99 changed files with 64038 additions and 24 deletions
--- a/.edk2.metadata
+++ b/.edk2.metadata
@ -1,3 +1,2 @@
-fdcb04021414cdd5a7e286058ca36aca359d323d SOURCES/RedHatSecureBootPkKek1.pem
 ae830c7278f985cb25e90f4687b46c8b22316bef SOURCES/edk2-bb1bba3d77.tar.xz
-df2e14a45d968b590194d82736fcbfe2be10d1b0 SOURCES/openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
+85388ae6525650667302c6b553894430197d9e0d SOURCES/openssl-rhel-cf317b2bb227899cb2e761b9163210f62cab1b1e.tar.xz
--- a/.gitignore
+++ b/.gitignore
@ -1,3 +1,2 @@
-SOURCES/RedHatSecureBootPkKek1.pem
 SOURCES/edk2-bb1bba3d77.tar.xz
-SOURCES/openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
+SOURCES/openssl-rhel-cf317b2bb227899cb2e761b9163210f62cab1b1e.tar.xz
--- a/SOURCES/RedHatSecureBootPkKek1.pem
+++ b/SOURCES/RedHatSecureBootPkKek1.pem
@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDoDCCAoigAwIBAgIJAP71iOjzlsDxMA0GCSqGSIb3DQEBCwUAMFExKzApBgNV
+BAMTIlJlZCBIYXQgU2VjdXJlIEJvb3QgKFBLL0tFSyBrZXkgMSkxIjAgBgkqhkiG
+9w0BCQEWE3NlY2FsZXJ0QHJlZGhhdC5jb20wHhcNMTQxMDMxMTExNTM3WhcNMzcx
+MDI1MTExNTM3WjBRMSswKQYDVQQDEyJSZWQgSGF0IFNlY3VyZSBCb290IChQSy9L
+RUsga2V5IDEpMSIwIAYJKoZIhvcNAQkBFhNzZWNhbGVydEByZWRoYXQuY29tMIIB
+IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkB+Ee42865cmgm2Iq4rJjGhw
+d9LB7I3gwsCyGdoMJ7j8PCZSrhZV8ZB9jiL/mZMSek3N5IumAEeWxRQ5qiNJQ31
+huarMMtAFuqNixaGcEM38s7Akd9xFI6ZDom2TG0kHozkL08l0LoG+MboGRh2cx2B
+bajYBc86yHsoyDajFg0pjJmaaNyrwE2Nv1q7K6k5SwSXHPk2u8U6hgSur9SCe+Cr
+3kkFaPz2rmgabJBNVxk8ZGYD9sdSm/eUz5NqoWjJqs+Za7yqXgjnORz3+A+6Bn7x
+y+h23f4i2q06Xls06rPJ4E0EKX64YLkF77XZF1hWFmC5MDLwNkrD8nmNEkBw8wID
+AQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVy
+YXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUPOlg4/8ZoQp7o0L0jUIutNWccuww
+HwYDVR0jBBgwFoAUPOlg4/8ZoQp7o0L0jUIutNWccuwwDQYJKoZIhvcNAQELBQAD
+ggEBAFxNkoi0gl8drYsR7N8GpnqlK583VQyNbgUArbcMQYlpz9ZlBptReNKtx7+c
+3AVzf+ceORO06rYwfUB1q5xDC9+wwhu/MOD0/sDbYiGY9sWv3jtPSQrmHvmGsD8N
+1tRGN9tUdF7/EcJgxnBYxRxv7LLYbm/DvDOHOKTzRGScNDsolCZ4J58WF+g7aQol
+qXM2fp43XOzoP9uR+RKzPc7n3RXDrowFIGGbld6br/qxXBzll+fDNBGF9YonJqRw
+NuwM9oM9kPc28/nzFdSQYr5TtK/TSa/v9HPoe3bkRCo3uoGkmQw6MSRxoOTktxrL
+R+SqIs/vdWGA40O3SFdzET14m2k=
+-----END CERTIFICATE-----
--- a/SOURCES/edk2-Apply-uncrustify-changes-to-.c-.h-files-in-the-Netwo.patch
+++ b/SOURCES/edk2-Apply-uncrustify-changes-to-.c-.h-files-in-the-Netwo.patch
--- a/SOURCES/edk2-ArmVirtPkg-Add-Hash2DxeCrypto-to-ArmVirtPkg.patch
+++ b/SOURCES/edk2-ArmVirtPkg-Add-Hash2DxeCrypto-to-ArmVirtPkg.patch
@ -0,0 +1,79 @@
+From 2013730b133b5ea78691ede3937b98144673fe1d Mon Sep 17 00:00:00 2001
+From: Flickdm <douglas.flick@microsoft.com>
+Date: Mon, 20 May 2024 11:06:38 -0700
+Subject: [PATCH] ArmVirtPkg: Add Hash2DxeCrypto to ArmVirtPkg
+
+RH-Author: Oliver Steffen <osteffen@redhat.com>
+RH-MergeRequest: 112: ArmVirtPkg: Add Hash2DxeCrypto to ArmVirtPkg
+RH-Jira: RHEL-71687
+RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+RH-Commit: [1/1] c84a2c074eebd93a07079683b5e5cf03d6fcd50f
+
+This patch adds Hash2DxeCrypto to ArmVirtPkg. The Hash2DxeCrypto is
+used to provide the hashing protocol services.
+
+Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
+Cc: Leif Lindholm <quic_llindhol@quicinc.com>
+Cc: Sami Mujawar <sami.mujawar@arm.com>
+Cc: Gerd Hoffmann <kraxel@redhat.com>
+
+Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit e10d83234c7e3caaf940df79f4b302fca3729fb0)
+---
+ ArmVirtPkg/ArmVirtQemu.dsc           | 5 +++++
+ ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 5 +++++
+ ArmVirtPkg/ArmVirtQemuKernel.dsc     | 5 +++++
+ 3 files changed, 15 insertions(+)
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index 2b23becf30..5d4b639bf2 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
+++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -526,6 +526,11 @@
+   MdeModulePkg/Bus/Usb/UsbKbDxe/UsbKbDxe.inf
+   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+  #
+  # Hash2 Protocol Support
+  #
+  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
+
+   #
+   # TPM2 support
+   #
+diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+index 7c655d384d..b4dc286843 100644
+--- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+@@ -180,6 +180,11 @@ READ_LOCK_STATUS   = TRUE
+   INF MdeModulePkg/Bus/Usb/UsbKbDxe/UsbKbDxe.inf
+   INF MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+  #
+  # Hash2 Protocol producer
+  #
+  INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
+
+   #
+   # TPM2 support
+   #
+diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+index 344e2c4ed9..dd9230e5b7 100644
+--- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
+++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+@@ -455,6 +455,11 @@
+   MdeModulePkg/Bus/Usb/UsbKbDxe/UsbKbDxe.inf
+   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+ 
+  #
+  # Hash2 Protocol Support
+  #
+  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
+
+   #
+   # ACPI Support
+   #
+-- 
+2.47.1
+
--- a/SOURCES/edk2-ArmVirtPkg-ArmVirtQemu-migrate-to-OVMF-s-VirtNorFlas.patch
+++ b/SOURCES/edk2-ArmVirtPkg-ArmVirtQemu-migrate-to-OVMF-s-VirtNorFlas.patch
@ -0,0 +1,149 @@
+From 9ef10bbe9a03f22aa5c5ff659012794d37ef9839 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 24 Oct 2022 18:41:22 +0200
+Subject: [PATCH 17/18] ArmVirtPkg/ArmVirtQemu: migrate to OVMF's
+ VirtNorFlashDxe
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [19/20] 2160140b0ea566451ab723e941d2ab91e1ad874e
+
+Switch to the virt specific NorFlashDxe driver implementation that was
+added recently.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
+(cherry picked from commit b92298af8218dd074c231947bc95f2be94af663c)
+---
+ ArmVirtPkg/ArmVirtQemu.dsc                           |  4 ++--
+ ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc                 |  2 +-
+ ArmVirtPkg/ArmVirtQemuKernel.dsc                     |  4 ++--
+ ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.c | 12 ++++++------
+ .../Library/NorFlashQemuLib/NorFlashQemuLib.inf      |  4 ++--
+ 5 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
+index e6fad9f066..2b23becf30 100644
+--- a/ArmVirtPkg/ArmVirtQemu.dsc
+++ b/ArmVirtPkg/ArmVirtQemu.dsc
+@@ -67,7 +67,7 @@
+   ArmPlatformLib|ArmPlatformPkg/Library/ArmPlatformLibNull/ArmPlatformLibNull.inf
+ 
+   TimerLib|ArmPkg/Library/ArmArchTimerLib/ArmArchTimerLib.inf
+-  NorFlashPlatformLib|ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.inf
+  VirtNorFlashPlatformLib|ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.inf
+ 
+   CapsuleLib|MdeModulePkg/Library/DxeCapsuleLibNull/DxeCapsuleLibNull.inf
+   BootLogoLib|MdeModulePkg/Library/BootLogoLib/BootLogoLib.inf
+@@ -400,7 +400,7 @@
+     <LibraryClasses>
+       NULL|ArmVirtPkg/Library/ArmVirtTimerFdtClientLib/ArmVirtTimerFdtClientLib.inf
+   }
+-  ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashDxe.inf
+  OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+   MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
+ 
+   #
+diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+index f6a538df72..7c655d384d 100644
+--- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
+@@ -73,7 +73,7 @@ READ_LOCK_STATUS   = TRUE
+ 
+   INF ArmPkg/Drivers/ArmGic/ArmGicDxe.inf
+   INF ArmPkg/Drivers/TimerDxe/TimerDxe.inf
+-  INF ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashDxe.inf
+  INF OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+   INF MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
+ 
+   #
+diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+index 656c9d99a3..344e2c4ed9 100644
+--- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
+++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
+@@ -65,7 +65,7 @@
+   ArmVirtMemInfoLib|ArmVirtPkg/Library/QemuVirtMemInfoLib/QemuVirtMemInfoLib.inf
+ 
+   TimerLib|ArmPkg/Library/ArmArchTimerLib/ArmArchTimerLib.inf
+-  NorFlashPlatformLib|ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.inf
+  VirtNorFlashPlatformLib|ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.inf
+ 
+   CapsuleLib|MdeModulePkg/Library/DxeCapsuleLibNull/DxeCapsuleLibNull.inf
+   BootLogoLib|MdeModulePkg/Library/BootLogoLib/BootLogoLib.inf
+@@ -329,7 +329,7 @@
+     <LibraryClasses>
+       NULL|ArmVirtPkg/Library/ArmVirtTimerFdtClientLib/ArmVirtTimerFdtClientLib.inf
+   }
+-  ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashDxe.inf
+  OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+   MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
+ 
+   #
+diff --git a/ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.c b/ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.c
+index 271d7f0efb..93a2fed40f 100644
+--- a/ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.c
+++ b/ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.c
+@@ -8,8 +8,8 @@
+ 
+ #include <Library/BaseLib.h>
+ #include <Library/DebugLib.h>
+-#include <Library/NorFlashPlatformLib.h>
+ #include <Library/UefiBootServicesTableLib.h>
+#include <Library/VirtNorFlashPlatformLib.h>
+ 
+ #include <Protocol/FdtClient.h>
+ 
+@@ -18,19 +18,19 @@
+ #define MAX_FLASH_BANKS        4
+ 
+ EFI_STATUS
+-NorFlashPlatformInitialization (
+VirtNorFlashPlatformInitialization (
+   VOID
+   )
+ {
+   return EFI_SUCCESS;
+ }
+ 
+-NOR_FLASH_DESCRIPTION mNorFlashDevices[MAX_FLASH_BANKS];
+STATIC VIRT_NOR_FLASH_DESCRIPTION  mNorFlashDevices[MAX_FLASH_BANKS];
+ 
+ EFI_STATUS
+-NorFlashPlatformGetDevices (
+-  OUT NOR_FLASH_DESCRIPTION   **NorFlashDescriptions,
+-  OUT UINT32                  *Count
+VirtNorFlashPlatformGetDevices (
+  OUT VIRT_NOR_FLASH_DESCRIPTION  **NorFlashDescriptions,
+  OUT UINT32                      *Count
+   )
+ {
+   FDT_CLIENT_PROTOCOL         *FdtClient;
+diff --git a/ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.inf b/ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.inf
+index 4c3683bf5d..a6b5865be9 100644
+--- a/ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.inf
+++ b/ArmVirtPkg/Library/NorFlashQemuLib/NorFlashQemuLib.inf
+@@ -14,17 +14,17 @@
+   FILE_GUID                      = 339B7829-4C5F-4EFC-B2DD-5050E530DECE
+   MODULE_TYPE                    = DXE_DRIVER
+   VERSION_STRING                 = 1.0
+-  LIBRARY_CLASS                  = NorFlashPlatformLib
+  LIBRARY_CLASS                  = VirtNorFlashPlatformLib
+ 
+ [Sources.common]
+   NorFlashQemuLib.c
+ 
+ [Packages]
+   MdePkg/MdePkg.dec
+-  ArmPlatformPkg/ArmPlatformPkg.dec
+   ArmPkg/ArmPkg.dec
+   ArmVirtPkg/ArmVirtPkg.dec
+   EmbeddedPkg/EmbeddedPkg.dec
+  OvmfPkg/OvmfPkg.dec
+ 
+ [LibraryClasses]
+   BaseLib
+-- 
+2.41.0
+
--- a/SOURCES/edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch
+++ b/SOURCES/edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch
@ -0,0 +1,56 @@
+From 045496325e278716e724ffdf9685667a8766d4f3 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 10:34:52 -0400
+Subject: [PATCH 28/31] CryptoPkg/Test: call ProcessLibraryConstructorList
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [28/31] 5ff484fbc68d094fbcdda2772c2869818c67de8d
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit 94961b8817eec6f8d0434555ac50a7aa51c22201
+Author: Gerd Hoffmann <kraxel@redhat.com>
+Date:   Fri Jun 14 11:45:49 2024 +0200
+
+    CryptoPkg/Test: call ProcessLibraryConstructorList
+
+    Needed to properly initialize BaseRngLib.
+
+    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c b/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
+index 88a3f96305..0ba9f35840 100644
+--- a/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
+++ b/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
+@@ -8,6 +8,11 @@
+ **/
+ #include "TestBaseCryptLib.h"
+ 
+VOID
+EFIAPI
+ProcessLibraryConstructorList (
+  VOID
+  );
+ 
+ /**
+   Initialize the unit test framework, suite, and unit tests for the
+@@ -77,5 +82,6 @@ main (
+   char *argv[]
+   )
+ {
+  ProcessLibraryConstructorList ();
+   return UefiTestMain ();
+ }
+-- 
+2.39.3
+
--- a/SOURCES/edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch
+++ b/SOURCES/edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch
@ -0,0 +1,174 @@
+From f8691984227809170b702f6fd087add1f95ee8fe Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 5 Mar 2024 16:38:49 -0500
+Subject: [PATCH 1/2] EmbeddedPkg/Hob: Integer Overflow in CreateHob()
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 66: EmbeddedPkg/Hob: Integer Overflow in CreateHob()
+RH-Jira: RHEL-21158
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [1/2] 301d3bfe82c39179fb85d510788831aa340212d9
+
+JIRA: https://issues.redhat.com/browse/RHEL-21158
+CVE: CVE-2022-36765
+Upstream: Merged
+
+commit aeaee8944f0eaacbf4cdf39279785b9ba4836bb6
+Author: Gua Guo <gua.guo@intel.com>
+Date:   Thu Jan 11 13:07:50 2024 +0800
+
+    EmbeddedPkg/Hob: Integer Overflow in CreateHob()
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
+
+    Fix integer overflow in various CreateHob instances.
+    Fixes: CVE-2022-36765
+
+    The CreateHob() function aligns the requested size to 8
+    performing the following operation:
+    ```
+    HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
+    ```
+
+    No checks are performed to ensure this value doesn't
+    overflow, and could lead to CreateHob() returning a smaller
+    HOB than requested, which could lead to OOB HOB accesses.
+
+    Reported-by: Marc Beatove <mbeatove@google.com>
+    Cc: Leif Lindholm <quic_llindhol@quicinc.com>
+    Reviewed-by: Ard Biesheuvel <ardb+tianocore@kernel.org>
+    Cc: Abner Chang <abner.chang@amd.com>
+    Cc: John Mathew <john.mathews@intel.com>
+    Authored-by: Gerd Hoffmann <kraxel@redhat.com>
+    Signed-off-by: Gua Guo <gua.guo@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ EmbeddedPkg/Library/PrePiHobLib/Hob.c | 47 +++++++++++++++++++++++++--
+ 1 file changed, 45 insertions(+), 2 deletions(-)
+
+diff --git a/EmbeddedPkg/Library/PrePiHobLib/Hob.c b/EmbeddedPkg/Library/PrePiHobLib/Hob.c
+index b5cc6c5d8f..f4c99369c6 100644
+--- a/EmbeddedPkg/Library/PrePiHobLib/Hob.c
+++ b/EmbeddedPkg/Library/PrePiHobLib/Hob.c
+@@ -112,6 +112,13 @@ CreateHob (
+ 
+   HandOffHob = GetHobList ();
+ 
+  //
+  // Check Length to avoid data overflow.
+  //
+  if (HobLength > MAX_UINT16 - 0x7) {
+    return NULL;
+  }
+
+   HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
+ 
+   FreeMemory = HandOffHob->EfiFreeMemoryTop - HandOffHob->EfiFreeMemoryBottom;
+@@ -161,7 +168,10 @@ BuildResourceDescriptorHob (
+   EFI_HOB_RESOURCE_DESCRIPTOR  *Hob;
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_RESOURCE_DESCRIPTOR, sizeof (EFI_HOB_RESOURCE_DESCRIPTOR));
+-  ASSERT(Hob != NULL);
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   Hob->ResourceType      = ResourceType;
+   Hob->ResourceAttribute = ResourceAttribute;
+@@ -403,6 +413,10 @@ BuildModuleHob (
+           ((ModuleLength & (EFI_PAGE_SIZE - 1)) == 0));
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION_MODULE));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   CopyGuid (&(Hob->MemoryAllocationHeader.Name), &gEfiHobMemoryAllocModuleGuid);
+   Hob->MemoryAllocationHeader.MemoryBaseAddress = MemoryAllocationModule;
+@@ -450,7 +464,12 @@ BuildGuidHob (
+   //
+   ASSERT (DataLength <= (0xffff - sizeof (EFI_HOB_GUID_TYPE)));
+ 
+-  Hob = CreateHob (EFI_HOB_TYPE_GUID_EXTENSION, (UINT16) (sizeof (EFI_HOB_GUID_TYPE) + DataLength));
+  Hob = CreateHob (EFI_HOB_TYPE_GUID_EXTENSION, (UINT16)(sizeof (EFI_HOB_GUID_TYPE) + DataLength));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return NULL;
+  }
+
+   CopyGuid (&Hob->Name, Guid);
+   return Hob + 1;
+ }
+@@ -516,6 +535,10 @@ BuildFvHob (
+   EFI_HOB_FIRMWARE_VOLUME  *Hob;
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_FV, sizeof (EFI_HOB_FIRMWARE_VOLUME));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   Hob->BaseAddress = BaseAddress;
+   Hob->Length      = Length;
+@@ -548,6 +571,10 @@ BuildFv2Hob (
+   EFI_HOB_FIRMWARE_VOLUME2  *Hob;
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_FV2, sizeof (EFI_HOB_FIRMWARE_VOLUME2));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   Hob->BaseAddress = BaseAddress;
+   Hob->Length      = Length;
+@@ -589,6 +616,10 @@ BuildFv3Hob (
+   EFI_HOB_FIRMWARE_VOLUME3  *Hob;
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_FV3, sizeof (EFI_HOB_FIRMWARE_VOLUME3));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   Hob->BaseAddress          = BaseAddress;
+   Hob->Length               = Length;
+@@ -645,6 +676,10 @@ BuildCpuHob (
+   EFI_HOB_CPU  *Hob;
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_CPU, sizeof (EFI_HOB_CPU));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   Hob->SizeOfMemorySpace = SizeOfMemorySpace;
+   Hob->SizeOfIoSpace     = SizeOfIoSpace;
+@@ -681,6 +716,10 @@ BuildStackHob (
+           ((Length & (EFI_PAGE_SIZE - 1)) == 0));
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION_STACK));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   CopyGuid (&(Hob->AllocDescriptor.Name), &gEfiHobMemoryAllocStackGuid);
+   Hob->AllocDescriptor.MemoryBaseAddress = BaseAddress;
+@@ -761,6 +800,10 @@ BuildMemoryAllocationHob (
+           ((Length & (EFI_PAGE_SIZE - 1)) == 0));
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   ZeroMem (&(Hob->AllocDescriptor.Name), sizeof (EFI_GUID));
+   Hob->AllocDescriptor.MemoryBaseAddress = BaseAddress;
+-- 
+2.39.3
+
--- a/SOURCES/edk2-MdeModulePkg-Change-use-of-EFI_D_-to-DEBUG_.patch
+++ b/SOURCES/edk2-MdeModulePkg-Change-use-of-EFI_D_-to-DEBUG_.patch
--- a/SOURCES/edk2-MdeModulePkg-Duplicate-BaseRngLibTimerLib-to-MdeModu.patch
+++ b/SOURCES/edk2-MdeModulePkg-Duplicate-BaseRngLibTimerLib-to-MdeModu.patch
--- a/SOURCES/edk2-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch
+++ b/SOURCES/edk2-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch
@ -0,0 +1,66 @@
+From 2e4b2b8fce40cf93f35e052102f37fee07b2e64a Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Mon, 10 Jun 2024 18:13:29 -0400
+Subject: [PATCH 02/31] MdeModulePkg: Potential UINT32 overflow in S3
+ ResumeCount
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [2/31] a3592c3437041cbd33a6c11feb3d0999e122c8c0
+
+JIRA: https://issues.redhat.com/browse/RHEL-40099
+CVE: CVE-2024-1298
+Upstream: Merged
+
+commit 284dbac43da752ee34825c8b3f6f9e8281cb5a19
+Author: Shanmugavel Pakkirisamy <shanmugavelx.pakkirisamy@intel.com>
+Date:   Mon May 6 17:53:09 2024 +0800
+
+    MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4677
+
+    Attacker able to modify physical memory and ResumeCount.
+    System will crash/DoS when ResumeCount reaches its MAX_UINT32.
+
+    Cc: Zhiguang Liu <zhiguang.liu@intel.com>
+    Cc: Dandan Bi <dandan.bi@intel.com>
+    Cc: Liming Gao <gaoliming@byosoft.com.cn>
+
+    Signed-off-by: Pakkirisamy ShanmugavelX <shanmugavelx.pakkirisamy@intel.com>
+    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../FirmwarePerformancePei.c                         | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c
+index 6881466201..54b3bc3c54 100644
+--- a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c
+++ b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c
+@@ -110,11 +110,15 @@ FpdtStatusCodeListenerPei (
+   //
+   S3ResumeTotal = MultU64x32 (AcpiS3ResumeRecord->AverageResume, AcpiS3ResumeRecord->ResumeCount);
+   AcpiS3ResumeRecord->ResumeCount++;
+-  AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
+  if (AcpiS3ResumeRecord->ResumeCount > 0) {
+    AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
+    DEBUG ((DEBUG_INFO, "\nFPDT: S3 Resume Performance - AverageResume = 0x%x\n", AcpiS3ResumeRecord->AverageResume));
+  } else {
+    DEBUG ((DEBUG_ERROR, "\nFPDT: S3 ResumeCount reaches the MAX_UINT32 value. S3 ResumeCount record reset to Zero."));
+  }
+ 
+-  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount   = %d\n", AcpiS3ResumeRecord->ResumeCount));
+-  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume    = %ld\n", AcpiS3ResumeRecord->FullResume));
+-  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - AverageResume = %ld\n", AcpiS3ResumeRecord->AverageResume));
+  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount   = 0x%x\n", AcpiS3ResumeRecord->ResumeCount));
+  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume    = 0x%x\n", AcpiS3ResumeRecord->FullResume));
+ 
+   //
+   // Update S3 Suspend Performance Record.
+-- 
+2.39.3
+
--- a/SOURCES/edk2-MdeModulePkg-Rng-Add-GUID-to-describe-unsafe-Rng-alg.patch
+++ b/SOURCES/edk2-MdeModulePkg-Rng-Add-GUID-to-describe-unsafe-Rng-alg.patch
@ -0,0 +1,90 @@
+From 5ba444af245d59e3208260478aa710d4f143f259 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 16:06:25 -0400
+Subject: [PATCH 20/31] MdeModulePkg/Rng: Add GUID to describe unsafe Rng
+ algorithms
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [20/31] d0e553560d60122f2fe5f33923b5b943c138a18d
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit 414c0f20896f3dec412135fa4260f8aad8bef246
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Fri Aug 11 16:33:07 2023 +0200
+
+    MdeModulePkg/Rng: Add GUID to describe unsafe Rng algorithms
+
+    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4441
+
+    The EFI_RNG_PROTOCOL can rely on the RngLib. The RngLib has multiple
+    implementations, some of them are unsafe (e.g. BaseRngLibTimerLib).
+    To allow the RngDxe to detect when such implementation is used,
+    a GetRngGuid() function is added in a following patch.
+
+    Prepare GetRngGuid() return values and add a gEdkiiRngAlgorithmUnSafe
+    to describe an unsafe implementation, cf. the BaseRngLibTimerLib.
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
+    Acked-by: Ard Biesheuvel <ardb@kernel.org>
+    Tested-by: Kun Qin <kun.qin@microsoft.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ MdeModulePkg/Include/Guid/RngAlgorithm.h | 23 +++++++++++++++++++++++
+ MdeModulePkg/MdeModulePkg.dec            |  3 +++
+ 2 files changed, 26 insertions(+)
+ create mode 100644 MdeModulePkg/Include/Guid/RngAlgorithm.h
+
+diff --git a/MdeModulePkg/Include/Guid/RngAlgorithm.h b/MdeModulePkg/Include/Guid/RngAlgorithm.h
+new file mode 100644
+index 0000000000..e2ac2ba3e5
+--- /dev/null
+++ b/MdeModulePkg/Include/Guid/RngAlgorithm.h
+@@ -0,0 +1,23 @@
+/** @file
+  Rng Algorithm
+
+  Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef RNG_ALGORITHM_GUID_H_
+#define RNG_ALGORITHM_GUID_H_
+
+///
+/// The implementation of a Random Number Generator might be unsafe, when using
+/// a dummy implementation for instance. Allow identifying such implementation
+/// with this GUID.
+///
+#define EDKII_RNG_ALGORITHM_UNSAFE \
+  { \
+    0x869f728c, 0x409d, 0x4ab4, {0xac, 0x03, 0x71, 0xd3, 0x09, 0xc1, 0xb3, 0xf4 } \
+  }
+
+extern EFI_GUID  gEdkiiRngAlgorithmUnSafe;
+
+#endif // #ifndef RNG_ALGORITHM_GUID_H_
+diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
+index 08d59dfb3e..3513a9678a 100644
+--- a/MdeModulePkg/MdeModulePkg.dec
+++ b/MdeModulePkg/MdeModulePkg.dec
+@@ -401,6 +401,9 @@
+   ## Include/Guid/MigratedFvInfo.h
+   gEdkiiMigratedFvInfoGuid = { 0xc1ab12f7, 0x74aa, 0x408d, { 0xa2, 0xf4, 0xc6, 0xce, 0xfd, 0x17, 0x98, 0x71 } }
+ 
+  ## Include/Guid/RngAlgorithm.h
+  gEdkiiRngAlgorithmUnSafe = { 0x869f728c, 0x409d, 0x4ab4, {0xac, 0x03, 0x71, 0xd3, 0x09, 0xc1, 0xb3, 0xf4 }}
+
+   #
+   # GUID defined in UniversalPayload
+   #
+-- 
+2.39.3
+
--- a/SOURCES/edk2-MdePkg-Add-deprecated-warning-to-BaseRngLibTimer.patch
+++ b/SOURCES/edk2-MdePkg-Add-deprecated-warning-to-BaseRngLibTimer.patch
@ -0,0 +1,89 @@
+From 3800b9ee5d6d4c05c7e27f949c3b32c422c78f2d Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 16:02:31 -0400
+Subject: [PATCH 16/31] MdePkg: Add deprecated warning to BaseRngLibTimer
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [16/31] 6e199344d083e90f60cbe01dfb3c2a3719e3177d
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit e93468442b7da7bc80e00014e854c0c8a0a7184b
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Fri Aug 11 16:33:03 2023 +0200
+
+    MdePkg: Add deprecated warning to BaseRngLibTimer
+
+    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4504
+
+    To keep the MdePkg self-contained and avoid dependencies on GUIDs
+    defined in other packages, the BaseRngLibTimer was moved to the
+    MdePkg.
+    Add a constructor to warn and request to use the MdeModulePkg
+    implementation.
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
+    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
+    Acked-by: Ard Biesheuvel <ardb@kernel.org>
+    Tested-by: Kun Qin <kun.qin@microsoft.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../BaseRngLibTimerLib/BaseRngLibTimerLib.inf |  1 +
+ .../Library/BaseRngLibTimerLib/RngLibTimer.c  | 22 +++++++++++++++++++
+ 2 files changed, 23 insertions(+)
+
+diff --git a/MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf b/MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+index f857290e82..96c90db63f 100644
+--- a/MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+++ b/MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+@@ -23,6 +23,7 @@
+   MODULE_TYPE                    = BASE
+   VERSION_STRING                 = 1.0
+   LIBRARY_CLASS                  = RngLib
+  CONSTRUCTOR                    = BaseRngLibTimerConstructor
+ 
+ [Sources]
+   RngLibTimer.c
+diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
+index 54d29d96f3..6b8392162b 100644
+--- a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
+++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
+@@ -13,6 +13,28 @@
+ 
+ #define DEFAULT_DELAY_TIME_IN_MICROSECONDS 10
+ 
+/**
+  This implementation is to be replaced by its MdeModulePkg copy.
+  The cause being that some GUIDs (gEdkiiRngAlgorithmUnSafe) cannot
+  be defined in the MdePkg.
+
+  @retval EFI_SUCCESS   The constructor always returns EFI_SUCCESS.
+**/
+RETURN_STATUS
+EFIAPI
+BaseRngLibTimerConstructor (
+  VOID
+  )
+{
+  DEBUG ((
+    DEBUG_WARN,
+    "Warning: This BaseRngTimerLib implementation will be deprecated. "
+    "Please use the MdeModulePkg implementation equivalent.\n"
+    ));
+
+  return RETURN_SUCCESS;
+}
+
+ /**
+  Using the TimerLib GetPerformanceCounterProperties() we delay
+  for enough time for the PerformanceCounter to increment.
+-- 
+2.39.3
+
--- a/SOURCES/edk2-MdePkg-Apply-uncrustify-changes.patch
+++ b/SOURCES/edk2-MdePkg-Apply-uncrustify-changes.patch
@ -0,0 +1,94 @@
+From 1198bceefa4834c09e1edc1c558aeffe4930d1f5 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 11 Jun 2024 21:32:26 -0400
+Subject: [PATCH 03/31] MdePkg: Apply uncrustify changes
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [3/31] 422d94b837bf0e65164968272a358c2656f59838
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+This is a subset of the whitespace changes in the corresponding upstream
+commit. It is needed for the next commits in this series to apply with
+less fewer conflicts.
+
+commit 2f88bd3a1296c522317f1c21377876de63de5be7
+Author: Michael Kubacki <michael.kubacki@microsoft.com>
+Date:   Sun Dec 5 14:54:05 2021 -0800
+
+    MdePkg: Apply uncrustify changes
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3737
+
+    Apply uncrustify changes to .c/.h files in the MdePkg package
+
+    Cc: Andrew Fish <afish@apple.com>
+    Cc: Leif Lindholm <leif@nuviainc.com>
+    Cc: Michael D Kinney <michael.d.kinney@intel.com>
+    Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
+    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ MdePkg/Include/Protocol/Rng.h | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/MdePkg/Include/Protocol/Rng.h b/MdePkg/Include/Protocol/Rng.h
+index a0a05d1661..baf425587b 100644
+--- a/MdePkg/Include/Protocol/Rng.h
+++ b/MdePkg/Include/Protocol/Rng.h
+@@ -93,7 +93,7 @@ typedef EFI_GUID EFI_RNG_ALGORITHM;
+ **/
+ typedef
+ EFI_STATUS
+-(EFIAPI *EFI_RNG_GET_INFO) (
+(EFIAPI *EFI_RNG_GET_INFO)(
+   IN EFI_RNG_PROTOCOL             *This,
+   IN OUT UINTN                    *RNGAlgorithmListSize,
+   OUT EFI_RNG_ALGORITHM           *RNGAlgorithmList
+@@ -123,9 +123,9 @@ EFI_STATUS
+ **/
+ typedef
+ EFI_STATUS
+-(EFIAPI *EFI_RNG_GET_RNG) (
+(EFIAPI *EFI_RNG_GET_RNG)(
+   IN EFI_RNG_PROTOCOL            *This,
+-  IN EFI_RNG_ALGORITHM           *RNGAlgorithm, OPTIONAL
+  IN EFI_RNG_ALGORITHM           *RNGAlgorithm  OPTIONAL,
+   IN UINTN                       RNGValueLength,
+   OUT UINT8                      *RNGValue
+   );
+@@ -135,16 +135,16 @@ EFI_STATUS
+ /// applications, or entropy for seeding other random number generators.
+ ///
+ struct _EFI_RNG_PROTOCOL {
+-  EFI_RNG_GET_INFO                GetInfo;
+-  EFI_RNG_GET_RNG                 GetRNG;
+  EFI_RNG_GET_INFO    GetInfo;
+  EFI_RNG_GET_RNG     GetRNG;
+ };
+ 
+-extern EFI_GUID gEfiRngProtocolGuid;
+-extern EFI_GUID gEfiRngAlgorithmSp80090Hash256Guid;
+-extern EFI_GUID gEfiRngAlgorithmSp80090Hmac256Guid;
+-extern EFI_GUID gEfiRngAlgorithmSp80090Ctr256Guid;
+-extern EFI_GUID gEfiRngAlgorithmX9313DesGuid;
+-extern EFI_GUID gEfiRngAlgorithmX931AesGuid;
+-extern EFI_GUID gEfiRngAlgorithmRaw;
+extern EFI_GUID  gEfiRngProtocolGuid;
+extern EFI_GUID  gEfiRngAlgorithmSp80090Hash256Guid;
+extern EFI_GUID  gEfiRngAlgorithmSp80090Hmac256Guid;
+extern EFI_GUID  gEfiRngAlgorithmSp80090Ctr256Guid;
+extern EFI_GUID  gEfiRngAlgorithmX9313DesGuid;
+extern EFI_GUID  gEfiRngAlgorithmX931AesGuid;
+extern EFI_GUID  gEfiRngAlgorithmRaw;
+ 
+ #endif
+-- 
+2.39.3
+
--- a/SOURCES/edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch
+++ b/SOURCES/edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch
@ -0,0 +1,213 @@
+From 1d4b6d489cb919faa3ad67a3ae53fe26c4cd0a75 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 10:32:29 -0400
+Subject: [PATCH 25/31] MdePkg/BaseRngLib: Add a smoketest for RDRAND and check
+ CPUID
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [25/31] 11804d6f86a644ae2c3dcad89c633ad63b794d3f
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit c3a8ca7b54a9fd17acdf16c6282a92cc989fa92a
+Author: Pedro Falcato <pedro.falcato@gmail.com>
+Date:   Tue Nov 22 22:31:03 2022 +0000
+
+    MdePkg/BaseRngLib: Add a smoketest for RDRAND and check CPUID
+
+    RDRAND has notoriously been broken many times over its lifespan.
+    Add a smoketest to RDRAND, in order to better sniff out potential
+    security concerns.
+
+    Also add a proper CPUID test in order to support older CPUs which may
+    not have it; it was previously being tested but then promptly ignored.
+
+    Testing algorithm inspired by linux's arch/x86/kernel/cpu/rdrand.c
+    :x86_init_rdrand() per commit 049f9ae9..
+
+    Many thanks to Jason Donenfeld for relicensing his linux RDRAND detection
+    code to MIT and the public domain.
+
+    >On Tue, Nov 22, 2022 at 2:21 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
+      <..>
+    >    I (re)wrote that function in Linux. I hereby relicense it as MIT, and
+    >    also place it into public domain. Do with it what you will now.
+    >
+    >    Jason
+
+    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4163
+
+    Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
+    Cc: Michael D Kinney <michael.d.kinney@intel.com>
+    Cc: Liming Gao <gaoliming@byosoft.com.cn>
+    Cc: Zhiguang Liu <zhiguang.liu@intel.com>
+    Cc: Jason A. Donenfeld <Jason@zx2c4.com>
+
+Signed-off-by: Jon Maloy <jmaloy@gmail.com>
+---
+ MdePkg/Library/BaseRngLib/Rand/RdRand.c | 99 +++++++++++++++++++++++--
+ 1 file changed, 91 insertions(+), 8 deletions(-)
+
+diff --git a/MdePkg/Library/BaseRngLib/Rand/RdRand.c b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
+index aee8ea04e8..7132ab0efd 100644
+--- a/MdePkg/Library/BaseRngLib/Rand/RdRand.c
+++ b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
+@@ -3,6 +3,7 @@
+   to provide high-quality random numbers.
+ 
+ Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
+Copyright (c) 2022, Pedro Falcato. All rights reserved.<BR>
+ Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
+ Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
+ 
+@@ -25,6 +26,88 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ STATIC BOOLEAN mRdRandSupported;
+ 
+//
+// Intel SDM says 10 tries is good enough for reliable RDRAND usage.
+//
+#define RDRAND_RETRIES  10
+
+#define RDRAND_TEST_SAMPLES  8
+
+#define RDRAND_MIN_CHANGE  5
+
+//
+// Add a define for native-word RDRAND, just for the test.
+//
+#ifdef MDE_CPU_X64
+#define ASM_RDRAND  AsmRdRand64
+#else
+#define ASM_RDRAND  AsmRdRand32
+#endif
+
+/**
+  Tests RDRAND for broken implementations.
+
+  @retval TRUE         RDRAND is reliable (and hopefully safe).
+  @retval FALSE        RDRAND is unreliable and should be disabled, despite CPUID.
+
+**/
+STATIC
+BOOLEAN
+TestRdRand (
+  VOID
+  )
+{
+  //
+  // Test for notoriously broken rdrand implementations that always return the same
+  // value, like the Zen 3 uarch (all-1s) or other several AMD families on suspend/resume (also all-1s).
+  // Note that this should be expanded to extensively test for other sorts of possible errata.
+  //
+
+  //
+  // Our algorithm samples rdrand $RDRAND_TEST_SAMPLES times and expects
+  // a different result $RDRAND_MIN_CHANGE times for reliable RDRAND usage.
+  //
+  UINTN   Prev;
+  UINT8   Idx;
+  UINT8   TestIteration;
+  UINT32  Changed;
+
+  Changed = 0;
+
+  for (TestIteration = 0; TestIteration < RDRAND_TEST_SAMPLES; TestIteration++) {
+    UINTN  Sample;
+    //
+    // Note: We use a retry loop for rdrand. Normal users get this in BaseRng.c
+    // Any failure to get a random number will assume RDRAND does not work.
+    //
+    for (Idx = 0; Idx < RDRAND_RETRIES; Idx++) {
+      if (ASM_RDRAND (&Sample)) {
+        break;
+      }
+    }
+
+    if (Idx == RDRAND_RETRIES) {
+      DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: Failed to get an RDRAND random number - disabling\n"));
+      return FALSE;
+    }
+
+    if (TestIteration != 0) {
+      Changed += Sample != Prev;
+    }
+
+    Prev = Sample;
+  }
+
+  if (Changed < RDRAND_MIN_CHANGE) {
+    DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: RDRAND not reliable - disabling\n"));
+    return FALSE;
+  }
+
+  return TRUE;
+}
+
+#undef ASM_RDRAND
+
+ /**
+   The constructor function checks whether or not RDRAND instruction is supported
+   by the host hardware.
+@@ -49,10 +132,13 @@ BaseRngLibConstructor (
+   // CPUID. A value of 1 indicates that processor support RDRAND instruction.
+   //
+   AsmCpuid (1, 0, 0, &RegEcx, 0);
+-  ASSERT ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
+ 
+   mRdRandSupported = ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
+ 
+  if (mRdRandSupported) {
+    mRdRandSupported = TestRdRand ();
+  }
+
+   return EFI_SUCCESS;
+ }
+ 
+@@ -71,6 +157,7 @@ ArchGetRandomNumber16 (
+   OUT     UINT16                    *Rand
+   )
+ {
+  ASSERT (mRdRandSupported);
+   return AsmRdRand16 (Rand);
+ }
+ 
+@@ -89,6 +176,7 @@ ArchGetRandomNumber32 (
+   OUT     UINT32                    *Rand
+   )
+ {
+  ASSERT (mRdRandSupported);
+   return AsmRdRand32 (Rand);
+ }
+ 
+@@ -107,6 +195,7 @@ ArchGetRandomNumber64 (
+   OUT     UINT64                    *Rand
+   )
+ {
+  ASSERT (mRdRandSupported);
+   return AsmRdRand64 (Rand);
+ }
+ 
+@@ -123,13 +212,7 @@ ArchIsRngSupported (
+   VOID
+   )
+ {
+-  /*
+-     Existing software depends on this always returning TRUE, so for
+-     now hard-code it.
+-
+-     return mRdRandSupported;
+-  */
+-  return TRUE;
+  return mRdRandSupported;
+ }
+ 
+ /**
+-- 
+2.39.3
+
--- a/SOURCES/edk2-MdePkg-DxeRngLib-Request-raw-algorithm-instead-of-de.patch
+++ b/SOURCES/edk2-MdePkg-DxeRngLib-Request-raw-algorithm-instead-of-de.patch
@ -0,0 +1,66 @@
+From 3351bd0ba07cc490c344d2dc54b86833993ca5a2 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 15:58:58 -0400
+Subject: [PATCH 18/31] MdePkg/DxeRngLib: Request raw algorithm instead of
+ default
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [18/31] fa2da700127ae713aa578638c2390673fc49522d
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit bd1f0eecc1dfe51ba20161bef8860d12392006bd
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Fri Aug 11 16:33:05 2023 +0200
+
+    MdePkg/DxeRngLib: Request raw algorithm instead of default
+
+    The DxeRngLib tries to generate a random number using the 3 NIST
+    SP 800-90 compliant DRBG algorithms, i.e. 256-bits CTR, HASH and HMAC.
+    If none of the call is successful, the fallback option is the default
+    RNG algorithm of the EFI_RNG_PROTOCOL. This default algorithm might
+    be an unsafe implementation.
+
+    Try requesting the Raw algorithm before requesting the default one.
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
+    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
+    Acked-by: Ard Biesheuvel <ardb@kernel.org>
+    Tested-by: Kun Qin <kun.qin@microsoft.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ MdePkg/Library/DxeRngLib/DxeRngLib.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/MdePkg/Library/DxeRngLib/DxeRngLib.c b/MdePkg/Library/DxeRngLib/DxeRngLib.c
+index 9c3d67b5a6..4b2fc1cde5 100644
+--- a/MdePkg/Library/DxeRngLib/DxeRngLib.c
+++ b/MdePkg/Library/DxeRngLib/DxeRngLib.c
+@@ -64,9 +64,16 @@ GenerateRandomNumberViaNist800Algorithm (
+   if (!EFI_ERROR (Status)) {
+     return Status;
+   }
+
+  Status = RngProtocol->GetRNG (RngProtocol, &gEfiRngAlgorithmRaw, BufferSize, Buffer);
+  DEBUG ((DEBUG_INFO, "%a: GetRNG algorithm Raw - Status = %r\n", __func__, Status));
+  if (!EFI_ERROR (Status)) {
+    return Status;
+  }
+
+   // If all the other methods have failed, use the default method from the RngProtocol
+   Status = RngProtocol->GetRNG (RngProtocol, NULL, BufferSize, Buffer);
+-  DEBUG((DEBUG_INFO, "%a: GetRNG algorithm Hash-256 - Status = %r\n", __FUNCTION__, Status));
+  DEBUG ((DEBUG_INFO, "%a: GetRNG algorithm default - Status = %r\n", __func__, Status));
+   if (!EFI_ERROR (Status)) {
+     return Status;
+   }
+-- 
+2.39.3
+
--- a/SOURCES/edk2-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch
+++ b/SOURCES/edk2-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch
@ -0,0 +1,63 @@
+From 30da4837584643c637eea751dbb01e0718fa764d Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Mon, 21 Oct 2024 14:45:37 -0400
+Subject: [PATCH] MdePkg: Fix overflow issue in BasePeCoffLib
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 96: MdePkg: Fix overflow issue in BasePeCoffLib
+RH-Jira: RHEL-60830
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [1/1] 5406406ac2711215ec2bd3d9c1a2e6bb268dda38 (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-60830
+CVE: CVE-2024-38796
+Upstream: Merged
+
+commit c95233b8525ca6828921affd1496146cff262e65
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Sep 27 12:08:55 2024 -0700
+
+    MdePkg: Fix overflow issue in BasePeCoffLib
+
+    The RelocDir->Size is a UINT32 value, and RelocDir->VirtualAddress is
+    also a UINT32 value. The current code does not check for overflow when
+    adding RelocDir->Size to RelocDir->VirtualAddress. This patch adds a
+    check to ensure that the addition does not overflow.
+
+    Signed-off-by: Doug Flick <dougflick@microsoft.com>
+    Authored-by: sriraamx gobichettipalayam <sri..@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ MdePkg/Library/BasePeCoffLib/BasePeCoff.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
+index 1102833b94..6b1ccc7217 100644
+--- a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
+++ b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
+@@ -991,13 +991,14 @@ PeCoffLoaderRelocateImage (
+     RelocDir = &Hdr.Te->DataDirectory[0];
+   }
+ 
+-  if ((RelocDir != NULL) && (RelocDir->Size > 0)) {
+-    RelocBase = (EFI_IMAGE_BASE_RELOCATION *) PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset);
+-    RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *) PeCoffLoaderImageAddress (ImageContext,
+-                                                                            RelocDir->VirtualAddress + RelocDir->Size - 1,
+-                                                                            TeStrippedOffset
+-                                                                            );
+-    if (RelocBase == NULL || RelocBaseEnd == NULL || (UINTN) RelocBaseEnd < (UINTN) RelocBase) {
+  if ((RelocDir != NULL) && (RelocDir->Size > 0) && (RelocDir->Size - 1 < MAX_UINT32 - RelocDir->VirtualAddress)) {
+    RelocBase    = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset);
+    RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (
+                                                  ImageContext,
+                                                  RelocDir->VirtualAddress + RelocDir->Size - 1,
+                                                  TeStrippedOffset
+                                                  );
+    if ((RelocBase == NULL) || (RelocBaseEnd == NULL) || ((UINTN)RelocBaseEnd < (UINTN)RelocBase)) {
+       ImageContext->ImageError = IMAGE_ERROR_FAILED_RELOCATION;
+       return RETURN_LOAD_ERROR;
+     }
+-- 
+2.45.2
+
--- a/SOURCES/edk2-MdePkg-Introduce-CcMeasurementProtocol-for-CC-Guest-.patch
+++ b/SOURCES/edk2-MdePkg-Introduce-CcMeasurementProtocol-for-CC-Guest-.patch
@ -0,0 +1,390 @@
+From b8261ac422ba284249cd4f341d78d058e79960f5 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 7 Feb 2024 11:56:37 -0500
+Subject: [PATCH 03/17] MdePkg: Introduce CcMeasurementProtocol for CC Guest
+ firmware
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 44: edk2: heap buffer overflow in Tcg2MeasureGptTable()
+RH-Jira: RHEL-21154 RHEL-21156
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [3/13] 6bf304f8e3bc875024c8fb0a4cd5d2c944f69480 (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21154
+CVE: CVE-2022-36763
+Upstream: Merged
+
+commit e193584da60550008722498442c62ddb77bf27d5
+Author: Min Xu <min.m.xu@intel.com>
+Date:   Sat Dec 11 21:08:40 2021 +0800
+
+    MdePkg: Introduce CcMeasurementProtocol for CC Guest firmware
+
+    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3625
+
+    CC guest is a Confidential Computing guest. If CC Guest firmware
+    supports measurement and an event is created, CC Guest firmware
+    is designed to report the event log with the same data structure
+    in TCG-Platform-Firmware-Profile specification with
+    EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 format.
+
+    The CC Guest firmware supports measurement. It is designed to
+    produce EFI_CC_MEASUREMENT_PROTOCOL with new GUID
+    EFI_CC_MEASUREMENT_PROTOCOL_GUID to report event log and provides
+    hash capability.
+
+    Cc: Michael D Kinney <michael.d.kinney@intel.com>
+    Cc: Liming Gao <gaoliming@byosoft.com.cn>
+    Cc: Zhiguang Liu <zhiguang.liu@intel.com>
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+    Cc: Jian J Wang <jian.j.wang@intel.com>
+    Cc: Ken Lu <ken.lu@intel.com>
+    Cc: Sami Mujawar <sami.mujawar@arm.com>
+    Cc: Gerd Hoffmann <kraxel@redhat.com>
+    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
+    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
+    Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+    Signed-off-by: Min Xu <min.m.xu@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ MdePkg/Include/Protocol/CcMeasurement.h | 302 ++++++++++++++++++++++++
+ MdePkg/MdePkg.dec                       |   6 +
+ 2 files changed, 308 insertions(+)
+ create mode 100644 MdePkg/Include/Protocol/CcMeasurement.h
+
+diff --git a/MdePkg/Include/Protocol/CcMeasurement.h b/MdePkg/Include/Protocol/CcMeasurement.h
+new file mode 100644
+index 0000000000..68029e977f
+--- /dev/null
+++ b/MdePkg/Include/Protocol/CcMeasurement.h
+@@ -0,0 +1,302 @@
+/** @file
+  If CC Guest firmware supports measurement and an event is created,
+  CC Guest firmware is designed to report the event log with the same
+  data structure in TCG-Platform-Firmware-Profile specification with
+  EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 format.
+
+  The CC Guest firmware supports measurement, the CC Guest Firmware is
+  designed to produce EFI_CC_MEASUREMENT_PROTOCOL with new GUID
+  EFI_CC_MEASUREMENT_PROTOCOL_GUID to report event log and provides hash
+  capability.
+
+Copyright (c) 2020 - 2021, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef CC_MEASUREMENT_PROTOCOL_H_
+#define CC_MEASUREMENT_PROTOCOL_H_
+
+#include <IndustryStandard/UefiTcgPlatform.h>
+
+#define EFI_CC_MEASUREMENT_PROTOCOL_GUID  \
+  { 0x96751a3d, 0x72f4, 0x41a6, { 0xa7, 0x94, 0xed, 0x5d, 0x0e, 0x67, 0xae, 0x6b }}
+extern EFI_GUID  gEfiCcMeasurementProtocolGuid;
+
+typedef struct _EFI_CC_MEASUREMENT_PROTOCOL EFI_CC_MEASUREMENT_PROTOCOL;
+
+typedef struct {
+  UINT8    Major;
+  UINT8    Minor;
+} EFI_CC_VERSION;
+
+//
+// EFI_CC Type/SubType definition
+//
+#define EFI_CC_TYPE_NONE  0
+#define EFI_CC_TYPE_SEV   1
+#define EFI_CC_TYPE_TDX   2
+
+typedef struct {
+  UINT8    Type;
+  UINT8    SubType;
+} EFI_CC_TYPE;
+
+typedef UINT32 EFI_CC_EVENT_LOG_BITMAP;
+typedef UINT32 EFI_CC_EVENT_LOG_FORMAT;
+typedef UINT32 EFI_CC_EVENT_ALGORITHM_BITMAP;
+typedef UINT32 EFI_CC_MR_INDEX;
+
+//
+// Intel TDX measure register index
+//
+#define TDX_MR_INDEX_MRTD   0
+#define TDX_MR_INDEX_RTMR0  1
+#define TDX_MR_INDEX_RTMR1  2
+#define TDX_MR_INDEX_RTMR2  3
+#define TDX_MR_INDEX_RTMR3  4
+
+#define EFI_CC_EVENT_LOG_FORMAT_TCG_2  0x00000002
+#define EFI_CC_BOOT_HASH_ALG_SHA384    0x00000004
+
+//
+// This bit is shall be set when an event shall be extended but not logged.
+//
+#define EFI_CC_FLAG_EXTEND_ONLY  0x0000000000000001
+//
+// This bit shall be set when the intent is to measure a PE/COFF image.
+//
+#define EFI_CC_FLAG_PE_COFF_IMAGE  0x0000000000000010
+
+#pragma pack (1)
+
+#define EFI_CC_EVENT_HEADER_VERSION  1
+
+typedef struct {
+  //
+  // Size of the event header itself (sizeof(EFI_CC_EVENT_HEADER)).
+  //
+  UINT32             HeaderSize;
+  //
+  // Header version. For this version of this specification, the value shall be 1.
+  //
+  UINT16             HeaderVersion;
+  //
+  // Index of the MR (measurement register) that shall be extended.
+  //
+  EFI_CC_MR_INDEX    MrIndex;
+  //
+  // Type of the event that shall be extended (and optionally logged).
+  //
+  UINT32             EventType;
+} EFI_CC_EVENT_HEADER;
+
+typedef struct {
+  //
+  // Total size of the event including the Size component, the header and the Event data.
+  //
+  UINT32                 Size;
+  EFI_CC_EVENT_HEADER    Header;
+  UINT8                  Event[1];
+} EFI_CC_EVENT;
+
+#pragma pack()
+
+typedef struct {
+  //
+  // Allocated size of the structure
+  //
+  UINT8                            Size;
+  //
+  // Version of the EFI_CC_BOOT_SERVICE_CAPABILITY structure itself.
+  // For this version of the protocol, the Major version shall be set to 1
+  // and the Minor version shall be set to 0.
+  //
+  EFI_CC_VERSION                   StructureVersion;
+  //
+  // Version of the EFI CC Measurement protocol.
+  // For this version of the protocol, the Major version shall be set to 1
+  // and the Minor version shall be set to 0.
+  //
+  EFI_CC_VERSION                   ProtocolVersion;
+  //
+  // Supported hash algorithms
+  //
+  EFI_CC_EVENT_ALGORITHM_BITMAP    HashAlgorithmBitmap;
+  //
+  // Bitmap of supported event log formats
+  //
+  EFI_CC_EVENT_LOG_BITMAP          SupportedEventLogs;
+
+  //
+  // Indicates the CC type
+  //
+  EFI_CC_TYPE                      CcType;
+} EFI_CC_BOOT_SERVICE_CAPABILITY;
+
+/**
+  The EFI_CC_MEASUREMENT_PROTOCOL GetCapability function call provides protocol
+  capability information and state information.
+
+  @param[in]      This               Indicates the calling context
+  @param[in, out] ProtocolCapability The caller allocates memory for a EFI_CC_BOOT_SERVICE_CAPABILITY
+                                     structure and sets the size field to the size of the structure allocated.
+                                     The callee fills in the fields with the EFI CC BOOT Service capability
+                                     information and the current CC information.
+
+  @retval EFI_SUCCESS            Operation completed successfully.
+  @retval EFI_DEVICE_ERROR       The command was unsuccessful.
+                                 The ProtocolCapability variable will not be populated.
+  @retval EFI_INVALID_PARAMETER  One or more of the parameters are incorrect.
+                                 The ProtocolCapability variable will not be populated.
+  @retval EFI_BUFFER_TOO_SMALL   The ProtocolCapability variable is too small to hold the full response.
+                                 It will be partially populated (required Size field will be set).
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CC_GET_CAPABILITY)(
+  IN     EFI_CC_MEASUREMENT_PROTOCOL       *This,
+  IN OUT EFI_CC_BOOT_SERVICE_CAPABILITY    *ProtocolCapability
+  );
+
+/**
+  The EFI_CC_MEASUREMENT_PROTOCOL Get Event Log function call allows a caller to
+  retrieve the address of a given event log and its last entry.
+
+  @param[in]  This               Indicates the calling context
+  @param[in]  EventLogFormat     The type of the event log for which the information is requested.
+  @param[out] EventLogLocation   A pointer to the memory address of the event log.
+  @param[out] EventLogLastEntry  If the Event Log contains more than one entry, this is a pointer to the
+                                 address of the start of the last entry in the event log in memory.
+  @param[out] EventLogTruncated  If the Event Log is missing at least one entry because an event would
+                                 have exceeded the area allocated for events, this value is set to TRUE.
+                                 Otherwise, the value will be FALSE and the Event Log will be complete.
+
+  @retval EFI_SUCCESS            Operation completed successfully.
+  @retval EFI_INVALID_PARAMETER  One or more of the parameters are incorrect
+                                 (e.g. asking for an event log whose format is not supported).
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CC_GET_EVENT_LOG)(
+  IN  EFI_CC_MEASUREMENT_PROTOCOL     *This,
+  IN  EFI_CC_EVENT_LOG_FORMAT         EventLogFormat,
+  OUT EFI_PHYSICAL_ADDRESS            *EventLogLocation,
+  OUT EFI_PHYSICAL_ADDRESS            *EventLogLastEntry,
+  OUT BOOLEAN                         *EventLogTruncated
+  );
+
+/**
+  The EFI_CC_MEASUREMENT_PROTOCOL HashLogExtendEvent function call provides
+  callers with an opportunity to extend and optionally log events without requiring
+  knowledge of actual CC commands.
+  The extend operation will occur even if this function cannot create an event
+  log entry (e.g. due to the event log being full).
+
+  @param[in]  This               Indicates the calling context
+  @param[in]  Flags              Bitmap providing additional information.
+  @param[in]  DataToHash         Physical address of the start of the data buffer to be hashed.
+  @param[in]  DataToHashLen      The length in bytes of the buffer referenced by DataToHash.
+  @param[in]  EfiCcEvent        Pointer to data buffer containing information about the event.
+
+  @retval EFI_SUCCESS            Operation completed successfully.
+  @retval EFI_DEVICE_ERROR       The command was unsuccessful.
+  @retval EFI_VOLUME_FULL        The extend operation occurred, but the event could not be written to one or more event logs.
+  @retval EFI_INVALID_PARAMETER  One or more of the parameters are incorrect.
+  @retval EFI_UNSUPPORTED        The PE/COFF image type is not supported.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CC_HASH_LOG_EXTEND_EVENT)(
+  IN EFI_CC_MEASUREMENT_PROTOCOL    *This,
+  IN UINT64                         Flags,
+  IN EFI_PHYSICAL_ADDRESS           DataToHash,
+  IN UINT64                         DataToHashLen,
+  IN EFI_CC_EVENT                   *EfiCcEvent
+  );
+
+/**
+  The EFI_CC_MEASUREMENT_PROTOCOL MapPcrToMrIndex function call provides callers
+  the info on TPM PCR <-> CC MR mapping information.
+
+  @param[in]  This               Indicates the calling context
+  @param[in]  PcrIndex           TPM PCR index.
+  @param[out] MrIndex            CC MR index.
+
+  @retval EFI_SUCCESS            The MrIndex is returned.
+  @retval EFI_INVALID_PARAMETER  The MrIndex is NULL.
+  @retval EFI_UNSUPPORTED        The PcrIndex is invalid.
+**/
+typedef
+EFI_STATUS
+(EFIAPI *EFI_CC_MAP_PCR_TO_MR_INDEX)(
+  IN  EFI_CC_MEASUREMENT_PROTOCOL    *This,
+  IN  TCG_PCRINDEX                   PcrIndex,
+  OUT EFI_CC_MR_INDEX                *MrIndex
+  );
+
+struct _EFI_CC_MEASUREMENT_PROTOCOL {
+  EFI_CC_GET_CAPABILITY           GetCapability;
+  EFI_CC_GET_EVENT_LOG            GetEventLog;
+  EFI_CC_HASH_LOG_EXTEND_EVENT    HashLogExtendEvent;
+  EFI_CC_MAP_PCR_TO_MR_INDEX      MapPcrToMrIndex;
+};
+
+//
+// CC event log
+//
+
+#pragma pack(1)
+
+//
+// Crypto Agile Log Entry Format.
+// It is similar with TCG_PCR_EVENT2 except the field of MrIndex and PCRIndex.
+//
+typedef struct {
+  EFI_CC_MR_INDEX       MrIndex;
+  UINT32                EventType;
+  TPML_DIGEST_VALUES    Digests;
+  UINT32                EventSize;
+  UINT8                 Event[1];
+} CC_EVENT;
+
+//
+// EFI CC Event Header
+// It is similar with TCG_PCR_EVENT2_HDR except the field of MrIndex and PCRIndex
+//
+typedef struct {
+  EFI_CC_MR_INDEX       MrIndex;
+  UINT32                EventType;
+  TPML_DIGEST_VALUES    Digests;
+  UINT32                EventSize;
+} CC_EVENT_HDR;
+
+#pragma pack()
+
+//
+// Log entries after Get Event Log service
+//
+
+#define EFI_CC_FINAL_EVENTS_TABLE_VERSION  1
+
+typedef struct {
+  //
+  // The version of this structure. It shall be set to 1.
+  //
+  UINT64    Version;
+  //
+  // Number of events recorded after invocation of GetEventLog API
+  //
+  UINT64    NumberOfEvents;
+  //
+  // List of events of type CC_EVENT.
+  //
+  // CC_EVENT              Event[1];
+} EFI_CC_FINAL_EVENTS_TABLE;
+
+#define EFI_CC_FINAL_EVENTS_TABLE_GUID \
+  {0xdd4a4648, 0x2de7, 0x4665, {0x96, 0x4d, 0x21, 0xd9, 0xef, 0x5f, 0xb4, 0x46}}
+
+extern EFI_GUID  gEfiCcFinalEventsTableGuid;
+
+#endif
+diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
+index 8b18415b10..6389a48338 100644
+--- a/MdePkg/MdePkg.dec
+++ b/MdePkg/MdePkg.dec
+@@ -823,6 +823,9 @@
+   #
+   gLinuxEfiInitrdMediaGuid       = {0x5568e427, 0x68fc, 0x4f3d, {0xac, 0x74, 0xca, 0x55, 0x52, 0x31, 0xcc, 0x68}}
+ 
+  ## Include/Protocol/CcMeasurement.h
+  gEfiCcFinalEventsTableGuid     = { 0xdd4a4648, 0x2de7, 0x4665, { 0x96, 0x4d, 0x21, 0xd9, 0xef, 0x5f, 0xb4, 0x46 }}
+
+ [Guids.IA32, Guids.X64]
+   ## Include/Guid/Cper.h
+   gEfiIa32X64ErrorTypeCacheCheckGuid = { 0xA55701F5, 0xE3EF, 0x43de, { 0xAC, 0x72, 0x24, 0x9B, 0x57, 0x3F, 0xAD, 0x2C }}
+@@ -1011,6 +1014,9 @@
+   ## Include/Protocol/PcdInfo.h
+   gGetPcdInfoProtocolGuid        = { 0x5be40f57, 0xfa68, 0x4610, { 0xbb, 0xbf, 0xe9, 0xc5, 0xfc, 0xda, 0xd3, 0x65 } }
+ 
+  ## Include/Protocol/CcMeasurement.h
+  gEfiCcMeasurementProtocolGuid  = { 0x96751a3d, 0x72f4, 0x41a6, { 0xa7, 0x94, 0xed, 0x5d, 0x0e, 0x67, 0xae, 0x6b }}
+
+   #
+   # Protocols defined in PI1.0.
+   #
+-- 
+2.41.0
+
--- a/SOURCES/edk2-MdePkg-Rng-Add-GUID-to-describe-Arm-Rndr-Rng-algorit.patch
+++ b/SOURCES/edk2-MdePkg-Rng-Add-GUID-to-describe-Arm-Rndr-Rng-algorit.patch
@ -0,0 +1,91 @@
+From 2a01056c29542a10941cb32929032b80df091a17 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 16:04:48 -0400
+Subject: [PATCH 19/31] MdePkg/Rng: Add GUID to describe Arm Rndr Rng
+ algorithms
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [19/31] 58b0f069c74b00eb6476427dd84a50a86aceb598
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit cf07238e5fa4f8b1138ac1c9e80530b4d4e59f1c
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Fri Aug 11 16:33:06 2023 +0200
+
+    MdePkg/Rng: Add GUID to describe Arm Rndr Rng algorithms
+
+    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4441
+
+    The EFI_RNG_PROTOCOL can rely on the RngLib. The RngLib has multiple
+    implementations, some of them are unsafe (e.g. BaseRngLibTimerLib).
+    To allow the RngDxe to detect when such implementation is used,
+    a GetRngGuid() function is added in a following patch.
+
+    Prepare GetRngGuid() return values and add a gEfiRngAlgorithmArmRndr
+    to describe a Rng algorithm accessed through Arm's RNDR instruction.
+    [1] states that the implementation of this algorithm should be
+    compliant to NIST SP900-80. The compliance is not guaranteed.
+
+    [1] Arm Architecture Reference Manual Armv8, for A-profile architecture
+    sK12.1 'Properties of the generated random number'
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
+    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
+    Acked-by: Ard Biesheuvel <ardb@kernel.org>
+    Tested-by: Kun Qin <kun.qin@microsoft.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ MdePkg/Include/Protocol/Rng.h | 10 ++++++++++
+ MdePkg/MdePkg.dec             |  1 +
+ 2 files changed, 11 insertions(+)
+
+diff --git a/MdePkg/Include/Protocol/Rng.h b/MdePkg/Include/Protocol/Rng.h
+index baf425587b..38bde53240 100644
+--- a/MdePkg/Include/Protocol/Rng.h
+++ b/MdePkg/Include/Protocol/Rng.h
+@@ -67,6 +67,15 @@ typedef EFI_GUID EFI_RNG_ALGORITHM;
+   { \
+     0xe43176d7, 0xb6e8, 0x4827, {0xb7, 0x84, 0x7f, 0xfd, 0xc4, 0xb6, 0x85, 0x61 } \
+   }
+///
+/// The Arm Architecture states the RNDR that the DRBG algorithm should be compliant
+/// with NIST SP800-90A, while not mandating a particular algorithm, so as to be
+/// inclusive of different geographies.
+///
+#define EFI_RNG_ALGORITHM_ARM_RNDR \
+  { \
+    0x43d2fde3, 0x9d4e, 0x4d79,  {0x02, 0x96, 0xa8, 0x9b, 0xca, 0x78, 0x08, 0x41} \
+  }
+ 
+ /**
+   Returns information about the random number generation implementation.
+@@ -146,5 +155,6 @@ extern EFI_GUID  gEfiRngAlgorithmSp80090Ctr256Guid;
+ extern EFI_GUID  gEfiRngAlgorithmX9313DesGuid;
+ extern EFI_GUID  gEfiRngAlgorithmX931AesGuid;
+ extern EFI_GUID  gEfiRngAlgorithmRaw;
+extern EFI_GUID  gEfiRngAlgorithmArmRndr;
+ 
+ #endif
+diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
+index 8f05e822ac..36501e8bb9 100644
+--- a/MdePkg/MdePkg.dec
+++ b/MdePkg/MdePkg.dec
+@@ -594,6 +594,7 @@
+   gEfiRngAlgorithmX9313DesGuid       = { 0x63c4785a, 0xca34, 0x4012, {0xa3, 0xc8, 0x0b, 0x6a, 0x32, 0x4f, 0x55, 0x46 }}
+   gEfiRngAlgorithmX931AesGuid        = { 0xacd03321, 0x777e, 0x4d3d, {0xb1, 0xc8, 0x20, 0xcf, 0xd8, 0x88, 0x20, 0xc9 }}
+   gEfiRngAlgorithmRaw                = { 0xe43176d7, 0xb6e8, 0x4827, {0xb7, 0x84, 0x7f, 0xfd, 0xc4, 0xb6, 0x85, 0x61 }}
+  gEfiRngAlgorithmArmRndr            = { 0x43d2fde3, 0x9d4e, 0x4d79, {0x02, 0x96, 0xa8, 0x9b, 0xca, 0x78, 0x08, 0x41 }}
+ 
+   ## Include/Protocol/AdapterInformation.h
+   gEfiAdapterInfoMediaStateGuid       = { 0xD7C74207, 0xA831, 0x4A26, {0xB1, 0xF5, 0xD1, 0x93, 0x06, 0x5C, 0xE8, 0xB6 }}
+-- 
+2.39.3
+
--- a/SOURCES/edk2-MdePkg-Rng-Add-GetRngGuid-to-RngLib.patch
+++ b/SOURCES/edk2-MdePkg-Rng-Add-GetRngGuid-to-RngLib.patch
@ -0,0 +1,409 @@
+From b466e2545e25ebb2004ae9b9f95c6c2f60d1f168 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 16:08:28 -0400
+Subject: [PATCH 21/31] MdePkg/Rng: Add GetRngGuid() to RngLib
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [21/31] 54783ad88ba101c620240aa463c5d758fa416c31
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit 5443c2dc310d2c8eb15fb8eefd5057342e78cd0d
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Fri Aug 11 16:33:08 2023 +0200
+
+    MdePkg/Rng: Add GetRngGuid() to RngLib
+
+    The EFI_RNG_PROTOCOL can use the RngLib. The RngLib has multiple
+    implementations, some of them are unsafe (e.g. BaseRngLibTimerLib).
+    To allow the RngDxe to detect when such implementation is used,
+    add a GetRngGuid() function to the RngLib.
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
+    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
+    Acked-by: Ard Biesheuvel <ardb@kernel.org>
+    Tested-by: Kun Qin <kun.qin@microsoft.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../BaseRngLibTimerLib/BaseRngLibTimerLib.inf |  4 ++
+ .../Library/BaseRngLibTimerLib/RngLibTimer.c  | 28 +++++++++++++
+ MdePkg/Include/Library/RngLib.h               | 19 ++++++++-
+ MdePkg/Library/BaseRngLib/AArch64/Rndr.c      | 42 +++++++++++++++++++
+ MdePkg/Library/BaseRngLib/BaseRngLib.inf      | 10 +++++
+ MdePkg/Library/BaseRngLib/Rand/RdRand.c       | 26 ++++++++++++
+ .../Library/BaseRngLibNull/BaseRngLibNull.c   | 22 ++++++++++
+ .../Library/BaseRngLibTimerLib/RngLibTimer.c  | 23 ++++++++++
+ MdePkg/Library/DxeRngLib/DxeRngLib.c          | 28 +++++++++++++
+ 9 files changed, 201 insertions(+), 1 deletion(-)
+
+diff --git a/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf b/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+index f729001060..8461260cc8 100644
+--- a/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+++ b/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+@@ -29,6 +29,10 @@
+ 
+ [Packages]
+   MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+
+[Guids]
+  gEdkiiRngAlgorithmUnSafe
+ 
+ [LibraryClasses]
+   BaseLib
+diff --git a/MdeModulePkg/Library/BaseRngLibTimerLib/RngLibTimer.c b/MdeModulePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
+index 980854d67b..28ff46c71f 100644
+--- a/MdeModulePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
+++ b/MdeModulePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
+@@ -2,14 +2,18 @@
+   BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+   Do not use this on a production system.
+ 
+  Copyright (c) 2023, Arm Limited. All rights reserved.
+   Copyright (c) Microsoft Corporation.
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ **/
+ 
+ #include <Base.h>
+#include <Uefi.h>
+ #include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+ #include <Library/DebugLib.h>
+ #include <Library/TimerLib.h>
+#include <Guid/RngAlgorithm.h>
+ 
+ #define DEFAULT_DELAY_TIME_IN_MICROSECONDS  10
+ 
+@@ -190,3 +194,27 @@ GetRandomNumber128 (
+   // Read second 64 bits
+   return GetRandomNumber64 (++Rand);
+ }
+
+/**
+  Get a GUID identifying the RNG algorithm implementation.
+
+  @param [out] RngGuid  If success, contains the GUID identifying
+                        the RNG algorithm implementation.
+
+  @retval EFI_SUCCESS             Success.
+  @retval EFI_UNSUPPORTED         Not supported.
+  @retval EFI_INVALID_PARAMETER   Invalid parameter.
+**/
+EFI_STATUS
+EFIAPI
+GetRngGuid (
+  GUID  *RngGuid
+  )
+{
+  if (RngGuid == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  CopyMem (RngGuid, &gEdkiiRngAlgorithmUnSafe, sizeof (*RngGuid));
+  return EFI_SUCCESS;
+}
+diff --git a/MdePkg/Include/Library/RngLib.h b/MdePkg/Include/Library/RngLib.h
+index 05e513022e..801aa6d5bd 100644
+--- a/MdePkg/Include/Library/RngLib.h
+++ b/MdePkg/Include/Library/RngLib.h
+@@ -1,6 +1,7 @@
+ /** @file
+   Provides random number generator services.
+ 
+Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
+ Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+@@ -77,4 +78,20 @@ GetRandomNumber128 (
+   OUT     UINT64                    *Rand
+   );
+ 
+-#endif  // __RNG_LIB_H__
+/**
+  Get a GUID identifying the RNG algorithm implementation.
+
+  @param [out] RngGuid  If success, contains the GUID identifying
+                        the RNG algorithm implementation.
+
+  @retval EFI_SUCCESS             Success.
+  @retval EFI_UNSUPPORTED         Not supported.
+  @retval EFI_INVALID_PARAMETER   Invalid parameter.
+**/
+EFI_STATUS
+EFIAPI
+GetRngGuid (
+  GUID  *RngGuid
+  );
+
+#endif // __RNG_LIB_H__
+diff --git a/MdePkg/Library/BaseRngLib/AArch64/Rndr.c b/MdePkg/Library/BaseRngLib/AArch64/Rndr.c
+index c9f8c813ed..7641314a54 100644
+--- a/MdePkg/Library/BaseRngLib/AArch64/Rndr.c
+++ b/MdePkg/Library/BaseRngLib/AArch64/Rndr.c
+@@ -2,6 +2,7 @@
+   Random number generator service that uses the RNDR instruction
+   to provide pseudorandom numbers.
+ 
+  Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
+   Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
+   Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
+ 
+@@ -11,6 +12,7 @@
+ 
+ #include <Uefi.h>
+ #include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+ #include <Library/DebugLib.h>
+ #include <Library/RngLib.h>
+ 
+@@ -137,3 +139,43 @@ ArchIsRngSupported (
+ {
+   return mRndrSupported;
+ }
+
+/**
+  Get a GUID identifying the RNG algorithm implementation.
+
+  @param [out] RngGuid  If success, contains the GUID identifying
+                        the RNG algorithm implementation.
+
+  @retval EFI_SUCCESS             Success.
+  @retval EFI_UNSUPPORTED         Not supported.
+  @retval EFI_INVALID_PARAMETER   Invalid parameter.
+**/
+EFI_STATUS
+EFIAPI
+GetRngGuid (
+  GUID  *RngGuid
+  )
+{
+  GUID  *RngLibGuid;
+
+  if (RngGuid == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  if (!mRndrSupported) {
+    return EFI_UNSUPPORTED;
+  }
+
+  //
+  // If the platform advertises the algorithm behind RNDR instruction,
+  // use it. Otherwise use gEfiRngAlgorithmArmRndr.
+  //
+  RngLibGuid = PcdGetPtr (PcdCpuRngSupportedAlgorithm);
+  if (!IsZeroGuid (RngLibGuid)) {
+    CopyMem (RngGuid, RngLibGuid, sizeof (*RngGuid));
+  } else {
+    CopyMem (RngGuid, &gEfiRngAlgorithmArmRndr, sizeof (*RngGuid));
+  }
+
+  return EFI_SUCCESS;
+}
+diff --git a/MdePkg/Library/BaseRngLib/BaseRngLib.inf b/MdePkg/Library/BaseRngLib/BaseRngLib.inf
+index 1fcceb9414..49503b139b 100644
+--- a/MdePkg/Library/BaseRngLib/BaseRngLib.inf
+++ b/MdePkg/Library/BaseRngLib/BaseRngLib.inf
+@@ -4,6 +4,7 @@
+ #  BaseRng Library that uses CPU RNG instructions (e.g. RdRand) to
+ #  provide random numbers.
+ #
+#  Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
+ #  Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
+ #  Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
+ #
+@@ -43,9 +44,18 @@
+   AArch64/ArmReadIdIsar0.asm | MSFT
+   AArch64/ArmRng.asm         | MSFT
+ 
+[Guids.AARCH64]
+  gEfiRngAlgorithmArmRndr
+
+[Guids.Ia32, Guids.X64]
+  gEfiRngAlgorithmSp80090Ctr256Guid
+
+ [Packages]
+   MdePkg/MdePkg.dec
+ 
+[Pcd.AARCH64]
+  gEfiMdePkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm
+
+ [LibraryClasses]
+   BaseLib
+   DebugLib
+diff --git a/MdePkg/Library/BaseRngLib/Rand/RdRand.c b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
+index 09fb875ac3..aee8ea04e8 100644
+--- a/MdePkg/Library/BaseRngLib/Rand/RdRand.c
+++ b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
+@@ -2,6 +2,7 @@
+   Random number generator services that uses RdRand instruction access
+   to provide high-quality random numbers.
+ 
+Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
+ Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
+ Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
+ 
+@@ -11,6 +12,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ #include <Uefi.h>
+ #include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+ #include <Library/DebugLib.h>
+ 
+ #include "BaseRngLibInternals.h"
+@@ -129,3 +131,27 @@ ArchIsRngSupported (
+   */
+   return TRUE;
+ }
+
+/**
+  Get a GUID identifying the RNG algorithm implementation.
+
+  @param [out] RngGuid  If success, contains the GUID identifying
+                        the RNG algorithm implementation.
+
+  @retval EFI_SUCCESS             Success.
+  @retval EFI_UNSUPPORTED         Not supported.
+  @retval EFI_INVALID_PARAMETER   Invalid parameter.
+**/
+EFI_STATUS
+EFIAPI
+GetRngGuid (
+  GUID  *RngGuid
+  )
+{
+  if (RngGuid == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  CopyMem (RngGuid, &gEfiRngAlgorithmSp80090Ctr256Guid, sizeof (*RngGuid));
+  return EFI_SUCCESS;
+}
+diff --git a/MdePkg/Library/BaseRngLibNull/BaseRngLibNull.c b/MdePkg/Library/BaseRngLibNull/BaseRngLibNull.c
+index cad30599ea..34a18e6a4d 100644
+--- a/MdePkg/Library/BaseRngLibNull/BaseRngLibNull.c
+++ b/MdePkg/Library/BaseRngLibNull/BaseRngLibNull.c
+@@ -1,13 +1,16 @@
+ /** @file
+   Null version of Random number generator services.
+ 
+Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
+ Copyright (c) 2019, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+ 
+#include <Uefi.h>
+ #include <Library/DebugLib.h>
+ #include <Library/RngLib.h>
+#include <Protocol/Rng.h>
+ 
+ /**
+   Generates a 16-bit random number.
+@@ -92,3 +95,22 @@ GetRandomNumber128 (
+   ASSERT (FALSE);
+   return FALSE;
+ }
+
+/**
+  Get a GUID identifying the RNG algorithm implementation.
+
+  @param [out] RngGuid  If success, contains the GUID identifying
+                        the RNG algorithm implementation.
+
+  @retval EFI_SUCCESS             Success.
+  @retval EFI_UNSUPPORTED         Not supported.
+  @retval EFI_INVALID_PARAMETER   Invalid parameter.
+**/
+EFI_STATUS
+EFIAPI
+GetRngGuid (
+  GUID  *RngGuid
+  )
+{
+  return EFI_UNSUPPORTED;
+}
+diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
+index 6b8392162b..7337500fec 100644
+--- a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
+++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
+@@ -209,3 +209,26 @@ GetRandomNumber128 (
+   // Read second 64 bits
+   return GetRandomNumber64 (++Rand);
+ }
+
+/**
+  Get a GUID identifying the RNG algorithm implementation.
+
+  @param [out] RngGuid  If success, contains the GUID identifying
+                        the RNG algorithm implementation.
+
+  @retval EFI_SUCCESS             Success.
+  @retval EFI_UNSUPPORTED         Not supported.
+  @retval EFI_INVALID_PARAMETER   Invalid parameter.
+**/
+RETURN_STATUS
+EFIAPI
+GetRngGuid (
+  GUID  *RngGuid
+  )
+{
+  /* This implementation is to be replaced by its MdeModulePkg copy.
+   * The cause being that some GUIDs (gEdkiiRngAlgorithmUnSafe) cannot
+   * be defined in the MdePkg.
+   */
+  return RETURN_UNSUPPORTED;
+}
+diff --git a/MdePkg/Library/DxeRngLib/DxeRngLib.c b/MdePkg/Library/DxeRngLib/DxeRngLib.c
+index 4b2fc1cde5..20248b4107 100644
+--- a/MdePkg/Library/DxeRngLib/DxeRngLib.c
+++ b/MdePkg/Library/DxeRngLib/DxeRngLib.c
+@@ -1,6 +1,7 @@
+ /** @file
+  Provides an implementation of the library class RngLib that uses the Rng protocol.
+ 
+ Copyright (c) 2023, Arm Limited. All rights reserved.
+  Copyright (c) Microsoft Corporation. All rights reserved.
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+@@ -204,3 +205,30 @@ GetRandomNumber128 (
+   }
+   return TRUE;
+ }
+
+/**
+  Get a GUID identifying the RNG algorithm implementation.
+
+  @param [out] RngGuid  If success, contains the GUID identifying
+                        the RNG algorithm implementation.
+
+  @retval EFI_SUCCESS             Success.
+  @retval EFI_UNSUPPORTED         Not supported.
+  @retval EFI_INVALID_PARAMETER   Invalid parameter.
+**/
+EFI_STATUS
+EFIAPI
+GetRngGuid (
+  GUID  *RngGuid
+  )
+{
+  /* It is not possible to know beforehand which Rng algorithm will
+   * be used by this library.
+   * This API is mainly used by RngDxe. RngDxe relies on the RngLib.
+   * The RngLib|DxeRngLib.inf implementation locates and uses an installed
+   * EFI_RNG_PROTOCOL.
+   * It is thus not possible to have both RngDxe and RngLib|DxeRngLib.inf.
+   * and it is ok not to support this API.
+   */
+  return EFI_UNSUPPORTED;
+}
+-- 
+2.39.3
+
--- a/SOURCES/edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch
+++ b/SOURCES/edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch
@ -0,0 +1,63 @@
+From 634ee7a8cef2eac9f41cff4b42859d9d54b204bf Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 10:35:27 -0400
+Subject: [PATCH 29/31] MdePkg/X86UnitTestHost: set rdrand cpuid bit
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [29/31] 60851c6253df6f0114dc2c5598e0dde139d56c4c
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit 5e776299a2604b336a947e68593012ab2cc16eb4
+Author: Gerd Hoffmann <kraxel@redhat.com>
+Date:   Fri Jun 14 11:45:53 2024 +0200
+
+    MdePkg/X86UnitTestHost: set rdrand cpuid bit
+
+    Set the rdrand feature bit when faking cpuid for host test cases.
+    Needed to make the CryptoPkg test cases work.
+
+    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ MdePkg/Library/BaseLib/X86UnitTestHost.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/MdePkg/Library/BaseLib/X86UnitTestHost.c b/MdePkg/Library/BaseLib/X86UnitTestHost.c
+index d0e428457e..abc092a990 100644
+--- a/MdePkg/Library/BaseLib/X86UnitTestHost.c
+++ b/MdePkg/Library/BaseLib/X86UnitTestHost.c
+@@ -66,6 +66,15 @@ UnitTestHostBaseLibAsmCpuid (
+   OUT     UINT32                    *Edx   OPTIONAL
+   )
+ {
+  UINT32  RetEcx;
+
+  RetEcx = 0;
+  switch (Index) {
+    case 1:
+      RetEcx |= BIT30; /* RdRand */
+      break;
+  }
+
+   if (Eax != NULL) {
+     *Eax = 0;
+   }
+@@ -73,7 +82,7 @@ UnitTestHostBaseLibAsmCpuid (
+     *Ebx = 0;
+   }
+   if (Ecx != NULL) {
+-    *Ecx = 0;
+    *Ecx = RetEcx;
+   }
+   if (Edx != NULL) {
+     *Edx = 0;
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch
+++ b/SOURCES/edk2-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch
@ -0,0 +1,169 @@
+From aa66757951e9880df4e21e191142400480aa3908 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 8 Feb 2024 10:35:14 -0500
+Subject: [PATCH 15/17] NetworkPkg: : Add Unit tests to CI and create Host Test
+ DSC
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 50: CVE-2023-45230 and CVE-2023-45229
+RH-Jira: RHEL-21840 RHEL-21842
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [2/4] 6669306e2dbb5aa3e7691d57f4a61685b7cd57b2 (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21842
+CVE: CVE-2023-45230
+Upstream: Merged
+
+commit 8014ac2d7bbbc503f5562b51af46bb20ae3d22ff
+Author: Doug Flick via groups.io <dougflick=microsoft.com@groups.io>
+Date:   Fri Jan 26 05:54:44 2024 +0800
+
+    NetworkPkg: : Add Unit tests to CI and create Host Test DSC
+
+    Adds Host Based testing to the NetworkPkg
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/NetworkPkg.ci.yaml          |  7 +-
+ NetworkPkg/Test/NetworkPkgHostTest.dsc | 98 ++++++++++++++++++++++++++
+ 2 files changed, 104 insertions(+), 1 deletion(-)
+ create mode 100644 NetworkPkg/Test/NetworkPkgHostTest.dsc
+
+diff --git a/NetworkPkg/NetworkPkg.ci.yaml b/NetworkPkg/NetworkPkg.ci.yaml
+index 07dc7abd69..076424eb60 100644
+--- a/NetworkPkg/NetworkPkg.ci.yaml
+++ b/NetworkPkg/NetworkPkg.ci.yaml
+@@ -24,6 +24,9 @@
+     "CompilerPlugin": {
+         "DscPath": "NetworkPkg.dsc"
+     },
+    "HostUnitTestCompilerPlugin": {
+        "DscPath": "Test/NetworkPkgHostTest.dsc"
+    },
+     "CharEncodingCheck": {
+         "IgnoreFiles": []
+     },
+@@ -35,7 +38,9 @@
+             "CryptoPkg/CryptoPkg.dec"
+         ],
+         # For host based unit tests
+-        "AcceptableDependencies-HOST_APPLICATION":[],
+        "AcceptableDependencies-HOST_APPLICATION":[
+            UnitTestFrameworkPkg/UnitTestFrameworkPkg.dec
+        ],
+         # For UEFI shell based apps
+         "AcceptableDependencies-UEFI_APPLICATION":[
+             "ShellPkg/ShellPkg.dec"
+diff --git a/NetworkPkg/Test/NetworkPkgHostTest.dsc b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+new file mode 100644
+index 0000000000..1aeca5c5b3
+--- /dev/null
+++ b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+@@ -0,0 +1,98 @@
+## @file
+# NetworkPkgHostTest DSC file used to build host-based unit tests.
