* Tue Apr 02 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20240214-1

- Imported edk2-202402 from RHEL 9 - Resolves: RHEL-30180
2024-04-02 04:22:40 -04:00 · 2024-04-02 04:22:40 -04:00 · 8a2fa30d59
commit 8a2fa30d59
parent 5f8b5dd1fe
65 changed files with 2261 additions and 2445 deletions
--- a/0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch
+++ b/0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch
@ -1,43 +0,0 @@
 From bdb3ed312b939fc5f0c7b9b56c2395dada7c689c Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Thu, 4 Jun 2020 13:34:12 +0200
 Subject: [PATCH 01/14] BaseTools: do not build BrotliCompress (RH only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
 - no change
 Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
 RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
 - New patch.
 BrotliCompress is not used for building ArmVirtPkg or OvmfPkg platforms.
 It depends on one of the upstream Brotli git submodules that we removed
 earlier in this rebase series. (See patch "remove upstream edk2's Brotli
 submodules (RH only").
 Do not attempt to build BrotliCompress.
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit db8ccca337e2c5722c1d408d2541cf653d3371a2)
 ---
 BaseTools/Source/C/GNUmakefile | 1 -
 1 file changed, 1 deletion(-)
 diff --git a/BaseTools/Source/C/GNUmakefile b/BaseTools/Source/C/GNUmakefile
 index 5275f657efe8..39d719975309 100644
 --- a/BaseTools/Source/C/GNUmakefile
 +++ b/BaseTools/Source/C/GNUmakefile
@@ -51,7 +51,6 @@ all: makerootdir subdirs
 LIBRARIES = Common
 VFRAUTOGEN = VfrCompile/VfrLexer.h
 APPLICATIONS = \
 -  BrotliCompress \
   VfrCompile \
   EfiRom \
   GenFfs \
 -- 
 2.41.0
--- a/0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch
+++ b/0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch
@ -1,50 +0,0 @@
 From d42cd3199b6a33ec9811e5cc42a6ef0647d6a597 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Thu, 4 Jun 2020 13:39:08 +0200
 Subject: [PATCH 02/14] MdeModulePkg: remove package-private Brotli include
 path (RH only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
 - no change
 Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
 RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
 - New patch.
 Originating from upstream commit 58802e02c41b
 ("MdeModulePkg/BrotliCustomDecompressLib: Make brotli a submodule",
 2020-04-16), "MdeModulePkg/MdeModulePkg.dec" contains a package-internal
 include path into a Brotli submodule.
 The edk2 build system requires such include paths to resolve successfully,
 regardless of the firmware platform being built. Because
 BrotliCustomDecompressLib is not consumed by any OvmfPkg or ArmVirtPkg
 platforms, and we've removed the submodule earlier in this patch set,
 remove the include path too.
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit e05e0de713c4a2b8adb6ff9809611f222bfe50ed)
 ---
 MdeModulePkg/MdeModulePkg.dec | 3 ---
 1 file changed, 3 deletions(-)
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
 index 0ff058b0a9da..2f8e49f87bcc 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
@@ -26,9 +26,6 @@ [Includes]
   Include
   Test/Mock/Include
 -[Includes.Common.Private]
 -  Library/BrotliCustomDecompressLib/brotli/c/include
 -
 [LibraryClasses]
   ##  @libraryclass  Defines a set of methods to reset whole system.
   ResetSystemLib|Include/Library/ResetSystemLib.h
 -- 
 2.41.0
--- a/0003-Remove-paths-leading-to-submodules.patch
+++ b/0003-Remove-paths-leading-to-submodules.patch
@ -0,0 +1,65 @@
 From 3ab8a3e323e1bafb82266c0728e60a42d173764f Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Thu, 24 Mar 2022 03:23:02 -0400
 Subject: [PATCH] Remove paths leading to submodules
 We removed submodules used upstream. However, edk2 build system requires
 such include paths to resolve successfully, regardless of the firmware
 platform being built.
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 BaseTools/Source/C/GNUmakefile | 1 -
 MdeModulePkg/MdeModulePkg.dec  | 3 ---
 MdePkg/MdePkg.dec              | 5 -----
 3 files changed, 9 deletions(-)
 diff --git a/BaseTools/Source/C/GNUmakefile b/BaseTools/Source/C/GNUmakefile
 index 5275f657ef..39d7199753 100644
 --- a/BaseTools/Source/C/GNUmakefile
 +++ b/BaseTools/Source/C/GNUmakefile
@@ -51,7 +51,6 @@ all: makerootdir subdirs
 LIBRARIES = Common
 VFRAUTOGEN = VfrCompile/VfrLexer.h
 APPLICATIONS = \
 -  BrotliCompress \
   VfrCompile \
   EfiRom \
   GenFfs \
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
 index a2cd83345f..98b3acb703 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
@@ -26,9 +26,6 @@
   Include
   Test/Mock/Include
 -[Includes.Common.Private]
 -  Library/BrotliCustomDecompressLib/brotli/c/include
 -
 [LibraryClasses]
   ##  @libraryclass  Defines a set of methods to reset whole system.
   ResetSystemLib|Include/Library/ResetSystemLib.h
 diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
 index 0459418906..bb347547f8 100644
 --- a/MdePkg/MdePkg.dec
 +++ b/MdePkg/MdePkg.dec
@@ -29,7 +29,6 @@
   Include
   Test/UnitTest/Include
   Test/Mock/Include
 -  Library/MipiSysTLib/mipisyst/library/include
 [Includes.IA32]
   Include/Ia32
@@ -295,10 +294,6 @@
   #
   FdtLib|Include/Library/FdtLib.h
 -  ##  @libraryclass  Provides general mipi sys-T services.
 -  #
 -  MipiSysTLib|Include/Library/MipiSysTLib.h
 -
   ##  @libraryclass  Provides API to output Trace Hub debug message.
   #
   TraceHubDebugSysTLib|Include/Library/TraceHubDebugSysTLib.h
--- a/0004-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
+++ b/0004-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
@ -1,9 +1,21 @@
-From e88e9ee342a168114a27c0fa09e807161bf54490 Mon Sep 17 00:00:00 2001
+From 1a8cccb3be265d0c423bbb42511b1d9111b076e0 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Tue, 25 Feb 2014 22:40:01 +0100
-Subject: [PATCH 03/14] MdeModulePkg: TerminalDxe: set xterm resolution on mode
+Subject: [PATCH] MdeModulePkg: TerminalDxe: set xterm resolution on mode
 change (RH only)
 Notes for rebase to edk2-stable202311:
 - Minor context changes due to new PCDs (for USB Networking) being added.
 Notes for rebase to edk2-stable202205:
 - Minor context changes due to fd306d1dbc MdeModulePkg: Add PcdTdxSharedBitMask
 Notes for rebase to edk2-stable202202:
 - Minor context changes due to 1436aea4d MdeModulePkg: Apply uncrustify changes
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -82,15 +94,15 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit bc2266f20de5db1636e09a07e4a72c8dbf505f5a)
 ---
 MdeModulePkg/MdeModulePkg.dec                 |  4 +++
 .../Console/TerminalDxe/TerminalConOut.c      | 30 +++++++++++++++++++
 .../Console/TerminalDxe/TerminalDxe.inf       |  2 ++
- .../Console/TerminalDxe/TerminalConOut.c      | 29 +++++++++++++++++++
+ 3 files changed, 36 insertions(+)
 3 files changed, 35 insertions(+)
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 2f8e49f87bcc..c1b10b38ef1d 100644
+index 98b3acb703..71a2967646 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
-@@ -2148,6 +2148,10 @@ [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
+@@ -2164,6 +2164,10 @@
   # @Prompt The value is use for Usb Network rate limiting supported.
   gEfiMdeModulePkgTokenSpaceGuid.PcdUsbNetworkRateLimitingFactor|100|UINT32|0x10000028
@ -101,28 +113,8 @@ index 2f8e49f87bcc..c1b10b38ef1d 100644
 [PcdsPatchableInModule]
   ## Specify memory size with page number for PEI code when
   #  Loading Module at Fixed Address feature is enabled.
 diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
 index b2a8aeba8510..eff625346539 100644
 --- a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
 +++ b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
@@ -55,6 +55,7 @@ [LibraryClasses]
   DebugLib
   PcdLib
   BaseLib
 +  PrintLib
 [Guids]
   ## SOMETIMES_PRODUCES ## Variable:L"ConInDev"
@@ -87,6 +88,7 @@ [Protocols]
 [Pcd]
   gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType           ## SOMETIMES_CONSUMES
   gEfiMdeModulePkgTokenSpaceGuid.PcdErrorCodeSetVariable    ## CONSUMES
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm             ## CONSUMES
 # [Event]
 # # Relative timer event set by UnicodeToEfiKey(), used to be one 2 seconds input timeout.
 diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
-index 7809869e7d49..496849458db4 100644
+index 7809869e7d..3be801039b 100644
 --- a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
 +++ b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalConOut.c
@@ -7,6 +7,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
@ -134,7 +126,7 @@ index 7809869e7d49..496849458db4 100644
 #include "Terminal.h"
 //
-@@ -80,6 +82,15 @@ CHAR16  mSetCursorPositionString[] = { ESC, '[', '0', '0', ';', '0', '0', 'H', 0
+@@ -80,6 +82,16 @@ CHAR16  mSetCursorPositionString[] = { ESC, '[', '0', '0', ';', '0', '0', 'H', 0
 CHAR16  mCursorForwardString[]     = { ESC, '[', '0', '0', 'C', 0 };
 CHAR16  mCursorBackwardString[]    = { ESC, '[', '0', '0', 'D', 0 };
@ -146,11 +138,12 @@ index 7809869e7d49..496849458db4 100644
 +//
 +CHAR8 mResizeTextAreaFormatString[] = "\x1B[8;%d;%dt";
 +#define RESIZE_SEQ_SIZE (sizeof mResizeTextAreaFormatString + 2 * (11 - 2))
 +
 +
 //
 // Body of the ConOut functions
 //
-@@ -498,6 +509,24 @@ TerminalConOutSetMode (
+@@ -498,6 +510,24 @@ TerminalConOutSetMode (
     return EFI_DEVICE_ERROR;
   }
@ -161,8 +154,8 @@ index 7809869e7d49..496849458db4 100644
 +      ResizeSequence,
 +      sizeof ResizeSequence,
 +      mResizeTextAreaFormatString,
-+      (INT32)TerminalDevice->TerminalConsoleModeData[ModeNumber].Rows,
+      (INT32) TerminalDevice->TerminalConsoleModeData[ModeNumber].Rows,
-+      (INT32)TerminalDevice->TerminalConsoleModeData[ModeNumber].Columns
+      (INT32) TerminalDevice->TerminalConsoleModeData[ModeNumber].Columns
 +      );
 +    TerminalDevice->OutputEscChar = TRUE;
 +    Status                        = This->OutputString (This, ResizeSequence);
@ -175,6 +168,23 @@ index 7809869e7d49..496849458db4 100644
   This->Mode->Mode = (INT32)ModeNumber;
   Status = This->ClearScreen (This);
-- 
+diff --git a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
-2.41.0
+index b2a8aeba85..96810f337c 100644
 --- a/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
 +++ b/MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
@@ -55,6 +55,7 @@
   DebugLib
   PcdLib
   BaseLib
 +  PrintLib
 [Guids]
   ## SOMETIMES_PRODUCES ## Variable:L"ConInDev"
@@ -87,6 +88,7 @@
 [Pcd]
   gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType           ## SOMETIMES_CONSUMES
   gEfiMdeModulePkgTokenSpaceGuid.PcdErrorCodeSetVariable    ## CONSUMES
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm             ## CONSUMES
 # [Event]
 # # Relative timer event set by UnicodeToEfiKey(), used to be one 2 seconds input timeout.
--- a/0005-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
+++ b/0005-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
@ -1,17 +1,12 @@
-From 20ba2d80413888bfcb1f5e5ba914b5c67fc4ced2 Mon Sep 17 00:00:00 2001
+From cf04a1c13e796013f0cb06447127cf5cf35eb0a0 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 14 Oct 2015 15:59:06 +0200
-Subject: [PATCH 04/14] OvmfPkg: take PcdResizeXterm from the QEMU command line
+Subject: [PATCH] OvmfPkg: take PcdResizeXterm from the QEMU command line (RH
- (RH only)
+ only)
-edk2-stable202205 rebase
+Notes about edk2-stable202205 rebase
- re-add UPDATE_BOOLEAN_PCD_FROM_FW_CFG
+- Necessary minor fixes for upstream changes
 - add microvm, cloudhw and inteltdx
 edk2-stable202108 rebase
 - resolve conflict in OvmfPkg/PlatformPei/PlatformPei.inf
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -79,19 +74,19 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 OvmfPkg/AmdSev/AmdSevX64.dsc        |  1 +
 OvmfPkg/CloudHv/CloudHvX64.dsc      |  1 +
 OvmfPkg/IntelTdx/IntelTdxX64.dsc    |  1 +
- OvmfPkg/Microvm/MicrovmX64.dsc      |  1 +
+ OvmfPkg/Microvm/MicrovmX64.dsc      |  2 +-
 OvmfPkg/OvmfPkgIa32.dsc             |  1 +
 OvmfPkg/OvmfPkgIa32X64.dsc          |  1 +
 OvmfPkg/OvmfPkgX64.dsc              |  1 +
 OvmfPkg/PlatformPei/PlatformPei.inf |  1 +
 OvmfPkg/PlatformPei/Platform.c      | 13 +++++++++++++
- 9 files changed, 21 insertions(+)
+ OvmfPkg/PlatformPei/PlatformPei.inf |  1 +
 9 files changed, 21 insertions(+), 1 deletion(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 2c6ed7c9745f..cf81a86c67dd 100644
+index a31a89344a..d6bfc43fe5 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -477,6 +477,7 @@ [PcdsFixedAtBuild]
+@@ -484,6 +484,7 @@
 [PcdsDynamicDefault]
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -100,10 +95,10 @@ index 2c6ed7c9745f..cf81a86c67dd 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc
-index e000deed9e4d..7a167bd4d039 100644
+index b522fa1059..c5fd84027f 100644
 --- a/OvmfPkg/CloudHv/CloudHvX64.dsc
 +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc
-@@ -576,6 +576,7 @@ [PcdsDynamicDefault]
+@@ -579,6 +579,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -112,10 +107,10 @@ index e000deed9e4d..7a167bd4d039 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-index 193657ff2d61..bfcd486976cf 100644
+index 82e3e41cfc..6d72b80dc9 100644
 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
 +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-@@ -474,6 +474,7 @@ [PcdsDynamicDefault]
+@@ -477,6 +477,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -124,22 +119,23 @@ index 193657ff2d61..bfcd486976cf 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
-index 2f7585639374..023b7b0fe959 100644
+index 063324cd05..53222d80be 100644
 --- a/OvmfPkg/Microvm/MicrovmX64.dsc
 +++ b/OvmfPkg/Microvm/MicrovmX64.dsc
-@@ -577,6 +577,7 @@ [PcdsDynamicDefault]
+@@ -582,7 +582,7 @@
   # only set when
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
- 
+-
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 80d8e370095d..2395bcf6b8dc 100644
+index 28379961a7..4f6dfedc2c 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -604,6 +604,7 @@ [PcdsDynamicDefault]
+@@ -599,6 +599,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -148,10 +144,10 @@ index 80d8e370095d..2395bcf6b8dc 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index d9757149e359..9bf5ac0d143c 100644
+index 5e9eee628a..923e187942 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -616,6 +616,7 @@ [PcdsDynamicDefault]
+@@ -611,6 +611,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -160,10 +156,10 @@ index d9757149e359..9bf5ac0d143c 100644
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index b12d874daa0a..69deaf8e08ec 100644
+index bf4c7906c4..06b38b1715 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -634,6 +634,7 @@ [PcdsDynamicDefault]
+@@ -629,6 +629,7 @@
   #   ($(SMM_REQUIRE) == FALSE)
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@ -171,20 +167,8 @@ index b12d874daa0a..69deaf8e08ec 100644
 !if $(SMM_REQUIRE) == FALSE
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf
 index 3934aeed9514..98123ec63b3d 100644
 --- a/OvmfPkg/PlatformPei/PlatformPei.inf
 +++ b/OvmfPkg/PlatformPei/PlatformPei.inf
@@ -100,6 +100,7 @@ [Pcd]
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm
   gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode
   gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
   gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
 diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
-index f5dc41c3a8c4..ce9868d57de1 100644
+index f5dc41c3a8..f244dcd24d 100644
 --- a/OvmfPkg/PlatformPei/Platform.c
 +++ b/OvmfPkg/PlatformPei/Platform.c
@@ -41,6 +41,18 @@
@ -214,6 +198,15 @@ index f5dc41c3a8c4..ce9868d57de1 100644
   }
   InstallClearCacheCallback ();
-- 
+diff --git a/OvmfPkg/PlatformPei/PlatformPei.inf b/OvmfPkg/PlatformPei/PlatformPei.inf
-2.41.0
+index ad52be3065..d7d688284b 100644
-
+--- a/OvmfPkg/PlatformPei/PlatformPei.inf
 +++ b/OvmfPkg/PlatformPei/PlatformPei.inf
@@ -100,6 +100,7 @@
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize
   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm
   gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode
   gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
   gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
--- a/0006-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
+++ b/0006-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
@ -1,8 +1,8 @@
-From 5b56419459e64d33cd92b4b98ef954bca8f9f344 Mon Sep 17 00:00:00 2001
+From 65e47dac7f0c2cc4d5fa2513f4a217a060c9da3c Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Sun, 26 Jul 2015 08:02:50 +0000
-Subject: [PATCH 05/14] ArmVirtPkg: take PcdResizeXterm from the QEMU command
+Subject: [PATCH] ArmVirtPkg: take PcdResizeXterm from the QEMU command line
- line (RH only)
+ (RH only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -89,17 +89,17 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit a5f7a57bf390f1f340ff1d1f1884a73716817ef1)
 ---
 ArmVirtPkg/ArmVirtQemu.dsc                    |  7 +++-
 .../TerminalPcdProducerLib.inf                | 33 ++++++++++++++++++
 .../TerminalPcdProducerLib.c                  | 34 +++++++++++++++++++
 .../TerminalPcdProducerLib.inf                | 33 ++++++++++++++++++
 3 files changed, 73 insertions(+), 1 deletion(-)
 create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
 create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
 create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 1e0225951aef..9f52eb44a1fd 100644
+index e48c75b5e9..181265057e 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -308,6 +308,8 @@ [PcdsPatchableInModule]
+@@ -309,6 +309,8 @@
   gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0x0
 !endif
@ -108,7 +108,7 @@ index 1e0225951aef..9f52eb44a1fd 100644
 [PcdsDynamicHii]
   gUefiOvmfPkgTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gOvmfVariableGuid|0x0|FALSE|NV,BS
-@@ -417,7 +419,10 @@ [Components.common]
+@@ -418,7 +420,10 @@
   MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
   MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitterDxe.inf
   MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
@ -120,48 +120,9 @@ index 1e0225951aef..9f52eb44a1fd 100644
   MdeModulePkg/Universal/SerialDxe/SerialDxe.inf
   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
 diff --git a/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
 new file mode 100644
 index 000000000000..a51dbd1670a8
 --- /dev/null
 +++ b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
@@ -0,0 +1,33 @@
 +## @file
 +#  Plugin library for setting up dynamic PCDs for TerminalDxe, from fw_cfg
 +#
 +#  Copyright (C) 2015-2020, Red Hat, Inc.
 +#  Copyright (c) 2014, Linaro Ltd. All rights reserved.<BR>
 +#
 +#  SPDX-License-Identifier: BSD-2-Clause-Patent
 +##
 +
 +[Defines]
 +  INF_VERSION                    = 0x00010005
 +  BASE_NAME                      = TerminalPcdProducerLib
 +  FILE_GUID                      = 4a0c5ed7-8c42-4c01-8f4c-7bf258316a96
 +  MODULE_TYPE                    = BASE
 +  VERSION_STRING                 = 1.0
 +  LIBRARY_CLASS                  = NULL
 +  CONSTRUCTOR                    = TerminalPcdProducerLibConstructor
 +
 +[Sources]
 +  TerminalPcdProducerLib.c
 +
 +[Packages]
 +  MdeModulePkg/MdeModulePkg.dec
 +  MdePkg/MdePkg.dec
 +  OvmfPkg/OvmfPkg.dec
 +
 +[LibraryClasses]
 +  DebugLib
 +  PcdLib
 +  QemuFwCfgSimpleParserLib
 +
 +[Pcd]
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm ## SOMETIMES_PRODUCES
 diff --git a/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
 new file mode 100644
-index 000000000000..bfd3a6a535f9
+index 0000000000..37f71c5e4c
 --- /dev/null
 +++ b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.c
@@ -0,0 +1,34 @@
@ -199,6 +160,42 @@ index 000000000000..bfd3a6a535f9
 +  UPDATE_BOOLEAN_PCD_FROM_FW_CFG (PcdResizeXterm);
 +  return RETURN_SUCCESS;
 +}
-- 
+diff --git a/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
-2.41.0
+new file mode 100644
-
+index 0000000000..c840f6f97a
 --- /dev/null
 +++ b/ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
@@ -0,0 +1,33 @@
 +## @file
 +#  Plugin library for setting up dynamic PCDs for TerminalDxe, from fw_cfg
 +#
 +#  Copyright (C) 2015-2020, Red Hat, Inc.
