35 changed files with 1 additions and 37232 deletions
--- a/SOURCES/edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch
+++ b/SOURCES/edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch
@ -1,56 +0,0 @@
 From 045496325e278716e724ffdf9685667a8766d4f3 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 20 Jun 2024 10:34:52 -0400
 Subject: [PATCH 28/31] CryptoPkg/Test: call ProcessLibraryConstructorList
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [28/31] 5ff484fbc68d094fbcdda2772c2869818c67de8d
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit 94961b8817eec6f8d0434555ac50a7aa51c22201
 Author: Gerd Hoffmann <kraxel@redhat.com>
 Date:   Fri Jun 14 11:45:49 2024 +0200
    CryptoPkg/Test: call ProcessLibraryConstructorList
    Needed to properly initialize BaseRngLib.
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c b/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
 index 88a3f96305..0ba9f35840 100644
 --- a/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
 +++ b/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
@@ -8,6 +8,11 @@
 **/
 #include "TestBaseCryptLib.h"
 +VOID
 +EFIAPI
 +ProcessLibraryConstructorList (
 +  VOID
 +  );
 /**
   Initialize the unit test framework, suite, and unit tests for the
@@ -77,5 +82,6 @@ main (
   char *argv[]
   )
 {
 +  ProcessLibraryConstructorList ();
   return UefiTestMain ();
 }
 -- 
 2.39.3
--- a/SOURCES/edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch
+++ b/SOURCES/edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch
@ -1,174 +0,0 @@
 From f8691984227809170b702f6fd087add1f95ee8fe Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 5 Mar 2024 16:38:49 -0500
 Subject: [PATCH 1/2] EmbeddedPkg/Hob: Integer Overflow in CreateHob()
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 66: EmbeddedPkg/Hob: Integer Overflow in CreateHob()
 RH-Jira: RHEL-21158
 RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [1/2] 301d3bfe82c39179fb85d510788831aa340212d9
 JIRA: https://issues.redhat.com/browse/RHEL-21158
 CVE: CVE-2022-36765
 Upstream: Merged
 commit aeaee8944f0eaacbf4cdf39279785b9ba4836bb6
 Author: Gua Guo <gua.guo@intel.com>
 Date:   Thu Jan 11 13:07:50 2024 +0800
    EmbeddedPkg/Hob: Integer Overflow in CreateHob()
    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
    Fix integer overflow in various CreateHob instances.
    Fixes: CVE-2022-36765
    The CreateHob() function aligns the requested size to 8
    performing the following operation:
    ```
    HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
    ```
    No checks are performed to ensure this value doesn't
    overflow, and could lead to CreateHob() returning a smaller
    HOB than requested, which could lead to OOB HOB accesses.
    Reported-by: Marc Beatove <mbeatove@google.com>
    Cc: Leif Lindholm <quic_llindhol@quicinc.com>
    Reviewed-by: Ard Biesheuvel <ardb+tianocore@kernel.org>
    Cc: Abner Chang <abner.chang@amd.com>
    Cc: John Mathew <john.mathews@intel.com>
    Authored-by: Gerd Hoffmann <kraxel@redhat.com>
    Signed-off-by: Gua Guo <gua.guo@intel.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 EmbeddedPkg/Library/PrePiHobLib/Hob.c | 47 +++++++++++++++++++++++++--
 1 file changed, 45 insertions(+), 2 deletions(-)
 diff --git a/EmbeddedPkg/Library/PrePiHobLib/Hob.c b/EmbeddedPkg/Library/PrePiHobLib/Hob.c
 index b5cc6c5d8f..f4c99369c6 100644
 --- a/EmbeddedPkg/Library/PrePiHobLib/Hob.c
 +++ b/EmbeddedPkg/Library/PrePiHobLib/Hob.c
@@ -112,6 +112,13 @@ CreateHob (
   HandOffHob = GetHobList ();
 +  //
 +  // Check Length to avoid data overflow.
 +  //
 +  if (HobLength > MAX_UINT16 - 0x7) {
 +    return NULL;
 +  }
 +
   HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
   FreeMemory = HandOffHob->EfiFreeMemoryTop - HandOffHob->EfiFreeMemoryBottom;
@@ -161,7 +168,10 @@ BuildResourceDescriptorHob (
   EFI_HOB_RESOURCE_DESCRIPTOR  *Hob;
   Hob = CreateHob (EFI_HOB_TYPE_RESOURCE_DESCRIPTOR, sizeof (EFI_HOB_RESOURCE_DESCRIPTOR));
 -  ASSERT(Hob != NULL);
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   Hob->ResourceType      = ResourceType;
   Hob->ResourceAttribute = ResourceAttribute;
@@ -403,6 +413,10 @@ BuildModuleHob (
           ((ModuleLength & (EFI_PAGE_SIZE - 1)) == 0));
   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION_MODULE));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   CopyGuid (&(Hob->MemoryAllocationHeader.Name), &gEfiHobMemoryAllocModuleGuid);
   Hob->MemoryAllocationHeader.MemoryBaseAddress = MemoryAllocationModule;
@@ -450,7 +464,12 @@ BuildGuidHob (
   //
   ASSERT (DataLength <= (0xffff - sizeof (EFI_HOB_GUID_TYPE)));
 -  Hob = CreateHob (EFI_HOB_TYPE_GUID_EXTENSION, (UINT16) (sizeof (EFI_HOB_GUID_TYPE) + DataLength));
 +  Hob = CreateHob (EFI_HOB_TYPE_GUID_EXTENSION, (UINT16)(sizeof (EFI_HOB_GUID_TYPE) + DataLength));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return NULL;
 +  }
 +
   CopyGuid (&Hob->Name, Guid);
   return Hob + 1;
 }
@@ -516,6 +535,10 @@ BuildFvHob (
   EFI_HOB_FIRMWARE_VOLUME  *Hob;
   Hob = CreateHob (EFI_HOB_TYPE_FV, sizeof (EFI_HOB_FIRMWARE_VOLUME));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   Hob->BaseAddress = BaseAddress;
   Hob->Length      = Length;
@@ -548,6 +571,10 @@ BuildFv2Hob (
   EFI_HOB_FIRMWARE_VOLUME2  *Hob;
   Hob = CreateHob (EFI_HOB_TYPE_FV2, sizeof (EFI_HOB_FIRMWARE_VOLUME2));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   Hob->BaseAddress = BaseAddress;
   Hob->Length      = Length;
@@ -589,6 +616,10 @@ BuildFv3Hob (
   EFI_HOB_FIRMWARE_VOLUME3  *Hob;
   Hob = CreateHob (EFI_HOB_TYPE_FV3, sizeof (EFI_HOB_FIRMWARE_VOLUME3));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   Hob->BaseAddress          = BaseAddress;
   Hob->Length               = Length;
@@ -645,6 +676,10 @@ BuildCpuHob (
   EFI_HOB_CPU  *Hob;
   Hob = CreateHob (EFI_HOB_TYPE_CPU, sizeof (EFI_HOB_CPU));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   Hob->SizeOfMemorySpace = SizeOfMemorySpace;
   Hob->SizeOfIoSpace     = SizeOfIoSpace;
@@ -681,6 +716,10 @@ BuildStackHob (
           ((Length & (EFI_PAGE_SIZE - 1)) == 0));
   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION_STACK));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   CopyGuid (&(Hob->AllocDescriptor.Name), &gEfiHobMemoryAllocStackGuid);
   Hob->AllocDescriptor.MemoryBaseAddress = BaseAddress;
@@ -761,6 +800,10 @@ BuildMemoryAllocationHob (
           ((Length & (EFI_PAGE_SIZE - 1)) == 0));
   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   ZeroMem (&(Hob->AllocDescriptor.Name), sizeof (EFI_GUID));
   Hob->AllocDescriptor.MemoryBaseAddress = BaseAddress;
 -- 
 2.39.3
--- a/SOURCES/edk2-MdeModulePkg-Change-use-of-EFI_D_-to-DEBUG_.patch
+++ b/SOURCES/edk2-MdeModulePkg-Change-use-of-EFI_D_-to-DEBUG_.patch
--- a/SOURCES/edk2-MdeModulePkg-Duplicate-BaseRngLibTimerLib-to-MdeModu.patch
+++ b/SOURCES/edk2-MdeModulePkg-Duplicate-BaseRngLibTimerLib-to-MdeModu.patch
--- a/SOURCES/edk2-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch
+++ b/SOURCES/edk2-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch
@ -1,66 +0,0 @@
 From 2e4b2b8fce40cf93f35e052102f37fee07b2e64a Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Mon, 10 Jun 2024 18:13:29 -0400
 Subject: [PATCH 02/31] MdeModulePkg: Potential UINT32 overflow in S3
 ResumeCount
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [2/31] a3592c3437041cbd33a6c11feb3d0999e122c8c0
 JIRA: https://issues.redhat.com/browse/RHEL-40099
 CVE: CVE-2024-1298
 Upstream: Merged
 commit 284dbac43da752ee34825c8b3f6f9e8281cb5a19
 Author: Shanmugavel Pakkirisamy <shanmugavelx.pakkirisamy@intel.com>
 Date:   Mon May 6 17:53:09 2024 +0800
    MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount
    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4677
    Attacker able to modify physical memory and ResumeCount.
    System will crash/DoS when ResumeCount reaches its MAX_UINT32.
    Cc: Zhiguang Liu <zhiguang.liu@intel.com>
    Cc: Dandan Bi <dandan.bi@intel.com>
    Cc: Liming Gao <gaoliming@byosoft.com.cn>
    Signed-off-by: Pakkirisamy ShanmugavelX <shanmugavelx.pakkirisamy@intel.com>
    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../FirmwarePerformancePei.c                         | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)
 diff --git a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c
 index 6881466201..54b3bc3c54 100644
 --- a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c
 +++ b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c
@@ -110,11 +110,15 @@ FpdtStatusCodeListenerPei (
   //
   S3ResumeTotal = MultU64x32 (AcpiS3ResumeRecord->AverageResume, AcpiS3ResumeRecord->ResumeCount);
   AcpiS3ResumeRecord->ResumeCount++;
 -  AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
 +  if (AcpiS3ResumeRecord->ResumeCount > 0) {
 +    AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
 +    DEBUG ((DEBUG_INFO, "\nFPDT: S3 Resume Performance - AverageResume = 0x%x\n", AcpiS3ResumeRecord->AverageResume));
 +  } else {
 +    DEBUG ((DEBUG_ERROR, "\nFPDT: S3 ResumeCount reaches the MAX_UINT32 value. S3 ResumeCount record reset to Zero."));
 +  }
 -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount   = %d\n", AcpiS3ResumeRecord->ResumeCount));
 -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume    = %ld\n", AcpiS3ResumeRecord->FullResume));
 -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - AverageResume = %ld\n", AcpiS3ResumeRecord->AverageResume));
 +  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount   = 0x%x\n", AcpiS3ResumeRecord->ResumeCount));
 +  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume    = 0x%x\n", AcpiS3ResumeRecord->FullResume));
   //
   // Update S3 Suspend Performance Record.
 -- 
 2.39.3
--- a/SOURCES/edk2-MdeModulePkg-Rng-Add-GUID-to-describe-unsafe-Rng-alg.patch
+++ b/SOURCES/edk2-MdeModulePkg-Rng-Add-GUID-to-describe-unsafe-Rng-alg.patch
@ -1,90 +0,0 @@
 From 5ba444af245d59e3208260478aa710d4f143f259 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 20 Jun 2024 16:06:25 -0400
 Subject: [PATCH 20/31] MdeModulePkg/Rng: Add GUID to describe unsafe Rng
 algorithms
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [20/31] d0e553560d60122f2fe5f33923b5b943c138a18d
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit 414c0f20896f3dec412135fa4260f8aad8bef246
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Fri Aug 11 16:33:07 2023 +0200
    MdeModulePkg/Rng: Add GUID to describe unsafe Rng algorithms
    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4441
    The EFI_RNG_PROTOCOL can rely on the RngLib. The RngLib has multiple
    implementations, some of them are unsafe (e.g. BaseRngLibTimerLib).
    To allow the RngDxe to detect when such implementation is used,
    a GetRngGuid() function is added in a following patch.
    Prepare GetRngGuid() return values and add a gEdkiiRngAlgorithmUnSafe
    to describe an unsafe implementation, cf. the BaseRngLibTimerLib.
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Tested-by: Kun Qin <kun.qin@microsoft.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 MdeModulePkg/Include/Guid/RngAlgorithm.h | 23 +++++++++++++++++++++++
 MdeModulePkg/MdeModulePkg.dec            |  3 +++
 2 files changed, 26 insertions(+)
 create mode 100644 MdeModulePkg/Include/Guid/RngAlgorithm.h
 diff --git a/MdeModulePkg/Include/Guid/RngAlgorithm.h b/MdeModulePkg/Include/Guid/RngAlgorithm.h
 new file mode 100644
 index 0000000000..e2ac2ba3e5
 --- /dev/null
 +++ b/MdeModulePkg/Include/Guid/RngAlgorithm.h
@@ -0,0 +1,23 @@
 +/** @file
 +  Rng Algorithm
 +
 +  Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
 +  SPDX-License-Identifier: BSD-2-Clause-Patent
 +**/
 +
 +#ifndef RNG_ALGORITHM_GUID_H_
 +#define RNG_ALGORITHM_GUID_H_
 +
 +///
 +/// The implementation of a Random Number Generator might be unsafe, when using
 +/// a dummy implementation for instance. Allow identifying such implementation
 +/// with this GUID.
 +///
 +#define EDKII_RNG_ALGORITHM_UNSAFE \
 +  { \
 +    0x869f728c, 0x409d, 0x4ab4, {0xac, 0x03, 0x71, 0xd3, 0x09, 0xc1, 0xb3, 0xf4 } \
 +  }
 +
 +extern EFI_GUID  gEdkiiRngAlgorithmUnSafe;
 +
 +#endif // #ifndef RNG_ALGORITHM_GUID_H_
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
 index 08d59dfb3e..3513a9678a 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
@@ -401,6 +401,9 @@
   ## Include/Guid/MigratedFvInfo.h
   gEdkiiMigratedFvInfoGuid = { 0xc1ab12f7, 0x74aa, 0x408d, { 0xa2, 0xf4, 0xc6, 0xce, 0xfd, 0x17, 0x98, 0x71 } }
 +  ## Include/Guid/RngAlgorithm.h
 +  gEdkiiRngAlgorithmUnSafe = { 0x869f728c, 0x409d, 0x4ab4, {0xac, 0x03, 0x71, 0xd3, 0x09, 0xc1, 0xb3, 0xf4 }}
 +
   #
   # GUID defined in UniversalPayload
   #
 -- 
 2.39.3
--- a/SOURCES/edk2-MdePkg-Add-deprecated-warning-to-BaseRngLibTimer.patch
+++ b/SOURCES/edk2-MdePkg-Add-deprecated-warning-to-BaseRngLibTimer.patch
@ -1,89 +0,0 @@
 From 3800b9ee5d6d4c05c7e27f949c3b32c422c78f2d Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 20 Jun 2024 16:02:31 -0400
 Subject: [PATCH 16/31] MdePkg: Add deprecated warning to BaseRngLibTimer
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [16/31] 6e199344d083e90f60cbe01dfb3c2a3719e3177d
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit e93468442b7da7bc80e00014e854c0c8a0a7184b
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Fri Aug 11 16:33:03 2023 +0200
    MdePkg: Add deprecated warning to BaseRngLibTimer
    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4504
    To keep the MdePkg self-contained and avoid dependencies on GUIDs
    defined in other packages, the BaseRngLibTimer was moved to the
    MdePkg.
    Add a constructor to warn and request to use the MdeModulePkg
    implementation.
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Tested-by: Kun Qin <kun.qin@microsoft.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../BaseRngLibTimerLib/BaseRngLibTimerLib.inf |  1 +
 .../Library/BaseRngLibTimerLib/RngLibTimer.c  | 22 +++++++++++++++++++
 2 files changed, 23 insertions(+)
 diff --git a/MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf b/MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
 index f857290e82..96c90db63f 100644
 --- a/MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
 +++ b/MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
@@ -23,6 +23,7 @@
   MODULE_TYPE                    = BASE
   VERSION_STRING                 = 1.0
   LIBRARY_CLASS                  = RngLib
 +  CONSTRUCTOR                    = BaseRngLibTimerConstructor
 [Sources]
   RngLibTimer.c
 diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
 index 54d29d96f3..6b8392162b 100644
 --- a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
 +++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
@@ -13,6 +13,28 @@
 #define DEFAULT_DELAY_TIME_IN_MICROSECONDS 10
 +/**
 +  This implementation is to be replaced by its MdeModulePkg copy.
 +  The cause being that some GUIDs (gEdkiiRngAlgorithmUnSafe) cannot
 +  be defined in the MdePkg.
 +
 +  @retval EFI_SUCCESS   The constructor always returns EFI_SUCCESS.
 +**/
 +RETURN_STATUS
 +EFIAPI
 +BaseRngLibTimerConstructor (
 +  VOID
 +  )
 +{
 +  DEBUG ((
 +    DEBUG_WARN,
 +    "Warning: This BaseRngTimerLib implementation will be deprecated. "
 +    "Please use the MdeModulePkg implementation equivalent.\n"
 +    ));
 +
 +  return RETURN_SUCCESS;
 +}
 +
 /**
  Using the TimerLib GetPerformanceCounterProperties() we delay
  for enough time for the PerformanceCounter to increment.
 -- 
 2.39.3
--- a/SOURCES/edk2-MdePkg-Apply-uncrustify-changes.patch
+++ b/SOURCES/edk2-MdePkg-Apply-uncrustify-changes.patch
@ -1,94 +0,0 @@
 From 1198bceefa4834c09e1edc1c558aeffe4930d1f5 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 11 Jun 2024 21:32:26 -0400
 Subject: [PATCH 03/31] MdePkg: Apply uncrustify changes
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [3/31] 422d94b837bf0e65164968272a358c2656f59838
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 This is a subset of the whitespace changes in the corresponding upstream
 commit. It is needed for the next commits in this series to apply with
 less fewer conflicts.
 commit 2f88bd3a1296c522317f1c21377876de63de5be7
 Author: Michael Kubacki <michael.kubacki@microsoft.com>
 Date:   Sun Dec 5 14:54:05 2021 -0800
    MdePkg: Apply uncrustify changes
    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3737
    Apply uncrustify changes to .c/.h files in the MdePkg package
    Cc: Andrew Fish <afish@apple.com>
    Cc: Leif Lindholm <leif@nuviainc.com>
    Cc: Michael D Kinney <michael.d.kinney@intel.com>
    Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 MdePkg/Include/Protocol/Rng.h | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)
 diff --git a/MdePkg/Include/Protocol/Rng.h b/MdePkg/Include/Protocol/Rng.h
 index a0a05d1661..baf425587b 100644
 --- a/MdePkg/Include/Protocol/Rng.h
 +++ b/MdePkg/Include/Protocol/Rng.h
@@ -93,7 +93,7 @@ typedef EFI_GUID EFI_RNG_ALGORITHM;
 **/
 typedef
 EFI_STATUS
 -(EFIAPI *EFI_RNG_GET_INFO) (
 +(EFIAPI *EFI_RNG_GET_INFO)(
   IN EFI_RNG_PROTOCOL             *This,
   IN OUT UINTN                    *RNGAlgorithmListSize,
   OUT EFI_RNG_ALGORITHM           *RNGAlgorithmList
@@ -123,9 +123,9 @@ EFI_STATUS
 **/
 typedef
 EFI_STATUS
 -(EFIAPI *EFI_RNG_GET_RNG) (
 +(EFIAPI *EFI_RNG_GET_RNG)(
   IN EFI_RNG_PROTOCOL            *This,
 -  IN EFI_RNG_ALGORITHM           *RNGAlgorithm, OPTIONAL
 +  IN EFI_RNG_ALGORITHM           *RNGAlgorithm  OPTIONAL,
   IN UINTN                       RNGValueLength,
   OUT UINT8                      *RNGValue
   );
@@ -135,16 +135,16 @@ EFI_STATUS
 /// applications, or entropy for seeding other random number generators.
 ///
 struct _EFI_RNG_PROTOCOL {
 -  EFI_RNG_GET_INFO                GetInfo;
 -  EFI_RNG_GET_RNG                 GetRNG;
 +  EFI_RNG_GET_INFO    GetInfo;
 +  EFI_RNG_GET_RNG     GetRNG;
 };
 -extern EFI_GUID gEfiRngProtocolGuid;
 -extern EFI_GUID gEfiRngAlgorithmSp80090Hash256Guid;
 -extern EFI_GUID gEfiRngAlgorithmSp80090Hmac256Guid;
 -extern EFI_GUID gEfiRngAlgorithmSp80090Ctr256Guid;
 -extern EFI_GUID gEfiRngAlgorithmX9313DesGuid;
 -extern EFI_GUID gEfiRngAlgorithmX931AesGuid;
 -extern EFI_GUID gEfiRngAlgorithmRaw;
 +extern EFI_GUID  gEfiRngProtocolGuid;
 +extern EFI_GUID  gEfiRngAlgorithmSp80090Hash256Guid;
 +extern EFI_GUID  gEfiRngAlgorithmSp80090Hmac256Guid;
 +extern EFI_GUID  gEfiRngAlgorithmSp80090Ctr256Guid;
 +extern EFI_GUID  gEfiRngAlgorithmX9313DesGuid;
 +extern EFI_GUID  gEfiRngAlgorithmX931AesGuid;
 +extern EFI_GUID  gEfiRngAlgorithmRaw;
 #endif
 -- 
 2.39.3
--- a/SOURCES/edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch
+++ b/SOURCES/edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch
@ -1,213 +0,0 @@
 From 1d4b6d489cb919faa3ad67a3ae53fe26c4cd0a75 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 20 Jun 2024 10:32:29 -0400
 Subject: [PATCH 25/31] MdePkg/BaseRngLib: Add a smoketest for RDRAND and check
 CPUID
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [25/31] 11804d6f86a644ae2c3dcad89c633ad63b794d3f
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit c3a8ca7b54a9fd17acdf16c6282a92cc989fa92a
 Author: Pedro Falcato <pedro.falcato@gmail.com>
 Date:   Tue Nov 22 22:31:03 2022 +0000
    MdePkg/BaseRngLib: Add a smoketest for RDRAND and check CPUID
    RDRAND has notoriously been broken many times over its lifespan.
    Add a smoketest to RDRAND, in order to better sniff out potential
    security concerns.
    Also add a proper CPUID test in order to support older CPUs which may
    not have it; it was previously being tested but then promptly ignored.
    Testing algorithm inspired by linux's arch/x86/kernel/cpu/rdrand.c
    :x86_init_rdrand() per commit 049f9ae9..
    Many thanks to Jason Donenfeld for relicensing his linux RDRAND detection
    code to MIT and the public domain.
    >On Tue, Nov 22, 2022 at 2:21 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
      <..>
    >    I (re)wrote that function in Linux. I hereby relicense it as MIT, and
    >    also place it into public domain. Do with it what you will now.
    >
    >    Jason
    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4163
    Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
    Cc: Michael D Kinney <michael.d.kinney@intel.com>
    Cc: Liming Gao <gaoliming@byosoft.com.cn>
    Cc: Zhiguang Liu <zhiguang.liu@intel.com>
    Cc: Jason A. Donenfeld <Jason@zx2c4.com>
 Signed-off-by: Jon Maloy <jmaloy@gmail.com>
 ---
 MdePkg/Library/BaseRngLib/Rand/RdRand.c | 99 +++++++++++++++++++++++--
 1 file changed, 91 insertions(+), 8 deletions(-)
 diff --git a/MdePkg/Library/BaseRngLib/Rand/RdRand.c b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
 index aee8ea04e8..7132ab0efd 100644
 --- a/MdePkg/Library/BaseRngLib/Rand/RdRand.c
 +++ b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
@@ -3,6 +3,7 @@
   to provide high-quality random numbers.
 Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
 +Copyright (c) 2022, Pedro Falcato. All rights reserved.<BR>
 Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
 Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
@@ -25,6 +26,88 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 STATIC BOOLEAN mRdRandSupported;
 +//
 +// Intel SDM says 10 tries is good enough for reliable RDRAND usage.
 +//
 +#define RDRAND_RETRIES  10
 +
 +#define RDRAND_TEST_SAMPLES  8
 +
 +#define RDRAND_MIN_CHANGE  5
 +
 +//
 +// Add a define for native-word RDRAND, just for the test.
 +//
 +#ifdef MDE_CPU_X64
 +#define ASM_RDRAND  AsmRdRand64
 +#else
 +#define ASM_RDRAND  AsmRdRand32
 +#endif
 +
 +/**
 +  Tests RDRAND for broken implementations.
 +
 +  @retval TRUE         RDRAND is reliable (and hopefully safe).
 +  @retval FALSE        RDRAND is unreliable and should be disabled, despite CPUID.
 +
 +**/
 +STATIC
 +BOOLEAN
 +TestRdRand (
 +  VOID
 +  )
 +{
 +  //
 +  // Test for notoriously broken rdrand implementations that always return the same
 +  // value, like the Zen 3 uarch (all-1s) or other several AMD families on suspend/resume (also all-1s).
 +  // Note that this should be expanded to extensively test for other sorts of possible errata.
 +  //
 +
 +  //
 +  // Our algorithm samples rdrand $RDRAND_TEST_SAMPLES times and expects
 +  // a different result $RDRAND_MIN_CHANGE times for reliable RDRAND usage.
 +  //
 +  UINTN   Prev;
 +  UINT8   Idx;
 +  UINT8   TestIteration;
 +  UINT32  Changed;
 +
 +  Changed = 0;
 +
 +  for (TestIteration = 0; TestIteration < RDRAND_TEST_SAMPLES; TestIteration++) {
 +    UINTN  Sample;
 +    //
 +    // Note: We use a retry loop for rdrand. Normal users get this in BaseRng.c
 +    // Any failure to get a random number will assume RDRAND does not work.
 +    //
 +    for (Idx = 0; Idx < RDRAND_RETRIES; Idx++) {
 +      if (ASM_RDRAND (&Sample)) {
 +        break;
 +      }
 +    }
 +
 +    if (Idx == RDRAND_RETRIES) {
 +      DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: Failed to get an RDRAND random number - disabling\n"));
 +      return FALSE;
 +    }
 +
 +    if (TestIteration != 0) {
 +      Changed += Sample != Prev;
 +    }
 +
 +    Prev = Sample;
 +  }
 +
 +  if (Changed < RDRAND_MIN_CHANGE) {
 +    DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: RDRAND not reliable - disabling\n"));
 +    return FALSE;
 +  }
 +
 +  return TRUE;
 +}
 +
 +#undef ASM_RDRAND
 +
 /**
   The constructor function checks whether or not RDRAND instruction is supported
   by the host hardware.
@@ -49,10 +132,13 @@ BaseRngLibConstructor (
   // CPUID. A value of 1 indicates that processor support RDRAND instruction.
   //
   AsmCpuid (1, 0, 0, &RegEcx, 0);
 -  ASSERT ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
   mRdRandSupported = ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
 +  if (mRdRandSupported) {
 +    mRdRandSupported = TestRdRand ();
 +  }
 +
   return EFI_SUCCESS;
 }
@@ -71,6 +157,7 @@ ArchGetRandomNumber16 (
   OUT     UINT16                    *Rand
   )
 {
 +  ASSERT (mRdRandSupported);
   return AsmRdRand16 (Rand);
 }
@@ -89,6 +176,7 @@ ArchGetRandomNumber32 (
   OUT     UINT32                    *Rand
   )
 {
 +  ASSERT (mRdRandSupported);
   return AsmRdRand32 (Rand);
 }
@@ -107,6 +195,7 @@ ArchGetRandomNumber64 (
   OUT     UINT64                    *Rand
   )
 {
 +  ASSERT (mRdRandSupported);
   return AsmRdRand64 (Rand);
 }
@@ -123,13 +212,7 @@ ArchIsRngSupported (
   VOID
   )
 {
 -  /*
 -     Existing software depends on this always returning TRUE, so for
 -     now hard-code it.
 -
 -     return mRdRandSupported;
 -  */
 -  return TRUE;
 +  return mRdRandSupported;
 }
 /**
 -- 
 2.39.3
--- a/SOURCES/edk2-MdePkg-DxeRngLib-Request-raw-algorithm-instead-of-de.patch
+++ b/SOURCES/edk2-MdePkg-DxeRngLib-Request-raw-algorithm-instead-of-de.patch
@ -1,66 +0,0 @@
 From 3351bd0ba07cc490c344d2dc54b86833993ca5a2 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 20 Jun 2024 15:58:58 -0400
 Subject: [PATCH 18/31] MdePkg/DxeRngLib: Request raw algorithm instead of
 default
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [18/31] fa2da700127ae713aa578638c2390673fc49522d
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit bd1f0eecc1dfe51ba20161bef8860d12392006bd
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Fri Aug 11 16:33:05 2023 +0200
    MdePkg/DxeRngLib: Request raw algorithm instead of default
    The DxeRngLib tries to generate a random number using the 3 NIST
    SP 800-90 compliant DRBG algorithms, i.e. 256-bits CTR, HASH and HMAC.
    If none of the call is successful, the fallback option is the default
    RNG algorithm of the EFI_RNG_PROTOCOL. This default algorithm might
    be an unsafe implementation.
    Try requesting the Raw algorithm before requesting the default one.
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Tested-by: Kun Qin <kun.qin@microsoft.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 MdePkg/Library/DxeRngLib/DxeRngLib.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
 diff --git a/MdePkg/Library/DxeRngLib/DxeRngLib.c b/MdePkg/Library/DxeRngLib/DxeRngLib.c
 index 9c3d67b5a6..4b2fc1cde5 100644
 --- a/MdePkg/Library/DxeRngLib/DxeRngLib.c
 +++ b/MdePkg/Library/DxeRngLib/DxeRngLib.c
@@ -64,9 +64,16 @@ GenerateRandomNumberViaNist800Algorithm (
   if (!EFI_ERROR (Status)) {
     return Status;
   }
 +
 +  Status = RngProtocol->GetRNG (RngProtocol, &gEfiRngAlgorithmRaw, BufferSize, Buffer);
 +  DEBUG ((DEBUG_INFO, "%a: GetRNG algorithm Raw - Status = %r\n", __func__, Status));
 +  if (!EFI_ERROR (Status)) {
 +    return Status;
 +  }
 +
   // If all the other methods have failed, use the default method from the RngProtocol
   Status = RngProtocol->GetRNG (RngProtocol, NULL, BufferSize, Buffer);
 -  DEBUG((DEBUG_INFO, "%a: GetRNG algorithm Hash-256 - Status = %r\n", __FUNCTION__, Status));
 +  DEBUG ((DEBUG_INFO, "%a: GetRNG algorithm default - Status = %r\n", __func__, Status));
   if (!EFI_ERROR (Status)) {
     return Status;
   }
 -- 
 2.39.3
--- a/SOURCES/edk2-MdePkg-Rng-Add-GUID-to-describe-Arm-Rndr-Rng-algorit.patch
+++ b/SOURCES/edk2-MdePkg-Rng-Add-GUID-to-describe-Arm-Rndr-Rng-algorit.patch
@ -1,91 +0,0 @@
 From 2a01056c29542a10941cb32929032b80df091a17 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 20 Jun 2024 16:04:48 -0400
 Subject: [PATCH 19/31] MdePkg/Rng: Add GUID to describe Arm Rndr Rng
 algorithms
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [19/31] 58b0f069c74b00eb6476427dd84a50a86aceb598
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit cf07238e5fa4f8b1138ac1c9e80530b4d4e59f1c
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Fri Aug 11 16:33:06 2023 +0200
    MdePkg/Rng: Add GUID to describe Arm Rndr Rng algorithms
    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4441
    The EFI_RNG_PROTOCOL can rely on the RngLib. The RngLib has multiple
    implementations, some of them are unsafe (e.g. BaseRngLibTimerLib).
    To allow the RngDxe to detect when such implementation is used,
    a GetRngGuid() function is added in a following patch.
    Prepare GetRngGuid() return values and add a gEfiRngAlgorithmArmRndr
    to describe a Rng algorithm accessed through Arm's RNDR instruction.
    [1] states that the implementation of this algorithm should be
    compliant to NIST SP900-80. The compliance is not guaranteed.
    [1] Arm Architecture Reference Manual Armv8, for A-profile architecture
    sK12.1 'Properties of the generated random number'
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Tested-by: Kun Qin <kun.qin@microsoft.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 MdePkg/Include/Protocol/Rng.h | 10 ++++++++++
 MdePkg/MdePkg.dec             |  1 +
 2 files changed, 11 insertions(+)
 diff --git a/MdePkg/Include/Protocol/Rng.h b/MdePkg/Include/Protocol/Rng.h
 index baf425587b..38bde53240 100644
 --- a/MdePkg/Include/Protocol/Rng.h
 +++ b/MdePkg/Include/Protocol/Rng.h
@@ -67,6 +67,15 @@ typedef EFI_GUID EFI_RNG_ALGORITHM;
   { \
     0xe43176d7, 0xb6e8, 0x4827, {0xb7, 0x84, 0x7f, 0xfd, 0xc4, 0xb6, 0x85, 0x61 } \
   }
 +///
 +/// The Arm Architecture states the RNDR that the DRBG algorithm should be compliant
 +/// with NIST SP800-90A, while not mandating a particular algorithm, so as to be
 +/// inclusive of different geographies.
 +///
 +#define EFI_RNG_ALGORITHM_ARM_RNDR \
 +  { \
 +    0x43d2fde3, 0x9d4e, 0x4d79,  {0x02, 0x96, 0xa8, 0x9b, 0xca, 0x78, 0x08, 0x41} \
 +  }
 /**
   Returns information about the random number generation implementation.
@@ -146,5 +155,6 @@ extern EFI_GUID  gEfiRngAlgorithmSp80090Ctr256Guid;
 extern EFI_GUID  gEfiRngAlgorithmX9313DesGuid;
 extern EFI_GUID  gEfiRngAlgorithmX931AesGuid;
 extern EFI_GUID  gEfiRngAlgorithmRaw;
 +extern EFI_GUID  gEfiRngAlgorithmArmRndr;
 #endif
 diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
 index 8f05e822ac..36501e8bb9 100644
 --- a/MdePkg/MdePkg.dec
 +++ b/MdePkg/MdePkg.dec
@@ -594,6 +594,7 @@
   gEfiRngAlgorithmX9313DesGuid       = { 0x63c4785a, 0xca34, 0x4012, {0xa3, 0xc8, 0x0b, 0x6a, 0x32, 0x4f, 0x55, 0x46 }}
   gEfiRngAlgorithmX931AesGuid        = { 0xacd03321, 0x777e, 0x4d3d, {0xb1, 0xc8, 0x20, 0xcf, 0xd8, 0x88, 0x20, 0xc9 }}
   gEfiRngAlgorithmRaw                = { 0xe43176d7, 0xb6e8, 0x4827, {0xb7, 0x84, 0x7f, 0xfd, 0xc4, 0xb6, 0x85, 0x61 }}
 +  gEfiRngAlgorithmArmRndr            = { 0x43d2fde3, 0x9d4e, 0x4d79, {0x02, 0x96, 0xa8, 0x9b, 0xca, 0x78, 0x08, 0x41 }}
   ## Include/Protocol/AdapterInformation.h
   gEfiAdapterInfoMediaStateGuid       = { 0xD7C74207, 0xA831, 0x4A26, {0xB1, 0xF5, 0xD1, 0x93, 0x06, 0x5C, 0xE8, 0xB6 }}
 -- 
 2.39.3
--- a/SOURCES/edk2-MdePkg-Rng-Add-GetRngGuid-to-RngLib.patch
+++ b/SOURCES/edk2-MdePkg-Rng-Add-GetRngGuid-to-RngLib.patch
@ -1,409 +0,0 @@
 From b466e2545e25ebb2004ae9b9f95c6c2f60d1f168 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 20 Jun 2024 16:08:28 -0400
 Subject: [PATCH 21/31] MdePkg/Rng: Add GetRngGuid() to RngLib
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [21/31] 54783ad88ba101c620240aa463c5d758fa416c31
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit 5443c2dc310d2c8eb15fb8eefd5057342e78cd0d
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Fri Aug 11 16:33:08 2023 +0200
    MdePkg/Rng: Add GetRngGuid() to RngLib
    The EFI_RNG_PROTOCOL can use the RngLib. The RngLib has multiple
    implementations, some of them are unsafe (e.g. BaseRngLibTimerLib).
    To allow the RngDxe to detect when such implementation is used,
    add a GetRngGuid() function to the RngLib.
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Tested-by: Kun Qin <kun.qin@microsoft.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../BaseRngLibTimerLib/BaseRngLibTimerLib.inf |  4 ++
 .../Library/BaseRngLibTimerLib/RngLibTimer.c  | 28 +++++++++++++
 MdePkg/Include/Library/RngLib.h               | 19 ++++++++-
 MdePkg/Library/BaseRngLib/AArch64/Rndr.c      | 42 +++++++++++++++++++
 MdePkg/Library/BaseRngLib/BaseRngLib.inf      | 10 +++++
 MdePkg/Library/BaseRngLib/Rand/RdRand.c       | 26 ++++++++++++
 .../Library/BaseRngLibNull/BaseRngLibNull.c   | 22 ++++++++++
 .../Library/BaseRngLibTimerLib/RngLibTimer.c  | 23 ++++++++++
 MdePkg/Library/DxeRngLib/DxeRngLib.c          | 28 +++++++++++++
 9 files changed, 201 insertions(+), 1 deletion(-)
 diff --git a/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf b/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
 index f729001060..8461260cc8 100644
 --- a/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
 +++ b/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
@@ -29,6 +29,10 @@
 [Packages]
   MdePkg/MdePkg.dec
 +  MdeModulePkg/MdeModulePkg.dec
 +
 +[Guids]
 +  gEdkiiRngAlgorithmUnSafe
 [LibraryClasses]
   BaseLib
 diff --git a/MdeModulePkg/Library/BaseRngLibTimerLib/RngLibTimer.c b/MdeModulePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
 index 980854d67b..28ff46c71f 100644
 --- a/MdeModulePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
 +++ b/MdeModulePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
@@ -2,14 +2,18 @@
   BaseRng Library that uses the TimerLib to provide reasonably random numbers.
   Do not use this on a production system.
 +  Copyright (c) 2023, Arm Limited. All rights reserved.
   Copyright (c) Microsoft Corporation.
   SPDX-License-Identifier: BSD-2-Clause-Patent
 **/
 #include <Base.h>
 +#include <Uefi.h>
 #include <Library/BaseLib.h>
 +#include <Library/BaseMemoryLib.h>
 #include <Library/DebugLib.h>
 #include <Library/TimerLib.h>
 +#include <Guid/RngAlgorithm.h>
 #define DEFAULT_DELAY_TIME_IN_MICROSECONDS  10
@@ -190,3 +194,27 @@ GetRandomNumber128 (
   // Read second 64 bits
   return GetRandomNumber64 (++Rand);
 }
 +
 +/**
 +  Get a GUID identifying the RNG algorithm implementation.
 +
 +  @param [out] RngGuid  If success, contains the GUID identifying
 +                        the RNG algorithm implementation.
 +
 +  @retval EFI_SUCCESS             Success.
 +  @retval EFI_UNSUPPORTED         Not supported.
 +  @retval EFI_INVALID_PARAMETER   Invalid parameter.
 +**/
 +EFI_STATUS
 +EFIAPI
 +GetRngGuid (
 +  GUID  *RngGuid
 +  )
 +{
 +  if (RngGuid == NULL) {
 +    return EFI_INVALID_PARAMETER;
 +  }
 +
 +  CopyMem (RngGuid, &gEdkiiRngAlgorithmUnSafe, sizeof (*RngGuid));
 +  return EFI_SUCCESS;
 +}
 diff --git a/MdePkg/Include/Library/RngLib.h b/MdePkg/Include/Library/RngLib.h
 index 05e513022e..801aa6d5bd 100644
 --- a/MdePkg/Include/Library/RngLib.h
 +++ b/MdePkg/Include/Library/RngLib.h
@@ -1,6 +1,7 @@
 /** @file
   Provides random number generator services.
 +Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
 Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
 SPDX-License-Identifier: BSD-2-Clause-Patent
@@ -77,4 +78,20 @@ GetRandomNumber128 (
   OUT     UINT64                    *Rand
   );
 -#endif  // __RNG_LIB_H__
 +/**
 +  Get a GUID identifying the RNG algorithm implementation.
 +
 +  @param [out] RngGuid  If success, contains the GUID identifying
 +                        the RNG algorithm implementation.
 +
 +  @retval EFI_SUCCESS             Success.
 +  @retval EFI_UNSUPPORTED         Not supported.
 +  @retval EFI_INVALID_PARAMETER   Invalid parameter.
 +**/
 +EFI_STATUS
 +EFIAPI
 +GetRngGuid (
 +  GUID  *RngGuid
 +  );
 +
 +#endif // __RNG_LIB_H__
 diff --git a/MdePkg/Library/BaseRngLib/AArch64/Rndr.c b/MdePkg/Library/BaseRngLib/AArch64/Rndr.c
 index c9f8c813ed..7641314a54 100644
 --- a/MdePkg/Library/BaseRngLib/AArch64/Rndr.c
 +++ b/MdePkg/Library/BaseRngLib/AArch64/Rndr.c
@@ -2,6 +2,7 @@
   Random number generator service that uses the RNDR instruction
   to provide pseudorandom numbers.
 +  Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
   Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
   Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
@@ -11,6 +12,7 @@
 #include <Uefi.h>
 #include <Library/BaseLib.h>
 +#include <Library/BaseMemoryLib.h>
 #include <Library/DebugLib.h>
 #include <Library/RngLib.h>
@@ -137,3 +139,43 @@ ArchIsRngSupported (
 {
   return mRndrSupported;
 }
 +
 +/**
 +  Get a GUID identifying the RNG algorithm implementation.
 +
 +  @param [out] RngGuid  If success, contains the GUID identifying
 +                        the RNG algorithm implementation.
 +
 +  @retval EFI_SUCCESS             Success.
 +  @retval EFI_UNSUPPORTED         Not supported.
 +  @retval EFI_INVALID_PARAMETER   Invalid parameter.
 +**/
 +EFI_STATUS
 +EFIAPI
 +GetRngGuid (
 +  GUID  *RngGuid
 +  )
 +{
 +  GUID  *RngLibGuid;
 +
 +  if (RngGuid == NULL) {
 +    return EFI_INVALID_PARAMETER;
 +  }
 +
 +  if (!mRndrSupported) {
 +    return EFI_UNSUPPORTED;
 +  }
 +
 +  //
 +  // If the platform advertises the algorithm behind RNDR instruction,
 +  // use it. Otherwise use gEfiRngAlgorithmArmRndr.
 +  //
 +  RngLibGuid = PcdGetPtr (PcdCpuRngSupportedAlgorithm);
 +  if (!IsZeroGuid (RngLibGuid)) {
 +    CopyMem (RngGuid, RngLibGuid, sizeof (*RngGuid));
 +  } else {
 +    CopyMem (RngGuid, &gEfiRngAlgorithmArmRndr, sizeof (*RngGuid));
 +  }
 +
 +  return EFI_SUCCESS;
 +}
 diff --git a/MdePkg/Library/BaseRngLib/BaseRngLib.inf b/MdePkg/Library/BaseRngLib/BaseRngLib.inf
 index 1fcceb9414..49503b139b 100644
 --- a/MdePkg/Library/BaseRngLib/BaseRngLib.inf
 +++ b/MdePkg/Library/BaseRngLib/BaseRngLib.inf
@@ -4,6 +4,7 @@
 #  BaseRng Library that uses CPU RNG instructions (e.g. RdRand) to
 #  provide random numbers.
 #
 +#  Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
 #  Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
 #  Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
 #
@@ -43,9 +44,18 @@
   AArch64/ArmReadIdIsar0.asm | MSFT
   AArch64/ArmRng.asm         | MSFT
 +[Guids.AARCH64]
 +  gEfiRngAlgorithmArmRndr
 +
 +[Guids.Ia32, Guids.X64]
 +  gEfiRngAlgorithmSp80090Ctr256Guid
 +
 [Packages]
   MdePkg/MdePkg.dec
 +[Pcd.AARCH64]
 +  gEfiMdePkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm
 +
 [LibraryClasses]
   BaseLib
   DebugLib
 diff --git a/MdePkg/Library/BaseRngLib/Rand/RdRand.c b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
 index 09fb875ac3..aee8ea04e8 100644
 --- a/MdePkg/Library/BaseRngLib/Rand/RdRand.c
 +++ b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
@@ -2,6 +2,7 @@
   Random number generator services that uses RdRand instruction access
   to provide high-quality random numbers.
 +Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
 Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
 Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
@@ -11,6 +12,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Uefi.h>
 #include <Library/BaseLib.h>
 +#include <Library/BaseMemoryLib.h>
 #include <Library/DebugLib.h>
 #include "BaseRngLibInternals.h"
@@ -129,3 +131,27 @@ ArchIsRngSupported (
   */
   return TRUE;
 }
 +
 +/**
 +  Get a GUID identifying the RNG algorithm implementation.
 +
 +  @param [out] RngGuid  If success, contains the GUID identifying
 +                        the RNG algorithm implementation.
 +
 +  @retval EFI_SUCCESS             Success.
 +  @retval EFI_UNSUPPORTED         Not supported.
 +  @retval EFI_INVALID_PARAMETER   Invalid parameter.
 +**/
 +EFI_STATUS
 +EFIAPI
 +GetRngGuid (
 +  GUID  *RngGuid
 +  )
 +{
 +  if (RngGuid == NULL) {
 +    return EFI_INVALID_PARAMETER;
 +  }
 +
 +  CopyMem (RngGuid, &gEfiRngAlgorithmSp80090Ctr256Guid, sizeof (*RngGuid));
 +  return EFI_SUCCESS;
 +}
 diff --git a/MdePkg/Library/BaseRngLibNull/BaseRngLibNull.c b/MdePkg/Library/BaseRngLibNull/BaseRngLibNull.c
 index cad30599ea..34a18e6a4d 100644
 --- a/MdePkg/Library/BaseRngLibNull/BaseRngLibNull.c
 +++ b/MdePkg/Library/BaseRngLibNull/BaseRngLibNull.c
@@ -1,13 +1,16 @@
 /** @file
   Null version of Random number generator services.
 +Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
 Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
 SPDX-License-Identifier: BSD-2-Clause-Patent
 **/
 +#include <Uefi.h>
 #include <Library/DebugLib.h>
 #include <Library/RngLib.h>
 +#include <Protocol/Rng.h>
 /**
   Generates a 16-bit random number.
@@ -92,3 +95,22 @@ GetRandomNumber128 (
   ASSERT (FALSE);
   return FALSE;
 }
 +
 +/**
 +  Get a GUID identifying the RNG algorithm implementation.