+#
+# Copyright (c) Microsoft Corporation.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+[Defines]
+  PLATFORM_NAME           = NetworkPkgHostTest
+  PLATFORM_GUID           = 3b68324e-fc07-4d49-9520-9347ede65879
+  PLATFORM_VERSION        = 0.1
+  DSC_SPECIFICATION       = 0x00010005
+  OUTPUT_DIRECTORY        = Build/NetworkPkg/HostTest
+  SUPPORTED_ARCHITECTURES = IA32|X64|AARCH64
+  BUILD_TARGETS           = NOOPT
+  SKUID_IDENTIFIER        = DEFAULT
+
+!include UnitTestFrameworkPkg/UnitTestFrameworkPkgHost.dsc.inc
+[Packages]
+  MdePkg/MdePkg.dec
+  UnitTestFrameworkPkg/UnitTestFrameworkPkg.dec
+
+[Components]
+  #
+  # Build HOST_APPLICATION that tests NetworkPkg
+  #
+
+# Despite these library classes being listed in [LibraryClasses] below, they are not needed for the host-based unit tests.
+[LibraryClasses]
+  NetLib|NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
+  DebugLib|MdePkg/Library/BaseDebugLibNull/BaseDebugLibNull.inf
+  BaseLib|MdePkg/Library/BaseLib/BaseLib.inf
+  BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
+  DevicePathLib|MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.inf
+  HiiLib|MdeModulePkg/Library/UefiHiiLib/UefiHiiLib.inf
+  MemoryAllocationLib|MdePkg/Library/UefiMemoryAllocationLib/UefiMemoryAllocationLib.inf
+  PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
+  PrintLib|MdePkg/Library/BasePrintLib/BasePrintLib.inf
+  UefiDriverEntryPoint|MdePkg/Library/UefiDriverEntryPoint/UefiDriverEntryPoint.inf
+  UefiApplicationEntryPoint|MdePkg/Library/UefiApplicationEntryPoint/UefiApplicationEntryPoint.inf
+  UefiBootServicesTableLib|MdePkg/Library/UefiBootServicesTableLib/UefiBootServicesTableLib.inf
+  UefiLib|MdePkg/Library/UefiLib/UefiLib.inf
+  UefiRuntimeServicesTableLib|MdePkg/Library/UefiRuntimeServicesTableLib/UefiRuntimeServicesTableLib.inf
+  UefiHiiServicesLib|MdeModulePkg/Library/UefiHiiServicesLib/UefiHiiServicesLib.inf
+  UefiBootManagerLib|MdeModulePkg/Library/UefiBootManagerLib/UefiBootManagerLib.inf
+  TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf
+  PerformanceLib|MdePkg/Library/BasePerformanceLibNull/BasePerformanceLibNull.inf
+  PeCoffGetEntryPointLib|MdePkg/Library/BasePeCoffGetEntryPointLib/BasePeCoffGetEntryPointLib.inf
+  DxeServicesLib|MdePkg/Library/DxeServicesLib/DxeServicesLib.inf
+  DxeServicesTableLib|MdePkg/Library/DxeServicesTableLib/DxeServicesTableLib.inf
+  SafeIntLib|MdePkg/Library/BaseSafeIntLib/BaseSafeIntLib.inf
+  RngLib|MdePkg/Library/BaseRngLib/BaseRngLib.inf
+  VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf
+!ifdef CONTINUOUS_INTEGRATION
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLibNull/BaseCryptLibNull.inf
+  TlsLib|CryptoPkg/Library/TlsLibNull/TlsLibNull.inf
+!else
+  BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf
+  OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
+  TlsLib|CryptoPkg/Library/TlsLib/TlsLib.inf
+!endif
+  DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf
+  FileHandleLib|MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.inf
+  FileExplorerLib|MdeModulePkg/Library/FileExplorerLib/FileExplorerLib.inf
+  SortLib|MdeModulePkg/Library/UefiSortLib/UefiSortLib.inf
+  IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
+
+!if $(TOOL_CHAIN_TAG) == VS2019 or $(TOOL_CHAIN_TAG) == VS2022
+[LibraryClasses.X64]
+  # Provide StackCookie support lib so that we can link to /GS exports for VS builds
+  RngLib|MdePkg/Library/BaseRngLib/BaseRngLib.inf
+!endif
+
+[LibraryClasses.common.UEFI_DRIVER]
+  HobLib|MdePkg/Library/DxeHobLib/DxeHobLib.inf
+  ReportStatusCodeLib|MdeModulePkg/Library/DxeReportStatusCodeLib/DxeReportStatusCodeLib.inf
+  DebugLib|MdePkg/Library/UefiDebugLibConOut/UefiDebugLibConOut.inf
+[LibraryClasses.common.UEFI_APPLICATION]
+  DebugLib|MdePkg/Library/UefiDebugLibStdErr/UefiDebugLibStdErr.inf
+  ShellLib|ShellPkg/Library/UefiShellLib/UefiShellLib.inf
+[LibraryClasses.ARM, LibraryClasses.AARCH64]
+  #
+  # It is not possible to prevent ARM compiler calls to generic intrinsic functions.
+  # This library provides the instrinsic functions generated by a given compiler.
+  # [LibraryClasses.ARM] and NULL mean link this library into all ARM images.
+  #
+!if $(TOOL_CHAIN_TAG) != VS2017 and $(TOOL_CHAIN_TAG) != VS2015 and $(TOOL_CHAIN_TAG) != VS2019
+  NULL|ArmPkg/Library/CompilerIntrinsicsLib/CompilerIntrinsicsLib.inf
+!endif
+  NULL|MdePkg/Library/BaseStackCheckLib/BaseStackCheckLib.inf
+[LibraryClasses.ARM]
+  RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+[LibraryClasses.RISCV64]
+  RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+
+[PcdsFixedAtBuild]
+  gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x2
+  gEfiNetworkPkgTokenSpaceGuid.PcdDhcp6UidType|0x4
+-- 
+2.41.0
+
--- a/SOURCES/edk2-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch
+++ b/SOURCES/edk2-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch
@ -0,0 +1,170 @@
+From ffa1202da2f55c1f540240e8267db9a7ec8d6a60 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 11/15] NetworkPkg: : Adds a SecurityFix.yaml file
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
+RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [11/15] 8a46b763887843d00293997bdd7d50ea120104d9
+
+JIRA: https://issues.redhat.com/browse/RHEL-21852
+CVE: CVE-2022-45235
+Upstream: Merged
+
+commit 1d0b95f6457d225c5108302a9da74b4ed7aa5a38
+Author: Doug Flick via groups.io <dougflick=microsoft.com@groups.io>
+Date:   Fri Jan 26 05:54:57 2024 +0800
+
+    NetworkPkg: : Adds a SecurityFix.yaml file
+
+    This creates / adds a security file that tracks the security fixes
+    found in this package and can be used to find the fixes that were
+    applied.
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/SecurityFixes.yaml | 123 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 123 insertions(+)
+ create mode 100644 NetworkPkg/SecurityFixes.yaml
+
+diff --git a/NetworkPkg/SecurityFixes.yaml b/NetworkPkg/SecurityFixes.yaml
+new file mode 100644
+index 0000000000..7e900483fe
+--- /dev/null
+++ b/NetworkPkg/SecurityFixes.yaml
+@@ -0,0 +1,123 @@
+## @file
+# Security Fixes for SecurityPkg
+#
+# Copyright (c) Microsoft Corporation
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+##
+CVE_2023_45229:
+  commit_titles:
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Patch"
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Unit Tests"
+  cve: CVE-2023-45229
+  date_reported: 2023-08-28 13:56 UTC
+  description: "Bug 01 - edk2/NetworkPkg: Out-of-bounds read when processing IA_NA/IA_TA options in a DHCPv6 Advertise message"
+  note:
+  files_impacted:
+    - NetworkPkg\Dhcp6Dxe\Dhcp6Io.c
+    - NetworkPkg\Dhcp6Dxe\Dhcp6Impl.h
+  links:
+    - https://bugzilla.tianocore.org/show_bug.cgi?id=4534
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-45229
+    - http://www.openwall.com/lists/oss-security/2024/01/16/2
+    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
+    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
+CVE_2023_45230:
+  commit_titles:
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch"
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Unit Tests"
+  cve: CVE-2023-45230
+  date_reported: 2023-08-28 13:56 UTC
+  description: "Bug 02 - edk2/NetworkPkg: Buffer overflow in the DHCPv6 client via a long Server ID option"
+  note:
+  files_impacted:
+    - NetworkPkg\Dhcp6Dxe\Dhcp6Io.c
+    - NetworkPkg\Dhcp6Dxe\Dhcp6Impl.h
+  links:
+    - https://bugzilla.tianocore.org/show_bug.cgi?id=4535
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-45230
+    - http://www.openwall.com/lists/oss-security/2024/01/16/2
+    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
+    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
+CVE_2023_45231:
+  commit_titles:
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45231 Patch"
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45231 Unit Tests"
+  cve: CVE-2023-45231
+  date_reported: 2023-08-28 13:56 UTC
+  description: "Bug 03 - edk2/NetworkPkg: Out-of-bounds read when handling a ND Redirect message with truncated options"
+  note:
+  files_impacted:
+    - NetworkPkg/Ip6Dxe/Ip6Option.c
+  links:
+    - https://bugzilla.tianocore.org/show_bug.cgi?id=4536
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-45231
+    - http://www.openwall.com/lists/oss-security/2024/01/16/2
+    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
+    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
+CVE_2023_45232:
+  commit_titles:
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45232 Patch"
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45232 Unit Tests"
+  cve: CVE-2023-45232
+  date_reported: 2023-08-28 13:56 UTC
+  description: "Bug 04 - edk2/NetworkPkg: Infinite loop when parsing unknown options in the Destination Options header"
+  note:
+  files_impacted:
+    - NetworkPkg/Ip6Dxe/Ip6Option.c
+    - NetworkPkg/Ip6Dxe/Ip6Option.h
+  links:
+    - https://bugzilla.tianocore.org/show_bug.cgi?id=4537
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-45232
+    - http://www.openwall.com/lists/oss-security/2024/01/16/2
+    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
+    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
+CVE_2023_45233:
+  commit_titles:
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45232 Patch"
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45232 Unit Tests"
+  cve: CVE-2023-45233
+  date_reported: 2023-08-28 13:56 UTC
+  description: "Bug 05 - edk2/NetworkPkg: Infinite loop when parsing a PadN option in the Destination Options header "
+  note: This was fixed along with CVE-2023-45233
+  files_impacted:
+    - NetworkPkg/Ip6Dxe/Ip6Option.c
+    - NetworkPkg/Ip6Dxe/Ip6Option.h
+  links:
+    - https://bugzilla.tianocore.org/show_bug.cgi?id=4538
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-45233
+    - http://www.openwall.com/lists/oss-security/2024/01/16/2
+    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
+    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
+CVE_2023_45234:
+  commit_titles:
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45234 Patch"
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45234 Unit Tests"
+  cve: CVE-2023-45234
+  date_reported: 2023-08-28 13:56 UTC
+  description: "Bug 06 - edk2/NetworkPkg: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message"
+  note:
+  files_impacted:
+    - NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
+  links:
+    - https://bugzilla.tianocore.org/show_bug.cgi?id=4539
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-45234
+    - http://www.openwall.com/lists/oss-security/2024/01/16/2
+    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
+    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
+CVE_2023_45235:
+  commit_titles:
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45235 Patch"
+    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45235 Unit Tests"
+  cve: CVE-2023-45235
+  date_reported: 2023-08-28 13:56 UTC
+  description: "Bug 07 - edk2/NetworkPkg: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message"
+  note:
+  files_impacted:
+    - NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
+    - NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h
+  links:
+    - https://bugzilla.tianocore.org/show_bug.cgi?id=4540
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-45235
+    - http://www.openwall.com/lists/oss-security/2024/01/16/2
+    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
+    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-Apply-uncrustify-changes-p2.patch
+++ b/SOURCES/edk2-NetworkPkg-Apply-uncrustify-changes-p2.patch
--- a/SOURCES/edk2-NetworkPkg-Apply-uncrustify-changes.p2.patch
+++ b/SOURCES/edk2-NetworkPkg-Apply-uncrustify-changes.p2.patch
--- a/SOURCES/edk2-NetworkPkg-Apply-uncrustify-changes.patch
+++ b/SOURCES/edk2-NetworkPkg-Apply-uncrustify-changes.patch
--- a/SOURCES/edk2-NetworkPkg-Dhcp6Dxe-Packet-Length-is-not-updated-bef.patch
+++ b/SOURCES/edk2-NetworkPkg-Dhcp6Dxe-Packet-Length-is-not-updated-bef.patch
@ -0,0 +1,69 @@
+From 649fe647114ca5dee84b0c55106ee58a9703984f Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 15/15] NetworkPkg: Dhcp6Dxe: Packet-Length is not updated
+ before appending
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
+RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [15/15] bc7ef287311bb3f757bc26f8921875566bcb5917
+
+JIRA: https://issues.redhat.com/browse/RHEL-21840
+CVE: CVE-2023-45229
+Upstream: Merged
+
+commit 75deaf5c3c0d164c61653258c331151241bb69d8
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Tue Feb 13 10:46:02 2024 -0800
+
+    NetworkPkg: Dhcp6Dxe: Packet-Length is not updated before appending
+
+    In order for Dhcp6AppendIaAddrOption (..) to safely append the IA
+    Address option, the Packet-Length field must be updated before appending
+    the option.
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
+index e172ffc2a2..c23eff8766 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
+++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
+@@ -948,6 +948,11 @@ Dhcp6AppendIaOption (
+     *PacketCursor += sizeof (T2);
+   }
+ 
+  //
+  // Update the packet length
+  //
+  Packet->Length += BytesNeeded;
+
+   //
+   // Fill all the addresses belong to the Ia
+   //
+@@ -959,11 +964,6 @@ Dhcp6AppendIaOption (
+     }
+   }
+ 
+-  //
+-  // Update the packet length
+-  //
+-  Packet->Length += BytesNeeded;
+-
+   //
+   // Fill the value of Ia option length
+   //
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch
+++ b/SOURCES/edk2-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch
@ -0,0 +1,161 @@
+From 4bf844922a963cb20fb1e72ca11a65a673992ca2 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 14/15] NetworkPkg: Dhcp6Dxe: Removes duplicate check and
+ replaces with macro
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
+RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [14/15] a943400f9267b219bf1fd202534500f82a2a4c56
+
+JIRA: https://issues.redhat.com/browse/RHEL-21840
+CVE: CVE-2023-45229
+Upstream: Merged
+
+commit af3fad99d6088881562e50149f414f76a5be0140
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Tue Feb 13 10:46:01 2024 -0800
+
+    NetworkPkg: Dhcp6Dxe: Removes duplicate check and replaces with macro
+
+    Removes duplicate check after merge
+
+    >
+    >  //
+    >  // Verify the PacketCursor is within the packet
+    >  //
+    >  if (  (*PacketCursor < Packet->Dhcp6.Option)
+    >     || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size -
+    sizeof (EFI_DHCP6_HEADER))))
+    >  {
+    >    return EFI_INVALID_PARAMETER;
+    >  }
+    >
+
+    Converts the check to a macro and replaces all instances of the check
+    with the macro
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c | 43 +++++++++++++-----------------
+ 1 file changed, 18 insertions(+), 25 deletions(-)
+
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
+index 484c360a96..e172ffc2a2 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
+++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
+@@ -10,6 +10,15 @@
+ 
+ #include "Dhcp6Impl.h"
+ 
+//
+// Verifies the packet cursor is within the packet
+// otherwise it is invalid
+//
+#define IS_INVALID_PACKET_CURSOR(PacketCursor, Packet) \
+  (((*PacketCursor) < (Packet)->Dhcp6.Option) || \
+   ((*PacketCursor) >= (Packet)->Dhcp6.Option + ((Packet)->Size - sizeof(EFI_DHCP6_HEADER))) \
+  )                                                                            \
+
+ 
+ /**
+   Generate client Duid in the format of Duid-llt.
+@@ -662,9 +671,7 @@ Dhcp6AppendOption (
+   //
+   // Verify the PacketCursor is within the packet
+   //
+-  if (  (*PacketCursor < Packet->Dhcp6.Option)
+-     || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
+-  {
+  if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+@@ -681,15 +688,6 @@ Dhcp6AppendOption (
+     return EFI_BUFFER_TOO_SMALL;
+   }
+ 
+-  //
+-  // Verify the PacketCursor is within the packet
+-  //
+-  if (  (*PacketCursor < Packet->Dhcp6.Option)
+-     || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
+-  {
+-    return EFI_INVALID_PARAMETER;
+-  }
+-
+   WriteUnaligned16 ((UINT16 *)*PacketCursor, OptType);
+   *PacketCursor += DHCP6_SIZE_OF_OPT_CODE;
+   WriteUnaligned16 ((UINT16 *)*PacketCursor, OptLen);
+@@ -768,9 +766,7 @@ Dhcp6AppendIaAddrOption (
+   //
+   // Verify the PacketCursor is within the packet
+   //
+-  if (  (*PacketCursor < Packet->Dhcp6.Option)
+-     || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
+-  {
+  if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+@@ -902,9 +898,7 @@ Dhcp6AppendIaOption (
+   //
+   // Verify the PacketCursor is within the packet
+   //
+-  if (  (*PacketCursor < Packet->Dhcp6.Option)
+-     || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
+-  {
+  if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+@@ -966,14 +960,14 @@ Dhcp6AppendIaOption (
+   }
+ 
+   //
+-  // Fill the value of Ia option length
+  // Update the packet length
+   //
+-  *Len = HTONS ((UINT16)(*PacketCursor - (UINT8 *)Len - 2));
+  Packet->Length += BytesNeeded;
+ 
+   //
+-  // Update the packet length
+  // Fill the value of Ia option length
+   //
+-  Packet->Length += BytesNeeded;
+  *Len = HTONS ((UINT16)(*PacketCursor - (UINT8 *)Len - 2));
+ 
+   return EFI_SUCCESS;
+ }
+@@ -982,6 +976,7 @@ Dhcp6AppendIaOption (
+   Append the appointed Elapsed time option to Buf, and move Buf to the end.
+ 
+   @param[in, out] Packet        A pointer to the packet, on success Packet->Length
+                                will be updated.
+   @param[in, out] PacketCursor  The pointer in the packet, on success PacketCursor
+                                 will be moved to the end of the option.
+   @param[in]      Instance      The pointer to the Dhcp6 instance.
+@@ -1037,9 +1032,7 @@ Dhcp6AppendETOption (
+   //
+   // Verify the PacketCursor is within the packet
+   //
+-  if (  (*PacketCursor < Packet->Dhcp6.Option)
+-     || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
+-  {
+  if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch
+++ b/SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch
@ -0,0 +1,621 @@
+From a115d0a66c3e73c60b74ec6d09e3759da89e919b Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 9 Feb 2024 17:57:07 -0500
+Subject: [PATCH 17/17] NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229
+ Patch
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 50: CVE-2023-45230 and CVE-2023-45229
+RH-Jira: RHEL-21840 RHEL-21842
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [4/4] 3daf69000f78416ee1f1bad0b6ceb01ed28a84a5 (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21840
+CVE: CVE-2023-45229
+Upstream: Merged
+
+commit 1dbb10cc52dc8ef49bb700daa1cefc76b26d52e0
+Author: Doug Flick via groups.io <dougflick=microsoft.com@groups.io>
+Date:   Fri Jan 26 05:54:46 2024 +0800
+
+    NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Patch
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4534
+
+    Bug Details:
+    PixieFail Bug #1
+    CVE-2023-45229
+    CVSS 6.5 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    CWE-125 Out-of-bounds Read
+
+    Change Overview:
+
+    Introduce Dhcp6SeekInnerOptionSafe which performs checks before seeking
+    the Inner Option from a DHCP6 Option.
+
+    >
+    > EFI_STATUS
+    > Dhcp6SeekInnerOptionSafe (
+    >  IN  UINT16  IaType,
+    >  IN  UINT8   *Option,
+    >  IN  UINT32  OptionLen,
+    >  OUT UINT8   **IaInnerOpt,
+    >  OUT UINT16  *IaInnerLen
+    >  );
+    >
+
+    Lots of code cleanup to improve code readability.
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Dhcp6Dxe/Dhcp6Impl.h | 138 ++++++++++++++++++---
+ NetworkPkg/Dhcp6Dxe/Dhcp6Io.c   | 205 +++++++++++++++++++++-----------
+ 2 files changed, 257 insertions(+), 86 deletions(-)
+
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Impl.h b/NetworkPkg/Dhcp6Dxe/Dhcp6Impl.h
+index ec0ed5d8f5..e759ab9a62 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Impl.h
+++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Impl.h
+@@ -47,6 +47,20 @@ typedef struct _DHCP6_INSTANCE DHCP6_INSTANCE;
+ #define DHCP6_SERVICE_SIGNATURE   SIGNATURE_32 ('D', 'H', '6', 'S')
+ #define DHCP6_INSTANCE_SIGNATURE  SIGNATURE_32 ('D', 'H', '6', 'I')
+ 
+#define DHCP6_PACKET_ALL        0
+#define DHCP6_PACKET_STATEFUL   1
+#define DHCP6_PACKET_STATELESS  2
+
+#define DHCP6_BASE_PACKET_SIZE  1024
+
+#define DHCP6_PORT_CLIENT  546
+#define DHCP6_PORT_SERVER  547
+
+#define DHCP_CHECK_MEDIA_WAITING_TIME    EFI_TIMER_PERIOD_SECONDS(20)
+
+#define DHCP6_INSTANCE_FROM_THIS(Instance) CR ((Instance), DHCP6_INSTANCE, Dhcp6, DHCP6_INSTANCE_SIGNATURE)
+#define DHCP6_SERVICE_FROM_THIS(Service)   CR ((Service), DHCP6_SERVICE, ServiceBinding, DHCP6_SERVICE_SIGNATURE)
+
+ //
+ // For more information on DHCP options see RFC 8415, Section 21.1
+ //
+@@ -61,12 +75,10 @@ typedef struct _DHCP6_INSTANCE DHCP6_INSTANCE;
+ //    |                      (option-len octets)                      |
+ //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ //
+-#define DHCP6_SIZE_OF_OPT_CODE  (sizeof(UINT16))
+-#define DHCP6_SIZE_OF_OPT_LEN   (sizeof(UINT16))
+#define DHCP6_SIZE_OF_OPT_CODE  (sizeof (((EFI_DHCP6_PACKET_OPTION *)0)->OpCode))
+#define DHCP6_SIZE_OF_OPT_LEN   (sizeof (((EFI_DHCP6_PACKET_OPTION *)0)->OpLen))
+ 
+-//
+ // Combined size of Code and Length
+-//
+ #define DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN  (DHCP6_SIZE_OF_OPT_CODE + \
+                                               DHCP6_SIZE_OF_OPT_LEN)
+ 
+@@ -75,34 +87,122 @@ STATIC_ASSERT (
+   "Combined size of Code and Length must be 4 per RFC 8415"
+   );
+ 
+-//
+ // Offset to the length is just past the code
+-//
+-#define DHCP6_OPT_LEN_OFFSET(a)  (a + DHCP6_SIZE_OF_OPT_CODE)
+#define DHCP6_OFFSET_OF_OPT_LEN(a)  (a + DHCP6_SIZE_OF_OPT_CODE)
+ STATIC_ASSERT (
+-  DHCP6_OPT_LEN_OFFSET (0) == 2,
+  DHCP6_OFFSET_OF_OPT_LEN (0) == 2,
+   "Offset of length is + 2 past start of option"
+   );
+ 
+-#define DHCP6_OPT_DATA_OFFSET(a)  (a + DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN)
+#define DHCP6_OFFSET_OF_OPT_DATA(a)  (a + DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN)
+ STATIC_ASSERT (
+-  DHCP6_OPT_DATA_OFFSET (0) == 4,
+  DHCP6_OFFSET_OF_OPT_DATA (0) == 4,
+   "Offset to option data should be +4 from start of option"
+   );
+//
+// Identity Association options (both NA (Non-Temporary) and TA (Temporary Association))
+// are defined in RFC 8415 and are a deriviation of a TLV stucture
+// For more information on IA_NA see Section 21.4
+// For more information on IA_TA see Section 21.5
+//
+//
+//  The format of IA_NA and IA_TA option:
+//
+//     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//    |          OPTION_IA_NA         |          option-len           |
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//    |                        IAID (4 octets)                        |
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//    |                        T1 (only for IA_NA)                    |
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//    |                        T2 (only for IA_NA)                    |
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//    |                                                               |
+//    .                  IA_NA-options/IA_TA-options                  .
+//    .                                                               .
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//
+#define DHCP6_SIZE_OF_IAID           (sizeof(UINT32))
+#define DHCP6_SIZE_OF_TIME_INTERVAL  (sizeof(UINT32))
+ 
+-#define DHCP6_PACKET_ALL        0
+-#define DHCP6_PACKET_STATEFUL   1
+-#define DHCP6_PACKET_STATELESS  2
+// Combined size of IAID, T1, and T2
+#define DHCP6_SIZE_OF_COMBINED_IAID_T1_T2  (DHCP6_SIZE_OF_IAID +  \
+                                            DHCP6_SIZE_OF_TIME_INTERVAL + \
+                                            DHCP6_SIZE_OF_TIME_INTERVAL)
+STATIC_ASSERT (
+  DHCP6_SIZE_OF_COMBINED_IAID_T1_T2 == 12,
+  "Combined size of IAID, T1, T2 must be 12 per RFC 8415"
+  );
+ 
+-#define DHCP6_BASE_PACKET_SIZE    1024
+// This is the size of IA_TA without options
+#define DHCP6_MIN_SIZE_OF_IA_TA  (DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN + \
+                                  DHCP6_SIZE_OF_IAID)
+STATIC_ASSERT (
+  DHCP6_MIN_SIZE_OF_IA_TA == 8,
+  "Minimum combined size of IA_TA per RFC 8415"
+  );
+ 
+-#define DHCP6_PORT_CLIENT         546
+-#define DHCP6_PORT_SERVER         547
+// Offset to a IA_TA inner option
+#define DHCP6_OFFSET_OF_IA_TA_INNER_OPT(a)  (a + DHCP6_MIN_SIZE_OF_IA_TA)
+STATIC_ASSERT (
+  DHCP6_OFFSET_OF_IA_TA_INNER_OPT (0) == 8,
+  "Offset of IA_TA Inner option is + 8 past start of option"
+  );
+ 
+-#define DHCP_CHECK_MEDIA_WAITING_TIME    EFI_TIMER_PERIOD_SECONDS(20)
+// This is the size of IA_NA without options (16)
+#define DHCP6_MIN_SIZE_OF_IA_NA  DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN + \
+                                 DHCP6_SIZE_OF_COMBINED_IAID_T1_T2
+STATIC_ASSERT (
+  DHCP6_MIN_SIZE_OF_IA_NA == 16,
+  "Minimum combined size of IA_TA per RFC 8415"
+  );
+ 
+-#define DHCP6_INSTANCE_FROM_THIS(Instance) CR ((Instance), DHCP6_INSTANCE, Dhcp6, DHCP6_INSTANCE_SIGNATURE)
+-#define DHCP6_SERVICE_FROM_THIS(Service)   CR ((Service), DHCP6_SERVICE, ServiceBinding, DHCP6_SERVICE_SIGNATURE)
+#define DHCP6_OFFSET_OF_IA_NA_INNER_OPT(a)  (a + DHCP6_MIN_SIZE_OF_IA_NA)
+STATIC_ASSERT (
+  DHCP6_OFFSET_OF_IA_NA_INNER_OPT (0) == 16,
+  "Offset of IA_NA Inner option is + 16 past start of option"
+  );
+
+#define DHCP6_OFFSET_OF_IA_NA_T1(a)  (a + \
+                                   DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN + \
+                                   DHCP6_SIZE_OF_IAID)
+STATIC_ASSERT (
+  DHCP6_OFFSET_OF_IA_NA_T1 (0) == 8,
+  "Offset of IA_NA Inner option is + 8 past start of option"
+  );
+
+#define DHCP6_OFFSET_OF_IA_NA_T2(a)  (a + \
+                                   DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN +\
+                                   DHCP6_SIZE_OF_IAID + \
+                                   DHCP6_SIZE_OF_TIME_INTERVAL)
+STATIC_ASSERT (
+  DHCP6_OFFSET_OF_IA_NA_T2 (0) == 12,
+  "Offset of IA_NA Inner option is + 12 past start of option"
+  );
+
+//
+// For more information see RFC 8415 Section 21.13
+//
+// The format of the Status Code Option:
+//
+//     0                   1                   2                   3
+//     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//    |       OPTION_STATUS_CODE      |         option-len            |
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//    |          status-code          |                               |
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               |
+//    .                                                               .
+//    .                        status-message                         .
+//    .                                                               .
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//
+#define DHCP6_OFFSET_OF_STATUS_CODE(a)  (a + DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN)
+STATIC_ASSERT (
+  DHCP6_OFFSET_OF_STATUS_CODE (0) == 4,
+  "Offset of status is + 4 past start of option"
+  );
+ 
+ extern EFI_IPv6_ADDRESS           mAllDhcpRelayAndServersAddress;
+ extern EFI_DHCP6_PROTOCOL         gDhcp6ProtocolTemplate;
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+index 2976684aba..d680febbf1 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+@@ -611,8 +611,8 @@ Dhcp6UpdateIaInfo (
+   // The inner options still start with 2 bytes option-code and 2 bytes option-len.
+   //
+   if (Instance->Config->IaDescriptor.Type == Dhcp6OptIana) {
+-    T1 = NTOHL (ReadUnaligned32 ((UINT32 *) (Option + 8)));
+-    T2 = NTOHL (ReadUnaligned32 ((UINT32 *) (Option + 12)));
+    T1 = NTOHL (ReadUnaligned32 ((UINT32 *)(DHCP6_OFFSET_OF_IA_NA_T1 (Option))));
+    T2 = NTOHL (ReadUnaligned32 ((UINT32 *)(DHCP6_OFFSET_OF_IA_NA_T2 (Option))));
+     //
+     // Refer to RFC3155 Chapter 22.4. If a client receives an IA_NA with T1 greater than T2,
+     // and both T1 and T2 are greater than 0, the client discards the IA_NA option and processes
+@@ -621,13 +621,14 @@ Dhcp6UpdateIaInfo (
+     if (T1 > T2 && T2 > 0) {
+       return EFI_DEVICE_ERROR;
+     }
+-    IaInnerOpt = Option + 16;
+-    IaInnerLen = (UINT16) (NTOHS (ReadUnaligned16 ((UINT16 *) (Option + 2))) - 12);
+    IaInnerOpt = DHCP6_OFFSET_OF_IA_NA_INNER_OPT (Option);
+    IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option)))) - DHCP6_SIZE_OF_COMBINED_IAID_T1_T2);
+   } else {
+     T1 = 0;
+     T2 = 0;
+-    IaInnerOpt = Option + 8;
+-    IaInnerLen = (UINT16) (NTOHS (ReadUnaligned16 ((UINT16 *) (Option + 2))) - 4);
+
+    IaInnerOpt = DHCP6_OFFSET_OF_IA_TA_INNER_OPT (Option);
+    IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option)))) - DHCP6_SIZE_OF_IAID);
+   }
+ 
+   //
+@@ -653,7 +654,7 @@ Dhcp6UpdateIaInfo (
+   Option  = Dhcp6SeekOption (IaInnerOpt, IaInnerLen, Dhcp6OptStatusCode);
+ 
+   if (Option != NULL) {
+-    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *) (Option + 4)));
+    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option))));
+     if (StsCode != Dhcp6StsSuccess) {
+       return EFI_DEVICE_ERROR;
+     }
+@@ -675,6 +676,87 @@ Dhcp6UpdateIaInfo (
+ 
+ 
+ 
+/**
+  Seeks the Inner Options from a DHCP6 Option
+
+  @param[in]  IaType          The type of the IA option.
+  @param[in]  Option          The pointer to the DHCP6 Option.
+  @param[in]  OptionLen       The length of the DHCP6 Option.
+  @param[out] IaInnerOpt      The pointer to the IA inner option.
+  @param[out] IaInnerLen      The length of the IA inner option.
+
+  @retval EFI_SUCCESS         Seek the inner option successfully.
+  @retval EFI_DEVICE_ERROR    The OptionLen is invalid. On Error,
+                              the pointers are not modified
+**/
+EFI_STATUS
+Dhcp6SeekInnerOptionSafe (
+  IN  UINT16  IaType,
+  IN  UINT8   *Option,
+  IN  UINT32  OptionLen,
+  OUT UINT8   **IaInnerOpt,
+  OUT UINT16  *IaInnerLen
+  )
+{
+  UINT16  IaInnerLenTmp;
+  UINT8   *IaInnerOptTmp;
+
+  if (Option == NULL) {
+    ASSERT (Option != NULL);
+    return EFI_DEVICE_ERROR;
+  }
+
+  if (IaInnerOpt == NULL) {
+    ASSERT (IaInnerOpt != NULL);
+    return EFI_DEVICE_ERROR;
+  }
+
+  if (IaInnerLen == NULL) {
+    ASSERT (IaInnerLen != NULL);
+    return EFI_DEVICE_ERROR;
+  }
+
+  if (IaType == Dhcp6OptIana) {
+    // Verify we have a fully formed IA_NA
+    if (OptionLen < DHCP6_MIN_SIZE_OF_IA_NA) {
+      return EFI_DEVICE_ERROR;
+    }
+
+    //
+    IaInnerOptTmp = DHCP6_OFFSET_OF_IA_NA_INNER_OPT (Option);
+
+    // Verify the IaInnerLen is valid.
+    IaInnerLenTmp = (UINT16)NTOHS (ReadUnaligned16 ((UINT16 *)DHCP6_OFFSET_OF_OPT_LEN (Option)));
+    if (IaInnerLenTmp < DHCP6_SIZE_OF_COMBINED_IAID_T1_T2) {
+      return EFI_DEVICE_ERROR;
+    }
+
+    IaInnerLenTmp -= DHCP6_SIZE_OF_COMBINED_IAID_T1_T2;
+  } else if (IaType == Dhcp6OptIata) {
+    // Verify the OptionLen is valid.
+    if (OptionLen < DHCP6_MIN_SIZE_OF_IA_TA) {
+      return EFI_DEVICE_ERROR;
+    }
+
+    IaInnerOptTmp = DHCP6_OFFSET_OF_IA_TA_INNER_OPT (Option);
+
+    // Verify the IaInnerLen is valid.
+    IaInnerLenTmp = (UINT16)NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option))));
+    if (IaInnerLenTmp < DHCP6_SIZE_OF_IAID) {
+      return EFI_DEVICE_ERROR;
+    }
+
+    IaInnerLenTmp -= DHCP6_SIZE_OF_IAID;
+  } else {
+    return EFI_DEVICE_ERROR;
+  }
+
+  *IaInnerOpt = IaInnerOptTmp;
+  *IaInnerLen = IaInnerLenTmp;
+
+  return EFI_SUCCESS;
+}
+
+ /**
+   Seek StatusCode Option in package. A Status Code option may appear in the
+   options field of a DHCP message and/or in the options field of another option.
+@@ -695,9 +777,15 @@ Dhcp6SeekStsOption (
+   OUT    UINT8                    **Option
+   )
+ {
+-  UINT8                       *IaInnerOpt;
+-  UINT16                      IaInnerLen;
+-  UINT16                      StsCode;
+  UINT8   *IaInnerOpt;
+  UINT16  IaInnerLen;
+  UINT16  StsCode;
+  UINT32  OptionLen;
+
+  // OptionLen is the length of the Options excluding the DHCP header.
+  // Length of the EFI_DHCP6_PACKET from the first byte of the Header field to the last
+  // byte of the Option[] field.
+  OptionLen = Packet->Length - sizeof (Packet->Dhcp6.Header);
+ 
+   //
+   // Seek StatusCode option directly in DHCP message body. That is, search in
+@@ -705,12 +793,12 @@ Dhcp6SeekStsOption (
+   //
+   *Option = Dhcp6SeekOption (
+               Packet->Dhcp6.Option,
+-              Packet->Length - 4,
+              OptionLen,
+               Dhcp6OptStatusCode
+               );
+ 
+   if (*Option != NULL) {
+-    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *) (*Option + 4)));
+    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_STATUS_CODE (*Option))));
+     if (StsCode != Dhcp6StsSuccess) {
+       return EFI_DEVICE_ERROR;
+     }
+@@ -721,7 +809,7 @@ Dhcp6SeekStsOption (
+   //
+   *Option = Dhcp6SeekIaOption (
+               Packet->Dhcp6.Option,
+-              Packet->Length - sizeof (EFI_DHCP6_HEADER),
+              OptionLen,
+               &Instance->Config->IaDescriptor
+               );
+   if (*Option == NULL) {
+@@ -729,52 +817,35 @@ Dhcp6SeekStsOption (
+   }
+ 
+   //
+-  // The format of the IA_NA option is:
+  // Calculate the distance from Packet->Dhcp6.Option to the IA option.
+   //
+-  //     0                   1                   2                   3
+-  //     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |          OPTION_IA_NA         |          option-len           |
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |                        IAID (4 octets)                        |
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |                              T1                               |
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |                              T2                               |
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |                                                               |
+-  //    .                         IA_NA-options                         .
+-  //    .                                                               .
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+  // Packet->Size and Packet->Length are both UINT32 type, and Packet->Size is
+  // the size of the whole packet, including the DHCP header, and Packet->Length
+  // is the length of the DHCP message body, excluding the DHCP header.
+   //
+-  // The format of the IA_TA option is:
+  // (*Option - Packet->Dhcp6.Option) is the number of bytes from the start of
+  // DHCP6 option area to the start of the IA option.
+   //
+-  //     0                   1                   2                   3
+-  //     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |         OPTION_IA_TA          |          option-len           |
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |                        IAID (4 octets)                        |
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |                                                               |
+-  //    .                         IA_TA-options                         .
+-  //    .                                                               .
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+  // Dhcp6SeekInnerOptionSafe() is searching starting from the start of the
+  // IA option to the end of the DHCP6 option area, thus subtract the space
+  // up until this option
+   //
+  OptionLen = OptionLen - (*Option - Packet->Dhcp6.Option);
+ 
+   //
+-  // sizeof (option-code + option-len + IaId)           = 8
+-  // sizeof (option-code + option-len + IaId + T1)      = 12
+-  // sizeof (option-code + option-len + IaId + T1 + T2) = 16
+  // Seek the inner option
+   //
+-  // The inner options still start with 2 bytes option-code and 2 bytes option-len.
+-  //
+-  if (Instance->Config->IaDescriptor.Type == Dhcp6OptIana) {
+-    IaInnerOpt = *Option + 16;
+-    IaInnerLen = (UINT16) (NTOHS (ReadUnaligned16 ((UINT16 *) (*Option + 2))) - 12);
+-  } else {
+-    IaInnerOpt = *Option + 8;
+-    IaInnerLen = (UINT16) (NTOHS (ReadUnaligned16 ((UINT16 *) (*Option + 2))) - 4);
+  if (EFI_ERROR (
+        Dhcp6SeekInnerOptionSafe (
+          Instance->Config->IaDescriptor.Type,
+          *Option,
+          OptionLen,
+          &IaInnerOpt,
+          &IaInnerLen
+          )
+        ))
+  {
+    return EFI_DEVICE_ERROR;
+   }
+ 
+   //
+@@ -798,7 +869,7 @@ Dhcp6SeekStsOption (
+   //
+   *Option  = Dhcp6SeekOption (IaInnerOpt, IaInnerLen, Dhcp6OptStatusCode);
+   if (*Option != NULL) {
+-    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *) (*Option + 4)));
+    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)((DHCP6_OFFSET_OF_STATUS_CODE (*Option)))));
+     if (StsCode != Dhcp6StsSuccess) {
+       return EFI_DEVICE_ERROR;
+     }
+@@ -1123,7 +1194,7 @@ Dhcp6SendRequestMsg (
+   //
+   Option = Dhcp6SeekOption (
+              Instance->AdSelect->Dhcp6.Option,
+-             Instance->AdSelect->Length - 4,
+             Instance->AdSelect->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptServerId
+              );
+   if (Option == NULL) {
+@@ -1309,7 +1380,7 @@ Dhcp6SendDeclineMsg (
+   //
+   Option = Dhcp6SeekOption (
+              LastReply->Dhcp6.Option,
+-             LastReply->Length - 4,
+             LastReply->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptServerId
+              );
+   if (Option == NULL) {
+@@ -1469,7 +1540,7 @@ Dhcp6SendReleaseMsg (
+   //
+   Option = Dhcp6SeekOption (
+              LastReply->Dhcp6.Option,
+-             LastReply->Length - 4,
+             LastReply->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptServerId
+              );
+   if (Option == NULL) {
+@@ -1695,7 +1766,7 @@ Dhcp6SendRenewRebindMsg (
+ 
+     Option = Dhcp6SeekOption (
+                LastReply->Dhcp6.Option,
+-               LastReply->Length - 4,
+               LastReply->Length - sizeof (EFI_DHCP6_HEADER),
+                Dhcp6OptServerId
+                );
+     if (Option == NULL) {
+@@ -2235,7 +2306,7 @@ Dhcp6HandleReplyMsg (
+   //
+   Option = Dhcp6SeekOption (
+              Packet->Dhcp6.Option,
+-             Packet->Length - 4,
+             Packet->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptRapidCommit
+              );
+ 
+@@ -2383,7 +2454,7 @@ Dhcp6HandleReplyMsg (
+     //
+     // Any error status code option is found.
+     //
+-    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *) (Option + 4)));
+    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)((DHCP6_OFFSET_OF_STATUS_CODE (Option)))));
+     switch (StsCode) {
+     case Dhcp6StsUnspecFail:
+       //
+@@ -2514,7 +2585,7 @@ Dhcp6SelectAdvertiseMsg (
+   //
+   Option = Dhcp6SeekOption(
+              AdSelect->Dhcp6.Option,
+-             AdSelect->Length - 4,
+             AdSelect->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptServerUnicast
+              );
+ 
+@@ -2526,7 +2597,7 @@ Dhcp6SelectAdvertiseMsg (
+       return EFI_OUT_OF_RESOURCES;
+     }
+ 
+-    CopyMem (Instance->Unicast, Option + 4, sizeof(EFI_IPv6_ADDRESS));
+    CopyMem (Instance->Unicast, DHCP6_OFFSET_OF_OPT_DATA (Option), sizeof (EFI_IPv6_ADDRESS));
+   }
+ 
+   //
+@@ -2580,7 +2651,7 @@ Dhcp6HandleAdvertiseMsg (
+   //
+   Option = Dhcp6SeekOption(
+              Packet->Dhcp6.Option,
+-             Packet->Length - 4,
+             Packet->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptRapidCommit
+              );
+ 
+@@ -2676,7 +2747,7 @@ Dhcp6HandleAdvertiseMsg (
+       CopyMem (Instance->AdSelect, Packet, Packet->Size);
+ 
+       if (Option != NULL) {
+-        Instance->AdPref = *(Option + 4);
+        Instance->AdPref = *(DHCP6_OFFSET_OF_OPT_DATA (Option));
+       }
+     } else {
+       //
+@@ -2747,11 +2818,11 @@ Dhcp6HandleStateful (
+   //
+   Option = Dhcp6SeekOption(
+              Packet->Dhcp6.Option,
+-             Packet->Length - 4,
+             Packet->Length - DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN,
+              Dhcp6OptClientId
+              );
+ 
+-  if (Option == NULL || CompareMem (Option + 4, ClientId->Duid, ClientId->Length) != 0) {
+  if ((Option == NULL) || (CompareMem (DHCP6_OFFSET_OF_OPT_DATA (Option), ClientId->Duid, ClientId->Length) != 0)) {
+     goto ON_CONTINUE;
+   }
+ 
+@@ -2760,7 +2831,7 @@ Dhcp6HandleStateful (
+   //
+   Option = Dhcp6SeekOption(
+              Packet->Dhcp6.Option,
+-             Packet->Length - 4,
+             Packet->Length - DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN,
+              Dhcp6OptServerId
+              );
+ 
+@@ -2865,7 +2936,7 @@ Dhcp6HandleStateless (
+   //
+   Option = Dhcp6SeekOption (
+              Packet->Dhcp6.Option,
+-             Packet->Length - 4,
+             Packet->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptServerId
+              );
+ 
+-- 
+2.41.0
+
--- a/SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch
+++ b/SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch
@ -0,0 +1,257 @@
+From 1b58858f28a364a8f8fa897a78db7ced068719dd Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 13/15] NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229
+ Related Patch
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
+RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [13/15] 904fd82592208d0ca42bbb64f437691a5bdfd0b6
+
+JIRA: https://issues.redhat.com/browse/RHEL-21840
+CVE: CVE-2023-45229
+Upstream: Merged
+
+commit 1c440a5eceedc64e892877eeac0f1a4938f5abbb
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Tue Feb 13 10:46:00 2024 -0800
+
+    NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Related Patch
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4673
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4534
+
+    This was not part of the Quarkslab bugs however the same pattern
+    as CVE-2023-45229 exists in Dhcp6UpdateIaInfo.
+
+    This patch replaces the code in question with the safe function
+    created to patch CVE-2023-45229
+
+    >
+    >   if (EFI_ERROR (
+    >        Dhcp6SeekInnerOptionSafe (
+    >          Instance->Config->IaDescriptor.Type,
+    >          Option,
+    >          OptionLen,
+    >          &IaInnerOpt,
+    >          &IaInnerLen
+    >          )
+    >        ))
+    >  {
+    >    return EFI_DEVICE_ERROR;
+    >  }
+    >
+
+    Additionally corrects incorrect usage of macro to read the status
+
+    > - StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)DHCP6_OFFSET_OF_OPT_LEN
+     (Option)));
+    > + StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)
+    DHCP6_OFFSET_OF_STATUS_CODE (Option));
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Dhcp6Dxe/Dhcp6Io.c | 70 ++++++++++++++++++++++++++---------
+ NetworkPkg/Dhcp6Dxe/Dhcp6Io.h | 22 +++++++++++
+ 2 files changed, 75 insertions(+), 17 deletions(-)
+
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+index 3b8feb4a20..a9bffae353 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+@@ -528,13 +528,23 @@ Dhcp6UpdateIaInfo (
+ {
+   EFI_STATUS  Status;
+   UINT8       *Option;
+  UINT32      OptionLen;
+   UINT8       *IaInnerOpt;
+   UINT16      IaInnerLen;
+   UINT16      StsCode;
+   UINT32      T1;
+   UINT32      T2;
+ 
+  T1 = 0;
+  T2 = 0;
+
+   ASSERT (Instance->Config != NULL);
+
+  // OptionLen is the length of the Options excluding the DHCP header.
+  // Length of the EFI_DHCP6_PACKET from the first byte of the Header field to the last
+  // byte of the Option[] field.
+  OptionLen = Packet->Length - sizeof (Packet->Dhcp6.Header);
+
+   //
+   // If the reply was received in response to a solicit with rapid commit option,
+   // request, renew or rebind message, the client updates the information it has
+@@ -549,13 +559,29 @@ Dhcp6UpdateIaInfo (
+   //
+   Option = Dhcp6SeekIaOption (
+              Packet->Dhcp6.Option,
+-             Packet->Length - sizeof (EFI_DHCP6_HEADER),
+             OptionLen,
+              &Instance->Config->IaDescriptor
+              );
+   if (Option == NULL) {
+     return EFI_DEVICE_ERROR;
+   }
+ 
+  //
+  // Calculate the distance from Packet->Dhcp6.Option to the IA option.
+  //
+  // Packet->Size and Packet->Length are both UINT32 type, and Packet->Size is
+  // the size of the whole packet, including the DHCP header, and Packet->Length
+  // is the length of the DHCP message body, excluding the DHCP header.
+  //
+  // (*Option - Packet->Dhcp6.Option) is the number of bytes from the start of
+  // DHCP6 option area to the start of the IA option.
+  //
+  // Dhcp6SeekInnerOptionSafe() is searching starting from the start of the
+  // IA option to the end of the DHCP6 option area, thus subtract the space
+  // up until this option
+  //
+  OptionLen = OptionLen - (UINT32)(Option - Packet->Dhcp6.Option);
+
+   //
+   // The format of the IA_NA option is:
+   //
+@@ -591,32 +617,32 @@ Dhcp6UpdateIaInfo (
+   //
+ 
+   //
+-  // sizeof (option-code + option-len + IaId)           = 8
+-  // sizeof (option-code + option-len + IaId + T1)      = 12
+-  // sizeof (option-code + option-len + IaId + T1 + T2) = 16
+-  //
+-  // The inner options still start with 2 bytes option-code and 2 bytes option-len.
+  // Seek the inner option
+   //
+  if (EFI_ERROR (
+        Dhcp6SeekInnerOptionSafe (
+          Instance->Config->IaDescriptor.Type,
+          Option,
+          OptionLen,
+          &IaInnerOpt,
+          &IaInnerLen
+          )
+        ))
+  {
+    return EFI_DEVICE_ERROR;
+  }
+
+   if (Instance->Config->IaDescriptor.Type == Dhcp6OptIana) {
+     T1 = NTOHL (ReadUnaligned32 ((UINT32 *)(DHCP6_OFFSET_OF_IA_NA_T1 (Option))));
+     T2 = NTOHL (ReadUnaligned32 ((UINT32 *)(DHCP6_OFFSET_OF_IA_NA_T2 (Option))));
+     //
+     // Refer to RFC3155 Chapter 22.4. If a client receives an IA_NA with T1 greater than T2,
+     // and both T1 and T2 are greater than 0, the client discards the IA_NA option and processes
+-    // the remainder of the message as though the server had not  included the invalid IA_NA option.
+    // the remainder of the message as though the server had not included the invalid IA_NA option.
+     //
+     if ((T1 > T2) && (T2 > 0)) {
+       return EFI_DEVICE_ERROR;
+     }
+-
+-    IaInnerOpt = DHCP6_OFFSET_OF_IA_NA_INNER_OPT (Option);
+-    IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option)))) - DHCP6_SIZE_OF_COMBINED_IAID_T1_T2);
+-  } else {
+-    T1 = 0;
+-    T2 = 0;
+-
+-    IaInnerOpt = DHCP6_OFFSET_OF_IA_TA_INNER_OPT (Option);
+-    IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option)))) - DHCP6_SIZE_OF_IAID);
+   }
+ 
+   //
+@@ -642,7 +668,7 @@ Dhcp6UpdateIaInfo (
+   Option  = Dhcp6SeekOption (IaInnerOpt, IaInnerLen, Dhcp6OptStatusCode);
+ 
+   if (Option != NULL) {
+-    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option))));
+    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_STATUS_CODE (Option))));
+     if (StsCode != Dhcp6StsSuccess) {
+       return EFI_DEVICE_ERROR;
+     }
+@@ -703,15 +729,21 @@ Dhcp6SeekInnerOptionSafe (
+   }
+ 
+   if (IaType == Dhcp6OptIana) {
+    //
+     // Verify we have a fully formed IA_NA
+    //
+     if (OptionLen < DHCP6_MIN_SIZE_OF_IA_NA) {
+       return EFI_DEVICE_ERROR;
+     }
+ 
+    //
+    // Get the IA Inner Option and Length
+     //
+     IaInnerOptTmp = DHCP6_OFFSET_OF_IA_NA_INNER_OPT (Option);
+ 
+    //
+     // Verify the IaInnerLen is valid.
+    //
+     IaInnerLenTmp = (UINT16)NTOHS (ReadUnaligned16 ((UINT16 *)DHCP6_OFFSET_OF_OPT_LEN (Option)));
+     if (IaInnerLenTmp < DHCP6_SIZE_OF_COMBINED_IAID_T1_T2) {
+       return EFI_DEVICE_ERROR;
+@@ -719,14 +751,18 @@ Dhcp6SeekInnerOptionSafe (
+ 
+     IaInnerLenTmp -= DHCP6_SIZE_OF_COMBINED_IAID_T1_T2;
+   } else if (IaType == Dhcp6OptIata) {
+    //
+     // Verify the OptionLen is valid.
+    //
+     if (OptionLen < DHCP6_MIN_SIZE_OF_IA_TA) {
+       return EFI_DEVICE_ERROR;
+     }
+ 
+     IaInnerOptTmp = DHCP6_OFFSET_OF_IA_TA_INNER_OPT (Option);
+ 
+    //
+     // Verify the IaInnerLen is valid.
+    //
+     IaInnerLenTmp = (UINT16)NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option))));
+     if (IaInnerLenTmp < DHCP6_SIZE_OF_IAID) {
+       return EFI_DEVICE_ERROR;
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.h b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.h
+index 554f0f5e5d..8c0d282bca 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.h
+++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.h
+@@ -218,4 +218,26 @@ Dhcp6OnTimerTick (
+   IN VOID                   *Context
+   );
+ 
+/**
+  Seeks the Inner Options from a DHCP6 Option
+
+  @param[in]  IaType          The type of the IA option.
+  @param[in]  Option          The pointer to the DHCP6 Option.
+  @param[in]  OptionLen       The length of the DHCP6 Option.
+  @param[out] IaInnerOpt      The pointer to the IA inner option.
+  @param[out] IaInnerLen      The length of the IA inner option.
+
+  @retval EFI_SUCCESS         Seek the inner option successfully.
+  @retval EFI_DEVICE_ERROR    The OptionLen is invalid. On Error,
+                              the pointers are not modified
+**/
+EFI_STATUS
+Dhcp6SeekInnerOptionSafe (
+  IN  UINT16  IaType,
+  IN  UINT8   *Option,
+  IN  UINT32  OptionLen,
+  OUT UINT8   **IaInnerOpt,
+  OUT UINT16  *IaInnerLen
+  );
+
+ #endif
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch
+++ b/SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch
--- a/SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch
+++ b/SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch
@ -0,0 +1,629 @@
+From f5274b449181cb37efce0f08ed5d75a6bf6e54a8 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 8 Feb 2024 10:35:14 -0500
+Subject: [PATCH 16/17] NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230
+ Unit Tests
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 50: CVE-2023-45230 and CVE-2023-45229
+RH-Jira: RHEL-21840 RHEL-21842
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [3/4] 43b8569c0586c7dbf66b19c5db335d0ce05829de (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21842
+CVE: CVE-2023-45230
+Upstream: Merged
+
+commit 5f3658197bf29c83b3349b0ab1d99cdb0c3814bc
+Author: Doug Flick via groups.io <dougflick=microsoft.com@groups.io>
+Date:   Fri Jan 26 05:54:45 2024 +0800
+
+    NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Unit Tests
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4535
+
+    Confirms that reported issue...
+
+    "Buffer overflow in the DHCPv6 client via a long Server ID option"
+
+    ..has been corrected by the provided patch.
+
+    Tests the following functions to ensure they appropriately handle
+    untrusted data (either too long or too small) to prevent a buffer
+    overflow:
+
+    Dhcp6AppendOption
+    Dhcp6AppendETOption
+    Dhcp6AppendIaOption
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../GoogleTest/Dhcp6DxeGoogleTest.cpp         |  20 +
+ .../GoogleTest/Dhcp6DxeGoogleTest.inf         |  43 ++
+ .../Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.cpp | 478 ++++++++++++++++++
+ NetworkPkg/Test/NetworkPkgHostTest.dsc        |   1 +
+ 4 files changed, 542 insertions(+)
+ create mode 100644 NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.cpp
+ create mode 100644 NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
+ create mode 100644 NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.cpp
+
+diff --git a/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.cpp b/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.cpp
+new file mode 100644
+index 0000000000..9aeced2f91
+--- /dev/null
+++ b/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.cpp
+@@ -0,0 +1,20 @@
+/** @file
+  Acts as the main entry point for the tests for the Dhcp6Dxe module.
+
+  Copyright (c) Microsoft Corporation
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+#include <gtest/gtest.h>
+
+////////////////////////////////////////////////////////////////////////////////
+// Run the tests
+////////////////////////////////////////////////////////////////////////////////
+int
+main (
+  int   argc,
+  char  *argv[]
+  )
+{
+  testing::InitGoogleTest (&argc, argv);
+  return RUN_ALL_TESTS ();
+}
+diff --git a/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf b/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
+new file mode 100644
+index 0000000000..8e9119a371
+--- /dev/null
+++ b/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
+@@ -0,0 +1,43 @@
+## @file
+# Unit test suite for the Dhcp6Dxe using Google Test
+#
+# Copyright (c) Microsoft Corporation.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+##
+[Defines]
+  INF_VERSION         = 0x00010017
+  BASE_NAME           = Dhcp6DxeGoogleTest
+  FILE_GUID           = 1D2A4C65-38C8-4C2F-BB60-B5FA49625AA9
+  VERSION_STRING      = 1.0
+  MODULE_TYPE         = HOST_APPLICATION
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64 AARCH64
+#
+[Sources]
+  Dhcp6DxeGoogleTest.cpp
+  Dhcp6IoGoogleTest.cpp
+  ../Dhcp6Io.c
+  ../Dhcp6Utility.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+  UnitTestFrameworkPkg/UnitTestFrameworkPkg.dec
+  NetworkPkg/NetworkPkg.dec
+
+[LibraryClasses]
+  GoogleTestLib
+  DebugLib
+  NetLib
+  PcdLib
+
+[Protocols]
+  gEfiDhcp6ServiceBindingProtocolGuid
+
+[Pcd]
+  gEfiNetworkPkgTokenSpaceGuid.PcdDhcp6UidType
+
+[Guids]
+  gZeroGuid
+diff --git a/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.cpp b/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.cpp
+new file mode 100644
+index 0000000000..7ee40e4af4
+--- /dev/null
+++ b/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.cpp
+@@ -0,0 +1,478 @@
+/** @file
+  Tests for Dhcp6Io.c.
+
+  Copyright (c) Microsoft Corporation
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+#include <gtest/gtest.h>
+
+extern "C" {
+  #include <Uefi.h>
+  #include <Library/BaseLib.h>
+  #include <Library/DebugLib.h>
+  #include <Library/BaseMemoryLib.h>
+  #include "../Dhcp6Impl.h"
+  #include "../Dhcp6Utility.h"
+}
+
+////////////////////////////////////////////////////////////////////////
+// Defines
+////////////////////////////////////////////////////////////////////////
+
+#define DHCP6_PACKET_MAX_LEN  1500
+
+////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////
+// Symbol Definitions
+// These functions are not directly under test - but required to compile
+////////////////////////////////////////////////////////////////////////
+
+// This definition is used by this test but is also required to compile
+// by Dhcp6Io.c
+EFI_IPv6_ADDRESS  mAllDhcpRelayAndServersAddress = {
+  { 0xFF, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 2 }
+};
+
+EFI_STATUS
+EFIAPI
+UdpIoSendDatagram (
+  IN  UDP_IO           *UdpIo,
+  IN  NET_BUF          *Packet,
+  IN  UDP_END_POINT    *EndPoint OPTIONAL,
+  IN  EFI_IP_ADDRESS   *Gateway  OPTIONAL,
+  IN  UDP_IO_CALLBACK  CallBack,
+  IN  VOID             *Context
+  )
+{
+  return EFI_SUCCESS;
+}
+
+EFI_STATUS
+EFIAPI
+UdpIoRecvDatagram (
+  IN  UDP_IO           *UdpIo,
+  IN  UDP_IO_CALLBACK  CallBack,
+  IN  VOID             *Context,
+  IN  UINT32           HeadLen
+  )
+{
+  return EFI_SUCCESS;
+}
+
+////////////////////////////////////////////////////////////////////////
+// Dhcp6AppendOptionTest Tests
+////////////////////////////////////////////////////////////////////////
+
+class Dhcp6AppendOptionTest : public ::testing::Test {
+public:
+  UINT8 *Buffer = NULL;
+  EFI_DHCP6_PACKET *Packet;
+
+protected:
+  // Add any setup code if needed
+  virtual void
+  SetUp (
+    )
+  {
+    // Initialize any resources or variables
+    Buffer = (UINT8 *)AllocateZeroPool (DHCP6_PACKET_MAX_LEN);
+    ASSERT_NE (Buffer, (UINT8 *)NULL);
+
+    Packet       = (EFI_DHCP6_PACKET *)Buffer;
+    Packet->Size = DHCP6_PACKET_MAX_LEN;
+  }
+
+  // Add any cleanup code if needed
+  virtual void
+  TearDown (
+    )
+  {
+    // Clean up any resources or variables
+    if (Buffer != NULL) {
+      FreePool (Buffer);
+    }
+  }
+};
+
+// Test Description:
+// Attempt to append an option to a packet that is too small by a duid that is too large
+TEST_F (Dhcp6AppendOptionTest, InvalidDataExpectBufferTooSmall) {
+  UINT8           *Cursor;
+  EFI_DHCP6_DUID  *UntrustedDuid;
+  EFI_STATUS      Status;
+
+  UntrustedDuid = (EFI_DHCP6_DUID *)AllocateZeroPool (sizeof (EFI_DHCP6_DUID));
+  ASSERT_NE (UntrustedDuid, (EFI_DHCP6_DUID *)NULL);
+
+  UntrustedDuid->Length = NTOHS (0xFFFF);
+
+  Cursor = Dhcp6AppendOptionTest::Packet->Dhcp6.Option;
+
+  Status = Dhcp6AppendOption (
+             Dhcp6AppendOptionTest::Packet,
+             &Cursor,
+             HTONS (Dhcp6OptServerId),
+             UntrustedDuid->Length,
+             UntrustedDuid->Duid
+             );
+
+  ASSERT_EQ (Status, EFI_BUFFER_TOO_SMALL);
+}
+
+// Test Description:
+// Attempt to append an option to a packet that is large enough
+TEST_F (Dhcp6AppendOptionTest, ValidDataExpectSuccess) {
+  UINT8           *Cursor;
+  EFI_DHCP6_DUID  *UntrustedDuid;
+  EFI_STATUS      Status;
+  UINTN           OriginalLength;
+
+  UINT8  Duid[6] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05 };
+
+  Packet->Length = sizeof (EFI_DHCP6_HEADER);
+  OriginalLength = Packet->Length;
+
+  UntrustedDuid = (EFI_DHCP6_DUID *)AllocateZeroPool (sizeof (EFI_DHCP6_DUID));
+  ASSERT_NE (UntrustedDuid, (EFI_DHCP6_DUID *)NULL);
+
+  UntrustedDuid->Length = NTOHS (sizeof (Duid));
+  CopyMem (UntrustedDuid->Duid, Duid, sizeof (Duid));
+
+  Cursor = Dhcp6AppendOptionTest::Packet->Dhcp6.Option;
+
+  Status = Dhcp6AppendOption (
+             Dhcp6AppendOptionTest::Packet,
+             &Cursor,
+             HTONS (Dhcp6OptServerId),
+             UntrustedDuid->Length,
+             UntrustedDuid->Duid
+             );
+
+  ASSERT_EQ (Status, EFI_SUCCESS);
+
+  // verify that the pointer to cursor moved by the expected amount
+  ASSERT_EQ (Cursor, (UINT8 *)Dhcp6AppendOptionTest::Packet->Dhcp6.Option + sizeof (Duid) + 4);
+
+  // verify that the length of the packet is now the expected amount
+  ASSERT_EQ (Dhcp6AppendOptionTest::Packet->Length, OriginalLength + sizeof (Duid) + 4);
+}
+
+////////////////////////////////////////////////////////////////////////
+// Dhcp6AppendETOption Tests
+////////////////////////////////////////////////////////////////////////
+
+class Dhcp6AppendETOptionTest : public ::testing::Test {
+public:
+  UINT8 *Buffer = NULL;
+  EFI_DHCP6_PACKET *Packet;
+
+protected:
+  // Add any setup code if needed
+  virtual void
+  SetUp (
+    )
+  {
+    // Initialize any resources or variables
+    Buffer = (UINT8 *)AllocateZeroPool (DHCP6_PACKET_MAX_LEN);
+    ASSERT_NE (Buffer, (UINT8 *)NULL);
+
+    Packet         = (EFI_DHCP6_PACKET *)Buffer;
+    Packet->Size   = DHCP6_PACKET_MAX_LEN;
+    Packet->Length = sizeof (EFI_DHCP6_HEADER);
+  }
+
+  // Add any cleanup code if needed
+  virtual void
+  TearDown (
+    )
+  {
+    // Clean up any resources or variables
+    if (Buffer != NULL) {
+      FreePool (Buffer);
+    }
+  }
+};
+
+// Test Description:
+// Attempt to append an option to a packet that is too small by a duid that is too large
+TEST_F (Dhcp6AppendETOptionTest, InvalidDataExpectBufferTooSmall) {
+  UINT8           *Cursor;
+  EFI_STATUS      Status;
+  DHCP6_INSTANCE  Instance;
+  UINT16          ElapsedTimeVal;
+  UINT16          *ElapsedTime;
+
+  Cursor      = Dhcp6AppendETOptionTest::Packet->Dhcp6.Option;
+  ElapsedTime = &ElapsedTimeVal;
+
+  Packet->Length = Packet->Size - 2;
+
+  Status = Dhcp6AppendETOption (
+             Dhcp6AppendETOptionTest::Packet,
+             &Cursor,
+             &Instance, // Instance is not used in this function
+             &ElapsedTime
+             );
+
+  // verify that we error out because the packet is too small for the option header
+  ASSERT_EQ (Status, EFI_BUFFER_TOO_SMALL);
+
+  // reset the length
+  Packet->Length = sizeof (EFI_DHCP6_HEADER);
+}
+
+// Test Description:
+// Attempt to append an option to a packet that is large enough
+TEST_F (Dhcp6AppendETOptionTest, ValidDataExpectSuccess) {
+  UINT8           *Cursor;
+  EFI_STATUS      Status;
+  DHCP6_INSTANCE  Instance;
+  UINT16          ElapsedTimeVal;
+  UINT16          *ElapsedTime;
+  UINTN           ExpectedSize;
+  UINTN           OriginalLength;
+
+  Cursor         = Dhcp6AppendETOptionTest::Packet->Dhcp6.Option;
+  ElapsedTime    = &ElapsedTimeVal;
+  ExpectedSize   = 6;
+  OriginalLength = Packet->Length;
+
+  Status = Dhcp6AppendETOption (
+             Dhcp6AppendETOptionTest::Packet,
+             &Cursor,
+             &Instance, // Instance is not used in this function
+             &ElapsedTime
+             );
+
+  // verify that the status is EFI_SUCCESS
+  ASSERT_EQ (Status, EFI_SUCCESS);
+
+  // verify that the pointer to cursor moved by the expected amount
+  ASSERT_EQ (Cursor, (UINT8 *)Dhcp6AppendETOptionTest::Packet->Dhcp6.Option + ExpectedSize);
+
+  // verify that the length of the packet is now the expected amount
+  ASSERT_EQ (Dhcp6AppendETOptionTest::Packet->Length, OriginalLength + ExpectedSize);
+}
+
+////////////////////////////////////////////////////////////////////////
+// Dhcp6AppendIaOption Tests
+////////////////////////////////////////////////////////////////////////
+
+class Dhcp6AppendIaOptionTest : public ::testing::Test {
+public:
+  UINT8 *Buffer = NULL;
+  EFI_DHCP6_PACKET *Packet;
+  EFI_DHCP6_IA *Ia;
+
+protected:
+  // Add any setup code if needed
+  virtual void
+  SetUp (
+    )
+  {
+    // Initialize any resources or variables
+    Buffer = (UINT8 *)AllocateZeroPool (DHCP6_PACKET_MAX_LEN);
+    ASSERT_NE (Buffer, (UINT8 *)NULL);
+
+    Packet       = (EFI_DHCP6_PACKET *)Buffer;
+    Packet->Size = DHCP6_PACKET_MAX_LEN;
+
+    Ia = (EFI_DHCP6_IA *)AllocateZeroPool (sizeof (EFI_DHCP6_IA) + sizeof (EFI_DHCP6_IA_ADDRESS) * 2);
+    ASSERT_NE (Ia, (EFI_DHCP6_IA *)NULL);
+
+    CopyMem (Ia->IaAddress, mAllDhcpRelayAndServersAddress.Addr, sizeof (EFI_IPv6_ADDRESS));
+    CopyMem (Ia->IaAddress + 1, mAllDhcpRelayAndServersAddress.Addr, sizeof (EFI_IPv6_ADDRESS));
+
+    Ia->IaAddressCount = 2;
+  }
+
+  // Add any cleanup code if needed
+  virtual void
+  TearDown (
+    )
+  {
+    // Clean up any resources or variables
+    if (Buffer != NULL) {
+      FreePool (Buffer);
+    }
+
+    if (Ia != NULL) {
+      FreePool (Ia);
+    }
+  }
+};
+
+// Test Description:
+// Attempt to append an option to a packet that doesn't have enough space
+// for the option header
+TEST_F (Dhcp6AppendIaOptionTest, IaNaInvalidDataExpectBufferTooSmall) {
+  UINT8       *Cursor;
+  EFI_STATUS  Status;
+
+  Packet->Length = Packet->Size - 2;
+
+  Ia->Descriptor.Type = Dhcp6OptIana;
+  Ia->Descriptor.IaId = 0x12345678;
+
+  Cursor = Dhcp6AppendIaOptionTest::Packet->Dhcp6.Option;
+
+  Status = Dhcp6AppendIaOption (
+             Dhcp6AppendIaOptionTest::Packet,
+             &Cursor,
+             Ia,
+             0x12345678,
+             0x11111111,
+             Dhcp6OptIana
+             );
+
+  // verify that we error out because the packet is too small for the option header
+  ASSERT_EQ (Status, EFI_BUFFER_TOO_SMALL);
+
+  // reset the length
+  Packet->Length = sizeof (EFI_DHCP6_HEADER);
+}
+
+// Test Description:
+// Attempt to append an option to a packet that doesn't have enough space
+// for the option header
+TEST_F (Dhcp6AppendIaOptionTest, IaTaInvalidDataExpectBufferTooSmall) {
+  UINT8       *Cursor;
+  EFI_STATUS  Status;
+
+  // Use up nearly all the space in the packet
+  Packet->Length = Packet->Size - 2;
+
+  Ia->Descriptor.Type = Dhcp6OptIata;
+  Ia->Descriptor.IaId = 0x12345678;
+
+  Cursor = Dhcp6AppendIaOptionTest::Packet->Dhcp6.Option;
+
+  Status = Dhcp6AppendIaOption (
+             Dhcp6AppendIaOptionTest::Packet,
+             &Cursor,
+             Ia,
+             0,
+             0,
+             Dhcp6OptIata
+             );
+
+  // verify that we error out because the packet is too small for the option header
+  ASSERT_EQ (Status, EFI_BUFFER_TOO_SMALL);
+
+  // reset the length
+  Packet->Length = sizeof (EFI_DHCP6_HEADER);
+}
+
+TEST_F (Dhcp6AppendIaOptionTest, IaNaValidDataExpectSuccess) {
+  UINT8       *Cursor;
+  EFI_STATUS  Status;
+  UINTN       ExpectedSize;
+  UINTN       OriginalLength;
+
+  //
+  // 2 bytes for the option header type
+  //
+  ExpectedSize = 2;
+  //
+  // 2 bytes for the option header length
+  //
+  ExpectedSize += 2;
+  //
+  // 4 bytes for the IAID
+  //
+  ExpectedSize += 4;
+  //
+  // + 4 bytes for the T1
+  //
+  ExpectedSize += 4;
+  //
+  // + 4 bytes for the T2
+  //
+  ExpectedSize += 4;
+  //
+  // + (4 + sizeof (EFI_DHCP6_IA_ADDRESS)) * 2;
+  //   + 2 bytes for the option header type
+  //   + 2 bytes for the option header length
+  //   + sizeof (EFI_DHCP6_IA_ADDRESS) for the IA Address
+  //
+  ExpectedSize += (4 + sizeof (EFI_DHCP6_IA_ADDRESS)) * 2;
+
+  Cursor = Dhcp6AppendIaOptionTest::Packet->Dhcp6.Option;
+
+  Packet->Length = sizeof (EFI_DHCP6_HEADER);
+  OriginalLength = Packet->Length;
+
+  Ia->Descriptor.Type = Dhcp6OptIana;
+  Ia->Descriptor.IaId = 0x12345678;
+
+  Status = Dhcp6AppendIaOption (
+             Dhcp6AppendIaOptionTest::Packet,
+             &Cursor,
+             Ia,
+             0x12345678,
+             0x12345678,
+             Dhcp6OptIana
+             );
+
+  // verify that the pointer to cursor moved by the expected amount
+  ASSERT_EQ (Cursor, (UINT8 *)Dhcp6AppendIaOptionTest::Packet->Dhcp6.Option + ExpectedSize);
+
+  // verify that the length of the packet is now the expected amount
+  ASSERT_EQ (Dhcp6AppendIaOptionTest::Packet->Length, OriginalLength + ExpectedSize);
+
+  // verify that the status is EFI_SUCCESS
+  ASSERT_EQ (Status, EFI_SUCCESS);
+}
+
+TEST_F (Dhcp6AppendIaOptionTest, IaTaValidDataExpectSuccess) {
+  UINT8       *Cursor;
+  EFI_STATUS  Status;
+  UINTN       ExpectedSize;
+  UINTN       OriginalLength;
+
+  //
+  // 2 bytes for the option header type
+  //
+  ExpectedSize = 2;
+  //
+  // 2 bytes for the option header length
+  //
+  ExpectedSize += 2;
+  //
+  // 4 bytes for the IAID
+  //
+  ExpectedSize += 4;
+  //
+  // + (4 + sizeof (EFI_DHCP6_IA_ADDRESS)) * 2;
+  //   + 2 bytes for the option header type
+  //   + 2 bytes for the option header length
+  //   + sizeof (EFI_DHCP6_IA_ADDRESS) for the IA Address
+  //
+  ExpectedSize += (4 + sizeof (EFI_DHCP6_IA_ADDRESS)) * 2;
+
+  Cursor = Dhcp6AppendIaOptionTest::Packet->Dhcp6.Option;
+
+  Packet->Length = sizeof (EFI_DHCP6_HEADER);
+  OriginalLength = Packet->Length;
+
+  Ia->Descriptor.Type = Dhcp6OptIata;
+  Ia->Descriptor.IaId = 0x12345678;
+
+  Status = Dhcp6AppendIaOption (
+             Dhcp6AppendIaOptionTest::Packet,
+             &Cursor,
+             Ia,
+             0,
+             0,
+             Dhcp6OptIata
+             );
+
+  // verify that the pointer to cursor moved by the expected amount
+  ASSERT_EQ (Cursor, (UINT8 *)Dhcp6AppendIaOptionTest::Packet->Dhcp6.Option + ExpectedSize);
+
+  // verify that the length of the packet is now the expected amount
+  ASSERT_EQ (Dhcp6AppendIaOptionTest::Packet->Length, OriginalLength + ExpectedSize);
+
+  // verify that the status is EFI_SUCCESS
+  ASSERT_EQ (Status, EFI_SUCCESS);
+}
+diff --git a/NetworkPkg/Test/NetworkPkgHostTest.dsc b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+index 1aeca5c5b3..20bc90b172 100644
+--- a/NetworkPkg/Test/NetworkPkgHostTest.dsc
+++ b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+@@ -24,6 +24,7 @@
+   #
+   # Build HOST_APPLICATION that tests NetworkPkg
+   #
+  NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
+ 
+ # Despite these library classes being listed in [LibraryClasses] below, they are not needed for the host-based unit tests.
+ [LibraryClasses]
+-- 
+2.41.0
+
--- a/SOURCES/edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch
+++ b/SOURCES/edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch
@ -0,0 +1,78 @@
+From e3f153773bd2ca13ee4869187f1711840fc8afc9 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 15 Feb 2024 11:51:09 -0500
+Subject: [PATCH 02/15] NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Patch
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
+RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [2/15] 61eaf6aac61b774c3a8ace54af8abd607651d2db
+
+JIRA: https://issues.redhat.com/browse/RHEL-21844
+CVE: CVE-2022-45231
+Upstream: Merged
+
+commit bbfee34f4188ac00371abe1389ae9c9fb989a0cd
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:48 2024 +0800
+
+    NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Patch
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4536
+
+    Bug Overview:
+    PixieFail Bug #3
+    CVE-2023-45231
+    CVSS 6.5 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    CWE-125 Out-of-bounds Read
+
+    Out-of-bounds read when handling a ND Redirect message with truncated
+    options
+
+    Change Overview:
+
+    Adds a check to prevent truncated options from being parsed
+    +  //
+    +  // Cannot process truncated options.
+    +  // Cannot process options with a length of 0 as there is no Type
+    field.
+    +  //
+    +  if (OptionLen < sizeof (IP6_OPTION_HEADER)) {
+    +    return FALSE;
+    +  }
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Ip6Dxe/Ip6Option.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/NetworkPkg/Ip6Dxe/Ip6Option.c b/NetworkPkg/Ip6Dxe/Ip6Option.c
+index 199eea124d..8718d5d875 100644
+--- a/NetworkPkg/Ip6Dxe/Ip6Option.c
+++ b/NetworkPkg/Ip6Dxe/Ip6Option.c
+@@ -137,6 +137,14 @@ Ip6IsNDOptionValid (
+     return FALSE;
+   }
+ 
+  //
+  // Cannot process truncated options.
+  // Cannot process options with a length of 0 as there is no Type field.
+  //
+  if (OptionLen < sizeof (IP6_OPTION_HEADER)) {
+    return FALSE;
+  }
+
+   Offset = 0;
+ 
+   //
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch
+++ b/SOURCES/edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch
@ -0,0 +1,277 @@
+From e8200dda7752d21794b2268efe9e957958ffef29 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 14 Feb 2024 12:24:44 -0500
+Subject: [PATCH 03/15] NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Unit
+ Tests
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
+RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [3/15] ca554677a3397423073d3bb4774f856b2329ae9c
+
+JIRA: https://issues.redhat.com/browse/RHEL-21844
+CVE: CVE-2022-45231
+Upstream: Merged
+
+commit 6f77463d72807ec7f4ed6518c3dac29a1040df9f
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:49 2024 +0800
+
+    NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Unit Tests
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4536
+
+    Validates that the patch for...
+
+    Out-of-bounds read when handling a ND Redirect message with truncated
+    options
+
+    .. has been fixed
+
+    Tests the following function to ensure that an out of bounds read does
+    not occur
+    Ip6OptionValidation
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp    |  20 +++
+ .../Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf    |  42 ++++++
+ .../Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp | 129 ++++++++++++++++++
+ NetworkPkg/Test/NetworkPkgHostTest.dsc        |   1 +
+ 4 files changed, 192 insertions(+)
+ create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp
+ create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+ create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
+
+diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp
+new file mode 100644
+index 0000000000..6ebfd5fdfb
+--- /dev/null
+++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp
+@@ -0,0 +1,20 @@
+/** @file
+  Acts as the main entry point for the tests for the Ip6Dxe module.
+
+  Copyright (c) Microsoft Corporation
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+#include <gtest/gtest.h>
+
+////////////////////////////////////////////////////////////////////////////////
+// Run the tests
+////////////////////////////////////////////////////////////////////////////////
+int
+main (
+  int   argc,
+  char  *argv[]
+  )
+{
+  testing::InitGoogleTest (&argc, argv);
+  return RUN_ALL_TESTS ();
+}
+diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+new file mode 100644
+index 0000000000..6e4de0745f
+--- /dev/null
+++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+@@ -0,0 +1,42 @@
+## @file
+# Unit test suite for the Ip6Dxe using Google Test
+#
+# Copyright (c) Microsoft Corporation.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+##
+[Defines]
+  INF_VERSION         = 0x00010017
+  BASE_NAME           = Ip6DxeUnitTest
+  FILE_GUID           = 4F05D17D-D3E7-4AAE-820C-576D46D2D34A
+  VERSION_STRING      = 1.0
+  MODULE_TYPE         = HOST_APPLICATION
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64 AARCH64
+#
+[Sources]
+  Ip6DxeGoogleTest.cpp
+  Ip6OptionGoogleTest.cpp
+  ../Ip6Option.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+  UnitTestFrameworkPkg/UnitTestFrameworkPkg.dec
+  NetworkPkg/NetworkPkg.dec
+
+[LibraryClasses]
+  GoogleTestLib
+  DebugLib
+  NetLib
+  PcdLib
+
+[Protocols]
+  gEfiDhcp6ServiceBindingProtocolGuid
+
+[Pcd]
+  gEfiNetworkPkgTokenSpaceGuid.PcdDhcp6UidType
+
+[Guids]
+  gZeroGuid
+diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
+new file mode 100644
+index 0000000000..f2cd90e1a9
+--- /dev/null
+++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
+@@ -0,0 +1,129 @@
+/** @file
+  Tests for Ip6Option.c.
+
+  Copyright (c) Microsoft Corporation
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+#include <gtest/gtest.h>
+
+extern "C" {
+  #include <Uefi.h>
+  #include <Library/BaseLib.h>
+  #include <Library/DebugLib.h>
+  #include "../Ip6Impl.h"
+  #include "../Ip6Option.h"
+}
+
+/////////////////////////////////////////////////////////////////////////
+// Defines
+///////////////////////////////////////////////////////////////////////
+
+#define IP6_PREFIX_INFO_OPTION_DATA_LEN    32
+#define OPTION_HEADER_IP6_PREFIX_DATA_LEN  (sizeof (IP6_OPTION_HEADER) + IP6_PREFIX_INFO_OPTION_DATA_LEN)
+
+////////////////////////////////////////////////////////////////////////
+// Symbol Definitions
+// These functions are not directly under test - but required to compile
+////////////////////////////////////////////////////////////////////////
+UINT32  mIp6Id;
+
+EFI_STATUS
+Ip6SendIcmpError (
+  IN IP6_SERVICE       *IpSb,
+  IN NET_BUF           *Packet,
+  IN EFI_IPv6_ADDRESS  *SourceAddress       OPTIONAL,
+  IN EFI_IPv6_ADDRESS  *DestinationAddress,
+  IN UINT8             Type,
+  IN UINT8             Code,
+  IN UINT32            *Pointer             OPTIONAL
+  )
+{
+  // ..