 +#  Copyright (c) 2014, Linaro Ltd. All rights reserved.<BR>
 +#
 +#  SPDX-License-Identifier: BSD-2-Clause-Patent
 +##
 +
 +[Defines]
 +  INF_VERSION                    = 0x00010005
 +  BASE_NAME                      = TerminalPcdProducerLib
 +  FILE_GUID                      = 4a0c5ed7-8c42-4c01-8f4c-7bf258316a96
 +  MODULE_TYPE                    = BASE
 +  VERSION_STRING                 = 1.0
 +  LIBRARY_CLASS                  = NULL
 +  CONSTRUCTOR                    = TerminalPcdProducerLibConstructor
 +
 +[Sources]
 +  TerminalPcdProducerLib.c
 +
 +[Packages]
 +  MdeModulePkg/MdeModulePkg.dec
 +  MdePkg/MdePkg.dec
 +  OvmfPkg/OvmfPkg.dec
 +
 +[LibraryClasses]
 +  DebugLib
 +  PcdLib
 +  QemuFwCfgSimpleParserLib
 +
 +[Pcd]
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm ## SOMETIMES_PRODUCES
--- a/0007-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+++ b/0007-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
@ -1,7 +1,7 @@
-From 6f1c7583bce90e89193ae40042923f16c6e16ca7 Mon Sep 17 00:00:00 2001
+From cf51a0c4a259a505f58c1cf626864f41cf3f27ef Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:45 +0100
-Subject: [PATCH 06/14] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
+Subject: [PATCH] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -65,10 +65,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 4 files changed, 4 insertions(+), 4 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index cf81a86c67dd..d8b1c4d9e8af 100644
+index d6bfc43fe5..2b4c551773 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -427,7 +427,7 @@ [PcdsFixedAtBuild]
+@@ -429,7 +429,7 @@
   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
@ -78,10 +78,10 @@ index cf81a86c67dd..d8b1c4d9e8af 100644
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 2395bcf6b8dc..21118b11f6b3 100644
+index 4f6dfedc2c..ae3b446ff2 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -537,7 +537,7 @@ [PcdsFixedAtBuild]
+@@ -535,7 +535,7 @@
   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
@ -91,10 +91,10 @@ index 2395bcf6b8dc..21118b11f6b3 100644
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 9bf5ac0d143c..afb1afcceb61 100644
+index 923e187942..4a547f28c0 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -544,7 +544,7 @@ [PcdsFixedAtBuild]
+@@ -542,7 +542,7 @@
   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
@ -104,10 +104,10 @@ index 9bf5ac0d143c..afb1afcceb61 100644
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 69deaf8e08ec..45e0658e2b4a 100644
+index 06b38b1715..68bd1f6dcb 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -563,7 +563,7 @@ [PcdsFixedAtBuild]
+@@ -561,7 +561,7 @@
   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
   #                             // significantly impact boot performance
   # DEBUG_ERROR     0x80000000  // Error
@ -116,6 +116,3 @@ index 69deaf8e08ec..45e0658e2b4a 100644
 !if $(SOURCE_DEBUG_ENABLE) == TRUE
   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 -- 
 2.41.0
--- a/0008-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+++ b/0008-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
@ -1,9 +1,13 @@
-From eaf1ac5c40d16705219e5021d4878e52904467ba Mon Sep 17 00:00:00 2001
+From 3ece2f792aec743c42c415809846ea1ac1f0aedf Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:46 +0100
-Subject: [PATCH 07/14] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
+Subject: [PATCH] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
 QemuVideoDxe/QemuRamfbDxe (RH)
 edk2-stable202402 rebase:
 - context changes due to CSM support removal.
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -82,12 +86,12 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 4 files changed, 32 insertions(+), 8 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index d8b1c4d9e8af..b3b70b600139 100644
+index 2b4c551773..f81a0ac375 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -685,8 +685,14 @@ [Components]
+@@ -691,8 +691,14 @@
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
@ -103,20 +107,19 @@ index d8b1c4d9e8af..b3b70b600139 100644
   #
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 21118b11f6b3..8686da30008f 100644
+index ae3b446ff2..7e07fbfd46 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -850,9 +850,15 @@ [Components]
+@@ -828,8 +828,14 @@
-   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 !ifndef $(CSM_ENABLE)
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
 !endif
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
@ -125,20 +128,19 @@ index 21118b11f6b3..8686da30008f 100644
   #
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index afb1afcceb61..4b9c0b312532 100644
+index 4a547f28c0..f28c71a7a8 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -868,9 +868,15 @@ [Components.X64]
+@@ -842,8 +842,14 @@
-   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 !ifndef $(CSM_ENABLE)
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
 !endif
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
@ -147,20 +149,19 @@ index afb1afcceb61..4b9c0b312532 100644
   #
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 45e0658e2b4a..9b83e51ba3c1 100644
+index 68bd1f6dcb..680bdb5f4c 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -936,9 +936,15 @@ [Components]
+@@ -910,8 +910,14 @@
-   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 !ifndef $(CSM_ENABLE)
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
 !endif
 -  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
@ -168,6 +169,3 @@ index 45e0658e2b4a..9b83e51ba3c1 100644
   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
   #
 -- 
 2.41.0
--- a/0009-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+++ b/0009-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
@ -1,7 +1,7 @@
-From 298ab8d033dac6298239b70a6494eb2de472e54f Mon Sep 17 00:00:00 2001
+From 33b60bfb25647368c761ae9d875c481086e147ce Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 27 Jan 2016 03:05:18 +0100
-Subject: [PATCH 08/14] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
+Subject: [PATCH] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
 QemuRamfbDxe (RH only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@ -61,10 +61,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 2 files changed, 8 insertions(+), 2 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 9f52eb44a1fd..8b44fadeeb39 100644
+index 181265057e..216b5a09cc 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -546,7 +546,10 @@ [Components.common]
+@@ -547,7 +547,10 @@
   #
   # Video support
   #
@ -77,10 +77,10 @@ index 9f52eb44a1fd..8b44fadeeb39 100644
   OvmfPkg/PlatformDxe/Platform.inf
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 8ef5927b53ff..2503cdb79c27 100644
+index 668a65ba64..5f07ed4dcc 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -446,7 +446,10 @@ [Components.common]
+@@ -447,7 +447,10 @@
   #
   # Video support
   #
@ -92,6 +92,3 @@ index 8ef5927b53ff..2503cdb79c27 100644
   OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
   OvmfPkg/PlatformDxe/Platform.inf
 -- 
 2.41.0
--- a/0010-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+++ b/0010-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
@ -1,8 +1,8 @@
-From ad5e6471ec1d395c6395d0e9775a88e239570884 Mon Sep 17 00:00:00 2001
+From d4be04b114213cc9b8ee4ce86a91a1c7e2c3928a Mon Sep 17 00:00:00 2001
 From: Philippe Mathieu-Daude <philmd@redhat.com>
 Date: Thu, 1 Aug 2019 20:43:48 +0200
-Subject: [PATCH 09/14] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on
+Subject: [PATCH] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on Aarch64
- Aarch64 silent builds (RH only)
+ silent builds (RH only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -42,24 +42,12 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit aa2b66b18a62d652bdbefae7b5732297294306ca)
 (cherry picked from commit deb3451034326b75fd760aba47a5171493ff055e)
 ---
 OvmfPkg/QemuRamfbDxe/QemuRamfb.c      | 14 ++++++++++++++
 OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf |  1 +
- OvmfPkg/QemuRamfbDxe/QemuRamfb.c      | 15 +++++++++++++++
+ 2 files changed, 15 insertions(+)
 2 files changed, 16 insertions(+)
 diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 index e3890b8c202f..6ffee5acb24c 100644
 --- a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +++ b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
@@ -29,6 +29,7 @@ [LibraryClasses]
   BaseLib
   BaseMemoryLib
   DebugLib
 +  DebugPrintErrorLevelLib
   DevicePathLib
   FrameBufferBltLib
   MemoryAllocationLib
 diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
-index 5a1044f0dc7b..3a687901b0d2 100644
+index 5a1044f0dc..83c6d26c74 100644
 --- a/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
 +++ b/OvmfPkg/QemuRamfbDxe/QemuRamfb.c
@@ -13,6 +13,7 @@
@ -70,11 +58,11 @@ index 5a1044f0dc7b..3a687901b0d2 100644
 #include <Library/DevicePathLib.h>
 #include <Library/FrameBufferBltLib.h>
 #include <Library/MemoryAllocationLib.h>
-@@ -259,6 +260,20 @@ InitializeQemuRamfb (
+@@ -259,6 +260,19 @@ InitializeQemuRamfb (
   Status = QemuFwCfgFindFile ("etc/ramfb", &mRamfbFwCfgItem, &FwCfgSize);
   if (EFI_ERROR (Status)) {
-+ #if defined (MDE_CPU_AARCH64)
+#if defined (MDE_CPU_AARCH64)
 +    //
 +    // RHBZ#1714446
 +    // If no ramfb device was configured, this platform DXE driver should
@ -86,11 +74,19 @@ index 5a1044f0dc7b..3a687901b0d2 100644
 +    if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
 +      return EFI_SUCCESS;
 +    }
-+
+#endif
 + #endif
     return EFI_NOT_FOUND;
   }
-- 
+diff --git a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
-2.41.0
+index e3890b8c20..f79a4bc987 100644
-
+--- a/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +++ b/OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
@@ -29,6 +29,7 @@
   BaseLib
   BaseMemoryLib
   DebugLib
 +  DebugPrintErrorLevelLib
   DevicePathLib
   FrameBufferBltLib
   MemoryAllocationLib
--- a/0011-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+++ b/0011-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
@ -1,8 +1,8 @@
-From a5c8a37b20394f8b2595c0e520955667b4c17527 Mon Sep 17 00:00:00 2001
+From e76b481430fc3ef2398cdbe4d21ce002050aa12b Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:47 +0100
-Subject: [PATCH 10/14] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in
+Subject: [PATCH] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in NvmExpressDxe
- NvmExpressDxe (RH only)
+ (RH only)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -63,10 +63,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 4 files changed, 16 insertions(+), 4 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index b3b70b600139..865d150a2871 100644
+index f81a0ac375..bdb786d10d 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -679,7 +679,10 @@ [Components]
+@@ -686,7 +686,10 @@
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@ -79,10 +79,10 @@ index b3b70b600139..865d150a2871 100644
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 8686da30008f..9cd981ae7be8 100644
+index 7e07fbfd46..8a8c7a0b37 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -843,7 +843,10 @@ [Components]
+@@ -823,7 +823,10 @@
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@ -95,10 +95,10 @@ index 8686da30008f..9cd981ae7be8 100644
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 4b9c0b312532..9186ab2ba83b 100644
+index f28c71a7a8..4bde14a05a 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -861,7 +861,10 @@ [Components.X64]
+@@ -837,7 +837,10 @@
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@ -111,10 +111,10 @@ index 4b9c0b312532..9186ab2ba83b 100644
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 9b83e51ba3c1..a059f143f5be 100644
+index 680bdb5f4c..a43352ede4 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -929,7 +929,10 @@ [Components]
+@@ -905,7 +905,10 @@
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
@ -126,6 +126,3 @@ index 9b83e51ba3c1..a059f143f5be 100644
   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 -- 
 2.41.0
--- a/0012-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
+++ b/0012-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
@ -1,8 +1,8 @@
-From 8cc002364f8c51114a39782737088331a7c6c5c3 Mon Sep 17 00:00:00 2001
+From 47ad6974185793994d69620d989f6d695f513c9c Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:31:36 +0200
-Subject: [PATCH 11/14] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no
+Subject: [PATCH] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no "-kernel"
- "-kernel" in silent aa64 build (RH)
+ in silent aa64 build (RH)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -27,24 +27,12 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 (cherry picked from commit 9adcdf493ebbd11efb74e2905ab5f6c8996e096d)
 ---
 .../QemuKernelLoaderFsDxe.c                     | 17 +++++++++++++++++
 .../QemuKernelLoaderFsDxe.inf                   |  1 +
- .../QemuKernelLoaderFsDxe.c                    | 18 ++++++++++++++++++
+ 2 files changed, 18 insertions(+)
 2 files changed, 19 insertions(+)
 diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
 index 7b35adb8e034..e0331c6e2cbc 100644
 --- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
 +++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
@@ -28,6 +28,7 @@ [LibraryClasses]
   BaseLib
   BaseMemoryLib
   DebugLib
 +  DebugPrintErrorLevelLib
   DevicePathLib
   MemoryAllocationLib
   QemuFwCfgLib
 diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
-index 3c12085f6c1e..e473c0b57345 100644
+index 3c12085f6c..e192809198 100644
 --- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
 +++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
@@ -19,6 +19,7 @@
@ -55,11 +43,11 @@ index 3c12085f6c1e..e473c0b57345 100644
 #include <Library/DevicePathLib.h>
 #include <Library/MemoryAllocationLib.h>
 #include <Library/QemuFwCfgLib.h>
-@@ -1081,6 +1082,23 @@ QemuKernelLoaderFsDxeEntrypoint (
+@@ -1081,6 +1082,22 @@ QemuKernelLoaderFsDxeEntrypoint (
   if (KernelBlob->Data == NULL) {
     Status = EFI_NOT_FOUND;
-+ #if defined (MDE_CPU_AARCH64)
+#if defined (MDE_CPU_AARCH64)
 +    //
 +    // RHBZ#1844682
 +    //
@ -74,11 +62,19 @@ index 3c12085f6c1e..e473c0b57345 100644
 +    if (GetDebugPrintErrorLevel () == DEBUG_ERROR) {
 +      Status = EFI_SUCCESS;
 +    }
-+
+#endif
 + #endif
     goto FreeBlobs;
   }
-- 
+diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
-2.41.0
+index 7b35adb8e0..23d9f5fca1 100644
-
+--- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
 +++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf
@@ -28,6 +28,7 @@
   BaseLib
   BaseMemoryLib
   DebugLib
 +  DebugPrintErrorLevelLib
   DevicePathLib
   MemoryAllocationLib
   QemuFwCfgLib
--- a/0013-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
+++ b/0013-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
@ -1,8 +1,8 @@
-From 14b635b6d18976cc9661001ce0a5fa3d5eec786f Mon Sep 17 00:00:00 2001
+From 26a8f215a1cee1b876105127ad22c68a7c07c6a8 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:40:09 +0200
-Subject: [PATCH 12/14] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in
+Subject: [PATCH] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in silent
- silent aa64 build (RH)
+ aa64 build (RH)
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@ -26,24 +26,12 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 (cherry picked from commit cbce29f7749477e271f9764fed82de94724af5df)
 ---
 SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf |  1 +
 SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c   | 17 +++++++++++++++++
 SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf |  1 +
 2 files changed, 18 insertions(+)
 diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
 index 7dc7a2683d71..3bc88339311e 100644
 --- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
 +++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
@@ -55,6 +55,7 @@ [LibraryClasses]
   UefiRuntimeServicesTableLib
   BaseMemoryLib
   DebugLib
 +  DebugPrintErrorLevelLib
   Tpm2CommandLib
   PrintLib
   UefiLib
 diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
-index f6ea8b2bbf18..681eb7e08b98 100644
+index f6ea8b2bbf..1fd5e187fb 100644
 --- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
 +++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c
@@ -28,6 +28,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
@ -77,6 +65,15 @@ index f6ea8b2bbf18..681eb7e08b98 100644
     return EFI_UNSUPPORTED;
   }
-- 
+diff --git a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
-2.41.0
+index 7dc7a2683d..ae90070b36 100644
-
+--- a/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
 +++ b/SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
@@ -55,6 +55,7 @@
   UefiRuntimeServicesTableLib
   BaseMemoryLib
   DebugLib
 +  DebugPrintErrorLevelLib
   Tpm2CommandLib
   PrintLib
   UefiLib
--- a/0014-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
+++ b/0014-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
@ -0,0 +1,126 @@
 From 14feac56ff842b1a9940f370ebc624846841faec Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:28:49 +0200
 Subject: [PATCH] OvmfPkg: Remove EbcDxe (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [2/19] 6777c3dc453e4aecddc20216f783ba2a5acccaa0
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 Remove EFI Byte Code interpreter.
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 OvmfPkg/AmdSev/AmdSevX64.dsc | 1 -
 OvmfPkg/AmdSev/AmdSevX64.fdf | 1 -
 OvmfPkg/OvmfPkgIa32.dsc      | 1 -
 OvmfPkg/OvmfPkgIa32.fdf      | 1 -
 OvmfPkg/OvmfPkgIa32X64.dsc   | 1 -
 OvmfPkg/OvmfPkgIa32X64.fdf   | 1 -
 OvmfPkg/OvmfPkgX64.dsc       | 1 -
 OvmfPkg/OvmfPkgX64.fdf       | 1 -
 8 files changed, 8 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
 index bdb786d10d..e565430e6c 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
@@ -611,7 +611,6 @@
 !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
   }
 -  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
   UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
   UefiCpuPkg/CpuDxe/CpuDxe.inf
   OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
 index 9dd4095967..78b4e1d528 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -206,7 +206,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
 INF  MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
 INF  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
 -INF  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
 INF  UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
 INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
 INF  OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
 index 8a8c7a0b37..ee8da63252 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -746,7 +746,6 @@
 !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
   }
 -  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
   UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
   UefiCpuPkg/CpuDxe/CpuDxe.inf
   OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
 index 501b4de469..5e0bc9d2c5 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -216,7 +216,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
 INF  MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
 INF  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
 -INF  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
 INF  UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
 INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
 INF  OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
 index 4bde14a05a..1c7b55a430 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -760,7 +760,6 @@
 !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
   }
 -  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
   UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
   UefiCpuPkg/CpuDxe/CpuDxe.inf
   OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
 index 74cfb58f06..ed33c906f3 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -217,7 +217,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
 INF  MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
 INF  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
 -INF  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
 INF  UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
 INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
 INF  OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
 index a43352ede4..9807c0a6b4 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -805,7 +805,6 @@
 !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
   }
 -  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
   UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
   UefiCpuPkg/CpuDxe/CpuDxe.inf {
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
 index f47ab1727e..feb3228ae2 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -239,7 +239,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
 INF  MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
 INF  MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
 -INF  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
 INF  UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
 INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
--- a/0015-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
+++ b/0015-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
@ -0,0 +1,126 @@
 From 94f1e0809390547cbfb0ed0e650a773c24b553ed Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:28:59 +0200
 Subject: [PATCH] OvmfPkg: Remove VirtioGpu device driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [4/19] f0a41317291f2e9e3b5bd3125149c3866f23ab08
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 QemuVideoDxe binds virtio-vga, so VirtioGpu is not needed.
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 OvmfPkg/AmdSev/AmdSevX64.dsc | 1 -
 OvmfPkg/AmdSev/AmdSevX64.fdf | 1 -
 OvmfPkg/OvmfPkgIa32.dsc      | 1 -
 OvmfPkg/OvmfPkgIa32.fdf      | 1 -
 OvmfPkg/OvmfPkgIa32X64.dsc   | 1 -
 OvmfPkg/OvmfPkgIa32X64.fdf   | 1 -
 OvmfPkg/OvmfPkgX64.dsc       | 1 -
 OvmfPkg/OvmfPkgX64.fdf       | 1 -
 8 files changed, 8 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
 index e565430e6c..c000cc8de8 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
@@ -701,7 +701,6 @@
     <PcdsFixedAtBuild>
       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
   }
 -  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
   #
   # ISA Support
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
 index 78b4e1d528..d6f785c205 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -300,7 +300,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
 INF  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 -INF  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
 INF  OvmfPkg/PlatformDxe/Platform.inf
 INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
 index ee8da63252..254d9f13f3 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -838,7 +838,6 @@
     <PcdsFixedAtBuild>
       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
   }
 -  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
   #
   # ISA Support
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
 index 5e0bc9d2c5..dec1258714 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -321,7 +321,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
 INF  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 -INF  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
 INF  OvmfPkg/PlatformDxe/Platform.inf
 INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
 index 1c7b55a430..a3a753bd8b 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -852,7 +852,6 @@
     <PcdsFixedAtBuild>
       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
   }
 -  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
   #
   # ISA Support
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
 index ed33c906f3..00bd49c89d 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -327,7 +327,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
 INF  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 -INF  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
 INF  OvmfPkg/PlatformDxe/Platform.inf
 INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
 index 9807c0a6b4..17cc17cbde 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -920,7 +920,6 @@
     <PcdsFixedAtBuild>
       gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
   }
 -  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
   #
   # ISA Support
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
 index feb3228ae2..bee30d8b4f 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -354,7 +354,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
 INF  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 -INF  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
 INF  OvmfPkg/PlatformDxe/Platform.inf
 INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
--- a/0016-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
+++ b/0016-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
@ -0,0 +1,100 @@
 From 0a61aba4d91c63ca263f628093331f6178728ad1 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:13 +0200
 Subject: [PATCH] OvmfPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [9/19] b40d8a6b9c38568a74fb922b12bbae9f0e721f95
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 Remove the virtio-fs driver.
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 OvmfPkg/OvmfPkgIa32.dsc    | 1 -
 OvmfPkg/OvmfPkgIa32.fdf    | 1 -
 OvmfPkg/OvmfPkgIa32X64.dsc | 1 -
 OvmfPkg/OvmfPkgIa32X64.fdf | 1 -
 OvmfPkg/OvmfPkgX64.dsc     | 1 -
 OvmfPkg/OvmfPkgX64.fdf     | 1 -
 6 files changed, 6 deletions(-)
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
 index 254d9f13f3..ca07b40857 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -816,7 +816,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
 index dec1258714..55d0f1ae5f 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -290,7 +290,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
 index a3a753bd8b..a5322783e5 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -830,7 +830,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
 index 00bd49c89d..fba268521b 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -291,7 +291,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
 index 17cc17cbde..190431b6fa 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -898,7 +898,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
 index bee30d8b4f..cea0e87cbf 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -316,7 +316,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -INF  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
--- a/0017-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
+++ b/0017-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
@ -0,0 +1,61 @@
 From 068776b4d85587427fbceebf0e79938eea33f68e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:16 +0200
 Subject: [PATCH] ArmVirtPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [10/19] 808ad4385c24fbf34fb0ba359808e6d364e1d030
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 Remove the virtio-fs driver.
