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
-   gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
--- 
-2.42.0
-

0018-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch

@@ -0,0 +1,126 @@
+From 6264a265fc50961c8d44a4c04b9c9e5ad07cc86c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Thu, 1 Jul 2021 20:29:19 +0200
+Subject: [PATCH] OvmfPkg: Remove UdfDxe filesystem driver (RHEL only)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-MergeRequest: 3: Disable features for RHEL9
+RH-Commit: [11/19] 21614de37221fca27d4eec0f03c5c8bce5911af3
+RH-Bugzilla: 1967747
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+Remove the UDF driver.
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc | 1 -
+ OvmfPkg/AmdSev/AmdSevX64.fdf | 1 -
+ OvmfPkg/OvmfPkgIa32.dsc      | 1 -
+ OvmfPkg/OvmfPkgIa32.fdf      | 1 -
+ OvmfPkg/OvmfPkgIa32X64.dsc   | 1 -
+ OvmfPkg/OvmfPkgIa32X64.fdf   | 1 -
+ OvmfPkg/OvmfPkgX64.dsc       | 1 -
+ OvmfPkg/OvmfPkgX64.fdf       | 1 -
+ 8 files changed, 8 deletions(-)
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index c000cc8de8..75bec7859e 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -679,7 +679,6 @@
+   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
+   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+   FatPkg/EnhancedFatDxe/Fat.inf
+-  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
+index d6f785c205..5d0cba1e13 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.fdf
++++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
+@@ -274,7 +274,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
+ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
+ 
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+-INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+ 
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+ INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index ca07b40857..62907e9458 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -815,7 +815,6 @@
+   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
+   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+   FatPkg/EnhancedFatDxe/Fat.inf
+-  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
+index 55d0f1ae5f..6c324943e4 100644
+--- a/OvmfPkg/OvmfPkgIa32.fdf
++++ b/OvmfPkg/OvmfPkgIa32.fdf
+@@ -289,7 +289,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
+ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
+ 
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+-INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index a5322783e5..28cf5ace70 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -829,7 +829,6 @@
+   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
+   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+   FatPkg/EnhancedFatDxe/Fat.inf
+-  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
+index fba268521b..a890d4a3e3 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.fdf
++++ b/OvmfPkg/OvmfPkgIa32X64.fdf
+@@ -290,7 +290,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
+ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
+ 
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+-INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index 190431b6fa..ca0c007181 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -897,7 +897,6 @@
+   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
+   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+   FatPkg/EnhancedFatDxe/Fat.inf
+-  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
+   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
+index cea0e87cbf..48da04eb9c 100644
+--- a/OvmfPkg/OvmfPkgX64.fdf
++++ b/OvmfPkg/OvmfPkgX64.fdf
+@@ -315,7 +315,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
+ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
+ 
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+-INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+ INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf

0018-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch

@@ -1,26 +0,0 @@
-From f34c799475de60e399463953870c182a08c39f81 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Mon, 27 Nov 2023 11:04:08 +0100
-Subject: [PATCH 18/18] silence '... has a LOAD segment with RWX permissions'
- warning
-
----
- BaseTools/Conf/tools_def.template | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/BaseTools/Conf/tools_def.template b/BaseTools/Conf/tools_def.template
-index c34ecfd557c5..53ac3baa6be3 100755
---- a/BaseTools/Conf/tools_def.template
-+++ b/BaseTools/Conf/tools_def.template
-@@ -747,7 +747,7 @@ DEFINE GCC_AARCH64_CC_FLAGS        = DEF(GCC_ALL_CC_FLAGS) -mlittle-endian -fno-
- DEFINE GCC_AARCH64_CC_XIPFLAGS     = -mstrict-align -mgeneral-regs-only
- DEFINE GCC_RISCV64_CC_XIPFLAGS     = -mstrict-align -mgeneral-regs-only
- DEFINE GCC_DLINK_FLAGS_COMMON      = -nostdlib --pie
--DEFINE GCC_DLINK2_FLAGS_COMMON     = -Wl,--script=$(EDK_TOOLS_PATH)/Scripts/GccBase.lds
-+DEFINE GCC_DLINK2_FLAGS_COMMON     = -Wl,--script=$(EDK_TOOLS_PATH)/Scripts/GccBase.lds -Wl,--no-warn-rwx-segments
- DEFINE GCC_IA32_X64_DLINK_COMMON   = DEF(GCC_DLINK_FLAGS_COMMON) --gc-sections
- DEFINE GCC_ARM_AARCH64_DLINK_COMMON= -Wl,--emit-relocs -nostdlib -Wl,--gc-sections -u $(IMAGE_ENTRY_POINT) -Wl,-e,$(IMAGE_ENTRY_POINT),-Map,$(DEST_DIR_DEBUG)/$(BASE_NAME).map
- DEFINE GCC_LOONGARCH64_DLINK_COMMON= -Wl,--emit-relocs -nostdlib -Wl,--gc-sections -u $(IMAGE_ENTRY_POINT) -Wl,-e,$(IMAGE_ENTRY_POINT),-Map,$(DEST_DIR_DEBUG)/$(BASE_NAME).map
--- 
-2.43.0
-

0019-ArmVirt-Allow-memory-attributes-protocol-to-be-disab.patch

@@ -1,182 +0,0 @@
-From d93c63a8d3fe63f14b2c9e8dbf6792592fc9ea84 Mon Sep 17 00:00:00 2001
-From: Ard Biesheuvel <ardb@kernel.org>
-Date: Tue, 12 Dec 2023 09:36:00 +0100
-Subject: [PATCH 19/19] ArmVirt: Allow memory attributes protocol to be
- disabled
-
-Shim's PE loader uses the EFI memory attributes protocol in a way that
-results in an immediate crash when invoking the loaded image, unless the
-base and size of its executable segment are both aligned to 4k.
-
-If this is not the case, it will strip the memory allocation of its
-executable permissions, but fail to add them back for the executable
-region, resulting in non-executable code. Unfortunately, the PE loader
-does not even bother invoking the protocol in this case (as it notices
-the misalignment), making it very hard for system firmware to work
-around this by attempting to infer the intent of the caller.
-
-So let's introduce a QEMU command line option to indicate that the
-protocol should not be exposed at all, and a PCD to set the default for
-this option when it is omitted.
-
-  -fw_cfg opt/org.tianocore/UninstallMemAttrProtocol,string=y
-
-Cc: Gerd Hoffmann <kraxel@redhat.com>
-Cc: Oliver Steffen <osteffen@redhat.com>
-Cc: Alexander Graf <graf@amazon.com>
-Cc: Oliver Smith-Denny <osde@linux.microsoft.com>
-Cc: Taylor Beebe <taylor.d.beebe@gmail.com>
-Cc: Peter Jones <pjones@redhat.com>
-Cc: Leif Lindholm <quic_llindhol@quicinc.com>
-Link: https://gitlab.com/qemu-project/qemu/-/issues/1990
-Reviewed-by: Laszlo Ersek <lersek@redhat.com>
-Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
-Tested-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-ID: <20231212083600.1889189-1-ardb@google.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- ArmVirtPkg/ArmVirtPkg.dec                     |  6 ++
- .../PlatformBootManagerLib.inf                |  3 +
- .../PlatformBootManagerLib/PlatformBm.c       | 64 +++++++++++++++++++
- 3 files changed, 73 insertions(+)
-
-diff --git a/ArmVirtPkg/ArmVirtPkg.dec b/ArmVirtPkg/ArmVirtPkg.dec
-index 0f2d7873279f..6fa7ca22b966 100644
---- a/ArmVirtPkg/ArmVirtPkg.dec
-+++ b/ArmVirtPkg/ArmVirtPkg.dec
-@@ -68,3 +68,9 @@ [PcdsFixedAtBuild, PcdsPatchableInModule]
-   # Cloud Hypervisor has no other way to pass Rsdp address to the guest except use a PCD.
-   #
-   gArmVirtTokenSpaceGuid.PcdCloudHvAcpiRsdpBaseAddress|0x0|UINT64|0x00000005
-+
-+  ##
-+  # Whether the EFI memory attributes protocol should be uninstalled before
-+  # invoking the OS loader. This may be needed to work around problematic
-+  # builds of shim that use the protocol incorrectly.
-+  gArmVirtTokenSpaceGuid.PcdUninstallMemAttrProtocol|FALSE|BOOLEAN|0x00000006
-diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
-index 997eb1a4429f..3a2822cda4b1 100644
---- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
-+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
-@@ -46,6 +46,7 @@ [LibraryClasses]
-   PcdLib
-   PlatformBmPrintScLib
-   QemuBootOrderLib
-+  QemuFwCfgSimpleParserLib
-   QemuLoadImageLib
-   ReportStatusCodeLib
-   TpmPlatformHierarchyLib
-@@ -55,6 +56,7 @@ [LibraryClasses]
-   UefiRuntimeServicesTableLib
- 
- [FixedPcd]
-+  gArmVirtTokenSpaceGuid.PcdUninstallMemAttrProtocol
-   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultBaudRate
-   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultDataBits
-   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultParity
-@@ -73,5 +75,6 @@ [Guids]
- [Protocols]
-   gEfiFirmwareVolume2ProtocolGuid
-   gEfiGraphicsOutputProtocolGuid
-+  gEfiMemoryAttributeProtocolGuid
-   gEfiPciRootBridgeIoProtocolGuid
-   gVirtioDeviceProtocolGuid
-diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-index 85c01351b09d..e9693a1cd9ac 100644
---- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-@@ -16,6 +16,7 @@
- #include <Library/PcdLib.h>
- #include <Library/PlatformBmPrintScLib.h>
- #include <Library/QemuBootOrderLib.h>
-+#include <Library/QemuFwCfgSimpleParserLib.h>
- #include <Library/TpmPlatformHierarchyLib.h>
- #include <Library/UefiBootManagerLib.h>
- #include <Protocol/DevicePath.h>
-@@ -1111,6 +1112,49 @@ PlatformBootManagerBeforeConsole (
-   FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciSerial, SetupVirtioSerial);
- }
- 
-+/**
-+  Uninstall the EFI memory attribute protocol if it exists.
-+**/
-+STATIC
-+VOID
-+UninstallEfiMemoryAttributesProtocol (
-+  VOID
-+  )
-+{
-+  EFI_STATUS  Status;
-+  EFI_HANDLE  Handle;
-+  UINTN       Size;
-+  VOID        *MemoryAttributeProtocol;
-+
-+  Size   = sizeof (Handle);
-+  Status = gBS->LocateHandle (
-+                  ByProtocol,
-+                  &gEfiMemoryAttributeProtocolGuid,
-+                  NULL,
-+                  &Size,
-+                  &Handle
-+                  );
-+
-+  if (EFI_ERROR (Status)) {
-+    ASSERT (Status == EFI_NOT_FOUND);
-+    return;
-+  }
-+
-+  Status = gBS->HandleProtocol (
-+                  Handle,
-+                  &gEfiMemoryAttributeProtocolGuid,
-+                  &MemoryAttributeProtocol
-+                  );
-+  ASSERT_EFI_ERROR (Status);
-+
-+  Status = gBS->UninstallProtocolInterface (
-+                  Handle,
-+                  &gEfiMemoryAttributeProtocolGuid,
-+                  MemoryAttributeProtocol
-+                  );
-+  ASSERT_EFI_ERROR (Status);
-+}
-+
- /**
-   Do the platform specific action after the console is ready
-   Possible things that can be done in PlatformBootManagerAfterConsole:
-@@ -1129,12 +1173,32 @@ PlatformBootManagerAfterConsole (
-   )
- {
-   RETURN_STATUS  Status;
-+  BOOLEAN        Uninstall;
- 
-   //
-   // Show the splash screen.
-   //
-   BootLogoEnableLogo ();
- 
-+  //
-+  // Work around shim's terminally broken use of the EFI memory attributes
-+  // protocol, by uninstalling it if requested on the QEMU command line.
-+  //
-+  // E.g.,
-+  //       -fw_cfg opt/org.tianocore/UninstallMemAttrProtocol,string=y
-+  //
-+  Uninstall = FixedPcdGetBool (PcdUninstallMemAttrProtocol);
-+  QemuFwCfgParseBool ("opt/org.tianocore/UninstallMemAttrProtocol", &Uninstall);
-+  DEBUG ((
-+    DEBUG_WARN,
-+    "%a: %auninstalling EFI memory protocol\n",
-+    __func__,
-+    Uninstall ? "" : "not "
-+    ));
-+  if (Uninstall) {
-+    UninstallEfiMemoryAttributesProtocol ();
-+  }
-+
-   //
-   // Process QEMU's -kernel command line option. The kernel booted this way
-   // will receive ACPI tables: in PlatformBootManagerBeforeConsole(), we
--- 
-2.43.0
-

0019-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch

@@ -0,0 +1,61 @@
+From 2ddf7702dee6a1a0edab8154b085c36f8d84376f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Thu, 1 Jul 2021 20:29:22 +0200
+Subject: [PATCH] ArmVirtPkg: Remove UdfDxe filesystem driver (RHEL only)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-MergeRequest: 3: Disable features for RHEL9
+RH-Commit: [12/19] fcadb6a747b65e4d449d48131c9a2eeed4bd3c9a
+RH-Bugzilla: 1967747
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+Remove the UDF driver.
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ ArmVirtPkg/ArmVirtQemu.dsc           | 1 -
+ ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 -
+ ArmVirtPkg/ArmVirtQemuKernel.dsc     | 1 -
+ 3 files changed, 3 deletions(-)
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index 1e6c76795b..9216faca8d 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
++++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -464,7 +464,6 @@
+   MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
+   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+   FatPkg/EnhancedFatDxe/Fat.inf
+-  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+ 
+   #
+   # Bds
+diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+index a814653dc4..a411a8f68d 100644
+--- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
++++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+@@ -83,7 +83,6 @@ READ_LOCK_STATUS   = TRUE
+   INF MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
+   INF FatPkg/EnhancedFatDxe/Fat.inf
+   INF MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+-  INF MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+ 
+   #
+   # Status Code Routing
+diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+index e48bdf8deb..66ad4b6948 100644
+--- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
++++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+@@ -364,7 +364,6 @@
+   MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
+   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
+   FatPkg/EnhancedFatDxe/Fat.inf
+-  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
+ 
+   #
+   # Bds

0020-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch

@@ -0,0 +1,109 @@
+From 90b02d61d206926d6b2687a4a94f600039ae2e7c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Thu, 1 Jul 2021 20:29:25 +0200
+Subject: [PATCH] OvmfPkg: Remove TftpDynamicCommand from shell (RHEL only)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-MergeRequest: 3: Disable features for RHEL9
+RH-Commit: [13/19] cf9ef346386ac89fa05b29d429d8d1b27cf0e3b0
+RH-Bugzilla: 1967747
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+Remove the command to download files in the shell via TFTP.
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ OvmfPkg/OvmfPkgIa32.dsc    | 4 ----
+ OvmfPkg/OvmfPkgIa32.fdf    | 1 -
+ OvmfPkg/OvmfPkgIa32X64.dsc | 4 ----
+ OvmfPkg/OvmfPkgIa32X64.fdf | 1 -
+ OvmfPkg/OvmfPkgX64.dsc     | 4 ----
+ OvmfPkg/OvmfPkgX64.fdf     | 1 -
+ 6 files changed, 15 deletions(-)
+
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 62907e9458..c2fe2e6042 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -881,10 +881,6 @@
+   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+-  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
+   ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
+index 6c324943e4..32a42c926b 100644
+--- a/OvmfPkg/OvmfPkgIa32.fdf
++++ b/OvmfPkg/OvmfPkgIa32.fdf
+@@ -291,7 +291,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+-INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+ INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
+ INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+ !endif
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 28cf5ace70..5d74007599 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -895,10 +895,6 @@
+   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+-  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
+   ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
+index a890d4a3e3..733f60ce7c 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.fdf
++++ b/OvmfPkg/OvmfPkgIa32X64.fdf
+@@ -292,7 +292,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+-INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+ INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
+ INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+ !endif
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index ca0c007181..f27932b38d 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -963,10 +963,6 @@
+   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+-  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
+   ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
+index 48da04eb9c..f562b5312b 100644
+--- a/OvmfPkg/OvmfPkgX64.fdf
++++ b/OvmfPkg/OvmfPkgX64.fdf
+@@ -317,7 +317,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+-INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+ INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
+ INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+ !endif