+  return EFI_SUCCESS;
+}
+
+////////////////////////////////////////////////////////////////////////
+// Ip6OptionValidation Tests
+////////////////////////////////////////////////////////////////////////
+
+// Define a fixture for your tests if needed
+class Ip6OptionValidationTest : public ::testing::Test {
+protected:
+  // Add any setup code if needed
+  virtual void
+  SetUp (
+    )
+  {
+    // Initialize any resources or variables
+  }
+
+  // Add any cleanup code if needed
+  virtual void
+  TearDown (
+    )
+  {
+    // Clean up any resources or variables
+  }
+};
+
+// Test Description:
+// Null option should return false
+TEST_F (Ip6OptionValidationTest, NullOptionShouldReturnFalse) {
+  UINT8   *option   = nullptr;
+  UINT16  optionLen = 10; // Provide a suitable length
+
+  EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
+}
+
+// Test Description:
+// Truncated option should return false
+TEST_F (Ip6OptionValidationTest, TruncatedOptionShouldReturnFalse) {
+  UINT8   option[]  = { 0x01 }; // Provide a truncated option
+  UINT16  optionLen = 1;
+
+  EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
+}
+
+// Test Description:
+// Ip6OptionPrefixInfo Option with zero length should return false
+TEST_F (Ip6OptionValidationTest, OptionWithZeroLengthShouldReturnFalse) {
+  IP6_OPTION_HEADER  optionHeader;
+
+  optionHeader.Type   = Ip6OptionPrefixInfo;
+  optionHeader.Length = 0;
+  UINT8  option[sizeof (IP6_OPTION_HEADER)];
+
+  CopyMem (option, &optionHeader, sizeof (IP6_OPTION_HEADER));
+  UINT16  optionLen = sizeof (IP6_OPTION_HEADER);
+
+  EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
+}
+
+// Test Description:
+// Ip6OptionPrefixInfo Option with valid length should return true
+TEST_F (Ip6OptionValidationTest, ValidPrefixInfoOptionShouldReturnTrue) {
+  IP6_OPTION_HEADER  optionHeader;
+
+  optionHeader.Type   = Ip6OptionPrefixInfo;
+  optionHeader.Length = 4; // Length 4 * 8 = 32
+  UINT8  option[OPTION_HEADER_IP6_PREFIX_DATA_LEN];
+
+  CopyMem (option, &optionHeader, sizeof (IP6_OPTION_HEADER));
+
+  EXPECT_TRUE (Ip6IsNDOptionValid (option, IP6_PREFIX_INFO_OPTION_DATA_LEN));
+}
+
+// Test Description:
+// Ip6OptionPrefixInfo Option with invalid length should return false
+TEST_F (Ip6OptionValidationTest, InvalidPrefixInfoOptionLengthShouldReturnFalse) {
+  IP6_OPTION_HEADER  optionHeader;
+
+  optionHeader.Type   = Ip6OptionPrefixInfo;
+  optionHeader.Length = 3; // Length 3 * 8 = 24 (Invalid)
+  UINT8  option[sizeof (IP6_OPTION_HEADER)];
+
+  CopyMem (option, &optionHeader, sizeof (IP6_OPTION_HEADER));
+  UINT16  optionLen = sizeof (IP6_OPTION_HEADER);
+
+  EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
+}
+diff --git a/NetworkPkg/Test/NetworkPkgHostTest.dsc b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+index 20bc90b172..ab7c2857b6 100644
+--- a/NetworkPkg/Test/NetworkPkgHostTest.dsc
+++ b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+@@ -25,6 +25,7 @@
+   # Build HOST_APPLICATION that tests NetworkPkg
+   #
+   NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
+  NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+ 
+ # Despite these library classes being listed in [LibraryClasses] below, they are not needed for the host-based unit tests.
+ [LibraryClasses]
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch
+++ b/SOURCES/edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch
@ -0,0 +1,377 @@
+From 23b31a16bbb789f4c251b1d2f23334210a9fb545 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 15 Feb 2024 11:51:09 -0500
+Subject: [PATCH 04/15] NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45232 Patch
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
+RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [4/15] 48c273e43a6275c7eae3223c4ffa433f4d6531a4
+
+JIRA: https://issues.redhat.com/browse/RHEL-21846
+CVE: CVE-2022-45232
+Upstream: Merged
+
+JIRA: https://issues.redhat.com/browse/RHEL-21848
+CVE: CVE-2022-45233
+Upstream: Merged
+
+commit 4df0229ef992d4f2721a8508787ebf9dc81fbd6e
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:50 2024 +0800
+
+    NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45232 Patch
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4537
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4538
+
+    Bug Details:
+    PixieFail Bug #4
+    CVE-2023-45232
+    CVSS 7.5 : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+    CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
+
+    Infinite loop when parsing unknown options in the Destination Options
+    header
+
+    PixieFail Bug #5
+    CVE-2023-45233
+    CVSS 7.5 : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+    CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
+
+    Infinite loop when parsing a PadN option in the Destination Options
+    header
+
+    Change Overview:
+
+    Most importantly this change corrects the following incorrect math
+    and cleans up the code.
+
+    >   // It is a PadN option
+    >   //
+    > - Offset = (UINT8)(Offset + *(Option + Offset + 1) + 2);
+    > + OptDataLen = ((EFI_IP6_OPTION *)(Option + Offset))->Length;
+    > + Offset     = IP6_NEXT_OPTION_OFFSET (Offset, OptDataLen);
+
+    > case Ip6OptionSkip:
+    > - Offset = (UINT8)(Offset + *(Option + Offset + 1));
+    >   OptDataLen = ((EFI_IP6_OPTION *)(Option + Offset))->Length;
+    >   Offset     = IP6_NEXT_OPTION_OFFSET (Offset, OptDataLen);
+
+    Additionally, this change also corrects incorrect math where the calling
+    function was calculating the HDR EXT optionLen as a uint8 instead of a
+    uint16
+
+    > - OptionLen = (UINT8)((*Option + 1) * 8 - 2);
+    > + OptionLen = IP6_HDR_EXT_LEN (*Option) -
+    IP6_COMBINED_SIZE_OF_NEXT_HDR_AND_LEN;
+
+    Additionally this check adds additional logic to santize the incoming
+    data
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Ip6Dxe/Ip6Nd.h     | 35 ++++++++++++++++
+ NetworkPkg/Ip6Dxe/Ip6Option.c | 76 ++++++++++++++++++++++++++++++-----
+ NetworkPkg/Ip6Dxe/Ip6Option.h | 71 ++++++++++++++++++++++++++++++++
+ 3 files changed, 171 insertions(+), 11 deletions(-)
+
+diff --git a/NetworkPkg/Ip6Dxe/Ip6Nd.h b/NetworkPkg/Ip6Dxe/Ip6Nd.h
+index 860934a167..bf64e9114e 100644
+--- a/NetworkPkg/Ip6Dxe/Ip6Nd.h
+++ b/NetworkPkg/Ip6Dxe/Ip6Nd.h
+@@ -56,13 +56,48 @@ VOID
+   VOID  *Context
+   );
+ 
+//
+// Per RFC8200 Section 4.2
+//
+//   Two of the currently-defined extension headers -- the Hop-by-Hop
+//   Options header and the Destination Options header -- carry a variable
+//   number of type-length-value (TLV) encoded "options", of the following
+//   format:
+//
+//      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - -
+//      |  Option Type  |  Opt Data Len |  Option Data
+//      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - -
+//
+//      Option Type          8-bit identifier of the type of option.
+//
+//      Opt Data Len         8-bit unsigned integer.  Length of the Option
+//                           Data field of this option, in octets.
+//
+//      Option Data          Variable-length field.  Option-Type-specific
+//                           data.
+//
+ typedef struct _IP6_OPTION_HEADER {
+  ///
+  /// identifier of the type of option.
+  ///
+   UINT8    Type;
+  ///
+  /// Length of the Option Data field of this option, in octets.
+  ///
+   UINT8    Length;
+  ///
+  /// Option-Type-specific data.
+  ///
+ } IP6_OPTION_HEADER;
+ 
+ STATIC_ASSERT (sizeof (IP6_OPTION_HEADER) == 2, "IP6_OPTION_HEADER is expected to be exactly 2 bytes long.");
+ 
+#define IP6_NEXT_OPTION_OFFSET(offset, length)  (offset + sizeof(IP6_OPTION_HEADER) + length)
+STATIC_ASSERT (
+  IP6_NEXT_OPTION_OFFSET (0, 0) == 2,
+  "The next option is minimally the combined size of the option tag and length"
+  );
+
+ typedef struct _IP6_ETHE_ADDR_OPTION {
+   UINT8    Type;
+   UINT8    Length;
+diff --git a/NetworkPkg/Ip6Dxe/Ip6Option.c b/NetworkPkg/Ip6Dxe/Ip6Option.c
+index 8718d5d875..fd97ce116f 100644
+--- a/NetworkPkg/Ip6Dxe/Ip6Option.c
+++ b/NetworkPkg/Ip6Dxe/Ip6Option.c
+@@ -17,7 +17,8 @@
+   @param[in]  IpSb              The IP6 service data.
+   @param[in]  Packet            The to be validated packet.
+   @param[in]  Option            The first byte of the option.
+-  @param[in]  OptionLen         The length of the whole option.
+  @param[in]  OptionLen         The length of all options, expressed in byte length of octets.
+                                Maximum length is 2046 bytes or ((n + 1) * 8) - 2 where n is 255.
+   @param[in]  Pointer           Identifies the octet offset within
+                                 the invoking packet where the error was detected.
+ 
+@@ -31,12 +32,33 @@ Ip6IsOptionValid (
+   IN IP6_SERVICE  *IpSb,
+   IN NET_BUF      *Packet,
+   IN UINT8        *Option,
+-  IN UINT8        OptionLen,
+  IN UINT16       OptionLen,
+   IN UINT32       Pointer
+   )
+ {
+-  UINT8  Offset;
+-  UINT8  OptionType;
+  UINT16  Offset;
+  UINT8   OptionType;
+  UINT8   OptDataLen;
+
+  if (Option == NULL) {
+    ASSERT (Option != NULL);
+    return FALSE;
+  }
+
+  if ((OptionLen <= 0) || (OptionLen > IP6_MAX_EXT_DATA_LENGTH)) {
+    ASSERT (OptionLen > 0 && OptionLen <= IP6_MAX_EXT_DATA_LENGTH);
+    return FALSE;
+  }
+
+  if (Packet == NULL) {
+    ASSERT (Packet != NULL);
+    return FALSE;
+  }
+
+  if (IpSb == NULL) {
+    ASSERT (IpSb != NULL);
+    return FALSE;
+  }
+ 
+   Offset = 0;
+ 
+@@ -54,7 +76,8 @@ Ip6IsOptionValid (
+         //
+         // It is a PadN option
+         //
+-        Offset = (UINT8)(Offset + *(Option + Offset + 1) + 2);
+        OptDataLen = ((IP6_OPTION_HEADER *)(Option + Offset))->Length;
+        Offset     = IP6_NEXT_OPTION_OFFSET (Offset, OptDataLen);
+         break;
+       case Ip6OptionRouterAlert:
+         //
+@@ -69,7 +92,8 @@ Ip6IsOptionValid (
+         //
+         switch (OptionType & Ip6OptionMask) {
+           case Ip6OptionSkip:
+-            Offset = (UINT8)(Offset + *(Option + Offset + 1));
+            OptDataLen = ((IP6_OPTION_HEADER *)(Option + Offset))->Length;
+            Offset     = IP6_NEXT_OPTION_OFFSET (Offset, OptDataLen);
+             break;
+           case Ip6OptionDiscard:
+             return FALSE;
+@@ -308,7 +332,7 @@ Ip6IsExtsValid (
+   UINT32               Pointer;
+   UINT32               Offset;
+   UINT8                *Option;
+-  UINT8                OptionLen;
+  UINT16               OptionLen;
+   BOOLEAN              Flag;
+   UINT8                CountD;
+   UINT8                CountA;
+@@ -385,6 +409,36 @@ Ip6IsExtsValid (
+       // Fall through
+       //
+       case IP6_DESTINATION:
+        //
+        // See https://www.rfc-editor.org/rfc/rfc2460#section-4.2 page 23
+        //
+        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+        // |  Next Header  |  Hdr Ext Len  |                               |
+        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
+        // |                                                               |
+        // .                                                               .
+        // .                            Options                            .
+        // .                                                               .
+        // |                                                               |
+        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+        //
+        //
+        //   Next Header    8-bit selector.  Identifies the type of header
+        //                  immediately following the Destination Options
+        //                  header.  Uses the same values as the IPv4
+        //                  Protocol field [RFC-1700 et seq.].
+        //
+        //   Hdr Ext Len    8-bit unsigned integer.  Length of the
+        //                  Destination Options header in 8-octet units, not
+        //                  including the first 8 octets.
+        //
+        //   Options        Variable-length field, of length such that the
+        //                  complete Destination Options header is an
+        //                  integer multiple of 8 octets long.  Contains one
+        //                  or  more TLV-encoded options, as described in
+        //                  section 4.2.
+        //
+
+         if (*NextHeader == IP6_DESTINATION) {
+           CountD++;
+         }
+@@ -398,7 +452,7 @@ Ip6IsExtsValid (
+ 
+         Offset++;
+         Option    = ExtHdrs + Offset;
+-        OptionLen = (UINT8)((*Option + 1) * 8 - 2);
+        OptionLen = IP6_HDR_EXT_LEN (*Option) - sizeof (IP6_EXT_HDR);
+         Option++;
+         Offset++;
+ 
+@@ -430,7 +484,7 @@ Ip6IsExtsValid (
+           //
+           // Ignore the routing header and proceed to process the next header.
+           //
+-          Offset = Offset + (RoutingHead->HeaderLen + 1) * 8;
+          Offset = Offset + IP6_HDR_EXT_LEN (RoutingHead->HeaderLen);
+ 
+           if (UnFragmentLen != NULL) {
+             *UnFragmentLen = Offset;
+@@ -441,7 +495,7 @@ Ip6IsExtsValid (
+           // to the packet's source address, pointing to the unrecognized routing
+           // type.
+           //
+-          Pointer = Offset + 2 + sizeof (EFI_IP6_HEADER);
+          Pointer = Offset + sizeof (IP6_EXT_HDR) + sizeof (EFI_IP6_HEADER);
+           if ((IpSb != NULL) && (Packet != NULL) &&
+               !IP6_IS_MULTICAST (&Packet->Ip.Ip6->DestinationAddress))
+           {
+@@ -527,7 +581,7 @@ Ip6IsExtsValid (
+         //
+         // RFC2402, Payload length is specified in 32-bit words, minus "2".
+         //
+-        OptionLen = (UINT8)((*Option + 2) * 4);
+        OptionLen = ((UINT16)(*Option + 2) * 4);
+         Offset    = Offset + OptionLen;
+         break;
+ 
+diff --git a/NetworkPkg/Ip6Dxe/Ip6Option.h b/NetworkPkg/Ip6Dxe/Ip6Option.h
+index bd8e223c8a..fb07c28f5a 100644
+--- a/NetworkPkg/Ip6Dxe/Ip6Option.h
+++ b/NetworkPkg/Ip6Dxe/Ip6Option.h
+@@ -12,6 +12,77 @@
+ 
+ #define IP6_FRAGMENT_OFFSET_MASK  (~0x3)
+ 
+//
+// For more information see RFC 8200, Section 4.3, 4.4, and 4.6
+//
+//  This example format is from section 4.6
+//  This does not apply to fragment headers
+//
+//     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//    |  Next Header  |  Hdr Ext Len  |                               |
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
+//    |                                                               |
+//    .                                                               .
+//    .                  Header-Specific Data                         .
+//    .                                                               .
+//    |                                                               |
+//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+//
+//      Next Header           8-bit selector.  Identifies the type of
+//                            header immediately following the extension
+//                            header.  Uses the same values as the IPv4
+//                            Protocol field [IANA-PN].
+//
+//      Hdr Ext Len           8-bit unsigned integer.  Length of the
+//                            Destination Options header in 8-octet units,
+//                            not including the first 8 octets.
+
+//
+// These defines apply to the following:
+//   1. Hop by Hop
+//   2. Routing
+//   3. Destination
+//
+typedef struct _IP6_EXT_HDR {
+  ///
+  /// The Next Header field identifies the type of header immediately
+  ///
+  UINT8    NextHeader;
+  ///
+  /// The Hdr Ext Len field specifies the length of the Hop-by-Hop Options
+  ///
+  UINT8    HdrExtLen;
+  ///
+  /// Header-Specific Data
+  ///
+} IP6_EXT_HDR;
+
+STATIC_ASSERT (
+  sizeof (IP6_EXT_HDR) == 2,
+  "The combined size of Next Header and Len is two 8 bit fields"
+  );
+
+//
+// IPv6 extension headers contain an 8-bit length field which describes the size of
+// the header. However, the length field only includes the size of the extension
+// header options, not the size of the first 8 bytes of the header. Therefore, in
+// order to calculate the full size of the extension header, we add 1 (to account
+// for the first 8 bytes omitted by the length field reporting) and then multiply
+// by 8 (since the size is represented in 8-byte units).
+//
+// a is the length field of the extension header (UINT8)
+// The result may be up to 2046 octets (UINT16)
+//
+#define IP6_HDR_EXT_LEN(a)  (((UINT16)((UINT8)(a)) + 1) * 8)
+
+// This is the maxmimum length permissible by a extension header
+// Length is UINT8 of 8 octets not including the first 8 octets
+#define IP6_MAX_EXT_DATA_LENGTH  (IP6_HDR_EXT_LEN (MAX_UINT8) - sizeof(IP6_EXT_HDR))
+STATIC_ASSERT (
+  IP6_MAX_EXT_DATA_LENGTH == 2046,
+  "Maximum data length is ((MAX_UINT8 + 1) * 8) - 2"
+  );
+
+ typedef struct _IP6_FRAGMENT_HEADER {
+   UINT8     NextHeader;
+   UINT8     Reserved;
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch
+++ b/SOURCES/edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch
@ -0,0 +1,430 @@
+From 2bd8bc051f6394f2ab3c22649c54ecbed5d636cd Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 14 Feb 2024 20:25:29 -0500
+Subject: [PATCH 05/15] NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45232 Unit
+ Tests
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
+RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [5/15] 624365d403df25927ab0514b0e25faea7376def8
+
+JIRA: https://issues.redhat.com/browse/RHEL-21846
+CVE: CVE-2022-45232
+Upstream: Merged
+
+commit c9c87f08dd6ace36fa843424522c3558a8374cac
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:51 2024 +0800
+
+    NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45232 Unit Tests
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4537
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4538
+
+    Unit tests to confirm that..
+    Infinite loop when parsing unknown options in the Destination Options
+    header
+
+    and
+
+    Infinite loop when parsing a PadN option in the Destination Options
+    header
+
+    ... have been patched
+
+    This patch tests the following functions:
+    Ip6IsOptionValid
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf    |  10 +-
+ .../Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp | 278 ++++++++++++++++++
+ .../Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.h   |  40 +++
+ 3 files changed, 324 insertions(+), 4 deletions(-)
+ create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.h
+
+diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+index 6e4de0745f..ba29dbabad 100644
+--- a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+@@ -1,13 +1,13 @@
+ ## @file
+-# Unit test suite for the Ip6Dxe using Google Test
+# Unit test suite for the Ip6DxeGoogleTest using Google Test
+ #
+ # Copyright (c) Microsoft Corporation.<BR>
+ # SPDX-License-Identifier: BSD-2-Clause-Patent
+ ##
+ [Defines]
+   INF_VERSION         = 0x00010017
+-  BASE_NAME           = Ip6DxeUnitTest
+-  FILE_GUID           = 4F05D17D-D3E7-4AAE-820C-576D46D2D34A
+  BASE_NAME           = Ip6DxeGoogleTest
+  FILE_GUID           = AE39981C-B7FE-41A8-A9C2-F41910477CA3
+   VERSION_STRING      = 1.0
+   MODULE_TYPE         = HOST_APPLICATION
+ #
+@@ -16,9 +16,11 @@
+ #  VALID_ARCHITECTURES           = IA32 X64 AARCH64
+ #
+ [Sources]
+  ../Ip6Option.c
+  Ip6OptionGoogleTest.h
+   Ip6DxeGoogleTest.cpp
+   Ip6OptionGoogleTest.cpp
+-  ../Ip6Option.c
+  Ip6OptionGoogleTest.h
+ 
+ [Packages]
+   MdePkg/MdePkg.dec
+diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
+index f2cd90e1a9..29f8a4a96e 100644
+--- a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
+++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
+@@ -12,6 +12,7 @@ extern "C" {
+   #include <Library/DebugLib.h>
+   #include "../Ip6Impl.h"
+   #include "../Ip6Option.h"
+  #include "Ip6OptionGoogleTest.h"
+ }
+ 
+ /////////////////////////////////////////////////////////////////////////
+@@ -127,3 +128,280 @@ TEST_F (Ip6OptionValidationTest, InvalidPrefixInfoOptionLengthShouldReturnFalse)
+ 
+   EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
+ }
+
+////////////////////////////////////////////////////////////////////////
+// Ip6IsOptionValid Tests
+////////////////////////////////////////////////////////////////////////
+
+// Define a fixture for your tests if needed
+class Ip6IsOptionValidTest : public ::testing::Test {
+protected:
+  // Add any setup code if needed
+  virtual void
+  SetUp (
+    )
+  {
+    // Initialize any resources or variables
+  }
+
+  // Add any cleanup code if needed
+  virtual void
+  TearDown (
+    )
+  {
+    // Clean up any resources or variables
+  }
+};
+
+// Test Description
+// Verify that a NULL option is Invalid
+TEST_F (Ip6IsOptionValidTest, NullOptionShouldReturnTrue) {
+  NET_BUF  Packet = { 0 };
+  // we need to define enough of the packet to make the function work
+  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
+  IP6_SERVICE  *IpSb = NULL;
+
+  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IP6_HEADER    Ip6Header          = { 0 };
+
+  Ip6Header.SourceAddress      = SourceAddress;
+  Ip6Header.DestinationAddress = DestinationAddress;
+  Packet.Ip.Ip6                = &Ip6Header;
+
+  EXPECT_FALSE (Ip6IsOptionValid (IpSb, &Packet, NULL, 0, 0));
+}
+
+// Test Description
+// Verify that an unknown option with a length of 0 and type of <unknown> does not cause an infinite loop
+TEST_F (Ip6IsOptionValidTest, VerifyNoInfiniteLoopOnUnknownOptionLength0) {
+  NET_BUF  Packet = { 0 };
+  // we need to define enough of the packet to make the function work
+  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
+  UINT32  DeadCode = 0xDeadC0de;
+  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
+  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
+
+  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IP6_HEADER    Ip6Header          = { 0 };
+
+  Ip6Header.SourceAddress      = SourceAddress;
+  Ip6Header.DestinationAddress = DestinationAddress;
+  Packet.Ip.Ip6                = &Ip6Header;
+
+  IP6_OPTION_HEADER  optionHeader;
+
+  optionHeader.Type   = 23;   // Unknown Option
+  optionHeader.Length = 0;    // This will cause an infinite loop if the function is not working correctly
+
+  // This should be a valid option even though the length is 0
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
+}
+
+// Test Description
+// Verify that an unknown option with a length of 1 and type of <unknown> does not cause an infinite loop
+TEST_F (Ip6IsOptionValidTest, VerifyNoInfiniteLoopOnUnknownOptionLength1) {
+  NET_BUF  Packet = { 0 };
+  // we need to define enough of the packet to make the function work
+  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
+  UINT32  DeadCode = 0xDeadC0de;
+  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
+  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
+
+  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IP6_HEADER    Ip6Header          = { 0 };
+
+  Ip6Header.SourceAddress      = SourceAddress;
+  Ip6Header.DestinationAddress = DestinationAddress;
+  Packet.Ip.Ip6                = &Ip6Header;
+
+  IP6_OPTION_HEADER  optionHeader;
+
+  optionHeader.Type   = 23;   // Unknown Option
+  optionHeader.Length = 1;    // This will cause an infinite loop if the function is not working correctly
+
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
+}
+
+// Test Description
+// Verify that an unknown option with a length of 2 and type of <unknown> does not cause an infinite loop
+TEST_F (Ip6IsOptionValidTest, VerifyIpSkipUnknownOption) {
+  NET_BUF  Packet = { 0 };
+  // we need to define enough of the packet to make the function work
+  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
+  UINT32  DeadCode = 0xDeadC0de;
+  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
+  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
+
+  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IP6_HEADER    Ip6Header          = { 0 };
+
+  Ip6Header.SourceAddress      = SourceAddress;
+  Ip6Header.DestinationAddress = DestinationAddress;
+  Packet.Ip.Ip6                = &Ip6Header;
+
+  IP6_OPTION_HEADER  optionHeader;
+
+  optionHeader.Type   = 23;   // Unknown Option
+  optionHeader.Length = 2;    // Valid length for an unknown option
+
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
+}
+
+// Test Description
+// Verify that Ip6OptionPad1 is valid with a length of 0
+TEST_F (Ip6IsOptionValidTest, VerifyIp6OptionPad1) {
+  NET_BUF  Packet = { 0 };
+  // we need to define enough of the packet to make the function work
+  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
+  UINT32  DeadCode = 0xDeadC0de;
+  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
+  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
+
+  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IP6_HEADER    Ip6Header          = { 0 };
+
+  Ip6Header.SourceAddress      = SourceAddress;
+  Ip6Header.DestinationAddress = DestinationAddress;
+  Packet.Ip.Ip6                = &Ip6Header;
+
+  IP6_OPTION_HEADER  optionHeader;
+
+  optionHeader.Type   = Ip6OptionPad1;
+  optionHeader.Length = 0;
+
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
+}
+
+// Test Description
+// Verify that Ip6OptionPadN doesn't overflow with various lengths
+TEST_F (Ip6IsOptionValidTest, VerifyIp6OptionPadN) {
+  NET_BUF  Packet = { 0 };
+  // we need to define enough of the packet to make the function work
+  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
+  UINT32  DeadCode = 0xDeadC0de;
+  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
+  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
+
+  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IP6_HEADER    Ip6Header          = { 0 };
+
+  Ip6Header.SourceAddress      = SourceAddress;
+  Ip6Header.DestinationAddress = DestinationAddress;
+  Packet.Ip.Ip6                = &Ip6Header;
+
+  IP6_OPTION_HEADER  optionHeader;
+
+  optionHeader.Type   = Ip6OptionPadN;
+  optionHeader.Length = 0xFF;
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
+
+  optionHeader.Length = 0xFE;
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
+
+  optionHeader.Length = 0xFD;
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
+
+  optionHeader.Length = 0xFC;
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
+}
+
+// Test Description
+// Verify an unknown option doesn't cause an infinite loop with various lengths
+TEST_F (Ip6IsOptionValidTest, VerifyNoInfiniteLoopOnUnknownOptionLengthAttemptOverflow) {
+  NET_BUF  Packet = { 0 };
+  // we need to define enough of the packet to make the function work
+  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
+  UINT32  DeadCode = 0xDeadC0de;
+  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
+  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
+
+  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IP6_HEADER    Ip6Header          = { 0 };
+
+  Ip6Header.SourceAddress      = SourceAddress;
+  Ip6Header.DestinationAddress = DestinationAddress;
+  Packet.Ip.Ip6                = &Ip6Header;
+
+  IP6_OPTION_HEADER  optionHeader;
+
+  optionHeader.Type   = 23;   // Unknown Option
+  optionHeader.Length = 0xFF;
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
+
+  optionHeader.Length = 0xFE;
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
+
+  optionHeader.Length = 0xFD;
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
+
+  optionHeader.Length = 0xFC;
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
+}
+
+// Test Description
+// Verify that the function supports multiple options
+TEST_F (Ip6IsOptionValidTest, MultiOptionSupport) {
+  UINT16   HdrLen;
+  NET_BUF  Packet = { 0 };
+  // we need to define enough of the packet to make the function work
+  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
+  UINT32  DeadCode = 0xDeadC0de;
+  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
+  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
+
+  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
+  EFI_IP6_HEADER    Ip6Header          = { 0 };
+
+  Ip6Header.SourceAddress      = SourceAddress;
+  Ip6Header.DestinationAddress = DestinationAddress;
+  Packet.Ip.Ip6                = &Ip6Header;
+
+  UINT8              ExtHdr[1024] = { 0 };
+  UINT8              *Cursor      = ExtHdr;
+  IP6_OPTION_HEADER  *Option      = (IP6_OPTION_HEADER *)ExtHdr;
+
+  // Let's start chaining options
+
+  Option->Type   = 23;   // Unknown Option
+  Option->Length = 0xFC;
+
+  Cursor += sizeof (IP6_OPTION_HEADER) + 0xFC;
+
+  Option       = (IP6_OPTION_HEADER *)Cursor;
+  Option->Type = Ip6OptionPad1;
+
+  Cursor += sizeof (1);
+
+  // Type and length aren't processed, instead it just moves the pointer forward by 4 bytes
+  Option         = (IP6_OPTION_HEADER *)Cursor;
+  Option->Type   = Ip6OptionRouterAlert;
+  Option->Length = 4;
+
+  Cursor += sizeof (IP6_OPTION_HEADER) + 4;
+
+  Option         = (IP6_OPTION_HEADER *)Cursor;
+  Option->Type   = Ip6OptionPadN;
+  Option->Length = 0xFC;
+
+  Cursor += sizeof (IP6_OPTION_HEADER) + 0xFC;
+
+  Option         = (IP6_OPTION_HEADER *)Cursor;
+  Option->Type   = Ip6OptionRouterAlert;
+  Option->Length = 4;
+
+  Cursor += sizeof (IP6_OPTION_HEADER) + 4;
+
+  // Total 524
+
+  HdrLen = (UINT16)(Cursor - ExtHdr);
+
+  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, ExtHdr, HdrLen, 0));
+}
+diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.h b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.h
+new file mode 100644
+index 0000000000..0509b6ae30
+--- /dev/null
+++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.h
+@@ -0,0 +1,40 @@
+/** @file
+  Exposes the functions needed to test the Ip6Option module.
+
+  Copyright (c) Microsoft Corporation
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef IP6_OPTION_HEADER_GOOGLE_TEST_H_
+#define IP6_OPTION_HEADER_GOOGLE_TEST_H_
+
+#include <Uefi.h>
+#include "../Ip6Impl.h"
+
+/**
+  Validate the IP6 option format for both the packets we received
+  and that we will transmit. It will compute the ICMPv6 error message fields
+  if the option is malformatted.
+
+  @param[in]  IpSb              The IP6 service data.
+  @param[in]  Packet            The to be validated packet.
+  @param[in]  Option            The first byte of the option.
+  @param[in]  OptionLen         The length of the whole option.
+  @param[in]  Pointer           Identifies the octet offset within
+                                the invoking packet where the error was detected.
+
+
+  @retval TRUE     The option is properly formatted.
+  @retval FALSE    The option is malformatted.
+
+**/
+BOOLEAN
+Ip6IsOptionValid (
+  IN IP6_SERVICE  *IpSb,
+  IN NET_BUF      *Packet,
+  IN UINT8        *Option,
+  IN UINT16       OptionLen,
+  IN UINT32       Pointer
+  );
+
+#endif // __IP6_OPTION_HEADER_GOOGLE_TEST_H__
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch
+++ b/SOURCES/edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch
--- a/SOURCES/edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch
+++ b/SOURCES/edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch
@ -0,0 +1,74 @@
+From 6eceae607639b46ea46ba26a288270bd1c97dc0f Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 13 Jun 2024 18:35:46 -0400
+Subject: [PATCH 31/31] NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow
+ in iPXE environment
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [31/31] 2088a79fef3d6dfec032f2f560ccf87ae42d786f
+
+JIRA: https://issues.redhat.com/browse/RHEL-21854
+Upstream: Merged
+CVE: CVE-2023-45236
+
+commit ced13b93afea87a8a1fe6ddbb67240a84cb2e3d3
+Author: Sam <Sam_Tsai@wiwynn.com>
+Date:   Wed May 29 07:46:03 2024 +0800
+
+    NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow in iPXE environment
+
+    This bug fix is based on the following commit "NetworkPkg TcpDxe: SECURITY PATCH"
+    REF: 1904a64
+
+    Issue Description:
+    An "Invalid handle" error was detected during runtime when attempting to destroy a child instance of the hashing protocol. The problematic code segment was:
+
+    NetworkPkg\TcpDxe\TcpDriver.c
+    Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, &mHash2ServiceHandle);
+
+    Root Cause Analysis:
+    The root cause of the error was the passing of an incorrect parameter type, a pointer to an EFI_HANDLE instead of an EFI_HANDLE itself, to the DestroyChild function. This mismatch resulted in the function receiving an invalid handle.
+
+    Implemented Solution:
+    To resolve this issue, the function call was corrected to pass mHash2ServiceHandle directly:
+
+    NetworkPkg\TcpDxe\TcpDriver.c
+    Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, mHash2ServiceHandle);
+
+    This modification ensures the correct handle type is used, effectively rectifying the "Invalid handle" error.
+
+    Verification:
+    Testing has been conducted, confirming the efficacy of the fix. Additionally, the BIOS can boot into the OS in an iPXE environment.
+
+    Cc: Doug Flick [MSFT] <doug.edk2@gmail.com>
+
+    Signed-off-by: Sam Tsai [Wiwynn] <sam_tsai@wiwynn.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/TcpDxe/TcpDriver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/NetworkPkg/TcpDxe/TcpDriver.c b/NetworkPkg/TcpDxe/TcpDriver.c
+index 34ae838ae0..1aec292501 100644
+--- a/NetworkPkg/TcpDxe/TcpDriver.c
+++ b/NetworkPkg/TcpDxe/TcpDriver.c
+@@ -509,7 +509,7 @@ TcpDestroyService (
+     //
+     // Destroy the instance of the hashing protocol for this controller.
+     //
+-    Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, &mHash2ServiceHandle);
+    Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, mHash2ServiceHandle);
+     if (EFI_ERROR (Status)) {
+       return EFI_UNSUPPORTED;
+     }
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch
+++ b/SOURCES/edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch
@ -0,0 +1,808 @@
+From 1e7f4034ddc0896e16c981d4220a1178813b4e86 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 11 Jun 2024 15:20:29 -0400
+Subject: [PATCH 30/31] NetworkPkg TcpDxe: SECURITY PATCH CVE-2023-45236
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [30/31] 9ae15a2abf1d9bd0a0df1ff73a88446b9eb33602
+
+JIRA: https://issues.redhat.com/browse/RHEL-21854
+Upstream: Merged
+CVE: CVE-2023-45236
+Conflicts: Didn't add new file NetworkPkg/SecurityFixes.yaml
+
+commit 1904a64bcc18199738e5be183d28887ac5d837d7
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Wed May 8 22:56:29 2024 -0700
+
+    NetworkPkg TcpDxe: SECURITY PATCH CVE-2023-45236
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4541
+    REF: https://www.rfc-editor.org/rfc/rfc1948.txt
+    REF: https://www.rfc-editor.org/rfc/rfc6528.txt
+    REF: https://www.rfc-editor.org/rfc/rfc9293.txt
+
+    Bug Overview:
+    PixieFail Bug #8
+    CVE-2023-45236
+    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
+    CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
+
+    Updates TCP ISN generation to use a cryptographic hash of the
+    connection's identifying parameters and a secret key.
+    This prevents an attacker from guessing the ISN used for some other
+    connection.
+
+    This is follows the guidance in RFC 1948, RFC 6528, and RFC 9293.
+
+    RFC: 9293 Section 3.4.1.  Initial Sequence Number Selection
+
+       A TCP implementation MUST use the above type of "clock" for clock-
+       driven selection of initial sequence numbers (MUST-8), and SHOULD
+       generate its initial sequence numbers with the expression:
+
+       ISN = M + F(localip, localport, remoteip, remoteport, secretkey)
+
+       where M is the 4 microsecond timer, and F() is a pseudorandom
+       function (PRF) of the connection's identifying parameters ("localip,
+       localport, remoteip, remoteport") and a secret key ("secretkey")
+       (SHLD-1).  F() MUST NOT be computable from the outside (MUST-9), or
+       an attacker could still guess at sequence numbers from the ISN used
+       for some other connection.  The PRF could be implemented as a
+       cryptographic hash of the concatenation of the TCP connection
+       parameters and some secret data.  For discussion of the selection of
+       a specific hash algorithm and management of the secret key data,
+       please see Section 3 of [42].
+
+       For each connection there is a send sequence number and a receive
+       sequence number.  The initial send sequence number (ISS) is chosen by
+       the data sending TCP peer, and the initial receive sequence number
+       (IRS) is learned during the connection-establishing procedure.
+
+       For a connection to be established or initialized, the two TCP peers
+       must synchronize on each other's initial sequence numbers.  This is
+       done in an exchange of connection-establishing segments carrying a
+       control bit called "SYN" (for synchronize) and the initial sequence
+       numbers.  As a shorthand, segments carrying the SYN bit are also
+       called "SYNs".  Hence, the solution requires a suitable mechanism for
+       picking an initial sequence number and a slightly involved handshake
+       to exchange the ISNs.
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/TcpDxe/TcpDriver.c |  92 ++++++++++++-
+ NetworkPkg/TcpDxe/TcpDxe.inf  |   8 +-
+ NetworkPkg/TcpDxe/TcpFunc.h   |  23 ++--
+ NetworkPkg/TcpDxe/TcpInput.c  |  13 +-
+ NetworkPkg/TcpDxe/TcpMain.h   |  59 ++++++--
+ NetworkPkg/TcpDxe/TcpMisc.c   | 244 ++++++++++++++++++++++++++++++++--
+ NetworkPkg/TcpDxe/TcpTimer.c  |   3 +-
+ 7 files changed, 394 insertions(+), 48 deletions(-)
+
+diff --git a/NetworkPkg/TcpDxe/TcpDriver.c b/NetworkPkg/TcpDxe/TcpDriver.c
+index 430911c2f4..34ae838ae0 100644
+--- a/NetworkPkg/TcpDxe/TcpDriver.c
+++ b/NetworkPkg/TcpDxe/TcpDriver.c
+@@ -83,6 +83,12 @@ EFI_SERVICE_BINDING_PROTOCOL  gTcpServiceBinding = {
+   TcpServiceBindingDestroyChild
+ };
+ 
+//
+// This is the handle for the Hash2ServiceBinding Protocol instance this driver produces
+// if the platform does not provide one.
+//
+EFI_HANDLE  mHash2ServiceHandle = NULL;
+
+ /**
+   Create and start the heartbeat timer for the TCP driver.
+ 
+@@ -165,6 +171,23 @@ TcpDriverEntryPoint (
+   EFI_STATUS  Status;
+   UINT32      Random;
+ 
+  //
+  // Initialize the Secret used for hashing TCP sequence numbers
+  //
+  // Normally this should be regenerated periodically, but since
+  // this is only used for UEFI networking and not a general purpose
+  // operating system, it is not necessary to regenerate it.
+  //
+  Status = PseudoRandomU32 (&mTcpGlobalSecret);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
+    return Status;
+  }
+
+  //
+  // Get a random number used to generate a random port number
+  // Intentionally not linking this to mTcpGlobalSecret to avoid leaking information about the secret
+  //
+   Status = PseudoRandomU32 (&Random);
+   if (EFI_ERROR (Status)) {
+     DEBUG ((DEBUG_ERROR, "%a Failed to generate random number: %r\n", __func__, Status));
+@@ -207,9 +230,8 @@ TcpDriverEntryPoint (
+   }
+ 
+   //
+-  // Initialize ISS and random port.
+  // Initialize the random port.
+   //
+-  mTcpGlobalIss   = Random % mTcpGlobalIss;
+   mTcp4RandomPort = (UINT16)(TCP_PORT_KNOWN + (Random % TCP_PORT_KNOWN));
+   mTcp6RandomPort = mTcp4RandomPort;
+ 
+@@ -224,6 +246,8 @@ TcpDriverEntryPoint (
+   @param[in]  IpVersion          IP_VERSION_4 or IP_VERSION_6.
+ 
+   @retval EFI_OUT_OF_RESOURCES   Failed to allocate some resources.
+  @retval EFI_UNSUPPORTED        Service Binding Protocols are unavailable.
+  @retval EFI_ALREADY_STARTED    The TCP driver is already started on the controller.
+   @retval EFI_SUCCESS            A new IP6 service binding private was created.
+ 
+ **/
+@@ -234,11 +258,13 @@ TcpCreateService (
+   IN UINT8       IpVersion
+   )
+ {
+-  EFI_STATUS        Status;
+-  EFI_GUID          *IpServiceBindingGuid;
+-  EFI_GUID          *TcpServiceBindingGuid;
+-  TCP_SERVICE_DATA  *TcpServiceData;
+-  IP_IO_OPEN_DATA   OpenData;
+  EFI_STATUS                    Status;
+  EFI_GUID                      *IpServiceBindingGuid;
+  EFI_GUID                      *TcpServiceBindingGuid;
+  TCP_SERVICE_DATA              *TcpServiceData;
+  IP_IO_OPEN_DATA               OpenData;
+  EFI_SERVICE_BINDING_PROTOCOL  *Hash2ServiceBinding;
+  EFI_HASH2_PROTOCOL            *Hash2Protocol;
+ 
+   if (IpVersion == IP_VERSION_4) {
+     IpServiceBindingGuid  = &gEfiIp4ServiceBindingProtocolGuid;
+@@ -272,6 +298,33 @@ TcpCreateService (
+     return EFI_UNSUPPORTED;
+   }
+ 
+  Status = gBS->LocateProtocol (&gEfiHash2ProtocolGuid, NULL, (VOID **)&Hash2Protocol);
+  if (EFI_ERROR (Status)) {
+    //
+    // If we can't find the Hashing protocol, then we need to create one.
+    //
+
+    //
+    // Platform is expected to publish the hash service binding protocol to support TCP.
+    //
+    Status = gBS->LocateProtocol (
+                    &gEfiHash2ServiceBindingProtocolGuid,
+                    NULL,
+                    (VOID **)&Hash2ServiceBinding
+                    );
+    if (EFI_ERROR (Status) || (Hash2ServiceBinding == NULL) || (Hash2ServiceBinding->CreateChild == NULL)) {
+      return EFI_UNSUPPORTED;
+    }
+
+    //
+    // Create an instance of the hash protocol for this controller.
+    //
+    Status = Hash2ServiceBinding->CreateChild (Hash2ServiceBinding, &mHash2ServiceHandle);
+    if (EFI_ERROR (Status)) {
+      return EFI_UNSUPPORTED;
+    }
+  }
+
+   //
+   // Create the TCP service data.
+   //
+@@ -423,6 +476,7 @@ TcpDestroyService (
+   EFI_STATUS                               Status;
+   LIST_ENTRY                               *List;
+   TCP_DESTROY_CHILD_IN_HANDLE_BUF_CONTEXT  Context;
+  EFI_SERVICE_BINDING_PROTOCOL             *Hash2ServiceBinding;
+ 
+   ASSERT ((IpVersion == IP_VERSION_4) || (IpVersion == IP_VERSION_6));
+ 
+@@ -439,6 +493,30 @@ TcpDestroyService (
+     return EFI_SUCCESS;
+   }
+ 
+  //
+  // Destroy the Hash2ServiceBinding instance if it is created by Tcp driver.
+  //
+  if (mHash2ServiceHandle != NULL) {
+    Status = gBS->LocateProtocol (
+                    &gEfiHash2ServiceBindingProtocolGuid,
+                    NULL,
+                    (VOID **)&Hash2ServiceBinding
+                    );
+    if (EFI_ERROR (Status) || (Hash2ServiceBinding == NULL) || (Hash2ServiceBinding->DestroyChild == NULL)) {
+      return EFI_UNSUPPORTED;
+    }
+
+    //
+    // Destroy the instance of the hashing protocol for this controller.
+    //
+    Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, &mHash2ServiceHandle);
+    if (EFI_ERROR (Status)) {
+      return EFI_UNSUPPORTED;
+    }
+
+    mHash2ServiceHandle = NULL;
+  }
+
+   Status = gBS->OpenProtocol (
+                   NicHandle,
+                   ServiceBindingGuid,
+diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf b/NetworkPkg/TcpDxe/TcpDxe.inf
+index cf5423f4c5..76de4cf9ec 100644
+--- a/NetworkPkg/TcpDxe/TcpDxe.inf
+++ b/NetworkPkg/TcpDxe/TcpDxe.inf
+@@ -6,6 +6,7 @@
+ #  stack has been loaded in system. This driver supports both IPv4 and IPv6 network stack.
+ #
+ #  Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+#  Copyright (c) Microsoft Corporation
+ #
+ #  SPDX-License-Identifier: BSD-2-Clause-Patent
+ #
+@@ -68,7 +69,6 @@
+   NetLib
+   IpIoLib
+ 
+-
+ [Protocols]
+   ## SOMETIMES_CONSUMES
+   ## SOMETIMES_PRODUCES
+@@ -81,6 +81,12 @@
+   gEfiIp6ServiceBindingProtocolGuid             ## TO_START
+   gEfiTcp6ProtocolGuid                          ## BY_START
+   gEfiTcp6ServiceBindingProtocolGuid            ## BY_START
+  gEfiHash2ProtocolGuid                         ## BY_START
+  gEfiHash2ServiceBindingProtocolGuid           ## BY_START
+
+[Guids]
+  gEfiHashAlgorithmMD5Guid                      ## CONSUMES
+  gEfiHashAlgorithmSha256Guid                   ## CONSUMES
+ 
+ [Depex]
+   gEfiHash2ServiceBindingProtocolGuid
+diff --git a/NetworkPkg/TcpDxe/TcpFunc.h b/NetworkPkg/TcpDxe/TcpFunc.h
+index 05cd3c75dc..e578b8bb29 100644
+--- a/NetworkPkg/TcpDxe/TcpFunc.h
+++ b/NetworkPkg/TcpDxe/TcpFunc.h
+@@ -2,7 +2,7 @@
+   Declaration of external functions shared in TCP driver.
+ 
+   Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+-
+  Copyright (c) Microsoft Corporation
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+@@ -36,8 +36,11 @@ VOID
+ 
+   @param[in, out]  Tcb               Pointer to the TCP_CB of this TCP instance.
+ 
+  @retval EFI_SUCCESS             The operation completed successfully
+  @retval others                  The underlying functions failed and could not complete the operation
+
+ **/
+-VOID
+EFI_STATUS
+ TcpInitTcbLocal (
+   IN OUT TCP_CB *Tcb
+   );
+@@ -128,17 +131,6 @@ TcpCloneTcb (
+   IN TCP_CB *Tcb
+   );
+ 
+-/**
+-  Compute an ISS to be used by a new connection.
+-
+-  @return The result ISS.
+-
+-**/
+-TCP_SEQNO
+-TcpGetIss (
+-  VOID
+-  );
+-
+ /**
+   Get the local mss.
+ 
+@@ -202,8 +194,11 @@ TcpFormatNetbuf (
+   @param[in, out]  Tcb          Pointer to the TCP_CB that wants to initiate a
+                                 connection.
+ 
+  @retval EFI_SUCCESS             The operation completed successfully
+  @retval others                  The underlying functions failed and could not complete the operation
+
+ **/
+-VOID
+EFI_STATUS
+ TcpOnAppConnect (
+   IN OUT TCP_CB  *Tcb
+   );
+diff --git a/NetworkPkg/TcpDxe/TcpInput.c b/NetworkPkg/TcpDxe/TcpInput.c
+index 5e6c8c54ca..c0656ccd7d 100644
+--- a/NetworkPkg/TcpDxe/TcpInput.c
+++ b/NetworkPkg/TcpDxe/TcpInput.c
+@@ -759,6 +759,7 @@ TcpInput (
+   TCP_SEQNO   Urg;
+   UINT16      Checksum;
+   INT32       Usable;
+  EFI_STATUS  Status;
+ 
+   ASSERT ((Version == IP_VERSION_4) || (Version == IP_VERSION_6));
+ 
+@@ -908,7 +909,17 @@ TcpInput (
+       Tcb->LocalEnd.Port  = Head->DstPort;
+       Tcb->RemoteEnd.Port = Head->SrcPort;
+ 
+-      TcpInitTcbLocal (Tcb);
+      Status = TcpInitTcbLocal (Tcb);
+      if (EFI_ERROR (Status)) {
+        DEBUG (
+          (DEBUG_ERROR,
+           "TcpInput: discard a segment because failed to init local end for TCB %p\n",
+           Tcb)
+          );
+
+        goto DISCARD;
+      }
+
+       TcpInitTcbPeer (Tcb, Seg, &Option);
+ 
+       TcpSetState (Tcb, TCP_SYN_RCVD);
+diff --git a/NetworkPkg/TcpDxe/TcpMain.h b/NetworkPkg/TcpDxe/TcpMain.h
+index 0709298bbf..3fa572d3d4 100644
+--- a/NetworkPkg/TcpDxe/TcpMain.h
+++ b/NetworkPkg/TcpDxe/TcpMain.h
+@@ -3,6 +3,7 @@
+   It is the common head file for all Tcp*.c in TCP driver.
+ 
+   Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) Microsoft Corporation
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+@@ -12,6 +13,7 @@
+ 
+ #include <Protocol/ServiceBinding.h>
+ #include <Protocol/DriverBinding.h>
+#include <Protocol/Hash2.h>
+ #include <Library/IpIoLib.h>
+ #include <Library/DevicePathLib.h>
+ #include <Library/PrintLib.h>
+@@ -30,7 +32,7 @@ extern EFI_UNICODE_STRING_TABLE      *gTcpControllerNameTable;
+ 
+ extern LIST_ENTRY  mTcpRunQue;
+ extern LIST_ENTRY  mTcpListenQue;
+-extern TCP_SEQNO   mTcpGlobalIss;
+extern TCP_SEQNO   mTcpGlobalSecret;
+ extern UINT32      mTcpTick;
+ 
+ ///
+@@ -44,15 +46,6 @@ extern UINT32      mTcpTick;
+ 
+ #define TCP_EXPIRE_TIME            65535
+ 
+-///
+-/// The implementation selects the initial send sequence number and the unit to
+-/// be added when it is increased.
+-///
+-#define TCP_BASE_ISS               0x4d7e980b
+-#define TCP_ISS_INCREMENT_1        2048
+-#define TCP_ISS_INCREMENT_2        100
+-
+-
+ typedef union {
+   EFI_TCP4_CONFIG_DATA    Tcp4CfgData;
+   EFI_TCP6_CONFIG_DATA    Tcp6CfgData;
+@@ -774,4 +767,50 @@ Tcp6Poll (
+   IN EFI_TCP6_PROTOCOL  *This
+   );
+ 
+/**
+  Retrieves the Initial Sequence Number (ISN) for a TCP connection identified by local
+  and remote IP addresses and ports.
+
+  This method is based on https://datatracker.ietf.org/doc/html/rfc9293#section-3.4.1
+  Where the ISN is computed as follows:
+    ISN = TimeStamp + MD5(LocalIP, LocalPort, RemoteIP, RemotePort, Secret)
+
+  Otherwise:
+    ISN = M + F(localip, localport, remoteip, remoteport, secretkey)
+
+    "Here M is the 4 microsecond timer, and F() is a pseudorandom function (PRF) of the
+    connection's identifying parameters ("localip, localport, remoteip, remoteport")
+    and a secret key ("secretkey") (SHLD-1). F() MUST NOT be computable from the
+    outside (MUST-9), or an attacker could still guess at sequence numbers from the
+    ISN used for some other connection. The PRF could be implemented as a
+    cryptographic hash of the concatenation of the TCP connection parameters and some
+    secret data. For discussion of the selection of a specific hash algorithm and
+    management of the secret key data."
+
+  @param[in]       LocalIp        A pointer to the local IP address of the TCP connection.
+  @param[in]       LocalIpSize    The size, in bytes, of the LocalIp buffer.
+  @param[in]       LocalPort      The local port number of the TCP connection.
+  @param[in]       RemoteIp       A pointer to the remote IP address of the TCP connection.
+  @param[in]       RemoteIpSize   The size, in bytes, of the RemoteIp buffer.
+  @param[in]       RemotePort     The remote port number of the TCP connection.
+  @param[out]      Isn            A pointer to the variable that will receive the Initial
+                                  Sequence Number (ISN).
+
+  @retval EFI_SUCCESS             The operation completed successfully, and the ISN was
+                                  retrieved.
+  @retval EFI_INVALID_PARAMETER   One or more of the input parameters are invalid.
+  @retval EFI_UNSUPPORTED         The operation is not supported.
+
+**/
+EFI_STATUS
+TcpGetIsn (
+  IN UINT8       *LocalIp,
+  IN UINTN       LocalIpSize,
+  IN UINT16      LocalPort,
+  IN UINT8       *RemoteIp,
+  IN UINTN       RemoteIpSize,
+  IN UINT16      RemotePort,
+  OUT TCP_SEQNO  *Isn
+  );
+
+ #endif
+diff --git a/NetworkPkg/TcpDxe/TcpMisc.c b/NetworkPkg/TcpDxe/TcpMisc.c
+index 3fa9d90d9f..42dc9fa941 100644
+--- a/NetworkPkg/TcpDxe/TcpMisc.c
+++ b/NetworkPkg/TcpDxe/TcpMisc.c
+@@ -3,6 +3,7 @@
+ 
+   (C) Copyright 2014 Hewlett-Packard Development Company, L.P.<BR>
+   Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) Microsoft Corporation
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+@@ -19,7 +20,34 @@ LIST_ENTRY  mTcpListenQue = {
+   &mTcpListenQue
+ };
+ 
+-TCP_SEQNO       mTcpGlobalIss = TCP_BASE_ISS;
+//
+// The Session secret
+// This must be initialized to a random value at boot time
+//
+TCP_SEQNO  mTcpGlobalSecret;
+
+//
+// Union to hold either an IPv4 or IPv6 address
+// This is used to simplify the ISN hash computation
+//
+typedef union {
+  UINT8    IPv4[4];
+  UINT8    IPv6[16];
+} NETWORK_ADDRESS;
+
+//
+// The ISN is computed by hashing this structure
+// It is initialized with the local and remote IP addresses and ports
+// and the secret
+//
+//
+typedef struct {
+  UINT16             LocalPort;
+  UINT16             RemotePort;
+  NETWORK_ADDRESS    LocalAddress;
+  NETWORK_ADDRESS    RemoteAddress;
+  TCP_SEQNO          Secret;
+} ISN_HASH_CTX;
+ 
+ CHAR16  *mTcpStateName[] = {
+   L"TCP_CLOSED",
+@@ -40,12 +68,18 @@ CHAR16  *mTcpStateName[] = {
+ 
+   @param[in, out]  Tcb               Pointer to the TCP_CB of this TCP instance.
+ 
+  @retval EFI_SUCCESS             The operation completed successfully
+  @retval others                  The underlying functions failed and could not complete the operation
+
+ **/
+-VOID
+EFI_STATUS
+ TcpInitTcbLocal (
+   IN OUT TCP_CB *Tcb
+   )
+ {
+  TCP_SEQNO   Isn;
+  EFI_STATUS  Status;
+
+   //
+   // Compute the checksum of the fixed parts of pseudo header
+   //
+@@ -56,6 +90,16 @@ TcpInitTcbLocal (
+                      0x06,
+                      0
+                      );
+
+    Status = TcpGetIsn (
+               Tcb->LocalEnd.Ip.v4.Addr,
+               sizeof (IPv4_ADDRESS),
+               Tcb->LocalEnd.Port,
+               Tcb->RemoteEnd.Ip.v4.Addr,
+               sizeof (IPv4_ADDRESS),
+               Tcb->RemoteEnd.Port,
+               &Isn
+               );
+   } else {
+     Tcb->HeadSum = NetIp6PseudoHeadChecksum (
+                      &Tcb->LocalEnd.Ip.v6,
+@@ -63,9 +107,25 @@ TcpInitTcbLocal (
+                      0x06,
+                      0
+                      );
+
+    Status = TcpGetIsn (
+               Tcb->LocalEnd.Ip.v6.Addr,
+               sizeof (IPv6_ADDRESS),
+               Tcb->LocalEnd.Port,
+               Tcb->RemoteEnd.Ip.v6.Addr,
+               sizeof (IPv6_ADDRESS),
+               Tcb->RemoteEnd.Port,
+               &Isn
+               );
+  }
+
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "TcpInitTcbLocal: failed to get isn\n"));
+    ASSERT (FALSE);
+    return Status;
+   }
+ 
+-  Tcb->Iss    = TcpGetIss ();
+  Tcb->Iss    = Isn;
+   Tcb->SndUna = Tcb->Iss;
+   Tcb->SndNxt = Tcb->Iss;
+ 
+@@ -81,6 +141,8 @@ TcpInitTcbLocal (
+   Tcb->RetxmitSeqMax = 0;
+ 
+   Tcb->ProbeTimerOn = FALSE;
+
+  return EFI_SUCCESS;
+ }
+ 
+ /**
+@@ -505,18 +567,162 @@ TcpCloneTcb (
+ }
+ 
+ /**
+-  Compute an ISS to be used by a new connection.
+-
+-  @return The resulting ISS.
+  Retrieves the Initial Sequence Number (ISN) for a TCP connection identified by local
+  and remote IP addresses and ports.
+
+  This method is based on https://datatracker.ietf.org/doc/html/rfc9293#section-3.4.1
+  Where the ISN is computed as follows:
+    ISN = TimeStamp + MD5(LocalIP, LocalPort, RemoteIP, RemotePort, Secret)
+
+  Otherwise:
+    ISN = M + F(localip, localport, remoteip, remoteport, secretkey)
+
+    "Here M is the 4 microsecond timer, and F() is a pseudorandom function (PRF) of the
+    connection's identifying parameters ("localip, localport, remoteip, remoteport")
+    and a secret key ("secretkey") (SHLD-1). F() MUST NOT be computable from the
+    outside (MUST-9), or an attacker could still guess at sequence numbers from the
+    ISN used for some other connection. The PRF could be implemented as a
+    cryptographic hash of the concatenation of the TCP connection parameters and some
+    secret data. For discussion of the selection of a specific hash algorithm and
+    management of the secret key data."
+
+  @param[in]       LocalIp        A pointer to the local IP address of the TCP connection.
+  @param[in]       LocalIpSize    The size, in bytes, of the LocalIp buffer.
+  @param[in]       LocalPort      The local port number of the TCP connection.
+  @param[in]       RemoteIp       A pointer to the remote IP address of the TCP connection.
+  @param[in]       RemoteIpSize   The size, in bytes, of the RemoteIp buffer.
+  @param[in]       RemotePort     The remote port number of the TCP connection.
+  @param[out]      Isn            A pointer to the variable that will receive the Initial
+                                  Sequence Number (ISN).
+
+  @retval EFI_SUCCESS             The operation completed successfully, and the ISN was
+                                  retrieved.
+  @retval EFI_INVALID_PARAMETER   One or more of the input parameters are invalid.
+  @retval EFI_UNSUPPORTED         The operation is not supported.
+ 
+ **/
+-TCP_SEQNO
+-TcpGetIss (
+-  VOID
+EFI_STATUS
+TcpGetIsn (
+  IN UINT8       *LocalIp,
+  IN UINTN       LocalIpSize,
+  IN UINT16      LocalPort,
+  IN UINT8       *RemoteIp,
+  IN UINTN       RemoteIpSize,
+  IN UINT16      RemotePort,
+  OUT TCP_SEQNO  *Isn
+   )
+ {
+-  mTcpGlobalIss += TCP_ISS_INCREMENT_1;
+-  return mTcpGlobalIss;
+  EFI_STATUS          Status;
+  EFI_HASH2_PROTOCOL  *Hash2Protocol;
+  EFI_HASH2_OUTPUT    HashResult;
+  ISN_HASH_CTX        IsnHashCtx;
+  EFI_TIME            TimeStamp;
+
+  //
+  // Check that the ISN pointer is valid
+  //
+  if (Isn == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  //
+  // The local ip may be a v4 or v6 address and may not be NULL
+  //
+  if ((LocalIp == NULL) || (LocalIpSize == 0) || (RemoteIp == NULL) || (RemoteIpSize == 0)) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  //
+  // the local ip may be a v4 or v6 address
+  //
+  if ((LocalIpSize != sizeof (EFI_IPv4_ADDRESS)) && (LocalIpSize != sizeof (EFI_IPv6_ADDRESS))) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  //
+  // Locate the Hash Protocol
+  //
+  Status = gBS->LocateProtocol (&gEfiHash2ProtocolGuid, NULL, (VOID **)&Hash2Protocol);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_NET, "Failed to locate Hash Protocol: %r\n", Status));
+
+    //
+    // TcpCreateService(..) is expected to be called prior to this function
+    //
+    ASSERT_EFI_ERROR (Status);
+    return Status;
+  }
+
+  //
+  // Initialize the hash algorithm
+  //
+  Status = Hash2Protocol->HashInit (Hash2Protocol, &gEfiHashAlgorithmSha256Guid);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_NET, "Failed to initialize sha256 hash algorithm: %r\n", Status));
+    return Status;
+  }
+
+  IsnHashCtx.LocalPort  = LocalPort;
+  IsnHashCtx.RemotePort = RemotePort;
+  IsnHashCtx.Secret     = mTcpGlobalSecret;
+
+  //
+  // Check the IP address family and copy accordingly
+  //
+  if (LocalIpSize == sizeof (EFI_IPv4_ADDRESS)) {
+    CopyMem (&IsnHashCtx.LocalAddress.IPv4, LocalIp, LocalIpSize);
+  } else if (LocalIpSize == sizeof (EFI_IPv6_ADDRESS)) {
+    CopyMem (&IsnHashCtx.LocalAddress.IPv6, LocalIp, LocalIpSize);
+  } else {
+    return EFI_INVALID_PARAMETER; // Unsupported address size
+  }
+
+  //
+  // Repeat the process for the remote IP address
+  //
+  if (RemoteIpSize == sizeof (EFI_IPv4_ADDRESS)) {
+    CopyMem (&IsnHashCtx.RemoteAddress.IPv4, RemoteIp, RemoteIpSize);
+  } else if (RemoteIpSize == sizeof (EFI_IPv6_ADDRESS)) {
+    CopyMem (&IsnHashCtx.RemoteAddress.IPv6, RemoteIp, RemoteIpSize);
+  } else {
+    return EFI_INVALID_PARAMETER; // Unsupported address size
+  }
+
+  //
+  // Compute the hash
+  // Update the hash with the data
+  //
+  Status = Hash2Protocol->HashUpdate (Hash2Protocol, (UINT8 *)&IsnHashCtx, sizeof (IsnHashCtx));
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_NET, "Failed to update hash: %r\n", Status));
+    return Status;
+  }
+
+  //
+  // Finalize the hash and retrieve the result
+  //
+  Status = Hash2Protocol->HashFinal (Hash2Protocol, &HashResult);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_NET, "Failed to finalize hash: %r\n", Status));
+    return Status;
+  }
+
+  Status = gRT->GetTime (&TimeStamp, NULL);
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  //
+  // copy the first 4 bytes of the hash result into the ISN
+  //
+  CopyMem (Isn, HashResult.Md5Hash, sizeof (*Isn));
+
+  //
+  // now add the timestamp to the ISN as 4 microseconds units (1000 / 4 = 250)
+  //
+  *Isn += (TCP_SEQNO)TimeStamp.Nanosecond * 250;
+
+  return Status;
+ }
+ 
+ /**
+@@ -719,17 +925,29 @@ TcpFormatNetbuf (
+ 
+   @param[in, out]  Tcb          Pointer to the TCP_CB that wants to initiate a
+                                 connection.
+
+  @retval EFI_SUCCESS             The operation completed successfully
+  @retval others                  The underlying functions failed and could not complete the operation
+
+ **/
+-VOID
+EFI_STATUS
+ TcpOnAppConnect (
+   IN OUT TCP_CB  *Tcb
+   )
+ {
+-  TcpInitTcbLocal (Tcb);
+  EFI_STATUS  Status;
+
+  Status = TcpInitTcbLocal (Tcb);
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+   TcpSetState (Tcb, TCP_SYN_SENT);
+ 
+   TcpSetTimer (Tcb, TCP_TIMER_CONNECT, Tcb->ConnectTimeout);
+   TcpToSendData (Tcb, 1);
+
+  return EFI_SUCCESS;
+ }
+ 
+ /**
+diff --git a/NetworkPkg/TcpDxe/TcpTimer.c b/NetworkPkg/TcpDxe/TcpTimer.c
+index 106d9470db..535d09d342 100644
+--- a/NetworkPkg/TcpDxe/TcpTimer.c
+++ b/NetworkPkg/TcpDxe/TcpTimer.c
+@@ -2,7 +2,7 @@
+   TCP timer related functions.
+ 
+   Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
+-
+  Copyright (c) Microsoft Corporation
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+@@ -497,7 +497,6 @@ TcpTickingDpc (
+   INT16           Index;
+ 
+   mTcpTick++;
+-  mTcpGlobalIss += TCP_ISS_INCREMENT_2;
+ 
+   //
+   // Don't use LIST_FOR_EACH, which isn't delete safe.
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
+++ b/SOURCES/edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
@ -0,0 +1,168 @@
+From 38baf93892ec464490b6fe611c23b014f574344b Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 07/15] NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234
+ Patch
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
+RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [7/15] c1baa0b2facbf0b63a90a0bfd55264af9f893098
+
+JIRA: https://issues.redhat.com/browse/RHEL-21850
+CVE: CVE-2022-45234
+Upstream: Merged
+
+commit 1b53515d53d303166b2bbd31e2cc7f16fd0aecd7
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:52 2024 +0800
+
+    NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234 Patch
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4539
+
+    Bug Details:
+    PixieFail Bug #6
+    CVE-2023-45234
+    CVSS 8.3 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
+    CWE-119 Improper Restriction of Operations within the Bounds of
+     a Memory Buffer
+
+    Buffer overflow when processing DNS Servers option in a DHCPv6
+    Advertise message
+
+    Change Overview:
+
+    Introduces a function to cache the Dns Server and perform sanitizing
+    on the incoming DnsServerLen to ensure that the length is valid
+
+    > + EFI_STATUS
+    > + PxeBcCacheDnsServerAddresses (
+    > +  IN PXEBC_PRIVATE_DATA        *Private,
+    > +  IN PXEBC_DHCP6_PACKET_CACHE  *Cache6
+    > +  )
+
+    Additional code cleanup
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c | 71 +++++++++++++++++++++++++---
+ 1 file changed, 65 insertions(+), 6 deletions(-)
+
+diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
+index 425e0cf806..2b2d372889 100644
+--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
+@@ -3,6 +3,7 @@
+ 
+   (C) Copyright 2014 Hewlett-Packard Development Company, L.P.<BR>
+   Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+  Copyright (c) Microsoft Corporation
+ 
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+@@ -1312,6 +1313,65 @@ PxeBcSelectDhcp6Offer (
+   }
+ }
+ 
+/**
+  Cache the DHCPv6 DNS Server addresses
+
+  @param[in] Private               The pointer to PXEBC_PRIVATE_DATA.
+  @param[in] Cache6                The pointer to PXEBC_DHCP6_PACKET_CACHE.
+
+  @retval    EFI_SUCCESS           Cache the DHCPv6 DNS Server address successfully.
+  @retval    EFI_OUT_OF_RESOURCES  Failed to allocate resources.
+  @retval    EFI_DEVICE_ERROR      The DNS Server Address Length provided by a untrusted
+                                   option is not a multiple of 16 bytes (sizeof (EFI_IPv6_ADDRESS)).
+**/
+EFI_STATUS
+PxeBcCacheDnsServerAddresses (
+  IN PXEBC_PRIVATE_DATA        *Private,
+  IN PXEBC_DHCP6_PACKET_CACHE  *Cache6
+  )
+{
+  UINT16  DnsServerLen;
+
+  DnsServerLen = NTOHS (Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->OpLen);
+  //
+  // Make sure that the number is nonzero
+  //
+  if (DnsServerLen == 0) {
+    return EFI_DEVICE_ERROR;
+  }
+
+  //
+  // Make sure the DnsServerlen is a multiple of EFI_IPv6_ADDRESS (16)
+  //
+  if (DnsServerLen % sizeof (EFI_IPv6_ADDRESS) != 0) {
+    return EFI_DEVICE_ERROR;
+  }
+
+  //
+  // This code is currently written to only support a single DNS Server instead
+  // of multiple such as is spec defined (RFC3646, Section 3). The proper behavior
+  // would be to allocate the full space requested, CopyMem all of the data,
+  // and then add a DnsServerCount field to Private and update additional code
+  // that depends on this.
+  //
+  // To support multiple DNS servers the `AllocationSize` would need to be changed to DnsServerLen
+  //
+  // This is tracked in https://bugzilla.tianocore.org/show_bug.cgi?id=1886
+  //
+  Private->DnsServer = AllocateZeroPool (sizeof (EFI_IPv6_ADDRESS));
+  if (Private->DnsServer == NULL) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  //
+  // Intentionally only copy over the first server address.
+  // To support multiple DNS servers, the `Length` would need to be changed to DnsServerLen
+  //
+  CopyMem (Private->DnsServer, Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->Data, sizeof (EFI_IPv6_ADDRESS));
+
+  return EFI_SUCCESS;
+}
+
+ /**
+   Handle the DHCPv6 offer packet.
+ 
+@@ -1335,6 +1395,7 @@ PxeBcHandleDhcp6Offer (
+   UINT32                    SelectIndex;
+   UINT32                    Index;
+ 
+  ASSERT (Private != NULL);
+   ASSERT (Private->SelectIndex > 0);
+   SelectIndex = (UINT32)(Private->SelectIndex - 1);
+   ASSERT (SelectIndex < PXEBC_OFFER_MAX_NUM);
+@@ -1342,15 +1403,13 @@ PxeBcHandleDhcp6Offer (
+   Status = EFI_SUCCESS;
+ 
+   //
+-  // First try to cache DNS server address if DHCP6 offer provides.
+  // First try to cache DNS server addresses if DHCP6 offer provides.
+   //
+   if (Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER] != NULL) {
+-    Private->DnsServer = AllocateZeroPool (NTOHS (Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->OpLen));
+-    if (Private->DnsServer == NULL) {
+-      return EFI_OUT_OF_RESOURCES;
+    Status = PxeBcCacheDnsServerAddresses (Private, Cache6);
+    if (EFI_ERROR (Status)) {
+      return Status;
+     }
+-
+-    CopyMem (Private->DnsServer, Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->Data, sizeof (EFI_IPv6_ADDRESS));
+   }
+ 
+   if (Cache6->OfferType == PxeOfferTypeDhcpBinl) {
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch
+++ b/SOURCES/edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch
@ -0,0 +1,511 @@
+From fd1bc6ff10a45123b0ec7f9ae3354ad3713bc532 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 08/15] NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234
+ Unit Tests
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
+RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [8/15] f88ebc7fa79ce4fe615dd79c42fedee0a0da7a0b
+
+JIRA: https://issues.redhat.com/browse/RHEL-21850
+CVE: CVE-2022-45234
+Upstream: Merged
+
+commit 458c582685fc0e8057d2511c5a0394078d988c17
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:53 2024 +0800
+
+    NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234 Unit Tests
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4539
+
+    Unit tests to that the bug..
+
+    Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise
+    message
+
+    ..has been patched
+
+    This contains tests for the following functions:
+    PxeBcHandleDhcp6Offer
+    PxeBcCacheDnsServerAddresses
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Test/NetworkPkgHostTest.dsc        |   1 +
+ .../GoogleTest/PxeBcDhcp6GoogleTest.cpp       | 300 ++++++++++++++++++
+ .../GoogleTest/PxeBcDhcp6GoogleTest.h         |  50 +++
+ .../GoogleTest/UefiPxeBcDxeGoogleTest.cpp     |  19 ++
+ .../GoogleTest/UefiPxeBcDxeGoogleTest.inf     |  48 +++
+ 5 files changed, 418 insertions(+)
+ create mode 100644 NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp
+ create mode 100644 NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h
+ create mode 100644 NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.cpp
+ create mode 100644 NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.inf
+
+diff --git a/NetworkPkg/Test/NetworkPkgHostTest.dsc b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+index ab7c2857b6..c8a991e5c1 100644
+--- a/NetworkPkg/Test/NetworkPkgHostTest.dsc
+++ b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+@@ -26,6 +26,7 @@
+   #
+   NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
+   NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+  NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.inf
+ 
+ # Despite these library classes being listed in [LibraryClasses] below, they are not needed for the host-based unit tests.
+ [LibraryClasses]
+diff --git a/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp b/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp
+new file mode 100644
+index 0000000000..8260eeee50
+--- /dev/null
+++ b/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp
+@@ -0,0 +1,300 @@
+/** @file
+  Host based unit test for PxeBcDhcp6.c.
+
+  Copyright (c) Microsoft Corporation
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+#include <gtest/gtest.h>
+
+extern "C" {
+  #include <Uefi.h>
+  #include <Library/BaseLib.h>
+  #include <Library/DebugLib.h>
+  #include "../PxeBcImpl.h"
+  #include "../PxeBcDhcp6.h"
+  #include "PxeBcDhcp6GoogleTest.h"
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// Definitions
+///////////////////////////////////////////////////////////////////////////////
+
+#define PACKET_SIZE  (1500)
+
+typedef struct {
+  UINT16    OptionCode;   // The option code for DHCP6_OPT_SERVER_ID (e.g., 0x03)
+  UINT16    OptionLen;    // The length of the option (e.g., 16 bytes)
+  UINT8     ServerId[16]; // The 16-byte DHCPv6 Server Identifier
+} DHCP6_OPTION_SERVER_ID;
+
+///////////////////////////////////////////////////////////////////////////////
+/// Symbol Definitions
+///////////////////////////////////////////////////////////////////////////////
+
+EFI_STATUS
+MockUdpWrite (
+  IN EFI_PXE_BASE_CODE_PROTOCOL      *This,
+  IN UINT16                          OpFlags,
+  IN EFI_IP_ADDRESS                  *DestIp,
+  IN EFI_PXE_BASE_CODE_UDP_PORT      *DestPort,
+  IN EFI_IP_ADDRESS                  *GatewayIp   OPTIONAL,
+  IN EFI_IP_ADDRESS                  *SrcIp       OPTIONAL,
+  IN OUT EFI_PXE_BASE_CODE_UDP_PORT  *SrcPort     OPTIONAL,
+  IN UINTN                           *HeaderSize  OPTIONAL,
+  IN VOID                            *HeaderPtr   OPTIONAL,
+  IN UINTN                           *BufferSize,
+  IN VOID                            *BufferPtr
+  )
+{
+  return EFI_SUCCESS;
+}
+
+EFI_STATUS
+MockUdpRead (
+  IN EFI_PXE_BASE_CODE_PROTOCOL      *This,
+  IN UINT16                          OpFlags,
+  IN OUT EFI_IP_ADDRESS              *DestIp      OPTIONAL,
+  IN OUT EFI_PXE_BASE_CODE_UDP_PORT  *DestPort    OPTIONAL,
+  IN OUT EFI_IP_ADDRESS              *SrcIp       OPTIONAL,
+  IN OUT EFI_PXE_BASE_CODE_UDP_PORT  *SrcPort     OPTIONAL,
+  IN UINTN                           *HeaderSize  OPTIONAL,
+  IN VOID                            *HeaderPtr   OPTIONAL,
+  IN OUT UINTN                       *BufferSize,
+  IN VOID                            *BufferPtr
+  )
+{
+  return EFI_SUCCESS;
+}
+
+EFI_STATUS
+MockConfigure (
+  IN EFI_UDP6_PROTOCOL     *This,
+  IN EFI_UDP6_CONFIG_DATA  *UdpConfigData OPTIONAL
+  )
+{
+  return EFI_SUCCESS;
+}
+
+// Needed by PxeBcSupport
+EFI_STATUS
+EFIAPI
+QueueDpc (
+  IN EFI_TPL            DpcTpl,
+  IN EFI_DPC_PROCEDURE  DpcProcedure,
+  IN VOID               *DpcContext    OPTIONAL
+  )
+{
+  return EFI_SUCCESS;
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// PxeBcHandleDhcp6OfferTest Tests
+///////////////////////////////////////////////////////////////////////////////
+
+class PxeBcHandleDhcp6OfferTest : public ::testing::Test {
+public:
+  PXEBC_PRIVATE_DATA Private = { 0 };
+  EFI_UDP6_PROTOCOL Udp6Read;
+  EFI_PXE_BASE_CODE_MODE Mode = { 0 };
+
+protected:
+  // Add any setup code if needed
+  virtual void
+  SetUp (
+    )
+  {
+    Private.Dhcp6Request = (EFI_DHCP6_PACKET *)AllocateZeroPool (PACKET_SIZE);
+
+    // Need to setup the EFI_PXE_BASE_CODE_PROTOCOL
+    // The function under test really only needs the following:
+    //  UdpWrite
+    //  UdpRead
+
+    Private.PxeBc.UdpWrite = (EFI_PXE_BASE_CODE_UDP_WRITE)MockUdpWrite;
+    Private.PxeBc.UdpRead  = (EFI_PXE_BASE_CODE_UDP_READ)MockUdpRead;
+
+    // Need to setup EFI_UDP6_PROTOCOL
+    // The function under test really only needs the following:
+    //  Configure
+
+    Udp6Read.Configure = (EFI_UDP6_CONFIGURE)MockConfigure;
+    Private.Udp6Read   = &Udp6Read;
+
+    // Need to setup the EFI_PXE_BASE_CODE_MODE
+    Private.PxeBc.Mode = &Mode;
+
+    // for this test it doesn't really matter what the Dhcpv6 ack is set to
+  }
+
+  // Add any cleanup code if needed
+  virtual void
+  TearDown (
+    )
+  {
+    if (Private.Dhcp6Request != NULL) {
+      FreePool (Private.Dhcp6Request);
+    }
+
+    // Clean up any resources or variables
+  }
+};
+
+// Note:
+// Testing PxeBcHandleDhcp6Offer() is difficult because it depends on a
+// properly setup Private structure. Attempting to properly test this function
+// without a signficant refactor is a fools errand. Instead, we will test
+// that we can prevent an overflow in the function.
+TEST_F (PxeBcHandleDhcp6OfferTest, BasicUsageTest) {
+  PXEBC_DHCP6_PACKET_CACHE  *Cache6 = NULL;
+  EFI_DHCP6_PACKET_OPTION   Option  = { 0 };
+
+  Private.SelectIndex = 1; // SelectIndex is 1-based
+  Cache6              = &Private.OfferBuffer[Private.SelectIndex - 1].Dhcp6;
+
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER] = &Option;
+  // Setup the DHCPv6 offer packet
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->OpCode = DHCP6_OPT_SERVER_ID;
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->OpLen  = NTOHS (1337);
+
+  ASSERT_EQ (PxeBcHandleDhcp6Offer (&(PxeBcHandleDhcp6OfferTest::Private)), EFI_DEVICE_ERROR);
+}
+
+class PxeBcCacheDnsServerAddressesTest : public ::testing::Test {
+public:
+  PXEBC_PRIVATE_DATA Private = { 0 };
+
+protected:
+  // Add any setup code if needed
+  virtual void
+  SetUp (
+    )
+  {
+  }
+
+  // Add any cleanup code if needed
+  virtual void
+  TearDown (
+    )
+  {
+  }
+};
+
+// Test Description
+// Test that we cache the DNS server address from the DHCPv6 offer packet
+TEST_F (PxeBcCacheDnsServerAddressesTest, BasicUsageTest) {
+  UINT8                     SearchPattern[16] = { 0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF, 0xDE, 0xAD, 0xBE, 0xEF };
+  EFI_DHCP6_PACKET_OPTION   *Option;
+  PXEBC_DHCP6_PACKET_CACHE  *Cache6 = NULL;
+
+  Option = (EFI_DHCP6_PACKET_OPTION *)AllocateZeroPool (sizeof (EFI_DHCP6_PACKET_OPTION) + sizeof (SearchPattern));
+  ASSERT_NE (Option, nullptr);
+
+  Option->OpCode = DHCP6_OPT_SERVER_ID;
+  Option->OpLen  = NTOHS (sizeof (SearchPattern));
+  CopyMem (Option->Data, SearchPattern, sizeof (SearchPattern));
+
+  Private.SelectIndex                         = 1; // SelectIndex is 1-based
+  Cache6                                      = &Private.OfferBuffer[Private.SelectIndex - 1].Dhcp6;
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER] = Option;
+
+  Private.DnsServer = nullptr;
+
+  ASSERT_EQ (PxeBcCacheDnsServerAddresses (&(PxeBcCacheDnsServerAddressesTest::Private), Cache6), EFI_SUCCESS);
+  ASSERT_NE (Private.DnsServer, nullptr);
+  ASSERT_EQ (CompareMem (Private.DnsServer, SearchPattern, sizeof (SearchPattern)), 0);
+
+  if (Private.DnsServer) {
+    FreePool (Private.DnsServer);
+  }
+
+  if (Option) {
+    FreePool (Option);
+  }
+}
+// Test Description
+// Test that we can prevent an overflow in the function
+TEST_F (PxeBcCacheDnsServerAddressesTest, AttemptOverflowTest) {
+  EFI_DHCP6_PACKET_OPTION   Option  = { 0 };
+  PXEBC_DHCP6_PACKET_CACHE  *Cache6 = NULL;
+
+  Private.SelectIndex                         = 1; // SelectIndex is 1-based
+  Cache6                                      = &Private.OfferBuffer[Private.SelectIndex - 1].Dhcp6;
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER] = &Option;
+  // Setup the DHCPv6 offer packet
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->OpCode = DHCP6_OPT_SERVER_ID;
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->OpLen  = NTOHS (1337);
+
+  Private.DnsServer = NULL;
+
+  ASSERT_EQ (PxeBcCacheDnsServerAddresses (&(PxeBcCacheDnsServerAddressesTest::Private), Cache6), EFI_DEVICE_ERROR);
+  ASSERT_EQ (Private.DnsServer, nullptr);
+
+  if (Private.DnsServer) {
+    FreePool (Private.DnsServer);
+  }
+}
+
+// Test Description
+// Test that we can prevent an underflow in the function
+TEST_F (PxeBcCacheDnsServerAddressesTest, AttemptUnderflowTest) {
+  EFI_DHCP6_PACKET_OPTION   Option  = { 0 };
+  PXEBC_DHCP6_PACKET_CACHE  *Cache6 = NULL;
+
+  Private.SelectIndex                         = 1; // SelectIndex is 1-based
+  Cache6                                      = &Private.OfferBuffer[Private.SelectIndex - 1].Dhcp6;
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER] = &Option;
+  // Setup the DHCPv6 offer packet
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->OpCode = DHCP6_OPT_SERVER_ID;
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->OpLen  = NTOHS (2);
+
+  Private.DnsServer = NULL;
+
+  ASSERT_EQ (PxeBcCacheDnsServerAddresses (&(PxeBcCacheDnsServerAddressesTest::Private), Cache6), EFI_DEVICE_ERROR);
+  ASSERT_EQ (Private.DnsServer, nullptr);
+
+  if (Private.DnsServer) {
+    FreePool (Private.DnsServer);
+  }
+}
+
+// Test Description
+// Test that we can handle recursive dns (multiple dns entries)
+TEST_F (PxeBcCacheDnsServerAddressesTest, MultipleDnsEntries) {
+  EFI_DHCP6_PACKET_OPTION   Option  = { 0 };
+  PXEBC_DHCP6_PACKET_CACHE  *Cache6 = NULL;
+
+  Private.SelectIndex                         = 1; // SelectIndex is 1-based
+  Cache6                                      = &Private.OfferBuffer[Private.SelectIndex - 1].Dhcp6;
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER] = &Option;
+  // Setup the DHCPv6 offer packet
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->OpCode = DHCP6_OPT_SERVER_ID;
+
+  EFI_IPv6_ADDRESS  addresses[2] = {
+    // 2001:db8:85a3::8a2e:370:7334
+    { 0x20, 0x01, 0x0d, 0xb8, 0x85, 0xa3, 0x00, 0x00, 0x00, 0x00, 0x8a, 0x2e, 0x03, 0x70, 0x73, 0x34 },
+    // fe80::d478:91c3:ecd7:4ff9
+    { 0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd4, 0x78, 0x91, 0xc3, 0xec, 0xd7, 0x4f, 0xf9 }
+  };
+
+  CopyMem (Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->Data, &addresses, sizeof (addresses));
+
+  Cache6->OptList[PXEBC_DHCP6_IDX_DNS_SERVER]->OpLen = NTOHS (sizeof (addresses));
+
+  Private.DnsServer = NULL;
+
+  ASSERT_EQ (PxeBcCacheDnsServerAddresses (&(PxeBcCacheDnsServerAddressesTest::Private), Cache6), EFI_SUCCESS);
+
+  ASSERT_NE (Private.DnsServer, nullptr);
+
+  //
+  // This is expected to fail until DnsServer supports multiple DNS servers
+  //
+  // This is tracked in https://bugzilla.tianocore.org/show_bug.cgi?id=1886
+  //
+  // Disabling:
+  // ASSERT_EQ (CompareMem(Private.DnsServer, &addresses, sizeof(addresses)), 0);
+
+  if (Private.DnsServer) {
+    FreePool (Private.DnsServer);
+  }
+}
+diff --git a/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h b/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h
+new file mode 100644
+index 0000000000..b17c314791
+--- /dev/null
+++ b/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h
+@@ -0,0 +1,50 @@
+/** @file
+  This file exposes the internal interfaces which may be unit tested
+  for the PxeBcDhcp6Dxe driver.
+
+  Copyright (c) Microsoft Corporation.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef PXE_BC_DHCP6_GOOGLE_TEST_H_
+#define PXE_BC_DHCP6_GOOGLE_TEST_H_
+
+//
+// Minimal includes needed to compile
+//
+#include <Uefi.h>
+#include "../PxeBcImpl.h"
+
+/**
+  Handle the DHCPv6 offer packet.
+
+  @param[in]  Private             The pointer to PXEBC_PRIVATE_DATA.
+
+  @retval     EFI_SUCCESS           Handled the DHCPv6 offer packet successfully.
+  @retval     EFI_NO_RESPONSE       No response to the following request packet.
+  @retval     EFI_OUT_OF_RESOURCES  Failed to allocate resources.
+  @retval     EFI_BUFFER_TOO_SMALL  Can't cache the offer pacet.