 +
 +  @param [out] RngGuid  If success, contains the GUID identifying
 +                        the RNG algorithm implementation.
 +
 +  @retval EFI_SUCCESS             Success.
 +  @retval EFI_UNSUPPORTED         Not supported.
 +  @retval EFI_INVALID_PARAMETER   Invalid parameter.
 +**/
 +EFI_STATUS
 +EFIAPI
 +GetRngGuid (
 +  GUID  *RngGuid
 +  )
 +{
 +  return EFI_UNSUPPORTED;
 +}
 diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
 index 6b8392162b..7337500fec 100644
 --- a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
 +++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
@@ -209,3 +209,26 @@ GetRandomNumber128 (
   // Read second 64 bits
   return GetRandomNumber64 (++Rand);
 }
 +
 +/**
 +  Get a GUID identifying the RNG algorithm implementation.
 +
 +  @param [out] RngGuid  If success, contains the GUID identifying
 +                        the RNG algorithm implementation.
 +
 +  @retval EFI_SUCCESS             Success.
 +  @retval EFI_UNSUPPORTED         Not supported.
 +  @retval EFI_INVALID_PARAMETER   Invalid parameter.
 +**/
 +RETURN_STATUS
 +EFIAPI
 +GetRngGuid (
 +  GUID  *RngGuid
 +  )
 +{
 +  /* This implementation is to be replaced by its MdeModulePkg copy.
 +   * The cause being that some GUIDs (gEdkiiRngAlgorithmUnSafe) cannot
 +   * be defined in the MdePkg.
 +   */
 +  return RETURN_UNSUPPORTED;
 +}
 diff --git a/MdePkg/Library/DxeRngLib/DxeRngLib.c b/MdePkg/Library/DxeRngLib/DxeRngLib.c
 index 4b2fc1cde5..20248b4107 100644
 --- a/MdePkg/Library/DxeRngLib/DxeRngLib.c
 +++ b/MdePkg/Library/DxeRngLib/DxeRngLib.c
@@ -1,6 +1,7 @@
 /** @file
  Provides an implementation of the library class RngLib that uses the Rng protocol.
 + Copyright (c) 2023, Arm Limited. All rights reserved.
  Copyright (c) Microsoft Corporation. All rights reserved.
  SPDX-License-Identifier: BSD-2-Clause-Patent
@@ -204,3 +205,30 @@ GetRandomNumber128 (
   }
   return TRUE;
 }
 +
 +/**
 +  Get a GUID identifying the RNG algorithm implementation.
 +
 +  @param [out] RngGuid  If success, contains the GUID identifying
 +                        the RNG algorithm implementation.
 +
 +  @retval EFI_SUCCESS             Success.
 +  @retval EFI_UNSUPPORTED         Not supported.
 +  @retval EFI_INVALID_PARAMETER   Invalid parameter.
 +**/
 +EFI_STATUS
 +EFIAPI
 +GetRngGuid (
 +  GUID  *RngGuid
 +  )
 +{
 +  /* It is not possible to know beforehand which Rng algorithm will
 +   * be used by this library.
 +   * This API is mainly used by RngDxe. RngDxe relies on the RngLib.
 +   * The RngLib|DxeRngLib.inf implementation locates and uses an installed
 +   * EFI_RNG_PROTOCOL.
 +   * It is thus not possible to have both RngDxe and RngLib|DxeRngLib.inf.
 +   * and it is ok not to support this API.
 +   */
 +  return EFI_UNSUPPORTED;
 +}
 -- 
 2.39.3
--- a/SOURCES/edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch
+++ b/SOURCES/edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch
@ -1,63 +0,0 @@
 From 634ee7a8cef2eac9f41cff4b42859d9d54b204bf Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 20 Jun 2024 10:35:27 -0400
 Subject: [PATCH 29/31] MdePkg/X86UnitTestHost: set rdrand cpuid bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [29/31] 60851c6253df6f0114dc2c5598e0dde139d56c4c
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit 5e776299a2604b336a947e68593012ab2cc16eb4
 Author: Gerd Hoffmann <kraxel@redhat.com>
 Date:   Fri Jun 14 11:45:53 2024 +0200
    MdePkg/X86UnitTestHost: set rdrand cpuid bit
    Set the rdrand feature bit when faking cpuid for host test cases.
    Needed to make the CryptoPkg test cases work.
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 MdePkg/Library/BaseLib/X86UnitTestHost.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)
 diff --git a/MdePkg/Library/BaseLib/X86UnitTestHost.c b/MdePkg/Library/BaseLib/X86UnitTestHost.c
 index d0e428457e..abc092a990 100644
 --- a/MdePkg/Library/BaseLib/X86UnitTestHost.c
 +++ b/MdePkg/Library/BaseLib/X86UnitTestHost.c
@@ -66,6 +66,15 @@ UnitTestHostBaseLibAsmCpuid (
   OUT     UINT32                    *Edx   OPTIONAL
   )
 {
 +  UINT32  RetEcx;
 +
 +  RetEcx = 0;
 +  switch (Index) {
 +    case 1:
 +      RetEcx |= BIT30; /* RdRand */
 +      break;
 +  }
 +
   if (Eax != NULL) {
     *Eax = 0;
   }
@@ -73,7 +82,7 @@ UnitTestHostBaseLibAsmCpuid (
     *Ebx = 0;
   }
   if (Ecx != NULL) {
 -    *Ecx = 0;
 +    *Ecx = RetEcx;
   }
   if (Edx != NULL) {
     *Edx = 0;
 -- 
 2.39.3
--- a/SOURCES/edk2-NetworkPkg-Apply-uncrustify-changes.p2.patch
+++ b/SOURCES/edk2-NetworkPkg-Apply-uncrustify-changes.p2.patch
--- a/SOURCES/edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch
+++ b/SOURCES/edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch
--- a/SOURCES/edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch
+++ b/SOURCES/edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch
@ -1,74 +0,0 @@
 From 6eceae607639b46ea46ba26a288270bd1c97dc0f Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 13 Jun 2024 18:35:46 -0400
 Subject: [PATCH 31/31] NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow
 in iPXE environment
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [31/31] 2088a79fef3d6dfec032f2f560ccf87ae42d786f
 JIRA: https://issues.redhat.com/browse/RHEL-21854
 Upstream: Merged
 CVE: CVE-2023-45236
 commit ced13b93afea87a8a1fe6ddbb67240a84cb2e3d3
 Author: Sam <Sam_Tsai@wiwynn.com>
 Date:   Wed May 29 07:46:03 2024 +0800
    NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow in iPXE environment
    This bug fix is based on the following commit "NetworkPkg TcpDxe: SECURITY PATCH"
    REF: 1904a64
    Issue Description:
    An "Invalid handle" error was detected during runtime when attempting to destroy a child instance of the hashing protocol. The problematic code segment was:
    NetworkPkg\TcpDxe\TcpDriver.c
    Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, &mHash2ServiceHandle);
    Root Cause Analysis:
    The root cause of the error was the passing of an incorrect parameter type, a pointer to an EFI_HANDLE instead of an EFI_HANDLE itself, to the DestroyChild function. This mismatch resulted in the function receiving an invalid handle.
    Implemented Solution:
    To resolve this issue, the function call was corrected to pass mHash2ServiceHandle directly:
    NetworkPkg\TcpDxe\TcpDriver.c
    Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, mHash2ServiceHandle);
    This modification ensures the correct handle type is used, effectively rectifying the "Invalid handle" error.
    Verification:
    Testing has been conducted, confirming the efficacy of the fix. Additionally, the BIOS can boot into the OS in an iPXE environment.
    Cc: Doug Flick [MSFT] <doug.edk2@gmail.com>
    Signed-off-by: Sam Tsai [Wiwynn] <sam_tsai@wiwynn.com>
    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 NetworkPkg/TcpDxe/TcpDriver.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/NetworkPkg/TcpDxe/TcpDriver.c b/NetworkPkg/TcpDxe/TcpDriver.c
 index 34ae838ae0..1aec292501 100644
 --- a/NetworkPkg/TcpDxe/TcpDriver.c
 +++ b/NetworkPkg/TcpDxe/TcpDriver.c
@@ -509,7 +509,7 @@ TcpDestroyService (
     //
     // Destroy the instance of the hashing protocol for this controller.
     //
 -    Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, &mHash2ServiceHandle);
 +    Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, mHash2ServiceHandle);
     if (EFI_ERROR (Status)) {
       return EFI_UNSUPPORTED;
     }
 -- 
 2.39.3
--- a/SOURCES/edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch
+++ b/SOURCES/edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch
@ -1,808 +0,0 @@
 From 1e7f4034ddc0896e16c981d4220a1178813b4e86 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 11 Jun 2024 15:20:29 -0400
 Subject: [PATCH 30/31] NetworkPkg TcpDxe: SECURITY PATCH CVE-2023-45236
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [30/31] 9ae15a2abf1d9bd0a0df1ff73a88446b9eb33602
 JIRA: https://issues.redhat.com/browse/RHEL-21854
 Upstream: Merged
 CVE: CVE-2023-45236
 Conflicts: Didn't add new file NetworkPkg/SecurityFixes.yaml
 commit 1904a64bcc18199738e5be183d28887ac5d837d7
 Author: Doug Flick <dougflick@microsoft.com>
 Date:   Wed May 8 22:56:29 2024 -0700
    NetworkPkg TcpDxe: SECURITY PATCH CVE-2023-45236
    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4541
    REF: https://www.rfc-editor.org/rfc/rfc1948.txt
    REF: https://www.rfc-editor.org/rfc/rfc6528.txt
    REF: https://www.rfc-editor.org/rfc/rfc9293.txt
    Bug Overview:
    PixieFail Bug #8
    CVE-2023-45236
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
    CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
    Updates TCP ISN generation to use a cryptographic hash of the
    connection's identifying parameters and a secret key.
    This prevents an attacker from guessing the ISN used for some other
    connection.
    This is follows the guidance in RFC 1948, RFC 6528, and RFC 9293.
    RFC: 9293 Section 3.4.1.  Initial Sequence Number Selection
       A TCP implementation MUST use the above type of "clock" for clock-
       driven selection of initial sequence numbers (MUST-8), and SHOULD
       generate its initial sequence numbers with the expression:
       ISN = M + F(localip, localport, remoteip, remoteport, secretkey)
       where M is the 4 microsecond timer, and F() is a pseudorandom
       function (PRF) of the connection's identifying parameters ("localip,
       localport, remoteip, remoteport") and a secret key ("secretkey")
       (SHLD-1).  F() MUST NOT be computable from the outside (MUST-9), or
       an attacker could still guess at sequence numbers from the ISN used
       for some other connection.  The PRF could be implemented as a
       cryptographic hash of the concatenation of the TCP connection
       parameters and some secret data.  For discussion of the selection of
       a specific hash algorithm and management of the secret key data,
       please see Section 3 of [42].
       For each connection there is a send sequence number and a receive
       sequence number.  The initial send sequence number (ISS) is chosen by
       the data sending TCP peer, and the initial receive sequence number
       (IRS) is learned during the connection-establishing procedure.
       For a connection to be established or initialized, the two TCP peers
       must synchronize on each other's initial sequence numbers.  This is
       done in an exchange of connection-establishing segments carrying a
       control bit called "SYN" (for synchronize) and the initial sequence
       numbers.  As a shorthand, segments carrying the SYN bit are also
       called "SYNs".  Hence, the solution requires a suitable mechanism for
       picking an initial sequence number and a slightly involved handshake
       to exchange the ISNs.
    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 NetworkPkg/TcpDxe/TcpDriver.c |  92 ++++++++++++-
 NetworkPkg/TcpDxe/TcpDxe.inf  |   8 +-
 NetworkPkg/TcpDxe/TcpFunc.h   |  23 ++--
 NetworkPkg/TcpDxe/TcpInput.c  |  13 +-
 NetworkPkg/TcpDxe/TcpMain.h   |  59 ++++++--
 NetworkPkg/TcpDxe/TcpMisc.c   | 244 ++++++++++++++++++++++++++++++++--
 NetworkPkg/TcpDxe/TcpTimer.c  |   3 +-
 7 files changed, 394 insertions(+), 48 deletions(-)
 diff --git a/NetworkPkg/TcpDxe/TcpDriver.c b/NetworkPkg/TcpDxe/TcpDriver.c
 index 430911c2f4..34ae838ae0 100644
 --- a/NetworkPkg/TcpDxe/TcpDriver.c
 +++ b/NetworkPkg/TcpDxe/TcpDriver.c
@@ -83,6 +83,12 @@ EFI_SERVICE_BINDING_PROTOCOL  gTcpServiceBinding = {
   TcpServiceBindingDestroyChild
 };
 +//
 +// This is the handle for the Hash2ServiceBinding Protocol instance this driver produces
 +// if the platform does not provide one.
 +//
 +EFI_HANDLE  mHash2ServiceHandle = NULL;
 +
 /**
   Create and start the heartbeat timer for the TCP driver.
@@ -165,6 +171,23 @@ TcpDriverEntryPoint (
   EFI_STATUS  Status;
   UINT32      Random;
 +  //
 +  // Initialize the Secret used for hashing TCP sequence numbers
 +  //
 +  // Normally this should be regenerated periodically, but since
 +  // this is only used for UEFI networking and not a general purpose
 +  // operating system, it is not necessary to regenerate it.
 +  //
 +  Status = PseudoRandomU32 (&mTcpGlobalSecret);
 +  if (EFI_ERROR (Status)) {
 +    DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
 +    return Status;
 +  }
 +
 +  //
 +  // Get a random number used to generate a random port number
 +  // Intentionally not linking this to mTcpGlobalSecret to avoid leaking information about the secret
 +  //
   Status = PseudoRandomU32 (&Random);
   if (EFI_ERROR (Status)) {
     DEBUG ((DEBUG_ERROR, "%a Failed to generate random number: %r\n", __func__, Status));
@@ -207,9 +230,8 @@ TcpDriverEntryPoint (
   }
   //
 -  // Initialize ISS and random port.
 +  // Initialize the random port.
   //
 -  mTcpGlobalIss   = Random % mTcpGlobalIss;
   mTcp4RandomPort = (UINT16)(TCP_PORT_KNOWN + (Random % TCP_PORT_KNOWN));
   mTcp6RandomPort = mTcp4RandomPort;
@@ -224,6 +246,8 @@ TcpDriverEntryPoint (
   @param[in]  IpVersion          IP_VERSION_4 or IP_VERSION_6.
   @retval EFI_OUT_OF_RESOURCES   Failed to allocate some resources.
 +  @retval EFI_UNSUPPORTED        Service Binding Protocols are unavailable.
 +  @retval EFI_ALREADY_STARTED    The TCP driver is already started on the controller.
   @retval EFI_SUCCESS            A new IP6 service binding private was created.
 **/
@@ -234,11 +258,13 @@ TcpCreateService (
   IN UINT8       IpVersion
   )
 {
 -  EFI_STATUS        Status;
 -  EFI_GUID          *IpServiceBindingGuid;
 -  EFI_GUID          *TcpServiceBindingGuid;
 -  TCP_SERVICE_DATA  *TcpServiceData;
 -  IP_IO_OPEN_DATA   OpenData;
 +  EFI_STATUS                    Status;
 +  EFI_GUID                      *IpServiceBindingGuid;
 +  EFI_GUID                      *TcpServiceBindingGuid;
 +  TCP_SERVICE_DATA              *TcpServiceData;
 +  IP_IO_OPEN_DATA               OpenData;
 +  EFI_SERVICE_BINDING_PROTOCOL  *Hash2ServiceBinding;
 +  EFI_HASH2_PROTOCOL            *Hash2Protocol;
   if (IpVersion == IP_VERSION_4) {
     IpServiceBindingGuid  = &gEfiIp4ServiceBindingProtocolGuid;
@@ -272,6 +298,33 @@ TcpCreateService (
     return EFI_UNSUPPORTED;
   }
 +  Status = gBS->LocateProtocol (&gEfiHash2ProtocolGuid, NULL, (VOID **)&Hash2Protocol);
 +  if (EFI_ERROR (Status)) {
 +    //
 +    // If we can't find the Hashing protocol, then we need to create one.
 +    //
 +
 +    //
 +    // Platform is expected to publish the hash service binding protocol to support TCP.
 +    //
 +    Status = gBS->LocateProtocol (
 +                    &gEfiHash2ServiceBindingProtocolGuid,
 +                    NULL,
 +                    (VOID **)&Hash2ServiceBinding
 +                    );
 +    if (EFI_ERROR (Status) || (Hash2ServiceBinding == NULL) || (Hash2ServiceBinding->CreateChild == NULL)) {
 +      return EFI_UNSUPPORTED;
 +    }
 +
 +    //
 +    // Create an instance of the hash protocol for this controller.
 +    //
 +    Status = Hash2ServiceBinding->CreateChild (Hash2ServiceBinding, &mHash2ServiceHandle);
 +    if (EFI_ERROR (Status)) {
 +      return EFI_UNSUPPORTED;
 +    }
 +  }
 +
   //
   // Create the TCP service data.
   //
@@ -423,6 +476,7 @@ TcpDestroyService (
   EFI_STATUS                               Status;
   LIST_ENTRY                               *List;
   TCP_DESTROY_CHILD_IN_HANDLE_BUF_CONTEXT  Context;
 +  EFI_SERVICE_BINDING_PROTOCOL             *Hash2ServiceBinding;
   ASSERT ((IpVersion == IP_VERSION_4) || (IpVersion == IP_VERSION_6));
@@ -439,6 +493,30 @@ TcpDestroyService (
     return EFI_SUCCESS;
   }
 +  //
 +  // Destroy the Hash2ServiceBinding instance if it is created by Tcp driver.
 +  //
 +  if (mHash2ServiceHandle != NULL) {
 +    Status = gBS->LocateProtocol (
 +                    &gEfiHash2ServiceBindingProtocolGuid,
 +                    NULL,
 +                    (VOID **)&Hash2ServiceBinding
 +                    );
 +    if (EFI_ERROR (Status) || (Hash2ServiceBinding == NULL) || (Hash2ServiceBinding->DestroyChild == NULL)) {
 +      return EFI_UNSUPPORTED;
 +    }
 +
 +    //
 +    // Destroy the instance of the hashing protocol for this controller.
 +    //
 +    Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, &mHash2ServiceHandle);
 +    if (EFI_ERROR (Status)) {
 +      return EFI_UNSUPPORTED;
 +    }
 +
 +    mHash2ServiceHandle = NULL;
 +  }
 +
   Status = gBS->OpenProtocol (
                   NicHandle,
                   ServiceBindingGuid,
 diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf b/NetworkPkg/TcpDxe/TcpDxe.inf
 index cf5423f4c5..76de4cf9ec 100644
 --- a/NetworkPkg/TcpDxe/TcpDxe.inf
 +++ b/NetworkPkg/TcpDxe/TcpDxe.inf
@@ -6,6 +6,7 @@
 #  stack has been loaded in system. This driver supports both IPv4 and IPv6 network stack.
 #
 #  Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
 +#  Copyright (c) Microsoft Corporation
 #
 #  SPDX-License-Identifier: BSD-2-Clause-Patent
 #
@@ -68,7 +69,6 @@
   NetLib
   IpIoLib
 -
 [Protocols]
   ## SOMETIMES_CONSUMES
   ## SOMETIMES_PRODUCES
@@ -81,6 +81,12 @@
   gEfiIp6ServiceBindingProtocolGuid             ## TO_START
   gEfiTcp6ProtocolGuid                          ## BY_START
   gEfiTcp6ServiceBindingProtocolGuid            ## BY_START
 +  gEfiHash2ProtocolGuid                         ## BY_START
 +  gEfiHash2ServiceBindingProtocolGuid           ## BY_START
 +
 +[Guids]
 +  gEfiHashAlgorithmMD5Guid                      ## CONSUMES
 +  gEfiHashAlgorithmSha256Guid                   ## CONSUMES
 [Depex]
   gEfiHash2ServiceBindingProtocolGuid
 diff --git a/NetworkPkg/TcpDxe/TcpFunc.h b/NetworkPkg/TcpDxe/TcpFunc.h
 index 05cd3c75dc..e578b8bb29 100644
 --- a/NetworkPkg/TcpDxe/TcpFunc.h
 +++ b/NetworkPkg/TcpDxe/TcpFunc.h
@@ -2,7 +2,7 @@
   Declaration of external functions shared in TCP driver.
   Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
 -
 +  Copyright (c) Microsoft Corporation
   SPDX-License-Identifier: BSD-2-Clause-Patent
 **/
@@ -36,8 +36,11 @@ VOID
   @param[in, out]  Tcb               Pointer to the TCP_CB of this TCP instance.
 +  @retval EFI_SUCCESS             The operation completed successfully
 +  @retval others                  The underlying functions failed and could not complete the operation
 +
 **/
 -VOID
 +EFI_STATUS
 TcpInitTcbLocal (
   IN OUT TCP_CB *Tcb
   );
@@ -128,17 +131,6 @@ TcpCloneTcb (
   IN TCP_CB *Tcb
   );
 -/**
 -  Compute an ISS to be used by a new connection.
 -
 -  @return The result ISS.
 -
 -**/
 -TCP_SEQNO
 -TcpGetIss (
 -  VOID
 -  );
 -
 /**
   Get the local mss.
@@ -202,8 +194,11 @@ TcpFormatNetbuf (
   @param[in, out]  Tcb          Pointer to the TCP_CB that wants to initiate a
                                 connection.
 +  @retval EFI_SUCCESS             The operation completed successfully
 +  @retval others                  The underlying functions failed and could not complete the operation
 +
 **/
 -VOID
 +EFI_STATUS
 TcpOnAppConnect (
   IN OUT TCP_CB  *Tcb
   );
 diff --git a/NetworkPkg/TcpDxe/TcpInput.c b/NetworkPkg/TcpDxe/TcpInput.c
 index 5e6c8c54ca..c0656ccd7d 100644
 --- a/NetworkPkg/TcpDxe/TcpInput.c
 +++ b/NetworkPkg/TcpDxe/TcpInput.c
@@ -759,6 +759,7 @@ TcpInput (
   TCP_SEQNO   Urg;
   UINT16      Checksum;
   INT32       Usable;
 +  EFI_STATUS  Status;
   ASSERT ((Version == IP_VERSION_4) || (Version == IP_VERSION_6));
@@ -908,7 +909,17 @@ TcpInput (
       Tcb->LocalEnd.Port  = Head->DstPort;
       Tcb->RemoteEnd.Port = Head->SrcPort;
 -      TcpInitTcbLocal (Tcb);
 +      Status = TcpInitTcbLocal (Tcb);
 +      if (EFI_ERROR (Status)) {
 +        DEBUG (
 +          (DEBUG_ERROR,
 +           "TcpInput: discard a segment because failed to init local end for TCB %p\n",
 +           Tcb)
 +          );
 +
 +        goto DISCARD;
 +      }
 +
       TcpInitTcbPeer (Tcb, Seg, &Option);
       TcpSetState (Tcb, TCP_SYN_RCVD);
 diff --git a/NetworkPkg/TcpDxe/TcpMain.h b/NetworkPkg/TcpDxe/TcpMain.h
 index 0709298bbf..3fa572d3d4 100644
 --- a/NetworkPkg/TcpDxe/TcpMain.h
 +++ b/NetworkPkg/TcpDxe/TcpMain.h
@@ -3,6 +3,7 @@
   It is the common head file for all Tcp*.c in TCP driver.
   Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
 +  Copyright (c) Microsoft Corporation
   SPDX-License-Identifier: BSD-2-Clause-Patent
 **/
@@ -12,6 +13,7 @@
 #include <Protocol/ServiceBinding.h>
 #include <Protocol/DriverBinding.h>
 +#include <Protocol/Hash2.h>
 #include <Library/IpIoLib.h>
 #include <Library/DevicePathLib.h>
 #include <Library/PrintLib.h>
@@ -30,7 +32,7 @@ extern EFI_UNICODE_STRING_TABLE      *gTcpControllerNameTable;
 extern LIST_ENTRY  mTcpRunQue;
 extern LIST_ENTRY  mTcpListenQue;
 -extern TCP_SEQNO   mTcpGlobalIss;
 +extern TCP_SEQNO   mTcpGlobalSecret;
 extern UINT32      mTcpTick;
 ///
@@ -44,15 +46,6 @@ extern UINT32      mTcpTick;
 #define TCP_EXPIRE_TIME            65535
 -///
 -/// The implementation selects the initial send sequence number and the unit to
 -/// be added when it is increased.
 -///
 -#define TCP_BASE_ISS               0x4d7e980b
 -#define TCP_ISS_INCREMENT_1        2048
 -#define TCP_ISS_INCREMENT_2        100
 -
 -
 typedef union {
   EFI_TCP4_CONFIG_DATA    Tcp4CfgData;
   EFI_TCP6_CONFIG_DATA    Tcp6CfgData;
@@ -774,4 +767,50 @@ Tcp6Poll (
   IN EFI_TCP6_PROTOCOL  *This
   );
 +/**
 +  Retrieves the Initial Sequence Number (ISN) for a TCP connection identified by local
 +  and remote IP addresses and ports.
 +
 +  This method is based on https://datatracker.ietf.org/doc/html/rfc9293#section-3.4.1
 +  Where the ISN is computed as follows:
 +    ISN = TimeStamp + MD5(LocalIP, LocalPort, RemoteIP, RemotePort, Secret)
 +
 +  Otherwise:
 +    ISN = M + F(localip, localport, remoteip, remoteport, secretkey)
 +
 +    "Here M is the 4 microsecond timer, and F() is a pseudorandom function (PRF) of the
 +    connection's identifying parameters ("localip, localport, remoteip, remoteport")
 +    and a secret key ("secretkey") (SHLD-1). F() MUST NOT be computable from the
 +    outside (MUST-9), or an attacker could still guess at sequence numbers from the
 +    ISN used for some other connection. The PRF could be implemented as a
 +    cryptographic hash of the concatenation of the TCP connection parameters and some
 +    secret data. For discussion of the selection of a specific hash algorithm and
 +    management of the secret key data."
 +
 +  @param[in]       LocalIp        A pointer to the local IP address of the TCP connection.
 +  @param[in]       LocalIpSize    The size, in bytes, of the LocalIp buffer.
 +  @param[in]       LocalPort      The local port number of the TCP connection.
 +  @param[in]       RemoteIp       A pointer to the remote IP address of the TCP connection.
 +  @param[in]       RemoteIpSize   The size, in bytes, of the RemoteIp buffer.
 +  @param[in]       RemotePort     The remote port number of the TCP connection.
 +  @param[out]      Isn            A pointer to the variable that will receive the Initial
 +                                  Sequence Number (ISN).
 +
 +  @retval EFI_SUCCESS             The operation completed successfully, and the ISN was
 +                                  retrieved.
 +  @retval EFI_INVALID_PARAMETER   One or more of the input parameters are invalid.
 +  @retval EFI_UNSUPPORTED         The operation is not supported.
 +
 +**/
 +EFI_STATUS
 +TcpGetIsn (
 +  IN UINT8       *LocalIp,
 +  IN UINTN       LocalIpSize,
 +  IN UINT16      LocalPort,
 +  IN UINT8       *RemoteIp,
 +  IN UINTN       RemoteIpSize,
 +  IN UINT16      RemotePort,
 +  OUT TCP_SEQNO  *Isn
 +  );
 +
 #endif
 diff --git a/NetworkPkg/TcpDxe/TcpMisc.c b/NetworkPkg/TcpDxe/TcpMisc.c
 index 3fa9d90d9f..42dc9fa941 100644
 --- a/NetworkPkg/TcpDxe/TcpMisc.c
 +++ b/NetworkPkg/TcpDxe/TcpMisc.c
@@ -3,6 +3,7 @@
   (C) Copyright 2014 Hewlett-Packard Development Company, L.P.<BR>
   Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>
 +  Copyright (c) Microsoft Corporation
   SPDX-License-Identifier: BSD-2-Clause-Patent
 **/
@@ -19,7 +20,34 @@ LIST_ENTRY  mTcpListenQue = {
   &mTcpListenQue
 };
 -TCP_SEQNO       mTcpGlobalIss = TCP_BASE_ISS;
 +//
 +// The Session secret
 +// This must be initialized to a random value at boot time
 +//
 +TCP_SEQNO  mTcpGlobalSecret;
 +
 +//
 +// Union to hold either an IPv4 or IPv6 address
 +// This is used to simplify the ISN hash computation
 +//
 +typedef union {
 +  UINT8    IPv4[4];
 +  UINT8    IPv6[16];
 +} NETWORK_ADDRESS;
 +
 +//
 +// The ISN is computed by hashing this structure
 +// It is initialized with the local and remote IP addresses and ports
 +// and the secret
 +//
 +//
 +typedef struct {
 +  UINT16             LocalPort;
 +  UINT16             RemotePort;
 +  NETWORK_ADDRESS    LocalAddress;
 +  NETWORK_ADDRESS    RemoteAddress;
 +  TCP_SEQNO          Secret;
 +} ISN_HASH_CTX;
 CHAR16  *mTcpStateName[] = {
   L"TCP_CLOSED",
@@ -40,12 +68,18 @@ CHAR16  *mTcpStateName[] = {
   @param[in, out]  Tcb               Pointer to the TCP_CB of this TCP instance.
 +  @retval EFI_SUCCESS             The operation completed successfully
 +  @retval others                  The underlying functions failed and could not complete the operation
 +
 **/
 -VOID
 +EFI_STATUS
 TcpInitTcbLocal (
   IN OUT TCP_CB *Tcb
   )
 {
 +  TCP_SEQNO   Isn;
 +  EFI_STATUS  Status;
 +
   //
   // Compute the checksum of the fixed parts of pseudo header
   //
@@ -56,6 +90,16 @@ TcpInitTcbLocal (
                      0x06,
                      0
                      );
 +
 +    Status = TcpGetIsn (
 +               Tcb->LocalEnd.Ip.v4.Addr,
 +               sizeof (IPv4_ADDRESS),
 +               Tcb->LocalEnd.Port,
 +               Tcb->RemoteEnd.Ip.v4.Addr,
 +               sizeof (IPv4_ADDRESS),
 +               Tcb->RemoteEnd.Port,
 +               &Isn
 +               );
   } else {
     Tcb->HeadSum = NetIp6PseudoHeadChecksum (
                      &Tcb->LocalEnd.Ip.v6,
@@ -63,9 +107,25 @@ TcpInitTcbLocal (
                      0x06,
                      0
                      );
 +
 +    Status = TcpGetIsn (
 +               Tcb->LocalEnd.Ip.v6.Addr,
 +               sizeof (IPv6_ADDRESS),
 +               Tcb->LocalEnd.Port,
 +               Tcb->RemoteEnd.Ip.v6.Addr,
 +               sizeof (IPv6_ADDRESS),
 +               Tcb->RemoteEnd.Port,
 +               &Isn
 +               );
 +  }
 +
 +  if (EFI_ERROR (Status)) {
 +    DEBUG ((DEBUG_ERROR, "TcpInitTcbLocal: failed to get isn\n"));
 +    ASSERT (FALSE);
 +    return Status;
   }
 -  Tcb->Iss    = TcpGetIss ();
 +  Tcb->Iss    = Isn;
   Tcb->SndUna = Tcb->Iss;
   Tcb->SndNxt = Tcb->Iss;
@@ -81,6 +141,8 @@ TcpInitTcbLocal (
   Tcb->RetxmitSeqMax = 0;
   Tcb->ProbeTimerOn = FALSE;
 +
 +  return EFI_SUCCESS;
 }
 /**
@@ -505,18 +567,162 @@ TcpCloneTcb (
 }
 /**
 -  Compute an ISS to be used by a new connection.
 -
 -  @return The resulting ISS.
 +  Retrieves the Initial Sequence Number (ISN) for a TCP connection identified by local
 +  and remote IP addresses and ports.
 +
 +  This method is based on https://datatracker.ietf.org/doc/html/rfc9293#section-3.4.1
 +  Where the ISN is computed as follows:
 +    ISN = TimeStamp + MD5(LocalIP, LocalPort, RemoteIP, RemotePort, Secret)
 +
 +  Otherwise:
 +    ISN = M + F(localip, localport, remoteip, remoteport, secretkey)
 +
 +    "Here M is the 4 microsecond timer, and F() is a pseudorandom function (PRF) of the
 +    connection's identifying parameters ("localip, localport, remoteip, remoteport")
 +    and a secret key ("secretkey") (SHLD-1). F() MUST NOT be computable from the
 +    outside (MUST-9), or an attacker could still guess at sequence numbers from the
 +    ISN used for some other connection. The PRF could be implemented as a
 +    cryptographic hash of the concatenation of the TCP connection parameters and some
 +    secret data. For discussion of the selection of a specific hash algorithm and
 +    management of the secret key data."
 +
 +  @param[in]       LocalIp        A pointer to the local IP address of the TCP connection.
 +  @param[in]       LocalIpSize    The size, in bytes, of the LocalIp buffer.
 +  @param[in]       LocalPort      The local port number of the TCP connection.
 +  @param[in]       RemoteIp       A pointer to the remote IP address of the TCP connection.
 +  @param[in]       RemoteIpSize   The size, in bytes, of the RemoteIp buffer.
 +  @param[in]       RemotePort     The remote port number of the TCP connection.
 +  @param[out]      Isn            A pointer to the variable that will receive the Initial
 +                                  Sequence Number (ISN).
 +
 +  @retval EFI_SUCCESS             The operation completed successfully, and the ISN was
 +                                  retrieved.
 +  @retval EFI_INVALID_PARAMETER   One or more of the input parameters are invalid.
 +  @retval EFI_UNSUPPORTED         The operation is not supported.
 **/
 -TCP_SEQNO
 -TcpGetIss (
 -  VOID
 +EFI_STATUS
 +TcpGetIsn (
 +  IN UINT8       *LocalIp,
 +  IN UINTN       LocalIpSize,
 +  IN UINT16      LocalPort,
 +  IN UINT8       *RemoteIp,
 +  IN UINTN       RemoteIpSize,
 +  IN UINT16      RemotePort,
 +  OUT TCP_SEQNO  *Isn
   )
 {
 -  mTcpGlobalIss += TCP_ISS_INCREMENT_1;
 -  return mTcpGlobalIss;
 +  EFI_STATUS          Status;
 +  EFI_HASH2_PROTOCOL  *Hash2Protocol;
 +  EFI_HASH2_OUTPUT    HashResult;
 +  ISN_HASH_CTX        IsnHashCtx;
 +  EFI_TIME            TimeStamp;
 +
 +  //
 +  // Check that the ISN pointer is valid
 +  //
 +  if (Isn == NULL) {
 +    return EFI_INVALID_PARAMETER;
 +  }
 +
 +  //
 +  // The local ip may be a v4 or v6 address and may not be NULL
 +  //
 +  if ((LocalIp == NULL) || (LocalIpSize == 0) || (RemoteIp == NULL) || (RemoteIpSize == 0)) {
 +    return EFI_INVALID_PARAMETER;
 +  }
 +
 +  //
 +  // the local ip may be a v4 or v6 address
 +  //
 +  if ((LocalIpSize != sizeof (EFI_IPv4_ADDRESS)) && (LocalIpSize != sizeof (EFI_IPv6_ADDRESS))) {
 +    return EFI_INVALID_PARAMETER;
 +  }
 +
 +  //
 +  // Locate the Hash Protocol
 +  //
 +  Status = gBS->LocateProtocol (&gEfiHash2ProtocolGuid, NULL, (VOID **)&Hash2Protocol);
 +  if (EFI_ERROR (Status)) {
 +    DEBUG ((DEBUG_NET, "Failed to locate Hash Protocol: %r\n", Status));
 +
 +    //
 +    // TcpCreateService(..) is expected to be called prior to this function
 +    //
 +    ASSERT_EFI_ERROR (Status);
 +    return Status;
 +  }
 +
 +  //
 +  // Initialize the hash algorithm
 +  //
 +  Status = Hash2Protocol->HashInit (Hash2Protocol, &gEfiHashAlgorithmSha256Guid);
 +  if (EFI_ERROR (Status)) {
 +    DEBUG ((DEBUG_NET, "Failed to initialize sha256 hash algorithm: %r\n", Status));
 +    return Status;
 +  }
 +
 +  IsnHashCtx.LocalPort  = LocalPort;
 +  IsnHashCtx.RemotePort = RemotePort;
 +  IsnHashCtx.Secret     = mTcpGlobalSecret;
 +
 +  //
 +  // Check the IP address family and copy accordingly
 +  //
 +  if (LocalIpSize == sizeof (EFI_IPv4_ADDRESS)) {
 +    CopyMem (&IsnHashCtx.LocalAddress.IPv4, LocalIp, LocalIpSize);
 +  } else if (LocalIpSize == sizeof (EFI_IPv6_ADDRESS)) {
 +    CopyMem (&IsnHashCtx.LocalAddress.IPv6, LocalIp, LocalIpSize);
 +  } else {
 +    return EFI_INVALID_PARAMETER; // Unsupported address size
 +  }
 +
 +  //
 +  // Repeat the process for the remote IP address
 +  //
 +  if (RemoteIpSize == sizeof (EFI_IPv4_ADDRESS)) {
 +    CopyMem (&IsnHashCtx.RemoteAddress.IPv4, RemoteIp, RemoteIpSize);
 +  } else if (RemoteIpSize == sizeof (EFI_IPv6_ADDRESS)) {
 +    CopyMem (&IsnHashCtx.RemoteAddress.IPv6, RemoteIp, RemoteIpSize);
 +  } else {
 +    return EFI_INVALID_PARAMETER; // Unsupported address size
 +  }
 +
 +  //
 +  // Compute the hash
 +  // Update the hash with the data
 +  //
 +  Status = Hash2Protocol->HashUpdate (Hash2Protocol, (UINT8 *)&IsnHashCtx, sizeof (IsnHashCtx));
 +  if (EFI_ERROR (Status)) {
 +    DEBUG ((DEBUG_NET, "Failed to update hash: %r\n", Status));
 +    return Status;
 +  }
 +
 +  //
 +  // Finalize the hash and retrieve the result
 +  //
 +  Status = Hash2Protocol->HashFinal (Hash2Protocol, &HashResult);
 +  if (EFI_ERROR (Status)) {
 +    DEBUG ((DEBUG_NET, "Failed to finalize hash: %r\n", Status));
 +    return Status;
 +  }
 +
 +  Status = gRT->GetTime (&TimeStamp, NULL);
 +  if (EFI_ERROR (Status)) {
 +    return Status;
 +  }
 +
 +  //
 +  // copy the first 4 bytes of the hash result into the ISN
 +  //
 +  CopyMem (Isn, HashResult.Md5Hash, sizeof (*Isn));
 +
 +  //
 +  // now add the timestamp to the ISN as 4 microseconds units (1000 / 4 = 250)
 +  //
 +  *Isn += (TCP_SEQNO)TimeStamp.Nanosecond * 250;
 +
 +  return Status;
 }
 /**
@@ -719,17 +925,29 @@ TcpFormatNetbuf (
   @param[in, out]  Tcb          Pointer to the TCP_CB that wants to initiate a
                                 connection.
 +
 +  @retval EFI_SUCCESS             The operation completed successfully
 +  @retval others                  The underlying functions failed and could not complete the operation
 +
 **/
 -VOID
 +EFI_STATUS
 TcpOnAppConnect (
   IN OUT TCP_CB  *Tcb
   )
 {
 -  TcpInitTcbLocal (Tcb);
 +  EFI_STATUS  Status;
 +
 +  Status = TcpInitTcbLocal (Tcb);
 +  if (EFI_ERROR (Status)) {
 +    return Status;
 +  }
 +
   TcpSetState (Tcb, TCP_SYN_SENT);
   TcpSetTimer (Tcb, TCP_TIMER_CONNECT, Tcb->ConnectTimeout);
   TcpToSendData (Tcb, 1);
 +
 +  return EFI_SUCCESS;
 }
 /**
 diff --git a/NetworkPkg/TcpDxe/TcpTimer.c b/NetworkPkg/TcpDxe/TcpTimer.c
 index 106d9470db..535d09d342 100644
 --- a/NetworkPkg/TcpDxe/TcpTimer.c
 +++ b/NetworkPkg/TcpDxe/TcpTimer.c
@@ -2,7 +2,7 @@
   TCP timer related functions.
   Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
 -
 +  Copyright (c) Microsoft Corporation
   SPDX-License-Identifier: BSD-2-Clause-Patent
 **/
@@ -497,7 +497,6 @@ TcpTickingDpc (
   INT16           Index;
   mTcpTick++;
 -  mTcpGlobalIss += TCP_ISS_INCREMENT_2;
   //
   // Don't use LIST_FOR_EACH, which isn't delete safe.
 -- 
 2.39.3
--- a/SOURCES/edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch
+++ b/SOURCES/edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch
@ -1,202 +0,0 @@
 From d6cdd646e7d9c4cfc78a061d66ab9ba4d2f02cf3 Mon Sep 17 00:00:00 2001
 From: Doug Flick <dougflick@microsoft.com>
 Date: Wed, 8 May 2024 22:56:24 -0700
 Subject: [PATCH] OvmfPkg: Add Hash2DxeCrypto to OvmfPkg
 RH-Author: Oliver Steffen <osteffen@redhat.com>
 RH-MergeRequest: 81: OvmfPkg: Add Hash2DxeCrypto to OvmfPkg
 RH-Jira: RHEL-53009
 RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
 RH-Commit: [1/1] 07d3c21a816826beefe963908284cc8b5dd0b075
 JIRA: https://issues.redhat.com/browse/RHEL-53009
 Upstream: Merged
 Upstream commit 4c4ceb2ceb80 ("NetworkPkg: SECURITY PATCH CVE-2023-45237")
 broke HTTP boot in OVMF. This fixes it.
 commit cb9d71189134e78efb00759eb9649ce92bf5b29a
 Author: Doug Flick <dougflick@microsoft.com>
 Date:   Wed May 8 22:56:24 2024 -0700
    OvmfPkg: Add Hash2DxeCrypto to OvmfPkg
    This patch adds Hash2DxeCrypto to OvmfPkg. The Hash2DxeCrypto is
    used to provide the hashing protocol services.
    Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
    Cc: Jiewen Yao <jiewen.yao@intel.com>
    Cc: Gerd Hoffmann <kraxel@redhat.com>
    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
    Tested-by: Gerd Hoffmann <kraxel@redhat.com>
    Acked-by: Gerd Hoffmann <kraxel@redhat.com>
    Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
 Signed-off-by: Oliver Steffen <osteffen@redhat.com>
 ---
 OvmfPkg/OvmfPkgIa32.dsc    | 6 +++++-
 OvmfPkg/OvmfPkgIa32.fdf    | 5 +++++
 OvmfPkg/OvmfPkgIa32X64.dsc | 6 +++++-
 OvmfPkg/OvmfPkgIa32X64.fdf | 5 +++++
 OvmfPkg/OvmfPkgX64.dsc     | 6 +++++-
 OvmfPkg/OvmfPkgX64.fdf     | 5 +++++
 OvmfPkg/OvmfXen.dsc        | 5 +++++
 OvmfPkg/OvmfXen.fdf        | 5 +++++
 8 files changed, 40 insertions(+), 3 deletions(-)
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
 index f03906a9ff..47c1732409 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -213,7 +213,6 @@
   VariablePolicyLib|MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf
   VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf
 -
   #
   # Network libraries
   #
@@ -884,6 +883,11 @@
   MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
   MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
 +  #
 +  # Hash2 Protocol producer
 +  #
 +  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
 +
   #
   # Network Support
   #
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
 index 050148948c..71fb83b285 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -300,6 +300,11 @@ INF  ShellPkg/Application/Shell/Shell.inf
 INF MdeModulePkg/Logo/LogoDxe.inf
 +#
 +# Hash2 Protocol producer
 +#
 +INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
 +
 #
 # Network modules
 #
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
 index 81145050c3..186f783ff5 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -217,7 +217,6 @@
   VariablePolicyLib|MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf
   VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf
 -
   #
   # Network libraries
   #
@@ -898,6 +897,11 @@
   MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
   MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
 +  #
 +  # Hash2 Protocol producer
 +  #
 +  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
 +
   #
   # Network Support
   #
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
 index 3e2373f225..6762627073 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -304,6 +304,11 @@ INF  ShellPkg/Application/Shell/Shell.inf
 INF MdeModulePkg/Logo/LogoDxe.inf
 +#
 +# Hash2 Protocol producer
 +#
 +INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
 +
 #
 # Network modules
 #
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
 index 1cb169b447..e968ab6be2 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -217,7 +217,6 @@
   VariablePolicyLib|MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf
   VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf
 -
   #
   # Network libraries
   #
@@ -896,6 +895,11 @@
   MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
   MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
 +  #
 +  # Hash2 Protocol producer
 +  #
 +  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
 +
   #
   # Network Support
   #
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
 index 8ba0ca437a..95544c2bc5 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -320,6 +320,11 @@ INF  ShellPkg/Application/Shell/Shell.inf
 INF MdeModulePkg/Logo/LogoDxe.inf
 +#
 +# Hash2 Protocol producer
 +#
 +INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
 +
 #
 # Network modules
 #
 diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc
 index e7c36d1b80..462e57ddcc 100644
 --- a/OvmfPkg/OvmfXen.dsc
 +++ b/OvmfPkg/OvmfXen.dsc
@@ -660,6 +660,11 @@
   MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
   MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
 +  #
 +  # Hash2 Protocol producer
 +  #
 +  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
 +
   #
   # Network Support
   #
 diff --git a/OvmfPkg/OvmfXen.fdf b/OvmfPkg/OvmfXen.fdf
 index 8b58235559..3c64619e8e 100644
 --- a/OvmfPkg/OvmfXen.fdf
 +++ b/OvmfPkg/OvmfXen.fdf
@@ -369,6 +369,11 @@ INF  ShellPkg/Application/Shell/Shell.inf
 INF MdeModulePkg/Logo/LogoDxe.inf
 +#
 +# Hash2 Protocol producer
 +#
 +INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
 +
 #
 # Network modules
 #
 -- 
 2.45.1
--- a/SOURCES/edk2-OvmfPkg-wire-up-RngDxe.patch
+++ b/SOURCES/edk2-OvmfPkg-wire-up-RngDxe.patch
@ -1,318 +0,0 @@
 From c74cced5adaab44edf1bbfae63010b3fa31d4c69 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Sun, 23 Jun 2024 19:20:44 -0400
 Subject: [PATCH 27/31] OvmfPkg: wire up RngDxe
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [27/31] 90226f6630261d2823bed33c4e2f6c96a4125027
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 Conflicts: - Needed to apply 9 earlier commits from Pierre Gondois
             to make this one apply and build.
 	   - Cherry pick wanted to add include files from the
             missing 'add ShellComponents' (commit 2cb466cc2cbf...)
             series. This had to be handled manually.