0021-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch

@@ -0,0 +1,54 @@
+From f7abc9b87c6034ada69ed16fc644c578cea5af19 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Thu, 1 Jul 2021 20:29:28 +0200
+Subject: [PATCH] ArmVirtPkg: Remove TftpDynamicCommand from shell (RHEL only)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-MergeRequest: 3: Disable features for RHEL9
+RH-Commit: [14/19] 12436014941bd4a7c99a26d779ebdcd75f169403
+RH-Bugzilla: 1967747
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+Remove the command to download files in the shell via TFTP.
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ ArmVirtPkg/ArmVirt.dsc.inc           | 7 +++----
+ ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 -
+ 2 files changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
+index 2bc6a29eb1..33f122f913 100644
+--- a/ArmVirtPkg/ArmVirt.dsc.inc
++++ b/ArmVirtPkg/ArmVirt.dsc.inc
+@@ -388,10 +388,9 @@
+   #
+   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
+ 
+-  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
++  #
++  # UEFI application (Shell Embedded Boot Loader)
++  #
+   ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+index a411a8f68d..4b00524fde 100644
+--- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
++++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+@@ -99,7 +99,6 @@ READ_LOCK_STATUS   = TRUE
+   INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ 
+   INF ShellPkg/Application/Shell/Shell.inf
+-  INF ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
+   INF ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
+   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
+   INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf

0022-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch

@@ -0,0 +1,113 @@
+From ab3da1407691781fb148e53d4b02e996a5dbca2f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Thu, 1 Jul 2021 20:29:31 +0200
+Subject: [PATCH] OvmfPkg: Remove HttpDynamicCommand from shell (RHEL only)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Rebase to edk2-stable202311:
+
+Minor update, context change due to new variable policy shell command.
+
+RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-MergeRequest: 3: Disable features for RHEL9
+RH-Commit: [15/19] 1911cf04f27467ef1175b1976864c1111d93d19e
+RH-Bugzilla: 1967747
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+Remove the command to download files in the shell via HTTP(S).
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ OvmfPkg/OvmfPkgIa32.dsc    | 4 ----
+ OvmfPkg/OvmfPkgIa32.fdf    | 1 -
+ OvmfPkg/OvmfPkgIa32X64.dsc | 4 ----
+ OvmfPkg/OvmfPkgIa32X64.fdf | 1 -
+ OvmfPkg/OvmfPkgX64.dsc     | 4 ----
+ OvmfPkg/OvmfPkgX64.fdf     | 1 -
+ 6 files changed, 15 deletions(-)
+
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index c2fe2e6042..44139c648c 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -881,10 +881,6 @@
+   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+-  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
+index 32a42c926b..56520eaf99 100644
+--- a/OvmfPkg/OvmfPkgIa32.fdf
++++ b/OvmfPkg/OvmfPkgIa32.fdf
+@@ -291,7 +291,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+-INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
+ INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+ !endif
+ !if $(BUILD_SHELL) == TRUE
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 5d74007599..e2f13499cc 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -895,10 +895,6 @@
+   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+-  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
+index 733f60ce7c..f04620418b 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.fdf
++++ b/OvmfPkg/OvmfPkgIa32X64.fdf
+@@ -292,7 +292,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+-INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
+ INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+ !endif
+ !if $(BUILD_SHELL) == TRUE
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index f27932b38d..f1dc48c3be 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -963,10 +963,6 @@
+   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+-  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
+index f562b5312b..61a3c63166 100644
+--- a/OvmfPkg/OvmfPkgX64.fdf
++++ b/OvmfPkg/OvmfPkgX64.fdf
+@@ -317,7 +317,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+-INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
+ INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+ !endif
+ !if $(BUILD_SHELL) == TRUE

0023-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch

@@ -0,0 +1,55 @@
+From 54c22fb545c567b4f99c81170ba8a4fc111e7646 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Thu, 1 Jul 2021 20:29:34 +0200
+Subject: [PATCH] ArmVirtPkg: Remove HttpDynamicCommand from shell (RHEL only)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Rebase to edk2-stable202311:
+
+Minor update, context change due to new variable policy shell command.
+
+RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-MergeRequest: 3: Disable features for RHEL9
+RH-Commit: [16/19] 07a74f1fdcdbb9a31d25ce9760edcd852e9574c3
+RH-Bugzilla: 1967747
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+Remove the command to download files in the shell via HTTP(S).
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ ArmVirtPkg/ArmVirt.dsc.inc           | 4 ----
+ ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 -
+ 2 files changed, 5 deletions(-)
+
+diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
+index 33f122f913..2b9315f8b3 100644
+--- a/ArmVirtPkg/ArmVirt.dsc.inc
++++ b/ArmVirtPkg/ArmVirt.dsc.inc
+@@ -391,10 +391,6 @@
+   #
+   # UEFI application (Shell Embedded Boot Loader)
+   #
+-  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+index 4b00524fde..aa3acdeae6 100644
+--- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
++++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+@@ -99,7 +99,6 @@ READ_LOCK_STATUS   = TRUE
+   INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ 
+   INF ShellPkg/Application/Shell/Shell.inf
+-  INF ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
+   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
+   INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+ 

0024-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch

@@ -0,0 +1,147 @@
+From 1025e8342c42c49d9b3bbffd6a923b4cb89ec76a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Thu, 1 Jul 2021 20:29:39 +0200
+Subject: [PATCH] OvmfPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Rebase to edk2-stable202311:
+
+Minor update, context change due to new variable policy shell command.
+
+RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-MergeRequest: 3: Disable features for RHEL9
+RH-Commit: [17/19] 491fe1301ea29c7cb56c20272e45614d5fcb6f14
+RH-Bugzilla: 1967747
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+Remove the command to register a file in the shell as the
+initial ramdisk for a UEFI stubbed kernel, to be booted next.
+
+Note: as further dynamic shell commands might show up upstream,
+we intentionally preserve the empty !ifdef'ry context to ease
+future downstream rebases.
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc | 4 ----
+ OvmfPkg/AmdSev/AmdSevX64.fdf | 1 -
+ OvmfPkg/OvmfPkgIa32.dsc      | 4 ----
+ OvmfPkg/OvmfPkgIa32.fdf      | 1 -
+ OvmfPkg/OvmfPkgIa32X64.dsc   | 4 ----
+ OvmfPkg/OvmfPkgIa32X64.fdf   | 1 -
+ OvmfPkg/OvmfPkgX64.dsc       | 4 ----
+ OvmfPkg/OvmfPkgX64.fdf       | 1 -
+ 8 files changed, 20 deletions(-)
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index 75bec7859e..753957bcc4 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -737,10 +737,6 @@
+   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+-  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
+ !endif
+   OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf
+   OvmfPkg/AmdSev/Grub/Grub.inf
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
+index 5d0cba1e13..9b65ebac56 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.fdf
++++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
+@@ -276,7 +276,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ 
+ !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+-INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+ !endif
+ INF OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf
+ INF  OvmfPkg/AmdSev/Grub/Grub.inf
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 44139c648c..2825acec3e 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -885,10 +885,6 @@
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+   }
+-  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
+ !endif
+ !if $(BUILD_SHELL) == TRUE
+   ShellPkg/Application/Shell/Shell.inf {
+diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
+index 56520eaf99..de73cabb6e 100644
+--- a/OvmfPkg/OvmfPkgIa32.fdf
++++ b/OvmfPkg/OvmfPkgIa32.fdf
+@@ -291,7 +291,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+-INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+ !endif
+ !if $(BUILD_SHELL) == TRUE
+ INF  ShellPkg/Application/Shell/Shell.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index e2f13499cc..f1af88a9b5 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -899,10 +899,6 @@
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+   }
+-  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
+ !endif
+ !if $(BUILD_SHELL) == TRUE
+   ShellPkg/Application/Shell/Shell.inf {
+diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
+index f04620418b..241019cb28 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.fdf
++++ b/OvmfPkg/OvmfPkgIa32X64.fdf
+@@ -292,7 +292,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+-INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+ !endif
+ !if $(BUILD_SHELL) == TRUE
+ INF  ShellPkg/Application/Shell/Shell.inf
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index f1dc48c3be..908895354b 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -967,10 +967,6 @@
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+   }
+-  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
+ !endif
+ !if $(BUILD_SHELL) == TRUE
+   ShellPkg/Application/Shell/Shell.inf {
+diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
+index 61a3c63166..c1e7240076 100644
+--- a/OvmfPkg/OvmfPkgX64.fdf
++++ b/OvmfPkg/OvmfPkgX64.fdf
+@@ -317,7 +317,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+ INF  FatPkg/EnhancedFatDxe/Fat.inf
+ 
+ !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
+-INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+ !endif
+ !if $(BUILD_SHELL) == TRUE
+ INF  ShellPkg/Application/Shell/Shell.inf

0025-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch

@@ -0,0 +1,66 @@
+From 1e792bb790474a68c6e63a6e0faa88f8e2647ae3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
+Date: Thu, 1 Jul 2021 20:29:46 +0200
+Subject: [PATCH] ArmVirtPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Rebase to edk2-stable202311:
+
+Minor update, context change due to new variable policy shell command.
+
+RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
+RH-MergeRequest: 3: Disable features for RHEL9
+RH-Commit: [18/19] 8f4e4007108462533e3d2050b84d8830073a7c0d
+RH-Bugzilla: 1967747
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+
+Remove the command to register a file in the shell as the initial
+ramdisk for a UEFI stubbed kernel, to be booted next.
+
+Suggested-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ ArmVirtPkg/ArmVirt.dsc.inc           | 10 +++-------
+ ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc |  1 -
+ 2 files changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
+index 2b9315f8b3..5d40a3c3c7 100644
+--- a/ArmVirtPkg/ArmVirt.dsc.inc
++++ b/ArmVirtPkg/ArmVirt.dsc.inc
+@@ -388,17 +388,13 @@
+   #
+   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
+ 
+-  #
+-  # UEFI application (Shell Embedded Boot Loader)
+-  #
++  #
++  # UEFI application (Shell Embedded Boot Loader)
++  #
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+   }
+-  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+-  }
+   ShellPkg/Application/Shell/Shell.inf {
+     <LibraryClasses>
+       ShellCommandLib|ShellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.inf
+diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+index aa3acdeae6..49bd633850 100644
+--- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
++++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+@@ -100,7 +100,6 @@ READ_LOCK_STATUS   = TRUE
+ 
+   INF ShellPkg/Application/Shell/Shell.inf
+   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
+-  INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
+ 
+   #
+   # Bds

0026-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch

@@ -1,21 +1,31 @@
-From eb24212304ec31c3ae8b878a21d4b875d5942cd1 Mon Sep 17 00:00:00 2001
+From d1572c35f13fd69f48c7c5adeb22eff09d3a1189 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 28 Feb 2023 15:47:00 +0100
-Subject: [PATCH 13/14] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
+Subject: [PATCH] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
+
+RH-Author: Gerd Hoffmann <kraxel@redhat.com>
+RH-MergeRequest: 42: UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
+RH-Bugzilla: 2124143
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [1/1] 5168501c31541a57aaeb3b3bd7c3602205eb7cdf (kraxel/centos-edk2)
 
 In case the number of CPUs can in increase beyond 255
 due to CPU hotplug choose x2apic mode.
 
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+patch_name: edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
+present_in_specfile: true
+location_in_specfile: 38
 ---
  UefiCpuPkg/Library/MpInitLib/MpLib.c | 8 +++++++-
  1 file changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
-index 6f1456cfe168..9277e06c9b4a 100644
+index cdfb570e61..7bc93dfa13 100644
 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
 +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
-@@ -527,7 +527,9 @@ CollectProcessorCount (
+@@ -533,7 +533,9 @@ CollectProcessorCount (
    //
    // Enable x2APIC mode if
    //  1. Number of CPU is greater than 255; or
@@ -26,7 +36,7 @@ index 6f1456cfe168..9277e06c9b4a 100644
    //
    X2Apic = FALSE;
    if (CpuMpData->CpuCount > 255) {
-@@ -535,6 +537,10 @@ CollectProcessorCount (
+@@ -541,6 +543,10 @@ CollectProcessorCount (
      // If there are more than 255 processor found, force to enable X2APIC
      //
      X2Apic = TRUE;
@@ -37,6 +47,3 @@ index 6f1456cfe168..9277e06c9b4a 100644
    } else {
      CpuInfoInHob = (CPU_INFO_IN_HOB *)(UINTN)CpuMpData->CpuInfoInHob;
      for (Index = 0; Index < CpuMpData->CpuCount; Index++) {
--- 
-2.41.0
-

0027-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch

@@ -0,0 +1,121 @@
+From 89a0a96bcfe49ca87087850d0b070e351850f6e8 Mon Sep 17 00:00:00 2001
+From: Oliver Steffen <osteffen@redhat.com>
+Date: Wed, 16 Aug 2023 12:09:40 +0200
+Subject: [PATCH] OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
+
+RH-Author: Oliver Steffen <osteffen@redhat.com>
+RH-MergeRequest: 46: OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
+RH-Bugzilla: 2218196
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [1/1] 9bf3bb989e36253aa34bf82ecfe8faa7312e8d22 (osteffen/edk2)
+
+Add a callback at the end of the Dxe phase that sets the
+"FB_NO_REBOOT" variable under the Shim GUID.
+This is a workaround for a boot loop in case a confidential
+guest that uses shim is booted with a vtpm device present.
+
+BZ 2218196
+
+Signed-off-by: Oliver Steffen <osteffen@redhat.com>
+
+patch_name: edk2-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
+present_in_specfile: true
+location_in_specfile: 44
+---
+ OvmfPkg/AmdSevDxe/AmdSevDxe.c   | 42 +++++++++++++++++++++++++++++++++
+ OvmfPkg/AmdSevDxe/AmdSevDxe.inf |  2 ++
+ 2 files changed, 44 insertions(+)
+
+diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.c b/OvmfPkg/AmdSevDxe/AmdSevDxe.c
+index db3675ae86..f639c093a2 100644
+--- a/OvmfPkg/AmdSevDxe/AmdSevDxe.c
++++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.c
+@@ -19,6 +19,7 @@
+ #include <Library/MemoryAllocationLib.h>
+ #include <Library/UefiBootServicesTableLib.h>
+ #include <Guid/ConfidentialComputingSevSnpBlob.h>
++#include <Guid/GlobalVariable.h>
+ #include <Library/PcdLib.h>
+ #include <Pi/PrePiDxeCis.h>
+ #include <Protocol/SevMemoryAcceptance.h>
+@@ -28,6 +29,10 @@
+ // Present, initialized, tested bits defined in MdeModulePkg/Core/Dxe/DxeMain.h
+ #define EFI_MEMORY_INTERNAL_MASK  0x0700000000000000ULL
+ 
++static EFI_GUID  ShimLockGuid = {
++  0x605dab50, 0xe046, 0x4300, { 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 }
++};
++
+ STATIC
+ EFI_STATUS
+ AllocateConfidentialComputingBlob (
+@@ -191,6 +196,32 @@ STATIC EDKII_MEMORY_ACCEPT_PROTOCOL  mMemoryAcceptProtocol = {
+   AmdSevMemoryAccept
+ };
+ 
++VOID
++EFIAPI
++PopulateVarstore (
++  EFI_EVENT  Event,
++  VOID       *Context
++  )
++{
++  EFI_SYSTEM_TABLE  *SystemTable = (EFI_SYSTEM_TABLE *)Context;
++  EFI_STATUS        Status;
++
++  DEBUG ((DEBUG_INFO, "Populating Varstore\n"));
++  UINT32  data = 1;
++
++  Status = SystemTable->RuntimeServices->SetVariable (
++                                           L"FB_NO_REBOOT",
++                                           &ShimLockGuid,
++                                           EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
++                                           sizeof (data),
++                                           &data
++                                           );
++  ASSERT_EFI_ERROR (Status);
++
++  Status = SystemTable->BootServices->CloseEvent (Event);
++  ASSERT_EFI_ERROR (Status);
++}
++
+ EFI_STATUS
+ EFIAPI
+ AmdSevDxeEntryPoint (
+@@ -203,6 +234,7 @@ AmdSevDxeEntryPoint (
+   UINTN                                     NumEntries;
+   UINTN                                     Index;
+   CONFIDENTIAL_COMPUTING_SNP_BLOB_LOCATION  *SnpBootDxeTable;
++  EFI_EVENT                                 PopulateVarstoreEvent;
+ 
+   //
+   // Do nothing when SEV is not enabled
+@@ -361,5 +393,15 @@ AmdSevDxeEntryPoint (
+                   );
+   }
+ 
++  Status = gBS->CreateEventEx (
++                  EVT_NOTIFY_SIGNAL,
++                  TPL_CALLBACK,
++                  PopulateVarstore,
++                  SystemTable,
++                  &gEfiEndOfDxeEventGroupGuid,
++                  &PopulateVarstoreEvent
++                  );
++  ASSERT_EFI_ERROR (Status);
++
+   return EFI_SUCCESS;
+ }
+diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf b/OvmfPkg/AmdSevDxe/AmdSevDxe.inf
+index e7c7d526c9..09cbd2b0ca 100644
+--- a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf
++++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.inf
+@@ -54,6 +54,8 @@
+ [Guids]
+   gConfidentialComputingSevSnpBlobGuid
+   gEfiEventBeforeExitBootServicesGuid
++  gEfiEndOfDxeEventGroupGuid              ## CONSUMES ## Event
++
+ 
+ [Pcd]
+   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId

0028-CryptoPkg-CrtLib-add-stat.h-include-file.patch

@@ -1,9 +1,11 @@
-From c3f28ab099ea7c6949b849129cf5ea1c15b03854 Mon Sep 17 00:00:00 2001
+From 1b7a4cb54f50883fee087fd85b7c9b86b5296fea Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Mon, 28 Aug 2023 13:11:02 +0200
-Subject: [PATCH 15/16] CryptoPkg/CrtLib: add stat.h
+Subject: [PATCH] CryptoPkg/CrtLib: add stat.h include file.
 