+
+**/
+EFI_STATUS
+PxeBcHandleDhcp6Offer (
+  IN PXEBC_PRIVATE_DATA  *Private
+  );
+
+/**
+  Cache the DHCPv6 Server address
+
+  @param[in] Private               The pointer to PXEBC_PRIVATE_DATA.
+  @param[in] Cache6                The pointer to PXEBC_DHCP6_PACKET_CACHE.
+
+  @retval    EFI_SUCCESS           Cache the DHCPv6 Server address successfully.
+  @retval    EFI_OUT_OF_RESOURCES  Failed to allocate resources.
+  @retval    EFI_DEVICE_ERROR      Failed to cache the DHCPv6 Server address.
+**/
+EFI_STATUS
+PxeBcCacheDnsServerAddresses (
+  IN PXEBC_PRIVATE_DATA        *Private,
+  IN PXEBC_DHCP6_PACKET_CACHE  *Cache6
+  );
+
+#endif // PXE_BC_DHCP6_GOOGLE_TEST_H_
+diff --git a/NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.cpp b/NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.cpp
+new file mode 100644
+index 0000000000..cc4fdf525b
+--- /dev/null
+++ b/NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.cpp
+@@ -0,0 +1,19 @@
+/** @file
+  Acts as the main entry point for the tests for the UefiPxeBcDxe module.
+  Copyright (c) Microsoft Corporation
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+#include <gtest/gtest.h>
+
+////////////////////////////////////////////////////////////////////////////////
+// Run the tests
+////////////////////////////////////////////////////////////////////////////////
+int
+main (
+  int   argc,
+  char  *argv[]
+  )
+{
+  testing::InitGoogleTest (&argc, argv);
+  return RUN_ALL_TESTS ();
+}
+diff --git a/NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.inf b/NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.inf
+new file mode 100644
+index 0000000000..301dcdf611
+--- /dev/null
+++ b/NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.inf
+@@ -0,0 +1,48 @@
+## @file
+# Unit test suite for the UefiPxeBcDxe using Google Test
+#
+# Copyright (c) Microsoft Corporation.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+##
+[Defines]
+INF_VERSION    = 0x00010005
+BASE_NAME      = UefiPxeBcDxeGoogleTest
+FILE_GUID      = 77D45C64-EC1E-4174-887B-886E89FD1EDF
+MODULE_TYPE    = HOST_APPLICATION
+VERSION_STRING = 1.0
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64
+#
+
+[Sources]
+  UefiPxeBcDxeGoogleTest.cpp
+  PxeBcDhcp6GoogleTest.cpp
+  PxeBcDhcp6GoogleTest.h
+  ../PxeBcDhcp6.c
+  ../PxeBcSupport.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+  UnitTestFrameworkPkg/UnitTestFrameworkPkg.dec
+  NetworkPkg/NetworkPkg.dec
+
+[LibraryClasses]
+  GoogleTestLib
+  DebugLib
+  NetLib
+  PcdLib
+
+[Protocols]
+  gEfiDhcp6ServiceBindingProtocolGuid
+  gEfiDns6ServiceBindingProtocolGuid
+  gEfiDns6ProtocolGuid
+
+[Pcd]
+  gEfiNetworkPkgTokenSpaceGuid.PcdDhcp6UidType
+
+[Guids]
+  gZeroGuid
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch
+++ b/SOURCES/edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch
@ -0,0 +1,257 @@
+From 0016db53099ba979617f376fe1104fefada4fa29 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 09/15] NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45235
+ Patch
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
+RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [9/15] c48c060b87761537ee526e1f8a9e5993eb1a0381
+
+JIRA: https://issues.redhat.com/browse/RHEL-21852
+CVE: CVE-2022-45235
+Upstream: Merged
+
+commit fac297724e6cc343430cd0104e55cd7a96d1151e
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:55 2024 +0800
+
+    NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45235 Patch
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4540
+
+    Bug Details:
+    PixieFail Bug #7
+    CVE-2023-45235
+    CVSS 8.3 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
+    CWE-119 Improper Restriction of Operations within the Bounds of
+     a Memory Buffer
+
+    Buffer overflow when handling Server ID option from a DHCPv6 proxy
+    Advertise message
+
+    Change Overview:
+
+    Performs two checks
+
+    1. Checks that the length of the duid is accurate
+    > + //
+    > + // Check that the minimum and maximum requirements are met
+    > + //
+    > + if ((OpLen < PXEBC_MIN_SIZE_OF_DUID) ||
+    (OpLen > PXEBC_MAX_SIZE_OF_DUID)) {
+    > +  Status = EFI_INVALID_PARAMETER;
+    > +  goto ON_ERROR;
+    > + }
+
+    2. Ensures that the amount of data written to the buffer is tracked and
+    never exceeds that
+    > + //
+    > + // Check that the option length is valid.
+    > + //
+    > + if ((DiscoverLen + OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN)
+     > DiscoverLenNeeded) {
+    > +     Status = EFI_OUT_OF_RESOURCES;
+    > +     goto ON_ERROR;
+    > + }
+
+    Additional code clean up and fix for memory leak in case Option was NULL
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c | 77 ++++++++++++++++++++++------
+ NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h | 17 ++++++
+ 2 files changed, 78 insertions(+), 16 deletions(-)
+
+diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
+index 2b2d372889..7fd1281c11 100644
+--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
+@@ -887,6 +887,7 @@ PxeBcRequestBootService (
+   EFI_STATUS                       Status;
+   EFI_DHCP6_PACKET                 *IndexOffer;
+   UINT8                            *Option;
+  UINTN                            DiscoverLenNeeded;
+ 
+   PxeBc      = &Private->PxeBc;
+   Request    = Private->Dhcp6Request;
+@@ -899,7 +900,8 @@ PxeBcRequestBootService (
+     return EFI_DEVICE_ERROR;
+   }
+ 
+-  Discover = AllocateZeroPool (sizeof (EFI_PXE_BASE_CODE_DHCPV6_PACKET));
+  DiscoverLenNeeded = sizeof (EFI_PXE_BASE_CODE_DHCPV6_PACKET);
+  Discover          = AllocateZeroPool (DiscoverLenNeeded);
+   if (Discover == NULL) {
+     return EFI_OUT_OF_RESOURCES;
+   }
+@@ -924,16 +926,34 @@ PxeBcRequestBootService (
+                DHCP6_OPT_SERVER_ID
+                );
+     if (Option == NULL) {
+-      return EFI_NOT_FOUND;
+      Status = EFI_NOT_FOUND;
+      goto ON_ERROR;
+     }
+ 
+     //
+     // Add Server ID Option.
+     //
+     OpLen = NTOHS (((EFI_DHCP6_PACKET_OPTION *)Option)->OpLen);
+-    CopyMem (DiscoverOpt, Option, OpLen + 4);
+-    DiscoverOpt += (OpLen + 4);
+-    DiscoverLen += (OpLen + 4);
+
+    //
+    // Check that the minimum and maximum requirements are met
+    //
+    if ((OpLen < PXEBC_MIN_SIZE_OF_DUID) || (OpLen > PXEBC_MAX_SIZE_OF_DUID)) {
+      Status = EFI_INVALID_PARAMETER;
+      goto ON_ERROR;
+    }
+
+    //
+    // Check that the option length is valid.
+    //
+    if ((DiscoverLen + OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN) > DiscoverLenNeeded) {
+      Status = EFI_OUT_OF_RESOURCES;
+      goto ON_ERROR;
+    }
+
+    CopyMem (DiscoverOpt, Option, OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+    DiscoverOpt += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+    DiscoverLen += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+   }
+ 
+   while (RequestLen < Request->Length) {
+@@ -944,16 +964,24 @@ PxeBcRequestBootService (
+         (OpCode != DHCP6_OPT_SERVER_ID)
+         )
+     {
+      //
+      // Check that the option length is valid.
+      //
+      if (DiscoverLen + OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN > DiscoverLenNeeded) {
+        Status = EFI_OUT_OF_RESOURCES;
+        goto ON_ERROR;
+      }
+
+       //
+       // Copy all the options except IA option and Server ID
+       //
+-      CopyMem (DiscoverOpt, RequestOpt, OpLen + 4);
+-      DiscoverOpt += (OpLen + 4);
+-      DiscoverLen += (OpLen + 4);
+      CopyMem (DiscoverOpt, RequestOpt, OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+      DiscoverOpt += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+      DiscoverLen += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+     }
+ 
+-    RequestOpt += (OpLen + 4);
+-    RequestLen += (OpLen + 4);
+    RequestOpt += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+    RequestLen += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+   }
+ 
+   //
+@@ -2154,6 +2182,7 @@ PxeBcDhcp6Discover (
+   UINT16                           OpLen;
+   UINT32                           Xid;
+   EFI_STATUS                       Status;
+  UINTN                            DiscoverLenNeeded;
+ 
+   PxeBc    = &Private->PxeBc;
+   Mode     = PxeBc->Mode;
+@@ -2169,7 +2198,8 @@ PxeBcDhcp6Discover (
+     return EFI_DEVICE_ERROR;
+   }
+ 
+-  Discover = AllocateZeroPool (sizeof (EFI_PXE_BASE_CODE_DHCPV6_PACKET));
+  DiscoverLenNeeded = sizeof (EFI_PXE_BASE_CODE_DHCPV6_PACKET);
+  Discover          = AllocateZeroPool (DiscoverLenNeeded);
+   if (Discover == NULL) {
+     return EFI_OUT_OF_RESOURCES;
+   }
+@@ -2185,22 +2215,37 @@ PxeBcDhcp6Discover (
+   DiscoverLen             = sizeof (EFI_DHCP6_HEADER);
+   RequestLen              = DiscoverLen;
+ 
+  //
+  // The request packet is generated by the UEFI network stack. In the DHCP4 DORA and DHCP6 SARR sequence,
+  // the first (discover in DHCP4 and solicit in DHCP6) and third (request in both DHCP4 and DHCP6) are
+  // generated by the DHCP client (the UEFI network stack in this case). By the time this function executes,
+  // the DHCP sequence already has been executed once (see UEFI Specification Figures 24.2 and 24.3), with
+  // Private->Dhcp6Request being a cached copy of the DHCP6 request packet that UEFI network stack previously
+  // generated and sent.
+  //
+  // Therefore while this code looks like it could overflow, in practice it's not possible.
+  //
+   while (RequestLen < Request->Length) {
+     OpCode = NTOHS (((EFI_DHCP6_PACKET_OPTION *)RequestOpt)->OpCode);
+     OpLen  = NTOHS (((EFI_DHCP6_PACKET_OPTION *)RequestOpt)->OpLen);
+     if ((OpCode != EFI_DHCP6_IA_TYPE_NA) &&
+         (OpCode != EFI_DHCP6_IA_TYPE_TA))
+     {
+      if (DiscoverLen + OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN > DiscoverLenNeeded) {
+        Status = EFI_OUT_OF_RESOURCES;
+        goto ON_ERROR;
+      }
+
+       //
+       // Copy all the options except IA option.
+       //
+-      CopyMem (DiscoverOpt, RequestOpt, OpLen + 4);
+-      DiscoverOpt += (OpLen + 4);
+-      DiscoverLen += (OpLen + 4);
+      CopyMem (DiscoverOpt, RequestOpt, OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+      DiscoverOpt += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+      DiscoverLen += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+     }
+ 
+-    RequestOpt += (OpLen + 4);
+-    RequestLen += (OpLen + 4);
+    RequestOpt += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+    RequestLen += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+   }
+ 
+   Status = PxeBc->UdpWrite (
+diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h
+index ae4be775e8..47eb8cc0c0 100644
+--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h
+@@ -35,6 +35,23 @@
+ #define PXEBC_ADDR_START_DELIMITER        '['
+ #define PXEBC_ADDR_END_DELIMITER          ']'
+ 
+//
+// A DUID consists of a 2-octet type code represented in network byte
+// order, followed by a variable number of octets that make up the
+// actual identifier.  The length of the DUID (not including the type
+// code) is at least 1 octet and at most 128 octets.
+//
+#define PXEBC_MIN_SIZE_OF_DUID  (sizeof(UINT16) + 1)
+#define PXEBC_MAX_SIZE_OF_DUID  (sizeof(UINT16) + 128)
+
+//
+// This define represents the combineds code and length field from
+// https://datatracker.ietf.org/doc/html/rfc3315#section-22.1
+//
+#define PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN  \
+      (sizeof (((EFI_DHCP6_PACKET_OPTION *)0)->OpCode) + \
+      sizeof (((EFI_DHCP6_PACKET_OPTION *)0)->OpLen))
+
+ #define GET_NEXT_DHCP6_OPTION(Opt) \
+   (EFI_DHCP6_PACKET_OPTION *) ((UINT8 *) (Opt) + \
+   sizeof (EFI_DHCP6_PACKET_OPTION) + (NTOHS ((Opt)->OpLen)) - 1)
+-- 
+2.39.3
+
--- a/SOURCES/edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch
+++ b/SOURCES/edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch
@ -0,0 +1,409 @@
+From 80b34c0f56228353c174f9ff739d0755c62d76cf Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 10/15] NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45235
+ Unit Tests
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 56: Pixiefail issues in NetworkPkg package
+RH-Jira: RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Commit: [10/15] 5dbf3f771506ff9a0c28827c568d04e825572658
+
+JIRA: https://issues.redhat.com/browse/RHEL-21852
+CVE: CVE-2022-45235
+Upstream: Merged
+
+commit ff2986358f75d8f58ef08a66fe673539c9c48f41
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:56 2024 +0800
+
+    NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45235 Unit Tests
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4540
+
+    Unit tests to confirm that the bug..
+
+    Buffer overflow when handling Server ID option from a DHCPv6 proxy
+    Advertise message
+
+    ..has been patched.
+
+    This patch contains unit tests for the following functions:
+    PxeBcRequestBootService
+    PxeBcDhcp6Discover
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Test/NetworkPkgHostTest.dsc        |   5 +-
+ .../GoogleTest/PxeBcDhcp6GoogleTest.cpp       | 278 +++++++++++++++++-
+ .../GoogleTest/PxeBcDhcp6GoogleTest.h         |  18 ++
+ 3 files changed, 298 insertions(+), 3 deletions(-)
+
+diff --git a/NetworkPkg/Test/NetworkPkgHostTest.dsc b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+index c8a991e5c1..1010a80a15 100644
+--- a/NetworkPkg/Test/NetworkPkgHostTest.dsc
+++ b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+@@ -26,7 +26,10 @@
+   #
+   NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
+   NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+-  NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.inf
+  NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.inf {
+    <LibraryClasses>
+      UefiRuntimeServicesTableLib|MdePkg/Test/Mock/Library/GoogleTest/MockUefiRuntimeServicesTableLib/MockUefiRuntimeServicesTableLib.inf
+  }
+ 
+ # Despite these library classes being listed in [LibraryClasses] below, they are not needed for the host-based unit tests.
+ [LibraryClasses]
+diff --git a/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp b/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp
+index 8260eeee50..bd423ebadf 100644
+--- a/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp
+++ b/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp
+@@ -4,7 +4,9 @@
+   Copyright (c) Microsoft Corporation
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ **/
+-#include <gtest/gtest.h>
+#include <Library/GoogleTestLib.h>
+#include <GoogleTest/Library/MockUefiLib.h>
+#include <GoogleTest/Library/MockUefiRuntimeServicesTableLib.h>
+ 
+ extern "C" {
+   #include <Uefi.h>
+@@ -19,7 +21,8 @@ extern "C" {
+ // Definitions
+ ///////////////////////////////////////////////////////////////////////////////
+ 
+-#define PACKET_SIZE  (1500)
+#define PACKET_SIZE            (1500)
+#define REQUEST_OPTION_LENGTH  (120)
+ 
+ typedef struct {
+   UINT16    OptionCode;   // The option code for DHCP6_OPT_SERVER_ID (e.g., 0x03)
+@@ -76,6 +79,26 @@ MockConfigure (
+ }
+ 
+ // Needed by PxeBcSupport
+EFI_STATUS
+PxeBcDns6 (
+  IN PXEBC_PRIVATE_DATA  *Private,
+  IN     CHAR16          *HostName,
+  OUT EFI_IPv6_ADDRESS   *IpAddress
+  )
+{
+  return EFI_SUCCESS;
+}
+
+UINT32
+PxeBcBuildDhcp6Options (
+  IN  PXEBC_PRIVATE_DATA       *Private,
+  OUT EFI_DHCP6_PACKET_OPTION  **OptList,
+  IN  UINT8                    *Buffer
+  )
+{
+  return EFI_SUCCESS;
+}
+
+ EFI_STATUS
+ EFIAPI
+ QueueDpc (
+@@ -159,6 +182,10 @@ TEST_F (PxeBcHandleDhcp6OfferTest, BasicUsageTest) {
+   ASSERT_EQ (PxeBcHandleDhcp6Offer (&(PxeBcHandleDhcp6OfferTest::Private)), EFI_DEVICE_ERROR);
+ }
+ 
+///////////////////////////////////////////////////////////////////////////////
+// PxeBcCacheDnsServerAddresses Tests
+///////////////////////////////////////////////////////////////////////////////
+
+ class PxeBcCacheDnsServerAddressesTest : public ::testing::Test {
+ public:
+   PXEBC_PRIVATE_DATA Private = { 0 };
+@@ -298,3 +325,250 @@ TEST_F (PxeBcCacheDnsServerAddressesTest, MultipleDnsEntries) {
+     FreePool (Private.DnsServer);
+   }
+ }
+
+///////////////////////////////////////////////////////////////////////////////
+// PxeBcRequestBootServiceTest Test Cases
+///////////////////////////////////////////////////////////////////////////////
+
+class PxeBcRequestBootServiceTest : public ::testing::Test {
+public:
+  PXEBC_PRIVATE_DATA Private = { 0 };
+  EFI_UDP6_PROTOCOL Udp6Read;
+
+protected:
+  // Add any setup code if needed
+  virtual void
+  SetUp (
+    )
+  {
+    Private.Dhcp6Request = (EFI_DHCP6_PACKET *)AllocateZeroPool (PACKET_SIZE);
+
+    // Need to setup the EFI_PXE_BASE_CODE_PROTOCOL
+    // The function under test really only needs the following:
+    //  UdpWrite
+    //  UdpRead
+
+    Private.PxeBc.UdpWrite = (EFI_PXE_BASE_CODE_UDP_WRITE)MockUdpWrite;
+    Private.PxeBc.UdpRead  = (EFI_PXE_BASE_CODE_UDP_READ)MockUdpRead;
+
+    // Need to setup EFI_UDP6_PROTOCOL
+    // The function under test really only needs the following:
+    //  Configure
+
+    Udp6Read.Configure = (EFI_UDP6_CONFIGURE)MockConfigure;
+    Private.Udp6Read   = &Udp6Read;
+  }
+
+  // Add any cleanup code if needed
+  virtual void
+  TearDown (
+    )
+  {
+    if (Private.Dhcp6Request != NULL) {
+      FreePool (Private.Dhcp6Request);
+    }
+
+    // Clean up any resources or variables
+  }
+};
+
+TEST_F (PxeBcRequestBootServiceTest, ServerDiscoverBasicUsageTest) {
+  PxeBcRequestBootServiceTest::Private.OfferBuffer[0].Dhcp6.OfferType = PxeOfferTypeProxyBinl;
+
+  DHCP6_OPTION_SERVER_ID  Server = { 0 };
+
+  Server.OptionCode =  HTONS (DHCP6_OPT_SERVER_ID);
+  Server.OptionLen  = HTONS (16); // valid length
+  UINT8  Index = 0;
+
+  EFI_DHCP6_PACKET  *Packet = (EFI_DHCP6_PACKET *)&Private.OfferBuffer[Index].Dhcp6.Packet.Offer;
+
+  UINT8  *Cursor = (UINT8 *)(Packet->Dhcp6.Option);
+
+  CopyMem (Cursor, &Server, sizeof (Server));
+  Cursor += sizeof (Server);
+
+  // Update the packet length
+  Packet->Length = (UINT16)(Cursor - (UINT8 *)Packet);
+  Packet->Size   = PACKET_SIZE;
+
+  ASSERT_EQ (PxeBcRequestBootService (&(PxeBcRequestBootServiceTest::Private), Index), EFI_SUCCESS);
+}
+
+TEST_F (PxeBcRequestBootServiceTest, AttemptDiscoverOverFlowExpectFailure) {
+  PxeBcRequestBootServiceTest::Private.OfferBuffer[0].Dhcp6.OfferType = PxeOfferTypeProxyBinl;
+
+  DHCP6_OPTION_SERVER_ID  Server = { 0 };
+
+  Server.OptionCode =  HTONS (DHCP6_OPT_SERVER_ID);
+  Server.OptionLen  = HTONS (1500); // This length would overflow without a check
+  UINT8  Index = 0;
+
+  EFI_DHCP6_PACKET  *Packet = (EFI_DHCP6_PACKET *)&Private.OfferBuffer[Index].Dhcp6.Packet.Offer;
+
+  UINT8  *Cursor = (UINT8 *)(Packet->Dhcp6.Option);
+
+  CopyMem (Cursor, &Server, sizeof (Server));
+  Cursor += sizeof (Server);
+
+  // Update the packet length
+  Packet->Length = (UINT16)(Cursor - (UINT8 *)Packet);
+  Packet->Size   = PACKET_SIZE;
+
+  // This is going to be stopped by the duid overflow check
+  ASSERT_EQ (PxeBcRequestBootService (&(PxeBcRequestBootServiceTest::Private), Index), EFI_INVALID_PARAMETER);
+}
+
+TEST_F (PxeBcRequestBootServiceTest, RequestBasicUsageTest) {
+  EFI_DHCP6_PACKET_OPTION  RequestOpt = { 0 }; // the data section doesn't really matter
+
+  RequestOpt.OpCode = HTONS (0x1337);
+  RequestOpt.OpLen  = 0; // valid length
+
+  UINT8  Index = 0;
+
+  EFI_DHCP6_PACKET  *Packet = (EFI_DHCP6_PACKET *)&Private.Dhcp6Request[Index];
+
+  UINT8  *Cursor = (UINT8 *)(Packet->Dhcp6.Option);
+
+  CopyMem (Cursor, &RequestOpt, sizeof (RequestOpt));
+  Cursor += sizeof (RequestOpt);
+
+  // Update the packet length
+  Packet->Length = (UINT16)(Cursor - (UINT8 *)Packet);
+  Packet->Size   = PACKET_SIZE;
+
+  ASSERT_EQ (PxeBcRequestBootService (&(PxeBcRequestBootServiceTest::Private), Index), EFI_SUCCESS);
+}
+
+TEST_F (PxeBcRequestBootServiceTest, AttemptRequestOverFlowExpectFailure) {
+  EFI_DHCP6_PACKET_OPTION  RequestOpt = { 0 }; // the data section doesn't really matter
+
+  RequestOpt.OpCode = HTONS (0x1337);
+  RequestOpt.OpLen  = 1500; // this length would overflow without a check
+
+  UINT8  Index = 0;
+
+  EFI_DHCP6_PACKET  *Packet = (EFI_DHCP6_PACKET *)&Private.Dhcp6Request[Index];
+
+  UINT8  *Cursor = (UINT8 *)(Packet->Dhcp6.Option);
+
+  CopyMem (Cursor, &RequestOpt, sizeof (RequestOpt));
+  Cursor += sizeof (RequestOpt);
+
+  // Update the packet length
+  Packet->Length = (UINT16)(Cursor - (UINT8 *)Packet);
+  Packet->Size   = PACKET_SIZE;
+
+  ASSERT_EQ (PxeBcRequestBootService (&(PxeBcRequestBootServiceTest::Private), Index), EFI_OUT_OF_RESOURCES);
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// PxeBcDhcp6Discover Test
+///////////////////////////////////////////////////////////////////////////////
+
+class PxeBcDhcp6DiscoverTest : public ::testing::Test {
+public:
+  PXEBC_PRIVATE_DATA Private = { 0 };
+  EFI_UDP6_PROTOCOL Udp6Read;
+
+protected:
+  MockUefiRuntimeServicesTableLib RtServicesMock;
+
+  // Add any setup code if needed
+  virtual void
+  SetUp (
+    )
+  {
+    Private.Dhcp6Request = (EFI_DHCP6_PACKET *)AllocateZeroPool (PACKET_SIZE);
+
+    // Need to setup the EFI_PXE_BASE_CODE_PROTOCOL
+    // The function under test really only needs the following:
+    //  UdpWrite
+    //  UdpRead
+
+    Private.PxeBc.UdpWrite = (EFI_PXE_BASE_CODE_UDP_WRITE)MockUdpWrite;
+    Private.PxeBc.UdpRead  = (EFI_PXE_BASE_CODE_UDP_READ)MockUdpRead;
+
+    // Need to setup EFI_UDP6_PROTOCOL
+    // The function under test really only needs the following:
+    //  Configure
+
+    Udp6Read.Configure = (EFI_UDP6_CONFIGURE)MockConfigure;
+    Private.Udp6Read   = &Udp6Read;
+  }
+
+  // Add any cleanup code if needed
+  virtual void
+  TearDown (
+    )
+  {
+    if (Private.Dhcp6Request != NULL) {
+      FreePool (Private.Dhcp6Request);
+    }
+
+    // Clean up any resources or variables
+  }
+};
+
+// Test Description
+// This will cause an overflow by an untrusted packet during the option parsing
+TEST_F (PxeBcDhcp6DiscoverTest, BasicOverflowTest) {
+  EFI_IPv6_ADDRESS         DestIp     = { 0 };
+  EFI_DHCP6_PACKET_OPTION  RequestOpt = { 0 }; // the data section doesn't really matter
+
+  RequestOpt.OpCode = HTONS (0x1337);
+  RequestOpt.OpLen  = HTONS (0xFFFF); // overflow
+
+  UINT8  *Cursor = (UINT8 *)(Private.Dhcp6Request->Dhcp6.Option);
+
+  CopyMem (Cursor, &RequestOpt, sizeof (RequestOpt));
+  Cursor += sizeof (RequestOpt);
+
+  Private.Dhcp6Request->Length = (UINT16)(Cursor - (UINT8 *)Private.Dhcp6Request);
+
+  EXPECT_CALL (RtServicesMock, gRT_GetTime)
+    .WillOnce (::testing::Return (0));
+
+  ASSERT_EQ (
+    PxeBcDhcp6Discover (
+      &(PxeBcDhcp6DiscoverTest::Private),
+      0,
+      NULL,
+      FALSE,
+      (EFI_IP_ADDRESS *)&DestIp
+      ),
+    EFI_OUT_OF_RESOURCES
+    );
+}
+
+// Test Description
+// This will test that we can handle a packet with a valid option length
+TEST_F (PxeBcDhcp6DiscoverTest, BasicUsageTest) {
+  EFI_IPv6_ADDRESS         DestIp     = { 0 };
+  EFI_DHCP6_PACKET_OPTION  RequestOpt = { 0 }; // the data section doesn't really matter
+
+  RequestOpt.OpCode = HTONS (0x1337);
+  RequestOpt.OpLen  = HTONS (0x30);
+
+  UINT8  *Cursor = (UINT8 *)(Private.Dhcp6Request->Dhcp6.Option);
+
+  CopyMem (Cursor, &RequestOpt, sizeof (RequestOpt));
+  Cursor += sizeof (RequestOpt);
+
+  Private.Dhcp6Request->Length = (UINT16)(Cursor - (UINT8 *)Private.Dhcp6Request);
+
+  EXPECT_CALL (RtServicesMock, gRT_GetTime)
+    .WillOnce (::testing::Return (0));
+
+  ASSERT_EQ (
+    PxeBcDhcp6Discover (
+      &(PxeBcDhcp6DiscoverTest::Private),
+      0,
+      NULL,
+      FALSE,
+      (EFI_IP_ADDRESS *)&DestIp
+      ),
+    EFI_SUCCESS
+    );
+}
+diff --git a/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h b/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h
+index b17c314791..0d825e4425 100644
+--- a/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h
+++ b/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h
+@@ -47,4 +47,22 @@ PxeBcCacheDnsServerAddresses (
+   IN PXEBC_DHCP6_PACKET_CACHE  *Cache6
+   );
+ 
+/**
+  Build and send out the request packet for the bootfile, and parse the reply.
+
+  @param[in]  Private               The pointer to PxeBc private data.
+  @param[in]  Index                 PxeBc option boot item type.
+
+  @retval     EFI_SUCCESS           Successfully discovered the boot file.
+  @retval     EFI_OUT_OF_RESOURCES  Failed to allocate resources.
+  @retval     EFI_NOT_FOUND         Can't get the PXE reply packet.
+  @retval     Others                Failed to discover the boot file.
+
+**/
+EFI_STATUS
+PxeBcRequestBootService (
+  IN  PXEBC_PRIVATE_DATA  *Private,
+  IN  UINT32              Index
+  );
+
+ #endif // PXE_BC_DHCP6_GOOGLE_TEST_H_
+-- 
+2.39.3
+
--- a/SOURCES/edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch
+++ b/SOURCES/edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch
@ -0,0 +1,202 @@
+From d6cdd646e7d9c4cfc78a061d66ab9ba4d2f02cf3 Mon Sep 17 00:00:00 2001
+From: Doug Flick <dougflick@microsoft.com>
+Date: Wed, 8 May 2024 22:56:24 -0700
+Subject: [PATCH] OvmfPkg: Add Hash2DxeCrypto to OvmfPkg
+
+RH-Author: Oliver Steffen <osteffen@redhat.com>
+RH-MergeRequest: 81: OvmfPkg: Add Hash2DxeCrypto to OvmfPkg
+RH-Jira: RHEL-53009
+RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
+RH-Commit: [1/1] 07d3c21a816826beefe963908284cc8b5dd0b075
+
+JIRA: https://issues.redhat.com/browse/RHEL-53009
+Upstream: Merged
+
+Upstream commit 4c4ceb2ceb80 ("NetworkPkg: SECURITY PATCH CVE-2023-45237")
+broke HTTP boot in OVMF. This fixes it.
+
+commit cb9d71189134e78efb00759eb9649ce92bf5b29a
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Wed May 8 22:56:24 2024 -0700
+
+    OvmfPkg: Add Hash2DxeCrypto to OvmfPkg
+
+    This patch adds Hash2DxeCrypto to OvmfPkg. The Hash2DxeCrypto is
+    used to provide the hashing protocol services.
+
+    Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+    Cc: Gerd Hoffmann <kraxel@redhat.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Tested-by: Gerd Hoffmann <kraxel@redhat.com>
+    Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+    Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+
+Signed-off-by: Oliver Steffen <osteffen@redhat.com>
+---
+ OvmfPkg/OvmfPkgIa32.dsc    | 6 +++++-
+ OvmfPkg/OvmfPkgIa32.fdf    | 5 +++++
+ OvmfPkg/OvmfPkgIa32X64.dsc | 6 +++++-
+ OvmfPkg/OvmfPkgIa32X64.fdf | 5 +++++
+ OvmfPkg/OvmfPkgX64.dsc     | 6 +++++-
+ OvmfPkg/OvmfPkgX64.fdf     | 5 +++++
+ OvmfPkg/OvmfXen.dsc        | 5 +++++
+ OvmfPkg/OvmfXen.fdf        | 5 +++++
+ 8 files changed, 40 insertions(+), 3 deletions(-)
+
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index f03906a9ff..47c1732409 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
+++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -213,7 +213,6 @@
+   VariablePolicyLib|MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf
+   VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf
+ 
+-
+   #
+   # Network libraries
+   #
+@@ -884,6 +883,11 @@
+   MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
+   MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
+ 
+  #
+  # Hash2 Protocol producer
+  #
+  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
+
+   #
+   # Network Support
+   #
+diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
+index 050148948c..71fb83b285 100644
+--- a/OvmfPkg/OvmfPkgIa32.fdf
+++ b/OvmfPkg/OvmfPkgIa32.fdf
+@@ -300,6 +300,11 @@ INF  ShellPkg/Application/Shell/Shell.inf
+ 
+ INF MdeModulePkg/Logo/LogoDxe.inf
+ 
+#
+# Hash2 Protocol producer
+#
+INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
+
+ #
+ # Network modules
+ #
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index 81145050c3..186f783ff5 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -217,7 +217,6 @@
+   VariablePolicyLib|MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf
+   VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf
+ 
+-
+   #
+   # Network libraries
+   #
+@@ -898,6 +897,11 @@
+   MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
+   MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
+ 
+  #
+  # Hash2 Protocol producer
+  #
+  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
+
+   #
+   # Network Support
+   #
+diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
+index 3e2373f225..6762627073 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.fdf
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
+@@ -304,6 +304,11 @@ INF  ShellPkg/Application/Shell/Shell.inf
+ 
+ INF MdeModulePkg/Logo/LogoDxe.inf
+ 
+#
+# Hash2 Protocol producer
+#
+INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
+
+ #
+ # Network modules
+ #
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index 1cb169b447..e968ab6be2 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -217,7 +217,6 @@
+   VariablePolicyLib|MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf
+   VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf
+ 
+-
+   #
+   # Network libraries
+   #
+@@ -896,6 +895,11 @@
+   MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
+   MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
+ 
+  #
+  # Hash2 Protocol producer
+  #
+  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
+
+   #
+   # Network Support
+   #
+diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
+index 8ba0ca437a..95544c2bc5 100644
+--- a/OvmfPkg/OvmfPkgX64.fdf
+++ b/OvmfPkg/OvmfPkgX64.fdf
+@@ -320,6 +320,11 @@ INF  ShellPkg/Application/Shell/Shell.inf
+ 
+ INF MdeModulePkg/Logo/LogoDxe.inf
+ 
+#
+# Hash2 Protocol producer
+#
+INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
+
+ #
+ # Network modules
+ #
+diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc
+index e7c36d1b80..462e57ddcc 100644
+--- a/OvmfPkg/OvmfXen.dsc
+++ b/OvmfPkg/OvmfXen.dsc
+@@ -660,6 +660,11 @@
+   MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
+   MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
+ 
+  #
+  # Hash2 Protocol producer
+  #
+  SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
+
+   #
+   # Network Support
+   #
+diff --git a/OvmfPkg/OvmfXen.fdf b/OvmfPkg/OvmfXen.fdf
+index 8b58235559..3c64619e8e 100644
+--- a/OvmfPkg/OvmfXen.fdf
+++ b/OvmfPkg/OvmfXen.fdf
+@@ -369,6 +369,11 @@ INF  ShellPkg/Application/Shell/Shell.inf
+ 
+ INF MdeModulePkg/Logo/LogoDxe.inf
+ 
+#
+# Hash2 Protocol producer
+#
+INF SecurityPkg/Hash2DxeCrypto/Hash2DxeCrypto.inf
+
+ #
+ # Network modules
+ #
+-- 
+2.45.1
+
--- a/SOURCES/edk2-OvmfPkg-Add-a-Fallback-RNG-RH-only.patch
+++ b/SOURCES/edk2-OvmfPkg-Add-a-Fallback-RNG-RH-only.patch
@ -0,0 +1,348 @@
+From 8d1a7ee22fc04d2106f08461415ee8bc9c68eee6 Mon Sep 17 00:00:00 2001
+From: Oliver Steffen <osteffen@redhat.com>
+Date: Mon, 4 Nov 2024 12:40:12 +0100
+Subject: [PATCH 1/2] OvmfPkg: Add a Fallback RNG (RH only)
+
+RH-Author: Oliver Steffen <osteffen@redhat.com>
+RH-MergeRequest: 104: OvmfPkg: Add a Fallback RNG (RH only)
+RH-Jira: RHEL-66236
+RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+RH-Commit: [1/2] b222642bafac64922f5fc30abf56347fe4a849ed
+
+Since the pixiefail CVE fix, the network stack requires a random number
+generator.
+In case there is no hardware random number generator available,
+have the Platform Boot Manager install a pseudo RNG to ensure
+the network can be used.
+
+Signed-off-by: Oliver Steffen <osteffen@redhat.com>
+---
+ .../PlatformBootManagerLib/BdsPlatform.c      |   6 +
+ .../PlatformBootManagerLib/FallbackRng.c      | 222 ++++++++++++++++++
+ .../PlatformBootManagerLib/FallbackRng.h      |  20 ++
+ .../PlatformBootManagerLib.inf                |   5 +
+ 4 files changed, 253 insertions(+)
+ create mode 100644 OvmfPkg/Library/PlatformBootManagerLib/FallbackRng.c
+ create mode 100644 OvmfPkg/Library/PlatformBootManagerLib/FallbackRng.h
+
+diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+index 186401296a..70d648c7e3 100644
+--- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+@@ -14,6 +14,7 @@
+ #include <Library/Tcg2PhysicalPresenceLib.h>
+ #include <Library/XenPlatformLib.h>
+ 
+#include "FallbackRng.h"
+ 
+ //
+ // Global data
+@@ -446,6 +447,9 @@ PlatformBootManagerBeforeConsole (
+   //
+   VisitAllInstancesOfProtocol (&gEfiPciIoProtocolGuid, ConnectVirtioPciRng,
+     NULL);
+
+  FallbackRngCheckAndInstall ();
+
+ }
+ 
+ 
+@@ -1528,6 +1532,8 @@ PlatformBootManagerAfterConsole (
+ 
+   DEBUG ((DEBUG_INFO, "PlatformBootManagerAfterConsole\n"));
+ 
+  FallbackRngPrintWarning ();
+
+   if (PcdGetBool (PcdOvmfFlashVariablesEnable)) {
+     DEBUG ((DEBUG_INFO, "PlatformBdsPolicyBehavior: not restoring NvVars "
+       "from disk since flash variables appear to be supported.\n"));
+diff --git a/OvmfPkg/Library/PlatformBootManagerLib/FallbackRng.c b/OvmfPkg/Library/PlatformBootManagerLib/FallbackRng.c
+new file mode 100644
+index 0000000000..bba60e29d5
+--- /dev/null
+++ b/OvmfPkg/Library/PlatformBootManagerLib/FallbackRng.c
+@@ -0,0 +1,222 @@
+/** @file
+  Copyright (C) 2024, Red Hat, Inc.
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include <Uefi/UefiBaseType.h>
+#include <Uefi/UefiSpec.h>
+#include <Protocol/Rng.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/BaseLib.h>
+#include <Library/DebugLib.h>
+#include <Library/RngLib.h>
+#include <Library/UefiBootServicesTableLib.h>
+#include <Library/UefiLib.h>
+#include <Library/PrintLib.h>
+#include <Library/DxeServicesTableLib.h>
+
+#include "FallbackRng.h"
+
+typedef struct {
+  EFI_RNG_PROTOCOL    Rng;
+  EFI_HANDLE          Handle;
+} FALLBACK_RNG_DEV;
+
+/**
+  Returns information about the random number generation implementation.
+
+  @param[in]     This                 A pointer to the EFI_RNG_PROTOCOL
+                                      instance.
+  @param[in,out] RNGAlgorithmListSize On input, the size in bytes of
+                                      RNGAlgorithmList.
+                                      On output with a return code of
+                                      EFI_SUCCESS, the size in bytes of the
+                                      data returned in RNGAlgorithmList. On
+                                      output with a return code of
+                                      EFI_BUFFER_TOO_SMALL, the size of
+                                      RNGAlgorithmList required to obtain the
+                                      list.
+  @param[out] RNGAlgorithmList        A caller-allocated memory buffer filled
+                                      by the driver with one EFI_RNG_ALGORITHM
+                                      element for each supported RNG algorithm.
+                                      The list must not change across multiple
+                                      calls to the same driver. The first
+                                      algorithm in the list is the default
+                                      algorithm for the driver.
+
+  @retval EFI_SUCCESS                 The RNG algorithm list was returned
+                                      successfully.
+  @retval EFI_UNSUPPORTED             The services is not supported by this
+                                      driver.
+  @retval EFI_DEVICE_ERROR            The list of algorithms could not be
+                                      retrieved due to a hardware or firmware
+                                      error.
+  @retval EFI_INVALID_PARAMETER       One or more of the parameters are
+                                      incorrect.
+  @retval EFI_BUFFER_TOO_SMALL        The buffer RNGAlgorithmList is too small
+                                      to hold the result.
+
+**/
+STATIC
+EFI_STATUS
+EFIAPI
+FallbackRngGetInfo (
+  IN      EFI_RNG_PROTOCOL   *This,
+  IN OUT  UINTN              *RNGAlgorithmListSize,
+  OUT     EFI_RNG_ALGORITHM  *RNGAlgorithmList
+  )
+{
+  if ((This == NULL) || (RNGAlgorithmListSize == NULL)) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  if (*RNGAlgorithmListSize < sizeof (EFI_RNG_ALGORITHM)) {
+    *RNGAlgorithmListSize = sizeof (EFI_RNG_ALGORITHM);
+    return EFI_BUFFER_TOO_SMALL;
+  }
+
+  if (RNGAlgorithmList == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  *RNGAlgorithmListSize = sizeof (EFI_RNG_ALGORITHM);
+  CopyGuid (RNGAlgorithmList, &gEfiRngAlgorithmRaw);
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Produces and returns an RNG value using either the default or specified RNG
+  algorithm.
+
+  @param[in]  This                    A pointer to the EFI_RNG_PROTOCOL
+                                      instance.
+  @param[in]  RNGAlgorithm            A pointer to the EFI_RNG_ALGORITHM that
+                                      identifies the RNG algorithm to use. May
+                                      be NULL in which case the function will
+                                      use its default RNG algorithm.
+  @param[in]  RNGValueLength          The length in bytes of the memory buffer
+                                      pointed to by RNGValue. The driver shall
+                                      return exactly this numbers of bytes.
+  @param[out] RNGValue                A caller-allocated memory buffer filled
+                                      by the driver with the resulting RNG
+                                      value.
+
+  @retval EFI_SUCCESS                 The RNG value was returned successfully.
+  @retval EFI_UNSUPPORTED             The algorithm specified by RNGAlgorithm
+                                      is not supported by this driver.
+  @retval EFI_DEVICE_ERROR            An RNG value could not be retrieved due
+                                      to a hardware or firmware error.
+  @retval EFI_NOT_READY               There is not enough random data available
+                                      to satisfy the length requested by
+                                      RNGValueLength.
+  @retval EFI_INVALID_PARAMETER       RNGValue is NULL or RNGValueLength is
+                                      zero.
+
+**/
+STATIC
+EFI_STATUS
+EFIAPI
+FallbackRngGetRNG (
+  IN EFI_RNG_PROTOCOL   *This,
+  IN EFI_RNG_ALGORITHM  *RNGAlgorithm  OPTIONAL,
+  IN UINTN              RNGValueLength,
+  OUT UINT8             *RNGValue
+  )
+{
+  UINT64      RandomData;
+  EFI_STATUS  Status;
+  UINTN       i;
+
+  if ((This == NULL) || (RNGValueLength == 0) || (RNGValue == NULL)) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  //
+  // We only support the raw algorithm, so reject requests for anything else
+  //
+  if ((RNGAlgorithm != NULL) &&
+      !CompareGuid (RNGAlgorithm, &gEfiRngAlgorithmRaw))
+  {
+    return EFI_UNSUPPORTED;
+  }
+
+  for (i = 0; i < RNGValueLength; ++i) {
+    if (i % 4 == 0) {
+      Status = GetRandomNumber64 (&RandomData);
+      if (EFI_ERROR (Status)) {
+        return Status;
+      }
+    }
+  }
+
+  return EFI_SUCCESS;
+}
+
+static FALLBACK_RNG_DEV  Dev = {
+  .Rng.GetInfo = FallbackRngGetInfo,
+  .Rng.GetRNG  = FallbackRngGetRNG,
+  .Handle      = NULL,
+};
+
+EFI_STATUS
+FallbackRngCheckAndInstall (
+  )
+{
+  EFI_STATUS  Status;
+  EFI_HANDLE  *HandleBuffer = NULL;
+  UINTN       HandleCount   = 0;
+
+  if (Dev.Handle != NULL) {
+    DEBUG ((DEBUG_INFO, "Fallback RNG already installed.\n"));
+    return EFI_ALREADY_STARTED;
+  }
+
+  Status = gBS->LocateHandleBuffer (
+                  ByProtocol,
+                  &gEfiRngProtocolGuid,
+                  NULL,
+                  &HandleCount,
+                  &HandleBuffer
+                  );
+
+  gBS->FreePool (HandleBuffer);
+
+  if (Status == EFI_NOT_FOUND) {
+    HandleCount = 0;
+  } else if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "Error locating RNG protocol instances: %r\n", Status));
+    return Status;
+  }
+
+  DEBUG ((DEBUG_INFO, "Found %u RNGs\n", HandleCount));
+
+  if (HandleCount == 0) {
+    // Install RNG
+    Status = gBS->InstallProtocolInterface (
+                    &Dev.Handle,
+                    &gEfiRngProtocolGuid,
+                    EFI_NATIVE_INTERFACE,
+                    &Dev.Rng
+                    );
+    if (EFI_ERROR (Status)) {
+      DEBUG ((DEBUG_ERROR, "Failed to install fallback RNG: %r\n", Status));
+      return Status;
+    }
+
+    gDS->Dispatch ();
+  }
+
+  return EFI_SUCCESS;
+}
+
+VOID
+FallbackRngPrintWarning (
+  )
+{
+  if (Dev.Handle != NULL) {
+    Print (L"WARNING: Pseudo Random Number Generator in use - Pixiefail CVE not mitigated!\n");
+    DEBUG ((DEBUG_WARN, "WARNING: Pseudo Random Number Generator in use - Pixiefail CVE not mitigated!\n"));
+    gBS->Stall (2000000);
+  }
+}
+diff --git a/OvmfPkg/Library/PlatformBootManagerLib/FallbackRng.h b/OvmfPkg/Library/PlatformBootManagerLib/FallbackRng.h
+new file mode 100644
+index 0000000000..77332bc51c
+--- /dev/null
+++ b/OvmfPkg/Library/PlatformBootManagerLib/FallbackRng.h
+@@ -0,0 +1,20 @@
+/** @file
+  Copyright (C) 2024, Red Hat, Inc.
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef _FALLBACK_RNG_H_
+#define _FALLBACK_RNG_H_
+
+#include <Uefi/UefiBaseType.h>
+#include <Uefi/UefiSpec.h>
+
+EFI_STATUS
+FallbackRngCheckAndInstall (
+  );
+
+VOID
+FallbackRngPrintWarning (
+  );
+
+#endif
+diff --git a/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+index c249a3cf1e..154b0b6c88 100644
+--- a/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+++ b/OvmfPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+@@ -25,6 +25,8 @@
+   PlatformData.c
+   QemuKernel.c
+   BdsPlatform.h
+  FallbackRng.c
+  FallbackRng.h
+ 
+ [Packages]
+   MdePkg/MdePkg.dec
+@@ -56,6 +58,7 @@
+   PlatformBmPrintScLib
+   Tcg2PhysicalPresenceLib
+   XenPlatformLib
+  RngLib
+ 
+ [Pcd]
+   gUefiOvmfPkgTokenSpaceGuid.PcdEmuVariableEvent
+@@ -78,9 +81,11 @@
+   gEfiDxeSmmReadyToLockProtocolGuid             # PROTOCOL SOMETIMES_PRODUCED
+   gEfiLoadedImageProtocolGuid                   # PROTOCOL SOMETIMES_PRODUCED
+   gEfiFirmwareVolume2ProtocolGuid               # PROTOCOL SOMETIMES_CONSUMED
+  gEfiRngProtocolGuid                           # PROTOCOL SOMETIMES_PRODUCED
+ 
+ [Guids]
+   gEfiEndOfDxeEventGroupGuid
+   gEfiGlobalVariableGuid
+   gRootBridgesConnectedEventGroupGuid
+   gUefiShellFileGuid
+  gEfiRngAlgorithmRaw
+-- 
+2.45.2
+
--- a/SOURCES/edk2-OvmfPkg-ArmVirtPkg-Add-a-Fallback-RNG-RH-only.patch
+++ b/SOURCES/edk2-OvmfPkg-ArmVirtPkg-Add-a-Fallback-RNG-RH-only.patch
@ -0,0 +1,92 @@
+From c465cf5cf3fbd09caf82d2c34fc6f127f5648b48 Mon Sep 17 00:00:00 2001
+From: Oliver Steffen <osteffen@redhat.com>
+Date: Thu, 7 Nov 2024 11:36:22 +0100
+Subject: [PATCH 2/2] OvmfPkg/ArmVirtPkg: Add a Fallback RNG (RH only)
+
+RH-Author: Oliver Steffen <osteffen@redhat.com>
+RH-MergeRequest: 104: OvmfPkg: Add a Fallback RNG (RH only)
+RH-Jira: RHEL-66236
+RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+RH-Commit: [2/2] d7748d697e522ab5ef70702da53241db71e602fe
+
+Since the pixiefail CVE fix, the network stack requires a random number
+generator.
+In case there is no hardware random number generator available,
+have the Platform Boot Manager install a pseudo RNG to ensure
+the network can be used.
+
+This patch adds the fallback rng which was introduced in a
+previous commit also to the ArmVirtPkg PlatformBootManagerLib.
+
+Signed-off-by: Oliver Steffen <osteffen@redhat.com>
+---
+ ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c       | 5 +++++
+ .../PlatformBootManagerLib/PlatformBootManagerLib.inf        | 5 +++++
+ 2 files changed, 10 insertions(+)
+
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+index 1848042f86..c4cfbfc7f6 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+@@ -29,6 +29,7 @@
+ #include <Guid/GlobalVariable.h>
+ #include <Guid/RootBridgesConnectedEventGroup.h>
+ #include <Guid/SerialPortLibVendor.h>
+#include "FallbackRng.h"
+ 
+ #include "PlatformBm.h"
+ 
+@@ -793,6 +794,8 @@ PlatformBootManagerBeforeConsole (
+   // instances on Virtio PCI RNG devices.
+   //
+   FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciRng, Connect);
+
+  FallbackRngCheckAndInstall ();
+ }
+ 
+ /**
+@@ -814,6 +817,8 @@ PlatformBootManagerAfterConsole (
+ {
+   RETURN_STATUS Status;
+ 
+  FallbackRngPrintWarning ();
+
+   //
+   // Show the splash screen.
+   //
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+index 997eb1a442..d4ea9bef60 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+@@ -27,6 +27,8 @@
+   PlatformBm.c
+   PlatformBm.h
+   QemuKernel.c
+  ../../../OvmfPkg/Library/PlatformBootManagerLib/FallbackRng.h
+  ../../../OvmfPkg/Library/PlatformBootManagerLib/FallbackRng.c
+ 
+ [Packages]
+   ArmVirtPkg/ArmVirtPkg.dec
+@@ -53,6 +55,7 @@
+   UefiBootServicesTableLib
+   UefiLib
+   UefiRuntimeServicesTableLib
+  RngLib
+ 
+ [FixedPcd]
+   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultBaudRate
+@@ -69,9 +72,11 @@
+   gEfiGlobalVariableGuid
+   gRootBridgesConnectedEventGroupGuid
+   gUefiShellFileGuid
+  gEfiRngAlgorithmRaw
+ 
+ [Protocols]
+   gEfiFirmwareVolume2ProtocolGuid
+   gEfiGraphicsOutputProtocolGuid
+   gEfiPciRootBridgeIoProtocolGuid
+   gVirtioDeviceProtocolGuid
+  gEfiRngProtocolGuid
+-- 
+2.45.2
+
--- a/SOURCES/edk2-OvmfPkg-Rerun-dispatcher-after-initializing-virtio-r.patch
+++ b/SOURCES/edk2-OvmfPkg-Rerun-dispatcher-after-initializing-virtio-r.patch
@ -0,0 +1,45 @@
+From a56ec52966412cd44dd2427ba569d1e7b89a6c6d Mon Sep 17 00:00:00 2001
+From: Oliver Steffen <osteffen@redhat.com>
+Date: Mon, 4 Nov 2024 19:00:11 +0100
+Subject: [PATCH] OvmfPkg: Rerun dispatcher after initializing virtio-rng
+
+RH-Author: Oliver Steffen <osteffen@redhat.com>
+RH-MergeRequest: 106: OvmfPkg: Rerun dispatcher after initializing virtio-rng
+RH-Jira: RHEL-66188
+RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+RH-Commit: [1/1] a62e445ae8e45d656aaa2ea5f1875541e658f1d8
+
+Since the pixiefail CVE fix the network stack requires a hardware
+random number generator. This can currently be a modern CPU supporting
+the RDRAND instruction or a virtio-rng device.
+The latter is initialized during the BDS phase.
+To ensure all depending (network) modules are also started, we need to
+run the dispatcher once more after the device was initialized.
+Without this, network boot is not available under certain hardware
+configurations.
+
+Fixes: 4c4ceb2ceb ("NetworkPkg: SECURITY PATCH CVE-2023-45237")
+
+Analysed-by: Stefano Garzarella <sgarzare@redhat.com>
+Suggested-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Oliver Steffen <osteffen@redhat.com>
+---
+ OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+index 70d648c7e3..eb97d67b62 100644
+--- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+@@ -558,6 +558,8 @@ ConnectVirtioPciRng (
+     if (EFI_ERROR (Status)) {
+       goto Error;
+     }
+
+    gDS->Dispatch ();
+   }
+   return EFI_SUCCESS;
+ 
+-- 
+2.45.2
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-ValidateFvHeader-unwritten-s.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-ValidateFvHeader-unwritten-s.patch
@ -0,0 +1,47 @@
+From f2aeff31924f6d070d7f8b87550dc6d9820531ad Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jan 2024 18:11:04 +0100
+Subject: [PATCH 15/18] OvmfPkg/VirtNorFlashDxe: ValidateFvHeader: unwritten
+ state is EOL too
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [17/20] 37220c700ea816c815e0612031e10b7d466b71a2
+
+It is possible to find variable entries with State being 0xff, i.e. not
+updated since flash block erase.   This indicates the variable driver
+could not complete the header write while appending a new entry, and
+therefore State was not set to VAR_HEADER_VALID_ONLY.
+
+This can only happen at the end of the variable list, so treat this as
+additional "end of variable list" condition.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240116171105.37831-6-kraxel@redhat.com>
+(cherry picked from commit 735d0a5e2e25c1577bf9bea7826da937ca38169d)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+index acc4a413ee..f8e71f88c1 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+@@ -302,6 +302,11 @@ ValidateFvHeader (
+       break;
+     }
+ 
+    if (VarHeader->State == 0xff) {
+      DEBUG ((DEBUG_INFO, "%a: end of var list (unwritten state)\n", __func__));
+      break;
+    }
+
+     VarName = NULL;
+     switch (VarHeader->State) {
+       // usage: State = VAR_HEADER_VALID_ONLY
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-add-a-loop-for-NorFlashWrite.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-add-a-loop-for-NorFlashWrite.patch
@ -0,0 +1,73 @@
+From 00d9e2d6cb03afeef5a1110d6f1fae1389a06f7a Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jan 2024 18:11:02 +0100
+Subject: [PATCH 13/18] OvmfPkg/VirtNorFlashDxe: add a loop for
+ NorFlashWriteBuffer calls.
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [15/20] 72004a196ea61d627ab528573db657dd7db16de2
+
+Replace the two NorFlashWriteBuffer() calls with a loop containing a
+single NorFlashWriteBuffer() call.
+
+With the changes in place the code is able to handle updates larger
+than two P30_MAX_BUFFER_SIZE_IN_BYTES blocks, even though the patch
+does not actually change the size limit.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240116171105.37831-4-kraxel@redhat.com>
+(cherry picked from commit 28ffd726894f11a587a6ac7f71a4c4af341e24d2)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 21 ++++++++-------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 88a4d2c23f..3d1343b381 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -521,6 +521,7 @@ NorFlashWriteSingleBlock (
+   UINTN       BlockAddress;
+   UINT8       *OrigData;
+   UINTN       Start, End;
+  UINT32      Index, Count;
+ 
+   DEBUG ((DEBUG_BLKIO, "NorFlashWriteSingleBlock(Parameters: Lba=%ld, Offset=0x%x, *NumBytes=0x%x, Buffer @ 0x%08x)\n", Lba, Offset, *NumBytes, Buffer));
+ 
+@@ -621,23 +622,17 @@ NorFlashWriteSingleBlock (
+       goto Exit;
+     }
+ 
+-    Status = NorFlashWriteBuffer (
+-               Instance,
+-               BlockAddress + Start,
+-               P30_MAX_BUFFER_SIZE_IN_BYTES,
+-               Instance->ShadowBuffer
+-               );
+-    if (EFI_ERROR (Status)) {
+-      goto Exit;
+-    }
+-
+-    if ((End - Start) > P30_MAX_BUFFER_SIZE_IN_BYTES) {
+    Count = (End - Start) / P30_MAX_BUFFER_SIZE_IN_BYTES;
+    for (Index = 0; Index < Count; Index++) {
+       Status = NorFlashWriteBuffer (
+                  Instance,
+-                 BlockAddress + Start + P30_MAX_BUFFER_SIZE_IN_BYTES,
+                 BlockAddress + Start + Index * P30_MAX_BUFFER_SIZE_IN_BYTES,
+                  P30_MAX_BUFFER_SIZE_IN_BYTES,
+-                 Instance->ShadowBuffer + P30_MAX_BUFFER_SIZE_IN_BYTES
+                 Instance->ShadowBuffer + Index * P30_MAX_BUFFER_SIZE_IN_BYTES
+                  );
+      if (EFI_ERROR (Status)) {
+        goto Exit;
+      }
+     }
+ 
+ Exit:
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-add-casts-to-UINTN-and-UINT3.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-add-casts-to-UINTN-and-UINT3.patch
@ -0,0 +1,55 @@
+From e8150ee7fdf1421d2e2801c901e0196496ef599e Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jan 2024 18:11:00 +0100
+Subject: [PATCH 11/18] OvmfPkg/VirtNorFlashDxe: add casts to UINTN and UINT32
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [13/20] fa695acadb9d693242b5221d2bc1958b929718e7
+
+This is needed to avoid bit operations being applied to signed integers.
+
+Suggested-by: László Érsek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240116171105.37831-2-kraxel@redhat.com>
+(cherry picked from commit 0395045ae307c43a41f72ca9a8bf4eb8f16b2fe0)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 2 +-
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 1afd60ce66..7f4743b003 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -581,7 +581,7 @@ NorFlashWriteSingleBlock (
+     // contents, while checking whether the old version had any bits cleared
+     // that we want to set. In that case, we will need to erase the block first.
+     for (CurOffset = 0; CurOffset < *NumBytes; CurOffset++) {
+-      if (~OrigData[CurOffset] & Buffer[CurOffset]) {
+      if (~(UINT32)OrigData[CurOffset] & (UINT32)Buffer[CurOffset]) {
+         goto DoErase;
+       }
+ 
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h
+index b7f5d208b2..455eafacc2 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h
+@@ -61,7 +61,7 @@
+ #define P30_MAX_BUFFER_SIZE_IN_BYTES  ((UINTN)128)
+ #define P30_MAX_BUFFER_SIZE_IN_WORDS  (P30_MAX_BUFFER_SIZE_IN_BYTES/((UINTN)4))
+ #define MAX_BUFFERED_PROG_ITERATIONS  10000000
+-#define BOUNDARY_OF_32_WORDS          0x7F
+#define BOUNDARY_OF_32_WORDS          ((UINTN)0x7F)
+ 
+ // CFI Addresses
+ #define P30_CFI_ADDR_QUERY_UNIQUE_QRY  0x10
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-allow-larger-writes-without-.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-allow-larger-writes-without-.patch
@ -0,0 +1,65 @@
+From 0193a89b0db837da31301bc1edb8382927842978 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jan 2024 18:11:03 +0100
+Subject: [PATCH 14/18] OvmfPkg/VirtNorFlashDxe: allow larger writes without
+ block erase
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [16/20] 27ac63b90eb5e6fdc00cbc5a9105c3178ee559cd
+
+Raise the limit for writes without block erase from two to four
+P30_MAX_BUFFER_SIZE_IN_BYTES blocks.  With this in place almost all efi
+variable updates are handled without block erase.  With the old limit
+some variable updates (with device paths) took the block erase code
+path.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240116171105.37831-5-kraxel@redhat.com>
+(cherry picked from commit b25733c97442513890ae6bb8e10fd340f13844a7)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 3d1343b381..3d1d20daa1 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -550,13 +550,15 @@ NorFlashWriteSingleBlock (
+     return EFI_BAD_BUFFER_SIZE;
+   }
+ 
+-  // Pick P30_MAX_BUFFER_SIZE_IN_BYTES (== 128 bytes) as a good start for word
+-  // operations as opposed to erasing the block and writing the data regardless
+-  // if an erase is really needed.  It looks like most individual NV variable
+-  // writes are smaller than 128 bytes.
+-  // To avoid pathological cases were a 2 byte write is disregarded because it
+-  // occurs right at a 128 byte buffered write alignment boundary, permit up to
+-  // twice the max buffer size, and perform two writes if needed.
+  // Pick 4 * P30_MAX_BUFFER_SIZE_IN_BYTES (== 512 bytes) as a good
+  // start for word operations as opposed to erasing the block and
+  // writing the data regardless if an erase is really needed.
+  //
+  // Many NV variable updates are small enough for a a single
+  // P30_MAX_BUFFER_SIZE_IN_BYTES block write.  In case the update is
+  // larger than a single block, or the update crosses a
+  // P30_MAX_BUFFER_SIZE_IN_BYTES boundary (as shown in the diagram
+  // below), or both, we might have to write two or more blocks.
+   //
+   //    0               128              256
+   //    [----------------|----------------]
+@@ -578,7 +580,7 @@ NorFlashWriteSingleBlock (
+   Start = Offset & ~BOUNDARY_OF_32_WORDS;
+   End   = ALIGN_VALUE (Offset + *NumBytes, P30_MAX_BUFFER_SIZE_IN_BYTES);
+ 
+-  if ((End - Start) <= (2 * P30_MAX_BUFFER_SIZE_IN_BYTES)) {
+  if ((End - Start) <= (4 * P30_MAX_BUFFER_SIZE_IN_BYTES)) {
+     // Check to see if we need to erase before programming the data into NOR.
+     // If the destination bits are only changing from 1s to 0s we can just write.
+     // After a block is erased all bits in the block is set to 1.
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-avoid-array-mode-switch-afte.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-avoid-array-mode-switch-afte.patch
@ -0,0 +1,89 @@
+From 20ba071dabad6b0f5663083a017799b7a6e684c5 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 24 Oct 2022 17:34:09 +0200
+Subject: [PATCH 05/18] OvmfPkg/VirtNorFlashDxe: avoid array mode switch after
+ each word write
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [7/20] 274f2ed71a6d5d3f6497129ee3c62f494cc2f067
+
+NorFlashWriteSingleWord() switches into programming mode and back into
+array mode for every single word that it writes. Under KVM, this
+involves tearing down the read-only memslot, and setting it up again,
+which is costly and unnecessary.
+
+Instead, move the array mode switch into the callers, and only make the
+switch when the writing is done.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
+(cherry picked from commit ca01e6216a8d1a26c69018e216d1dc3f88a819a4)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c    | 12 +++---------
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c |  3 +++
+ 2 files changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index f41d9d372f..0a5c5d48c7 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -205,9 +205,6 @@ NorFlashWriteSingleWord (
+     SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_CLEAR_STATUS_REGISTER);
+   }
+ 
+-  // Put device back into Read Array mode
+-  SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_READ_ARRAY);
+-
+   return Status;
+ }
+ 
+@@ -286,8 +283,7 @@ NorFlashWriteBuffer (
+ 
+   // The buffer was not available for writing
+   if (WaitForBuffer == 0) {
+-    Status = EFI_DEVICE_ERROR;
+-    goto EXIT;
+    return EFI_DEVICE_ERROR;
+   }
+ 
+   // From now on we work in 32-bit words
+@@ -337,10 +333,6 @@ NorFlashWriteBuffer (
+     SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_CLEAR_STATUS_REGISTER);
+   }
+ 
+-EXIT:
+-  // Put device back into Read Array mode
+-  SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_READ_ARRAY);
+-
+   return Status;
+ }
+ 
+@@ -739,6 +731,8 @@ NorFlashWriteSingleBlock (
+       }
+ 
+       TempStatus = NorFlashWriteSingleWord (Instance, WordAddr, WordToWrite);
+      // Put device back into Read Array mode
+      SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_READ_ARRAY);
+       if (EFI_ERROR (TempStatus)) {
+         return EFI_DEVICE_ERROR;
+       }
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+index 2ceda22635..f9a41f6aab 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+@@ -280,6 +280,9 @@ NorFlashWriteFullBlock (
+   }
+ 
+ EXIT:
+  // Put device back into Read Array mode
+  SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_READ_ARRAY);
+
+   if (!EfiAtRuntime ()) {
+     // Interruptions can resume.
+     gBS->RestoreTPL (OriginalTPL);
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-avoid-switching-between-mode.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-avoid-switching-between-mode.patch
@ -0,0 +1,303 @@
+From 67e26db39c0ec90c164634251da761f649546529 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 24 Oct 2022 17:58:07 +0200
+Subject: [PATCH 06/18] OvmfPkg/VirtNorFlashDxe: avoid switching between modes
+ in a tight loop
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [8/20] 4923b0fb1586d7955be466b90dce5f790da704ff
+
+Currently, when dealing with small updates that can be written out
+directly (i.e., if they only involve clearing bits and not setting bits,
+as the latter requires a block level erase), we iterate over the data
+one word at a time, read the old value, compare it, write the new value,
+and repeat, unless we encountered a value that we cannot write (0->1
+transition), in which case we fall back to a block level operation.
+
+This is inefficient for two reasons:
+- reading and writing a word at a time involves switching between array
+and programming mode for every word of data, which is
+disproportionately costly when running under KVM;
+- we end up writing some data twice, as we may not notice that a block
+erase is needed until after some data has been written to flash.
+
+So replace this sequence with a single read of up to twice the buffered
+write maximum size, followed by one or two buffered writes if the data
+can be written directly. Otherwise, fall back to the existing block
+level sequence, but without writing out part of the data twice.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
+(cherry picked from commit 25589c4a76e7e3668fd6f794dd1827e958b6719c)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 214 +++++++++----------------
+ 1 file changed, 76 insertions(+), 138 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 0a5c5d48c7..0343131a54 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -576,23 +576,20 @@ NorFlashWriteSingleBlock (
+   IN        UINT8               *Buffer
+   )
+ {
+-  EFI_STATUS  TempStatus;
+-  UINT32      Tmp;
+-  UINT32      TmpBuf;
+-  UINT32      WordToWrite;
+-  UINT32      Mask;
+-  BOOLEAN     DoErase;
+-  UINTN       BytesToWrite;
+  EFI_STATUS  Status;
+   UINTN       CurOffset;
+-  UINTN       WordAddr;
+   UINTN       BlockSize;
+   UINTN       BlockAddress;
+-  UINTN       PrevBlockAddress;
+-
+-  PrevBlockAddress = 0;
+  UINT8       *OrigData;
+ 
+   DEBUG ((DEBUG_BLKIO, "NorFlashWriteSingleBlock(Parameters: Lba=%ld, Offset=0x%x, *NumBytes=0x%x, Buffer @ 0x%08x)\n", Lba, Offset, *NumBytes, Buffer));
+ 
+  // Check we did get some memory. Buffer is BlockSize.
+  if (Instance->ShadowBuffer == NULL) {
+    DEBUG ((DEBUG_ERROR, "FvbWrite: ERROR - Buffer not ready\n"));
+    return EFI_DEVICE_ERROR;
+  }
+
+   // Cache the block size to avoid de-referencing pointers all the time
+   BlockSize = Instance->BlockSize;
+ 
+@@ -612,148 +609,89 @@ NorFlashWriteSingleBlock (
+     return EFI_BAD_BUFFER_SIZE;
+   }
+ 
+-  // Pick 128bytes as a good start for word operations as opposed to erasing the
+-  // block and writing the data regardless if an erase is really needed.
+-  // It looks like most individual NV variable writes are smaller than 128bytes.
+-  if (*NumBytes <= 128) {
+  // Pick P30_MAX_BUFFER_SIZE_IN_BYTES (== 128 bytes) as a good start for word
+  // operations as opposed to erasing the block and writing the data regardless
+  // if an erase is really needed.  It looks like most individual NV variable
+  // writes are smaller than 128 bytes.
+  // To avoid pathological cases were a 2 byte write is disregarded because it
+  // occurs right at a 128 byte buffered write alignment boundary, permit up to
+  // twice the max buffer size, and perform two writes if needed.
+  if ((*NumBytes + (Offset & BOUNDARY_OF_32_WORDS)) <= (2 * P30_MAX_BUFFER_SIZE_IN_BYTES)) {
+     // Check to see if we need to erase before programming the data into NOR.
+     // If the destination bits are only changing from 1s to 0s we can just write.
+     // After a block is erased all bits in the block is set to 1.
+     // If any byte requires us to erase we just give up and rewrite all of it.
+-    DoErase      = FALSE;
+-    BytesToWrite = *NumBytes;
+-    CurOffset    = Offset;
+-
+-    while (BytesToWrite > 0) {
+-      // Read full word from NOR, splice as required. A word is the smallest
+-      // unit we can write.
+-      TempStatus = NorFlashRead (Instance, Lba, CurOffset & ~(0x3), sizeof (Tmp), &Tmp);
+-      if (EFI_ERROR (TempStatus)) {
+-        return EFI_DEVICE_ERROR;
+-      }
+ 
+-      // Physical address of word in NOR to write.
+-      WordAddr = (CurOffset & ~(0x3)) + GET_NOR_BLOCK_ADDRESS (
+-                                          Instance->RegionBaseAddress,
+-                                          Lba,
+-                                          BlockSize
+-                                          );
+-      // The word of data that is to be written.
+-      TmpBuf = *((UINT32 *)(Buffer + (*NumBytes - BytesToWrite)));
+-
+-      // First do word aligned chunks.
+-      if ((CurOffset & 0x3) == 0) {
+-        if (BytesToWrite >= 4) {
+-          // Is the destination still in 'erased' state?
+-          if (~Tmp != 0) {
+-            // Check to see if we are only changing bits to zero.
+-            if ((Tmp ^ TmpBuf) & TmpBuf) {
+-              DoErase = TRUE;
+-              break;
+-            }
+-          }
+-
+-          // Write this word to NOR
+-          WordToWrite   = TmpBuf;
+-          CurOffset    += sizeof (TmpBuf);
+-          BytesToWrite -= sizeof (TmpBuf);
+-        } else {
+-          // BytesToWrite < 4. Do small writes and left-overs
+-          Mask = ~((~0) << (BytesToWrite * 8));
+-          // Mask out the bytes we want.
+-          TmpBuf &= Mask;
+-          // Is the destination still in 'erased' state?
+-          if ((Tmp & Mask) != Mask) {
+-            // Check to see if we are only changing bits to zero.
+-            if ((Tmp ^ TmpBuf) & TmpBuf) {
+-              DoErase = TRUE;
+-              break;
+-            }
+-          }
+-
+-          // Merge old and new data. Write merged word to NOR
+-          WordToWrite  = (Tmp & ~Mask) | TmpBuf;
+-          CurOffset   += BytesToWrite;
+-          BytesToWrite = 0;
+-        }
+-      } else {
+-        // Do multiple words, but starting unaligned.
+-        if (BytesToWrite > (4 - (CurOffset & 0x3))) {
+-          Mask = ((~0) << ((CurOffset & 0x3) * 8));
+-          // Mask out the bytes we want.
+-          TmpBuf &= Mask;
+-          // Is the destination still in 'erased' state?
+-          if ((Tmp & Mask) != Mask) {
+-            // Check to see if we are only changing bits to zero.
+-            if ((Tmp ^ TmpBuf) & TmpBuf) {
+-              DoErase = TRUE;
+-              break;
+-            }
+-          }
+-
+-          // Merge old and new data. Write merged word to NOR
+-          WordToWrite   = (Tmp & ~Mask) | TmpBuf;
+-          BytesToWrite -= (4 - (CurOffset & 0x3));
+-          CurOffset    += (4 - (CurOffset & 0x3));
+-        } else {
+-          // Unaligned and fits in one word.
+-          Mask = (~((~0) << (BytesToWrite * 8))) << ((CurOffset & 0x3) * 8);
+-          // Mask out the bytes we want.
+-          TmpBuf = (TmpBuf << ((CurOffset & 0x3) * 8)) & Mask;
+-          // Is the destination still in 'erased' state?
+-          if ((Tmp & Mask) != Mask) {
+-            // Check to see if we are only changing bits to zero.
+-            if ((Tmp ^ TmpBuf) & TmpBuf) {
+-              DoErase = TRUE;
+-              break;
+-            }
+-          }
+-
+-          // Merge old and new data. Write merged word to NOR
+-          WordToWrite  = (Tmp & ~Mask) | TmpBuf;
+-          CurOffset   += BytesToWrite;
+-          BytesToWrite = 0;
+-        }
+    // Read the old version of the data into the shadow buffer
+    Status = NorFlashRead (
+               Instance,
+               Lba,
+               Offset & ~BOUNDARY_OF_32_WORDS,
+               (*NumBytes | BOUNDARY_OF_32_WORDS) + 1,
+               Instance->ShadowBuffer
+               );
+    if (EFI_ERROR (Status)) {
+      return EFI_DEVICE_ERROR;
+    }
+
+    // Make OrigData point to the start of the old version of the data inside
+    // the word aligned buffer
+    OrigData = Instance->ShadowBuffer + (Offset & BOUNDARY_OF_32_WORDS);
+
+    // Update the buffer containing the old version of the data with the new
+    // contents, while checking whether the old version had any bits cleared
+    // that we want to set. In that case, we will need to erase the block first.
+    for (CurOffset = 0; CurOffset < *NumBytes; CurOffset++) {
+      if (~OrigData[CurOffset] & Buffer[CurOffset]) {
+        goto DoErase;
+       }
+ 
+-      //
+-      // Write the word to NOR.
+-      //
+      OrigData[CurOffset] = Buffer[CurOffset];
+    }
+ 
+-      BlockAddress = GET_NOR_BLOCK_ADDRESS (Instance->RegionBaseAddress, Lba, BlockSize);
+-      if (BlockAddress != PrevBlockAddress) {
+-        TempStatus = NorFlashUnlockSingleBlockIfNecessary (Instance, BlockAddress);
+-        if (EFI_ERROR (TempStatus)) {
+-          return EFI_DEVICE_ERROR;
+-        }
+    //
+    // Write the updated buffer to NOR.
+    //
+    BlockAddress = GET_NOR_BLOCK_ADDRESS (Instance->RegionBaseAddress, Lba, BlockSize);
+ 
+-        PrevBlockAddress = BlockAddress;
+-      }
+    // Unlock the block if we have to
+    Status = NorFlashUnlockSingleBlockIfNecessary (Instance, BlockAddress);
+    if (EFI_ERROR (Status)) {
+      goto Exit;
+    }
+ 
+-      TempStatus = NorFlashWriteSingleWord (Instance, WordAddr, WordToWrite);
+-      // Put device back into Read Array mode
+-      SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_READ_ARRAY);
+-      if (EFI_ERROR (TempStatus)) {
+-        return EFI_DEVICE_ERROR;
+-      }
+    Status = NorFlashWriteBuffer (
+               Instance,
+               BlockAddress + (Offset & ~BOUNDARY_OF_32_WORDS),
+               P30_MAX_BUFFER_SIZE_IN_BYTES,
+               Instance->ShadowBuffer
+               );
+    if (EFI_ERROR (Status)) {
+      goto Exit;
+     }
+ 
+-    // Exit if we got here and could write all the data. Otherwise do the
+-    // Erase-Write cycle.
+-    if (!DoErase) {
+-      return EFI_SUCCESS;
+    if ((*NumBytes + (Offset & BOUNDARY_OF_32_WORDS)) > P30_MAX_BUFFER_SIZE_IN_BYTES) {
+      BlockAddress += P30_MAX_BUFFER_SIZE_IN_BYTES;
+
+      Status = NorFlashWriteBuffer (
+                 Instance,
+                 BlockAddress + (Offset & ~BOUNDARY_OF_32_WORDS),
+                 P30_MAX_BUFFER_SIZE_IN_BYTES,
+                 Instance->ShadowBuffer + P30_MAX_BUFFER_SIZE_IN_BYTES
+                 );
+     }
+-  }
+ 
+-  // Check we did get some memory. Buffer is BlockSize.
+-  if (Instance->ShadowBuffer == NULL) {
+-    DEBUG ((DEBUG_ERROR, "FvbWrite: ERROR - Buffer not ready\n"));
+-    return EFI_DEVICE_ERROR;
+Exit:
+    // Put device back into Read Array mode
+    SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_READ_ARRAY);
+
+    return Status;
+   }
+ 
+DoErase:
+   // Read NOR Flash data into shadow buffer
+-  TempStatus = NorFlashReadBlocks (Instance, Lba, BlockSize, Instance->ShadowBuffer);
+-  if (EFI_ERROR (TempStatus)) {
+  Status = NorFlashReadBlocks (Instance, Lba, BlockSize, Instance->ShadowBuffer);
+  if (EFI_ERROR (Status)) {
+     // Return one of the pre-approved error statuses
+     return EFI_DEVICE_ERROR;
+   }
+@@ -762,8 +700,8 @@ NorFlashWriteSingleBlock (
+   CopyMem ((VOID *)((UINTN)Instance->ShadowBuffer + Offset), Buffer, *NumBytes);
+ 
+   // Write the modified buffer back to the NorFlash
+-  TempStatus = NorFlashWriteBlocks (Instance, Lba, BlockSize, Instance->ShadowBuffer);
+-  if (EFI_ERROR (TempStatus)) {
+  Status = NorFlashWriteBlocks (Instance, Lba, BlockSize, Instance->ShadowBuffer);
+  if (EFI_ERROR (Status)) {
+     // Return one of the pre-approved error statuses
+     return EFI_DEVICE_ERROR;
+   }
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-clarify-block-write-logic-fi.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-clarify-block-write-logic-fi.patch
@ -0,0 +1,110 @@
+From f136d4895b1477a56b916a76448ba76e67b08163 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jan 2024 18:11:01 +0100
+Subject: [PATCH 12/18] OvmfPkg/VirtNorFlashDxe: clarify block write logic &
+ fix shadowbuffer reads
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [14/20] 38009625e5f189166f7a93e236576140a7ccb393
+
+Introduce 'Start' and 'End' variables to make it easier to follow the
+logic and code flow.  Also add a ascii art diagram (based on a
+suggestion by Laszlo).
+
+This also fixes the 'Size' calculation for the NorFlashRead() call.
+Without this patch the code will read only one instead of two
+P30_MAX_BUFFER_SIZE_IN_BYTES blocks in case '*NumBytes' is smaller than
+P30_MAX_BUFFER_SIZE_IN_BYTES but 'Offset + *NumBytes' is not, i.e. the
+update range crosses a P30_MAX_BUFFER_SIZE_IN_BYTES boundary.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240116171105.37831-3-kraxel@redhat.com>
+(cherry picked from commit 35d8ea8097794b522149688b5cfaf8364bc44d54)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 36 ++++++++++++++++++++------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 7f4743b003..88a4d2c23f 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -520,6 +520,7 @@ NorFlashWriteSingleBlock (
+   UINTN       BlockSize;
+   UINTN       BlockAddress;
+   UINT8       *OrigData;
+  UINTN       Start, End;
+ 
+   DEBUG ((DEBUG_BLKIO, "NorFlashWriteSingleBlock(Parameters: Lba=%ld, Offset=0x%x, *NumBytes=0x%x, Buffer @ 0x%08x)\n", Lba, Offset, *NumBytes, Buffer));
+ 
+@@ -555,7 +556,28 @@ NorFlashWriteSingleBlock (
+   // To avoid pathological cases were a 2 byte write is disregarded because it
+   // occurs right at a 128 byte buffered write alignment boundary, permit up to
+   // twice the max buffer size, and perform two writes if needed.
+-  if ((*NumBytes + (Offset & BOUNDARY_OF_32_WORDS)) <= (2 * P30_MAX_BUFFER_SIZE_IN_BYTES)) {
+  //
+  //    0               128              256
+  //    [----------------|----------------]
+  //    ^         ^             ^         ^
+  //    |         |             |         |
+  //    |         |             |        End, the next "word" boundary beyond
+  //    |         |             |        the (logical) update
+  //    |         |             |
+  //    |         |     (Offset & BOUNDARY_OF_32_WORDS) + NumBytes;
+  //    |         |     i.e., the relative offset inside (or just past)
+  //    |         |     the *double-word* such that it is the
+  //    |         |     *exclusive* end of the (logical) update.
+  //    |         |
+  //    |         Offset & BOUNDARY_OF_32_WORDS; i.e., Offset within the "word";
+  //    |         this is where the (logical) update is supposed to start
+  //    |
+  //    Start = Offset & ~BOUNDARY_OF_32_WORDS; i.e., Offset truncated to "word" boundary
+
+  Start = Offset & ~BOUNDARY_OF_32_WORDS;
+  End   = ALIGN_VALUE (Offset + *NumBytes, P30_MAX_BUFFER_SIZE_IN_BYTES);
+
+  if ((End - Start) <= (2 * P30_MAX_BUFFER_SIZE_IN_BYTES)) {
+     // Check to see if we need to erase before programming the data into NOR.
+     // If the destination bits are only changing from 1s to 0s we can just write.
+     // After a block is erased all bits in the block is set to 1.
