import edk2-20231122-6.el9_4.2

.edk2.metadata

@@ -1,3 +1,3 @@
 de143fc38b339d982079517b6f01bcec5246cf5e SOURCES/DBXUpdate-20230509.x64.bin
-a1a81793c0fbda8685b41ff839a942af5eda280a SOURCES/edk2-ba91d0292e.tar.xz
+4b2ed0d355d3ef44e21a72573e17017630b6d33c SOURCES/edk2-8736b8fdca.tar.xz
-c0518a4102a3909928dcc2e0a2c1784a53a419c6 SOURCES/openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
+bf431935cb72db4d80c8435a0956abb25ca71185 SOURCES/openssl-rhel-db0287935122edceb91dcda8dfb53b4090734e22.tar.xz

.gitignore

@@ -1,3 +1,3 @@
 SOURCES/DBXUpdate-20230509.x64.bin
-SOURCES/edk2-ba91d0292e.tar.xz
+SOURCES/edk2-8736b8fdca.tar.xz
-SOURCES/openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
+SOURCES/openssl-rhel-db0287935122edceb91dcda8dfb53b4090734e22.tar.xz

SOURCES/0001-ignore-build-artifacts-generated-files-session-setti.patch

@@ -0,0 +1,83 @@
+From 21816395a94558c8e5c97f13adbb5ffb909656b8 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 11 Jun 2014 21:55:22 +0200
+Subject: [PATCH] ignore build artifacts, generated files, session settings etc
+ (RHEL only)
+
+Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
+RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
+
+- no changes
+
+Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
+RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
+
+- refresh against upstream commit 48760409ccc8 (".gitignore: Ignore python
+  compiled files, extdeps, and vscode", 2019-11-11)
+
+- add ".AutoGenIdFile.txt" to "Conf/.gitignore", in response to upstream
+  commit 373298ca0d60 ("BaseTools: Fixed issue for IgnoreAutoGen",
+  2019-09-10)
+
+Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
+RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
+
+- no changes
+
+Notes about the RHEL-8.0/20180508-ee3198e672e2 ->
+RHEL-8.1/20190308-89910a39dcfd rebase:
+
+- no changes
+
+Notes about the RHEL-7.6/ovmf-20180508-2.gitee3198e672e2.el7 ->
+RHEL-8.0/20180508-ee3198e672e2 rebase:
+
+- reorder the rebase changelog in the commit message so that it reads like
+  a blog: place more recent entries near the top
+- no changes to the patch body
+
+Notes about the 20171011-92d07e48907f -> 20180508-ee3198e672e2 rebase:
+
+- no changes
+
+Notes about the 20170228-c325e41585e3 -> 20171011-92d07e48907f rebase:
+
+- Conflict resolution against upstream commit 112f4ada2e6b ("edk2: Add
+  .DS_Store to .gitignore for macOS", 2017-05-04), in the ".gitignore"
+  file.
+
+Notes about the 20160608b-988715a -> 20170228-c325e41585e3 rebase:
+
+- no changes
+
+Notes about the 9ece15a -> c9e5618 rebase:
+
+- Upstream added .gitignore files in the meanwhile, we just need some
+  light customization. In particular the Conf/ReadMe.txt file should not
+  be ignored, it is not generated.
+
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 3b9c914f2d6bff6274d5ed45fcf4c757ce27031b)
+(cherry picked from commit b66c3c6d11a834dc7cb3ab326f09c6a21c0b81e8)
+(cherry picked from commit c94381432988f6137de46772cbd4080d9832c9ad)
+(cherry picked from commit 730cc57005e4908fcee29109672284808b21ec1c)
+(cherry picked from commit 161184bcb55a670f8f7f8c4147825eb360b73794)
+(cherry picked from commit 4eec2bb2176f2deda2b2c44a6f2ea167c5a43433)
+(cherry picked from commit ea548c8d0c9d4cd5b8b5200eda8ff6ac220a6307)
+(cherry picked from commit 4872f69df8b0460fbbfcd75950d81fdcd213f8c0)
+---
+ Conf/.gitignore | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/Conf/.gitignore b/Conf/.gitignore
+index 5e4debcc10..8601fc0cee 100644
+--- a/Conf/.gitignore
++++ b/Conf/.gitignore
+@@ -1 +1,6 @@
+-*
++.AutoGenIdFile.txt
++.cache/
++BuildEnv.sh
++build_rule.txt
++target.txt
++tools_def.txt

SOURCES/0002-Remove-submodules.patch

@@ -1,7 +1,13 @@
-From a4954b2259c4be78f61127684239cb11486bc0f7 Mon Sep 17 00:00:00 2001
+From ff10592d4710f12d601dcfcdd25f28b6941c5141 Mon Sep 17 00:00:00 2001
 From: Miroslav Rezanina <mrezanin@redhat.com>
 Date: Thu, 24 Mar 2022 03:23:02 -0400
-Subject: Remove submodules
+Subject: [PATCH] Remove submodules
+
+Rebase to edk2-stable202311: removing additional submodule:
+
+- CryptoPkg/Library/MbedTlsLib/mbedtls
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 
 Rebase to edk2-stable202305: removing additional submodules:
 
@@ -50,35 +56,12 @@ remove the include path too.
 Signed-off-by: Laszlo Ersek <lersek@redhat.com>
 (cherry picked from commit e05e0de713c4a2b8adb6ff9809611f222bfe50ed)
 ---
- .gitmodules                                   | 34 -------------------
+ BaseTools/Source/C/GNUmakefile | 1 -
- .../ArmSoftFloatLib/berkeley-softfloat-3      |  1 -
+ CryptoPkg/.gitignore           | 1 +
- BaseTools/Source/C/BrotliCompress/brotli      |  1 -
+ MdeModulePkg/MdeModulePkg.dec  | 3 ---
- BaseTools/Source/C/GNUmakefile                |  1 -
+ MdePkg/MdePkg.dec              | 5 -----
- CryptoPkg/.gitignore                          |  1 +
+ 4 files changed, 1 insertion(+), 9 deletions(-)
- CryptoPkg/Library/OpensslLib/openssl          |  1 -
- .../Library/BrotliCustomDecompressLib/brotli  |  1 -
- MdeModulePkg/MdeModulePkg.dec                 |  3 --
- .../Universal/RegularExpressionDxe/oniguruma  |  1 -
- MdePkg/Library/BaseFdtLib/libfdt              |  1 -
- MdePkg/Library/MipiSysTLib/mipisyst           |  1 -
- MdePkg/MdePkg.dec                             |  5 ---
- RedfishPkg/Library/JsonLib/jansson            |  1 -
- UnitTestFrameworkPkg/Library/CmockaLib/cmocka |  1 -
- .../Library/GoogleTestLib/googletest          |  1 -
- .../Library/SubhookLib/subhook                |  1 -
- 16 files changed, 1 insertion(+), 54 deletions(-)
- delete mode 160000 ArmPkg/Library/ArmSoftFloatLib/berkeley-softfloat-3
- delete mode 160000 BaseTools/Source/C/BrotliCompress/brotli
  create mode 100644 CryptoPkg/.gitignore
- delete mode 160000 CryptoPkg/Library/OpensslLib/openssl
- delete mode 160000 MdeModulePkg/Library/BrotliCustomDecompressLib/brotli
- delete mode 160000 MdeModulePkg/Universal/RegularExpressionDxe/oniguruma
- delete mode 160000 MdePkg/Library/BaseFdtLib/libfdt
- delete mode 160000 MdePkg/Library/MipiSysTLib/mipisyst
- delete mode 160000 RedfishPkg/Library/JsonLib/jansson
- delete mode 160000 UnitTestFrameworkPkg/Library/CmockaLib/cmocka
- delete mode 160000 UnitTestFrameworkPkg/Library/GoogleTestLib/googletest
- delete mode 160000 UnitTestFrameworkPkg/Library/SubhookLib/subhook
 
 diff --git a/BaseTools/Source/C/GNUmakefile b/BaseTools/Source/C/GNUmakefile
 index 5275f657ef..39d7199753 100644
@@ -92,8 +75,15 @@ index 5275f657ef..39d7199753 100644
    VfrCompile \
    EfiRom \
    GenFfs \
+diff --git a/CryptoPkg/.gitignore b/CryptoPkg/.gitignore
+new file mode 100644
+index 0000000000..68b83272b7
+--- /dev/null
++++ b/CryptoPkg/.gitignore
+@@ -0,0 +1 @@
++Library/OpensslLib/openssl*/
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 95dd077e19..1609b6d9c2 100644
+index d2fede4f87..265dfec94f 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
 @@ -26,9 +26,6 @@
@@ -107,7 +97,7 @@ index 95dd077e19..1609b6d9c2 100644
    ##  @libraryclass  Defines a set of methods to reset whole system.
    ResetSystemLib|Include/Library/ResetSystemLib.h
 diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
-index b85614992b..57b0b5ea6f 100644
+index ac54338089..29f0a6e178 100644
 --- a/MdePkg/MdePkg.dec
 +++ b/MdePkg/MdePkg.dec
 @@ -29,7 +29,6 @@

SOURCES/0003-MdeModulePkg-TerminalDxe-set-xterm-resolution-on-mod.patch

@@ -1,8 +1,12 @@
-From 5eef1273ee036bfa0ba9da1b276e0bf130b1cfbc Mon Sep 17 00:00:00 2001
+From a531e0f3c999670f54926b2579e0721d217a49e0 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Tue, 25 Feb 2014 22:40:01 +0100
-Subject: MdeModulePkg: TerminalDxe: set xterm resolution on mode change (RH
+Subject: [PATCH] MdeModulePkg: TerminalDxe: set xterm resolution on mode
- only)
+ change (RH only)
+
+Notes for rebase to edk2-stable202311:
+
+- Minor context changes due to new PCDs (for USB Networking) being added.
 
 Notes for rebase to edk2-stable202205:
 
@@ -95,12 +99,12 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  3 files changed, 36 insertions(+)
 
 diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
-index 1609b6d9c2..705fb02f66 100644
+index 265dfec94f..092a8dee2a 100644
 --- a/MdeModulePkg/MdeModulePkg.dec
 +++ b/MdeModulePkg/MdeModulePkg.dec
-@@ -2127,6 +2127,10 @@
+@@ -2158,6 +2158,10 @@
-   # @Prompt The shared bit mask when Intel Tdx is enabled.
+   # @Prompt The value is use for Usb Network rate limiting supported.
-   gEfiMdeModulePkgTokenSpaceGuid.PcdTdxSharedBitMask|0x0|UINT64|0x10000025
+   gEfiMdeModulePkgTokenSpaceGuid.PcdUsbNetworkRateLimitingFactor|100|UINT32|0x10000028
  
 +  ## Controls whether TerminalDxe outputs an XTerm resize sequence on terminal
 +  #  mode change.
@@ -184,6 +188,3 @@ index b2a8aeba85..96810f337c 100644
  
  # [Event]
  # # Relative timer event set by UnicodeToEfiKey(), used to be one 2 seconds input timeout.
--- 
-2.39.3
-

SOURCES/0004-OvmfPkg-take-PcdResizeXterm-from-the-QEMU-command-li.patch

@@ -1,7 +1,8 @@
-From a1d4a00637d184cff886bc150cdfd8de165ed162 Mon Sep 17 00:00:00 2001
+From c53aae9d945648b7301efede1dc77bf7b7f4ee1c Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 14 Oct 2015 15:59:06 +0200
-Subject: OvmfPkg: take PcdResizeXterm from the QEMU command line (RH only)
+Subject: [PATCH] OvmfPkg: take PcdResizeXterm from the QEMU command line (RH
+ only)
 
 Notes about edk2-stable202205 rebase
 
@@ -82,10 +83,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  9 files changed, 21 insertions(+), 1 deletion(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index b32049194d..c62d6e2805 100644
+index 302c90e7c2..ef70f5f08c 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -476,6 +476,7 @@
+@@ -486,6 +486,7 @@
  [PcdsDynamicDefault]
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -94,10 +95,10 @@ index b32049194d..c62d6e2805 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc
-index 2a1139daaa..cfa4943ed4 100644
+index c23c7eaf6c..49521ba47c 100644
 --- a/OvmfPkg/CloudHv/CloudHvX64.dsc
 +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc
-@@ -575,6 +575,7 @@
+@@ -576,6 +576,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -106,10 +107,10 @@ index 2a1139daaa..cfa4943ed4 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-index d4403f11a7..e4bc192733 100644
+index 182ec3705d..fd6722499a 100644
 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
 +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
-@@ -473,6 +473,7 @@
+@@ -482,6 +482,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -118,10 +119,10 @@ index d4403f11a7..e4bc192733 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
-index 5f671bc384..49d1d7ef5c 100644
+index ea1fa3e296..79f14b5c05 100644
 --- a/OvmfPkg/Microvm/MicrovmX64.dsc
 +++ b/OvmfPkg/Microvm/MicrovmX64.dsc
-@@ -572,7 +572,7 @@
+@@ -584,7 +584,7 @@
    # only set when
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
@@ -131,10 +132,10 @@ index 5f671bc384..49d1d7ef5c 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index e333b8b418..b4f7334569 100644
+index ed3a19feeb..3101a3a4cf 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -595,6 +595,7 @@
+@@ -604,6 +604,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -143,10 +144,10 @@ index e333b8b418..b4f7334569 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 25974230a2..e11ccae622 100644
+index 16ca139b29..0c174947b7 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -603,6 +603,7 @@
+@@ -616,6 +616,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -155,10 +156,10 @@ index 25974230a2..e11ccae622 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index c1762ffca4..4ac6b492e2 100644
+index dc1a0942aa..a328726d55 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -626,6 +626,7 @@
+@@ -634,6 +634,7 @@
    #   ($(SMM_REQUIRE) == FALSE)
    gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
  
@@ -167,7 +168,7 @@ index c1762ffca4..4ac6b492e2 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
 diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
-index c56247e294..bf5d37c1f6 100644
+index f5dc41c3a8..f244dcd24d 100644
 --- a/OvmfPkg/PlatformPei/Platform.c
 +++ b/OvmfPkg/PlatformPei/Platform.c
 @@ -41,6 +41,18 @@
@@ -189,7 +190,7 @@ index c56247e294..bf5d37c1f6 100644
  EFI_PEI_PPI_DESCRIPTOR  mPpiBootMode[] = {
    {
      EFI_PEI_PPI_DESCRIPTOR_PPI | EFI_PEI_PPI_DESCRIPTOR_TERMINATE_LIST,
-@@ -386,6 +398,7 @@ InitializePlatform (
+@@ -355,6 +367,7 @@ InitializePlatform (
      MemTypeInfoInitialization (PlatformInfoHob);
      MemMapInitialization (PlatformInfoHob);
      NoexecDxeInitialization (PlatformInfoHob);
@@ -209,6 +210,3 @@ index 3934aeed95..d84aefee6d 100644
    gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode
    gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
    gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack
--- 
-2.39.3
-

SOURCES/0005-ArmVirtPkg-take-PcdResizeXterm-from-the-QEMU-command.patch

@@ -1,7 +1,8 @@
-From 5b458fdeac6a656ab83e0be1662f22e293a5622a Mon Sep 17 00:00:00 2001
+From db9d61b18715590fc8956eb5da9b036afbfd9ab9 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Sun, 26 Jul 2015 08:02:50 +0000
-Subject: ArmVirtPkg: take PcdResizeXterm from the QEMU command line (RH only)
+Subject: [PATCH] ArmVirtPkg: take PcdResizeXterm from the QEMU command line
+ (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -95,10 +96,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  create mode 100644 ArmVirtPkg/Library/TerminalPcdProducerLib/TerminalPcdProducerLib.inf
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 449e73b9e1..b6b9a7f192 100644
+index 30e3cfc8b9..7b88b7441f 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -307,6 +307,8 @@
+@@ -309,6 +309,8 @@
    gEfiSecurityPkgTokenSpaceGuid.PcdTpmBaseAddress|0x0
  !endif
  
@@ -107,7 +108,7 @@ index 449e73b9e1..b6b9a7f192 100644
  [PcdsDynamicHii]
    gUefiOvmfPkgTokenSpaceGuid.PcdForceNoAcpi|L"ForceNoAcpi"|gOvmfVariableGuid|0x0|FALSE|NV,BS
  
-@@ -416,7 +418,10 @@
+@@ -418,7 +420,10 @@
    MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
    MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitterDxe.inf
    MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
@@ -198,6 +199,3 @@ index 0000000000..c840f6f97a
 +
 +[Pcd]
 +  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm ## SOMETIMES_PRODUCES
--- 
-2.39.3
-

SOURCES/0006-OvmfPkg-enable-DEBUG_VERBOSE-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 23e43af54fd29691bf94a5f4e2ac3014b819e37e Mon Sep 17 00:00:00 2001
+From ccc528cc7a9d5b0029a1ca91cb592c999e9f8c5a Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:45 +0100
-Subject: OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
+Subject: [PATCH] OvmfPkg: enable DEBUG_VERBOSE (RHEL only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -65,10 +65,10 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index c62d6e2805..ac73229829 100644
+index ef70f5f08c..28bdc56227 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -426,7 +426,7 @@
+@@ -428,7 +428,7 @@
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -78,10 +78,10 @@ index c62d6e2805..ac73229829 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b4f7334569..0b9fc53884 100644
+index 3101a3a4cf..c4fc79a851 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -535,7 +535,7 @@
+@@ -537,7 +537,7 @@
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -91,10 +91,10 @@ index b4f7334569..0b9fc53884 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index e11ccae622..51823fb746 100644
+index 0c174947b7..1da23b5389 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -541,7 +541,7 @@
+@@ -544,7 +544,7 @@
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -104,10 +104,10 @@ index e11ccae622..51823fb746 100644
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 4ac6b492e2..d1474b0155 100644
+index a328726d55..4f886ba644 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -562,7 +562,7 @@
+@@ -563,7 +563,7 @@
    # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
    #                             // significantly impact boot performance
    # DEBUG_ERROR     0x80000000  // Error
@@ -116,6 +116,3 @@ index 4ac6b492e2..d1474b0155 100644
  
  !if $(SOURCE_DEBUG_ENABLE) == TRUE
    gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
--- 
-2.39.3
-

SOURCES/0007-OvmfPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuVide.patch

@@ -1,7 +1,7 @@
-From 13c6ac7528d5be2638f121b19432597cc529ea7c Mon Sep 17 00:00:00 2001
+From 4bb5f3b3473da371b4db99899c1128ae4ff99f6e Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:46 +0100
-Subject: OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
+Subject: [PATCH] OvmfPkg: silence DEBUG_VERBOSE (0x00400000) in
  QemuVideoDxe/QemuRamfbDxe (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
@@ -76,16 +76,16 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 (cherry picked from commit 1355849ad97c1e4a5c430597a377165a5cc118f7)
 ---
  OvmfPkg/AmdSev/AmdSevX64.dsc | 10 ++++++++--
- OvmfPkg/OvmfPkgIa32.dsc      | 12 +++++++++---
+ OvmfPkg/OvmfPkgIa32.dsc      | 10 ++++++++--
  OvmfPkg/OvmfPkgIa32X64.dsc   | 10 ++++++++--
  OvmfPkg/OvmfPkgX64.dsc       | 10 ++++++++--
- 4 files changed, 33 insertions(+), 9 deletions(-)
+ 4 files changed, 32 insertions(+), 8 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index ac73229829..70f154b477 100644
+index 28bdc56227..cbd48af4dc 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -684,8 +684,14 @@
+@@ -694,8 +694,14 @@
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
@@ -103,21 +103,20 @@ index ac73229829..70f154b477 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 0b9fc53884..b05e010069 100644
+index c4fc79a851..75a61c88e6 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -841,9 +841,15 @@
+@@ -850,9 +850,15 @@
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
  !ifndef $(CSM_ENABLE)
 -  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
--!endif
--  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
 +  }
-+!endif
+ !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
 +  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
 +    <PcdsFixedAtBuild>
 +      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
@@ -126,10 +125,10 @@ index 0b9fc53884..b05e010069 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 51823fb746..78f97ff17e 100644
+index 1da23b5389..e5ca067d4c 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -855,9 +855,15 @@
+@@ -868,9 +868,15 @@
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
  !ifndef $(CSM_ENABLE)
@@ -148,10 +147,10 @@ index 51823fb746..78f97ff17e 100644
  
    #
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index d1474b0155..2a4829d26e 100644
+index 4f886ba644..ad314d86c6 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -929,9 +929,15 @@
+@@ -936,9 +936,15 @@
    MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
  
  !ifndef $(CSM_ENABLE)
@@ -169,6 +168,3 @@ index d1474b0155..2a4829d26e 100644
    OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
  
    #
--- 
-2.39.3
-

SOURCES/0008-ArmVirtPkg-silence-DEBUG_VERBOSE-0x00400000-in-QemuR.patch

@@ -1,8 +1,8 @@
-From 6e76f73b1ea3bac22d248499b9c2062ca5ed020d Mon Sep 17 00:00:00 2001
+From 72830b010e7b78ef8d74cefcb5c6ad018c653ea6 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 27 Jan 2016 03:05:18 +0100
-Subject: ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in QemuRamfbDxe (RH
+Subject: [PATCH] ArmVirtPkg: silence DEBUG_VERBOSE (0x00400000) in
- only)
+ QemuRamfbDxe (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -61,10 +61,10 @@ Signed-off-by: Laszlo Ersek <lersek@redhat.com>
  2 files changed, 8 insertions(+), 2 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index b6b9a7f192..176246d683 100644
+index 7b88b7441f..fe7b7e1d64 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -544,7 +544,10 @@
+@@ -547,7 +547,10 @@
    #
    # Video support
    #
@@ -77,10 +77,10 @@ index b6b9a7f192..176246d683 100644
    OvmfPkg/PlatformDxe/Platform.inf
  
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 3cb9120e4e..18d59c2414 100644
+index b50f8e84a3..4a43892f7d 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -444,7 +444,10 @@
+@@ -447,7 +447,10 @@
    #
    # Video support
    #
@@ -92,6 +92,3 @@ index 3cb9120e4e..18d59c2414 100644
    OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
    OvmfPkg/PlatformDxe/Platform.inf
  
--- 
-2.39.3
-

SOURCES/0009-OvmfPkg-QemuRamfbDxe-Do-not-report-DXE-failure-on-Aa.patch

@@ -1,8 +1,8 @@
-From fe859725d7da9d4452d79b65aad4b4cb3589e873 Mon Sep 17 00:00:00 2001
+From 2b84cf52f9a6f24f932bce5548202460f20ca9d0 Mon Sep 17 00:00:00 2001
 From: Philippe Mathieu-Daude <philmd@redhat.com>
 Date: Thu, 1 Aug 2019 20:43:48 +0200
-Subject: OvmfPkg: QemuRamfbDxe: Do not report DXE failure on Aarch64 silent
+Subject: [PATCH] OvmfPkg: QemuRamfbDxe: Do not report DXE failure on Aarch64
- builds (RH only)
+ silent builds (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -90,6 +90,3 @@ index e3890b8c20..f79a4bc987 100644
    DevicePathLib
    FrameBufferBltLib
    MemoryAllocationLib
--- 
-2.39.3
-

SOURCES/0010-OvmfPkg-silence-EFI_D_VERBOSE-0x00400000-in-NvmExpre.patch

@@ -1,8 +1,8 @@
-From 4939fadb84796923b287becaecd568d5d77fe20b Mon Sep 17 00:00:00 2001
+From 67230df28e3861c4a7a8fb064a45ed85f015209c Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Tue, 21 Nov 2017 00:57:47 +0100
-Subject: OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in NvmExpressDxe (RH
+Subject: [PATCH] OvmfPkg: silence EFI_D_VERBOSE (0x00400000) in NvmExpressDxe
- only)
+ (RH only)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -63,11 +63,11 @@ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  4 files changed, 16 insertions(+), 4 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 70f154b477..0d30ee9526 100644
+index cbd48af4dc..a0319c1f0a 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -678,7 +678,10 @@
+@@ -688,7 +688,10 @@
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
@@ -79,11 +79,11 @@ index 70f154b477..0d30ee9526 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index b05e010069..ef6362aac5 100644
+index 75a61c88e6..34ad4f2777 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -834,7 +834,10 @@
+@@ -843,7 +843,10 @@
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
@@ -95,11 +95,11 @@ index b05e010069..ef6362aac5 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 78f97ff17e..1793cc96fc 100644
+index e5ca067d4c..4278ce5e1d 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -848,7 +848,10 @@
+@@ -861,7 +861,10 @@
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
@@ -111,11 +111,11 @@ index 78f97ff17e..1793cc96fc 100644
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 2a4829d26e..c32a36b513 100644
+index ad314d86c6..e41a1b976e 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -922,7 +922,10 @@
+@@ -929,7 +929,10 @@
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
    MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
    MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
 -  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf
@@ -126,6 +126,3 @@ index 2a4829d26e..c32a36b513 100644
    MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
    MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
    MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
--- 
-2.39.3
-

SOURCES/0011-OvmfPkg-QemuKernelLoaderFsDxe-suppress-error-on-no-k.patch

@@ -1,8 +1,8 @@
-From b32764469522eb1ac742a34e2ff8b513a329cc41 Mon Sep 17 00:00:00 2001
+From 9bf175beabab17dae1b5883d528ae3d9d834249b Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:31:36 +0200
-Subject: OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no "-kernel" in
+Subject: [PATCH] OvmfPkg/QemuKernelLoaderFsDxe: suppress error on no "-kernel"
- silent aa64 build (RH)
+ in silent aa64 build (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -78,6 +78,3 @@ index 7b35adb8e0..23d9f5fca1 100644
    DevicePathLib
    MemoryAllocationLib
    QemuFwCfgLib
--- 
-2.39.3
-

SOURCES/0012-SecurityPkg-Tcg2Dxe-suppress-error-on-no-swtpm-in-si.patch

@@ -1,8 +1,8 @@
-From f38c073fdceec2dac64dc3632ad531f5b73fda8e Mon Sep 17 00:00:00 2001
+From d3d9a0ea8cdd6a8438a878a859ca0cd416c42ad6 Mon Sep 17 00:00:00 2001
 From: Laszlo Ersek <lersek@redhat.com>
 Date: Wed, 24 Jun 2020 11:40:09 +0200
-Subject: SecurityPkg/Tcg2Dxe: suppress error on no swtpm in silent aa64 build
+Subject: [PATCH] SecurityPkg/Tcg2Dxe: suppress error on no swtpm in silent
- (RH)
+ aa64 build (RH)
 
 Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
 RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
@@ -77,6 +77,3 @@ index 7dc7a2683d..ae90070b36 100644
    Tpm2CommandLib
    PrintLib
    UefiLib
--- 
-2.39.3
-

SOURCES/0013-OvmfPkg-Remove-EbcDxe-RHEL-only.patch

@@ -1,7 +1,7 @@
-From f48037fba5ef28692e1dd1db90d4729a5fa13e84 Mon Sep 17 00:00:00 2001
+From ce3ac92a202a0b845654c05449107840edf5d2f9 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:28:49 +0200
-Subject: OvmfPkg: Remove EbcDxe (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove EbcDxe (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -29,10 +29,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  8 files changed, 8 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 0d30ee9526..2b624582c6 100644
+index a0319c1f0a..906c1a4332 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -603,7 +603,6 @@
+@@ -613,7 +613,6 @@
  !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
    }
  
@@ -41,7 +41,7 @@ index 0d30ee9526..2b624582c6 100644
    UefiCpuPkg/CpuDxe/CpuDxe.inf
    OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index fec08468d3..2c61d5fa0a 100644
+index b2ab0c7773..20d31d0e2d 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
 @@ -205,7 +205,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@@ -53,10 +53,10 @@ index fec08468d3..2c61d5fa0a 100644
  INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
  INF  OvmfPkg/LocalApicTimerDxe/LocalApicTimerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index ef6362aac5..36ea20fb93 100644
+index 34ad4f2777..d664b42c67 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -744,7 +744,6 @@
+@@ -753,7 +753,6 @@
  !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
    }
  
@@ -65,7 +65,7 @@ index ef6362aac5..36ea20fb93 100644
    UefiCpuPkg/CpuDxe/CpuDxe.inf
  !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index c9c9384397..8135a3dc01 100644
+index 383613e54b..236680dec2 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -216,7 +216,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@@ -77,10 +77,10 @@ index c9c9384397..8135a3dc01 100644
  INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
  !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 1793cc96fc..9638e03578 100644
+index 4278ce5e1d..2e0af7698a 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -758,7 +758,6 @@
+@@ -771,7 +771,6 @@
  !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
    }
  
@@ -89,7 +89,7 @@ index 1793cc96fc..9638e03578 100644
    UefiCpuPkg/CpuDxe/CpuDxe.inf
  !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index f52219e0c2..9d6314d56e 100644
+index 3cec3d0c87..3ad2fe5eee 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -217,7 +217,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@@ -101,10 +101,10 @@ index f52219e0c2..9d6314d56e 100644
  INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
  !ifdef $(CSM_ENABLE)
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index c32a36b513..7d702f3d21 100644
+index e41a1b976e..55f6760f4c 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -808,7 +808,6 @@
+@@ -816,7 +816,6 @@
  !include OvmfPkg/Include/Dsc/OvmfTpmSecurityStub.dsc.inc
    }
  
@@ -113,7 +113,7 @@ index c32a36b513..7d702f3d21 100644
  
    UefiCpuPkg/CpuDxe/CpuDxe.inf {
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 00c7f8849f..474ef5ca7e 100644
+index 9c35b6e848..da4541d747 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -239,7 +239,6 @@ INF  MdeModulePkg/Universal/PCD/Dxe/Pcd.inf
@@ -124,6 +124,3 @@ index 00c7f8849f..474ef5ca7e 100644
  INF  UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf
  
  INF  UefiCpuPkg/CpuDxe/CpuDxe.inf
--- 
-2.39.3
-

SOURCES/0014-OvmfPkg-Remove-VirtioGpu-device-driver-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 324341ee7f56c09987c16d9a7513465cb56e0dcf Mon Sep 17 00:00:00 2001
+From 536709a91fe5d9bf5bb41bc0ae56cb3e3fa0cf5a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:28:59 +0200
-Subject: OvmfPkg: Remove VirtioGpu device driver (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove VirtioGpu device driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -29,10 +29,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  8 files changed, 8 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 2b624582c6..dafdc1e67a 100644
+index 906c1a4332..52b0d1062c 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -694,7 +694,6 @@
+@@ -704,7 +704,6 @@
      <PcdsFixedAtBuild>
        gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
    }
@@ -41,10 +41,10 @@ index 2b624582c6..dafdc1e67a 100644
    #
    # ISA Support
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index 2c61d5fa0a..2bedd4bef1 100644
+index 20d31d0e2d..48cc3b00c1 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
-@@ -298,7 +298,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
+@@ -300,7 +300,6 @@ INF  MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
  INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
  
  INF  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
@@ -53,10 +53,10 @@ index 2c61d5fa0a..2bedd4bef1 100644
  INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
  INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 36ea20fb93..daed0cb362 100644
+index d664b42c67..d39d9e8c27 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -852,7 +852,6 @@
+@@ -861,7 +861,6 @@
      <PcdsFixedAtBuild>
        gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
    }
@@ -65,7 +65,7 @@ index 36ea20fb93..daed0cb362 100644
    #
    # ISA Support
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 8135a3dc01..f8d2385b91 100644
+index 236680dec2..381735165d 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -334,7 +334,6 @@ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
@@ -77,10 +77,10 @@ index 8135a3dc01..f8d2385b91 100644
  INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
  
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 9638e03578..c284351665 100644
+index 2e0af7698a..0e3de2ec5e 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -866,7 +866,6 @@
+@@ -879,7 +879,6 @@
      <PcdsFixedAtBuild>
        gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
    }
@@ -89,7 +89,7 @@ index 9638e03578..c284351665 100644
    #
    # ISA Support
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index 9d6314d56e..5d49c55d8a 100644
+index 3ad2fe5eee..2ca10f7c5e 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -340,7 +340,6 @@ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
@@ -101,10 +101,10 @@ index 9d6314d56e..5d49c55d8a 100644
  INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
  INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 7d702f3d21..88140034c1 100644
+index 55f6760f4c..c266686361 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -940,7 +940,6 @@
+@@ -947,7 +947,6 @@
      <PcdsFixedAtBuild>
        gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
    }
@@ -113,7 +113,7 @@ index 7d702f3d21..88140034c1 100644
    #
    # ISA Support
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 474ef5ca7e..d09bd16e2f 100644
+index da4541d747..00b3f9d0d8 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -367,7 +367,6 @@ INF  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf
@@ -124,6 +124,3 @@ index 474ef5ca7e..d09bd16e2f 100644
  INF  OvmfPkg/PlatformDxe/Platform.inf
  INF  OvmfPkg/AmdSevDxe/AmdSevDxe.inf
  INF  OvmfPkg/IoMmuDxe/IoMmuDxe.inf
--- 
-2.39.3
-

SOURCES/0015-OvmfPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL-on.patch

@@ -1,7 +1,7 @@
-From 4e165646d809f6ebb0ca0492b00d48ad225db81b Mon Sep 17 00:00:00 2001
+From ff214a87a99084bd91a04711e52ec1bffa911557 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:13 +0200
-Subject: OvmfPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -27,19 +27,19 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  6 files changed, 6 deletions(-)
 
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index daed0cb362..bcfd40ce66 100644
+index d39d9e8c27..12ed090eab 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -827,7 +827,6 @@
+@@ -836,7 +836,6 @@
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
    MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index f8d2385b91..410bb2893c 100644
+index 381735165d..bd69792100 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -296,7 +296,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -51,19 +51,19 @@ index f8d2385b91..410bb2893c 100644
  !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
  INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index c284351665..eced00f16a 100644
+index 0e3de2ec5e..821423cfe2 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -841,7 +841,6 @@
+@@ -854,7 +854,6 @@
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
    MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index 5d49c55d8a..cb3ea94514 100644
+index 2ca10f7c5e..4011682faf 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -75,19 +75,19 @@ index 5d49c55d8a..cb3ea94514 100644
  !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
  INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 88140034c1..9a7325a373 100644
+index c266686361..ea3f8d73bc 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -915,7 +915,6 @@
+@@ -922,7 +922,6 @@
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
    MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
 -  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index d09bd16e2f..765cc46921 100644
+index 00b3f9d0d8..c53501679a 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -322,7 +322,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -98,6 +98,3 @@ index d09bd16e2f..765cc46921 100644
  
  !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
  INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
--- 
-2.39.3
-

SOURCES/0016-ArmVirtPkg-Remove-VirtioFsDxe-filesystem-driver-RHEL.patch

@@ -1,7 +1,7 @@
-From 7894ed0cd0583d4b6d39798310bb537d64eb8e34 Mon Sep 17 00:00:00 2001
+From 7478b17347f2119448467a0ce821a5c5f865a2c8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:16 +0200
-Subject: ArmVirtPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove VirtioFsDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -24,10 +24,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  3 files changed, 3 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 176246d683..8fe5926ece 100644
+index fe7b7e1d64..f0946821c6 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -462,7 +462,6 @@
+@@ -465,7 +465,6 @@
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
    MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
@@ -36,7 +36,7 @@ index 176246d683..8fe5926ece 100644
    #
    # Bds
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 8a063bac04..5da1481532 100644
+index 9b3e37d5c9..a997063751 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 @@ -84,7 +84,6 @@ READ_LOCK_STATUS   = TRUE
@@ -48,10 +48,10 @@ index 8a063bac04..5da1481532 100644
    #
    # Status Code Routing
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index 18d59c2414..c76657d0c4 100644
+index 4a43892f7d..8fa801dad6 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -362,7 +362,6 @@
+@@ -365,7 +365,6 @@
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
    MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
@@ -59,6 +59,3 @@ index 18d59c2414..c76657d0c4 100644
  
    #
    # Bds
--- 
-2.39.3
-

SOURCES/0017-OvmfPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 2b5fd3beae02e9b8cec957804440d4f80cd081b0 Mon Sep 17 00:00:00 2001
+From 42c144b94db706be6f01d5fb1537a35cc803daa8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:19 +0200
-Subject: OvmfPkg: Remove UdfDxe filesystem driver (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove UdfDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -29,22 +29,22 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  8 files changed, 8 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index dafdc1e67a..5987de6d83 100644
+index 52b0d1062c..41953c119d 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -671,7 +671,6 @@
+@@ -681,7 +681,6 @@
    MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index 2bedd4bef1..4d2f9c7248 100644
+index 48cc3b00c1..2f03c80ffd 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
-@@ -272,7 +272,6 @@ INF  OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf
+@@ -274,7 +274,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
  INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
  
  INF  FatPkg/EnhancedFatDxe/Fat.inf
@@ -53,19 +53,19 @@ index 2bedd4bef1..4d2f9c7248 100644
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
  INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index bcfd40ce66..5762871fee 100644
+index 12ed090eab..07176ad930 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -826,7 +826,6 @@
+@@ -835,7 +835,6 @@
    MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 410bb2893c..9df41eae67 100644
+index bd69792100..97c808446e 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -295,7 +295,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
@@ -77,19 +77,19 @@ index 410bb2893c..9df41eae67 100644
  !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
  INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index eced00f16a..dc5020a632 100644
+index 821423cfe2..ba7ed38412 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -840,7 +840,6 @@
+@@ -853,7 +853,6 @@
    MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index cb3ea94514..e002846515 100644
+index 4011682faf..6351ce645b 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -296,7 +296,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
@@ -101,19 +101,19 @@ index cb3ea94514..e002846515 100644
  !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
  INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 9a7325a373..e1e1df4b9d 100644
+index ea3f8d73bc..55f3315241 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -914,7 +914,6 @@
+@@ -921,7 +921,6 @@
    MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
 -  MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf
    MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf
-   OvmfPkg/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 765cc46921..e586632664 100644
+index c53501679a..558a944f20 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -321,7 +321,6 @@ INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
@@ -124,6 +124,3 @@ index 765cc46921..e586632664 100644
  
  !if $(BUILD_SHELL) == TRUE && $(TOOL_CHAIN_TAG) != "XCODE5"
  INF  ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
--- 
-2.39.3
-

SOURCES/0018-ArmVirtPkg-Remove-UdfDxe-filesystem-driver-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 1078848167171e47d42cfaa0de2ba5dc1bad4639 Mon Sep 17 00:00:00 2001
+From 34b2ee906d0cce11a8156105777b6ecfaca5feba Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:22 +0200
-Subject: ArmVirtPkg: Remove UdfDxe filesystem driver (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove UdfDxe filesystem driver (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -24,10 +24,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  3 files changed, 3 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index 8fe5926ece..b1deefc2fd 100644
+index f0946821c6..68ad5877ee 100644
 --- a/ArmVirtPkg/ArmVirtQemu.dsc
 +++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -461,7 +461,6 @@
+@@ -464,7 +464,6 @@
    MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
@@ -36,7 +36,7 @@ index 8fe5926ece..b1deefc2fd 100644
    #
    # Bds
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 5da1481532..2b17211256 100644
+index a997063751..dcb1b793d1 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 @@ -83,7 +83,6 @@ READ_LOCK_STATUS   = TRUE
@@ -48,10 +48,10 @@ index 5da1481532..2b17211256 100644
    #
    # Status Code Routing
 diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index c76657d0c4..afebc46a04 100644
+index 8fa801dad6..87e54e682a 100644
 --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
 +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -361,7 +361,6 @@
+@@ -364,7 +364,6 @@
    MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf
    MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf
    FatPkg/EnhancedFatDxe/Fat.inf
@@ -59,6 +59,3 @@ index c76657d0c4..afebc46a04 100644
  
    #
    # Bds
--- 
-2.39.3
-

SOURCES/0019-OvmfPkg-Remove-TftpDynamicCommand-from-shell-RHEL-on.patch

@@ -1,7 +1,7 @@
-From c536b7c67fe45bfa1bc27299ba0a584af572e80d Mon Sep 17 00:00:00 2001
+From aac73e5f62e2305e6578c9b22ae557741bf6532a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:25 +0200
-Subject: OvmfPkg: Remove TftpDynamicCommand from shell (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove TftpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -27,10 +27,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  6 files changed, 15 deletions(-)
 
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 5762871fee..ed72cbf57e 100644
+index 07176ad930..0183511722 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -904,10 +904,6 @@
+@@ -913,10 +913,6 @@
  !endif
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -42,7 +42,7 @@ index 5762871fee..ed72cbf57e 100644
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 9df41eae67..1d19e20e8a 100644
+index 97c808446e..cb95c842fa 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -54,10 +54,10 @@ index 9df41eae67..1d19e20e8a 100644
  INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
  !endif
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index dc5020a632..9b97e664d7 100644
+index ba7ed38412..66554b42ed 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -918,10 +918,6 @@
+@@ -931,10 +931,6 @@
  !endif
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -69,7 +69,7 @@ index dc5020a632..9b97e664d7 100644
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index e002846515..621772963f 100644
+index 6351ce645b..592f0fed82 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -298,7 +298,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -81,10 +81,10 @@ index e002846515..621772963f 100644
  INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
  !endif
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index e1e1df4b9d..8bf848c647 100644
+index 55f3315241..6d1d2bd39b 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -992,10 +992,6 @@
+@@ -999,10 +999,6 @@
  !endif
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -96,7 +96,7 @@ index e1e1df4b9d..8bf848c647 100644
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index e586632664..b1d6c23a93 100644
+index 558a944f20..70556f8ace 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -323,7 +323,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -107,6 +107,3 @@ index e586632664..b1d6c23a93 100644
  INF  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
  INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
  !endif
--- 
-2.39.3
-

SOURCES/0020-ArmVirtPkg-Remove-TftpDynamicCommand-from-shell-RHEL.patch

@@ -1,7 +1,7 @@
-From 2795327b7185bec84238542ce94801733a41ffe3 Mon Sep 17 00:00:00 2001
+From a3493c0945f733e395ea7444f1639a42f8a717f0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:28 +0200
-Subject: ArmVirtPkg: Remove TftpDynamicCommand from shell (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove TftpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -23,10 +23,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  2 files changed, 3 insertions(+), 5 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
-index 2443e8351c..9534d6f95a 100644
+index fe6488ee99..5677bad717 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
-@@ -375,10 +375,9 @@
+@@ -385,10 +385,9 @@
    #
    MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
  
@@ -41,17 +41,14 @@ index 2443e8351c..9534d6f95a 100644
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 2b17211256..16a073c4a1 100644
+index dcb1b793d1..b1c3fcc66d 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-@@ -98,7 +98,6 @@ READ_LOCK_STATUS   = TRUE
+@@ -99,7 +99,6 @@ READ_LOCK_STATUS   = TRUE
-   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
+   INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
  
    INF ShellPkg/Application/Shell/Shell.inf
 -  INF ShellPkg/DynamicCommand/TftpDynamicCommand/TftpDynamicCommand.inf
    INF ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
+   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
    INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
- 
--- 
-2.39.3
-