-needed by rhel downstream openssl patches
+Needed by rhel downstream openssl patches.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
  CryptoPkg/Library/Include/sys/stat.h | 9 +++++++++
  1 file changed, 9 insertions(+)
@@ -11,7 +13,7 @@ needed by rhel downstream openssl patches
 
 diff --git a/CryptoPkg/Library/Include/sys/stat.h b/CryptoPkg/Library/Include/sys/stat.h
 new file mode 100644
-index 000000000000..22247bb2db80
+index 0000000000..22247bb2db
 --- /dev/null
 +++ b/CryptoPkg/Library/Include/sys/stat.h
 @@ -0,0 +1,9 @@
@@ -24,6 +26,3 @@ index 000000000000..22247bb2db80
 +**/
 +
 +#include <CrtLibSupport.h>
--- 
-2.41.0
-

0029-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch

@@ -1,17 +1,78 @@
-From dc0c929b8e17eefd7931ba21705eb0ec90c49714 Mon Sep 17 00:00:00 2001
+From e47e4f4efb118cf38f76c7abc8f1cb537e1f79e5 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Mon, 28 Aug 2023 13:27:09 +0200
-Subject: [PATCH 16/16] CryptoPkg/CrtLib: add access/open/read/write/close
+Subject: [PATCH] CryptoPkg/CrtLib: add access/open/read/write/close syscalls
- syscalls
 
-needed by rhel downstream openssl patches
+Needed by rhel downstream openssl patches, they use unix syscalls
+for file access (instead of fopen + friends like the rest of the
+code base).  No actual file access is needed for edk2, so just
+add stubs to make linking work.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
- CryptoPkg/Library/Include/CrtLibSupport.h     | 41 +++++++++++++++++
  .../Library/BaseCryptLib/SysCall/CrtWrapper.c | 46 +++++++++++++++++++
+ CryptoPkg/Library/Include/CrtLibSupport.h     | 41 +++++++++++++++++
  2 files changed, 87 insertions(+)
 
+diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
+index 37cdecc9bd..dfdb635536 100644
+--- a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
++++ b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
+@@ -550,6 +550,52 @@ fread (
+   return 0;
+ }
+ 
++int
++access(
++  const char*,
++  int
++  )
++{
++  return -1;
++}
++
++int
++open (
++  const char *,
++  int
++  )
++{
++  return -1;
++}
++
++ssize_t
++read (
++  int,
++  void*,
++  size_t
++  )
++{
++  return -1;
++}
++
++ssize_t
++write (
++  int,
++  const void*,
++  size_t
++  )
++{
++  return -1;
++}
++
++int
++close (
++  int
++  )
++{
++  return -1;
++}
++
+ uid_t
+ getuid (
+   void
 diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h b/CryptoPkg/Library/Include/CrtLibSupport.h
-index f36fe08f0c61..7d98496af80b 100644
+index f36fe08f0c..7d98496af8 100644
 --- a/CryptoPkg/Library/Include/CrtLibSupport.h
 +++ b/CryptoPkg/Library/Include/CrtLibSupport.h
 @@ -78,6 +78,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
@@ -76,63 +137,3 @@ index f36fe08f0c61..7d98496af80b 100644
  time_t
  time        (
    time_t *
-diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
-index 37cdecc9bd1d..dfdb63553667 100644
---- a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
-+++ b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
-@@ -550,6 +550,52 @@ fread (
-   return 0;
- }
- 
-+int
-+access(
-+  const char*,
-+  int
-+  )
-+{
-+  return -1;
-+}
-+
-+int
-+open (
-+  const char *,
-+  int
-+  )
-+{
-+  return -1;
-+}
-+
-+ssize_t
-+read (
-+  int,
-+  void*,
-+  size_t
-+  )
-+{
-+  return -1;
-+}
-+
-+ssize_t
-+write (
-+  int,
-+  const void*,
-+  size_t
-+  )
-+{
-+  return -1;
-+}
-+
-+int
-+close (
-+  int
-+  )
-+{
-+  return -1;
-+}
-+
- uid_t
- getuid (
-   void
--- 
-2.41.0
-

0030-OvmfPkg-Sec-Setup-MTRR-early-in-the-boot-process.patch

@@ -0,0 +1,194 @@
+From 9388cc72866fc379d94cf3dc029292f4246bfe39 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 30 Jan 2024 14:04:38 +0100
+Subject: [PATCH] OvmfPkg/Sec: Setup MTRR early in the boot process.
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
+RH-Jira: RHEL-21704
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [1/4] c4061788d34f409944898b48642d610c259161f3 (kraxel.rh/centos-src-edk2)
+
+Specifically before running lzma uncompress of the main firmware volume.
+This is needed to make sure caching is enabled, otherwise the uncompress
+can be extremely slow.
+
+Adapt the ASSERTs and MTRR setup in PlatformInitLib to the changes.
+
+Background:  Depending on virtual machine configuration kvm may uses EPT
+memory types to apply guest MTRR settings.  In case MTRRs are disabled
+kvm will use the uncachable memory type for all mappings.  The
+vmx_get_mt_mask() function in the linux kernel handles this and can be
+found here:
+
+https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kvm/vmx/vmx.c?h=v6.7.1#n7580
+
+In most VM configurations kvm uses MTRR_TYPE_WRBACK unconditionally.  In
+case the VM has a mdev device assigned that is not the case though.
+
+Before commit e8aa4c6546ad ("UefiCpuPkg/ResetVector: Cache Disable
+should not be set by default in CR0") kvm also ended up using
+MTRR_TYPE_WRBACK due to KVM_X86_QUIRK_CD_NW_CLEARED.  After that commit
+kvm evaluates guest mtrr settings, which why setting up MTRRs early is
+important now.
+
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-ID: <20240130130441.772484-2-kraxel@redhat.com>
+
+[ kraxel: Downstream-only for now.  Timely upstream merge is unlikely
+          due to chinese holidays and rhel-9.4 deadlines are close.
+          QE regression testing passed.  So go with upstream posted
+          series v3 ]
+
+patch_name: edk2-OvmfPkg-Sec-Setup-MTRR-early-in-the-boot-process.patch
+present_in_specfile: true
+location_in_specfile: 49
+---
+ OvmfPkg/IntelTdx/Sec/SecMain.c              | 32 +++++++++++++++++++++
+ OvmfPkg/Library/PlatformInitLib/MemDetect.c | 10 +++----
+ OvmfPkg/Sec/SecMain.c                       | 32 +++++++++++++++++++++
+ 3 files changed, 69 insertions(+), 5 deletions(-)
+
+diff --git a/OvmfPkg/IntelTdx/Sec/SecMain.c b/OvmfPkg/IntelTdx/Sec/SecMain.c
+index 42a587adfa..0daddac0a0 100644
+--- a/OvmfPkg/IntelTdx/Sec/SecMain.c
++++ b/OvmfPkg/IntelTdx/Sec/SecMain.c
+@@ -27,6 +27,8 @@
+ #include <Library/TdxHelperLib.h>
+ #include <Library/CcProbeLib.h>
+ #include <Library/PeilessStartupLib.h>
++#include <Register/Intel/ArchitecturalMsr.h>
++#include <Register/Intel/Cpuid.h>
+ 
+ #define SEC_IDT_ENTRY_COUNT  34
+ 
+@@ -48,6 +50,31 @@ IA32_IDT_GATE_DESCRIPTOR  mIdtEntryTemplate = {
+   }
+ };
+ 
++//
++// Enable MTRR early, set default type to write back.
++// Needed to make sure caching is enabled,
++// without this lzma decompress can be very slow.
++//
++STATIC
++VOID
++SecMtrrSetup (
++  VOID
++  )
++{
++  CPUID_VERSION_INFO_EDX           Edx;
++  MSR_IA32_MTRR_DEF_TYPE_REGISTER  DefType;
++
++  AsmCpuid (CPUID_VERSION_INFO, NULL, NULL, NULL, &Edx.Uint32);
++  if (!Edx.Bits.MTRR) {
++    return;
++  }
++
++  DefType.Uint64    = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
++  DefType.Bits.Type = 6; /* write back */
++  DefType.Bits.E    = 1; /* enable */
++  AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
++}
++
+ VOID
+ EFIAPI
+ SecCoreStartupWithStack (
+@@ -204,6 +231,11 @@ SecCoreStartupWithStack (
+   InitializeApicTimer (0, MAX_UINT32, TRUE, 5);
+   DisableApicTimerInterrupt ();
+ 
++  //
++  // Initialize MTRR
++  //
++  SecMtrrSetup ();
++
+   PeilessStartup (&SecCoreData);
+ 
+   ASSERT (FALSE);
+diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
+index f042517bb6..313f5e1f7f 100644
+--- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
++++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
+@@ -1082,18 +1082,18 @@ PlatformQemuInitializeRam (
+     MtrrGetAllMtrrs (&MtrrSettings);
+ 
+     //
+-    // MTRRs disabled, fixed MTRRs disabled, default type is uncached
++    // See SecMtrrSetup(), default type should be write back
+     //
+-    ASSERT ((MtrrSettings.MtrrDefType & BIT11) == 0);
++    ASSERT ((MtrrSettings.MtrrDefType & BIT11) != 0);
+     ASSERT ((MtrrSettings.MtrrDefType & BIT10) == 0);
+-    ASSERT ((MtrrSettings.MtrrDefType & 0xFF) == 0);
++    ASSERT ((MtrrSettings.MtrrDefType & 0xFF) == MTRR_CACHE_WRITE_BACK);
+ 
+     //
+     // flip default type to writeback
+     //
+-    SetMem (&MtrrSettings.Fixed, sizeof MtrrSettings.Fixed, 0x06);
++    SetMem (&MtrrSettings.Fixed, sizeof MtrrSettings.Fixed, MTRR_CACHE_WRITE_BACK);
+     ZeroMem (&MtrrSettings.Variables, sizeof MtrrSettings.Variables);
+-    MtrrSettings.MtrrDefType |= BIT11 | BIT10 | 6;
++    MtrrSettings.MtrrDefType |= BIT10;
+     MtrrSetAllMtrrs (&MtrrSettings);
+ 
+     //
+diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
+index 31da5d0ace..3b7dc7205d 100644
+--- a/OvmfPkg/Sec/SecMain.c
++++ b/OvmfPkg/Sec/SecMain.c
+@@ -30,6 +30,8 @@
+ #include <Ppi/MpInitLibDep.h>
+ #include <Library/TdxHelperLib.h>
+ #include <Library/CcProbeLib.h>
++#include <Register/Intel/ArchitecturalMsr.h>
++#include <Register/Intel/Cpuid.h>
+ #include "AmdSev.h"
+ 
+ #define SEC_IDT_ENTRY_COUNT  34
+@@ -744,6 +746,31 @@ FindAndReportEntryPoints (
+   return;
+ }
+ 
++//
++// Enable MTRR early, set default type to write back.
++// Needed to make sure caching is enabled,
++// without this lzma decompress can be very slow.
++//
++STATIC
++VOID
++SecMtrrSetup (
++  VOID
++  )
++{
++  CPUID_VERSION_INFO_EDX           Edx;
++  MSR_IA32_MTRR_DEF_TYPE_REGISTER  DefType;
++
++  AsmCpuid (CPUID_VERSION_INFO, NULL, NULL, NULL, &Edx.Uint32);
++  if (!Edx.Bits.MTRR) {
++    return;
++  }
++
++  DefType.Uint64    = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
++  DefType.Bits.Type = 6; /* write back */
++  DefType.Bits.E    = 1; /* enable */
++  AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
++}
++
+ VOID
+ EFIAPI
+ SecCoreStartupWithStack (
+@@ -942,6 +969,11 @@ SecCoreStartupWithStack (
+   InitializeApicTimer (0, MAX_UINT32, TRUE, 5);
+   DisableApicTimerInterrupt ();
+ 
++  //
++  // Initialize MTRR
++  //
++  SecMtrrSetup ();
++
+   //
+   // Initialize Debug Agent to support source level debug in SEC/PEI phases before memory ready.
+   //

0031-MdePkg-ArchitecturalMsr.h-add-defines-for-MTRR-cache.patch

@@ -0,0 +1,41 @@
+From 625a70fc26d752b0025eae19682b386f44fa089b Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 30 Jan 2024 14:04:39 +0100
+Subject: [PATCH] MdePkg/ArchitecturalMsr.h: add #defines for MTRR cache types
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
+RH-Jira: RHEL-21704
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [2/4] a568bc2793d677462a2971aae9566a9bbc64b063 (kraxel.rh/centos-src-edk2)
+
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-ID: <20240130130441.772484-3-kraxel@redhat.com>
+
+patch_name: edk2-MdePkg-ArchitecturalMsr.h-add-defines-for-MTRR-cache.patch
+present_in_specfile: true
+location_in_specfile: 50
+---
+ MdePkg/Include/Register/Intel/ArchitecturalMsr.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/MdePkg/Include/Register/Intel/ArchitecturalMsr.h b/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
+index 756e7c86ec..08ba949cf7 100644
+--- a/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
++++ b/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
+@@ -2103,6 +2103,13 @@ typedef union {
+ #define MSR_IA32_MTRR_PHYSBASE9  0x00000212
+ /// @}
+ 
++#define MSR_IA32_MTRR_CACHE_UNCACHEABLE      0
++#define MSR_IA32_MTRR_CACHE_WRITE_COMBINING  1
++#define MSR_IA32_MTRR_CACHE_WRITE_THROUGH    4
++#define MSR_IA32_MTRR_CACHE_WRITE_PROTECTED  5
++#define MSR_IA32_MTRR_CACHE_WRITE_BACK       6
++#define MSR_IA32_MTRR_CACHE_INVALID_TYPE     7
++
+ /**
+   MSR information returned for MSR indexes #MSR_IA32_MTRR_PHYSBASE0 to
+   #MSR_IA32_MTRR_PHYSBASE9