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 ArmVirtPkg/ArmVirtQemu.dsc           | 1 -
 ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 -
 ArmVirtPkg/ArmVirtQemuKernel.dsc     | 1 -
 3 files changed, 3 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
 index 216b5a09cc..1e6c76795b 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
@@ -465,7 +465,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
   #
   # Bds
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 index c5d097ffb9..a814653dc4 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -84,7 +84,6 @@ READ_LOCK_STATUS   = TRUE
   INF FatPkg/EnhancedFatDxe/Fat.inf
   INF MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   INF MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  INF OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
   #
   # Status Code Routing
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
 index 5f07ed4dcc..e48bdf8deb 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
@@ -365,7 +365,6 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
   #
   # Bds
--- a/0017-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
+++ b/0017-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
@ -1,100 +0,0 @@
 From d33fa1e334e7dc75a3cd43728e1c825acd52f5c3 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Mon, 25 Sep 2023 09:48:46 +0200
 Subject: [PATCH 17/17] OvmfPkg: set PcdVariableStoreSize +
 PcdMaxVolatileVariableSize unconditionally
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
 OvmfPkg/OvmfPkgIa32.dsc    | 10 ----------
 OvmfPkg/OvmfPkgIa32X64.dsc | 10 ----------
 OvmfPkg/OvmfPkgX64.dsc     | 10 ----------
 3 files changed, 30 deletions(-)
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
 index d20afa771c36..1c3437e7437c 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -493,23 +493,13 @@ [PcdsFixedAtBuild]
 !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
 -!if $(NETWORK_TLS_ENABLE) == FALSE
 -  # match PcdFlashNvStorageVariableSize purely for convenience
 -  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
 -!endif
 !endif
 !if $(FD_SIZE_IN_KB) == 4096
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
 -!if $(NETWORK_TLS_ENABLE) == FALSE
 -  # match PcdFlashNvStorageVariableSize purely for convenience
 -  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
 !endif
 -!endif
 -!if $(NETWORK_TLS_ENABLE) == TRUE
   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
 -!endif
   gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
   gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
 index 52a8ac2a5592..87067f468285 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -500,23 +500,13 @@ [PcdsFixedAtBuild]
 !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
 -!if $(NETWORK_TLS_ENABLE) == FALSE
 -  # match PcdFlashNvStorageVariableSize purely for convenience
 -  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
 -!endif
 !endif
 !if $(FD_SIZE_IN_KB) == 4096
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
 -!if $(NETWORK_TLS_ENABLE) == FALSE
 -  # match PcdFlashNvStorageVariableSize purely for convenience
 -  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
 !endif
 -!endif
 -!if $(NETWORK_TLS_ENABLE) == TRUE
   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
 -!endif
   gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
   gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
 index 4e2459d34e2e..a625399d8246 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -519,23 +519,13 @@ [PcdsFixedAtBuild]
 !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
 -!if $(NETWORK_TLS_ENABLE) == FALSE
 -  # match PcdFlashNvStorageVariableSize purely for convenience
 -  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0xe000
 -!endif
 !endif
 !if $(FD_SIZE_IN_KB) == 4096
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8400
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x8400
 -!if $(NETWORK_TLS_ENABLE) == FALSE
 -  # match PcdFlashNvStorageVariableSize purely for convenience
 -  gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x40000
 !endif
 -!endif
 -!if $(NETWORK_TLS_ENABLE) == TRUE
   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x80000
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000
 -!endif
   gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0
   gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE
 -- 
 2.42.0
--- a/0018-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
+++ b/0018-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
@ -0,0 +1,126 @@
 From 6264a265fc50961c8d44a4c04b9c9e5ad07cc86c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:19 +0200
 Subject: [PATCH] OvmfPkg: Remove UdfDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [11/19] 21614de37221fca27d4eec0f03c5c8bce5911af3
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 Remove the UDF driver.
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 OvmfPkg/AmdSev/AmdSevX64.dsc | 1 -
 OvmfPkg/AmdSev/AmdSevX64.fdf | 1 -
 OvmfPkg/OvmfPkgIa32.dsc      | 1 -
 OvmfPkg/OvmfPkgIa32.fdf      | 1 -
 OvmfPkg/OvmfPkgIa32X64.dsc   | 1 -
 OvmfPkg/OvmfPkgIa32X64.fdf   | 1 -
 OvmfPkg/OvmfPkgX64.dsc       | 1 -
 OvmfPkg/OvmfPkgX64.fdf       | 1 -
 8 files changed, 8 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
 index c000cc8de8..75bec7859e 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
@@ -679,7 +679,6 @@
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
 index d6f785c205..5d0cba1e13 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -274,7 +274,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
 INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 -INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
 index ca07b40857..62907e9458 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -815,7 +815,6 @@
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
 index 55d0f1ae5f..6c324943e4 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -289,7 +289,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
 INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 -INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
 index a5322783e5..28cf5ace70 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -829,7 +829,6 @@
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
 index fba268521b..a890d4a3e3 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -290,7 +290,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
 INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 -INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
 index 190431b6fa..ca0c007181 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -897,7 +897,6 @@
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
 index cea0e87cbf..48da04eb9c 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -315,7 +315,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
 INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 -INF  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
--- a/0018-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch
+++ b/0018-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch
@ -1,26 +0,0 @@
 From f34c799475de60e399463953870c182a08c39f81 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Mon, 27 Nov 2023 11:04:08 +0100
 Subject: [PATCH 18/18] silence '... has a LOAD segment with RWX permissions'
 warning
 ---
 BaseTools/Conf/tools_def.template | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/BaseTools/Conf/tools_def.template b/BaseTools/Conf/tools_def.template
 index c34ecfd557c5..53ac3baa6be3 100755
 --- a/BaseTools/Conf/tools_def.template
 +++ b/BaseTools/Conf/tools_def.template
@@ -747,7 +747,7 @@ DEFINE GCC_AARCH64_CC_FLAGS        = DEF(GCC_ALL_CC_FLAGS) -mlittle-endian -fno-
 DEFINE GCC_AARCH64_CC_XIPFLAGS     = -mstrict-align -mgeneral-regs-only
 DEFINE GCC_RISCV64_CC_XIPFLAGS     = -mstrict-align -mgeneral-regs-only
 DEFINE GCC_DLINK_FLAGS_COMMON      = -nostdlib --pie
 -DEFINE GCC_DLINK2_FLAGS_COMMON     = -Wl,--script=$(EDK_TOOLS_PATH)/Scripts/GccBase.lds
 +DEFINE GCC_DLINK2_FLAGS_COMMON     = -Wl,--script=$(EDK_TOOLS_PATH)/Scripts/GccBase.lds -Wl,--no-warn-rwx-segments
 DEFINE GCC_IA32_X64_DLINK_COMMON   = DEF(GCC_DLINK_FLAGS_COMMON) --gc-sections
 DEFINE GCC_ARM_AARCH64_DLINK_COMMON= -Wl,--emit-relocs -nostdlib -Wl,--gc-sections -u $(IMAGE_ENTRY_POINT) -Wl,-e,$(IMAGE_ENTRY_POINT),-Map,$(DEST_DIR_DEBUG)/$(BASE_NAME).map
 DEFINE GCC_LOONGARCH64_DLINK_COMMON= -Wl,--emit-relocs -nostdlib -Wl,--gc-sections -u $(IMAGE_ENTRY_POINT) -Wl,-e,$(IMAGE_ENTRY_POINT),-Map,$(DEST_DIR_DEBUG)/$(BASE_NAME).map
 -- 
 2.43.0
--- a/0019-ArmVirt-Allow-memory-attributes-protocol-to-be-disab.patch
+++ b/0019-ArmVirt-Allow-memory-attributes-protocol-to-be-disab.patch
@ -1,182 +0,0 @@
 From d93c63a8d3fe63f14b2c9e8dbf6792592fc9ea84 Mon Sep 17 00:00:00 2001
 From: Ard Biesheuvel <ardb@kernel.org>
 Date: Tue, 12 Dec 2023 09:36:00 +0100
 Subject: [PATCH 19/19] ArmVirt: Allow memory attributes protocol to be
 disabled
 Shim's PE loader uses the EFI memory attributes protocol in a way that
 results in an immediate crash when invoking the loaded image, unless the
 base and size of its executable segment are both aligned to 4k.
 If this is not the case, it will strip the memory allocation of its
 executable permissions, but fail to add them back for the executable
 region, resulting in non-executable code. Unfortunately, the PE loader
 does not even bother invoking the protocol in this case (as it notices
 the misalignment), making it very hard for system firmware to work
 around this by attempting to infer the intent of the caller.
 So let's introduce a QEMU command line option to indicate that the
 protocol should not be exposed at all, and a PCD to set the default for
 this option when it is omitted.
  -fw_cfg opt/org.tianocore/UninstallMemAttrProtocol,string=y
 Cc: Gerd Hoffmann <kraxel@redhat.com>
 Cc: Oliver Steffen <osteffen@redhat.com>
 Cc: Alexander Graf <graf@amazon.com>
 Cc: Oliver Smith-Denny <osde@linux.microsoft.com>
 Cc: Taylor Beebe <taylor.d.beebe@gmail.com>
 Cc: Peter Jones <pjones@redhat.com>
 Cc: Leif Lindholm <quic_llindhol@quicinc.com>
 Link: https://gitlab.com/qemu-project/qemu/-/issues/1990
 Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
 Tested-by: Gerd Hoffmann <kraxel@redhat.com>
 Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
 Message-ID: <20231212083600.1889189-1-ardb@google.com>
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
 ArmVirtPkg/ArmVirtPkg.dec                     |  6 ++
 .../PlatformBootManagerLib.inf                |  3 +
 .../PlatformBootManagerLib/PlatformBm.c       | 64 +++++++++++++++++++
 3 files changed, 73 insertions(+)
 diff --git a/ArmVirtPkg/ArmVirtPkg.dec b/ArmVirtPkg/ArmVirtPkg.dec
 index 0f2d7873279f..6fa7ca22b966 100644
 --- a/ArmVirtPkg/ArmVirtPkg.dec
 +++ b/ArmVirtPkg/ArmVirtPkg.dec
@@ -68,3 +68,9 @@ [PcdsFixedAtBuild, PcdsPatchableInModule]
   # Cloud Hypervisor has no other way to pass Rsdp address to the guest except use a PCD.
   #
   gArmVirtTokenSpaceGuid.PcdCloudHvAcpiRsdpBaseAddress|0x0|UINT64|0x00000005
 +
 +  ##
 +  # Whether the EFI memory attributes protocol should be uninstalled before
 +  # invoking the OS loader. This may be needed to work around problematic
 +  # builds of shim that use the protocol incorrectly.
 +  gArmVirtTokenSpaceGuid.PcdUninstallMemAttrProtocol|FALSE|BOOLEAN|0x00000006
 diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
 index 997eb1a4429f..3a2822cda4b1 100644
 --- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
 +++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
@@ -46,6 +46,7 @@ [LibraryClasses]
   PcdLib
   PlatformBmPrintScLib
   QemuBootOrderLib
 +  QemuFwCfgSimpleParserLib
   QemuLoadImageLib
   ReportStatusCodeLib
   TpmPlatformHierarchyLib
@@ -55,6 +56,7 @@ [LibraryClasses]
   UefiRuntimeServicesTableLib
 [FixedPcd]
 +  gArmVirtTokenSpaceGuid.PcdUninstallMemAttrProtocol
   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultBaudRate
   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultDataBits
   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultParity
@@ -73,5 +75,6 @@ [Guids]
 [Protocols]
   gEfiFirmwareVolume2ProtocolGuid
   gEfiGraphicsOutputProtocolGuid
 +  gEfiMemoryAttributeProtocolGuid
   gEfiPciRootBridgeIoProtocolGuid
   gVirtioDeviceProtocolGuid
 diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
 index 85c01351b09d..e9693a1cd9ac 100644
 --- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
 +++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
@@ -16,6 +16,7 @@
 #include <Library/PcdLib.h>
 #include <Library/PlatformBmPrintScLib.h>
 #include <Library/QemuBootOrderLib.h>
 +#include <Library/QemuFwCfgSimpleParserLib.h>
 #include <Library/TpmPlatformHierarchyLib.h>
 #include <Library/UefiBootManagerLib.h>
 #include <Protocol/DevicePath.h>
@@ -1111,6 +1112,49 @@ PlatformBootManagerBeforeConsole (
   FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciSerial, SetupVirtioSerial);
 }
 +/**
 +  Uninstall the EFI memory attribute protocol if it exists.
 +**/
 +STATIC
 +VOID
 +UninstallEfiMemoryAttributesProtocol (
 +  VOID
 +  )
 +{
 +  EFI_STATUS  Status;
 +  EFI_HANDLE  Handle;
 +  UINTN       Size;
 +  VOID        *MemoryAttributeProtocol;
 +
 +  Size   = sizeof (Handle);
 +  Status = gBS->LocateHandle (
 +                  ByProtocol,
 +                  &gEfiMemoryAttributeProtocolGuid,
 +                  NULL,
 +                  &Size,
 +                  &Handle
 +                  );
 +
 +  if (EFI_ERROR (Status)) {
 +    ASSERT (Status == EFI_NOT_FOUND);
 +    return;
 +  }
 +
 +  Status = gBS->HandleProtocol (
 +                  Handle,
 +                  &gEfiMemoryAttributeProtocolGuid,
 +                  &MemoryAttributeProtocol
 +                  );
 +  ASSERT_EFI_ERROR (Status);
 +
 +  Status = gBS->UninstallProtocolInterface (
 +                  Handle,
 +                  &gEfiMemoryAttributeProtocolGuid,
 +                  MemoryAttributeProtocol
 +                  );
 +  ASSERT_EFI_ERROR (Status);
 +}
 +
 /**
   Do the platform specific action after the console is ready
   Possible things that can be done in PlatformBootManagerAfterConsole:
@@ -1129,12 +1173,32 @@ PlatformBootManagerAfterConsole (
   )
 {
   RETURN_STATUS  Status;
 +  BOOLEAN        Uninstall;
   //
   // Show the splash screen.
   //
   BootLogoEnableLogo ();
 +  //
 +  // Work around shim's terminally broken use of the EFI memory attributes
 +  // protocol, by uninstalling it if requested on the QEMU command line.
 +  //
 +  // E.g.,
 +  //       -fw_cfg opt/org.tianocore/UninstallMemAttrProtocol,string=y
 +  //
 +  Uninstall = FixedPcdGetBool (PcdUninstallMemAttrProtocol);
 +  QemuFwCfgParseBool ("opt/org.tianocore/UninstallMemAttrProtocol", &Uninstall);
 +  DEBUG ((
 +    DEBUG_WARN,
 +    "%a: %auninstalling EFI memory protocol\n",
 +    __func__,
 +    Uninstall ? "" : "not "
 +    ));
 +  if (Uninstall) {
 +    UninstallEfiMemoryAttributesProtocol ();
 +  }
 +
   //
   // Process QEMU's -kernel command line option. The kernel booted this way
   // will receive ACPI tables: in PlatformBootManagerBeforeConsole(), we
 -- 
 2.43.0
--- a/0019-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
+++ b/0019-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
@ -0,0 +1,61 @@
 From 2ddf7702dee6a1a0edab8154b085c36f8d84376f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:22 +0200
 Subject: [PATCH] ArmVirtPkg: Remove UdfDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [12/19] fcadb6a747b65e4d449d48131c9a2eeed4bd3c9a
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 Remove the UDF driver.
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 ArmVirtPkg/ArmVirtQemu.dsc           | 1 -
 ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 -
 ArmVirtPkg/ArmVirtQemuKernel.dsc     | 1 -
 3 files changed, 3 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
 index 1e6c76795b..9216faca8d 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
@@ -464,7 +464,6 @@
   MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
   #
   # Bds
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 index a814653dc4..a411a8f68d 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -83,7 +83,6 @@ READ_LOCK_STATUS   = TRUE
   INF MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
   INF FatPkg/EnhancedFatDxe/Fat.inf
   INF MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
 -  INF MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
   #
   # Status Code Routing
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
 index e48bdf8deb..66ad4b6948 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
@@ -364,7 +364,6 @@
   MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
   FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
   #
   # Bds
--- a/0020-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
+++ b/0020-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
@ -0,0 +1,109 @@
 From 90b02d61d206926d6b2687a4a94f600039ae2e7c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:25 +0200
 Subject: [PATCH] OvmfPkg: Remove TftpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [13/19] cf9ef346386ac89fa05b29d429d8d1b27cf0e3b0
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 Remove the command to download files in the shell via TFTP.
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 OvmfPkg/OvmfPkgIa32.dsc    | 4 ----
 OvmfPkg/OvmfPkgIa32.fdf    | 1 -
 OvmfPkg/OvmfPkgIa32X64.dsc | 4 ----
 OvmfPkg/OvmfPkgIa32X64.fdf | 1 -
 OvmfPkg/OvmfPkgX64.dsc     | 4 ----
 OvmfPkg/OvmfPkgX64.fdf     | 1 -
 6 files changed, 15 deletions(-)
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
 index 62907e9458..c2fe2e6042 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -881,10 +881,6 @@
   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
   ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
 index 6c324943e4..32a42c926b 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -291,7 +291,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
 index 28cf5ace70..5d74007599 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -895,10 +895,6 @@
   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
   ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
 index a890d4a3e3..733f60ce7c 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -292,7 +292,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
 index ca0c007181..f27932b38d 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -963,10 +963,6 @@
   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
   ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
 index 48da04eb9c..f562b5312b 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -317,7 +317,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
--- a/0021-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
+++ b/0021-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
@ -0,0 +1,54 @@
 From f7abc9b87c6034ada69ed16fc644c578cea5af19 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:28 +0200
 Subject: [PATCH] ArmVirtPkg: Remove TftpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [14/19] 12436014941bd4a7c99a26d779ebdcd75f169403
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 Remove the command to download files in the shell via TFTP.
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 ArmVirtPkg/ArmVirt.dsc.inc           | 7 +++----
 ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 -
 2 files changed, 3 insertions(+), 5 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
 index 2bc6a29eb1..33f122f913 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
@@ -388,10 +388,9 @@
   #
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
 -  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
 +  #
 +  # UEFI application (Shell Embedded Boot Loader)
 +  #
   ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 index a411a8f68d..4b00524fde 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -99,7 +99,6 @@ READ_LOCK_STATUS   = TRUE
   INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
   INF ShellPkg/Application/Shell/Shell.inf
 -  INF ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
   INF ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
   INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
--- a/0022-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
+++ b/0022-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
@ -0,0 +1,113 @@
 From ab3da1407691781fb148e53d4b02e996a5dbca2f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:31 +0200
 Subject: [PATCH] OvmfPkg: Remove HttpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Rebase to edk2-stable202311:
 Minor update, context change due to new variable policy shell command.
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [15/19] 1911cf04f27467ef1175b1976864c1111d93d19e
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 Remove the command to download files in the shell via HTTP(S).
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 OvmfPkg/OvmfPkgIa32.dsc    | 4 ----
 OvmfPkg/OvmfPkgIa32.fdf    | 1 -
 OvmfPkg/OvmfPkgIa32X64.dsc | 4 ----
 OvmfPkg/OvmfPkgIa32X64.fdf | 1 -
 OvmfPkg/OvmfPkgX64.dsc     | 4 ----
 OvmfPkg/OvmfPkgX64.fdf     | 1 -
 6 files changed, 15 deletions(-)
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
 index c2fe2e6042..44139c648c 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -881,10 +881,6 @@
   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
 index 32a42c926b..56520eaf99 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -291,7 +291,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 !if $(BUILD_SHELL) == TRUE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
 index 5d74007599..e2f13499cc 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -895,10 +895,6 @@
   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
 index 733f60ce7c..f04620418b 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -292,7 +292,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 !if $(BUILD_SHELL) == TRUE
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
 index f27932b38d..f1dc48c3be 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -963,10 +963,6 @@
   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
 index f562b5312b..61a3c63166 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -317,7 +317,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
 INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 !if $(BUILD_SHELL) == TRUE
--- a/0023-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
+++ b/0023-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
@ -0,0 +1,55 @@
 From 54c22fb545c567b4f99c81170ba8a4fc111e7646 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:34 +0200
 Subject: [PATCH] ArmVirtPkg: Remove HttpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Rebase to edk2-stable202311:
 Minor update, context change due to new variable policy shell command.
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [16/19] 07a74f1fdcdbb9a31d25ce9760edcd852e9574c3
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 Remove the command to download files in the shell via HTTP(S).
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 ArmVirtPkg/ArmVirt.dsc.inc           | 4 ----
 ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 -
 2 files changed, 5 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
 index 33f122f913..2b9315f8b3 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
@@ -391,10 +391,6 @@
   #
   # UEFI application (Shell Embedded Boot Loader)
   #
 -  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 index 4b00524fde..aa3acdeae6 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -99,7 +99,6 @@ READ_LOCK_STATUS   = TRUE
   INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
   INF ShellPkg/Application/Shell/Shell.inf
 -  INF ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
   INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
--- a/0024-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
+++ b/0024-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
@ -0,0 +1,147 @@
 From 1025e8342c42c49d9b3bbffd6a923b4cb89ec76a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:39 +0200
 Subject: [PATCH] OvmfPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Rebase to edk2-stable202311:
 Minor update, context change due to new variable policy shell command.
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [17/19] 491fe1301ea29c7cb56c20272e45614d5fcb6f14
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 Remove the command to register a file in the shell as the
 initial ramdisk for a UEFI stubbed kernel, to be booted next.