SOURCES/0021-OvmfPkg-Remove-HttpDynamicCommand-from-shell-RHEL-on.patch

@@ -1,11 +1,15 @@
-From 8ddd92f068c1f5f5177db1bc381201118bd2816c Mon Sep 17 00:00:00 2001
+From 873a03ce289c988d822f1bb420c1e9a0eef5ca56 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:31 +0200
-Subject: OvmfPkg: Remove HttpDynamicCommand from shell (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove HttpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
+Rebase to edk2-stable202311:
+
+Minor update, context change due to new variable policy shell command.
+
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [15/19] 1911cf04f27467ef1175b1976864c1111d93d19e
@@ -27,10 +31,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  6 files changed, 15 deletions(-)
 
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index ed72cbf57e..078eab1acc 100644
+index 0183511722..970ffbad82 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -904,10 +904,6 @@
+@@ -913,10 +913,6 @@
  !endif
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -38,11 +42,11 @@ index ed72cbf57e..078eab1acc 100644
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
-   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 1d19e20e8a..5b2265c7d1 100644
+index cb95c842fa..891e0e06ef 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -54,10 +58,10 @@ index 1d19e20e8a..5b2265c7d1 100644
  !endif
  !if $(BUILD_SHELL) == TRUE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 9b97e664d7..6779503e7e 100644
+index 66554b42ed..3127e3d18d 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -918,10 +918,6 @@
+@@ -931,10 +931,6 @@
  !endif
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -65,11 +69,11 @@ index 9b97e664d7..6779503e7e 100644
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
-   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index 621772963f..da32cf1a2f 100644
+index 592f0fed82..61a827b365 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -298,7 +298,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -81,10 +85,10 @@ index 621772963f..da32cf1a2f 100644
  !endif
  !if $(BUILD_SHELL) == TRUE
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 8bf848c647..66f267f731 100644
+index 6d1d2bd39b..6f078b5b27 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -992,10 +992,6 @@
+@@ -999,10 +999,6 @@
  !endif
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -92,11 +96,11 @@ index 8bf848c647..66f267f731 100644
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
-   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index b1d6c23a93..7bf83e266c 100644
+index 70556f8ace..d2e1c2894f 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -323,7 +323,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -107,6 +111,3 @@ index b1d6c23a93..7bf83e266c 100644
  INF  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
  !endif
  !if $(BUILD_SHELL) == TRUE
--- 
-2.39.3
-

SOURCES/0022-ArmVirtPkg-Remove-HttpDynamicCommand-from-shell-RHEL.patch

@@ -1,11 +1,15 @@
-From a9ad729ef5a9dd474842e2e1e0c8be1166af1afa Mon Sep 17 00:00:00 2001
+From 4b212f0b5f5d2dbe595e53bc0b553abb90ee288a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:34 +0200
-Subject: ArmVirtPkg: Remove HttpDynamicCommand from shell (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove HttpDynamicCommand from shell (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
+Rebase to edk2-stable202311:
+
+Minor update, context change due to new variable policy shell command.
+
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [16/19] 07a74f1fdcdbb9a31d25ce9760edcd852e9574c3
@@ -23,10 +27,10 @@ Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
  2 files changed, 5 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
-index 9534d6f95a..d5ebc11ad8 100644
+index 5677bad717..d4c001e1bd 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
-@@ -378,10 +378,6 @@
+@@ -388,10 +388,6 @@
    #
    # UEFI application (Shell Embedded Boot Loader)
    #
@@ -34,21 +38,18 @@ index 9534d6f95a..d5ebc11ad8 100644
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 -  }
-   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
      <PcdsFixedAtBuild>
        gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 16a073c4a1..0a01c29722 100644
+index b1c3fcc66d..8153558686 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-@@ -98,7 +98,6 @@ READ_LOCK_STATUS   = TRUE
+@@ -99,7 +99,6 @@ READ_LOCK_STATUS   = TRUE
-   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
+   INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
  
    INF ShellPkg/Application/Shell/Shell.inf
 -  INF ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf
+   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
    INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
  
-   #
--- 
-2.39.3
-

SOURCES/0023-OvmfPkg-Remove-LinuxInitrdDynamicShellCommand-RHEL-o.patch

@@ -1,11 +1,15 @@
-From e07788f7cf34a364b770e2b979942bf1a8b659f0 Mon Sep 17 00:00:00 2001
+From 3635ecb975af26d0d4886b862f8cf812b891eb37 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:39 +0200
-Subject: OvmfPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
+Subject: [PATCH] OvmfPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
+Rebase to edk2-stable202311:
+
+Minor update, context change due to new variable policy shell command.
+
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [17/19] 491fe1301ea29c7cb56c20272e45614d5fcb6f14
@@ -23,21 +27,21 @@ Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- OvmfPkg/AmdSev/AmdSevX64.dsc | 4 ----
+ OvmfPkg/AmdSev/AmdSevX64.dsc |  4 ----
- OvmfPkg/AmdSev/AmdSevX64.fdf | 1 -
+ OvmfPkg/AmdSev/AmdSevX64.fdf |  1 -
- OvmfPkg/OvmfPkgIa32.dsc      | 4 ----
+ OvmfPkg/OvmfPkgIa32.dsc      | 32 ++++++++++++++------------------
- OvmfPkg/OvmfPkgIa32.fdf      | 1 -
+ OvmfPkg/OvmfPkgIa32.fdf      |  1 -
- OvmfPkg/OvmfPkgIa32X64.dsc   | 4 ----
+ OvmfPkg/OvmfPkgIa32X64.dsc   | 32 ++++++++++++++------------------
- OvmfPkg/OvmfPkgIa32X64.fdf   | 1 -
+ OvmfPkg/OvmfPkgIa32X64.fdf   |  1 -
- OvmfPkg/OvmfPkgX64.dsc       | 4 ----
+ OvmfPkg/OvmfPkgX64.dsc       | 32 ++++++++++++++------------------
- OvmfPkg/OvmfPkgX64.fdf       | 1 -
+ OvmfPkg/OvmfPkgX64.fdf       |  1 -
- 8 files changed, 20 deletions(-)
+ 8 files changed, 42 insertions(+), 62 deletions(-)
 
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 5987de6d83..427df673f3 100644
+index 41953c119d..7bb6ffb3f0 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
 +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -728,10 +728,6 @@
+@@ -740,10 +740,6 @@
    MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -49,10 +53,10 @@ index 5987de6d83..427df673f3 100644
    OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf
    OvmfPkg/AmdSev/Grub/Grub.inf
 diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index 4d2f9c7248..a48c93e2a5 100644
+index 2f03c80ffd..0e3d7bea2b 100644
 --- a/OvmfPkg/AmdSev/AmdSevX64.fdf
 +++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
-@@ -274,7 +274,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
+@@ -276,7 +276,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
  INF  FatPkg/EnhancedFatDxe/Fat.inf
  
  !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
@@ -61,13 +65,69 @@ index 4d2f9c7248..a48c93e2a5 100644
  INF OvmfPkg/AmdSev/SecretDxe/SecretDxe.inf
  INF  OvmfPkg/AmdSev/Grub/Grub.inf
 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
-index 078eab1acc..147774ef58 100644
+index 970ffbad82..83adecc374 100644
 --- a/OvmfPkg/OvmfPkgIa32.dsc
 +++ b/OvmfPkg/OvmfPkgIa32.dsc
-@@ -904,10 +904,6 @@
+@@ -537,7 +537,7 @@
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+ 
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+@@ -604,7 +604,7 @@
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+ !if $(SMM_REQUIRE) == FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+@@ -840,25 +840,25 @@
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+ !ifndef $(CSM_ENABLE)
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
  !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
  
- !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+   #
+   # ISA Support
+@@ -917,10 +917,6 @@
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@@ -76,7 +136,7 @@ index 078eab1acc..147774ef58 100644
  !if $(BUILD_SHELL) == TRUE
    ShellPkg/Application/Shell/Shell.inf {
 diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
-index 5b2265c7d1..56f2c45795 100644
+index 891e0e06ef..88c57ff5ff 100644
 --- a/OvmfPkg/OvmfPkgIa32.fdf
 +++ b/OvmfPkg/OvmfPkgIa32.fdf
 @@ -297,7 +297,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -88,13 +148,69 @@ index 5b2265c7d1..56f2c45795 100644
  !if $(BUILD_SHELL) == TRUE
  INF  ShellPkg/Application/Shell/Shell.inf
 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index 6779503e7e..a41bc32454 100644
+index 3127e3d18d..b47cdf63e7 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.dsc
 +++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -918,10 +918,6 @@
+@@ -544,7 +544,7 @@
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+ 
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+@@ -616,7 +616,7 @@
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+ !if $(SMM_REQUIRE) == FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+@@ -858,25 +858,25 @@
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+ !ifndef $(CSM_ENABLE)
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
  !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
  
- !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+   #
+   # ISA Support
+@@ -935,10 +935,6 @@
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@@ -103,7 +219,7 @@ index 6779503e7e..a41bc32454 100644
  !if $(BUILD_SHELL) == TRUE
    ShellPkg/Application/Shell/Shell.inf {
 diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
-index da32cf1a2f..9efbe6a06d 100644
+index 61a827b365..ab5a9bc306 100644
 --- a/OvmfPkg/OvmfPkgIa32X64.fdf
 +++ b/OvmfPkg/OvmfPkgIa32X64.fdf
 @@ -298,7 +298,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -115,13 +231,69 @@ index da32cf1a2f..9efbe6a06d 100644
  !if $(BUILD_SHELL) == TRUE
  INF  ShellPkg/Application/Shell/Shell.inf
 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
-index 66f267f731..ce363f748f 100644
+index 6f078b5b27..be3824ec1e 100644
 --- a/OvmfPkg/OvmfPkgX64.dsc
 +++ b/OvmfPkg/OvmfPkgX64.dsc
-@@ -992,10 +992,6 @@
+@@ -563,7 +563,7 @@
+   # DEBUG_VERBOSE   0x00400000  // Detailed debug messages that may
+   #                             // significantly impact boot performance
+   # DEBUG_ERROR     0x80000000  // Error
+-  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
++  gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8040004F
+ 
+ !if $(SOURCE_DEBUG_ENABLE) == TRUE
+   gEfiMdePkgTokenSpaceGuid.PcdDebugPropertyMask|0x17
+@@ -634,7 +634,7 @@
+   #   ($(SMM_REQUIRE) == FALSE)
+   gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved|0
+ 
+-  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
++  gEfiMdeModulePkgTokenSpaceGuid.PcdResizeXterm|FALSE
+ !if $(SMM_REQUIRE) == FALSE
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase64|0
+   gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64|0
+@@ -926,25 +926,25 @@
+   MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
+   MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf
+   MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf
+-  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
+   MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf
+   MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf
+   MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf
+   MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe.inf
+ 
+ !ifndef $(CSM_ENABLE)
+-  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
  !endif
+-  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
+-    <PcdsFixedAtBuild>
+-      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
+-  }
++  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf {
++    <PcdsFixedAtBuild>
++      gEfiMdePkgTokenSpaceGuid.PcdDebugPrintErrorLevel|0x8000004F
++  }
  
- !if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE
+   #
+   # ISA Support
+@@ -1003,10 +1003,6 @@
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@@ -130,7 +302,7 @@ index 66f267f731..ce363f748f 100644
  !if $(BUILD_SHELL) == TRUE
    ShellPkg/Application/Shell/Shell.inf {
 diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
-index 7bf83e266c..404e72dc7d 100644
+index d2e1c2894f..851399888f 100644
 --- a/OvmfPkg/OvmfPkgX64.fdf
 +++ b/OvmfPkg/OvmfPkgX64.fdf
 @@ -323,7 +323,6 @@ INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResour
@@ -141,6 +313,3 @@ index 7bf83e266c..404e72dc7d 100644
  !endif
  !if $(BUILD_SHELL) == TRUE
  INF  ShellPkg/Application/Shell/Shell.inf
--- 
-2.39.3
-

SOURCES/0024-ArmVirtPkg-Remove-LinuxInitrdDynamicShellCommand-RHE.patch

@@ -1,11 +1,15 @@
-From df6b72f26ffb68a28c45f426ad3225388e5fccff Mon Sep 17 00:00:00 2001
+From b91bdc055499a46d825b3c6a2613de5c77e3a66d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@redhat.com>
 Date: Thu, 1 Jul 2021 20:29:46 +0200
-Subject: ArmVirtPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
+Subject: [PATCH] ArmVirtPkg: Remove LinuxInitrdDynamicShellCommand (RHEL only)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
+Rebase to edk2-stable202311:
+
+Minor update, context change due to new variable policy shell command.
+
 RH-Author: Philippe Mathieu-Daudé <philmd@redhat.com>
 RH-MergeRequest: 3: Disable features for RHEL9
 RH-Commit: [18/19] 8f4e4007108462533e3d2050b84d8830073a7c0d
@@ -19,18 +23,28 @@ Suggested-by: Laszlo Ersek <lersek@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
 ---
- ArmVirtPkg/ArmVirt.dsc.inc           | 4 ----
+ ArmVirtPkg/ArmVirt.dsc.inc           | 10 +++-------
- ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 -
+ ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc |  1 -
- 2 files changed, 5 deletions(-)
+ 2 files changed, 3 insertions(+), 8 deletions(-)
 
 diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc
-index d5ebc11ad8..0b2b64c1cb 100644
+index d4c001e1bd..fee6e5b17f 100644
 --- a/ArmVirtPkg/ArmVirt.dsc.inc
 +++ b/ArmVirtPkg/ArmVirt.dsc.inc
-@@ -378,10 +378,6 @@
+@@ -385,17 +385,13 @@
-   #
+   #
-   # UEFI application (Shell Embedded Boot Loader)
+   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
-   #
+ 
+-  #
+-  # UEFI application (Shell Embedded Boot Loader)
+-  #
++  #
++  # UEFI application (Shell Embedded Boot Loader)
++  #
+   ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf {
+     <PcdsFixedAtBuild>
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+   }
 -  OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {
 -    <PcdsFixedAtBuild>
 -      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
@@ -39,17 +53,14 @@ index d5ebc11ad8..0b2b64c1cb 100644
      <LibraryClasses>
        ShellCommandLib|ShellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.inf
 diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 0a01c29722..4dbb77a6ca 100644
+index 8153558686..4cd53995d2 100644
 --- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
 +++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-@@ -98,7 +98,6 @@ READ_LOCK_STATUS   = TRUE
+@@ -100,7 +100,6 @@ READ_LOCK_STATUS   = TRUE
-   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
  
    INF ShellPkg/Application/Shell/Shell.inf
+   INF ShellPkg/DynamicCommand/VariablePolicyDynamicCommand/VariablePolicyDynamicCommand.inf
 -  INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf
  
    #
    # Bds
--- 
-2.39.3
-

SOURCES/0025-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch

@@ -1,7 +1,7 @@
-From a920227615c895522739bbbf3a5fb7f6a470de86 Mon Sep 17 00:00:00 2001
+From 41089770963055b4bc9662ba4204d8ee7907fbcd Mon Sep 17 00:00:00 2001
 From: Gerd Hoffmann <kraxel@redhat.com>
 Date: Tue, 28 Feb 2023 15:47:00 +0100
-Subject: [PATCH 09/12] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
+Subject: [PATCH] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
 
 RH-Author: Gerd Hoffmann <kraxel@redhat.com>
 RH-MergeRequest: 42: UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
@@ -13,15 +13,19 @@ In case the number of CPUs can in increase beyond 255
 due to CPU hotplug choose x2apic mode.
 
 Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+patch_name: edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
+present_in_specfile: true
+location_in_specfile: 38
 ---
  UefiCpuPkg/Library/MpInitLib/MpLib.c | 8 +++++++-
  1 file changed, 7 insertions(+), 1 deletion(-)
 
 diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
-index f1f2840714..79fd8fb04d 100644
+index 9a6ec5db5c..14ecc62f2b 100644
 --- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
 +++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
-@@ -526,7 +526,9 @@ CollectProcessorCount (
+@@ -527,7 +527,9 @@ CollectProcessorCount (
    //
    // Enable x2APIC mode if
    //  1. Number of CPU is greater than 255; or
@@ -32,7 +36,7 @@ index f1f2840714..79fd8fb04d 100644
    //
    X2Apic = FALSE;
    if (CpuMpData->CpuCount > 255) {
-@@ -534,6 +536,10 @@ CollectProcessorCount (
+@@ -535,6 +537,10 @@ CollectProcessorCount (
      // If there are more than 255 processor found, force to enable X2APIC
      //
      X2Apic = TRUE;
@@ -43,6 +47,3 @@ index f1f2840714..79fd8fb04d 100644
    } else {
      CpuInfoInHob = (CPU_INFO_IN_HOB *)(UINTN)CpuMpData->CpuInfoInHob;
      for (Index = 0; Index < CpuMpData->CpuCount; Index++) {
--- 
-2.39.3
-

SOURCES/0025-recreate-import-redhat-directory.patch

@@ -1,164 +0,0 @@
-From 37e0f9ed6e872224afe70065627de3965689425c Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Wed, 11 Jun 2014 20:45:26 +0200
-Subject: recreate / import "redhat/" directory
-
-This patch now unites the following downstream commits:
-
-- 18bd1193e7 .distro: simplify WORKSPACE setup
-- b00f3398c8 fix tpm build options
-- e032ab1675 spec: Centralize non-firmware %install files at the top
-- 8501863acc spec: Don't put build output in the top directory
-- e6ec0363d3 spec: Factor out OVMF_FLAGS and OVMF_SB_FLAGS
-- 596f34c8b6 spec: Use %make_build macro
-- 55169e466d spec: Replace RPM_BUILD_ROOT with %{buildroot}
-- 69c4c60920 spec: Split out build_iso() function
-- ed67da8c85 spec: Add %{qosb_testing} macro
-- 44519f5b94 spec: Move %check to between %install and %files
-- b37b334dc7 spec: Remove extra 'true' at end of %check
-- dd11149c3a spec: Add %{qemu_package} and %{qemu_binary}
-- 0f5d4ae0d5 spec: Move -D TPM_ENABLE to common CC_FLAGS
-- 84b3fd93f9 spec: Replace ifarch+else conditionals with build_XXX variables
-- e97f79e744 spec: Use %autosetup with our required git config options
-- 45a347a759 spec: don't conditionalize %package definitions
-- acfcfaea1e spec: Add BuildRequires: make
-- d917a93f6f spec: remove Group: and %defattr
-- f2d3be3ae3 redhat: build UefiShell.iso with xorriso rather than genisoimage
-- 3fb4a20f30 redhat: narrow the "qemu-kvm" BuildRequires down to "qemu-kvm-core"
-- bfb89c4ae5 redhat: drop Split tool from the edk2-tools subpackage
-- ac8be2e0ef redhat: refresh "Makefile.common" for the 8.5 rebase
-- 2bd2d18864 redhat: filter out jansson submodule removal hunks
-- f13d7899ed recreate / import "redhat/" directory
-
-Merged patches (edk2-stable202202):
-- 1a7b1c3b72 spec: adapt specfile to build option changes, disable tpm1
-- 96eb388be3 spec: build amdsev variant
-- ea34352d41 redhat: bump OpenSSL dist-git submodule to a75722161d20 / RHEL-8.5
-
-Merged patches (edk2-stable202208):
-- a60bf3fd10 Adding support for CentOS 9 build
-- d3f25d438c OvmfPkg: Update target machines config
-- d63f783930 openssl: jump to 8.7.0 branch (2022-07-22)
-- 39882ce96d qemu-ovmf-secureboot: Do not use submodule
-- 283ef4a67d ovmf-vars-generator: Use max cpu
-- b6887ef7e1 Update build target to RHEL 9.2.0
-
-Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
-
-Merged patches (edk2-stable202305):
-- 5eef16bd65 remove amd-sev feature flag from secure boot builds (rh only)
-- cc9e1b6eaa build script update
-- 046c1f08e6 PcdDxeNxMemoryProtectionPolicy update
-- b9dc1b5365 add aarch64 qcow2 images
-- f4e2d6bf41 update json files
-- be03b42128 add libvirt version conflict
-- dce699b61d add dbx update blob (rh only)
-- d8b2407343 spec: apply dbx update (rh only)
-- a8a5ef95b5 dbx update, 2023-05-09, black lotus edition
-- 310e179053 json descriptors: explicitly set mode = split
-- additionally
-  - update frh.py, add new upstream submodules
-  - replace egrep with grep -E and fgrep with grep -F in downstream
-    scripts
-  - remove git commit sha from package version string
-
-Signed-off-by: Oliver Steffen <osteffen@redhat.com>
-
-drop  git sha
-
-Signed-off-by: Oliver Steffen <osteffen@redhat.com>
----
- .distro/.gitignore                            |    3 +
- .distro/DBXUpdate-20230314.x64.bin            |  Bin 0 -> 13922 bytes
- .distro/DBXUpdate-20230509.x64.bin            |  Bin 0 -> 21170 bytes
- .distro/Makefile                              |  114 +
- .distro/Makefile.common                       |   31 +
- .distro/README                                |  236 ++
- .distro/RedHatSecureBootPkKek1.pem            |   22 +
- .distro/TargetRelease                         |    4 +
- .distro/edk2-build.py                         |  391 +++
- .distro/edk2-build.rhel-9                     |  119 +
- .distro/edk2.spec.template                    | 1301 +++++++++
- .../30-edk2-ovmf-x64-sb-enrolled.json         |   36 +
- .distro/metafiles/40-edk2-ovmf-x64-sb.json    |   35 +
- .distro/metafiles/50-edk2-aarch64-qcow2.json  |   32 +
- .distro/metafiles/50-edk2-ovmf-x64-nosb.json  |   35 +
- .distro/metafiles/51-edk2-aarch64-raw.json    |   32 +
- .../52-edk2-aarch64-verbose-qcow2.json        |   32 +
- .../53-edk2-aarch64-verbose-raw.json          |   32 +
- .../metafiles/60-edk2-ovmf-x64-amdsev.json    |   31 +
- .../metafiles/60-edk2-ovmf-x64-inteltdx.json  |   29 +
- .distro/openssl-rhel                          |    1 +
- .distro/ovmf-whitepaper-c770f8c.txt           | 2422 +++++++++++++++++
- .distro/qemu-ovmf-secureboot/CONTRIBUTING     |   45 +
- .distro/qemu-ovmf-secureboot/LICENSE          |   21 +
- .distro/qemu-ovmf-secureboot/README.md        |   66 +
- .../qemu-ovmf-secureboot/ovmf-vars-generator  |  296 ++
- .distro/rpmbuild/BUILD/.gitignore             |    2 +
- .distro/rpmbuild/RPMS/.gitignore              |    2 +
- .distro/rpmbuild/SOURCES/.gitignore           |    2 +
- .distro/rpmbuild/SPECS/.gitignore             |    2 +
- .distro/rpmbuild/SRPMS/.gitignore             |    2 +
- .distro/scripts/edk2-guids                    |   85 +
- .distro/scripts/frh.py                        |   51 +
- .distro/scripts/git-backport-diff             |  327 +++
- .distro/scripts/git-compile-check             |  215 ++
- .distro/scripts/openssl-update                |   79 +
- .distro/scripts/process-patches.sh            |   75 +
- .distro/scripts/tarball_checksum.sh           |    3 +
- .gitattributes                                |   15 +
- .gitignore                                    |   16 +-
- .gitmodules                                   |    4 +
- sources                                       |    1 +
- 42 files changed, 6240 insertions(+), 7 deletions(-)
- create mode 100644 .distro/.gitignore
- create mode 100644 .distro/DBXUpdate-20230314.x64.bin
- create mode 100644 .distro/DBXUpdate-20230509.x64.bin
- create mode 100644 .distro/Makefile
- create mode 100644 .distro/Makefile.common
- create mode 100644 .distro/README
- create mode 100644 .distro/RedHatSecureBootPkKek1.pem
- create mode 100644 .distro/TargetRelease
- create mode 100755 .distro/edk2-build.py
- create mode 100644 .distro/edk2-build.rhel-9
- create mode 100644 .distro/edk2.spec.template
- create mode 100644 .distro/metafiles/30-edk2-ovmf-x64-sb-enrolled.json
- create mode 100644 .distro/metafiles/40-edk2-ovmf-x64-sb.json
- create mode 100644 .distro/metafiles/50-edk2-aarch64-qcow2.json
- create mode 100644 .distro/metafiles/50-edk2-ovmf-x64-nosb.json
- create mode 100644 .distro/metafiles/51-edk2-aarch64-raw.json
- create mode 100644 .distro/metafiles/52-edk2-aarch64-verbose-qcow2.json
- create mode 100644 .distro/metafiles/53-edk2-aarch64-verbose-raw.json
- create mode 100644 .distro/metafiles/60-edk2-ovmf-x64-amdsev.json
- create mode 100644 .distro/metafiles/60-edk2-ovmf-x64-inteltdx.json
- create mode 160000 .distro/openssl-rhel
- create mode 100644 .distro/ovmf-whitepaper-c770f8c.txt
- create mode 100644 .distro/qemu-ovmf-secureboot/CONTRIBUTING
- create mode 100644 .distro/qemu-ovmf-secureboot/LICENSE
- create mode 100644 .distro/qemu-ovmf-secureboot/README.md
- create mode 100755 .distro/qemu-ovmf-secureboot/ovmf-vars-generator
- create mode 100644 .distro/rpmbuild/BUILD/.gitignore
- create mode 100644 .distro/rpmbuild/RPMS/.gitignore
- create mode 100644 .distro/rpmbuild/SOURCES/.gitignore
- create mode 100644 .distro/rpmbuild/SPECS/.gitignore
- create mode 100644 .distro/rpmbuild/SRPMS/.gitignore
- create mode 100755 .distro/scripts/edk2-guids
- create mode 100644 .distro/scripts/frh.py
- create mode 100755 .distro/scripts/git-backport-diff
- create mode 100755 .distro/scripts/git-compile-check
- create mode 100755 .distro/scripts/openssl-update
- create mode 100755 .distro/scripts/process-patches.sh
- create mode 100755 .distro/scripts/tarball_checksum.sh
- create mode 100644 .gitattributes
- create mode 100644 sources
-
-diff --git a/sources b/sources
-new file mode 100644
-index 0000000000..ea8c8ad50b
---- /dev/null
-+++ b/sources
-@@ -0,0 +1 @@
-+SHA512 (edk2-ba91d0292e.tar.xz) = 3b21cc39671d28bfeb059da3683751cc5277c63a894b2a05bdfbd2bbe53545c34f04c229becf44f1563f89a738f37ae8f2333076d126a7e94d234bc4bb25454c
--- 
-2.39.3
-

SOURCES/0026-CryptoPkg-OpensslLib-list-RHEL8-specific-OpenSSL-fil.patch

@@ -1,181 +0,0 @@
-From fb3719378d7ce646c684fc2c8b52806aca0c576a Mon Sep 17 00:00:00 2001
-From: Laszlo Ersek <lersek@redhat.com>
-Date: Sat, 16 Nov 2019 17:11:27 +0100
-Subject: CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files in the INFs
- (RH)
-
-Notes about the RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] ->
-RHEL-8.5/20210520-e1999b264f1f [edk2-stable202105] rebase:
-
-- Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1938257
-
-- Recreate the patch based on downstream commits:
-
-  - 56c4bb81b311 ("CryptoPkg/OpensslLib: list RHEL8-specific OpenSSL files
-                  in the INFs (RH)", 2020-06-05),
-  - e81751a1c303 ("CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1g",
-                  2020-11-23),
-  - 3e3fe5e62079 ("redhat: bump OpenSSL dist-git submodule to 1.1.1g+ /
-                  RHEL-8.4", 2020-11-23).
-
-  (1) At e81751a1c303, downstream edk2 was in sync with upstream edk2
-      consuming OpenSSL 1.1.1g (upstream edk2 commit 8c30327debb2
-      ("CryptoPkg/OpensslLib: Upgrade OpenSSL to 1.1.1g", 2020-07-25)).
-
-      Since commit 8c30327debb2, upstream edk2 modified the OpensslLib INF
-      files, namely
-
-      - CryptoPkg/Library/OpensslLib/OpensslLib.inf
-      - CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-
-      in the following commits only:
-
-      - be01087e0780 ("CryptoPkg/Library: Remove the redundant build
-        option", 2020-08-12), which did not affect the source file list at
-        all,
-
-      - b5701a4c7a0f ("CryptoPkg: OpensslLib: Use RngLib to generate
-        entropy in rand_pool", 2020-09-18), which replaced some of the
-        *edk2-specific* "rand_pool_noise" source files with an RngLib
-        dependency.
-
-      This means that the list of required, actual OpenSSL source files
-      has not changed in upstream edk2 since our downstream edk2 commit
-      e81751a1c303.
-
-  (2) At commit 3e3fe5e62079 (the direct child of e81751a1c303),
-      downstream edk2's OpenSSL dependency was satisfied with RHEL-8
-      OpenSSL at dist-git commit bdd048e929dc ("Two fixes that will be
-      shipped in RHEL-8.3.0.z", 2020-10-23).
-
-      Since commit bdd048e929dc, RHEL-8 OpenSSL dist-git advanced
-      (fast-forwarded) to commit a75722161d20 ("Update to version 1.1.1k",
-      2021-05-25), which is the current head of the rhel-8.5.0 branch.
-      (See also <https://bugzilla.redhat.com/show_bug.cgi?id=1938257#c6>.)
-
-      At both dist-git bdd048e929dc and dist-git a75722161d20, I built the
-      respective RHEL-8 OpenSSL *source* RPM, and prepped the respective
-      source tree, with "rpmbuild -bp". Subsequently I compared the
-      prepped source trees recursively.
-
-      - The following files disappeared:
-
-        - 29 backup files created by "patch",
-
-        - the assembly generator perl script called
-          "ecp_nistz256-avx2.pl", which is not used during the build.
-
-      - The following new files appeared:
-
-        - 18 files directly or indirectly under the "test" subdirectory,
-          which are not used during the build,
-
-        - 5 backup files created by "patch",
-
-        - 2 DCL scripts used when building OpenSSL on OpenVMS.
-
-      This means that the total list of RHEL-8 OpenSSL source files has
-      not changed in RHEL-8 OpenSSL dist-git since our downstream edk2
-      commit 3e3fe5e62079.
-
-  As a result, copy the "RHEL8-specific OpenSSL file list" sections
-  verbatim from the INF files, at downstream commit e81751a1c303. (I used
-  the "git checkout -p e81751a1c303 -- Library/OpensslLib/OpensslLib.inf
-  CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf" command.)
-
-Notes about the RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] ->
-RHEL-8.3/20200603-ca407c7246bf [edk2-stable202005] rebase:
-
-- "OpensslLib.inf":
-
-  - Automatic leading context refresh against upstream commit c72ca4666886
-    ("CryptoPkg/OpensslLib: Add "sort" keyword to header file parsing
-    loop", 2020-03-10).
-
-  - Manual trailing context refresh against upstream commit b49a6c8f80d9
-    ("CryptoPkg/OpensslLib: improve INF file consistency", 2019-12-02).
-
-- "OpensslLibCrypto.inf":
-
-  - Automatic leading context refresh against upstream commits
-    8906f076de35 ("CryptoPkg/OpensslLib: Add missing header files in INF
-    file", 2019-08-16) and 9f4fbd56d430 ("CryptoPkg/OpensslLib: Update
-    process_files.pl to generate .h files", 2019-10-30).
-
-Notes about the RHEL-8.1/20190308-89910a39dcfd [edk2-stable201903] ->
-RHEL-8.2/20190904-37eef91017ad [edk2-stable201908] rebase:
-
-- new patch
-
-The downstream changes in RHEL8's OpenSSL package, for example in
-"openssl-1.1.1-evp-kdf.patch", introduce new files, and even move some
-preexistent code into those new files. In order to avoid undefined
-references in link editing, we have to list the new files.
-
-Note: "process_files.pl" is not re-run at this time manually, because
-
-(a) "process_files.pl" would pollute the file list (and some of the
-    auto-generated header files) with RHEL8-specific FIPS artifacts, which
-    are explicitly unwanted in edk2,
-
-(b) The RHEL OpenSSL maintainer, Tomas Mraz, identified this specific set
-    of files in <https://bugzilla.redhat.com/show_bug.cgi?id=1749693#c10>,
-    and will help with future changes too.
-
-Signed-off-by: Laszlo Ersek <lersek@redhat.com>
-(cherry picked from commit 57bd3f146590df8757865d8f2cdd1db3cf3f4d40)
-(cherry picked from commit 56c4bb81b311dfcee6a34c81d3e4feeda7f88995)
----
- CryptoPkg/Library/OpensslLib/OpensslLib.inf       | 12 ++++++++++++
- CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 12 ++++++++++++
- 2 files changed, 24 insertions(+)
-
-diff --git a/CryptoPkg/Library/OpensslLib/OpensslLib.inf b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
-index 0f64c9fa7e..1641754e4d 100644
---- a/CryptoPkg/Library/OpensslLib/OpensslLib.inf
-+++ b/CryptoPkg/Library/OpensslLib/OpensslLib.inf
-@@ -576,6 +576,18 @@
-   $(OPENSSL_PATH)/ssl/statem/statem.h
-   $(OPENSSL_PATH)/ssl/statem/statem_local.h
- # Autogenerated files list ends here
-+# RHEL8-specific OpenSSL file list starts here
-+  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
-+  $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
-+  $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/kdf_local.h
-+  $(OPENSSL_PATH)/crypto/kdf/kdf_util.c
-+  $(OPENSSL_PATH)/crypto/kdf/krb5kdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/pbkdf2.c
-+  $(OPENSSL_PATH)/crypto/kdf/sshkdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/sskdf.c
-+# RHEL8-specific OpenSSL file list ends here
-   buildinf.h
-   ossl_store.c
-   rand_pool.c
-diff --git a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-index 311cd1e605..7e980a7d03 100644
---- a/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-+++ b/CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
-@@ -526,6 +526,18 @@
-   $(OPENSSL_PATH)/crypto/x509v3/standard_exts.h
-   $(OPENSSL_PATH)/crypto/x509v3/v3_admis.h
- # Autogenerated files list ends here
-+# RHEL8-specific OpenSSL file list starts here
-+  $(OPENSSL_PATH)/crypto/bn/rsa_sup_mul.c
-+  $(OPENSSL_PATH)/crypto/evp/kdf_lib.c
-+  $(OPENSSL_PATH)/crypto/evp/pkey_kdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/kbkdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/kdf_local.h
-+  $(OPENSSL_PATH)/crypto/kdf/kdf_util.c
-+  $(OPENSSL_PATH)/crypto/kdf/krb5kdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/pbkdf2.c
-+  $(OPENSSL_PATH)/crypto/kdf/sshkdf.c
-+  $(OPENSSL_PATH)/crypto/kdf/sskdf.c
-+# RHEL8-specific OpenSSL file list ends here
-   buildinf.h
-   ossl_store.c
-   rand_pool.c
--- 
-2.39.3
-

SOURCES/0026-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch

@@ -1,7 +1,7 @@
-From 9f0b4df867e6a2d56838e4048be245eac3fcc18e Mon Sep 17 00:00:00 2001
+From 5870362631ee204936f495b8e60eb2611bb05c3b Mon Sep 17 00:00:00 2001
 From: Oliver Steffen <osteffen@redhat.com>
 Date: Wed, 16 Aug 2023 12:09:40 +0200
-Subject: [PATCH 3/3] OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
+Subject: [PATCH] OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
 
 RH-Author: Oliver Steffen <osteffen@redhat.com>
 RH-MergeRequest: 46: OvmfPkg/AmdSevDxe: Shim Reboot workaround (RHEL only)
@@ -17,6 +17,10 @@ guest that uses shim is booted with a vtpm device present.
 BZ 2218196
 
 Signed-off-by: Oliver Steffen <osteffen@redhat.com>
+
+patch_name: edk2-OvmfPkg-AmdSevDxe-Shim-Reboot-workaround-RHEL-only.patch
+present_in_specfile: true
+location_in_specfile: 44
 ---
  OvmfPkg/AmdSevDxe/AmdSevDxe.c   | 42 +++++++++++++++++++++++++++++++++
  OvmfPkg/AmdSevDxe/AmdSevDxe.inf |  2 ++
@@ -115,6 +119,3 @@ index e7c7d526c9..09cbd2b0ca 100644
  
  [Pcd]
    gUefiOvmfPkgTokenSpaceGuid.PcdOvmfHostBridgePciDevId
--- 
-2.39.3
-

SOURCES/0027-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch

@@ -1,27 +0,0 @@
-From 218d3b32592bffe5ec7317c4838d29e92b4b86f0 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 2 Mar 2023 12:01:36 +0100
-Subject: OvmfPkg: disable dynamic mmio window (rhel only)
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
----
- OvmfPkg/Library/PlatformInitLib/MemDetect.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-index acf90b4e93..86700fc028 100644
---- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-+++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-@@ -679,7 +679,8 @@ PlatformDynamicMmioWindow (
-   AddrSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth);
-   MmioSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth - 3);
- 
--  if ((PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
-+  if (FALSE /* disable for RHEL-9.2, libvirt is not ready yet */ &&
-+      (PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
-       (PlatformInfoHob->PcdPciMmio64Base + MmioSpace < AddrSpace))
-   {
-     DEBUG ((DEBUG_INFO, "%a: using dynamic mmio window\n", __func__));
--- 
-2.39.3
-

SOURCES/0027-recreate-import-.distro-directory.patch

@@ -0,0 +1,85 @@
+From 771ce5bae1eb03240b04dde05a7a40dcec3c8a10 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Wed, 11 Jun 2014 20:45:26 +0200
+Subject: [PATCH] recreate / import ".distro/" directory
+
+This patch now unites the following downstream commits:
+
+- 18bd1193e7 .distro: simplify WORKSPACE setup
+- b00f3398c8 fix tpm build options
+- e032ab1675 spec: Centralize non-firmware %install files at the top
+- 8501863acc spec: Don't put build output in the top directory
+- e6ec0363d3 spec: Factor out OVMF_FLAGS and OVMF_SB_FLAGS
+- 596f34c8b6 spec: Use %make_build macro
+- 55169e466d spec: Replace RPM_BUILD_ROOT with %{buildroot}
+- 69c4c60920 spec: Split out build_iso() function
+- ed67da8c85 spec: Add %{qosb_testing} macro
+- 44519f5b94 spec: Move %check to between %install and %files
+- b37b334dc7 spec: Remove extra 'true' at end of %check
+- dd11149c3a spec: Add %{qemu_package} and %{qemu_binary}
+- 0f5d4ae0d5 spec: Move -D TPM_ENABLE to common CC_FLAGS
+- 84b3fd93f9 spec: Replace ifarch+else conditionals with build_XXX variables
+- e97f79e744 spec: Use %autosetup with our required git config options
+- 45a347a759 spec: don't conditionalize %package definitions
+- acfcfaea1e spec: Add BuildRequires: make
+- d917a93f6f spec: remove Group: and %defattr
+- f2d3be3ae3 redhat: build UefiShell.iso with xorriso rather than genisoimage
+- 3fb4a20f30 redhat: narrow the "qemu-kvm" BuildRequires down to "qemu-kvm-core"
+- bfb89c4ae5 redhat: drop Split tool from the edk2-tools subpackage
+- ac8be2e0ef redhat: refresh "Makefile.common" for the 8.5 rebase
+- 2bd2d18864 redhat: filter out jansson submodule removal hunks
+- f13d7899ed recreate / import "redhat/" directory
+
+Merged patches (edk2-stable202202):
+- 1a7b1c3b72 spec: adapt specfile to build option changes, disable tpm1
+- 96eb388be3 spec: build amdsev variant
+- ea34352d41 redhat: bump OpenSSL dist-git submodule to a75722161d20 / RHEL-8.5
+
+Merged patches (edk2-stable202208):
+- a60bf3fd10 Adding support for CentOS 9 build
+- d3f25d438c OvmfPkg: Update target machines config
+- d63f783930 openssl: jump to 8.7.0 branch (2022-07-22)
+- 39882ce96d qemu-ovmf-secureboot: Do not use submodule
+- 283ef4a67d ovmf-vars-generator: Use max cpu
+- b6887ef7e1 Update build target to RHEL 9.2.0
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+
+Merged patches (edk2-stable202305):
+- 5eef16bd65 remove amd-sev feature flag from secure boot builds (rh only)
+- cc9e1b6eaa build script update
+- 046c1f08e6 PcdDxeNxMemoryProtectionPolicy update
+- b9dc1b5365 add aarch64 qcow2 images
+- f4e2d6bf41 update json files
+- be03b42128 add libvirt version conflict
+- dce699b61d add dbx update blob (rh only)
+- d8b2407343 spec: apply dbx update (rh only)
+- a8a5ef95b5 dbx update, 2023-05-09, black lotus edition
+- 310e179053 json descriptors: explicitly set mode = split
+- additionally
+  - update frh.py, add new upstream submodules
+  - replace egrep with grep -E and fgrep with grep -F in downstream
+    scripts
+  - remove git commit sha from package version string
+
+Signed-off-by: Oliver Steffen <osteffen@redhat.com>
+
+Rebase to edk2-stable202311: squash commits:
+
+- 5b833f0c8d Update TargetRelease to support 9.4.0
+- 20024b4cbe Use fixed length for short hash for Makefile
+- 8618f7367e Updated TargetRelease content to support 9.4.0 only.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ sources | 1 +
+ 1 file changed, 1 insertion(+)
+ create mode 100644 sources
+
+diff --git a/sources b/sources
+new file mode 100644
+index 0000000000..ea8c8ad50b
+--- /dev/null
++++ b/sources
+@@ -0,0 +1 @@
++SHA512 (edk2-ba91d0292e.tar.xz) = 3b21cc39671d28bfeb059da3683751cc5277c63a894b2a05bdfbd2bbe53545c34f04c229becf44f1563f89a738f37ae8f2333076d126a7e94d234bc4bb25454c