0032-UefiCpuPkg-MtrrLib.h-use-cache-type-defines-from-Arc.patch

@@ -0,0 +1,70 @@
+From d545c8ac6a7c96cb64661b2f5b6fccb97f9c02f8 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 30 Jan 2024 14:04:40 +0100
+Subject: [PATCH] UefiCpuPkg/MtrrLib.h: use cache type #defines from
+ ArchitecturalMsr.h
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
+RH-Jira: RHEL-21704
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [3/4] 8b766c97b247a8665662697534455c19423ff23c (kraxel.rh/centos-src-edk2)
+
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-ID: <20240130130441.772484-4-kraxel@redhat.com>
+
+patch_name: edk2-UefiCpuPkg-MtrrLib.h-use-cache-type-defines-from-Arc.patch
+present_in_specfile: true
+location_in_specfile: 51
+---
+ UefiCpuPkg/Include/Library/MtrrLib.h | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/UefiCpuPkg/Include/Library/MtrrLib.h b/UefiCpuPkg/Include/Library/MtrrLib.h
+index 86cc1aab3b..287d249a99 100644
+--- a/UefiCpuPkg/Include/Library/MtrrLib.h
++++ b/UefiCpuPkg/Include/Library/MtrrLib.h
+@@ -9,6 +9,8 @@
+ #ifndef  _MTRR_LIB_H_
+ #define  _MTRR_LIB_H_
+ 
++#include <Register/Intel/ArchitecturalMsr.h>
++
+ //
+ // According to IA32 SDM, MTRRs number and MSR offset are always consistent
+ // for IA32 processor family
+@@ -82,20 +84,20 @@ typedef struct _MTRR_SETTINGS_ {
+ // Memory cache types
+ //
+ typedef enum {
+-  CacheUncacheable    = 0,
+-  CacheWriteCombining = 1,
+-  CacheWriteThrough   = 4,
+-  CacheWriteProtected = 5,
+-  CacheWriteBack      = 6,
+-  CacheInvalid        = 7
++  CacheUncacheable    = MSR_IA32_MTRR_CACHE_UNCACHEABLE,
++  CacheWriteCombining = MSR_IA32_MTRR_CACHE_WRITE_COMBINING,
++  CacheWriteThrough   = MSR_IA32_MTRR_CACHE_WRITE_THROUGH,
++  CacheWriteProtected = MSR_IA32_MTRR_CACHE_WRITE_PROTECTED,
++  CacheWriteBack      = MSR_IA32_MTRR_CACHE_WRITE_BACK,
++  CacheInvalid        = MSR_IA32_MTRR_CACHE_INVALID_TYPE,
+ } MTRR_MEMORY_CACHE_TYPE;
+ 
+-#define  MTRR_CACHE_UNCACHEABLE      0
+-#define  MTRR_CACHE_WRITE_COMBINING  1
+-#define  MTRR_CACHE_WRITE_THROUGH    4
+-#define  MTRR_CACHE_WRITE_PROTECTED  5
+-#define  MTRR_CACHE_WRITE_BACK       6
+-#define  MTRR_CACHE_INVALID_TYPE     7
++#define  MTRR_CACHE_UNCACHEABLE      MSR_IA32_MTRR_CACHE_UNCACHEABLE
++#define  MTRR_CACHE_WRITE_COMBINING  MSR_IA32_MTRR_CACHE_WRITE_COMBINING
++#define  MTRR_CACHE_WRITE_THROUGH    MSR_IA32_MTRR_CACHE_WRITE_THROUGH
++#define  MTRR_CACHE_WRITE_PROTECTED  MSR_IA32_MTRR_CACHE_WRITE_PROTECTED
++#define  MTRR_CACHE_WRITE_BACK       MSR_IA32_MTRR_CACHE_WRITE_BACK
++#define  MTRR_CACHE_INVALID_TYPE     MSR_IA32_MTRR_CACHE_INVALID_TYPE
+ 
+ typedef struct {
+   UINT64                    BaseAddress;

0033-OvmfPkg-Sec-use-cache-type-defines-from-Architectura.patch

@@ -0,0 +1,49 @@
+From 77a0448486125a840a33e438e430d8e0844dab81 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 30 Jan 2024 14:04:41 +0100
+Subject: [PATCH] OvmfPkg/Sec: use cache type #defines from ArchitecturalMsr.h
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
+RH-Jira: RHEL-21704
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [4/4] 55f00e3e153ca945ca458e7abc26780a8d83ac85 (kraxel.rh/centos-src-edk2)
+
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-ID: <20240130130441.772484-5-kraxel@redhat.com>
+
+patch_name: edk2-OvmfPkg-Sec-use-cache-type-defines-from-Architectura.patch
+present_in_specfile: true
+location_in_specfile: 52
+---
+ OvmfPkg/IntelTdx/Sec/SecMain.c | 2 +-
+ OvmfPkg/Sec/SecMain.c          | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/OvmfPkg/IntelTdx/Sec/SecMain.c b/OvmfPkg/IntelTdx/Sec/SecMain.c
+index 0daddac0a0..c00b852f0e 100644
+--- a/OvmfPkg/IntelTdx/Sec/SecMain.c
++++ b/OvmfPkg/IntelTdx/Sec/SecMain.c
+@@ -70,7 +70,7 @@ SecMtrrSetup (
+   }
+ 
+   DefType.Uint64    = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
+-  DefType.Bits.Type = 6; /* write back */
++  DefType.Bits.Type = MSR_IA32_MTRR_CACHE_WRITE_BACK;
+   DefType.Bits.E    = 1; /* enable */
+   AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
+ }
+diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
+index 3b7dc7205d..aa0fa1b1ec 100644
+--- a/OvmfPkg/Sec/SecMain.c
++++ b/OvmfPkg/Sec/SecMain.c
+@@ -766,7 +766,7 @@ SecMtrrSetup (
+   }
+ 
+   DefType.Uint64    = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
+-  DefType.Bits.Type = 6; /* write back */
++  DefType.Bits.Type = MSR_IA32_MTRR_CACHE_WRITE_BACK;
+   DefType.Bits.E    = 1; /* enable */
+   AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
+ }

30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json

@@ -1,36 +0,0 @@
-{
-    "description": "OVMF with SB+SMM, SB enabled, MS certs enrolled",
-    "interface-types": [
-        "uefi"
-    ],
-    "mapping": {
-        "device": "flash",
-        "mode" : "split",
-        "executable": {
-            "filename": "/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2",
-            "format": "qcow2"
-        },
-        "nvram-template": {
-            "filename": "/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2",
-            "format": "qcow2"
-        }
-    },
-    "targets": [
-        {
-            "architecture": "x86_64",
-            "machines": [
-                "pc-q35-*"
-            ]
-        }
-    ],
-    "features": [
-        "acpi-s3",
-        "enrolled-keys",
-        "requires-smm",
-        "secure-boot",
-        "verbose-dynamic"
-    ],
-    "tags": [
-
-    ]
-}

30-edk2-ovmf-ia32-sb-enrolled.json

@@ -1,36 +0,0 @@
-{
-    "description": "OVMF for i386, with SB+SMM, SB enabled, MS certs enrolled",
-    "interface-types": [
-        "uefi"
-    ],
-    "mapping": {
-        "device": "flash",
-        "mode" : "split",
-        "executable": {
-            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_CODE.secboot.fd",
-            "format": "raw"
-        },
-        "nvram-template": {
-            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_VARS.secboot.fd",
-            "format": "raw"
-        }
-    },
-    "targets": [
-        {
-            "architecture": "i386",
-            "machines": [
-                "pc-q35-*"
-            ]
-        }
-    ],
-    "features": [
-        "acpi-s3",
-        "enrolled-keys",
-        "requires-smm",
-        "secure-boot",
-        "verbose-dynamic"
-    ],
-    "tags": [
-
-    ]
-}

40-edk2-ovmf-4m-qcow2-x64-sb.json

@@ -1,35 +0,0 @@
-{
-    "description": "OVMF with SB+SMM, empty varstore",
-    "interface-types": [
-        "uefi"
-    ],
-    "mapping": {
-        "device": "flash",
-        "mode" : "split",
-        "executable": {
-            "filename": "/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2",
-            "format": "qcow2"
-        },
-        "nvram-template": {
-            "filename": "/usr/share/edk2/ovmf/OVMF_VARS_4M.qcow2",
-            "format": "qcow2"
-        }
-    },
-    "targets": [
-        {
-            "architecture": "x86_64",
-            "machines": [
-                "pc-q35-*"
-            ]
-        }
-    ],
-    "features": [
-        "acpi-s3",
-        "requires-smm",
-        "secure-boot",
-        "verbose-dynamic"
-    ],
-    "tags": [
-
-    ]
-}

40-edk2-ovmf-ia32-sb.json

@@ -1,35 +0,0 @@
-{
-    "description": "OVMF for i386, with SB+SMM, empty varstore",
-    "interface-types": [
-        "uefi"
-    ],
-    "mapping": {
-        "device": "flash",
-        "mode" : "split",
-        "executable": {
-            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_CODE.secboot.fd",
-            "format": "raw"
-        },
-        "nvram-template": {
-            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_VARS.fd",
-            "format": "raw"
-        }
-    },
-    "targets": [
-        {
-            "architecture": "i386",
-            "machines": [
-                "pc-q35-*"
-            ]
-        }
-    ],
-    "features": [
-        "acpi-s3",
-        "requires-smm",
-        "secure-boot",
-        "verbose-dynamic"
-    ],
-    "tags": [
-
-    ]
-}

50-edk2-arm-verbose.json

@@ -1,32 +0,0 @@
-{
-    "description": "UEFI firmware for arm, verbose logs",
-    "interface-types": [
-        "uefi"
-    ],
-    "mapping": {
-        "device": "flash",
-        "mode" : "split",
-        "executable": {
-            "filename": "/usr/share/edk2/arm/QEMU_EFI-pflash.raw",
-            "format": "raw"
-        },
-        "nvram-template": {
-            "filename": "/usr/share/edk2/arm/vars-template-pflash.raw",
-            "format": "raw"
-        }
-    },
-    "targets": [
-        {
-            "architecture": "arm",
-            "machines": [
-                "virt-*"
-            ]
-        }
-    ],
-    "features": [
-        "verbose-static"
-    ],
-    "tags": [
-
-    ]
-}

50-edk2-ovmf-4m-qcow2-x64-nosb.json

@@ -1,36 +0,0 @@
-{
-    "description": "OVMF without SB+SMM, empty varstore",
-    "interface-types": [
-        "uefi"
-    ],
-    "mapping": {
-        "device": "flash",
-        "mode" : "split",
-        "executable": {
-            "filename": "/usr/share/edk2/ovmf/OVMF_CODE_4M.qcow2",
-            "format": "qcow2"
-        },
-        "nvram-template": {
-            "filename": "/usr/share/edk2/ovmf/OVMF_VARS_4M.qcow2",
-            "format": "qcow2"
-        }
-    },
-    "targets": [
-        {
-            "architecture": "x86_64",
-            "machines": [
-                "pc-i440fx-*",
-                "pc-q35-*"
-            ]
-        }
-    ],
-    "features": [
-        "acpi-s3",
-        "amd-sev",
-        "amd-sev-es",
-        "verbose-dynamic"
-    ],
-    "tags": [
-
-    ]
-}

50-edk2-ovmf-ia32-nosb.json

@@ -1,34 +0,0 @@
-{
-    "description": "OVMF for i386, without SB+SMM, empty varstore",
-    "interface-types": [
-        "uefi"
-    ],
-    "mapping": {
-        "device": "flash",
-        "mode" : "split",
-        "executable": {
-            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_CODE.fd",
-            "format": "raw"
-        },
-        "nvram-template": {
-            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_VARS.fd",
-            "format": "raw"
-        }
-    },
-    "targets": [
-        {
-            "architecture": "i386",
-            "machines": [
-                "pc-i440fx-*",
-                "pc-q35-*"
-            ]
-        }
-    ],
-    "features": [
-        "acpi-s3",
-        "verbose-dynamic"
-    ],
-    "tags": [
-
-    ]
-}

50-edk2-ovmf-x64-microvm.json

@@ -1,22 +0,0 @@
-{
-    "description": "OVMF for microvm",
-    "interface-types": [
-        "uefi"
-    ],
-    "mapping": {
-        "device": "memory",
-        "filename": "/usr/share/edk2/ovmf/MICROVM.fd"
-    },
-    "targets": [
-        {
-            "architecture": "x86_64",
-            "machines": [
-                "microvm"
-            ]
-        }
-    ],
-    "features": [
-    ],
-    "tags": [
-    ]
-}

50-edk2-ovmf-x64-nosb.json

@@ -19,7 +19,6 @@
         {
             "architecture": "x86_64",
             "machines": [
-                "pc-i440fx-*",
                 "pc-q35-*"
             ]
         }

50-edk2-riscv-qcow2.json

@@ -1,33 +0,0 @@
-{
-    "description": "UEFI firmware for RISC-V virtual machines",
-    "interface-types": [
-        "uefi"
-    ],
-    "mapping": {
-        "device": "flash",
-        "mode" : "split",
-        "executable": {
-            "filename": "/usr/share/edk2/riscv/RISCV_VIRT_CODE.qcow2",
-            "format": "qcow2"
-        },
-        "nvram-template": {
-            "filename": "/usr/share/edk2/riscv/RISCV_VIRT_VARS.qcow2",
-            "format": "qcow2"
-        }
-    },
-    "targets": [
-        {
-            "architecture": "riscv64",
-            "machines": [
-                "virt",
-                "virt-*"
-            ]
-        }
-    ],
-    "features": [
-
-    ],
-    "tags": [
-
-    ]
-}