+@@ -565,8 +587,8 @@ NorFlashWriteSingleBlock (
+     Status = NorFlashRead (
+                Instance,
+                Lba,
+-               Offset & ~BOUNDARY_OF_32_WORDS,
+-               (*NumBytes | BOUNDARY_OF_32_WORDS) + 1,
+               Start,
+               End - Start,
+                Instance->ShadowBuffer
+                );
+     if (EFI_ERROR (Status)) {
+@@ -601,7 +623,7 @@ NorFlashWriteSingleBlock (
+ 
+     Status = NorFlashWriteBuffer (
+                Instance,
+-               BlockAddress + (Offset & ~BOUNDARY_OF_32_WORDS),
+               BlockAddress + Start,
+                P30_MAX_BUFFER_SIZE_IN_BYTES,
+                Instance->ShadowBuffer
+                );
+@@ -609,12 +631,10 @@ NorFlashWriteSingleBlock (
+       goto Exit;
+     }
+ 
+-    if ((*NumBytes + (Offset & BOUNDARY_OF_32_WORDS)) > P30_MAX_BUFFER_SIZE_IN_BYTES) {
+-      BlockAddress += P30_MAX_BUFFER_SIZE_IN_BYTES;
+-
+    if ((End - Start) > P30_MAX_BUFFER_SIZE_IN_BYTES) {
+       Status = NorFlashWriteBuffer (
+                  Instance,
+-                 BlockAddress + (Offset & ~BOUNDARY_OF_32_WORDS),
+                 BlockAddress + Start + P30_MAX_BUFFER_SIZE_IN_BYTES,
+                  P30_MAX_BUFFER_SIZE_IN_BYTES,
+                  Instance->ShadowBuffer + P30_MAX_BUFFER_SIZE_IN_BYTES
+                  );
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-clone-ArmPlatformPkg-s-NOR-f.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-clone-ArmPlatformPkg-s-NOR-f.patch
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-drop-block-I-O-protocol-impl.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-drop-block-I-O-protocol-impl.patch
@ -0,0 +1,504 @@
+From 8cf16599ade30de07c9b51f90d2208046f74fee6 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 24 Oct 2022 17:12:08 +0200
+Subject: [PATCH 04/18] OvmfPkg/VirtNorFlashDxe: drop block I/O protocol
+ implementation
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [6/20] 6843078997a30c2818e0d53a90fb7f6accb89aaf
+
+We never boot from NOR flash, and generally rely on the firmware volume
+PI protocols to expose the contents. So drop the block I/O protocol
+implementation from VirtNorFlashDxe.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
+(cherry picked from commit 83f11f957240ead9b135a778316330762b0a3acb)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c      | 49 ++++++------------
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h      | 54 ++------------------
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c   | 40 +++------------
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf |  1 -
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c   | 55 ++++++++-------------
+ 5 files changed, 45 insertions(+), 154 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 1094d48f7d..f41d9d372f 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -366,10 +366,6 @@ NorFlashWriteBlocks (
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+-  if (Instance->Media.ReadOnly == TRUE) {
+-    return EFI_WRITE_PROTECTED;
+-  }
+-
+   // We must have some bytes to read
+   DEBUG ((DEBUG_BLKIO, "NorFlashWriteBlocks: BufferSizeInBytes=0x%x\n", BufferSizeInBytes));
+   if (BufferSizeInBytes == 0) {
+@@ -377,22 +373,22 @@ NorFlashWriteBlocks (
+   }
+ 
+   // The size of the buffer must be a multiple of the block size
+-  DEBUG ((DEBUG_BLKIO, "NorFlashWriteBlocks: BlockSize in bytes =0x%x\n", Instance->Media.BlockSize));
+-  if ((BufferSizeInBytes % Instance->Media.BlockSize) != 0) {
+  DEBUG ((DEBUG_BLKIO, "NorFlashWriteBlocks: BlockSize in bytes =0x%x\n", Instance->BlockSize));
+  if ((BufferSizeInBytes % Instance->BlockSize) != 0) {
+     return EFI_BAD_BUFFER_SIZE;
+   }
+ 
+   // All blocks must be within the device
+-  NumBlocks = ((UINT32)BufferSizeInBytes) / Instance->Media.BlockSize;
+  NumBlocks = ((UINT32)BufferSizeInBytes) / Instance->BlockSize;
+ 
+-  DEBUG ((DEBUG_BLKIO, "NorFlashWriteBlocks: NumBlocks=%d, LastBlock=%ld, Lba=%ld.\n", NumBlocks, Instance->Media.LastBlock, Lba));
+  DEBUG ((DEBUG_BLKIO, "NorFlashWriteBlocks: NumBlocks=%d, LastBlock=%ld, Lba=%ld.\n", NumBlocks, Instance->LastBlock, Lba));
+ 
+-  if ((Lba + NumBlocks) > (Instance->Media.LastBlock + 1)) {
+  if ((Lba + NumBlocks) > (Instance->LastBlock + 1)) {
+     DEBUG ((DEBUG_ERROR, "NorFlashWriteBlocks: ERROR - Write will exceed last block.\n"));
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+-  BlockSizeInWords = Instance->Media.BlockSize / 4;
+  BlockSizeInWords = Instance->BlockSize / 4;
+ 
+   // Because the target *Buffer is a pointer to VOID, we must put all the data into a pointer
+   // to a proper data type, so use *ReadBuffer
+@@ -489,8 +485,8 @@ NorFlashReadBlocks (
+     DEBUG_BLKIO,
+     "NorFlashReadBlocks: BufferSize=0x%xB BlockSize=0x%xB LastBlock=%ld, Lba=%ld.\n",
+     BufferSizeInBytes,
+-    Instance->Media.BlockSize,
+-    Instance->Media.LastBlock,
+    Instance->BlockSize,
+    Instance->LastBlock,
+     Lba
+     ));
+ 
+@@ -505,14 +501,14 @@ NorFlashReadBlocks (
+   }
+ 
+   // The size of the buffer must be a multiple of the block size
+-  if ((BufferSizeInBytes % Instance->Media.BlockSize) != 0) {
+  if ((BufferSizeInBytes % Instance->BlockSize) != 0) {
+     return EFI_BAD_BUFFER_SIZE;
+   }
+ 
+   // All blocks must be within the device
+-  NumBlocks = ((UINT32)BufferSizeInBytes) / Instance->Media.BlockSize;
+  NumBlocks = ((UINT32)BufferSizeInBytes) / Instance->BlockSize;
+ 
+-  if ((Lba + NumBlocks) > (Instance->Media.LastBlock + 1)) {
+  if ((Lba + NumBlocks) > (Instance->LastBlock + 1)) {
+     DEBUG ((DEBUG_ERROR, "NorFlashReadBlocks: ERROR - Read will exceed last block\n"));
+     return EFI_INVALID_PARAMETER;
+   }
+@@ -521,7 +517,7 @@ NorFlashReadBlocks (
+   StartAddress = GET_NOR_BLOCK_ADDRESS (
+                    Instance->RegionBaseAddress,
+                    Lba,
+-                   Instance->Media.BlockSize
+                   Instance->BlockSize
+                    );
+ 
+   // Put the device into Read Array mode
+@@ -554,7 +550,7 @@ NorFlashRead (
+     return EFI_SUCCESS;
+   }
+ 
+-  if (((Lba * Instance->Media.BlockSize) + Offset + BufferSizeInBytes) > Instance->Size) {
+  if (((Lba * Instance->BlockSize) + Offset + BufferSizeInBytes) > Instance->Size) {
+     DEBUG ((DEBUG_ERROR, "NorFlashRead: ERROR - Read will exceed device size.\n"));
+     return EFI_INVALID_PARAMETER;
+   }
+@@ -563,7 +559,7 @@ NorFlashRead (
+   StartAddress = GET_NOR_BLOCK_ADDRESS (
+                    Instance->RegionBaseAddress,
+                    Lba,
+-                   Instance->Media.BlockSize
+                   Instance->BlockSize
+                    );
+ 
+   // Put the device into Read Array mode
+@@ -577,7 +573,7 @@ NorFlashRead (
+ 
+ /*
+   Write a full or portion of a block. It must not span block boundaries; that is,
+-  Offset + *NumBytes <= Instance->Media.BlockSize.
+  Offset + *NumBytes <= Instance->BlockSize.
+ */
+ EFI_STATUS
+ NorFlashWriteSingleBlock (
+@@ -605,15 +601,8 @@ NorFlashWriteSingleBlock (
+ 
+   DEBUG ((DEBUG_BLKIO, "NorFlashWriteSingleBlock(Parameters: Lba=%ld, Offset=0x%x, *NumBytes=0x%x, Buffer @ 0x%08x)\n", Lba, Offset, *NumBytes, Buffer));
+ 
+-  // Detect WriteDisabled state
+-  if (Instance->Media.ReadOnly == TRUE) {
+-    DEBUG ((DEBUG_ERROR, "NorFlashWriteSingleBlock: ERROR - Can not write: Device is in WriteDisabled state.\n"));
+-    // It is in WriteDisabled state, return an error right away
+-    return EFI_ACCESS_DENIED;
+-  }
+-
+   // Cache the block size to avoid de-referencing pointers all the time
+-  BlockSize = Instance->Media.BlockSize;
+  BlockSize = Instance->BlockSize;
+ 
+   // The write must not span block boundaries.
+   // We need to check each variable individually because adding two large values together overflows.
+@@ -819,12 +808,6 @@ NorFlashVirtualNotifyEvent (
+     EfiConvertPointer (0x0, (VOID **)&mNorFlashInstances[Index]->DeviceBaseAddress);
+     EfiConvertPointer (0x0, (VOID **)&mNorFlashInstances[Index]->RegionBaseAddress);
+ 
+-    // Convert BlockIo protocol
+-    EfiConvertPointer (0x0, (VOID **)&mNorFlashInstances[Index]->BlockIoProtocol.FlushBlocks);
+-    EfiConvertPointer (0x0, (VOID **)&mNorFlashInstances[Index]->BlockIoProtocol.ReadBlocks);
+-    EfiConvertPointer (0x0, (VOID **)&mNorFlashInstances[Index]->BlockIoProtocol.Reset);
+-    EfiConvertPointer (0x0, (VOID **)&mNorFlashInstances[Index]->BlockIoProtocol.WriteBlocks);
+-
+     // Convert Fvb
+     EfiConvertPointer (0x0, (VOID **)&mNorFlashInstances[Index]->FvbProtocol.EraseBlocks);
+     EfiConvertPointer (0x0, (VOID **)&mNorFlashInstances[Index]->FvbProtocol.GetAttributes);
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h
+index 7733ee02ee..b7f5d208b2 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h
+@@ -14,7 +14,6 @@
+ 
+ #include <Guid/EventGroup.h>
+ 
+-#include <Protocol/BlockIo.h>
+ #include <Protocol/FirmwareVolumeBlock.h>
+ 
+ #include <Library/DebugLib.h>
+@@ -108,8 +107,7 @@
+ #define P30_CMD_READ_CONFIGURATION_REGISTER        0x0003
+ 
+ #define NOR_FLASH_SIGNATURE  SIGNATURE_32('n', 'o', 'r', '0')
+-#define INSTANCE_FROM_FVB_THIS(a)     CR(a, NOR_FLASH_INSTANCE, FvbProtocol, NOR_FLASH_SIGNATURE)
+-#define INSTANCE_FROM_BLKIO_THIS(a)   CR(a, NOR_FLASH_INSTANCE, BlockIoProtocol, NOR_FLASH_SIGNATURE)
+#define INSTANCE_FROM_FVB_THIS(a)  CR(a, NOR_FLASH_INSTANCE, FvbProtocol, NOR_FLASH_SIGNATURE)
+ 
+ typedef struct _NOR_FLASH_INSTANCE NOR_FLASH_INSTANCE;
+ 
+@@ -129,9 +127,8 @@ struct _NOR_FLASH_INSTANCE {
+   UINTN                                  RegionBaseAddress;
+   UINTN                                  Size;
+   EFI_LBA                                StartLba;
+-
+-  EFI_BLOCK_IO_PROTOCOL                  BlockIoProtocol;
+-  EFI_BLOCK_IO_MEDIA                     Media;
+  EFI_LBA                                LastBlock;
+  UINT32                                 BlockSize;
+ 
+   EFI_FIRMWARE_VOLUME_BLOCK2_PROTOCOL    FvbProtocol;
+   VOID                                   *ShadowBuffer;
+@@ -155,51 +152,6 @@ NorFlashWriteBuffer (
+   IN UINT32              *Buffer
+   );
+ 
+-//
+-// BlockIO Protocol function EFI_BLOCK_IO_PROTOCOL.Reset
+-//
+-EFI_STATUS
+-EFIAPI
+-NorFlashBlockIoReset (
+-  IN EFI_BLOCK_IO_PROTOCOL  *This,
+-  IN BOOLEAN                ExtendedVerification
+-  );
+-
+-//
+-// BlockIO Protocol function EFI_BLOCK_IO_PROTOCOL.ReadBlocks
+-//
+-EFI_STATUS
+-EFIAPI
+-NorFlashBlockIoReadBlocks (
+-  IN  EFI_BLOCK_IO_PROTOCOL  *This,
+-  IN  UINT32                 MediaId,
+-  IN  EFI_LBA                Lba,
+-  IN  UINTN                  BufferSizeInBytes,
+-  OUT VOID                   *Buffer
+-  );
+-
+-//
+-// BlockIO Protocol function EFI_BLOCK_IO_PROTOCOL.WriteBlocks
+-//
+-EFI_STATUS
+-EFIAPI
+-NorFlashBlockIoWriteBlocks (
+-  IN  EFI_BLOCK_IO_PROTOCOL  *This,
+-  IN  UINT32                 MediaId,
+-  IN  EFI_LBA                Lba,
+-  IN  UINTN                  BufferSizeInBytes,
+-  IN  VOID                   *Buffer
+-  );
+-
+-//
+-// BlockIO Protocol function EFI_BLOCK_IO_PROTOCOL.FlushBlocks
+-//
+-EFI_STATUS
+-EFIAPI
+-NorFlashBlockIoFlushBlocks (
+-  IN EFI_BLOCK_IO_PROTOCOL  *This
+-  );
+-
+ //
+ // NorFlashFvbDxe.c
+ //
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+index 4875b057d5..2ceda22635 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+@@ -34,29 +34,8 @@ NOR_FLASH_INSTANCE  mNorFlashInstanceTemplate = {
+   0, // RegionBaseAddress ... NEED TO BE FILLED
+   0, // Size ... NEED TO BE FILLED
+   0, // StartLba
+-
+-  {
+-    EFI_BLOCK_IO_PROTOCOL_REVISION2, // Revision
+-    NULL,                            // Media ... NEED TO BE FILLED
+-    NorFlashBlockIoReset,            // Reset;
+-    NorFlashBlockIoReadBlocks,       // ReadBlocks
+-    NorFlashBlockIoWriteBlocks,      // WriteBlocks
+-    NorFlashBlockIoFlushBlocks       // FlushBlocks
+-  }, // BlockIoProtocol
+-
+-  {
+-    0,     // MediaId ... NEED TO BE FILLED
+-    FALSE, // RemovableMedia
+-    TRUE,  // MediaPresent
+-    FALSE, // LogicalPartition
+-    FALSE, // ReadOnly
+-    FALSE, // WriteCaching;
+-    0,     // BlockSize ... NEED TO BE FILLED
+-    4,     //  IoAlign
+-    0,     // LastBlock ... NEED TO BE FILLED
+-    0,     // LowestAlignedLba
+-    1,     // LogicalBlocksPerPhysicalBlock
+-  }, // Media;
+  0, // LastBlock
+  0, // BlockSize
+ 
+   {
+     FvbGetAttributes,      // GetAttributes
+@@ -115,11 +94,8 @@ NorFlashCreateInstance (
+   Instance->DeviceBaseAddress = NorFlashDeviceBase;
+   Instance->RegionBaseAddress = NorFlashRegionBase;
+   Instance->Size              = NorFlashSize;
+-
+-  Instance->BlockIoProtocol.Media = &Instance->Media;
+-  Instance->Media.MediaId         = Index;
+-  Instance->Media.BlockSize       = BlockSize;
+-  Instance->Media.LastBlock       = (NorFlashSize / BlockSize)-1;
+  Instance->BlockSize         = BlockSize;
+  Instance->LastBlock         = (NorFlashSize / BlockSize) - 1;
+ 
+   CopyGuid (&Instance->DevicePath.Vendor.Guid, &gEfiCallerIdGuid);
+   Instance->DevicePath.Index = (UINT8)Index;
+@@ -136,8 +112,6 @@ NorFlashCreateInstance (
+                     &Instance->Handle,
+                     &gEfiDevicePathProtocolGuid,
+                     &Instance->DevicePath,
+-                    &gEfiBlockIoProtocolGuid,
+-                    &Instance->BlockIoProtocol,
+                     &gEfiFirmwareVolumeBlockProtocolGuid,
+                     &Instance->FvbProtocol,
+                     NULL
+@@ -151,8 +125,6 @@ NorFlashCreateInstance (
+                     &Instance->Handle,
+                     &gEfiDevicePathProtocolGuid,
+                     &Instance->DevicePath,
+-                    &gEfiBlockIoProtocolGuid,
+-                    &Instance->BlockIoProtocol,
+                     NULL
+                     );
+     if (EFI_ERROR (Status)) {
+@@ -434,7 +406,7 @@ NorFlashFvbInitialize (
+                                 PcdGet64 (PcdFlashNvStorageVariableBase64) : PcdGet32 (PcdFlashNvStorageVariableBase);
+ 
+   // Set the index of the first LBA for the FVB
+-  Instance->StartLba = (mFlashNvStorageVariableBase - Instance->RegionBaseAddress) / Instance->Media.BlockSize;
+  Instance->StartLba = (mFlashNvStorageVariableBase - Instance->RegionBaseAddress) / Instance->BlockSize;
+ 
+   BootMode = GetBootModeHob ();
+   if (BootMode == BOOT_WITH_DEFAULT_SETTINGS) {
+@@ -455,7 +427,7 @@ NorFlashFvbInitialize (
+       ));
+ 
+     // Erase all the NorFlash that is reserved for variable storage
+-    FvbNumLba = (PcdGet32 (PcdFlashNvStorageVariableSize) + PcdGet32 (PcdFlashNvStorageFtwWorkingSize) + PcdGet32 (PcdFlashNvStorageFtwSpareSize)) / Instance->Media.BlockSize;
+    FvbNumLba = (PcdGet32 (PcdFlashNvStorageVariableSize) + PcdGet32 (PcdFlashNvStorageFtwWorkingSize) + PcdGet32 (PcdFlashNvStorageFtwSpareSize)) / Instance->BlockSize;
+ 
+     Status = FvbEraseBlocks (&Instance->FvbProtocol, (EFI_LBA)0, FvbNumLba, EFI_LBA_LIST_TERMINATOR);
+     if (EFI_ERROR (Status)) {
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+index 53e9d58204..2a3d4a218e 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+@@ -19,7 +19,6 @@
+ [Sources.common]
+   VirtNorFlash.c
+   VirtNorFlash.h
+-  VirtNorFlashBlockIoDxe.c
+   VirtNorFlashDxe.c
+   VirtNorFlashFvb.c
+ 
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+index c824e0a0fb..cc5eefaaf3 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+@@ -89,7 +89,7 @@ InitializeFvAndVariableStoreHeaders (
+   }
+ 
+   // Check if the size of the area is at least one block size
+-  if ((NvStorageVariableSize <= 0) || (NvStorageVariableSize / Instance->Media.BlockSize <= 0)) {
+  if ((NvStorageVariableSize <= 0) || (NvStorageVariableSize / Instance->BlockSize <= 0)) {
+     DEBUG ((
+       DEBUG_ERROR,
+       "%a: NvStorageVariableSize is 0x%x, should be atleast one block size\n",
+@@ -99,7 +99,7 @@ InitializeFvAndVariableStoreHeaders (
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+-  if ((NvStorageFtwWorkingSize <= 0) || (NvStorageFtwWorkingSize / Instance->Media.BlockSize <= 0)) {
+  if ((NvStorageFtwWorkingSize <= 0) || (NvStorageFtwWorkingSize / Instance->BlockSize <= 0)) {
+     DEBUG ((
+       DEBUG_ERROR,
+       "%a: NvStorageFtwWorkingSize is 0x%x, should be atleast one block size\n",
+@@ -109,7 +109,7 @@ InitializeFvAndVariableStoreHeaders (
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+-  if ((NvStorageFtwSpareSize <= 0) || (NvStorageFtwSpareSize / Instance->Media.BlockSize <= 0)) {
+  if ((NvStorageFtwSpareSize <= 0) || (NvStorageFtwSpareSize / Instance->BlockSize <= 0)) {
+     DEBUG ((
+       DEBUG_ERROR,
+       "%a: NvStorageFtwSpareSize is 0x%x, should be atleast one block size\n",
+@@ -120,9 +120,9 @@ InitializeFvAndVariableStoreHeaders (
+   }
+ 
+   // Ensure the Variable area Base Addresses are aligned on a block size boundaries
+-  if ((NvStorageVariableBase % Instance->Media.BlockSize != 0) ||
+-      (NvStorageFtwWorkingBase % Instance->Media.BlockSize != 0) ||
+-      (NvStorageFtwSpareBase % Instance->Media.BlockSize != 0))
+  if ((NvStorageVariableBase % Instance->BlockSize != 0) ||
+      (NvStorageFtwWorkingBase % Instance->BlockSize != 0) ||
+      (NvStorageFtwSpareBase % Instance->BlockSize != 0))
+   {
+     DEBUG ((DEBUG_ERROR, "%a: NvStorage Base addresses must be aligned to block size boundaries", __FUNCTION__));
+     return EFI_INVALID_PARAMETER;
+@@ -149,8 +149,8 @@ InitializeFvAndVariableStoreHeaders (
+                                                             );
+   FirmwareVolumeHeader->HeaderLength          = sizeof (EFI_FIRMWARE_VOLUME_HEADER) + sizeof (EFI_FV_BLOCK_MAP_ENTRY);
+   FirmwareVolumeHeader->Revision              = EFI_FVH_REVISION;
+-  FirmwareVolumeHeader->BlockMap[0].NumBlocks = Instance->Media.LastBlock + 1;
+-  FirmwareVolumeHeader->BlockMap[0].Length    = Instance->Media.BlockSize;
+  FirmwareVolumeHeader->BlockMap[0].NumBlocks = Instance->LastBlock + 1;
+  FirmwareVolumeHeader->BlockMap[0].Length    = Instance->BlockSize;
+   FirmwareVolumeHeader->BlockMap[1].NumBlocks = 0;
+   FirmwareVolumeHeader->BlockMap[1].Length    = 0;
+   FirmwareVolumeHeader->Checksum              = CalculateCheckSum16 ((UINT16 *)FirmwareVolumeHeader, FirmwareVolumeHeader->HeaderLength);
+@@ -284,9 +284,6 @@ FvbGetAttributes (
+   )
+ {
+   EFI_FVB_ATTRIBUTES_2  FlashFvbAttributes;
+-  NOR_FLASH_INSTANCE    *Instance;
+-
+-  Instance = INSTANCE_FROM_FVB_THIS (This);
+ 
+   FlashFvbAttributes = (EFI_FVB_ATTRIBUTES_2)(
+ 
+@@ -294,17 +291,12 @@ FvbGetAttributes (
+                                               EFI_FVB2_READ_STATUS      | // Reads are currently enabled
+                                               EFI_FVB2_STICKY_WRITE     | // A block erase is required to flip bits into EFI_FVB2_ERASE_POLARITY
+                                               EFI_FVB2_MEMORY_MAPPED    | // It is memory mapped
+-                                              EFI_FVB2_ERASE_POLARITY     // After erasure all bits take this value (i.e. '1')
+                                              EFI_FVB2_ERASE_POLARITY   | // After erasure all bits take this value (i.e. '1')
+                                              EFI_FVB2_WRITE_STATUS     | // Writes are currently enabled
+                                              EFI_FVB2_WRITE_ENABLED_CAP  // Writes may be enabled
+ 
+                                               );
+ 
+-  // Check if it is write protected
+-  if (Instance->Media.ReadOnly != TRUE) {
+-    FlashFvbAttributes = FlashFvbAttributes         |
+-                         EFI_FVB2_WRITE_STATUS      | // Writes are currently enabled
+-                         EFI_FVB2_WRITE_ENABLED_CAP;  // Writes may be enabled
+-  }
+-
+   *Attributes = FlashFvbAttributes;
+ 
+   DEBUG ((DEBUG_BLKIO, "FvbGetAttributes(0x%X)\n", *Attributes));
+@@ -418,15 +410,15 @@ FvbGetBlockSize (
+ 
+   Instance = INSTANCE_FROM_FVB_THIS (This);
+ 
+-  DEBUG ((DEBUG_BLKIO, "FvbGetBlockSize(Lba=%ld, BlockSize=0x%x, LastBlock=%ld)\n", Lba, Instance->Media.BlockSize, Instance->Media.LastBlock));
+  DEBUG ((DEBUG_BLKIO, "FvbGetBlockSize(Lba=%ld, BlockSize=0x%x, LastBlock=%ld)\n", Lba, Instance->BlockSize, Instance->LastBlock));
+ 
+-  if (Lba > Instance->Media.LastBlock) {
+-    DEBUG ((DEBUG_ERROR, "FvbGetBlockSize: ERROR - Parameter LBA %ld is beyond the last Lba (%ld).\n", Lba, Instance->Media.LastBlock));
+  if (Lba > Instance->LastBlock) {
+    DEBUG ((DEBUG_ERROR, "FvbGetBlockSize: ERROR - Parameter LBA %ld is beyond the last Lba (%ld).\n", Lba, Instance->LastBlock));
+     Status = EFI_INVALID_PARAMETER;
+   } else {
+     // This is easy because in this platform each NorFlash device has equal sized blocks.
+-    *BlockSize      = (UINTN)Instance->Media.BlockSize;
+-    *NumberOfBlocks = (UINTN)(Instance->Media.LastBlock - Lba + 1);
+    *BlockSize      = (UINTN)Instance->BlockSize;
+    *NumberOfBlocks = (UINTN)(Instance->LastBlock - Lba + 1);
+ 
+     DEBUG ((DEBUG_BLKIO, "FvbGetBlockSize: *BlockSize=0x%x, *NumberOfBlocks=0x%x.\n", *BlockSize, *NumberOfBlocks));
+ 
+@@ -498,7 +490,7 @@ FvbRead (
+   TempStatus = EFI_SUCCESS;
+ 
+   // Cache the block size to avoid de-referencing pointers all the time
+-  BlockSize = Instance->Media.BlockSize;
+  BlockSize = Instance->BlockSize;
+ 
+   DEBUG ((DEBUG_BLKIO, "FvbRead: Check if (Offset=0x%x + NumBytes=0x%x) <= BlockSize=0x%x\n", Offset, *NumBytes, BlockSize));
+ 
+@@ -669,13 +661,6 @@ FvbEraseBlocks (
+ 
+   Status = EFI_SUCCESS;
+ 
+-  // Detect WriteDisabled state
+-  if (Instance->Media.ReadOnly == TRUE) {
+-    // Firmware volume is in WriteDisabled state
+-    DEBUG ((DEBUG_ERROR, "FvbEraseBlocks: ERROR - Device is in WriteDisabled state.\n"));
+-    return EFI_ACCESS_DENIED;
+-  }
+-
+   // Before erasing, check the entire list of parameters to ensure all specified blocks are valid
+ 
+   VA_START (Args, This);
+@@ -698,9 +683,9 @@ FvbEraseBlocks (
+       "FvbEraseBlocks: Check if: ( StartingLba=%ld + NumOfLba=%Lu - 1 ) > LastBlock=%ld.\n",
+       Instance->StartLba + StartingLba,
+       (UINT64)NumOfLba,
+-      Instance->Media.LastBlock
+      Instance->LastBlock
+       ));
+-    if ((NumOfLba == 0) || ((Instance->StartLba + StartingLba + NumOfLba - 1) > Instance->Media.LastBlock)) {
+    if ((NumOfLba == 0) || ((Instance->StartLba + StartingLba + NumOfLba - 1) > Instance->LastBlock)) {
+       VA_END (Args);
+       DEBUG ((DEBUG_ERROR, "FvbEraseBlocks: ERROR - Lba range goes past the last Lba.\n"));
+       Status = EFI_INVALID_PARAMETER;
+@@ -733,7 +718,7 @@ FvbEraseBlocks (
+       BlockAddress = GET_NOR_BLOCK_ADDRESS (
+                        Instance->RegionBaseAddress,
+                        Instance->StartLba + StartingLba,
+-                       Instance->Media.BlockSize
+                       Instance->BlockSize
+                        );
+ 
+       // Erase it
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch
@ -0,0 +1,67 @@
+From 15415de9a228e74ff1847777a29f1531754b03b0 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 11 Jan 2023 19:00:23 +0100
+Subject: [PATCH 08/18] OvmfPkg/VirtNorFlashDxe: map flash memory as
+ uncacheable
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [10/20] 40ca967bead9ec5c98c528bfe0757f75f3d3352f
+
+Switching from the ArmPlatformPkg/NorFlashDxe driver to the
+OvmfPkg/VirtNorFlashDxe driver had the side effect that flash address
+space got registered as EFI_MEMORY_WC instead of EFI_MEMORY_UC.
+
+That confuses the linux kernel's numa code, seems this makes kernel
+consider the flash being node memory.  "lsmem" changes from ...
+
+    RANGE                                 SIZE  STATE REMOVABLE BLOCK
+    0x0000000040000000-0x000000013fffffff   4G online       yes  8-39
+
+... to ...
+
+    RANGE                                  SIZE  STATE REMOVABLE BLOCK
+    0x0000000000000000-0x0000000007ffffff  128M online       yes     0
+    0x0000000040000000-0x000000013fffffff    4G online       yes  8-39
+
+... and in the kernel log got new error lines:
+
+    NUMA: Warning: invalid memblk node 512 [mem 0x0000000004000000-0x0000000007ffffff]
+    NUMA: Faking a node at [mem 0x0000000004000000-0x000000013fffffff]
+
+Changing the attributes back to EFI_MEMORY_UC fixes this.
+
+Fixes: b92298af8218 ("ArmVirtPkg/ArmVirtQemu: migrate to OVMF's VirtNorFlashDxe")
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit e5ec3ba409b5baa9cf429cc25fdf3c8d1b8dcef0)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+index ff3121af2a..f9a41f6aab 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+@@ -394,14 +394,14 @@ NorFlashFvbInitialize (
+                   EfiGcdMemoryTypeMemoryMappedIo,
+                   Instance->DeviceBaseAddress,
+                   RuntimeMmioRegionSize,
+-                  EFI_MEMORY_WC | EFI_MEMORY_RUNTIME
+                  EFI_MEMORY_UC | EFI_MEMORY_RUNTIME
+                   );
+   ASSERT_EFI_ERROR (Status);
+ 
+   Status = gDS->SetMemorySpaceAttributes (
+                   Instance->DeviceBaseAddress,
+                   RuntimeMmioRegionSize,
+-                  EFI_MEMORY_WC | EFI_MEMORY_RUNTIME
+                  EFI_MEMORY_UC | EFI_MEMORY_RUNTIME
+                   );
+   ASSERT_EFI_ERROR (Status);
+ 
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-move-DoErase-code-block-into.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-move-DoErase-code-block-into.patch
@ -0,0 +1,131 @@
+From 791c26a4a172b4a609a708db8018411ab653de4a Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jan 2024 18:11:05 +0100
+Subject: [PATCH 16/18] OvmfPkg/VirtNorFlashDxe: move DoErase code block into
+ new function
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [18/20] 10f4685bfcb0c5423e392b4cf0e8633cd25b46b4
+
+Move the DoErase code block into a separate function, call the function
+instead of jumping around with goto.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-Id: <20240116171105.37831-7-kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit b481b00f593ef37695ee14271453320ed02a1256)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 76 ++++++++++++++++++--------
+ 1 file changed, 52 insertions(+), 24 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 3d1d20daa1..e6aaed27ce 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -502,6 +502,38 @@ NorFlashRead (
+   return EFI_SUCCESS;
+ }
+ 
+STATIC
+EFI_STATUS
+NorFlashWriteSingleBlockWithErase (
+  IN        NOR_FLASH_INSTANCE  *Instance,
+  IN        EFI_LBA             Lba,
+  IN        UINTN               Offset,
+  IN OUT    UINTN               *NumBytes,
+  IN        UINT8               *Buffer
+  )
+{
+  EFI_STATUS  Status;
+
+  // Read NOR Flash data into shadow buffer
+  Status = NorFlashReadBlocks (Instance, Lba, Instance->BlockSize, Instance->ShadowBuffer);
+  if (EFI_ERROR (Status)) {
+    // Return one of the pre-approved error statuses
+    return EFI_DEVICE_ERROR;
+  }
+
+  // Put the data at the appropriate location inside the buffer area
+  CopyMem ((VOID *)((UINTN)Instance->ShadowBuffer + Offset), Buffer, *NumBytes);
+
+  // Write the modified buffer back to the NorFlash
+  Status = NorFlashWriteBlocks (Instance, Lba, Instance->BlockSize, Instance->ShadowBuffer);
+  if (EFI_ERROR (Status)) {
+    // Return one of the pre-approved error statuses
+    return EFI_DEVICE_ERROR;
+  }
+
+  return EFI_SUCCESS;
+}
+
+ /*
+   Write a full or portion of a block. It must not span block boundaries; that is,
+   Offset + *NumBytes <= Instance->BlockSize.
+@@ -607,7 +639,14 @@ NorFlashWriteSingleBlock (
+     // that we want to set. In that case, we will need to erase the block first.
+     for (CurOffset = 0; CurOffset < *NumBytes; CurOffset++) {
+       if (~(UINT32)OrigData[CurOffset] & (UINT32)Buffer[CurOffset]) {
+-        goto DoErase;
+        Status = NorFlashWriteSingleBlockWithErase (
+                   Instance,
+                   Lba,
+                   Offset,
+                   NumBytes,
+                   Buffer
+                   );
+        return Status;
+       }
+ 
+       OrigData[CurOffset] = Buffer[CurOffset];
+@@ -636,33 +675,22 @@ NorFlashWriteSingleBlock (
+         goto Exit;
+       }
+     }
+-
+-Exit:
+-    // Put device back into Read Array mode
+-    SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_READ_ARRAY);
+-
+  } else {
+    Status = NorFlashWriteSingleBlockWithErase (
+               Instance,
+               Lba,
+               Offset,
+               NumBytes,
+               Buffer
+               );
+     return Status;
+   }
+ 
+-DoErase:
+-  // Read NOR Flash data into shadow buffer
+-  Status = NorFlashReadBlocks (Instance, Lba, BlockSize, Instance->ShadowBuffer);
+-  if (EFI_ERROR (Status)) {
+-    // Return one of the pre-approved error statuses
+-    return EFI_DEVICE_ERROR;
+-  }
+-
+-  // Put the data at the appropriate location inside the buffer area
+-  CopyMem ((VOID *)((UINTN)Instance->ShadowBuffer + Offset), Buffer, *NumBytes);
+-
+-  // Write the modified buffer back to the NorFlash
+-  Status = NorFlashWriteBlocks (Instance, Lba, BlockSize, Instance->ShadowBuffer);
+-  if (EFI_ERROR (Status)) {
+-    // Return one of the pre-approved error statuses
+-    return EFI_DEVICE_ERROR;
+-  }
+Exit:
+  // Put device back into Read Array mode
+  SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_READ_ARRAY);
+ 
+-  return EFI_SUCCESS;
+  return Status;
+ }
+ 
+ EFI_STATUS
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-remove-CheckBlockLocked-feat.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-remove-CheckBlockLocked-feat.patch
@ -0,0 +1,94 @@
+From 03e0a729a5c3ebcab8806d136cd8908627bd91c9 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 24 Oct 2022 16:45:02 +0200
+Subject: [PATCH 02/18] OvmfPkg/VirtNorFlashDxe: remove CheckBlockLocked
+ feature
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [4/20] 990bdf373801df8107d8a6ec4db3fb93e5a6ad68
+
+We inherited a feature from the ArmPlatformPkg version of this driver
+that never gets enabled. Let's remove it.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
+(cherry picked from commit 0a64106c566273ff8ef951d56ddfa972fe65bd6c)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c      | 35 +++++----------------
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf |  3 --
+ 2 files changed, 8 insertions(+), 30 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 12fa720dad..59a562efdf 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -65,35 +65,16 @@ NorFlashUnlockSingleBlock (
+   // Raise the Task Priority Level to TPL_NOTIFY to serialise all its operations
+   // and to protect shared data structures.
+ 
+-  if (FeaturePcdGet (PcdNorFlashCheckBlockLocked) == TRUE) {
+-    do {
+-      // Request a lock setup
+-      SEND_NOR_COMMAND (BlockAddress, 0, P30_CMD_LOCK_BLOCK_SETUP);
+  // Request a lock setup
+  SEND_NOR_COMMAND (BlockAddress, 0, P30_CMD_LOCK_BLOCK_SETUP);
+ 
+-      // Request an unlock
+-      SEND_NOR_COMMAND (BlockAddress, 0, P30_CMD_UNLOCK_BLOCK);
+  // Request an unlock
+  SEND_NOR_COMMAND (BlockAddress, 0, P30_CMD_UNLOCK_BLOCK);
+ 
+-      // Send command for reading device id
+-      SEND_NOR_COMMAND (BlockAddress, 2, P30_CMD_READ_DEVICE_ID);
+-
+-      // Read block lock status
+-      LockStatus = MmioRead32 (CREATE_NOR_ADDRESS (BlockAddress, 2));
+-
+-      // Decode block lock status
+-      LockStatus = FOLD_32BIT_INTO_16BIT (LockStatus);
+-    } while ((LockStatus & 0x1) == 1);
+-  } else {
+-    // Request a lock setup
+-    SEND_NOR_COMMAND (BlockAddress, 0, P30_CMD_LOCK_BLOCK_SETUP);
+-
+-    // Request an unlock
+-    SEND_NOR_COMMAND (BlockAddress, 0, P30_CMD_UNLOCK_BLOCK);
+-
+-    // Wait until the status register gives us the all clear
+-    do {
+-      LockStatus = NorFlashReadStatusRegister (Instance, BlockAddress);
+-    } while ((LockStatus & P30_SR_BIT_WRITE) != P30_SR_BIT_WRITE);
+-  }
+  // Wait until the status register gives us the all clear
+  do {
+    LockStatus = NorFlashReadStatusRegister (Instance, BlockAddress);
+  } while ((LockStatus & P30_SR_BIT_WRITE) != P30_SR_BIT_WRITE);
+ 
+   // Put device back into Read Array mode
+   SEND_NOR_COMMAND (BlockAddress, 0, P30_CMD_READ_ARRAY);
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+index 1bf50e4823..53e9d58204 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+@@ -24,7 +24,6 @@
+   VirtNorFlashFvb.c
+ 
+ [Packages]
+-  ArmPlatformPkg/ArmPlatformPkg.dec
+   EmbeddedPkg/EmbeddedPkg.dec
+   MdePkg/MdePkg.dec
+   MdeModulePkg/MdeModulePkg.dec
+@@ -66,7 +65,5 @@
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
+ 
+-  gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked
+-
+ [Depex]
+   gEfiCpuArchProtocolGuid
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-remove-disk-I-O-protocol-imp.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-remove-disk-I-O-protocol-imp.patch
@ -0,0 +1,386 @@
+From 56041232238e4e4d3c8d703b27f51b0bc70fd5c8 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 24 Oct 2022 16:50:05 +0200
+Subject: [PATCH 03/18] OvmfPkg/VirtNorFlashDxe: remove disk I/O protocol
+ implementation
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [5/20] 0551c3f56f43396cfdc380127565e89d69eb29a3
+
+We only use NOR flash for firmware volumes, either for executable images
+or for the variable store. So we have no need for exposing disk I/O on
+top of the NOR flash partitions so let's remove it.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
+(cherry picked from commit 68d234989b2d6bd8f255577e08bf8be0b1d197bb)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c        | 129 ------------------
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h        |  29 ----
+ .../VirtNorFlashDxe/VirtNorFlashBlockIoDxe.c  | 123 -----------------
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c     |   8 --
+ 4 files changed, 289 deletions(-)
+ delete mode 100644 OvmfPkg/VirtNorFlashDxe/VirtNorFlashBlockIoDxe.c
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 59a562efdf..1094d48f7d 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -788,135 +788,6 @@ NorFlashWriteSingleBlock (
+   return EFI_SUCCESS;
+ }
+ 
+-/*
+-  Although DiskIoDxe will automatically install the DiskIO protocol whenever
+-  we install the BlockIO protocol, its implementation is sub-optimal as it reads
+-  and writes entire blocks using the BlockIO protocol. In fact we can access
+-  NOR flash with a finer granularity than that, so we can improve performance
+-  by directly producing the DiskIO protocol.
+-*/
+-
+-/**
+-  Read BufferSize bytes from Offset into Buffer.
+-
+-  @param  This                  Protocol instance pointer.
+-  @param  MediaId               Id of the media, changes every time the media is replaced.
+-  @param  Offset                The starting byte offset to read from
+-  @param  BufferSize            Size of Buffer
+-  @param  Buffer                Buffer containing read data
+-
+-  @retval EFI_SUCCESS           The data was read correctly from the device.
+-  @retval EFI_DEVICE_ERROR      The device reported an error while performing the read.
+-  @retval EFI_NO_MEDIA          There is no media in the device.
+-  @retval EFI_MEDIA_CHANGED     The MediaId does not match the current device.
+-  @retval EFI_INVALID_PARAMETER The read request contains device addresses that are not
+-                                valid for the device.
+-
+-**/
+-EFI_STATUS
+-EFIAPI
+-NorFlashDiskIoReadDisk (
+-  IN EFI_DISK_IO_PROTOCOL  *This,
+-  IN UINT32                MediaId,
+-  IN UINT64                DiskOffset,
+-  IN UINTN                 BufferSize,
+-  OUT VOID                 *Buffer
+-  )
+-{
+-  NOR_FLASH_INSTANCE  *Instance;
+-  UINT32              BlockSize;
+-  UINT32              BlockOffset;
+-  EFI_LBA             Lba;
+-
+-  Instance = INSTANCE_FROM_DISKIO_THIS (This);
+-
+-  if (MediaId != Instance->Media.MediaId) {
+-    return EFI_MEDIA_CHANGED;
+-  }
+-
+-  BlockSize = Instance->Media.BlockSize;
+-  Lba       = (EFI_LBA)DivU64x32Remainder (DiskOffset, BlockSize, &BlockOffset);
+-
+-  return NorFlashRead (Instance, Lba, BlockOffset, BufferSize, Buffer);
+-}
+-
+-/**
+-  Writes a specified number of bytes to a device.
+-
+-  @param  This       Indicates a pointer to the calling context.
+-  @param  MediaId    ID of the medium to be written.
+-  @param  Offset     The starting byte offset on the logical block I/O device to write.
+-  @param  BufferSize The size in bytes of Buffer. The number of bytes to write to the device.
+-  @param  Buffer     A pointer to the buffer containing the data to be written.
+-
+-  @retval EFI_SUCCESS           The data was written correctly to the device.
+-  @retval EFI_WRITE_PROTECTED   The device can not be written to.
+-  @retval EFI_DEVICE_ERROR      The device reported an error while performing the write.
+-  @retval EFI_NO_MEDIA          There is no media in the device.
+-  @retval EFI_MEDIA_CHANGED     The MediaId does not match the current device.
+-  @retval EFI_INVALID_PARAMETER The write request contains device addresses that are not
+-                                 valid for the device.
+-
+-**/
+-EFI_STATUS
+-EFIAPI
+-NorFlashDiskIoWriteDisk (
+-  IN EFI_DISK_IO_PROTOCOL  *This,
+-  IN UINT32                MediaId,
+-  IN UINT64                DiskOffset,
+-  IN UINTN                 BufferSize,
+-  IN VOID                  *Buffer
+-  )
+-{
+-  NOR_FLASH_INSTANCE  *Instance;
+-  UINT32              BlockSize;
+-  UINT32              BlockOffset;
+-  EFI_LBA             Lba;
+-  UINTN               RemainingBytes;
+-  UINTN               WriteSize;
+-  EFI_STATUS          Status;
+-
+-  Instance = INSTANCE_FROM_DISKIO_THIS (This);
+-
+-  if (MediaId != Instance->Media.MediaId) {
+-    return EFI_MEDIA_CHANGED;
+-  }
+-
+-  BlockSize = Instance->Media.BlockSize;
+-  Lba       = (EFI_LBA)DivU64x32Remainder (DiskOffset, BlockSize, &BlockOffset);
+-
+-  RemainingBytes = BufferSize;
+-
+-  // Write either all the remaining bytes, or the number of bytes that bring
+-  // us up to a block boundary, whichever is less.
+-  // (DiskOffset | (BlockSize - 1)) + 1) rounds DiskOffset up to the next
+-  // block boundary (even if it is already on one).
+-  WriteSize = MIN (RemainingBytes, ((DiskOffset | (BlockSize - 1)) + 1) - DiskOffset);
+-
+-  do {
+-    if (WriteSize == BlockSize) {
+-      // Write a full block
+-      Status = NorFlashWriteFullBlock (Instance, Lba, Buffer, BlockSize / sizeof (UINT32));
+-    } else {
+-      // Write a partial block
+-      Status = NorFlashWriteSingleBlock (Instance, Lba, BlockOffset, &WriteSize, Buffer);
+-    }
+-
+-    if (EFI_ERROR (Status)) {
+-      return Status;
+-    }
+-
+-    // Now continue writing either all the remaining bytes or single blocks.
+-    RemainingBytes -= WriteSize;
+-    Buffer          = (UINT8 *)Buffer + WriteSize;
+-    Lba++;
+-    BlockOffset = 0;
+-    WriteSize   = MIN (RemainingBytes, BlockSize);
+-  } while (RemainingBytes);
+-
+-  return Status;
+-}
+-
+ EFI_STATUS
+ NorFlashReset (
+   IN  NOR_FLASH_INSTANCE  *Instance
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h
+index e46522a198..7733ee02ee 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h
+@@ -15,7 +15,6 @@
+ #include <Guid/EventGroup.h>
+ 
+ #include <Protocol/BlockIo.h>
+-#include <Protocol/DiskIo.h>
+ #include <Protocol/FirmwareVolumeBlock.h>
+ 
+ #include <Library/DebugLib.h>
+@@ -111,7 +110,6 @@
+ #define NOR_FLASH_SIGNATURE  SIGNATURE_32('n', 'o', 'r', '0')
+ #define INSTANCE_FROM_FVB_THIS(a)     CR(a, NOR_FLASH_INSTANCE, FvbProtocol, NOR_FLASH_SIGNATURE)
+ #define INSTANCE_FROM_BLKIO_THIS(a)   CR(a, NOR_FLASH_INSTANCE, BlockIoProtocol, NOR_FLASH_SIGNATURE)
+-#define INSTANCE_FROM_DISKIO_THIS(a)  CR(a, NOR_FLASH_INSTANCE, DiskIoProtocol, NOR_FLASH_SIGNATURE)
+ 
+ typedef struct _NOR_FLASH_INSTANCE NOR_FLASH_INSTANCE;
+ 
+@@ -134,7 +132,6 @@ struct _NOR_FLASH_INSTANCE {
+ 
+   EFI_BLOCK_IO_PROTOCOL                  BlockIoProtocol;
+   EFI_BLOCK_IO_MEDIA                     Media;
+-  EFI_DISK_IO_PROTOCOL                   DiskIoProtocol;
+ 
+   EFI_FIRMWARE_VOLUME_BLOCK2_PROTOCOL    FvbProtocol;
+   VOID                                   *ShadowBuffer;
+@@ -203,32 +200,6 @@ NorFlashBlockIoFlushBlocks (
+   IN EFI_BLOCK_IO_PROTOCOL  *This
+   );
+ 
+-//
+-// DiskIO Protocol function EFI_DISK_IO_PROTOCOL.ReadDisk
+-//
+-EFI_STATUS
+-EFIAPI
+-NorFlashDiskIoReadDisk (
+-  IN EFI_DISK_IO_PROTOCOL  *This,
+-  IN UINT32                MediaId,
+-  IN UINT64                Offset,
+-  IN UINTN                 BufferSize,
+-  OUT VOID                 *Buffer
+-  );
+-
+-//
+-// DiskIO Protocol function EFI_DISK_IO_PROTOCOL.WriteDisk
+-//
+-EFI_STATUS
+-EFIAPI
+-NorFlashDiskIoWriteDisk (
+-  IN EFI_DISK_IO_PROTOCOL  *This,
+-  IN UINT32                MediaId,
+-  IN UINT64                Offset,
+-  IN UINTN                 BufferSize,
+-  IN VOID                  *Buffer
+-  );
+-
+ //
+ // NorFlashFvbDxe.c
+ //
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashBlockIoDxe.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashBlockIoDxe.c
+deleted file mode 100644
+index ecf152e355..0000000000
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashBlockIoDxe.c
+++ /dev/null
+@@ -1,123 +0,0 @@
+-/** @file  NorFlashBlockIoDxe.c
+-
+-  Copyright (c) 2011-2013, ARM Ltd. All rights reserved.<BR>
+-
+-  SPDX-License-Identifier: BSD-2-Clause-Patent
+-
+-**/
+-
+-#include <Library/BaseMemoryLib.h>
+-#include <Library/UefiBootServicesTableLib.h>
+-
+-#include "VirtNorFlash.h"
+-
+-//
+-// BlockIO Protocol function EFI_BLOCK_IO_PROTOCOL.Reset
+-//
+-EFI_STATUS
+-EFIAPI
+-NorFlashBlockIoReset (
+-  IN EFI_BLOCK_IO_PROTOCOL  *This,
+-  IN BOOLEAN                ExtendedVerification
+-  )
+-{
+-  NOR_FLASH_INSTANCE  *Instance;
+-
+-  Instance = INSTANCE_FROM_BLKIO_THIS (This);
+-
+-  DEBUG ((DEBUG_BLKIO, "NorFlashBlockIoReset(MediaId=0x%x)\n", This->Media->MediaId));
+-
+-  return NorFlashReset (Instance);
+-}
+-
+-//
+-// BlockIO Protocol function EFI_BLOCK_IO_PROTOCOL.ReadBlocks
+-//
+-EFI_STATUS
+-EFIAPI
+-NorFlashBlockIoReadBlocks (
+-  IN  EFI_BLOCK_IO_PROTOCOL  *This,
+-  IN  UINT32                 MediaId,
+-  IN  EFI_LBA                Lba,
+-  IN  UINTN                  BufferSizeInBytes,
+-  OUT VOID                   *Buffer
+-  )
+-{
+-  NOR_FLASH_INSTANCE  *Instance;
+-  EFI_STATUS          Status;
+-  EFI_BLOCK_IO_MEDIA  *Media;
+-
+-  if (This == NULL) {
+-    return EFI_INVALID_PARAMETER;
+-  }
+-
+-  Instance = INSTANCE_FROM_BLKIO_THIS (This);
+-  Media    = This->Media;
+-
+-  DEBUG ((DEBUG_BLKIO, "NorFlashBlockIoReadBlocks(MediaId=0x%x, Lba=%ld, BufferSize=0x%x bytes (%d kB), BufferPtr @ 0x%08x)\n", MediaId, Lba, BufferSizeInBytes, BufferSizeInBytes, Buffer));
+-
+-  if (!Media) {
+-    Status = EFI_INVALID_PARAMETER;
+-  } else if (!Media->MediaPresent) {
+-    Status = EFI_NO_MEDIA;
+-  } else if (Media->MediaId != MediaId) {
+-    Status = EFI_MEDIA_CHANGED;
+-  } else if ((Media->IoAlign > 2) && (((UINTN)Buffer & (Media->IoAlign - 1)) != 0)) {
+-    Status = EFI_INVALID_PARAMETER;
+-  } else {
+-    Status = NorFlashReadBlocks (Instance, Lba, BufferSizeInBytes, Buffer);
+-  }
+-
+-  return Status;
+-}
+-
+-//
+-// BlockIO Protocol function EFI_BLOCK_IO_PROTOCOL.WriteBlocks
+-//
+-EFI_STATUS
+-EFIAPI
+-NorFlashBlockIoWriteBlocks (
+-  IN  EFI_BLOCK_IO_PROTOCOL  *This,
+-  IN  UINT32                 MediaId,
+-  IN  EFI_LBA                Lba,
+-  IN  UINTN                  BufferSizeInBytes,
+-  IN  VOID                   *Buffer
+-  )
+-{
+-  NOR_FLASH_INSTANCE  *Instance;
+-  EFI_STATUS          Status;
+-
+-  Instance = INSTANCE_FROM_BLKIO_THIS (This);
+-
+-  DEBUG ((DEBUG_BLKIO, "NorFlashBlockIoWriteBlocks(MediaId=0x%x, Lba=%ld, BufferSize=0x%x bytes, BufferPtr @ 0x%08x)\n", MediaId, Lba, BufferSizeInBytes, Buffer));
+-
+-  if ( !This->Media->MediaPresent ) {
+-    Status = EFI_NO_MEDIA;
+-  } else if ( This->Media->MediaId != MediaId ) {
+-    Status = EFI_MEDIA_CHANGED;
+-  } else if ( This->Media->ReadOnly ) {
+-    Status = EFI_WRITE_PROTECTED;
+-  } else {
+-    Status = NorFlashWriteBlocks (Instance, Lba, BufferSizeInBytes, Buffer);
+-  }
+-
+-  return Status;
+-}
+-
+-//
+-// BlockIO Protocol function EFI_BLOCK_IO_PROTOCOL.FlushBlocks
+-//
+-EFI_STATUS
+-EFIAPI
+-NorFlashBlockIoFlushBlocks (
+-  IN EFI_BLOCK_IO_PROTOCOL  *This
+-  )
+-{
+-  // No Flush required for the NOR Flash driver
+-  // because cache operations are not permitted.
+-
+-  DEBUG ((DEBUG_BLKIO, "NorFlashBlockIoFlushBlocks: Function NOT IMPLEMENTED (not required).\n"));
+-
+-  // Nothing to do so just return without error
+-  return EFI_SUCCESS;
+-}
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+index 819425545e..4875b057d5 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+@@ -58,12 +58,6 @@ NOR_FLASH_INSTANCE  mNorFlashInstanceTemplate = {
+     1,     // LogicalBlocksPerPhysicalBlock
+   }, // Media;
+ 
+-  {
+-    EFI_DISK_IO_PROTOCOL_REVISION, // Revision
+-    NorFlashDiskIoReadDisk,        // ReadDisk
+-    NorFlashDiskIoWriteDisk        // WriteDisk
+-  },
+-
+   {
+     FvbGetAttributes,      // GetAttributes
+     FvbSetAttributes,      // SetAttributes
+@@ -159,8 +153,6 @@ NorFlashCreateInstance (
+                     &Instance->DevicePath,
+                     &gEfiBlockIoProtocolGuid,
+                     &Instance->BlockIoProtocol,
+-                    &gEfiDiskIoProtocolGuid,
+-                    &Instance->DiskIoProtocol,
+                     NULL
+                     );
+     if (EFI_ERROR (Status)) {
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variable2.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variable2.patch
@ -0,0 +1,216 @@
+From c4d2144caff4eddb7021752fce6c2dec6d5e1632 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 9 Jan 2024 12:29:02 +0100
+Subject: [PATCH 10/18] OvmfPkg/VirtNorFlashDxe: sanity-check variables
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [12/20] 2ad3957478b82a4ca29249ceb9620f97c591a1fe
+
+Extend the ValidateFvHeader function, additionally to the header checks
+walk over the list of variables and sanity check them.
+
+In case we find inconsistencies indicating variable store corruption
+return EFI_NOT_FOUND so the variable store will be re-initialized.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-Id: <20240109112902.30002-4-kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+[lersek@redhat.com: fix StartId initialization/assignment coding style]
+(cherry picked from commit 4a443f73fd67ca8caaf0a3e1a01f8231b330d2e0)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf |   1 +
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c   | 149 +++++++++++++++++++-
+ 2 files changed, 145 insertions(+), 5 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+index 2a3d4a218e..f549400280 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+@@ -34,6 +34,7 @@
+   DxeServicesTableLib
+   HobLib
+   IoLib
+  SafeIntLib
+   UefiBootServicesTableLib
+   UefiDriverEntryPoint
+   UefiLib
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+index c503272a2b..acc4a413ee 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+@@ -12,6 +12,7 @@
+ #include <Library/BaseMemoryLib.h>
+ #include <Library/MemoryAllocationLib.h>
+ #include <Library/PcdLib.h>
+#include <Library/SafeIntLib.h>
+ #include <Library/UefiLib.h>
+ 
+ #include <Guid/NvVarStoreFormatted.h>
+@@ -185,11 +186,12 @@ ValidateFvHeader (
+   IN  NOR_FLASH_INSTANCE  *Instance
+   )
+ {
+-  UINT16                      Checksum;
+-  EFI_FIRMWARE_VOLUME_HEADER  *FwVolHeader;
+-  VARIABLE_STORE_HEADER       *VariableStoreHeader;
+-  UINTN                       VariableStoreLength;
+-  UINTN                       FvLength;
+  UINT16                            Checksum;
+  CONST EFI_FIRMWARE_VOLUME_HEADER  *FwVolHeader;
+  CONST VARIABLE_STORE_HEADER       *VariableStoreHeader;
+  UINTN                             VarOffset;
+  UINTN                             VariableStoreLength;
+  UINTN                             FvLength;
+ 
+   FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER *)Instance->RegionBaseAddress;
+ 
+@@ -258,6 +260,143 @@ ValidateFvHeader (
+     return EFI_NOT_FOUND;
+   }
+ 
+  //
+  // check variables
+  //
+  DEBUG ((DEBUG_INFO, "%a: checking variables\n", __func__));
+  VarOffset = sizeof (*VariableStoreHeader);
+  for ( ; ;) {
+    UINTN                                VarHeaderEnd;
+    UINTN                                VarNameEnd;
+    UINTN                                VarEnd;
+    UINTN                                VarPadding;
+    CONST AUTHENTICATED_VARIABLE_HEADER  *VarHeader;
+    CONST CHAR16                         *VarName;
+    CONST CHAR8                          *VarState;
+    RETURN_STATUS                        Status;
+
+    Status = SafeUintnAdd (VarOffset, sizeof (*VarHeader), &VarHeaderEnd);
+    if (RETURN_ERROR (Status)) {
+      DEBUG ((DEBUG_ERROR, "%a: integer overflow\n", __func__));
+      return EFI_NOT_FOUND;
+    }
+
+    if (VarHeaderEnd >= VariableStoreHeader->Size) {
+      if (VarOffset <= VariableStoreHeader->Size - sizeof (UINT16)) {
+        CONST UINT16  *StartId;
+
+        StartId = (VOID *)((UINTN)VariableStoreHeader + VarOffset);
+        if (*StartId == 0x55aa) {
+          DEBUG ((DEBUG_ERROR, "%a: startid at invalid location\n", __func__));
+          return EFI_NOT_FOUND;
+        }
+      }
+
+      DEBUG ((DEBUG_INFO, "%a: end of var list (no space left)\n", __func__));
+      break;
+    }
+
+    VarHeader = (VOID *)((UINTN)VariableStoreHeader + VarOffset);
+    if (VarHeader->StartId != 0x55aa) {
+      DEBUG ((DEBUG_INFO, "%a: end of var list (no startid)\n", __func__));
+      break;
+    }
+
+    VarName = NULL;
+    switch (VarHeader->State) {
+      // usage: State = VAR_HEADER_VALID_ONLY
+      case VAR_HEADER_VALID_ONLY:
+        VarState = "header-ok";
+        VarName  = L"<unknown>";
+        break;
+
+      // usage: State = VAR_ADDED
+      case VAR_ADDED:
+        VarState = "ok";
+        break;
+
+      // usage: State &= VAR_IN_DELETED_TRANSITION
+      case VAR_ADDED &VAR_IN_DELETED_TRANSITION:
+        VarState = "del-in-transition";
+        break;
+
+      // usage: State &= VAR_DELETED
+      case VAR_ADDED &VAR_DELETED:
+      case VAR_ADDED &VAR_DELETED &VAR_IN_DELETED_TRANSITION:
+        VarState = "deleted";
+        break;
+
+      default:
+        DEBUG ((
+          DEBUG_ERROR,
+          "%a: invalid variable state: 0x%x\n",
+          __func__,
+          VarHeader->State
+          ));
+        return EFI_NOT_FOUND;
+    }
+
+    Status = SafeUintnAdd (VarHeaderEnd, VarHeader->NameSize, &VarNameEnd);
+    if (RETURN_ERROR (Status)) {
+      DEBUG ((DEBUG_ERROR, "%a: integer overflow\n", __func__));
+      return EFI_NOT_FOUND;
+    }
+
+    Status = SafeUintnAdd (VarNameEnd, VarHeader->DataSize, &VarEnd);
+    if (RETURN_ERROR (Status)) {
+      DEBUG ((DEBUG_ERROR, "%a: integer overflow\n", __func__));
+      return EFI_NOT_FOUND;
+    }
+
+    if (VarEnd > VariableStoreHeader->Size) {
+      DEBUG ((
+        DEBUG_ERROR,
+        "%a: invalid variable size: 0x%Lx + 0x%Lx + 0x%x + 0x%x > 0x%x\n",
+        __func__,
+        (UINT64)VarOffset,
+        (UINT64)(sizeof (*VarHeader)),
+        VarHeader->NameSize,
+        VarHeader->DataSize,
+        VariableStoreHeader->Size
+        ));
+      return EFI_NOT_FOUND;
+    }
+
+    if (((VarHeader->NameSize & 1) != 0) ||
+        (VarHeader->NameSize < 4))
+    {
+      DEBUG ((DEBUG_ERROR, "%a: invalid name size\n", __func__));
+      return EFI_NOT_FOUND;
+    }
+
+    if (VarName == NULL) {
+      VarName = (VOID *)((UINTN)VariableStoreHeader + VarHeaderEnd);
+      if (VarName[VarHeader->NameSize / 2 - 1] != L'\0') {
+        DEBUG ((DEBUG_ERROR, "%a: name is not null terminated\n", __func__));
+        return EFI_NOT_FOUND;
+      }
+    }
+
+    DEBUG ((
+      DEBUG_VERBOSE,
+      "%a: +0x%04Lx: name=0x%x data=0x%x guid=%g '%s' (%a)\n",
+      __func__,
+      (UINT64)VarOffset,
+      VarHeader->NameSize,
+      VarHeader->DataSize,
+      &VarHeader->VendorGuid,
+      VarName,
+      VarState
+      ));
+
+    VarPadding = (4 - (VarEnd & 3)) & 3;
+    Status     = SafeUintnAdd (VarEnd, VarPadding, &VarOffset);
+    if (RETURN_ERROR (Status)) {
+      DEBUG ((DEBUG_ERROR, "%a: integer overflow\n", __func__));
+      return EFI_NOT_FOUND;
+    }
+  }
+
+   return EFI_SUCCESS;
+ }
+ 
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variables.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variables.patch
@ -0,0 +1,216 @@
+From c4eef747624d41aaa09dc64ccafdb84bf1fe656e Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 9 Jan 2024 12:29:02 +0100
+Subject: [PATCH 2/2] OvmfPkg/VirtNorFlashDxe: sanity-check variables
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 42: OvmfPkg/VirtNorFlashDxe: sanity-check variables
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [2/2] 56ff961f754d517c0e27ccf46a95b228efe7ab4b
+
+Extend the ValidateFvHeader function, additionally to the header checks
+walk over the list of variables and sanity check them.
+
+In case we find inconsistencies indicating variable store corruption
+return EFI_NOT_FOUND so the variable store will be re-initialized.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-Id: <20240109112902.30002-4-kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+[lersek@redhat.com: fix StartId initialization/assignment coding style]
+(cherry picked from commit 4a443f73fd67ca8caaf0a3e1a01f8231b330d2e0)
+---
+ .../Drivers/NorFlashDxe/NorFlashDxe.inf       |   1 +
+ .../Drivers/NorFlashDxe/NorFlashFvb.c         | 149 +++++++++++++++++-
+ 2 files changed, 145 insertions(+), 5 deletions(-)
+
+diff --git a/ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashDxe.inf b/ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashDxe.inf
+index f8d4c27031..10388880a1 100644
+--- a/ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashDxe.inf
+++ b/ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashDxe.inf
+@@ -35,6 +35,7 @@
+   DebugLib
+   HobLib
+   NorFlashPlatformLib
+  SafeIntLib
+   UefiLib
+   UefiDriverEntryPoint
+   UefiBootServicesTableLib
+diff --git a/ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashFvb.c b/ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashFvb.c
+index 904605cbbc..2a166c94a6 100644
+--- a/ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashFvb.c
+++ b/ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashFvb.c
+@@ -13,6 +13,7 @@
+ #include <Library/UefiLib.h>
+ #include <Library/BaseMemoryLib.h>
+ #include <Library/MemoryAllocationLib.h>
+#include <Library/SafeIntLib.h>
+ 
+ #include <Guid/VariableFormat.h>
+ #include <Guid/SystemNvDataGuid.h>
+@@ -166,11 +167,12 @@ ValidateFvHeader (
+   IN  NOR_FLASH_INSTANCE *Instance
+   )
+ {
+-  UINT16                      Checksum;
+-  EFI_FIRMWARE_VOLUME_HEADER  *FwVolHeader;
+-  VARIABLE_STORE_HEADER       *VariableStoreHeader;
+-  UINTN                       VariableStoreLength;
+-  UINTN                       FvLength;
+  UINT16                            Checksum;
+  CONST EFI_FIRMWARE_VOLUME_HEADER  *FwVolHeader;
+  CONST VARIABLE_STORE_HEADER       *VariableStoreHeader;
+  UINTN                             VarOffset;
+  UINTN                             VariableStoreLength;
+  UINTN                             FvLength;
+ 
+   FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress;
+ 
+@@ -223,6 +225,143 @@ ValidateFvHeader (
+     return EFI_NOT_FOUND;
+   }
+ 
+  //
+  // check variables
+  //
+  DEBUG ((DEBUG_INFO, "%a: checking variables\n", __func__));
+  VarOffset = sizeof (*VariableStoreHeader);
+  for ( ; ;) {
+    UINTN                                VarHeaderEnd;
+    UINTN                                VarNameEnd;
+    UINTN                                VarEnd;
+    UINTN                                VarPadding;
+    CONST AUTHENTICATED_VARIABLE_HEADER  *VarHeader;
+    CONST CHAR16                         *VarName;
+    CONST CHAR8                          *VarState;
+    RETURN_STATUS                        Status;
+
+    Status = SafeUintnAdd (VarOffset, sizeof (*VarHeader), &VarHeaderEnd);
+    if (RETURN_ERROR (Status)) {
+      DEBUG ((DEBUG_ERROR, "%a: integer overflow\n", __func__));
+      return EFI_NOT_FOUND;
+    }
+
+    if (VarHeaderEnd >= VariableStoreHeader->Size) {
+      if (VarOffset <= VariableStoreHeader->Size - sizeof (UINT16)) {
+        CONST UINT16  *StartId;
+
+        StartId = (VOID *)((UINTN)VariableStoreHeader + VarOffset);
+        if (*StartId == 0x55aa) {
+          DEBUG ((DEBUG_ERROR, "%a: startid at invalid location\n", __func__));
+          return EFI_NOT_FOUND;
+        }
+      }
+
+      DEBUG ((DEBUG_INFO, "%a: end of var list (no space left)\n", __func__));
+      break;
+    }
+
+    VarHeader = (VOID *)((UINTN)VariableStoreHeader + VarOffset);
+    if (VarHeader->StartId != 0x55aa) {
+      DEBUG ((DEBUG_INFO, "%a: end of var list (no startid)\n", __func__));
+      break;
+    }
+
+    VarName = NULL;
+    switch (VarHeader->State) {
+      // usage: State = VAR_HEADER_VALID_ONLY
+      case VAR_HEADER_VALID_ONLY:
+        VarState = "header-ok";
+        VarName  = L"<unknown>";
+        break;
+
+      // usage: State = VAR_ADDED
+      case VAR_ADDED:
+        VarState = "ok";
+        break;
+
+      // usage: State &= VAR_IN_DELETED_TRANSITION
+      case VAR_ADDED &VAR_IN_DELETED_TRANSITION:
+        VarState = "del-in-transition";
+        break;
+
+      // usage: State &= VAR_DELETED
+      case VAR_ADDED &VAR_DELETED:
+      case VAR_ADDED &VAR_DELETED &VAR_IN_DELETED_TRANSITION:
+        VarState = "deleted";
+        break;
+
+      default:
+        DEBUG ((
+          DEBUG_ERROR,
+          "%a: invalid variable state: 0x%x\n",
+          __func__,
+          VarHeader->State
+          ));
+        return EFI_NOT_FOUND;
+    }
+
+    Status = SafeUintnAdd (VarHeaderEnd, VarHeader->NameSize, &VarNameEnd);
+    if (RETURN_ERROR (Status)) {
+      DEBUG ((DEBUG_ERROR, "%a: integer overflow\n", __func__));
+      return EFI_NOT_FOUND;
+    }
+
+    Status = SafeUintnAdd (VarNameEnd, VarHeader->DataSize, &VarEnd);
+    if (RETURN_ERROR (Status)) {
+      DEBUG ((DEBUG_ERROR, "%a: integer overflow\n", __func__));
+      return EFI_NOT_FOUND;
+    }
+
+    if (VarEnd > VariableStoreHeader->Size) {
+      DEBUG ((
+        DEBUG_ERROR,
+        "%a: invalid variable size: 0x%Lx + 0x%Lx + 0x%x + 0x%x > 0x%x\n",
+        __func__,
+        (UINT64)VarOffset,
+        (UINT64)(sizeof (*VarHeader)),
+        VarHeader->NameSize,
+        VarHeader->DataSize,
+        VariableStoreHeader->Size
+        ));
+      return EFI_NOT_FOUND;
+    }
+
+    if (((VarHeader->NameSize & 1) != 0) ||
+        (VarHeader->NameSize < 4))
+    {
+      DEBUG ((DEBUG_ERROR, "%a: invalid name size\n", __func__));
+      return EFI_NOT_FOUND;
+    }
+
+    if (VarName == NULL) {
+      VarName = (VOID *)((UINTN)VariableStoreHeader + VarHeaderEnd);
+      if (VarName[VarHeader->NameSize / 2 - 1] != L'\0') {
+        DEBUG ((DEBUG_ERROR, "%a: name is not null terminated\n", __func__));
+        return EFI_NOT_FOUND;
+      }
+    }
+
+    DEBUG ((
+      DEBUG_VERBOSE,
+      "%a: +0x%04Lx: name=0x%x data=0x%x guid=%g '%s' (%a)\n",
+      __func__,
+      (UINT64)VarOffset,
+      VarHeader->NameSize,
+      VarHeader->DataSize,
+      &VarHeader->VendorGuid,
+      VarName,
+      VarState
+      ));
+
+    VarPadding = (4 - (VarEnd & 3)) & 3;
+    Status     = SafeUintnAdd (VarEnd, VarPadding, &VarOffset);
+    if (RETURN_ERROR (Status)) {
+      DEBUG ((DEBUG_ERROR, "%a: integer overflow\n", __func__));
+      return EFI_NOT_FOUND;
+    }
+  }
+
+   return EFI_SUCCESS;
+ }
+ 
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariable2.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariable2.patch
@ -0,0 +1,49 @@
+From 1444157aad1b98ce9c1193ef109011b084113890 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 9 Jan 2024 12:29:01 +0100
+Subject: [PATCH 09/18] OvmfPkg/VirtNorFlashDxe: stop accepting
+ gEfiVariableGuid
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [11/20] c7b9cd1b716e1b8163b8094fbea8117241901815
+
+Only accept gEfiAuthenticatedVariableGuid when checking the variable
+store header in ValidateFvHeader().
+
+The edk2 code base has been switched to use the authenticated varstore
+format unconditionally (even in case secure boot is not used or
+supported) a few years ago.
+
+Suggested-by: László Érsek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240109112902.30002-3-kraxel@redhat.com>
+(cherry picked from commit ae22b2f136bcbd27135a5f4dd76d3a68a172d00e)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+index cc5eefaaf3..c503272a2b 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+@@ -239,9 +239,7 @@ ValidateFvHeader (
+   VariableStoreHeader = (VARIABLE_STORE_HEADER *)((UINTN)FwVolHeader + FwVolHeader->HeaderLength);
+ 
+   // Check the Variable Store Guid
+-  if (!CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) &&
+-      !CompareGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid))
+-  {
+  if (!CompareGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid)) {
+     DEBUG ((
+       DEBUG_INFO,
+       "%a: Variable Store Guid non-compatible\n",
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariableG.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariableG.patch
@ -0,0 +1,47 @@
+From abe5b633eaae333190fb742af3fa15968f02a92e Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 9 Jan 2024 12:29:01 +0100
+Subject: [PATCH 1/2] OvmfPkg/VirtNorFlashDxe: stop accepting gEfiVariableGuid
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 42: OvmfPkg/VirtNorFlashDxe: sanity-check variables
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [1/2] 790f895bd180bc2c4b957a7a3c7d07e9107dd74b
+
+Only accept gEfiAuthenticatedVariableGuid when checking the variable
+store header in ValidateFvHeader().
+
+The edk2 code base has been switched to use the authenticated varstore
+format unconditionally (even in case secure boot is not used or
+supported) a few years ago.
+
+Suggested-by: László Érsek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240109112902.30002-3-kraxel@redhat.com>
+(cherry picked from commit ae22b2f136bcbd27135a5f4dd76d3a68a172d00e)
+---
+ ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashFvb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashFvb.c b/ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashFvb.c
+index db8eb595f4..904605cbbc 100644
+--- a/ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashFvb.c
+++ b/ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashFvb.c
+@@ -210,8 +210,7 @@ ValidateFvHeader (
+   VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + FwVolHeader->HeaderLength);
+ 
+   // Check the Variable Store Guid
+-  if (!CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) &&
+-      !CompareGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid)) {
+  if (!CompareGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid)) {
+     DEBUG ((EFI_D_INFO, "%a: Variable Store Guid non-compatible\n",
+       __FUNCTION__));
+     return EFI_NOT_FOUND;
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-use-EFI_MEMORY_WC-and-drop-A.patch
+++ b/SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-use-EFI_MEMORY_WC-and-drop-A.patch
@ -0,0 +1,150 @@
+From e65da48afdabc9a5cba1c212b4323898b91ef2a4 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 24 Oct 2022 18:16:18 +0200
+Subject: [PATCH 07/18] OvmfPkg/VirtNorFlashDxe: use EFI_MEMORY_WC and drop
+ AlignedCopyMem()
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [9/20] 0c01619eff8282d08e05fae8c37175b944449f59
+
+NOR flash emulation under KVM involves switching between two modes,
+where array mode is backed by a read-only memslot, and programming mode
+is fully emulated, i.e., the memory region is not backed by anything,
+and the faulting accesses are forwarded to the VMM by the hypervisor,
+which translates them into NOR flash programming commands.
+
+Normally, we are limited to the use of device attributes when mapping
+such regions, given that the programming mode has MMIO semantics.
+However, when running under KVM, the chosen memory attributes only take
+effect when in array mode, since no memory mapping exists otherwise.
+
+This means we can tune the memory mapping so it behaves a bit more like
+a ROM, by switching to EFI_MEMORY_WC attributes. This means we no longer
+need a special CopyMem() implementation that avoids unaligned accesses
+at all cost.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
+(cherry picked from commit 789a723285533f35652ebd6029976e2ddc955655)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c    | 65 +----------------------
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c |  4 +-
+ 2 files changed, 4 insertions(+), 65 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 0343131a54..1afd60ce66 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -401,67 +401,6 @@ NorFlashWriteBlocks (
+   return Status;
+ }
+ 
+-#define BOTH_ALIGNED(a, b, align)  ((((UINTN)(a) | (UINTN)(b)) & ((align) - 1)) == 0)
+-
+-/**
+-  Copy Length bytes from Source to Destination, using aligned accesses only.
+-  Note that this implementation uses memcpy() semantics rather then memmove()
+-  semantics, i.e., SourceBuffer and DestinationBuffer should not overlap.
+-
+-  @param  DestinationBuffer The target of the copy request.
+-  @param  SourceBuffer      The place to copy from.
+-  @param  Length            The number of bytes to copy.
+-
+-  @return Destination
+-
+-**/
+-STATIC
+-VOID *
+-AlignedCopyMem (
+-  OUT     VOID        *DestinationBuffer,
+-  IN      CONST VOID  *SourceBuffer,
+-  IN      UINTN       Length
+-  )
+-{
+-  UINT8         *Destination8;
+-  CONST UINT8   *Source8;
+-  UINT32        *Destination32;
+-  CONST UINT32  *Source32;
+-  UINT64        *Destination64;
+-  CONST UINT64  *Source64;
+-
+-  if (BOTH_ALIGNED (DestinationBuffer, SourceBuffer, 8) && (Length >= 8)) {
+-    Destination64 = DestinationBuffer;
+-    Source64      = SourceBuffer;
+-    while (Length >= 8) {
+-      *Destination64++ = *Source64++;
+-      Length          -= 8;
+-    }
+-
+-    Destination8 = (UINT8 *)Destination64;
+-    Source8      = (CONST UINT8 *)Source64;
+-  } else if (BOTH_ALIGNED (DestinationBuffer, SourceBuffer, 4) && (Length >= 4)) {
+-    Destination32 = DestinationBuffer;
+-    Source32      = SourceBuffer;
+-    while (Length >= 4) {
+-      *Destination32++ = *Source32++;
+-      Length          -= 4;
+-    }
+-
+-    Destination8 = (UINT8 *)Destination32;
+-    Source8      = (CONST UINT8 *)Source32;
+-  } else {
+-    Destination8 = DestinationBuffer;
+-    Source8      = SourceBuffer;
+-  }
+-
+-  while (Length-- != 0) {
+-    *Destination8++ = *Source8++;
+-  }
+-
+-  return DestinationBuffer;
+-}
+-
+ EFI_STATUS
+ NorFlashReadBlocks (
+   IN NOR_FLASH_INSTANCE  *Instance,
+@@ -516,7 +455,7 @@ NorFlashReadBlocks (
+   SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_READ_ARRAY);
+ 
+   // Readout the data
+-  AlignedCopyMem (Buffer, (VOID *)StartAddress, BufferSizeInBytes);
+  CopyMem (Buffer, (VOID *)StartAddress, BufferSizeInBytes);
+ 
+   return EFI_SUCCESS;
+ }
+@@ -558,7 +497,7 @@ NorFlashRead (
+   SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_READ_ARRAY);
+ 
+   // Readout the data
+-  AlignedCopyMem (Buffer, (VOID *)(StartAddress + Offset), BufferSizeInBytes);
+  CopyMem (Buffer, (VOID *)(StartAddress + Offset), BufferSizeInBytes);
+ 
+   return EFI_SUCCESS;
+ }
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+index f9a41f6aab..ff3121af2a 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.c
+@@ -394,14 +394,14 @@ NorFlashFvbInitialize (
+                   EfiGcdMemoryTypeMemoryMappedIo,
+                   Instance->DeviceBaseAddress,
+                   RuntimeMmioRegionSize,
+-                  EFI_MEMORY_UC | EFI_MEMORY_RUNTIME
+                  EFI_MEMORY_WC | EFI_MEMORY_RUNTIME
+                   );
+   ASSERT_EFI_ERROR (Status);
+ 
+   Status = gDS->SetMemorySpaceAttributes (
+                   Instance->DeviceBaseAddress,
+                   RuntimeMmioRegionSize,
+-                  EFI_MEMORY_UC | EFI_MEMORY_RUNTIME
+                  EFI_MEMORY_WC | EFI_MEMORY_RUNTIME
+                   );
+   ASSERT_EFI_ERROR (Status);
+ 
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-clone-NorFlashPlatformLib-into-VirtNorFlashP.patch
+++ b/SOURCES/edk2-OvmfPkg-clone-NorFlashPlatformLib-into-VirtNorFlashP.patch
@ -0,0 +1,80 @@
+From 59fb955aa77b75345f7828bf9f83764adf4bed46 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 24 Oct 2022 18:35:10 +0200
+Subject: [PATCH 18/18] OvmfPkg: clone NorFlashPlatformLib into
+ VirtNorFlashPlatformLib
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 43: OvmfPkg/VirtNorFlashDxe backport
+RH-Jira: RHEL-17587
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [20/20] 50ea104b99a997d7d08c1fdef617df1d930ffae6
+
+Create a new library class in Ovmf that duplicates the existing
+NorFlashPlatformLib, but which will be tied to the VirtNorFlashDxe
+driver that will be introduced in a subsequent patch. This allows us to
+retire the original from ArmPlatformPkg.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
+(cherry picked from commit 16bf588b604a9f190accb71ada715b81756c94e2)
+---
+ .../Include/Library/VirtNorFlashPlatformLib.h | 30 +++++++++++++++++++
+ OvmfPkg/OvmfPkg.dec                           |  4 +++
+ 2 files changed, 34 insertions(+)
+ create mode 100644 OvmfPkg/Include/Library/VirtNorFlashPlatformLib.h
+
+diff --git a/OvmfPkg/Include/Library/VirtNorFlashPlatformLib.h b/OvmfPkg/Include/Library/VirtNorFlashPlatformLib.h
+new file mode 100644
+index 0000000000..8f5b5e972d
+--- /dev/null
+++ b/OvmfPkg/Include/Library/VirtNorFlashPlatformLib.h
+@@ -0,0 +1,30 @@
+/** @file
+
+ Copyright (c) 2011-2012, ARM Ltd. All rights reserved.<BR>
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+ **/
+
+#ifndef __VIRT_NOR_FLASH_PLATFORM_LIB__
+#define __VIRT_NOR_FLASH_PLATFORM_LIB__
+
+typedef struct {
+  UINTN    DeviceBaseAddress;       // Start address of the Device Base Address (DBA)
+  UINTN    RegionBaseAddress;       // Start address of one single region
+  UINTN    Size;
+  UINTN    BlockSize;
+} VIRT_NOR_FLASH_DESCRIPTION;
+
+EFI_STATUS
+VirtNorFlashPlatformInitialization (
+  VOID
+  );
+
+EFI_STATUS
+VirtNorFlashPlatformGetDevices (
+  OUT VIRT_NOR_FLASH_DESCRIPTION  **NorFlashDescriptions,
+  OUT UINT32                      *Count
+  );
+
+#endif /* __VIRT_NOR_FLASH_PLATFORM_LIB__ */
+diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec
+index 340d83f794..e65ebd81c8 100644
+--- a/OvmfPkg/OvmfPkg.dec
+++ b/OvmfPkg/OvmfPkg.dec
+@@ -97,6 +97,10 @@
+   #                  transports.
+   VirtioMmioDeviceLib|Include/Library/VirtioMmioDeviceLib.h
+ 
+  ##  @libraryclass  Provides a Nor flash interface.
+  #
+  VirtNorFlashPlatformLib|Include/Library/VirtNorFlashPlatformLib.h
+
+   ##  @libraryclass  Invoke Xen hypercalls
+   #
+   XenHypercallLib|Include/Library/XenHypercallLib.h
+-- 
+2.41.0
+
--- a/SOURCES/edk2-OvmfPkg-wire-up-RngDxe.patch
+++ b/SOURCES/edk2-OvmfPkg-wire-up-RngDxe.patch
@ -0,0 +1,318 @@
+From c74cced5adaab44edf1bbfae63010b3fa31d4c69 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Sun, 23 Jun 2024 19:20:44 -0400
+Subject: [PATCH 27/31] OvmfPkg: wire up RngDxe
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [27/31] 90226f6630261d2823bed33c4e2f6c96a4125027
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+Conflicts: - Needed to apply 9 earlier commits from Pierre Gondois
+             to make this one apply and build.
+	   - Cherry pick wanted to add include files from the
+             missing 'add ShellComponents' (commit 2cb466cc2cbf...)
+             series. This had to be handled manually.
+           - There are no Dsc and Fdf subdirectories under
+             OvmfPkg/Include/ in this version. We adjust includes
+             and move files to OvmfPkg/ where needed.
+
+commit 712797cf19acd292bf203522a79e40e7e13d268b
+Author: Gerd Hoffmann <kraxel@redhat.com>
+Date:   Fri May 24 12:51:17 2024 +0200
+
+    OvmfPkg: wire up RngDxe
+
+    Add OvmfRng include snippets with the random number generator
+    configuration for OVMF.  Include RngDxe, build with BaseRngLib,
+    so the rdrand instruction is used (if available).
+
+    Also move VirtioRng to the include snippets.
+
+    Use the new include snippets for OVMF builds.