           - There are no Dsc and Fdf subdirectories under
             OvmfPkg/Include/ in this version. We adjust includes
             and move files to OvmfPkg/ where needed.
 commit 712797cf19acd292bf203522a79e40e7e13d268b
 Author: Gerd Hoffmann <kraxel@redhat.com>
 Date:   Fri May 24 12:51:17 2024 +0200
    OvmfPkg: wire up RngDxe
    Add OvmfRng include snippets with the random number generator
    configuration for OVMF.  Include RngDxe, build with BaseRngLib,
    so the rdrand instruction is used (if available).
    Also move VirtioRng to the include snippets.
    Use the new include snippets for OVMF builds.
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 OvmfPkg/AmdSev/AmdSevX64.dsc      | 2 +-
 OvmfPkg/AmdSev/AmdSevX64.fdf      | 3 ++-
 OvmfPkg/IntelTdx/IntelTdxX64.dsc  | 2 +-
 OvmfPkg/Microvm/MicrovmX64.dsc    | 2 +-
 OvmfPkg/Microvm/MicrovmX64.fdf    | 3 ++-
 OvmfPkg/OvmfPkgIa32.dsc           | 2 +-
 OvmfPkg/OvmfPkgIa32.fdf           | 3 ++-
 OvmfPkg/OvmfPkgIa32X64.dsc        | 2 +-
 OvmfPkg/OvmfPkgIa32X64.fdf        | 2 +-
 OvmfPkg/OvmfPkgX64.dsc            | 2 +-
 OvmfPkg/OvmfPkgX64.fdf            | 2 +-
 OvmfPkg/OvmfRngComponents.dsc.inc | 9 +++++++++
 OvmfPkg/OvmfRngDxe.fdf.inc        | 6 ++++++
 13 files changed, 29 insertions(+), 11 deletions(-)
 create mode 100644 OvmfPkg/OvmfRngComponents.dsc.inc
 create mode 100644 OvmfPkg/OvmfRngDxe.fdf.inc
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
 index a1a6897bc2..499ad2e6e8 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
@@ -707,7 +707,6 @@
   OvmfPkg/Virtio10Dxe/Virtio10.inf
   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
 -  OvmfPkg/VirtioRngDxe/VirtioRng.inf
 !if $(PVSCSI_ENABLE) == TRUE
   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
 !endif
@@ -824,6 +823,7 @@
       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
   }
 !endif
 +!include OvmfPkg/OvmfRngComponents.dsc.inc
   OvmfPkg/PlatformDxe/Platform.inf
   OvmfPkg/AmdSevDxe/AmdSevDxe.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
 index 5662609886..06ff2f1d30 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
@@ -222,7 +222,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
 INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
 INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
 INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
 -INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
 !if $(PVSCSI_ENABLE) == TRUE
 INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
 !endif
@@ -327,6 +326,8 @@ INF  SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
 !endif
 !endif
 +!include OvmfPkg/OvmfRngDxe.fdf.inc
 +
 ################################################################################
 [FV.FVMAIN_COMPACT]
 diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
 index d08b77ff25..4f2909b76e 100644
 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
 +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
@@ -635,7 +635,6 @@
   OvmfPkg/Virtio10Dxe/Virtio10.inf
   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
 -  OvmfPkg/VirtioRngDxe/VirtioRng.inf
 !if $(PVSCSI_ENABLE) == TRUE
   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
 !endif
@@ -744,6 +743,7 @@
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
   }
 +!include OvmfPkg/OvmfRngComponents.dsc.inc
 !if $(SECURE_BOOT_ENABLE) == TRUE
   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
 diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
 index afd4bf3e98..0efb0b456d 100644
 --- a/OvmfPkg/Microvm/MicrovmX64.dsc
 +++ b/OvmfPkg/Microvm/MicrovmX64.dsc
@@ -694,7 +694,6 @@
   OvmfPkg/Virtio10Dxe/Virtio10.inf
   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
 -  OvmfPkg/VirtioRngDxe/VirtioRng.inf
   MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
   MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
   MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
@@ -820,6 +819,7 @@
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
   }
 +!include OvmfPkg/OvmfRngComponents.dsc.inc
   OvmfPkg/PlatformDxe/Platform.inf
   OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/Microvm/MicrovmX64.fdf b/OvmfPkg/Microvm/MicrovmX64.fdf
 index 6314014f3d..bd5afdafe0 100644
 --- a/OvmfPkg/Microvm/MicrovmX64.fdf
 +++ b/OvmfPkg/Microvm/MicrovmX64.fdf
@@ -230,7 +230,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
 INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
 INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
 INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
 -INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
 INF  MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
 INF  MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
@@ -322,6 +321,8 @@ INF  OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf
 INF  MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
 INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
 +!include OvmfPkg/OvmfRngDxe.fdf.inc
 +
 ################################################################################
 [FV.FVMAIN_COMPACT]
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
 index 47426c5cd2..f03906a9ff 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
@@ -801,7 +801,6 @@
   OvmfPkg/Virtio10Dxe/Virtio10.inf
   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
 -  OvmfPkg/VirtioRngDxe/VirtioRng.inf
 !if $(PVSCSI_ENABLE) == TRUE
   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
 !endif
@@ -958,6 +957,7 @@
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
   }
 +!include OvmfPkg/OvmfRngComponents.dsc.inc
 !if $(SECURE_BOOT_ENABLE) == TRUE
   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
 index 00ea14adf0..050148948c 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
@@ -228,7 +228,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
 INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
 INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
 INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
 -INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
 !if $(PVSCSI_ENABLE) == TRUE
 INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
 !endif
@@ -363,6 +362,7 @@ INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
 #
 # TPM support
 #
 +
 !if $(TPM_ENABLE) == TRUE
 INF  SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
 INF  SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
@@ -371,6 +371,7 @@ INF  SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
 INF  SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
 !endif
 !endif
 +!include OvmfPkg/OvmfRngDxe.fdf.inc
 !if $(LOAD_X64_ON_IA32_ENABLE) == TRUE
 INF  OvmfPkg/CompatImageLoaderDxe/CompatImageLoaderDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
 index d4b30e8133..81145050c3 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
@@ -815,7 +815,6 @@
   OvmfPkg/Virtio10Dxe/Virtio10.inf
   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
 -  OvmfPkg/VirtioRngDxe/VirtioRng.inf
 !if $(PVSCSI_ENABLE) == TRUE
   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
 !endif
@@ -972,6 +971,7 @@
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
   }
 +!include OvmfPkg/OvmfRngComponents.dsc.inc
 !if $(SECURE_BOOT_ENABLE) == TRUE
   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
 index e33a40c44e..3e2373f225 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
@@ -232,7 +232,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
 INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
 INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
 INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
 -INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
 !if $(PVSCSI_ENABLE) == TRUE
 INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
 !endif
@@ -381,6 +380,7 @@ INF  SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
 INF  SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
 !endif
 !endif
 +!include OvmfPkg/OvmfRngDxe.fdf.inc
 ################################################################################
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
 index 5b0f6c8747..1cb169b447 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -813,7 +813,6 @@
   OvmfPkg/Virtio10Dxe/Virtio10.inf
   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
 -  OvmfPkg/VirtioRngDxe/VirtioRng.inf
 !if $(PVSCSI_ENABLE) == TRUE
   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
 !endif
@@ -970,6 +969,7 @@
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
   }
 +!include OvmfPkg/OvmfRngComponents.dsc.inc
 !if $(SECURE_BOOT_ENABLE) == TRUE
   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
 index 85b4b23857..8ba0ca437a 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
@@ -248,7 +248,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
 INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
 INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
 INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
 -INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
 !if $(PVSCSI_ENABLE) == TRUE
 INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
 !endif
@@ -397,6 +396,7 @@ INF  SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
 INF  SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
 !endif
 !endif
 +!include OvmfPkg/OvmfRngDxe.fdf.inc
 ################################################################################
 diff --git a/OvmfPkg/OvmfRngComponents.dsc.inc b/OvmfPkg/OvmfRngComponents.dsc.inc
 new file mode 100644
 index 0000000000..68839a0caa
 --- /dev/null
 +++ b/OvmfPkg/OvmfRngComponents.dsc.inc
@@ -0,0 +1,9 @@
 +##
 +#    SPDX-License-Identifier: BSD-2-Clause-Patent
 +##
 +
 +  SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf {
 +    <LibraryClasses>
 +      RngLib|MdePkg/Library/BaseRngLib/BaseRngLib.inf
 +  }
 +  OvmfPkg/VirtioRngDxe/VirtioRng.inf
 diff --git a/OvmfPkg/OvmfRngDxe.fdf.inc b/OvmfPkg/OvmfRngDxe.fdf.inc
 new file mode 100644
 index 0000000000..99cb4a32b1
 --- /dev/null
 +++ b/OvmfPkg/OvmfRngDxe.fdf.inc
@@ -0,0 +1,6 @@
 +##
 +#    SPDX-License-Identifier: BSD-2-Clause-Patent
 +##
 +
 +INF  SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 +INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Add-AArch64-RawAlgorithm-support-.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Add-AArch64-RawAlgorithm-support-.patch
@ -1,246 +0,0 @@
 From 660ffc1753c84e89281d54059c0cb73eef7200d0 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 25 Jun 2024 22:27:16 -0400
 Subject: [PATCH 09/31] SecurityPkg/RngDxe: Add AArch64 RawAlgorithm support
 through ArmTrngLib
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [9/31] 34f5db557b893a686c382a09ceacda728dbd4ad9
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 CVE: CVE-2022-45237
 Upstream: Merged
 commit 863fe9e191fb3d90c3283062183692c04cd71975
 Author: Sami Mujawar <sami.mujawar@arm.com>
 Date:   Fri Oct 28 17:32:55 2022 +0200
    SecurityPkg/RngDxe: Add AArch64 RawAlgorithm support through ArmTrngLib
    Bugzilla: 3668 (https://bugzilla.tianocore.org/show_bug.cgi?id=3668)
    RawAlgorithm is used to provide access to entropy that is suitable
    for cryptographic applications. Therefore, add RawAlgorithm support
    that provides access to entropy using the ArmTrngLib.
    Also remove unused UefiBootServicesTableLib library inclusion
    and Status variable.
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../RngDxe/AArch64/RngDxe.c                   | 28 ++++++--
 .../RandomNumberGenerator/RngDxe/ArmTrng.c    | 71 +++++++++++++++++++
 .../RandomNumberGenerator/RngDxe/RngDxe.inf   |  5 ++
 SecurityPkg/SecurityPkg.dsc                   |  4 ++
 4 files changed, 104 insertions(+), 4 deletions(-)
 create mode 100644 SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
 index c9d66d9777..c0b0d28d48 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
@@ -1,11 +1,13 @@
 /** @file
   RNG Driver to produce the UEFI Random Number Generator protocol.
 -  The driver will use the RNDR instruction to produce random numbers.
 +  The driver can use RNDR instruction (through the RngLib and if FEAT_RNG is
 +  present) to produce random numbers. It also uses the Arm FW-TRNG interface
 +  to implement EFI_RNG_ALGORITHM_RAW.
   RNG Algorithms defined in UEFI 2.4:
    - EFI_RNG_ALGORITHM_SP800_90_CTR_256_GUID
 -   - EFI_RNG_ALGORITHM_RAW                    - Unsupported
 +   - EFI_RNG_ALGORITHM_RAW
    - EFI_RNG_ALGORITHM_SP800_90_HMAC_256_GUID
    - EFI_RNG_ALGORITHM_SP800_90_HASH_256_GUID
    - EFI_RNG_ALGORITHM_X9_31_3DES_GUID        - Unsupported
@@ -26,12 +28,14 @@
 #include <Library/MemoryAllocationLib.h>
 #include <Library/UefiBootServicesTableLib.h>
 #include <Library/RngLib.h>
 +#include <Library/DebugLib.h>
 +#include <Library/ArmTrngLib.h>
 #include <Protocol/Rng.h>
 #include "RngDxeInternals.h"
 // Maximum number of Rng algorithms.
 -#define RNG_AVAILABLE_ALGO_MAX  1
 +#define RNG_AVAILABLE_ALGO_MAX  2
 /** Allocate and initialize mAvailableAlgoArray with the available
     Rng algorithms. Also update mAvailableAlgoArrayCount.
@@ -46,8 +50,9 @@ GetAvailableAlgorithms (
   )
 {
   UINT64  DummyRand;
 +  UINT16  MajorRevision;
 +  UINT16  MinorRevision;
 -  // Allocate RNG_AVAILABLE_ALGO_MAX entries to avoid evaluating
   // Rng algorithms 2 times, one for the allocation, one to populate.
   mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
   if (mAvailableAlgoArray == NULL) {
@@ -64,6 +69,16 @@ GetAvailableAlgorithms (
     mAvailableAlgoArrayCount++;
   }
 +  // Raw algorithm (Trng)
 +  if (!EFI_ERROR (GetArmTrngVersion (&MajorRevision, &MinorRevision))) {
 +    CopyMem (
 +      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
 +      &gEfiRngAlgorithmRaw,
 +      sizeof (EFI_RNG_ALGORITHM)
 +      );
 +    mAvailableAlgoArrayCount++;
 +  }
 +
   return EFI_SUCCESS;
 }
@@ -141,6 +156,11 @@ FoundAlgo:
     return Status;
   }
 +  // Raw algorithm (Trng)
 +  if (CompareGuid (RNGAlgorithm, &gEfiRngAlgorithmRaw)) {
 +    return GenerateEntropy (RNGValueLength, RNGValue);
 +  }
 +
   //
   // Other algorithms are unsupported by this driver.
   //
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c
 new file mode 100644
 index 0000000000..ffe557b692
 --- /dev/null
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c
@@ -0,0 +1,71 @@
 +/** @file
 +  RNG Driver to produce the UEFI Random Number Generator protocol.
 +
 +  The driver implements the EFI_RNG_ALGORITHM_RAW using the FW-TRNG
 +  interface to provide entropy.
 +
 +  Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
 +
 +  SPDX-License-Identifier: BSD-2-Clause-Patent
 +
 +**/
 +
 +#include <Library/BaseLib.h>
 +#include <Library/BaseMemoryLib.h>
 +#include <Library/DebugLib.h>
 +#include <Library/ArmTrngLib.h>
 +#include <Protocol/Rng.h>
 +
 +#include "RngDxeInternals.h"
 +
 +/**
 +  Generate high-quality entropy source using a TRNG or through RDRAND.
 +
 +  @param[in]   Length        Size of the buffer, in bytes, to fill with.
 +  @param[out]  Entropy       Pointer to the buffer to store the entropy data.
 +
 +  @retval  RETURN_SUCCESS            The function completed successfully.
 +  @retval  RETURN_INVALID_PARAMETER  Invalid parameter.
 +  @retval  RETURN_UNSUPPORTED        Function not implemented.
 +  @retval  RETURN_BAD_BUFFER_SIZE    Buffer size is too small.
 +  @retval  RETURN_NOT_READY          No Entropy available.
 +**/
 +EFI_STATUS
 +EFIAPI
 +GenerateEntropy (
 +  IN  UINTN  Length,
 +  OUT UINT8  *Entropy
 +  )
 +{
 +  EFI_STATUS  Status;
 +  UINTN       CollectedEntropyBits;
 +  UINTN       RequiredEntropyBits;
 +  UINTN       EntropyBits;
 +  UINTN       Index;
 +  UINTN       MaxBits;
 +
 +  ZeroMem (Entropy, Length);
 +
 +  RequiredEntropyBits  = (Length << 3);
 +  Index                = 0;
 +  CollectedEntropyBits = 0;
 +  MaxBits              = GetArmTrngMaxSupportedEntropyBits ();
 +  while (CollectedEntropyBits < RequiredEntropyBits) {
 +    EntropyBits = MIN ((RequiredEntropyBits - CollectedEntropyBits), MaxBits);
 +    Status      = GetArmTrngEntropy (
 +                    EntropyBits,
 +                    (Length - Index),
 +                    &Entropy[Index]
 +                    );
 +    if (EFI_ERROR (Status)) {
 +      // Discard the collected bits.
 +      ZeroMem (Entropy, Length);
 +      return Status;
 +    }
 +
 +    CollectedEntropyBits += EntropyBits;
 +    Index                += (EntropyBits >> 3);
 +  } // while
 +
 +  return Status;
 +}
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 index 1985dfbb46..e0e767cbf3 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
@@ -43,8 +43,10 @@
 [Sources.AARCH64]
   AArch64/RngDxe.c
 +  ArmTrng.c
 [Packages]
 +  MdeModulePkg/MdeModulePkg.dec
   MdePkg/MdePkg.dec
   SecurityPkg/SecurityPkg.dec
@@ -57,6 +59,9 @@
   TimerLib
   RngLib
 +[LibraryClasses.AARCH64]
 +  ArmTrngLib
 +
 [Guids]
   gEfiRngAlgorithmSp80090Hash256Guid  ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
   gEfiRngAlgorithmSp80090Hmac256Guid  ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
 diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
 index 73a93c2285..9f58cc2333 100644
 --- a/SecurityPkg/SecurityPkg.dsc
 +++ b/SecurityPkg/SecurityPkg.dsc
@@ -3,6 +3,8 @@
 #
 # Copyright (c) 2009 - 2021, Intel Corporation. All rights reserved.<BR>
 # (C) Copyright 2015-2020 Hewlett Packard Enterprise Development LP<BR>
 +# Copyright (c) 2022, Loongson Technology Corporation Limited. All rights reserved.<BR>
 +# Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
 # SPDX-License-Identifier: BSD-2-Clause-Patent
 #
 ##
@@ -86,6 +88,8 @@
   ArmSoftFloatLib|ArmPkg/Library/ArmSoftFloatLib/ArmSoftFloatLib.inf
 +  ArmTrngLib|MdePkg/Library/BaseArmTrngLibNull/BaseArmTrngLibNull.inf
 +
 [LibraryClasses.ARM]
   RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Add-Arm-support-of-RngDxe.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Add-Arm-support-of-RngDxe.patch
@ -1,311 +0,0 @@
 From 0c6e925403e5aa50a77797af59308e6fee4be6b1 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 25 Jun 2024 22:31:58 -0400
 Subject: [PATCH 12/31] SecurityPkg/RngDxe: Add Arm support of RngDxe
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [12/31] 11b72f6d69392c7b2e8565025a576e76877fe7ed
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 CVE: CVE-2022-45237
 Upstream: Merged
 commit 9eb5ccda505917f6ee80284ed6fb5b51aa7152f9
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Fri Oct 28 17:32:58 2022 +0200
    SecurityPkg/RngDxe: Add Arm support of RngDxe
    Bugzilla: 3668 (https://bugzilla.tianocore.org/show_bug.cgi?id=3668)
    Add RngDxe support for Arm. This implementation uses the ArmTrngLib
    to support the RawAlgorithm and doens't support the RNDR instruction.
    To re-use the RngGetRNG(), RngGetInfo() and FreeAvailableAlgorithms()
    functions, create Arm/AArch64 files which implement the arch specific
    function GetAvailableAlgorithms(). Indeed, FEAT_RNG instruction is not
    supported on Arm.
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../RngDxe/AArch64/AArch64Algo.c              | 72 +++++++++++++++++++
 .../RngDxe/Arm/ArmAlgo.c                      | 51 +++++++++++++
 .../RandomNumberGenerator/RngDxe/ArmRngDxe.c  | 60 ----------------
 .../RandomNumberGenerator/RngDxe/RngDxe.inf   | 12 +++-
 SecurityPkg/SecurityPkg.dsc                   |  2 +-
 5 files changed, 133 insertions(+), 64 deletions(-)
 create mode 100644 SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c
 create mode 100644 SecurityPkg/RandomNumberGenerator/RngDxe/Arm/ArmAlgo.c
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c
 new file mode 100644
 index 0000000000..e8be217f8a
 --- /dev/null
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c
@@ -0,0 +1,72 @@
 +/** @file
 +  Aarch64 specific code.
 +
 +  Copyright (c) 2022, Arm Limited. All rights reserved.<BR>
 +  SPDX-License-Identifier: BSD-2-Clause-Patent
 +**/
 +
 +#include <Library/BaseLib.h>
 +#include <Library/BaseMemoryLib.h>
 +#include <Library/DebugLib.h>
 +#include <Library/MemoryAllocationLib.h>
 +#include <Library/ArmTrngLib.h>
 +
 +#include "RngDxeInternals.h"
 +
 +// Maximum number of Rng algorithms.
 +#define RNG_AVAILABLE_ALGO_MAX  2
 +
 +/** Allocate and initialize mAvailableAlgoArray with the available
 +    Rng algorithms. Also update mAvailableAlgoArrayCount.
 +
 +  @retval EFI_SUCCESS             The function completed successfully.
 +  @retval EFI_OUT_OF_RESOURCES    Could not allocate memory.
 +**/
 +EFI_STATUS
 +EFIAPI
 +GetAvailableAlgorithms (
 +  VOID
 +  )
 +{
 +  UINT64  DummyRand;
 +  UINT16  MajorRevision;
 +  UINT16  MinorRevision;
 +
 +  // Rng algorithms 2 times, one for the allocation, one to populate.
 +  mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
 +  if (mAvailableAlgoArray == NULL) {
 +    return EFI_OUT_OF_RESOURCES;
 +  }
 +
 +  // Check RngGetBytes() before advertising PcdCpuRngSupportedAlgorithm.
 +  if (!EFI_ERROR (RngGetBytes (sizeof (DummyRand), (UINT8 *)&DummyRand))) {
 +    CopyMem (
 +      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
 +      PcdGetPtr (PcdCpuRngSupportedAlgorithm),
 +      sizeof (EFI_RNG_ALGORITHM)
 +      );
 +    mAvailableAlgoArrayCount++;
 +
 +    DEBUG_CODE_BEGIN ();
 +    if (IsZeroGuid (PcdGetPtr (PcdCpuRngSupportedAlgorithm))) {
 +      DEBUG ((
 +        DEBUG_WARN,
 +        "PcdCpuRngSupportedAlgorithm should be a non-zero GUID\n"
 +        ));
 +    }
 +
 +    DEBUG_CODE_END ();
 +  }
 +
 +  // Raw algorithm (Trng)
 +  if (!EFI_ERROR (GetArmTrngVersion (&MajorRevision, &MinorRevision))) {
 +    CopyMem (
 +      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
 +      &gEfiRngAlgorithmRaw,
 +      sizeof (EFI_RNG_ALGORITHM)
 +      );
 +    mAvailableAlgoArrayCount++;
 +  }
 +
 +  return EFI_SUCCESS;
 +}
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Arm/ArmAlgo.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Arm/ArmAlgo.c
 new file mode 100644
 index 0000000000..4b24f5c4a6
 --- /dev/null
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Arm/ArmAlgo.c
@@ -0,0 +1,51 @@
 +/** @file
 +  Arm specific code.
 +
 +  Copyright (c) 2022, Arm Limited. All rights reserved.<BR>
 +  SPDX-License-Identifier: BSD-2-Clause-Patent
 +**/
 +
 +#include <Library/BaseLib.h>
 +#include <Library/BaseMemoryLib.h>
 +#include <Library/DebugLib.h>
 +#include <Library/MemoryAllocationLib.h>
 +#include <Library/ArmTrngLib.h>
 +
 +#include "RngDxeInternals.h"
 +
 +// Maximum number of Rng algorithms.
 +#define RNG_AVAILABLE_ALGO_MAX  1
 +
 +/** Allocate and initialize mAvailableAlgoArray with the available
 +    Rng algorithms. Also update mAvailableAlgoArrayCount.
 +
 +  @retval EFI_SUCCESS             The function completed successfully.