README.experimental

@@ -1,36 +0,0 @@
-
-experimental edk2 builds
-------------------------
-
-OVMF.stateless.fd
-OVMF.stateless.secboot.fd
-OVMF.stateless.secboot.pcr
-
-  Stateless (== no persistent uefi variables) ovmf build.  Has secure
-  boot support, the 'secboot' variant has secure boot enabled.  Does
-  not require SMM support.
-
-OVMF_CODE.4m.secboot.strictnx.fd
-
-  OVMF build with strict NX configuration (using r-x for code, rw- for
-  data).  Known to not work with some grub and linux kernel versions
-  because they use the wrong memory type for allocations and run into
-  NX faults.  Useful for bootloader development and CI.
-
-QEMU_EFI.strictnx.fd
-QEMU_EFI-strictnx-pflash.raw
-
-  ArmVirt build with strict NX configuration (see above for details).
-
-QEMU_EFI.secboot.testonly.fd
-QEMU_EFI-secboot-testonly-pflash.raw
-vars-template-secboot-testonly-pflash.raw
-
-  ArmVirt build with secure boot support.
-
-  Exposes the secure boot APIs, so they can be used for development /
-  testing / CI.
-
-  The EFI variable store is NOT protected, therefore the build is NOT
-  suitable for production use.
-

changelog

@@ -1,369 +0,0 @@
-* Thu Apr 27 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-4
-- fix tpm detection.
-
-* Thu Apr 13 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-2
-- add StandaloneMM and ArmVirtQemuKernel builds.
-- add json files for qcow2 images.
-- update dbx files to 2023-03.
-
-* Mon Mar 06 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-1
-- update to edk2-stable202302
-- update dbx database to 20220812
-- add riscv64 sub-rpm
-
-* Fri Feb 17 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-14
-- add sub-package with xen build (resolves: rhbz#2170730)
-
-* Sat Feb 11 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-13
-- update openssl (CVE-2023-0286, CVE-2023-0215, CVE-2022-4450, CVE-2022-4304).
-
-* Wed Feb 08 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-12
-- cherry-pick aarch64 bugfixes.
-- set firmware build release date.
-- add ext4 sub-package.
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 20221117gitfff6d81270b5-11
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Fri Jan 06 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-10
-- add experimental builds with strict nx checking.
-
-* Mon Jan 02 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-9
-- revert 'make files sparse again' (resolves: rhbz#2155673).
-- pick up compiler + linker flags from rpm
-
-* Tue Dec 20 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-8
-- make files sparse again
-
-* Thu Dec 15 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-7
-- backport https://github.com/tianocore/edk2/pull/3770
-
-* Mon Dec 12 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-6
-- fix ovmf platform config (revert broken commit).
-- show version information in smbios (backport).
-
-* Mon Dec 05 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-5
-- rename *.json files to be more consistent.
-- build script update
-
-* Fri Dec 02 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-4
-- apply dbx updates
-
-* Tue Nov 29 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-3
-- fix build script
-
-* Mon Nov 28 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-2
-- add workaround for broken grub
-
-* Tue Sep 20 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220826gitba0e0e4c6a17-1
-- update edk2 to 2022-08 stable tag.
-- update openssl bundle to rhel-8.7 level.
-- add stdvga fix.
-- add 4MB firmware builds.
-
-* Thu Aug 18 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-5
-- comment out patch #4 (bug 2116534 workaround)
-- comment out patch #12 (bug 2114858 workaround)
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 20220526git16779ede2d36-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Fri Jun 10 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-3
-- swap stack fix patch.
-
-* Wed Jun 08 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-2
-- fix PcdResizeXterm patch.
-- minor specfile cleanup.
-- add 0021-OvmfPkg-Sec-fix-stack-switch.patch
-- Resolves rhbz#2093745
-
-* Tue May 31 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-1
-- update to new edk2 stable tag (2022-05), refresh patches.
-- add amdsev and inteltdx builds
-- drop qosb
-
-* Tue Apr 19 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220221gitb24306f15daa-4
-- switch to virt-firmware for secure boot key enrollment
-- Stop builds on armv7 too (iasl missing).
-
-* Thu Apr 07 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220221gitb24306f15daa-3
-- Fix TPM build options.
-- Stop builds on i686 (iasl missing).
-- Resolves rhbz#2072827
-
-* Wed Mar 23 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220221gitb24306f15daa-1
-- Update to edk2-stable202202
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 20211126gitbb1bba3d7767-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Mon Dec 6 2021 Gerd Hoffmann <kraxel@redhat.com> - 20211126gitbb1bba3d7767-1
-- Update to edk2-stable202111
-- Resolves rhbz#1978966
-- Resolves rhbz#2026744
-
-* Mon Dec  6 2021 Daniel P. Berrangé <berrange@redhat.com> - 20210527gite1999b264f1f-5
-- Drop glibc strcmp workaround
-
-* Mon Nov 29 2021 Daniel P. Berrangé <berrange@redhat.com> - 20210527gite1999b264f1f-4
-- Drop customized splash screen boot logo
-- Temporary workaround for suspected glibc strcmp bug breaking builds in koji
-
-* Wed Sep  1 2021 Daniel P. Berrangé <berrange@redhat.com> - 20210527gite1999b264f1f-3
-- Fix qemu packaging conditionals for ELN builds
-
-* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 20210527gite1999b264f1f-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Tue Jul 20 2021 Cole Robinson <crobinso@redhat.com> - 20210527gite1999b264f1f-1
-- Update to git snapshot
-- Sync with c9s packaging
-
-* Mon Jun 14 2021 Jiri Kucera <jkucera@redhat.com> - 20200801stable-5
-- Replace genisoimage with xorriso
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 20200801stable-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Thu Dec 03 2020 Cole Robinson <aintdiscole@gmail.com> - 20200801stable-3
-- Really fix TPM breakage (bz 1897367)
-
-* Tue Nov 24 2020 Cole Robinson <aintdiscole@gmail.com> - 20200801stable-2
-- Fix openssl usage, unbreak TPM (bz 1897367)
-
-* Wed Sep 16 2020 Cole Robinson <crobinso@redhat.com> - 20200801stable-1
-- Update to edk2 stable 202008
-
-* Sat Sep 12 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 20200201stable-6
-- Tweaks for aarch64/ARMv7 builds
-- Minor cleanups
-
-* Tue Aug 04 2020 Cole Robinson <aintdiscole@gmail.com> - 20200201stable-5
-- Fix build failures on rawhide
-
-* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 20200201stable-4
-- Second attempt - Rebuilt for
-  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 20200201stable-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Mon Jul 13 2020 Tom Stellard <tstellar@redhat.com> - 20200201stable-2
-- Use make macros
-- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
-
-* Mon Apr 13 2020 Cole Robinson <aintdiscole@gmail.com> - 20200201stable-1
-- Update to stable-202002
-
-* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 20190501stable-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Fri Sep 06 2019 Patrick Uiterwijk <puiterwijk@redhat.com> - 20190501stable-4
-- Updated HTTP_BOOT option to new upstream value
-
-* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 20190501stable-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Mon Jul 15 2019 Cole Robinson <aintdiscole@gmail.com> - 20190501stable-2
-- License is now BSD-2-Clause-Patent
-- Re-enable secureboot enrollment
-- Use qemu-ovmf-secureboot from git
-
-* Thu Jul 11 2019 Cole Robinson <crobinso@redhat.com> - 20190501stable-1
-- Update to stable-201905
-- Update to openssl-1.1.1b
-- Ship VARS file for ovmf-ia32 (bug 1688596)
-- Ship Fedora-variant JSON "firmware descriptor files"
-- Resolves rhbz#1728652
-
-* Mon Mar 18 2019 Cole Robinson <aintdiscole@gmail.com> - 20190308stable-1
-- Use YYYYMMDD versioning to fix upgrade path
-
-* Fri Mar 15 2019 Cole Robinson <aintdiscole@gmail.com> - 201903stable-1
-- Update to stable-201903
-- Update to openssl-1.1.0j
-- Move to python3 deps
-
-* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 20180815gitcb5f4f45ce-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Wed Nov 14 2018 Patrick Uiterwijk <puiterwijk@redhat.com> - 20180815gitcb5f4f45ce-5
-- Add -qosb dependency on python3
-
-* Fri Nov 9 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180815gitcb5f4f45ce-4
-- Fix network boot via grub (bz 1648476)
-
-* Wed Sep 12 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180815gitcb5f4f45ce-3
-- Explicitly compile the scripts using py_byte_compile
-
-* Fri Aug 31 2018 Cole Robinson <crobinso@redhat.com> - 20180815gitcb5f4f45ce-2
-- Fix passing through RPM build flags (bz 1540244)
-
-* Tue Aug 21 2018 Cole Robinson <crobinso@redhat.com> - 20180815gitcb5f4f45ce-1
-- Update to edk2 git cb5f4f45ce, edk2-stable201808
-- Update to qemu-ovmf-secureboot-1.1.3
-- Enable TPM2 support
-
-* Mon Jul 23 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-5
-- Fixes for AMD SEV on OVMF_CODE.fd
-- Add Provides for bundled OpenSSL
-
-* Wed Jul 18 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-4
-- Enable IPv6
-
-* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 20180529gitee3198e672e2-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Wed Jun 20 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-2
-- Backport two bug fixes from RHEL: connect again virtio-rng devices, and
-  connect consoles unconditionally in OVMF (ARM firmware already did it)
-
-* Tue May 29 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-1
-- Rebase to ee3198e672e2
-
-* Tue May 01 2018 Cole Robinson <crobinso@redhat.com> - 20171011git92d07e4-7
-- Bump release for new build
-
-* Fri Mar 30 2018 Patrick Uiterwijk <puiterwijk@redhat.com> - 20171011git92d07e4-6
-- Add qemu-ovmf-secureboot (qosb)
-- Generate pre-enrolled Secure Boot OVMF VARS files
-
-* Wed Mar 07 2018 Paolo Bonzini <pbonzini@redhat.com> - 20171011git92d07e4-5
-- Fix GCC 8 compilation
-- Replace dosfstools and mtools with qemu-img vvfat
-
-* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 20171011git92d07e4-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
-* Fri Jan 19 2018 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-3
-- Add OpenSSL patches from Fedora
-- Enable TLS_MODE
-
-* Fri Nov 17 2017 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-2
-- Backport patches 19-21 from RHEL
-- Add patches 22-24 to fix SEV slowness
-- Add fedora conditionals
-
-* Tue Nov 14 2017 Paolo Bonzini <pbonzini@redhat.com> - 20171011git92d07e4-1
-- Import source and patches from RHEL version
-- Update OpenSSL to 1.1.0e
-- Refresh 0099-Tweak-the-tools_def-to-support-cross-compiling.patch
-
-* Mon Nov 13 2017 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-6
-- Allow non-cross builds
-- Install /usr/share/OVMF and /usr/share/AAVMF
-
-* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20170209git296153c5-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20170209git296153c5-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Wed Mar 15 2017 Cole Robinson <crobinso@redhat.com> - 20170209git296153c5-3
-- Ship ovmf-ia32 package (bz 1424722)
-
-* Thu Feb 16 2017 Cole Robinson <crobinso@redhat.com> - 20170209git296153c5-2
-- Update EnrollDefaultKeys patch (bz #1398743)
-
-* Mon Feb 13 2017 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-1
-- Rebase to git master
-- New patch 0010 fixes failure to build from source.
-
-* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20161105git3b25ca8-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Sun Nov 06 2016 Cole Robinson <crobinso@redhat.com> - 20161105git3b25ca8-1
-- Rebase to git master
-
-* Fri Sep  9 2016 Tom Callaway <spot@fedoraproject.org> - 20160418gita8c39ba-5
-- replace legally problematic openssl source with "hobbled" tarball
-
-* Thu Jul 21 2016 Gerd Hoffmann <kraxel@redhat.com> - 20160418gita8c39ba-4
-- Also build for armv7.
-
-* Tue Jul 19 2016 Gerd Hoffmann <kraxel@redhat.com> 20160418gita8c39ba-3
-- Update EnrollDefaultKeys patch.
-
-* Fri Jul 8 2016 Paolo Bonzini <pbonzini@redhat.com> - 20160418gita8c39ba-2
-- Distribute edk2-ovmf on aarch64
-
-* Sat May 21 2016 Cole Robinson <crobinso@redhat.com> - 20160418gita8c39ba-1
-- Distribute edk2-aarch64 on x86 (bz #1338027)
-
-* Mon Apr 18 2016 Gerd Hoffmann <kraxel@redhat.com> 20160418gita8c39ba-0
-- Update to latest git.
-- Add firmware builds (FatPkg is free now).
-
-* Mon Feb 15 2016 Cole Robinson <crobinso@redhat.com> 20151127svn18975-3
-- Fix FTBFS gcc warning (bz 1307439)
-
-* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 20151127svn18975-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
-
-* Fri Nov 27 2015 Paolo Bonzini <pbonzini@redhat.com> - 20151127svn18975-1
-- Rebase to 20151127svn18975-1
-- Linker script renamed to GccBase.lds
-
-* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20150519svn17469-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
-
-* Tue May 19 2015 Paolo Bonzini <pbonzini@redhat.com> - 20150519svn17469-1
-- Rebase to 20150519svn17469-1
-- edk2-remove-tree-check.patch now upstream
-
-* Sat May 02 2015 Kalev Lember <kalevlember@gmail.com> - 20140724svn2670-6
-- Rebuilt for GCC 5 C++11 ABI change
-
-* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20140724svn2670-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
-
-* Thu Jul 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140724svn2670-1
-- Rebase to 20140724svn2670-1
-
-* Tue Jun 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140624svn2649-1
-- Use standalone .tar.xz from buildtools repo
-
-* Tue Jun 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140328svn15376-4
-- Install BuildTools/BaseEnv
-
-* Mon Jun 23 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140328svn15376-3
-- Rebase to get GCC48 configuration
-- Package EDK_TOOLS_PATH as /usr/share/edk2
-- Package "build" and LzmaF86Compress too, as well as the new
-  tools Ecc and TianoCompress.
-
-* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20131114svn14844-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
-
-* Thu Nov 14 2013 Paolo Bonzini <pbonzini@redhat.com> - 20131114svn14844-1
-- Upgrade to r14844.
-- Remove upstreamed parts of patch 1.
-
-* Fri Nov 8 2013 Paolo Bonzini <pbonzini@redhat.com> - 20130515svn14365-7
-- Make BaseTools compile on ARM.
-
-* Fri Aug 30 2013 Paolo Bonzini <pbonzini@redhat.com> - 20130515svn14365-6
-- Revert previous change; firmware packages should be noarch, and building
-  BaseTools twice is simply wrong.
-
-* Mon Aug 19 2013 Kay Sievers <kay@redhat.com> - 20130515svn14365-5
-- Add sub-package with EFI shell
-
-* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20130515svn14365-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
-
-* Thu May 23 2013 Dan Horák <dan[at]danny.cz> 20130515svn14365-3
-- set ExclusiveArch
-
-* Thu May 16 2013 Paolo Bonzini <pbonzini@redhat.com> 20130515svn14365-2
-- Fix edk2-tools-python Requires
-
-* Wed May 15 2013 Paolo Bonzini <pbonzini@redhat.com> 20130515svn14365-1
-- Split edk2-tools-doc and edk2-tools-python
-- Fix Python BuildRequires
-- Remove FatBinPkg at package creation time.
-- Use fully versioned dependency.
-- Add comment on how to generate the sources.
-
-* Thu May 2 2013 Paolo Bonzini <pbonzini@redhat.com> 20130502.g732d199-1
-- Create.