+
+    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc      | 2 +-
+ OvmfPkg/AmdSev/AmdSevX64.fdf      | 3 ++-
+ OvmfPkg/IntelTdx/IntelTdxX64.dsc  | 2 +-
+ OvmfPkg/Microvm/MicrovmX64.dsc    | 2 +-
+ OvmfPkg/Microvm/MicrovmX64.fdf    | 3 ++-
+ OvmfPkg/OvmfPkgIa32.dsc           | 2 +-
+ OvmfPkg/OvmfPkgIa32.fdf           | 3 ++-
+ OvmfPkg/OvmfPkgIa32X64.dsc        | 2 +-
+ OvmfPkg/OvmfPkgIa32X64.fdf        | 2 +-
+ OvmfPkg/OvmfPkgX64.dsc            | 2 +-
+ OvmfPkg/OvmfPkgX64.fdf            | 2 +-
+ OvmfPkg/OvmfRngComponents.dsc.inc | 9 +++++++++
+ OvmfPkg/OvmfRngDxe.fdf.inc        | 6 ++++++
+ 13 files changed, 29 insertions(+), 11 deletions(-)
+ create mode 100644 OvmfPkg/OvmfRngComponents.dsc.inc
+ create mode 100644 OvmfPkg/OvmfRngDxe.fdf.inc
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index a1a6897bc2..499ad2e6e8 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -707,7 +707,6 @@
+   OvmfPkg/Virtio10Dxe/Virtio10.inf
+   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -824,6 +823,7 @@
+       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
+   }
+ !endif
+!include OvmfPkg/OvmfRngComponents.dsc.inc
+ 
+   OvmfPkg/PlatformDxe/Platform.inf
+   OvmfPkg/AmdSevDxe/AmdSevDxe.inf
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
+index 5662609886..06ff2f1d30 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.fdf
+++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
+@@ -222,7 +222,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
+ INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
+ INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+ INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+ INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -327,6 +326,8 @@ INF  SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
+ !endif
+ !endif
+ 
+!include OvmfPkg/OvmfRngDxe.fdf.inc
+
+ ################################################################################
+ 
+ [FV.FVMAIN_COMPACT]
+diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
+index d08b77ff25..4f2909b76e 100644
+--- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
+++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
+@@ -635,7 +635,6 @@
+   OvmfPkg/Virtio10Dxe/Virtio10.inf
+   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -744,6 +743,7 @@
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
+   }
+!include OvmfPkg/OvmfRngComponents.dsc.inc
+ 
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
+index afd4bf3e98..0efb0b456d 100644
+--- a/OvmfPkg/Microvm/MicrovmX64.dsc
+++ b/OvmfPkg/Microvm/MicrovmX64.dsc
+@@ -694,7 +694,6 @@
+   OvmfPkg/Virtio10Dxe/Virtio10.inf
+   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+   MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
+   MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
+   MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
+@@ -820,6 +819,7 @@
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
+   }
+!include OvmfPkg/OvmfRngComponents.dsc.inc
+ 
+   OvmfPkg/PlatformDxe/Platform.inf
+   OvmfPkg/IoMmuDxe/IoMmuDxe.inf
+diff --git a/OvmfPkg/Microvm/MicrovmX64.fdf b/OvmfPkg/Microvm/MicrovmX64.fdf
+index 6314014f3d..bd5afdafe0 100644
+--- a/OvmfPkg/Microvm/MicrovmX64.fdf
+++ b/OvmfPkg/Microvm/MicrovmX64.fdf
+@@ -230,7 +230,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
+ INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
+ INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+ INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ 
+ INF  MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
+ INF  MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
+@@ -322,6 +321,8 @@ INF  OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf
+ INF  MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
+ INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
+ 
+!include OvmfPkg/OvmfRngDxe.fdf.inc
+
+ ################################################################################
+ 
+ [FV.FVMAIN_COMPACT]
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 47426c5cd2..f03906a9ff 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
+++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -801,7 +801,6 @@
+   OvmfPkg/Virtio10Dxe/Virtio10.inf
+   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -958,6 +957,7 @@
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
+   }
+!include OvmfPkg/OvmfRngComponents.dsc.inc
+ 
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
+index 00ea14adf0..050148948c 100644
+--- a/OvmfPkg/OvmfPkgIa32.fdf
+++ b/OvmfPkg/OvmfPkgIa32.fdf
+@@ -228,7 +228,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
+ INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
+ INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+ INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+ INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -363,6 +362,7 @@ INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
+ #
+ # TPM support
+ #
+
+ !if $(TPM_ENABLE) == TRUE
+ INF  SecurityPkg/Tcg/TcgDxe/TcgDxe.inf
+ INF  SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.inf
+@@ -371,6 +371,7 @@ INF  SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
+ INF  SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
+ !endif
+ !endif
+!include OvmfPkg/OvmfRngDxe.fdf.inc
+ 
+ !if $(LOAD_X64_ON_IA32_ENABLE) == TRUE
+ INF  OvmfPkg/CompatImageLoaderDxe/CompatImageLoaderDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index d4b30e8133..81145050c3 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -815,7 +815,6 @@
+   OvmfPkg/Virtio10Dxe/Virtio10.inf
+   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -972,6 +971,7 @@
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
+   }
+!include OvmfPkg/OvmfRngComponents.dsc.inc
+ 
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
+index e33a40c44e..3e2373f225 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.fdf
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
+@@ -232,7 +232,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
+ INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
+ INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+ INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+ INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -381,6 +380,7 @@ INF  SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
+ INF  SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
+ !endif
+ !endif
+!include OvmfPkg/OvmfRngDxe.fdf.inc
+ 
+ ################################################################################
+ 
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index 5b0f6c8747..1cb169b447 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -813,7 +813,6 @@
+   OvmfPkg/Virtio10Dxe/Virtio10.inf
+   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -970,6 +969,7 @@
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
+   }
+!include OvmfPkg/OvmfRngComponents.dsc.inc
+ 
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
+index 85b4b23857..8ba0ca437a 100644
+--- a/OvmfPkg/OvmfPkgX64.fdf
+++ b/OvmfPkg/OvmfPkgX64.fdf
+@@ -248,7 +248,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
+ INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
+ INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+ INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+ INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -397,6 +396,7 @@ INF  SecurityPkg/Tcg/Tcg2PlatformDxe/Tcg2PlatformDxe.inf
+ INF  SecurityPkg/Tcg/Tcg2Config/Tcg2ConfigDxe.inf
+ !endif
+ !endif
+!include OvmfPkg/OvmfRngDxe.fdf.inc
+ 
+ ################################################################################
+ 
+diff --git a/OvmfPkg/OvmfRngComponents.dsc.inc b/OvmfPkg/OvmfRngComponents.dsc.inc
+new file mode 100644
+index 0000000000..68839a0caa
+--- /dev/null
+++ b/OvmfPkg/OvmfRngComponents.dsc.inc
+@@ -0,0 +1,9 @@
+##
+#    SPDX-License-Identifier: BSD-2-Clause-Patent
+##
+
+  SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf {
+    <LibraryClasses>
+      RngLib|MdePkg/Library/BaseRngLib/BaseRngLib.inf
+  }
+  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+diff --git a/OvmfPkg/OvmfRngDxe.fdf.inc b/OvmfPkg/OvmfRngDxe.fdf.inc
+new file mode 100644
+index 0000000000..99cb4a32b1
+--- /dev/null
+++ b/OvmfPkg/OvmfRngDxe.fdf.inc
+@@ -0,0 +1,6 @@
+##
+#    SPDX-License-Identifier: BSD-2-Clause-Patent
+##
+
+INF  SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch
+++ b/SOURCES/edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch
@ -0,0 +1,68 @@
+From 2794a967f43f2bbdfcd2cb5197ac8cad4b13c3de Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 17 Jan 2024 12:20:52 -0500
+Subject: [PATCH 08/17] SecurityPkg: Adding CVE 2022-36763 to
+ SecurityFixes.yaml
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 44: edk2: heap buffer overflow in Tcg2MeasureGptTable()
+RH-Jira: RHEL-21154 RHEL-21156
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [8/13] 74117caf760e403566f6511332b2c0f41483f28c (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21154
+Upstream: Merged
+CVE: CVE-2022-36763
+
+commit 1ddcb9fc6b4164e882687b031e8beacfcf7df29e
+Author: Douglas Flick [MSFT] <doug.edk2@gmail.com>
+Date:   Fri Jan 12 02:16:03 2024 +0800
+
+    SecurityPkg: : Adding CVE 2022-36763 to SecurityFixes.yaml
+
+    This creates / adds a security file that tracks the security fixes
+    found in this package and can be used to find the fixes that were
+    applied.
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ SecurityPkg/SecurityFixes.yaml | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+ create mode 100644 SecurityPkg/SecurityFixes.yaml
+
+diff --git a/SecurityPkg/SecurityFixes.yaml b/SecurityPkg/SecurityFixes.yaml
+new file mode 100644
+index 0000000000..f9e3e7be74
+--- /dev/null
+++ b/SecurityPkg/SecurityFixes.yaml
+@@ -0,0 +1,22 @@
+## @file
+# Security Fixes for SecurityPkg
+#
+# Copyright (c) Microsoft Corporation
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+##
+CVE_2022_36763:
+  commit_titles:
+    - "SecurityPkg: DxeTpm2Measurement: SECURITY PATCH 4117 - CVE 2022-36763"
+    - "SecurityPkg: DxeTpmMeasurement: SECURITY PATCH 4117 - CVE 2022-36763"
+    - "SecurityPkg: : Adding CVE 2022-36763 to SecurityFixes.yaml"
+  cve: CVE-2022-36763
+  date_reported: 2022-10-25 11:31 UTC
+  description: (CVE-2022-36763) - Heap Buffer Overflow in Tcg2MeasureGptTable()
+  note: This patch is related to and supersedes TCBZ2168
+  files_impacted:
+  - Library\DxeTpm2MeasureBootLib\DxeTpm2MeasureBootLib.c
+  - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
+  links:
+  - https://bugzilla.tianocore.org/show_bug.cgi?id=4117
+  - https://bugzilla.tianocore.org/show_bug.cgi?id=2168
+  - https://bugzilla.tianocore.org/show_bug.cgi?id=1990
+-- 
+2.41.0
+
--- a/SOURCES/edk2-SecurityPkg-Change-OPTIONAL-keyword-usage-style.patch
+++ b/SOURCES/edk2-SecurityPkg-Change-OPTIONAL-keyword-usage-style.patch
@ -0,0 +1,403 @@
+From e2ccaef3baa2eb045019558c325bb94cabf65e1a Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 7 Feb 2024 11:56:37 -0500
+Subject: [PATCH 02/17] SecurityPkg: Change OPTIONAL keyword usage style
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 44: edk2: heap buffer overflow in Tcg2MeasureGptTable()
+RH-Jira: RHEL-21154 RHEL-21156
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [2/13] 6a2141d871e3efc3aeea1994ab9c325614ddce57 (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21154
+CVE: CVE-2022-36763
+Upstream: Merged
+
+commit 948f4003ee399241a40dc147a738f05ad2e37375
+Author: Michael D Kinney <michael.d.kinney@intel.com>
+Date:   Thu Dec 2 18:00:56 2021 -0800
+
+    SecurityPkg: Change OPTIONAL keyword usage style
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3760
+
+    Update all use of ', OPTIONAL' to ' OPTIONAL,' for function params.
+
+    Cc: Andrew Fish <afish@apple.com>
+    Cc: Leif Lindholm <leif@nuviainc.com>
+    Cc: Michael Kubacki <michael.kubacki@microsoft.com>
+    Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
+    Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ SecurityPkg/Include/Library/Tcg2PpVendorLib.h      |  2 +-
+ SecurityPkg/Include/Library/Tpm2CommandLib.h       | 14 +++++++-------
+ SecurityPkg/Library/AuthVariableLib/AuthService.c  |  6 +++---
+ .../DxeImageAuthenticationStatusLib.c              |  2 +-
+ .../DxeImageVerificationLib.c                      |  2 +-
+ .../DxeRsa2048Sha256GuidedSectionExtractLib.c      |  2 +-
+ .../DxeTcg2PhysicalPresenceLib.c                   |  4 ++--
+ .../DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c  |  2 +-
+ .../DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c    |  2 +-
+ .../PeiRsa2048Sha256GuidedSectionExtractLib.c      |  2 +-
+ .../Tcg2PpVendorLibNull/Tcg2PpVendorLibNull.c      |  2 +-
+ .../Tpm2CommandLib/Tpm2EnhancedAuthorization.c     |  2 +-
+ SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c      |  2 +-
+ SecurityPkg/Library/Tpm2CommandLib/Tpm2Hierarchy.c |  2 +-
+ SecurityPkg/Library/Tpm2CommandLib/Tpm2Integrity.c |  2 +-
+ SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c |  6 +++---
+ .../RandomNumberGenerator/RngDxe/AArch64/RngDxe.c  |  2 +-
+ .../RandomNumberGenerator/RngDxe/Rand/RngDxe.c     |  2 +-
+ .../RandomNumberGenerator/RngDxe/RngDxeInternals.h |  2 +-
+ SecurityPkg/Tcg/TcgConfigDxe/TcgConfigImpl.c       |  2 +-
+ 20 files changed, 31 insertions(+), 31 deletions(-)
+
+diff --git a/SecurityPkg/Include/Library/Tcg2PpVendorLib.h b/SecurityPkg/Include/Library/Tcg2PpVendorLib.h
+index 569eba6874..914517f034 100644
+--- a/SecurityPkg/Include/Library/Tcg2PpVendorLib.h
+++ b/SecurityPkg/Include/Library/Tcg2PpVendorLib.h
+@@ -40,7 +40,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ UINT32
+ EFIAPI
+ Tcg2PpVendorLibExecutePendingRequest (
+-  IN TPM2B_AUTH             *PlatformAuth,  OPTIONAL
+  IN TPM2B_AUTH             *PlatformAuth   OPTIONAL,
+   IN UINT32                 OperationRequest,
+   IN OUT UINT32             *ManagementFlags,
+   OUT BOOLEAN               *ResetRequired
+diff --git a/SecurityPkg/Include/Library/Tpm2CommandLib.h b/SecurityPkg/Include/Library/Tpm2CommandLib.h
+index ee8eb62295..ad3b982d48 100644
+--- a/SecurityPkg/Include/Library/Tpm2CommandLib.h
+++ b/SecurityPkg/Include/Library/Tpm2CommandLib.h
+@@ -186,7 +186,7 @@ EFI_STATUS
+ EFIAPI
+ Tpm2ClearControl (
+   IN TPMI_RH_CLEAR             AuthHandle,
+-  IN TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
+  IN TPMS_AUTH_COMMAND         *AuthSession  OPTIONAL,
+   IN TPMI_YES_NO               Disable
+   );
+ 
+@@ -340,7 +340,7 @@ EFI_STATUS
+ EFIAPI
+ Tpm2NvDefineSpace (
+   IN      TPMI_RH_PROVISION         AuthHandle,
+-  IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
+  IN      TPMS_AUTH_COMMAND         *AuthSession  OPTIONAL,
+   IN      TPM2B_AUTH                *Auth,
+   IN      TPM2B_NV_PUBLIC           *NvPublic
+   );
+@@ -383,7 +383,7 @@ EFIAPI
+ Tpm2NvRead (
+   IN      TPMI_RH_NV_AUTH           AuthHandle,
+   IN      TPMI_RH_NV_INDEX          NvIndex,
+-  IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
+  IN      TPMS_AUTH_COMMAND         *AuthSession  OPTIONAL,
+   IN      UINT16                    Size,
+   IN      UINT16                    Offset,
+   IN OUT  TPM2B_MAX_BUFFER          *OutData
+@@ -407,7 +407,7 @@ EFIAPI
+ Tpm2NvWrite (
+   IN      TPMI_RH_NV_AUTH           AuthHandle,
+   IN      TPMI_RH_NV_INDEX          NvIndex,
+-  IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
+  IN      TPMS_AUTH_COMMAND         *AuthSession  OPTIONAL,
+   IN      TPM2B_MAX_BUFFER          *InData,
+   IN      UINT16                    Offset
+   );
+@@ -566,7 +566,7 @@ Tpm2PcrAllocate (
+ EFI_STATUS
+ EFIAPI
+ Tpm2PcrAllocateBanks (
+-  IN TPM2B_AUTH                *PlatformAuth,  OPTIONAL
+  IN TPM2B_AUTH                *PlatformAuth   OPTIONAL,
+   IN UINT32                    SupportedPCRBanks,
+   IN UINT32                    PCRBanks
+   );
+@@ -908,7 +908,7 @@ EFIAPI
+ Tpm2PolicySecret (
+   IN      TPMI_DH_ENTITY            AuthHandle,
+   IN      TPMI_SH_POLICY            PolicySession,
+-  IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
+  IN      TPMS_AUTH_COMMAND         *AuthSession  OPTIONAL,
+   IN      TPM2B_NONCE               *NonceTPM,
+   IN      TPM2B_DIGEST              *CpHashA,
+   IN      TPM2B_NONCE               *PolicyRef,
+@@ -1004,7 +1004,7 @@ Tpm2ReadPublic (
+ UINT32
+ EFIAPI
+ CopyAuthSessionCommand (
+-  IN      TPMS_AUTH_COMMAND         *AuthSessionIn, OPTIONAL
+  IN      TPMS_AUTH_COMMAND         *AuthSessionIn  OPTIONAL,
+   OUT     UINT8                     *AuthSessionOut
+   );
+ 
+diff --git a/SecurityPkg/Library/AuthVariableLib/AuthService.c b/SecurityPkg/Library/AuthVariableLib/AuthService.c
+index aa9ebaf3be..3059e5d256 100644
+--- a/SecurityPkg/Library/AuthVariableLib/AuthService.c
+++ b/SecurityPkg/Library/AuthVariableLib/AuthService.c
+@@ -1183,9 +1183,9 @@ FindCertsFromDb (
+   IN     EFI_GUID         *VendorGuid,
+   IN     UINT8            *Data,
+   IN     UINTN            DataSize,
+-  OUT    UINT32           *CertOffset,    OPTIONAL
+-  OUT    UINT32           *CertDataSize,  OPTIONAL
+-  OUT    UINT32           *CertNodeOffset,OPTIONAL
+  OUT    UINT32           *CertOffset     OPTIONAL,
+  OUT    UINT32           *CertDataSize   OPTIONAL,
+  OUT    UINT32           *CertNodeOffset OPTIONAL,
+   OUT    UINT32           *CertNodeSize   OPTIONAL
+   )
+ {
+diff --git a/SecurityPkg/Library/DxeImageAuthenticationStatusLib/DxeImageAuthenticationStatusLib.c b/SecurityPkg/Library/DxeImageAuthenticationStatusLib/DxeImageAuthenticationStatusLib.c
+index ec77151c9c..9acff2ae7d 100644
+--- a/SecurityPkg/Library/DxeImageAuthenticationStatusLib/DxeImageAuthenticationStatusLib.c
+++ b/SecurityPkg/Library/DxeImageAuthenticationStatusLib/DxeImageAuthenticationStatusLib.c
+@@ -32,7 +32,7 @@ EFI_STATUS
+ EFIAPI
+ DxeImageAuthenticationStatusHandler (
+   IN  UINT32                           AuthenticationStatus,
+-  IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File, OPTIONAL
+  IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File  OPTIONAL,
+   IN  VOID                             *FileBuffer,
+   IN  UINTN                            FileSize,
+   IN  BOOLEAN                          BootPolicy
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index 1252927664..0a12692454 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -1636,7 +1636,7 @@ EFI_STATUS
+ EFIAPI
+ DxeImageVerificationHandler (
+   IN  UINT32                           AuthenticationStatus,
+-  IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File, OPTIONAL
+  IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File  OPTIONAL,
+   IN  VOID                             *FileBuffer,
+   IN  UINTN                            FileSize,
+   IN  BOOLEAN                          BootPolicy
+diff --git a/SecurityPkg/Library/DxeRsa2048Sha256GuidedSectionExtractLib/DxeRsa2048Sha256GuidedSectionExtractLib.c b/SecurityPkg/Library/DxeRsa2048Sha256GuidedSectionExtractLib/DxeRsa2048Sha256GuidedSectionExtractLib.c
+index 28807d4d98..5124b884c9 100644
+--- a/SecurityPkg/Library/DxeRsa2048Sha256GuidedSectionExtractLib/DxeRsa2048Sha256GuidedSectionExtractLib.c
+++ b/SecurityPkg/Library/DxeRsa2048Sha256GuidedSectionExtractLib/DxeRsa2048Sha256GuidedSectionExtractLib.c
+@@ -123,7 +123,7 @@ EFIAPI
+ Rsa2048Sha256GuidedSectionHandler (
+   IN CONST  VOID    *InputSection,
+   OUT       VOID    **OutputBuffer,
+-  IN        VOID    *ScratchBuffer,        OPTIONAL
+  IN        VOID    *ScratchBuffer         OPTIONAL,
+   OUT       UINT32  *AuthenticationStatus
+   )
+ {
+diff --git a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c
+index fce5c0af50..d92658f80d 100644
+--- a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c
+++ b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c
+@@ -147,7 +147,7 @@ Tpm2CommandChangeEps (
+ **/
+ UINT32
+ Tcg2ExecutePhysicalPresence (
+-  IN      TPM2B_AUTH                       *PlatformAuth,  OPTIONAL
+  IN      TPM2B_AUTH                       *PlatformAuth   OPTIONAL,
+   IN      UINT32                           CommandCode,
+   IN      UINT32                           CommandParameter,
+   IN OUT  EFI_TCG2_PHYSICAL_PRESENCE_FLAGS *PpiFlags
+@@ -720,7 +720,7 @@ Tcg2HaveValidTpmRequest  (
+ **/
+ VOID
+ Tcg2ExecutePendingTpmRequest (
+-  IN      TPM2B_AUTH                       *PlatformAuth,  OPTIONAL
+  IN      TPM2B_AUTH                       *PlatformAuth   OPTIONAL,
+   IN OUT  EFI_TCG2_PHYSICAL_PRESENCE       *TcgPpData,
+   IN OUT  EFI_TCG2_PHYSICAL_PRESENCE_FLAGS *Flags
+   )
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+index a531385f81..95682ac567 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+@@ -416,7 +416,7 @@ EFI_STATUS
+ EFIAPI
+ DxeTpm2MeasureBootHandler (
+   IN  UINT32                           AuthenticationStatus,
+-  IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File, OPTIONAL
+  IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File  OPTIONAL,
+   IN  VOID                             *FileBuffer,
+   IN  UINTN                            FileSize,
+   IN  BOOLEAN                          BootPolicy
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+index 4e74cd9db6..27c0ea48ca 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+@@ -710,7 +710,7 @@ EFI_STATUS
+ EFIAPI
+ DxeTpmMeasureBootHandler (
+   IN  UINT32                           AuthenticationStatus,
+-  IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File, OPTIONAL
+  IN  CONST EFI_DEVICE_PATH_PROTOCOL   *File  OPTIONAL,
+   IN  VOID                             *FileBuffer,
+   IN  UINTN                            FileSize,
+   IN  BOOLEAN                          BootPolicy
+diff --git a/SecurityPkg/Library/PeiRsa2048Sha256GuidedSectionExtractLib/PeiRsa2048Sha256GuidedSectionExtractLib.c b/SecurityPkg/Library/PeiRsa2048Sha256GuidedSectionExtractLib/PeiRsa2048Sha256GuidedSectionExtractLib.c
+index a759183d20..96638e26aa 100644
+--- a/SecurityPkg/Library/PeiRsa2048Sha256GuidedSectionExtractLib/PeiRsa2048Sha256GuidedSectionExtractLib.c
+++ b/SecurityPkg/Library/PeiRsa2048Sha256GuidedSectionExtractLib/PeiRsa2048Sha256GuidedSectionExtractLib.c
+@@ -121,7 +121,7 @@ EFIAPI
+ Rsa2048Sha256GuidedSectionHandler (
+   IN CONST  VOID    *InputSection,
+   OUT       VOID    **OutputBuffer,
+-  IN        VOID    *ScratchBuffer,        OPTIONAL
+  IN        VOID    *ScratchBuffer         OPTIONAL,
+   OUT       UINT32  *AuthenticationStatus
+   )
+ {
+diff --git a/SecurityPkg/Library/Tcg2PpVendorLibNull/Tcg2PpVendorLibNull.c b/SecurityPkg/Library/Tcg2PpVendorLibNull/Tcg2PpVendorLibNull.c
+index 895d05a28d..aa3dcb6beb 100644
+--- a/SecurityPkg/Library/Tcg2PpVendorLibNull/Tcg2PpVendorLibNull.c
+++ b/SecurityPkg/Library/Tcg2PpVendorLibNull/Tcg2PpVendorLibNull.c
+@@ -30,7 +30,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ UINT32
+ EFIAPI
+ Tcg2PpVendorLibExecutePendingRequest (
+-  IN TPM2B_AUTH             *PlatformAuth,  OPTIONAL
+  IN TPM2B_AUTH             *PlatformAuth   OPTIONAL,
+   IN UINT32                 OperationRequest,
+   IN OUT UINT32             *ManagementFlags,
+   OUT BOOLEAN               *ResetRequired
+diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2EnhancedAuthorization.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2EnhancedAuthorization.c
+index 0404c0f321..53983d745b 100644
+--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2EnhancedAuthorization.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2EnhancedAuthorization.c
+@@ -90,7 +90,7 @@ EFIAPI
+ Tpm2PolicySecret (
+   IN      TPMI_DH_ENTITY            AuthHandle,
+   IN      TPMI_SH_POLICY            PolicySession,
+-  IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
+  IN      TPMS_AUTH_COMMAND         *AuthSession  OPTIONAL,
+   IN      TPM2B_NONCE               *NonceTPM,
+   IN      TPM2B_DIGEST              *CpHashA,
+   IN      TPM2B_NONCE               *PolicyRef,
+diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
+index 13eeb6ec18..44115cded3 100644
+--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Help.c
+@@ -84,7 +84,7 @@ GetHashMaskFromAlgo (
+ UINT32
+ EFIAPI
+ CopyAuthSessionCommand (
+-  IN      TPMS_AUTH_COMMAND         *AuthSessionIn, OPTIONAL
+  IN      TPMS_AUTH_COMMAND         *AuthSessionIn  OPTIONAL,
+   OUT     UINT8                     *AuthSessionOut
+   )
+ {
+diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Hierarchy.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Hierarchy.c
+index 043d358a06..957d694431 100644
+--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Hierarchy.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Hierarchy.c
+@@ -305,7 +305,7 @@ EFI_STATUS
+ EFIAPI
+ Tpm2ClearControl (
+   IN TPMI_RH_CLEAR             AuthHandle,
+-  IN TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
+  IN TPMS_AUTH_COMMAND         *AuthSession  OPTIONAL,
+   IN TPMI_YES_NO               Disable
+   )
+ {
+diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Integrity.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Integrity.c
+index 8c87de0b0c..d232fe725d 100644
+--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2Integrity.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2Integrity.c
+@@ -566,7 +566,7 @@ Done:
+ EFI_STATUS
+ EFIAPI
+ Tpm2PcrAllocateBanks (
+-  IN TPM2B_AUTH                *PlatformAuth,  OPTIONAL
+  IN TPM2B_AUTH                *PlatformAuth   OPTIONAL,
+   IN UINT32                    SupportedPCRBanks,
+   IN UINT32                    PCRBanks
+   )
+diff --git a/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c b/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c
+index fb46af0fed..d9171fb9a0 100644
+--- a/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c
+++ b/SecurityPkg/Library/Tpm2CommandLib/Tpm2NVStorage.c
+@@ -281,7 +281,7 @@ EFI_STATUS
+ EFIAPI
+ Tpm2NvDefineSpace (
+   IN      TPMI_RH_PROVISION         AuthHandle,
+-  IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
+  IN      TPMS_AUTH_COMMAND         *AuthSession  OPTIONAL,
+   IN      TPM2B_AUTH                *Auth,
+   IN      TPM2B_NV_PUBLIC           *NvPublic
+   )
+@@ -525,7 +525,7 @@ EFIAPI
+ Tpm2NvRead (
+   IN      TPMI_RH_NV_AUTH           AuthHandle,
+   IN      TPMI_RH_NV_INDEX          NvIndex,
+-  IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
+  IN      TPMS_AUTH_COMMAND         *AuthSession  OPTIONAL,
+   IN      UINT16                    Size,
+   IN      UINT16                    Offset,
+   IN OUT  TPM2B_MAX_BUFFER          *OutData
+@@ -670,7 +670,7 @@ EFIAPI
+ Tpm2NvWrite (
+   IN      TPMI_RH_NV_AUTH           AuthHandle,
+   IN      TPMI_RH_NV_INDEX          NvIndex,
+-  IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
+  IN      TPMS_AUTH_COMMAND         *AuthSession  OPTIONAL,
+   IN      TPM2B_MAX_BUFFER          *InData,
+   IN      UINT16                    Offset
+   )
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+index 282fdca9d3..1cdc842966 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+@@ -53,7 +53,7 @@ EFI_STATUS
+ EFIAPI
+ RngGetRNG (
+   IN EFI_RNG_PROTOCOL            *This,
+-  IN EFI_RNG_ALGORITHM           *RNGAlgorithm, OPTIONAL
+  IN EFI_RNG_ALGORITHM           *RNGAlgorithm  OPTIONAL,
+   IN UINTN                       RNGValueLength,
+   OUT UINT8                      *RNGValue
+   )
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+index d0e6b7de06..834123b945 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+@@ -49,7 +49,7 @@ EFI_STATUS
+ EFIAPI
+ RngGetRNG (
+   IN EFI_RNG_PROTOCOL            *This,
+-  IN EFI_RNG_ALGORITHM           *RNGAlgorithm, OPTIONAL
+  IN EFI_RNG_ALGORITHM           *RNGAlgorithm  OPTIONAL,
+   IN UINTN                       RNGValueLength,
+   OUT UINT8                      *RNGValue
+   )
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
+index 2660ed5875..25cccbe92c 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
+@@ -67,7 +67,7 @@ EFI_STATUS
+ EFIAPI
+ RngGetRNG (
+   IN EFI_RNG_PROTOCOL            *This,
+-  IN EFI_RNG_ALGORITHM           *RNGAlgorithm, OPTIONAL
+  IN EFI_RNG_ALGORITHM           *RNGAlgorithm  OPTIONAL,
+   IN UINTN                       RNGValueLength,
+   OUT UINT8                      *RNGValue
+   );
+diff --git a/SecurityPkg/Tcg/TcgConfigDxe/TcgConfigImpl.c b/SecurityPkg/Tcg/TcgConfigDxe/TcgConfigImpl.c
+index 68cd62307c..09cb4b0ee9 100644
+--- a/SecurityPkg/Tcg/TcgConfigDxe/TcgConfigImpl.c
+++ b/SecurityPkg/Tcg/TcgConfigDxe/TcgConfigImpl.c
+@@ -56,7 +56,7 @@ HII_VENDOR_DEVICE_PATH          mTcgHiiVendorDevicePath = {
+ EFI_STATUS
+ GetTpmState (
+   IN  EFI_TCG_PROTOCOL          *TcgProtocol,
+-  OUT BOOLEAN                   *TpmEnable,  OPTIONAL
+  OUT BOOLEAN                   *TpmEnable   OPTIONAL,
+   OUT BOOLEAN                   *TpmActivate OPTIONAL
+   )
+ {
+-- 
+2.41.0
+
--- a/SOURCES/edk2-SecurityPkg-Change-use-of-EFI_D_-to-DEBUG_.patch
+++ b/SOURCES/edk2-SecurityPkg-Change-use-of-EFI_D_-to-DEBUG_.patch
--- a/SOURCES/edk2-SecurityPkg-DxeImageVerificationLib-Check-result-of-.patch
+++ b/SOURCES/edk2-SecurityPkg-DxeImageVerificationLib-Check-result-of-.patch
@ -0,0 +1,109 @@
+From bb0f29580825e60a5dc5c67e260dd20258eb71b0 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 29 Mar 2023 11:52:52 -0400
+Subject: [PATCH] SecurityPkg/DxeImageVerificationLib: Check result of
+ GetEfiGlobalVariable2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 22: SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable2
+RH-Bugzilla: 1861743
+RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
+RH-Commit: [1/1] 70e1ae5e2c7c148fc23160acdd360c044df5f4ff
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1861743
+Upstream: Merged
+CVE: CVE-2019-14560
+
+commit 494127613b36e870250649b02cd4ce5f1969d9bd
+Author: Gerd Hoffmann <kraxel@redhat.com>
+Date:   Fri Mar 3 18:35:53 2023 +0800
+
+    SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable2
+
+    Call gRT->GetVariable() directly to read the SecureBoot variable.  It is
+    one byte in size so we can easily place it on the stack instead of
+    having GetEfiGlobalVariable2() allocate it for us, which avoids a few
+    possible error cases.
+
+    Skip secure boot checks if (and only if):
+
+     (a) the SecureBoot variable is not present (EFI_NOT_FOUND) according to
+         the return value, or
+     (b) the SecureBoot variable was read successfully and is set to
+         SECURE_BOOT_MODE_DISABLE.
+
+    Previously the code skipped the secure boot checks on *any*
+    gRT->GetVariable() error (GetEfiGlobalVariable2 sets the variable
+    value to NULL in that case) and also on memory allocation failures.
+
+    Fixes: CVE-2019-14560
+    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+    Suggested-by: Marvin Häuser <mhaeuser@posteo.de>
+    Reviewed-by: Min Xu <min.m.xu@intel.com>
+    Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeImageVerificationLib.c                  | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+index c48861cd64..1252927664 100644
+--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+@@ -1650,7 +1650,8 @@ DxeImageVerificationHandler (
+   EFI_IMAGE_EXECUTION_ACTION           Action;
+   WIN_CERTIFICATE                      *WinCertificate;
+   UINT32                               Policy;
+-  UINT8                                *SecureBoot;
+  UINT8                                SecureBoot;
+  UINTN                                SecureBootSize;
+   PE_COFF_LOADER_IMAGE_CONTEXT         ImageContext;
+   UINT32                               NumberOfRvaAndSizes;
+   WIN_CERTIFICATE_EFI_PKCS             *PkcsCertData;
+@@ -1665,6 +1666,8 @@ DxeImageVerificationHandler (
+   RETURN_STATUS                        PeCoffStatus;
+   EFI_STATUS                           HashStatus;
+   EFI_STATUS                           DbStatus;
+  EFI_STATUS                           VarStatus;
+  UINT32                               VarAttr;
+   BOOLEAN                              IsFound;
+ 
+   SignatureList     = NULL;
+@@ -1720,22 +1723,25 @@ DxeImageVerificationHandler (
+     CpuDeadLoop ();
+   }
+ 
+-  GetEfiGlobalVariable2 (EFI_SECURE_BOOT_MODE_NAME, (VOID**)&SecureBoot, NULL);
+  SecureBootSize = sizeof (SecureBoot);
+  VarStatus      = gRT->GetVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &VarAttr, &SecureBootSize, &SecureBoot);
+   //
+   // Skip verification if SecureBoot variable doesn't exist.
+   //
+-  if (SecureBoot == NULL) {
+  if (VarStatus == EFI_NOT_FOUND) {
+     return EFI_SUCCESS;
+   }
+ 
+   //
+   // Skip verification if SecureBoot is disabled but not AuditMode
+   //
+-  if (*SecureBoot == SECURE_BOOT_MODE_DISABLE) {
+-    FreePool (SecureBoot);
+  if ((VarStatus == EFI_SUCCESS) &&
+      (VarAttr == (EFI_VARIABLE_BOOTSERVICE_ACCESS |
+                   EFI_VARIABLE_RUNTIME_ACCESS)) &&
+      (SecureBoot == SECURE_BOOT_MODE_DISABLE))
+  {
+     return EFI_SUCCESS;
+   }
+-  FreePool (SecureBoot);
+ 
+   //
+   // Read the Dos header.
+-- 
+2.39.1
+
--- a/SOURCES/edk2-SecurityPkg-DxeTpm2MeasureBootLib-SEC-PATCH-4118-2.patch
+++ b/SOURCES/edk2-SecurityPkg-DxeTpm2MeasureBootLib-SEC-PATCH-4118-2.patch
@ -0,0 +1,272 @@
+From 7b5040e857f1a16bed935f7944bda8bc6f6999ac Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 13 Feb 2024 16:30:10 -0500
+Subject: [PATCH 11/17] SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH
+ 4117/4118 symbol rename
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 44: edk2: heap buffer overflow in Tcg2MeasureGptTable()
+RH-Jira: RHEL-21154 RHEL-21156
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [11/13] 45fc2658aaa726b57219789bb1af64f5c4e2cfdc (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21156
+CVE: CVE-2022-36764
+Upstream: Merged
+
+commit 40adbb7f628dee79156c679fb0857968b61b7620
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Wed Jan 17 14:47:20 2024 -0800
+
+    SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117/4118 symbol rename
+
+    Updates the sanitation function names to be lib unique names
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+    Cc: Rahul Kumar <rahul1.kumar@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Message-Id: <7b18434c8a8b561654efd40ced3becb8b378c8f1.1705529990.git.doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeTpm2MeasureBootLib.c                   |  8 +++---
+ .../DxeTpm2MeasureBootLibSanitization.c       |  8 +++---
+ .../DxeTpm2MeasureBootLibSanitization.h       |  8 +++---
+ .../DxeTpm2MeasureBootLibSanitizationTest.c   | 26 +++++++++----------
+ 4 files changed, 25 insertions(+), 25 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+index f06926e631..8f8bef1d0b 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+@@ -197,7 +197,7 @@ Tcg2MeasureGptTable (
+                      BlockIo->Media->BlockSize,
+                      (UINT8 *)PrimaryHeader
+                      );
+-  if (EFI_ERROR (Status) || EFI_ERROR (SanitizeEfiPartitionTableHeader (PrimaryHeader, BlockIo))) {
+  if (EFI_ERROR (Status) || EFI_ERROR (Tpm2SanitizeEfiPartitionTableHeader (PrimaryHeader, BlockIo))) {
+     DEBUG ((DEBUG_ERROR, "Failed to read Partition Table Header or invalid Partition Table Header!\n"));
+     FreePool (PrimaryHeader);
+     return EFI_DEVICE_ERROR;
+@@ -206,7 +206,7 @@ Tcg2MeasureGptTable (
+   //
+   // Read the partition entry.
+   //
+-  Status = SanitizePrimaryHeaderAllocationSize (PrimaryHeader, &AllocSize);
+  Status = Tpm2SanitizePrimaryHeaderAllocationSize (PrimaryHeader, &AllocSize);
+   if (EFI_ERROR (Status)) {
+     FreePool (PrimaryHeader);
+     return EFI_BAD_BUFFER_SIZE;
+@@ -245,7 +245,7 @@ Tcg2MeasureGptTable (
+   //
+   // Prepare Data for Measurement (CcProtocol and Tcg2Protocol)
+   //
+-  Status = SanitizePrimaryHeaderGptEventSize (PrimaryHeader, NumberOfPartition, &TcgEventSize);
+  Status = Tpm2SanitizePrimaryHeaderGptEventSize (PrimaryHeader, NumberOfPartition, &TcgEventSize);
+   if (EFI_ERROR (Status)) {
+     FreePool (PrimaryHeader);
+     FreePool (EntryPtr);
+@@ -414,7 +414,7 @@ Tcg2MeasurePeImage (
+   }
+ 
+   FilePathSize = (UINT32)GetDevicePathSize (FilePath);
+-  Status       = SanitizePeImageEventSize (FilePathSize, &EventSize);
+  Status       = Tpm2SanitizePeImageEventSize (FilePathSize, &EventSize);
+   if (EFI_ERROR (Status)) {
+     return EFI_UNSUPPORTED;
+   }
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
+index 2a4d52c6d5..809a3bfd89 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
+@@ -63,7 +63,7 @@
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizeEfiPartitionTableHeader (
+Tpm2SanitizeEfiPartitionTableHeader (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN CONST EFI_BLOCK_IO_PROTOCOL       *BlockIo
+   )
+@@ -169,7 +169,7 @@ SanitizeEfiPartitionTableHeader (
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizePrimaryHeaderAllocationSize (
+Tpm2SanitizePrimaryHeaderAllocationSize (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   OUT UINT32                           *AllocationSize
+   )
+@@ -221,7 +221,7 @@ SanitizePrimaryHeaderAllocationSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePrimaryHeaderGptEventSize (
+Tpm2SanitizePrimaryHeaderGptEventSize (
+   IN  CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN  UINTN                             NumberOfPartition,
+   OUT UINT32                            *EventSize
+@@ -292,7 +292,7 @@ SanitizePrimaryHeaderGptEventSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePeImageEventSize (
+Tpm2SanitizePeImageEventSize (
+   IN  UINT32  FilePathSize,
+   OUT UINT32  *EventSize
+   )
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
+index 8f72ba4240..8526bc7537 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
+@@ -54,7 +54,7 @@
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizeEfiPartitionTableHeader (
+Tpm2SanitizeEfiPartitionTableHeader (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN CONST EFI_BLOCK_IO_PROTOCOL       *BlockIo
+   );
+@@ -78,7 +78,7 @@ SanitizeEfiPartitionTableHeader (
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizePrimaryHeaderAllocationSize (
+Tpm2SanitizePrimaryHeaderAllocationSize (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   OUT UINT32                           *AllocationSize
+   );
+@@ -107,7 +107,7 @@ SanitizePrimaryHeaderAllocationSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePrimaryHeaderGptEventSize (
+Tpm2SanitizePrimaryHeaderGptEventSize (
+   IN  CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN  UINTN                             NumberOfPartition,
+   OUT UINT32                            *EventSize
+@@ -131,7 +131,7 @@ SanitizePrimaryHeaderGptEventSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePeImageEventSize (
+Tpm2SanitizePeImageEventSize (
+   IN  UINT32  FilePathSize,
+   OUT UINT32  *EventSize
+   );
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
+index 820e99aeb9..50a68e1076 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
+@@ -84,27 +84,27 @@ TestSanitizeEfiPartitionTableHeader (
+   PrimaryHeader.Header.CRC32 = CalculateCrc32 ((UINT8 *)&PrimaryHeader, PrimaryHeader.Header.HeaderSize);
+ 
+   // Test that a normal PrimaryHeader passes validation
+-  Status = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+  Status = Tpm2SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_NOT_EFI_ERROR (Status);
+ 
+   // Test that when number of partition entries is 0, the function returns EFI_DEVICE_ERROR
+   // Should print "Invalid Partition Table Header NumberOfPartitionEntries!""
+   PrimaryHeader.NumberOfPartitionEntries = 0;
+-  Status                                 = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+  Status                                 = Tpm2SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+   PrimaryHeader.NumberOfPartitionEntries = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+ 
+   // Test that when the header size is too small, the function returns EFI_DEVICE_ERROR
+   // Should print "Invalid Partition Table Header Size!"
+   PrimaryHeader.Header.HeaderSize = 0;
+-  Status                          = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+  Status                          = Tpm2SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+   PrimaryHeader.Header.HeaderSize = sizeof (EFI_PARTITION_TABLE_HEADER);
+ 
+   // Test that when the SizeOfPartitionEntry is too small, the function returns EFI_DEVICE_ERROR
+   // should print: "SizeOfPartitionEntry shall be set to a value of 128 x 2^n where n is an integer greater than or equal to zero (e.g., 128, 256, 512, etc.)!"
+   PrimaryHeader.SizeOfPartitionEntry = 1;
+-  Status                             = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+  Status                             = Tpm2SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+@@ -137,7 +137,7 @@ TestSanitizePrimaryHeaderAllocationSize (
+   PrimaryHeader.NumberOfPartitionEntries = 5;
+   PrimaryHeader.SizeOfPartitionEntry     = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+ 
+-  Status = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+  Status = Tpm2SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_NOT_EFI_ERROR (Status);
+ 
+   // Test that the allocation size is correct compared to the existing logic
+@@ -146,19 +146,19 @@ TestSanitizePrimaryHeaderAllocationSize (
+   // Test that an overflow is detected
+   PrimaryHeader.NumberOfPartitionEntries = MAX_UINT32;
+   PrimaryHeader.SizeOfPartitionEntry     = 5;
+-  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+  Status                                 = Tpm2SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   // Test the inverse
+   PrimaryHeader.NumberOfPartitionEntries = 5;
+   PrimaryHeader.SizeOfPartitionEntry     = MAX_UINT32;
+-  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+  Status                                 = Tpm2SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   // Test the worst case scenario
+   PrimaryHeader.NumberOfPartitionEntries = MAX_UINT32;
+   PrimaryHeader.SizeOfPartitionEntry     = MAX_UINT32;
+-  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+  Status                                 = Tpm2SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+@@ -196,7 +196,7 @@ TestSanitizePrimaryHeaderGptEventSize (
+   NumberOfPartition = 13;
+ 
+   // that the primary event size is correct
+-  Status = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+  Status = Tpm2SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+   UT_ASSERT_NOT_EFI_ERROR (Status);
+ 
+   // Calculate the existing logic event size
+@@ -207,12 +207,12 @@ TestSanitizePrimaryHeaderGptEventSize (
+   UT_ASSERT_EQUAL (EventSize, ExistingLogicEventSize);
+ 
+   // Tests that the primary event size may not overflow
+-  Status = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, MAX_UINT32, &EventSize);
+  Status = Tpm2SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, MAX_UINT32, &EventSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   // Test that the size of partition entries may not overflow
+   PrimaryHeader.SizeOfPartitionEntry = MAX_UINT32;
+-  Status                             = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+  Status                             = Tpm2SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+@@ -245,7 +245,7 @@ TestSanitizePeImageEventSize (
+   FilePathSize = 255;
+ 
+   // Test that a normal PE image passes validation
+-  Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
+  Status = Tpm2SanitizePeImageEventSize (FilePathSize, &EventSize);
+   UT_ASSERT_EQUAL (Status, EFI_SUCCESS);
+ 
+   // Test that the event size is correct compared to the existing logic
+@@ -258,7 +258,7 @@ TestSanitizePeImageEventSize (
+   }
+ 
+   // Test that the event size may not overflow
+-  Status = SanitizePeImageEventSize (MAX_UINT32, &EventSize);
+  Status = Tpm2SanitizePeImageEventSize (MAX_UINT32, &EventSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+-- 
+2.41.0
+
--- a/SOURCES/edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch
+++ b/SOURCES/edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch
--- a/SOURCES/edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-418.patch
+++ b/SOURCES/edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-418.patch
@ -0,0 +1,286 @@
+From 7c3fefb0c857acb9e7e14b150c4c3131e78fbb63 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 7 Feb 2024 15:43:10 -0500
+Subject: [PATCH 09/17] SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118
+ - CVE 2022-36764
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 44: edk2: heap buffer overflow in Tcg2MeasureGptTable()
+RH-Jira: RHEL-21154 RHEL-21156
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [9/13] c7890fc5c5d7fef2fc1daa931ea2d48f3a76b9e3 (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21156
+CVE: CVE-2022-36764
+Upstream: Merged
+
+commit c7b27944218130cca3bbb20314ba5b88b5de4aa4
+Author: Douglas Flick [MSFT] <doug.edk2@gmail.com>
+Date:   Fri Jan 12 02:16:04 2024 +0800
+
+    SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764
+
+    This commit contains the patch files and tests for DxeTpm2MeasureBootLib
+    CVE 2022-36764.
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeTpm2MeasureBootLib.c                   | 15 +++--
+ .../DxeTpm2MeasureBootLibSanitization.c       | 46 +++++++++++++-
+ .../DxeTpm2MeasureBootLibSanitization.h       | 28 ++++++++-
+ .../DxeTpm2MeasureBootLibSanitizationTest.c   | 60 ++++++++++++++++---
+ 4 files changed, 133 insertions(+), 16 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+index 476c8d543f..f06926e631 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+@@ -372,7 +372,6 @@ Exit:
+   @retval EFI_OUT_OF_RESOURCES   No enough resource to measure image.
+   @retval EFI_UNSUPPORTED        ImageType is unsupported or PE image is mal-format.
+   @retval other error value
+-
+ **/
+ EFI_STATUS
+ EFIAPI
+@@ -399,6 +398,7 @@ Tcg2MeasurePeImage (
+   Status    = EFI_UNSUPPORTED;
+   ImageLoad = NULL;
+   EventPtr  = NULL;
+  Tcg2Event = NULL;
+ 
+   Tcg2Protocol = MeasureBootProtocols->Tcg2Protocol;
+   CcProtocol   = MeasureBootProtocols->CcProtocol;
+@@ -413,19 +413,24 @@ Tcg2MeasurePeImage (
+     return EFI_UNSUPPORTED;
+   }
+ 
+-  FilePathSize  = (UINT32) GetDevicePathSize (FilePath);
+  FilePathSize = (UINT32)GetDevicePathSize (FilePath);
+  Status       = SanitizePeImageEventSize (FilePathSize, &EventSize);
+  if (EFI_ERROR (Status)) {
+    return EFI_UNSUPPORTED;
+  }
+ 
+   //
+   // Determine destination PCR by BootPolicy
+   //
+-  EventSize = sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
+-  EventPtr  = AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event));
+  // from a malicious GPT disk partition
+  EventPtr = AllocateZeroPool (EventSize);
+   if (EventPtr == NULL) {
+     return EFI_OUT_OF_RESOURCES;
+   }
+ 
+   Tcg2Event                       = (EFI_TCG2_EVENT *)EventPtr;
+-  Tcg2Event->Header.HeaderSize    = sizeof(EFI_TCG2_EVENT_HEADER);
+  Tcg2Event->Size                 = EventSize;
+  Tcg2Event->Header.HeaderSize    = sizeof (EFI_TCG2_EVENT_HEADER);
+   Tcg2Event->Header.HeaderVersion = EFI_TCG2_EVENT_HEADER_VERSION;
+   ImageLoad           = (EFI_IMAGE_LOAD_EVENT *) Tcg2Event->Event;
+ 
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
+index e2309655d3..2a4d52c6d5 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
+@@ -151,7 +151,7 @@ SanitizeEfiPartitionTableHeader (
+ }
+ 
+ /**
+-  This function will validate that the allocation size from the primary header is sane
+ This function will validate that the allocation size from the primary header is sane
+   It will check the following:
+     - AllocationSize does not overflow
+ 
+@@ -273,3 +273,47 @@ SanitizePrimaryHeaderGptEventSize (
+ 
+   return EFI_SUCCESS;
+ }
+
+/**
+  This function will validate that the PeImage Event Size from the loaded image is sane
+  It will check the following:
+    - EventSize does not overflow
+
+  @param[in] FilePathSize - Size of the file path.
+  @param[out] EventSize - Pointer to the event size.
+
+  @retval EFI_SUCCESS
+    The event size is valid.
+
+  @retval EFI_OUT_OF_RESOURCES
+    Overflow would have occurred.
+
+  @retval EFI_INVALID_PARAMETER
+    One of the passed parameters was invalid.
+**/
+EFI_STATUS
+SanitizePeImageEventSize (
+  IN  UINT32  FilePathSize,
+  OUT UINT32  *EventSize
+  )
+{
+  EFI_STATUS  Status;
+
+  // Replacing logic:
+  // sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
+  Status = SafeUint32Add (OFFSET_OF (EFI_IMAGE_LOAD_EVENT, DevicePath), FilePathSize, EventSize);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "EventSize would overflow!\n"));
+    return EFI_BAD_BUFFER_SIZE;
+  }
+
+  // Replacing logic:
+  // EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event)
+  Status = SafeUint32Add (*EventSize, OFFSET_OF (EFI_TCG2_EVENT, Event), EventSize);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "EventSize would overflow!\n"));
+    return EFI_BAD_BUFFER_SIZE;
+  }
+
+  return EFI_SUCCESS;
+}
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
+index 048b738987..8f72ba4240 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
+@@ -9,6 +9,9 @@
+   Tcg2MeasureGptTable() function will receive untrusted GPT partition table, and parse
+   partition data carefully.
+ 
+  Tcg2MeasurePeImage() function will accept untrusted PE/COFF image and validate its
+  data structure within this image buffer before use.
+
+   Copyright (c) Microsoft Corporation.<BR>
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+@@ -110,4 +113,27 @@ SanitizePrimaryHeaderGptEventSize (
+   OUT UINT32                            *EventSize
+   );
+ 
+-#endif // DXE_TPM2_MEASURE_BOOT_LIB_SANITATION_
+/**
+  This function will validate that the PeImage Event Size from the loaded image is sane
+  It will check the following:
+    - EventSize does not overflow
+
+  @param[in] FilePathSize - Size of the file path.
+  @param[out] EventSize - Pointer to the event size.
+
+  @retval EFI_SUCCESS
+    The event size is valid.
+
+  @retval EFI_OUT_OF_RESOURCES
+    Overflow would have occurred.
+
+  @retval EFI_INVALID_PARAMETER
+    One of the passed parameters was invalid.
+**/
+EFI_STATUS
+SanitizePeImageEventSize (
+  IN  UINT32  FilePathSize,
+  OUT UINT32  *EventSize
+  );
+
+#endif // DXE_TPM2_MEASURE_BOOT_LIB_VALIDATION_
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
+index 3eb9763e3c..820e99aeb9 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
+@@ -72,10 +72,10 @@ TestSanitizeEfiPartitionTableHeader (
+   PrimaryHeader.Header.Revision          = DEFAULT_PRIMARY_TABLE_HEADER_REVISION;
+   PrimaryHeader.Header.HeaderSize        = sizeof (EFI_PARTITION_TABLE_HEADER);
+   PrimaryHeader.MyLBA                    = 1;
+-  PrimaryHeader.AlternateLBA             = 2;
+-  PrimaryHeader.FirstUsableLBA           = 3;
+-  PrimaryHeader.LastUsableLBA            = 4;
+-  PrimaryHeader.PartitionEntryLBA        = 5;
+  PrimaryHeader.PartitionEntryLBA        = 2;
+  PrimaryHeader.AlternateLBA             = 3;
+  PrimaryHeader.FirstUsableLBA           = 4;
+  PrimaryHeader.LastUsableLBA            = 5;
+   PrimaryHeader.NumberOfPartitionEntries = DEFAULT_PRIMARY_TABLE_HEADER_NUMBER_OF_PARTITION_ENTRIES;
+   PrimaryHeader.SizeOfPartitionEntry     = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+   PrimaryHeader.PartitionEntryArrayCRC32 = 0; // Purposely invalid
+@@ -187,11 +187,6 @@ TestSanitizePrimaryHeaderGptEventSize (
+   EFI_STATUS                  Status;
+   EFI_PARTITION_TABLE_HEADER  PrimaryHeader;
+   UINTN                       NumberOfPartition;
+-  EFI_GPT_DATA                *GptData;
+-  EFI_TCG2_EVENT              *Tcg2Event;
+-
+-  Tcg2Event = NULL;
+-  GptData   = NULL;
+ 
+   // Test that a normal PrimaryHeader passes validation
+   PrimaryHeader.NumberOfPartitionEntries = 5;
+@@ -225,6 +220,52 @@ TestSanitizePrimaryHeaderGptEventSize (
+   return UNIT_TEST_PASSED;
+ }
+ 
+/**
+  This function tests the SanitizePeImageEventSize function.
+  It's intent is to test that the untrusted input from a file path when generating a
+  EFI_IMAGE_LOAD_EVENT structure will not cause an overflow when calculating
+  the event size when allocating space
+
+  @param[in] Context  The unit test context.
+
+  @retval UNIT_TEST_PASSED  The test passed.
+  @retval UNIT_TEST_ERROR_TEST_FAILED  The test failed.
+**/
+UNIT_TEST_STATUS
+EFIAPI
+TestSanitizePeImageEventSize (
+  IN UNIT_TEST_CONTEXT  Context
+  )
+{
+  UINT32      EventSize;
+  UINTN       ExistingLogicEventSize;
+  UINT32      FilePathSize;
+  EFI_STATUS  Status;
+
+  FilePathSize = 255;
+
+  // Test that a normal PE image passes validation
+  Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
+  UT_ASSERT_EQUAL (Status, EFI_SUCCESS);
+
+  // Test that the event size is correct compared to the existing logic
+  ExistingLogicEventSize  = OFFSET_OF (EFI_IMAGE_LOAD_EVENT, DevicePath) + FilePathSize;
+  ExistingLogicEventSize += OFFSET_OF (EFI_TCG2_EVENT, Event);
+
+  if (EventSize != ExistingLogicEventSize) {
+    UT_LOG_ERROR ("SanitizePeImageEventSize returned an incorrect event size. Expected %u, got %u\n", ExistingLogicEventSize, EventSize);
+    return UNIT_TEST_ERROR_TEST_FAILED;
+  }
+
+  // Test that the event size may not overflow
+  Status = SanitizePeImageEventSize (MAX_UINT32, &EventSize);
+  UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+
+  DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+
+  return UNIT_TEST_PASSED;
+}
+
+ // *--------------------------------------------------------------------*
+ // *  Unit Test Code Main Function
+ // *--------------------------------------------------------------------*
+@@ -267,6 +308,7 @@ UefiTestMain (
+   AddTestCase (Tcg2MeasureBootLibValidationTestSuite, "Tests Validating EFI Partition Table", "Common.Tcg2MeasureBootLibValidation", TestSanitizeEfiPartitionTableHeader, NULL, NULL, NULL);
+   AddTestCase (Tcg2MeasureBootLibValidationTestSuite, "Tests Primary header gpt event checks for overflow", "Common.Tcg2MeasureBootLibValidation", TestSanitizePrimaryHeaderAllocationSize, NULL, NULL, NULL);
+   AddTestCase (Tcg2MeasureBootLibValidationTestSuite, "Tests Primary header allocation size checks for overflow", "Common.Tcg2MeasureBootLibValidation", TestSanitizePrimaryHeaderGptEventSize, NULL, NULL, NULL);
+  AddTestCase (Tcg2MeasureBootLibValidationTestSuite, "Tests PE Image and FileSize checks for overflow", "Common.Tcg2MeasureBootLibValidation", TestSanitizePeImageEventSize, NULL, NULL, NULL);
+ 
+   Status = RunAllTestSuites (Framework);
+ 
+-- 
+2.41.0
+
--- a/SOURCES/edk2-SecurityPkg-DxeTpmMeasureBootLib-SEC-PATCH-4117-2.patch
+++ b/SOURCES/edk2-SecurityPkg-DxeTpmMeasureBootLib-SEC-PATCH-4117-2.patch
@ -0,0 +1,279 @@
+From ac25c501c8d97c7520a7c75ae708fb4c43bae035 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 13 Feb 2024 16:30:10 -0500
+Subject: [PATCH 12/17] SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH
+ 4117/4118 symbol rename
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 44: edk2: heap buffer overflow in Tcg2MeasureGptTable()
+RH-Jira: RHEL-21154 RHEL-21156
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [12/13] 6ef41050fb68f984a5ae6104ccc102afb5290f9f (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21156
+CVE: CVE-2022-36764
+Upstream: Merged
+
+commit 326db0c9072004dea89427ea3a44393a84966f2b
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Wed Jan 17 14:47:21 2024 -0800
+
+    SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117/4118 symbol rename
+
+    Updates the sanitation function names to be lib unique names
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+    Cc: Rahul Kumar <rahul1.kumar@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Message-Id: <355aa846a99ca6ac0f7574cf5982661da0d9fea6.1705529990.git.doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeTpmMeasureBootLib.c                    |  8 +++---
+ .../DxeTpmMeasureBootLibSanitization.c        | 10 +++----
+ .../DxeTpmMeasureBootLibSanitization.h        |  8 +++---
+ .../DxeTpmMeasureBootLibSanitizationTest.c    | 26 +++++++++----------
+ 4 files changed, 26 insertions(+), 26 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+index 1598015176..c39018d7e4 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+@@ -171,7 +171,7 @@ TcgMeasureGptTable (
+                      BlockIo->Media->BlockSize,
+                      (UINT8 *)PrimaryHeader
+                      );
+-  if (EFI_ERROR (Status) || EFI_ERROR (SanitizeEfiPartitionTableHeader (PrimaryHeader, BlockIo))) {
+  if (EFI_ERROR (Status) || EFI_ERROR (TpmSanitizeEfiPartitionTableHeader (PrimaryHeader, BlockIo))) {
+     DEBUG ((DEBUG_ERROR, "Failed to read Partition Table Header or invalid Partition Table Header!\n"));
+     FreePool (PrimaryHeader);
+     return EFI_DEVICE_ERROR;
+@@ -179,7 +179,7 @@ TcgMeasureGptTable (
+   //
+   // Read the partition entry.
+   //
+-  Status = SanitizePrimaryHeaderAllocationSize (PrimaryHeader, &AllocSize);
+  Status = TpmSanitizePrimaryHeaderAllocationSize (PrimaryHeader, &AllocSize);
+   if (EFI_ERROR (Status)) {
+     FreePool (PrimaryHeader);
+     return EFI_DEVICE_ERROR;
+@@ -218,7 +218,7 @@ TcgMeasureGptTable (
+   //
+   // Prepare Data for Measurement
+   //
+-  Status   = SanitizePrimaryHeaderGptEventSize (PrimaryHeader, NumberOfPartition, &EventSize);
+  Status   = TpmSanitizePrimaryHeaderGptEventSize (PrimaryHeader, NumberOfPartition, &EventSize);
+   TcgEvent = (TCG_PCR_EVENT *)AllocateZeroPool (EventSize);
+   if (TcgEvent == NULL) {
+     FreePool (PrimaryHeader);
+@@ -344,7 +344,7 @@ TcgMeasurePeImage (
+ 
+   // Determine destination PCR by BootPolicy
+   //
+-  Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
+  Status = TpmSanitizePeImageEventSize (FilePathSize, &EventSize);
+   if (EFI_ERROR (Status)) {
+     return EFI_UNSUPPORTED;
+   }
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+index bcf8c6de6f..7f17af56cd 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+@@ -1,5 +1,5 @@
+ /** @file
+-  The library instance provides security service of TPM2 measure boot and
+  The library instance provides security service of TPM measure boot and
+   Confidential Computing (CC) measure boot.
+ 
+   Caution: This file requires additional review when modified.
+@@ -63,7 +63,7 @@
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizeEfiPartitionTableHeader (
+TpmSanitizeEfiPartitionTableHeader (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN CONST EFI_BLOCK_IO_PROTOCOL       *BlockIo
+   )
+@@ -145,7 +145,7 @@ SanitizeEfiPartitionTableHeader (
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizePrimaryHeaderAllocationSize (
+TpmSanitizePrimaryHeaderAllocationSize (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   OUT UINT32                           *AllocationSize
+   )
+@@ -194,7 +194,7 @@ SanitizePrimaryHeaderAllocationSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePrimaryHeaderGptEventSize (
+TpmSanitizePrimaryHeaderGptEventSize (
+   IN  CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN  UINTN                             NumberOfPartition,
+   OUT UINT32                            *EventSize
+@@ -258,7 +258,7 @@ SanitizePrimaryHeaderGptEventSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePeImageEventSize (
+TpmSanitizePeImageEventSize (
+   IN  UINT32  FilePathSize,
+   OUT UINT32  *EventSize
+   )
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+index 2248495813..db6e9c3752 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+@@ -53,7 +53,7 @@
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizeEfiPartitionTableHeader (
+TpmSanitizeEfiPartitionTableHeader (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN CONST EFI_BLOCK_IO_PROTOCOL       *BlockIo
+   );
+@@ -77,7 +77,7 @@ SanitizeEfiPartitionTableHeader (
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizePrimaryHeaderAllocationSize (
+TpmSanitizePrimaryHeaderAllocationSize (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   OUT UINT32                           *AllocationSize
+   );
+@@ -105,7 +105,7 @@ SanitizePrimaryHeaderAllocationSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePrimaryHeaderGptEventSize (
+TpmSanitizePrimaryHeaderGptEventSize (
+   IN  CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN  UINTN                             NumberOfPartition,
+   OUT UINT32                            *EventSize
+@@ -129,7 +129,7 @@ SanitizePrimaryHeaderGptEventSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePeImageEventSize (
+TpmSanitizePeImageEventSize (
+   IN  UINT32  FilePathSize,
+   OUT UINT32  *EventSize
+   );
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+index c41498be45..de1740af41 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+@@ -83,27 +83,27 @@ TestSanitizeEfiPartitionTableHeader (
+   PrimaryHeader.Header.CRC32 = CalculateCrc32 ((UINT8 *)&PrimaryHeader, PrimaryHeader.Header.HeaderSize);
+ 
+   // Test that a normal PrimaryHeader passes validation
+-  Status = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+  Status = TpmSanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_NOT_EFI_ERROR (Status);
+ 
+   // Test that when number of partition entries is 0, the function returns EFI_DEVICE_ERROR
+   // Should print "Invalid Partition Table Header NumberOfPartitionEntries!""
+   PrimaryHeader.NumberOfPartitionEntries = 0;
+-  Status                                 = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+  Status                                 = TpmSanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+   PrimaryHeader.NumberOfPartitionEntries = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+ 
+   // Test that when the header size is too small, the function returns EFI_DEVICE_ERROR
+   // Should print "Invalid Partition Table Header Size!"
+   PrimaryHeader.Header.HeaderSize = 0;
+-  Status                          = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+  Status                          = TpmSanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+   PrimaryHeader.Header.HeaderSize = sizeof (EFI_PARTITION_TABLE_HEADER);
+ 
+   // Test that when the SizeOfPartitionEntry is too small, the function returns EFI_DEVICE_ERROR
+   // should print: "SizeOfPartitionEntry shall be set to a value of 128 x 2^n where n is an integer greater than or equal to zero (e.g., 128, 256, 512, etc.)!"
+   PrimaryHeader.SizeOfPartitionEntry = 1;
+-  Status                             = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+  Status                             = TpmSanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+@@ -136,7 +136,7 @@ TestSanitizePrimaryHeaderAllocationSize (
+   PrimaryHeader.NumberOfPartitionEntries = 5;
+   PrimaryHeader.SizeOfPartitionEntry     = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+ 
+-  Status = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+  Status = TpmSanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_NOT_EFI_ERROR (Status);
+ 
+   // Test that the allocation size is correct compared to the existing logic
+@@ -145,19 +145,19 @@ TestSanitizePrimaryHeaderAllocationSize (
+   // Test that an overflow is detected
+   PrimaryHeader.NumberOfPartitionEntries = MAX_UINT32;
+   PrimaryHeader.SizeOfPartitionEntry     = 5;
+-  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+  Status                                 = TpmSanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   // Test the inverse
+   PrimaryHeader.NumberOfPartitionEntries = 5;
+   PrimaryHeader.SizeOfPartitionEntry     = MAX_UINT32;
+-  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+  Status                                 = TpmSanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   // Test the worst case scenario
+   PrimaryHeader.NumberOfPartitionEntries = MAX_UINT32;
+   PrimaryHeader.SizeOfPartitionEntry     = MAX_UINT32;
+-  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+  Status                                 = TpmSanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+@@ -195,7 +195,7 @@ TestSanitizePrimaryHeaderGptEventSize (
+   NumberOfPartition = 13;
+ 
+   // that the primary event size is correct
+-  Status = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+  Status = TpmSanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+   UT_ASSERT_NOT_EFI_ERROR (Status);
+ 
+   // Calculate the existing logic event size
+@@ -206,12 +206,12 @@ TestSanitizePrimaryHeaderGptEventSize (
+   UT_ASSERT_EQUAL (EventSize, ExistingLogicEventSize);
+ 
+   // Tests that the primary event size may not overflow
+-  Status = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, MAX_UINT32, &EventSize);
+  Status = TpmSanitizePrimaryHeaderGptEventSize (&PrimaryHeader, MAX_UINT32, &EventSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   // Test that the size of partition entries may not overflow
+   PrimaryHeader.SizeOfPartitionEntry = MAX_UINT32;
+-  Status                             = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+  Status                             = TpmSanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+@@ -269,7 +269,7 @@ TestSanitizePeImageEventSize (
+   FilePathSize = 255;
+ 
+   // Test that a normal PE image passes validation
+-  Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
+  Status = TpmSanitizePeImageEventSize (FilePathSize, &EventSize);
+   if (EFI_ERROR (Status)) {
+     UT_LOG_ERROR ("SanitizePeImageEventSize failed with %r\n", Status);
+     goto Exit;
+@@ -285,7 +285,7 @@ TestSanitizePeImageEventSize (
+   }
+ 
+   // Test that the event size may not overflow
+-  Status = SanitizePeImageEventSize (MAX_UINT32, &EventSize);
+  Status = TpmSanitizePeImageEventSize (MAX_UINT32, &EventSize);
+   if (Status != EFI_BAD_BUFFER_SIZE) {
+     UT_LOG_ERROR ("SanitizePeImageEventSize succeded when it was supposed to fail with %r\n", Status);
+     goto Exit;
+-- 
+2.41.0
+
--- a/SOURCES/edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch
+++ b/SOURCES/edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch
@ -0,0 +1,960 @@
+From cb36d95002013ae8d4e5120383cd756a2a6c4124 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 17 Jan 2024 12:20:52 -0500
+Subject: [PATCH 07/17] SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117
+ - CVE 2022-36763
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 44: edk2: heap buffer overflow in Tcg2MeasureGptTable()
+RH-Jira: RHEL-21154 RHEL-21156
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [7/13] f5a5d2b0a33dc1efdb83e501eda2716df0e904a0 (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21154
+CVE: CVE-2022-36763
+Upstream: Merged
+Conflicts: We get function definiton clash for the following three functions:
+           - SanitizeEfiPartitionTableHeader()
+           - SanitizePrimaryHeaderAllocationSize()
+           - SanitizePrimaryHeaderGptEventSize()
+           Those are are defined both in
+           - SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitazion.c
+           and
+           - SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitazion.c
+           Closer investigation reveals that they are identical in functionality (although
+           not in comment style).
+           I chose to leave them as is now, meaning that this package will be
+           unbuildable until I add a commit renaming these symbols later in
+           this series.
+
+commit 4776a1b39ee08fc45c70c1eab5a0195f325000d3
+Author: Douglas Flick [MSFT] <doug.edk2@gmail.com>
+Date:   Fri Jan 12 02:16:02 2024 +0800
+
+    SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117 - CVE 2022-36763
+
+    This commit contains the patch files and tests for DxeTpmMeasureBootLib
+    CVE 2022-36763.
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeTpmMeasureBootLib.c                    |  74 +++--
+ .../DxeTpmMeasureBootLib.inf                  |   4 +-
+ .../DxeTpmMeasureBootLibSanitization.c        | 242 ++++++++++++++
+ .../DxeTpmMeasureBootLibSanitization.h        | 114 +++++++
+ .../DxeTpmMeasureBootLibSanitizationTest.c    | 301 ++++++++++++++++++
+ ...eTpmMeasureBootLibSanitizationTestHost.inf |  28 ++
+ SecurityPkg/SecurityPkg.ci.yaml               |   1 +
+ SecurityPkg/Test/SecurityPkgHostTest.dsc      |   1 +
+ 8 files changed, 734 insertions(+), 31 deletions(-)
+ create mode 100644 SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+ create mode 100644 SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+ create mode 100644 SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+ create mode 100644 SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTestHost.inf
+
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+index 27c0ea48ca..d44422dee8 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+@@ -18,6 +18,8 @@
+ Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+Copyright (c) Microsoft Corporation.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+ **/
+ 
+ #include <PiDxe.h>
+@@ -40,6 +42,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ #include <Library/SecurityManagementLib.h>
+ #include <Library/HobLib.h>
+ 
+#include "DxeTpmMeasureBootLibSanitization.h"
+
+ //
+ // Flag to check GPT partition. It only need be measured once.
+ //
+@@ -123,19 +127,22 @@ TcgMeasureGptTable (
+   IN  EFI_HANDLE         GptHandle
+   )
+ {
+-  EFI_STATUS                        Status;
+-  EFI_BLOCK_IO_PROTOCOL             *BlockIo;
+-  EFI_DISK_IO_PROTOCOL              *DiskIo;
+-  EFI_PARTITION_TABLE_HEADER        *PrimaryHeader;
+-  EFI_PARTITION_ENTRY               *PartitionEntry;
+-  UINT8                             *EntryPtr;
+-  UINTN                             NumberOfPartition;
+-  UINT32                            Index;
+-  TCG_PCR_EVENT                     *TcgEvent;
+-  EFI_GPT_DATA                      *GptData;
+-  UINT32                            EventSize;
+-  UINT32                            EventNumber;
+-  EFI_PHYSICAL_ADDRESS              EventLogLastEntry;
+  EFI_STATUS                  Status;
+  EFI_BLOCK_IO_PROTOCOL       *BlockIo;
+  EFI_DISK_IO_PROTOCOL        *DiskIo;
+  EFI_PARTITION_TABLE_HEADER  *PrimaryHeader;
+  EFI_PARTITION_ENTRY         *PartitionEntry;
+  UINT8                       *EntryPtr;
+  UINTN                       NumberOfPartition;
+  UINT32                      Index;
+  TCG_PCR_EVENT               *TcgEvent;
+  EFI_GPT_DATA                *GptData;
+  UINT32                      EventSize;
+  UINT32                      EventNumber;
+  EFI_PHYSICAL_ADDRESS        EventLogLastEntry;
+  UINT32                      AllocSize;
+
+  GptData = NULL;
+ 
+   if (mMeasureGptCount > 0) {
+     return EFI_SUCCESS;
+@@ -163,15 +170,21 @@ TcgMeasureGptTable (
+                      BlockIo->Media->BlockSize,
+                      (UINT8 *)PrimaryHeader
+                      );
+-  if (EFI_ERROR (Status)) {
+-    DEBUG ((DEBUG_ERROR, "Failed to Read Partition Table Header!\n"));
+  if (EFI_ERROR (Status) || EFI_ERROR (SanitizeEfiPartitionTableHeader (PrimaryHeader, BlockIo))) {
+    DEBUG ((DEBUG_ERROR, "Failed to read Partition Table Header or invalid Partition Table Header!\n"));
+     FreePool (PrimaryHeader);
+     return EFI_DEVICE_ERROR;
+   }
+   //
+   // Read the partition entry.
+   //
+-  EntryPtr = (UINT8 *)AllocatePool (PrimaryHeader->NumberOfPartitionEntries * PrimaryHeader->SizeOfPartitionEntry);
+  Status = SanitizePrimaryHeaderAllocationSize (PrimaryHeader, &AllocSize);
+  if (EFI_ERROR (Status)) {
+    FreePool (PrimaryHeader);
+    return EFI_DEVICE_ERROR;
+  }
+
+  EntryPtr = (UINT8 *)AllocatePool (AllocSize);
+   if (EntryPtr == NULL) {
+     FreePool (PrimaryHeader);
+     return EFI_OUT_OF_RESOURCES;
+@@ -179,8 +192,8 @@ TcgMeasureGptTable (
+   Status = DiskIo->ReadDisk (
+                      DiskIo,
+                      BlockIo->Media->MediaId,
+-                     MultU64x32(PrimaryHeader->PartitionEntryLBA, BlockIo->Media->BlockSize),
+-                     PrimaryHeader->NumberOfPartitionEntries * PrimaryHeader->SizeOfPartitionEntry,
+                     MultU64x32 (PrimaryHeader->PartitionEntryLBA, BlockIo->Media->BlockSize),
+                     AllocSize,
+                      EntryPtr
+                      );
+   if (EFI_ERROR (Status)) {
+@@ -204,19 +217,18 @@ TcgMeasureGptTable (
+   //
+   // Prepare Data for Measurement
+   //
+-  EventSize = (UINT32)(sizeof (EFI_GPT_DATA) - sizeof (GptData->Partitions)
+-                        + NumberOfPartition * PrimaryHeader->SizeOfPartitionEntry);
+-  TcgEvent = (TCG_PCR_EVENT *) AllocateZeroPool (EventSize + sizeof (TCG_PCR_EVENT_HDR));
+  Status   = SanitizePrimaryHeaderGptEventSize (PrimaryHeader, NumberOfPartition, &EventSize);
+  TcgEvent = (TCG_PCR_EVENT *)AllocateZeroPool (EventSize);
+   if (TcgEvent == NULL) {
+     FreePool (PrimaryHeader);
+     FreePool (EntryPtr);
+     return EFI_OUT_OF_RESOURCES;
+   }
+ 
+-  TcgEvent->PCRIndex   = 5;
+-  TcgEvent->EventType  = EV_EFI_GPT_EVENT;
+-  TcgEvent->EventSize  = EventSize;
+-  GptData = (EFI_GPT_DATA *) TcgEvent->Event;
+  TcgEvent->PCRIndex  = 5;
+  TcgEvent->EventType = EV_EFI_GPT_EVENT;
+  TcgEvent->EventSize = EventSize - sizeof (TCG_PCR_EVENT_HDR);
+  GptData             = (EFI_GPT_DATA *)TcgEvent->Event;
+ 
+   //
+   // Copy the EFI_PARTITION_TABLE_HEADER and NumberOfPartition
+@@ -354,11 +366,13 @@ TcgMeasurePeImage (
+       TcgEvent->PCRIndex  = 2;
+       break;
+     default:
+-      DEBUG ((
+-        DEBUG_ERROR,
+-        "TcgMeasurePeImage: Unknown subsystem type %d",
+-        ImageType
+-        ));
+      DEBUG (
+        (
+         DEBUG_ERROR,
+         "TcgMeasurePeImage: Unknown subsystem type %d",
+         ImageType
+        )
+        );
+       goto Finish;
+   }
+ 
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf
+index ebab6f7c1e..414c654d15 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf
+@@ -32,6 +32,8 @@
+ 
+ [Sources]
+   DxeTpmMeasureBootLib.c
+  DxeTpmMeasureBootLibSanitization.c
+  DxeTpmMeasureBootLibSanitization.h
+ 
+ [Packages]
+   MdePkg/MdePkg.dec
+@@ -41,6 +43,7 @@
+ 
+ [LibraryClasses]
+   BaseMemoryLib
+  SafeIntLib
+   DebugLib
+   MemoryAllocationLib
+   DevicePathLib
+@@ -59,4 +62,3 @@
+   gEfiFirmwareVolumeBlockProtocolGuid   ## SOMETIMES_CONSUMES
+   gEfiBlockIoProtocolGuid               ## SOMETIMES_CONSUMES
+   gEfiDiskIoProtocolGuid                ## SOMETIMES_CONSUMES
+-
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+new file mode 100644
+index 0000000000..37cd3ed0ea
+--- /dev/null
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+@@ -0,0 +1,242 @@
+/** @file
+  The library instance provides security service of TPM2 measure boot and
+  Confidential Computing (CC) measure boot.
+
+  Caution: This file requires additional review when modified.
+  This library will have external input - PE/COFF image and GPT partition.
+  This external input must be validated carefully to avoid security issue like
+  buffer overflow, integer overflow.
+
+  This file will pull out the validation logic from the following functions, in an
+  attempt to validate the untrusted input in the form of unit tests
+
+  These are those functions:
+
+  DxeTpmMeasureBootLibImageRead() function will make sure the PE/COFF image content
+  read is within the image buffer.
+
+  Tcg2MeasureGptTable() function will receive untrusted GPT partition table, and parse
+  partition data carefully.
+
+  Copyright (c) Microsoft Corporation.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+#include <Uefi.h>
+#include <Uefi/UefiSpec.h>
+#include <Library/SafeIntLib.h>
+#include <Library/UefiLib.h>
+#include <Library/DebugLib.h>
+#include <Library/BaseLib.h>
+#include <IndustryStandard/UefiTcgPlatform.h>
+#include <Protocol/BlockIo.h>
+#include <Library/MemoryAllocationLib.h>
+
+#include "DxeTpmMeasureBootLibSanitization.h"
+
+#define GPT_HEADER_REVISION_V1  0x00010000
+
+/**
+  This function will validate the EFI_PARTITION_TABLE_HEADER structure is safe to parse
+  However this function will not attempt to verify the validity of the GPT partition
+  It will check the following:
+    - Signature
+    - Revision
+    - AlternateLBA
+    - FirstUsableLBA
+    - LastUsableLBA
+    - PartitionEntryLBA
+    - NumberOfPartitionEntries
+    - SizeOfPartitionEntry
+    - BlockIo
+
+  @param[in] PrimaryHeader
+    Pointer to the EFI_PARTITION_TABLE_HEADER structure.
+
+  @param[in] BlockIo
+    Pointer to the EFI_BLOCK_IO_PROTOCOL structure.
+
+  @retval EFI_SUCCESS
+    The EFI_PARTITION_TABLE_HEADER structure is valid.
+
+  @retval EFI_INVALID_PARAMETER
+    The EFI_PARTITION_TABLE_HEADER structure is invalid.
+**/
+EFI_STATUS
+EFIAPI
+SanitizeEfiPartitionTableHeader (
+  IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+  IN CONST EFI_BLOCK_IO_PROTOCOL       *BlockIo
+  )
+{
+  // Verify that the input parameters are safe to use
+  if (PrimaryHeader == NULL) {
+    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header!\n"));
+    return EFI_INVALID_PARAMETER;
+  }
+
+  if ((BlockIo == NULL) || (BlockIo->Media == NULL)) {
+    DEBUG ((DEBUG_ERROR, "Invalid BlockIo!\n"));
+    return EFI_INVALID_PARAMETER;
+  }
+
+  // The signature must be EFI_PTAB_HEADER_ID ("EFI PART" in ASCII)
+  if (PrimaryHeader->Header.Signature != EFI_PTAB_HEADER_ID) {
+    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header!\n"));
+    return EFI_DEVICE_ERROR;
+  }
+
+  // The version must be GPT_HEADER_REVISION_V1 (0x00010000)
+  if (PrimaryHeader->Header.Revision != GPT_HEADER_REVISION_V1) {
+    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header Revision!\n"));
+    return EFI_DEVICE_ERROR;
+  }
+
+  // The HeaderSize must be greater than or equal to 92 and must be less than or equal to the logical block size
+  if ((PrimaryHeader->Header.HeaderSize < sizeof (EFI_PARTITION_TABLE_HEADER)) || (PrimaryHeader->Header.HeaderSize > BlockIo->Media->BlockSize)) {
+    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header HeaderSize!\n"));
+    return EFI_DEVICE_ERROR;
+  }
+
+  // check that the PartitionEntryLBA greater than the Max LBA
+  // This will be used later for multiplication
+  if (PrimaryHeader->PartitionEntryLBA > DivU64x32 (MAX_UINT64, BlockIo->Media->BlockSize)) {
+    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header PartitionEntryLBA!\n"));
+    return EFI_DEVICE_ERROR;
+  }
+
+  // Check that the number of partition entries is greater than zero
+  if (PrimaryHeader->NumberOfPartitionEntries == 0) {
+    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header NumberOfPartitionEntries!\n"));
+    return EFI_DEVICE_ERROR;
+  }
+
+  // SizeOfPartitionEntry must be 128, 256, 512... improper size may lead to accessing uninitialized memory
+  if ((PrimaryHeader->SizeOfPartitionEntry < 128) || ((PrimaryHeader->SizeOfPartitionEntry & (PrimaryHeader->SizeOfPartitionEntry - 1)) != 0)) {
+    DEBUG ((DEBUG_ERROR, "SizeOfPartitionEntry shall be set to a value of 128 x 2^n where n is an integer greater than or equal to zero (e.g., 128, 256, 512, etc.)!\n"));
+    return EFI_DEVICE_ERROR;
+  }
+
+  // This check is to prevent overflow when calculating the allocation size for the partition entries
+  // This check will be used later for multiplication
+  if (PrimaryHeader->NumberOfPartitionEntries > DivU64x32 (MAX_UINT64, PrimaryHeader->SizeOfPartitionEntry)) {
+    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header NumberOfPartitionEntries!\n"));
+    return EFI_DEVICE_ERROR;
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  This function will validate that the allocation size from the primary header is sane
+  It will check the following:
+    - AllocationSize does not overflow
+
+  @param[in] PrimaryHeader
+    Pointer to the EFI_PARTITION_TABLE_HEADER structure.
+
+  @param[out] AllocationSize
+    Pointer to the allocation size.
+
+  @retval EFI_SUCCESS
+    The allocation size is valid.
+
+  @retval EFI_OUT_OF_RESOURCES
+    The allocation size is invalid.
+**/
+EFI_STATUS
+EFIAPI
+SanitizePrimaryHeaderAllocationSize (
+  IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+  OUT UINT32                           *AllocationSize
+  )
+{
+  EFI_STATUS  Status;
+
+  if (PrimaryHeader == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  if (AllocationSize == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  // Replacing logic:
+  // PrimaryHeader->NumberOfPartitionEntries * PrimaryHeader->SizeOfPartitionEntry;
+  Status = SafeUint32Mult (PrimaryHeader->NumberOfPartitionEntries, PrimaryHeader->SizeOfPartitionEntry, AllocationSize);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "Allocation Size would have overflowed!\n"));
+    return EFI_BAD_BUFFER_SIZE;
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  This function will validate that the Gpt Event Size calculated from the primary header is sane
+  It will check the following:
+    - EventSize does not overflow
+
+  Important: This function includes the entire length of the allocated space, including the
+  TCG_PCR_EVENT_HDR. When hashing the buffer allocated with this size, the caller must subtract
+  the size of the TCG_PCR_EVENT_HDR from the size of the buffer before hashing.
+
+  @param[in] PrimaryHeader - Pointer to the EFI_PARTITION_TABLE_HEADER structure.
+  @param[in] NumberOfPartition - Number of partitions.
+  @param[out] EventSize - Pointer to the event size.
+
+  @retval EFI_SUCCESS
+    The event size is valid.
+
+  @retval EFI_OUT_OF_RESOURCES
+    Overflow would have occurred.
+
+  @retval EFI_INVALID_PARAMETER
+    One of the passed parameters was invalid.
+**/
+EFI_STATUS
+SanitizePrimaryHeaderGptEventSize (
+  IN  CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+  IN  UINTN                             NumberOfPartition,
+  OUT UINT32                            *EventSize
+  )
+{
+  EFI_STATUS  Status;
+  UINT32      SafeNumberOfPartitions;
+
+  if (PrimaryHeader == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  if (EventSize == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  // We shouldn't even attempt to perform the multiplication if the number of partitions is greater than the maximum value of UINT32
+  Status = SafeUintnToUint32 (NumberOfPartition, &SafeNumberOfPartitions);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "NumberOfPartition would have overflowed!\n"));
+    return EFI_INVALID_PARAMETER;
+  }
+
+  // Replacing logic:
+  // (UINT32)(sizeof (EFI_GPT_DATA) - sizeof (GptData->Partitions) + NumberOfPartition * PrimaryHeader.SizeOfPartitionEntry + sizeof (TCG_PCR_EVENT_HDR));
+  Status = SafeUint32Mult (SafeNumberOfPartitions, PrimaryHeader->SizeOfPartitionEntry, EventSize);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "Event Size would have overflowed!\n"));
+    return EFI_BAD_BUFFER_SIZE;
+  }
+
+  Status = SafeUint32Add (
+             sizeof (TCG_PCR_EVENT_HDR) +
+             OFFSET_OF (EFI_GPT_DATA, Partitions),
+             *EventSize,
+             EventSize
+             );
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "Event Size would have overflowed because of GPTData!\n"));
+    return EFI_BAD_BUFFER_SIZE;
+  }
+
+  return EFI_SUCCESS;
+}
+
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+new file mode 100644
+index 0000000000..0d9d00c281
+--- /dev/null
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+@@ -0,0 +1,114 @@
+/** @file
+  This file includes the function prototypes for the sanitization functions.
+
+  These are those functions:
+
+  DxeTpmMeasureBootLibImageRead() function will make sure the PE/COFF image content
+  read is within the image buffer.
+
+  TcgMeasurePeImage() function will accept untrusted PE/COFF image and validate its
+  data structure within this image buffer before use.
+
+  TcgMeasureGptTable() function will receive untrusted GPT partition table, and parse
+  partition data carefully.
+
+  Copyright (c) Microsoft Corporation.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#ifndef DXE_TPM_MEASURE_BOOT_LIB_VALIDATION_
+#define DXE_TPM_MEASURE_BOOT_LIB_VALIDATION_
+
+#include <Uefi.h>
+#include <Uefi/UefiSpec.h>
+#include <Protocol/BlockIo.h>
+#include <IndustryStandard/UefiTcgPlatform.h>
+
+/**
+  This function will validate the EFI_PARTITION_TABLE_HEADER structure is safe to parse
+  However this function will not attempt to verify the validity of the GPT partition
+  It will check the following:
+    - Signature
+    - Revision
+    - AlternateLBA
+    - FirstUsableLBA
+    - LastUsableLBA
+    - PartitionEntryLBA
+    - NumberOfPartitionEntries
+    - SizeOfPartitionEntry
+    - BlockIo
+
+  @param[in] PrimaryHeader
+    Pointer to the EFI_PARTITION_TABLE_HEADER structure.
+
+  @param[in] BlockIo
+    Pointer to the EFI_BLOCK_IO_PROTOCOL structure.
+
+  @retval EFI_SUCCESS
+    The EFI_PARTITION_TABLE_HEADER structure is valid.
+
+  @retval EFI_INVALID_PARAMETER
+    The EFI_PARTITION_TABLE_HEADER structure is invalid.