 +  @retval EFI_OUT_OF_RESOURCES    Could not allocate memory.
 +**/
 +EFI_STATUS
 +EFIAPI
 +GetAvailableAlgorithms (
 +  VOID
 +  )
 +{
 +  UINT16  MajorRevision;
 +  UINT16  MinorRevision;
 +
 +  // Rng algorithms 2 times, one for the allocation, one to populate.
 +  mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
 +  if (mAvailableAlgoArray == NULL) {
 +    return EFI_OUT_OF_RESOURCES;
 +  }
 +
 +  // Raw algorithm (Trng)
 +  if (!EFI_ERROR (GetArmTrngVersion (&MajorRevision, &MinorRevision))) {
 +    CopyMem (
 +      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
 +      &gEfiRngAlgorithmRaw,
 +      sizeof (EFI_RNG_ALGORITHM)
 +      );
 +    mAvailableAlgoArrayCount++;
 +  }
 +
 +  return EFI_SUCCESS;
 +}
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
 index a800a85792..5e7d9ef681 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
@@ -28,70 +28,10 @@
 #include <Library/MemoryAllocationLib.h>
 #include <Library/UefiBootServicesTableLib.h>
 #include <Library/RngLib.h>
 -#include <Library/DebugLib.h>
 -#include <Library/ArmTrngLib.h>
 #include <Protocol/Rng.h>
 #include "RngDxeInternals.h"
 -// Maximum number of Rng algorithms.
 -#define RNG_AVAILABLE_ALGO_MAX  2
 -
 -/** Allocate and initialize mAvailableAlgoArray with the available
 -    Rng algorithms. Also update mAvailableAlgoArrayCount.
 -
 -  @retval EFI_SUCCESS             The function completed successfully.
 -  @retval EFI_OUT_OF_RESOURCES    Could not allocate memory.
 -**/
 -EFI_STATUS
 -EFIAPI
 -GetAvailableAlgorithms (
 -  VOID
 -  )
 -{
 -  UINT64  DummyRand;
 -  UINT16  MajorRevision;
 -  UINT16  MinorRevision;
 -
 -  // Rng algorithms 2 times, one for the allocation, one to populate.
 -  mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
 -  if (mAvailableAlgoArray == NULL) {
 -    return EFI_OUT_OF_RESOURCES;
 -  }
 -
 -  // Check RngGetBytes() before advertising PcdCpuRngSupportedAlgorithm.
 -  if (!EFI_ERROR (RngGetBytes (sizeof (DummyRand), (UINT8 *)&DummyRand))) {
 -    CopyMem (
 -      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
 -      PcdGetPtr (PcdCpuRngSupportedAlgorithm),
 -      sizeof (EFI_RNG_ALGORITHM)
 -      );
 -    mAvailableAlgoArrayCount++;
 -
 -    DEBUG_CODE_BEGIN ();
 -    if (IsZeroGuid (PcdGetPtr (PcdCpuRngSupportedAlgorithm))) {
 -      DEBUG ((
 -        DEBUG_WARN,
 -        "PcdCpuRngSupportedAlgorithm should be a non-zero GUID\n"
 -        ));
 -    }
 -
 -    DEBUG_CODE_END ();
 -  }
 -
 -  // Raw algorithm (Trng)
 -  if (!EFI_ERROR (GetArmTrngVersion (&MajorRevision, &MinorRevision))) {
 -    CopyMem (
 -      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
 -      &gEfiRngAlgorithmRaw,
 -      sizeof (EFI_RNG_ALGORITHM)
 -      );
 -    mAvailableAlgoArrayCount++;
 -  }
 -
 -  return EFI_SUCCESS;
 -}
 -
 /** Free mAvailableAlgoArray.
 **/
 VOID
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 index 1d0bdef57d..c8e0ee4ae5 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
@@ -28,7 +28,7 @@
 #
 # The following information is for reference only and not required by the build tools.
 #
 -#  VALID_ARCHITECTURES           = IA32 X64 AARCH64
 +#  VALID_ARCHITECTURES           = IA32 X64 AARCH64 ARM
 #
 [Sources.common]
@@ -41,10 +41,16 @@
   Rand/AesCore.c
   Rand/AesCore.h
 -[Sources.AARCH64]
 +[Sources.AARCH64, Sources.ARM]
   ArmRngDxe.c
   ArmTrng.c
 +[Sources.AARCH64]
 +  AArch64/AArch64Algo.c
 +
 +[Sources.ARM]
 +  Arm/ArmAlgo.c
 +
 [Packages]
   MdeModulePkg/MdeModulePkg.dec
   MdePkg/MdePkg.dec
@@ -59,7 +65,7 @@
   TimerLib
   RngLib
 -[LibraryClasses.AARCH64]
 +[LibraryClasses.AARCH64, LibraryClasses.ARM]
   ArmTrngLib
 [Guids]
 diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
 index 9f58cc2333..36493f04ee 100644
 --- a/SecurityPkg/SecurityPkg.dsc
 +++ b/SecurityPkg/SecurityPkg.dsc
@@ -281,7 +281,7 @@
   SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf
   SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf
 -[Components.IA32, Components.X64, Components.AARCH64]
 +[Components.IA32, Components.X64, Components.AARCH64, Components.ARM]
   #
   # Random Number Generator
   #
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Add-debug-warning-for-NULL-PcdCpu.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Add-debug-warning-for-NULL-PcdCpu.patch
@ -1,58 +0,0 @@
 From 8b78800fed2a4af7c08eebd20d1bf764e8e10c84 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 25 Jun 2024 22:28:58 -0400
 Subject: [PATCH 10/31] SecurityPkg/RngDxe: Add debug warning for NULL
 PcdCpuRngSupportedAlgorithm
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [10/31] 66b888e9b1e2be0c79784e02b4821854bd80432d
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 CVE: CVE-2022-45237
 Upstream: Merged
 commit 6cdddccf0085cf2929f8ae710515e4e53663dfb2
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Fri Oct 28 17:32:56 2022 +0200
    SecurityPkg/RngDxe: Add debug warning for NULL PcdCpuRngSupportedAlgorithm
    PcdCpuRngSupportedAlgorithm should allow to identify the the algorithm
    used by the RNDR CPU instruction to generate a random number.
    Add a debug warning if the Pcd is not set.
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../RandomNumberGenerator/RngDxe/AArch64/RngDxe.c      | 10 ++++++++++
 1 file changed, 10 insertions(+)
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
 index c0b0d28d48..a800a85792 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
@@ -67,6 +67,16 @@ GetAvailableAlgorithms (
       sizeof (EFI_RNG_ALGORITHM)
       );
     mAvailableAlgoArrayCount++;
 +
 +    DEBUG_CODE_BEGIN ();
 +    if (IsZeroGuid (PcdGetPtr (PcdCpuRngSupportedAlgorithm))) {
 +      DEBUG ((
 +        DEBUG_WARN,
 +        "PcdCpuRngSupportedAlgorithm should be a non-zero GUID\n"
 +        ));
 +    }
 +
 +    DEBUG_CODE_END ();
   }
   // Raw algorithm (Trng)
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Check-before-advertising-Cpu-Rng-.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Check-before-advertising-Cpu-Rng-.patch
@ -1,336 +0,0 @@
 From 5bd27a5a923c8880a06d52fca48e304becbbb8f6 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 25 Jun 2024 22:25:23 -0400
 Subject: [PATCH 08/31] SecurityPkg/RngDxe: Check before advertising Cpu Rng
 algo
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [8/31] 5417b276749a2d1b1afa9465b5b7a501def26a12
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 CVE: CVE-2022-45237
 Upstream: Merged
 commit 4b3e9d80bedf5909a4ec901425ed9c0a738fc76f
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Fri Oct 28 17:32:54 2022 +0200
    SecurityPkg/RngDxe: Check before advertising Cpu Rng algo
    RngGetBytes() relies on the RngLib. The RngLib might use the RNDR
    instruction if the FEAT_RNG feature is present. RngGetInfo and
    RngGetRNG both must check that RngGetBytes() is working before
    advertising/using it.
    To do so, allocate an array storing the available algorithms.
    The Rng algorithm at the lowest index will be the default Rng
    algorithm. The array is shared between RngGetInfo and RngGetRNG.
    This array is allocated when the driver is loaded, and freed
    when unloaded.
    This patch also prevents from having PcdCpuRngSupportedAlgorithm
    let to a zero GUID, but let the possibility to have no valid Rng
    algorithm in such case.
    Signed-off-by: Pierre Gondois <Pierre.Gondois@arm.com>
    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../RngDxe/AArch64/RngDxe.c                   | 87 +++++++++++++++++--
 .../RngDxe/Rand/RngDxe.c                      | 26 ++++++
 .../RandomNumberGenerator/RngDxe/RngDxe.c     | 40 ++++++++-
 .../RandomNumberGenerator/RngDxe/RngDxe.inf   |  1 +
 .../RngDxe/RngDxeInternals.h                  | 27 ++++++
 5 files changed, 172 insertions(+), 9 deletions(-)
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
 index 8c6ad4ed43..c9d66d9777 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
@@ -22,11 +22,63 @@
 #include <Library/BaseLib.h>
 #include <Library/BaseMemoryLib.h>
 +#include <Library/DebugLib.h>
 +#include <Library/MemoryAllocationLib.h>
 #include <Library/UefiBootServicesTableLib.h>
 +#include <Library/RngLib.h>
 #include <Protocol/Rng.h>
 #include "RngDxeInternals.h"
 +// Maximum number of Rng algorithms.
 +#define RNG_AVAILABLE_ALGO_MAX  1
 +
 +/** Allocate and initialize mAvailableAlgoArray with the available
 +    Rng algorithms. Also update mAvailableAlgoArrayCount.
 +
 +  @retval EFI_SUCCESS             The function completed successfully.
 +  @retval EFI_OUT_OF_RESOURCES    Could not allocate memory.
 +**/
 +EFI_STATUS
 +EFIAPI
 +GetAvailableAlgorithms (
 +  VOID
 +  )
 +{
 +  UINT64  DummyRand;
 +
 +  // Allocate RNG_AVAILABLE_ALGO_MAX entries to avoid evaluating
 +  // Rng algorithms 2 times, one for the allocation, one to populate.
 +  mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
 +  if (mAvailableAlgoArray == NULL) {
 +    return EFI_OUT_OF_RESOURCES;
 +  }
 +
 +  // Check RngGetBytes() before advertising PcdCpuRngSupportedAlgorithm.
 +  if (!EFI_ERROR (RngGetBytes (sizeof (DummyRand), (UINT8 *)&DummyRand))) {
 +    CopyMem (
 +      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
 +      PcdGetPtr (PcdCpuRngSupportedAlgorithm),
 +      sizeof (EFI_RNG_ALGORITHM)
 +      );
 +    mAvailableAlgoArrayCount++;
 +  }
 +
 +  return EFI_SUCCESS;
 +}
 +
 +/** Free mAvailableAlgoArray.
 +**/
 +VOID
 +EFIAPI
 +FreeAvailableAlgorithms (
 +  VOID
 +  )
 +{
 +  FreePool (mAvailableAlgoArray);
 +  return;
 +}
 +
 /**
   Produces and returns an RNG value using either the default or specified RNG algorithm.
@@ -59,6 +111,7 @@ RngGetRNG (
   )
 {
   EFI_STATUS    Status;
 +  UINTN       Index;
   if ((This == NULL) || (RNGValueLength == 0) || (RNGValue == NULL)) {
     return EFI_INVALID_PARAMETER;
@@ -68,9 +121,21 @@ RngGetRNG (
     //
     // Use the default RNG algorithm if RNGAlgorithm is NULL.
     //
 -    RNGAlgorithm = PcdGetPtr (PcdCpuRngSupportedAlgorithm);
 +    for (Index = 0; Index < mAvailableAlgoArrayCount; Index++) {
 +      if (!IsZeroGuid (&mAvailableAlgoArray[Index])) {
 +        RNGAlgorithm = &mAvailableAlgoArray[Index];
 +        goto FoundAlgo;
 +      }
 +    }
 +
 +    if (Index == mAvailableAlgoArrayCount) {
 +      // No algorithm available.
 +      ASSERT (Index != mAvailableAlgoArrayCount);
 +      return EFI_DEVICE_ERROR;
 +    }
   }
 +FoundAlgo:
   if (CompareGuid (RNGAlgorithm, PcdGetPtr (PcdCpuRngSupportedAlgorithm))) {
     Status = RngGetBytes (RNGValueLength, RNGValue);
     return Status;
@@ -113,24 +178,30 @@ RngGetInfo (
   OUT EFI_RNG_ALGORITHM  *RNGAlgorithmList
   )
 {
 -  UINTN RequiredSize;
 -  EFI_RNG_ALGORITHM *CpuRngSupportedAlgorithm;
 -
 -  RequiredSize = sizeof (EFI_RNG_ALGORITHM);
 +  UINTN  RequiredSize;
   if ((This == NULL) || (RNGAlgorithmListSize == NULL)) {
     return EFI_INVALID_PARAMETER;
   }
 +  RequiredSize = mAvailableAlgoArrayCount * sizeof (EFI_RNG_ALGORITHM);
 +
 +  if (RequiredSize == 0) {
 +    // No supported algorithms found.
 +    return EFI_UNSUPPORTED;
 +  }
 +
   if (*RNGAlgorithmListSize < RequiredSize) {
     *RNGAlgorithmListSize = RequiredSize;
     return EFI_BUFFER_TOO_SMALL;
   }
 -  CpuRngSupportedAlgorithm = PcdGetPtr (PcdCpuRngSupportedAlgorithm);
 -
 -  CopyMem(&RNGAlgorithmList[0], CpuRngSupportedAlgorithm, sizeof (EFI_RNG_ALGORITHM));
 +  if (RNGAlgorithmList == NULL) {
 +    return EFI_INVALID_PARAMETER;
 +  }
 +  // There is no gap in the array, so copy the block.
 +  CopyMem (RNGAlgorithmList, mAvailableAlgoArray, RequiredSize);
   *RNGAlgorithmListSize = RequiredSize;
   return EFI_SUCCESS;
 }
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
 index 70b6ac20c9..7caa64a4ff 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
@@ -26,6 +26,32 @@
 #include "RngDxeInternals.h"
 +/** Allocate and initialize mAvailableAlgoArray with the available
 +    Rng algorithms. Also update mAvailableAlgoArrayCount.
 +
 +  @retval EFI_SUCCESS             The function completed successfully.
 +  @retval EFI_OUT_OF_RESOURCES    Could not allocate memory.
 +**/
 +EFI_STATUS
 +EFIAPI
 +GetAvailableAlgorithms (
 +  VOID
 +  )
 +{
 +  return EFI_SUCCESS;
 +}
 +
 +/** Free mAvailableAlgoArray.
 +**/
 +VOID
 +EFIAPI
 +FreeAvailableAlgorithms (
 +  VOID
 +  )
 +{
 +  return;
 +}
 +
 /**
   Produces and returns an RNG value using either the default or specified RNG algorithm.
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
 index 4599728889..cc2ddfcc06 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
@@ -27,6 +27,13 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include "RngDxeInternals.h"
 +//
 +// Array containing the validated Rng algorithm.
 +// The entry with the lowest index will be the default algorithm.
 +//
 +UINTN              mAvailableAlgoArrayCount;
 +EFI_RNG_ALGORITHM  *mAvailableAlgoArray;
 +
 //
 // The Random Number Generator (RNG) protocol
 //
@@ -66,8 +73,39 @@ RngDriverEntry (
                   &mRngRdRand,
                   NULL
                   );
 +  if (EFI_ERROR (Status)) {
 +    return Status;
 +  }
 +
 +  //
 +  // Get the list of available algorithm.
 +  //
 +  return GetAvailableAlgorithms ();
 +}
 +
 +/**
 +  This is the unload handle for RndgDxe module.
 +
 +  Disconnect the driver specified by ImageHandle from all the devices in the handle database.
 +  Uninstall all the protocols installed in the driver entry point.
 -  return Status;
 +  @param[in] ImageHandle           The drivers' driver image.
 +
 +  @retval    EFI_SUCCESS           The image is unloaded.
 +  @retval    Others                Failed to unload the image.
 +
 +**/
 +EFI_STATUS
 +EFIAPI
 +RngDriverUnLoad (
 +  IN EFI_HANDLE  ImageHandle
 +  )
 +{
 +  //
 +  // Free the list of available algorithm.
 +  //
 +  FreeAvailableAlgorithms ();
 +  return EFI_SUCCESS;
 }
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 index 60efb5562e..1985dfbb46 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
@@ -22,6 +22,7 @@
   MODULE_TYPE                    = DXE_DRIVER
   VERSION_STRING                 = 1.0
   ENTRY_POINT                    = RngDriverEntry
 +  UNLOAD_IMAGE                   = RngDriverUnLoad
   MODULE_UNI_FILE                = RngDxe.uni
 #
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
 index f17adb83fb..0ef5e6522f 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
@@ -12,6 +12,33 @@
 #include <Protocol/Rng.h>
 +//
 +// Array containing the validated Rng algorithm.
 +// The entry with the lowest index will be the default algorithm.
 +//
 +extern UINTN              mAvailableAlgoArrayCount;
 +extern EFI_RNG_ALGORITHM  *mAvailableAlgoArray;
 +
 +/** Allocate and initialize mAvailableAlgoArray with the available
 +    Rng algorithms. Also update mAvailableAlgoArrayCount.
 +
 +  @retval EFI_SUCCESS             The function completed successfully.
 +  @retval EFI_OUT_OF_RESOURCES    Could not allocate memory.
 +**/
 +EFI_STATUS
 +EFIAPI
 +GetAvailableAlgorithms (
 +  VOID
 +  );
 +
 +/** Free mAvailableAlgoArray.
 +**/
 +VOID
 +EFIAPI
 +FreeAvailableAlgorithms (
 +  VOID
 +  );
 +
 /**
   Returns information about the random number generation implementation.
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Conditionally-install-EFI_RNG_PRO.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Conditionally-install-EFI_RNG_PRO.patch
@ -1,79 +0,0 @@
 From e7444d0b84a8fd41aa63ecb083e65fd56b32fd38 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Sun, 23 Jun 2024 14:21:01 -0400
 Subject: [PATCH 14/31] SecurityPkg/RngDxe: Conditionally install
 EFI_RNG_PROTOCOL
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [14/31] bc64d4cad6c30353723d674ef9f10eb10aeb1cac
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit 75fb0cfc82376906243386514be0e4067d702117
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Thu Nov 24 17:17:55 2022 +0100
    SecurityPkg/RngDxe: Conditionally install EFI_RNG_PROTOCOL
    On Arm platforms, the number of available RNG algorithms is
    dynamically detected and can be 0 in the absence of FEAT_RNG
    and firmware TRNG.
    In this case, the EFI_RNG_PROTOCOL should not be installed to
    prevent from installing an empty protocol.
    Signed-off-by: Pierre Gondois <Pierre.Gondois@arm.com>
    [ardb: return EFI_REQUEST_UNLOAD_IMAGE instead of an error]
    Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../RandomNumberGenerator/RngDxe/RngDxe.c     | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
 index cc2ddfcc06..55e8dd49d0 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
@@ -63,6 +63,18 @@ RngDriverEntry (
   EFI_STATUS    Status;
   EFI_HANDLE    Handle;
 +  //
 +  // Get the list of available algorithm.
 +  //
 +  Status = GetAvailableAlgorithms ();
 +  if (EFI_ERROR (Status)) {
 +    return Status;
 +  }
 +
 +  if (mAvailableAlgoArrayCount == 0) {
 +    return EFI_REQUEST_UNLOAD_IMAGE;
 +  }
 +
   //
   // Install UEFI RNG (Random Number Generator) Protocol
   //
@@ -74,13 +86,10 @@ RngDriverEntry (
                   NULL
                   );
   if (EFI_ERROR (Status)) {
 -    return Status;
 +    FreeAvailableAlgorithms ();
   }
 -  //
 -  // Get the list of available algorithm.
 -  //
 -  return GetAvailableAlgorithms ();
 +  return Status;
 }
 /**
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Correctly-update-mAvailableAlgoAr.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Correctly-update-mAvailableAlgoAr.patch
@ -1,105 +0,0 @@
 From b9a937603080bfada6c224a6e9da046a8a33f868 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Sun, 23 Jun 2024 14:18:18 -0400
 Subject: [PATCH 13/31] SecurityPkg/RngDxe: Correctly update
 mAvailableAlgoArrayCount
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [13/31] 3e06e270cad90038537305a4cb7828fcc45251fb
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit bfb574db110899471fe09db819587b3151c7b7b5
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Thu Nov 24 17:17:54 2022 +0100
    SecurityPkg/RngDxe: Correctly update mAvailableAlgoArrayCount
    mAvailableAlgoArrayCount holds the count of available RNG algorithms.
    In a following patch, its value will be used to prevent the
    EFI_RNG_PROTOCOL to be installed if no RNG algorithm is available.
    Correctly set/reset the value for all implementations.
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../RandomNumberGenerator/RngDxe/ArmRngDxe.c     |  1 +
 .../RandomNumberGenerator/RngDxe/Rand/RngDxe.c   | 16 ++++++++++++++--
 2 files changed, 15 insertions(+), 2 deletions(-)
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
 index 5e7d9ef681..0e44d0c931 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
@@ -40,6 +40,7 @@ FreeAvailableAlgorithms (
   VOID
   )
 {
 +  mAvailableAlgoArrayCount = 0;
   FreePool (mAvailableAlgoArray);
   return;
 }
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
 index 7caa64a4ff..149de875ce 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
@@ -26,6 +26,11 @@
 #include "RngDxeInternals.h"
 +//
 +// Count of Rng algorithms.
 +//
 +#define RNG_ALGORITHM_COUNT  2
 +
 /** Allocate and initialize mAvailableAlgoArray with the available
     Rng algorithms. Also update mAvailableAlgoArrayCount.
@@ -38,6 +43,13 @@ GetAvailableAlgorithms (
   VOID
   )
 {
 +
 +  UINT64  RngTest;
 +
 +  if (GetRandomNumber64 (&RngTest)) {
 +    mAvailableAlgoArrayCount = RNG_ALGORITHM_COUNT;
 +  }
 +
   return EFI_SUCCESS;
 }
@@ -49,6 +61,7 @@ FreeAvailableAlgorithms (
   VOID
   )
 {
 +  mAvailableAlgoArrayCount = 0;
   return;
 }
@@ -159,13 +172,12 @@ RngGetInfo (
   )
 {
   UINTN RequiredSize;
 -  EFI_RNG_ALGORITHM *CpuRngSupportedAlgorithm;
   if ((This == NULL) || (RNGAlgorithmListSize == NULL)) {
     return EFI_INVALID_PARAMETER;
   }
 -  RequiredSize = 2 * sizeof (EFI_RNG_ALGORITHM);
 +  RequiredSize = RNG_ALGORITHM_COUNT * sizeof (EFI_RNG_ALGORITHM);
   if (*RNGAlgorithmListSize < RequiredSize) {
     *RNGAlgorithmListSize = RequiredSize;
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Documentation-include-parameter-c.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Documentation-include-parameter-c.patch
@ -1,98 +0,0 @@
 From 0f8890578f46bc791d007b19dbbfa0dd2805032d Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 25 Jun 2024 22:23:42 -0400
 Subject: [PATCH 07/31] SecurityPkg/RngDxe: Documentation/include/parameter
 cleanup
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [7/31] 19a0a13d18fc7f92c7b05e8da08f4d83df77ea6c
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 CVE: CVE-2022-45237
 Upstream: Merged
 commit 199031b2b0233652ad5d5fdf73f0f44c0f264d55
 Author: Pierre Gondois <Pierre.Gondois@arm.com>
 Date:   Fri Oct 28 17:32:53 2022 +0200
    SecurityPkg/RngDxe: Documentation/include/parameter cleanup
    This patch:
    -Update RngGetBytes() documentation to align the function
     definition and declaration.