edk2-build.fedora

@@ -1,312 +0,0 @@
-
-[opts.ovmf.common]
-NETWORK_HTTP_BOOT_ENABLE = TRUE
-NETWORK_IP6_ENABLE       = TRUE
-NETWORK_TLS_ENABLE       = TRUE
-NETWORK_ISCSI_ENABLE     = TRUE
-NETWORK_ALLOW_HTTP_CONNECTIONS = TRUE
-TPM2_ENABLE              = TRUE
-TPM2_CONFIG_ENABLE       = TRUE
-TPM1_ENABLE              = TRUE
-CAVIUM_ERRATUM_27456     = TRUE
-
-[opts.ovmf.4m]
-FD_SIZE_4MB              = TRUE
-
-[opts.ovmf.2m]
-FD_SIZE_2MB              = TRUE
-NETWORK_ISCSI_ENABLE     = FALSE
-NETWORK_TLS_ENABLE       = FALSE
-
-[opts.ovmf.sb.smm]
-SECURE_BOOT_ENABLE       = TRUE
-SMM_REQUIRE              = TRUE
-# old downstream
-EXCLUDE_SHELL_FROM_FD    = TRUE
-# new upstream
-BUILD_SHELL              = FALSE
-
-# requires edk2 2022-11 or newer
-[opts.ovmf.sb.stateless]
-SECURE_BOOT_ENABLE       = TRUE
-SMM_REQUIRE              = FALSE
-
-[opts.armvirt.verbose]
-DEBUG_PRINT_ERROR_LEVEL  = 0x8040004F
-
-[opts.armvirt.silent]
-DEBUG_PRINT_ERROR_LEVEL  = 0x80000000
-
-[opts.armvirt.sb.testonly]
-SECURE_BOOT_ENABLE       = TRUE
-
-[opts.armvirt.kernel]
-TPM2_ENABLE              = FALSE
-TPM2_CONFIG_ENABLE       = FALSE
-
-
-[pcds.nx.strict]
-PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD5
-PcdImageProtectionPolicy       = 0x03
-PcdSetNxForStack               = TRUE
-# Default is FALSE, so there no need to actually set it.
-#PcdUninstallMemAttrProtocol    = FALSE
-
-[pcds.nx.broken.shim.grub]
-# grub.efi uses EfiLoaderData for code
-PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD1
-# shim.efi has broken MemAttr code
-PcdUninstallMemAttrProtocol    = TRUE
-
-
-#####################################################################
-# stateful ovmf builds (with vars in flash)
-
-[build.ovmf.2m.default]
-desc = ovmf build (64-bit, 2MB)
-conf = OvmfPkg/OvmfPkgX64.dsc
-arch = X64
-opts = ovmf.common
-       ovmf.2m
-plat = OvmfX64
-dest = Fedora/ovmf
-cpy1 = FV/OVMF_CODE.fd
-cpy2 = FV/OVMF_VARS.fd
-cpy3 = X64/Shell.efi
-
-[build.ovmf.4m.default]
-desc = ovmf build (64-bit, 4MB)
-conf = OvmfPkg/OvmfPkgX64.dsc
-arch = X64
-opts = ovmf.common
-       ovmf.4m
-plat = OvmfX64
-dest = Fedora/ovmf
-cpy1 = FV/OVMF_CODE.fd OVMF_CODE_4M.fd
-cpy2 = FV/OVMF_VARS.fd OVMF_VARS_4M.fd
-
-[build.ovmf.2m.sb.smm]
-desc = ovmf build (64-bit, 2MB, q35 only, needs smm, secure boot)
-conf = OvmfPkg/OvmfPkgX64.dsc
-arch = X64
-opts = ovmf.common
-       ovmf.2m
-       ovmf.sb.smm
-plat = OvmfX64
-dest = Fedora/ovmf
-cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
-cpy2 = X64/EnrollDefaultKeys.efi
-
-[build.ovmf.4m.sb.smm]
-desc = ovmf build (64-bit, 4MB, q35 only, needs smm, secure boot)
-conf = OvmfPkg/OvmfPkgX64.dsc
-arch = X64
-opts = ovmf.common
-       ovmf.4m
-       ovmf.sb.smm
-plat = OvmfX64
-dest = Fedora/ovmf
-cpy1 = FV/OVMF_CODE.fd OVMF_CODE_4M.secboot.fd
-
-
-#####################################################################
-# stateless ovmf builds (firmware in rom or r/o flash)
-
-[build.ovmf.microvm]
-desc = ovmf build for qemu microvm (2MB)
-conf = OvmfPkg/Microvm/MicrovmX64.dsc
-arch = X64
-opts = ovmf.common
-       ovmf.2m
-plat = MicrovmX64
-dest = Fedora/ovmf
-cpy1 = FV/MICROVM.fd
-
-[build.ovmf.xen]
-desc = ovmf build for Xen
-conf = OvmfPkg/OvmfXen.dsc
-arch = X64
-opts = ovmf.common
-       ovmf.2m
-plat = OvmfXen
-dest = Fedora/xen
-cpy1 = FV/OVMF.fd
-
-[build.ovmf.amdsev]
-desc = ovmf build for AmdSev (2MB)
-conf = OvmfPkg/AmdSev/AmdSevX64.dsc
-arch = X64
-opts = ovmf.common
-       ovmf.2m
-plat = AmdSev
-dest = Fedora/ovmf
-cpy1 = FV/OVMF.fd OVMF.amdsev.fd
-
-[build.ovmf.inteltdx]
-desc = ovmf build for IntelTdx (2MB)
-conf = OvmfPkg/IntelTdx/IntelTdxX64.dsc
-arch = X64
-opts = ovmf.common
-       ovmf.2m
-       ovmf.sb.stateless
-plat = IntelTdx
-dest = Fedora/ovmf
-cpy1 = FV/OVMF.fd OVMF.inteltdx.fd
-
-
-#####################################################################
-# armvirt builds
-
-[build.armvirt.aa64.verbose]
-desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
-conf = ArmVirtPkg/ArmVirtQemu.dsc
-arch = AARCH64
-opts = ovmf.common
-       armvirt.verbose
-pcds = nx.broken.shim.grub
-plat = ArmVirtQemu-AARCH64
-dest = Fedora/aarch64
-cpy1 = FV/QEMU_EFI.fd
-cpy2 = FV/QEMU_VARS.fd
-cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
-cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
-pad3 = QEMU_EFI-pflash.raw      64m
-pad4 = vars-template-pflash.raw 64m
-
-[build.armvirt.aa64.silent]
-desc = ArmVirt build for qemu, 64-bit (arm v8), silent
-conf = ArmVirtPkg/ArmVirtQemu.dsc
-arch = AARCH64
-opts = ovmf.common
-       armvirt.silent
-pcds = nx.broken.shim.grub
-plat = ArmVirtQemu-AARCH64
-dest = Fedora/aarch64
-cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.silent.fd
-cpy2 = FV/QEMU_EFI.fd  QEMU_EFI-silent-pflash.raw
-pad2 = QEMU_EFI-silent-pflash.raw 64m
-
-[build.armvirt.aa64.kernel]
-desc = ArmVirt build for qemu, 64-bit (arm v8)
-conf = ArmVirtPkg/ArmVirtQemuKernel.dsc
-arch = AARCH64
-opts = ovmf.common
-       armvirt.silent
-       armvirt.kernel
-pcds = nx.broken.shim.grub
-plat = ArmVirtQemuKernel-AARCH64
-dest = Fedora/aarch64
-cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.kernel.fd
-
-
-#####################################################################
-# riscv
-
-[build.riscv.qemu]
-conf = OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc
-arch = RISCV64
-plat = RiscVVirtQemu
-dest = Fedora/riscv
-cpy1 = FV/RISCV_VIRT_CODE.fd
-cpy2 = FV/RISCV_VIRT_CODE.fd RISCV_VIRT_CODE.raw
-cpy3 = FV/RISCV_VIRT_VARS.fd
-cpy4 = FV/RISCV_VIRT_VARS.fd RISCV_VIRT_VARS.raw
-pad1 = RISCV_VIRT_CODE.raw 32m
-pad2 = RISCV_VIRT_VARS.raw 32m
-
-
-#####################################################################
-# 32-bit builds
-
-[build.ovmf.ia32.default]
-desc = ovmf build (32-bit, 2MB)
-conf = OvmfPkg/OvmfPkgIa32.dsc
-arch = IA32
-opts = ovmf.common
-       ovmf.2m
-plat = OvmfIa32
-dest = Fedora/ovmf-ia32
-cpy1 = FV/OVMF_CODE.fd
-cpy2 = FV/OVMF_VARS.fd
-cpy3 = IA32/Shell.efi
-
-[build.ovmf.ia32.sb.smm]
-desc = ovmf build (32-bit, 2MB, q35 only, needs smm, secure boot)
-conf = OvmfPkg/OvmfPkgIa32.dsc
-arch = IA32
-opts = ovmf.common
-       ovmf.2m
-       ovmf.sb.smm
-plat = OvmfIa32
-dest = Fedora/ovmf-ia32
-cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
-cpy2 = IA32/EnrollDefaultKeys.efi
-
-[build.armvirt.arm]
-desc = ArmVirt build for qemu, 32-bit (arm v7)
-conf = ArmVirtPkg/ArmVirtQemu.dsc
-arch = ARM
-opts = ovmf.common
-pcds = nx.broken.shim.grub
-plat = ArmVirtQemu-ARM
-dest = Fedora/arm
-cpy1 = FV/QEMU_EFI.fd
-cpy2 = FV/QEMU_VARS.fd
-cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
-cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
-pad3 = QEMU_EFI-pflash.raw      64m
-pad4 = vars-template-pflash.raw 64m
-
-
-#####################################################################
-# experimental builds
-
-[build.ovmf.sb.stateless]
-desc = ovmf build (64-bit, stateless secure boot)
-conf = OvmfPkg/OvmfPkgX64.dsc
-arch = X64
-opts = ovmf.common
-       ovmf.4m
-       ovmf.sb.stateless
-plat = OvmfX64
-dest = Fedora/experimental
-cpy1 = FV/OVMF.fd OVMF.stateless.fd
-
-[build.ovmf.strict.nx]
-desc = ovmf build (64-bit, 4MB, q35 only, needs smm, secure boot, strict nx)
-conf = OvmfPkg/OvmfPkgX64.dsc
-arch = X64
-opts = ovmf.common
-       ovmf.4m
-       ovmf.sb.smm
-pcds = nx.strict
-plat = OvmfX64
-dest = Fedora/experimental
-cpy1 = FV/OVMF_CODE.fd OVMF_CODE_4M.secboot.strictnx.fd
-
-[build.armvirt.aa64.strict.nx]
-desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
-conf = ArmVirtPkg/ArmVirtQemu.dsc
-arch = AARCH64
-opts = ovmf.common
-       armvirt.verbose
-pcds = nx.strict
-plat = ArmVirtQemu-AARCH64
-dest = Fedora/experimental
-cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.strictnx.fd
-cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-strictnx-pflash.raw
-pad3 = QEMU_EFI-strictnx-pflash.raw  64m
-
-[build.armvirt.aa64.secboot.testonly]
-desc = ArmVirt build for qemu, 64-bit (arm v8), secure boot
-conf = ArmVirtPkg/ArmVirtQemu.dsc
-arch = AARCH64
-opts = ovmf.common
-       armvirt.verbose
-       armvirt.sb.testonly
-pcds = nx.strict
-plat = ArmVirtQemu-AARCH64
-dest = Fedora/experimental
-cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.secboot.testonly.fd
-cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-secboot-testonly-pflash.raw
-pad3 = QEMU_EFI-secboot-testonly-pflash.raw  64m

edk2-build.fedora.platforms

@@ -1,47 +0,0 @@
-
-#####################################################################
-# ext4 driver
-
-[build.ext4.x64]
-desc = ext4 driver
-conf = Features/Ext4Pkg/Ext4Pkg.dsc
-arch = X64
-plat = Ext4Pkg
-dest = Fedora/drivers
-cpy1 = X64/Ext4Dxe.efi ext4x64.efi
-
-[build.ext4.aa64]
-desc = ext4 driver
-conf = Features/Ext4Pkg/Ext4Pkg.dsc
-arch = AARCH64
-plat = Ext4Pkg
-dest = Fedora/drivers
-cpy1 = AARCH64/Ext4Dxe.efi ext4aa64.efi
-
-[build.ext4.riscv64]
-desc = ext4 driver
-conf = Features/Ext4Pkg/Ext4Pkg.dsc
-arch = RISCV64
-plat = Ext4Pkg
-dest = Fedora/drivers
-cpy1 = RISCV64/Ext4Dxe.efi ext4riscv64.efi
-
-
-#####################################################################
-# arm standalone mm
-
-[build.standalone.mm.aa64]
-conf = Platform/StandaloneMm/PlatformStandaloneMmPkg/PlatformStandaloneMmRpmb.dsc
-arch = AARCH64
-plat = MmStandaloneRpmb
-dest = Fedora/aarch64
-cpy1 = FV/BL32_AP_MM.fd
-
-
-#####################################################################
-# loongarch builds
-
-[build.loongarch]
-desc = Loongarch build
-conf = Platform/Loongson/LoongArchQemuPkg/Loongson.dsc
-arch = LOONGARCH64

edk2.spec

@@ -1,29 +1,15 @@
-# https://fedoraproject.org/wiki/Changes/SetBuildFlagsBuildCheck
+ExclusiveArch: x86_64 aarch64
-# breaks cross-building
-%undefine _auto_set_build_flags
 
-# actual firmware builds support cross-compiling.  edk2-tools
+# edk2-stable202402
-# in theory should build everywhere without much trouble, but
+%define GITDATE        20240214
-# in practice the edk2 build system barfs on archs it doesn't know
+%define GITCOMMIT      edc6681206
-# (such as ppc), so lets limit things to the known-good ones.
-ExclusiveArch: x86_64 aarch64 riscv64
-
-# edk2-stable202308
-%define GITDATE        20231122
-%define GITCOMMIT      8736b8fdca85
 %define TOOLCHAIN      GCC
 
-%define PLATFORMS_COMMIT 10e2eb030de3
-
 %define OPENSSL_VER    3.0.7
-%define OPENSSL_COMMIT db0287935122edceb91dcda8dfb53b4090734e22
+%define OPENSSL_HASH   db0287935122edceb91dcda8dfb53b4090734e22
 
 %define DBXDATE        20230509
 
-# Undefine this to get *HUGE* (50MB+) verbose build logs
-%define silent --silent
-
-%if %{defined rhel}
 %define build_ovmf 0
 %define build_aarch64 0
 %ifarch x86_64
@@ -32,36 +18,21 @@ ExclusiveArch: x86_64 aarch64 riscv64
 %ifarch aarch64
   %define build_aarch64 1
 %endif
-%define build_riscv64 0
-%else
-%define build_ovmf 1
-%define build_aarch64 1
-%define build_riscv64 1
-%endif
-
-%global softfloat_version 20180726-gitb64af41
-%define cross %{defined fedora}
-%define disable_werror %{defined fedora}
-
 
 Name:       edk2
 Version:    %{GITDATE}
-Release:    %autorelease
+Release:    1%{?dist}
 Summary:    UEFI firmware for 64-bit virtual machines
-License:    Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND BSD-3-Clause AND BSD-4-Clause AND ISC AND MIT AND LicenseRef-Fedora-Public-Domain
+License:    BSD-2-Clause-Patent and Apache-2.0 and MIT
 URL:        http://www.tianocore.org
 
 # The source tarball is created using following commands:
-# COMMIT=bb1bba3d7767
+# COMMIT=ba91d0292e
 # git archive --format=tar --prefix=edk2-$COMMIT/ $COMMIT \
 # | xz -9ev >/tmp/edk2-$COMMIT.tar.xz
 Source0: edk2-%{GITCOMMIT}.tar.xz
 Source1: ovmf-whitepaper-c770f8c.txt
-Source2: openssl-rhel-%{OPENSSL_COMMIT}.tar.xz
+Source2: openssl-rhel-%{OPENSSL_HASH}.tar.xz
-Source3: softfloat-%{softfloat_version}.tar.xz
-Source4: edk2-platforms-%{PLATFORMS_COMMIT}.tar.xz
-Source5: jansson-2.13.1.tar.bz2
-Source6: README.experimental
 
 # json description files
 Source10: 50-edk2-aarch64-qcow2.json
@@ -69,54 +40,48 @@ Source11: 51-edk2-aarch64-raw.json
 Source12: 52-edk2-aarch64-verbose-qcow2.json
 Source13: 53-edk2-aarch64-verbose-raw.json
 
-Source20: 50-edk2-arm-verbose.json
+Source40: 30-edk2-ovmf-x64-sb-enrolled.json
-
+Source41: 40-edk2-ovmf-x64-sb.json
-Source30: 30-edk2-ovmf-ia32-sb-enrolled.json
+Source43: 50-edk2-ovmf-x64-nosb.json
-Source31: 40-edk2-ovmf-ia32-sb.json
+Source44: 60-edk2-ovmf-x64-amdsev.json
-Source32: 50-edk2-ovmf-ia32-nosb.json
+Source45: 60-edk2-ovmf-x64-inteltdx.json
-
-Source40: 30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json
-Source41: 31-edk2-ovmf-2m-raw-x64-sb-enrolled.json
-Source42: 40-edk2-ovmf-4m-qcow2-x64-sb.json
-Source43: 41-edk2-ovmf-2m-raw-x64-sb.json
-Source44: 50-edk2-ovmf-x64-microvm.json
-Source45: 50-edk2-ovmf-4m-qcow2-x64-nosb.json
-Source46: 51-edk2-ovmf-2m-raw-x64-nosb.json
-Source47: 60-edk2-ovmf-x64-amdsev.json
-Source48: 60-edk2-ovmf-x64-inteltdx.json
-
-Source50: 50-edk2-riscv-qcow2.json
 
 # https://gitlab.com/kraxel/edk2-build-config
 Source80: edk2-build.py
-Source81: edk2-build.fedora
+Source82: edk2-build.rhel-9
-Source82: edk2-build.fedora.platforms
-Source83: edk2-build.rhel-9
 