SOURCES/0028-ArmPkg-Disable-EFI_MEMORY_ATTRIBUTE_PROTOCOL-RH-only.patch

@@ -1,76 +0,0 @@
-From 5c2e46b64824e5432181507ec0706f7fe74c3fe2 Mon Sep 17 00:00:00 2001
-From: Oliver Steffen <osteffen@redhat.com>
-Date: Mon, 19 Jun 2023 11:21:52 +0200
-Subject: ArmPkg: Disable EFI_MEMORY_ATTRIBUTE_PROTOCOL (RH only)
-
-Recent versions of shim (15.6 and 15.7) crash when the newly added
-EFI_MEMORY_ATTRIBUTE_PROTOCOL is provided by the firmware.  To allow
-existing installations to boot, provide a workaround in form of a Pcd
-that allows tuning it off at build time (defaults to 'enabled').
-Additionally, check the return code of the protocol installation calls.
-
-Disable the EFI_MEMORY_ATTRIBUTE_PROTOCOL protocol out builds.
-
-Signed-off-by: Oliver Steffen <osteffen@redhat.com>
----
- .distro/edk2-build.rhel-9        |  2 ++
- ArmPkg/ArmPkg.dec                |  3 +++
- ArmPkg/Drivers/CpuDxe/CpuDxe.c   | 13 +++++++++++--
- ArmPkg/Drivers/CpuDxe/CpuDxe.inf |  1 +
- 4 files changed, 17 insertions(+), 2 deletions(-)
-
-diff --git a/ArmPkg/ArmPkg.dec b/ArmPkg/ArmPkg.dec
-index 2444457ae5..d9e579b5fa 100644
---- a/ArmPkg/ArmPkg.dec
-+++ b/ArmPkg/ArmPkg.dec
-@@ -167,6 +167,9 @@
-   gArmTokenSpaceGuid.PcdCpuVectorBaseAddress|0xffff0000|UINT64|0x00000004
-   gArmTokenSpaceGuid.PcdCpuResetAddress|0x00000000|UINT32|0x00000005
- 
-+  # Enable/Disable EFI_MEMORY_ATTRIBUTE_PROTOCOL
-+  gArmTokenSpaceGuid.PcdEnableEfiMemoryAttributeProtocol|TRUE|BOOLEAN|0x000000EE
-+
-   #
-   # ARM Secure Firmware PCDs
-   #
-diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.c b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
-index d04958e79e..ff7d735b2b 100644
---- a/ArmPkg/Drivers/CpuDxe/CpuDxe.c
-+++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.c
-@@ -244,10 +244,19 @@ CpuDxeInitialize (
-                   &mCpuHandle,
-                   &gEfiCpuArchProtocolGuid,
-                   &mCpu,
--                  &gEfiMemoryAttributeProtocolGuid,
--                  &mMemoryAttribute,
-                   NULL
-                   );
-+  ASSERT_EFI_ERROR (Status);
-+
-+  if (PcdGetBool (PcdEnableEfiMemoryAttributeProtocol)) {
-+    Status = gBS->InstallMultipleProtocolInterfaces (
-+                    &mCpuHandle,
-+                    &gEfiMemoryAttributeProtocolGuid,
-+                    &mMemoryAttribute,
-+                    NULL
-+                    );
-+    ASSERT_EFI_ERROR (Status);
-+  }
- 
-   //
-   // Make sure GCD and MMU settings match. This API calls gDS->SetMemorySpaceAttributes ()
-diff --git a/ArmPkg/Drivers/CpuDxe/CpuDxe.inf b/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
-index e732e21cb9..1bad4ae160 100644
---- a/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
-+++ b/ArmPkg/Drivers/CpuDxe/CpuDxe.inf
-@@ -64,6 +64,7 @@
- 
- [Pcd.common]
-   gArmTokenSpaceGuid.PcdVFPEnabled
-+  gArmTokenSpaceGuid.PcdEnableEfiMemoryAttributeProtocol
- 
- [FeaturePcd.common]
-   gArmTokenSpaceGuid.PcdDebuggerExceptionSupport
--- 
-2.39.3
-

SOURCES/0028-distro-apply-git-diff-c9s-new_c9s-by-mirek.patch

@@ -0,0 +1,27 @@
+From c0347206c55c9d4d69b46725e9edbb21448f7494 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 28 Nov 2023 12:11:55 +0100
+Subject: [PATCH] distro: apply 'git diff c9s new_c9s' by mirek
+
+Bring .distro toi latest standards for more automatic support.
+---
+ CryptoPkg/.gitignore | 1 -
+ sources              | 1 -
+ 2 files changed, 2 deletions(-)
+ delete mode 100644 CryptoPkg/.gitignore
+ delete mode 100644 sources
+
+diff --git a/CryptoPkg/.gitignore b/CryptoPkg/.gitignore
+deleted file mode 100644
+index 68b83272b7..0000000000
+--- a/CryptoPkg/.gitignore
++++ /dev/null
+@@ -1 +0,0 @@
+-Library/OpensslLib/openssl*/
+diff --git a/sources b/sources
+deleted file mode 100644
+index ea8c8ad50b..0000000000
+--- a/sources
++++ /dev/null
+@@ -1 +0,0 @@
+-SHA512 (edk2-ba91d0292e.tar.xz) = 3b21cc39671d28bfeb059da3683751cc5277c63a894b2a05bdfbd2bbe53545c34f04c229becf44f1563f89a738f37ae8f2333076d126a7e94d234bc4bb25454c

SOURCES/0029-CryptoPkg-CrtLib-add-stat.h-include-file.patch

@@ -0,0 +1,28 @@
+From 192cc2b49dbccc59f5731e2abc120bed3e06cc32 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 28 Aug 2023 13:11:02 +0200
+Subject: [PATCH] CryptoPkg/CrtLib: add stat.h include file.
+
+Needed by rhel downstream openssl patches.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ CryptoPkg/Library/Include/sys/stat.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+ create mode 100644 CryptoPkg/Library/Include/sys/stat.h
+
+diff --git a/CryptoPkg/Library/Include/sys/stat.h b/CryptoPkg/Library/Include/sys/stat.h
+new file mode 100644
+index 0000000000..22247bb2db
+--- /dev/null
++++ b/CryptoPkg/Library/Include/sys/stat.h
+@@ -0,0 +1,9 @@
++/** @file
++  Include file to support building the third-party cryptographic library.
++
++Copyright (c) 2010 - 2017, Intel Corporation. All rights reserved.<BR>
++SPDX-License-Identifier: BSD-2-Clause-Patent
++
++**/
++
++#include <CrtLibSupport.h>

SOURCES/0029-OvmfPkg-PciHotPlugInitDxe-Do-not-reserve-IO-ports-by.patch

@@ -1,46 +0,0 @@
-From 8f924bd2691789f6b0d9deae9ddb046677a0610b Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Tue, 16 May 2023 11:47:58 +0200
-Subject: OvmfPkg/PciHotPlugInitDxe: Do not reserve IO ports by default.
-
-Flip the default for IO address space reservations for PCI(e) bridges
-and root ports with hotplug support from TRUE to FALSE.
-
-PCI(e) bridges will still get IO address space assigned in case:
-
-  (a) Downstream devices actually need IO address space, or
-  (b) Explicit configuration, using "qemu -device
-      pcie-root-port,io-reserve=<size>".
-
-In case IO address space is exhausted edk2 will stop assigning resources
-to PCI(e) bridges.  This is not limited to IO resources, the affected
-bridges will not get any memory resources assigned either.
-
-This patch solves this issue by not handing out the scarce IO address
-space, which is not needed in most cases anyway.  Result is a more
-consistent PCI configuration in virtual machine configurations with many
-PCie root ports.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit 27727338b2c0e3f50eb0176a1044e903fcb3c3b1)
----
- OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c b/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
-index 6b2b6797b3..69903a6009 100644
---- a/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
-+++ b/OvmfPkg/PciHotPlugInitDxe/PciHotPlugInit.c
-@@ -589,7 +589,7 @@ GetResourcePadding (
-     return EFI_INVALID_PARAMETER;
-   }
- 
--  DefaultIo       = TRUE;
-+  DefaultIo       = FALSE;
-   DefaultMmio     = TRUE;
-   DefaultPrefMmio = TRUE;
- 
--- 
-2.39.3
-

SOURCES/0030-CryptoPkg-CrtLib-add-access-open-read-write-close-sy.patch

@@ -0,0 +1,139 @@
+From 09ccd0ffae512d7f0a7548cdfbc60e1482153796 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 28 Aug 2023 13:27:09 +0200
+Subject: [PATCH] CryptoPkg/CrtLib: add access/open/read/write/close syscalls
+
+Needed by rhel downstream openssl patches, they use unix syscalls
+for file access (instead of fopen + friends like the rest of the
+code base).  No actual file access is needed for edk2, so just
+add stubs to make linking work.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ .../Library/BaseCryptLib/SysCall/CrtWrapper.c | 46 +++++++++++++++++++
+ CryptoPkg/Library/Include/CrtLibSupport.h     | 41 +++++++++++++++++
+ 2 files changed, 87 insertions(+)
+
+diff --git a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
+index 37cdecc9bd..dfdb635536 100644
+--- a/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
++++ b/CryptoPkg/Library/BaseCryptLib/SysCall/CrtWrapper.c
+@@ -550,6 +550,52 @@ fread (
+   return 0;
+ }
+ 
++int
++access(
++  const char*,
++  int
++  )
++{
++  return -1;
++}
++
++int
++open (
++  const char *,
++  int
++  )
++{
++  return -1;
++}
++
++ssize_t
++read (
++  int,
++  void*,
++  size_t
++  )
++{
++  return -1;
++}
++
++ssize_t
++write (
++  int,
++  const void*,
++  size_t
++  )
++{
++  return -1;
++}
++
++int
++close (
++  int
++  )
++{
++  return -1;
++}
++
+ uid_t
+ getuid (
+   void
+diff --git a/CryptoPkg/Library/Include/CrtLibSupport.h b/CryptoPkg/Library/Include/CrtLibSupport.h
+index f36fe08f0c..7d98496af8 100644
+--- a/CryptoPkg/Library/Include/CrtLibSupport.h
++++ b/CryptoPkg/Library/Include/CrtLibSupport.h
+@@ -78,6 +78,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ //
+ // Definitions for global constants used by CRT library routines
+ //
++#define EINTR         4
+ #define EINVAL        22              /* Invalid argument */
+ #define EAFNOSUPPORT  47              /* Address family not supported by protocol family */
+ #define INT_MAX       0x7FFFFFFF      /* Maximum (signed) int value */
+@@ -102,6 +103,15 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ #define NS_INADDRSZ   4   /*%< IPv4 T_A */
+ #define NS_IN6ADDRSZ  16  /*%< IPv6 T_AAAA */
+ 
++#define O_RDONLY        00000000
++#define O_WRONLY        00000001
++#define O_RDWR          00000002
++
++#define R_OK  4
++#define W_OK  2
++#define X_OK  1
++#define F_OK  0
++
+ //
+ // Basic types mapping
+ //
+@@ -324,6 +334,37 @@ fprintf     (
+   ...
+   );
+ 
++int
++access(
++  const char*,
++  int
++  );
++
++int
++open (
++  const char *,
++  int
++  );
++
++ssize_t
++read (
++  int,
++  void*,
++  size_t
++  );
++
++ssize_t
++write (
++  int,
++  const void*,
++  size_t
++  );
++
++int
++close (
++  int
++  );
++
+ time_t
+ time        (
+   time_t *

SOURCES/0031-ArmVirtQemu-Allow-EFI-memory-attributes-protocol-to-.patch

@@ -0,0 +1,169 @@
+From 0120fb7b5877ab40537fd17e64772f53bc89cd07 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 4 Dec 2023 10:41:08 +0100
+Subject: [PATCH] ArmVirtQemu: Allow EFI memory attributes protocol to be
+ disabled
+
+Shim's PE loader uses the EFI memory attributes protocol in a way that
+results in an immediate crash when invoking the loaded image, unless the
+base and size of its executable segment are both aligned to 4k.
+
+If this is not the case, it will strip the memory allocation of its
+executable permissions, but fail to add them back for the executable
+region, resulting in non-executable code. Unfortunately, the PE loader
+does not even bother invoking the protocol in this case (as it notices
+the misalignment), making it very hard for system firmware to work
+around this by attempting to infer the intent of the caller.
+
+So let's introduce a QEMU command line option to indicate that the
+protocol should not be exposed at all, and a PCD to set the default for
+this option when it is omitted.
+
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Tested-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
+Link: https://gitlab.com/qemu-project/qemu/-/issues/1990
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+(cherry picked from commit cee7ba349c0c1ce489001a338a4e28555728b573)
+---
+ ArmVirtPkg/ArmVirtPkg.dec                     |  6 ++
+ .../PlatformBootManagerLib/PlatformBm.c       | 64 +++++++++++++++++++
+ .../PlatformBootManagerLib.inf                |  3 +
+ 3 files changed, 73 insertions(+)
+
+diff --git a/ArmVirtPkg/ArmVirtPkg.dec b/ArmVirtPkg/ArmVirtPkg.dec
+index 0f2d787327..313aebda90 100644
+--- a/ArmVirtPkg/ArmVirtPkg.dec
++++ b/ArmVirtPkg/ArmVirtPkg.dec
+@@ -68,3 +68,9 @@
+   # Cloud Hypervisor has no other way to pass Rsdp address to the guest except use a PCD.
+   #
+   gArmVirtTokenSpaceGuid.PcdCloudHvAcpiRsdpBaseAddress|0x0|UINT64|0x00000005
++
++  ##
++  # Whether the EFI memory attributes protocol should be uninstalled before
++  # invoking the OS loader. This may be needed to work around problematic
++  # builds of shim that use the protocol incorrectly.
++  gArmVirtTokenSpaceGuid.PcdUninstallMemAttrProtocol|FALSE|BOOLEAN|0x00000006
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+index 85c01351b0..8e93f3cfed 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
++++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+@@ -16,6 +16,7 @@
+ #include <Library/PcdLib.h>
+ #include <Library/PlatformBmPrintScLib.h>
+ #include <Library/QemuBootOrderLib.h>
++#include <Library/QemuFwCfgSimpleParserLib.h>
+ #include <Library/TpmPlatformHierarchyLib.h>
+ #include <Library/UefiBootManagerLib.h>
+ #include <Protocol/DevicePath.h>
+@@ -1111,6 +1112,49 @@ PlatformBootManagerBeforeConsole (
+   FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciSerial, SetupVirtioSerial);
+ }
+ 
++/**
++  Uninstall the EFI memory attribute protocol if it exists.
++**/
++STATIC
++VOID
++UninstallEfiMemoryAttributesProtocol (
++  VOID
++  )
++{
++  EFI_STATUS  Status;
++  EFI_HANDLE  Handle;
++  UINTN       Size;
++  VOID        *MemoryAttributeProtocol;
++
++  Size   = sizeof (Handle);
++  Status = gBS->LocateHandle (
++                  ByProtocol,
++                  &gEfiMemoryAttributeProtocolGuid,
++                  NULL,
++                  &Size,
++                  &Handle
++                  );
++
++  if (EFI_ERROR (Status)) {
++    ASSERT (Status == EFI_NOT_FOUND);
++    return;
++  }
++
++  Status = gBS->HandleProtocol (
++                  Handle,
++                  &gEfiMemoryAttributeProtocolGuid,
++                  &MemoryAttributeProtocol
++                  );
++  ASSERT_EFI_ERROR (Status);
++
++  Status = gBS->UninstallProtocolInterface (
++                  Handle,
++                  &gEfiMemoryAttributeProtocolGuid,
++                  MemoryAttributeProtocol
++                  );
++  ASSERT_EFI_ERROR (Status);
++}
++
+ /**
+   Do the platform specific action after the console is ready
+   Possible things that can be done in PlatformBootManagerAfterConsole:
+@@ -1129,12 +1173,32 @@ PlatformBootManagerAfterConsole (
+   )
+ {
+   RETURN_STATUS  Status;
++  BOOLEAN        Uninstall;
+ 
+   //
+   // Show the splash screen.
+   //
+   BootLogoEnableLogo ();
+ 
++  //
++  // Work around shim's terminally broken use of the EFI memory attributes
++  // protocol, by uninstalling it if requested on the QEMU command line.
++  //
++  // E.g.,
++  //       -fw_cfg opt/org.tianocore/UninstallMemAttrProtocol,string=y
++  //
++  Uninstall = FixedPcdGetBool (PcdUninstallMemAttrProtocol);
++  QemuFwCfgParseBool ("opt/org.tianocore/UninstallMemAttrProtocol", &Uninstall);
++  DEBUG ((
++    DEBUG_WARN,
++    "%a: %auninstalling EFI memory protocol\n",
++    __func__,
++    Uninstall ? "" : "not "
++    ));
++  if (Uninstall) {
++    UninstallEfiMemoryAttributesProtocol ();
++  }
++
+   //
+   // Process QEMU's -kernel command line option. The kernel booted this way
+   // will receive ACPI tables: in PlatformBootManagerBeforeConsole(), we
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+index 997eb1a442..70e4ebf94a 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
++++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+@@ -46,6 +46,7 @@
+   PcdLib
+   PlatformBmPrintScLib
+   QemuBootOrderLib
++  QemuFwCfgSimpleParserLib
+   QemuLoadImageLib
+   ReportStatusCodeLib
+   TpmPlatformHierarchyLib
+@@ -55,6 +56,7 @@
+   UefiRuntimeServicesTableLib
+ 
+ [FixedPcd]
++  gArmVirtTokenSpaceGuid.PcdUninstallMemAttrProtocol
+   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultBaudRate
+   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultDataBits
+   gEfiMdePkgTokenSpaceGuid.PcdUartDefaultParity
+@@ -73,5 +75,6 @@
+ [Protocols]
+   gEfiFirmwareVolume2ProtocolGuid
+   gEfiGraphicsOutputProtocolGuid
++  gEfiMemoryAttributeProtocolGuid
+   gEfiPciRootBridgeIoProtocolGuid
+   gVirtioDeviceProtocolGuid

SOURCES/60-edk2-ovmf-x64-inteltdx.json

@@ -4,12 +4,8 @@
         "uefi"
     ],
     "mapping": {
-        "device": "flash",
+        "device": "memory",
-        "mode": "stateless",
+        "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.secboot.fd"
-        "executable": {
-            "filename": "/usr/share/edk2/ovmf/OVMF.inteltdx.fd",
-            "format": "raw"
-        }
     },
     "targets": [
         {
@@ -20,7 +16,9 @@
         }
     ],
     "features": [
+        "enrolled-keys",
         "intel-tdx",
+        "secure-boot",
         "verbose-dynamic"
     ],
     "tags": [

SOURCES/edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtio.patch

@@ -1,74 +0,0 @@
-From 9572a0fe959277c5b57df05a32503ff83a7e93af Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 1 Jun 2023 13:57:11 +0200
-Subject: [PATCH 02/12] ArmVirt/PlatformBootManagerLib: factor out IsVirtio()
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-RH-Jira: RHEL-643
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [2/6] 553a155707eb1c878133c1d13f6422c2b70fb78d (kraxel/centos-edk2)
-
-IsVirtioRng() becomes just a thin wrapper for IsVirtio().
-This allows to add similar thin wrappers for other virtio
-devices in the future.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit a196b04926e70880334fcd649837d0ac63b0bfd5)
----
- .../PlatformBootManagerLib/PlatformBm.c       | 26 +++++++++++++++----
- 1 file changed, 21 insertions(+), 5 deletions(-)
-
-diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-index 10c815378c..5eb6f0f9c1 100644
---- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-@@ -269,15 +269,16 @@ IsPciDisplay (
- }
- 
- /**
--  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
--  the VIRTIO_DEVICE_PROTOCOL level.
-+  This function checks if a handle corresponds to the Virtio Device ID given
-+  at the VIRTIO_DEVICE_PROTOCOL level.
- **/
- STATIC
- BOOLEAN
- EFIAPI
--IsVirtioRng (
-+IsVirtio (
-   IN EFI_HANDLE    Handle,
--  IN CONST CHAR16  *ReportText
-+  IN CONST CHAR16  *ReportText,
-+  IN UINT16        VirtIoDeviceId
-   )
- {
-   EFI_STATUS              Status;
-@@ -293,7 +294,22 @@ IsVirtioRng (
-   }
- 
-   return (BOOLEAN)(VirtIo->SubSystemDeviceId ==
--                   VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
-+                   VirtIoDeviceId);
-+}
-+
-+/**
-+  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
-+  the VIRTIO_DEVICE_PROTOCOL level.
-+**/
-+STATIC
-+BOOLEAN
-+EFIAPI
-+IsVirtioRng (
-+  IN EFI_HANDLE    Handle,
-+  IN CONST CHAR16  *ReportText
-+  )
-+{
-+  return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
- }
- 
- /**
--- 
-2.39.3
-

SOURCES/edk2-ArmVirt-PlatformBootManagerLib-factor-out-IsVirtioPc.patch

@@ -1,96 +0,0 @@
-From 8545529f2b6d967946f111d79455ec8896d53311 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 1 Jun 2023 13:57:12 +0200
-Subject: [PATCH 03/12] ArmVirt/PlatformBootManagerLib: factor out
- IsVirtioPci()
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-RH-Jira: RHEL-643
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [3/6] d0000df1169e1f7b8ce3ad4942460cdc661a0ed9 (kraxel/centos-edk2)
-
-IsVirtioPciRng() becomes just a thin wrapper for IsVirtioPci().
-This allows to add similar thin wrappers for other virtio
-devices in the future.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit aaf546879ab71722c36738ccc6f0f0ab4ecf5076)
----
- .../PlatformBootManagerLib/PlatformBm.c       | 30 ++++++++++++++-----
- 1 file changed, 23 insertions(+), 7 deletions(-)
-
-diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-index 5eb6f0f9c1..ed38c42a43 100644
---- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-@@ -313,15 +313,16 @@ IsVirtioRng (
- }
- 
- /**
--  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
--  the EFI_PCI_IO_PROTOCOL level.
-+  This function checks if a handle corresponds to the Virtio Device ID given
-+  at the EFI_PCI_IO_PROTOCOL level.
- **/
- STATIC
- BOOLEAN
- EFIAPI
--IsVirtioPciRng (
-+IsVirtioPci (
-   IN EFI_HANDLE    Handle,
--  IN CONST CHAR16  *ReportText
-+  IN CONST CHAR16  *ReportText,
-+  IN UINT16        VirtIoDeviceId
-   )
- {
-   EFI_STATUS           Status;
-@@ -387,11 +388,11 @@ IsVirtioPciRng (
-   //
-   // From DeviceId and RevisionId, determine whether the device is a
-   // modern-only Virtio 1.0 device. In case of Virtio 1.0, DeviceId can
--  // immediately be restricted to VIRTIO_SUBSYSTEM_ENTROPY_SOURCE, and
-+  // immediately be restricted to VirtIoDeviceId, and
-   // SubsystemId will only play a sanity-check role. Otherwise, DeviceId can
-   // only be sanity-checked, and SubsystemId will decide.
-   //
--  if ((DeviceId == 0x1040 + VIRTIO_SUBSYSTEM_ENTROPY_SOURCE) &&
-+  if ((DeviceId == 0x1040 + VirtIoDeviceId) &&
-       (RevisionId >= 0x01))
-   {
-     Virtio10 = TRUE;
-@@ -419,7 +420,7 @@ IsVirtioPciRng (
-     return TRUE;
-   }
- 
--  if (!Virtio10 && (SubsystemId == VIRTIO_SUBSYSTEM_ENTROPY_SOURCE)) {
-+  if (!Virtio10 && (SubsystemId == VirtIoDeviceId)) {
-     return TRUE;
-   }
- 
-@@ -430,6 +431,21 @@ PciError:
-   return FALSE;
- }
- 
-+/**
-+  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
-+  the EFI_PCI_IO_PROTOCOL level.
-+**/
-+STATIC
-+BOOLEAN
-+EFIAPI
-+IsVirtioPciRng (
-+  IN EFI_HANDLE    Handle,
-+  IN CONST CHAR16  *ReportText
-+  )
-+{
-+  return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
-+}
-+
- /**
-   This CALLBACK_FUNCTION attempts to connect a handle non-recursively, asking
-   the matching driver to produce all first-level child handles.
--- 
-2.39.3
-

SOURCES/edk2-ArmVirt-PlatformBootManagerLib-set-up-virtio-serial-.patch

@@ -1,228 +0,0 @@
-From ad95ab2b76485458fed60ab20631b62a010c0e4d Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 1 Jun 2023 13:57:13 +0200
-Subject: [PATCH 04/12] ArmVirt/PlatformBootManagerLib: set up virtio serial as
- console
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-RH-Jira: RHEL-643
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [4/6] 46540eeb8901cfeef83cffcdcb6e1c23995b391a (kraxel/centos-edk2)
-
-In case a virtio serial device is found in the system register the first
-console port as EFI console, by updating ConIn, ConOut and ErrOut.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit 15f83fa36442eaa272300b31699b3b82ce7e07a9)
----
- .../PlatformBootManagerLib/PlatformBm.c       | 172 ++++++++++++++++++
- 1 file changed, 172 insertions(+)
-
-diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-index ed38c42a43..b92a916f7e 100644
---- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-+++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
-@@ -312,6 +312,21 @@ IsVirtioRng (
-   return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
- }
- 
-+/**
-+  This FILTER_FUNCTION checks if a handle corresponds to a Virtio serial device at
-+  the VIRTIO_DEVICE_PROTOCOL level.
-+**/
-+STATIC
-+BOOLEAN
-+EFIAPI
-+IsVirtioSerial (
-+  IN EFI_HANDLE    Handle,
-+  IN CONST CHAR16  *ReportText
-+  )
-+{
-+  return IsVirtio (Handle, ReportText, VIRTIO_SUBSYSTEM_CONSOLE);
-+}
-+
- /**
-   This function checks if a handle corresponds to the Virtio Device ID given
-   at the EFI_PCI_IO_PROTOCOL level.
-@@ -446,6 +461,21 @@ IsVirtioPciRng (
-   return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
- }
- 
-+/**
-+  This FILTER_FUNCTION checks if a handle corresponds to a Virtio serial device at
-+  the EFI_PCI_IO_PROTOCOL level.
-+**/
-+STATIC
-+BOOLEAN
-+EFIAPI
-+IsVirtioPciSerial (
-+  IN EFI_HANDLE    Handle,
-+  IN CONST CHAR16  *ReportText
-+  )
-+{
-+  return IsVirtioPci (Handle, ReportText, VIRTIO_SUBSYSTEM_CONSOLE);
-+}
-+
- /**
-   This CALLBACK_FUNCTION attempts to connect a handle non-recursively, asking
-   the matching driver to produce all first-level child handles.
-@@ -534,6 +564,142 @@ AddOutput (
-     ));
- }
- 
-+/**
-+  This CALLBACK_FUNCTION retrieves the EFI_DEVICE_PATH_PROTOCOL from
-+  the handle, appends serial, uart and terminal nodes, finally updates
-+  ConIn, ConOut and ErrOut.
-+**/
-+STATIC
-+VOID
-+EFIAPI
-+SetupVirtioSerial (
-+  IN EFI_HANDLE    Handle,
-+  IN CONST CHAR16  *ReportText
-+  )
-+{
-+  STATIC CONST ACPI_HID_DEVICE_PATH  SerialNode = {
-+    {
-+      ACPI_DEVICE_PATH,
-+      ACPI_DP,
-+      {
-+        (UINT8)(sizeof (ACPI_HID_DEVICE_PATH)),
-+        (UINT8)((sizeof (ACPI_HID_DEVICE_PATH)) >> 8)
-+      },
-+    },
-+    EISA_PNP_ID (0x0501),
-+    0
-+  };
-+
-+  STATIC CONST UART_DEVICE_PATH  UartNode = {
-+    {
-+      MESSAGING_DEVICE_PATH,
-+      MSG_UART_DP,
-+      {
-+        (UINT8)(sizeof (UART_DEVICE_PATH)),
-+        (UINT8)((sizeof (UART_DEVICE_PATH)) >> 8)
-+      },
-+    },
-+    0,
-+    115200,
-+    8,
-+    1,
-+    1
-+  };
-+
-+  STATIC CONST VENDOR_DEVICE_PATH  TerminalNode = {
-+    {
-+      MESSAGING_DEVICE_PATH,
-+      MSG_VENDOR_DP,
-+      {
-+        (UINT8)(sizeof (VENDOR_DEVICE_PATH)),
-+        (UINT8)((sizeof (VENDOR_DEVICE_PATH)) >> 8)
-+      },
-+    },
-+    DEVICE_PATH_MESSAGING_VT_UTF8
-+  };
-+
-+  EFI_STATUS                Status;
-+  EFI_DEVICE_PATH_PROTOCOL  *DevicePath, *OldDevicePath;
-+
-+  DevicePath = DevicePathFromHandle (Handle);
-+
-+  if (DevicePath == NULL) {
-+    DEBUG ((
-+      DEBUG_ERROR,
-+      "%a: %s: handle %p: device path not found\n",
-+      __func__,
-+      ReportText,
-+      Handle
-+      ));
-+    return;
-+  }
-+
-+  DevicePath = AppendDevicePathNode (
-+                 DevicePath,
-+                 &SerialNode.Header
-+                 );
-+
-+  OldDevicePath = DevicePath;
-+  DevicePath    = AppendDevicePathNode (
-+                    DevicePath,
-+                    &UartNode.Header
-+                    );
-+  FreePool (OldDevicePath);
-+
-+  OldDevicePath = DevicePath;
-+  DevicePath    = AppendDevicePathNode (
-+                    DevicePath,
-+                    &TerminalNode.Header
-+                    );
-+  FreePool (OldDevicePath);
-+
-+  Status = EfiBootManagerUpdateConsoleVariable (ConIn, DevicePath, NULL);
-+  if (EFI_ERROR (Status)) {
-+    DEBUG ((
-+      DEBUG_ERROR,
-+      "%a: %s: adding to ConIn: %r\n",
-+      __func__,
-+      ReportText,
-+      Status
-+      ));
-+    return;
-+  }
-+
-+  Status = EfiBootManagerUpdateConsoleVariable (ConOut, DevicePath, NULL);
-+  if (EFI_ERROR (Status)) {
-+    DEBUG ((
-+      DEBUG_ERROR,
-+
-+      "%a: %s: adding to ConOut: %r\n",
-+      __func__,
-+      ReportText,
-+      Status
-+      ));
-+    return;
-+  }
-+
-+  Status = EfiBootManagerUpdateConsoleVariable (ErrOut, DevicePath, NULL);
-+  if (EFI_ERROR (Status)) {
-+    DEBUG ((
-+      DEBUG_ERROR,
-+      "%a: %s: adding to ErrOut: %r\n",
-+      __func__,
-+      ReportText,
-+      Status
-+      ));
-+    return;
-+  }
-+
-+  FreePool (DevicePath);
-+
-+  DEBUG ((
-+    DEBUG_VERBOSE,
-+    "%a: %s: added to ConIn, ConOut and ErrOut\n",
-+    __func__,
-+    ReportText
-+    ));
-+}
-+
- STATIC
- VOID
- PlatformRegisterFvBootOption (
-@@ -932,6 +1098,12 @@ PlatformBootManagerBeforeConsole (
-   // instances on Virtio PCI RNG devices.
-   //
-   FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciRng, Connect);
-+
-+  //
-+  // Register Virtio serial devices as console.
-+  //
-+  FilterAndProcess (&gVirtioDeviceProtocolGuid, IsVirtioSerial, SetupVirtioSerial);
-+  FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciSerial, SetupVirtioSerial);
- }
- 
- /**
--- 
-2.39.3
-

SOURCES/edk2-ArmVirt-add-VirtioSerialDxe-to-ArmVirtQemu-builds.patch

@@ -1,59 +0,0 @@
-From 262a607fbc608c02fc3c2a87244d033932d564bb Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 1 Jun 2023 13:57:10 +0200
-Subject: [PATCH 01/12] ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-RH-Jira: RHEL-643
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [1/6] 03b627e1fae7851fa51e6fe67253ff1b64948d0e (kraxel/centos-edk2)
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Acked-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit 6925150febb3a76d8e40c19babcc578555ca78fe)
----
- ArmVirtPkg/ArmVirtQemu.dsc           | 1 +
- ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc | 1 +
- ArmVirtPkg/ArmVirtQemuKernel.dsc     | 1 +
- 3 files changed, 3 insertions(+)
-
-diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
-index b1deefc2fd..5df6a89578 100644
---- a/ArmVirtPkg/ArmVirtQemu.dsc
-+++ b/ArmVirtPkg/ArmVirtQemu.dsc
-@@ -453,6 +453,7 @@
-   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
-   OvmfPkg/VirtioNetDxe/VirtioNet.inf
-   OvmfPkg/VirtioRngDxe/VirtioRng.inf
-+  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
- 
-   #
-   # FAT filesystem + GPT/MBR partitioning + UDF filesystem + virtio-fs
-diff --git a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-index 4dbb77a6ca..00ec4dd186 100644
---- a/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-+++ b/ArmVirtPkg/ArmVirtQemuFvMain.fdf.inc
-@@ -96,6 +96,7 @@ READ_LOCK_STATUS   = TRUE
-   INF OvmfPkg/VirtioNetDxe/VirtioNet.inf
-   INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
-   INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
-+  INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
- 
-   INF ShellPkg/Application/Shell/Shell.inf
- 
-diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-index afebc46a04..76b7c128bb 100644
---- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
-+++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
-@@ -353,6 +353,7 @@
-   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
-   OvmfPkg/VirtioNetDxe/VirtioNet.inf
-   OvmfPkg/VirtioRngDxe/VirtioRng.inf
-+  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
- 
-   #
-   # FAT filesystem + GPT/MBR partitioning + UDF filesystem + virtio-fs
--- 
-2.39.3
-

SOURCES/edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch

@@ -0,0 +1,57 @@
+From b8793ffc6a7e7cfe3ecd9bd0da566ffd913a4544 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 10:34:52 -0400
+Subject: [PATCH 7/8] CryptoPkg/Test: call ProcessLibraryConstructorList
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 75: NetworkPkg: SECURITY PATCH CVE-2023-45236 and CVE-2023-45237
+RH-Jira: RHEL-40270 RHEL-40272
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [7/8] 7b09b94bfb56f5b81df2ccf1e6dbe21a7354a723
+
+JIRA: https://issues.redhat.com/browse/RHEL-40270
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit 94961b8817eec6f8d0434555ac50a7aa51c22201
+Author: Gerd Hoffmann <kraxel@redhat.com>
+Date:   Fri Jun 14 11:45:49 2024 +0200
+
+    CryptoPkg/Test: call ProcessLibraryConstructorList
+
+    Needed to properly initialize BaseRngLib.
+
+    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c      | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c b/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
+index d0c1c7a4f7..48d463b8ad 100644
+--- a/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
++++ b/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
+@@ -8,6 +8,12 @@
+ **/
+ #include "TestBaseCryptLib.h"
+ 
++VOID
++EFIAPI
++ProcessLibraryConstructorList (
++  VOID
++  );
++
+ /**
+   Initialize the unit test framework, suite, and unit tests for the
+   sample unit tests and run the unit tests.
+@@ -76,5 +82,6 @@ main (
+   char  *argv[]
+   )
+ {
++  ProcessLibraryConstructorList ();
+   return UefiTestMain ();
+ }
+-- 
+2.39.3
+

SOURCES/edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch

@@ -0,0 +1,170 @@
+From f01b34eaeff2ccdd0ee7f2cf6371542efc0b13f5 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Sat, 6 Apr 2024 11:00:29 -0400
+Subject: [PATCH 1/2] EmbeddedPkg/Hob: Integer Overflow in CreateHob()
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 69: EmbeddedPkg/Hob: Integer Overflow in CreateHob()
+RH-Jira: RHEL-30156
+RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [1/2] 1b851d3ecf23092f7961cd0320221dc56b69adc4
+
+JIRA: https://issues.redhat.com/browse/RHEL-30156
+CVE: CVE-2022-36765
+Upstream: Merged
+
+commit aeaee8944f0eaacbf4cdf39279785b9ba4836bb6
+Author: Gua Guo <gua.guo@intel.com>
+Date:   Thu Jan 11 13:07:50 2024 +0800
+
+    EmbeddedPkg/Hob: Integer Overflow in CreateHob()
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
+
+    Fix integer overflow in various CreateHob instances.
+    Fixes: CVE-2022-36765
+
+    The CreateHob() function aligns the requested size to 8
+    performing the following operation:
+    ```
+    HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
+    ```
+
+    No checks are performed to ensure this value doesn't
+    overflow, and could lead to CreateHob() returning a smaller
+    HOB than requested, which could lead to OOB HOB accesses.
+
+    Reported-by: Marc Beatove <mbeatove@google.com>
+    Cc: Leif Lindholm <quic_llindhol@quicinc.com>
+    Reviewed-by: Ard Biesheuvel <ardb+tianocore@kernel.org>
+    Cc: Abner Chang <abner.chang@amd.com>
+    Cc: John Mathew <john.mathews@intel.com>
+    Authored-by: Gerd Hoffmann <kraxel@redhat.com>
+    Signed-off-by: Gua Guo <gua.guo@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ EmbeddedPkg/Library/PrePiHobLib/Hob.c | 43 +++++++++++++++++++++++++++
+ 1 file changed, 43 insertions(+)
+
+diff --git a/EmbeddedPkg/Library/PrePiHobLib/Hob.c b/EmbeddedPkg/Library/PrePiHobLib/Hob.c
+index 8eb175aa96..cbc35152cc 100644
+--- a/EmbeddedPkg/Library/PrePiHobLib/Hob.c
++++ b/EmbeddedPkg/Library/PrePiHobLib/Hob.c
+@@ -110,6 +110,13 @@ CreateHob (
+ 
+   HandOffHob = GetHobList ();
+ 
++  //
++  // Check Length to avoid data overflow.
++  //
++  if (HobLength > MAX_UINT16 - 0x7) {
++    return NULL;
++  }
++
+   HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
+ 
+   FreeMemory = HandOffHob->EfiFreeMemoryTop - HandOffHob->EfiFreeMemoryBottom;
+@@ -160,6 +167,9 @@ BuildResourceDescriptorHob (
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_RESOURCE_DESCRIPTOR, sizeof (EFI_HOB_RESOURCE_DESCRIPTOR));
+   ASSERT (Hob != NULL);
++  if (Hob == NULL) {
++    return;
++  }
+ 
+   Hob->ResourceType      = ResourceType;
+   Hob->ResourceAttribute = ResourceAttribute;
+@@ -401,6 +411,10 @@ BuildModuleHob (
+     );
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION_MODULE));
++  ASSERT (Hob != NULL);
++  if (Hob == NULL) {
++    return;
++  }
+ 
+   CopyGuid (&(Hob->MemoryAllocationHeader.Name), &gEfiHobMemoryAllocModuleGuid);
+   Hob->MemoryAllocationHeader.MemoryBaseAddress = MemoryAllocationModule;
+@@ -449,6 +463,11 @@ BuildGuidHob (
+   ASSERT (DataLength <= (0xffff - sizeof (EFI_HOB_GUID_TYPE)));
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_GUID_EXTENSION, (UINT16)(sizeof (EFI_HOB_GUID_TYPE) + DataLength));
++  ASSERT (Hob != NULL);
++  if (Hob == NULL) {
++    return NULL;
++  }
++
+   CopyGuid (&Hob->Name, Guid);
+   return Hob + 1;
+ }
+@@ -512,6 +531,10 @@ BuildFvHob (
+   EFI_HOB_FIRMWARE_VOLUME  *Hob;
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_FV, sizeof (EFI_HOB_FIRMWARE_VOLUME));
++  ASSERT (Hob != NULL);
++  if (Hob == NULL) {
++    return;
++  }
+ 
+   Hob->BaseAddress = BaseAddress;
+   Hob->Length      = Length;
+@@ -543,6 +566,10 @@ BuildFv2Hob (
+   EFI_HOB_FIRMWARE_VOLUME2  *Hob;
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_FV2, sizeof (EFI_HOB_FIRMWARE_VOLUME2));
++  ASSERT (Hob != NULL);
++  if (Hob == NULL) {
++    return;
++  }
+ 
+   Hob->BaseAddress = BaseAddress;
+   Hob->Length      = Length;
+@@ -584,6 +611,10 @@ BuildFv3Hob (
+   EFI_HOB_FIRMWARE_VOLUME3  *Hob;
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_FV3, sizeof (EFI_HOB_FIRMWARE_VOLUME3));
++  ASSERT (Hob != NULL);
++  if (Hob == NULL) {
++    return;
++  }
+ 
+   Hob->BaseAddress          = BaseAddress;
+   Hob->Length               = Length;
+@@ -639,6 +670,10 @@ BuildCpuHob (
+   EFI_HOB_CPU  *Hob;
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_CPU, sizeof (EFI_HOB_CPU));
++  ASSERT (Hob != NULL);
++  if (Hob == NULL) {
++    return;
++  }
+ 
+   Hob->SizeOfMemorySpace = SizeOfMemorySpace;
+   Hob->SizeOfIoSpace     = SizeOfIoSpace;
+@@ -676,6 +711,10 @@ BuildStackHob (
+     );
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION_STACK));
++  ASSERT (Hob != NULL);
++  if (Hob == NULL) {
++    return;
++  }
+ 
+   CopyGuid (&(Hob->AllocDescriptor.Name), &gEfiHobMemoryAllocStackGuid);
+   Hob->AllocDescriptor.MemoryBaseAddress = BaseAddress;
+@@ -756,6 +795,10 @@ BuildMemoryAllocationHob (
+     );
+ 
+   Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION));
++  ASSERT (Hob != NULL);
++  if (Hob == NULL) {
++    return;
++  }
+ 
+   ZeroMem (&(Hob->AllocDescriptor.Name), sizeof (EFI_GUID));
+   Hob->AllocDescriptor.MemoryBaseAddress = BaseAddress;
+-- 
+2.39.3
+

SOURCES/edk2-MdePkg-ArchitecturalMsr.h-add-defines-for-MTRR-cache.patch

@@ -0,0 +1,41 @@
+From 08fc72d06946ef3adebf110c097ed869ab0ed416 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 30 Jan 2024 14:04:39 +0100
+Subject: [PATCH 7/9] MdePkg/ArchitecturalMsr.h: add #defines for MTRR cache
+ types
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
+RH-Jira: RHEL-21704
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [2/4] a568bc2793d677462a2971aae9566a9bbc64b063 (kraxel.rh/centos-src-edk2)
+
+Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-ID: <20240130130441.772484-3-kraxel@redhat.com>
+---
+ MdePkg/Include/Register/Intel/ArchitecturalMsr.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/MdePkg/Include/Register/Intel/ArchitecturalMsr.h b/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
+index 756e7c86ec..08ba949cf7 100644
+--- a/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
++++ b/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
+@@ -2103,6 +2103,13 @@ typedef union {
+ #define MSR_IA32_MTRR_PHYSBASE9  0x00000212
+ /// @}
+ 
++#define MSR_IA32_MTRR_CACHE_UNCACHEABLE      0
++#define MSR_IA32_MTRR_CACHE_WRITE_COMBINING  1
++#define MSR_IA32_MTRR_CACHE_WRITE_THROUGH    4
++#define MSR_IA32_MTRR_CACHE_WRITE_PROTECTED  5
++#define MSR_IA32_MTRR_CACHE_WRITE_BACK       6
++#define MSR_IA32_MTRR_CACHE_INVALID_TYPE     7
++
+ /**
+   MSR information returned for MSR indexes #MSR_IA32_MTRR_PHYSBASE0 to
+   #MSR_IA32_MTRR_PHYSBASE9
+-- 
+2.39.3
+