 Note: as further dynamic shell commands might show up upstream,
 we intentionally preserve the empty !ifdef'ry context to ease
 future downstream rebases.
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 OvmfPkg/AmdSev/AmdSevX64.dsc | 4 ----
 OvmfPkg/AmdSev/AmdSevX64.fdf | 1 -
 OvmfPkg/OvmfPkgIa32.dsc      | 4 ----
 OvmfPkg/OvmfPkgIa32.fdf      | 1 -
 OvmfPkg/OvmfPkgIa32X64.dsc   | 4 ----
 OvmfPkg/OvmfPkgIa32X64.fdf   | 1 -
 OvmfPkg/OvmfPkgX64.dsc       | 4 ----
 OvmfPkg/OvmfPkgX64.fdf       | 1 -
 8 files changed, 20 deletions(-)
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
 index 75bec7859e..753957bcc4 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
@@ -737,10 +737,6 @@
   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
 !endif
   OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf
   OvmfPkg/AmdSev/Grub/Grub.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
 index 5d0cba1e13..9b65ebac56 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -276,7 +276,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
 -INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 INF OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf
 INF  OvmfPkg/AmdSev/Grub/Grub.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
 index 44139c648c..2825acec3e 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -885,10 +885,6 @@
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
 !endif
 !if $(BUILD_SHELL) == TRUE
   ShellPkg/Application/Shell/Shell.inf {
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
 index 56520eaf99..de73cabb6e 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -291,7 +291,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 !if $(BUILD_SHELL) == TRUE
 INF  ShellPkg/Application/Shell/Shell.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
 index e2f13499cc..f1af88a9b5 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -899,10 +899,6 @@
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
 !endif
 !if $(BUILD_SHELL) == TRUE
   ShellPkg/Application/Shell/Shell.inf {
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
 index f04620418b..241019cb28 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -292,7 +292,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 !if $(BUILD_SHELL) == TRUE
 INF  ShellPkg/Application/Shell/Shell.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
 index f1dc48c3be..908895354b 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -967,10 +967,6 @@
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
 !endif
 !if $(BUILD_SHELL) == TRUE
   ShellPkg/Application/Shell/Shell.inf {
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
 index 61a3c63166..c1e7240076 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -317,7 +317,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
 INF  FatPkg/EnhancedFatDxe/Fat.inf
 !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
 -INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 !endif
 !if $(BUILD_SHELL) == TRUE
 INF  ShellPkg/Application/Shell/Shell.inf
--- a/0025-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
+++ b/0025-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
@ -0,0 +1,66 @@
 From 1e792bb790474a68c6e63a6e0faa88f8e2647ae3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:46 +0200
 Subject: [PATCH] ArmVirtPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Rebase to edk2-stable202311:
 Minor update, context change due to new variable policy shell command.
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [18/19] 8f4e4007108462533e3d2050b84d8830073a7c0d
 RH-Bugzilla: 1967747
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 Remove the command to register a file in the shell as the initial
 ramdisk for a UEFI stubbed kernel, to be booted next.
 Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
 ArmVirtPkg/ArmVirt.dsc.inc           | 10 +++-------
 ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc |  1 -
 2 files changed, 3 insertions(+), 8 deletions(-)
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
 index 2b9315f8b3..5d40a3c3c7 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
@@ -388,17 +388,13 @@
   #
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
 -  #
 -  # UEFI application (Shell Embedded Boot Loader)
 -  #
 +  #
 +  # UEFI application (Shell Embedded Boot Loader)
 +  #
   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
     <PcdsFixedAtBuild>
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
   ShellPkg/Application/Shell/Shell.inf {
     <LibraryClasses>
       ShellCommandLib|ShellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.inf
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 index aa3acdeae6..49bd633850 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
@@ -100,7 +100,6 @@ READ_LOCK_STATUS   = TRUE
   INF ShellPkg/Application/Shell/Shell.inf
   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
 -  INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
   #
   # Bds
--- a/0026-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
+++ b/0026-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
@ -1,21 +1,31 @@
-From eb24212304ec31c3ae8b878a21d4b875d5942cd1 Mon Sep 17 00:00:00 2001
+From d1572c35f13fd69f48c7c5adeb22eff09d3a1189 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 28 Feb 2023 15:47:00 +0100
-Subject: [PATCH 13/14] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
+Subject: [PATCH] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 42: UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
 RH-Bugzilla: 2124143
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [1/1] 5168501c31541a57aaeb3b3bd7c3602205eb7cdf (kraxel/centos-edk2)
 In case the number of CPUs can in increase beyond 255
 due to CPU hotplug choose x2apic mode.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 patch_name: edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
 present_in_specfile: true
 location_in_specfile: 38
 ---
 UefiCpuPkg/Library/MpInitLib/MpLib.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
 diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
-index 6f1456cfe168..9277e06c9b4a 100644
+index cdfb570e61..7bc93dfa13 100644
 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
 +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
-@@ -527,7 +527,9 @@ CollectProcessorCount (
+@@ -533,7 +533,9 @@ CollectProcessorCount (
   //
   // Enable x2APIC mode if
   //  1. Number of CPU is greater than 255; or
@ -26,7 +36,7 @@ index 6f1456cfe168..9277e06c9b4a 100644
   //
   X2Apic = FALSE;
   if (CpuMpData->CpuCount > 255) {
-@@ -535,6 +537,10 @@ CollectProcessorCount (
+@@ -541,6 +543,10 @@ CollectProcessorCount (
     // If there are more than 255 processor found, force to enable X2APIC
     //
     X2Apic = TRUE;
@ -37,6 +47,3 @@ index 6f1456cfe168..9277e06c9b4a 100644
   } else {
     CpuInfoInHob = (CPU_INFO_IN_HOB *)(UINTN)CpuMpData->CpuInfoInHob;
     for (Index = 0; Index < CpuMpData->CpuCount; Index++) {
 -- 
 2.41.0
--- a/0027-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
+++ b/0027-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
@ -0,0 +1,121 @@
 From 89a0a96bcfe49ca87087850d0b070e351850f6e8 Mon Sep 17 00:00:00 2001
 From: Oliver Steffen <osteffen@redhat.com>
 Date: Wed, 16 Aug 2023 12:09:40 +0200
 Subject: [PATCH] OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
 RH-Author: Oliver Steffen <osteffen@redhat.com>
 RH-MergeRequest: 46: OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
 RH-Bugzilla: 2218196
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [1/1] 9bf3bb989e36253aa34bf82ecfe8faa7312e8d22 (osteffen/edk2)
 Add a callback at the end of the Dxe phase that sets the
 "FB_NO_REBOOT" variable under the Shim GUID.
 This is a workaround for a boot loop in case a confidential
 guest that uses shim is booted with a vtpm device present.
 BZ 2218196
 Signed-off-by: Oliver Steffen <osteffen@redhat.com>
 patch_name: edk2-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
 present_in_specfile: true
 location_in_specfile: 44
 ---
 OvmfPkg/AmdSevDxe/AmdSevDxe.c   | 42 +++++++++++++++++++++++++++++++++
 OvmfPkg/AmdSevDxe/AmdSevDxe.inf |  2 ++
 2 files changed, 44 insertions(+)
 diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.c b/OvmfPkg/AmdSevDxe/AmdSevDxe.c
 index db3675ae86..f639c093a2 100644
 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.c
 +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.c
@@ -19,6 +19,7 @@
 #include <Library/MemoryAllocationLib.h>
 #include <Library/UefiBootServicesTableLib.h>
 #include <Guid/ConfidentialComputingSevSnpBlob.h>
 +#include <Guid/GlobalVariable.h>
 #include <Library/PcdLib.h>
 #include <Pi/PrePiDxeCis.h>
 #include <Protocol/SevMemoryAcceptance.h>
@@ -28,6 +29,10 @@
 // Present, initialized, tested bits defined in MdeModulePkg/Core/Dxe/DxeMain.h
 #define EFI_MEMORY_INTERNAL_MASK  0x0700000000000000ULL
 +static EFI_GUID  ShimLockGuid = {
 +  0x605dab50, 0xe046, 0x4300, { 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 }
 +};
 +
 STATIC
 EFI_STATUS
 AllocateConfidentialComputingBlob (
@@ -191,6 +196,32 @@ STATIC EDKII_MEMORY_ACCEPT_PROTOCOL  mMemoryAcceptProtocol = {
   AmdSevMemoryAccept
 };
 +VOID
 +EFIAPI
 +PopulateVarstore (
 +  EFI_EVENT  Event,
 +  VOID       *Context
 +  )
 +{
 +  EFI_SYSTEM_TABLE  *SystemTable = (EFI_SYSTEM_TABLE *)Context;
 +  EFI_STATUS        Status;
 +
 +  DEBUG ((DEBUG_INFO, "Populating Varstore\n"));
 +  UINT32  data = 1;
 +
 +  Status = SystemTable->RuntimeServices->SetVariable (
 +                                           L"FB_NO_REBOOT",
 +                                           &ShimLockGuid,
 +                                           EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 +                                           sizeof (data),
 +                                           &data
 +                                           );
 +  ASSERT_EFI_ERROR (Status);
 +
 +  Status = SystemTable->BootServices->CloseEvent (Event);
 +  ASSERT_EFI_ERROR (Status);
 +}
 +
 EFI_STATUS
 EFIAPI
 AmdSevDxeEntryPoint (
@@ -203,6 +234,7 @@ AmdSevDxeEntryPoint (
   UINTN                                     NumEntries;
   UINTN                                     Index;
   CONFIDENTIAL_COMPUTING_SNP_BLOB_LOCATION  *SnpBootDxeTable;
 +  EFI_EVENT                                 PopulateVarstoreEvent;
   //
   // Do nothing when SEV is not enabled
@@ -361,5 +393,15 @@ AmdSevDxeEntryPoint (
                   );
   }
 +  Status = gBS->CreateEventEx (
 +                  EVT_NOTIFY_SIGNAL,
 +                  TPL_CALLBACK,
 +                  PopulateVarstore,
 +                  SystemTable,
 +                  &gEfiEndOfDxeEventGroupGuid,
 +                  &PopulateVarstoreEvent
 +                  );
 +  ASSERT_EFI_ERROR (Status);
 +
   return EFI_SUCCESS;
 }
 diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf b/OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 index e7c7d526c9..09cbd2b0ca 100644
 --- a/OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 +++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.inf
@@ -54,6 +54,8 @@
 [Guids]
   gConfidentialComputingSevSnpBlobGuid
   gEfiEventBeforeExitBootServicesGuid
 +  gEfiEndOfDxeEventGroupGuid              ## CONSUMES ## Event
 +
 [Pcd]
   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId
--- a/0028-CryptoPkg-CrtLib-add-stat.h-include-file.patch
+++ b/0028-CryptoPkg-CrtLib-add-stat.h-include-file.patch
@ -1,9 +1,11 @@
-From c3f28ab099ea7c6949b849129cf5ea1c15b03854 Mon Sep 17 00:00:00 2001
+From 1b7a4cb54f50883fee087fd85b7c9b86b5296fea Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Mon, 28 Aug 2023 13:11:02 +0200
-Subject: [PATCH 15/16] CryptoPkg/CrtLib: add stat.h
+Subject: [PATCH] CryptoPkg/CrtLib: add stat.h include file.
-needed by rhel downstream openssl patches
+Needed by rhel downstream openssl patches.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
 CryptoPkg/Library/Include/sys/stat.h | 9 +++++++++
 1 file changed, 9 insertions(+)
@ -11,7 +13,7 @@ needed by rhel downstream openssl patches
 diff --git a/CryptoPkg/Library/Include/sys/stat.h b/CryptoPkg/Library/Include/sys/stat.h
 new file mode 100644
-index 000000000000..22247bb2db80
+index 0000000000..22247bb2db
 --- /dev/null
 +++ b/CryptoPkg/Library/Include/sys/stat.h
@@ -0,0 +1,9 @@
@ -24,6 +26,3 @@ index 000000000000..22247bb2db80
 +**/
 +
 +#include <CrtLibSupport.h>
 -- 
 2.41.0
--- a/0029-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch
+++ b/0029-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch
@ -1,17 +1,78 @@
-From dc0c929b8e17eefd7931ba21705eb0ec90c49714 Mon Sep 17 00:00:00 2001
+From e47e4f4efb118cf38f76c7abc8f1cb537e1f79e5 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Mon, 28 Aug 2023 13:27:09 +0200
-Subject: [PATCH 16/16] CryptoPkg/CrtLib: add access/open/read/write/close
+Subject: [PATCH] CryptoPkg/CrtLib: add access/open/read/write/close syscalls
 syscalls
-needed by rhel downstream openssl patches
+Needed by rhel downstream openssl patches, they use unix syscalls
 for file access (instead of fopen + friends like the rest of the
 code base).  No actual file access is needed for edk2, so just
 add stubs to make linking work.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
 CryptoPkg/Library/Include/CrtLibSupport.h     | 41 +++++++++++++++++
 .../Library/BaseCryptLib/SysCall/CrtWrapper.c | 46 +++++++++++++++++++
 CryptoPkg/Library/Include/CrtLibSupport.h     | 41 +++++++++++++++++
 2 files changed, 87 insertions(+)
 diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
 index 37cdecc9bd..dfdb635536 100644
 --- a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
 +++ b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
@@ -550,6 +550,52 @@ fread (
   return 0;
 }
 +int
 +access(
 +  const char*,
 +  int
 +  )
 +{
 +  return -1;
 +}
 +
 +int
 +open (
 +  const char *,
 +  int
 +  )
 +{
 +  return -1;
 +}
 +
 +ssize_t
 +read (
 +  int,
 +  void*,
 +  size_t
 +  )
 +{
 +  return -1;
 +}
 +
 +ssize_t
 +write (
 +  int,
 +  const void*,
 +  size_t
 +  )
 +{
 +  return -1;
 +}
 +
 +int
 +close (
 +  int
 +  )
 +{
 +  return -1;
 +}
 +
 uid_t
 getuid (
   void
 diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h b/CryptoPkg/Library/Include/CrtLibSupport.h
-index f36fe08f0c61..7d98496af80b 100644
+index f36fe08f0c..7d98496af8 100644
 --- a/CryptoPkg/Library/Include/CrtLibSupport.h
 +++ b/CryptoPkg/Library/Include/CrtLibSupport.h
@@ -78,6 +78,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
@ -76,63 +137,3 @@ index f36fe08f0c61..7d98496af80b 100644
 time_t
 time        (
   time_t *
 diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
 index 37cdecc9bd1d..dfdb63553667 100644
 --- a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
 +++ b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
@@ -550,6 +550,52 @@ fread (
   return 0;
 }
 +int
 +access(
 +  const char*,
 +  int
 +  )
 +{
 +  return -1;
 +}
 +
 +int
 +open (
 +  const char *,
 +  int
 +  )
 +{
 +  return -1;
 +}
 +
 +ssize_t
 +read (
 +  int,
 +  void*,
 +  size_t
 +  )
 +{
 +  return -1;
 +}
 +
 +ssize_t
 +write (
 +  int,
 +  const void*,
 +  size_t
 +  )
 +{
 +  return -1;
 +}
 +
 +int
 +close (
 +  int
 +  )
 +{
 +  return -1;
 +}
 +
 uid_t
 getuid (
   void
 -- 
 2.41.0
--- a/0030-OvmfPkg-Sec-Setup-MTRR-early-in-the-boot-process.patch
+++ b/0030-OvmfPkg-Sec-Setup-MTRR-early-in-the-boot-process.patch
@ -0,0 +1,194 @@
 From 9388cc72866fc379d94cf3dc029292f4246bfe39 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 30 Jan 2024 14:04:38 +0100
 Subject: [PATCH] OvmfPkg/Sec: Setup MTRR early in the boot process.
 RH-Author: Gerd Hoffmann <None>
 RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
 RH-Jira: RHEL-21704
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [1/4] c4061788d34f409944898b48642d610c259161f3 (kraxel.rh/centos-src-edk2)
 Specifically before running lzma uncompress of the main firmware volume.
 This is needed to make sure caching is enabled, otherwise the uncompress
 can be extremely slow.
 Adapt the ASSERTs and MTRR setup in PlatformInitLib to the changes.
 Background:  Depending on virtual machine configuration kvm may uses EPT
 memory types to apply guest MTRR settings.  In case MTRRs are disabled
 kvm will use the uncachable memory type for all mappings.  The
 vmx_get_mt_mask() function in the linux kernel handles this and can be
 found here:
 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kvm/vmx/vmx.c?h=v6.7.1#n7580
 In most VM configurations kvm uses MTRR_TYPE_WRBACK unconditionally.  In
 case the VM has a mdev device assigned that is not the case though.
 Before commit e8aa4c6546ad ("UefiCpuPkg/ResetVector: Cache Disable
 should not be set by default in CR0") kvm also ended up using
 MTRR_TYPE_WRBACK due to KVM_X86_QUIRK_CD_NW_CLEARED.  After that commit
 kvm evaluates guest mtrr settings, which why setting up MTRRs early is
 important now.
 Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Message-ID: <20240130130441.772484-2-kraxel@redhat.com>
 [ kraxel: Downstream-only for now.  Timely upstream merge is unlikely
          due to chinese holidays and rhel-9.4 deadlines are close.
          QE regression testing passed.  So go with upstream posted
          series v3 ]
 patch_name: edk2-OvmfPkg-Sec-Setup-MTRR-early-in-the-boot-process.patch
 present_in_specfile: true
 location_in_specfile: 49
 ---
 OvmfPkg/IntelTdx/Sec/SecMain.c              | 32 +++++++++++++++++++++
 OvmfPkg/Library/PlatformInitLib/MemDetect.c | 10 +++----
 OvmfPkg/Sec/SecMain.c                       | 32 +++++++++++++++++++++
 3 files changed, 69 insertions(+), 5 deletions(-)
 diff --git a/OvmfPkg/IntelTdx/Sec/SecMain.c b/OvmfPkg/IntelTdx/Sec/SecMain.c
 index 42a587adfa..0daddac0a0 100644
 --- a/OvmfPkg/IntelTdx/Sec/SecMain.c
 +++ b/OvmfPkg/IntelTdx/Sec/SecMain.c
@@ -27,6 +27,8 @@
 #include <Library/TdxHelperLib.h>
 #include <Library/CcProbeLib.h>
 #include <Library/PeilessStartupLib.h>
 +#include <Register/Intel/ArchitecturalMsr.h>
 +#include <Register/Intel/Cpuid.h>
 #define SEC_IDT_ENTRY_COUNT  34
@@ -48,6 +50,31 @@ IA32_IDT_GATE_DESCRIPTOR  mIdtEntryTemplate = {
   }
 };
 +//
 +// Enable MTRR early, set default type to write back.
 +// Needed to make sure caching is enabled,
 +// without this lzma decompress can be very slow.
 +//
 +STATIC
 +VOID
 +SecMtrrSetup (
 +  VOID
 +  )
 +{
 +  CPUID_VERSION_INFO_EDX           Edx;
 +  MSR_IA32_MTRR_DEF_TYPE_REGISTER  DefType;
 +
 +  AsmCpuid (CPUID_VERSION_INFO, NULL, NULL, NULL, &Edx.Uint32);
 +  if (!Edx.Bits.MTRR) {
 +    return;
 +  }
 +
 +  DefType.Uint64    = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
 +  DefType.Bits.Type = 6; /* write back */
 +  DefType.Bits.E    = 1; /* enable */
 +  AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
 +}
 +
 VOID
 EFIAPI
 SecCoreStartupWithStack (
@@ -204,6 +231,11 @@ SecCoreStartupWithStack (
   InitializeApicTimer (0, MAX_UINT32, TRUE, 5);
   DisableApicTimerInterrupt ();
 +  //
 +  // Initialize MTRR
 +  //
 +  SecMtrrSetup ();
 +
   PeilessStartup (&SecCoreData);
   ASSERT (FALSE);
 diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
 index f042517bb6..313f5e1f7f 100644
 --- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
 +++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
@@ -1082,18 +1082,18 @@ PlatformQemuInitializeRam (
     MtrrGetAllMtrrs (&MtrrSettings);
     //
 -    // MTRRs disabled, fixed MTRRs disabled, default type is uncached
 +    // See SecMtrrSetup(), default type should be write back
     //
 -    ASSERT ((MtrrSettings.MtrrDefType & BIT11) == 0);
 +    ASSERT ((MtrrSettings.MtrrDefType & BIT11) != 0);
     ASSERT ((MtrrSettings.MtrrDefType & BIT10) == 0);
 -    ASSERT ((MtrrSettings.MtrrDefType & 0xFF) == 0);
 +    ASSERT ((MtrrSettings.MtrrDefType & 0xFF) == MTRR_CACHE_WRITE_BACK);
     //
     // flip default type to writeback
     //
 -    SetMem (&MtrrSettings.Fixed, sizeof MtrrSettings.Fixed, 0x06);
 +    SetMem (&MtrrSettings.Fixed, sizeof MtrrSettings.Fixed, MTRR_CACHE_WRITE_BACK);
     ZeroMem (&MtrrSettings.Variables, sizeof MtrrSettings.Variables);
 -    MtrrSettings.MtrrDefType |= BIT11 | BIT10 | 6;
 +    MtrrSettings.MtrrDefType |= BIT10;
     MtrrSetAllMtrrs (&MtrrSettings);
     //
 diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
 index 31da5d0ace..3b7dc7205d 100644
 --- a/OvmfPkg/Sec/SecMain.c
 +++ b/OvmfPkg/Sec/SecMain.c
@@ -30,6 +30,8 @@
 #include <Ppi/MpInitLibDep.h>
 #include <Library/TdxHelperLib.h>
 #include <Library/CcProbeLib.h>
 +#include <Register/Intel/ArchitecturalMsr.h>
 +#include <Register/Intel/Cpuid.h>
 #include "AmdSev.h"
 #define SEC_IDT_ENTRY_COUNT  34
@@ -744,6 +746,31 @@ FindAndReportEntryPoints (
   return;
 }
 +//
 +// Enable MTRR early, set default type to write back.