 Source90: DBXUpdate-%{DBXDATE}.x64.bin
-Source91: DBXUpdate-%{DBXDATE}.ia32.bin
+Patch1: 0003-Remove-paths-leading-to-submodules.patch
-
+Patch2: 0004-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
-Patch0001: 0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch
+Patch3: 0005-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
-Patch0002: 0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch
+Patch4: 0006-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
-Patch0003: 0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
+Patch5: 0007-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
-Patch0004: 0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
+Patch6: 0008-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
-Patch0005: 0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
+Patch7: 0009-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
-Patch0006: 0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+Patch8: 0010-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
-Patch0007: 0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+Patch9: 0011-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
-Patch0008: 0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+Patch10: 0012-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
-Patch0009: 0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+Patch11: 0013-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
-Patch0010: 0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+Patch12: 0014-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
-Patch0011: 0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
+Patch13: 0015-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
-Patch0012: 0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
+Patch14: 0016-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
-Patch0013: 0013-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
+Patch15: 0017-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
-Patch0015: 0015-CryptoPkg-CrtLib-add-stat.h.patch
+Patch16: 0018-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
-Patch0016: 0016-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch
+Patch17: 0019-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
-Patch0017: 0017-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
+Patch18: 0020-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
-%if 0%{?fedora} >= 38 || 0%{?rhel} >= 10
+Patch19: 0021-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
-Patch0018: 0018-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch
+Patch20: 0022-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
-%endif
+Patch21: 0023-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
-Patch0019: 0019-ArmVirt-Allow-memory-attributes-protocol-to-be-disab.patch
+Patch22: 0024-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
-
+Patch23: 0025-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
+Patch24: 0026-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
+Patch25: 0027-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
+Patch26: 0028-CryptoPkg-CrtLib-add-stat.h-include-file.patch
+Patch27: 0029-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch
+Patch28: 0030-OvmfPkg-Sec-Setup-MTRR-early-in-the-boot-process.patch
+Patch29: 0031-MdePkg-ArchitecturalMsr.h-add-defines-for-MTRR-cache.patch
+Patch30: 0032-UefiCpuPkg-MtrrLib.h-use-cache-type-defines-from-Arc.patch
+Patch31: 0033-OvmfPkg-Sec-use-cache-type-defines-from-Architectura.patch
 
 # python3-devel and libuuid-devel are required for building tools.
 # python3-devel is also needed for varstore template generation and
@@ -125,15 +90,9 @@ BuildRequires:  python3-devel
 BuildRequires:  libuuid-devel
 BuildRequires:  /usr/bin/iasl
 BuildRequires:  binutils gcc git gcc-c++ make
+BuildRequires:  perl perl(JSON)
 BuildRequires:  qemu-img
 
-# openssl configure
-BuildRequires:  perl(FindBin)
-BuildRequires:  perl(IPC::Cmd)
-BuildRequires:  perl(File::Compare)
-BuildRequires:  perl(File::Copy)
-BuildRequires:  perl(JSON)
-
 %if %{build_ovmf}
 # Only OVMF includes 80x86 assembly files (*.nasm*).
 BuildRequires:  nasm
@@ -144,21 +103,12 @@ BuildRequires:  dosfstools
 BuildRequires:  mtools
 BuildRequires:  xorriso
 
-# For generating the variable store template with the default certificates
+# secure boot enrollment
-# enrolled.
+BuildRequires:  python3dist(virt-firmware) >= 23.4
-BuildRequires:  python3-virt-firmware >= 23.5
 
 # endif build_ovmf
 %endif
 
-%if %{cross}
-BuildRequires:  gcc-aarch64-linux-gnu
-BuildRequires:  gcc-arm-linux-gnu
-BuildRequires:  gcc-x86_64-linux-gnu
-BuildRequires:  gcc-riscv64-linux-gnu
-%endif
-
-
 
 %package ovmf
 Summary:    UEFI firmware for x86_64 virtual machines
@@ -166,13 +116,10 @@ BuildArch:  noarch
 Provides:   OVMF = %{version}-%{release}
 Obsoletes:  OVMF < 20180508-100.gitee3198e672e2.el7
 
-# need libvirt version with qcow2 support
-Conflicts:  libvirt-daemon-driver-qemu < 9.7.0
-
 # OVMF includes the Secure Boot and IPv6 features; it has a builtin OpenSSL
 # library.
 Provides:   bundled(openssl) = %{OPENSSL_VER}
-License:    Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND BSD-4-Clause AND ISC AND LicenseRef-Fedora-Public-Domain
+License:    BSD-2-Clause-Patent and Apache-2.0
 
 # URL taken from the Maintainers.txt file.
 URL:        http://www.tianocore.org/ovmf/
@@ -190,11 +137,11 @@ Provides:   AAVMF = %{version}-%{release}
 Obsoletes:  AAVMF < 20180508-100.gitee3198e672e2.el7
 
 # need libvirt version with qcow2 support
-Conflicts:  libvirt-daemon-driver-qemu < 9.7.0
+Conflicts:  libvirt-daemon-driver-qemu < 9.2.0
 
 # No Secure Boot for AAVMF yet, but we include OpenSSL for the IPv6 stack.
 Provides:   bundled(openssl) = %{OPENSSL_VER}
-License:    Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND BSD-4-Clause AND ISC AND LicenseRef-Fedora-Public-Domain
+License:    BSD-2-Clause-Patent and Apache-2.0
 
 # URL taken from the Maintainers.txt file.
 URL:        https://github.com/tianocore/tianocore.github.io/wiki/ArmVirtPkg
@@ -207,7 +154,7 @@ package contains a 64-bit build.
 
 %package tools
 Summary:        EFI Development Kit II Tools
-License:        BSD-2-Clause-Patent AND LicenseRef-Fedora-Public-Domain
+License:        BSD-2-Clause-Patent
 URL:            https://github.com/tianocore/tianocore.github.io/wiki/BaseTools
 %description tools
 This package provides tools that are needed to
@@ -227,78 +174,6 @@ EDK II is a modern, feature-rich, cross-platform firmware development
 environment for the UEFI and PI specifications. This package contains sample
 64-bit UEFI firmware builds for QEMU and KVM.
 
-
-%if %{defined fedora}
-%package ovmf-ia32
-Summary:        Open Virtual Machine Firmware
-License:        Apache-2.0 AND BSD-2-Clause-Patent AND BSD-4-Clause AND ISC AND LicenseRef-Fedora-Public-Domain
-Provides:       bundled(openssl)
-BuildArch:      noarch
-%description ovmf-ia32
-EFI Development Kit II
-Open Virtual Machine Firmware (ia32)
-
-%package ovmf-xen
-Summary:        Open Virtual Machine Firmware, Xen build
-License:        Apache-2.0 AND BSD-2-Clause-Patent AND BSD-4-Clause AND ISC AND LicenseRef-Fedora-Public-Domain
-Provides:       bundled(openssl)
-BuildArch:      noarch
-%description ovmf-xen
-EFI Development Kit II
-Open Virtual Machine Firmware (Xen build)
-
-%package experimental
-Summary:        Open Virtual Machine Firmware, experimental builds
-License:        Apache-2.0 AND BSD-2-Clause-Patent AND BSD-4-Clause AND ISC AND LicenseRef-Fedora-Public-Domain
-Provides:       bundled(openssl)
-Obsoletes:      edk2-ovmf-experimental < 20230825
-BuildArch:      noarch
-%description experimental
-EFI Development Kit II
-Open Virtual Machine Firmware (experimental builds)
-
-%package arm
-Summary:        ARM Virtual Machine Firmware
-BuildArch:      noarch
-License:        Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND BSD-3-Clause AND BSD-4-Clause AND ISC AND LicenseRef-Fedora-Public-Domain
-%description arm
-EFI Development Kit II
-ARMv7 UEFI Firmware
-
-%package riscv64
-Summary:        RISC-V Virtual Machine Firmware
-BuildArch:      noarch
-License:        Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND LicenseRef-Fedora-Public-Domain
-
-# need libvirt version with qcow2 support
-Conflicts:  libvirt-daemon-driver-qemu < 9.7.0
-
-%description riscv64
-EFI Development Kit II
-RISC-V UEFI Firmware
-
-%package ext4
-Summary:        Ext4 filesystem driver
-License:        Apache-2.0 AND BSD-2-Clause-Patent
-BuildArch:      noarch
-%description ext4
-EFI Development Kit II
-Ext4 filesystem driver
-
-%package tools-python
-Summary:        EFI Development Kit II Tools
-Requires:       python3
-BuildArch:      noarch
-
-%description tools-python
-This package provides tools that are needed to build EFI executables
-and ROMs using the GNU tools.  You do not need to install this package;
-you probably want to install edk2-tools only.
-# endif fedora
-%endif
-
-
-
 %prep
 # We needs some special git config options that %%autosetup won't give us.
 # We init the git dir ourselves, then tell %%autosetup not to blow it away.
@@ -311,32 +186,15 @@ git config am.keepcr true
 %autosetup -T -D -n edk2-%{GITCOMMIT} -S git_am
 
 cp -a -- %{SOURCE1} .
+cp -a -- %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} .
+cp -a -- %{SOURCE40} %{SOURCE41} %{SOURCE43} %{SOURCE44} %{SOURCE45} .
+cp -a -- %{SOURCE80} %{SOURCE82} .
+cp -a -- %{SOURCE90} .
 tar -C CryptoPkg/Library/OpensslLib -a -f %{SOURCE2} -x
-# extract softfloat into place
-tar -xf %{SOURCE3} --strip-components=1 --directory ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3/
-tar -xf %{SOURCE4} --strip-components=1 "*/Drivers" "*/Features" "*/Platform" "*/Silicon"
-tar -xf %{SOURCE5} --strip-components=1 --directory RedfishPkg/Library/JsonLib/jansson
-# include paths pointing to unused submodules
-mkdir -p MdePkg/Library/MipiSysTLib/mipisyst/library/include
-mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include
-mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include/mbedtls
-mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/library
 
 # Done by %setup, but we do not use it for the auxiliary tarballs
 chmod -Rf a+rX,u+w,g-w,o-w .
 
-cp -a -- \
-   %{SOURCE6} \
-   %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} \
-   %{SOURCE20} \
-   %{SOURCE30} %{SOURCE31} %{SOURCE32} \
-   %{SOURCE40} %{SOURCE41} %{SOURCE42} %{SOURCE43} %{SOURCE44} \
-   %{SOURCE45} %{SOURCE46} %{SOURCE47} %{SOURCE48} \
-   %{SOURCE50} \
-   %{SOURCE80} %{SOURCE81} %{SOURCE82} %{SOURCE83} \
-   %{SOURCE90} %{SOURCE91} \
-   .
-
 %build
 
 build_iso() {
@@ -380,10 +238,15 @@ export RELEASE_DATE="$(echo %{GITDATE} | sed -e 's|\(....\)\(..\)\(..\)|\2/\3/\1
 touch OvmfPkg/AmdSev/Grub/grub.efi   # dummy
 python3 CryptoPkg/Library/OpensslLib/configure.py
 
-%if %{build_ovmf}
+# include dirs of unused submodules
-%if %{defined rhel}
+mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include
+mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include/mbedtls
+mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/library
 
-./edk2-build.py --config edk2-build.rhel-9 %{?silent} --release-date "$RELEASE_DATE" -m ovmf
+%if %{build_ovmf}
+./edk2-build.py --config edk2-build.rhel-9 -m ovmf --release-date "$RELEASE_DATE"
+build_iso RHEL-9/ovmf
+cp DBXUpdate-%{DBXDATE}.x64.bin RHEL-9/ovmf
 virt-fw-vars --input   RHEL-9/ovmf/OVMF_VARS.fd \
              --output  RHEL-9/ovmf/OVMF_VARS.secboot.fd \
              --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
@@ -391,93 +254,18 @@ virt-fw-vars --input   RHEL-9/ovmf/OVMF_VARS.fd \
 virt-fw-vars --input   RHEL-9/ovmf/OVMF.inteltdx.fd \
              --output  RHEL-9/ovmf/OVMF.inteltdx.secboot.fd \
              --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
-             --enroll-redhat --secure-boot
-build_iso RHEL-9/ovmf
-cp DBXUpdate-%{DBXDATE}.x64.bin RHEL-9/ovmf
-
-%else
-
-./edk2-build.py --config edk2-build.fedora %{?silent} --release-date "$RELEASE_DATE" -m ovmf
-./edk2-build.py --config edk2-build.fedora.platforms %{?silent} -m x64
-virt-fw-vars --input   Fedora/ovmf/OVMF_VARS.fd \
-             --output  Fedora/ovmf/OVMF_VARS.secboot.fd \
-             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
-             --enroll-redhat --secure-boot
-virt-fw-vars --input   Fedora/ovmf/OVMF_VARS_4M.fd \
-             --output  Fedora/ovmf/OVMF_VARS_4M.secboot.fd \
-             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
-             --enroll-redhat --secure-boot
-virt-fw-vars --input   Fedora/ovmf/OVMF.inteltdx.fd \
-             --output  Fedora/ovmf/OVMF.inteltdx.secboot.fd \
-             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
-             --enroll-redhat --secure-boot
-virt-fw-vars --input   Fedora/ovmf-ia32/OVMF_VARS.fd \
-             --output  Fedora/ovmf-ia32/OVMF_VARS.secboot.fd \
-             --set-dbx DBXUpdate-%{DBXDATE}.ia32.bin \
-             --enroll-redhat --secure-boot
-build_iso Fedora/ovmf
-build_iso Fedora/ovmf-ia32
-cp DBXUpdate-%{DBXDATE}.x64.bin Fedora/ovmf
-cp DBXUpdate-%{DBXDATE}.ia32.bin Fedora/ovmf-ia32
-
-for raw in */{ovmf,experimental}/*_4M*.fd; do
-    qcow2="${raw%.fd}.qcow2"
-    qemu-img convert -f raw -O qcow2 -o cluster_size=4096 -S 4096 "$raw" "$qcow2"
-    rm -f "$raw"
-done
-
-# experimental stateless builds
-virt-fw-vars --input   Fedora/experimental/OVMF.stateless.fd \
-             --output  Fedora/experimental/OVMF.stateless.secboot.fd \
-             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
              --enroll-redhat --secure-boot \
              --set-fallback-no-reboot
-
-for image in \
-	Fedora/ovmf/OVMF_CODE.secboot.fd \
-	Fedora/ovmf/OVMF_CODE_4M.secboot.qcow2 \
-	Fedora/experimental/OVMF.stateless.secboot.fd \
-; do
-	pcr="${image}"
-	pcr="${pcr%.fd}"
-	pcr="${pcr%.qcow2}"
-	pcr="${pcr}.pcr"
-	python3 /usr/share/doc/python3-virt-firmware/experimental/measure.py \
-		--image "$image" \
-		--version "%{name}-%{version}-%{release}" \
-                --no-shim \
-		> "$pcr"
-done
-
-%endif
 %endif
 
 %if %{build_aarch64}
-%if %{defined rhel}
+./edk2-build.py --config edk2-build.rhel-9 -m armvirt --release-date "$RELEASE_DATE"
-./edk2-build.py --config edk2-build.rhel-9 %{?silent} --release-date "$RELEASE_DATE" -m armvirt
-%else
-./edk2-build.py --config edk2-build.fedora %{?silent} --release-date "$RELEASE_DATE" -m armvirt
-./edk2-build.py --config edk2-build.fedora.platforms %{?silent} -m aa64
-virt-fw-vars --input   Fedora/aarch64/vars-template-pflash.raw \
-             --output  Fedora/experimental/vars-template-secboot-testonly-pflash.raw \
-             --enroll-redhat --secure-boot --distro-keys rhel
-%endif
 for raw in */aarch64/*.raw; do
     qcow2="${raw%.raw}.qcow2"
     qemu-img convert -f raw -O qcow2 -o cluster_size=4096 -S 4096 "$raw" "$qcow2"
 done
 %endif
 
-%if %{build_riscv64}
-./edk2-build.py --config edk2-build.fedora %{?silent} --release-date "$RELEASE_DATE" -m riscv
-./edk2-build.py --config edk2-build.fedora.platforms %{?silent} -m riscv
-for raw in */riscv/*.raw; do
-    qcow2="${raw%.raw}.qcow2"
-    qemu-img convert -f raw -O qcow2 -o cluster_size=4096 -S 4096 "$raw" "$qcow2"
-    rm -f "$raw"
-done
-%endif
-
 %install
 
 cp -a OvmfPkg/License.txt License.OvmfPkg.txt
@@ -499,113 +287,50 @@ install BaseTools/Conf/*.template \
 install BaseTools/Scripts/GccBase.lds \
         %{buildroot}%{_datadir}/%{name}/Scripts
 