+**/
+EFI_STATUS
+EFIAPI
+SanitizeEfiPartitionTableHeader (
+  IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+  IN CONST EFI_BLOCK_IO_PROTOCOL       *BlockIo
+  );
+
+/**
+  This function will validate that the allocation size from the primary header is sane
+  It will check the following:
+    - AllocationSize does not overflow
+
+  @param[in] PrimaryHeader
+    Pointer to the EFI_PARTITION_TABLE_HEADER structure.
+
+  @param[out] AllocationSize
+    Pointer to the allocation size.
+
+  @retval EFI_SUCCESS
+    The allocation size is valid.
+
+  @retval EFI_OUT_OF_RESOURCES
+    The allocation size is invalid.
+**/
+EFI_STATUS
+EFIAPI
+SanitizePrimaryHeaderAllocationSize (
+  IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+  OUT UINT32                           *AllocationSize
+  );
+
+/**
+  This function will validate that the Gpt Event Size calculated from the primary header is sane
+  It will check the following:
+    - EventSize does not overflow
+
+  Important: This function includes the entire length of the allocated space, including the
+  TCG_PCR_EVENT_HDR. When hashing the buffer allocated with this size, the caller must subtract
+  the size of the TCG_PCR_EVENT_HDR from the size of the buffer before hashing.
+
+  @param[in] PrimaryHeader - Pointer to the EFI_PARTITION_TABLE_HEADER structure.
+  @param[in] NumberOfPartition - Number of partitions.
+  @param[out] EventSize - Pointer to the event size.
+
+  @retval EFI_SUCCESS
+    The event size is valid.
+
+  @retval EFI_OUT_OF_RESOURCES
+    Overflow would have occurred.
+
+  @retval EFI_INVALID_PARAMETER
+    One of the passed parameters was invalid.
+**/
+EFI_STATUS
+SanitizePrimaryHeaderGptEventSize (
+  IN  CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+  IN  UINTN                             NumberOfPartition,
+  OUT UINT32                            *EventSize
+  );
+
+#endif // DXE_TPM_MEASURE_BOOT_LIB_VALIDATION_
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+new file mode 100644
+index 0000000000..eeb928cdb0
+--- /dev/null
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+@@ -0,0 +1,301 @@
+/** @file
+This file includes the unit test cases for the DxeTpmMeasureBootLibSanitizationTest.c.
+
+Copyright (c) Microsoft Corporation.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include <Uefi.h>
+#include <Library/UefiLib.h>
+#include <Library/DebugLib.h>
+#include <Library/UnitTestLib.h>
+#include <Protocol/BlockIo.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <IndustryStandard/UefiTcgPlatform.h>
+
+#include "../DxeTpmMeasureBootLibSanitization.h"
+
+#define UNIT_TEST_NAME     "DxeTpmMeasureBootLibSanitizationTest"
+#define UNIT_TEST_VERSION  "1.0"
+
+#define DEFAULT_PRIMARY_TABLE_HEADER_REVISION                     0x00010000
+#define DEFAULT_PRIMARY_TABLE_HEADER_NUMBER_OF_PARTITION_ENTRIES  1
+#define DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY      128
+
+/**
+  This function tests the SanitizeEfiPartitionTableHeader function.
+  It's intent is to test that a malicious EFI_PARTITION_TABLE_HEADER
+  structure will not cause undefined or unexpected behavior.
+
+  In general the TPM should still be able to measure the data, but
+  be the header should be sanitized to prevent any unexpected behavior.
+
+  @param[in] Context  The unit test context.
+
+  @retval UNIT_TEST_PASSED  The test passed.
+  @retval UNIT_TEST_ERROR_TEST_FAILED  The test failed.
+**/
+UNIT_TEST_STATUS
+EFIAPI
+TestSanitizeEfiPartitionTableHeader (
+  IN UNIT_TEST_CONTEXT  Context
+  )
+{
+  EFI_STATUS                  Status;
+  EFI_PARTITION_TABLE_HEADER  PrimaryHeader;
+  EFI_BLOCK_IO_PROTOCOL       BlockIo;
+  EFI_BLOCK_IO_MEDIA          BlockMedia;
+
+  // Generate EFI_BLOCK_IO_MEDIA test data
+  BlockMedia.MediaId          = 1;
+  BlockMedia.RemovableMedia   = FALSE;
+  BlockMedia.MediaPresent     = TRUE;
+  BlockMedia.LogicalPartition = FALSE;
+  BlockMedia.ReadOnly         = FALSE;
+  BlockMedia.WriteCaching     = FALSE;
+  BlockMedia.BlockSize        = 512;
+  BlockMedia.IoAlign          = 1;
+  BlockMedia.LastBlock        = 0;
+
+  // Generate EFI_BLOCK_IO_PROTOCOL test data
+  BlockIo.Revision    = 1;
+  BlockIo.Media       = &BlockMedia;
+  BlockIo.Reset       = NULL;
+  BlockIo.ReadBlocks  = NULL;
+  BlockIo.WriteBlocks = NULL;
+  BlockIo.FlushBlocks = NULL;
+
+  // Geneate EFI_PARTITION_TABLE_HEADER test data
+  PrimaryHeader.Header.Signature         = EFI_PTAB_HEADER_ID;
+  PrimaryHeader.Header.Revision          = DEFAULT_PRIMARY_TABLE_HEADER_REVISION;
+  PrimaryHeader.Header.HeaderSize        = sizeof (EFI_PARTITION_TABLE_HEADER);
+  PrimaryHeader.MyLBA                    = 1;
+  PrimaryHeader.AlternateLBA             = 2;
+  PrimaryHeader.FirstUsableLBA           = 3;
+  PrimaryHeader.LastUsableLBA            = 4;
+  PrimaryHeader.PartitionEntryLBA        = 5;
+  PrimaryHeader.NumberOfPartitionEntries = DEFAULT_PRIMARY_TABLE_HEADER_NUMBER_OF_PARTITION_ENTRIES;
+  PrimaryHeader.SizeOfPartitionEntry     = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+  PrimaryHeader.PartitionEntryArrayCRC32 = 0; // Purposely invalid
+
+  // Calculate the CRC32 of the PrimaryHeader
+  PrimaryHeader.Header.CRC32 = CalculateCrc32 ((UINT8 *)&PrimaryHeader, PrimaryHeader.Header.HeaderSize);
+
+  // Test that a normal PrimaryHeader passes validation
+  Status = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+  UT_ASSERT_NOT_EFI_ERROR (Status);
+
+  // Test that when number of partition entries is 0, the function returns EFI_DEVICE_ERROR
+  // Should print "Invalid Partition Table Header NumberOfPartitionEntries!""
+  PrimaryHeader.NumberOfPartitionEntries = 0;
+  Status                                 = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+  UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+  PrimaryHeader.NumberOfPartitionEntries = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+
+  // Test that when the header size is too small, the function returns EFI_DEVICE_ERROR
+  // Should print "Invalid Partition Table Header Size!"
+  PrimaryHeader.Header.HeaderSize = 0;
+  Status                          = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+  UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+  PrimaryHeader.Header.HeaderSize = sizeof (EFI_PARTITION_TABLE_HEADER);
+
+  // Test that when the SizeOfPartitionEntry is too small, the function returns EFI_DEVICE_ERROR
+  // should print: "SizeOfPartitionEntry shall be set to a value of 128 x 2^n where n is an integer greater than or equal to zero (e.g., 128, 256, 512, etc.)!"
+  PrimaryHeader.SizeOfPartitionEntry = 1;
+  Status                             = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+  UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+
+  DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+
+  return UNIT_TEST_PASSED;
+}
+
+/**
+  This function tests the SanitizePrimaryHeaderAllocationSize function.
+  It's intent is to test that the untrusted input from a EFI_PARTITION_TABLE_HEADER
+  structure will not cause an overflow when calculating the allocation size.
+
+  @param[in] Context  The unit test context.
+
+  @retval UNIT_TEST_PASSED  The test passed.
+  @retval UNIT_TEST_ERROR_TEST_FAILED  The test failed.
+**/
+UNIT_TEST_STATUS
+EFIAPI
+TestSanitizePrimaryHeaderAllocationSize (
+  IN UNIT_TEST_CONTEXT  Context
+  )
+{
+  UINT32  AllocationSize;
+
+  EFI_STATUS                  Status;
+  EFI_PARTITION_TABLE_HEADER  PrimaryHeader;
+
+  // Test that a normal PrimaryHeader passes validation
+  PrimaryHeader.NumberOfPartitionEntries = 5;
+  PrimaryHeader.SizeOfPartitionEntry     = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+
+  Status = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+  UT_ASSERT_NOT_EFI_ERROR (Status);
+
+  // Test that the allocation size is correct compared to the existing logic
+  UT_ASSERT_EQUAL (AllocationSize, PrimaryHeader.NumberOfPartitionEntries * PrimaryHeader.SizeOfPartitionEntry);
+
+  // Test that an overflow is detected
+  PrimaryHeader.NumberOfPartitionEntries = MAX_UINT32;
+  PrimaryHeader.SizeOfPartitionEntry     = 5;
+  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+  UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+
+  // Test the inverse
+  PrimaryHeader.NumberOfPartitionEntries = 5;
+  PrimaryHeader.SizeOfPartitionEntry     = MAX_UINT32;
+  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+  UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+
+  // Test the worst case scenario
+  PrimaryHeader.NumberOfPartitionEntries = MAX_UINT32;
+  PrimaryHeader.SizeOfPartitionEntry     = MAX_UINT32;
+  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+  UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+
+  DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+
+  return UNIT_TEST_PASSED;
+}
+
+/**
+  This function tests the SanitizePrimaryHeaderGptEventSize function.
+  It's intent is to test that the untrusted input from a EFI_GPT_DATA structure
+  will not cause an overflow when calculating the event size.
+
+  @param[in] Context  The unit test context.
+
+  @retval UNIT_TEST_PASSED  The test passed.
+  @retval UNIT_TEST_ERROR_TEST_FAILED  The test failed.
+**/
+UNIT_TEST_STATUS
+EFIAPI
+TestSanitizePrimaryHeaderGptEventSize (
+  IN UNIT_TEST_CONTEXT  Context
+  )
+{
+  UINT32                      EventSize;
+  UINT32                      ExistingLogicEventSize;
+  EFI_STATUS                  Status;
+  EFI_PARTITION_TABLE_HEADER  PrimaryHeader;
+  UINTN                       NumberOfPartition;
+  EFI_GPT_DATA                *GptData;
+
+  GptData = NULL;
+
+  // Test that a normal PrimaryHeader passes validation
+  PrimaryHeader.NumberOfPartitionEntries = 5;
+  PrimaryHeader.SizeOfPartitionEntry     = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+
+  // set the number of partitions
+  NumberOfPartition = 13;
+
+  // that the primary event size is correct
+  Status = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+  UT_ASSERT_NOT_EFI_ERROR (Status);
+
+  // Calculate the existing logic event size
+  ExistingLogicEventSize = (UINT32)(sizeof (TCG_PCR_EVENT_HDR) + OFFSET_OF (EFI_GPT_DATA, Partitions)
+                                    + NumberOfPartition * PrimaryHeader.SizeOfPartitionEntry);
+
+  // Check that the event size is correct
+  UT_ASSERT_EQUAL (EventSize, ExistingLogicEventSize);
+
+  // Tests that the primary event size may not overflow
+  Status = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, MAX_UINT32, &EventSize);
+  UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+
+  // Test that the size of partition entries may not overflow
+  PrimaryHeader.SizeOfPartitionEntry = MAX_UINT32;
+  Status                             = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+  UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+
+  DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+
+  return UNIT_TEST_PASSED;
+}
+
+// *--------------------------------------------------------------------*
+// *  Unit Test Code Main Function
+// *--------------------------------------------------------------------*
+
+/**
+  This function acts as the entry point for the unit tests.
+
+  @param argc - The number of command line arguments
+  @param argv - The command line arguments
+
+  @return int - The status of the test
+**/
+EFI_STATUS
+EFIAPI
+UefiTestMain (
+  VOID
+  )
+{
+  EFI_STATUS                  Status;
+  UNIT_TEST_FRAMEWORK_HANDLE  Framework;
+  UNIT_TEST_SUITE_HANDLE      TcgMeasureBootLibValidationTestSuite;
+
+  Framework = NULL;
+
+  DEBUG ((DEBUG_INFO, "%a: TestMain() - Start\n", UNIT_TEST_NAME));
+
+  Status = InitUnitTestFramework (&Framework, UNIT_TEST_NAME, gEfiCallerBaseName, UNIT_TEST_VERSION);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "%a: Failed in InitUnitTestFramework. Status = %r\n", UNIT_TEST_NAME, Status));
+    goto EXIT;
+  }
+
+  Status = CreateUnitTestSuite (&TcgMeasureBootLibValidationTestSuite, Framework, "TcgMeasureBootLibValidationTestSuite", "Common.TcgMeasureBootLibValidation", NULL, NULL);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "%s: Failed in CreateUnitTestSuite for TcgMeasureBootLibValidationTestSuite\n", UNIT_TEST_NAME));
+    Status = EFI_OUT_OF_RESOURCES;
+    goto EXIT;
+  }
+
+  // -----------Suite---------------------------------Description----------------------------Class----------------------------------Test Function------------------------Pre---Clean-Context
+  AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Validating EFI Partition Table", "Common.TcgMeasureBootLibValidation", TestSanitizeEfiPartitionTableHeader, NULL, NULL, NULL);
+  AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Primary header gpt event checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePrimaryHeaderAllocationSize, NULL, NULL, NULL);
+  AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Primary header allocation size checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePrimaryHeaderGptEventSize, NULL, NULL, NULL);
+
+  Status = RunAllTestSuites (Framework);
+
+EXIT:
+  if (Framework != NULL) {
+    FreeUnitTestFramework (Framework);
+  }
+
+  DEBUG ((DEBUG_INFO, "%a: TestMain() - End\n", UNIT_TEST_NAME));
+  return Status;
+}
+
+///
+/// Avoid ECC error for function name that starts with lower case letter
+///
+#define DxeTpmMeasureBootLibUnitTestMain  main
+
+/**
+  Standard POSIX C entry point for host based unit test execution.
+
+  @param[in] Argc  Number of arguments
+  @param[in] Argv  Array of pointers to arguments
+
+  @retval 0      Success
+  @retval other  Error
+**/
+INT32
+DxeTpmMeasureBootLibUnitTestMain (
+  IN INT32  Argc,
+  IN CHAR8  *Argv[]
+  )
+{
+  return (INT32)UefiTestMain ();
+}
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTestHost.inf b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTestHost.inf
+new file mode 100644
+index 0000000000..47b0811b00
+--- /dev/null
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTestHost.inf
+@@ -0,0 +1,28 @@
+## @file
+# This file builds the unit tests for DxeTpmMeasureBootLib
+#
+# Copyright (C) Microsoft Corporation.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010006
+  BASE_NAME                      = DxeTpmMeasuredBootLibTest
+  FILE_GUID                      = eb01bc38-309c-4d3e-967e-9f078c90772f
+  MODULE_TYPE                    = HOST_APPLICATION
+  VERSION_STRING                 = 1.0
+  ENTRY_POINT                    = main
+
+[Sources]
+  DxeTpmMeasureBootLibSanitizationTest.c
+  ../DxeTpmMeasureBootLibSanitization.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+
+[LibraryClasses]
+  BaseLib
+  DebugLib
+  UnitTestLib
+  PrintLib
+  SafeIntLib
+diff --git a/SecurityPkg/SecurityPkg.ci.yaml b/SecurityPkg/SecurityPkg.ci.yaml
+index aa8496d6d9..26865cb15a 100644
+--- a/SecurityPkg/SecurityPkg.ci.yaml
+++ b/SecurityPkg/SecurityPkg.ci.yaml
+@@ -17,6 +17,7 @@
+         "ExceptionList": [
+             "8005", "gRT",
+             "8001", "DxeTpm2MeasureBootLibUnitTestMain",
+            "8001", "DxeTpmMeasureBootLibUnitTestMain"
+         ],
+         ## Both file path and directory path are accepted.
+         "IgnoreFiles": [
+diff --git a/SecurityPkg/Test/SecurityPkgHostTest.dsc b/SecurityPkg/Test/SecurityPkgHostTest.dsc
+index 788c1ab6fe..1655e573ea 100644
+--- a/SecurityPkg/Test/SecurityPkgHostTest.dsc
+++ b/SecurityPkg/Test/SecurityPkgHostTest.dsc
+@@ -27,6 +27,7 @@
+   SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
+   SecurityPkg/Test/Mock/Library/GoogleTest/MockPlatformPKProtectionLib/MockPlatformPKProtectionLib.inf
+   SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTestHost.inf
+  SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTestHost.inf
+ 
+   #
+   # Build SecurityPkg HOST_APPLICATION Tests
+-- 
+2.41.0
+
--- a/SOURCES/edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch
+++ b/SOURCES/edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch
@ -0,0 +1,307 @@
+From f6f72373630d901f331df719a0fb55e8f1143c4f Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 7 Feb 2024 15:43:10 -0500
+Subject: [PATCH 10/17] SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4118
+ - CVE 2022-36764
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 44: edk2: heap buffer overflow in Tcg2MeasureGptTable()
+RH-Jira: RHEL-21154 RHEL-21156
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [10/13] 5ed702e16f390c79d1abb0ec0b04d886e0094c0b (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21156
+CVE: CVE-2022-36764
+Upstream: Merged
+Conflicts: We get function definiton clash for the following three functions:
+           - SanitizePeImageEventSize()
+           This is defined both in
+           - SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitazion.c
+           and
+           - SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitazion.c
+           Closer investigation reveals that they are identical in functionality (although
+           not in comment style).
+           I chose to leave them as is now, meaning that this package will be
+           unbuildable until I add a commit renaming these symbols later in
+           this series.
+
+commit 0d341c01eeabe0ab5e76693b36e728b8f538a40e
+Author: Douglas Flick [MSFT] <doug.edk2@gmail.com>
+Date:   Fri Jan 12 02:16:05 2024 +0800
+
+    SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764
+
+    This commit contains the patch files and tests for DxeTpmMeasureBootLib
+    CVE 2022-36764.
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeTpmMeasureBootLib.c                    | 17 ++--
+ .../DxeTpmMeasureBootLibSanitization.c        | 44 +++++++++
+ .../DxeTpmMeasureBootLibSanitization.h        | 23 +++++
+ .../DxeTpmMeasureBootLibSanitizationTest.c    | 98 +++++++++++++++++--
+ 4 files changed, 170 insertions(+), 12 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+index d44422dee8..1598015176 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+@@ -17,6 +17,7 @@
+ 
+ Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+Copyright (c) Microsoft Corporation.<BR>
+ 
+ Copyright (c) Microsoft Corporation.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+@@ -338,19 +339,23 @@ TcgMeasurePeImage (
+   ImageLoad     = NULL;
+   SectionHeader = NULL;
+   Sha1Ctx       = NULL;
+-  FilePathSize  = (UINT32) GetDevicePathSize (FilePath);
+  TcgEvent      = NULL;
+  FilePathSize  = (UINT32)GetDevicePathSize (FilePath);
+ 
+-  //
+   // Determine destination PCR by BootPolicy
+   //
+-  EventSize = sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
+-  TcgEvent = AllocateZeroPool (EventSize + sizeof (TCG_PCR_EVENT));
+  Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
+  if (EFI_ERROR (Status)) {
+    return EFI_UNSUPPORTED;
+  }
+
+  TcgEvent = AllocateZeroPool (EventSize);
+   if (TcgEvent == NULL) {
+     return EFI_OUT_OF_RESOURCES;
+   }
+ 
+-  TcgEvent->EventSize = EventSize;
+-  ImageLoad           = (EFI_IMAGE_LOAD_EVENT *) TcgEvent->Event;
+  TcgEvent->EventSize = EventSize - sizeof (TCG_PCR_EVENT_HDR);
+  ImageLoad           = (EFI_IMAGE_LOAD_EVENT *)TcgEvent->Event;
+ 
+   switch (ImageType) {
+     case EFI_IMAGE_SUBSYSTEM_EFI_APPLICATION:
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+index 37cd3ed0ea..bcf8c6de6f 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+@@ -240,3 +240,47 @@ SanitizePrimaryHeaderGptEventSize (
+   return EFI_SUCCESS;
+ }
+ 
+/**
+  This function will validate that the PeImage Event Size from the loaded image is sane
+  It will check the following:
+    - EventSize does not overflow
+
+  @param[in] FilePathSize - Size of the file path.
+  @param[out] EventSize - Pointer to the event size.
+
+  @retval EFI_SUCCESS
+    The event size is valid.
+
+  @retval EFI_OUT_OF_RESOURCES
+    Overflow would have occurred.
+
+  @retval EFI_INVALID_PARAMETER
+    One of the passed parameters was invalid.
+**/
+EFI_STATUS
+SanitizePeImageEventSize (
+  IN  UINT32  FilePathSize,
+  OUT UINT32  *EventSize
+  )
+{
+  EFI_STATUS  Status;
+
+  // Replacing logic:
+  // sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
+  Status = SafeUint32Add (OFFSET_OF (EFI_IMAGE_LOAD_EVENT, DevicePath), FilePathSize, EventSize);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "EventSize would overflow!\n"));
+    return EFI_BAD_BUFFER_SIZE;
+  }
+
+  // Replacing logic:
+  // EventSize + sizeof (TCG_PCR_EVENT_HDR)
+  Status = SafeUint32Add (*EventSize, sizeof (TCG_PCR_EVENT_HDR), EventSize);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "EventSize would overflow!\n"));
+    return EFI_BAD_BUFFER_SIZE;
+  }
+
+  return EFI_SUCCESS;
+}
+
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+index 0d9d00c281..2248495813 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+@@ -111,4 +111,27 @@ SanitizePrimaryHeaderGptEventSize (
+   OUT UINT32                            *EventSize
+   );
+ 
+/**
+  This function will validate that the PeImage Event Size from the loaded image is sane
+  It will check the following:
+    - EventSize does not overflow
+
+  @param[in] FilePathSize - Size of the file path.
+  @param[out] EventSize - Pointer to the event size.
+
+  @retval EFI_SUCCESS
+    The event size is valid.
+
+  @retval EFI_OUT_OF_RESOURCES
+    Overflow would have occurred.
+
+  @retval EFI_INVALID_PARAMETER
+    One of the passed parameters was invalid.
+**/
+EFI_STATUS
+SanitizePeImageEventSize (
+  IN  UINT32  FilePathSize,
+  OUT UINT32  *EventSize
+  );
+
+ #endif // DXE_TPM_MEASURE_BOOT_LIB_VALIDATION_
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+index eeb928cdb0..c41498be45 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+@@ -1,8 +1,8 @@
+ /** @file
+-This file includes the unit test cases for the DxeTpmMeasureBootLibSanitizationTest.c.
+  This file includes the unit test cases for the DxeTpmMeasureBootLibSanitizationTest.c.
+ 
+-Copyright (c) Microsoft Corporation.<BR>
+-SPDX-License-Identifier: BSD-2-Clause-Patent
+  Copyright (c) Microsoft Corporation.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+ **/
+ 
+ #include <Uefi.h>
+@@ -186,9 +186,6 @@ TestSanitizePrimaryHeaderGptEventSize (
+   EFI_STATUS                  Status;
+   EFI_PARTITION_TABLE_HEADER  PrimaryHeader;
+   UINTN                       NumberOfPartition;
+-  EFI_GPT_DATA                *GptData;
+-
+-  GptData = NULL;
+ 
+   // Test that a normal PrimaryHeader passes validation
+   PrimaryHeader.NumberOfPartitionEntries = 5;
+@@ -222,6 +219,94 @@ TestSanitizePrimaryHeaderGptEventSize (
+   return UNIT_TEST_PASSED;
+ }
+ 
+/**
+  This function tests the SanitizePeImageEventSize function.
+  It's intent is to test that the untrusted input from a file path for an
+  EFI_IMAGE_LOAD_EVENT structure will not cause an overflow when calculating
+  the event size when allocating space.
+
+  @param[in] Context  The unit test context.
+
+  @retval UNIT_TEST_PASSED  The test passed.
+  @retval UNIT_TEST_ERROR_TEST_FAILED  The test failed.
+**/
+UNIT_TEST_STATUS
+EFIAPI
+TestSanitizePeImageEventSize (
+  IN UNIT_TEST_CONTEXT  Context
+  )
+{
+  UINT32                    EventSize;
+  UINTN                     ExistingLogicEventSize;
+  UINT32                    FilePathSize;
+  EFI_STATUS                Status;
+  EFI_DEVICE_PATH_PROTOCOL  DevicePath;
+  EFI_IMAGE_LOAD_EVENT      *ImageLoadEvent;
+  UNIT_TEST_STATUS          TestStatus;
+
+  TestStatus = UNIT_TEST_ERROR_TEST_FAILED;
+
+  // Generate EFI_DEVICE_PATH_PROTOCOL test data
+  DevicePath.Type      = 0;
+  DevicePath.SubType   = 0;
+  DevicePath.Length[0] = 0;
+  DevicePath.Length[1] = 0;
+
+  // Generate EFI_IMAGE_LOAD_EVENT test data
+  ImageLoadEvent = AllocateZeroPool (sizeof (EFI_IMAGE_LOAD_EVENT) + sizeof (EFI_DEVICE_PATH_PROTOCOL));
+  if (ImageLoadEvent == NULL) {
+    DEBUG ((DEBUG_ERROR, "%a: AllocateZeroPool failed\n", __func__));
+    goto Exit;
+  }
+
+  // Populate EFI_IMAGE_LOAD_EVENT54 test data
+  ImageLoadEvent->ImageLocationInMemory = (EFI_PHYSICAL_ADDRESS)0x12345678;
+  ImageLoadEvent->ImageLengthInMemory   = 0x1000;
+  ImageLoadEvent->ImageLinkTimeAddress  = (UINTN)ImageLoadEvent;
+  ImageLoadEvent->LengthOfDevicePath    = sizeof (EFI_DEVICE_PATH_PROTOCOL);
+  CopyMem (ImageLoadEvent->DevicePath, &DevicePath, sizeof (EFI_DEVICE_PATH_PROTOCOL));
+
+  FilePathSize = 255;
+
+  // Test that a normal PE image passes validation
+  Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
+  if (EFI_ERROR (Status)) {
+    UT_LOG_ERROR ("SanitizePeImageEventSize failed with %r\n", Status);
+    goto Exit;
+  }
+
+  // Test that the event size is correct compared to the existing logic
+  ExistingLogicEventSize  = OFFSET_OF (EFI_IMAGE_LOAD_EVENT, DevicePath) + FilePathSize;
+  ExistingLogicEventSize += sizeof (TCG_PCR_EVENT_HDR);
+
+  if (EventSize != ExistingLogicEventSize) {
+    UT_LOG_ERROR ("SanitizePeImageEventSize returned an incorrect event size. Expected %u, got %u\n", ExistingLogicEventSize, EventSize);
+    goto Exit;
+  }
+
+  // Test that the event size may not overflow
+  Status = SanitizePeImageEventSize (MAX_UINT32, &EventSize);
+  if (Status != EFI_BAD_BUFFER_SIZE) {
+    UT_LOG_ERROR ("SanitizePeImageEventSize succeded when it was supposed to fail with %r\n", Status);
+    goto Exit;
+  }
+
+  TestStatus = UNIT_TEST_PASSED;
+Exit:
+
+  if (ImageLoadEvent != NULL) {
+    FreePool (ImageLoadEvent);
+  }
+
+  if (TestStatus == UNIT_TEST_ERROR_TEST_FAILED) {
+    DEBUG ((DEBUG_ERROR, "%a: Test failed\n", __func__));
+  } else {
+    DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+  }
+
+  return TestStatus;
+}
+
+ // *--------------------------------------------------------------------*
+ // *  Unit Test Code Main Function
+ // *--------------------------------------------------------------------*
+@@ -265,6 +350,7 @@ UefiTestMain (
+   AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Validating EFI Partition Table", "Common.TcgMeasureBootLibValidation", TestSanitizeEfiPartitionTableHeader, NULL, NULL, NULL);
+   AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Primary header gpt event checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePrimaryHeaderAllocationSize, NULL, NULL, NULL);
+   AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Primary header allocation size checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePrimaryHeaderGptEventSize, NULL, NULL, NULL);
+  AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests PE Image and FileSize checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePeImageEventSize, NULL, NULL, NULL);
+ 
+   Status = RunAllTestSuites (Framework);
+ 
+-- 
+2.41.0
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Add-AArch64-RawAlgorithm-support-.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Add-AArch64-RawAlgorithm-support-.patch
@ -0,0 +1,246 @@
+From 660ffc1753c84e89281d54059c0cb73eef7200d0 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 25 Jun 2024 22:27:16 -0400
+Subject: [PATCH 09/31] SecurityPkg/RngDxe: Add AArch64 RawAlgorithm support
+ through ArmTrngLib
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [9/31] 34f5db557b893a686c382a09ceacda728dbd4ad9
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+CVE: CVE-2022-45237
+Upstream: Merged
+
+commit 863fe9e191fb3d90c3283062183692c04cd71975
+Author: Sami Mujawar <sami.mujawar@arm.com>
+Date:   Fri Oct 28 17:32:55 2022 +0200
+
+    SecurityPkg/RngDxe: Add AArch64 RawAlgorithm support through ArmTrngLib
+
+    Bugzilla: 3668 (https://bugzilla.tianocore.org/show_bug.cgi?id=3668)
+
+    RawAlgorithm is used to provide access to entropy that is suitable
+    for cryptographic applications. Therefore, add RawAlgorithm support
+    that provides access to entropy using the ArmTrngLib.
+
+    Also remove unused UefiBootServicesTableLib library inclusion
+    and Status variable.
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../RngDxe/AArch64/RngDxe.c                   | 28 ++++++--
+ .../RandomNumberGenerator/RngDxe/ArmTrng.c    | 71 +++++++++++++++++++
+ .../RandomNumberGenerator/RngDxe/RngDxe.inf   |  5 ++
+ SecurityPkg/SecurityPkg.dsc                   |  4 ++
+ 4 files changed, 104 insertions(+), 4 deletions(-)
+ create mode 100644 SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+index c9d66d9777..c0b0d28d48 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+@@ -1,11 +1,13 @@
+ /** @file
+   RNG Driver to produce the UEFI Random Number Generator protocol.
+ 
+-  The driver will use the RNDR instruction to produce random numbers.
+  The driver can use RNDR instruction (through the RngLib and if FEAT_RNG is
+  present) to produce random numbers. It also uses the Arm FW-TRNG interface
+  to implement EFI_RNG_ALGORITHM_RAW.
+ 
+   RNG Algorithms defined in UEFI 2.4:
+    - EFI_RNG_ALGORITHM_SP800_90_CTR_256_GUID
+-   - EFI_RNG_ALGORITHM_RAW                    - Unsupported
+   - EFI_RNG_ALGORITHM_RAW
+    - EFI_RNG_ALGORITHM_SP800_90_HMAC_256_GUID
+    - EFI_RNG_ALGORITHM_SP800_90_HASH_256_GUID
+    - EFI_RNG_ALGORITHM_X9_31_3DES_GUID        - Unsupported
+@@ -26,12 +28,14 @@
+ #include <Library/MemoryAllocationLib.h>
+ #include <Library/UefiBootServicesTableLib.h>
+ #include <Library/RngLib.h>
+#include <Library/DebugLib.h>
+#include <Library/ArmTrngLib.h>
+ #include <Protocol/Rng.h>
+ 
+ #include "RngDxeInternals.h"
+ 
+ // Maximum number of Rng algorithms.
+-#define RNG_AVAILABLE_ALGO_MAX  1
+#define RNG_AVAILABLE_ALGO_MAX  2
+ 
+ /** Allocate and initialize mAvailableAlgoArray with the available
+     Rng algorithms. Also update mAvailableAlgoArrayCount.
+@@ -46,8 +50,9 @@ GetAvailableAlgorithms (
+   )
+ {
+   UINT64  DummyRand;
+  UINT16  MajorRevision;
+  UINT16  MinorRevision;
+ 
+-  // Allocate RNG_AVAILABLE_ALGO_MAX entries to avoid evaluating
+   // Rng algorithms 2 times, one for the allocation, one to populate.
+   mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
+   if (mAvailableAlgoArray == NULL) {
+@@ -64,6 +69,16 @@ GetAvailableAlgorithms (
+     mAvailableAlgoArrayCount++;
+   }
+ 
+  // Raw algorithm (Trng)
+  if (!EFI_ERROR (GetArmTrngVersion (&MajorRevision, &MinorRevision))) {
+    CopyMem (
+      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
+      &gEfiRngAlgorithmRaw,
+      sizeof (EFI_RNG_ALGORITHM)
+      );
+    mAvailableAlgoArrayCount++;
+  }
+
+   return EFI_SUCCESS;
+ }
+ 
+@@ -141,6 +156,11 @@ FoundAlgo:
+     return Status;
+   }
+ 
+  // Raw algorithm (Trng)
+  if (CompareGuid (RNGAlgorithm, &gEfiRngAlgorithmRaw)) {
+    return GenerateEntropy (RNGValueLength, RNGValue);
+  }
+
+   //
+   // Other algorithms are unsupported by this driver.
+   //
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c
+new file mode 100644
+index 0000000000..ffe557b692
+--- /dev/null
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmTrng.c
+@@ -0,0 +1,71 @@
+/** @file
+  RNG Driver to produce the UEFI Random Number Generator protocol.
+
+  The driver implements the EFI_RNG_ALGORITHM_RAW using the FW-TRNG
+  interface to provide entropy.
+
+  Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
+
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/ArmTrngLib.h>
+#include <Protocol/Rng.h>
+
+#include "RngDxeInternals.h"
+
+/**
+  Generate high-quality entropy source using a TRNG or through RDRAND.
+
+  @param[in]   Length        Size of the buffer, in bytes, to fill with.
+  @param[out]  Entropy       Pointer to the buffer to store the entropy data.
+
+  @retval  RETURN_SUCCESS            The function completed successfully.
+  @retval  RETURN_INVALID_PARAMETER  Invalid parameter.
+  @retval  RETURN_UNSUPPORTED        Function not implemented.
+  @retval  RETURN_BAD_BUFFER_SIZE    Buffer size is too small.
+  @retval  RETURN_NOT_READY          No Entropy available.
+**/
+EFI_STATUS
+EFIAPI
+GenerateEntropy (
+  IN  UINTN  Length,
+  OUT UINT8  *Entropy
+  )
+{
+  EFI_STATUS  Status;
+  UINTN       CollectedEntropyBits;
+  UINTN       RequiredEntropyBits;
+  UINTN       EntropyBits;
+  UINTN       Index;
+  UINTN       MaxBits;
+
+  ZeroMem (Entropy, Length);
+
+  RequiredEntropyBits  = (Length << 3);
+  Index                = 0;
+  CollectedEntropyBits = 0;
+  MaxBits              = GetArmTrngMaxSupportedEntropyBits ();
+  while (CollectedEntropyBits < RequiredEntropyBits) {
+    EntropyBits = MIN ((RequiredEntropyBits - CollectedEntropyBits), MaxBits);
+    Status      = GetArmTrngEntropy (
+                    EntropyBits,
+                    (Length - Index),
+                    &Entropy[Index]
+                    );
+    if (EFI_ERROR (Status)) {
+      // Discard the collected bits.
+      ZeroMem (Entropy, Length);
+      return Status;
+    }
+
+    CollectedEntropyBits += EntropyBits;
+    Index                += (EntropyBits >> 3);
+  } // while
+
+  return Status;
+}
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+index 1985dfbb46..e0e767cbf3 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+@@ -43,8 +43,10 @@
+ 
+ [Sources.AARCH64]
+   AArch64/RngDxe.c
+  ArmTrng.c
+ 
+ [Packages]
+  MdeModulePkg/MdeModulePkg.dec
+   MdePkg/MdePkg.dec
+   SecurityPkg/SecurityPkg.dec
+ 
+@@ -57,6 +59,9 @@
+   TimerLib
+   RngLib
+ 
+[LibraryClasses.AARCH64]
+  ArmTrngLib
+
+ [Guids]
+   gEfiRngAlgorithmSp80090Hash256Guid  ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
+   gEfiRngAlgorithmSp80090Hmac256Guid  ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
+diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
+index 73a93c2285..9f58cc2333 100644
+--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
+@@ -3,6 +3,8 @@
+ #
+ # Copyright (c) 2009 - 2021, Intel Corporation. All rights reserved.<BR>
+ # (C) Copyright 2015-2020 Hewlett Packard Enterprise Development LP<BR>
+# Copyright (c) 2022, Loongson Technology Corporation Limited. All rights reserved.<BR>
+# Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
+ # SPDX-License-Identifier: BSD-2-Clause-Patent
+ #
+ ##
+@@ -86,6 +88,8 @@
+ 
+   ArmSoftFloatLib|ArmPkg/Library/ArmSoftFloatLib/ArmSoftFloatLib.inf
+ 
+  ArmTrngLib|MdePkg/Library/BaseArmTrngLibNull/BaseArmTrngLibNull.inf
+
+ [LibraryClasses.ARM]
+   RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+ 
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Add-Arm-support-of-RngDxe.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Add-Arm-support-of-RngDxe.patch
@ -0,0 +1,311 @@
+From 0c6e925403e5aa50a77797af59308e6fee4be6b1 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 25 Jun 2024 22:31:58 -0400
+Subject: [PATCH 12/31] SecurityPkg/RngDxe: Add Arm support of RngDxe
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [12/31] 11b72f6d69392c7b2e8565025a576e76877fe7ed
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+CVE: CVE-2022-45237
+Upstream: Merged
+
+commit 9eb5ccda505917f6ee80284ed6fb5b51aa7152f9
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Fri Oct 28 17:32:58 2022 +0200
+
+    SecurityPkg/RngDxe: Add Arm support of RngDxe
+
+    Bugzilla: 3668 (https://bugzilla.tianocore.org/show_bug.cgi?id=3668)
+
+    Add RngDxe support for Arm. This implementation uses the ArmTrngLib
+    to support the RawAlgorithm and doens't support the RNDR instruction.
+
+    To re-use the RngGetRNG(), RngGetInfo() and FreeAvailableAlgorithms()
+    functions, create Arm/AArch64 files which implement the arch specific
+    function GetAvailableAlgorithms(). Indeed, FEAT_RNG instruction is not
+    supported on Arm.
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../RngDxe/AArch64/AArch64Algo.c              | 72 +++++++++++++++++++
+ .../RngDxe/Arm/ArmAlgo.c                      | 51 +++++++++++++
+ .../RandomNumberGenerator/RngDxe/ArmRngDxe.c  | 60 ----------------
+ .../RandomNumberGenerator/RngDxe/RngDxe.inf   | 12 +++-
+ SecurityPkg/SecurityPkg.dsc                   |  2 +-
+ 5 files changed, 133 insertions(+), 64 deletions(-)
+ create mode 100644 SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c
+ create mode 100644 SecurityPkg/RandomNumberGenerator/RngDxe/Arm/ArmAlgo.c
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c
+new file mode 100644
+index 0000000000..e8be217f8a
+--- /dev/null
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c
+@@ -0,0 +1,72 @@
+/** @file
+  Aarch64 specific code.
+
+  Copyright (c) 2022, Arm Limited. All rights reserved.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/ArmTrngLib.h>
+
+#include "RngDxeInternals.h"
+
+// Maximum number of Rng algorithms.
+#define RNG_AVAILABLE_ALGO_MAX  2
+
+/** Allocate and initialize mAvailableAlgoArray with the available
+    Rng algorithms. Also update mAvailableAlgoArrayCount.
+
+  @retval EFI_SUCCESS             The function completed successfully.
+  @retval EFI_OUT_OF_RESOURCES    Could not allocate memory.
+**/
+EFI_STATUS
+EFIAPI
+GetAvailableAlgorithms (
+  VOID
+  )
+{
+  UINT64  DummyRand;
+  UINT16  MajorRevision;
+  UINT16  MinorRevision;
+
+  // Rng algorithms 2 times, one for the allocation, one to populate.
+  mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
+  if (mAvailableAlgoArray == NULL) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  // Check RngGetBytes() before advertising PcdCpuRngSupportedAlgorithm.
+  if (!EFI_ERROR (RngGetBytes (sizeof (DummyRand), (UINT8 *)&DummyRand))) {
+    CopyMem (
+      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
+      PcdGetPtr (PcdCpuRngSupportedAlgorithm),
+      sizeof (EFI_RNG_ALGORITHM)
+      );
+    mAvailableAlgoArrayCount++;
+
+    DEBUG_CODE_BEGIN ();
+    if (IsZeroGuid (PcdGetPtr (PcdCpuRngSupportedAlgorithm))) {
+      DEBUG ((
+        DEBUG_WARN,
+        "PcdCpuRngSupportedAlgorithm should be a non-zero GUID\n"
+        ));
+    }
+
+    DEBUG_CODE_END ();
+  }
+
+  // Raw algorithm (Trng)
+  if (!EFI_ERROR (GetArmTrngVersion (&MajorRevision, &MinorRevision))) {
+    CopyMem (
+      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
+      &gEfiRngAlgorithmRaw,
+      sizeof (EFI_RNG_ALGORITHM)
+      );
+    mAvailableAlgoArrayCount++;
+  }
+
+  return EFI_SUCCESS;
+}
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Arm/ArmAlgo.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Arm/ArmAlgo.c
+new file mode 100644
+index 0000000000..4b24f5c4a6
+--- /dev/null
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Arm/ArmAlgo.c
+@@ -0,0 +1,51 @@
+/** @file
+  Arm specific code.
+
+  Copyright (c) 2022, Arm Limited. All rights reserved.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/ArmTrngLib.h>
+
+#include "RngDxeInternals.h"
+
+// Maximum number of Rng algorithms.
+#define RNG_AVAILABLE_ALGO_MAX  1
+
+/** Allocate and initialize mAvailableAlgoArray with the available
+    Rng algorithms. Also update mAvailableAlgoArrayCount.
+
+  @retval EFI_SUCCESS             The function completed successfully.
+  @retval EFI_OUT_OF_RESOURCES    Could not allocate memory.
+**/
+EFI_STATUS
+EFIAPI
+GetAvailableAlgorithms (
+  VOID
+  )
+{
+  UINT16  MajorRevision;
+  UINT16  MinorRevision;
+
+  // Rng algorithms 2 times, one for the allocation, one to populate.
+  mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
+  if (mAvailableAlgoArray == NULL) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  // Raw algorithm (Trng)
+  if (!EFI_ERROR (GetArmTrngVersion (&MajorRevision, &MinorRevision))) {
+    CopyMem (
+      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
+      &gEfiRngAlgorithmRaw,
+      sizeof (EFI_RNG_ALGORITHM)
+      );
+    mAvailableAlgoArrayCount++;
+  }
+
+  return EFI_SUCCESS;
+}
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+index a800a85792..5e7d9ef681 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+@@ -28,70 +28,10 @@
+ #include <Library/MemoryAllocationLib.h>
+ #include <Library/UefiBootServicesTableLib.h>
+ #include <Library/RngLib.h>
+-#include <Library/DebugLib.h>
+-#include <Library/ArmTrngLib.h>
+ #include <Protocol/Rng.h>
+ 
+ #include "RngDxeInternals.h"
+ 
+-// Maximum number of Rng algorithms.
+-#define RNG_AVAILABLE_ALGO_MAX  2
+-
+-/** Allocate and initialize mAvailableAlgoArray with the available
+-    Rng algorithms. Also update mAvailableAlgoArrayCount.
+-
+-  @retval EFI_SUCCESS             The function completed successfully.
+-  @retval EFI_OUT_OF_RESOURCES    Could not allocate memory.
+-**/
+-EFI_STATUS
+-EFIAPI
+-GetAvailableAlgorithms (
+-  VOID
+-  )
+-{
+-  UINT64  DummyRand;
+-  UINT16  MajorRevision;
+-  UINT16  MinorRevision;
+-
+-  // Rng algorithms 2 times, one for the allocation, one to populate.
+-  mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
+-  if (mAvailableAlgoArray == NULL) {
+-    return EFI_OUT_OF_RESOURCES;
+-  }
+-
+-  // Check RngGetBytes() before advertising PcdCpuRngSupportedAlgorithm.
+-  if (!EFI_ERROR (RngGetBytes (sizeof (DummyRand), (UINT8 *)&DummyRand))) {
+-    CopyMem (
+-      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
+-      PcdGetPtr (PcdCpuRngSupportedAlgorithm),
+-      sizeof (EFI_RNG_ALGORITHM)
+-      );
+-    mAvailableAlgoArrayCount++;
+-
+-    DEBUG_CODE_BEGIN ();
+-    if (IsZeroGuid (PcdGetPtr (PcdCpuRngSupportedAlgorithm))) {
+-      DEBUG ((
+-        DEBUG_WARN,
+-        "PcdCpuRngSupportedAlgorithm should be a non-zero GUID\n"
+-        ));
+-    }
+-
+-    DEBUG_CODE_END ();
+-  }
+-
+-  // Raw algorithm (Trng)
+-  if (!EFI_ERROR (GetArmTrngVersion (&MajorRevision, &MinorRevision))) {
+-    CopyMem (
+-      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
+-      &gEfiRngAlgorithmRaw,
+-      sizeof (EFI_RNG_ALGORITHM)
+-      );
+-    mAvailableAlgoArrayCount++;
+-  }
+-
+-  return EFI_SUCCESS;
+-}
+-
+ /** Free mAvailableAlgoArray.
+ **/
+ VOID
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+index 1d0bdef57d..c8e0ee4ae5 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+@@ -28,7 +28,7 @@
+ #
+ # The following information is for reference only and not required by the build tools.
+ #
+-#  VALID_ARCHITECTURES           = IA32 X64 AARCH64
+#  VALID_ARCHITECTURES           = IA32 X64 AARCH64 ARM
+ #
+ 
+ [Sources.common]
+@@ -41,10 +41,16 @@
+   Rand/AesCore.c
+   Rand/AesCore.h
+ 
+-[Sources.AARCH64]
+[Sources.AARCH64, Sources.ARM]
+   ArmRngDxe.c
+   ArmTrng.c
+ 
+[Sources.AARCH64]
+  AArch64/AArch64Algo.c
+
+[Sources.ARM]
+  Arm/ArmAlgo.c
+
+ [Packages]
+   MdeModulePkg/MdeModulePkg.dec
+   MdePkg/MdePkg.dec
+@@ -59,7 +65,7 @@
+   TimerLib
+   RngLib
+ 
+-[LibraryClasses.AARCH64]
+[LibraryClasses.AARCH64, LibraryClasses.ARM]
+   ArmTrngLib
+ 
+ [Guids]
+diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc
+index 9f58cc2333..36493f04ee 100644
+--- a/SecurityPkg/SecurityPkg.dsc
+++ b/SecurityPkg/SecurityPkg.dsc
+@@ -281,7 +281,7 @@
+   SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf
+   SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf
+ 
+-[Components.IA32, Components.X64, Components.AARCH64]
+[Components.IA32, Components.X64, Components.AARCH64, Components.ARM]
+   #
+   # Random Number Generator
+   #
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Add-debug-warning-for-NULL-PcdCpu.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Add-debug-warning-for-NULL-PcdCpu.patch
@ -0,0 +1,58 @@
+From 8b78800fed2a4af7c08eebd20d1bf764e8e10c84 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 25 Jun 2024 22:28:58 -0400
+Subject: [PATCH 10/31] SecurityPkg/RngDxe: Add debug warning for NULL
+ PcdCpuRngSupportedAlgorithm
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [10/31] 66b888e9b1e2be0c79784e02b4821854bd80432d
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+CVE: CVE-2022-45237
+Upstream: Merged
+
+commit 6cdddccf0085cf2929f8ae710515e4e53663dfb2
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Fri Oct 28 17:32:56 2022 +0200
+
+    SecurityPkg/RngDxe: Add debug warning for NULL PcdCpuRngSupportedAlgorithm
+
+    PcdCpuRngSupportedAlgorithm should allow to identify the the algorithm
+    used by the RNDR CPU instruction to generate a random number.
+    Add a debug warning if the Pcd is not set.
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../RandomNumberGenerator/RngDxe/AArch64/RngDxe.c      | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+index c0b0d28d48..a800a85792 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+@@ -67,6 +67,16 @@ GetAvailableAlgorithms (
+       sizeof (EFI_RNG_ALGORITHM)
+       );
+     mAvailableAlgoArrayCount++;
+
+    DEBUG_CODE_BEGIN ();
+    if (IsZeroGuid (PcdGetPtr (PcdCpuRngSupportedAlgorithm))) {
+      DEBUG ((
+        DEBUG_WARN,
+        "PcdCpuRngSupportedAlgorithm should be a non-zero GUID\n"
+        ));
+    }
+
+    DEBUG_CODE_END ();
+   }
+ 
+   // Raw algorithm (Trng)
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Check-before-advertising-Cpu-Rng-.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Check-before-advertising-Cpu-Rng-.patch
@ -0,0 +1,336 @@
+From 5bd27a5a923c8880a06d52fca48e304becbbb8f6 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 25 Jun 2024 22:25:23 -0400
+Subject: [PATCH 08/31] SecurityPkg/RngDxe: Check before advertising Cpu Rng
+ algo
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [8/31] 5417b276749a2d1b1afa9465b5b7a501def26a12
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+CVE: CVE-2022-45237
+Upstream: Merged
+
+commit 4b3e9d80bedf5909a4ec901425ed9c0a738fc76f
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Fri Oct 28 17:32:54 2022 +0200
+
+    SecurityPkg/RngDxe: Check before advertising Cpu Rng algo
+
+    RngGetBytes() relies on the RngLib. The RngLib might use the RNDR
+    instruction if the FEAT_RNG feature is present. RngGetInfo and
+    RngGetRNG both must check that RngGetBytes() is working before
+    advertising/using it.
+
+    To do so, allocate an array storing the available algorithms.
+    The Rng algorithm at the lowest index will be the default Rng
+    algorithm. The array is shared between RngGetInfo and RngGetRNG.
+
+    This array is allocated when the driver is loaded, and freed
+    when unloaded.
+
+    This patch also prevents from having PcdCpuRngSupportedAlgorithm
+    let to a zero GUID, but let the possibility to have no valid Rng
+    algorithm in such case.
+
+    Signed-off-by: Pierre Gondois <Pierre.Gondois@arm.com>
+    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../RngDxe/AArch64/RngDxe.c                   | 87 +++++++++++++++++--
+ .../RngDxe/Rand/RngDxe.c                      | 26 ++++++
+ .../RandomNumberGenerator/RngDxe/RngDxe.c     | 40 ++++++++-
+ .../RandomNumberGenerator/RngDxe/RngDxe.inf   |  1 +
+ .../RngDxe/RngDxeInternals.h                  | 27 ++++++
+ 5 files changed, 172 insertions(+), 9 deletions(-)
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+index 8c6ad4ed43..c9d66d9777 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+@@ -22,11 +22,63 @@
+ 
+ #include <Library/BaseLib.h>
+ #include <Library/BaseMemoryLib.h>
+#include <Library/DebugLib.h>
+#include <Library/MemoryAllocationLib.h>
+ #include <Library/UefiBootServicesTableLib.h>
+#include <Library/RngLib.h>
+ #include <Protocol/Rng.h>
+ 
+ #include "RngDxeInternals.h"
+ 
+// Maximum number of Rng algorithms.
+#define RNG_AVAILABLE_ALGO_MAX  1
+
+/** Allocate and initialize mAvailableAlgoArray with the available
+    Rng algorithms. Also update mAvailableAlgoArrayCount.
+
+  @retval EFI_SUCCESS             The function completed successfully.
+  @retval EFI_OUT_OF_RESOURCES    Could not allocate memory.
+**/
+EFI_STATUS
+EFIAPI
+GetAvailableAlgorithms (
+  VOID
+  )
+{
+  UINT64  DummyRand;
+
+  // Allocate RNG_AVAILABLE_ALGO_MAX entries to avoid evaluating
+  // Rng algorithms 2 times, one for the allocation, one to populate.
+  mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
+  if (mAvailableAlgoArray == NULL) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  // Check RngGetBytes() before advertising PcdCpuRngSupportedAlgorithm.
+  if (!EFI_ERROR (RngGetBytes (sizeof (DummyRand), (UINT8 *)&DummyRand))) {
+    CopyMem (
+      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
+      PcdGetPtr (PcdCpuRngSupportedAlgorithm),
+      sizeof (EFI_RNG_ALGORITHM)
+      );
+    mAvailableAlgoArrayCount++;
+  }
+
+  return EFI_SUCCESS;
+}
+
+/** Free mAvailableAlgoArray.
+**/
+VOID
+EFIAPI
+FreeAvailableAlgorithms (
+  VOID
+  )
+{
+  FreePool (mAvailableAlgoArray);
+  return;
+}
+
+ /**
+   Produces and returns an RNG value using either the default or specified RNG algorithm.
+ 
+@@ -59,6 +111,7 @@ RngGetRNG (
+   )
+ {
+   EFI_STATUS    Status;
+  UINTN       Index;
+ 
+   if ((This == NULL) || (RNGValueLength == 0) || (RNGValue == NULL)) {
+     return EFI_INVALID_PARAMETER;
+@@ -68,9 +121,21 @@ RngGetRNG (
+     //
+     // Use the default RNG algorithm if RNGAlgorithm is NULL.
+     //
+-    RNGAlgorithm = PcdGetPtr (PcdCpuRngSupportedAlgorithm);
+    for (Index = 0; Index < mAvailableAlgoArrayCount; Index++) {
+      if (!IsZeroGuid (&mAvailableAlgoArray[Index])) {
+        RNGAlgorithm = &mAvailableAlgoArray[Index];
+        goto FoundAlgo;
+      }
+    }
+
+    if (Index == mAvailableAlgoArrayCount) {
+      // No algorithm available.
+      ASSERT (Index != mAvailableAlgoArrayCount);
+      return EFI_DEVICE_ERROR;
+    }
+   }
+ 
+FoundAlgo:
+   if (CompareGuid (RNGAlgorithm, PcdGetPtr (PcdCpuRngSupportedAlgorithm))) {
+     Status = RngGetBytes (RNGValueLength, RNGValue);
+     return Status;
+@@ -113,24 +178,30 @@ RngGetInfo (
+   OUT EFI_RNG_ALGORITHM  *RNGAlgorithmList
+   )
+ {
+-  UINTN RequiredSize;
+-  EFI_RNG_ALGORITHM *CpuRngSupportedAlgorithm;
+-
+-  RequiredSize = sizeof (EFI_RNG_ALGORITHM);
+  UINTN  RequiredSize;
+ 
+   if ((This == NULL) || (RNGAlgorithmListSize == NULL)) {
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+  RequiredSize = mAvailableAlgoArrayCount * sizeof (EFI_RNG_ALGORITHM);
+
+  if (RequiredSize == 0) {
+    // No supported algorithms found.
+    return EFI_UNSUPPORTED;
+  }
+
+   if (*RNGAlgorithmListSize < RequiredSize) {
+     *RNGAlgorithmListSize = RequiredSize;
+     return EFI_BUFFER_TOO_SMALL;
+   }
+ 
+-  CpuRngSupportedAlgorithm = PcdGetPtr (PcdCpuRngSupportedAlgorithm);
+-
+-  CopyMem(&RNGAlgorithmList[0], CpuRngSupportedAlgorithm, sizeof (EFI_RNG_ALGORITHM));
+  if (RNGAlgorithmList == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+ 
+  // There is no gap in the array, so copy the block.
+  CopyMem (RNGAlgorithmList, mAvailableAlgoArray, RequiredSize);
+   *RNGAlgorithmListSize = RequiredSize;
+   return EFI_SUCCESS;
+ }
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+index 70b6ac20c9..7caa64a4ff 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+@@ -26,6 +26,32 @@
+ 
+ #include "RngDxeInternals.h"
+ 
+/** Allocate and initialize mAvailableAlgoArray with the available
+    Rng algorithms. Also update mAvailableAlgoArrayCount.
+
+  @retval EFI_SUCCESS             The function completed successfully.
+  @retval EFI_OUT_OF_RESOURCES    Could not allocate memory.
+**/
+EFI_STATUS
+EFIAPI
+GetAvailableAlgorithms (
+  VOID
+  )
+{
+  return EFI_SUCCESS;
+}
+
+/** Free mAvailableAlgoArray.
+**/
+VOID
+EFIAPI
+FreeAvailableAlgorithms (
+  VOID
+  )
+{
+  return;
+}
+
+ /**
+   Produces and returns an RNG value using either the default or specified RNG algorithm.
+ 
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
+index 4599728889..cc2ddfcc06 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
+@@ -27,6 +27,13 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ #include "RngDxeInternals.h"
+ 
+//
+// Array containing the validated Rng algorithm.
+// The entry with the lowest index will be the default algorithm.
+//
+UINTN              mAvailableAlgoArrayCount;
+EFI_RNG_ALGORITHM  *mAvailableAlgoArray;
+
+ //
+ // The Random Number Generator (RNG) protocol
+ //
+@@ -66,8 +73,39 @@ RngDriverEntry (
+                   &mRngRdRand,
+                   NULL
+                   );
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  //
+  // Get the list of available algorithm.
+  //
+  return GetAvailableAlgorithms ();
+}
+
+/**
+  This is the unload handle for RndgDxe module.
+
+  Disconnect the driver specified by ImageHandle from all the devices in the handle database.
+  Uninstall all the protocols installed in the driver entry point.
+ 
+-  return Status;
+  @param[in] ImageHandle           The drivers' driver image.
+
+  @retval    EFI_SUCCESS           The image is unloaded.
+  @retval    Others                Failed to unload the image.
+
+**/
+EFI_STATUS
+EFIAPI
+RngDriverUnLoad (
+  IN EFI_HANDLE  ImageHandle
+  )
+{
+  //
+  // Free the list of available algorithm.
+  //
+  FreeAvailableAlgorithms ();
+  return EFI_SUCCESS;
+ }
+ 
+ 
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+index 60efb5562e..1985dfbb46 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+@@ -22,6 +22,7 @@
+   MODULE_TYPE                    = DXE_DRIVER
+   VERSION_STRING                 = 1.0
+   ENTRY_POINT                    = RngDriverEntry
+  UNLOAD_IMAGE                   = RngDriverUnLoad
+   MODULE_UNI_FILE                = RngDxe.uni
+ 
+ #
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
+index f17adb83fb..0ef5e6522f 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
+@@ -12,6 +12,33 @@
+ 
+ #include <Protocol/Rng.h>
+ 
+//
+// Array containing the validated Rng algorithm.
+// The entry with the lowest index will be the default algorithm.
+//
+extern UINTN              mAvailableAlgoArrayCount;
+extern EFI_RNG_ALGORITHM  *mAvailableAlgoArray;
+
+/** Allocate and initialize mAvailableAlgoArray with the available
+    Rng algorithms. Also update mAvailableAlgoArrayCount.
+
+  @retval EFI_SUCCESS             The function completed successfully.
+  @retval EFI_OUT_OF_RESOURCES    Could not allocate memory.
+**/
+EFI_STATUS
+EFIAPI
+GetAvailableAlgorithms (
+  VOID
+  );
+
+/** Free mAvailableAlgoArray.
+**/
+VOID
+EFIAPI
+FreeAvailableAlgorithms (
+  VOID
+  );
+
+ /**
+   Returns information about the random number generation implementation.
+ 
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Conditionally-install-EFI_RNG_PRO.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Conditionally-install-EFI_RNG_PRO.patch
@ -0,0 +1,79 @@
+From e7444d0b84a8fd41aa63ecb083e65fd56b32fd38 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Sun, 23 Jun 2024 14:21:01 -0400
+Subject: [PATCH 14/31] SecurityPkg/RngDxe: Conditionally install
+ EFI_RNG_PROTOCOL
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [14/31] bc64d4cad6c30353723d674ef9f10eb10aeb1cac
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit 75fb0cfc82376906243386514be0e4067d702117
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Thu Nov 24 17:17:55 2022 +0100
+
+    SecurityPkg/RngDxe: Conditionally install EFI_RNG_PROTOCOL
+
+    On Arm platforms, the number of available RNG algorithms is
+    dynamically detected and can be 0 in the absence of FEAT_RNG
+    and firmware TRNG.
+    In this case, the EFI_RNG_PROTOCOL should not be installed to
+    prevent from installing an empty protocol.
+
+    Signed-off-by: Pierre Gondois <Pierre.Gondois@arm.com>
+    [ardb: return EFI_REQUEST_UNLOAD_IMAGE instead of an error]
+    Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../RandomNumberGenerator/RngDxe/RngDxe.c     | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
+index cc2ddfcc06..55e8dd49d0 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
+@@ -63,6 +63,18 @@ RngDriverEntry (
+   EFI_STATUS    Status;
+   EFI_HANDLE    Handle;
+ 
+  //
+  // Get the list of available algorithm.
+  //
+  Status = GetAvailableAlgorithms ();
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  if (mAvailableAlgoArrayCount == 0) {
+    return EFI_REQUEST_UNLOAD_IMAGE;
+  }
+
+   //
+   // Install UEFI RNG (Random Number Generator) Protocol
+   //
+@@ -74,13 +86,10 @@ RngDriverEntry (
+                   NULL
+                   );
+   if (EFI_ERROR (Status)) {
+-    return Status;
+    FreeAvailableAlgorithms ();
+   }
+ 
+-  //
+-  // Get the list of available algorithm.
+-  //
+-  return GetAvailableAlgorithms ();
+  return Status;
+ }
+ 
+ /**
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Correctly-update-mAvailableAlgoAr.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Correctly-update-mAvailableAlgoAr.patch
@ -0,0 +1,105 @@
+From b9a937603080bfada6c224a6e9da046a8a33f868 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Sun, 23 Jun 2024 14:18:18 -0400
+Subject: [PATCH 13/31] SecurityPkg/RngDxe: Correctly update
+ mAvailableAlgoArrayCount
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [13/31] 3e06e270cad90038537305a4cb7828fcc45251fb
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit bfb574db110899471fe09db819587b3151c7b7b5
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Thu Nov 24 17:17:54 2022 +0100
+
+    SecurityPkg/RngDxe: Correctly update mAvailableAlgoArrayCount
+
+    mAvailableAlgoArrayCount holds the count of available RNG algorithms.
+    In a following patch, its value will be used to prevent the
+    EFI_RNG_PROTOCOL to be installed if no RNG algorithm is available.
+
+    Correctly set/reset the value for all implementations.
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../RandomNumberGenerator/RngDxe/ArmRngDxe.c     |  1 +
+ .../RandomNumberGenerator/RngDxe/Rand/RngDxe.c   | 16 ++++++++++++++--
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+index 5e7d9ef681..0e44d0c931 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+@@ -40,6 +40,7 @@ FreeAvailableAlgorithms (
+   VOID
+   )
+ {
+  mAvailableAlgoArrayCount = 0;
+   FreePool (mAvailableAlgoArray);
+   return;
+ }
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+index 7caa64a4ff..149de875ce 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+@@ -26,6 +26,11 @@
+ 
+ #include "RngDxeInternals.h"
+ 
+//
+// Count of Rng algorithms.
+//
+#define RNG_ALGORITHM_COUNT  2
+
+ /** Allocate and initialize mAvailableAlgoArray with the available
+     Rng algorithms. Also update mAvailableAlgoArrayCount.
+ 
+@@ -38,6 +43,13 @@ GetAvailableAlgorithms (
+   VOID
+   )
+ {
+
+  UINT64  RngTest;
+
+  if (GetRandomNumber64 (&RngTest)) {
+    mAvailableAlgoArrayCount = RNG_ALGORITHM_COUNT;
+  }
+
+   return EFI_SUCCESS;
+ }
+ 
+@@ -49,6 +61,7 @@ FreeAvailableAlgorithms (
+   VOID
+   )
+ {
+  mAvailableAlgoArrayCount = 0;
+   return;
+ }
+ 
+@@ -159,13 +172,12 @@ RngGetInfo (
+   )
+ {
+   UINTN RequiredSize;
+-  EFI_RNG_ALGORITHM *CpuRngSupportedAlgorithm;
+ 
+   if ((This == NULL) || (RNGAlgorithmListSize == NULL)) {
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+-  RequiredSize = 2 * sizeof (EFI_RNG_ALGORITHM);
+  RequiredSize = RNG_ALGORITHM_COUNT * sizeof (EFI_RNG_ALGORITHM);
+ 
+   if (*RNGAlgorithmListSize < RequiredSize) {
+     *RNGAlgorithmListSize = RequiredSize;
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Documentation-include-parameter-c.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Documentation-include-parameter-c.patch
@ -0,0 +1,98 @@
+From 0f8890578f46bc791d007b19dbbfa0dd2805032d Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 25 Jun 2024 22:23:42 -0400
+Subject: [PATCH 07/31] SecurityPkg/RngDxe: Documentation/include/parameter
+ cleanup
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [7/31] 19a0a13d18fc7f92c7b05e8da08f4d83df77ea6c
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+CVE: CVE-2022-45237
+Upstream: Merged
+
+commit 199031b2b0233652ad5d5fdf73f0f44c0f264d55
+Author: Pierre Gondois <Pierre.Gondois@arm.com>
+Date:   Fri Oct 28 17:32:53 2022 +0200
+
+    SecurityPkg/RngDxe: Documentation/include/parameter cleanup
+
+    This patch:
+    -Update RngGetBytes() documentation to align the function
+     definition and declaration.
+    -Improve input parameter checking. Even though 'This'
+     it is not used, the parameter should always point to the
+     current EFI_RNG_PROTOCOL.
+    -Removes TimerLib inclusion as unused.
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c | 3 +--
+ SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c    | 2 +-
+ SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c         | 3 +--
+ 3 files changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+index f6a0bf7b2b..8c6ad4ed43 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+@@ -23,7 +23,6 @@
+ #include <Library/BaseLib.h>
+ #include <Library/BaseMemoryLib.h>
+ #include <Library/UefiBootServicesTableLib.h>
+-#include <Library/TimerLib.h>
+ #include <Protocol/Rng.h>
+ 
+ #include "RngDxeInternals.h"
+@@ -61,7 +60,7 @@ RngGetRNG (
+ {
+   EFI_STATUS    Status;
+ 
+-  if ((RNGValueLength == 0) || (RNGValue == NULL)) {
+  if ((This == NULL) || (RNGValueLength == 0) || (RNGValue == NULL)) {
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+index 5a649ecf24..70b6ac20c9 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+@@ -59,7 +59,7 @@ RngGetRNG (
+ {
+   EFI_STATUS    Status;
+ 
+-  if ((RNGValueLength == 0) || (RNGValue == NULL)) {
+  if ((This == NULL) || (RNGValueLength == 0) || (RNGValue == NULL)) {
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
+index 7b8ecfc70d..4599728889 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
+@@ -23,7 +23,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ #include <Library/BaseMemoryLib.h>
+ #include <Library/UefiBootServicesTableLib.h>
+ #include <Library/RngLib.h>
+-#include <Library/TimerLib.h>
+ #include <Protocol/Rng.h>
+ 
+ #include "RngDxeInternals.h"
+@@ -73,7 +72,7 @@ RngDriverEntry (
+ 
+ 
+ /**
+-  Calls RDRAND to fill a buffer of arbitrary size with random bytes.
+  Runs CPU RNG instruction to fill a buffer of arbitrary size with random bytes.
+ 
+   @param[in]   Length        Size of the buffer, in bytes,  to fill with.
+   @param[out]  RandBuffer    Pointer to the buffer to store the random result.
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Remove-ArchGetSupportedRngAlgorit.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Remove-ArchGetSupportedRngAlgorit.patch
@ -0,0 +1,258 @@
+From df912b4c93cd848991d9a9439d3aba441bae1d67 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 25 Jun 2024 22:21:09 -0400
+Subject: [PATCH 06/31] SecurityPkg/RngDxe: Remove
+ ArchGetSupportedRngAlgorithms()
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [6/31] 4066cb1503b5c5a29b6d45a4b671d0829f2671ae
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+CVE: CVE-2022-45237
+Upstream: Merged
+
+commit 922bf317f1731554b3e77a0a48033a38fdc75a77
+Author: Pierre Gondois <Pierre.Gondois@arm.com>
+Date:   Fri Oct 28 17:32:52 2022 +0200
+
+    SecurityPkg/RngDxe: Remove ArchGetSupportedRngAlgorithms()
+
+    RngGetInfo() is one of the 2 functions of the EFI_RNG_PROTOCOL.
+    RngGetInfo() is currently a mere wrapper around
+    ArchGetSupportedRngAlgorithms() which is implemented differently
+    depending on the architecture used.
+
+    RngGetInfo() does nothing more than calling
+    ArchGetSupportedRngAlgorithms(). So remove it, and let RngGetInfo()
+    be implemented differently according to the architecture.
+
+    This follows the implementation of the other function of the
+    EFI_RNG_PROTOCOL, RngGetRNG().
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../RngDxe/AArch64/RngDxe.c                   | 19 +++++--
+ .../RngDxe/Rand/RngDxe.c                      | 24 ++++++---
+ .../RandomNumberGenerator/RngDxe/RngDxe.c     | 49 -------------------
+ .../RngDxe/RngDxeInternals.h                  | 25 ----------
+ 4 files changed, 33 insertions(+), 84 deletions(-)
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+index 1cdc842966..f6a0bf7b2b 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+@@ -14,6 +14,7 @@
+   Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
+   Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+   (C) Copyright 2015 Hewlett Packard Enterprise Development LP<BR>
+  Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
+ 
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+@@ -85,6 +86,7 @@ RngGetRNG (
+ /**
+   Returns information about the random number generation implementation.
+ 
+  @param[in]     This                 A pointer to the EFI_RNG_PROTOCOL instance.
+   @param[in,out] RNGAlgorithmListSize On input, the size in bytes of RNGAlgorithmList.
+                                       On output with a return code of EFI_SUCCESS, the size
+                                       in bytes of the data returned in RNGAlgorithmList. On output
+@@ -97,14 +99,19 @@ RngGetRNG (
+                                       is the default algorithm for the driver.
+ 
+   @retval EFI_SUCCESS                 The RNG algorithm list was returned successfully.
+  @retval EFI_UNSUPPORTED             The services is not supported by this driver.
+  @retval EFI_DEVICE_ERROR            The list of algorithms could not be retrieved due to a
+                                      hardware or firmware error.
+  @retval EFI_INVALID_PARAMETER       One or more of the parameters are incorrect.
+   @retval EFI_BUFFER_TOO_SMALL        The buffer RNGAlgorithmList is too small to hold the result.
+ 
+ **/
+-UINTN
+EFI_STATUS
+ EFIAPI
+-ArchGetSupportedRngAlgorithms (
+-  IN OUT UINTN                     *RNGAlgorithmListSize,
+-  OUT    EFI_RNG_ALGORITHM         *RNGAlgorithmList
+RngGetInfo (
+  IN EFI_RNG_PROTOCOL    *This,
+  IN OUT UINTN           *RNGAlgorithmListSize,
+  OUT EFI_RNG_ALGORITHM  *RNGAlgorithmList
+   )
+ {
+   UINTN RequiredSize;
+@@ -112,6 +119,10 @@ ArchGetSupportedRngAlgorithms (
+ 
+   RequiredSize = sizeof (EFI_RNG_ALGORITHM);
+ 
+  if ((This == NULL) || (RNGAlgorithmListSize == NULL)) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+   if (*RNGAlgorithmListSize < RequiredSize) {
+     *RNGAlgorithmListSize = RequiredSize;
+     return EFI_BUFFER_TOO_SMALL;
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+index 19755b3bfd..5a649ecf24 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+@@ -104,6 +104,7 @@ RngGetRNG (
+ /**
+   Returns information about the random number generation implementation.
+ 
+  @param[in]     This                 A pointer to the EFI_RNG_PROTOCOL instance.
+   @param[in,out] RNGAlgorithmListSize On input, the size in bytes of RNGAlgorithmList.
+                                       On output with a return code of EFI_SUCCESS, the size
+                                       in bytes of the data returned in RNGAlgorithmList. On output
+@@ -116,19 +117,28 @@ RngGetRNG (
+                                       is the default algorithm for the driver.
+ 
+   @retval EFI_SUCCESS                 The RNG algorithm list was returned successfully.
+  @retval EFI_UNSUPPORTED             No supported algorithms found.
+  @retval EFI_DEVICE_ERROR            The list of algorithms could not be retrieved due to a
+                                      hardware or firmware error.
+  @retval EFI_INVALID_PARAMETER       One or more of the parameters are incorrect.
+   @retval EFI_BUFFER_TOO_SMALL        The buffer RNGAlgorithmList is too small to hold the result.
+ 
+ **/
+-UINTN
+EFI_STATUS
+ EFIAPI
+-ArchGetSupportedRngAlgorithms (
+-  IN OUT UINTN                     *RNGAlgorithmListSize,
+-  OUT    EFI_RNG_ALGORITHM         *RNGAlgorithmList
+RngGetInfo (
+  IN EFI_RNG_PROTOCOL    *This,
+  IN OUT UINTN           *RNGAlgorithmListSize,
+  OUT EFI_RNG_ALGORITHM  *RNGAlgorithmList
+   )
+ {
+   UINTN RequiredSize;
+   EFI_RNG_ALGORITHM *CpuRngSupportedAlgorithm;
+ 
+  if ((This == NULL) || (RNGAlgorithmListSize == NULL)) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+   RequiredSize = 2 * sizeof (EFI_RNG_ALGORITHM);
+ 
+   if (*RNGAlgorithmListSize < RequiredSize) {
+@@ -136,9 +146,11 @@ ArchGetSupportedRngAlgorithms (
+     return EFI_BUFFER_TOO_SMALL;
+   }
+ 
+-  CpuRngSupportedAlgorithm = PcdGetPtr (PcdCpuRngSupportedAlgorithm);
+  if (RNGAlgorithmList == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+ 
+-  CopyMem(&RNGAlgorithmList[0], CpuRngSupportedAlgorithm, sizeof (EFI_RNG_ALGORITHM));
+  CopyMem (&RNGAlgorithmList[0], &gEfiRngAlgorithmSp80090Ctr256Guid, sizeof (EFI_RNG_ALGORITHM));
+ 
+   // x86 platforms also support EFI_RNG_ALGORITHM_RAW via RDSEED
+   CopyMem(&RNGAlgorithmList[1], &gEfiRngAlgorithmRaw, sizeof (EFI_RNG_ALGORITHM));
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
+index b959c70536..7b8ecfc70d 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.c
+@@ -28,55 +28,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ #include "RngDxeInternals.h"
+ 
+-/**
+-  Returns information about the random number generation implementation.
+-
+-  @param[in]     This                 A pointer to the EFI_RNG_PROTOCOL instance.
+-  @param[in,out] RNGAlgorithmListSize On input, the size in bytes of RNGAlgorithmList.
+-                                      On output with a return code of EFI_SUCCESS, the size
+-                                      in bytes of the data returned in RNGAlgorithmList. On output
+-                                      with a return code of EFI_BUFFER_TOO_SMALL,
+-                                      the size of RNGAlgorithmList required to obtain the list.
+-  @param[out] RNGAlgorithmList        A caller-allocated memory buffer filled by the driver
+-                                      with one EFI_RNG_ALGORITHM element for each supported
+-                                      RNG algorithm. The list must not change across multiple
+-                                      calls to the same driver. The first algorithm in the list
+-                                      is the default algorithm for the driver.
+-
+-  @retval EFI_SUCCESS                 The RNG algorithm list was returned successfully.
+-  @retval EFI_UNSUPPORTED             The services is not supported by this driver.
+-  @retval EFI_DEVICE_ERROR            The list of algorithms could not be retrieved due to a
+-                                      hardware or firmware error.
+-  @retval EFI_INVALID_PARAMETER       One or more of the parameters are incorrect.
+-  @retval EFI_BUFFER_TOO_SMALL        The buffer RNGAlgorithmList is too small to hold the result.
+-
+-**/
+-EFI_STATUS
+-EFIAPI
+-RngGetInfo (
+-  IN EFI_RNG_PROTOCOL             *This,
+-  IN OUT UINTN                    *RNGAlgorithmListSize,
+-  OUT EFI_RNG_ALGORITHM           *RNGAlgorithmList
+-  )
+-{
+-  EFI_STATUS    Status;
+-
+-  if ((This == NULL) || (RNGAlgorithmListSize == NULL)) {
+-    return EFI_INVALID_PARAMETER;
+-  }
+-
+-  //
+-  // Return algorithm list supported by driver.
+-  //
+-  if (RNGAlgorithmList != NULL) {
+-    Status = ArchGetSupportedRngAlgorithms (RNGAlgorithmListSize, RNGAlgorithmList);
+-  } else {
+-    Status = EFI_INVALID_PARAMETER;
+-  }
+-
+-  return Status;
+-}
+-
+ //
+ // The Random Number Generator (RNG) protocol
+ //
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
+index fcb8b69153..f17adb83fb 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
+@@ -74,31 +74,6 @@ RngGetRNG (
+   OUT UINT8                      *RNGValue
+   );
+ 
+-/**
+-  Returns information about the random number generation implementation.
+-
+-  @param[in,out] RNGAlgorithmListSize On input, the size in bytes of RNGAlgorithmList.
+-                                      On output with a return code of EFI_SUCCESS, the size
+-                                      in bytes of the data returned in RNGAlgorithmList. On output
+-                                      with a return code of EFI_BUFFER_TOO_SMALL,
+-                                      the size of RNGAlgorithmList required to obtain the list.
+-  @param[out] RNGAlgorithmList        A caller-allocated memory buffer filled by the driver
+-                                      with one EFI_RNG_ALGORITHM element for each supported
+-                                      RNG algorithm. The list must not change across multiple
+-                                      calls to the same driver. The first algorithm in the list
+-                                      is the default algorithm for the driver.
+-
+-  @retval EFI_SUCCESS                 The RNG algorithm list was returned successfully.
+-  @retval EFI_BUFFER_TOO_SMALL        The buffer RNGAlgorithmList is too small to hold the result.
+-
+-**/
+-UINTN
+-EFIAPI
+-ArchGetSupportedRngAlgorithms (
+-  IN OUT UINTN                     *RNGAlgorithmListSize,
+-  OUT    EFI_RNG_ALGORITHM         *RNGAlgorithmList
+-  );
+-
+ /**
+   Runs CPU RNG instruction to fill a buffer of arbitrary size with random bytes.
+ 
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Rename-AArch64-RngDxe.c.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Rename-AArch64-RngDxe.c.patch
@ -0,0 +1,55 @@
+From 05ffe3749d73942cf4df7ed8f53ae239e62d5376 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 25 Jun 2024 22:30:19 -0400
+Subject: [PATCH 11/31] SecurityPkg/RngDxe: Rename AArch64/RngDxe.c
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [11/31] 39c8a7a1e45c7c26f5d16f79d81abac1fbae4f22
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+CVE: CVE-2022-45237
+Upstream: Merged
+
+commit ff29cdb968a1a4d7bd7ab4eba2597a77c0748dc2
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Fri Oct 28 17:32:57 2022 +0200
+
+    SecurityPkg/RngDxe: Rename AArch64/RngDxe.c
+
+    To re-use the AArch64/RngDxe.c for an Arm implementation,
+    rename AArch64/RngDxe.c to ArmRngDxe.c.
+
+    Acked-by: Leif Lindholm <quic_llindhol@quicinc.com>
+    Signed-off-by: Pierre Gondois <Pierre.Gondois@arm.com>
+    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../RngDxe/{AArch64/RngDxe.c => ArmRngDxe.c}                    | 0
+ SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf             | 2 +-
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+ rename SecurityPkg/RandomNumberGenerator/RngDxe/{AArch64/RngDxe.c => ArmRngDxe.c} (100%)
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+similarity index 100%
+rename from SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/RngDxe.c
+rename to SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+index e0e767cbf3..1d0bdef57d 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+@@ -42,7 +42,7 @@
+   Rand/AesCore.h
+ 
+ [Sources.AARCH64]
+-  AArch64/RngDxe.c
+  ArmRngDxe.c
+   ArmTrng.c
+ 
+ [Packages]
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Rename-RdRandGenerateEntropy-to-g.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Rename-RdRandGenerateEntropy-to-g.patch
@ -0,0 +1,176 @@
+From 2a5e4e144cbea46784fde638765a9c9068ed2869 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 25 Jun 2024 22:19:10 -0400
+Subject: [PATCH 05/31] SecurityPkg/RngDxe: Rename RdRandGenerateEntropy to
+ generic name
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [5/31] 12b8646964435f1a70def57afb9f4565b11c5dc8
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+CVE: CVE-2022-45237
+Upstream: Merged
+
+commit 8a89747844a5061791e55a25daedcf895180a794
+Author: Sami Mujawar <sami.mujawar@arm.com>
+Date:   Fri Oct 28 17:32:50 2022 +0200
+
+    SecurityPkg/RngDxe: Rename RdRandGenerateEntropy to generic name
+
+    Bugzilla: 3668 (https://bugzilla.tianocore.org/show_bug.cgi?id=3668)
+
+    Rename RdRandGenerateEntropy() to GenerateEntropy() to provide a
+    common interface to generate entropy on other architectures.
+    GenerateEntropy() is intended to generate high quality entropy.
+
+    Also move the definition to RngDxeInternals.h
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Acked-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../RngDxe/Rand/RdRand.c                      | 20 ++++++++++++-----
+ .../RngDxe/Rand/RngDxe.c                      |  7 ++++--
+ .../RandomNumberGenerator/RngDxe/RngDxe.inf   |  2 +-
+ .../RngDxe/RngDxeInternals.h                  | 22 ++++++++++++++++++-
+ 4 files changed, 41 insertions(+), 10 deletions(-)
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RdRand.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RdRand.c
+index 83025a47d4..853bf43148 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RdRand.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RdRand.c
+@@ -1,15 +1,23 @@
+ /** @file
+-  Support routines for RDRAND instruction access.
+-
+  Support routines for RDRAND instruction access, which will leverage
+  Intel Secure Key technology to provide high-quality random numbers for use
+  in applications, or entropy for seeding other random number generators.
+  Refer to http://software.intel.com/en-us/articles/intel-digital-random-number
+  -generator-drng-software-implementation-guide/ for more information about Intel
+  Secure Key technology.
+
+Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
+ Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+ (C) Copyright 2015 Hewlett Packard Enterprise Development LP<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+ #include <Library/RngLib.h>
+#include <Library/TimerLib.h>
+ 
+ #include "AesCore.h"
+-#include "RdRand.h"
+ #include "RngDxeInternals.h"
+ 
+ /**
+@@ -87,9 +95,9 @@ RdRandGetSeed128 (
+ **/
+ EFI_STATUS
+ EFIAPI
+-RdRandGenerateEntropy (
+-  IN UINTN         Length,
+-  OUT UINT8        *Entropy
+GenerateEntropy (
+  IN UINTN   Length,
+  OUT UINT8  *Entropy
+   )
+ {
+   EFI_STATUS  Status;
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+index 834123b945..19755b3bfd 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+@@ -14,13 +14,16 @@
+    - EFI_RNG_ALGORITHM_X9_31_3DES_GUID        - Unsupported
+    - EFI_RNG_ALGORITHM_X9_31_AES_GUID         - Unsupported
+ 
+  Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
+   Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+   (C) Copyright 2015 Hewlett Packard Enterprise Development LP<BR>
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+ 
+-#include "RdRand.h"
+#include <Library/BaseLib.h>
+#include <Library/BaseMemoryLib.h>
+
+ #include "RngDxeInternals.h"
+ 
+ /**
+@@ -88,7 +91,7 @@ RngGetRNG (
+       return EFI_INVALID_PARAMETER;
+     }
+ 
+-    Status = RdRandGenerateEntropy (RNGValueLength, RNGValue);
+    Status = GenerateEntropy (RNGValueLength, RNGValue);
+     return Status;
+   }
+ 
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+index f330097199..60efb5562e 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+@@ -10,6 +10,7 @@
+ #
+ #  Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+ #  (C) Copyright 2015 Hewlett Packard Enterprise Development LP<BR>
+#  Copyright (c) 2021 - 2022, Arm Limited. All rights reserved.<BR>
+ #  SPDX-License-Identifier: BSD-2-Clause-Patent
+ #
+ ##
+@@ -36,7 +37,6 @@
+ [Sources.IA32, Sources.X64]
+   Rand/RngDxe.c
+   Rand/RdRand.c
+-  Rand/RdRand.h
+   Rand/AesCore.c
+   Rand/AesCore.h
+ 
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
+index 25cccbe92c..fcb8b69153 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxeInternals.h
+@@ -10,6 +10,8 @@
+ #ifndef RNGDXE_INTERNALS_H_
+ #define RNGDXE_INTERNALS_H_
+ 
+#include <Protocol/Rng.h>
+
+ /**
+   Returns information about the random number generation implementation.
+ 
+@@ -114,4 +116,22 @@ RngGetBytes (
+   OUT UINT8        *RandBuffer
+   );
+ 
+-#endif  // RNGDXE_INTERNALS_H_
+/**
+  Generate high-quality entropy source using a TRNG or through RDRAND.
+
+  @param[in]   Length        Size of the buffer, in bytes, to fill with.
+  @param[out]  Entropy       Pointer to the buffer to store the entropy data.