    -Improve input parameter checking. Even though 'This'
     it is not used, the parameter should always point to the
     current EFI_RNG_PROTOCOL.
    -Removes TimerLib inclusion as unused.
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c | 3 +--
 SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c    | 2 +-
 SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c         | 3 +--
 3 files changed, 3 insertions(+), 5 deletions(-)
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
 index f6a0bf7b2b..8c6ad4ed43 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
@@ -23,7 +23,6 @@
 #include <Library/BaseLib.h>
 #include <Library/BaseMemoryLib.h>
 #include <Library/UefiBootServicesTableLib.h>
 -#include <Library/TimerLib.h>
 #include <Protocol/Rng.h>
 #include "RngDxeInternals.h"
@@ -61,7 +60,7 @@ RngGetRNG (
 {
   EFI_STATUS    Status;
 -  if ((RNGValueLength == 0) || (RNGValue == NULL)) {
 +  if ((This == NULL) || (RNGValueLength == 0) || (RNGValue == NULL)) {
     return EFI_INVALID_PARAMETER;
   }
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
 index 5a649ecf24..70b6ac20c9 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
@@ -59,7 +59,7 @@ RngGetRNG (
 {
   EFI_STATUS    Status;
 -  if ((RNGValueLength == 0) || (RNGValue == NULL)) {
 +  if ((This == NULL) || (RNGValueLength == 0) || (RNGValue == NULL)) {
     return EFI_INVALID_PARAMETER;
   }
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
 index 7b8ecfc70d..4599728889 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
@@ -23,7 +23,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Library/BaseMemoryLib.h>
 #include <Library/UefiBootServicesTableLib.h>
 #include <Library/RngLib.h>
 -#include <Library/TimerLib.h>
 #include <Protocol/Rng.h>
 #include "RngDxeInternals.h"
@@ -73,7 +72,7 @@ RngDriverEntry (
 /**
 -  Calls RDRAND to fill a buffer of arbitrary size with random bytes.
 +  Runs CPU RNG instruction to fill a buffer of arbitrary size with random bytes.
   @param[in]   Length        Size of the buffer, in bytes,  to fill with.
   @param[out]  RandBuffer    Pointer to the buffer to store the random result.
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Remove-ArchGetSupportedRngAlgorit.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Remove-ArchGetSupportedRngAlgorit.patch
@ -1,258 +0,0 @@
 From df912b4c93cd848991d9a9439d3aba441bae1d67 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 25 Jun 2024 22:21:09 -0400
 Subject: [PATCH 06/31] SecurityPkg/RngDxe: Remove
 ArchGetSupportedRngAlgorithms()
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [6/31] 4066cb1503b5c5a29b6d45a4b671d0829f2671ae
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 CVE: CVE-2022-45237
 Upstream: Merged
 commit 922bf317f1731554b3e77a0a48033a38fdc75a77
 Author: Pierre Gondois <Pierre.Gondois@arm.com>
 Date:   Fri Oct 28 17:32:52 2022 +0200
    SecurityPkg/RngDxe: Remove ArchGetSupportedRngAlgorithms()
    RngGetInfo() is one of the 2 functions of the EFI_RNG_PROTOCOL.
    RngGetInfo() is currently a mere wrapper around
    ArchGetSupportedRngAlgorithms() which is implemented differently
    depending on the architecture used.
    RngGetInfo() does nothing more than calling
    ArchGetSupportedRngAlgorithms(). So remove it, and let RngGetInfo()
    be implemented differently according to the architecture.
    This follows the implementation of the other function of the
    EFI_RNG_PROTOCOL, RngGetRNG().
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../RngDxe/AArch64/RngDxe.c                   | 19 +++++--
 .../RngDxe/Rand/RngDxe.c                      | 24 ++++++---
 .../RandomNumberGenerator/RngDxe/RngDxe.c     | 49 -------------------
 .../RngDxe/RngDxeInternals.h                  | 25 ----------
 4 files changed, 33 insertions(+), 84 deletions(-)
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
 index 1cdc842966..f6a0bf7b2b 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
@@ -14,6 +14,7 @@
   Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
   Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
   (C) Copyright 2015 Hewlett Packard Enterprise Development LP<BR>
 +  Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
   SPDX-License-Identifier: BSD-2-Clause-Patent
@@ -85,6 +86,7 @@ RngGetRNG (
 /**
   Returns information about the random number generation implementation.
 +  @param[in]     This                 A pointer to the EFI_RNG_PROTOCOL instance.
   @param[in,out] RNGAlgorithmListSize On input, the size in bytes of RNGAlgorithmList.
                                       On output with a return code of EFI_SUCCESS, the size
                                       in bytes of the data returned in RNGAlgorithmList. On output
@@ -97,14 +99,19 @@ RngGetRNG (
                                       is the default algorithm for the driver.
   @retval EFI_SUCCESS                 The RNG algorithm list was returned successfully.
 +  @retval EFI_UNSUPPORTED             The services is not supported by this driver.
 +  @retval EFI_DEVICE_ERROR            The list of algorithms could not be retrieved due to a
 +                                      hardware or firmware error.
 +  @retval EFI_INVALID_PARAMETER       One or more of the parameters are incorrect.
   @retval EFI_BUFFER_TOO_SMALL        The buffer RNGAlgorithmList is too small to hold the result.
 **/
 -UINTN
 +EFI_STATUS
 EFIAPI
 -ArchGetSupportedRngAlgorithms (
 -  IN OUT UINTN                     *RNGAlgorithmListSize,
 -  OUT    EFI_RNG_ALGORITHM         *RNGAlgorithmList
 +RngGetInfo (
 +  IN EFI_RNG_PROTOCOL    *This,
 +  IN OUT UINTN           *RNGAlgorithmListSize,
 +  OUT EFI_RNG_ALGORITHM  *RNGAlgorithmList
   )
 {
   UINTN RequiredSize;
@@ -112,6 +119,10 @@ ArchGetSupportedRngAlgorithms (
   RequiredSize = sizeof (EFI_RNG_ALGORITHM);
 +  if ((This == NULL) || (RNGAlgorithmListSize == NULL)) {
 +    return EFI_INVALID_PARAMETER;
 +  }
 +
   if (*RNGAlgorithmListSize < RequiredSize) {
     *RNGAlgorithmListSize = RequiredSize;
     return EFI_BUFFER_TOO_SMALL;
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
 index 19755b3bfd..5a649ecf24 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
@@ -104,6 +104,7 @@ RngGetRNG (
 /**
   Returns information about the random number generation implementation.
 +  @param[in]     This                 A pointer to the EFI_RNG_PROTOCOL instance.
   @param[in,out] RNGAlgorithmListSize On input, the size in bytes of RNGAlgorithmList.
                                       On output with a return code of EFI_SUCCESS, the size
                                       in bytes of the data returned in RNGAlgorithmList. On output
@@ -116,19 +117,28 @@ RngGetRNG (
                                       is the default algorithm for the driver.
   @retval EFI_SUCCESS                 The RNG algorithm list was returned successfully.
 +  @retval EFI_UNSUPPORTED             No supported algorithms found.
 +  @retval EFI_DEVICE_ERROR            The list of algorithms could not be retrieved due to a
 +                                      hardware or firmware error.
 +  @retval EFI_INVALID_PARAMETER       One or more of the parameters are incorrect.
   @retval EFI_BUFFER_TOO_SMALL        The buffer RNGAlgorithmList is too small to hold the result.
 **/
 -UINTN
 +EFI_STATUS
 EFIAPI
 -ArchGetSupportedRngAlgorithms (
 -  IN OUT UINTN                     *RNGAlgorithmListSize,
 -  OUT    EFI_RNG_ALGORITHM         *RNGAlgorithmList
 +RngGetInfo (
 +  IN EFI_RNG_PROTOCOL    *This,
 +  IN OUT UINTN           *RNGAlgorithmListSize,
 +  OUT EFI_RNG_ALGORITHM  *RNGAlgorithmList
   )
 {
   UINTN RequiredSize;
   EFI_RNG_ALGORITHM *CpuRngSupportedAlgorithm;
 +  if ((This == NULL) || (RNGAlgorithmListSize == NULL)) {
 +    return EFI_INVALID_PARAMETER;
 +  }
 +
   RequiredSize = 2 * sizeof (EFI_RNG_ALGORITHM);
   if (*RNGAlgorithmListSize < RequiredSize) {
@@ -136,9 +146,11 @@ ArchGetSupportedRngAlgorithms (
     return EFI_BUFFER_TOO_SMALL;
   }
 -  CpuRngSupportedAlgorithm = PcdGetPtr (PcdCpuRngSupportedAlgorithm);
 +  if (RNGAlgorithmList == NULL) {
 +    return EFI_INVALID_PARAMETER;
 +  }
 -  CopyMem(&RNGAlgorithmList[0], CpuRngSupportedAlgorithm, sizeof (EFI_RNG_ALGORITHM));
 +  CopyMem (&RNGAlgorithmList[0], &gEfiRngAlgorithmSp80090Ctr256Guid, sizeof (EFI_RNG_ALGORITHM));
   // x86 platforms also support EFI_RNG_ALGORITHM_RAW via RDSEED
   CopyMem(&RNGAlgorithmList[1], &gEfiRngAlgorithmRaw, sizeof (EFI_RNG_ALGORITHM));
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
 index b959c70536..7b8ecfc70d 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
@@ -28,55 +28,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include "RngDxeInternals.h"
 -/**
 -  Returns information about the random number generation implementation.
 -
 -  @param[in]     This                 A pointer to the EFI_RNG_PROTOCOL instance.
 -  @param[in,out] RNGAlgorithmListSize On input, the size in bytes of RNGAlgorithmList.
 -                                      On output with a return code of EFI_SUCCESS, the size
 -                                      in bytes of the data returned in RNGAlgorithmList. On output
 -                                      with a return code of EFI_BUFFER_TOO_SMALL,
 -                                      the size of RNGAlgorithmList required to obtain the list.
 -  @param[out] RNGAlgorithmList        A caller-allocated memory buffer filled by the driver
 -                                      with one EFI_RNG_ALGORITHM element for each supported
 -                                      RNG algorithm. The list must not change across multiple
 -                                      calls to the same driver. The first algorithm in the list
 -                                      is the default algorithm for the driver.
 -
 -  @retval EFI_SUCCESS                 The RNG algorithm list was returned successfully.
 -  @retval EFI_UNSUPPORTED             The services is not supported by this driver.
 -  @retval EFI_DEVICE_ERROR            The list of algorithms could not be retrieved due to a
 -                                      hardware or firmware error.
 -  @retval EFI_INVALID_PARAMETER       One or more of the parameters are incorrect.
 -  @retval EFI_BUFFER_TOO_SMALL        The buffer RNGAlgorithmList is too small to hold the result.
 -
 -**/
 -EFI_STATUS
 -EFIAPI
 -RngGetInfo (
 -  IN EFI_RNG_PROTOCOL             *This,
 -  IN OUT UINTN                    *RNGAlgorithmListSize,
 -  OUT EFI_RNG_ALGORITHM           *RNGAlgorithmList
 -  )
 -{
 -  EFI_STATUS    Status;
 -
 -  if ((This == NULL) || (RNGAlgorithmListSize == NULL)) {
 -    return EFI_INVALID_PARAMETER;
 -  }
 -
 -  //
 -  // Return algorithm list supported by driver.
 -  //
 -  if (RNGAlgorithmList != NULL) {
 -    Status = ArchGetSupportedRngAlgorithms (RNGAlgorithmListSize, RNGAlgorithmList);
 -  } else {
 -    Status = EFI_INVALID_PARAMETER;
 -  }
 -
 -  return Status;
 -}
 -
 //
 // The Random Number Generator (RNG) protocol
 //
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
 index fcb8b69153..f17adb83fb 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
@@ -74,31 +74,6 @@ RngGetRNG (
   OUT UINT8                      *RNGValue
   );
 -/**
 -  Returns information about the random number generation implementation.
 -
 -  @param[in,out] RNGAlgorithmListSize On input, the size in bytes of RNGAlgorithmList.
 -                                      On output with a return code of EFI_SUCCESS, the size
 -                                      in bytes of the data returned in RNGAlgorithmList. On output
 -                                      with a return code of EFI_BUFFER_TOO_SMALL,
 -                                      the size of RNGAlgorithmList required to obtain the list.
 -  @param[out] RNGAlgorithmList        A caller-allocated memory buffer filled by the driver
 -                                      with one EFI_RNG_ALGORITHM element for each supported
 -                                      RNG algorithm. The list must not change across multiple
 -                                      calls to the same driver. The first algorithm in the list
 -                                      is the default algorithm for the driver.
 -
 -  @retval EFI_SUCCESS                 The RNG algorithm list was returned successfully.
 -  @retval EFI_BUFFER_TOO_SMALL        The buffer RNGAlgorithmList is too small to hold the result.
 -
 -**/
 -UINTN
 -EFIAPI
 -ArchGetSupportedRngAlgorithms (
 -  IN OUT UINTN                     *RNGAlgorithmListSize,
 -  OUT    EFI_RNG_ALGORITHM         *RNGAlgorithmList
 -  );
 -
 /**
   Runs CPU RNG instruction to fill a buffer of arbitrary size with random bytes.
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Rename-AArch64-RngDxe.c.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Rename-AArch64-RngDxe.c.patch
@ -1,55 +0,0 @@
 From 05ffe3749d73942cf4df7ed8f53ae239e62d5376 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 25 Jun 2024 22:30:19 -0400
 Subject: [PATCH 11/31] SecurityPkg/RngDxe: Rename AArch64/RngDxe.c
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [11/31] 39c8a7a1e45c7c26f5d16f79d81abac1fbae4f22
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 CVE: CVE-2022-45237
 Upstream: Merged
 commit ff29cdb968a1a4d7bd7ab4eba2597a77c0748dc2
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Fri Oct 28 17:32:57 2022 +0200
    SecurityPkg/RngDxe: Rename AArch64/RngDxe.c
    To re-use the AArch64/RngDxe.c for an Arm implementation,
    rename AArch64/RngDxe.c to ArmRngDxe.c.
    Acked-by: Leif Lindholm <quic_llindhol@quicinc.com>
    Signed-off-by: Pierre Gondois <Pierre.Gondois@arm.com>
    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../RngDxe/{AArch64/RngDxe.c => ArmRngDxe.c}                    | 0
 SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf             | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename SecurityPkg/RandomNumberGenerator/RngDxe/{AArch64/RngDxe.c => ArmRngDxe.c} (100%)
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
 similarity index 100%
 rename from SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
 rename to SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 index e0e767cbf3..1d0bdef57d 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
@@ -42,7 +42,7 @@
   Rand/AesCore.h
 [Sources.AARCH64]
 -  AArch64/RngDxe.c
 +  ArmRngDxe.c
   ArmTrng.c
 [Packages]
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Rename-RdRandGenerateEntropy-to-g.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Rename-RdRandGenerateEntropy-to-g.patch
@ -1,176 +0,0 @@
 From 2a5e4e144cbea46784fde638765a9c9068ed2869 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 25 Jun 2024 22:19:10 -0400
 Subject: [PATCH 05/31] SecurityPkg/RngDxe: Rename RdRandGenerateEntropy to
 generic name
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [5/31] 12b8646964435f1a70def57afb9f4565b11c5dc8
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 CVE: CVE-2022-45237
 Upstream: Merged
 commit 8a89747844a5061791e55a25daedcf895180a794
 Author: Sami Mujawar <sami.mujawar@arm.com>
 Date:   Fri Oct 28 17:32:50 2022 +0200
    SecurityPkg/RngDxe: Rename RdRandGenerateEntropy to generic name
    Bugzilla: 3668 (https://bugzilla.tianocore.org/show_bug.cgi?id=3668)
    Rename RdRandGenerateEntropy() to GenerateEntropy() to provide a
    common interface to generate entropy on other architectures.
    GenerateEntropy() is intended to generate high quality entropy.
    Also move the definition to RngDxeInternals.h
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../RngDxe/Rand/RdRand.c                      | 20 ++++++++++++-----
 .../RngDxe/Rand/RngDxe.c                      |  7 ++++--
 .../RandomNumberGenerator/RngDxe/RngDxe.inf   |  2 +-
 .../RngDxe/RngDxeInternals.h                  | 22 ++++++++++++++++++-
 4 files changed, 41 insertions(+), 10 deletions(-)
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RdRand.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RdRand.c
 index 83025a47d4..853bf43148 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RdRand.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RdRand.c
@@ -1,15 +1,23 @@
 /** @file
 -  Support routines for RDRAND instruction access.
 -
 +  Support routines for RDRAND instruction access, which will leverage
 +  Intel Secure Key technology to provide high-quality random numbers for use
 +  in applications, or entropy for seeding other random number generators.
 +  Refer to http://software.intel.com/en-us/articles/intel-digital-random-number
 +  -generator-drng-software-implementation-guide/ for more information about Intel
 +  Secure Key technology.
 +
 +Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
 Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
 (C) Copyright 2015 Hewlett Packard Enterprise Development LP<BR>
 SPDX-License-Identifier: BSD-2-Clause-Patent
 **/
 +#include <Library/BaseLib.h>
 +#include <Library/BaseMemoryLib.h>
 #include <Library/RngLib.h>
 +#include <Library/TimerLib.h>
 #include "AesCore.h"
 -#include "RdRand.h"
 #include "RngDxeInternals.h"
 /**
@@ -87,9 +95,9 @@ RdRandGetSeed128 (
 **/
 EFI_STATUS
 EFIAPI
 -RdRandGenerateEntropy (
 -  IN UINTN         Length,
 -  OUT UINT8        *Entropy
 +GenerateEntropy (
 +  IN UINTN   Length,
 +  OUT UINT8  *Entropy
   )
 {
   EFI_STATUS  Status;
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
 index 834123b945..19755b3bfd 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
@@ -14,13 +14,16 @@
    - EFI_RNG_ALGORITHM_X9_31_3DES_GUID        - Unsupported
    - EFI_RNG_ALGORITHM_X9_31_AES_GUID         - Unsupported
 +  Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
   Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
   (C) Copyright 2015 Hewlett Packard Enterprise Development LP<BR>
   SPDX-License-Identifier: BSD-2-Clause-Patent
 **/
 -#include "RdRand.h"
 +#include <Library/BaseLib.h>
 +#include <Library/BaseMemoryLib.h>
 +
 #include "RngDxeInternals.h"
 /**
@@ -88,7 +91,7 @@ RngGetRNG (
       return EFI_INVALID_PARAMETER;
     }
 -    Status = RdRandGenerateEntropy (RNGValueLength, RNGValue);
 +    Status = GenerateEntropy (RNGValueLength, RNGValue);
     return Status;
   }
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 index f330097199..60efb5562e 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
@@ -10,6 +10,7 @@
 #
 #  Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
 #  (C) Copyright 2015 Hewlett Packard Enterprise Development LP<BR>
 +#  Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
 #  SPDX-License-Identifier: BSD-2-Clause-Patent
 #
 ##
@@ -36,7 +37,6 @@
 [Sources.IA32, Sources.X64]
   Rand/RngDxe.c
   Rand/RdRand.c
 -  Rand/RdRand.h
   Rand/AesCore.c
   Rand/AesCore.h
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
 index 25cccbe92c..fcb8b69153 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
@@ -10,6 +10,8 @@
 #ifndef RNGDXE_INTERNALS_H_
 #define RNGDXE_INTERNALS_H_
 +#include <Protocol/Rng.h>
 +
 /**
   Returns information about the random number generation implementation.
@@ -114,4 +116,22 @@ RngGetBytes (
   OUT UINT8        *RandBuffer
   );
 -#endif  // RNGDXE_INTERNALS_H_
 +/**
 +  Generate high-quality entropy source using a TRNG or through RDRAND.
 +
 +  @param[in]   Length        Size of the buffer, in bytes, to fill with.
 +  @param[out]  Entropy       Pointer to the buffer to store the entropy data.
 +
 +  @retval EFI_SUCCESS        Entropy generation succeeded.
 +  @retval EFI_NOT_READY      Failed to request random data.
 +
 +**/
 +EFI_STATUS
 +EFIAPI
 +GenerateEntropy (
 +  IN UINTN   Length,
 +  OUT UINT8  *Entropy
 +  );
 +
 +#endif // RNGDXE_INTERNALS_H_
 +
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Simplify-Rng-algorithm-selection-.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Simplify-Rng-algorithm-selection-.patch
@ -1,78 +0,0 @@
 From 1a0bf45b088e05f6eb7edaa0d24aec894ea3491b Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 20 Jun 2024 16:11:16 -0400
 Subject: [PATCH 23/31] SecurityPkg/RngDxe: Simplify Rng algorithm selection
 for Arm
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [23/31] 21b2854eed63bf5d406cfec5ac03b9ae3901a679
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit ff7ddc02b273f9159ef46fdb67d99062f8e598d9
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Fri Aug 11 16:33:10 2023 +0200
    SecurityPkg/RngDxe: Simplify Rng algorithm selection for Arm
    The first element of mAvailableAlgoArray is defined as the default
    Rng algorithm to use. Don't go through the array at each RngGetRNG()
    call and just return the first element of the array.
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
    Tested-by: Kun Qin <kun.qin@microsoft.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../RandomNumberGenerator/RngDxe/ArmRngDxe.c    | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
 index 2fc36fc186..7249904413 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
@@ -77,7 +77,6 @@ RngGetRNG (
   )
 {
   EFI_STATUS  Status;
 -  UINTN       Index;
   GUID        RngGuid;
   if ((This == NULL) || (RNGValueLength == 0) || (RNGValue == NULL)) {
@@ -88,21 +87,13 @@ RngGetRNG (
     //
     // Use the default RNG algorithm if RNGAlgorithm is NULL.
     //
 -    for (Index = 0; Index < mAvailableAlgoArrayCount; Index++) {
 -      if (!IsZeroGuid (&mAvailableAlgoArray[Index])) {
 -        RNGAlgorithm = &mAvailableAlgoArray[Index];
 -        goto FoundAlgo;
 -      }
 -    }
 -
 -    if (Index == mAvailableAlgoArrayCount) {
 -      // No algorithm available.
 -      ASSERT (Index != mAvailableAlgoArrayCount);
 -      return EFI_DEVICE_ERROR;
 +    if (mAvailableAlgoArrayCount != 0) {
 +      RNGAlgorithm = &mAvailableAlgoArray[0];
 +    } else {
 +      return EFI_UNSUPPORTED;
     }
   }
 -FoundAlgo:
   Status = GetRngGuid (&RngGuid);
   if (!EFI_ERROR (Status) &&
       CompareGuid (RNGAlgorithm, &RngGuid))
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Use-GetRngGuid-when-probing-RngLi.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Use-GetRngGuid-when-probing-RngLi.patch
@ -1,195 +0,0 @@
 From 6b3795dcecf31b0d8aa7edabeffccf37b7259ff0 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 20 Jun 2024 16:09:46 -0400
 Subject: [PATCH 22/31] SecurityPkg/RngDxe: Use GetRngGuid() when probing
 RngLib
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [22/31] 17b40bc3daeba2ba8407826e17f3096c4a5151c6
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit 19438cff973bfb35a1ef12fab45fabb28b63fe64
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Fri Aug 11 16:33:09 2023 +0200
    SecurityPkg/RngDxe: Use GetRngGuid() when probing RngLib
    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4151
    The EFI_RNG_PROTOCOL can rely on the RngLib. The RngLib has multiple
    implementations, some of them are unsafe (e.g. BaseRngLibTimerLib).