-# install firmware images
 mkdir -p %{buildroot}%{_datadir}/%{name}
-%if %{defined rhel}
 cp -av RHEL-9/* %{buildroot}%{_datadir}/%{name}
-%else
-cp -av Fedora/* %{buildroot}%{_datadir}/%{name}
-%endif
-
 
 %if %{build_ovmf}
-
-# compat symlinks
 mkdir -p %{buildroot}%{_datadir}/OVMF
-ln -s ../%{name}/ovmf/OVMF_CODE.fd         %{buildroot}%{_datadir}/OVMF/
+
 ln -s ../%{name}/ovmf/OVMF_CODE.secboot.fd %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/OVMF_VARS.fd         %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/OVMF_VARS.secboot.fd %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/UefiShell.iso        %{buildroot}%{_datadir}/OVMF/
 ln -s OVMF_CODE.fd %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
 
-# json description files
-mkdir -p %{buildroot}%{_datadir}/qemu/firmware
 install -m 0644 \
-        30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json \
+        30-edk2-ovmf-x64-sb-enrolled.json \
-        31-edk2-ovmf-2m-raw-x64-sb-enrolled.json \
+        40-edk2-ovmf-x64-sb.json \
-        40-edk2-ovmf-4m-qcow2-x64-sb.json \
+        50-edk2-ovmf-x64-nosb.json \
-        41-edk2-ovmf-2m-raw-x64-sb.json \
-        50-edk2-ovmf-4m-qcow2-x64-nosb.json \
-        51-edk2-ovmf-2m-raw-x64-nosb.json \
         60-edk2-ovmf-x64-amdsev.json \
         60-edk2-ovmf-x64-inteltdx.json \
         %{buildroot}%{_datadir}/qemu/firmware
-%if %{defined fedora}
-install -m 0644 \
-        50-edk2-ovmf-x64-microvm.json \
-        30-edk2-ovmf-ia32-sb-enrolled.json \
-        40-edk2-ovmf-ia32-sb.json \
-        50-edk2-ovmf-ia32-nosb.json \
-        %{buildroot}%{_datadir}/qemu/firmware
-%endif
 
 # endif build_ovmf
 %endif
 
 %if %{build_aarch64}
-
-# compat symlinks
 mkdir -p %{buildroot}%{_datadir}/AAVMF
+
 ln -s ../%{name}/aarch64/QEMU_EFI-pflash.raw \
   %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
 ln -s ../%{name}/aarch64/QEMU_EFI-silent-pflash.raw \
   %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.fd
 ln -s ../%{name}/aarch64/vars-template-pflash.raw \
   %{buildroot}%{_datadir}/AAVMF/AAVMF_VARS.fd
-%if %{defined fedora}
-ln -s ../%{name}/arm/QEMU_EFI-pflash.raw \
-   %{buildroot}%{_datadir}/AAVMF/AAVMF32_CODE.fd
-%endif
 
-# json description files
 install -m 0644 \
         50-edk2-aarch64-qcow2.json \
         51-edk2-aarch64-raw.json \
         52-edk2-aarch64-verbose-qcow2.json \
         53-edk2-aarch64-verbose-raw.json \
         %{buildroot}%{_datadir}/qemu/firmware
-%if %{defined fedora}
-install -m 0644 \
-        50-edk2-arm-verbose.json \
-        %{buildroot}%{_datadir}/qemu/firmware
-%endif
 
 # endif build_aarch64
 %endif
 
-%if %{build_riscv64}
-
-install -m 0644 \
-        50-edk2-riscv-qcow2.json \
-        %{buildroot}%{_datadir}/qemu/firmware
-
-# endif build_riscv64
-%endif
-
-%if %{defined fedora}
-
-# edk2-tools-python install
-cp -R BaseTools/Source/Python %{buildroot}%{_datadir}/%{name}/Python
-for i in build BPDG Ecc GenDepex GenFds GenPatchPcdTable PatchPcdValue TargetTool Trim UPT; do
-echo '#!/bin/sh
-export PYTHONPATH=%{_datadir}/%{name}/Python
-exec python3 '%{_datadir}/%{name}/Python/$i/$i.py' "$@"' > %{buildroot}%{_bindir}/$i
-  chmod +x %{buildroot}%{_bindir}/$i
-done
-
-%if 0%{?py_byte_compile:1}
-# https://docs.fedoraproject.org/en-US/packaging-guidelines/Python_Appendix/#manual-bytecompilation
-%py_byte_compile %{python3} %{buildroot}%{_datadir}/edk2/Python
-%endif
-
-%endif
-
 %check
-for file in %{buildroot}%{_datadir}/%{name}/*/*VARS.secboot.fd; do
-    test -f "$file" || continue
-    virt-fw-vars --input $file --print | grep "SecureBootEnable.*ON" || exit 1
-done
 
 %global common_files \
   %%license License.txt License.OvmfPkg.txt License-History.txt LICENSE.openssl \
@@ -619,11 +344,6 @@ done
 %doc OvmfPkg/README
 %doc ovmf-whitepaper-c770f8c.txt
 %dir %{_datadir}/OVMF/
-%{_datadir}/OVMF/OVMF_CODE.fd
-%{_datadir}/OVMF/OVMF_CODE.secboot.fd
-%{_datadir}/OVMF/OVMF_VARS.fd
-%{_datadir}/OVMF/OVMF_VARS.secboot.fd
-%{_datadir}/OVMF/UefiShell.iso
 %dir %{_datadir}/%{name}/ovmf/
 %{_datadir}/%{name}/ovmf/OVMF_CODE.fd
 %{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
@@ -633,27 +353,19 @@ done
 %{_datadir}/%{name}/ovmf/OVMF.amdsev.fd
 %{_datadir}/%{name}/ovmf/OVMF.inteltdx.fd
 %{_datadir}/%{name}/ovmf/OVMF.inteltdx.secboot.fd
+%{_datadir}/%{name}/ovmf/DBXUpdate*.bin
 %{_datadir}/%{name}/ovmf/UefiShell.iso
+%{_datadir}/OVMF/OVMF_CODE.secboot.fd
+%{_datadir}/OVMF/OVMF_VARS.fd
+%{_datadir}/OVMF/OVMF_VARS.secboot.fd
+%{_datadir}/OVMF/UefiShell.iso
 %{_datadir}/%{name}/ovmf/Shell.efi
 %{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi
-%{_datadir}/%{name}/ovmf/DBXUpdate*.bin
+%{_datadir}/qemu/firmware/30-edk2-ovmf-x64-sb-enrolled.json
-%{_datadir}/qemu/firmware/30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json
+%{_datadir}/qemu/firmware/40-edk2-ovmf-x64-sb.json
-%{_datadir}/qemu/firmware/31-edk2-ovmf-2m-raw-x64-sb-enrolled.json
+%{_datadir}/qemu/firmware/50-edk2-ovmf-x64-nosb.json
-%{_datadir}/qemu/firmware/40-edk2-ovmf-4m-qcow2-x64-sb.json
-%{_datadir}/qemu/firmware/41-edk2-ovmf-2m-raw-x64-sb.json
-%{_datadir}/qemu/firmware/50-edk2-ovmf-4m-qcow2-x64-nosb.json
-%{_datadir}/qemu/firmware/51-edk2-ovmf-2m-raw-x64-nosb.json
 %{_datadir}/qemu/firmware/60-edk2-ovmf-x64-amdsev.json
 %{_datadir}/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
-%if %{defined fedora}
-%{_datadir}/%{name}/ovmf/MICROVM.fd
-%{_datadir}/qemu/firmware/50-edk2-ovmf-x64-microvm.json
-%{_datadir}/%{name}/ovmf/OVMF_CODE_4M.qcow2
-%{_datadir}/%{name}/ovmf/OVMF_CODE_4M.secboot.qcow2
-%{_datadir}/%{name}/ovmf/OVMF_VARS_4M.qcow2
-%{_datadir}/%{name}/ovmf/OVMF_VARS_4M.secboot.qcow2
-%{_datadir}/%{name}/ovmf/*.pcr
-%endif
 # endif build_ovmf
 %endif
 
@@ -661,20 +373,16 @@ done
 %files aarch64
 %common_files
 %dir %{_datadir}/AAVMF/
-%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
-%{_datadir}/AAVMF/AAVMF_CODE.fd
-%{_datadir}/AAVMF/AAVMF_VARS.fd
 %dir %{_datadir}/%{name}/aarch64/
 %{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.*
 %{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.*
 %{_datadir}/%{name}/aarch64/vars-template-pflash.*
+%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
+%{_datadir}/AAVMF/AAVMF_CODE.fd
+%{_datadir}/AAVMF/AAVMF_VARS.fd
 %{_datadir}/%{name}/aarch64/QEMU_EFI.fd
 %{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd
 %{_datadir}/%{name}/aarch64/QEMU_VARS.fd
-%if %{defined fedora}
-%{_datadir}/%{name}/aarch64/BL32_AP_MM.fd
-%{_datadir}/%{name}/aarch64/QEMU_EFI.kernel.fd
-%endif
 %{_datadir}/qemu/firmware/50-edk2-aarch64-qcow2.json
 %{_datadir}/qemu/firmware/51-edk2-aarch64-raw.json
 %{_datadir}/qemu/firmware/52-edk2-aarch64-verbose-qcow2.json
@@ -706,78 +414,8 @@ done
 %doc BaseTools/UserManuals/*.rtf
 
 
-%if %{defined fedora}
-%if %{build_ovmf}
-%files ovmf-ia32
-%common_files
-%dir %{_datadir}/%{name}/ovmf-ia32
-%{_datadir}/%{name}/ovmf-ia32/EnrollDefaultKeys.efi
-%{_datadir}/%{name}/ovmf-ia32/OVMF_CODE.fd
-%{_datadir}/%{name}/ovmf-ia32/OVMF_CODE.secboot.fd
-%{_datadir}/%{name}/ovmf-ia32/OVMF_VARS.fd
-%{_datadir}/%{name}/ovmf-ia32/OVMF_VARS.secboot.fd
-%{_datadir}/%{name}/ovmf-ia32/Shell.efi
-%{_datadir}/%{name}/ovmf-ia32/UefiShell.iso
-%{_datadir}/%{name}/ovmf-ia32/DBXUpdate*.bin
-%{_datadir}/qemu/firmware/30-edk2-ovmf-ia32-sb-enrolled.json
-%{_datadir}/qemu/firmware/40-edk2-ovmf-ia32-sb.json
-%{_datadir}/qemu/firmware/50-edk2-ovmf-ia32-nosb.json
-
-%files experimental
-%common_files
-%doc README.experimental
-%dir %{_datadir}/%{name}/experimental
-%{_datadir}/%{name}/experimental/*.fd
-%{_datadir}/%{name}/experimental/*.raw
-%{_datadir}/%{name}/experimental/*.qcow2
-%{_datadir}/%{name}/experimental/*.pcr
-
-%files ovmf-xen
-%common_files
-%dir %{_datadir}/%{name}/xen
-%{_datadir}/%{name}/xen/*.fd
-%endif
-
-%files arm
-%common_files
-%dir %{_datadir}/AAVMF/
-%{_datadir}/AAVMF/AAVMF32_CODE.fd
-%dir %{_datadir}/%{name}/arm
-%{_datadir}/%{name}/arm/QEMU_EFI-pflash.raw
-%{_datadir}/%{name}/arm/QEMU_EFI.fd
-%{_datadir}/%{name}/arm/QEMU_VARS.fd
-%{_datadir}/%{name}/arm/vars-template-pflash.raw
-%{_datadir}/qemu/firmware/50-edk2-arm-verbose.json
-
-%files riscv64
-%common_files
-%{_datadir}/%{name}/riscv/*.fd
-%{_datadir}/%{name}/riscv/*.qcow2
-%{_datadir}/qemu/firmware/50-edk2-riscv-qcow2.json
-
-%files ext4
-%common_files
-%dir %{_datadir}/%{name}/drivers
-%{_datadir}/%{name}/drivers/ext4*.efi
-
-
-%files tools-python
-%{_bindir}/build
-%{_bindir}/BPDG
-%{_bindir}/Ecc
-%{_bindir}/GenDepex
-%{_bindir}/GenFds
-%{_bindir}/GenPatchPcdTable
-%{_bindir}/PatchPcdValue
-%{_bindir}/TargetTool
-%{_bindir}/Trim
-%{_bindir}/UPT
-%dir %{_datadir}/%{name}
-%{_datadir}/%{name}/Python
-
-# endif fedora
-%endif
-
-
 %changelog
-%autochangelog
+* Tue Apr 02 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20240214-1
+- Imported edk2-202402 from RHEL 9
+- Resolves: RHEL-30180
+

make-tarball.sh

@@ -1,24 +0,0 @@
-#!/bin/sh
-
-# args
-repo="${1%/}"
-ref="${2-HEAD}"
-ab="${3-12}"
-
-# check
-if test ! -d "${repo}/.git"; then
-    echo "usage: $0 <repodir> [ <ref> [ <abbrev> ] ]"
-    exit 1
-fi
-
-# get + print info
-commit=$(cd $repo; git show --abbrev=$ab --pretty='format:%h' $ref | head -1)
-date=$(cd $repo; git show --pretty='format:%cs' $ref | head -1 | tr -d '-')
-echo "# $repo $ref  ->  commit $commit - date $date"
-
-# create tarball
-name="${repo##*/}"
-file="${name}-${commit}.tar.xz"
-(cd $repo; git archive --format=tar --prefix=${name}-${commit}/ ${commit}) \
-    | xz -9ev > "$file"
-echo "# $file written"

sources

@@ -1,5 +1,3 @@
-SHA512 (softfloat-20180726-gitb64af41.tar.xz) = f079debd1bfcc0fe64329a8947b0689ef49246793edcdd28a2879f6550c652b0cf0f53ac4f6f5ab61ac4f7933972e0019d0ab63eb9931b6884c2909f3a5ead30
+SHA512 (DBXUpdate-20230509.x64.bin) = 71fb6e8cd6918126b3acd78b95651913336df372e13fdfdfdd20d5d23f0e509050c6c88c8a2c43f8ac44f987df86bd45174bb3065d5a7a8c7e3b8772fd06d624
-SHA512 (jansson-2.13.1.tar.bz2) = 057f0eda43e4162569888d739f4d78d1d02fce8359400d8f66fdc6e440b0405cb457e1126820dc8ce51e9c4a7f4b7effc640caf1d54307c78c0c47c3fc093011
+SHA512 (edk2-edc6681206.tar.xz) = 6cb8812ae80702125f3b7ac3721eaed805eaa7997f486012fa4b83ac5b6a422ca31f8b34b7cc712750ab5d402d9d6e3f9d9aacf3dc9065833afc3fe555bb9021
-SHA512 (edk2-8736b8fdca85.tar.xz) = 217df116863f247b0316f8af643002abc0716a35c1b0260007127d443a7bd5dfced49c373c9ef483c3490f772d7f04f35817ce8a51592902e489e1ea9a005111
+SHA512 (openssl-rhel-db0287935122edceb91dcda8dfb53b4090734e22.tar.xz) = 7958f06cd36b74215feec13a11c86026568f51650d598e048d94598cdc227ac7d2b97eceb1910f3c19e3525c3199b8b5a438b5098156871f9feb3550f677ca58
-SHA512 (edk2-platforms-10e2eb030de3.tar.xz) = 8b0c3ff4fbfc6ed7622e0f34e379da3251c8d67d821d5f1d0c27a1d8294da848193105f2f94b7636233f91cfc726fbd6fae875e06db2dfd986393deb2e084c7d
-SHA512 (openssl-rhel-db0287935122edceb91dcda8dfb53b4090734e22.tar.xz) = a0f525832d385427b67a31b68b09dcd77d761ff19c9dc07c02278107995ea806370990796632038fe09192f9f661e67393f54567385e0fe96d382833c3abc453