+
+  @retval EFI_SUCCESS        Entropy generation succeeded.
+  @retval EFI_NOT_READY      Failed to request random data.
+
+**/
+EFI_STATUS
+EFIAPI
+GenerateEntropy (
+  IN UINTN   Length,
+  OUT UINT8  *Entropy
+  );
+
+#endif // RNGDXE_INTERNALS_H_
+
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Simplify-Rng-algorithm-selection-.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Simplify-Rng-algorithm-selection-.patch
@ -0,0 +1,78 @@
+From 1a0bf45b088e05f6eb7edaa0d24aec894ea3491b Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 16:11:16 -0400
+Subject: [PATCH 23/31] SecurityPkg/RngDxe: Simplify Rng algorithm selection
+ for Arm
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [23/31] 21b2854eed63bf5d406cfec5ac03b9ae3901a679
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit ff7ddc02b273f9159ef46fdb67d99062f8e598d9
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Fri Aug 11 16:33:10 2023 +0200
+
+    SecurityPkg/RngDxe: Simplify Rng algorithm selection for Arm
+
+    The first element of mAvailableAlgoArray is defined as the default
+    Rng algorithm to use. Don't go through the array at each RngGetRNG()
+    call and just return the first element of the array.
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
+    Acked-by: Ard Biesheuvel <ardb@kernel.org>
+    Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
+    Tested-by: Kun Qin <kun.qin@microsoft.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../RandomNumberGenerator/RngDxe/ArmRngDxe.c    | 17 ++++-------------
+ 1 file changed, 4 insertions(+), 13 deletions(-)
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+index 2fc36fc186..7249904413 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+@@ -77,7 +77,6 @@ RngGetRNG (
+   )
+ {
+   EFI_STATUS  Status;
+-  UINTN       Index;
+   GUID        RngGuid;
+ 
+   if ((This == NULL) || (RNGValueLength == 0) || (RNGValue == NULL)) {
+@@ -88,21 +87,13 @@ RngGetRNG (
+     //
+     // Use the default RNG algorithm if RNGAlgorithm is NULL.
+     //
+-    for (Index = 0; Index < mAvailableAlgoArrayCount; Index++) {
+-      if (!IsZeroGuid (&mAvailableAlgoArray[Index])) {
+-        RNGAlgorithm = &mAvailableAlgoArray[Index];
+-        goto FoundAlgo;
+-      }
+-    }
+-
+-    if (Index == mAvailableAlgoArrayCount) {
+-      // No algorithm available.
+-      ASSERT (Index != mAvailableAlgoArrayCount);
+-      return EFI_DEVICE_ERROR;
+    if (mAvailableAlgoArrayCount != 0) {
+      RNGAlgorithm = &mAvailableAlgoArray[0];
+    } else {
+      return EFI_UNSUPPORTED;
+     }
+   }
+ 
+-FoundAlgo:
+   Status = GetRngGuid (&RngGuid);
+   if (!EFI_ERROR (Status) &&
+       CompareGuid (RNGAlgorithm, &RngGuid))
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-Use-GetRngGuid-when-probing-RngLi.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-Use-GetRngGuid-when-probing-RngLi.patch
@ -0,0 +1,195 @@
+From 6b3795dcecf31b0d8aa7edabeffccf37b7259ff0 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 16:09:46 -0400
+Subject: [PATCH 22/31] SecurityPkg/RngDxe: Use GetRngGuid() when probing
+ RngLib
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [22/31] 17b40bc3daeba2ba8407826e17f3096c4a5151c6
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit 19438cff973bfb35a1ef12fab45fabb28b63fe64
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Fri Aug 11 16:33:09 2023 +0200
+
+    SecurityPkg/RngDxe: Use GetRngGuid() when probing RngLib
+
+    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4151
+
+    The EFI_RNG_PROTOCOL can rely on the RngLib. The RngLib has multiple
+    implementations, some of them are unsafe (e.g. BaseRngLibTimerLib).
+    To allow the RngDxe to detect when such implementation is used,
+    a GetRngGuid() function was added in a previous patch.
+
+    The EFI_RNG_PROTOCOL can advertise multiple algorithms through
+    Guids. The PcdCpuRngSupportedAlgorithm is currently used to
+    advertise the RngLib in the Arm implementation.
+
+    The issues of doing that are:
+    - the RngLib implementation might not use CPU instructions,
+      cf. the BaseRngLibTimerLib
+    - most platforms don't set PcdCpuRngSupportedAlgorithm
+
+    A GetRngGuid() was added to the RngLib in a previous patch,
+    allowing to identify the algorithm implemented by the RngLib.
+    Make use of this function and place the unsage algorithm
+    at the last position in the mAvailableAlgoArray.
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
+    Acked-by: Ard Biesheuvel <ardb@kernel.org>
+    Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
+    Tested-by: Kun Qin <kun.qin@microsoft.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../RngDxe/AArch64/AArch64Algo.c              | 55 +++++++++++++------
+ .../RandomNumberGenerator/RngDxe/ArmRngDxe.c  |  8 ++-
+ .../RandomNumberGenerator/RngDxe/RngDxe.inf   |  4 +-
+ 3 files changed, 45 insertions(+), 22 deletions(-)
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c
+index e8be217f8a..a270441ebb 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/AArch64/AArch64Algo.c
+@@ -10,6 +10,8 @@
+ #include <Library/DebugLib.h>
+ #include <Library/MemoryAllocationLib.h>
+ #include <Library/ArmTrngLib.h>
+#include <Library/RngLib.h>
+#include <Guid/RngAlgorithm.h>
+ 
+ #include "RngDxeInternals.h"
+ 
+@@ -28,9 +30,13 @@ GetAvailableAlgorithms (
+   VOID
+   )
+ {
+-  UINT64  DummyRand;
+-  UINT16  MajorRevision;
+-  UINT16  MinorRevision;
+  EFI_STATUS  Status;
+  UINT16      MajorRevision;
+  UINT16      MinorRevision;
+  GUID        RngGuid;
+  BOOLEAN     UnSafeAlgo;
+
+  UnSafeAlgo = FALSE;
+ 
+   // Rng algorithms 2 times, one for the allocation, one to populate.
+   mAvailableAlgoArray = AllocateZeroPool (RNG_AVAILABLE_ALGO_MAX);
+@@ -38,24 +44,29 @@ GetAvailableAlgorithms (
+     return EFI_OUT_OF_RESOURCES;
+   }
+ 
+-  // Check RngGetBytes() before advertising PcdCpuRngSupportedAlgorithm.
+-  if (!EFI_ERROR (RngGetBytes (sizeof (DummyRand), (UINT8 *)&DummyRand))) {
+-    CopyMem (
+-      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
+-      PcdGetPtr (PcdCpuRngSupportedAlgorithm),
+-      sizeof (EFI_RNG_ALGORITHM)
+-      );
+-    mAvailableAlgoArrayCount++;
+-
+-    DEBUG_CODE_BEGIN ();
+-    if (IsZeroGuid (PcdGetPtr (PcdCpuRngSupportedAlgorithm))) {
+  // Identify RngLib algorithm.
+  Status = GetRngGuid (&RngGuid);
+  if (!EFI_ERROR (Status)) {
+    if (IsZeroGuid (&RngGuid) ||
+        CompareGuid (&RngGuid, &gEdkiiRngAlgorithmUnSafe))
+    {
+      // Treat zero GUID as an unsafe algorithm
+       DEBUG ((
+         DEBUG_WARN,
+-        "PcdCpuRngSupportedAlgorithm should be a non-zero GUID\n"
+        "RngLib uses an Unsafe algorithm and "
+        "must not be used for production builds.\n"
+         ));
+      // Set the UnSafeAlgo flag to indicate an unsafe algorithm was found
+      // so that it can be added at the end of the algorithm list.
+      UnSafeAlgo = TRUE;
+    } else {
+      CopyMem (
+        &mAvailableAlgoArray[mAvailableAlgoArrayCount],
+        &RngGuid,
+        sizeof (RngGuid)
+        );
+      mAvailableAlgoArrayCount++;
+     }
+-
+-    DEBUG_CODE_END ();
+   }
+ 
+   // Raw algorithm (Trng)
+@@ -68,5 +79,15 @@ GetAvailableAlgorithms (
+     mAvailableAlgoArrayCount++;
+   }
+ 
+  // Add unsafe algorithm at the end of the list.
+  if (UnSafeAlgo) {
+    CopyMem (
+      &mAvailableAlgoArray[mAvailableAlgoArrayCount],
+      &gEdkiiRngAlgorithmUnSafe,
+      sizeof (EFI_RNG_ALGORITHM)
+      );
+    mAvailableAlgoArrayCount++;
+  }
+
+   return EFI_SUCCESS;
+ }
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+index 0e44d0c931..2fc36fc186 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/ArmRngDxe.c
+@@ -76,8 +76,9 @@ RngGetRNG (
+   OUT UINT8                      *RNGValue
+   )
+ {
+-  EFI_STATUS    Status;
+  EFI_STATUS  Status;
+   UINTN       Index;
+  GUID        RngGuid;
+ 
+   if ((This == NULL) || (RNGValueLength == 0) || (RNGValue == NULL)) {
+     return EFI_INVALID_PARAMETER;
+@@ -102,7 +103,10 @@ RngGetRNG (
+   }
+ 
+ FoundAlgo:
+-  if (CompareGuid (RNGAlgorithm, PcdGetPtr (PcdCpuRngSupportedAlgorithm))) {
+  Status = GetRngGuid (&RngGuid);
+  if (!EFI_ERROR (Status) &&
+      CompareGuid (RNGAlgorithm, &RngGuid))
+  {
+     Status = RngGetBytes (RNGValueLength, RNGValue);
+     return Status;
+   }
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+index d6c2d30195..8704a64441 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+@@ -75,13 +75,11 @@
+   gEfiRngAlgorithmX9313DesGuid        ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
+   gEfiRngAlgorithmX931AesGuid         ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
+   gEfiRngAlgorithmRaw                 ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
+  gEdkiiRngAlgorithmUnSafe            ## SOMETIMES_PRODUCES    ## GUID        # Unique ID of the algorithm for RNG
+ 
+ [Protocols]
+   gEfiRngProtocolGuid                ## PRODUCES
+ 
+-[Pcd.AARCH64]
+-  gEfiMdePkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm      ## CONSUMES
+-
+ [Depex]
+   TRUE
+ 
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-RngDxe-add-rng-test.patch
+++ b/SOURCES/edk2-SecurityPkg-RngDxe-add-rng-test.patch
@ -0,0 +1,57 @@
+From 5022087de4a4bcd113ef0325e657bd78b798d5f6 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 10:33:43 -0400
+Subject: [PATCH 26/31] SecurityPkg/RngDxe: add rng test
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [26/31] 97c8deefd351f2755cf458f10679dd1d859fb321
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit a61bc0accb8a76edba4f073fdc7bafc908df045d
+Author: Gerd Hoffmann <kraxel@redhat.com>
+Date:   Fri May 31 09:49:13 2024 +0200
+
+    SecurityPkg/RngDxe: add rng test
+
+    Check whenever RngLib actually returns random numbers, only return
+    a non-zero number of Algorithms if that is the case.
+
+    This has the effect that RndDxe loads and installs EFI_RNG_PROTOCOL
+    only in case it can actually deliver random numbers.
+
+    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+
+Check whenever RngLib actually returns random numbers, only return
+a non-zero number of Algorithms if that is the case.
+
+This has the effect that RndDxe loads and installs EFI_RNG_PROTOCOL
+only in case it can actually deliver random numbers.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+index 149de875ce..e374b62208 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+@@ -23,6 +23,7 @@
+ 
+ #include <Library/BaseLib.h>
+ #include <Library/BaseMemoryLib.h>
+#include <Library/RngLib.h>
+ 
+ #include "RngDxeInternals.h"
+ 
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-SecurityPkg.dec-Move-PcdCpuRngSupportedA.patch
+++ b/SOURCES/edk2-SecurityPkg-SecurityPkg.dec-Move-PcdCpuRngSupportedA.patch
@ -0,0 +1,104 @@
+From 1548ea758f7d9d58fd61110f5719cc12786380d3 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 16:01:08 -0400
+Subject: [PATCH 17/31] SecurityPkg/SecurityPkg.dec: Move
+ PcdCpuRngSupportedAlgorithm to MdePkg
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
+RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [17/31] 01f31c97f800f3451072762c0e9a9eb59f1cc2ab
+
+JIRA: https://issues.redhat.com/browse/RHEL-21856
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit 65b5dd828ef2ea5056031b239a4e7a6642f771a3
+Author: Pierre Gondois <pierre.gondois@arm.com>
+Date:   Fri Aug 11 16:33:04 2023 +0200
+
+    SecurityPkg/SecurityPkg.dec: Move PcdCpuRngSupportedAlgorithm to MdePkg
+
+    In order to use PcdCpuRngSupportedAlgorithm in the MdePkg in a
+    following patch and to avoid making the MdePkg dependent on another
+    package, move PcdCpuRngSupportedAlgorithm to the MdePkg.
+
+    As the Pcd is only used for AARCH64, place it in an AARCH64
+    specific sections.
+
+    Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
+    Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
+    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
+    Acked-by: Ard Biesheuvel <ardb@kernel.org>
+    Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
+    Tested-by: Kun Qin <kun.qin@microsoft.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf        | 2 +-
+ MdePkg/MdePkg.dec                                            | 5 +++++
+ SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf          | 4 ++--
+ SecurityPkg/SecurityPkg.dec                                  | 2 --
+ 4 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf b/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+index f857290e82..f729001060 100644
+--- a/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+++ b/MdeModulePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
+@@ -19,7 +19,7 @@
+   INF_VERSION                    = 1.27
+   BASE_NAME                      = BaseRngLibTimerLib
+   MODULE_UNI_FILE                = BaseRngLibTimerLib.uni
+-  FILE_GUID                      = 74950C45-10FC-4AB5-B114-49C87C17409B
+  FILE_GUID                      = B3E66B05-D218-4B9A-AC33-EF0F83D6A513
+   MODULE_TYPE                    = BASE
+   VERSION_STRING                 = 1.0
+   LIBRARY_CLASS                  = RngLib
+diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
+index 6389a48338..8f05e822ac 100644
+--- a/MdePkg/MdePkg.dec
+++ b/MdePkg/MdePkg.dec
+@@ -2306,6 +2306,11 @@
+   # @Prompt Memory Address of GuidedExtractHandler Table.
+   gEfiMdePkgTokenSpaceGuid.PcdGuidedExtractHandlerTableAddress|0x1000000|UINT64|0x30001015
+ 
+[PcdsFixedAtBuild.AARCH64, PcdsPatchableInModule.AARCH64]
+  ## GUID identifying the Rng algorithm implemented by CPU instruction.
+  # @Prompt CPU Rng algorithm's GUID.
+  gEfiMdePkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm|{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}|VOID*|0x00000037
+
+ [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
+   ## This value is used to set the base address of PCI express hierarchy.
+   # @Prompt PCI Express Base Address.
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+index c8e0ee4ae5..d6c2d30195 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
+@@ -79,8 +79,8 @@
+ [Protocols]
+   gEfiRngProtocolGuid                ## PRODUCES
+ 
+-[Pcd]
+-  gEfiSecurityPkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm      ## CONSUMES
+[Pcd.AARCH64]
+  gEfiMdePkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm      ## CONSUMES
+ 
+ [Depex]
+   TRUE
+diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
+index 9f7a032d60..8cf80b1e84 100644
+--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
+@@ -323,8 +323,6 @@
+   gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeFvVerificationPass|0x0303100A|UINT32|0x00010030
+   gEfiSecurityPkgTokenSpaceGuid.PcdStatusCodeFvVerificationFail|0x0303100B|UINT32|0x00010031
+ 
+-  gEfiSecurityPkgTokenSpaceGuid.PcdCpuRngSupportedAlgorithm|{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}|VOID*|0x00010032
+-
+ [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
+   ## Image verification policy for OptionRom. Only following values are valid:<BR><BR>
+   #  NOTE: Do NOT use 0x5 and 0x2 since it violates the UEFI specification and has been removed.<BR>
+-- 
+2.39.3
+
--- a/SOURCES/edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpm2.patch
+++ b/SOURCES/edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpm2.patch
@ -0,0 +1,584 @@
+From e138f66708415704ad1133938c0dce5243795656 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 13 Feb 2024 16:30:10 -0500
+Subject: [PATCH 04/17] SecurityPkg: Support CcMeasurementProtocol in
+ DxeTpm2MeasureBootLib
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 44: edk2: heap buffer overflow in Tcg2MeasureGptTable()
+RH-Jira: RHEL-21154 RHEL-21156
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [4/13] 8038fb605dbdaccfd40cb9d9d56db559ee9df639 (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21154
+CVE: CVE-2022-36763
+Upstream: Merged
+Conflicts: Only cosmetic, due to the uncrustify changes made
+           in the newer version.
+
+commit a124cd4ef92a349a6c823ea6701fcfd3a17db255
+Author: Min Xu <min.m.xu@intel.com>
+Date:   Sat Dec 11 21:08:41 2021 +0800
+
+    SecurityPkg: Support CcMeasurementProtocol in DxeTpm2MeasureBootLib
+
+    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3625
+
+    DxeTpm2MeasureBootLib supports TPM2 based measure boot. After
+    CcMeasurementProtocol is introduced, CC based measure boot needs to
+    be supported in DxeTpm2MeasureBootLib as well.
+
+    There are 2 major changes in this commit.
+
+    1. A platform should have only one RTS/RTR. Only one of (virtual)TPM1.2,
+    (virtual)TPM2.0 and CC MR exists. Then only one TCG_SERVICE_PROTOCOL,
+    TCG2_PROTOCOL, CC_MEASUREMENT_PROTOCOL is exposed. In this library when
+    do measure boot only one of TCG2_PROTOCOL / CC_MEASUREMENT_PROTOCOL
+    will be called. MEASURE_BOOT_PROTOCOLS is defined to store the instances
+    of TCG2 protocol and CC Measurement protocol.
+
+    2. CcEvent is similar to Tcg2Event except the MrIndex and PcrIndex.
+    So in the code Tcg2Event will be first created and intialized. If
+    CcMeasurementProtocol is called to do the measure boot, then CcEvent
+    points to Tcg2Event and the MrIndex is adjusted.
+
+    Cc: Michael D Kinney <michael.d.kinney@intel.com>
+    Cc: Liming Gao <gaoliming@byosoft.com.cn>
+    Cc: Zhiguang Liu <zhiguang.liu@intel.com>
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+    Cc: Jian J Wang <jian.j.wang@intel.com>
+    Cc: Sami Mujawar <sami.mujawar@arm.com>
+    Cc: Gerd Hoffmann <kraxel@redhat.com>
+    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
+    Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+    Signed-off-by: Min Xu <min.m.xu@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeTpm2MeasureBootLib.c                   | 347 ++++++++++++++----
+ .../DxeTpm2MeasureBootLib.inf                 |   3 +-
+ 2 files changed, 271 insertions(+), 79 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+index 95682ac567..7abacdbc0a 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+@@ -1,5 +1,6 @@
+ /** @file
+-  The library instance provides security service of TPM2 measure boot.
+  The library instance provides security service of TPM2 measure boot and
+  Confidential Computing (CC) measure boot.
+ 
+   Caution: This file requires additional review when modified.
+   This library will have external input - PE/COFF image and GPT partition.
+@@ -41,6 +42,12 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ #include <Library/PeCoffLib.h>
+ #include <Library/SecurityManagementLib.h>
+ #include <Library/HobLib.h>
+#include <Protocol/CcMeasurement.h>
+
+typedef struct {
+   EFI_TCG2_PROTOCOL              *Tcg2Protocol;
+   EFI_CC_MEASUREMENT_PROTOCOL    *CcProtocol;
+} MEASURE_BOOT_PROTOCOLS;
+ 
+ //
+ // Flag to check GPT partition. It only need be measured once.
+@@ -109,7 +116,7 @@ DxeTpm2MeasureBootLibImageRead (
+   Caution: This function may receive untrusted input.
+   The GPT partition table is external input, so this function should parse partition data carefully.
+ 
+-  @param Tcg2Protocol            Pointer to the located TCG2 protocol instance.
+  @param MeasureBootProtocols    Pointer to the located MeasureBoot protocol instances (i.e. TCG2/CC protocol).
+   @param GptHandle               Handle that GPT partition was installed.
+ 
+   @retval EFI_SUCCESS            Successfully measure GPT table.
+@@ -121,26 +128,48 @@ DxeTpm2MeasureBootLibImageRead (
+ EFI_STATUS
+ EFIAPI
+ Tcg2MeasureGptTable (
+-  IN  EFI_TCG2_PROTOCOL  *Tcg2Protocol,
+-  IN  EFI_HANDLE         GptHandle
+  IN  MEASURE_BOOT_PROTOCOLS  *MeasureBootProtocols,
+  IN  EFI_HANDLE              GptHandle
+   )
+ {
+-  EFI_STATUS                        Status;
+-  EFI_BLOCK_IO_PROTOCOL             *BlockIo;
+-  EFI_DISK_IO_PROTOCOL              *DiskIo;
+-  EFI_PARTITION_TABLE_HEADER        *PrimaryHeader;
+-  EFI_PARTITION_ENTRY               *PartitionEntry;
+-  UINT8                             *EntryPtr;
+-  UINTN                             NumberOfPartition;
+-  UINT32                            Index;
+-  EFI_TCG2_EVENT                    *Tcg2Event;
+-  EFI_GPT_DATA                      *GptData;
+-  UINT32                            EventSize;
+  EFI_STATUS                   Status;
+  EFI_BLOCK_IO_PROTOCOL        *BlockIo;
+  EFI_DISK_IO_PROTOCOL         *DiskIo;
+  EFI_PARTITION_TABLE_HEADER   *PrimaryHeader;
+  EFI_PARTITION_ENTRY          *PartitionEntry;
+  UINT8                        *EntryPtr;
+  UINTN                        NumberOfPartition;
+  UINT32                       Index;
+  UINT8                        *EventPtr;
+  EFI_TCG2_EVENT               *Tcg2Event;
+  EFI_CC_EVENT                 *CcEvent;
+  EFI_GPT_DATA                 *GptData;
+  UINT32                       EventSize;
+  EFI_TCG2_PROTOCOL            *Tcg2Protocol;
+  EFI_CC_MEASUREMENT_PROTOCOL  *CcProtocol;
+  EFI_CC_MR_INDEX              MrIndex;
+ 
+   if (mTcg2MeasureGptCount > 0) {
+     return EFI_SUCCESS;
+   }
+ 
+  PrimaryHeader = NULL;
+  EntryPtr      = NULL;
+  EventPtr      = NULL;
+
+  Tcg2Protocol = MeasureBootProtocols->Tcg2Protocol;
+  CcProtocol   = MeasureBootProtocols->CcProtocol;
+
+  if ((Tcg2Protocol == NULL) && (CcProtocol == NULL)) {
+    ASSERT (FALSE);
+    return EFI_UNSUPPORTED;
+  }
+
+  if (sizeof (EFI_CC_EVENT) != sizeof (EFI_TCG2_EVENT)) {
+    ASSERT (FALSE);
+    return EFI_UNSUPPORTED;
+  }
+
+   Status = gBS->HandleProtocol (GptHandle, &gEfiBlockIoProtocolGuid, (VOID**)&BlockIo);
+   if (EFI_ERROR (Status)) {
+     return EFI_UNSUPPORTED;
+@@ -168,6 +197,16 @@ Tcg2MeasureGptTable (
+     FreePool (PrimaryHeader);
+     return EFI_DEVICE_ERROR;
+   }
+
+  //
+  // PrimaryHeader->SizeOfPartitionEntry should not be zero
+  //
+  if (PrimaryHeader->SizeOfPartitionEntry == 0) {
+    DEBUG ((DEBUG_ERROR, "SizeOfPartitionEntry should not be zero!\n"));
+    FreePool (PrimaryHeader);
+    return EFI_BAD_BUFFER_SIZE;
+  }
+
+   //
+   // Read the partition entry.
+   //
+@@ -202,11 +241,17 @@ Tcg2MeasureGptTable (
+   }
+ 
+   //
+-  // Prepare Data for Measurement
+  // Prepare Data for Measurement (CcProtocol and Tcg2Protocol)
+   //
+   EventSize = (UINT32)(sizeof (EFI_GPT_DATA) - sizeof (GptData->Partitions)
+                         + NumberOfPartition * PrimaryHeader->SizeOfPartitionEntry);
+-  Tcg2Event = (EFI_TCG2_EVENT *) AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Event->Event));
+  EventPtr = (UINT8 *)AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event));
+  if (EventPtr == NULL) {
+    Status = EFI_OUT_OF_RESOURCES;
+    goto Exit;
+  }
+
+  Tcg2Event                       = (EFI_TCG2_EVENT *)EventPtr;
+   if (Tcg2Event == NULL) {
+     FreePool (PrimaryHeader);
+     FreePool (EntryPtr);
+@@ -243,22 +288,66 @@ Tcg2MeasureGptTable (
+   }
+ 
+   //
+-  // Measure the GPT data
+  // Only one of TCG2_PROTOCOL or CC_MEASUREMENT_PROTOCOL is exposed.
+  // So Measure the GPT data with one of the protocol.
+   //
+-  Status = Tcg2Protocol->HashLogExtendEvent (
+-             Tcg2Protocol,
+-             0,
+-             (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData,
+-             (UINT64) EventSize,
+-             Tcg2Event
+-             );
+-  if (!EFI_ERROR (Status)) {
+-    mTcg2MeasureGptCount++;
+  if (CcProtocol != NULL) {
+    //
+    // EFI_CC_EVENT share the same data structure with EFI_TCG2_EVENT
+    // except the MrIndex and PCRIndex in Header.
+    // Tcg2Event has been created and initialized before. So only the MrIndex need
+    // be adjusted.
+    //
+    Status = CcProtocol->MapPcrToMrIndex (CcProtocol, Tcg2Event->Header.PCRIndex, &MrIndex);
+    if (EFI_ERROR (Status)) {
+      DEBUG ((DEBUG_ERROR, "Cannot map PcrIndex(%d) to MrIndex\n", Tcg2Event->Header.PCRIndex));
+      goto Exit;
+    }
+
+    CcEvent                 = (EFI_CC_EVENT *)EventPtr;
+    CcEvent->Header.MrIndex = MrIndex;
+    Status                  = CcProtocol->HashLogExtendEvent (
+                                            CcProtocol,
+                                            0,
+                                            (EFI_PHYSICAL_ADDRESS)(UINTN)(VOID *)GptData,
+                                            (UINT64)EventSize,
+                                            CcEvent
+                                            );
+    if (!EFI_ERROR (Status)) {
+      mTcg2MeasureGptCount++;
+    }
+
+    DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Cc MeasureGptTable - %r\n", Status));
+  } else if (Tcg2Protocol != NULL) {
+    //
+    // If Tcg2Protocol is installed, then Measure GPT data with this protocol.
+    //
+    Status = Tcg2Protocol->HashLogExtendEvent (
+                             Tcg2Protocol,
+                             0,
+                             (EFI_PHYSICAL_ADDRESS)(UINTN)(VOID *)GptData,
+                             (UINT64)EventSize,
+                             Tcg2Event
+                             );
+    if (!EFI_ERROR (Status)) {
+      mTcg2MeasureGptCount++;
+    }
+
+    DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2 MeasureGptTable - %r\n", Status));
+   }
+ 
+-  FreePool (PrimaryHeader);
+-  FreePool (EntryPtr);
+-  FreePool (Tcg2Event);
+Exit:
+  if (PrimaryHeader != NULL) {
+    FreePool (PrimaryHeader);
+  }
+
+  if (EntryPtr != NULL) {
+    FreePool (EntryPtr);
+  }
+
+  if (EventPtr != NULL) {
+    FreePool (EventPtr);
+  }
+ 
+   return Status;
+ }
+@@ -271,12 +360,12 @@ Tcg2MeasureGptTable (
+   PE/COFF image is external input, so this function will validate its data structure
+   within this image buffer before use.
+ 
+-  @param[in] Tcg2Protocol   Pointer to the located TCG2 protocol instance.
+-  @param[in] ImageAddress   Start address of image buffer.
+-  @param[in] ImageSize      Image size
+-  @param[in] LinkTimeBase   Address that the image is loaded into memory.
+-  @param[in] ImageType      Image subsystem type.
+-  @param[in] FilePath       File path is corresponding to the input image.
+  @param[in] MeasureBootProtocols   Pointer to the located MeasureBoot protocol instances.
+  @param[in] ImageAddress           Start address of image buffer.
+  @param[in] ImageSize              Image size
+  @param[in] LinkTimeBase           Address that the image is loaded into memory.
+  @param[in] ImageType              Image subsystem type.
+  @param[in] FilePath               File path is corresponding to the input image.
+ 
+   @retval EFI_SUCCESS            Successfully measure image.
+   @retval EFI_OUT_OF_RESOURCES   No enough resource to measure image.
+@@ -287,7 +376,7 @@ Tcg2MeasureGptTable (
+ EFI_STATUS
+ EFIAPI
+ Tcg2MeasurePeImage (
+-  IN  EFI_TCG2_PROTOCOL         *Tcg2Protocol,
+  IN  MEASURE_BOOT_PROTOCOLS    *MeasureBootProtocols,
+   IN  EFI_PHYSICAL_ADDRESS      ImageAddress,
+   IN  UINTN                     ImageSize,
+   IN  UINTN                     LinkTimeBase,
+@@ -295,26 +384,46 @@ Tcg2MeasurePeImage (
+   IN  EFI_DEVICE_PATH_PROTOCOL  *FilePath
+   )
+ {
+-  EFI_STATUS                        Status;
+-  EFI_TCG2_EVENT                    *Tcg2Event;
+-  EFI_IMAGE_LOAD_EVENT              *ImageLoad;
+-  UINT32                            FilePathSize;
+-  UINT32                            EventSize;
+  EFI_STATUS                   Status;
+  EFI_TCG2_EVENT               *Tcg2Event;
+  EFI_IMAGE_LOAD_EVENT         *ImageLoad;
+  UINT32                       FilePathSize;
+  UINT32                       EventSize;
+  EFI_CC_EVENT                 *CcEvent;
+  EFI_CC_MEASUREMENT_PROTOCOL  *CcProtocol;
+  EFI_TCG2_PROTOCOL            *Tcg2Protocol;
+  UINT8                        *EventPtr;
+  EFI_CC_MR_INDEX              MrIndex;
+
+  Status    = EFI_UNSUPPORTED;
+  ImageLoad = NULL;
+  EventPtr  = NULL;
+
+  Tcg2Protocol = MeasureBootProtocols->Tcg2Protocol;
+  CcProtocol   = MeasureBootProtocols->CcProtocol;
+
+  if ((Tcg2Protocol == NULL) && (CcProtocol == NULL)) {
+    ASSERT (FALSE);
+    return EFI_UNSUPPORTED;
+  }
+
+  if (sizeof (EFI_CC_EVENT) != sizeof (EFI_TCG2_EVENT)) {
+    ASSERT (FALSE);
+    return EFI_UNSUPPORTED;
+  }
+ 
+-  Status        = EFI_UNSUPPORTED;
+-  ImageLoad     = NULL;
+   FilePathSize  = (UINT32) GetDevicePathSize (FilePath);
+ 
+   //
+   // Determine destination PCR by BootPolicy
+   //
+   EventSize = sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
+-  Tcg2Event = AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Event->Event));
+-  if (Tcg2Event == NULL) {
+  EventPtr  = AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event));
+  if (EventPtr == NULL) {
+     return EFI_OUT_OF_RESOURCES;
+   }
+ 
+-  Tcg2Event->Size = EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Event->Event);
+  Tcg2Event                       = (EFI_TCG2_EVENT *)EventPtr;
+   Tcg2Event->Header.HeaderSize    = sizeof(EFI_TCG2_EVENT_HEADER);
+   Tcg2Event->Header.HeaderVersion = EFI_TCG2_EVENT_HEADER_VERSION;
+   ImageLoad           = (EFI_IMAGE_LOAD_EVENT *) Tcg2Event->Event;
+@@ -352,13 +461,35 @@ Tcg2MeasurePeImage (
+   //
+   // Log the PE data
+   //
+-  Status = Tcg2Protocol->HashLogExtendEvent (
+-             Tcg2Protocol,
+-             PE_COFF_IMAGE,
+-             ImageAddress,
+-             ImageSize,
+-             Tcg2Event
+-             );
+  if (CcProtocol != NULL) {
+    Status = CcProtocol->MapPcrToMrIndex (CcProtocol, Tcg2Event->Header.PCRIndex, &MrIndex);
+    if (EFI_ERROR (Status)) {
+      DEBUG ((DEBUG_ERROR, "Cannot map PcrIndex(%d) to MrIndex\n", Tcg2Event->Header.PCRIndex));
+      goto Finish;
+    }
+
+    CcEvent                 = (EFI_CC_EVENT *)EventPtr;
+    CcEvent->Header.MrIndex = MrIndex;
+
+    Status = CcProtocol->HashLogExtendEvent (
+                           CcProtocol,
+                           PE_COFF_IMAGE,
+                           ImageAddress,
+                           ImageSize,
+                           CcEvent
+                           );
+    DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Cc MeasurePeImage - %r\n", Status));
+  } else if (Tcg2Protocol != NULL) {
+    Status = Tcg2Protocol->HashLogExtendEvent (
+                             Tcg2Protocol,
+                             PE_COFF_IMAGE,
+                             ImageAddress,
+                             ImageSize,
+                             Tcg2Event
+                             );
+    DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2 MeasurePeImage - %r\n", Status));
+  }
+
+   if (Status == EFI_VOLUME_FULL) {
+     //
+     // Volume full here means the image is hashed and its result is extended to PCR.
+@@ -369,11 +500,77 @@ Tcg2MeasurePeImage (
+   }
+ 
+ Finish:
+-  FreePool (Tcg2Event);
+  if (EventPtr != NULL) {
+    FreePool (EventPtr);
+  }
+ 
+   return Status;
+ }
+ 
+/**
+  Get the measure boot protocols.
+
+  There are 2 measure boot, TCG2 protocol based and Cc measurement protocol based.
+
+  @param  MeasureBootProtocols  Pointer to the located measure boot protocol instances.
+
+  @retval EFI_SUCCESS           Sucessfully locate the measure boot protocol instances (at least one instance).
+  @retval EFI_UNSUPPORTED       Measure boot is not supported.
+**/
+EFI_STATUS
+EFIAPI
+GetMeasureBootProtocols (
+  MEASURE_BOOT_PROTOCOLS  *MeasureBootProtocols
+  )
+{
+  EFI_STATUS                        Status;
+  EFI_TCG2_PROTOCOL                 *Tcg2Protocol;
+  EFI_CC_MEASUREMENT_PROTOCOL       *CcProtocol;
+  EFI_TCG2_BOOT_SERVICE_CAPABILITY  Tcg2ProtocolCapability;
+  EFI_CC_BOOT_SERVICE_CAPABILITY    CcProtocolCapability;
+
+  CcProtocol = NULL;
+  Status     = gBS->LocateProtocol (&gEfiCcMeasurementProtocolGuid, NULL, (VOID **)&CcProtocol);
+  if (EFI_ERROR (Status)) {
+    //
+    // Cc Measurement protocol is not installed.
+    //
+    DEBUG ((DEBUG_VERBOSE, "CcMeasurementProtocol is not installed. - %r\n", Status));
+  } else {
+    ZeroMem (&CcProtocolCapability, sizeof (CcProtocolCapability));
+    CcProtocolCapability.Size = sizeof (CcProtocolCapability);
+    Status                    = CcProtocol->GetCapability (CcProtocol, &CcProtocolCapability);
+    if (EFI_ERROR (Status) || (CcProtocolCapability.CcType.Type == EFI_CC_TYPE_NONE)) {
+      DEBUG ((DEBUG_ERROR, " CcProtocol->GetCapability returns : %x, %r\n", CcProtocolCapability.CcType.Type, Status));
+      CcProtocol = NULL;
+    }
+  }
+
+  Tcg2Protocol = NULL;
+  Status       = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **)&Tcg2Protocol);
+  if (EFI_ERROR (Status)) {
+    //
+    // Tcg2 protocol is not installed. So, TPM2 is not present.
+    //
+    DEBUG ((DEBUG_VERBOSE, "Tcg2Protocol is not installed. - %r\n", Status));
+  } else {
+    Tcg2ProtocolCapability.Size = (UINT8)sizeof (Tcg2ProtocolCapability);
+    Status                      = Tcg2Protocol->GetCapability (Tcg2Protocol, &Tcg2ProtocolCapability);
+    if (EFI_ERROR (Status) || (!Tcg2ProtocolCapability.TPMPresentFlag)) {
+      //
+      // TPM device doesn't work or activate.
+      //
+      DEBUG ((DEBUG_ERROR, "TPMPresentFlag=FALSE %r\n", Status));
+      Tcg2Protocol = NULL;
+    }
+  }
+
+  MeasureBootProtocols->Tcg2Protocol = Tcg2Protocol;
+  MeasureBootProtocols->CcProtocol   = CcProtocol;
+
+  return (Tcg2Protocol == NULL && CcProtocol == NULL) ? EFI_UNSUPPORTED : EFI_SUCCESS;
+}
+
+ /**
+   The security handler is used to abstract platform-specific policy
+   from the DXE core response to an attempt to use a file that returns a
+@@ -422,9 +619,8 @@ DxeTpm2MeasureBootHandler (
+   IN  BOOLEAN                          BootPolicy
+   )
+ {
+-  EFI_TCG2_PROTOCOL                   *Tcg2Protocol;
+  MEASURE_BOOT_PROTOCOLS              MeasureBootProtocols;
+   EFI_STATUS                          Status;
+-  EFI_TCG2_BOOT_SERVICE_CAPABILITY    ProtocolCapability;
+   EFI_DEVICE_PATH_PROTOCOL            *DevicePathNode;
+   EFI_DEVICE_PATH_PROTOCOL            *OrigDevicePathNode;
+   EFI_HANDLE                          Handle;
+@@ -435,29 +631,25 @@ DxeTpm2MeasureBootHandler (
+   EFI_PHYSICAL_ADDRESS                FvAddress;
+   UINT32                              Index;
+ 
+-  Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &Tcg2Protocol);
+  MeasureBootProtocols.Tcg2Protocol = NULL;
+  MeasureBootProtocols.CcProtocol   = NULL;
+
+  Status = GetMeasureBootProtocols (&MeasureBootProtocols);
+
+   if (EFI_ERROR (Status)) {
+     //
+-    // Tcg2 protocol is not installed. So, TPM2 is not present.
+    // None of Measured boot protocols (Tcg2, Cc) is installed.
+     // Don't do any measurement, and directly return EFI_SUCCESS.
+     //
+-    DEBUG ((DEBUG_VERBOSE, "DxeTpm2MeasureBootHandler - Tcg2 - %r\n", Status));
+    DEBUG ((DEBUG_INFO, "None of Tcg2Protocol/CcMeasurementProtocol is installed.\n"));
+     return EFI_SUCCESS;
+   }
+-
+-  ProtocolCapability.Size = (UINT8) sizeof (ProtocolCapability);
+-  Status = Tcg2Protocol->GetCapability (
+-                           Tcg2Protocol,
+-                           &ProtocolCapability
+-                           );
+-  if (EFI_ERROR (Status) || (!ProtocolCapability.TPMPresentFlag)) {
+-    //
+-    // TPM device doesn't work or activate.
+-    //
+-    DEBUG ((DEBUG_ERROR, "DxeTpm2MeasureBootHandler (%r) - TPMPresentFlag - %x\n", Status, ProtocolCapability.TPMPresentFlag));
+-    return EFI_SUCCESS;
+-  }
+-
+  DEBUG ((
+    DEBUG_INFO,
+    "Tcg2Protocol = %p, CcMeasurementProtocol = %p\n",
+    MeasureBootProtocols.Tcg2Protocol,
+    MeasureBootProtocols.CcProtocol
+    ));
+   //
+   // Copy File Device Path
+   //
+@@ -502,8 +694,8 @@ DxeTpm2MeasureBootHandler (
+             //
+             // Measure GPT disk.
+             //
+-            Status = Tcg2MeasureGptTable (Tcg2Protocol, Handle);
+-            DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2MeasureGptTable - %r\n", Status));
+            Status = Tcg2MeasureGptTable (&MeasureBootProtocols, Handle);
+
+             if (!EFI_ERROR (Status)) {
+               //
+               // GPT disk check done.
+@@ -647,14 +839,13 @@ DxeTpm2MeasureBootHandler (
+     // Measure PE image into TPM log.
+     //
+     Status = Tcg2MeasurePeImage (
+-               Tcg2Protocol,
+               &MeasureBootProtocols,
+                (EFI_PHYSICAL_ADDRESS) (UINTN) FileBuffer,
+                FileSize,
+                (UINTN) ImageContext.ImageAddress,
+                ImageContext.ImageType,
+                DevicePathNode
+                );
+-    DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2MeasurePeImage - %r\n", Status));
+   }
+ 
+   //
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf
+index 2506abbe7c..6dca79a20c 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf
+@@ -1,5 +1,5 @@
+ ## @file
+-#  Provides security service for TPM 2.0 measured boot
+#  Provides security service for TPM 2.0 measured boot and Confidential Computing measure boot.
+ #
+ #  Spec Compliance Info:
+ #    "TCG PC Client Platform Firmware Profile Specification for TPM Family 2.0 Level 00 Revision 1.03 v51"
+@@ -61,6 +61,7 @@
+ 
+ [Protocols]
+   gEfiTcg2ProtocolGuid                  ## SOMETIMES_CONSUMES
+  gEfiCcMeasurementProtocolGuid         ## SOMETIMES_CONSUMES
+   gEfiFirmwareVolumeBlockProtocolGuid   ## SOMETIMES_CONSUMES
+   gEfiBlockIoProtocolGuid               ## SOMETIMES_CONSUMES
+   gEfiDiskIoProtocolGuid                ## SOMETIMES_CONSUMES
+-- 
+2.41.0
+
--- a/SOURCES/edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpmM.patch
+++ b/SOURCES/edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpmM.patch
@ -0,0 +1,255 @@
+From a35a08c5c8d9308ba2b63a15a40e4ddc3e265dbd Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 13 Feb 2024 16:30:10 -0500
+Subject: [PATCH 05/17] SecurityPkg: Support CcMeasurementProtocol in
+ DxeTpmMeasurementLib
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 44: edk2: heap buffer overflow in Tcg2MeasureGptTable()
+RH-Jira: RHEL-21154 RHEL-21156
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [5/13] fa844740ca589cabb52ae7dfa0dd329315dc168f (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21154
+CVE: CVE-2022-36763
+Upstream: Merged
+Conflicts: Only cosmetic, due to the uncrustify changes made
+           in the newer version.
+
+commit 314ff1dc8c9a9597280b50e44a5c861cb6a58517 (HEAD -> CVE-2022-36763_RHEL-21154_rhel-8.10.0)
+Author: Min Xu <min.m.xu@intel.com>
+Date:   Sat Dec 11 21:08:42 2021 +0800
+
+    SecurityPkg: Support CcMeasurementProtocol in DxeTpmMeasurementLib
+
+    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3625
+
+    DxeTpmMeasurementLib supports TPM based measurement in DXE phase.
+    After CcMeasurementProtocol is introduced, CC based measurement needs
+    to be supported in DxeTpmMeasurementLib as well.
+
+    A platform should have only one RTS/RTR. Only one of (virtual)TPM1.2,
+    (virtual)TPM2.0 and CC MR exists. Then only one TCG_SERVICE_PROTOCOL,
+    TCG2_PROTOCOL, CC_MEASUREMENT_PROTOCOL is exposed.
+
+    In this library when do measurement only one of above 3 protocols will
+    be called.
+
+    Cc: Michael D Kinney <michael.d.kinney@intel.com>
+    Cc: Liming Gao <gaoliming@byosoft.com.cn>
+    Cc: Zhiguang Liu <zhiguang.liu@intel.com>
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+    Cc: Jian J Wang <jian.j.wang@intel.com>
+    Cc: Sami Mujawar <sami.mujawar@arm.com>
+    Cc: Gerd Hoffmann <kraxel@redhat.com>
+    Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
+    Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+    Signed-off-by: Min Xu <min.m.xu@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeTpmMeasurementLib.c                    | 122 +++++++++++++++---
+ .../DxeTpmMeasurementLib.inf                  |   9 +-
+ 2 files changed, 111 insertions(+), 20 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c
+index 061136ee78..802bc3c3cd 100644
+--- a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c
+++ b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.c
+@@ -1,5 +1,6 @@
+ /** @file
+-  This library is used by other modules to measure data to TPM.
+  This library is used by other modules to measure data to TPM and Confidential
+  Computing (CC) measure registers.
+ 
+ Copyright (c) 2012 - 2018, Intel Corporation. All rights reserved. <BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+@@ -19,6 +20,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ #include <Guid/Acpi.h>
+ #include <IndustryStandard/Acpi.h>
+#include <Protocol/CcMeasurement.h>
+ 
+ 
+ 
+@@ -37,6 +39,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+   @retval EFI_OUT_OF_RESOURCES  Out of memory.
+   @retval EFI_DEVICE_ERROR      The operation was unsuccessful.
+ **/
+STATIC
+ EFI_STATUS
+ Tpm12MeasureAndLogData (
+   IN UINT32             PcrIndex,
+@@ -103,6 +106,7 @@ Tpm12MeasureAndLogData (
+   @retval EFI_OUT_OF_RESOURCES  Out of memory.
+   @retval EFI_DEVICE_ERROR      The operation was unsuccessful.
+ **/
+STATIC
+ EFI_STATUS
+ Tpm20MeasureAndLogData (
+   IN UINT32             PcrIndex,
+@@ -149,6 +153,73 @@ Tpm20MeasureAndLogData (
+   return Status;
+ }
+ 
+/**
+  Cc measure and log data, and extend the measurement result into a
+  specific CC MR.
+
+  @param[in]  CcProtocol       Instance of CC measurement protocol
+  @param[in]  PcrIndex         PCR Index.
+  @param[in]  EventType        Event type.
+  @param[in]  EventLog         Measurement event log.
+  @param[in]  LogLen           Event log length in bytes.
+  @param[in]  HashData         The start of the data buffer to be hashed, extended.
+  @param[in]  HashDataLen      The length, in bytes, of the buffer referenced by HashData
+
+  @retval EFI_SUCCESS           Operation completed successfully.
+  @retval EFI_UNSUPPORTED       CC guest not available.
+  @retval EFI_OUT_OF_RESOURCES  Out of memory.
+  @retval EFI_DEVICE_ERROR      The operation was unsuccessful.
+  @retval EFI_INVALID_PARAMETER The input parameter is invalid.
+**/
+STATIC
+EFI_STATUS
+CcMeasureAndLogData (
+  IN EFI_CC_MEASUREMENT_PROTOCOL  *CcProtocol,
+  IN UINT32                       PcrIndex,
+  IN UINT32                       EventType,
+  IN VOID                         *EventLog,
+  IN UINT32                       LogLen,
+  IN VOID                         *HashData,
+  IN UINT64                       HashDataLen
+  )
+{
+  EFI_STATUS       Status;
+  EFI_CC_EVENT     *EfiCcEvent;
+  EFI_CC_MR_INDEX  MrIndex;
+
+  if (CcProtocol == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  Status = CcProtocol->MapPcrToMrIndex (CcProtocol, PcrIndex, &MrIndex);
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  EfiCcEvent = (EFI_CC_EVENT *)AllocateZeroPool (LogLen + sizeof (EFI_CC_EVENT));
+  if (EfiCcEvent == NULL) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  EfiCcEvent->Size                 = (UINT32)LogLen + sizeof (EFI_CC_EVENT) - sizeof (EfiCcEvent->Event);
+  EfiCcEvent->Header.HeaderSize    = sizeof (EFI_CC_EVENT_HEADER);
+  EfiCcEvent->Header.HeaderVersion = EFI_CC_EVENT_HEADER_VERSION;
+  EfiCcEvent->Header.MrIndex       = MrIndex;
+  EfiCcEvent->Header.EventType     = EventType;
+  CopyMem (&EfiCcEvent->Event[0], EventLog, LogLen);
+
+  Status = CcProtocol->HashLogExtendEvent (
+                         CcProtocol,
+                         0,
+                         (EFI_PHYSICAL_ADDRESS)(UINTN)HashData,
+                         HashDataLen,
+                         EfiCcEvent
+                         );
+  FreePool (EfiCcEvent);
+
+  return Status;
+}
+
+ /**
+   Tpm measure and log data, and extend the measurement result into a specific PCR.
+ 
+@@ -175,25 +246,16 @@ TpmMeasureAndLogData (
+   IN UINT64             HashDataLen
+   )
+ {
+-  EFI_STATUS  Status;
+-
+-  //
+-  // Try to measure using Tpm20 protocol
+-  //
+-  Status = Tpm20MeasureAndLogData(
+-             PcrIndex,
+-             EventType,
+-             EventLog,
+-             LogLen,
+-             HashData,
+-             HashDataLen
+-             );
+  EFI_STATUS                   Status;
+  EFI_CC_MEASUREMENT_PROTOCOL  *CcProtocol;
+ 
+-  if (EFI_ERROR (Status)) {
+  Status = gBS->LocateProtocol (&gEfiCcMeasurementProtocolGuid, NULL, (VOID **)&CcProtocol);
+  if (!EFI_ERROR (Status)) {
+     //
+-    // Try to measure using Tpm1.2 protocol
+    // Try to measure using Cc measurement protocol
+     //
+-    Status = Tpm12MeasureAndLogData(
+    Status = CcMeasureAndLogData (
+               CcProtocol,
+                PcrIndex,
+                EventType,
+                EventLog,
+@@ -201,6 +263,32 @@ TpmMeasureAndLogData (
+                HashData,
+                HashDataLen
+                );
+  } else {
+    //
+    // Try to measure using Tpm20 protocol
+    //
+    Status = Tpm20MeasureAndLogData (
+               PcrIndex,
+               EventType,
+               EventLog,
+               LogLen,
+               HashData,
+               HashDataLen
+               );
+
+    if (EFI_ERROR (Status)) {
+      //
+      // Try to measure using Tpm1.2 protocol
+      //
+      Status = Tpm12MeasureAndLogData (
+                 PcrIndex,
+                 EventType,
+                 EventLog,
+                 LogLen,
+                 HashData,
+                 HashDataLen
+                 );
+    }
+   }
+ 
+   return Status;
+diff --git a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf
+index 7d41bc41f9..3af3d4e33b 100644
+--- a/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf
+++ b/SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf
+@@ -1,5 +1,7 @@
+ ## @file
+-#  Provides TPM measurement functions for TPM1.2 and TPM 2.0
+#  Provides below measurement functions:
+#    1. TPM measurement functions for TPM1.2 and TPM 2.0
+#    2. Confidential Computing (CC) measurement functions
+ #
+ #  This library provides TpmMeasureAndLogData() to measure and log data, and
+ #  extend the measurement result into a specific PCR.
+@@ -40,5 +42,6 @@
+   UefiBootServicesTableLib
+ 
+ [Protocols]
+-  gEfiTcgProtocolGuid           ## SOMETIMES_CONSUMES
+-  gEfiTcg2ProtocolGuid          ## SOMETIMES_CONSUMES
+  gEfiTcgProtocolGuid               ## SOMETIMES_CONSUMES
+  gEfiTcg2ProtocolGuid              ## SOMETIMES_CONSUMES
+  gEfiCcMeasurementProtocolGuid     ## SOMETIMES_CONSUMES
+-- 
+2.41.0
+
--- a/SOURCES/edk2-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch
+++ b/SOURCES/edk2-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch
@ -0,0 +1,84 @@
+From fa892c7112cfb5aa742f358544da3788a831e431 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 13 Feb 2024 16:30:10 -0500
+Subject: [PATCH 13/17] SecurityPkg: : Updating SecurityFixes.yaml after symbol
+ rename
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 44: edk2: heap buffer overflow in Tcg2MeasureGptTable()
+RH-Jira: RHEL-21154 RHEL-21156
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [13/13] 3bf59dbb583b67eddb54361781054cc650398309 (jmaloy/jons_fork)
+
+JIRA: https://issues.redhat.com/browse/RHEL-21156
+CVE: CVE-2022-36764
+Upstream: Merged
+
+commit 264636d8e6983e0f6dc6be2fca9d84ec81315954
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Wed Jan 17 14:47:22 2024 -0800
+
+    SecurityPkg: : Updating SecurityFixes.yaml after symbol rename
+
+    Adding the new commit titles for the symbol renames
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+    Cc: Rahul Kumar <rahul1.kumar@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Message-Id: <5e0e851e97459e183420178888d4fcdadc2f1ae1.1705529990.git.doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ SecurityPkg/SecurityFixes.yaml | 31 ++++++++++++++++++++++++++-----
+ 1 file changed, 26 insertions(+), 5 deletions(-)
+
+diff --git a/SecurityPkg/SecurityFixes.yaml b/SecurityPkg/SecurityFixes.yaml
+index f9e3e7be74..dc1bb83489 100644
+--- a/SecurityPkg/SecurityFixes.yaml
+++ b/SecurityPkg/SecurityFixes.yaml
+@@ -9,14 +9,35 @@ CVE_2022_36763:
+     - "SecurityPkg: DxeTpm2Measurement: SECURITY PATCH 4117 - CVE 2022-36763"
+     - "SecurityPkg: DxeTpmMeasurement: SECURITY PATCH 4117 - CVE 2022-36763"
+     - "SecurityPkg: : Adding CVE 2022-36763 to SecurityFixes.yaml"
+    - "SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117/4118 symbol rename"
+    - "SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117/4118 symbol rename"
+    - "SecurityPkg: : Updating SecurityFixes.yaml after symbol rename"
+   cve: CVE-2022-36763
+   date_reported: 2022-10-25 11:31 UTC
+   description: (CVE-2022-36763) - Heap Buffer Overflow in Tcg2MeasureGptTable()
+   note: This patch is related to and supersedes TCBZ2168
+   files_impacted:
+-  - Library\DxeTpm2MeasureBootLib\DxeTpm2MeasureBootLib.c
+-  - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
+    - Library\DxeTpm2MeasureBootLib\DxeTpm2MeasureBootLib.c
+    - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
+   links:
+-  - https://bugzilla.tianocore.org/show_bug.cgi?id=4117
+-  - https://bugzilla.tianocore.org/show_bug.cgi?id=2168
+-  - https://bugzilla.tianocore.org/show_bug.cgi?id=1990
+    - https://bugzilla.tianocore.org/show_bug.cgi?id=4117
+    - https://bugzilla.tianocore.org/show_bug.cgi?id=2168
+    - https://bugzilla.tianocore.org/show_bug.cgi?id=1990
+CVE_2022_36764:
+  commit_titles:
+    - "SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764"
+    - "SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764"
+    - "SecurityPkg: : Adding CVE 2022-36764 to SecurityFixes.yaml"
+    - "SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117/4118 symbol rename"
+    - "SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117/4118 symbol rename"
+    - "SecurityPkg: : Updating SecurityFixes.yaml after symbol rename"
+  cve: CVE-2022-36764
+  date_reported: 2022-10-25 12:23 UTC
+  description: Heap Buffer Overflow in Tcg2MeasurePeImage()
+  note:
+  files_impacted:
+    - Library\DxeTpm2MeasureBootLib\DxeTpm2MeasureBootLib.c
+    - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
+  links:
+    - https://bugzilla.tianocore.org/show_bug.cgi?id=4118
+
+-- 
+2.41.0
+
--- a/SOURCES/edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch
+++ b/SOURCES/edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch
@ -0,0 +1,150 @@
+From 155eceaf831492dcd77172833350072e4156e1c9 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 5 Mar 2024 16:38:49 -0500
+Subject: [PATCH 2/2] StandaloneMmPkg/Hob: Integer Overflow in CreateHob()
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 66: EmbeddedPkg/Hob: Integer Overflow in CreateHob()
+RH-Jira: RHEL-21158
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [2/2] be7ee11a65a56faec07c249a35940cf9b95b9ec1
+
+JIRA: https://issues.redhat.com/browse/RHEL-21158
+CVE: CVE-2022-36765
+Upstream: Merged
+
+commit 9a75b030cf27d2530444e9a2f9f11867f79bf679
+Author: Gua Guo <gua.guo@intel.com>
+Date:   Thu Jan 11 13:03:26 2024 +0800
+
+    StandaloneMmPkg/Hob: Integer Overflow in CreateHob()
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
+
+    Fix integer overflow in various CreateHob instances.
+    Fixes: CVE-2022-36765
+
+    The CreateHob() function aligns the requested size to 8
+    performing the following operation:
+    ```
+    HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
+    ```
+
+    No checks are performed to ensure this value doesn't
+    overflow, and could lead to CreateHob() returning a smaller
+    HOB than requested, which could lead to OOB HOB accesses.
+
+    Reported-by: Marc Beatove <mbeatove@google.com>
+    Reviewed-by: Ard Biesheuvel <ardb+tianocore@kernel.org>
+    Cc: Sami Mujawar <sami.mujawar@arm.com>
+    Reviewed-by: Ray Ni <ray.ni@intel.com>
+    Cc: John Mathew <john.mathews@intel.com>
+    Authored-by: Gerd Hoffmann <kraxel@redhat.com>
+    Signed-off-by: Gua Guo <gua.guo@intel.com>
+
+ Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../Arm/StandaloneMmCoreHobLib.c              | 37 ++++++++++++++++++-
+ 1 file changed, 36 insertions(+), 1 deletion(-)
+
+diff --git a/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c b/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c
+index 0ec2d4ad6f..3b13249e33 100644
+--- a/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c
+++ b/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c
+@@ -34,6 +34,13 @@ CreateHob (
+ 
+   HandOffHob = GetHobList ();
+ 
+  //
+  // Check Length to avoid data overflow.
+  //
+  if (HobLength > MAX_UINT16 - 0x7) {
+    return NULL;
+  }
+
+   HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
+ 
+   FreeMemory = HandOffHob->EfiFreeMemoryTop - HandOffHob->EfiFreeMemoryBottom;
+@@ -87,6 +94,10 @@ BuildModuleHob (
+           ((ModuleLength & (EFI_PAGE_SIZE - 1)) == 0));
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION_MODULE));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   CopyGuid (&(Hob->MemoryAllocationHeader.Name), &gEfiHobMemoryAllocModuleGuid);
+   Hob->MemoryAllocationHeader.MemoryBaseAddress = MemoryAllocationModule;
+@@ -127,6 +138,9 @@ BuildResourceDescriptorHob (
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_RESOURCE_DESCRIPTOR, sizeof (EFI_HOB_RESOURCE_DESCRIPTOR));
+   ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   Hob->ResourceType      = ResourceType;
+   Hob->ResourceAttribute = ResourceAttribute;
+@@ -164,7 +178,12 @@ BuildGuidHob (
+   //
+   ASSERT (DataLength <= (0xffff - sizeof (EFI_HOB_GUID_TYPE)));
+ 
+-  Hob = CreateHob (EFI_HOB_TYPE_GUID_EXTENSION, (UINT16) (sizeof (EFI_HOB_GUID_TYPE) + DataLength));
+  Hob = CreateHob (EFI_HOB_TYPE_GUID_EXTENSION, (UINT16)(sizeof (EFI_HOB_GUID_TYPE) + DataLength));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return NULL;
+  }
+
+   CopyGuid (&Hob->Name, Guid);
+   return Hob + 1;
+ }
+@@ -225,6 +244,10 @@ BuildFvHob (
+   EFI_HOB_FIRMWARE_VOLUME  *Hob;
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_FV, sizeof (EFI_HOB_FIRMWARE_VOLUME));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   Hob->BaseAddress = BaseAddress;
+   Hob->Length      = Length;
+@@ -255,6 +278,10 @@ BuildFv2Hob (
+   EFI_HOB_FIRMWARE_VOLUME2  *Hob;
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_FV2, sizeof (EFI_HOB_FIRMWARE_VOLUME2));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   Hob->BaseAddress = BaseAddress;
+   Hob->Length      = Length;
+@@ -283,6 +310,10 @@ BuildCpuHob (
+   EFI_HOB_CPU  *Hob;
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_CPU, sizeof (EFI_HOB_CPU));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   Hob->SizeOfMemorySpace = SizeOfMemorySpace;
+   Hob->SizeOfIoSpace     = SizeOfIoSpace;
+@@ -318,6 +349,10 @@ BuildMemoryAllocationHob (
+           ((Length & (EFI_PAGE_SIZE - 1)) == 0));
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION));
+  ASSERT (Hob != NULL);
+  if (Hob == NULL) {
+    return;
+  }
+ 
+   ZeroMem (&(Hob->AllocDescriptor.Name), sizeof (EFI_GUID));
+   Hob->AllocDescriptor.MemoryBaseAddress = BaseAddress;
+-- 
+2.39.3
+
--- a/SOURCES/edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
+++ b/SOURCES/edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
@ -0,0 +1,49 @@
+From c32f4994552ea5835cf00ce06f2f7d88c71249e5 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 28 Feb 2023 15:47:00 +0100
+Subject: [PATCH] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
+
+RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
+RH-MergeRequest: 29: UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
+RH-Bugzilla: 2150267
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
+RH-Commit: [1/1] e7e332ac0e6edf207b1b9692f2e1aed4a1fe7c0c
+
+In case the number of CPUs can in increase beyond 255
+due to CPU hotplug choose x2apic mode.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ UefiCpuPkg/Library/MpInitLib/MpLib.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
+index b9a06747ed..177d15ab5b 100644
+--- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
+++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
+@@ -495,7 +495,9 @@ CollectProcessorCount (
+   //
+   // Enable x2APIC mode if
+   //  1. Number of CPU is greater than 255; or
+-  //  2. There are any logical processors reporting an Initial APIC ID of 255 or greater.
+  //  2. The platform exposed the exact *boot* CPU count to us in advance, and
+  //     more than 255 logical processors are possible later, with hotplug; or
+  //  3. There are any logical processors reporting an Initial APIC ID of 255 or greater.
+   //
+   X2Apic = FALSE;
+   if (CpuMpData->CpuCount > 255) {
+@@ -503,6 +505,10 @@ CollectProcessorCount (
+     // If there are more than 255 processor found, force to enable X2APIC
+     //
+     X2Apic = TRUE;
+  } else if ((PcdGet32 (PcdCpuBootLogicalProcessorNumber) > 0) &&
+             (PcdGet32 (PcdCpuMaxLogicalProcessorNumber) > 255))
+  {
+    X2Apic = TRUE;
+   } else {
+     CpuInfoInHob = (CPU_INFO_IN_HOB *) (UINTN) CpuMpData->CpuInfoInHob;
+     for (Index = 0; Index < CpuMpData->CpuCount; Index++) {
+-- 
+2.37.3
+
--- a/SOURCES/edk2-ovmf-cc.json
+++ b/SOURCES/edk2-ovmf-cc.json
@ -18,6 +18,7 @@
        {
            "architecture": "x86_64",
            "machines": [
+                "pc-q35-rhel8.6.0",
                "pc-q35-rhel8.5.0"
            ]
        }
--- a/SOURCES/ovmf-vars-generator
+++ b/SOURCES/ovmf-vars-generator
@ -46,6 +46,7 @@ def generate_qemu_cmd(args, readonly, *extra_args):
        args.qemu_binary,
        '-machine', machinetype,
        '-display', 'none',
+        '-no-reboot',
        '-no-user-config',
        '-nodefaults',
        '-m', '768',
@ -104,20 +105,18 @@ def enroll_keys(args):
        stdout=subprocess.PIPE,
        stderr=subprocess.STDOUT)
    logging.info('Performing enrollment')
-    # Wait until the UEFI shell starts (first line is printed)
-    read = p.stdout.readline()
-    if b'char device redirected' in read:
-        read = p.stdout.readline()
-    # Skip passed QEMU warnings, like the following one we see in Ubuntu:
-    # qemu-system-x86_64: warning: TCG doesn't support requested feature: CPUID.01H:ECX.vmx [bit 5]
-    while b'qemu-system-x86_64: warning:' in read:
+
+    while True:
        read = p.stdout.readline()
        if args.print_output:
            print(strip_special(read), end='')
            print()
-    # Send the escape char to enter the UEFI shell early
-    p.stdin.write(b'\x1b')
-    p.stdin.flush()
+        # due to line buffering this actually waits until the 5 sec
+        # delay is over and the efi shell is ready to accept input.
+        if b'Press' in read:
+            break
+
+    #
    # And then run the following three commands from the UEFI shell:
    # change into the first file system device; install the default
    # keys and certificates, and reboot
@ -127,11 +126,13 @@ def enroll_keys(args):
    p.stdin.flush()
    while True:
        read = p.stdout.readline()
-        if args.print_output:
+        if args.print_output and len(read):
            print('OUT: %s' % strip_special(read), end='')
            print()
        if b'info: success' in read:
            break
+        elif b'Reset with <null string>' in read:
+            break
    p.wait()
    if args.print_output:
        print(strip_special(p.stdout.read()), end='')
@ -157,7 +158,7 @@ def test_keys(args):
        logging.info('Performing verification')
        while True:
            read = p.stdout.readline()
-            if args.print_output:
+            if args.print_output and len(read):
                print('OUT: %s' % strip_special(read), end='')
                print()
            if b'Secure boot disabled' in read:
@ -212,9 +213,9 @@ def parse_args():
                        help='Fedora version to get kernel for checking',
                        default='27')
    parser.add_argument('--kernel-url', help='Kernel URL',
-                        default='https://download.fedoraproject.org/pub/fedora'
-                                '/linux/releases/%(version)s/Everything/x86_64'
-                                '/os/images/pxeboot/vmlinuz')
+                        default='https://archives.fedoraproject.org/pub'
+                                '/archive/fedora/linux/releases/%(version)s'
+                                '/Everything/x86_64/os/images/pxeboot/vmlinuz')
    parser.add_argument('--disable-smm',
                        help=('Don\'t restrict varstore pflash writes to '
                              'guest code that executes in SMM. Use this '
--- a/SPECS/edk2.spec
+++ b/SPECS/edk2.spec
@ -7,7 +7,7 @@ ExclusiveArch: x86_64 aarch64

 Name:       edk2
 Version:    %{GITDATE}git%{GITCOMMIT}
-Release:    4%{?dist}
+Release:    13%{?dist}.8
 Summary:    UEFI firmware for 64-bit virtual machines
 Group:      Applications/Emulators
 License:    BSD-2-Clause-Patent and OpenSSL and MIT
@ -19,7 +19,7 @@ URL:        http://www.tianocore.org
 # | xz -9ev >/tmp/edk2-$COMMIT.tar.xz
 Source0: http://batcave.lab.eng.brq.redhat.com/www/edk2-%{GITCOMMIT}.tar.xz
 Source1: ovmf-whitepaper-c770f8c.txt
-Source2: openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
+Source2: openssl-rhel-cf317b2bb227899cb2e761b9163210f62cab1b1e.tar.xz
 Source3: ovmf-vars-generator
 Source4: LICENSE.qosb
 Source5: RedHatSecureBootPkKek1.pem
@ -56,6 +56,346 @@ Patch27: edk2-OvmfPkg-AmdSev-SecretPei-Mark-SEV-launch-secret-area.patch
 # For bz#2164558 - CVE-2023-0215 edk2: openssl: use-after-free following BIO_new_NDEF [rhel-8]
 # For bz#2164581 - CVE-2022-4450 edk2: openssl: double free after calling PEM_read_bio_ex [rhel-8]
 Patch28: edk2-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch
+# For bz#1861743 - CVE-2019-14560 edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() [rhel-8]
+Patch29: edk2-SecurityPkg-DxeImageVerificationLib-Check-result-of-.patch
+# For bz#2150267 - ovmf must consider max cpu count not boot cpu count for apic mode [rhel-8]
+Patch30: edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch31: edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariableG.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch32: edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variables.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch33: edk2-OvmfPkg-VirtNorFlashDxe-clone-ArmPlatformPkg-s-NOR-f.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch34: edk2-OvmfPkg-VirtNorFlashDxe-remove-CheckBlockLocked-feat.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch35: edk2-OvmfPkg-VirtNorFlashDxe-remove-disk-I-O-protocol-imp.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch36: edk2-OvmfPkg-VirtNorFlashDxe-drop-block-I-O-protocol-impl.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch37: edk2-OvmfPkg-VirtNorFlashDxe-avoid-array-mode-switch-afte.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch38: edk2-OvmfPkg-VirtNorFlashDxe-avoid-switching-between-mode.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch39: edk2-OvmfPkg-VirtNorFlashDxe-use-EFI_MEMORY_WC-and-drop-A.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch40: edk2-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch41: edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariable2.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch42:  edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variable2.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch43: edk2-OvmfPkg-VirtNorFlashDxe-add-casts-to-UINTN-and-UINT3.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch44: edk2-OvmfPkg-VirtNorFlashDxe-clarify-block-write-logic-fi.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch45: edk2-OvmfPkg-VirtNorFlashDxe-add-a-loop-for-NorFlashWrite.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch46: edk2-OvmfPkg-VirtNorFlashDxe-allow-larger-writes-without-.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch47: edk2-OvmfPkg-VirtNorFlashDxe-ValidateFvHeader-unwritten-s.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch48: edk2-OvmfPkg-VirtNorFlashDxe-move-DoErase-code-block-into.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch49: edk2-ArmVirtPkg-ArmVirtQemu-migrate-to-OVMF-s-VirtNorFlas.patch
+# For RHEL-17587 - [rhel8] guest fails to boot due to ASSERT error
+Patch50: edk2-OvmfPkg-clone-NorFlashPlatformLib-into-VirtNorFlashP.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch51: edk2-SecurityPkg-Change-use-of-EFI_D_-to-DEBUG_.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch52: edk2-SecurityPkg-Change-OPTIONAL-keyword-usage-style.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch53: edk2-MdePkg-Introduce-CcMeasurementProtocol-for-CC-Guest-.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch54: edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpm2.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch55: edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpmM.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch56: edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch57: edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch58: edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch59: edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-418.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch60: edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch61: edk2-SecurityPkg-DxeTpm2MeasureBootLib-SEC-PATCH-4118-2.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch62: edk2-SecurityPkg-DxeTpmMeasureBootLib-SEC-PATCH-4117-2.patch
+# For RHEL-21154 - CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8]
+# For RHEL-21156 - CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8]
+Patch63: edk2-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21842 - CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-8]
+Patch64: edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21842 - CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-8]
+Patch65: edk2-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21842 - CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-8]
+Patch66: edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21842 - CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-8]
+Patch67: edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch68: edk2-Apply-uncrustify-changes-to-.c-.h-files-in-the-Netwo.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch69: edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch70: edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch71: edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch72: edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch73: edk2-NetworkPkg-Apply-uncrustify-changes.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch74: edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch75: edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch76: edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch77: edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch78: edk2-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch79: edk2-NetworkPkg-Apply-uncrustify-changes-p2.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch80: edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch81: edk2-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch
+# For RHEL-21840 - CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21844 - CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8]
+# For RHEL-21846 - CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8]
+# For RHEL-21848 - CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8]
+# For RHEL-21850 - CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8]
+# For RHEL-21852 - CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8]
+Patch82: edk2-NetworkPkg-Dhcp6Dxe-Packet-Length-is-not-updated-bef.patch
+# For RHEL-21158 - CVE-2022-36765 edk2: integer overflow in CreateHob() could lead to HOB OOB R/W [rhel-8]
+Patch83: edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch
+# For RHEL-21158 - CVE-2022-36765 edk2: integer overflow in CreateHob() could lead to HOB OOB R/W [rhel-8]
+Patch84: edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch85: edk2-MdeModulePkg-Change-use-of-EFI_D_-to-DEBUG_.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch86: edk2-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch87: edk2-MdePkg-Apply-uncrustify-changes.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch88: edk2-NetworkPkg-Apply-uncrustify-changes.p2.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch89: edk2-SecurityPkg-RngDxe-Rename-RdRandGenerateEntropy-to-g.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch90: edk2-SecurityPkg-RngDxe-Remove-ArchGetSupportedRngAlgorit.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch91: edk2-SecurityPkg-RngDxe-Documentation-include-parameter-c.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch92: edk2-SecurityPkg-RngDxe-Check-before-advertising-Cpu-Rng-.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch93: edk2-SecurityPkg-RngDxe-Add-AArch64-RawAlgorithm-support-.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch94: edk2-SecurityPkg-RngDxe-Add-debug-warning-for-NULL-PcdCpu.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch95: edk2-SecurityPkg-RngDxe-Rename-AArch64-RngDxe.c.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch96: edk2-SecurityPkg-RngDxe-Add-Arm-support-of-RngDxe.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch97: edk2-SecurityPkg-RngDxe-Correctly-update-mAvailableAlgoAr.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch98: edk2-SecurityPkg-RngDxe-Conditionally-install-EFI_RNG_PRO.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch99: edk2-MdeModulePkg-Duplicate-BaseRngLibTimerLib-to-MdeModu.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch100: edk2-MdePkg-Add-deprecated-warning-to-BaseRngLibTimer.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch101: edk2-SecurityPkg-SecurityPkg.dec-Move-PcdCpuRngSupportedA.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch102: edk2-MdePkg-DxeRngLib-Request-raw-algorithm-instead-of-de.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch103: edk2-MdePkg-Rng-Add-GUID-to-describe-Arm-Rndr-Rng-algorit.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch104: edk2-MdeModulePkg-Rng-Add-GUID-to-describe-unsafe-Rng-alg.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch105: edk2-MdePkg-Rng-Add-GetRngGuid-to-RngLib.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch106: edk2-SecurityPkg-RngDxe-Use-GetRngGuid-when-probing-RngLi.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch107: edk2-SecurityPkg-RngDxe-Simplify-Rng-algorithm-selection-.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch108: edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch109: edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch110: edk2-SecurityPkg-RngDxe-add-rng-test.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch111: edk2-OvmfPkg-wire-up-RngDxe.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch112: edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch113: edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch114: edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch
+# For RHEL-21854 - CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8]
+# For RHEL-21856 - CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8]
+# For RHEL-40099 - CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z]
+Patch115: edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch
+# For RHEL-53009 - No http boot support on edk2-ovmf-20231122-6.el9_4.2 [rhel-8.10.z]
+Patch116: edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch
+# For RHEL-60830 - CVE-2024-38796 edk2: Integer overflows in PeCoffLoaderRelocateImage [rhel-8.10.z]
+Patch117: edk2-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch
+# For RHEL-66236 - [Regression] HTTP Boot not working on old vCPU without virtio-rng device present [rhel-8.10]
+Patch118: edk2-OvmfPkg-Add-a-Fallback-RNG-RH-only.patch
+# For RHEL-66236 - [Regression] HTTP Boot not working on old vCPU without virtio-rng device present [rhel-8.10]
+Patch119: edk2-OvmfPkg-ArmVirtPkg-Add-a-Fallback-RNG-RH-only.patch
+# For RHEL-66188 - [Regression] HTTP Boot fails to work with edk2-ovmf-20231122-6.el9_4.2 and greater [rhel-8.10]
+Patch120: edk2-OvmfPkg-Rerun-dispatcher-after-initializing-virtio-r.patch
+# For RHEL-71687 - [Regression] HTTP boot not available [aarch64] [rhel-8.10.z]
+Patch121: edk2-ArmVirtPkg-Add-Hash2DxeCrypto-to-ArmVirtPkg.patch


 # python3-devel and libuuid-devel are required for building tools.
@ -202,6 +542,8 @@ sed \
  %{SOURCE5} \
  > PkKek1.oemstr

+# Hack to ensure git lock is removed before chmod starts to not fail
+sleep 5
 # Done by %setup, but we do not use it for the auxiliary tarballs
 chmod -Rf a+rX,u+w,g-w,o-w .

@ -500,6 +842,188 @@ true
 %endif

 %changelog
+* Mon Jan 06 2025 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-13.el8.8
+- edk2-ArmVirtPkg-Add-Hash2DxeCrypto-to-ArmVirtPkg.patch [RHEL-71687]
+- Resolves: RHEL-71687
+  ([Regression] HTTP boot not available [aarch64] [rhel-8.10.z])
+
+* Fri Dec 06 2024 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-13.el8.7
+- edk2-redhat-Fix-ovmf-vars-generator-RH-only.patch [RHEL-66236]
+- Resolves: RHEL-66236
+  ([Regression] HTTP Boot fails to work with edk2-ovmf-20231122-6.el9_4.2 and greater [rhel-8.10])
+
+* Fri Nov 29 2024 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-13.el8.6
+- edk2-OvmfPkg-Rerun-dispatcher-after-initializing-virtio-r.patch [RHEL-66188]
+- Resolves: RHEL-66188
+  ([Regression] HTTP Boot fails to work with edk2-ovmf-20231122-6.el9_4.2 and greater [rhel-8.10])
+
+* Thu Nov 14 2024 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-13.el8.5
+- edk2-OvmfPkg-Add-a-Fallback-RNG-RH-only.patch [RHEL-66236]
+- edk2-OvmfPkg-ArmVirtPkg-Add-a-Fallback-RNG-RH-only.patch [RHEL-66236]
+- Resolves: RHEL-66236
+  ([Regression] HTTP Boot not working on old vCPU without virtio-rng device present [rhel-8.10])
+
+* Tue Oct 29 2024 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-13.el8.4
+- edk2-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch [RHEL-60830]
+- Resolves: RHEL-60830
+  (CVE-2024-38796 edk2: Integer overflows in PeCoffLoaderRelocateImage [rhel-8.10.z])
+
+* Mon Aug 26 2024 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-13.el8.3
+- edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch [RHEL-53009]
+- Resolves: RHEL-53009
+  (No http boot support on edk2-ovmf-20231122-6.el9_4.2 [rhel-8.10.z])
+
+* Wed Jul 10 2024 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-13.el8_10.2
+
+* Wed Jul 03 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-13.el8_10.1
+- edk2-MdeModulePkg-Change-use-of-EFI_D_-to-DEBUG_.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-MdePkg-Apply-uncrustify-changes.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-NetworkPkg-Apply-uncrustify-changes.p2.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-Rename-RdRandGenerateEntropy-to-g.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-Remove-ArchGetSupportedRngAlgorit.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-Documentation-include-parameter-c.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-Check-before-advertising-Cpu-Rng-.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-Add-AArch64-RawAlgorithm-support-.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-Add-debug-warning-for-NULL-PcdCpu.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-Rename-AArch64-RngDxe.c.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-Add-Arm-support-of-RngDxe.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-Correctly-update-mAvailableAlgoAr.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-Conditionally-install-EFI_RNG_PRO.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-MdeModulePkg-Duplicate-BaseRngLibTimerLib-to-MdeModu.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-MdePkg-Add-deprecated-warning-to-BaseRngLibTimer.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-SecurityPkg.dec-Move-PcdCpuRngSupportedA.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-MdePkg-DxeRngLib-Request-raw-algorithm-instead-of-de.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-MdePkg-Rng-Add-GUID-to-describe-Arm-Rndr-Rng-algorit.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-MdeModulePkg-Rng-Add-GUID-to-describe-unsafe-Rng-alg.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-MdePkg-Rng-Add-GetRngGuid-to-RngLib.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-Use-GetRngGuid-when-probing-RngLi.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-Simplify-Rng-algorithm-selection-.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-SecurityPkg-RngDxe-add-rng-test.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-OvmfPkg-wire-up-RngDxe.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch [RHEL-21854 RHEL-21856 RHEL-40099]
+- Resolves: RHEL-21854
+  (CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8])
+- Resolves: RHEL-21856
+  (CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8])
+- Resolves: RHEL-40099
+  (CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z])
+
+* Thu Mar 14 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-13
+- edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-21158]
+- edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-21158]
+- Resolves: RHEL-21158
+  (CVE-2022-36765 edk2: integer overflow in CreateHob() could lead to HOB OOB R/W [rhel-8])
+
+* Tue Feb 27 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-12
+- edk2-Apply-uncrustify-changes-to-.c-.h-files-in-the-Netwo.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-Apply-uncrustify-changes.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-Apply-uncrustify-changes-p2.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- edk2-NetworkPkg-Dhcp6Dxe-Packet-Length-is-not-updated-bef.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
+- Resolves: RHEL-21840
+  (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8])
+- Resolves: RHEL-21844
+  (CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8])
+- Resolves: RHEL-21846
+  (CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8])
+- Resolves: RHEL-21848
+  (CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8])
+- Resolves: RHEL-21850
+  (CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8])
+- Resolves: RHEL-21852
+  (CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8])
+
+* Wed Feb 14 2024 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-11
+- edk2-SecurityPkg-Change-use-of-EFI_D_-to-DEBUG_.patch [RHEL-21154 RHEL-21156]
+- edk2-SecurityPkg-Change-OPTIONAL-keyword-usage-style.patch [RHEL-21154 RHEL-21156]
+- edk2-MdePkg-Introduce-CcMeasurementProtocol-for-CC-Guest-.patch [RHEL-21154 RHEL-21156]
+- edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpm2.patch [RHEL-21154 RHEL-21156]
+- edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpmM.patch [RHEL-21154 RHEL-21156]
+- edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch [RHEL-21154 RHEL-21156]
+- edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch [RHEL-21154 RHEL-21156]
+- edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch [RHEL-21154 RHEL-21156]
+- edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-418.patch [RHEL-21154 RHEL-21156]
+- edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch [RHEL-21154 RHEL-21156]
+- edk2-SecurityPkg-DxeTpm2MeasureBootLib-SEC-PATCH-4118-2.patch [RHEL-21154 RHEL-21156]
+- edk2-SecurityPkg-DxeTpmMeasureBootLib-SEC-PATCH-4117-2.patch [RHEL-21154 RHEL-21156]
+- edk2-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch [RHEL-21154 RHEL-21156]
+- edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21840 RHEL-21842]
+- edk2-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch [RHEL-21840 RHEL-21842]
+- edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch [RHEL-21840 RHEL-21842]
+- edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch [RHEL-21840 RHEL-21842]
+- Resolves: RHEL-21154
+  (CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8])
+- Resolves: RHEL-21156
+  (CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8])
+- Resolves: RHEL-21840
+  (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8])
+- Resolves: RHEL-21842
+  (CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-8])
+
+* Sat Feb 03 2024 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-10
+- edk2-OvmfPkg-VirtNorFlashDxe-clone-ArmPlatformPkg-s-NOR-f.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-remove-CheckBlockLocked-feat.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-remove-disk-I-O-protocol-imp.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-drop-block-I-O-protocol-impl.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-avoid-array-mode-switch-afte.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-avoid-switching-between-mode.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-use-EFI_MEMORY_WC-and-drop-A.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariable2.patch [RHEL-17587]
+-  edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variable2.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-add-casts-to-UINTN-and-UINT3.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-clarify-block-write-logic-fi.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-add-a-loop-for-NorFlashWrite.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-allow-larger-writes-without-.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-ValidateFvHeader-unwritten-s.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-move-DoErase-code-block-into.patch [RHEL-17587]
+- edk2-ArmVirtPkg-ArmVirtQemu-migrate-to-OVMF-s-VirtNorFlas.patch [RHEL-17587]
+- edk2-OvmfPkg-clone-NorFlashPlatformLib-into-VirtNorFlashP.patch [RHEL-17587]
+- Resolves: RHEL-17587
+  ([rhel8] guest fails to boot due to ASSERT error)
+
+* Wed Jan 24 2024 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-9
+- edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariableG.patch [RHEL-17587]
+- edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variables.patch [RHEL-17587]
+- Resolves: RHEL-17587
+  ([rhel8] guest fails to boot due to ASSERT error)
+
+* Fri Jan 05 2024 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-8
+- edk2-Bumped-openssl-submodule-version-to-cf317b2bb227.patch [RHEL-7560]
+- Resolves: RHEL-7560
+  (CVE-2023-3446 edk2: openssl: Excessive time spent checking DH keys and parameters [rhel-8])
+
+* Wed Nov 22 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-7
+- edk2-add-8.6-machine-type-to-edk2-ovmf-cc.json.patch [RHEL-12626]
+- Resolves: RHEL-12626
+  (Missing firmware descriptor with secureboot disabled in RHEL 8)
+
+* Fri Aug 04 2023 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-6
+- edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch [bz#2150267]
+- Resolves: bz#2150267
+  (ovmf must consider max cpu count not boot cpu count for apic mode [rhel-8])
+
+* Thu Apr 06 2023 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-5
+- edk2-SecurityPkg-DxeImageVerificationLib-Check-result-of-.patch [bz#1861743]
+- Resolves: bz#1861743
+  (CVE-2019-14560 edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() [rhel-8])
+
 * Wed Feb 15 2023 Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-4
 - edk2-openssl-update.patch [bz#2164531 bz#2164543 bz#2164558 bz#2164581]
 - edk2-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch [bz#2164531 bz#2164543 bz#2164558 bz#2164581]