    To allow the RngDxe to detect when such implementation is used,
    a GetRngGuid() function was added in a previous patch.
    The EFI_RNG_PROTOCOL can advertise multiple algorithms through
    Guids. The PcdCpuRngSupportedAlgorithm is currently used to
    advertise the RngLib in the Arm implementation.
    The issues of doing that are:
    - the RngLib implementation might not use CPU instructions,
      cf. the BaseRngLibTimerLib
    - most platforms don't set PcdCpuRngSupportedAlgorithm
    A GetRngGuid() was added to the RngLib in a previous patch,
    allowing to identify the algorithm implemented by the RngLib.
    Make use of this function and place the unsage algorithm
    at the last position in the mAvailableAlgoArray.
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
    Tested-by: Kun Qin <kun.qin@microsoft.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../RngDxe/AArch64/AArch64Algo.c              | 55 +++++++++++++------
 .../RandomNumberGenerator/RngDxe/ArmRngDxe.c  |  8 ++-
 .../RandomNumberGenerator/RngDxe/RngDxe.inf   |  4 +-
 3 files changed, 45 insertions(+), 22 deletions(-)
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c
 index e8be217f8a..a270441ebb 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c
@@ -10,6 +10,8 @@
 #include <Library/DebugLib.h>
 #include <Library/MemoryAllocationLib.h>
 #include <Library/ArmTrngLib.h>
 +#include <Library/RngLib.h>
 +#include <Guid/RngAlgorithm.h>
 #include "RngDxeInternals.h"
@@ -28,9 +30,13 @@ GetAvailableAlgorithms (
   VOID
   )
 {
 -  UINT64  DummyRand;
 -  UINT16  MajorRevision;
 -  UINT16  MinorRevision;
 +  EFI_STATUS  Status;
 +  UINT16      MajorRevision;
 +  UINT16      MinorRevision;
 +  GUID        RngGuid;
 +  BOOLEAN     UnSafeAlgo;
 +
 +  UnSafeAlgo = FALSE;
   // Rng algorithms 2 times, one for the allocation, one to populate.
   mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
@@ -38,24 +44,29 @@ GetAvailableAlgorithms (
     return EFI_OUT_OF_RESOURCES;
   }
 -  // Check RngGetBytes() before advertising PcdCpuRngSupportedAlgorithm.
 -  if (!EFI_ERROR (RngGetBytes (sizeof (DummyRand), (UINT8 *)&DummyRand))) {
 -    CopyMem (
 -      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
 -      PcdGetPtr (PcdCpuRngSupportedAlgorithm),
 -      sizeof (EFI_RNG_ALGORITHM)
 -      );
 -    mAvailableAlgoArrayCount++;
 -
 -    DEBUG_CODE_BEGIN ();
 -    if (IsZeroGuid (PcdGetPtr (PcdCpuRngSupportedAlgorithm))) {
 +  // Identify RngLib algorithm.
 +  Status = GetRngGuid (&RngGuid);
 +  if (!EFI_ERROR (Status)) {
 +    if (IsZeroGuid (&RngGuid) ||
 +        CompareGuid (&RngGuid, &gEdkiiRngAlgorithmUnSafe))
 +    {
 +      // Treat zero GUID as an unsafe algorithm
       DEBUG ((
         DEBUG_WARN,
 -        "PcdCpuRngSupportedAlgorithm should be a non-zero GUID\n"
 +        "RngLib uses an Unsafe algorithm and "
 +        "must not be used for production builds.\n"
         ));
 +      // Set the UnSafeAlgo flag to indicate an unsafe algorithm was found
 +      // so that it can be added at the end of the algorithm list.
 +      UnSafeAlgo = TRUE;
 +    } else {
 +      CopyMem (
 +        &mAvailableAlgoArray[mAvailableAlgoArrayCount],
 +        &RngGuid,
 +        sizeof (RngGuid)
 +        );
 +      mAvailableAlgoArrayCount++;
     }
 -
 -    DEBUG_CODE_END ();
   }
   // Raw algorithm (Trng)
@@ -68,5 +79,15 @@ GetAvailableAlgorithms (
     mAvailableAlgoArrayCount++;
   }
 +  // Add unsafe algorithm at the end of the list.
 +  if (UnSafeAlgo) {
 +    CopyMem (
 +      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
 +      &gEdkiiRngAlgorithmUnSafe,
 +      sizeof (EFI_RNG_ALGORITHM)
 +      );
 +    mAvailableAlgoArrayCount++;
 +  }
 +
   return EFI_SUCCESS;
 }
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
 index 0e44d0c931..2fc36fc186 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
@@ -76,8 +76,9 @@ RngGetRNG (
   OUT UINT8                      *RNGValue
   )
 {
 -  EFI_STATUS    Status;
 +  EFI_STATUS  Status;
   UINTN       Index;
 +  GUID        RngGuid;
   if ((This == NULL) || (RNGValueLength == 0) || (RNGValue == NULL)) {
     return EFI_INVALID_PARAMETER;
@@ -102,7 +103,10 @@ RngGetRNG (
   }
 FoundAlgo:
 -  if (CompareGuid (RNGAlgorithm, PcdGetPtr (PcdCpuRngSupportedAlgorithm))) {
 +  Status = GetRngGuid (&RngGuid);
 +  if (!EFI_ERROR (Status) &&
 +      CompareGuid (RNGAlgorithm, &RngGuid))
 +  {
     Status = RngGetBytes (RNGValueLength, RNGValue);
     return Status;
   }
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 index d6c2d30195..8704a64441 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
@@ -75,13 +75,11 @@
   gEfiRngAlgorithmX9313DesGuid        ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
   gEfiRngAlgorithmX931AesGuid         ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
   gEfiRngAlgorithmRaw                 ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
 +  gEdkiiRngAlgorithmUnSafe            ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
 [Protocols]
   gEfiRngProtocolGuid                ## PRODUCES
 -[Pcd.AARCH64]
 -  gEfiMdePkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm      ## CONSUMES
 -
 [Depex]
   TRUE
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-RngDxe-add-rng-test.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-add-rng-test.patch
@ -1,57 +0,0 @@
 From 5022087de4a4bcd113ef0325e657bd78b798d5f6 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 20 Jun 2024 10:33:43 -0400
 Subject: [PATCH 26/31] SecurityPkg/RngDxe: add rng test
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [26/31] 97c8deefd351f2755cf458f10679dd1d859fb321
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit a61bc0accb8a76edba4f073fdc7bafc908df045d
 Author: Gerd Hoffmann <kraxel@redhat.com>
 Date:   Fri May 31 09:49:13 2024 +0200
    SecurityPkg/RngDxe: add rng test
    Check whenever RngLib actually returns random numbers, only return
    a non-zero number of Algorithms if that is the case.
    This has the effect that RndDxe loads and installs EFI_RNG_PROTOCOL
    only in case it can actually deliver random numbers.
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 Check whenever RngLib actually returns random numbers, only return
 a non-zero number of Algorithms if that is the case.
 This has the effect that RndDxe loads and installs EFI_RNG_PROTOCOL
 only in case it can actually deliver random numbers.
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 ---
 SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
 index 149de875ce..e374b62208 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
@@ -23,6 +23,7 @@
 #include <Library/BaseLib.h>
 #include <Library/BaseMemoryLib.h>
 +#include <Library/RngLib.h>
 #include "RngDxeInternals.h"
 -- 
 2.39.3
--- a/SOURCES/edk2-SecurityPkg-SecurityPkg.dec-Move-PcdCpuRngSupportedA.patch
+++ b/SOURCES/edk2-SecurityPkg-SecurityPkg.dec-Move-PcdCpuRngSupportedA.patch
@ -1,104 +0,0 @@
 From 1548ea758f7d9d58fd61110f5719cc12786380d3 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 20 Jun 2024 16:01:08 -0400
 Subject: [PATCH 17/31] SecurityPkg/SecurityPkg.dec: Move
 PcdCpuRngSupportedAlgorithm to MdePkg
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
 RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [17/31] 01f31c97f800f3451072762c0e9a9eb59f1cc2ab
 JIRA: https://issues.redhat.com/browse/RHEL-21856
 Upstream: Merged
 CVE: CVE-2023-45237
 commit 65b5dd828ef2ea5056031b239a4e7a6642f771a3
 Author: Pierre Gondois <pierre.gondois@arm.com>
 Date:   Fri Aug 11 16:33:04 2023 +0200
    SecurityPkg/SecurityPkg.dec: Move PcdCpuRngSupportedAlgorithm to MdePkg
    In order to use PcdCpuRngSupportedAlgorithm in the MdePkg in a
    following patch and to avoid making the MdePkg dependent on another
    package, move PcdCpuRngSupportedAlgorithm to the MdePkg.
    As the Pcd is only used for AARCH64, place it in an AARCH64
    specific sections.
    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
    Acked-by: Ard Biesheuvel <ardb@kernel.org>
    Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
    Tested-by: Kun Qin <kun.qin@microsoft.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf        | 2 +-
 MdePkg/MdePkg.dec                                            | 5 +++++
 SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf          | 4 ++--
 SecurityPkg/SecurityPkg.dec                                  | 2 --
 4 files changed, 8 insertions(+), 5 deletions(-)
 diff --git a/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf b/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
 index f857290e82..f729001060 100644
 --- a/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
 +++ b/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
@@ -19,7 +19,7 @@
   INF_VERSION                    = 1.27
   BASE_NAME                      = BaseRngLibTimerLib
   MODULE_UNI_FILE                = BaseRngLibTimerLib.uni
 -  FILE_GUID                      = 74950C45-10FC-4AB5-B114-49C87C17409B
 +  FILE_GUID                      = B3E66B05-D218-4B9A-AC33-EF0F83D6A513
   MODULE_TYPE                    = BASE
   VERSION_STRING                 = 1.0
   LIBRARY_CLASS                  = RngLib
 diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
 index 6389a48338..8f05e822ac 100644
 --- a/MdePkg/MdePkg.dec
 +++ b/MdePkg/MdePkg.dec
@@ -2306,6 +2306,11 @@
   # @Prompt Memory Address of GuidedExtractHandler Table.
   gEfiMdePkgTokenSpaceGuid.PcdGuidedExtractHandlerTableAddress|0x1000000|UINT64|0x30001015
 +[PcdsFixedAtBuild.AARCH64, PcdsPatchableInModule.AARCH64]
 +  ## GUID identifying the Rng algorithm implemented by CPU instruction.
 +  # @Prompt CPU Rng algorithm's GUID.
 +  gEfiMdePkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm|{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}|VOID*|0x00000037
 +
 [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
   ## This value is used to set the base address of PCI express hierarchy.
   # @Prompt PCI Express Base Address.
 diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 index c8e0ee4ae5..d6c2d30195 100644
 --- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
 +++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
@@ -79,8 +79,8 @@
 [Protocols]
   gEfiRngProtocolGuid                ## PRODUCES
 -[Pcd]
 -  gEfiSecurityPkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm      ## CONSUMES
 +[Pcd.AARCH64]
 +  gEfiMdePkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm      ## CONSUMES
 [Depex]
   TRUE
 diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
 index 9f7a032d60..8cf80b1e84 100644
 --- a/SecurityPkg/SecurityPkg.dec
 +++ b/SecurityPkg/SecurityPkg.dec
@@ -323,8 +323,6 @@
   gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeFvVerificationPass|0x0303100A|UINT32|0x00010030
   gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeFvVerificationFail|0x0303100B|UINT32|0x00010031
 -  gEfiSecurityPkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm|{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}|VOID*|0x00010032
 -
 [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
   ## Image verification policy for OptionRom. Only following values are valid:<BR><BR>
   #  NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification and has been removed.<BR>
 -- 
 2.39.3
--- a/SOURCES/edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch
+++ b/SOURCES/edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch
@ -1,150 +0,0 @@
 From 155eceaf831492dcd77172833350072e4156e1c9 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Tue, 5 Mar 2024 16:38:49 -0500
 Subject: [PATCH 2/2] StandaloneMmPkg/Hob: Integer Overflow in CreateHob()
 RH-Author: Jon Maloy <jmaloy@redhat.com>
 RH-MergeRequest: 66: EmbeddedPkg/Hob: Integer Overflow in CreateHob()
 RH-Jira: RHEL-21158
 RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
 RH-Acked-by: Gerd Hoffmann <None>
 RH-Commit: [2/2] be7ee11a65a56faec07c249a35940cf9b95b9ec1
 JIRA: https://issues.redhat.com/browse/RHEL-21158
 CVE: CVE-2022-36765
 Upstream: Merged
 commit 9a75b030cf27d2530444e9a2f9f11867f79bf679
 Author: Gua Guo <gua.guo@intel.com>
 Date:   Thu Jan 11 13:03:26 2024 +0800
    StandaloneMmPkg/Hob: Integer Overflow in CreateHob()
    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
    Fix integer overflow in various CreateHob instances.
    Fixes: CVE-2022-36765
    The CreateHob() function aligns the requested size to 8
    performing the following operation:
    ```
    HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
    ```
    No checks are performed to ensure this value doesn't
    overflow, and could lead to CreateHob() returning a smaller
    HOB than requested, which could lead to OOB HOB accesses.
    Reported-by: Marc Beatove <mbeatove@google.com>
    Reviewed-by: Ard Biesheuvel <ardb+tianocore@kernel.org>
    Cc: Sami Mujawar <sami.mujawar@arm.com>
    Reviewed-by: Ray Ni <ray.ni@intel.com>
    Cc: John Mathew <john.mathews@intel.com>
    Authored-by: Gerd Hoffmann <kraxel@redhat.com>
    Signed-off-by: Gua Guo <gua.guo@intel.com>
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
 .../Arm/StandaloneMmCoreHobLib.c              | 37 ++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)
 diff --git a/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c b/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c
 index 0ec2d4ad6f..3b13249e33 100644
 --- a/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c
 +++ b/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c
@@ -34,6 +34,13 @@ CreateHob (
   HandOffHob = GetHobList ();
 +  //
 +  // Check Length to avoid data overflow.
 +  //
 +  if (HobLength > MAX_UINT16 - 0x7) {
 +    return NULL;
 +  }
 +
   HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
   FreeMemory = HandOffHob->EfiFreeMemoryTop - HandOffHob->EfiFreeMemoryBottom;
@@ -87,6 +94,10 @@ BuildModuleHob (
           ((ModuleLength & (EFI_PAGE_SIZE - 1)) == 0));
   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION_MODULE));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   CopyGuid (&(Hob->MemoryAllocationHeader.Name), &gEfiHobMemoryAllocModuleGuid);
   Hob->MemoryAllocationHeader.MemoryBaseAddress = MemoryAllocationModule;
@@ -127,6 +138,9 @@ BuildResourceDescriptorHob (
   Hob = CreateHob (EFI_HOB_TYPE_RESOURCE_DESCRIPTOR, sizeof (EFI_HOB_RESOURCE_DESCRIPTOR));
   ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   Hob->ResourceType      = ResourceType;
   Hob->ResourceAttribute = ResourceAttribute;
@@ -164,7 +178,12 @@ BuildGuidHob (
   //
   ASSERT (DataLength <= (0xffff - sizeof (EFI_HOB_GUID_TYPE)));
 -  Hob = CreateHob (EFI_HOB_TYPE_GUID_EXTENSION, (UINT16) (sizeof (EFI_HOB_GUID_TYPE) + DataLength));
 +  Hob = CreateHob (EFI_HOB_TYPE_GUID_EXTENSION, (UINT16)(sizeof (EFI_HOB_GUID_TYPE) + DataLength));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return NULL;
 +  }
 +
   CopyGuid (&Hob->Name, Guid);
   return Hob + 1;
 }
@@ -225,6 +244,10 @@ BuildFvHob (
   EFI_HOB_FIRMWARE_VOLUME  *Hob;
   Hob = CreateHob (EFI_HOB_TYPE_FV, sizeof (EFI_HOB_FIRMWARE_VOLUME));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   Hob->BaseAddress = BaseAddress;
   Hob->Length      = Length;
@@ -255,6 +278,10 @@ BuildFv2Hob (
   EFI_HOB_FIRMWARE_VOLUME2  *Hob;
   Hob = CreateHob (EFI_HOB_TYPE_FV2, sizeof (EFI_HOB_FIRMWARE_VOLUME2));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   Hob->BaseAddress = BaseAddress;
   Hob->Length      = Length;
@@ -283,6 +310,10 @@ BuildCpuHob (
   EFI_HOB_CPU  *Hob;
   Hob = CreateHob (EFI_HOB_TYPE_CPU, sizeof (EFI_HOB_CPU));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   Hob->SizeOfMemorySpace = SizeOfMemorySpace;
   Hob->SizeOfIoSpace     = SizeOfIoSpace;
@@ -318,6 +349,10 @@ BuildMemoryAllocationHob (
           ((Length & (EFI_PAGE_SIZE - 1)) == 0));
   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION));
 +  ASSERT (Hob != NULL);
 +  if (Hob == NULL) {
 +    return;
 +  }
   ZeroMem (&(Hob->AllocDescriptor.Name), sizeof (EFI_GUID));
   Hob->AllocDescriptor.MemoryBaseAddress = BaseAddress;
 -- 
 2.39.3
--- a/SPECS/edk2.spec
+++ b/SPECS/edk2.spec
@ -7,7 +7,7 @@ ExclusiveArch: x86_64 aarch64
 Name:       edk2
 Version:    %{GITDATE}git%{GITCOMMIT}
-Release:    13%{?dist}.3
+Release:    12%{?dist}
 Summary:    UEFI firmware for 64-bit virtual machines
 Group:      Applications/Emulators
 License:    BSD-2-Clause-Patent and OpenSSL and MIT
@ -256,136 +256,6 @@ Patch81: edk2-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch
 # For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
 # For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
 Patch82: edk2-NetworkPkg-Dhcp6Dxe-Packet-Length-is-not-updated-bef.patch
 # For RHEL-21158 - CVE-2022-36765 edk2: integer overflow in CreateHob() could lead to HOB OOB R/W [rhel-8]
 Patch83: edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch
 # For RHEL-21158 - CVE-2022-36765 edk2: integer overflow in CreateHob() could lead to HOB OOB R/W [rhel-8]
 Patch84: edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch85: edk2-MdeModulePkg-Change-use-of-EFI_D_-to-DEBUG_.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch86: edk2-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch87: edk2-MdePkg-Apply-uncrustify-changes.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch88: edk2-NetworkPkg-Apply-uncrustify-changes.p2.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch89: edk2-SecurityPkg-RngDxe-Rename-RdRandGenerateEntropy-to-g.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch90: edk2-SecurityPkg-RngDxe-Remove-ArchGetSupportedRngAlgorit.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch91: edk2-SecurityPkg-RngDxe-Documentation-include-parameter-c.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch92: edk2-SecurityPkg-RngDxe-Check-before-advertising-Cpu-Rng-.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch93: edk2-SecurityPkg-RngDxe-Add-AArch64-RawAlgorithm-support-.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch94: edk2-SecurityPkg-RngDxe-Add-debug-warning-for-NULL-PcdCpu.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch95: edk2-SecurityPkg-RngDxe-Rename-AArch64-RngDxe.c.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch96: edk2-SecurityPkg-RngDxe-Add-Arm-support-of-RngDxe.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch97: edk2-SecurityPkg-RngDxe-Correctly-update-mAvailableAlgoAr.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch98: edk2-SecurityPkg-RngDxe-Conditionally-install-EFI_RNG_PRO.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch99: edk2-MdeModulePkg-Duplicate-BaseRngLibTimerLib-to-MdeModu.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch100: edk2-MdePkg-Add-deprecated-warning-to-BaseRngLibTimer.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch101: edk2-SecurityPkg-SecurityPkg.dec-Move-PcdCpuRngSupportedA.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch102: edk2-MdePkg-DxeRngLib-Request-raw-algorithm-instead-of-de.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch103: edk2-MdePkg-Rng-Add-GUID-to-describe-Arm-Rndr-Rng-algorit.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch104: edk2-MdeModulePkg-Rng-Add-GUID-to-describe-unsafe-Rng-alg.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch105: edk2-MdePkg-Rng-Add-GetRngGuid-to-RngLib.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch106: edk2-SecurityPkg-RngDxe-Use-GetRngGuid-when-probing-RngLi.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch107: edk2-SecurityPkg-RngDxe-Simplify-Rng-algorithm-selection-.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch108: edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch109: edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch110: edk2-SecurityPkg-RngDxe-add-rng-test.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch111: edk2-OvmfPkg-wire-up-RngDxe.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch112: edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch113: edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch114: edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch
 # For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
 # For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
 # For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
 Patch115: edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch
 # For RHEL-53009 - No http boot support on edk2-ovmf-20231122-6.el9_4.2 [rhel-8.10.z]
 Patch116: edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch
 # python3-devel and libuuid-devel are required for building tools.
@ -832,58 +702,6 @@ true
 %endif
 %changelog
 * Mon Aug 26 2024 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-13.el8.3
 - edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch [RHEL-53009]
 - Resolves: RHEL-53009
  (No http boot support on edk2-ovmf-20231122-6.el9_4.2 [rhel-8.10.z])
 * Wed Jul 10 2024 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-13.el8_10.2
 * Wed Jul 03 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-13.el8_10.1
 - edk2-MdeModulePkg-Change-use-of-EFI_D_-to-DEBUG_.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-MdePkg-Apply-uncrustify-changes.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-NetworkPkg-Apply-uncrustify-changes.p2.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-Rename-RdRandGenerateEntropy-to-g.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-Remove-ArchGetSupportedRngAlgorit.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-Documentation-include-parameter-c.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-Check-before-advertising-Cpu-Rng-.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-Add-AArch64-RawAlgorithm-support-.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-Add-debug-warning-for-NULL-PcdCpu.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-Rename-AArch64-RngDxe.c.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-Add-Arm-support-of-RngDxe.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-Correctly-update-mAvailableAlgoAr.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-Conditionally-install-EFI_RNG_PRO.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-MdeModulePkg-Duplicate-BaseRngLibTimerLib-to-MdeModu.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-MdePkg-Add-deprecated-warning-to-BaseRngLibTimer.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-SecurityPkg.dec-Move-PcdCpuRngSupportedA.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-MdePkg-DxeRngLib-Request-raw-algorithm-instead-of-de.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-MdePkg-Rng-Add-GUID-to-describe-Arm-Rndr-Rng-algorit.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-MdeModulePkg-Rng-Add-GUID-to-describe-unsafe-Rng-alg.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-MdePkg-Rng-Add-GetRngGuid-to-RngLib.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-Use-GetRngGuid-when-probing-RngLi.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-Simplify-Rng-algorithm-selection-.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-SecurityPkg-RngDxe-add-rng-test.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-OvmfPkg-wire-up-RngDxe.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch [RHEL-21854 RHEL-21856 RHEL-40099]
 - Resolves: RHEL-21854
  (CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8])
 - Resolves: RHEL-21856
  (CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8])
 - Resolves: RHEL-40099
  (CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z])
 * Thu Mar 14 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-13
 - edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-21158]
 - edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-21158]
 - Resolves: RHEL-21158
  (CVE-2022-36765 edk2: integer overflow in CreateHob() could lead to HOB OOB R/W [rhel-8])
 * Tue Feb 27 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-12
 - edk2-Apply-uncrustify-changes-to-.c-.h-files-in-the-Netwo.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
 - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]