 +// Needed to make sure caching is enabled,
 +// without this lzma decompress can be very slow.
 +//
 +STATIC
 +VOID
 +SecMtrrSetup (
 +  VOID
 +  )
 +{
 +  CPUID_VERSION_INFO_EDX           Edx;
 +  MSR_IA32_MTRR_DEF_TYPE_REGISTER  DefType;
 +
 +  AsmCpuid (CPUID_VERSION_INFO, NULL, NULL, NULL, &Edx.Uint32);
 +  if (!Edx.Bits.MTRR) {
 +    return;
 +  }
 +
 +  DefType.Uint64    = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
 +  DefType.Bits.Type = 6; /* write back */
 +  DefType.Bits.E    = 1; /* enable */
 +  AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
 +}
 +
 VOID
 EFIAPI
 SecCoreStartupWithStack (
@@ -942,6 +969,11 @@ SecCoreStartupWithStack (
   InitializeApicTimer (0, MAX_UINT32, TRUE, 5);
   DisableApicTimerInterrupt ();
 +  //
 +  // Initialize MTRR
 +  //
 +  SecMtrrSetup ();
 +
   //
   // Initialize Debug Agent to support source level debug in SEC/PEI phases before memory ready.
   //
--- a/0031-MdePkg-ArchitecturalMsr.h-add-defines-for-MTRR-cache.patch
+++ b/0031-MdePkg-ArchitecturalMsr.h-add-defines-for-MTRR-cache.patch
@ -0,0 +1,41 @@
 From 625a70fc26d752b0025eae19682b386f44fa089b Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 30 Jan 2024 14:04:39 +0100
 Subject: [PATCH] MdePkg/ArchitecturalMsr.h: add #defines for MTRR cache types
 RH-Author: Gerd Hoffmann <None>
 RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
 RH-Jira: RHEL-21704
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [2/4] a568bc2793d677462a2971aae9566a9bbc64b063 (kraxel.rh/centos-src-edk2)
 Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
 Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Message-ID: <20240130130441.772484-3-kraxel@redhat.com>
 patch_name: edk2-MdePkg-ArchitecturalMsr.h-add-defines-for-MTRR-cache.patch
 present_in_specfile: true
 location_in_specfile: 50
 ---
 MdePkg/Include/Register/Intel/ArchitecturalMsr.h | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/MdePkg/Include/Register/Intel/ArchitecturalMsr.h b/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
 index 756e7c86ec..08ba949cf7 100644
 --- a/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
 +++ b/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
@@ -2103,6 +2103,13 @@ typedef union {
 #define MSR_IA32_MTRR_PHYSBASE9  0x00000212
 /// @}
 +#define MSR_IA32_MTRR_CACHE_UNCACHEABLE      0
 +#define MSR_IA32_MTRR_CACHE_WRITE_COMBINING  1
 +#define MSR_IA32_MTRR_CACHE_WRITE_THROUGH    4
 +#define MSR_IA32_MTRR_CACHE_WRITE_PROTECTED  5
 +#define MSR_IA32_MTRR_CACHE_WRITE_BACK       6
 +#define MSR_IA32_MTRR_CACHE_INVALID_TYPE     7
 +
 /**
   MSR information returned for MSR indexes #MSR_IA32_MTRR_PHYSBASE0 to
   #MSR_IA32_MTRR_PHYSBASE9
--- a/0032-UefiCpuPkg-MtrrLib.h-use-cache-type-defines-from-Arc.patch
+++ b/0032-UefiCpuPkg-MtrrLib.h-use-cache-type-defines-from-Arc.patch
@ -0,0 +1,70 @@
 From d545c8ac6a7c96cb64661b2f5b6fccb97f9c02f8 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 30 Jan 2024 14:04:40 +0100
 Subject: [PATCH] UefiCpuPkg/MtrrLib.h: use cache type #defines from
 ArchitecturalMsr.h
 RH-Author: Gerd Hoffmann <None>
 RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
 RH-Jira: RHEL-21704
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [3/4] 8b766c97b247a8665662697534455c19423ff23c (kraxel.rh/centos-src-edk2)
 Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
 Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Message-ID: <20240130130441.772484-4-kraxel@redhat.com>
 patch_name: edk2-UefiCpuPkg-MtrrLib.h-use-cache-type-defines-from-Arc.patch
 present_in_specfile: true
 location_in_specfile: 51
 ---
 UefiCpuPkg/Include/Library/MtrrLib.h | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)
 diff --git a/UefiCpuPkg/Include/Library/MtrrLib.h b/UefiCpuPkg/Include/Library/MtrrLib.h
 index 86cc1aab3b..287d249a99 100644
 --- a/UefiCpuPkg/Include/Library/MtrrLib.h
 +++ b/UefiCpuPkg/Include/Library/MtrrLib.h
@@ -9,6 +9,8 @@
 #ifndef  _MTRR_LIB_H_
 #define  _MTRR_LIB_H_
 +#include <Register/Intel/ArchitecturalMsr.h>
 +
 //
 // According to IA32 SDM, MTRRs number and MSR offset are always consistent
 // for IA32 processor family
@@ -82,20 +84,20 @@ typedef struct _MTRR_SETTINGS_ {
 // Memory cache types
 //
 typedef enum {
 -  CacheUncacheable    = 0,
 -  CacheWriteCombining = 1,
 -  CacheWriteThrough   = 4,
 -  CacheWriteProtected = 5,
 -  CacheWriteBack      = 6,
 -  CacheInvalid        = 7
 +  CacheUncacheable    = MSR_IA32_MTRR_CACHE_UNCACHEABLE,
 +  CacheWriteCombining = MSR_IA32_MTRR_CACHE_WRITE_COMBINING,
 +  CacheWriteThrough   = MSR_IA32_MTRR_CACHE_WRITE_THROUGH,
 +  CacheWriteProtected = MSR_IA32_MTRR_CACHE_WRITE_PROTECTED,
 +  CacheWriteBack      = MSR_IA32_MTRR_CACHE_WRITE_BACK,
 +  CacheInvalid        = MSR_IA32_MTRR_CACHE_INVALID_TYPE,
 } MTRR_MEMORY_CACHE_TYPE;
 -#define  MTRR_CACHE_UNCACHEABLE      0
 -#define  MTRR_CACHE_WRITE_COMBINING  1
 -#define  MTRR_CACHE_WRITE_THROUGH    4
 -#define  MTRR_CACHE_WRITE_PROTECTED  5
 -#define  MTRR_CACHE_WRITE_BACK       6
 -#define  MTRR_CACHE_INVALID_TYPE     7
 +#define  MTRR_CACHE_UNCACHEABLE      MSR_IA32_MTRR_CACHE_UNCACHEABLE
 +#define  MTRR_CACHE_WRITE_COMBINING  MSR_IA32_MTRR_CACHE_WRITE_COMBINING
 +#define  MTRR_CACHE_WRITE_THROUGH    MSR_IA32_MTRR_CACHE_WRITE_THROUGH
 +#define  MTRR_CACHE_WRITE_PROTECTED  MSR_IA32_MTRR_CACHE_WRITE_PROTECTED
 +#define  MTRR_CACHE_WRITE_BACK       MSR_IA32_MTRR_CACHE_WRITE_BACK
 +#define  MTRR_CACHE_INVALID_TYPE     MSR_IA32_MTRR_CACHE_INVALID_TYPE
 typedef struct {
   UINT64                    BaseAddress;
--- a/0033-OvmfPkg-Sec-use-cache-type-defines-from-Architectura.patch
+++ b/0033-OvmfPkg-Sec-use-cache-type-defines-from-Architectura.patch
@ -0,0 +1,49 @@
 From 77a0448486125a840a33e438e430d8e0844dab81 Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 30 Jan 2024 14:04:41 +0100
 Subject: [PATCH] OvmfPkg/Sec: use cache type #defines from ArchitecturalMsr.h
 RH-Author: Gerd Hoffmann <None>
 RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
 RH-Jira: RHEL-21704
 RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
 RH-Commit: [4/4] 55f00e3e153ca945ca458e7abc26780a8d83ac85 (kraxel.rh/centos-src-edk2)
 Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Message-ID: <20240130130441.772484-5-kraxel@redhat.com>
 patch_name: edk2-OvmfPkg-Sec-use-cache-type-defines-from-Architectura.patch
 present_in_specfile: true
 location_in_specfile: 52
 ---
 OvmfPkg/IntelTdx/Sec/SecMain.c | 2 +-
 OvmfPkg/Sec/SecMain.c          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 diff --git a/OvmfPkg/IntelTdx/Sec/SecMain.c b/OvmfPkg/IntelTdx/Sec/SecMain.c
 index 0daddac0a0..c00b852f0e 100644
 --- a/OvmfPkg/IntelTdx/Sec/SecMain.c
 +++ b/OvmfPkg/IntelTdx/Sec/SecMain.c
@@ -70,7 +70,7 @@ SecMtrrSetup (
   }
   DefType.Uint64    = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
 -  DefType.Bits.Type = 6; /* write back */
 +  DefType.Bits.Type = MSR_IA32_MTRR_CACHE_WRITE_BACK;
   DefType.Bits.E    = 1; /* enable */
   AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
 }
 diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
 index 3b7dc7205d..aa0fa1b1ec 100644
 --- a/OvmfPkg/Sec/SecMain.c
 +++ b/OvmfPkg/Sec/SecMain.c
@@ -766,7 +766,7 @@ SecMtrrSetup (
   }
   DefType.Uint64    = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
 -  DefType.Bits.Type = 6; /* write back */
 +  DefType.Bits.Type = MSR_IA32_MTRR_CACHE_WRITE_BACK;
   DefType.Bits.E    = 1; /* enable */
   AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
 }
--- a/30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json
+++ b/30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json
@ -1,36 +0,0 @@
 {
    "description": "OVMF with SB+SMM, SB enabled, MS certs enrolled",
    "interface-types": [
        "uefi"
    ],
    "mapping": {
        "device": "flash",
        "mode" : "split",
        "executable": {
            "filename": "/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2",
            "format": "qcow2"
        },
        "nvram-template": {
            "filename": "/usr/share/edk2/ovmf/OVMF_VARS_4M.secboot.qcow2",
            "format": "qcow2"
        }
    },
    "targets": [
        {
            "architecture": "x86_64",
            "machines": [
                "pc-q35-*"
            ]
        }
    ],
    "features": [
        "acpi-s3",
        "enrolled-keys",
        "requires-smm",
        "secure-boot",
        "verbose-dynamic"
    ],
    "tags": [
    ]
 }
--- a/30-edk2-ovmf-ia32-sb-enrolled.json
+++ b/30-edk2-ovmf-ia32-sb-enrolled.json
@ -1,36 +0,0 @@
 {
    "description": "OVMF for i386, with SB+SMM, SB enabled, MS certs enrolled",
    "interface-types": [
        "uefi"
    ],
    "mapping": {
        "device": "flash",
        "mode" : "split",
        "executable": {
            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_CODE.secboot.fd",
            "format": "raw"
        },
        "nvram-template": {
            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_VARS.secboot.fd",
            "format": "raw"
        }
    },
    "targets": [
        {
            "architecture": "i386",
            "machines": [
                "pc-q35-*"
            ]
        }
    ],
    "features": [
        "acpi-s3",
        "enrolled-keys",
        "requires-smm",
        "secure-boot",
        "verbose-dynamic"
    ],
    "tags": [
    ]
 }
--- a/31-edk2-ovmf-2m-raw-x64-sb-enrolled.json
+++ b/31-edk2-ovmf-2m-raw-x64-sb-enrolled.json
@ -5,7 +5,7 @@
    ],
    "mapping": {
        "device": "flash",
-        "mode" : "split",
+        "mode": "split",
        "executable": {
            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd",
            "format": "raw"
--- a/40-edk2-ovmf-4m-qcow2-x64-sb.json
+++ b/40-edk2-ovmf-4m-qcow2-x64-sb.json
@ -1,35 +0,0 @@
 {
    "description": "OVMF with SB+SMM, empty varstore",
    "interface-types": [
        "uefi"
    ],
    "mapping": {
        "device": "flash",
        "mode" : "split",
        "executable": {
            "filename": "/usr/share/edk2/ovmf/OVMF_CODE_4M.secboot.qcow2",
            "format": "qcow2"
        },
        "nvram-template": {
            "filename": "/usr/share/edk2/ovmf/OVMF_VARS_4M.qcow2",
            "format": "qcow2"
        }
    },
    "targets": [
        {
            "architecture": "x86_64",
            "machines": [
                "pc-q35-*"
            ]
        }
    ],
    "features": [
        "acpi-s3",
        "requires-smm",
        "secure-boot",
        "verbose-dynamic"
    ],
    "tags": [
    ]
 }
--- a/40-edk2-ovmf-ia32-sb.json
+++ b/40-edk2-ovmf-ia32-sb.json
@ -1,35 +0,0 @@
 {
    "description": "OVMF for i386, with SB+SMM, empty varstore",
    "interface-types": [
        "uefi"
    ],
    "mapping": {
        "device": "flash",
        "mode" : "split",
        "executable": {
            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_CODE.secboot.fd",
            "format": "raw"
        },
        "nvram-template": {
            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_VARS.fd",
            "format": "raw"
        }
    },
    "targets": [
        {
            "architecture": "i386",
            "machines": [
                "pc-q35-*"
            ]
        }
    ],
    "features": [
        "acpi-s3",
        "requires-smm",
        "secure-boot",
        "verbose-dynamic"
    ],
    "tags": [
    ]
 }
--- a/41-edk2-ovmf-2m-raw-x64-sb.json
+++ b/41-edk2-ovmf-2m-raw-x64-sb.json
@ -5,7 +5,7 @@
    ],
    "mapping": {
        "device": "flash",
-        "mode" : "split",
+        "mode": "split",
        "executable": {
            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd",
            "format": "raw"
--- a/50-edk2-aarch64-qcow2.json
+++ b/50-edk2-aarch64-qcow2.json
@ -5,7 +5,7 @@
    ],
    "mapping": {
        "device": "flash",
-        "mode" : "split",
+        "mode": "split",
        "executable": {
            "filename": "/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.qcow2",
            "format": "qcow2"
--- a/50-edk2-arm-verbose.json
+++ b/50-edk2-arm-verbose.json
@ -1,32 +0,0 @@
 {
    "description": "UEFI firmware for arm, verbose logs",
    "interface-types": [
        "uefi"
    ],
    "mapping": {
        "device": "flash",
        "mode" : "split",
        "executable": {
            "filename": "/usr/share/edk2/arm/QEMU_EFI-pflash.raw",
            "format": "raw"
        },
        "nvram-template": {
            "filename": "/usr/share/edk2/arm/vars-template-pflash.raw",
            "format": "raw"
        }
    },
    "targets": [
        {
            "architecture": "arm",
            "machines": [
                "virt-*"
            ]
        }
    ],
    "features": [
        "verbose-static"
    ],
    "tags": [
    ]
 }
--- a/50-edk2-ovmf-4m-qcow2-x64-nosb.json
+++ b/50-edk2-ovmf-4m-qcow2-x64-nosb.json
@ -1,36 +0,0 @@
 {
    "description": "OVMF without SB+SMM, empty varstore",
    "interface-types": [
        "uefi"
    ],
    "mapping": {
        "device": "flash",
        "mode" : "split",
        "executable": {
            "filename": "/usr/share/edk2/ovmf/OVMF_CODE_4M.qcow2",
            "format": "qcow2"
        },
        "nvram-template": {
            "filename": "/usr/share/edk2/ovmf/OVMF_VARS_4M.qcow2",
            "format": "qcow2"
        }
    },
    "targets": [
        {
            "architecture": "x86_64",
            "machines": [
                "pc-i440fx-*",
                "pc-q35-*"
            ]
        }
    ],
    "features": [
        "acpi-s3",
        "amd-sev",
        "amd-sev-es",
        "verbose-dynamic"
    ],
    "tags": [
    ]
 }
--- a/50-edk2-ovmf-ia32-nosb.json
+++ b/50-edk2-ovmf-ia32-nosb.json
@ -1,34 +0,0 @@
 {
    "description": "OVMF for i386, without SB+SMM, empty varstore",
    "interface-types": [
        "uefi"
    ],
    "mapping": {
        "device": "flash",
        "mode" : "split",
        "executable": {
            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_CODE.fd",
            "format": "raw"
        },
        "nvram-template": {
            "filename": "/usr/share/edk2/ovmf-ia32/OVMF_VARS.fd",
            "format": "raw"
        }
    },
    "targets": [
        {
            "architecture": "i386",
            "machines": [
                "pc-i440fx-*",
                "pc-q35-*"
            ]
        }
    ],
    "features": [
        "acpi-s3",
        "verbose-dynamic"
    ],
    "tags": [
    ]
 }
--- a/50-edk2-ovmf-x64-microvm.json
+++ b/50-edk2-ovmf-x64-microvm.json
@ -1,22 +0,0 @@
 {
    "description": "OVMF for microvm",
    "interface-types": [
        "uefi"
    ],
    "mapping": {
        "device": "memory",
        "filename": "/usr/share/edk2/ovmf/MICROVM.fd"
    },
    "targets": [
        {
            "architecture": "x86_64",
            "machines": [
                "microvm"
            ]
        }
    ],
    "features": [
    ],
    "tags": [
    ]
 }
--- a/51-edk2-ovmf-2m-raw-x64-nosb.json
+++ b/51-edk2-ovmf-2m-raw-x64-nosb.json
@ -5,7 +5,7 @@
    ],
    "mapping": {
        "device": "flash",
-        "mode" : "split",
+        "mode": "split",
        "executable": {
            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.fd",
            "format": "raw"
@ -19,7 +19,6 @@
        {
            "architecture": "x86_64",
            "machines": [
                "pc-i440fx-*",
                "pc-q35-*"
            ]
        }
--- a/50-edk2-riscv-qcow2.json
+++ b/50-edk2-riscv-qcow2.json
@ -1,33 +0,0 @@
 {
    "description": "UEFI firmware for RISC-V virtual machines",
    "interface-types": [
        "uefi"
    ],
    "mapping": {
        "device": "flash",
        "mode" : "split",
        "executable": {
            "filename": "/usr/share/edk2/riscv/RISCV_VIRT_CODE.qcow2",
            "format": "qcow2"
        },
        "nvram-template": {
            "filename": "/usr/share/edk2/riscv/RISCV_VIRT_VARS.qcow2",
            "format": "qcow2"
        }
    },
    "targets": [
        {
            "architecture": "riscv64",
            "machines": [
                "virt",
                "virt-*"
            ]
        }
    ],
    "features": [
    ],
    "tags": [
    ]
 }
--- a/51-edk2-aarch64-raw.json
+++ b/51-edk2-aarch64-raw.json
@ -5,7 +5,7 @@
    ],
    "mapping": {
        "device": "flash",
-        "mode" : "split",
+        "mode": "split",
        "executable": {
            "filename": "/usr/share/edk2/aarch64/QEMU_EFI-silent-pflash.raw",
            "format": "raw"
--- a/52-edk2-aarch64-verbose-qcow2.json
+++ b/52-edk2-aarch64-verbose-qcow2.json
@ -5,7 +5,7 @@
    ],
    "mapping": {
        "device": "flash",
-        "mode" : "split",
+        "mode": "split",
        "executable": {
            "filename": "/usr/share/edk2/aarch64/QEMU_EFI-pflash.qcow2",
            "format": "qcow2"
--- a/53-edk2-aarch64-verbose-raw.json
+++ b/53-edk2-aarch64-verbose-raw.json
@ -5,7 +5,7 @@
    ],
    "mapping": {
        "device": "flash",
-        "mode" : "split",
+        "mode": "split",
        "executable": {
            "filename": "/usr/share/edk2/aarch64/QEMU_EFI-pflash.raw",
            "format": "raw"
--- a/DBXUpdate-20220812.ia32.bin
+++ b/DBXUpdate-20220812.ia32.bin
--- a/DBXUpdate-20220812.x64.bin
+++ b/DBXUpdate-20220812.x64.bin
--- a/DBXUpdate-20230314.ia32.bin
+++ b/DBXUpdate-20230314.ia32.bin
--- a/DBXUpdate-20230314.x64.bin
+++ b/DBXUpdate-20230314.x64.bin
--- a/DBXUpdate-20230509.ia32.bin
+++ b/DBXUpdate-20230509.ia32.bin
--- a/DBXUpdate-20230509.x64.bin
+++ b/DBXUpdate-20230509.x64.bin
--- a/README.experimental
+++ b/README.experimental
@ -1,36 +0,0 @@
 experimental edk2 builds
 ------------------------
 OVMF.stateless.fd
 OVMF.stateless.secboot.fd
 OVMF.stateless.secboot.pcr
  Stateless (== no persistent uefi variables) ovmf build.  Has secure
  boot support, the 'secboot' variant has secure boot enabled.  Does
  not require SMM support.
 OVMF_CODE.4m.secboot.strictnx.fd
  OVMF build with strict NX configuration (using r-x for code, rw- for
  data).  Known to not work with some grub and linux kernel versions
  because they use the wrong memory type for allocations and run into
  NX faults.  Useful for bootloader development and CI.
 QEMU_EFI.strictnx.fd
 QEMU_EFI-strictnx-pflash.raw
  ArmVirt build with strict NX configuration (see above for details).
 QEMU_EFI.secboot.testonly.fd
 QEMU_EFI-secboot-testonly-pflash.raw
 vars-template-secboot-testonly-pflash.raw
  ArmVirt build with secure boot support.
  Exposes the secure boot APIs, so they can be used for development /
  testing / CI.
  The EFI variable store is NOT protected, therefore the build is NOT
  suitable for production use.
--- a/369
+++ b/369
@ -1,369 +0,0 @@
 * Thu Apr 27 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-4
 - fix tpm detection.
 * Thu Apr 13 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-2
 - add StandaloneMM and ArmVirtQemuKernel builds.
 - add json files for qcow2 images.
 - update dbx files to 2023-03.
 * Mon Mar 06 2023 Gerd Hoffmann <kraxel@redhat.com> - 20230301gitf80f052277c8-1
 - update to edk2-stable202302
 - update dbx database to 20220812
 - add riscv64 sub-rpm
 * Fri Feb 17 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-14
 - add sub-package with xen build (resolves: rhbz#2170730)
 * Sat Feb 11 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-13
 - update openssl (CVE-2023-0286, CVE-2023-0215, CVE-2022-4450, CVE-2022-4304).
 * Wed Feb 08 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-12
 - cherry-pick aarch64 bugfixes.
 - set firmware build release date.
 - add ext4 sub-package.
 * Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 20221117gitfff6d81270b5-11
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 * Fri Jan 06 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-10
 - add experimental builds with strict nx checking.
 * Mon Jan 02 2023 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-9
 - revert 'make files sparse again' (resolves: rhbz#2155673).
 - pick up compiler + linker flags from rpm
 * Tue Dec 20 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-8
 - make files sparse again
 * Thu Dec 15 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-7
 - backport https://github.com/tianocore/edk2/pull/3770
 * Mon Dec 12 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-6
 - fix ovmf platform config (revert broken commit).
 - show version information in smbios (backport).
 * Mon Dec 05 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-5
 - rename *.json files to be more consistent.
 - build script update
 * Fri Dec 02 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-4
 - apply dbx updates
 * Tue Nov 29 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-3
 - fix build script
 * Mon Nov 28 2022 Gerd Hoffmann <kraxel@redhat.com> - 20221117gitfff6d81270b5-2
 - add workaround for broken grub
 * Tue Sep 20 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220826gitba0e0e4c6a17-1
 - update edk2 to 2022-08 stable tag.
 - update openssl bundle to rhel-8.7 level.
 - add stdvga fix.
 - add 4MB firmware builds.
 * Thu Aug 18 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-5
 - comment out patch #4 (bug 2116534 workaround)
 - comment out patch #12 (bug 2114858 workaround)
 * Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 20220526git16779ede2d36-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 * Fri Jun 10 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-3
 - swap stack fix patch.
 * Wed Jun 08 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-2
 - fix PcdResizeXterm patch.
 - minor specfile cleanup.
 - add 0021-OvmfPkg-Sec-fix-stack-switch.patch
 - Resolves rhbz#2093745
 * Tue May 31 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220526git16779ede2d36-1
 - update to new edk2 stable tag (2022-05), refresh patches.
 - add amdsev and inteltdx builds
 - drop qosb
 * Tue Apr 19 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220221gitb24306f15daa-4
 - switch to virt-firmware for secure boot key enrollment
 - Stop builds on armv7 too (iasl missing).
 * Thu Apr 07 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220221gitb24306f15daa-3
 - Fix TPM build options.
 - Stop builds on i686 (iasl missing).
 - Resolves rhbz#2072827
 * Wed Mar 23 2022 Gerd Hoffmann <kraxel@redhat.com> - 20220221gitb24306f15daa-1
 - Update to edk2-stable202202
 * Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 20211126gitbb1bba3d7767-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 * Mon Dec 6 2021 Gerd Hoffmann <kraxel@redhat.com> - 20211126gitbb1bba3d7767-1
 - Update to edk2-stable202111
 - Resolves rhbz#1978966
 - Resolves rhbz#2026744
 * Mon Dec  6 2021 Daniel P. Berrangé <berrange@redhat.com> - 20210527gite1999b264f1f-5
 - Drop glibc strcmp workaround
 * Mon Nov 29 2021 Daniel P. Berrangé <berrange@redhat.com> - 20210527gite1999b264f1f-4
 - Drop customized splash screen boot logo
 - Temporary workaround for suspected glibc strcmp bug breaking builds in koji
 * Wed Sep  1 2021 Daniel P. Berrangé <berrange@redhat.com> - 20210527gite1999b264f1f-3
 - Fix qemu packaging conditionals for ELN builds
 * Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 20210527gite1999b264f1f-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
 * Tue Jul 20 2021 Cole Robinson <crobinso@redhat.com> - 20210527gite1999b264f1f-1
 - Update to git snapshot
 - Sync with c9s packaging
 * Mon Jun 14 2021 Jiri Kucera <jkucera@redhat.com> - 20200801stable-5
 - Replace genisoimage with xorriso
 * Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 20200801stable-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 * Thu Dec 03 2020 Cole Robinson <aintdiscole@gmail.com> - 20200801stable-3
 - Really fix TPM breakage (bz 1897367)
 * Tue Nov 24 2020 Cole Robinson <aintdiscole@gmail.com> - 20200801stable-2
 - Fix openssl usage, unbreak TPM (bz 1897367)
 * Wed Sep 16 2020 Cole Robinson <crobinso@redhat.com> - 20200801stable-1
 - Update to edk2 stable 202008
 * Sat Sep 12 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 20200201stable-6
 - Tweaks for aarch64/ARMv7 builds
 - Minor cleanups
 * Tue Aug 04 2020 Cole Robinson <aintdiscole@gmail.com> - 20200201stable-5
 - Fix build failures on rawhide
 * Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 20200201stable-4
 - Second attempt - Rebuilt for
  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 * Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 20200201stable-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 * Mon Jul 13 2020 Tom Stellard <tstellar@redhat.com> - 20200201stable-2
 - Use make macros
 - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
 * Mon Apr 13 2020 Cole Robinson <aintdiscole@gmail.com> - 20200201stable-1
 - Update to stable-202002
 * Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 20190501stable-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 * Fri Sep 06 2019 Patrick Uiterwijk <puiterwijk@redhat.com> - 20190501stable-4
 - Updated HTTP_BOOT option to new upstream value
 * Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 20190501stable-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 * Mon Jul 15 2019 Cole Robinson <aintdiscole@gmail.com> - 20190501stable-2
 - License is now BSD-2-Clause-Patent
 - Re-enable secureboot enrollment
 - Use qemu-ovmf-secureboot from git
 * Thu Jul 11 2019 Cole Robinson <crobinso@redhat.com> - 20190501stable-1
 - Update to stable-201905
 - Update to openssl-1.1.1b
 - Ship VARS file for ovmf-ia32 (bug 1688596)
 - Ship Fedora-variant JSON "firmware descriptor files"
 - Resolves rhbz#1728652
 * Mon Mar 18 2019 Cole Robinson <aintdiscole@gmail.com> - 20190308stable-1
 - Use YYYYMMDD versioning to fix upgrade path
 * Fri Mar 15 2019 Cole Robinson <aintdiscole@gmail.com> - 201903stable-1
 - Update to stable-201903
 - Update to openssl-1.1.0j
 - Move to python3 deps
 * Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 20180815gitcb5f4f45ce-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 * Wed Nov 14 2018 Patrick Uiterwijk <puiterwijk@redhat.com> - 20180815gitcb5f4f45ce-5
 - Add -qosb dependency on python3
 * Fri Nov 9 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180815gitcb5f4f45ce-4
 - Fix network boot via grub (bz 1648476)
 * Wed Sep 12 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180815gitcb5f4f45ce-3
 - Explicitly compile the scripts using py_byte_compile
 * Fri Aug 31 2018 Cole Robinson <crobinso@redhat.com> - 20180815gitcb5f4f45ce-2
 - Fix passing through RPM build flags (bz 1540244)
 * Tue Aug 21 2018 Cole Robinson <crobinso@redhat.com> - 20180815gitcb5f4f45ce-1
 - Update to edk2 git cb5f4f45ce, edk2-stable201808
 - Update to qemu-ovmf-secureboot-1.1.3
 - Enable TPM2 support
 * Mon Jul 23 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-5
 - Fixes for AMD SEV on OVMF_CODE.fd
 - Add Provides for bundled OpenSSL
 * Wed Jul 18 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-4
 - Enable IPv6
 * Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 20180529gitee3198e672e2-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 * Wed Jun 20 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-2
 - Backport two bug fixes from RHEL: connect again virtio-rng devices, and
  connect consoles unconditionally in OVMF (ARM firmware already did it)
 * Tue May 29 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-1
 - Rebase to ee3198e672e2
 * Tue May 01 2018 Cole Robinson <crobinso@redhat.com> - 20171011git92d07e4-7
 - Bump release for new build
 * Fri Mar 30 2018 Patrick Uiterwijk <puiterwijk@redhat.com> - 20171011git92d07e4-6
 - Add qemu-ovmf-secureboot (qosb)
 - Generate pre-enrolled Secure Boot OVMF VARS files
 * Wed Mar 07 2018 Paolo Bonzini <pbonzini@redhat.com> - 20171011git92d07e4-5
 - Fix GCC 8 compilation
 - Replace dosfstools and mtools with qemu-img vvfat
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 20171011git92d07e4-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
 * Fri Jan 19 2018 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-3
 - Add OpenSSL patches from Fedora
 - Enable TLS_MODE
 * Fri Nov 17 2017 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-2
 - Backport patches 19-21 from RHEL
 - Add patches 22-24 to fix SEV slowness
 - Add fedora conditionals
 * Tue Nov 14 2017 Paolo Bonzini <pbonzini@redhat.com> - 20171011git92d07e4-1
 - Import source and patches from RHEL version
 - Update OpenSSL to 1.1.0e
 - Refresh 0099-Tweak-the-tools_def-to-support-cross-compiling.patch
 * Mon Nov 13 2017 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-6
 - Allow non-cross builds
 - Install /usr/share/OVMF and /usr/share/AAVMF
 * Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20170209git296153c5-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
 * Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20170209git296153c5-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
 * Wed Mar 15 2017 Cole Robinson <crobinso@redhat.com> - 20170209git296153c5-3
 - Ship ovmf-ia32 package (bz 1424722)
 * Thu Feb 16 2017 Cole Robinson <crobinso@redhat.com> - 20170209git296153c5-2
 - Update EnrollDefaultKeys patch (bz #1398743)
 * Mon Feb 13 2017 Paolo Bonzini <pbonzini@redhat.com> - 20170209git296153c5-1
 - Rebase to git master
 - New patch 0010 fixes failure to build from source.
 * Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 20161105git3b25ca8-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 * Sun Nov 06 2016 Cole Robinson <crobinso@redhat.com> - 20161105git3b25ca8-1
 - Rebase to git master
 * Fri Sep  9 2016 Tom Callaway <spot@fedoraproject.org> - 20160418gita8c39ba-5
 - replace legally problematic openssl source with "hobbled" tarball
 * Thu Jul 21 2016 Gerd Hoffmann <kraxel@redhat.com> - 20160418gita8c39ba-4
 - Also build for armv7.
 * Tue Jul 19 2016 Gerd Hoffmann <kraxel@redhat.com> 20160418gita8c39ba-3
 - Update EnrollDefaultKeys patch.
 * Fri Jul 8 2016 Paolo Bonzini <pbonzini@redhat.com> - 20160418gita8c39ba-2
 - Distribute edk2-ovmf on aarch64
 * Sat May 21 2016 Cole Robinson <crobinso@redhat.com> - 20160418gita8c39ba-1
 - Distribute edk2-aarch64 on x86 (bz #1338027)
 * Mon Apr 18 2016 Gerd Hoffmann <kraxel@redhat.com> 20160418gita8c39ba-0
 - Update to latest git.
 - Add firmware builds (FatPkg is free now).
 * Mon Feb 15 2016 Cole Robinson <crobinso@redhat.com> 20151127svn18975-3
 - Fix FTBFS gcc warning (bz 1307439)
 * Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 20151127svn18975-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
 * Fri Nov 27 2015 Paolo Bonzini <pbonzini@redhat.com> - 20151127svn18975-1
 - Rebase to 20151127svn18975-1
 - Linker script renamed to GccBase.lds
 * Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20150519svn17469-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
 * Tue May 19 2015 Paolo Bonzini <pbonzini@redhat.com> - 20150519svn17469-1
 - Rebase to 20150519svn17469-1
 - edk2-remove-tree-check.patch now upstream
 * Sat May 02 2015 Kalev Lember <kalevlember@gmail.com> - 20140724svn2670-6
 - Rebuilt for GCC 5 C++11 ABI change
 * Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20140724svn2670-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
 * Thu Jul 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140724svn2670-1
 - Rebase to 20140724svn2670-1
 * Tue Jun 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140624svn2649-1
 - Use standalone .tar.xz from buildtools repo
 * Tue Jun 24 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140328svn15376-4
 - Install BuildTools/BaseEnv
 * Mon Jun 23 2014 Paolo Bonzini <pbonzini@redhat.com> - 20140328svn15376-3
 - Rebase to get GCC48 configuration
 - Package EDK_TOOLS_PATH as /usr/share/edk2
 - Package "build" and LzmaF86Compress too, as well as the new
  tools Ecc and TianoCompress.
 * Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20131114svn14844-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
 * Thu Nov 14 2013 Paolo Bonzini <pbonzini@redhat.com> - 20131114svn14844-1
 - Upgrade to r14844.
 - Remove upstreamed parts of patch 1.
 * Fri Nov 8 2013 Paolo Bonzini <pbonzini@redhat.com> - 20130515svn14365-7
 - Make BaseTools compile on ARM.
 * Fri Aug 30 2013 Paolo Bonzini <pbonzini@redhat.com> - 20130515svn14365-6
 - Revert previous change; firmware packages should be noarch, and building
  BaseTools twice is simply wrong.
 * Mon Aug 19 2013 Kay Sievers <kay@redhat.com> - 20130515svn14365-5
 - Add sub-package with EFI shell
 * Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20130515svn14365-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
 * Thu May 23 2013 Dan Horák <dan[at]danny.cz> 20130515svn14365-3
 - set ExclusiveArch
 * Thu May 16 2013 Paolo Bonzini <pbonzini@redhat.com> 20130515svn14365-2
 - Fix edk2-tools-python Requires
 * Wed May 15 2013 Paolo Bonzini <pbonzini@redhat.com> 20130515svn14365-1
 - Split edk2-tools-doc and edk2-tools-python
 - Fix Python BuildRequires
 - Remove FatBinPkg at package creation time.
 - Use fully versioned dependency.
 - Add comment on how to generate the sources.
 * Thu May 2 2013 Paolo Bonzini <pbonzini@redhat.com> 20130502.g732d199-1
 - Create.
--- a/edk2-build.fedora
+++ b/edk2-build.fedora
@ -1,312 +0,0 @@
 [opts.ovmf.common]
 NETWORK_HTTP_BOOT_ENABLE = TRUE
 NETWORK_IP6_ENABLE       = TRUE
 NETWORK_TLS_ENABLE       = TRUE
 NETWORK_ISCSI_ENABLE     = TRUE
 NETWORK_ALLOW_HTTP_CONNECTIONS = TRUE
 TPM2_ENABLE              = TRUE
 TPM2_CONFIG_ENABLE       = TRUE
 TPM1_ENABLE              = TRUE
 CAVIUM_ERRATUM_27456     = TRUE
 [opts.ovmf.4m]
 FD_SIZE_4MB              = TRUE
 [opts.ovmf.2m]
 FD_SIZE_2MB              = TRUE
 NETWORK_ISCSI_ENABLE     = FALSE
 NETWORK_TLS_ENABLE       = FALSE
 [opts.ovmf.sb.smm]
 SECURE_BOOT_ENABLE       = TRUE
 SMM_REQUIRE              = TRUE
 # old downstream
 EXCLUDE_SHELL_FROM_FD    = TRUE
 # new upstream
 BUILD_SHELL              = FALSE
 # requires edk2 2022-11 or newer
 [opts.ovmf.sb.stateless]
 SECURE_BOOT_ENABLE       = TRUE
 SMM_REQUIRE              = FALSE
 [opts.armvirt.verbose]
 DEBUG_PRINT_ERROR_LEVEL  = 0x8040004F
 [opts.armvirt.silent]
 DEBUG_PRINT_ERROR_LEVEL  = 0x80000000
 [opts.armvirt.sb.testonly]
 SECURE_BOOT_ENABLE       = TRUE
 [opts.armvirt.kernel]
 TPM2_ENABLE              = FALSE
 TPM2_CONFIG_ENABLE       = FALSE
 [pcds.nx.strict]
 PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD5
 PcdImageProtectionPolicy       = 0x03
 PcdSetNxForStack               = TRUE
 # Default is FALSE, so there no need to actually set it.
 #PcdUninstallMemAttrProtocol    = FALSE
 [pcds.nx.broken.shim.grub]
 # grub.efi uses EfiLoaderData for code
 PcdDxeNxMemoryProtectionPolicy = 0xC000000000007FD1
 # shim.efi has broken MemAttr code
 PcdUninstallMemAttrProtocol    = TRUE
 #####################################################################
 # stateful ovmf builds (with vars in flash)
 [build.ovmf.2m.default]
 desc = ovmf build (64-bit, 2MB)
 conf = OvmfPkg/OvmfPkgX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.2m
 plat = OvmfX64
 dest = Fedora/ovmf
 cpy1 = FV/OVMF_CODE.fd
 cpy2 = FV/OVMF_VARS.fd
 cpy3 = X64/Shell.efi
 [build.ovmf.4m.default]
 desc = ovmf build (64-bit, 4MB)
 conf = OvmfPkg/OvmfPkgX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.4m
 plat = OvmfX64
 dest = Fedora/ovmf
 cpy1 = FV/OVMF_CODE.fd OVMF_CODE_4M.fd
 cpy2 = FV/OVMF_VARS.fd OVMF_VARS_4M.fd
 [build.ovmf.2m.sb.smm]
 desc = ovmf build (64-bit, 2MB, q35 only, needs smm, secure boot)
 conf = OvmfPkg/OvmfPkgX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.2m
       ovmf.sb.smm
 plat = OvmfX64
 dest = Fedora/ovmf
 cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
 cpy2 = X64/EnrollDefaultKeys.efi
 [build.ovmf.4m.sb.smm]
 desc = ovmf build (64-bit, 4MB, q35 only, needs smm, secure boot)
 conf = OvmfPkg/OvmfPkgX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.4m
       ovmf.sb.smm
 plat = OvmfX64
 dest = Fedora/ovmf
 cpy1 = FV/OVMF_CODE.fd OVMF_CODE_4M.secboot.fd
 #####################################################################
 # stateless ovmf builds (firmware in rom or r/o flash)
 [build.ovmf.microvm]
 desc = ovmf build for qemu microvm (2MB)
 conf = OvmfPkg/Microvm/MicrovmX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.2m
 plat = MicrovmX64
 dest = Fedora/ovmf
 cpy1 = FV/MICROVM.fd
 [build.ovmf.xen]
 desc = ovmf build for Xen
 conf = OvmfPkg/OvmfXen.dsc
 arch = X64
 opts = ovmf.common
       ovmf.2m
 plat = OvmfXen
 dest = Fedora/xen
 cpy1 = FV/OVMF.fd
 [build.ovmf.amdsev]
 desc = ovmf build for AmdSev (2MB)
 conf = OvmfPkg/AmdSev/AmdSevX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.2m
 plat = AmdSev
 dest = Fedora/ovmf
 cpy1 = FV/OVMF.fd OVMF.amdsev.fd
 [build.ovmf.inteltdx]
 desc = ovmf build for IntelTdx (2MB)
 conf = OvmfPkg/IntelTdx/IntelTdxX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.2m
       ovmf.sb.stateless
 plat = IntelTdx
 dest = Fedora/ovmf
 cpy1 = FV/OVMF.fd OVMF.inteltdx.fd
 #####################################################################
 # armvirt builds
 [build.armvirt.aa64.verbose]
 desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
 conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = AARCH64
 opts = ovmf.common
       armvirt.verbose
 pcds = nx.broken.shim.grub
 plat = ArmVirtQemu-AARCH64
 dest = Fedora/aarch64
 cpy1 = FV/QEMU_EFI.fd
 cpy2 = FV/QEMU_VARS.fd
 cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
 cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
 pad3 = QEMU_EFI-pflash.raw      64m
 pad4 = vars-template-pflash.raw 64m
 [build.armvirt.aa64.silent]
 desc = ArmVirt build for qemu, 64-bit (arm v8), silent
 conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = AARCH64
 opts = ovmf.common
       armvirt.silent
 pcds = nx.broken.shim.grub
 plat = ArmVirtQemu-AARCH64
 dest = Fedora/aarch64
 cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.silent.fd
 cpy2 = FV/QEMU_EFI.fd  QEMU_EFI-silent-pflash.raw
 pad2 = QEMU_EFI-silent-pflash.raw 64m
 [build.armvirt.aa64.kernel]
 desc = ArmVirt build for qemu, 64-bit (arm v8)
 conf = ArmVirtPkg/ArmVirtQemuKernel.dsc
 arch = AARCH64
 opts = ovmf.common
       armvirt.silent
       armvirt.kernel
 pcds = nx.broken.shim.grub
 plat = ArmVirtQemuKernel-AARCH64
 dest = Fedora/aarch64
 cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.kernel.fd
 #####################################################################
 # riscv
 [build.riscv.qemu]
 conf = OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc
 arch = RISCV64
 plat = RiscVVirtQemu
 dest = Fedora/riscv
 cpy1 = FV/RISCV_VIRT_CODE.fd
 cpy2 = FV/RISCV_VIRT_CODE.fd RISCV_VIRT_CODE.raw
 cpy3 = FV/RISCV_VIRT_VARS.fd
 cpy4 = FV/RISCV_VIRT_VARS.fd RISCV_VIRT_VARS.raw
 pad1 = RISCV_VIRT_CODE.raw 32m
 pad2 = RISCV_VIRT_VARS.raw 32m
 #####################################################################
 # 32-bit builds
 [build.ovmf.ia32.default]
 desc = ovmf build (32-bit, 2MB)
 conf = OvmfPkg/OvmfPkgIa32.dsc
 arch = IA32
 opts = ovmf.common
       ovmf.2m
 plat = OvmfIa32
 dest = Fedora/ovmf-ia32
 cpy1 = FV/OVMF_CODE.fd
 cpy2 = FV/OVMF_VARS.fd
 cpy3 = IA32/Shell.efi
 [build.ovmf.ia32.sb.smm]
 desc = ovmf build (32-bit, 2MB, q35 only, needs smm, secure boot)
 conf = OvmfPkg/OvmfPkgIa32.dsc
 arch = IA32
 opts = ovmf.common
       ovmf.2m
       ovmf.sb.smm
 plat = OvmfIa32
 dest = Fedora/ovmf-ia32
 cpy1 = FV/OVMF_CODE.fd OVMF_CODE.secboot.fd
 cpy2 = IA32/EnrollDefaultKeys.efi
 [build.armvirt.arm]
 desc = ArmVirt build for qemu, 32-bit (arm v7)
 conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = ARM
 opts = ovmf.common
 pcds = nx.broken.shim.grub
 plat = ArmVirtQemu-ARM
 dest = Fedora/arm
 cpy1 = FV/QEMU_EFI.fd
 cpy2 = FV/QEMU_VARS.fd
 cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-pflash.raw
 cpy4 = FV/QEMU_VARS.fd vars-template-pflash.raw
 pad3 = QEMU_EFI-pflash.raw      64m
 pad4 = vars-template-pflash.raw 64m
 #####################################################################
 # experimental builds
 [build.ovmf.sb.stateless]
 desc = ovmf build (64-bit, stateless secure boot)
 conf = OvmfPkg/OvmfPkgX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.4m
       ovmf.sb.stateless
 plat = OvmfX64
 dest = Fedora/experimental
 cpy1 = FV/OVMF.fd OVMF.stateless.fd
 [build.ovmf.strict.nx]
 desc = ovmf build (64-bit, 4MB, q35 only, needs smm, secure boot, strict nx)
 conf = OvmfPkg/OvmfPkgX64.dsc
 arch = X64
 opts = ovmf.common
       ovmf.4m
       ovmf.sb.smm
 pcds = nx.strict
 plat = OvmfX64
 dest = Fedora/experimental
 cpy1 = FV/OVMF_CODE.fd OVMF_CODE_4M.secboot.strictnx.fd
 [build.armvirt.aa64.strict.nx]
 desc = ArmVirt build for qemu, 64-bit (arm v8), verbose
 conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = AARCH64
 opts = ovmf.common
       armvirt.verbose
 pcds = nx.strict
 plat = ArmVirtQemu-AARCH64
 dest = Fedora/experimental
 cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.strictnx.fd
 cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-strictnx-pflash.raw
 pad3 = QEMU_EFI-strictnx-pflash.raw  64m
 [build.armvirt.aa64.secboot.testonly]
 desc = ArmVirt build for qemu, 64-bit (arm v8), secure boot
 conf = ArmVirtPkg/ArmVirtQemu.dsc
 arch = AARCH64
 opts = ovmf.common
       armvirt.verbose
       armvirt.sb.testonly
 pcds = nx.strict
 plat = ArmVirtQemu-AARCH64
 dest = Fedora/experimental
 cpy1 = FV/QEMU_EFI.fd  QEMU_EFI.secboot.testonly.fd
 cpy3 = FV/QEMU_EFI.fd  QEMU_EFI-secboot-testonly-pflash.raw
 pad3 = QEMU_EFI-secboot-testonly-pflash.raw  64m
--- a/edk2-build.fedora.platforms
+++ b/edk2-build.fedora.platforms
@ -1,47 +0,0 @@
 #####################################################################
 # ext4 driver
 [build.ext4.x64]
 desc = ext4 driver
 conf = Features/Ext4Pkg/Ext4Pkg.dsc
 arch = X64
 plat = Ext4Pkg
 dest = Fedora/drivers
 cpy1 = X64/Ext4Dxe.efi ext4x64.efi
 [build.ext4.aa64]
 desc = ext4 driver
 conf = Features/Ext4Pkg/Ext4Pkg.dsc
 arch = AARCH64
 plat = Ext4Pkg
 dest = Fedora/drivers
 cpy1 = AARCH64/Ext4Dxe.efi ext4aa64.efi
 [build.ext4.riscv64]
 desc = ext4 driver
 conf = Features/Ext4Pkg/Ext4Pkg.dsc
 arch = RISCV64
 plat = Ext4Pkg
 dest = Fedora/drivers
 cpy1 = RISCV64/Ext4Dxe.efi ext4riscv64.efi
 #####################################################################
 # arm standalone mm
 [build.standalone.mm.aa64]
 conf = Platform/StandaloneMm/PlatformStandaloneMmPkg/PlatformStandaloneMmRpmb.dsc
 arch = AARCH64
 plat = MmStandaloneRpmb
 dest = Fedora/aarch64
 cpy1 = FV/BL32_AP_MM.fd
 #####################################################################
 # loongarch builds
 [build.loongarch]
 desc = Loongarch build
 conf = Platform/Loongson/LoongArchQemuPkg/Loongson.dsc
 arch = LOONGARCH64
--- a/edk2.spec
+++ b/edk2.spec
@ -1,29 +1,15 @@
-# https://fedoraproject.org/wiki/Changes/SetBuildFlagsBuildCheck
+ExclusiveArch: x86_64 aarch64
 # breaks cross-building
 %undefine _auto_set_build_flags
-# actual firmware builds support cross-compiling.  edk2-tools
+# edk2-stable202402
-# in theory should build everywhere without much trouble, but
+%define GITDATE        20240214
-# in practice the edk2 build system barfs on archs it doesn't know
+%define GITCOMMIT      edc6681206
 # (such as ppc), so lets limit things to the known-good ones.
 ExclusiveArch: x86_64 aarch64 riscv64
 # edk2-stable202308
 %define GITDATE        20231122
 %define GITCOMMIT      8736b8fdca85
 %define TOOLCHAIN      GCC
 %define PLATFORMS_COMMIT 10e2eb030de3
 %define OPENSSL_VER    3.0.7
-%define OPENSSL_COMMIT db0287935122edceb91dcda8dfb53b4090734e22
+%define OPENSSL_HASH   db0287935122edceb91dcda8dfb53b4090734e22
 %define DBXDATE        20230509
 # Undefine this to get *HUGE* (50MB+) verbose build logs
 %define silent --silent
 %if %{defined rhel}
 %define build_ovmf 0
 %define build_aarch64 0
 %ifarch x86_64
@ -32,36 +18,21 @@ ExclusiveArch: x86_64 aarch64 riscv64
 %ifarch aarch64
  %define build_aarch64 1
 %endif
 %define build_riscv64 0
 %else
 %define build_ovmf 1
 %define build_aarch64 1
 %define build_riscv64 1
 %endif
 %global softfloat_version 20180726-gitb64af41
 %define cross %{defined fedora}
 %define disable_werror %{defined fedora}
 Name:       edk2
 Version:    %{GITDATE}
-Release:    %autorelease
+Release:    1%{?dist}
 Summary:    UEFI firmware for 64-bit virtual machines
-License:    Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND BSD-3-Clause AND BSD-4-Clause AND ISC AND MIT AND LicenseRef-Fedora-Public-Domain
+License:    BSD-2-Clause-Patent and Apache-2.0 and MIT
 URL:        http://www.tianocore.org
 # The source tarball is created using following commands:
-# COMMIT=bb1bba3d7767
+# COMMIT=ba91d0292e
 # git archive --format=tar --prefix=edk2-$COMMIT/ $COMMIT \
 # | xz -9ev >/tmp/edk2-$COMMIT.tar.xz
 Source0: edk2-%{GITCOMMIT}.tar.xz
 Source1: ovmf-whitepaper-c770f8c.txt
-Source2: openssl-rhel-%{OPENSSL_COMMIT}.tar.xz
+Source2: openssl-rhel-%{OPENSSL_HASH}.tar.xz
 Source3: softfloat-%{softfloat_version}.tar.xz
 Source4: edk2-platforms-%{PLATFORMS_COMMIT}.tar.xz
 Source5: jansson-2.13.1.tar.bz2
 Source6: README.experimental
 # json description files
 Source10: 50-edk2-aarch64-qcow2.json
@ -69,54 +40,48 @@ Source11: 51-edk2-aarch64-raw.json
 Source12: 52-edk2-aarch64-verbose-qcow2.json
 Source13: 53-edk2-aarch64-verbose-raw.json
-Source20: 50-edk2-arm-verbose.json
+Source40: 30-edk2-ovmf-x64-sb-enrolled.json
-
+Source41: 40-edk2-ovmf-x64-sb.json
-Source30: 30-edk2-ovmf-ia32-sb-enrolled.json
+Source43: 50-edk2-ovmf-x64-nosb.json
-Source31: 40-edk2-ovmf-ia32-sb.json
+Source44: 60-edk2-ovmf-x64-amdsev.json
-Source32: 50-edk2-ovmf-ia32-nosb.json
+Source45: 60-edk2-ovmf-x64-inteltdx.json
 Source40: 30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json
 Source41: 31-edk2-ovmf-2m-raw-x64-sb-enrolled.json
 Source42: 40-edk2-ovmf-4m-qcow2-x64-sb.json
 Source43: 41-edk2-ovmf-2m-raw-x64-sb.json
 Source44: 50-edk2-ovmf-x64-microvm.json
 Source45: 50-edk2-ovmf-4m-qcow2-x64-nosb.json
 Source46: 51-edk2-ovmf-2m-raw-x64-nosb.json
 Source47: 60-edk2-ovmf-x64-amdsev.json
 Source48: 60-edk2-ovmf-x64-inteltdx.json
 Source50: 50-edk2-riscv-qcow2.json
 # https://gitlab.com/kraxel/edk2-build-config
 Source80: edk2-build.py
-Source81: edk2-build.fedora
+Source82: edk2-build.rhel-9
 Source82: edk2-build.fedora.platforms
 Source83: edk2-build.rhel-9
 Source90: DBXUpdate-%{DBXDATE}.x64.bin
-Source91: DBXUpdate-%{DBXDATE}.ia32.bin
+Patch1: 0003-Remove-paths-leading-to-submodules.patch
-
+Patch2: 0004-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
-Patch0001: 0001-BaseTools-do-not-build-BrotliCompress-RH-only.patch
+Patch3: 0005-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
-Patch0002: 0002-MdeModulePkg-remove-package-private-Brotli-include-p.patch
+Patch4: 0006-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
-Patch0003: 0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch
+Patch5: 0007-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
-Patch0004: 0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch
+Patch6: 0008-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
-Patch0005: 0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch
+Patch7: 0009-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
-Patch0006: 0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch
+Patch8: 0010-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
-Patch0007: 0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch
+Patch9: 0011-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
-Patch0008: 0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch
+Patch10: 0012-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
-Patch0009: 0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch
+Patch11: 0013-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
-Patch0010: 0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch
+Patch12: 0014-OvmfPkg-Remove-EbcDxe-RHEL-only.patch
-Patch0011: 0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch
+Patch13: 0015-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch
-Patch0012: 0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch
+Patch14: 0016-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch
-Patch0013: 0013-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
+Patch15: 0017-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch
-Patch0015: 0015-CryptoPkg-CrtLib-add-stat.h.patch
+Patch16: 0018-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
-Patch0016: 0016-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch
+Patch17: 0019-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch
-Patch0017: 0017-OvmfPkg-set-PcdVariableStoreSize-PcdMaxVolatileVaria.patch
+Patch18: 0020-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch
-%if 0%{?fedora} >= 38 || 0%{?rhel} >= 10
+Patch19: 0021-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch
-Patch0018: 0018-silence-.-has-a-LOAD-segment-with-RWX-permissions-wa.patch
+Patch20: 0022-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch
-%endif
+Patch21: 0023-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch
-Patch0019: 0019-ArmVirt-Allow-memory-attributes-protocol-to-be-disab.patch
+Patch22: 0024-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch
-
+Patch23: 0025-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch
 Patch24: 0026-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
 Patch25: 0027-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
 Patch26: 0028-CryptoPkg-CrtLib-add-stat.h-include-file.patch
 Patch27: 0029-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch
 Patch28: 0030-OvmfPkg-Sec-Setup-MTRR-early-in-the-boot-process.patch
 Patch29: 0031-MdePkg-ArchitecturalMsr.h-add-defines-for-MTRR-cache.patch
 Patch30: 0032-UefiCpuPkg-MtrrLib.h-use-cache-type-defines-from-Arc.patch
 Patch31: 0033-OvmfPkg-Sec-use-cache-type-defines-from-Architectura.patch
 # python3-devel and libuuid-devel are required for building tools.
 # python3-devel is also needed for varstore template generation and
@ -125,15 +90,9 @@ BuildRequires:  python3-devel
 BuildRequires:  libuuid-devel
 BuildRequires:  /usr/bin/iasl
 BuildRequires:  binutils gcc git gcc-c++ make
 BuildRequires:  perl perl(JSON)
 BuildRequires:  qemu-img
 # openssl configure
 BuildRequires:  perl(FindBin)
 BuildRequires:  perl(IPC::Cmd)
 BuildRequires:  perl(File::Compare)
 BuildRequires:  perl(File::Copy)
 BuildRequires:  perl(JSON)
 %if %{build_ovmf}
 # Only OVMF includes 80x86 assembly files (*.nasm*).
 BuildRequires:  nasm
@ -144,21 +103,12 @@ BuildRequires:  dosfstools
 BuildRequires:  mtools
 BuildRequires:  xorriso
-# For generating the variable store template with the default certificates
+# secure boot enrollment
-# enrolled.
+BuildRequires:  python3dist(virt-firmware) >= 23.4
 BuildRequires:  python3-virt-firmware >= 23.5
 # endif build_ovmf
 %endif
 %if %{cross}
 BuildRequires:  gcc-aarch64-linux-gnu
 BuildRequires:  gcc-arm-linux-gnu
 BuildRequires:  gcc-x86_64-linux-gnu
 BuildRequires:  gcc-riscv64-linux-gnu
 %endif
 %package ovmf
 Summary:    UEFI firmware for x86_64 virtual machines
@ -166,13 +116,10 @@ BuildArch:  noarch
 Provides:   OVMF = %{version}-%{release}
 Obsoletes:  OVMF < 20180508-100.gitee3198e672e2.el7
 # need libvirt version with qcow2 support
 Conflicts:  libvirt-daemon-driver-qemu < 9.7.0
 # OVMF includes the Secure Boot and IPv6 features; it has a builtin OpenSSL
 # library.
 Provides:   bundled(openssl) = %{OPENSSL_VER}
-License:    Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND BSD-4-Clause AND ISC AND LicenseRef-Fedora-Public-Domain
+License:    BSD-2-Clause-Patent and Apache-2.0
 # URL taken from the Maintainers.txt file.
 URL:        http://www.tianocore.org/ovmf/
@ -190,11 +137,11 @@ Provides:   AAVMF = %{version}-%{release}
 Obsoletes:  AAVMF < 20180508-100.gitee3198e672e2.el7
 # need libvirt version with qcow2 support
-Conflicts:  libvirt-daemon-driver-qemu < 9.7.0
+Conflicts:  libvirt-daemon-driver-qemu < 9.2.0
 # No Secure Boot for AAVMF yet, but we include OpenSSL for the IPv6 stack.
 Provides:   bundled(openssl) = %{OPENSSL_VER}
-License:    Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND BSD-4-Clause AND ISC AND LicenseRef-Fedora-Public-Domain
+License:    BSD-2-Clause-Patent and Apache-2.0
 # URL taken from the Maintainers.txt file.
 URL:        https://github.com/tianocore/tianocore.github.io/wiki/ArmVirtPkg
@ -207,7 +154,7 @@ package contains a 64-bit build.
 %package tools
 Summary:        EFI Development Kit II Tools
-License:        BSD-2-Clause-Patent AND LicenseRef-Fedora-Public-Domain
+License:        BSD-2-Clause-Patent
 URL:            https://github.com/tianocore/tianocore.github.io/wiki/BaseTools
 %description tools
 This package provides tools that are needed to
@ -227,78 +174,6 @@ EDK II is a modern, feature-rich, cross-platform firmware development
 environment for the UEFI and PI specifications. This package contains sample
 64-bit UEFI firmware builds for QEMU and KVM.
 %if %{defined fedora}
 %package ovmf-ia32
 Summary:        Open Virtual Machine Firmware
 License:        Apache-2.0 AND BSD-2-Clause-Patent AND BSD-4-Clause AND ISC AND LicenseRef-Fedora-Public-Domain
 Provides:       bundled(openssl)
 BuildArch:      noarch
 %description ovmf-ia32
 EFI Development Kit II
 Open Virtual Machine Firmware (ia32)
 %package ovmf-xen
 Summary:        Open Virtual Machine Firmware, Xen build
 License:        Apache-2.0 AND BSD-2-Clause-Patent AND BSD-4-Clause AND ISC AND LicenseRef-Fedora-Public-Domain
 Provides:       bundled(openssl)
 BuildArch:      noarch
 %description ovmf-xen
 EFI Development Kit II
 Open Virtual Machine Firmware (Xen build)
 %package experimental
 Summary:        Open Virtual Machine Firmware, experimental builds
 License:        Apache-2.0 AND BSD-2-Clause-Patent AND BSD-4-Clause AND ISC AND LicenseRef-Fedora-Public-Domain
 Provides:       bundled(openssl)
 Obsoletes:      edk2-ovmf-experimental < 20230825
 BuildArch:      noarch
 %description experimental
 EFI Development Kit II
 Open Virtual Machine Firmware (experimental builds)
 %package arm
 Summary:        ARM Virtual Machine Firmware
 BuildArch:      noarch
 License:        Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND BSD-3-Clause AND BSD-4-Clause AND ISC AND LicenseRef-Fedora-Public-Domain
 %description arm
 EFI Development Kit II
 ARMv7 UEFI Firmware
 %package riscv64
 Summary:        RISC-V Virtual Machine Firmware
 BuildArch:      noarch
 License:        Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND LicenseRef-Fedora-Public-Domain
 # need libvirt version with qcow2 support
 Conflicts:  libvirt-daemon-driver-qemu < 9.7.0
 %description riscv64
 EFI Development Kit II
 RISC-V UEFI Firmware
 %package ext4
 Summary:        Ext4 filesystem driver
 License:        Apache-2.0 AND BSD-2-Clause-Patent
 BuildArch:      noarch
 %description ext4
 EFI Development Kit II
 Ext4 filesystem driver
 %package tools-python
 Summary:        EFI Development Kit II Tools
 Requires:       python3
 BuildArch:      noarch
 %description tools-python
 This package provides tools that are needed to build EFI executables
 and ROMs using the GNU tools.  You do not need to install this package;
 you probably want to install edk2-tools only.
 # endif fedora
 %endif
 %prep
 # We needs some special git config options that %%autosetup won't give us.
 # We init the git dir ourselves, then tell %%autosetup not to blow it away.
@ -311,32 +186,15 @@ git config am.keepcr true
 %autosetup -T -D -n edk2-%{GITCOMMIT} -S git_am
 cp -a -- %{SOURCE1} .
 cp -a -- %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} .
 cp -a -- %{SOURCE40} %{SOURCE41} %{SOURCE43} %{SOURCE44} %{SOURCE45} .
 cp -a -- %{SOURCE80} %{SOURCE82} .
 cp -a -- %{SOURCE90} .
 tar -C CryptoPkg/Library/OpensslLib -a -f %{SOURCE2} -x
 # extract softfloat into place
 tar -xf %{SOURCE3} --strip-components=1 --directory ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3/
 tar -xf %{SOURCE4} --strip-components=1 "*/Drivers" "*/Features" "*/Platform" "*/Silicon"
 tar -xf %{SOURCE5} --strip-components=1 --directory RedfishPkg/Library/JsonLib/jansson
 # include paths pointing to unused submodules
 mkdir -p MdePkg/Library/MipiSysTLib/mipisyst/library/include
 mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include
 mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include/mbedtls
 mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/library
 # Done by %setup, but we do not use it for the auxiliary tarballs
 chmod -Rf a+rX,u+w,g-w,o-w .
 cp -a -- \
   %{SOURCE6} \
   %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} \
   %{SOURCE20} \
   %{SOURCE30} %{SOURCE31} %{SOURCE32} \
   %{SOURCE40} %{SOURCE41} %{SOURCE42} %{SOURCE43} %{SOURCE44} \
   %{SOURCE45} %{SOURCE46} %{SOURCE47} %{SOURCE48} \
   %{SOURCE50} \
   %{SOURCE80} %{SOURCE81} %{SOURCE82} %{SOURCE83} \
   %{SOURCE90} %{SOURCE91} \
   .
 %build
 build_iso() {
@ -380,10 +238,15 @@ export RELEASE_DATE="$(echo %{GITDATE} | sed -e 's|\(....\)\(..\)\(..\)|\2/\3/\1
 touch OvmfPkg/AmdSev/Grub/grub.efi   # dummy
 python3 CryptoPkg/Library/OpensslLib/configure.py
-%if %{build_ovmf}
+# include dirs of unused submodules
-%if %{defined rhel}
+mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include
 mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/include/mbedtls
 mkdir -p CryptoPkg/Library/MbedTlsLib/mbedtls/library
-./edk2-build.py --config edk2-build.rhel-9 %{?silent} --release-date "$RELEASE_DATE" -m ovmf
+%if %{build_ovmf}
 ./edk2-build.py --config edk2-build.rhel-9 -m ovmf --release-date "$RELEASE_DATE"
 build_iso RHEL-9/ovmf
 cp DBXUpdate-%{DBXDATE}.x64.bin RHEL-9/ovmf
 virt-fw-vars --input   RHEL-9/ovmf/OVMF_VARS.fd \
             --output  RHEL-9/ovmf/OVMF_VARS.secboot.fd \
             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
@ -391,93 +254,18 @@ virt-fw-vars --input   RHEL-9/ovmf/OVMF_VARS.fd \
 virt-fw-vars --input   RHEL-9/ovmf/OVMF.inteltdx.fd \
             --output  RHEL-9/ovmf/OVMF.inteltdx.secboot.fd \
             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
             --enroll-redhat --secure-boot
 build_iso RHEL-9/ovmf
 cp DBXUpdate-%{DBXDATE}.x64.bin RHEL-9/ovmf
 %else
 ./edk2-build.py --config edk2-build.fedora %{?silent} --release-date "$RELEASE_DATE" -m ovmf
 ./edk2-build.py --config edk2-build.fedora.platforms %{?silent} -m x64
 virt-fw-vars --input   Fedora/ovmf/OVMF_VARS.fd \
             --output  Fedora/ovmf/OVMF_VARS.secboot.fd \
             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
             --enroll-redhat --secure-boot
 virt-fw-vars --input   Fedora/ovmf/OVMF_VARS_4M.fd \
             --output  Fedora/ovmf/OVMF_VARS_4M.secboot.fd \
             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
             --enroll-redhat --secure-boot
 virt-fw-vars --input   Fedora/ovmf/OVMF.inteltdx.fd \
             --output  Fedora/ovmf/OVMF.inteltdx.secboot.fd \
             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
             --enroll-redhat --secure-boot
 virt-fw-vars --input   Fedora/ovmf-ia32/OVMF_VARS.fd \
             --output  Fedora/ovmf-ia32/OVMF_VARS.secboot.fd \
             --set-dbx DBXUpdate-%{DBXDATE}.ia32.bin \
             --enroll-redhat --secure-boot
 build_iso Fedora/ovmf
 build_iso Fedora/ovmf-ia32
 cp DBXUpdate-%{DBXDATE}.x64.bin Fedora/ovmf
 cp DBXUpdate-%{DBXDATE}.ia32.bin Fedora/ovmf-ia32
 for raw in */{ovmf,experimental}/*_4M*.fd; do
    qcow2="${raw%.fd}.qcow2"
    qemu-img convert -f raw -O qcow2 -o cluster_size=4096 -S 4096 "$raw" "$qcow2"
    rm -f "$raw"
 done
 # experimental stateless builds
 virt-fw-vars --input   Fedora/experimental/OVMF.stateless.fd \
             --output  Fedora/experimental/OVMF.stateless.secboot.fd \
             --set-dbx DBXUpdate-%{DBXDATE}.x64.bin \
             --enroll-redhat --secure-boot \
             --set-fallback-no-reboot
 for image in \
 	Fedora/ovmf/OVMF_CODE.secboot.fd \
 	Fedora/ovmf/OVMF_CODE_4M.secboot.qcow2 \
 	Fedora/experimental/OVMF.stateless.secboot.fd \
 ; do
 	pcr="${image}"
 	pcr="${pcr%.fd}"
 	pcr="${pcr%.qcow2}"
 	pcr="${pcr}.pcr"
 	python3 /usr/share/doc/python3-virt-firmware/experimental/measure.py \
 		--image "$image" \
 		--version "%{name}-%{version}-%{release}" \
                --no-shim \
 		> "$pcr"
 done
 %endif
 %endif
 %if %{build_aarch64}
-%if %{defined rhel}
+./edk2-build.py --config edk2-build.rhel-9 -m armvirt --release-date "$RELEASE_DATE"
 ./edk2-build.py --config edk2-build.rhel-9 %{?silent} --release-date "$RELEASE_DATE" -m armvirt
 %else
 ./edk2-build.py --config edk2-build.fedora %{?silent} --release-date "$RELEASE_DATE" -m armvirt
 ./edk2-build.py --config edk2-build.fedora.platforms %{?silent} -m aa64
 virt-fw-vars --input   Fedora/aarch64/vars-template-pflash.raw \
             --output  Fedora/experimental/vars-template-secboot-testonly-pflash.raw \
             --enroll-redhat --secure-boot --distro-keys rhel
 %endif
 for raw in */aarch64/*.raw; do
    qcow2="${raw%.raw}.qcow2"
    qemu-img convert -f raw -O qcow2 -o cluster_size=4096 -S 4096 "$raw" "$qcow2"
 done
 %endif
 %if %{build_riscv64}
 ./edk2-build.py --config edk2-build.fedora %{?silent} --release-date "$RELEASE_DATE" -m riscv
 ./edk2-build.py --config edk2-build.fedora.platforms %{?silent} -m riscv
 for raw in */riscv/*.raw; do
    qcow2="${raw%.raw}.qcow2"
    qemu-img convert -f raw -O qcow2 -o cluster_size=4096 -S 4096 "$raw" "$qcow2"
    rm -f "$raw"
 done
 %endif
 %install
 cp -a OvmfPkg/License.txt License.OvmfPkg.txt
@ -499,113 +287,50 @@ install BaseTools/Conf/*.template \
 install BaseTools/Scripts/GccBase.lds \
        %{buildroot}%{_datadir}/%{name}/Scripts
 # install firmware images
 mkdir -p %{buildroot}%{_datadir}/%{name}
 %if %{defined rhel}
 cp -av RHEL-9/* %{buildroot}%{_datadir}/%{name}
 %else
 cp -av Fedora/* %{buildroot}%{_datadir}/%{name}
 %endif
 %if %{build_ovmf}
 # compat symlinks
 mkdir -p %{buildroot}%{_datadir}/OVMF
-ln -s ../%{name}/ovmf/OVMF_CODE.fd         %{buildroot}%{_datadir}/OVMF/
+
 ln -s ../%{name}/ovmf/OVMF_CODE.secboot.fd %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/OVMF_VARS.fd         %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/OVMF_VARS.secboot.fd %{buildroot}%{_datadir}/OVMF/
 ln -s ../%{name}/ovmf/UefiShell.iso        %{buildroot}%{_datadir}/OVMF/
 ln -s OVMF_CODE.fd %{buildroot}%{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
 # json description files
 mkdir -p %{buildroot}%{_datadir}/qemu/firmware
 install -m 0644 \
-        30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json \
+        30-edk2-ovmf-x64-sb-enrolled.json \
-        31-edk2-ovmf-2m-raw-x64-sb-enrolled.json \
+        40-edk2-ovmf-x64-sb.json \
-        40-edk2-ovmf-4m-qcow2-x64-sb.json \
+        50-edk2-ovmf-x64-nosb.json \
        41-edk2-ovmf-2m-raw-x64-sb.json \
        50-edk2-ovmf-4m-qcow2-x64-nosb.json \
        51-edk2-ovmf-2m-raw-x64-nosb.json \
        60-edk2-ovmf-x64-amdsev.json \
        60-edk2-ovmf-x64-inteltdx.json \
        %{buildroot}%{_datadir}/qemu/firmware
 %if %{defined fedora}
 install -m 0644 \
        50-edk2-ovmf-x64-microvm.json \
        30-edk2-ovmf-ia32-sb-enrolled.json \
        40-edk2-ovmf-ia32-sb.json \
        50-edk2-ovmf-ia32-nosb.json \
        %{buildroot}%{_datadir}/qemu/firmware
 %endif
 # endif build_ovmf
 %endif
 %if %{build_aarch64}
 # compat symlinks
 mkdir -p %{buildroot}%{_datadir}/AAVMF
 ln -s ../%{name}/aarch64/QEMU_EFI-pflash.raw \
  %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
 ln -s ../%{name}/aarch64/QEMU_EFI-silent-pflash.raw \
  %{buildroot}%{_datadir}/AAVMF/AAVMF_CODE.fd
 ln -s ../%{name}/aarch64/vars-template-pflash.raw \
  %{buildroot}%{_datadir}/AAVMF/AAVMF_VARS.fd
 %if %{defined fedora}
 ln -s ../%{name}/arm/QEMU_EFI-pflash.raw \
   %{buildroot}%{_datadir}/AAVMF/AAVMF32_CODE.fd
 %endif
 # json description files
 install -m 0644 \
        50-edk2-aarch64-qcow2.json \
        51-edk2-aarch64-raw.json \
        52-edk2-aarch64-verbose-qcow2.json \
        53-edk2-aarch64-verbose-raw.json \
        %{buildroot}%{_datadir}/qemu/firmware
 %if %{defined fedora}
 install -m 0644 \
        50-edk2-arm-verbose.json \
        %{buildroot}%{_datadir}/qemu/firmware
 %endif
 # endif build_aarch64
 %endif
 %if %{build_riscv64}
 install -m 0644 \
        50-edk2-riscv-qcow2.json \
        %{buildroot}%{_datadir}/qemu/firmware
 # endif build_riscv64
 %endif
 %if %{defined fedora}
 # edk2-tools-python install
 cp -R BaseTools/Source/Python %{buildroot}%{_datadir}/%{name}/Python
 for i in build BPDG Ecc GenDepex GenFds GenPatchPcdTable PatchPcdValue TargetTool Trim UPT; do
 echo '#!/bin/sh
 export PYTHONPATH=%{_datadir}/%{name}/Python
 exec python3 '%{_datadir}/%{name}/Python/$i/$i.py' "$@"' > %{buildroot}%{_bindir}/$i
  chmod +x %{buildroot}%{_bindir}/$i
 done
 %if 0%{?py_byte_compile:1}
 # https://docs.fedoraproject.org/en-US/packaging-guidelines/Python_Appendix/#manual-bytecompilation
 %py_byte_compile %{python3} %{buildroot}%{_datadir}/edk2/Python
 %endif
 %endif
 %check
 for file in %{buildroot}%{_datadir}/%{name}/*/*VARS.secboot.fd; do
    test -f "$file" || continue
    virt-fw-vars --input $file --print | grep "SecureBootEnable.*ON" || exit 1
 done
 %global common_files \
  %%license License.txt License.OvmfPkg.txt License-History.txt LICENSE.openssl \
@ -619,11 +344,6 @@ done
 %doc OvmfPkg/README
 %doc ovmf-whitepaper-c770f8c.txt
 %dir %{_datadir}/OVMF/
 %{_datadir}/OVMF/OVMF_CODE.fd
 %{_datadir}/OVMF/OVMF_CODE.secboot.fd
 %{_datadir}/OVMF/OVMF_VARS.fd
 %{_datadir}/OVMF/OVMF_VARS.secboot.fd
 %{_datadir}/OVMF/UefiShell.iso
 %dir %{_datadir}/%{name}/ovmf/
 %{_datadir}/%{name}/ovmf/OVMF_CODE.fd
 %{_datadir}/%{name}/ovmf/OVMF_CODE.cc.fd
@ -633,27 +353,19 @@ done
 %{_datadir}/%{name}/ovmf/OVMF.amdsev.fd
 %{_datadir}/%{name}/ovmf/OVMF.inteltdx.fd
 %{_datadir}/%{name}/ovmf/OVMF.inteltdx.secboot.fd
 %{_datadir}/%{name}/ovmf/DBXUpdate*.bin
 %{_datadir}/%{name}/ovmf/UefiShell.iso
 %{_datadir}/OVMF/OVMF_CODE.secboot.fd
 %{_datadir}/OVMF/OVMF_VARS.fd
 %{_datadir}/OVMF/OVMF_VARS.secboot.fd
 %{_datadir}/OVMF/UefiShell.iso
 %{_datadir}/%{name}/ovmf/Shell.efi
 %{_datadir}/%{name}/ovmf/EnrollDefaultKeys.efi
-%{_datadir}/%{name}/ovmf/DBXUpdate*.bin
+%{_datadir}/qemu/firmware/30-edk2-ovmf-x64-sb-enrolled.json
-%{_datadir}/qemu/firmware/30-edk2-ovmf-4m-qcow2-x64-sb-enrolled.json
+%{_datadir}/qemu/firmware/40-edk2-ovmf-x64-sb.json
-%{_datadir}/qemu/firmware/31-edk2-ovmf-2m-raw-x64-sb-enrolled.json
+%{_datadir}/qemu/firmware/50-edk2-ovmf-x64-nosb.json
 %{_datadir}/qemu/firmware/40-edk2-ovmf-4m-qcow2-x64-sb.json
 %{_datadir}/qemu/firmware/41-edk2-ovmf-2m-raw-x64-sb.json
 %{_datadir}/qemu/firmware/50-edk2-ovmf-4m-qcow2-x64-nosb.json
 %{_datadir}/qemu/firmware/51-edk2-ovmf-2m-raw-x64-nosb.json
 %{_datadir}/qemu/firmware/60-edk2-ovmf-x64-amdsev.json
 %{_datadir}/qemu/firmware/60-edk2-ovmf-x64-inteltdx.json
 %if %{defined fedora}
 %{_datadir}/%{name}/ovmf/MICROVM.fd
 %{_datadir}/qemu/firmware/50-edk2-ovmf-x64-microvm.json
 %{_datadir}/%{name}/ovmf/OVMF_CODE_4M.qcow2
 %{_datadir}/%{name}/ovmf/OVMF_CODE_4M.secboot.qcow2
 %{_datadir}/%{name}/ovmf/OVMF_VARS_4M.qcow2
 %{_datadir}/%{name}/ovmf/OVMF_VARS_4M.secboot.qcow2
 %{_datadir}/%{name}/ovmf/*.pcr
 %endif
 # endif build_ovmf
 %endif
@ -661,20 +373,16 @@ done
 %files aarch64
 %common_files
 %dir %{_datadir}/AAVMF/
 %{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
 %{_datadir}/AAVMF/AAVMF_CODE.fd
 %{_datadir}/AAVMF/AAVMF_VARS.fd
 %dir %{_datadir}/%{name}/aarch64/
 %{_datadir}/%{name}/aarch64/QEMU_EFI-pflash.*
 %{_datadir}/%{name}/aarch64/QEMU_EFI-silent-pflash.*
 %{_datadir}/%{name}/aarch64/vars-template-pflash.*
 %{_datadir}/AAVMF/AAVMF_CODE.verbose.fd
 %{_datadir}/AAVMF/AAVMF_CODE.fd
 %{_datadir}/AAVMF/AAVMF_VARS.fd
 %{_datadir}/%{name}/aarch64/QEMU_EFI.fd
 %{_datadir}/%{name}/aarch64/QEMU_EFI.silent.fd
 %{_datadir}/%{name}/aarch64/QEMU_VARS.fd
 %if %{defined fedora}
 %{_datadir}/%{name}/aarch64/BL32_AP_MM.fd
 %{_datadir}/%{name}/aarch64/QEMU_EFI.kernel.fd
 %endif
 %{_datadir}/qemu/firmware/50-edk2-aarch64-qcow2.json
 %{_datadir}/qemu/firmware/51-edk2-aarch64-raw.json
 %{_datadir}/qemu/firmware/52-edk2-aarch64-verbose-qcow2.json
@ -706,78 +414,8 @@ done
 %doc BaseTools/UserManuals/*.rtf
 %if %{defined fedora}
 %if %{build_ovmf}
 %files ovmf-ia32
 %common_files
 %dir %{_datadir}/%{name}/ovmf-ia32
 %{_datadir}/%{name}/ovmf-ia32/EnrollDefaultKeys.efi
 %{_datadir}/%{name}/ovmf-ia32/OVMF_CODE.fd
 %{_datadir}/%{name}/ovmf-ia32/OVMF_CODE.secboot.fd
 %{_datadir}/%{name}/ovmf-ia32/OVMF_VARS.fd
 %{_datadir}/%{name}/ovmf-ia32/OVMF_VARS.secboot.fd
 %{_datadir}/%{name}/ovmf-ia32/Shell.efi
 %{_datadir}/%{name}/ovmf-ia32/UefiShell.iso
 %{_datadir}/%{name}/ovmf-ia32/DBXUpdate*.bin
 %{_datadir}/qemu/firmware/30-edk2-ovmf-ia32-sb-enrolled.json
 %{_datadir}/qemu/firmware/40-edk2-ovmf-ia32-sb.json
 %{_datadir}/qemu/firmware/50-edk2-ovmf-ia32-nosb.json
 %files experimental
 %common_files
 %doc README.experimental
 %dir %{_datadir}/%{name}/experimental
 %{_datadir}/%{name}/experimental/*.fd
 %{_datadir}/%{name}/experimental/*.raw
 %{_datadir}/%{name}/experimental/*.qcow2
 %{_datadir}/%{name}/experimental/*.pcr
 %files ovmf-xen
 %common_files
 %dir %{_datadir}/%{name}/xen
 %{_datadir}/%{name}/xen/*.fd
 %endif
 %files arm
 %common_files
 %dir %{_datadir}/AAVMF/
 %{_datadir}/AAVMF/AAVMF32_CODE.fd
 %dir %{_datadir}/%{name}/arm
 %{_datadir}/%{name}/arm/QEMU_EFI-pflash.raw
 %{_datadir}/%{name}/arm/QEMU_EFI.fd
 %{_datadir}/%{name}/arm/QEMU_VARS.fd
 %{_datadir}/%{name}/arm/vars-template-pflash.raw
 %{_datadir}/qemu/firmware/50-edk2-arm-verbose.json
 %files riscv64
 %common_files
 %{_datadir}/%{name}/riscv/*.fd
 %{_datadir}/%{name}/riscv/*.qcow2
 %{_datadir}/qemu/firmware/50-edk2-riscv-qcow2.json
 %files ext4
 %common_files
 %dir %{_datadir}/%{name}/drivers
 %{_datadir}/%{name}/drivers/ext4*.efi
 %files tools-python
 %{_bindir}/build
 %{_bindir}/BPDG
 %{_bindir}/Ecc
 %{_bindir}/GenDepex
 %{_bindir}/GenFds
 %{_bindir}/GenPatchPcdTable
 %{_bindir}/PatchPcdValue
 %{_bindir}/TargetTool
 %{_bindir}/Trim
 %{_bindir}/UPT
 %dir %{_datadir}/%{name}
 %{_datadir}/%{name}/Python
 # endif fedora
 %endif
 %changelog
-%autochangelog
+* Tue Apr 02 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20240214-1
 - Imported edk2-202402 from RHEL 9
 - Resolves: RHEL-30180
--- a/make-tarball.sh
+++ b/make-tarball.sh
@ -1,24 +0,0 @@
 #!/bin/sh
 # args
 repo="${1%/}"
 ref="${2-HEAD}"
 ab="${3-12}"
 # check
 if test ! -d "${repo}/.git"; then
    echo "usage: $0 <repodir> [ <ref> [ <abbrev> ] ]"
    exit 1
 fi
 # get + print info
 commit=$(cd $repo; git show --abbrev=$ab --pretty='format:%h' $ref | head -1)
 date=$(cd $repo; git show --pretty='format:%cs' $ref | head -1 | tr -d '-')
 echo "# $repo $ref  ->  commit $commit - date $date"
 # create tarball
 name="${repo##*/}"
 file="${name}-${commit}.tar.xz"
 (cd $repo; git archive --format=tar --prefix=${name}-${commit}/ ${commit}) \
    | xz -9ev > "$file"
 echo "# $file written"
--- a/8
+++ b/8
@ -1,5 +1,3 @@
-SHA512 (softfloat-20180726-gitb64af41.tar.xz) = f079debd1bfcc0fe64329a8947b0689ef49246793edcdd28a2879f6550c652b0cf0f53ac4f6f5ab61ac4f7933972e0019d0ab63eb9931b6884c2909f3a5ead30
+SHA512 (DBXUpdate-20230509.x64.bin) = 71fb6e8cd6918126b3acd78b95651913336df372e13fdfdfdd20d5d23f0e509050c6c88c8a2c43f8ac44f987df86bd45174bb3065d5a7a8c7e3b8772fd06d624
-SHA512 (jansson-2.13.1.tar.bz2) = 057f0eda43e4162569888d739f4d78d1d02fce8359400d8f66fdc6e440b0405cb457e1126820dc8ce51e9c4a7f4b7effc640caf1d54307c78c0c47c3fc093011
+SHA512 (edk2-edc6681206.tar.xz) = 6cb8812ae80702125f3b7ac3721eaed805eaa7997f486012fa4b83ac5b6a422ca31f8b34b7cc712750ab5d402d9d6e3f9d9aacf3dc9065833afc3fe555bb9021
-SHA512 (edk2-8736b8fdca85.tar.xz) = 217df116863f247b0316f8af643002abc0716a35c1b0260007127d443a7bd5dfced49c373c9ef483c3490f772d7f04f35817ce8a51592902e489e1ea9a005111
+SHA512 (openssl-rhel-db0287935122edceb91dcda8dfb53b4090734e22.tar.xz) = 7958f06cd36b74215feec13a11c86026568f51650d598e048d94598cdc227ac7d2b97eceb1910f3c19e3525c3199b8b5a438b5098156871f9feb3550f677ca58
 SHA512 (edk2-platforms-10e2eb030de3.tar.xz) = 8b0c3ff4fbfc6ed7622e0f34e379da3251c8d67d821d5f1d0c27a1d8294da848193105f2f94b7636233f91cfc726fbd6fae875e06db2dfd986393deb2e084c7d
 SHA512 (openssl-rhel-db0287935122edceb91dcda8dfb53b4090734e22.tar.xz) = a0f525832d385427b67a31b68b09dcd77d761ff19c9dc07c02278107995ea806370990796632038fe09192f9f661e67393f54567385e0fe96d382833c3abc453