SOURCES/edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch

@@ -0,0 +1,213 @@
+From a0f61781d9d7d816363704823688ba251fe7e0ba Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 10:32:29 -0400
+Subject: [PATCH 4/8] MdePkg/BaseRngLib: Add a smoketest for RDRAND and check
+ CPUID
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 75: NetworkPkg: SECURITY PATCH CVE-2023-45236 and CVE-2023-45237
+RH-Jira: RHEL-40270 RHEL-40272
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [4/8] 4fe23181254479e4a0f1abd31cedabacaec22944
+
+JIRA: https://issues.redhat.com/browse/RHEL-40270
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit c3a8ca7b54a9fd17acdf16c6282a92cc989fa92a
+Author: Pedro Falcato <pedro.falcato@gmail.com>
+Date:   Tue Nov 22 22:31:03 2022 +0000
+
+    MdePkg/BaseRngLib: Add a smoketest for RDRAND and check CPUID
+
+    RDRAND has notoriously been broken many times over its lifespan.
+    Add a smoketest to RDRAND, in order to better sniff out potential
+    security concerns.
+
+    Also add a proper CPUID test in order to support older CPUs which may
+    not have it; it was previously being tested but then promptly ignored.
+
+    Testing algorithm inspired by linux's arch/x86/kernel/cpu/rdrand.c
+    :x86_init_rdrand() per commit 049f9ae9..
+
+    Many thanks to Jason Donenfeld for relicensing his linux RDRAND detection
+    code to MIT and the public domain.
+
+    >On Tue, Nov 22, 2022 at 2:21 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
+      <..>
+    >    I (re)wrote that function in Linux. I hereby relicense it as MIT, and
+    >    also place it into public domain. Do with it what you will now.
+    >
+    >    Jason
+
+    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4163
+
+    Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
+    Cc: Michael D Kinney <michael.d.kinney@intel.com>
+    Cc: Liming Gao <gaoliming@byosoft.com.cn>
+    Cc: Zhiguang Liu <zhiguang.liu@intel.com>
+    Cc: Jason A. Donenfeld <Jason@zx2c4.com>
+
+Signed-off-by: Jon Maloy <jmaloy@gmail.com>
+---
+ MdePkg/Library/BaseRngLib/Rand/RdRand.c | 99 +++++++++++++++++++++++--
+ 1 file changed, 91 insertions(+), 8 deletions(-)
+
+diff --git a/MdePkg/Library/BaseRngLib/Rand/RdRand.c b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
+index 9bd68352f9..06d2a6f12d 100644
+--- a/MdePkg/Library/BaseRngLib/Rand/RdRand.c
++++ b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
+@@ -3,6 +3,7 @@
+   to provide high-quality random numbers.
+ 
+ Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
++Copyright (c) 2022, Pedro Falcato. All rights reserved.<BR>
+ Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
+ Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
+ 
+@@ -24,6 +25,88 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ STATIC BOOLEAN  mRdRandSupported;
+ 
++//
++// Intel SDM says 10 tries is good enough for reliable RDRAND usage.
++//
++#define RDRAND_RETRIES  10
++
++#define RDRAND_TEST_SAMPLES  8
++
++#define RDRAND_MIN_CHANGE  5
++
++//
++// Add a define for native-word RDRAND, just for the test.
++//
++#ifdef MDE_CPU_X64
++#define ASM_RDRAND  AsmRdRand64
++#else
++#define ASM_RDRAND  AsmRdRand32
++#endif
++
++/**
++  Tests RDRAND for broken implementations.
++
++  @retval TRUE         RDRAND is reliable (and hopefully safe).
++  @retval FALSE        RDRAND is unreliable and should be disabled, despite CPUID.
++
++**/
++STATIC
++BOOLEAN
++TestRdRand (
++  VOID
++  )
++{
++  //
++  // Test for notoriously broken rdrand implementations that always return the same
++  // value, like the Zen 3 uarch (all-1s) or other several AMD families on suspend/resume (also all-1s).
++  // Note that this should be expanded to extensively test for other sorts of possible errata.
++  //
++
++  //
++  // Our algorithm samples rdrand $RDRAND_TEST_SAMPLES times and expects
++  // a different result $RDRAND_MIN_CHANGE times for reliable RDRAND usage.
++  //
++  UINTN   Prev;
++  UINT8   Idx;
++  UINT8   TestIteration;
++  UINT32  Changed;
++
++  Changed = 0;
++
++  for (TestIteration = 0; TestIteration < RDRAND_TEST_SAMPLES; TestIteration++) {
++    UINTN  Sample;
++    //
++    // Note: We use a retry loop for rdrand. Normal users get this in BaseRng.c
++    // Any failure to get a random number will assume RDRAND does not work.
++    //
++    for (Idx = 0; Idx < RDRAND_RETRIES; Idx++) {
++      if (ASM_RDRAND (&Sample)) {
++        break;
++      }
++    }
++
++    if (Idx == RDRAND_RETRIES) {
++      DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: Failed to get an RDRAND random number - disabling\n"));
++      return FALSE;
++    }
++
++    if (TestIteration != 0) {
++      Changed += Sample != Prev;
++    }
++
++    Prev = Sample;
++  }
++
++  if (Changed < RDRAND_MIN_CHANGE) {
++    DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: RDRAND not reliable - disabling\n"));
++    return FALSE;
++  }
++
++  return TRUE;
++}
++
++#undef ASM_RDRAND
++
+ /**
+   The constructor function checks whether or not RDRAND instruction is supported
+   by the host hardware.
+@@ -48,10 +131,13 @@ BaseRngLibConstructor (
+   // CPUID. A value of 1 indicates that processor support RDRAND instruction.
+   //
+   AsmCpuid (1, 0, 0, &RegEcx, 0);
+-  ASSERT ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
+ 
+   mRdRandSupported = ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
+ 
++  if (mRdRandSupported) {
++    mRdRandSupported = TestRdRand ();
++  }
++
+   return EFI_SUCCESS;
+ }
+ 
+@@ -70,6 +156,7 @@ ArchGetRandomNumber16 (
+   OUT     UINT16  *Rand
+   )
+ {
++  ASSERT (mRdRandSupported);
+   return AsmRdRand16 (Rand);
+ }
+ 
+@@ -88,6 +175,7 @@ ArchGetRandomNumber32 (
+   OUT     UINT32  *Rand
+   )
+ {
++  ASSERT (mRdRandSupported);
+   return AsmRdRand32 (Rand);
+ }
+ 
+@@ -106,6 +194,7 @@ ArchGetRandomNumber64 (
+   OUT     UINT64  *Rand
+   )
+ {
++  ASSERT (mRdRandSupported);
+   return AsmRdRand64 (Rand);
+ }
+ 
+@@ -122,13 +211,7 @@ ArchIsRngSupported (
+   VOID
+   )
+ {
+-  /*
+-     Existing software depends on this always returning TRUE, so for
+-     now hard-code it.
+-
+-     return mRdRandSupported;
+-  */
+-  return TRUE;
++  return mRdRandSupported;
+ }
+ 
+ /**
+-- 
+2.39.3
+

SOURCES/edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch

@@ -0,0 +1,63 @@
+From 90461020e9b7534dc03baeea7b485045ed5962e9 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 10:35:27 -0400
+Subject: [PATCH 8/8] MdePkg/X86UnitTestHost: set rdrand cpuid bit
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 75: NetworkPkg: SECURITY PATCH CVE-2023-45236 and CVE-2023-45237
+RH-Jira: RHEL-40270 RHEL-40272
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [8/8] 5bacbf3cf6fadd3362dfd6f31743707e65b4f119
+
+JIRA: https://issues.redhat.com/browse/RHEL-40270
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit 5e776299a2604b336a947e68593012ab2cc16eb4
+Author: Gerd Hoffmann <kraxel@redhat.com>
+Date:   Fri Jun 14 11:45:53 2024 +0200
+
+    MdePkg/X86UnitTestHost: set rdrand cpuid bit
+
+    Set the rdrand feature bit when faking cpuid for host test cases.
+    Needed to make the CryptoPkg test cases work.
+
+    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ MdePkg/Library/BaseLib/X86UnitTestHost.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/MdePkg/Library/BaseLib/X86UnitTestHost.c b/MdePkg/Library/BaseLib/X86UnitTestHost.c
+index 8ba4f54a38..7f7276f7f4 100644
+--- a/MdePkg/Library/BaseLib/X86UnitTestHost.c
++++ b/MdePkg/Library/BaseLib/X86UnitTestHost.c
+@@ -66,6 +66,15 @@ UnitTestHostBaseLibAsmCpuid (
+   OUT     UINT32  *Edx   OPTIONAL
+   )
+ {
++  UINT32  RetEcx;
++
++  RetEcx = 0;
++  switch (Index) {
++    case 1:
++      RetEcx |= BIT30; /* RdRand */
++      break;
++  }
++
+   if (Eax != NULL) {
+     *Eax = 0;
+   }
+@@ -75,7 +84,7 @@ UnitTestHostBaseLibAsmCpuid (
+   }
+ 
+   if (Ecx != NULL) {
+-    *Ecx = 0;
++    *Ecx = RetEcx;
+   }
+ 
+   if (Edx != NULL) {
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch

@@ -1,16 +1,17 @@
-From 06e2c375a90fd98774c5f38c2d33751084865ece Mon Sep 17 00:00:00 2001
+From 0d85ac65b3e469e879f687150d0a25e6dbd6cac1 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 8 Feb 2024 10:35:14 -0500
-Subject: [PATCH 2/3] NetworkPkg: : Add Unit tests to CI and create Host Test
+Subject: [PATCH 02/18] NetworkPkg: : Add Unit tests to CI and create Host Test
  DSC
 
 RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 45: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
-RH-Jira: RHEL-21996
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
 RH-Acked-by: Gerd Hoffmann <None>
-RH-Commit: [2/3] 3dc2853357d44516d878203aba7cd6e4f74f3f57
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [2/18] 331bea0d7e46de0e35e595ad08c94eec99c80cd8
 
-JIRA: https://issues.redhat.com/browse/RHEL-21996
+JIRA: https://issues.redhat.com/browse/RHEL-21843
 CVE: CVE-2023-45230
 Upstream: Merged
 

SOURCES/edk2-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch

@@ -0,0 +1,170 @@
+From 3c1cf95b979cea6b0dee6e107756558a7a71d4ac Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 14/18] NetworkPkg: : Adds a SecurityFix.yaml file
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [14/18] dddbcbe14e38dc1bb03acf4622d6285090c4bb02
+
+JIRA: https://issues.redhat.com/browse/RHEL-21853
+CVE: CVE-2022-45235
+Upstream: Merged
+
+commit 1d0b95f6457d225c5108302a9da74b4ed7aa5a38
+Author: Doug Flick via groups.io <dougflick=microsoft.com@groups.io>
+Date:   Fri Jan 26 05:54:57 2024 +0800
+
+    NetworkPkg: : Adds a SecurityFix.yaml file
+
+    This creates / adds a security file that tracks the security fixes
+    found in this package and can be used to find the fixes that were
+    applied.
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/SecurityFixes.yaml | 123 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 123 insertions(+)
+ create mode 100644 NetworkPkg/SecurityFixes.yaml
+
+diff --git a/NetworkPkg/SecurityFixes.yaml b/NetworkPkg/SecurityFixes.yaml
+new file mode 100644
+index 0000000000..7e900483fe
+--- /dev/null
++++ b/NetworkPkg/SecurityFixes.yaml
+@@ -0,0 +1,123 @@
++## @file
++# Security Fixes for SecurityPkg
++#
++# Copyright (c) Microsoft Corporation
++# SPDX-License-Identifier: BSD-2-Clause-Patent
++##
++CVE_2023_45229:
++  commit_titles:
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Patch"
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Unit Tests"
++  cve: CVE-2023-45229
++  date_reported: 2023-08-28 13:56 UTC
++  description: "Bug 01 - edk2/NetworkPkg: Out-of-bounds read when processing IA_NA/IA_TA options in a DHCPv6 Advertise message"
++  note:
++  files_impacted:
++    - NetworkPkg\Dhcp6Dxe\Dhcp6Io.c
++    - NetworkPkg\Dhcp6Dxe\Dhcp6Impl.h
++  links:
++    - https://bugzilla.tianocore.org/show_bug.cgi?id=4534
++    - https://nvd.nist.gov/vuln/detail/CVE-2023-45229
++    - http://www.openwall.com/lists/oss-security/2024/01/16/2
++    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
++    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
++CVE_2023_45230:
++  commit_titles:
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch"
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Unit Tests"
++  cve: CVE-2023-45230
++  date_reported: 2023-08-28 13:56 UTC
++  description: "Bug 02 - edk2/NetworkPkg: Buffer overflow in the DHCPv6 client via a long Server ID option"
++  note:
++  files_impacted:
++    - NetworkPkg\Dhcp6Dxe\Dhcp6Io.c
++    - NetworkPkg\Dhcp6Dxe\Dhcp6Impl.h
++  links:
++    - https://bugzilla.tianocore.org/show_bug.cgi?id=4535
++    - https://nvd.nist.gov/vuln/detail/CVE-2023-45230
++    - http://www.openwall.com/lists/oss-security/2024/01/16/2
++    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
++    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
++CVE_2023_45231:
++  commit_titles:
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45231 Patch"
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45231 Unit Tests"
++  cve: CVE-2023-45231
++  date_reported: 2023-08-28 13:56 UTC
++  description: "Bug 03 - edk2/NetworkPkg: Out-of-bounds read when handling a ND Redirect message with truncated options"
++  note:
++  files_impacted:
++    - NetworkPkg/Ip6Dxe/Ip6Option.c
++  links:
++    - https://bugzilla.tianocore.org/show_bug.cgi?id=4536
++    - https://nvd.nist.gov/vuln/detail/CVE-2023-45231
++    - http://www.openwall.com/lists/oss-security/2024/01/16/2
++    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
++    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
++CVE_2023_45232:
++  commit_titles:
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45232 Patch"
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45232 Unit Tests"
++  cve: CVE-2023-45232
++  date_reported: 2023-08-28 13:56 UTC
++  description: "Bug 04 - edk2/NetworkPkg: Infinite loop when parsing unknown options in the Destination Options header"
++  note:
++  files_impacted:
++    - NetworkPkg/Ip6Dxe/Ip6Option.c
++    - NetworkPkg/Ip6Dxe/Ip6Option.h
++  links:
++    - https://bugzilla.tianocore.org/show_bug.cgi?id=4537
++    - https://nvd.nist.gov/vuln/detail/CVE-2023-45232
++    - http://www.openwall.com/lists/oss-security/2024/01/16/2
++    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
++    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
++CVE_2023_45233:
++  commit_titles:
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45232 Patch"
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45232 Unit Tests"
++  cve: CVE-2023-45233
++  date_reported: 2023-08-28 13:56 UTC
++  description: "Bug 05 - edk2/NetworkPkg: Infinite loop when parsing a PadN option in the Destination Options header "
++  note: This was fixed along with CVE-2023-45233
++  files_impacted:
++    - NetworkPkg/Ip6Dxe/Ip6Option.c
++    - NetworkPkg/Ip6Dxe/Ip6Option.h
++  links:
++    - https://bugzilla.tianocore.org/show_bug.cgi?id=4538
++    - https://nvd.nist.gov/vuln/detail/CVE-2023-45233
++    - http://www.openwall.com/lists/oss-security/2024/01/16/2
++    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
++    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
++CVE_2023_45234:
++  commit_titles:
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45234 Patch"
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45234 Unit Tests"
++  cve: CVE-2023-45234
++  date_reported: 2023-08-28 13:56 UTC
++  description: "Bug 06 - edk2/NetworkPkg: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message"
++  note:
++  files_impacted:
++    - NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
++  links:
++    - https://bugzilla.tianocore.org/show_bug.cgi?id=4539
++    - https://nvd.nist.gov/vuln/detail/CVE-2023-45234
++    - http://www.openwall.com/lists/oss-security/2024/01/16/2
++    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
++    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
++CVE_2023_45235:
++  commit_titles:
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45235 Patch"
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45235 Unit Tests"
++  cve: CVE-2023-45235
++  date_reported: 2023-08-28 13:56 UTC
++  description: "Bug 07 - edk2/NetworkPkg: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message"
++  note:
++  files_impacted:
++    - NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
++    - NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h
++  links:
++    - https://bugzilla.tianocore.org/show_bug.cgi?id=4540
++    - https://nvd.nist.gov/vuln/detail/CVE-2023-45235
++    - http://www.openwall.com/lists/oss-security/2024/01/16/2
++    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
++    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-Dhcp6Dxe-Packet-Length-is-not-updated-bef.patch

@@ -0,0 +1,69 @@
+From 3ab0e3be00cc74b39db482e33bfe923f70768ae4 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 17/18] NetworkPkg: Dhcp6Dxe: Packet-Length is not updated
+ before appending
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [17/18] c13c96534ecea4c43ca98cecf0789b07680958ca
+
+JIRA: https://issues.redhat.com/browse/RHEL-21841
+CVE: CVE-2023-45229
+Upstream: Merged
+
+commit 75deaf5c3c0d164c61653258c331151241bb69d8
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Tue Feb 13 10:46:02 2024 -0800
+
+    NetworkPkg: Dhcp6Dxe: Packet-Length is not updated before appending
+
+    In order for Dhcp6AppendIaAddrOption (..) to safely append the IA
+    Address option, the Packet-Length field must be updated before appending
+    the option.
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
+index e4e0725622..f38e3ee3fe 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
++++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
+@@ -924,6 +924,11 @@ Dhcp6AppendIaOption (
+     *PacketCursor += sizeof (T2);
+   }
+ 
++  //
++  // Update the packet length
++  //
++  Packet->Length += BytesNeeded;
++
+   //
+   // Fill all the addresses belong to the Ia
+   //
+@@ -935,11 +940,6 @@ Dhcp6AppendIaOption (
+     }
+   }
+ 
+-  //
+-  // Update the packet length
+-  //
+-  Packet->Length += BytesNeeded;
+-
+   //
+   // Fill the value of Ia option length
+   //
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch

@@ -0,0 +1,162 @@
+From bb9d1831fd53d43889112a2e30a52b2c4504fdae Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 16/18] NetworkPkg: Dhcp6Dxe: Removes duplicate check and
+ replaces with macro
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [16/18] 61914482aa965883b1ec3f29cf6143b67e88742a
+
+JIRA: https://issues.redhat.com/browse/RHEL-21841
+CVE: CVE-2023-45229
+Upstream: Merged
+
+commit af3fad99d6088881562e50149f414f76a5be0140
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Tue Feb 13 10:46:01 2024 -0800
+
+    NetworkPkg: Dhcp6Dxe: Removes duplicate check and replaces with macro
+
+    Removes duplicate check after merge
+
+    >
+    >  //
+    >  // Verify the PacketCursor is within the packet
+    >  //
+    >  if (  (*PacketCursor < Packet->Dhcp6.Option)
+    >     || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size -
+    sizeof (EFI_DHCP6_HEADER))))
+    >  {
+    >    return EFI_INVALID_PARAMETER;
+    >  }
+    >
+
+    Converts the check to a macro and replaces all instances of the check
+    with the macro
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c | 44 +++++++++++++-----------------
+ 1 file changed, 19 insertions(+), 25 deletions(-)
+
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
+index 705c665c51..e4e0725622 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
++++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Utility.c
+@@ -10,6 +10,16 @@
+ 
+ #include "Dhcp6Impl.h"
+ 
++//
++// Verifies the packet cursor is within the packet
++// otherwise it is invalid
++//
++#define IS_INVALID_PACKET_CURSOR(PacketCursor, Packet) \
++  (((*PacketCursor) < (Packet)->Dhcp6.Option) || \
++   ((*PacketCursor) >= (Packet)->Dhcp6.Option + ((Packet)->Size - sizeof(EFI_DHCP6_HEADER))) \
++  )                                                                            \
++
++
+ /**
+   Generate client Duid in the format of Duid-llt.
+ 
+@@ -638,9 +648,7 @@ Dhcp6AppendOption (
+   //
+   // Verify the PacketCursor is within the packet
+   //
+-  if (  (*PacketCursor < Packet->Dhcp6.Option)
+-     || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
+-  {
++  if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+@@ -657,15 +665,6 @@ Dhcp6AppendOption (
+     return EFI_BUFFER_TOO_SMALL;
+   }
+ 
+-  //
+-  // Verify the PacketCursor is within the packet
+-  //
+-  if (  (*PacketCursor < Packet->Dhcp6.Option)
+-     || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
+-  {
+-    return EFI_INVALID_PARAMETER;
+-  }
+-
+   WriteUnaligned16 ((UINT16 *)*PacketCursor, OptType);
+   *PacketCursor += DHCP6_SIZE_OF_OPT_CODE;
+   WriteUnaligned16 ((UINT16 *)*PacketCursor, OptLen);
+@@ -744,9 +743,7 @@ Dhcp6AppendIaAddrOption (
+   //
+   // Verify the PacketCursor is within the packet
+   //
+-  if (  (*PacketCursor < Packet->Dhcp6.Option)
+-     || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
+-  {
++  if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+@@ -877,9 +874,7 @@ Dhcp6AppendIaOption (
+   //
+   // Verify the PacketCursor is within the packet
+   //
+-  if (  (*PacketCursor < Packet->Dhcp6.Option)
+-     || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
+-  {
++  if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+@@ -941,14 +936,14 @@ Dhcp6AppendIaOption (
+   }
+ 
+   //
+-  // Fill the value of Ia option length
++  // Update the packet length
+   //
+-  *Len = HTONS ((UINT16)(*PacketCursor - (UINT8 *)Len - 2));
++  Packet->Length += BytesNeeded;
+ 
+   //
+-  // Update the packet length
++  // Fill the value of Ia option length
+   //
+-  Packet->Length += BytesNeeded;
++  *Len = HTONS ((UINT16)(*PacketCursor - (UINT8 *)Len - 2));
+ 
+   return EFI_SUCCESS;
+ }
+@@ -957,6 +952,7 @@ Dhcp6AppendIaOption (
+   Append the appointed Elapsed time option to Buf, and move Buf to the end.
+ 
+   @param[in, out] Packet        A pointer to the packet, on success Packet->Length
++                                will be updated.
+   @param[in, out] PacketCursor  The pointer in the packet, on success PacketCursor
+                                 will be moved to the end of the option.
+   @param[in]      Instance      The pointer to the Dhcp6 instance.
+@@ -1012,9 +1008,7 @@ Dhcp6AppendETOption (
+   //
+   // Verify the PacketCursor is within the packet
+   //
+-  if (  (*PacketCursor < Packet->Dhcp6.Option)
+-     || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER))))
+-  {
++  if (IS_INVALID_PACKET_CURSOR (PacketCursor, Packet)) {
+     return EFI_INVALID_PARAMETER;
+   }
+ 
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch

@@ -0,0 +1,618 @@
+From c1700b34913109cd9600f58f1fa6b82b08ce3795 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 9 Feb 2024 17:57:07 -0500
+Subject: [PATCH 04/18] NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229
+ Patch
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [4/18] 23b6841dbb01249055b8040d85995c366bd94252
+
+JIRA: https://issues.redhat.com/browse/RHEL-21841
+CVE: CVE-2023-45229
+Upstream: Merged
+
+commit 1dbb10cc52dc8ef49bb700daa1cefc76b26d52e0
+Author: Doug Flick via groups.io <dougflick=microsoft.com@groups.io>
+Date:   Fri Jan 26 05:54:46 2024 +0800
+
+    NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Patch
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4534
+
+    Bug Details:
+    PixieFail Bug #1
+    CVE-2023-45229
+    CVSS 6.5 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    CWE-125 Out-of-bounds Read
+
+    Change Overview:
+
+    Introduce Dhcp6SeekInnerOptionSafe which performs checks before seeking
+    the Inner Option from a DHCP6 Option.
+
+    >
+    > EFI_STATUS
+    > Dhcp6SeekInnerOptionSafe (
+    >  IN  UINT16  IaType,
+    >  IN  UINT8   *Option,
+    >  IN  UINT32  OptionLen,
+    >  OUT UINT8   **IaInnerOpt,
+    >  OUT UINT16  *IaInnerLen
+    >  );
+    >
+
+    Lots of code cleanup to improve code readability.
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Dhcp6Dxe/Dhcp6Impl.h | 138 +++++++++++++++++++---
+ NetworkPkg/Dhcp6Dxe/Dhcp6Io.c   | 203 +++++++++++++++++++++-----------
+ 2 files changed, 256 insertions(+), 85 deletions(-)
+
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Impl.h b/NetworkPkg/Dhcp6Dxe/Dhcp6Impl.h
+index f2422c2f28..220e7c68f1 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Impl.h
++++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Impl.h
+@@ -45,6 +45,20 @@ typedef struct _DHCP6_INSTANCE  DHCP6_INSTANCE;
+ #define DHCP6_SERVICE_SIGNATURE   SIGNATURE_32 ('D', 'H', '6', 'S')
+ #define DHCP6_INSTANCE_SIGNATURE  SIGNATURE_32 ('D', 'H', '6', 'I')
+ 
++#define DHCP6_PACKET_ALL        0
++#define DHCP6_PACKET_STATEFUL   1
++#define DHCP6_PACKET_STATELESS  2
++
++#define DHCP6_BASE_PACKET_SIZE  1024
++
++#define DHCP6_PORT_CLIENT  546
++#define DHCP6_PORT_SERVER  547
++
++#define DHCP_CHECK_MEDIA_WAITING_TIME  EFI_TIMER_PERIOD_SECONDS(20)
++
++#define DHCP6_INSTANCE_FROM_THIS(Instance)  CR ((Instance), DHCP6_INSTANCE, Dhcp6, DHCP6_INSTANCE_SIGNATURE)
++#define DHCP6_SERVICE_FROM_THIS(Service)    CR ((Service), DHCP6_SERVICE, ServiceBinding, DHCP6_SERVICE_SIGNATURE)
++
+ //
+ // For more information on DHCP options see RFC 8415, Section 21.1
+ //
+@@ -59,12 +73,10 @@ typedef struct _DHCP6_INSTANCE  DHCP6_INSTANCE;
+ //    |                      (option-len octets)                      |
+ //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ //
+-#define DHCP6_SIZE_OF_OPT_CODE  (sizeof(UINT16))
+-#define DHCP6_SIZE_OF_OPT_LEN   (sizeof(UINT16))
++#define DHCP6_SIZE_OF_OPT_CODE  (sizeof (((EFI_DHCP6_PACKET_OPTION *)0)->OpCode))
++#define DHCP6_SIZE_OF_OPT_LEN   (sizeof (((EFI_DHCP6_PACKET_OPTION *)0)->OpLen))
+ 
+-//
+ // Combined size of Code and Length
+-//
+ #define DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN  (DHCP6_SIZE_OF_OPT_CODE + \
+                                               DHCP6_SIZE_OF_OPT_LEN)
+ 
+@@ -73,34 +85,122 @@ STATIC_ASSERT (
+   "Combined size of Code and Length must be 4 per RFC 8415"
+   );
+ 
+-//
+ // Offset to the length is just past the code
+-//
+-#define DHCP6_OPT_LEN_OFFSET(a)  (a + DHCP6_SIZE_OF_OPT_CODE)
++#define DHCP6_OFFSET_OF_OPT_LEN(a)  (a + DHCP6_SIZE_OF_OPT_CODE)
+ STATIC_ASSERT (
+-  DHCP6_OPT_LEN_OFFSET (0) == 2,
++  DHCP6_OFFSET_OF_OPT_LEN (0) == 2,
+   "Offset of length is + 2 past start of option"
+   );
+ 
+-#define DHCP6_OPT_DATA_OFFSET(a)  (a + DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN)
++#define DHCP6_OFFSET_OF_OPT_DATA(a)  (a + DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN)
+ STATIC_ASSERT (
+-  DHCP6_OPT_DATA_OFFSET (0) == 4,
++  DHCP6_OFFSET_OF_OPT_DATA (0) == 4,
+   "Offset to option data should be +4 from start of option"
+   );
++//
++// Identity Association options (both NA (Non-Temporary) and TA (Temporary Association))
++// are defined in RFC 8415 and are a deriviation of a TLV stucture
++// For more information on IA_NA see Section 21.4
++// For more information on IA_TA see Section 21.5
++//
++//
++//  The format of IA_NA and IA_TA option:
++//
++//     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
++//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++//    |          OPTION_IA_NA         |          option-len           |
++//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++//    |                        IAID (4 octets)                        |
++//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++//    |                        T1 (only for IA_NA)                    |
++//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++//    |                        T2 (only for IA_NA)                    |
++//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++//    |                                                               |
++//    .                  IA_NA-options/IA_TA-options                  .
++//    .                                                               .
++//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++//
++#define DHCP6_SIZE_OF_IAID           (sizeof(UINT32))
++#define DHCP6_SIZE_OF_TIME_INTERVAL  (sizeof(UINT32))
+ 
+-#define DHCP6_PACKET_ALL        0
+-#define DHCP6_PACKET_STATEFUL   1
+-#define DHCP6_PACKET_STATELESS  2
++// Combined size of IAID, T1, and T2
++#define DHCP6_SIZE_OF_COMBINED_IAID_T1_T2  (DHCP6_SIZE_OF_IAID +  \
++                                            DHCP6_SIZE_OF_TIME_INTERVAL + \
++                                            DHCP6_SIZE_OF_TIME_INTERVAL)
++STATIC_ASSERT (
++  DHCP6_SIZE_OF_COMBINED_IAID_T1_T2 == 12,
++  "Combined size of IAID, T1, T2 must be 12 per RFC 8415"
++  );
+ 
+-#define DHCP6_BASE_PACKET_SIZE  1024
++// This is the size of IA_TA without options
++#define DHCP6_MIN_SIZE_OF_IA_TA  (DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN + \
++                                  DHCP6_SIZE_OF_IAID)
++STATIC_ASSERT (
++  DHCP6_MIN_SIZE_OF_IA_TA == 8,
++  "Minimum combined size of IA_TA per RFC 8415"
++  );
+ 
+-#define DHCP6_PORT_CLIENT  546
+-#define DHCP6_PORT_SERVER  547
++// Offset to a IA_TA inner option
++#define DHCP6_OFFSET_OF_IA_TA_INNER_OPT(a)  (a + DHCP6_MIN_SIZE_OF_IA_TA)
++STATIC_ASSERT (
++  DHCP6_OFFSET_OF_IA_TA_INNER_OPT (0) == 8,
++  "Offset of IA_TA Inner option is + 8 past start of option"
++  );
+ 
+-#define DHCP_CHECK_MEDIA_WAITING_TIME  EFI_TIMER_PERIOD_SECONDS(20)
++// This is the size of IA_NA without options (16)
++#define DHCP6_MIN_SIZE_OF_IA_NA  DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN + \
++                                 DHCP6_SIZE_OF_COMBINED_IAID_T1_T2
++STATIC_ASSERT (
++  DHCP6_MIN_SIZE_OF_IA_NA == 16,
++  "Minimum combined size of IA_TA per RFC 8415"
++  );
+ 
+-#define DHCP6_INSTANCE_FROM_THIS(Instance)  CR ((Instance), DHCP6_INSTANCE, Dhcp6, DHCP6_INSTANCE_SIGNATURE)
+-#define DHCP6_SERVICE_FROM_THIS(Service)    CR ((Service), DHCP6_SERVICE, ServiceBinding, DHCP6_SERVICE_SIGNATURE)
++#define DHCP6_OFFSET_OF_IA_NA_INNER_OPT(a)  (a + DHCP6_MIN_SIZE_OF_IA_NA)
++STATIC_ASSERT (
++  DHCP6_OFFSET_OF_IA_NA_INNER_OPT (0) == 16,
++  "Offset of IA_NA Inner option is + 16 past start of option"
++  );
++
++#define DHCP6_OFFSET_OF_IA_NA_T1(a)  (a + \
++                                   DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN + \
++                                   DHCP6_SIZE_OF_IAID)
++STATIC_ASSERT (
++  DHCP6_OFFSET_OF_IA_NA_T1 (0) == 8,
++  "Offset of IA_NA Inner option is + 8 past start of option"
++  );
++
++#define DHCP6_OFFSET_OF_IA_NA_T2(a)  (a + \
++                                   DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN +\
++                                   DHCP6_SIZE_OF_IAID + \
++                                   DHCP6_SIZE_OF_TIME_INTERVAL)
++STATIC_ASSERT (
++  DHCP6_OFFSET_OF_IA_NA_T2 (0) == 12,
++  "Offset of IA_NA Inner option is + 12 past start of option"
++  );
++
++//
++// For more information see RFC 8415 Section 21.13
++//
++// The format of the Status Code Option:
++//
++//     0                   1                   2                   3
++//     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
++//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++//    |       OPTION_STATUS_CODE      |         option-len            |
++//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++//    |          status-code          |                               |
++//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               |
++//    .                                                               .
++//    .                        status-message                         .
++//    .                                                               .
++//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++//
++#define DHCP6_OFFSET_OF_STATUS_CODE(a)  (a + DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN)
++STATIC_ASSERT (
++  DHCP6_OFFSET_OF_STATUS_CODE (0) == 4,
++  "Offset of status is + 4 past start of option"
++  );
+ 
+ extern EFI_IPv6_ADDRESS    mAllDhcpRelayAndServersAddress;
+ extern EFI_DHCP6_PROTOCOL  gDhcp6ProtocolTemplate;
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+index bf5aa7a769..89d16484a5 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
++++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+@@ -598,8 +598,8 @@ Dhcp6UpdateIaInfo (
+   // The inner options still start with 2 bytes option-code and 2 bytes option-len.
+   //
+   if (Instance->Config->IaDescriptor.Type == Dhcp6OptIana) {
+-    T1 = NTOHL (ReadUnaligned32 ((UINT32 *)(Option + 8)));
+-    T2 = NTOHL (ReadUnaligned32 ((UINT32 *)(Option + 12)));
++    T1 = NTOHL (ReadUnaligned32 ((UINT32 *)(DHCP6_OFFSET_OF_IA_NA_T1 (Option))));
++    T2 = NTOHL (ReadUnaligned32 ((UINT32 *)(DHCP6_OFFSET_OF_IA_NA_T2 (Option))));
+     //
+     // Refer to RFC3155 Chapter 22.4. If a client receives an IA_NA with T1 greater than T2,
+     // and both T1 and T2 are greater than 0, the client discards the IA_NA option and processes
+@@ -609,13 +609,14 @@ Dhcp6UpdateIaInfo (
+       return EFI_DEVICE_ERROR;
+     }
+ 
+-    IaInnerOpt = Option + 16;
+-    IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(Option + 2))) - 12);
++    IaInnerOpt = DHCP6_OFFSET_OF_IA_NA_INNER_OPT (Option);
++    IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option)))) - DHCP6_SIZE_OF_COMBINED_IAID_T1_T2);
+   } else {
+-    T1         = 0;
+-    T2         = 0;
+-    IaInnerOpt = Option + 8;
+-    IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(Option + 2))) - 4);
++    T1 = 0;
++    T2 = 0;
++
++    IaInnerOpt = DHCP6_OFFSET_OF_IA_TA_INNER_OPT (Option);
++    IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option)))) - DHCP6_SIZE_OF_IAID);
+   }
+ 
+   //
+@@ -641,7 +642,7 @@ Dhcp6UpdateIaInfo (
+   Option  = Dhcp6SeekOption (IaInnerOpt, IaInnerLen, Dhcp6OptStatusCode);
+ 
+   if (Option != NULL) {
+-    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(Option + 4)));
++    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option))));
+     if (StsCode != Dhcp6StsSuccess) {
+       return EFI_DEVICE_ERROR;
+     }
+@@ -661,6 +662,87 @@ Dhcp6UpdateIaInfo (
+   return Status;
+ }
+ 
++/**
++  Seeks the Inner Options from a DHCP6 Option
++
++  @param[in]  IaType          The type of the IA option.
++  @param[in]  Option          The pointer to the DHCP6 Option.
++  @param[in]  OptionLen       The length of the DHCP6 Option.
++  @param[out] IaInnerOpt      The pointer to the IA inner option.
++  @param[out] IaInnerLen      The length of the IA inner option.
++
++  @retval EFI_SUCCESS         Seek the inner option successfully.
++  @retval EFI_DEVICE_ERROR    The OptionLen is invalid. On Error,
++                              the pointers are not modified
++**/
++EFI_STATUS
++Dhcp6SeekInnerOptionSafe (
++  IN  UINT16  IaType,
++  IN  UINT8   *Option,
++  IN  UINT32  OptionLen,
++  OUT UINT8   **IaInnerOpt,
++  OUT UINT16  *IaInnerLen
++  )
++{
++  UINT16  IaInnerLenTmp;
++  UINT8   *IaInnerOptTmp;
++
++  if (Option == NULL) {
++    ASSERT (Option != NULL);
++    return EFI_DEVICE_ERROR;
++  }
++
++  if (IaInnerOpt == NULL) {
++    ASSERT (IaInnerOpt != NULL);
++    return EFI_DEVICE_ERROR;
++  }
++
++  if (IaInnerLen == NULL) {
++    ASSERT (IaInnerLen != NULL);
++    return EFI_DEVICE_ERROR;
++  }
++
++  if (IaType == Dhcp6OptIana) {
++    // Verify we have a fully formed IA_NA
++    if (OptionLen < DHCP6_MIN_SIZE_OF_IA_NA) {
++      return EFI_DEVICE_ERROR;
++    }
++
++    //
++    IaInnerOptTmp = DHCP6_OFFSET_OF_IA_NA_INNER_OPT (Option);
++
++    // Verify the IaInnerLen is valid.
++    IaInnerLenTmp = (UINT16)NTOHS (ReadUnaligned16 ((UINT16 *)DHCP6_OFFSET_OF_OPT_LEN (Option)));
++    if (IaInnerLenTmp < DHCP6_SIZE_OF_COMBINED_IAID_T1_T2) {
++      return EFI_DEVICE_ERROR;
++    }
++
++    IaInnerLenTmp -= DHCP6_SIZE_OF_COMBINED_IAID_T1_T2;
++  } else if (IaType == Dhcp6OptIata) {
++    // Verify the OptionLen is valid.
++    if (OptionLen < DHCP6_MIN_SIZE_OF_IA_TA) {
++      return EFI_DEVICE_ERROR;
++    }
++
++    IaInnerOptTmp = DHCP6_OFFSET_OF_IA_TA_INNER_OPT (Option);
++
++    // Verify the IaInnerLen is valid.
++    IaInnerLenTmp = (UINT16)NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option))));
++    if (IaInnerLenTmp < DHCP6_SIZE_OF_IAID) {
++      return EFI_DEVICE_ERROR;
++    }
++
++    IaInnerLenTmp -= DHCP6_SIZE_OF_IAID;
++  } else {
++    return EFI_DEVICE_ERROR;
++  }
++
++  *IaInnerOpt = IaInnerOptTmp;
++  *IaInnerLen = IaInnerLenTmp;
++
++  return EFI_SUCCESS;
++}
++
+ /**
+   Seek StatusCode Option in package. A Status Code option may appear in the
+   options field of a DHCP message and/or in the options field of another option.
+@@ -684,6 +766,12 @@ Dhcp6SeekStsOption (
+   UINT8   *IaInnerOpt;
+   UINT16  IaInnerLen;
+   UINT16  StsCode;
++  UINT32  OptionLen;
++
++  // OptionLen is the length of the Options excluding the DHCP header.
++  // Length of the EFI_DHCP6_PACKET from the first byte of the Header field to the last
++  // byte of the Option[] field.
++  OptionLen = Packet->Length - sizeof (Packet->Dhcp6.Header);
+ 
+   //
+   // Seek StatusCode option directly in DHCP message body. That is, search in
+@@ -691,12 +779,12 @@ Dhcp6SeekStsOption (
+   //
+   *Option = Dhcp6SeekOption (
+               Packet->Dhcp6.Option,
+-              Packet->Length - 4,
++              OptionLen,
+               Dhcp6OptStatusCode
+               );
+ 
+   if (*Option != NULL) {
+-    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(*Option + 4)));
++    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_STATUS_CODE (*Option))));
+     if (StsCode != Dhcp6StsSuccess) {
+       return EFI_DEVICE_ERROR;
+     }
+@@ -707,7 +795,7 @@ Dhcp6SeekStsOption (
+   //
+   *Option = Dhcp6SeekIaOption (
+               Packet->Dhcp6.Option,
+-              Packet->Length - sizeof (EFI_DHCP6_HEADER),
++              OptionLen,
+               &Instance->Config->IaDescriptor
+               );
+   if (*Option == NULL) {
+@@ -715,52 +803,35 @@ Dhcp6SeekStsOption (
+   }
+ 
+   //
+-  // The format of the IA_NA option is:
++  // Calculate the distance from Packet->Dhcp6.Option to the IA option.
+   //
+-  //     0                   1                   2                   3
+-  //     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |          OPTION_IA_NA         |          option-len           |
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |                        IAID (4 octets)                        |
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |                              T1                               |
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |                              T2                               |
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |                                                               |
+-  //    .                         IA_NA-options                         .
+-  //    .                                                               .
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++  // Packet->Size and Packet->Length are both UINT32 type, and Packet->Size is
++  // the size of the whole packet, including the DHCP header, and Packet->Length
++  // is the length of the DHCP message body, excluding the DHCP header.
+   //
+-  // The format of the IA_TA option is:
++  // (*Option - Packet->Dhcp6.Option) is the number of bytes from the start of
++  // DHCP6 option area to the start of the IA option.
+   //
+-  //     0                   1                   2                   3
+-  //     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |         OPTION_IA_TA          |          option-len           |
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |                        IAID (4 octets)                        |
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-  //    |                                                               |
+-  //    .                         IA_TA-options                         .
+-  //    .                                                               .
+-  //    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++  // Dhcp6SeekInnerOptionSafe() is searching starting from the start of the
++  // IA option to the end of the DHCP6 option area, thus subtract the space
++  // up until this option
+   //
++  OptionLen = OptionLen - (*Option - Packet->Dhcp6.Option);
+ 
+   //
+-  // sizeof (option-code + option-len + IaId)           = 8
+-  // sizeof (option-code + option-len + IaId + T1)      = 12
+-  // sizeof (option-code + option-len + IaId + T1 + T2) = 16
+-  //
+-  // The inner options still start with 2 bytes option-code and 2 bytes option-len.
++  // Seek the inner option
+   //
+-  if (Instance->Config->IaDescriptor.Type == Dhcp6OptIana) {
+-    IaInnerOpt = *Option + 16;
+-    IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(*Option + 2))) - 12);
+-  } else {
+-    IaInnerOpt = *Option + 8;
+-    IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(*Option + 2))) - 4);
++  if (EFI_ERROR (
++        Dhcp6SeekInnerOptionSafe (
++          Instance->Config->IaDescriptor.Type,
++          *Option,
++          OptionLen,
++          &IaInnerOpt,
++          &IaInnerLen
++          )
++        ))
++  {
++    return EFI_DEVICE_ERROR;
+   }
+ 
+   //
+@@ -784,7 +855,7 @@ Dhcp6SeekStsOption (
+   //
+   *Option = Dhcp6SeekOption (IaInnerOpt, IaInnerLen, Dhcp6OptStatusCode);
+   if (*Option != NULL) {
+-    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(*Option + 4)));
++    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)((DHCP6_OFFSET_OF_STATUS_CODE (*Option)))));
+     if (StsCode != Dhcp6StsSuccess) {
+       return EFI_DEVICE_ERROR;
+     }
+@@ -1105,7 +1176,7 @@ Dhcp6SendRequestMsg (
+   //
+   Option = Dhcp6SeekOption (
+              Instance->AdSelect->Dhcp6.Option,
+-             Instance->AdSelect->Length - 4,
++             Instance->AdSelect->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptServerId
+              );
+   if (Option == NULL) {
+@@ -1289,7 +1360,7 @@ Dhcp6SendDeclineMsg (
+   //
+   Option = Dhcp6SeekOption (
+              LastReply->Dhcp6.Option,
+-             LastReply->Length - 4,
++             LastReply->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptServerId
+              );
+   if (Option == NULL) {
+@@ -1448,7 +1519,7 @@ Dhcp6SendReleaseMsg (
+   //
+   Option = Dhcp6SeekOption (
+              LastReply->Dhcp6.Option,
+-             LastReply->Length - 4,
++             LastReply->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptServerId
+              );
+   if (Option == NULL) {
+@@ -1673,7 +1744,7 @@ Dhcp6SendRenewRebindMsg (
+ 
+     Option = Dhcp6SeekOption (
+                LastReply->Dhcp6.Option,
+-               LastReply->Length - 4,
++               LastReply->Length - sizeof (EFI_DHCP6_HEADER),
+                Dhcp6OptServerId
+                );
+     if (Option == NULL) {
+@@ -2208,7 +2279,7 @@ Dhcp6HandleReplyMsg (
+   //
+   Option = Dhcp6SeekOption (
+              Packet->Dhcp6.Option,
+-             Packet->Length - 4,
++             Packet->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptRapidCommit
+              );
+ 
+@@ -2354,7 +2425,7 @@ Dhcp6HandleReplyMsg (
+     //
+     // Any error status code option is found.
+     //
+-    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(Option + 4)));
++    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)((DHCP6_OFFSET_OF_STATUS_CODE (Option)))));
+     switch (StsCode) {
+       case Dhcp6StsUnspecFail:
+         //
+@@ -2487,7 +2558,7 @@ Dhcp6SelectAdvertiseMsg (
+   //
+   Option = Dhcp6SeekOption (
+              AdSelect->Dhcp6.Option,
+-             AdSelect->Length - 4,
++             AdSelect->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptServerUnicast
+              );
+ 
+@@ -2498,7 +2569,7 @@ Dhcp6SelectAdvertiseMsg (
+       return EFI_OUT_OF_RESOURCES;
+     }
+ 
+-    CopyMem (Instance->Unicast, Option + 4, sizeof (EFI_IPv6_ADDRESS));
++    CopyMem (Instance->Unicast, DHCP6_OFFSET_OF_OPT_DATA (Option), sizeof (EFI_IPv6_ADDRESS));
+   }
+ 
+   //
+@@ -2551,7 +2622,7 @@ Dhcp6HandleAdvertiseMsg (
+   //
+   Option = Dhcp6SeekOption (
+              Packet->Dhcp6.Option,
+-             Packet->Length - 4,
++             Packet->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptRapidCommit
+              );
+ 
+@@ -2645,7 +2716,7 @@ Dhcp6HandleAdvertiseMsg (
+       CopyMem (Instance->AdSelect, Packet, Packet->Size);
+ 
+       if (Option != NULL) {
+-        Instance->AdPref = *(Option + 4);
++        Instance->AdPref = *(DHCP6_OFFSET_OF_OPT_DATA (Option));
+       }
+     } else {
+       //
+@@ -2714,11 +2785,11 @@ Dhcp6HandleStateful (
+   //
+   Option = Dhcp6SeekOption (
+              Packet->Dhcp6.Option,
+-             Packet->Length - 4,
++             Packet->Length - DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN,
+              Dhcp6OptClientId
+              );
+ 
+-  if ((Option == NULL) || (CompareMem (Option + 4, ClientId->Duid, ClientId->Length) != 0)) {
++  if ((Option == NULL) || (CompareMem (DHCP6_OFFSET_OF_OPT_DATA (Option), ClientId->Duid, ClientId->Length) != 0)) {
+     goto ON_CONTINUE;
+   }
+ 
+@@ -2727,7 +2798,7 @@ Dhcp6HandleStateful (
+   //
+   Option = Dhcp6SeekOption (
+              Packet->Dhcp6.Option,
+-             Packet->Length - 4,
++             Packet->Length - DHCP6_SIZE_OF_COMBINED_CODE_AND_LEN,
+              Dhcp6OptServerId
+              );
+ 
+@@ -2832,7 +2903,7 @@ Dhcp6HandleStateless (
+   //
+   Option = Dhcp6SeekOption (
+              Packet->Dhcp6.Option,
+-             Packet->Length - 4,
++             Packet->Length - sizeof (EFI_DHCP6_HEADER),
+              Dhcp6OptServerId
+              );
+ 
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch

@@ -0,0 +1,257 @@
+From dcfd5b6e28536e5b28fb4c47ec57f8d106b6b181 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 15/18] NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229
+ Related Patch
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [15/18] e2fe2033c2f90145249d9416a539d5b2fc52596a
+
+JIRA: https://issues.redhat.com/browse/RHEL-21841
+CVE: CVE-2023-45229
+Upstream: Merged
+
+commit 1c440a5eceedc64e892877eeac0f1a4938f5abbb
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Tue Feb 13 10:46:00 2024 -0800
+
+    NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Related Patch
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4673
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4534
+
+    This was not part of the Quarkslab bugs however the same pattern
+    as CVE-2023-45229 exists in Dhcp6UpdateIaInfo.
+
+    This patch replaces the code in question with the safe function
+    created to patch CVE-2023-45229
+
+    >
+    >   if (EFI_ERROR (
+    >        Dhcp6SeekInnerOptionSafe (
+    >          Instance->Config->IaDescriptor.Type,
+    >          Option,
+    >          OptionLen,
+    >          &IaInnerOpt,
+    >          &IaInnerLen
+    >          )
+    >        ))
+    >  {
+    >    return EFI_DEVICE_ERROR;
+    >  }
+    >
+
+    Additionally corrects incorrect usage of macro to read the status
+
+    > - StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)DHCP6_OFFSET_OF_OPT_LEN
+     (Option)));
+    > + StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)
+    DHCP6_OFFSET_OF_STATUS_CODE (Option));
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Dhcp6Dxe/Dhcp6Io.c | 70 ++++++++++++++++++++++++++---------
+ NetworkPkg/Dhcp6Dxe/Dhcp6Io.h | 22 +++++++++++
+ 2 files changed, 75 insertions(+), 17 deletions(-)
+
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+index 3b8feb4a20..a9bffae353 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
++++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+@@ -528,13 +528,23 @@ Dhcp6UpdateIaInfo (
+ {
+   EFI_STATUS  Status;
+   UINT8       *Option;
++  UINT32      OptionLen;
+   UINT8       *IaInnerOpt;
+   UINT16      IaInnerLen;
+   UINT16      StsCode;
+   UINT32      T1;
+   UINT32      T2;
+ 
++  T1 = 0;
++  T2 = 0;
++
+   ASSERT (Instance->Config != NULL);
++
++  // OptionLen is the length of the Options excluding the DHCP header.
++  // Length of the EFI_DHCP6_PACKET from the first byte of the Header field to the last
++  // byte of the Option[] field.
++  OptionLen = Packet->Length - sizeof (Packet->Dhcp6.Header);
++
+   //
+   // If the reply was received in response to a solicit with rapid commit option,
+   // request, renew or rebind message, the client updates the information it has
+@@ -549,13 +559,29 @@ Dhcp6UpdateIaInfo (
+   //
+   Option = Dhcp6SeekIaOption (
+              Packet->Dhcp6.Option,
+-             Packet->Length - sizeof (EFI_DHCP6_HEADER),
++             OptionLen,
+              &Instance->Config->IaDescriptor
+              );
+   if (Option == NULL) {
+     return EFI_DEVICE_ERROR;
+   }
+ 
++  //
++  // Calculate the distance from Packet->Dhcp6.Option to the IA option.
++  //
++  // Packet->Size and Packet->Length are both UINT32 type, and Packet->Size is
++  // the size of the whole packet, including the DHCP header, and Packet->Length
++  // is the length of the DHCP message body, excluding the DHCP header.
++  //
++  // (*Option - Packet->Dhcp6.Option) is the number of bytes from the start of
++  // DHCP6 option area to the start of the IA option.
++  //
++  // Dhcp6SeekInnerOptionSafe() is searching starting from the start of the
++  // IA option to the end of the DHCP6 option area, thus subtract the space
++  // up until this option
++  //
++  OptionLen = OptionLen - (UINT32)(Option - Packet->Dhcp6.Option);
++
+   //
+   // The format of the IA_NA option is:
+   //
+@@ -591,32 +617,32 @@ Dhcp6UpdateIaInfo (
+   //
+ 
+   //
+-  // sizeof (option-code + option-len + IaId)           = 8
+-  // sizeof (option-code + option-len + IaId + T1)      = 12
+-  // sizeof (option-code + option-len + IaId + T1 + T2) = 16
+-  //
+-  // The inner options still start with 2 bytes option-code and 2 bytes option-len.
++  // Seek the inner option
+   //
++  if (EFI_ERROR (
++        Dhcp6SeekInnerOptionSafe (
++          Instance->Config->IaDescriptor.Type,
++          Option,
++          OptionLen,
++          &IaInnerOpt,
++          &IaInnerLen
++          )
++        ))
++  {
++    return EFI_DEVICE_ERROR;
++  }
++
+   if (Instance->Config->IaDescriptor.Type == Dhcp6OptIana) {
+     T1 = NTOHL (ReadUnaligned32 ((UINT32 *)(DHCP6_OFFSET_OF_IA_NA_T1 (Option))));
+     T2 = NTOHL (ReadUnaligned32 ((UINT32 *)(DHCP6_OFFSET_OF_IA_NA_T2 (Option))));
+     //
+     // Refer to RFC3155 Chapter 22.4. If a client receives an IA_NA with T1 greater than T2,
+     // and both T1 and T2 are greater than 0, the client discards the IA_NA option and processes
+-    // the remainder of the message as though the server had not  included the invalid IA_NA option.
++    // the remainder of the message as though the server had not included the invalid IA_NA option.
+     //
+     if ((T1 > T2) && (T2 > 0)) {
+       return EFI_DEVICE_ERROR;
+     }
+-
+-    IaInnerOpt = DHCP6_OFFSET_OF_IA_NA_INNER_OPT (Option);
+-    IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option)))) - DHCP6_SIZE_OF_COMBINED_IAID_T1_T2);
+-  } else {
+-    T1 = 0;
+-    T2 = 0;
+-
+-    IaInnerOpt = DHCP6_OFFSET_OF_IA_TA_INNER_OPT (Option);
+-    IaInnerLen = (UINT16)(NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option)))) - DHCP6_SIZE_OF_IAID);
+   }
+ 
+   //
+@@ -642,7 +668,7 @@ Dhcp6UpdateIaInfo (
+   Option  = Dhcp6SeekOption (IaInnerOpt, IaInnerLen, Dhcp6OptStatusCode);
+ 
+   if (Option != NULL) {
+-    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option))));
++    StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_STATUS_CODE (Option))));
+     if (StsCode != Dhcp6StsSuccess) {
+       return EFI_DEVICE_ERROR;
+     }
+@@ -703,15 +729,21 @@ Dhcp6SeekInnerOptionSafe (
+   }
+ 
+   if (IaType == Dhcp6OptIana) {
++    //
+     // Verify we have a fully formed IA_NA
++    //
+     if (OptionLen < DHCP6_MIN_SIZE_OF_IA_NA) {
+       return EFI_DEVICE_ERROR;
+     }
+ 
++    //
++    // Get the IA Inner Option and Length
+     //
+     IaInnerOptTmp = DHCP6_OFFSET_OF_IA_NA_INNER_OPT (Option);
+ 
++    //
+     // Verify the IaInnerLen is valid.
++    //
+     IaInnerLenTmp = (UINT16)NTOHS (ReadUnaligned16 ((UINT16 *)DHCP6_OFFSET_OF_OPT_LEN (Option)));
+     if (IaInnerLenTmp < DHCP6_SIZE_OF_COMBINED_IAID_T1_T2) {
+       return EFI_DEVICE_ERROR;
+@@ -719,14 +751,18 @@ Dhcp6SeekInnerOptionSafe (
+ 
+     IaInnerLenTmp -= DHCP6_SIZE_OF_COMBINED_IAID_T1_T2;
+   } else if (IaType == Dhcp6OptIata) {
++    //
+     // Verify the OptionLen is valid.
++    //
+     if (OptionLen < DHCP6_MIN_SIZE_OF_IA_TA) {
+       return EFI_DEVICE_ERROR;
+     }
+ 
+     IaInnerOptTmp = DHCP6_OFFSET_OF_IA_TA_INNER_OPT (Option);
+ 
++    //
+     // Verify the IaInnerLen is valid.
++    //
+     IaInnerLenTmp = (UINT16)NTOHS (ReadUnaligned16 ((UINT16 *)(DHCP6_OFFSET_OF_OPT_LEN (Option))));
+     if (IaInnerLenTmp < DHCP6_SIZE_OF_IAID) {
+       return EFI_DEVICE_ERROR;
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.h b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.h
+index 051a652f2b..ab0e1ac27f 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.h
++++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.h
+@@ -217,4 +217,26 @@ Dhcp6OnTimerTick (
+   IN VOID       *Context
+   );
+ 
++/**
++  Seeks the Inner Options from a DHCP6 Option
++
++  @param[in]  IaType          The type of the IA option.
++  @param[in]  Option          The pointer to the DHCP6 Option.
++  @param[in]  OptionLen       The length of the DHCP6 Option.
++  @param[out] IaInnerOpt      The pointer to the IA inner option.
++  @param[out] IaInnerLen      The length of the IA inner option.
++
++  @retval EFI_SUCCESS         Seek the inner option successfully.
++  @retval EFI_DEVICE_ERROR    The OptionLen is invalid. On Error,
++                              the pointers are not modified
++**/
++EFI_STATUS
++Dhcp6SeekInnerOptionSafe (
++  IN  UINT16  IaType,
++  IN  UINT8   *Option,
++  IN  UINT32  OptionLen,
++  OUT UINT8   **IaInnerOpt,
++  OUT UINT16  *IaInnerLen
++  );
++
+ #endif
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Un.patch

@@ -0,0 +1,565 @@
+From 76930459d2e3f82e10968ec8904e45c8bac77fd8 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 9 Feb 2024 17:57:07 -0500
+Subject: [PATCH 05/18] NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229
+ Unit Tests
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [5/18] 7421b6f8d8e6bc3d8ea4aaf90f65608136b968b2
+
+JIRA: https://issues.redhat.com/browse/RHEL-21841
+CVE: CVE-2023-45229
+Upstream: Merged
+
+commit 07362769ab7a7d74dbea1c7a7a3662c7b5d1f097
+Author: Doug Flick via groups.io <dougflick=microsoft.com@groups.io>
+Date:   Fri Jan 26 05:54:47 2024 +0800
+
+    NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Unit Tests
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4534
+
+    These tests confirm that the report bug...
+
+    "Out-of-bounds read when processing IA_NA/IA_TA options in a
+    DHCPv6 Advertise message"
+
+    ..has been patched.
+
+    The following functions are tested to confirm an out of bounds read is
+    patched and that the correct statuses are returned:
+
+    Dhcp6SeekInnerOptionSafe
+    Dhcp6SeekStsOption
+
+    TCBZ4534
+    CVE-2023-45229
+    CVSS 6.5 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    CWE-125 Out-of-bounds Read
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Dhcp6Dxe/Dhcp6Io.c                 |   2 +-
+ .../GoogleTest/Dhcp6DxeGoogleTest.inf         |   1 +
+ .../Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.cpp | 365 +++++++++++++++++-
+ .../Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.h   |  58 +++
+ NetworkPkg/Test/NetworkPkgHostTest.dsc        |   1 +
+ 5 files changed, 424 insertions(+), 3 deletions(-)
+ create mode 100644 NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.h
+
+diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+index 89d16484a5..3b8feb4a20 100644
+--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
++++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Io.c
+@@ -816,7 +816,7 @@ Dhcp6SeekStsOption (
+   // IA option to the end of the DHCP6 option area, thus subtract the space
+   // up until this option
+   //
+-  OptionLen = OptionLen - (*Option - Packet->Dhcp6.Option);
++  OptionLen = OptionLen - (UINT32)(*Option - Packet->Dhcp6.Option);
+ 
+   //
+   // Seek the inner option
+diff --git a/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf b/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
+index 8e9119a371..12532ed30c 100644
+--- a/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
++++ b/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
+@@ -18,6 +18,7 @@
+ [Sources]
+   Dhcp6DxeGoogleTest.cpp
+   Dhcp6IoGoogleTest.cpp
++  Dhcp6IoGoogleTest.h
+   ../Dhcp6Io.c
+   ../Dhcp6Utility.c
+ 
+diff --git a/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.cpp b/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.cpp
+index 7ee40e4af4..7db253a7b8 100644
+--- a/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.cpp
++++ b/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.cpp
+@@ -13,6 +13,7 @@ extern "C" {
+   #include <Library/BaseMemoryLib.h>
+   #include "../Dhcp6Impl.h"
+   #include "../Dhcp6Utility.h"
++  #include "Dhcp6IoGoogleTest.h"
+ }
+ 
+ ////////////////////////////////////////////////////////////////////////
+@@ -21,7 +22,35 @@ extern "C" {
+ 
+ #define DHCP6_PACKET_MAX_LEN  1500
+ 
++// This definition is used by this test but is also required to compile
++// by Dhcp6Io.c
++#define DHCPV6_OPTION_IA_NA  3
++#define DHCPV6_OPTION_IA_TA  4
++
++#define SEARCH_PATTERN      0xDEADC0DE
++#define SEARCH_PATTERN_LEN  sizeof(SEARCH_PATTERN)
++
+ ////////////////////////////////////////////////////////////////////////
++// Test structures for IA_NA and IA_TA options
++////////////////////////////////////////////////////////////////////////
++typedef struct {
++  UINT16    Code;
++  UINT16    Len;
++  UINT32    IAID;
++} DHCPv6_OPTION;
++
++typedef struct {
++  DHCPv6_OPTION    Header;
++  UINT32           T1;
++  UINT32           T2;
++  UINT8            InnerOptions[0];
++} DHCPv6_OPTION_IA_NA;
++
++typedef struct {
++  DHCPv6_OPTION    Header;
++  UINT8            InnerOptions[0];
++} DHCPv6_OPTION_IA_TA;
++
+ ////////////////////////////////////////////////////////////////////////
+ // Symbol Definitions
+ // These functions are not directly under test - but required to compile
+@@ -210,7 +239,7 @@ TEST_F (Dhcp6AppendETOptionTest, InvalidDataExpectBufferTooSmall) {
+   Status = Dhcp6AppendETOption (
+              Dhcp6AppendETOptionTest::Packet,
+              &Cursor,
+-             &Instance, // Instance is not used in this function
++             &Instance,                    // Instance is not used in this function
+              &ElapsedTime
+              );
+ 
+@@ -240,7 +269,7 @@ TEST_F (Dhcp6AppendETOptionTest, ValidDataExpectSuccess) {
+   Status = Dhcp6AppendETOption (
+              Dhcp6AppendETOptionTest::Packet,
+              &Cursor,
+-             &Instance, // Instance is not used in this function
++             &Instance,                    // Instance is not used in this function
+              &ElapsedTime
+              );
+ 
+@@ -476,3 +505,335 @@ TEST_F (Dhcp6AppendIaOptionTest, IaTaValidDataExpectSuccess) {
+   // verify that the status is EFI_SUCCESS
+   ASSERT_EQ (Status, EFI_SUCCESS);
+ }
++
++////////////////////////////////////////////////////////////////////////
++// Dhcp6SeekInnerOptionSafe Tests
++////////////////////////////////////////////////////////////////////////
++
++// Define a fixture for your tests if needed
++class Dhcp6SeekInnerOptionSafeTest : public ::testing::Test {
++protected:
++  // Add any setup code if needed
++  virtual void
++  SetUp (
++    )
++  {
++    // Initialize any resources or variables
++  }
++
++  // Add any cleanup code if needed
++  virtual void
++  TearDown (
++    )
++  {
++    // Clean up any resources or variables
++  }
++};
++
++// Test Description:
++// This test verifies that Dhcp6SeekInnerOptionSafe returns EFI_SUCCESS when the IANA option is found.
++TEST_F (Dhcp6SeekInnerOptionSafeTest, IANAValidOptionExpectSuccess) {
++  EFI_STATUS           Result;
++  UINT8                Option[sizeof (DHCPv6_OPTION_IA_NA) + SEARCH_PATTERN_LEN] = { 0 };
++  UINT32               OptionLength                                              = sizeof (Option);
++  DHCPv6_OPTION_IA_NA  *OptionPtr                                                = (DHCPv6_OPTION_IA_NA *)Option;
++  UINT32               SearchPattern                                             = SEARCH_PATTERN;
++
++  UINTN   SearchPatternLength = SEARCH_PATTERN_LEN;
++  UINT8   *InnerOptionPtr     = NULL;
++  UINT16  InnerOptionLength   = 0;
++
++  OptionPtr->Header.Code = Dhcp6OptIana;
++  OptionPtr->Header.Len  = HTONS (4 + 12); // Valid length has to be more than 12
++  OptionPtr->Header.IAID = 0x12345678;
++  OptionPtr->T1          = 0x11111111;
++  OptionPtr->T2          = 0x22222222;
++  CopyMem (OptionPtr->InnerOptions, &SearchPattern, SearchPatternLength);
++
++  Result = Dhcp6SeekInnerOptionSafe (
++             Dhcp6OptIana,
++             Option,
++             OptionLength,
++             &InnerOptionPtr,
++             &InnerOptionLength
++             );
++  ASSERT_EQ (Result, EFI_SUCCESS);
++  ASSERT_EQ (InnerOptionLength, 4);
++  ASSERT_EQ (CompareMem (InnerOptionPtr, &SearchPattern, SearchPatternLength), 0);
++}
++
++// Test Description:
++// This test verifies that Dhcp6SeekInnerOptionSafe returns EFI_DEIVCE_ERROR when the IANA option size is invalid.
++TEST_F (Dhcp6SeekInnerOptionSafeTest, IANAInvalidSizeExpectFail) {
++  // Lets add an inner option of bytes we expect to find
++  EFI_STATUS           Status;
++  UINT8                Option[sizeof (DHCPv6_OPTION_IA_NA) + SEARCH_PATTERN_LEN] = { 0 };
++  UINT32               OptionLength                                              = sizeof (Option);
++  DHCPv6_OPTION_IA_NA  *OptionPtr                                                = (DHCPv6_OPTION_IA_NA *)Option;
++  UINT32               SearchPattern                                             = SEARCH_PATTERN;
++
++  UINTN   SearchPatternLength = SEARCH_PATTERN_LEN;
++  UINT8   *InnerOptionPtr     = NULL;
++  UINT16  InnerOptionLength   = 0;
++
++  OptionPtr->Header.Code = Dhcp6OptIana;
++  OptionPtr->Header.Len  = HTONS (4); // Set the length to lower than expected (12)
++  OptionPtr->Header.IAID = 0x12345678;
++  OptionPtr->T1          = 0x11111111;
++  OptionPtr->T2          = 0x22222222;
++  CopyMem (OptionPtr->InnerOptions, &SearchPattern, SearchPatternLength);
++
++  // Set the InnerOptionLength to be less than the size of the option
++  Status = Dhcp6SeekInnerOptionSafe (
++             Dhcp6OptIana,
++             Option,
++             OptionLength,
++             &InnerOptionPtr,
++             &InnerOptionLength
++             );
++  ASSERT_EQ (Status, EFI_DEVICE_ERROR);
++
++  // Now set the OptionLength to be less than the size of the option
++  OptionLength = sizeof (DHCPv6_OPTION_IA_NA) - 1;
++  Status       = Dhcp6SeekInnerOptionSafe (
++                   Dhcp6OptIana,
++                   Option,
++                   OptionLength,
++                   &InnerOptionPtr,
++                   &InnerOptionLength
++                   );
++  ASSERT_EQ (Status, EFI_DEVICE_ERROR);
++}
++
++// Test Description:
++// This test verifies that Dhcp6SeekInnerOptionSafe returns EFI_SUCCESS when the IATA option is found
++TEST_F (Dhcp6SeekInnerOptionSafeTest, IATAValidOptionExpectSuccess) {
++  // Lets add an inner option of bytes we expect to find
++  EFI_STATUS           Status;
++  UINT8                Option[sizeof (DHCPv6_OPTION_IA_TA) + SEARCH_PATTERN_LEN] = { 0 };
++  UINT32               OptionLength                                              = sizeof (Option);
++  DHCPv6_OPTION_IA_TA  *OptionPtr                                                = (DHCPv6_OPTION_IA_TA *)Option;
++  UINT32               SearchPattern                                             = SEARCH_PATTERN;
++
++  UINTN   SearchPatternLength = SEARCH_PATTERN_LEN;
++  UINT8   *InnerOptionPtr     = NULL;
++  UINT16  InnerOptionLength   = 0;
++
++  OptionPtr->Header.Code = Dhcp6OptIata;
++  OptionPtr->Header.Len  = HTONS (4 + 4); // Valid length has to be more than 4
++  OptionPtr->Header.IAID = 0x12345678;
++  CopyMem (OptionPtr->InnerOptions, &SearchPattern, SearchPatternLength);
++
++  Status = Dhcp6SeekInnerOptionSafe (
++             Dhcp6OptIata,
++             Option,
++             OptionLength,
++             &InnerOptionPtr,
++             &InnerOptionLength
++             );
++  ASSERT_EQ (Status, EFI_SUCCESS);
++  ASSERT_EQ (InnerOptionLength, 4);
++  ASSERT_EQ (CompareMem (InnerOptionPtr, &SearchPattern, SearchPatternLength), 0);
++}
++
++// Test Description:
++// This test verifies that Dhcp6SeekInnerOptionSafe returns EFI_SUCCESS when the IATA option size is invalid.
++TEST_F (Dhcp6SeekInnerOptionSafeTest, IATAInvalidSizeExpectFail) {
++  // Lets add an inner option of bytes we expect to find
++  EFI_STATUS           Status;
++  UINT8                Option[sizeof (DHCPv6_OPTION_IA_TA) + SEARCH_PATTERN_LEN] = { 0 };
++  UINT32               OptionLength                                              = sizeof (Option);
++  DHCPv6_OPTION_IA_TA  *OptionPtr                                                = (DHCPv6_OPTION_IA_TA *)Option;
++  UINT32               SearchPattern                                             = SEARCH_PATTERN;
++
++  UINTN   SearchPatternLength = SEARCH_PATTERN_LEN;
++  UINT8   *InnerOptionPtr     = NULL;
++  UINT16  InnerOptionLength   = 0;
++
++  OptionPtr->Header.Code = Dhcp6OptIata;
++  OptionPtr->Header.Len  = HTONS (2); // Set the length to lower than expected (4)
++  OptionPtr->Header.IAID = 0x12345678;
++  CopyMem (OptionPtr->InnerOptions, &SearchPattern, SearchPatternLength);
++
++  Status = Dhcp6SeekInnerOptionSafe (
++             Dhcp6OptIata,
++             Option,
++             OptionLength,
++             &InnerOptionPtr,
++             &InnerOptionLength
++             );
++  ASSERT_EQ (Status, EFI_DEVICE_ERROR);
++
++  // Now lets try modifying the OptionLength to be less than the size of the option
++  OptionLength = sizeof (DHCPv6_OPTION_IA_TA) - 1;
++  Status       = Dhcp6SeekInnerOptionSafe (
++                   Dhcp6OptIata,
++                   Option,
++                   OptionLength,
++                   &InnerOptionPtr,
++                   &InnerOptionLength
++                   );
++  ASSERT_EQ (Status, EFI_DEVICE_ERROR);
++}
++
++// Test Description:
++// This test verifies that any other Option Type fails
++TEST_F (Dhcp6SeekInnerOptionSafeTest, InvalidOption) {
++  // Lets add an inner option of bytes we expect to find
++  EFI_STATUS           Result;
++  UINT8                Option[sizeof (DHCPv6_OPTION_IA_TA) + SEARCH_PATTERN_LEN] = { 0 };
++  UINT32               OptionLength                                              = sizeof (Option);
++  DHCPv6_OPTION_IA_TA  *OptionPtr                                                = (DHCPv6_OPTION_IA_TA *)Option;
++  UINT32               SearchPattern                                             = SEARCH_PATTERN;
++
++  UINTN   SearchPatternLength = SEARCH_PATTERN_LEN;
++  UINT8   *InnerOptionPtr     = NULL;
++  UINT16  InnerOptionLength   = 0;
++
++  OptionPtr->Header.Code = 0xC0DE;
++  OptionPtr->Header.Len  = HTONS (2); // Set the length to lower than expected (4)
++  OptionPtr->Header.IAID = 0x12345678;
++  CopyMem (OptionPtr->InnerOptions, &SearchPattern, SearchPatternLength);
++
++  Result = Dhcp6SeekInnerOptionSafe (0xC0DE, Option, OptionLength, &InnerOptionPtr, &InnerOptionLength);
++  ASSERT_EQ (Result, EFI_DEVICE_ERROR);
++}
++
++////////////////////////////////////////////////////////////////////////
++// Dhcp6SeekStsOption Tests
++////////////////////////////////////////////////////////////////////////
++
++#define PACKET_SIZE  (1500)
++
++class Dhcp6SeekStsOptionTest : public ::testing::Test {
++public:
++  DHCP6_INSTANCE Instance      = { 0 };
++  EFI_DHCP6_PACKET *Packet     = NULL;
++  EFI_DHCP6_CONFIG_DATA Config = { 0 };
++
++protected:
++  // Add any setup code if needed
++  virtual void
++  SetUp (
++    )
++  {
++    // Allocate a packet
++    Packet = (EFI_DHCP6_PACKET *)AllocateZeroPool (PACKET_SIZE);
++    ASSERT_NE (Packet, nullptr);
++
++    // Initialize the packet
++    Packet->Size = PACKET_SIZE;
++
++    Instance.Config = &Config;
++  }
++
++  // Add any cleanup code if needed
++  virtual void
++  TearDown (
++    )
++  {
++    // Clean up any resources or variables
++    FreePool (Packet);
++  }
++};
++
++// Test Description:
++// This test verifies that Dhcp6SeekStsOption returns EFI_DEVICE_ERROR when the option is invalid
++// This verifies that the calling function is working as expected
++TEST_F (Dhcp6SeekStsOptionTest, SeekIATAOptionExpectFail) {
++  EFI_STATUS    Status;
++  UINT8         *Option             = NULL;
++  UINT32        SearchPattern       = SEARCH_PATTERN;
++  UINT16        SearchPatternLength = SEARCH_PATTERN_LEN;
++  UINT16        *Len                = NULL;
++  EFI_DHCP6_IA  Ia                  = { 0 };
++
++  Ia.Descriptor.Type                = DHCPV6_OPTION_IA_TA;
++  Ia.IaAddressCount                 = 1;
++  Ia.IaAddress[0].PreferredLifetime = 0xDEADBEEF;
++  Ia.IaAddress[0].ValidLifetime     = 0xDEADAAAA;
++  Ia.IaAddress[0].IpAddress         = mAllDhcpRelayAndServersAddress;
++
++  Packet->Length = sizeof (EFI_DHCP6_HEADER);
++
++  Option = Dhcp6SeekStsOptionTest::Packet->Dhcp6.Option;
++
++  // Let's append the option to the packet
++  Status = Dhcp6AppendOption (
++             Dhcp6SeekStsOptionTest::Packet,
++             &Option,
++             Dhcp6OptStatusCode,
++             SearchPatternLength,
++             (UINT8 *)&SearchPattern
++             );
++  ASSERT_EQ (Status, EFI_SUCCESS);
++
++  // Inner option length - this will be overwritten later
++  Len = (UINT16 *)(Option + 2);
++
++  // Fill in the inner IA option
++  Status = Dhcp6AppendIaOption (
++             Dhcp6SeekStsOptionTest::Packet,
++             &Option,
++             &Ia,
++             0x12345678,
++             0x11111111,
++             0x22222222
++             );
++  ASSERT_EQ (Status, EFI_SUCCESS);
++
++  // overwrite the len of inner Ia option
++  *Len = HTONS (3);
++
++  Dhcp6SeekStsOptionTest::Instance.Config->IaDescriptor.Type = DHCPV6_OPTION_IA_TA;
++
++  Option = NULL;
++  Status = Dhcp6SeekStsOption (&(Dhcp6SeekStsOptionTest::Instance), Dhcp6SeekStsOptionTest::Packet, &Option);
++
++  ASSERT_EQ (Status, EFI_DEVICE_ERROR);
++}
++
++// Test Description:
++// This test verifies that Dhcp6SeekInnerOptionSafe returns EFI_SUCCESS when the IATA option size is invalid.
++TEST_F (Dhcp6SeekStsOptionTest, SeekIANAOptionExpectSuccess) {
++  EFI_STATUS    Status              = EFI_NOT_FOUND;
++  UINT8         *Option             = NULL;
++  UINT32        SearchPattern       = SEARCH_PATTERN;
++  UINT16        SearchPatternLength = SEARCH_PATTERN_LEN;
++  EFI_DHCP6_IA  Ia                  = { 0 };
++
++  Ia.Descriptor.Type                = DHCPV6_OPTION_IA_NA;
++  Ia.IaAddressCount                 = 1;
++  Ia.IaAddress[0].PreferredLifetime = 0x11111111;
++  Ia.IaAddress[0].ValidLifetime     = 0x22222222;
++  Ia.IaAddress[0].IpAddress         = mAllDhcpRelayAndServersAddress;
++  Packet->Length                    = sizeof (EFI_DHCP6_HEADER);
++
++  Option = Dhcp6SeekStsOptionTest::Packet->Dhcp6.Option;
++
++  Status = Dhcp6AppendOption (
++             Dhcp6SeekStsOptionTest::Packet,
++             &Option,
++             Dhcp6OptStatusCode,
++             SearchPatternLength,
++             (UINT8 *)&SearchPattern
++             );
++  ASSERT_EQ (Status, EFI_SUCCESS);
++
++  Status = Dhcp6AppendIaOption (
++             Dhcp6SeekStsOptionTest::Packet,
++             &Option,
++             &Ia,
++             0x12345678,
++             0x11111111,
++             0x22222222
++             );
++  ASSERT_EQ (Status, EFI_SUCCESS);
++
++  Dhcp6SeekStsOptionTest::Instance.Config->IaDescriptor.Type = DHCPV6_OPTION_IA_NA;
++
++  Option = NULL;
++  Status = Dhcp6SeekStsOption (&(Dhcp6SeekStsOptionTest::Instance), Dhcp6SeekStsOptionTest::Packet, &Option);
++
++  ASSERT_EQ (Status, EFI_SUCCESS);
++}
+diff --git a/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.h b/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.h
+new file mode 100644
+index 0000000000..aed3b89082
+--- /dev/null
++++ b/NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6IoGoogleTest.h
+@@ -0,0 +1,58 @@
++/** @file
++  Acts as header for private functions under test in Dhcp6Io.c
++
++  Copyright (c) Microsoft Corporation
++  SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++
++#ifndef DHCP6_IO_GOOGLE_TEST_H_
++#define DHCP6_IO_GOOGLE_TEST_H_
++
++////////////////////////////////////////////////////////////////////////////////
++// These are the functions that are being unit tested
++////////////////////////////////////////////////////////////////////////////////
++
++#include <Uefi.h>
++
++/**
++  Seeks the Inner Options from a DHCP6 Option
++
++  @param[in]  IaType          The type of the IA option.
++  @param[in]  Option          The pointer to the DHCP6 Option.
++  @param[in]  OptionLen       The length of the DHCP6 Option.
++  @param[out] IaInnerOpt      The pointer to the IA inner option.
++  @param[out] IaInnerLen      The length of the IA inner option.
++
++  @retval EFI_SUCCESS         Seek the inner option successfully.
++  @retval EFI_DEVICE_ERROR    The OptionLen is invalid.
++*/
++EFI_STATUS
++Dhcp6SeekInnerOptionSafe (
++  UINT16  IaType,
++  UINT8   *Option,
++  UINT32  OptionLen,
++  UINT8   **IaInnerOpt,
++  UINT16  *IaInnerLen
++  );
++
++/**
++  Seek StatusCode Option in package. A Status Code option may appear in the
++  options field of a DHCP message and/or in the options field of another option.
++  See details in section 22.13, RFC3315.
++
++  @param[in]       Instance        The pointer to the Dhcp6 instance.
++  @param[in]       Packet          The pointer to reply messages.
++  @param[out]      Option          The pointer to status code option.
++
++  @retval EFI_SUCCESS              Seek status code option successfully.
++  @retval EFI_DEVICE_ERROR         An unexpected error.
++
++**/
++EFI_STATUS
++Dhcp6SeekStsOption (
++  IN     DHCP6_INSTANCE    *Instance,
++  IN     EFI_DHCP6_PACKET  *Packet,
++  OUT    UINT8             **Option
++  );
++
++#endif // DHCP6_IO_GOOGLE_TEST_H
+diff --git a/NetworkPkg/Test/NetworkPkgHostTest.dsc b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+index 20bc90b172..24dee654df 100644
+--- a/NetworkPkg/Test/NetworkPkgHostTest.dsc
++++ b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+@@ -16,6 +16,7 @@
+   SKUID_IDENTIFIER        = DEFAULT
+ 
+ !include UnitTestFrameworkPkg/UnitTestFrameworkPkgHost.dsc.inc
++
+ [Packages]
+   MdePkg/MdePkg.dec
+   UnitTestFrameworkPkg/UnitTestFrameworkPkg.dec
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch

@@ -1,15 +1,17 @@
-From 4241f572eb8dd990edd2b65b8dc47bbf07e53960 Mon Sep 17 00:00:00 2001
+From ad79184c7d5d9f95af057b31036167627e92deba Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 8 Feb 2024 10:35:14 -0500
-Subject: [PATCH 1/3] NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+Subject: [PATCH 01/18] NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230
+ Patch
 
 RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 45: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
-RH-Jira: RHEL-21996
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
 RH-Acked-by: Gerd Hoffmann <None>
-RH-Commit: [1/3] b2f70ced5dc3a59dfe1cf5912a294e323216cf7d
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [1/18] 0c3dc6f4652f517fcfbe21a5faab4d1eea934f58
 
-JIRA: https://issues.redhat.com/browse/RHEL-21996
+JIRA: https://issues.redhat.com/browse/RHEL-21843
 CVE: CVE-2023-45230
 Upstream: Merged
 

SOURCES/edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch

@@ -1,16 +1,17 @@
-From ae83afb620d9ee63528c309c242a97fc2c92dc29 Mon Sep 17 00:00:00 2001
+From c4b0517aaa38857640b4b08b55803ae8a833c1e7 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Thu, 8 Feb 2024 10:35:14 -0500
-Subject: [PATCH 3/3] NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Unit
+Subject: [PATCH 03/18] NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230
- Tests
+ Unit Tests
 
 RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 45: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
-RH-Jira: RHEL-21996
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
 RH-Acked-by: Gerd Hoffmann <None>
-RH-Commit: [3/3] 13b1b35722715ec380605e97a22eb92ca821981b
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [3/18] 0fe85bcd3683b2424bcd91ad1495d1b79eb07405
 
-JIRA: https://issues.redhat.com/browse/RHEL-21996
+JIRA: https://issues.redhat.com/browse/RHEL-21843
 CVE: CVE-2023-45230
 Upstream: Merged
 

SOURCES/edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch

@@ -0,0 +1,78 @@
+From d51f47c8654f44a787d70b675830ebc7a4ea74f6 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 15 Feb 2024 11:51:09 -0500
+Subject: [PATCH 06/18] NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Patch
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [6/18] 58ad218f1216ac1ea34ca01ef8cc21e207e2eaf2
+
+JIRA: https://issues.redhat.com/browse/RHEL-21845
+CVE: CVE-2022-45231
+Upstream: Merged
+
+commit bbfee34f4188ac00371abe1389ae9c9fb989a0cd
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:48 2024 +0800
+
+    NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Patch
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4536
+
+    Bug Overview:
+    PixieFail Bug #3
+    CVE-2023-45231
+    CVSS 6.5 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    CWE-125 Out-of-bounds Read
+
+    Out-of-bounds read when handling a ND Redirect message with truncated
+    options
+
+    Change Overview:
+
+    Adds a check to prevent truncated options from being parsed
+    +  //
+    +  // Cannot process truncated options.
+    +  // Cannot process options with a length of 0 as there is no Type
+    field.
+    +  //
+    +  if (OptionLen < sizeof (IP6_OPTION_HEADER)) {
+    +    return FALSE;
+    +  }
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Ip6Dxe/Ip6Option.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/NetworkPkg/Ip6Dxe/Ip6Option.c b/NetworkPkg/Ip6Dxe/Ip6Option.c
+index 199eea124d..8718d5d875 100644
+--- a/NetworkPkg/Ip6Dxe/Ip6Option.c
++++ b/NetworkPkg/Ip6Dxe/Ip6Option.c
+@@ -137,6 +137,14 @@ Ip6IsNDOptionValid (
+     return FALSE;
+   }
+ 
++  //
++  // Cannot process truncated options.
++  // Cannot process options with a length of 0 as there is no Type field.
++  //
++  if (OptionLen < sizeof (IP6_OPTION_HEADER)) {
++    return FALSE;
++  }
++
+   Offset = 0;
+ 
+   //
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch

@@ -0,0 +1,277 @@
+From a5757e84bd77ad98580c50ba81da2d1daf0f147a Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 14 Feb 2024 12:24:44 -0500
+Subject: [PATCH 07/18] NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Unit
+ Tests
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [7/18] 57d08b408b30ea98de1e5dfd74f8892b66c0867c
+
+JIRA: https://issues.redhat.com/browse/RHEL-21845
+CVE: CVE-2022-45231
+Upstream: Merged
+
+commit 6f77463d72807ec7f4ed6518c3dac29a1040df9f
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:49 2024 +0800
+
+    NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Unit Tests
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4536
+
+    Validates that the patch for...
+
+    Out-of-bounds read when handling a ND Redirect message with truncated
+    options
+
+    .. has been fixed
+
+    Tests the following function to ensure that an out of bounds read does
+    not occur
+    Ip6OptionValidation
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp    |  20 +++
+ .../Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf    |  42 ++++++
+ .../Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp | 129 ++++++++++++++++++
+ NetworkPkg/Test/NetworkPkgHostTest.dsc        |   1 +
+ 4 files changed, 192 insertions(+)
+ create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp
+ create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+ create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
+
+diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp
+new file mode 100644
+index 0000000000..6ebfd5fdfb
+--- /dev/null
++++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp
+@@ -0,0 +1,20 @@
++/** @file
++  Acts as the main entry point for the tests for the Ip6Dxe module.
++
++  Copyright (c) Microsoft Corporation
++  SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++#include <gtest/gtest.h>
++
++////////////////////////////////////////////////////////////////////////////////
++// Run the tests
++////////////////////////////////////////////////////////////////////////////////
++int
++main (
++  int   argc,
++  char  *argv[]
++  )
++{
++  testing::InitGoogleTest (&argc, argv);
++  return RUN_ALL_TESTS ();
++}
+diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+new file mode 100644
+index 0000000000..6e4de0745f
+--- /dev/null
++++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+@@ -0,0 +1,42 @@
++## @file
++# Unit test suite for the Ip6Dxe using Google Test
++#
++# Copyright (c) Microsoft Corporation.<BR>
++# SPDX-License-Identifier: BSD-2-Clause-Patent
++##
++[Defines]
++  INF_VERSION         = 0x00010017
++  BASE_NAME           = Ip6DxeUnitTest
++  FILE_GUID           = 4F05D17D-D3E7-4AAE-820C-576D46D2D34A
++  VERSION_STRING      = 1.0
++  MODULE_TYPE         = HOST_APPLICATION
++#
++# The following information is for reference only and not required by the build tools.
++#
++#  VALID_ARCHITECTURES           = IA32 X64 AARCH64
++#
++[Sources]
++  Ip6DxeGoogleTest.cpp
++  Ip6OptionGoogleTest.cpp
++  ../Ip6Option.c
++
++[Packages]
++  MdePkg/MdePkg.dec
++  MdeModulePkg/MdeModulePkg.dec
++  UnitTestFrameworkPkg/UnitTestFrameworkPkg.dec
++  NetworkPkg/NetworkPkg.dec
++
++[LibraryClasses]
++  GoogleTestLib
++  DebugLib
++  NetLib
++  PcdLib
++
++[Protocols]
++  gEfiDhcp6ServiceBindingProtocolGuid
++
++[Pcd]
++  gEfiNetworkPkgTokenSpaceGuid.PcdDhcp6UidType
++
++[Guids]
++  gZeroGuid
+diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
+new file mode 100644
+index 0000000000..f2cd90e1a9
+--- /dev/null
++++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
+@@ -0,0 +1,129 @@
++/** @file
++  Tests for Ip6Option.c.
++
++  Copyright (c) Microsoft Corporation
++  SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++#include <gtest/gtest.h>
++
++extern "C" {
++  #include <Uefi.h>
++  #include <Library/BaseLib.h>
++  #include <Library/DebugLib.h>
++  #include "../Ip6Impl.h"
++  #include "../Ip6Option.h"
++}
++
++/////////////////////////////////////////////////////////////////////////
++// Defines
++///////////////////////////////////////////////////////////////////////
++
++#define IP6_PREFIX_INFO_OPTION_DATA_LEN    32
++#define OPTION_HEADER_IP6_PREFIX_DATA_LEN  (sizeof (IP6_OPTION_HEADER) + IP6_PREFIX_INFO_OPTION_DATA_LEN)
++
++////////////////////////////////////////////////////////////////////////
++// Symbol Definitions
++// These functions are not directly under test - but required to compile
++////////////////////////////////////////////////////////////////////////
++UINT32  mIp6Id;
++
++EFI_STATUS
++Ip6SendIcmpError (
++  IN IP6_SERVICE       *IpSb,
++  IN NET_BUF           *Packet,
++  IN EFI_IPv6_ADDRESS  *SourceAddress       OPTIONAL,
++  IN EFI_IPv6_ADDRESS  *DestinationAddress,
++  IN UINT8             Type,
++  IN UINT8             Code,
++  IN UINT32            *Pointer             OPTIONAL
++  )
++{
++  // ..
++  return EFI_SUCCESS;
++}
++
++////////////////////////////////////////////////////////////////////////
++// Ip6OptionValidation Tests
++////////////////////////////////////////////////////////////////////////
++
++// Define a fixture for your tests if needed
++class Ip6OptionValidationTest : public ::testing::Test {
++protected:
++  // Add any setup code if needed
++  virtual void
++  SetUp (
++    )
++  {
++    // Initialize any resources or variables
++  }
++
++  // Add any cleanup code if needed
++  virtual void
++  TearDown (
++    )
++  {
++    // Clean up any resources or variables
++  }
++};
++
++// Test Description:
++// Null option should return false
++TEST_F (Ip6OptionValidationTest, NullOptionShouldReturnFalse) {
++  UINT8   *option   = nullptr;
++  UINT16  optionLen = 10; // Provide a suitable length
++
++  EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
++}
++
++// Test Description:
++// Truncated option should return false
++TEST_F (Ip6OptionValidationTest, TruncatedOptionShouldReturnFalse) {
++  UINT8   option[]  = { 0x01 }; // Provide a truncated option
++  UINT16  optionLen = 1;
++
++  EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
++}
++
++// Test Description:
++// Ip6OptionPrefixInfo Option with zero length should return false
++TEST_F (Ip6OptionValidationTest, OptionWithZeroLengthShouldReturnFalse) {
++  IP6_OPTION_HEADER  optionHeader;
++
++  optionHeader.Type   = Ip6OptionPrefixInfo;
++  optionHeader.Length = 0;
++  UINT8  option[sizeof (IP6_OPTION_HEADER)];
++
++  CopyMem (option, &optionHeader, sizeof (IP6_OPTION_HEADER));
++  UINT16  optionLen = sizeof (IP6_OPTION_HEADER);
++
++  EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
++}
++
++// Test Description:
++// Ip6OptionPrefixInfo Option with valid length should return true
++TEST_F (Ip6OptionValidationTest, ValidPrefixInfoOptionShouldReturnTrue) {
++  IP6_OPTION_HEADER  optionHeader;
++
++  optionHeader.Type   = Ip6OptionPrefixInfo;
++  optionHeader.Length = 4; // Length 4 * 8 = 32
++  UINT8  option[OPTION_HEADER_IP6_PREFIX_DATA_LEN];
++
++  CopyMem (option, &optionHeader, sizeof (IP6_OPTION_HEADER));
++
++  EXPECT_TRUE (Ip6IsNDOptionValid (option, IP6_PREFIX_INFO_OPTION_DATA_LEN));
++}
++
++// Test Description:
++// Ip6OptionPrefixInfo Option with invalid length should return false
++TEST_F (Ip6OptionValidationTest, InvalidPrefixInfoOptionLengthShouldReturnFalse) {
++  IP6_OPTION_HEADER  optionHeader;
++
++  optionHeader.Type   = Ip6OptionPrefixInfo;
++  optionHeader.Length = 3; // Length 3 * 8 = 24 (Invalid)
++  UINT8  option[sizeof (IP6_OPTION_HEADER)];
++
++  CopyMem (option, &optionHeader, sizeof (IP6_OPTION_HEADER));
++  UINT16  optionLen = sizeof (IP6_OPTION_HEADER);
++
++  EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
++}
+diff --git a/NetworkPkg/Test/NetworkPkgHostTest.dsc b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+index 24dee654df..7fa7b0f9d5 100644
+--- a/NetworkPkg/Test/NetworkPkgHostTest.dsc
++++ b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+@@ -26,6 +26,7 @@
+   # Build HOST_APPLICATION that tests NetworkPkg
+   #
+   NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
++  NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+ 
+ # Despite these library classes being listed in [LibraryClasses] below, they are not needed for the host-based unit tests.
+ [LibraryClasses]
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch

@@ -0,0 +1,377 @@
+From ff4f1d8227c6c4c89060e24df37defec6d7a07e2 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 15 Feb 2024 11:51:09 -0500
+Subject: [PATCH 08/18] NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45232 Patch
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [8/18] c7bf831954da5b678450f1ba8e34371645959c81
+
+JIRA: https://issues.redhat.com/browse/RHEL-21847
+CVE: CVE-2022-45232
+Upstream: Merged
+
+JIRA: https://issues.redhat.com/browse/RHEL-21849
+CVE: CVE-2022-45233
+Upstream: Merged
+
+commit 4df0229ef992d4f2721a8508787ebf9dc81fbd6e
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:50 2024 +0800
+
+    NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45232 Patch
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4537
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4538
+
+    Bug Details:
+    PixieFail Bug #4
+    CVE-2023-45232
+    CVSS 7.5 : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+    CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
+
+    Infinite loop when parsing unknown options in the Destination Options
+    header
+
+    PixieFail Bug #5
+    CVE-2023-45233
+    CVSS 7.5 : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+    CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
+
+    Infinite loop when parsing a PadN option in the Destination Options
+    header
+
+    Change Overview:
+
+    Most importantly this change corrects the following incorrect math
+    and cleans up the code.
+
+    >   // It is a PadN option
+    >   //
+    > - Offset = (UINT8)(Offset + *(Option + Offset + 1) + 2);
+    > + OptDataLen = ((EFI_IP6_OPTION *)(Option + Offset))->Length;
+    > + Offset     = IP6_NEXT_OPTION_OFFSET (Offset, OptDataLen);
+
+    > case Ip6OptionSkip:
+    > - Offset = (UINT8)(Offset + *(Option + Offset + 1));
+    >   OptDataLen = ((EFI_IP6_OPTION *)(Option + Offset))->Length;
+    >   Offset     = IP6_NEXT_OPTION_OFFSET (Offset, OptDataLen);
+
+    Additionally, this change also corrects incorrect math where the calling
+    function was calculating the HDR EXT optionLen as a uint8 instead of a
+    uint16
+
+    > - OptionLen = (UINT8)((*Option + 1) * 8 - 2);
+    > + OptionLen = IP6_HDR_EXT_LEN (*Option) -
+    IP6_COMBINED_SIZE_OF_NEXT_HDR_AND_LEN;
+
+    Additionally this check adds additional logic to santize the incoming
+    data
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Ip6Dxe/Ip6Nd.h     | 35 ++++++++++++++++
+ NetworkPkg/Ip6Dxe/Ip6Option.c | 76 ++++++++++++++++++++++++++++++-----
+ NetworkPkg/Ip6Dxe/Ip6Option.h | 71 ++++++++++++++++++++++++++++++++
+ 3 files changed, 171 insertions(+), 11 deletions(-)
+
+diff --git a/NetworkPkg/Ip6Dxe/Ip6Nd.h b/NetworkPkg/Ip6Dxe/Ip6Nd.h
+index 860934a167..bf64e9114e 100644
+--- a/NetworkPkg/Ip6Dxe/Ip6Nd.h
++++ b/NetworkPkg/Ip6Dxe/Ip6Nd.h
+@@ -56,13 +56,48 @@ VOID
+   VOID  *Context
+   );
+ 
++//
++// Per RFC8200 Section 4.2
++//
++//   Two of the currently-defined extension headers -- the Hop-by-Hop
++//   Options header and the Destination Options header -- carry a variable
++//   number of type-length-value (TLV) encoded "options", of the following
++//   format:
++//
++//      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - -
++//      |  Option Type  |  Opt Data Len |  Option Data
++//      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- - - - - - - - -
++//
++//      Option Type          8-bit identifier of the type of option.
++//
++//      Opt Data Len         8-bit unsigned integer.  Length of the Option
++//                           Data field of this option, in octets.
++//
++//      Option Data          Variable-length field.  Option-Type-specific
++//                           data.
++//
+ typedef struct _IP6_OPTION_HEADER {
++  ///
++  /// identifier of the type of option.
++  ///
+   UINT8    Type;
++  ///
++  /// Length of the Option Data field of this option, in octets.
++  ///
+   UINT8    Length;
++  ///
++  /// Option-Type-specific data.
++  ///
+ } IP6_OPTION_HEADER;
+ 
+ STATIC_ASSERT (sizeof (IP6_OPTION_HEADER) == 2, "IP6_OPTION_HEADER is expected to be exactly 2 bytes long.");
+ 
++#define IP6_NEXT_OPTION_OFFSET(offset, length)  (offset + sizeof(IP6_OPTION_HEADER) + length)
++STATIC_ASSERT (
++  IP6_NEXT_OPTION_OFFSET (0, 0) == 2,
++  "The next option is minimally the combined size of the option tag and length"
++  );
++
+ typedef struct _IP6_ETHE_ADDR_OPTION {
+   UINT8    Type;
+   UINT8    Length;
+diff --git a/NetworkPkg/Ip6Dxe/Ip6Option.c b/NetworkPkg/Ip6Dxe/Ip6Option.c
+index 8718d5d875..fd97ce116f 100644
+--- a/NetworkPkg/Ip6Dxe/Ip6Option.c
++++ b/NetworkPkg/Ip6Dxe/Ip6Option.c
+@@ -17,7 +17,8 @@
+   @param[in]  IpSb              The IP6 service data.
+   @param[in]  Packet            The to be validated packet.
+   @param[in]  Option            The first byte of the option.
+-  @param[in]  OptionLen         The length of the whole option.
++  @param[in]  OptionLen         The length of all options, expressed in byte length of octets.
++                                Maximum length is 2046 bytes or ((n + 1) * 8) - 2 where n is 255.
+   @param[in]  Pointer           Identifies the octet offset within
+                                 the invoking packet where the error was detected.
+ 
+@@ -31,12 +32,33 @@ Ip6IsOptionValid (
+   IN IP6_SERVICE  *IpSb,
+   IN NET_BUF      *Packet,
+   IN UINT8        *Option,
+-  IN UINT8        OptionLen,
++  IN UINT16       OptionLen,
+   IN UINT32       Pointer
+   )
+ {
+-  UINT8  Offset;
+-  UINT8  OptionType;
++  UINT16  Offset;
++  UINT8   OptionType;
++  UINT8   OptDataLen;
++
++  if (Option == NULL) {
++    ASSERT (Option != NULL);
++    return FALSE;
++  }
++
++  if ((OptionLen <= 0) || (OptionLen > IP6_MAX_EXT_DATA_LENGTH)) {
++    ASSERT (OptionLen > 0 && OptionLen <= IP6_MAX_EXT_DATA_LENGTH);
++    return FALSE;
++  }
++
++  if (Packet == NULL) {
++    ASSERT (Packet != NULL);
++    return FALSE;
++  }
++
++  if (IpSb == NULL) {
++    ASSERT (IpSb != NULL);
++    return FALSE;
++  }
+ 
+   Offset = 0;
+ 
+@@ -54,7 +76,8 @@ Ip6IsOptionValid (
+         //
+         // It is a PadN option
+         //
+-        Offset = (UINT8)(Offset + *(Option + Offset + 1) + 2);
++        OptDataLen = ((IP6_OPTION_HEADER *)(Option + Offset))->Length;
++        Offset     = IP6_NEXT_OPTION_OFFSET (Offset, OptDataLen);
+         break;
+       case Ip6OptionRouterAlert:
+         //
+@@ -69,7 +92,8 @@ Ip6IsOptionValid (
+         //
+         switch (OptionType & Ip6OptionMask) {
+           case Ip6OptionSkip:
+-            Offset = (UINT8)(Offset + *(Option + Offset + 1));
++            OptDataLen = ((IP6_OPTION_HEADER *)(Option + Offset))->Length;
++            Offset     = IP6_NEXT_OPTION_OFFSET (Offset, OptDataLen);
+             break;
+           case Ip6OptionDiscard:
+             return FALSE;
+@@ -308,7 +332,7 @@ Ip6IsExtsValid (
+   UINT32               Pointer;
+   UINT32               Offset;
+   UINT8                *Option;
+-  UINT8                OptionLen;
++  UINT16               OptionLen;
+   BOOLEAN              Flag;
+   UINT8                CountD;
+   UINT8                CountA;
+@@ -385,6 +409,36 @@ Ip6IsExtsValid (
+       // Fall through
+       //
+       case IP6_DESTINATION:
++        //
++        // See https://www.rfc-editor.org/rfc/rfc2460#section-4.2 page 23
++        //
++        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++        // |  Next Header  |  Hdr Ext Len  |                               |
++        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
++        // |                                                               |
++        // .                                                               .
++        // .                            Options                            .
++        // .                                                               .
++        // |                                                               |
++        // +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++        //
++        //
++        //   Next Header    8-bit selector.  Identifies the type of header
++        //                  immediately following the Destination Options
++        //                  header.  Uses the same values as the IPv4
++        //                  Protocol field [RFC-1700 et seq.].
++        //
++        //   Hdr Ext Len    8-bit unsigned integer.  Length of the
++        //                  Destination Options header in 8-octet units, not
++        //                  including the first 8 octets.
++        //
++        //   Options        Variable-length field, of length such that the
++        //                  complete Destination Options header is an
++        //                  integer multiple of 8 octets long.  Contains one
++        //                  or  more TLV-encoded options, as described in
++        //                  section 4.2.
++        //
++
+         if (*NextHeader == IP6_DESTINATION) {
+           CountD++;
+         }
+@@ -398,7 +452,7 @@ Ip6IsExtsValid (
+ 
+         Offset++;
+         Option    = ExtHdrs + Offset;
+-        OptionLen = (UINT8)((*Option + 1) * 8 - 2);
++        OptionLen = IP6_HDR_EXT_LEN (*Option) - sizeof (IP6_EXT_HDR);
+         Option++;
+         Offset++;
+ 
+@@ -430,7 +484,7 @@ Ip6IsExtsValid (
+           //
+           // Ignore the routing header and proceed to process the next header.
+           //
+-          Offset = Offset + (RoutingHead->HeaderLen + 1) * 8;
++          Offset = Offset + IP6_HDR_EXT_LEN (RoutingHead->HeaderLen);
+ 
+           if (UnFragmentLen != NULL) {
+             *UnFragmentLen = Offset;
+@@ -441,7 +495,7 @@ Ip6IsExtsValid (
+           // to the packet's source address, pointing to the unrecognized routing
+           // type.
+           //
+-          Pointer = Offset + 2 + sizeof (EFI_IP6_HEADER);
++          Pointer = Offset + sizeof (IP6_EXT_HDR) + sizeof (EFI_IP6_HEADER);
+           if ((IpSb != NULL) && (Packet != NULL) &&
+               !IP6_IS_MULTICAST (&Packet->Ip.Ip6->DestinationAddress))
+           {
+@@ -527,7 +581,7 @@ Ip6IsExtsValid (
+         //
+         // RFC2402, Payload length is specified in 32-bit words, minus "2".
+         //
+-        OptionLen = (UINT8)((*Option + 2) * 4);
++        OptionLen = ((UINT16)(*Option + 2) * 4);
+         Offset    = Offset + OptionLen;
+         break;
+ 
+diff --git a/NetworkPkg/Ip6Dxe/Ip6Option.h b/NetworkPkg/Ip6Dxe/Ip6Option.h
+index bd8e223c8a..fb07c28f5a 100644
+--- a/NetworkPkg/Ip6Dxe/Ip6Option.h
++++ b/NetworkPkg/Ip6Dxe/Ip6Option.h
+@@ -12,6 +12,77 @@
+ 
+ #define IP6_FRAGMENT_OFFSET_MASK  (~0x3)
+ 
++//
++// For more information see RFC 8200, Section 4.3, 4.4, and 4.6
++//
++//  This example format is from section 4.6
++//  This does not apply to fragment headers
++//
++//     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++//    |  Next Header  |  Hdr Ext Len  |                               |
++//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+                               +
++//    |                                                               |
++//    .                                                               .
++//    .                  Header-Specific Data                         .
++//    .                                                               .
++//    |                                                               |
++//    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
++//
++//      Next Header           8-bit selector.  Identifies the type of
++//                            header immediately following the extension
++//                            header.  Uses the same values as the IPv4
++//                            Protocol field [IANA-PN].
++//
++//      Hdr Ext Len           8-bit unsigned integer.  Length of the
++//                            Destination Options header in 8-octet units,
++//                            not including the first 8 octets.
++
++//
++// These defines apply to the following:
++//   1. Hop by Hop
++//   2. Routing
++//   3. Destination
++//
++typedef struct _IP6_EXT_HDR {
++  ///
++  /// The Next Header field identifies the type of header immediately
++  ///
++  UINT8    NextHeader;
++  ///
++  /// The Hdr Ext Len field specifies the length of the Hop-by-Hop Options
++  ///
++  UINT8    HdrExtLen;
++  ///
++  /// Header-Specific Data
++  ///
++} IP6_EXT_HDR;
++
++STATIC_ASSERT (
++  sizeof (IP6_EXT_HDR) == 2,
++  "The combined size of Next Header and Len is two 8 bit fields"
++  );
++
++//
++// IPv6 extension headers contain an 8-bit length field which describes the size of
++// the header. However, the length field only includes the size of the extension
++// header options, not the size of the first 8 bytes of the header. Therefore, in
++// order to calculate the full size of the extension header, we add 1 (to account
++// for the first 8 bytes omitted by the length field reporting) and then multiply
++// by 8 (since the size is represented in 8-byte units).
++//
++// a is the length field of the extension header (UINT8)
++// The result may be up to 2046 octets (UINT16)
++//
++#define IP6_HDR_EXT_LEN(a)  (((UINT16)((UINT8)(a)) + 1) * 8)
++
++// This is the maxmimum length permissible by a extension header
++// Length is UINT8 of 8 octets not including the first 8 octets
++#define IP6_MAX_EXT_DATA_LENGTH  (IP6_HDR_EXT_LEN (MAX_UINT8) - sizeof(IP6_EXT_HDR))
++STATIC_ASSERT (
++  IP6_MAX_EXT_DATA_LENGTH == 2046,
++  "Maximum data length is ((MAX_UINT8 + 1) * 8) - 2"
++  );
++
+ typedef struct _IP6_FRAGMENT_HEADER {
+   UINT8     NextHeader;
+   UINT8     Reserved;
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch

@@ -0,0 +1,430 @@
+From dab03ad5334af1c93797119f2eeda6ce757461f8 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 14 Feb 2024 20:25:29 -0500
+Subject: [PATCH 09/18] NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45232 Unit
+ Tests
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [9/18] f68829a7f34f5a09a02d28cc5cfd109f90c442da
+
+JIRA: https://issues.redhat.com/browse/RHEL-21847
+CVE: CVE-2022-45232
+Upstream: Merged
+
+commit c9c87f08dd6ace36fa843424522c3558a8374cac
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:51 2024 +0800
+
+    NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45232 Unit Tests
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4537
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4538
+
+    Unit tests to confirm that..
+    Infinite loop when parsing unknown options in the Destination Options
+    header
+
+    and
+
+    Infinite loop when parsing a PadN option in the Destination Options
+    header
+
+    ... have been patched
+
+    This patch tests the following functions:
+    Ip6IsOptionValid
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf    |  10 +-
+ .../Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp | 278 ++++++++++++++++++
+ .../Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.h   |  40 +++
+ 3 files changed, 324 insertions(+), 4 deletions(-)
+ create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.h
+
+diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+index 6e4de0745f..ba29dbabad 100644
+--- a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
++++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+@@ -1,13 +1,13 @@
+ ## @file
+-# Unit test suite for the Ip6Dxe using Google Test
++# Unit test suite for the Ip6DxeGoogleTest using Google Test
+ #
+ # Copyright (c) Microsoft Corporation.<BR>
+ # SPDX-License-Identifier: BSD-2-Clause-Patent
+ ##
+ [Defines]
+   INF_VERSION         = 0x00010017
+-  BASE_NAME           = Ip6DxeUnitTest
+-  FILE_GUID           = 4F05D17D-D3E7-4AAE-820C-576D46D2D34A
++  BASE_NAME           = Ip6DxeGoogleTest
++  FILE_GUID           = AE39981C-B7FE-41A8-A9C2-F41910477CA3
+   VERSION_STRING      = 1.0
+   MODULE_TYPE         = HOST_APPLICATION
+ #
+@@ -16,9 +16,11 @@
+ #  VALID_ARCHITECTURES           = IA32 X64 AARCH64
+ #
+ [Sources]
++  ../Ip6Option.c
++  Ip6OptionGoogleTest.h
+   Ip6DxeGoogleTest.cpp
+   Ip6OptionGoogleTest.cpp
+-  ../Ip6Option.c
++  Ip6OptionGoogleTest.h
+ 
+ [Packages]
+   MdePkg/MdePkg.dec
+diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
+index f2cd90e1a9..29f8a4a96e 100644
+--- a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
++++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
+@@ -12,6 +12,7 @@ extern "C" {
+   #include <Library/DebugLib.h>
+   #include "../Ip6Impl.h"
+   #include "../Ip6Option.h"
++  #include "Ip6OptionGoogleTest.h"
+ }
+ 
+ /////////////////////////////////////////////////////////////////////////
+@@ -127,3 +128,280 @@ TEST_F (Ip6OptionValidationTest, InvalidPrefixInfoOptionLengthShouldReturnFalse)
+ 
+   EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
+ }
++
++////////////////////////////////////////////////////////////////////////
++// Ip6IsOptionValid Tests
++////////////////////////////////////////////////////////////////////////
++
++// Define a fixture for your tests if needed
++class Ip6IsOptionValidTest : public ::testing::Test {
++protected:
++  // Add any setup code if needed
++  virtual void
++  SetUp (
++    )
++  {
++    // Initialize any resources or variables
++  }
++
++  // Add any cleanup code if needed
++  virtual void
++  TearDown (
++    )
++  {
++    // Clean up any resources or variables
++  }
++};
++
++// Test Description
++// Verify that a NULL option is Invalid
++TEST_F (Ip6IsOptionValidTest, NullOptionShouldReturnTrue) {
++  NET_BUF  Packet = { 0 };
++  // we need to define enough of the packet to make the function work
++  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
++  IP6_SERVICE  *IpSb = NULL;
++
++  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IP6_HEADER    Ip6Header          = { 0 };
++
++  Ip6Header.SourceAddress      = SourceAddress;
++  Ip6Header.DestinationAddress = DestinationAddress;
++  Packet.Ip.Ip6                = &Ip6Header;
++
++  EXPECT_FALSE (Ip6IsOptionValid (IpSb, &Packet, NULL, 0, 0));
++}
++
++// Test Description
++// Verify that an unknown option with a length of 0 and type of <unknown> does not cause an infinite loop
++TEST_F (Ip6IsOptionValidTest, VerifyNoInfiniteLoopOnUnknownOptionLength0) {
++  NET_BUF  Packet = { 0 };
++  // we need to define enough of the packet to make the function work
++  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
++  UINT32  DeadCode = 0xDeadC0de;
++  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
++  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
++
++  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IP6_HEADER    Ip6Header          = { 0 };
++
++  Ip6Header.SourceAddress      = SourceAddress;
++  Ip6Header.DestinationAddress = DestinationAddress;
++  Packet.Ip.Ip6                = &Ip6Header;
++
++  IP6_OPTION_HEADER  optionHeader;
++
++  optionHeader.Type   = 23;   // Unknown Option
++  optionHeader.Length = 0;    // This will cause an infinite loop if the function is not working correctly
++
++  // This should be a valid option even though the length is 0
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
++}
++
++// Test Description
++// Verify that an unknown option with a length of 1 and type of <unknown> does not cause an infinite loop
++TEST_F (Ip6IsOptionValidTest, VerifyNoInfiniteLoopOnUnknownOptionLength1) {
++  NET_BUF  Packet = { 0 };
++  // we need to define enough of the packet to make the function work
++  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
++  UINT32  DeadCode = 0xDeadC0de;
++  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
++  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
++
++  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IP6_HEADER    Ip6Header          = { 0 };
++
++  Ip6Header.SourceAddress      = SourceAddress;
++  Ip6Header.DestinationAddress = DestinationAddress;
++  Packet.Ip.Ip6                = &Ip6Header;
++
++  IP6_OPTION_HEADER  optionHeader;
++
++  optionHeader.Type   = 23;   // Unknown Option
++  optionHeader.Length = 1;    // This will cause an infinite loop if the function is not working correctly
++
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
++}
++
++// Test Description
++// Verify that an unknown option with a length of 2 and type of <unknown> does not cause an infinite loop
++TEST_F (Ip6IsOptionValidTest, VerifyIpSkipUnknownOption) {
++  NET_BUF  Packet = { 0 };
++  // we need to define enough of the packet to make the function work
++  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
++  UINT32  DeadCode = 0xDeadC0de;
++  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
++  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
++
++  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IP6_HEADER    Ip6Header          = { 0 };
++
++  Ip6Header.SourceAddress      = SourceAddress;
++  Ip6Header.DestinationAddress = DestinationAddress;
++  Packet.Ip.Ip6                = &Ip6Header;
++
++  IP6_OPTION_HEADER  optionHeader;
++
++  optionHeader.Type   = 23;   // Unknown Option
++  optionHeader.Length = 2;    // Valid length for an unknown option
++
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
++}
++
++// Test Description
++// Verify that Ip6OptionPad1 is valid with a length of 0
++TEST_F (Ip6IsOptionValidTest, VerifyIp6OptionPad1) {
++  NET_BUF  Packet = { 0 };
++  // we need to define enough of the packet to make the function work
++  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
++  UINT32  DeadCode = 0xDeadC0de;
++  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
++  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
++
++  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IP6_HEADER    Ip6Header          = { 0 };
++
++  Ip6Header.SourceAddress      = SourceAddress;
++  Ip6Header.DestinationAddress = DestinationAddress;
++  Packet.Ip.Ip6                = &Ip6Header;
++
++  IP6_OPTION_HEADER  optionHeader;
++
++  optionHeader.Type   = Ip6OptionPad1;
++  optionHeader.Length = 0;
++
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
++}
++
++// Test Description
++// Verify that Ip6OptionPadN doesn't overflow with various lengths
++TEST_F (Ip6IsOptionValidTest, VerifyIp6OptionPadN) {
++  NET_BUF  Packet = { 0 };
++  // we need to define enough of the packet to make the function work
++  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
++  UINT32  DeadCode = 0xDeadC0de;
++  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
++  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
++
++  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IP6_HEADER    Ip6Header          = { 0 };
++
++  Ip6Header.SourceAddress      = SourceAddress;
++  Ip6Header.DestinationAddress = DestinationAddress;
++  Packet.Ip.Ip6                = &Ip6Header;
++
++  IP6_OPTION_HEADER  optionHeader;
++
++  optionHeader.Type   = Ip6OptionPadN;
++  optionHeader.Length = 0xFF;
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
++
++  optionHeader.Length = 0xFE;
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
++
++  optionHeader.Length = 0xFD;
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
++
++  optionHeader.Length = 0xFC;
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
++}
++
++// Test Description
++// Verify an unknown option doesn't cause an infinite loop with various lengths
++TEST_F (Ip6IsOptionValidTest, VerifyNoInfiniteLoopOnUnknownOptionLengthAttemptOverflow) {
++  NET_BUF  Packet = { 0 };
++  // we need to define enough of the packet to make the function work
++  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
++  UINT32  DeadCode = 0xDeadC0de;
++  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
++  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
++
++  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IP6_HEADER    Ip6Header          = { 0 };
++
++  Ip6Header.SourceAddress      = SourceAddress;
++  Ip6Header.DestinationAddress = DestinationAddress;
++  Packet.Ip.Ip6                = &Ip6Header;
++
++  IP6_OPTION_HEADER  optionHeader;
++
++  optionHeader.Type   = 23;   // Unknown Option
++  optionHeader.Length = 0xFF;
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
++
++  optionHeader.Length = 0xFE;
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
++
++  optionHeader.Length = 0xFD;
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
++
++  optionHeader.Length = 0xFC;
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, (UINT8 *)&optionHeader, sizeof (optionHeader), 0));
++}
++
++// Test Description
++// Verify that the function supports multiple options
++TEST_F (Ip6IsOptionValidTest, MultiOptionSupport) {
++  UINT16   HdrLen;
++  NET_BUF  Packet = { 0 };
++  // we need to define enough of the packet to make the function work
++  // The function being tested will pass IpSb to Ip6SendIcmpError which is defined above
++  UINT32  DeadCode = 0xDeadC0de;
++  // Don't actually use this pointer, just pass it to the function, nothing will be done with it
++  IP6_SERVICE  *IpSb = (IP6_SERVICE *)&DeadCode;
++
++  EFI_IPv6_ADDRESS  SourceAddress      = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IPv6_ADDRESS  DestinationAddress = { 0x20, 0x01, 0x0d, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0x00, 0x00, 0x42, 0x83, 0x29 };
++  EFI_IP6_HEADER    Ip6Header          = { 0 };
++
++  Ip6Header.SourceAddress      = SourceAddress;
++  Ip6Header.DestinationAddress = DestinationAddress;
++  Packet.Ip.Ip6                = &Ip6Header;
++
++  UINT8              ExtHdr[1024] = { 0 };
++  UINT8              *Cursor      = ExtHdr;
++  IP6_OPTION_HEADER  *Option      = (IP6_OPTION_HEADER *)ExtHdr;
++
++  // Let's start chaining options
++
++  Option->Type   = 23;   // Unknown Option
++  Option->Length = 0xFC;
++
++  Cursor += sizeof (IP6_OPTION_HEADER) + 0xFC;
++
++  Option       = (IP6_OPTION_HEADER *)Cursor;
++  Option->Type = Ip6OptionPad1;
++
++  Cursor += sizeof (1);
++
++  // Type and length aren't processed, instead it just moves the pointer forward by 4 bytes
++  Option         = (IP6_OPTION_HEADER *)Cursor;
++  Option->Type   = Ip6OptionRouterAlert;
++  Option->Length = 4;
++
++  Cursor += sizeof (IP6_OPTION_HEADER) + 4;
++
++  Option         = (IP6_OPTION_HEADER *)Cursor;
++  Option->Type   = Ip6OptionPadN;
++  Option->Length = 0xFC;
++
++  Cursor += sizeof (IP6_OPTION_HEADER) + 0xFC;
++
++  Option         = (IP6_OPTION_HEADER *)Cursor;
++  Option->Type   = Ip6OptionRouterAlert;
++  Option->Length = 4;
++
++  Cursor += sizeof (IP6_OPTION_HEADER) + 4;
++
++  // Total 524
++
++  HdrLen = (UINT16)(Cursor - ExtHdr);
++
++  EXPECT_TRUE (Ip6IsOptionValid (IpSb, &Packet, ExtHdr, HdrLen, 0));
++}
+diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.h b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.h
+new file mode 100644
+index 0000000000..0509b6ae30
+--- /dev/null
++++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.h
+@@ -0,0 +1,40 @@
++/** @file
++  Exposes the functions needed to test the Ip6Option module.
++
++  Copyright (c) Microsoft Corporation
++  SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++
++#ifndef IP6_OPTION_HEADER_GOOGLE_TEST_H_
++#define IP6_OPTION_HEADER_GOOGLE_TEST_H_
++
++#include <Uefi.h>
++#include "../Ip6Impl.h"
++
++/**
++  Validate the IP6 option format for both the packets we received
++  and that we will transmit. It will compute the ICMPv6 error message fields
++  if the option is malformatted.
++
++  @param[in]  IpSb              The IP6 service data.
++  @param[in]  Packet            The to be validated packet.
++  @param[in]  Option            The first byte of the option.
++  @param[in]  OptionLen         The length of the whole option.
++  @param[in]  Pointer           Identifies the octet offset within
++                                the invoking packet where the error was detected.
++
++
++  @retval TRUE     The option is properly formatted.
++  @retval FALSE    The option is malformatted.
++
++**/
++BOOLEAN
++Ip6IsOptionValid (
++  IN IP6_SERVICE  *IpSb,
++  IN NET_BUF      *Packet,
++  IN UINT8        *Option,
++  IN UINT16       OptionLen,
++  IN UINT32       Pointer
++  );
++
++#endif // __IP6_OPTION_HEADER_GOOGLE_TEST_H__
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch

@@ -0,0 +1,74 @@
+From 5e93f6c09a57dd69f1b05654455452c4a0154a79 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 13 Jun 2024 18:35:46 -0400
+Subject: [PATCH 3/8] NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow in
+ iPXE environment
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 75: NetworkPkg: SECURITY PATCH CVE-2023-45236 and CVE-2023-45237
+RH-Jira: RHEL-40270 RHEL-40272
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [3/8] 9307e82e90d6f526d303607255a4c469ebe574d4
+
+JIRA: https://issues.redhat.com/browse/RHEL-40272
+Upstream: Merged
+CVE: CVE-2023-45236
+
+commit ced13b93afea87a8a1fe6ddbb67240a84cb2e3d3
+Author: Sam <Sam_Tsai@wiwynn.com>
+Date:   Wed May 29 07:46:03 2024 +0800
+
+    NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow in iPXE environment
+
+    This bug fix is based on the following commit "NetworkPkg TcpDxe: SECURITY PATCH"
+    REF: 1904a64
+
+    Issue Description:
+    An "Invalid handle" error was detected during runtime when attempting to destroy a child instance of the hashing protocol. The problematic code segment was:
+
+    NetworkPkg\TcpDxe\TcpDriver.c
+    Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, ​&mHash2ServiceHandle);
+
+    Root Cause Analysis:
+    The root cause of the error was the passing of an incorrect parameter type, a pointer to an EFI_HANDLE instead of an EFI_HANDLE itself, to the DestroyChild function. This mismatch resulted in the function receiving an invalid handle.
+
+    Implemented Solution:
+    To resolve this issue, the function call was corrected to pass mHash2ServiceHandle directly:
+
+    NetworkPkg\TcpDxe\TcpDriver.c
+    Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, mHash2ServiceHandle);
+
+    This modification ensures the correct handle type is used, effectively rectifying the "Invalid handle" error.
+
+    Verification:
+    Testing has been conducted, confirming the efficacy of the fix. Additionally, the BIOS can boot into the OS in an iPXE environment.
+
+    Cc: Doug Flick [MSFT] <doug.edk2@gmail.com>
+
+    Signed-off-by: Sam Tsai [Wiwynn] <sam_tsai@wiwynn.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/TcpDxe/TcpDriver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/NetworkPkg/TcpDxe/TcpDriver.c b/NetworkPkg/TcpDxe/TcpDriver.c
+index 40bba4080c..c6e7c0df54 100644
+--- a/NetworkPkg/TcpDxe/TcpDriver.c
++++ b/NetworkPkg/TcpDxe/TcpDriver.c
+@@ -509,7 +509,7 @@ TcpDestroyService (
+     //
+     // Destroy the instance of the hashing protocol for this controller.
+     //
+-    Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, &mHash2ServiceHandle);
++    Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, mHash2ServiceHandle);
+     if (EFI_ERROR (Status)) {
+       return EFI_UNSUPPORTED;
+     }
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch

@@ -0,0 +1,841 @@
+From 6f0cf9f14b1abefa62416c1611f01d6fb3353c44 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 11 Jun 2024 15:20:29 -0400
+Subject: [PATCH 2/8] NetworkPkg TcpDxe: SECURITY PATCH CVE-2023-45236
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 75: NetworkPkg: SECURITY PATCH CVE-2023-45236 and CVE-2023-45237
+RH-Jira: RHEL-40270 RHEL-40272
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [2/8] 18e88b5def6b058ecd4ffa565ef6f3bafe6f03ad
+
+JIRA: https://issues.redhat.com/browse/RHEL-40272
+Upstream: Merged
+CVE: CVE-2023-45236
+
+commit 1904a64bcc18199738e5be183d28887ac5d837d7
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Wed May 8 22:56:29 2024 -0700
+
+    NetworkPkg TcpDxe: SECURITY PATCH CVE-2023-45236
+
+    REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4541
+    REF: https://www.rfc-editor.org/rfc/rfc1948.txt
+    REF: https://www.rfc-editor.org/rfc/rfc6528.txt
+    REF: https://www.rfc-editor.org/rfc/rfc9293.txt
+
+    Bug Overview:
+    PixieFail Bug #8
+    CVE-2023-45236
+    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
+    CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
+
+    Updates TCP ISN generation to use a cryptographic hash of the
+    connection's identifying parameters and a secret key.
+    This prevents an attacker from guessing the ISN used for some other
+    connection.
+
+    This is follows the guidance in RFC 1948, RFC 6528, and RFC 9293.
+
+    RFC: 9293 Section 3.4.1.  Initial Sequence Number Selection
+
+       A TCP implementation MUST use the above type of "clock" for clock-
+       driven selection of initial sequence numbers (MUST-8), and SHOULD
+       generate its initial sequence numbers with the expression:
+
+       ISN = M + F(localip, localport, remoteip, remoteport, secretkey)
+
+       where M is the 4 microsecond timer, and F() is a pseudorandom
+       function (PRF) of the connection's identifying parameters ("localip,
+       localport, remoteip, remoteport") and a secret key ("secretkey")
+       (SHLD-1).  F() MUST NOT be computable from the outside (MUST-9), or
+       an attacker could still guess at sequence numbers from the ISN used
+       for some other connection.  The PRF could be implemented as a
+       cryptographic hash of the concatenation of the TCP connection
+       parameters and some secret data.  For discussion of the selection of
+       a specific hash algorithm and management of the secret key data,
+       please see Section 3 of [42].
+
+       For each connection there is a send sequence number and a receive
+       sequence number.  The initial send sequence number (ISS) is chosen by
+       the data sending TCP peer, and the initial receive sequence number
+       (IRS) is learned during the connection-establishing procedure.
+
+       For a connection to be established or initialized, the two TCP peers
+       must synchronize on each other's initial sequence numbers.  This is
+       done in an exchange of connection-establishing segments carrying a
+       control bit called "SYN" (for synchronize) and the initial sequence
+       numbers.  As a shorthand, segments carrying the SYN bit are also
+       called "SYNs".  Hence, the solution requires a suitable mechanism for
+       picking an initial sequence number and a slightly involved handshake
+       to exchange the ISNs.
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/SecurityFixes.yaml |  22 +++
+ NetworkPkg/TcpDxe/TcpDriver.c |  92 ++++++++++++-
+ NetworkPkg/TcpDxe/TcpDxe.inf  |   8 +-
+ NetworkPkg/TcpDxe/TcpFunc.h   |  23 ++--
+ NetworkPkg/TcpDxe/TcpInput.c  |  13 +-
+ NetworkPkg/TcpDxe/TcpMain.h   |  59 ++++++--
+ NetworkPkg/TcpDxe/TcpMisc.c   | 244 ++++++++++++++++++++++++++++++++--
+ NetworkPkg/TcpDxe/TcpTimer.c  |   3 +-
+ 8 files changed, 415 insertions(+), 49 deletions(-)
+
+diff --git a/NetworkPkg/SecurityFixes.yaml b/NetworkPkg/SecurityFixes.yaml
+index 20a4555019..4305328425 100644
+--- a/NetworkPkg/SecurityFixes.yaml
++++ b/NetworkPkg/SecurityFixes.yaml
+@@ -122,6 +122,28 @@ CVE_2023_45235:
+     - http://www.openwall.com/lists/oss-security/2024/01/16/2
+     - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
+     - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
++CVE_2023_45236:
++  commit_titles:
++    - "NetworkPkg: TcpDxe: SECURITY PATCH CVE-2023-45236 Patch"
++  cve: CVE-2023-45236
++  date_reported: 2023-08-28 13:56 UTC
++  description: "Bug 08 - edk2/NetworkPkg: Predictable TCP Initial Sequence Numbers"
++  note:
++  files_impacted:
++    - NetworkPkg/Include/Library/NetLib.h
++    - NetworkPkg/TcpDxe/TcpDriver.c
++    - NetworkPkg/TcpDxe/TcpDxe.inf
++    - NetworkPkg/TcpDxe/TcpFunc.h
++    - NetworkPkg/TcpDxe/TcpInput.c
++    - NetworkPkg/TcpDxe/TcpMain.h
++    - NetworkPkg/TcpDxe/TcpMisc.c
++    - NetworkPkg/TcpDxe/TcpTimer.c
++  links:
++    - https://bugzilla.tianocore.org/show_bug.cgi?id=4541
++    - https://nvd.nist.gov/vuln/detail/CVE-2023-45236
++    - http://www.openwall.com/lists/oss-security/2024/01/16/2
++    - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
++    - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
+ CVE_2023_45237:
+   commit_titles:
+     - "NetworkPkg:: SECURITY PATCH CVE 2023-45237"
+diff --git a/NetworkPkg/TcpDxe/TcpDriver.c b/NetworkPkg/TcpDxe/TcpDriver.c
+index 8fe6badd68..40bba4080c 100644
+--- a/NetworkPkg/TcpDxe/TcpDriver.c
++++ b/NetworkPkg/TcpDxe/TcpDriver.c
+@@ -83,6 +83,12 @@ EFI_SERVICE_BINDING_PROTOCOL  gTcpServiceBinding = {
+   TcpServiceBindingDestroyChild
+ };
+ 
++//
++// This is the handle for the Hash2ServiceBinding Protocol instance this driver produces
++// if the platform does not provide one.
++//
++EFI_HANDLE  mHash2ServiceHandle = NULL;
++
+ /**
+   Create and start the heartbeat timer for the TCP driver.
+ 
+@@ -165,6 +171,23 @@ TcpDriverEntryPoint (
+   EFI_STATUS  Status;
+   UINT32      Random;
+ 
++  //
++  // Initialize the Secret used for hashing TCP sequence numbers
++  //
++  // Normally this should be regenerated periodically, but since
++  // this is only used for UEFI networking and not a general purpose
++  // operating system, it is not necessary to regenerate it.
++  //
++  Status = PseudoRandomU32 (&mTcpGlobalSecret);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
++    return Status;
++  }
++
++  //
++  // Get a random number used to generate a random port number
++  // Intentionally not linking this to mTcpGlobalSecret to avoid leaking information about the secret
++  //
+   Status = PseudoRandomU32 (&Random);
+   if (EFI_ERROR (Status)) {
+     DEBUG ((DEBUG_ERROR, "%a Failed to generate random number: %r\n", __func__, Status));
+@@ -207,9 +230,8 @@ TcpDriverEntryPoint (
+   }
+ 
+   //
+-  // Initialize ISS and random port.
++  // Initialize the random port.
+   //
+-  mTcpGlobalIss   = Random % mTcpGlobalIss;
+   mTcp4RandomPort = (UINT16)(TCP_PORT_KNOWN + (Random % TCP_PORT_KNOWN));
+   mTcp6RandomPort = mTcp4RandomPort;
+ 
+@@ -224,6 +246,8 @@ TcpDriverEntryPoint (
+   @param[in]  IpVersion          IP_VERSION_4 or IP_VERSION_6.
+ 
+   @retval EFI_OUT_OF_RESOURCES   Failed to allocate some resources.
++  @retval EFI_UNSUPPORTED        Service Binding Protocols are unavailable.
++  @retval EFI_ALREADY_STARTED    The TCP driver is already started on the controller.
+   @retval EFI_SUCCESS            A new IP6 service binding private was created.
+ 
+ **/
+@@ -234,11 +258,13 @@ TcpCreateService (
+   IN UINT8       IpVersion
+   )
+ {
+-  EFI_STATUS        Status;
+-  EFI_GUID          *IpServiceBindingGuid;
+-  EFI_GUID          *TcpServiceBindingGuid;
+-  TCP_SERVICE_DATA  *TcpServiceData;
+-  IP_IO_OPEN_DATA   OpenData;
++  EFI_STATUS                    Status;
++  EFI_GUID                      *IpServiceBindingGuid;
++  EFI_GUID                      *TcpServiceBindingGuid;
++  TCP_SERVICE_DATA              *TcpServiceData;
++  IP_IO_OPEN_DATA               OpenData;
++  EFI_SERVICE_BINDING_PROTOCOL  *Hash2ServiceBinding;
++  EFI_HASH2_PROTOCOL            *Hash2Protocol;
+ 
+   if (IpVersion == IP_VERSION_4) {
+     IpServiceBindingGuid  = &gEfiIp4ServiceBindingProtocolGuid;
+@@ -272,6 +298,33 @@ TcpCreateService (
+     return EFI_UNSUPPORTED;
+   }
+ 
++  Status = gBS->LocateProtocol (&gEfiHash2ProtocolGuid, NULL, (VOID **)&Hash2Protocol);
++  if (EFI_ERROR (Status)) {
++    //
++    // If we can't find the Hashing protocol, then we need to create one.
++    //
++
++    //
++    // Platform is expected to publish the hash service binding protocol to support TCP.
++    //
++    Status = gBS->LocateProtocol (
++                    &gEfiHash2ServiceBindingProtocolGuid,
++                    NULL,
++                    (VOID **)&Hash2ServiceBinding
++                    );
++    if (EFI_ERROR (Status) || (Hash2ServiceBinding == NULL) || (Hash2ServiceBinding->CreateChild == NULL)) {
++      return EFI_UNSUPPORTED;
++    }
++
++    //
++    // Create an instance of the hash protocol for this controller.
++    //
++    Status = Hash2ServiceBinding->CreateChild (Hash2ServiceBinding, &mHash2ServiceHandle);
++    if (EFI_ERROR (Status)) {
++      return EFI_UNSUPPORTED;
++    }
++  }
++
+   //
+   // Create the TCP service data.
+   //
+@@ -423,6 +476,7 @@ TcpDestroyService (
+   EFI_STATUS                               Status;
+   LIST_ENTRY                               *List;
+   TCP_DESTROY_CHILD_IN_HANDLE_BUF_CONTEXT  Context;
++  EFI_SERVICE_BINDING_PROTOCOL             *Hash2ServiceBinding;
+ 
+   ASSERT ((IpVersion == IP_VERSION_4) || (IpVersion == IP_VERSION_6));
+ 
+@@ -439,6 +493,30 @@ TcpDestroyService (
+     return EFI_SUCCESS;
+   }
+ 
++  //
++  // Destroy the Hash2ServiceBinding instance if it is created by Tcp driver.
++  //
++  if (mHash2ServiceHandle != NULL) {
++    Status = gBS->LocateProtocol (
++                    &gEfiHash2ServiceBindingProtocolGuid,
++                    NULL,
++                    (VOID **)&Hash2ServiceBinding
++                    );
++    if (EFI_ERROR (Status) || (Hash2ServiceBinding == NULL) || (Hash2ServiceBinding->DestroyChild == NULL)) {
++      return EFI_UNSUPPORTED;
++    }
++
++    //
++    // Destroy the instance of the hashing protocol for this controller.
++    //
++    Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, &mHash2ServiceHandle);
++    if (EFI_ERROR (Status)) {
++      return EFI_UNSUPPORTED;
++    }
++
++    mHash2ServiceHandle = NULL;
++  }
++
+   Status = gBS->OpenProtocol (
+                   NicHandle,
+                   ServiceBindingGuid,
+diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf b/NetworkPkg/TcpDxe/TcpDxe.inf
+index cf5423f4c5..76de4cf9ec 100644
+--- a/NetworkPkg/TcpDxe/TcpDxe.inf
++++ b/NetworkPkg/TcpDxe/TcpDxe.inf
+@@ -6,6 +6,7 @@
+ #  stack has been loaded in system. This driver supports both IPv4 and IPv6 network stack.
+ #
+ #  Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
++#  Copyright (c) Microsoft Corporation
+ #
+ #  SPDX-License-Identifier: BSD-2-Clause-Patent
+ #
+@@ -68,7 +69,6 @@
+   NetLib
+   IpIoLib
+ 
+-
+ [Protocols]
+   ## SOMETIMES_CONSUMES
+   ## SOMETIMES_PRODUCES
+@@ -81,6 +81,12 @@
+   gEfiIp6ServiceBindingProtocolGuid             ## TO_START
+   gEfiTcp6ProtocolGuid                          ## BY_START
+   gEfiTcp6ServiceBindingProtocolGuid            ## BY_START
++  gEfiHash2ProtocolGuid                         ## BY_START
++  gEfiHash2ServiceBindingProtocolGuid           ## BY_START
++
++[Guids]
++  gEfiHashAlgorithmMD5Guid                      ## CONSUMES
++  gEfiHashAlgorithmSha256Guid                   ## CONSUMES
+ 
+ [Depex]
+   gEfiHash2ServiceBindingProtocolGuid
+diff --git a/NetworkPkg/TcpDxe/TcpFunc.h b/NetworkPkg/TcpDxe/TcpFunc.h
+index a7af01fff2..c707bee3e5 100644
+--- a/NetworkPkg/TcpDxe/TcpFunc.h
++++ b/NetworkPkg/TcpDxe/TcpFunc.h
+@@ -2,7 +2,7 @@
+   Declaration of external functions shared in TCP driver.
+ 
+   Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
+-
++  Copyright (c) Microsoft Corporation
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+@@ -36,8 +36,11 @@ VOID
+ 
+   @param[in, out]  Tcb               Pointer to the TCP_CB of this TCP instance.
+ 
++  @retval EFI_SUCCESS             The operation completed successfully
++  @retval others                  The underlying functions failed and could not complete the operation
++
+ **/
+-VOID
++EFI_STATUS
+ TcpInitTcbLocal (
+   IN OUT TCP_CB  *Tcb
+   );
+@@ -128,17 +131,6 @@ TcpCloneTcb (
+   IN TCP_CB  *Tcb
+   );
+ 
+-/**
+-  Compute an ISS to be used by a new connection.
+-
+-  @return The result ISS.
+-
+-**/
+-TCP_SEQNO
+-TcpGetIss (
+-  VOID
+-  );
+-
+ /**
+   Get the local mss.
+ 
+@@ -202,8 +194,11 @@ TcpFormatNetbuf (
+   @param[in, out]  Tcb          Pointer to the TCP_CB that wants to initiate a
+                                 connection.
+ 
++  @retval EFI_SUCCESS             The operation completed successfully
++  @retval others                  The underlying functions failed and could not complete the operation
++
+ **/
+-VOID
++EFI_STATUS
+ TcpOnAppConnect (
+   IN OUT TCP_CB  *Tcb
+   );
+diff --git a/NetworkPkg/TcpDxe/TcpInput.c b/NetworkPkg/TcpDxe/TcpInput.c
+index 7b329be64d..86dd7c4907 100644
+--- a/NetworkPkg/TcpDxe/TcpInput.c
++++ b/NetworkPkg/TcpDxe/TcpInput.c
+@@ -724,6 +724,7 @@ TcpInput (
+   TCP_SEQNO   Urg;
+   UINT16      Checksum;
+   INT32       Usable;
++  EFI_STATUS  Status;
+ 
+   ASSERT ((Version == IP_VERSION_4) || (Version == IP_VERSION_6));
+ 
+@@ -872,7 +873,17 @@ TcpInput (
+       Tcb->LocalEnd.Port  = Head->DstPort;
+       Tcb->RemoteEnd.Port = Head->SrcPort;
+ 
+-      TcpInitTcbLocal (Tcb);
++      Status = TcpInitTcbLocal (Tcb);
++      if (EFI_ERROR (Status)) {
++        DEBUG (
++          (DEBUG_ERROR,
++           "TcpInput: discard a segment because failed to init local end for TCB %p\n",
++           Tcb)
++          );
++
++        goto DISCARD;
++      }
++
+       TcpInitTcbPeer (Tcb, Seg, &Option);
+ 
+       TcpSetState (Tcb, TCP_SYN_RCVD);
+diff --git a/NetworkPkg/TcpDxe/TcpMain.h b/NetworkPkg/TcpDxe/TcpMain.h
+index c0c9b7f46e..4d5566ab93 100644
+--- a/NetworkPkg/TcpDxe/TcpMain.h
++++ b/NetworkPkg/TcpDxe/TcpMain.h
+@@ -3,7 +3,7 @@
+   It is the common head file for all Tcp*.c in TCP driver.
+ 
+   Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
+-
++  Copyright (c) Microsoft Corporation
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+@@ -13,6 +13,7 @@
+ 
+ #include <Protocol/ServiceBinding.h>
+ #include <Protocol/DriverBinding.h>
++#include <Protocol/Hash2.h>
+ #include <Library/IpIoLib.h>
+ #include <Library/DevicePathLib.h>
+ #include <Library/PrintLib.h>
+@@ -31,7 +32,7 @@ extern EFI_UNICODE_STRING_TABLE      *gTcpControllerNameTable;
+ 
+ extern LIST_ENTRY  mTcpRunQue;
+ extern LIST_ENTRY  mTcpListenQue;
+-extern TCP_SEQNO   mTcpGlobalIss;
++extern TCP_SEQNO   mTcpGlobalSecret;
+ extern UINT32      mTcpTick;
+ 
+ ///
+@@ -45,14 +46,6 @@ extern UINT32      mTcpTick;
+ 
+ #define TCP_EXPIRE_TIME  65535
+ 
+-///
+-/// The implementation selects the initial send sequence number and the unit to
+-/// be added when it is increased.
+-///
+-#define TCP_BASE_ISS         0x4d7e980b
+-#define TCP_ISS_INCREMENT_1  2048
+-#define TCP_ISS_INCREMENT_2  100
+-
+ typedef union {
+   EFI_TCP4_CONFIG_DATA    Tcp4CfgData;
+   EFI_TCP6_CONFIG_DATA    Tcp6CfgData;
+@@ -774,4 +767,50 @@ Tcp6Poll (
+   IN EFI_TCP6_PROTOCOL  *This
+   );
+ 
++/**
++  Retrieves the Initial Sequence Number (ISN) for a TCP connection identified by local
++  and remote IP addresses and ports.
++
++  This method is based on https://datatracker.ietf.org/doc/html/rfc9293#section-3.4.1
++  Where the ISN is computed as follows:
++    ISN = TimeStamp + MD5(LocalIP, LocalPort, RemoteIP, RemotePort, Secret)
++
++  Otherwise:
++    ISN = M + F(localip, localport, remoteip, remoteport, secretkey)
++
++    "Here M is the 4 microsecond timer, and F() is a pseudorandom function (PRF) of the
++    connection's identifying parameters ("localip, localport, remoteip, remoteport")
++    and a secret key ("secretkey") (SHLD-1). F() MUST NOT be computable from the
++    outside (MUST-9), or an attacker could still guess at sequence numbers from the
++    ISN used for some other connection. The PRF could be implemented as a
++    cryptographic hash of the concatenation of the TCP connection parameters and some
++    secret data. For discussion of the selection of a specific hash algorithm and
++    management of the secret key data."
++
++  @param[in]       LocalIp        A pointer to the local IP address of the TCP connection.
++  @param[in]       LocalIpSize    The size, in bytes, of the LocalIp buffer.
++  @param[in]       LocalPort      The local port number of the TCP connection.
++  @param[in]       RemoteIp       A pointer to the remote IP address of the TCP connection.
++  @param[in]       RemoteIpSize   The size, in bytes, of the RemoteIp buffer.
++  @param[in]       RemotePort     The remote port number of the TCP connection.
++  @param[out]      Isn            A pointer to the variable that will receive the Initial
++                                  Sequence Number (ISN).
++
++  @retval EFI_SUCCESS             The operation completed successfully, and the ISN was
++                                  retrieved.
++  @retval EFI_INVALID_PARAMETER   One or more of the input parameters are invalid.
++  @retval EFI_UNSUPPORTED         The operation is not supported.
++
++**/
++EFI_STATUS
++TcpGetIsn (
++  IN UINT8       *LocalIp,
++  IN UINTN       LocalIpSize,
++  IN UINT16      LocalPort,
++  IN UINT8       *RemoteIp,
++  IN UINTN       RemoteIpSize,
++  IN UINT16      RemotePort,
++  OUT TCP_SEQNO  *Isn
++  );
++
+ #endif
+diff --git a/NetworkPkg/TcpDxe/TcpMisc.c b/NetworkPkg/TcpDxe/TcpMisc.c
+index c93212d47d..3310306f63 100644
+--- a/NetworkPkg/TcpDxe/TcpMisc.c
++++ b/NetworkPkg/TcpDxe/TcpMisc.c
+@@ -3,7 +3,7 @@
+ 
+   (C) Copyright 2014 Hewlett-Packard Development Company, L.P.<BR>
+   Copyright (c) 2009 - 2017, Intel Corporation. All rights reserved.<BR>
+-
++  Copyright (c) Microsoft Corporation
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+@@ -20,7 +20,34 @@ LIST_ENTRY  mTcpListenQue = {
+   &mTcpListenQue
+ };
+ 
+-TCP_SEQNO  mTcpGlobalIss = TCP_BASE_ISS;
++//
++// The Session secret
++// This must be initialized to a random value at boot time
++//
++TCP_SEQNO  mTcpGlobalSecret;
++
++//
++// Union to hold either an IPv4 or IPv6 address
++// This is used to simplify the ISN hash computation
++//
++typedef union {
++  UINT8    IPv4[4];
++  UINT8    IPv6[16];
++} NETWORK_ADDRESS;
++
++//
++// The ISN is computed by hashing this structure
++// It is initialized with the local and remote IP addresses and ports
++// and the secret
++//
++//
++typedef struct {
++  UINT16             LocalPort;
++  UINT16             RemotePort;
++  NETWORK_ADDRESS    LocalAddress;
++  NETWORK_ADDRESS    RemoteAddress;
++  TCP_SEQNO          Secret;
++} ISN_HASH_CTX;
+ 
+ CHAR16  *mTcpStateName[] = {
+   L"TCP_CLOSED",
+@@ -41,12 +68,18 @@ CHAR16  *mTcpStateName[] = {
+ 
+   @param[in, out]  Tcb               Pointer to the TCP_CB of this TCP instance.
+ 
++  @retval EFI_SUCCESS             The operation completed successfully
++  @retval others                  The underlying functions failed and could not complete the operation
++
+ **/
+-VOID
++EFI_STATUS
+ TcpInitTcbLocal (
+   IN OUT TCP_CB  *Tcb
+   )
+ {
++  TCP_SEQNO   Isn;
++  EFI_STATUS  Status;
++
+   //
+   // Compute the checksum of the fixed parts of pseudo header
+   //
+@@ -57,6 +90,16 @@ TcpInitTcbLocal (
+                      0x06,
+                      0
+                      );
++
++    Status = TcpGetIsn (
++               Tcb->LocalEnd.Ip.v4.Addr,
++               sizeof (IPv4_ADDRESS),
++               Tcb->LocalEnd.Port,
++               Tcb->RemoteEnd.Ip.v4.Addr,
++               sizeof (IPv4_ADDRESS),
++               Tcb->RemoteEnd.Port,
++               &Isn
++               );
+   } else {
+     Tcb->HeadSum = NetIp6PseudoHeadChecksum (
+                      &Tcb->LocalEnd.Ip.v6,
+@@ -64,9 +107,25 @@ TcpInitTcbLocal (
+                      0x06,
+                      0
+                      );
++
++    Status = TcpGetIsn (
++               Tcb->LocalEnd.Ip.v6.Addr,
++               sizeof (IPv6_ADDRESS),
++               Tcb->LocalEnd.Port,
++               Tcb->RemoteEnd.Ip.v6.Addr,
++               sizeof (IPv6_ADDRESS),
++               Tcb->RemoteEnd.Port,
++               &Isn
++               );
++  }
++
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_ERROR, "TcpInitTcbLocal: failed to get isn\n"));
++    ASSERT (FALSE);
++    return Status;
+   }
+ 
+-  Tcb->Iss    = TcpGetIss ();
++  Tcb->Iss    = Isn;
+   Tcb->SndUna = Tcb->Iss;
+   Tcb->SndNxt = Tcb->Iss;
+ 
+@@ -82,6 +141,8 @@ TcpInitTcbLocal (
+   Tcb->RetxmitSeqMax = 0;
+ 
+   Tcb->ProbeTimerOn = FALSE;
++
++  return EFI_SUCCESS;
+ }
+ 
+ /**
+@@ -506,18 +567,162 @@ TcpCloneTcb (
+ }
+ 
+ /**
+-  Compute an ISS to be used by a new connection.
+-
+-  @return The resulting ISS.
++  Retrieves the Initial Sequence Number (ISN) for a TCP connection identified by local
++  and remote IP addresses and ports.
++
++  This method is based on https://datatracker.ietf.org/doc/html/rfc9293#section-3.4.1
++  Where the ISN is computed as follows:
++    ISN = TimeStamp + MD5(LocalIP, LocalPort, RemoteIP, RemotePort, Secret)
++
++  Otherwise:
++    ISN = M + F(localip, localport, remoteip, remoteport, secretkey)
++
++    "Here M is the 4 microsecond timer, and F() is a pseudorandom function (PRF) of the
++    connection's identifying parameters ("localip, localport, remoteip, remoteport")
++    and a secret key ("secretkey") (SHLD-1). F() MUST NOT be computable from the
++    outside (MUST-9), or an attacker could still guess at sequence numbers from the
++    ISN used for some other connection. The PRF could be implemented as a
++    cryptographic hash of the concatenation of the TCP connection parameters and some
++    secret data. For discussion of the selection of a specific hash algorithm and
++    management of the secret key data."
++
++  @param[in]       LocalIp        A pointer to the local IP address of the TCP connection.
++  @param[in]       LocalIpSize    The size, in bytes, of the LocalIp buffer.
++  @param[in]       LocalPort      The local port number of the TCP connection.
++  @param[in]       RemoteIp       A pointer to the remote IP address of the TCP connection.
++  @param[in]       RemoteIpSize   The size, in bytes, of the RemoteIp buffer.
++  @param[in]       RemotePort     The remote port number of the TCP connection.
++  @param[out]      Isn            A pointer to the variable that will receive the Initial
++                                  Sequence Number (ISN).
++
++  @retval EFI_SUCCESS             The operation completed successfully, and the ISN was
++                                  retrieved.
++  @retval EFI_INVALID_PARAMETER   One or more of the input parameters are invalid.
++  @retval EFI_UNSUPPORTED         The operation is not supported.
+ 
+ **/
+-TCP_SEQNO
+-TcpGetIss (
+-  VOID
++EFI_STATUS
++TcpGetIsn (
++  IN UINT8       *LocalIp,
++  IN UINTN       LocalIpSize,
++  IN UINT16      LocalPort,
++  IN UINT8       *RemoteIp,
++  IN UINTN       RemoteIpSize,
++  IN UINT16      RemotePort,
++  OUT TCP_SEQNO  *Isn
+   )
+ {
+-  mTcpGlobalIss += TCP_ISS_INCREMENT_1;
+-  return mTcpGlobalIss;
++  EFI_STATUS          Status;
++  EFI_HASH2_PROTOCOL  *Hash2Protocol;
++  EFI_HASH2_OUTPUT    HashResult;
++  ISN_HASH_CTX        IsnHashCtx;
++  EFI_TIME            TimeStamp;
++
++  //
++  // Check that the ISN pointer is valid
++  //
++  if (Isn == NULL) {
++    return EFI_INVALID_PARAMETER;
++  }
++
++  //
++  // The local ip may be a v4 or v6 address and may not be NULL
++  //
++  if ((LocalIp == NULL) || (LocalIpSize == 0) || (RemoteIp == NULL) || (RemoteIpSize == 0)) {
++    return EFI_INVALID_PARAMETER;
++  }
++
++  //
++  // the local ip may be a v4 or v6 address
++  //
++  if ((LocalIpSize != sizeof (EFI_IPv4_ADDRESS)) && (LocalIpSize != sizeof (EFI_IPv6_ADDRESS))) {
++    return EFI_INVALID_PARAMETER;
++  }
++
++  //
++  // Locate the Hash Protocol
++  //
++  Status = gBS->LocateProtocol (&gEfiHash2ProtocolGuid, NULL, (VOID **)&Hash2Protocol);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_NET, "Failed to locate Hash Protocol: %r\n", Status));
++
++    //
++    // TcpCreateService(..) is expected to be called prior to this function
++    //
++    ASSERT_EFI_ERROR (Status);
++    return Status;
++  }
++
++  //
++  // Initialize the hash algorithm
++  //
++  Status = Hash2Protocol->HashInit (Hash2Protocol, &gEfiHashAlgorithmSha256Guid);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_NET, "Failed to initialize sha256 hash algorithm: %r\n", Status));
++    return Status;
++  }
++
++  IsnHashCtx.LocalPort  = LocalPort;
++  IsnHashCtx.RemotePort = RemotePort;
++  IsnHashCtx.Secret     = mTcpGlobalSecret;
++
++  //
++  // Check the IP address family and copy accordingly
++  //
++  if (LocalIpSize == sizeof (EFI_IPv4_ADDRESS)) {
++    CopyMem (&IsnHashCtx.LocalAddress.IPv4, LocalIp, LocalIpSize);
++  } else if (LocalIpSize == sizeof (EFI_IPv6_ADDRESS)) {
++    CopyMem (&IsnHashCtx.LocalAddress.IPv6, LocalIp, LocalIpSize);
++  } else {
++    return EFI_INVALID_PARAMETER; // Unsupported address size
++  }
++
++  //
++  // Repeat the process for the remote IP address
++  //
++  if (RemoteIpSize == sizeof (EFI_IPv4_ADDRESS)) {
++    CopyMem (&IsnHashCtx.RemoteAddress.IPv4, RemoteIp, RemoteIpSize);
++  } else if (RemoteIpSize == sizeof (EFI_IPv6_ADDRESS)) {
++    CopyMem (&IsnHashCtx.RemoteAddress.IPv6, RemoteIp, RemoteIpSize);
++  } else {
++    return EFI_INVALID_PARAMETER; // Unsupported address size
++  }
++
++  //
++  // Compute the hash
++  // Update the hash with the data
++  //
++  Status = Hash2Protocol->HashUpdate (Hash2Protocol, (UINT8 *)&IsnHashCtx, sizeof (IsnHashCtx));
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_NET, "Failed to update hash: %r\n", Status));
++    return Status;
++  }
++
++  //
++  // Finalize the hash and retrieve the result
++  //
++  Status = Hash2Protocol->HashFinal (Hash2Protocol, &HashResult);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_NET, "Failed to finalize hash: %r\n", Status));
++    return Status;
++  }
++
++  Status = gRT->GetTime (&TimeStamp, NULL);
++  if (EFI_ERROR (Status)) {
++    return Status;
++  }
++
++  //
++  // copy the first 4 bytes of the hash result into the ISN
++  //
++  CopyMem (Isn, HashResult.Md5Hash, sizeof (*Isn));
++
++  //
++  // now add the timestamp to the ISN as 4 microseconds units (1000 / 4 = 250)
++  //
++  *Isn += (TCP_SEQNO)TimeStamp.Nanosecond * 250;
++
++  return Status;
+ }
+ 
+ /**
+@@ -721,17 +926,28 @@ TcpFormatNetbuf (
+   @param[in, out]  Tcb          Pointer to the TCP_CB that wants to initiate a
+                                 connection.
+ 
++  @retval EFI_SUCCESS             The operation completed successfully
++  @retval others                  The underlying functions failed and could not complete the operation
++
+ **/
+-VOID
++EFI_STATUS
+ TcpOnAppConnect (
+   IN OUT TCP_CB  *Tcb
+   )
+ {
+-  TcpInitTcbLocal (Tcb);
++  EFI_STATUS  Status;
++
++  Status = TcpInitTcbLocal (Tcb);
++  if (EFI_ERROR (Status)) {
++    return Status;
++  }
++
+   TcpSetState (Tcb, TCP_SYN_SENT);
+ 
+   TcpSetTimer (Tcb, TCP_TIMER_CONNECT, Tcb->ConnectTimeout);
+   TcpToSendData (Tcb, 1);
++
++  return EFI_SUCCESS;
+ }
+ 
+ /**
+diff --git a/NetworkPkg/TcpDxe/TcpTimer.c b/NetworkPkg/TcpDxe/TcpTimer.c
+index 5d2e124977..065b1bdf5f 100644
+--- a/NetworkPkg/TcpDxe/TcpTimer.c
++++ b/NetworkPkg/TcpDxe/TcpTimer.c
+@@ -2,7 +2,7 @@
+   TCP timer related functions.
+ 
+   Copyright (c) 2009 - 2010, Intel Corporation. All rights reserved.<BR>
+-
++  Copyright (c) Microsoft Corporation
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+ **/
+@@ -483,7 +483,6 @@ TcpTickingDpc (
+   INT16       Index;
+ 
+   mTcpTick++;
+-  mTcpGlobalIss += TCP_ISS_INCREMENT_2;
+ 
+   //
+   // Don't use LIST_FOR_EACH, which isn't delete safe.
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch

@@ -1,20 +1,21 @@
-From deaae42b0a299303997813db8a708524d48dcf28 Mon Sep 17 00:00:00 2001
+From 1afdf854f67fbaeea47f15efa0c34c0f1fe6a504 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Fri, 16 Feb 2024 10:48:05 -0500
-Subject: [PATCH 1/2] NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234
+Subject: [PATCH 10/18] NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234
  Patch
 
 RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 57: NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234 Patch
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
-RH-Jira: RHEL-22005
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
 RH-Acked-by: Gerd Hoffmann <None>
-RH-Commit: [1/2] e3f3e3f2bdf9465e0eb48ae7c61bb4777540b3b0
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [10/18] c7527c63ebe3afb55a2ef78103c1a57de26c36b7
 
-JIRA: https://issues.redhat.com/browse/RHEL-22005
+JIRA: https://issues.redhat.com/browse/RHEL-21851
 CVE: CVE-2022-45234
 Upstream: Merged
 
-commit cbf2a0cce1a76e497b19a0f0fa90a42eb2c2f206 (HEAD -> CVE-2023-4530_RHEL-21843_c9s)
+commit 1b53515d53d303166b2bbd31e2cc7f16fd0aecd7
 Author: Doug Flick <dougflick@microsoft.com>
 Date:   Fri Jan 26 05:54:52 2024 +0800
 

SOURCES/edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch

@@ -1,16 +1,17 @@
-From b6d483e64d9e437645d48c4e261eac8ec02d7403 Mon Sep 17 00:00:00 2001
+From d60257df151a6c58aefe74c2d2baee59344318d2 Mon Sep 17 00:00:00 2001
 From: Jon Maloy <jmaloy@redhat.com>
 Date: Fri, 16 Feb 2024 10:48:05 -0500
-Subject: [PATCH 2/2] NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234
+Subject: [PATCH 11/18] NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234
  Unit Tests
 
 RH-Author: Jon Maloy <jmaloy@redhat.com>
-RH-MergeRequest: 57: NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234 Patch
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
-RH-Jira: RHEL-22005
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
 RH-Acked-by: Gerd Hoffmann <None>
-RH-Commit: [2/2] f277f0365674319e73dd862e81b3e6b8b1839418
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [11/18] b917383d597172d4bf75548d9b281d08bf34e299
 
-JIRA: https://issues.redhat.com/browse/RHEL-22005
+JIRA: https://issues.redhat.com/browse/RHEL-21851
 CVE: CVE-2022-45234
 Upstream: Merged
 
@@ -41,26 +42,25 @@ Date:   Fri Jan 26 05:54:53 2024 +0800
 
 Signed-off-by: Jon Maloy <jmaloy@redhat.com>
 ---
- NetworkPkg/Test/NetworkPkgHostTest.dsc        |   2 +
+ NetworkPkg/Test/NetworkPkgHostTest.dsc        |   1 +
  .../GoogleTest/PxeBcDhcp6GoogleTest.cpp       | 300 ++++++++++++++++++
  .../GoogleTest/PxeBcDhcp6GoogleTest.h         |  50 +++
  .../GoogleTest/UefiPxeBcDxeGoogleTest.cpp     |  19 ++
  .../GoogleTest/UefiPxeBcDxeGoogleTest.inf     |  48 +++
- 5 files changed, 419 insertions(+)
+ 5 files changed, 418 insertions(+)
  create mode 100644 NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp
  create mode 100644 NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h
  create mode 100644 NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.cpp
  create mode 100644 NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.inf
 
 diff --git a/NetworkPkg/Test/NetworkPkgHostTest.dsc b/NetworkPkg/Test/NetworkPkgHostTest.dsc
-index 20bc90b172..c8a991e5c1 100644
+index 7fa7b0f9d5..a0273c4310 100644
 --- a/NetworkPkg/Test/NetworkPkgHostTest.dsc
 +++ b/NetworkPkg/Test/NetworkPkgHostTest.dsc
-@@ -25,6 +25,8 @@
+@@ -27,6 +27,7 @@
-   # Build HOST_APPLICATION that tests NetworkPkg
    #
    NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
-+  NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+   NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
 +  NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.inf
  
  # Despite these library classes being listed in [LibraryClasses] below, they are not needed for the host-based unit tests.

SOURCES/edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch

@@ -0,0 +1,257 @@
+From b57bd437db8cff7b7a206e3cd694b7821014ba53 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 12/18] NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45235
+ Patch
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [12/18] 310a770792d1a81dbf54ee372f926541309492e8
+
+JIRA: https://issues.redhat.com/browse/RHEL-21853
+CVE: CVE-2022-45235
+Upstream: Merged
+
+commit fac297724e6cc343430cd0104e55cd7a96d1151e
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:55 2024 +0800
+
+    NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45235 Patch
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4540
+
+    Bug Details:
+    PixieFail Bug #7
+    CVE-2023-45235
+    CVSS 8.3 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
+    CWE-119 Improper Restriction of Operations within the Bounds of
+     a Memory Buffer
+
+    Buffer overflow when handling Server ID option from a DHCPv6 proxy
+    Advertise message
+
+    Change Overview:
+
+    Performs two checks
+
+    1. Checks that the length of the duid is accurate
+    > + //
+    > + // Check that the minimum and maximum requirements are met
+    > + //
+    > + if ((OpLen < PXEBC_MIN_SIZE_OF_DUID) ||
+    (OpLen > PXEBC_MAX_SIZE_OF_DUID)) {
+    > +  Status = EFI_INVALID_PARAMETER;
+    > +  goto ON_ERROR;
+    > + }
+
+    2. Ensures that the amount of data written to the buffer is tracked and
+    never exceeds that
+    > + //
+    > + // Check that the option length is valid.
+    > + //
+    > + if ((DiscoverLen + OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN)
+     > DiscoverLenNeeded) {
+    > +     Status = EFI_OUT_OF_RESOURCES;
+    > +     goto ON_ERROR;
+    > + }
+
+    Additional code clean up and fix for memory leak in case Option was NULL
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c | 77 ++++++++++++++++++++++------
+ NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h | 17 ++++++
+ 2 files changed, 78 insertions(+), 16 deletions(-)
+
+diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
+index 2b2d372889..7fd1281c11 100644
+--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
++++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
+@@ -887,6 +887,7 @@ PxeBcRequestBootService (
+   EFI_STATUS                       Status;
+   EFI_DHCP6_PACKET                 *IndexOffer;
+   UINT8                            *Option;
++  UINTN                            DiscoverLenNeeded;
+ 
+   PxeBc      = &Private->PxeBc;
+   Request    = Private->Dhcp6Request;
+@@ -899,7 +900,8 @@ PxeBcRequestBootService (
+     return EFI_DEVICE_ERROR;
+   }
+ 
+-  Discover = AllocateZeroPool (sizeof (EFI_PXE_BASE_CODE_DHCPV6_PACKET));
++  DiscoverLenNeeded = sizeof (EFI_PXE_BASE_CODE_DHCPV6_PACKET);
++  Discover          = AllocateZeroPool (DiscoverLenNeeded);
+   if (Discover == NULL) {
+     return EFI_OUT_OF_RESOURCES;
+   }
+@@ -924,16 +926,34 @@ PxeBcRequestBootService (
+                DHCP6_OPT_SERVER_ID
+                );
+     if (Option == NULL) {
+-      return EFI_NOT_FOUND;
++      Status = EFI_NOT_FOUND;
++      goto ON_ERROR;
+     }
+ 
+     //
+     // Add Server ID Option.
+     //
+     OpLen = NTOHS (((EFI_DHCP6_PACKET_OPTION *)Option)->OpLen);
+-    CopyMem (DiscoverOpt, Option, OpLen + 4);
+-    DiscoverOpt += (OpLen + 4);
+-    DiscoverLen += (OpLen + 4);
++
++    //
++    // Check that the minimum and maximum requirements are met
++    //
++    if ((OpLen < PXEBC_MIN_SIZE_OF_DUID) || (OpLen > PXEBC_MAX_SIZE_OF_DUID)) {
++      Status = EFI_INVALID_PARAMETER;
++      goto ON_ERROR;
++    }
++
++    //
++    // Check that the option length is valid.
++    //
++    if ((DiscoverLen + OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN) > DiscoverLenNeeded) {
++      Status = EFI_OUT_OF_RESOURCES;
++      goto ON_ERROR;
++    }
++
++    CopyMem (DiscoverOpt, Option, OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
++    DiscoverOpt += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
++    DiscoverLen += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+   }
+ 
+   while (RequestLen < Request->Length) {
+@@ -944,16 +964,24 @@ PxeBcRequestBootService (
+         (OpCode != DHCP6_OPT_SERVER_ID)
+         )
+     {
++      //
++      // Check that the option length is valid.
++      //
++      if (DiscoverLen + OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN > DiscoverLenNeeded) {
++        Status = EFI_OUT_OF_RESOURCES;
++        goto ON_ERROR;
++      }
++
+       //
+       // Copy all the options except IA option and Server ID
+       //
+-      CopyMem (DiscoverOpt, RequestOpt, OpLen + 4);
+-      DiscoverOpt += (OpLen + 4);
+-      DiscoverLen += (OpLen + 4);
++      CopyMem (DiscoverOpt, RequestOpt, OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
++      DiscoverOpt += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
++      DiscoverLen += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+     }
+ 
+-    RequestOpt += (OpLen + 4);
+-    RequestLen += (OpLen + 4);
++    RequestOpt += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
++    RequestLen += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+   }
+ 
+   //
+@@ -2154,6 +2182,7 @@ PxeBcDhcp6Discover (
+   UINT16                           OpLen;
+   UINT32                           Xid;
+   EFI_STATUS                       Status;
++  UINTN                            DiscoverLenNeeded;
+ 
+   PxeBc    = &Private->PxeBc;
+   Mode     = PxeBc->Mode;
+@@ -2169,7 +2198,8 @@ PxeBcDhcp6Discover (
+     return EFI_DEVICE_ERROR;
+   }
+ 
+-  Discover = AllocateZeroPool (sizeof (EFI_PXE_BASE_CODE_DHCPV6_PACKET));
++  DiscoverLenNeeded = sizeof (EFI_PXE_BASE_CODE_DHCPV6_PACKET);
++  Discover          = AllocateZeroPool (DiscoverLenNeeded);
+   if (Discover == NULL) {
+     return EFI_OUT_OF_RESOURCES;
+   }
+@@ -2185,22 +2215,37 @@ PxeBcDhcp6Discover (
+   DiscoverLen             = sizeof (EFI_DHCP6_HEADER);
+   RequestLen              = DiscoverLen;
+ 
++  //
++  // The request packet is generated by the UEFI network stack. In the DHCP4 DORA and DHCP6 SARR sequence,
++  // the first (discover in DHCP4 and solicit in DHCP6) and third (request in both DHCP4 and DHCP6) are
++  // generated by the DHCP client (the UEFI network stack in this case). By the time this function executes,
++  // the DHCP sequence already has been executed once (see UEFI Specification Figures 24.2 and 24.3), with
++  // Private->Dhcp6Request being a cached copy of the DHCP6 request packet that UEFI network stack previously
++  // generated and sent.
++  //
++  // Therefore while this code looks like it could overflow, in practice it's not possible.
++  //
+   while (RequestLen < Request->Length) {
+     OpCode = NTOHS (((EFI_DHCP6_PACKET_OPTION *)RequestOpt)->OpCode);
+     OpLen  = NTOHS (((EFI_DHCP6_PACKET_OPTION *)RequestOpt)->OpLen);
+     if ((OpCode != EFI_DHCP6_IA_TYPE_NA) &&
+         (OpCode != EFI_DHCP6_IA_TYPE_TA))
+     {
++      if (DiscoverLen + OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN > DiscoverLenNeeded) {
++        Status = EFI_OUT_OF_RESOURCES;
++        goto ON_ERROR;
++      }
++
+       //
+       // Copy all the options except IA option.
+       //
+-      CopyMem (DiscoverOpt, RequestOpt, OpLen + 4);
+-      DiscoverOpt += (OpLen + 4);
+-      DiscoverLen += (OpLen + 4);
++      CopyMem (DiscoverOpt, RequestOpt, OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
++      DiscoverOpt += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
++      DiscoverLen += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+     }
+ 
+-    RequestOpt += (OpLen + 4);
+-    RequestLen += (OpLen + 4);
++    RequestOpt += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
++    RequestLen += (OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN);
+   }
+ 
+   Status = PxeBc->UdpWrite (
+diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h
+index c86f6d391b..6357d27fae 100644
+--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h
++++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.h
+@@ -34,6 +34,23 @@
+ #define PXEBC_ADDR_START_DELIMITER        '['
+ #define PXEBC_ADDR_END_DELIMITER          ']'
+ 
++//
++// A DUID consists of a 2-octet type code represented in network byte
++// order, followed by a variable number of octets that make up the
++// actual identifier.  The length of the DUID (not including the type
++// code) is at least 1 octet and at most 128 octets.
++//
++#define PXEBC_MIN_SIZE_OF_DUID  (sizeof(UINT16) + 1)
++#define PXEBC_MAX_SIZE_OF_DUID  (sizeof(UINT16) + 128)
++
++//
++// This define represents the combineds code and length field from
++// https://datatracker.ietf.org/doc/html/rfc3315#section-22.1
++//
++#define PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN  \
++      (sizeof (((EFI_DHCP6_PACKET_OPTION *)0)->OpCode) + \
++      sizeof (((EFI_DHCP6_PACKET_OPTION *)0)->OpLen))
++
+ #define GET_NEXT_DHCP6_OPTION(Opt) \
+   (EFI_DHCP6_PACKET_OPTION *) ((UINT8 *) (Opt) + \
+   sizeof (EFI_DHCP6_PACKET_OPTION) + (NTOHS ((Opt)->OpLen)) - 1)
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch

@@ -0,0 +1,409 @@
+From 59b9d468ebf6be2a5c53d7979c12040f9b41c2c2 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 13/18] NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45235
+ Unit Tests
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [13/18] 074410155526b2ee2a74cf161ea46385932da059
+
+JIRA: https://issues.redhat.com/browse/RHEL-21853
+CVE: CVE-2022-45235
+Upstream: Merged
+
+commit ff2986358f75d8f58ef08a66fe673539c9c48f41
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Fri Jan 26 05:54:56 2024 +0800
+
+    NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45235 Unit Tests
+
+    REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4540
+
+    Unit tests to confirm that the bug..
+
+    Buffer overflow when handling Server ID option from a DHCPv6 proxy
+    Advertise message
+
+    ..has been patched.
+
+    This patch contains unit tests for the following functions:
+    PxeBcRequestBootService
+    PxeBcDhcp6Discover
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/Test/NetworkPkgHostTest.dsc        |   5 +-
+ .../GoogleTest/PxeBcDhcp6GoogleTest.cpp       | 278 +++++++++++++++++-
+ .../GoogleTest/PxeBcDhcp6GoogleTest.h         |  18 ++
+ 3 files changed, 298 insertions(+), 3 deletions(-)
+
+diff --git a/NetworkPkg/Test/NetworkPkgHostTest.dsc b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+index a0273c4310..fa301a7a52 100644
+--- a/NetworkPkg/Test/NetworkPkgHostTest.dsc
++++ b/NetworkPkg/Test/NetworkPkgHostTest.dsc
+@@ -27,7 +27,10 @@
+   #
+   NetworkPkg/Dhcp6Dxe/GoogleTest/Dhcp6DxeGoogleTest.inf
+   NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
+-  NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.inf
++  NetworkPkg/UefiPxeBcDxe/GoogleTest/UefiPxeBcDxeGoogleTest.inf {
++    <LibraryClasses>
++      UefiRuntimeServicesTableLib|MdePkg/Test/Mock/Library/GoogleTest/MockUefiRuntimeServicesTableLib/MockUefiRuntimeServicesTableLib.inf
++  }
+ 
+ # Despite these library classes being listed in [LibraryClasses] below, they are not needed for the host-based unit tests.
+ [LibraryClasses]
+diff --git a/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp b/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp
+index 8260eeee50..bd423ebadf 100644
+--- a/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp
++++ b/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.cpp
+@@ -4,7 +4,9 @@
+   Copyright (c) Microsoft Corporation
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ **/
+-#include <gtest/gtest.h>
++#include <Library/GoogleTestLib.h>
++#include <GoogleTest/Library/MockUefiLib.h>
++#include <GoogleTest/Library/MockUefiRuntimeServicesTableLib.h>
+ 
+ extern "C" {
+   #include <Uefi.h>
+@@ -19,7 +21,8 @@ extern "C" {
+ // Definitions
+ ///////////////////////////////////////////////////////////////////////////////
+ 
+-#define PACKET_SIZE  (1500)
++#define PACKET_SIZE            (1500)
++#define REQUEST_OPTION_LENGTH  (120)
+ 
+ typedef struct {
+   UINT16    OptionCode;   // The option code for DHCP6_OPT_SERVER_ID (e.g., 0x03)
+@@ -76,6 +79,26 @@ MockConfigure (
+ }
+ 
+ // Needed by PxeBcSupport
++EFI_STATUS
++PxeBcDns6 (
++  IN PXEBC_PRIVATE_DATA  *Private,
++  IN     CHAR16          *HostName,
++  OUT EFI_IPv6_ADDRESS   *IpAddress
++  )
++{
++  return EFI_SUCCESS;
++}
++
++UINT32
++PxeBcBuildDhcp6Options (
++  IN  PXEBC_PRIVATE_DATA       *Private,
++  OUT EFI_DHCP6_PACKET_OPTION  **OptList,
++  IN  UINT8                    *Buffer
++  )
++{
++  return EFI_SUCCESS;
++}
++
+ EFI_STATUS
+ EFIAPI
+ QueueDpc (
+@@ -159,6 +182,10 @@ TEST_F (PxeBcHandleDhcp6OfferTest, BasicUsageTest) {
+   ASSERT_EQ (PxeBcHandleDhcp6Offer (&(PxeBcHandleDhcp6OfferTest::Private)), EFI_DEVICE_ERROR);
+ }
+ 
++///////////////////////////////////////////////////////////////////////////////
++// PxeBcCacheDnsServerAddresses Tests
++///////////////////////////////////////////////////////////////////////////////
++
+ class PxeBcCacheDnsServerAddressesTest : public ::testing::Test {
+ public:
+   PXEBC_PRIVATE_DATA Private = { 0 };
+@@ -298,3 +325,250 @@ TEST_F (PxeBcCacheDnsServerAddressesTest, MultipleDnsEntries) {
+     FreePool (Private.DnsServer);
+   }
+ }
++
++///////////////////////////////////////////////////////////////////////////////
++// PxeBcRequestBootServiceTest Test Cases
++///////////////////////////////////////////////////////////////////////////////
++
++class PxeBcRequestBootServiceTest : public ::testing::Test {
++public:
++  PXEBC_PRIVATE_DATA Private = { 0 };
++  EFI_UDP6_PROTOCOL Udp6Read;
++
++protected:
++  // Add any setup code if needed
++  virtual void
++  SetUp (
++    )
++  {
++    Private.Dhcp6Request = (EFI_DHCP6_PACKET *)AllocateZeroPool (PACKET_SIZE);
++
++    // Need to setup the EFI_PXE_BASE_CODE_PROTOCOL
++    // The function under test really only needs the following:
++    //  UdpWrite
++    //  UdpRead
++
++    Private.PxeBc.UdpWrite = (EFI_PXE_BASE_CODE_UDP_WRITE)MockUdpWrite;
++    Private.PxeBc.UdpRead  = (EFI_PXE_BASE_CODE_UDP_READ)MockUdpRead;
++
++    // Need to setup EFI_UDP6_PROTOCOL
++    // The function under test really only needs the following:
++    //  Configure
++
++    Udp6Read.Configure = (EFI_UDP6_CONFIGURE)MockConfigure;
++    Private.Udp6Read   = &Udp6Read;
++  }
++
++  // Add any cleanup code if needed
++  virtual void
++  TearDown (
++    )
++  {
++    if (Private.Dhcp6Request != NULL) {
++      FreePool (Private.Dhcp6Request);
++    }
++
++    // Clean up any resources or variables
++  }
++};
++
++TEST_F (PxeBcRequestBootServiceTest, ServerDiscoverBasicUsageTest) {
++  PxeBcRequestBootServiceTest::Private.OfferBuffer[0].Dhcp6.OfferType = PxeOfferTypeProxyBinl;
++
++  DHCP6_OPTION_SERVER_ID  Server = { 0 };
++
++  Server.OptionCode =  HTONS (DHCP6_OPT_SERVER_ID);
++  Server.OptionLen  = HTONS (16); // valid length
++  UINT8  Index = 0;
++
++  EFI_DHCP6_PACKET  *Packet = (EFI_DHCP6_PACKET *)&Private.OfferBuffer[Index].Dhcp6.Packet.Offer;
++
++  UINT8  *Cursor = (UINT8 *)(Packet->Dhcp6.Option);
++
++  CopyMem (Cursor, &Server, sizeof (Server));
++  Cursor += sizeof (Server);
++
++  // Update the packet length
++  Packet->Length = (UINT16)(Cursor - (UINT8 *)Packet);
++  Packet->Size   = PACKET_SIZE;
++
++  ASSERT_EQ (PxeBcRequestBootService (&(PxeBcRequestBootServiceTest::Private), Index), EFI_SUCCESS);
++}
++
++TEST_F (PxeBcRequestBootServiceTest, AttemptDiscoverOverFlowExpectFailure) {
++  PxeBcRequestBootServiceTest::Private.OfferBuffer[0].Dhcp6.OfferType = PxeOfferTypeProxyBinl;
++
++  DHCP6_OPTION_SERVER_ID  Server = { 0 };
++
++  Server.OptionCode =  HTONS (DHCP6_OPT_SERVER_ID);
++  Server.OptionLen  = HTONS (1500); // This length would overflow without a check
++  UINT8  Index = 0;
++
++  EFI_DHCP6_PACKET  *Packet = (EFI_DHCP6_PACKET *)&Private.OfferBuffer[Index].Dhcp6.Packet.Offer;
++
++  UINT8  *Cursor = (UINT8 *)(Packet->Dhcp6.Option);
++
++  CopyMem (Cursor, &Server, sizeof (Server));
++  Cursor += sizeof (Server);
++
++  // Update the packet length
++  Packet->Length = (UINT16)(Cursor - (UINT8 *)Packet);
++  Packet->Size   = PACKET_SIZE;
++
++  // This is going to be stopped by the duid overflow check
++  ASSERT_EQ (PxeBcRequestBootService (&(PxeBcRequestBootServiceTest::Private), Index), EFI_INVALID_PARAMETER);
++}
++
++TEST_F (PxeBcRequestBootServiceTest, RequestBasicUsageTest) {
++  EFI_DHCP6_PACKET_OPTION  RequestOpt = { 0 }; // the data section doesn't really matter
++
++  RequestOpt.OpCode = HTONS (0x1337);
++  RequestOpt.OpLen  = 0; // valid length
++
++  UINT8  Index = 0;
++
++  EFI_DHCP6_PACKET  *Packet = (EFI_DHCP6_PACKET *)&Private.Dhcp6Request[Index];
++
++  UINT8  *Cursor = (UINT8 *)(Packet->Dhcp6.Option);
++
++  CopyMem (Cursor, &RequestOpt, sizeof (RequestOpt));
++  Cursor += sizeof (RequestOpt);
++
++  // Update the packet length
++  Packet->Length = (UINT16)(Cursor - (UINT8 *)Packet);
++  Packet->Size   = PACKET_SIZE;
++
++  ASSERT_EQ (PxeBcRequestBootService (&(PxeBcRequestBootServiceTest::Private), Index), EFI_SUCCESS);
++}
++
++TEST_F (PxeBcRequestBootServiceTest, AttemptRequestOverFlowExpectFailure) {
++  EFI_DHCP6_PACKET_OPTION  RequestOpt = { 0 }; // the data section doesn't really matter
++
++  RequestOpt.OpCode = HTONS (0x1337);
++  RequestOpt.OpLen  = 1500; // this length would overflow without a check
++
++  UINT8  Index = 0;
++
++  EFI_DHCP6_PACKET  *Packet = (EFI_DHCP6_PACKET *)&Private.Dhcp6Request[Index];
++
++  UINT8  *Cursor = (UINT8 *)(Packet->Dhcp6.Option);
++
++  CopyMem (Cursor, &RequestOpt, sizeof (RequestOpt));
++  Cursor += sizeof (RequestOpt);
++
++  // Update the packet length
++  Packet->Length = (UINT16)(Cursor - (UINT8 *)Packet);
++  Packet->Size   = PACKET_SIZE;
++
++  ASSERT_EQ (PxeBcRequestBootService (&(PxeBcRequestBootServiceTest::Private), Index), EFI_OUT_OF_RESOURCES);
++}
++
++///////////////////////////////////////////////////////////////////////////////
++// PxeBcDhcp6Discover Test
++///////////////////////////////////////////////////////////////////////////////
++
++class PxeBcDhcp6DiscoverTest : public ::testing::Test {
++public:
++  PXEBC_PRIVATE_DATA Private = { 0 };
++  EFI_UDP6_PROTOCOL Udp6Read;
++
++protected:
++  MockUefiRuntimeServicesTableLib RtServicesMock;
++
++  // Add any setup code if needed
++  virtual void
++  SetUp (
++    )
++  {
++    Private.Dhcp6Request = (EFI_DHCP6_PACKET *)AllocateZeroPool (PACKET_SIZE);
++
++    // Need to setup the EFI_PXE_BASE_CODE_PROTOCOL
++    // The function under test really only needs the following:
++    //  UdpWrite
++    //  UdpRead
++
++    Private.PxeBc.UdpWrite = (EFI_PXE_BASE_CODE_UDP_WRITE)MockUdpWrite;
++    Private.PxeBc.UdpRead  = (EFI_PXE_BASE_CODE_UDP_READ)MockUdpRead;
++
++    // Need to setup EFI_UDP6_PROTOCOL
++    // The function under test really only needs the following:
++    //  Configure
++
++    Udp6Read.Configure = (EFI_UDP6_CONFIGURE)MockConfigure;
++    Private.Udp6Read   = &Udp6Read;
++  }
++
++  // Add any cleanup code if needed
++  virtual void
++  TearDown (
++    )
++  {
++    if (Private.Dhcp6Request != NULL) {
++      FreePool (Private.Dhcp6Request);
++    }
++
++    // Clean up any resources or variables
++  }
++};
++
++// Test Description
++// This will cause an overflow by an untrusted packet during the option parsing
++TEST_F (PxeBcDhcp6DiscoverTest, BasicOverflowTest) {
++  EFI_IPv6_ADDRESS         DestIp     = { 0 };
++  EFI_DHCP6_PACKET_OPTION  RequestOpt = { 0 }; // the data section doesn't really matter
++
++  RequestOpt.OpCode = HTONS (0x1337);
++  RequestOpt.OpLen  = HTONS (0xFFFF); // overflow
++
++  UINT8  *Cursor = (UINT8 *)(Private.Dhcp6Request->Dhcp6.Option);
++
++  CopyMem (Cursor, &RequestOpt, sizeof (RequestOpt));
++  Cursor += sizeof (RequestOpt);
++
++  Private.Dhcp6Request->Length = (UINT16)(Cursor - (UINT8 *)Private.Dhcp6Request);
++
++  EXPECT_CALL (RtServicesMock, gRT_GetTime)
++    .WillOnce (::testing::Return (0));
++
++  ASSERT_EQ (
++    PxeBcDhcp6Discover (
++      &(PxeBcDhcp6DiscoverTest::Private),
++      0,
++      NULL,
++      FALSE,
++      (EFI_IP_ADDRESS *)&DestIp
++      ),
++    EFI_OUT_OF_RESOURCES
++    );
++}
++
++// Test Description
++// This will test that we can handle a packet with a valid option length
++TEST_F (PxeBcDhcp6DiscoverTest, BasicUsageTest) {
++  EFI_IPv6_ADDRESS         DestIp     = { 0 };
++  EFI_DHCP6_PACKET_OPTION  RequestOpt = { 0 }; // the data section doesn't really matter
++
++  RequestOpt.OpCode = HTONS (0x1337);
++  RequestOpt.OpLen  = HTONS (0x30);
++
++  UINT8  *Cursor = (UINT8 *)(Private.Dhcp6Request->Dhcp6.Option);
++
++  CopyMem (Cursor, &RequestOpt, sizeof (RequestOpt));
++  Cursor += sizeof (RequestOpt);
++
++  Private.Dhcp6Request->Length = (UINT16)(Cursor - (UINT8 *)Private.Dhcp6Request);
++
++  EXPECT_CALL (RtServicesMock, gRT_GetTime)
++    .WillOnce (::testing::Return (0));
++
++  ASSERT_EQ (
++    PxeBcDhcp6Discover (
++      &(PxeBcDhcp6DiscoverTest::Private),
++      0,
++      NULL,
++      FALSE,
++      (EFI_IP_ADDRESS *)&DestIp
++      ),
++    EFI_SUCCESS
++    );
++}
+diff --git a/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h b/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h
+index b17c314791..0d825e4425 100644
+--- a/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h
++++ b/NetworkPkg/UefiPxeBcDxe/GoogleTest/PxeBcDhcp6GoogleTest.h
+@@ -47,4 +47,22 @@ PxeBcCacheDnsServerAddresses (
+   IN PXEBC_DHCP6_PACKET_CACHE  *Cache6
+   );
+ 
++/**
++  Build and send out the request packet for the bootfile, and parse the reply.
++
++  @param[in]  Private               The pointer to PxeBc private data.
++  @param[in]  Index                 PxeBc option boot item type.
++
++  @retval     EFI_SUCCESS           Successfully discovered the boot file.
++  @retval     EFI_OUT_OF_RESOURCES  Failed to allocate resources.
++  @retval     EFI_NOT_FOUND         Can't get the PXE reply packet.
++  @retval     Others                Failed to discover the boot file.
++
++**/
++EFI_STATUS
++PxeBcRequestBootService (
++  IN  PXEBC_PRIVATE_DATA  *Private,
++  IN  UINT32              Index
++  );
++
+ #endif // PXE_BC_DHCP6_GOOGLE_TEST_H_
+-- 
+2.39.3
+

SOURCES/edk2-NetworkPkg-Updating-SecurityFixes.yaml.patch

@@ -0,0 +1,51 @@
+From ababd8837103d4e504cc5d044a13fb9516543795 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Fri, 16 Feb 2024 10:48:05 -0500
+Subject: [PATCH 18/18] NetworkPkg: : Updating SecurityFixes.yaml
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 54: NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Patch
+RH-Jira: RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [18/18] e77d4ea79359b99e7d1073251d67909c2bfdb879
+
+JIRA: https://issues.redhat.com/browse/RHEL-21841
+CVE: CVE-2023-45229
+Upstream: Merged
+
+commit 5fd3078a2e08f607dc86a16c1b184b6e30a34a49
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Tue Feb 13 10:46:03 2024 -0800
+
+    NetworkPkg: : Updating SecurityFixes.yaml
+
+    This captures the related security change for Dhcp6Dxe that is related
+    to CVE-2023-45229
+
+    Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
+    Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ NetworkPkg/SecurityFixes.yaml | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/NetworkPkg/SecurityFixes.yaml b/NetworkPkg/SecurityFixes.yaml
+index 7e900483fe..fa42025e0d 100644
+--- a/NetworkPkg/SecurityFixes.yaml
++++ b/NetworkPkg/SecurityFixes.yaml
+@@ -8,6 +8,7 @@ CVE_2023_45229:
+   commit_titles:
+     - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Patch"
+     - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Unit Tests"
++    - "NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Related Patch"
+   cve: CVE-2023-45229
+   date_reported: 2023-08-28 13:56 UTC
+   description: "Bug 01 - edk2/NetworkPkg: Out-of-bounds read when processing IA_NA/IA_TA options in a DHCPv6 Advertise message"
+-- 
+2.39.3
+

SOURCES/edk2-OvmfPkg-AmdSev-fix-BdsPlatform.c-assertion-failure-d.patch

@@ -1,88 +0,0 @@
-From 673ed284a598bf94d39f01f118158e55e5c04645 Mon Sep 17 00:00:00 2001
-From: Michael Roth <michael.roth@amd.com>
-Date: Wed, 16 Aug 2023 15:11:45 -0500
-Subject: [PATCH 1/3] OvmfPkg/AmdSev: fix BdsPlatform.c assertion failure
- during boot
-
-RH-Author: Gerd Hoffmann <None>
-RH-MergeRequest: 44: OvmfPkg/AmdSev: fix BdsPlatform.c assertion failure during boot
-RH-Bugzilla: 2190244
-RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
-RH-Commit: [1/1] 44f18b2324cbd4aa1840613d9a8d19f0fbec7b1b (kraxel.rh/centos-src-edk2)
-
-Booting an SEV guest with AmdSev OVMF package currently triggers the
-following assertion with QEMU:
-
-  InstallQemuFwCfgTables: installed 7 tables
-  PcRtc: Write 0x20 to CMOS location 0x32
-  [Variable]END_OF_DXE is signaled
-  Initialize variable error flag (FF)
-
-  ASSERT_EFI_ERROR (Status = Not Found)
-  ASSERT [BdsDxe] /home/VT_BUILD/ovmf/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c(1711): !(((INTN)(RETURN_STATUS)(Status)) < 0)
-
-This seems to be due to commit 81dc0d8b4c, which switched to using
-PlatformBootManagerLib instead of PlatformBootManagerLibGrub. That
-pulls in a dependency on gEfiS3SaveStateProtocolGuid provider being
-available (which is asserted for in
-BdsPlatform.c:PlatformBootManagerBeforeConsole()/SaveS3BootScript()),
-but the libraries that provide it aren't currently included in the
-build. Add them similarly to what's done for OvmfPkg.
-
-Fixes: 81dc0d8b4c ("OvmfPkg/AmdSev: stop using PlatformBootManagerLibGrub")
-Cc: Gerd Hoffmann <kraxel@redhat.com>
-Cc: Ray Ni <ray.ni@intel.com>
-Cc: Erdem Aktas <erdemaktas@google.com>
-Cc: James Bottomley <jejb@linux.ibm.com>
-Cc: Jiewen Yao <jiewen.yao@intel.com>
-Cc: Min Xu <min.m.xu@intel.com>
-Cc: Tom Lendacky <thomas.lendacky@amd.com>
-Signed-off-by: Michael Roth <michael.roth@amd.com>
-Acked-by: Jiewen Yao <Jiewen.yao@intel.com>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-ID: <20230816201146.1634348-2-michael.roth@amd.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-
-List-Archive: https://edk2.groups.io/g/devel/message/107806
----
- OvmfPkg/AmdSev/AmdSevX64.dsc | 3 +++
- OvmfPkg/AmdSev/AmdSevX64.fdf | 2 ++
- 2 files changed, 5 insertions(+)
-
-diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
-index 427df673f3..8d165ed05a 100644
---- a/OvmfPkg/AmdSev/AmdSevX64.dsc
-+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
-@@ -199,6 +199,7 @@
- 
-   SmbusLib|MdePkg/Library/BaseSmbusLibNull/BaseSmbusLibNull.inf
-   OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib/BaseOrderedCollectionRedBlackTreeLib.inf
-+  S3BootScriptLib|MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.inf
- 
- !include OvmfPkg/Include/Dsc/OvmfTpmLibs.dsc.inc
- 
-@@ -715,6 +716,8 @@
-   #
-   MdeModulePkg/Universal/Acpi/AcpiTableDxe/AcpiTableDxe.inf
-   OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf
-+  MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf
-+  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
-   MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
- 
-   #
-diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
-index a48c93e2a5..3e6ee61823 100644
---- a/OvmfPkg/AmdSev/AmdSevX64.fdf
-+++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
-@@ -269,6 +269,8 @@ INF  OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.inf
- 
- INF  MdeModulePkg/Universal/Acpi/AcpiTableDxe/AcpiTableDxe.inf
- INF  OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf
-+INF  MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf
-+INF  MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorDxe.inf
- INF  MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphicsResourceTableDxe.inf
- 
- INF  FatPkg/EnhancedFatDxe/Fat.inf
--- 
-2.39.3
-

SOURCES/edk2-OvmfPkg-IoMmuDxe-add-locking-to-IoMmuAllocateBounceB.patch

@@ -1,79 +0,0 @@
-From 7f3f6e3088655e33600aacd886aa51d19c01c59a Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Wed, 19 Jul 2023 18:31:29 +0200
-Subject: [PATCH 2/3] OvmfPkg/IoMmuDxe: add locking to
- IoMmuAllocateBounceBuffer
-
-RH-Author: Gerd Hoffmann <None>
-RH-MergeRequest: 45: OvmfPkg/IoMmuDxe: add locking to IoMmuAllocateBounceBuffer
-RH-Bugzilla: 2211060
-RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
-RH-Commit: [1/1] c4998c57651df23342a0cd6e8982bf59f306da83 (kraxel.rh/centos-src-edk2)
-
-Searching for an unused bounce buffer in mReservedMemBitmap and
-reserving the buffer by flipping the bit is a critical section
-which must not be interrupted.  Raise the TPL level to ensure
-that.
-
-Without this fix it can happen that IoMmuDxe hands out the same
-bounce buffer twice, causing trouble down the road.  Seen happening
-in practice with VirtioNetDxe setting up the network interface (and
-calling into IoMmuDxe from a polling timer callback) in parallel with
-Boot Manager doing some disk I/O.  An ASSERT() in VirtioNet caught
-the buffer inconsistency.
-
-Full story with lots of details and discussions is available here:
-https://bugzilla.redhat.com/show_bug.cgi?id=2211060
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit a52044a9e602bc168cdf5d73a48952bfc9edb521)
----
- OvmfPkg/IoMmuDxe/IoMmuBuffer.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/OvmfPkg/IoMmuDxe/IoMmuBuffer.c b/OvmfPkg/IoMmuDxe/IoMmuBuffer.c
-index c8f6cf4818..103003cae3 100644
---- a/OvmfPkg/IoMmuDxe/IoMmuBuffer.c
-+++ b/OvmfPkg/IoMmuDxe/IoMmuBuffer.c
-@@ -367,7 +367,9 @@ IoMmuAllocateBounceBuffer (
- {
-   EFI_STATUS  Status;
-   UINT32      ReservedMemBitmap;
-+  EFI_TPL     OldTpl;
- 
-+  OldTpl            = gBS->RaiseTPL (TPL_NOTIFY);
-   ReservedMemBitmap = 0;
-   Status            = InternalAllocateBuffer (
-                         Type,
-@@ -378,6 +380,7 @@ IoMmuAllocateBounceBuffer (
-                         );
-   MapInfo->ReservedMemBitmap = ReservedMemBitmap;
-   mReservedMemBitmap        |= ReservedMemBitmap;
-+  gBS->RestoreTPL (OldTpl);
- 
-   ASSERT (Status == EFI_SUCCESS);
- 
-@@ -395,6 +398,8 @@ IoMmuFreeBounceBuffer (
-   IN OUT     MAP_INFO  *MapInfo
-   )
- {
-+  EFI_TPL  OldTpl;
-+
-   if (MapInfo->ReservedMemBitmap == 0) {
-     gBS->FreePages (MapInfo->PlainTextAddress, MapInfo->NumberOfPages);
-   } else {
-@@ -407,9 +412,11 @@ IoMmuFreeBounceBuffer (
-       mReservedMemBitmap,
-       mReservedMemBitmap & ((UINT32)(~MapInfo->ReservedMemBitmap))
-       ));
-+    OldTpl                     = gBS->RaiseTPL (TPL_NOTIFY);
-     MapInfo->PlainTextAddress  = 0;
-     mReservedMemBitmap        &= (UINT32)(~MapInfo->ReservedMemBitmap);
-     MapInfo->ReservedMemBitmap = 0;
-+    gBS->RestoreTPL (OldTpl);
-   }
- 
-   return EFI_SUCCESS;
--- 
-2.39.3
-

SOURCES/edk2-OvmfPkg-MicrovmX64-enable-1G-pages.patch

@@ -1,37 +0,0 @@
-From db07792f9eb095a1f7570b23b1e9dad6edca17a5 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Wed, 17 May 2023 12:24:49 +0200
-Subject: [PATCH 12/12] OvmfPkg/MicrovmX64: enable 1G pages
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 40: enable use of gigabyte pages
-RH-Jira: RHEL-644
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [3/3] 369373082e4dd0be9a4f257e5be9c827cc7de3c5 (kraxel/centos-edk2)
-
-Reduces the memory footprint and speeds up booting.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Acked-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit 04c5b3023e49c35d291f41d2c39b4d12a62b8f9c)
----
- OvmfPkg/Microvm/MicrovmX64.dsc | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
-index 49d1d7ef5c..cc8e3abc45 100644
---- a/OvmfPkg/Microvm/MicrovmX64.dsc
-+++ b/OvmfPkg/Microvm/MicrovmX64.dsc
-@@ -544,6 +544,9 @@
-   gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesCode|0x100
-   gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesData|0x100
- 
-+  # use 1G pages
-+  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable|TRUE
-+
-   #
-   # Network Pcds
-   #
--- 
-2.39.3
-

SOURCES/edk2-OvmfPkg-OvmfPkgIa32X64-enable-1G-pages.patch

@@ -1,37 +0,0 @@
-From 943b4994942d550bef98685d13ffb26d4b5dd665 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Wed, 17 May 2023 12:24:48 +0200
-Subject: [PATCH 11/12] OvmfPkg/OvmfPkgIa32X64: enable 1G pages
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 40: enable use of gigabyte pages
-RH-Jira: RHEL-644
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [2/3] 7385647b30e5096b356a13085a8081de79c916f8 (kraxel/centos-edk2)
-
-Reduces the memory footprint and speeds up booting.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Acked-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit b63e17d746aa6bab2b1101711395725005e71a02)
----
- OvmfPkg/OvmfPkgIa32X64.dsc | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
-index a41bc32454..a6714cea91 100644
---- a/OvmfPkg/OvmfPkgIa32X64.dsc
-+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
-@@ -557,6 +557,9 @@
-   # never lets the RAM below 4 GB exceed 2816 MB.
-   gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress|0xE0000000
- 
-+  # use 1G pages
-+  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable|TRUE
-+
- !if $(SOURCE_DEBUG_ENABLE) == TRUE
-   gEfiSourceLevelDebugPkgTokenSpaceGuid.PcdDebugLoadImageMethod|0x2
- !endif
--- 
-2.39.3
-

SOURCES/edk2-OvmfPkg-PlatformInitLib-check-PcdUse1GPageTable.patch

@@ -1,57 +0,0 @@
-From f24768ae482651073db9050fdaad49afe930b127 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Wed, 17 May 2023 12:24:47 +0200
-Subject: [PATCH 10/12] OvmfPkg/PlatformInitLib: check PcdUse1GPageTable
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 40: enable use of gigabyte pages
-RH-Jira: RHEL-644
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [1/3] 5d8b87d3b6a6b8af4d1a4aabedd8f69c512bf01c (kraxel/centos-edk2)
-
-If PcdUse1GPageTable is not enabled restrict the physical address space
-used to 1TB, to limit the amount of memory needed for identity mapping
-page tables.
-
-The same already happens in case the processor has no support for
-gigabyte pages.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-Acked-by: Ard Biesheuvel <ardb@kernel.org>
-(cherry picked from commit d4d24001f78bcee965d8854fba6f08f48b4ec446)
----
- OvmfPkg/Library/PlatformInitLib/MemDetect.c         | 5 +++++
- OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf | 1 +
- 2 files changed, 6 insertions(+)
-
-diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-index 0482d8906d..662e7e85bb 100644
---- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-+++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-@@ -666,6 +666,11 @@ PlatformAddressWidthFromCpuid (
-       PhysBits = 40;
-     }
- 
-+    if (!FixedPcdGetBool (PcdUse1GPageTable) && (PhysBits > 40)) {
-+      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 40 (PcdUse1GPageTable is false)\n", __func__));
-+      PhysBits = 40;
-+    }
-+
-     PlatformInfoHob->PhysMemAddressWidth = PhysBits;
-     PlatformInfoHob->FirstNonAddress     = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth);
-   }
-diff --git a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
-index 86a82ad3e0..5a79d95b68 100644
---- a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
-+++ b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
-@@ -58,6 +58,7 @@
- 
- [Pcd]
-   gEfiMdePkgTokenSpaceGuid.PcdPciExpressBaseAddress
-+  gEfiMdeModulePkgTokenSpaceGuid.PcdUse1GPageTable
- 
- [FixedPcd]
-   gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase
--- 
-2.39.3
-

SOURCES/edk2-OvmfPkg-PlatformInitLib-limit-phys-bits-to-46.patch

@@ -1,53 +0,0 @@
-From b1643b16a4a70ea576b5f90476fd9c59750eafe8 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 1 Jun 2023 09:57:31 +0200
-Subject: [PATCH 07/12] OvmfPkg/PlatformInitLib: limit phys-bits to 46.
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 41: enable dynamic mmio window
-RH-Bugzilla: 2174749
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [1/2] d08a95b72276cba504176b3837714db67122ed66 (kraxel/centos-edk2)
-
-Older linux kernels have problems with phys-bits larger than 46,
-ubuntu 18.04 (kernel 4.15) has been reported to be affected.
-
-Reduce phys-bits limit from 47 to 46.
-
-Reported-by: Fiona Ebner <f.ebner@proxmox.com>
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit c1e853769046b322690ad336fdb98966757e7414)
----
- OvmfPkg/Library/PlatformInitLib/MemDetect.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-index 86700fc028..aab266399f 100644
---- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-+++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-@@ -646,16 +646,19 @@ PlatformAddressWidthFromCpuid (
-     ));
- 
-   if (Valid) {
--    if (PhysBits > 47) {
-+    if (PhysBits > 46) {
-       /*
-        * Avoid 5-level paging altogether for now, which limits
-        * PhysBits to 48.  Also avoid using address bit 48, due to sign
-        * extension we can't identity-map these addresses (and lots of
-        * places in edk2 assume we have everything identity-mapped).
-        * So the actual limit is 47.
-+       *
-+       * Also some older linux kernels apparently have problems handling
-+       * phys-bits > 46 correctly, so use that as limit.
-        */
--      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 47 (avoid 5-level paging)\n", __func__));
--      PhysBits = 47;
-+      DEBUG ((DEBUG_INFO, "%a: limit PhysBits to 46 (avoid 5-level paging)\n", __func__));
-+      PhysBits = 46;
-     }
- 
-     if (!Page1GSupport && (PhysBits > 40)) {
--- 
-2.39.3
-

SOURCES/edk2-OvmfPkg-ResetVector-Fix-assembler-bit-test-flag-chec.patch

@@ -1,42 +0,0 @@
-From bcc2e81950016f6cda6f3c125bfa7c88a5f8ca8e Mon Sep 17 00:00:00 2001
-From: Tom Lendacky <thomas.lendacky@amd.com>
-Date: Fri, 14 Jul 2023 15:28:26 -0500
-Subject: [PATCH] OvmfPkg/ResetVector: Fix assembler bit test flag check
-
-RH-Author: Gerd Hoffmann <None>
-RH-MergeRequest: 47: OvmfPkg/ResetVector: Fix assembler bit test flag check
-RH-Jira: RHEL-9943
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [1/1] 4565e2863391eb63d598991bc1b394cabd96a466 (kraxel.rh/centos-src-edk2)
-
-Commit 63c50d3ff2854a76432b752af4f2a76f33ff1974 changed the check that is
-used to determine if SEV-ES is active. Originally, a CMP instruction with
-a supporting JZ instruction was used for the check. It was changed to use
-the BT instruction but not JZ instruction. The result of a BT instruction
-changes the the carry flag (CF) and not the zero flag (ZF). As a result,
-the wrong condition is being checked. Update the JZ to a JNC to properly
-detect if SEV-ES is active.
-
-Fixes: 63c50d3ff285 ("OvmfPkg/ResetVector: cache the SEV status MSR...")
-Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
-(cherry picked from commit e674096accc8e57cd0dd84679905e1222423251e)
----
- OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm b/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm
-index c5c683ebed..429a58c5ef 100644
---- a/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm
-+++ b/OvmfPkg/ResetVector/Ia32/Flat32ToFlat64.asm
-@@ -44,7 +44,7 @@ Transition32FlatTo64Flat:
- 
-     mov     ecx, 1
-     bt      [SEV_ES_WORK_AREA_STATUS_MSR], ecx
--    jz      EnablePaging
-+    jnc     EnablePaging
- 
-     ;
-     ; SEV-ES is active, perform a quick sanity check against the reported
--- 
-2.39.3
-

SOURCES/edk2-OvmfPkg-RiscVVirt-use-gEfiAuthenticatedVariableGuid-.patch

@@ -0,0 +1,52 @@
+From 390efa52b8c2b61bcc6f24cc9f3b805798150b6e Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 9 Jan 2024 12:29:00 +0100
+Subject: [PATCH 1/3] OvmfPkg/RiscVVirt: use gEfiAuthenticatedVariableGuid
+ unconditionally
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+ArmVirt and OVMF are doing the same.
+
+See commit d92eaabefbe0 ("OvmfPkg: simplify VARIABLE_STORE_HEADER
+generation") for details.
+
+Suggested-by: László Érsek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Sunil V L <sunilvl@ventanamicro.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240109112902.30002-2-kraxel@redhat.com>
+(cherry picked from commit 3b1ddbddeee64cee5aba4f0170fbf5e4781d4879)
+---
+ OvmfPkg/RiscVVirt/VarStore.fdf.inc | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/OvmfPkg/RiscVVirt/VarStore.fdf.inc b/OvmfPkg/RiscVVirt/VarStore.fdf.inc
+index aba32315cc..6679c246b3 100644
+--- a/OvmfPkg/RiscVVirt/VarStore.fdf.inc
++++ b/OvmfPkg/RiscVVirt/VarStore.fdf.inc
+@@ -36,19 +36,12 @@ DATA = {
+   # Blockmap[1]: End
+   0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+   ## This is the VARIABLE_STORE_HEADER
+-!if $(SECURE_BOOT_ENABLE) == TRUE
++  # It is compatible with SECURE_BOOT_ENABLE == FALSE as well.
+   # Signature: gEfiAuthenticatedVariableGuid =
+   #   { 0xaaf32c78, 0x947b, 0x439a,
+   #     { 0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92 }}
+   0x78, 0x2c, 0xf3, 0xaa, 0x7b, 0x94, 0x9a, 0x43,
+   0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92,
+-!else
+-  # Signature: gEfiVariableGuid =
+-  #   { 0xddcf3616, 0x3275, 0x4164,
+-  #     { 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d }}
+-  0x16, 0x36, 0xcf, 0xdd, 0x75, 0x32, 0x64, 0x41,
+-  0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d,
+-!endif
+   # Size: 0x40000 (gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize) -
+   #         0x48 (size of EFI_FIRMWARE_VOLUME_HEADER) = 0x3FFB8
+   # This can speed up the Variable Dispatch a bit.
+-- 
+2.39.3
+

SOURCES/edk2-OvmfPkg-Sec-Setup-MTRR-early-in-the-boot-process.patch

@@ -0,0 +1,193 @@
+From 7b1298045185749369115719317dc92f58af92d7 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 30 Jan 2024 14:04:38 +0100
+Subject: [PATCH 6/9] OvmfPkg/Sec: Setup MTRR early in the boot process.
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
+RH-Jira: RHEL-21704
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [1/4] c4061788d34f409944898b48642d610c259161f3 (kraxel.rh/centos-src-edk2)
+
+Specifically before running lzma uncompress of the main firmware volume.
+This is needed to make sure caching is enabled, otherwise the uncompress
+can be extremely slow.
+
+Adapt the ASSERTs and MTRR setup in PlatformInitLib to the changes.
+
+Background:  Depending on virtual machine configuration kvm may uses EPT
+memory types to apply guest MTRR settings.  In case MTRRs are disabled
+kvm will use the uncachable memory type for all mappings.  The
+vmx_get_mt_mask() function in the linux kernel handles this and can be
+found here:
+
+https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kvm/vmx/vmx.c?h=v6.7.1#n7580
+
+In most VM configurations kvm uses MTRR_TYPE_WRBACK unconditionally.  In
+case the VM has a mdev device assigned that is not the case though.
+
+Before commit e8aa4c6546ad ("UefiCpuPkg/ResetVector: Cache Disable
+should not be set by default in CR0") kvm also ended up using
+MTRR_TYPE_WRBACK due to KVM_X86_QUIRK_CD_NW_CLEARED.  After that commit
+kvm evaluates guest mtrr settings, which why setting up MTRRs early is
+important now.
+
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-ID: <20240130130441.772484-2-kraxel@redhat.com>
+
+[ kraxel: Downstream-only for now.  Timely upstream merge is unlikely
+          due to chinese holidays and rhel-9.4 deadlines are close.
+          QE regression testing passed.  So go with upstream posted
+          series v3 ]
+---
+ OvmfPkg/IntelTdx/Sec/SecMain.c              | 32 +++++++++++++++++++++
+ OvmfPkg/Library/PlatformInitLib/MemDetect.c | 10 +++----
+ OvmfPkg/Sec/SecMain.c                       | 32 +++++++++++++++++++++
+ 3 files changed, 69 insertions(+), 5 deletions(-)
+
+diff --git a/OvmfPkg/IntelTdx/Sec/SecMain.c b/OvmfPkg/IntelTdx/Sec/SecMain.c
+index 42a587adfa..0daddac0a0 100644
+--- a/OvmfPkg/IntelTdx/Sec/SecMain.c
++++ b/OvmfPkg/IntelTdx/Sec/SecMain.c
+@@ -27,6 +27,8 @@
+ #include <Library/TdxHelperLib.h>
+ #include <Library/CcProbeLib.h>
+ #include <Library/PeilessStartupLib.h>
++#include <Register/Intel/ArchitecturalMsr.h>
++#include <Register/Intel/Cpuid.h>
+ 
+ #define SEC_IDT_ENTRY_COUNT  34
+ 
+@@ -48,6 +50,31 @@ IA32_IDT_GATE_DESCRIPTOR  mIdtEntryTemplate = {
+   }
+ };
+ 
++//
++// Enable MTRR early, set default type to write back.
++// Needed to make sure caching is enabled,
++// without this lzma decompress can be very slow.
++//
++STATIC
++VOID
++SecMtrrSetup (
++  VOID
++  )
++{
++  CPUID_VERSION_INFO_EDX           Edx;
++  MSR_IA32_MTRR_DEF_TYPE_REGISTER  DefType;
++
++  AsmCpuid (CPUID_VERSION_INFO, NULL, NULL, NULL, &Edx.Uint32);
++  if (!Edx.Bits.MTRR) {
++    return;
++  }
++
++  DefType.Uint64    = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
++  DefType.Bits.Type = 6; /* write back */
++  DefType.Bits.E    = 1; /* enable */
++  AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
++}
++
+ VOID
+ EFIAPI
+ SecCoreStartupWithStack (
+@@ -204,6 +231,11 @@ SecCoreStartupWithStack (
+   InitializeApicTimer (0, MAX_UINT32, TRUE, 5);
+   DisableApicTimerInterrupt ();
+ 
++  //
++  // Initialize MTRR
++  //
++  SecMtrrSetup ();
++
+   PeilessStartup (&SecCoreData);
+ 
+   ASSERT (FALSE);
+diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
+index 662e7e85bb..f8d7f5bf1c 100644
+--- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
++++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
+@@ -1035,18 +1035,18 @@ PlatformQemuInitializeRam (
+     MtrrGetAllMtrrs (&MtrrSettings);
+ 
+     //
+-    // MTRRs disabled, fixed MTRRs disabled, default type is uncached
++    // See SecMtrrSetup(), default type should be write back
+     //
+-    ASSERT ((MtrrSettings.MtrrDefType & BIT11) == 0);
++    ASSERT ((MtrrSettings.MtrrDefType & BIT11) != 0);
+     ASSERT ((MtrrSettings.MtrrDefType & BIT10) == 0);
+-    ASSERT ((MtrrSettings.MtrrDefType & 0xFF) == 0);
++    ASSERT ((MtrrSettings.MtrrDefType & 0xFF) == MTRR_CACHE_WRITE_BACK);
+ 
+     //
+     // flip default type to writeback
+     //
+-    SetMem (&MtrrSettings.Fixed, sizeof MtrrSettings.Fixed, 0x06);
++    SetMem (&MtrrSettings.Fixed, sizeof MtrrSettings.Fixed, MTRR_CACHE_WRITE_BACK);
+     ZeroMem (&MtrrSettings.Variables, sizeof MtrrSettings.Variables);
+-    MtrrSettings.MtrrDefType |= BIT11 | BIT10 | 6;
++    MtrrSettings.MtrrDefType |= BIT10;
+     MtrrSetAllMtrrs (&MtrrSettings);
+ 
+     //
+diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
+index 31da5d0ace..3b7dc7205d 100644
+--- a/OvmfPkg/Sec/SecMain.c
++++ b/OvmfPkg/Sec/SecMain.c
+@@ -30,6 +30,8 @@
+ #include <Ppi/MpInitLibDep.h>
+ #include <Library/TdxHelperLib.h>
+ #include <Library/CcProbeLib.h>
++#include <Register/Intel/ArchitecturalMsr.h>
++#include <Register/Intel/Cpuid.h>
+ #include "AmdSev.h"
+ 
+ #define SEC_IDT_ENTRY_COUNT  34
+@@ -744,6 +746,31 @@ FindAndReportEntryPoints (
+   return;
+ }
+ 
++//
++// Enable MTRR early, set default type to write back.
++// Needed to make sure caching is enabled,
++// without this lzma decompress can be very slow.
++//
++STATIC
++VOID
++SecMtrrSetup (
++  VOID
++  )
++{
++  CPUID_VERSION_INFO_EDX           Edx;
++  MSR_IA32_MTRR_DEF_TYPE_REGISTER  DefType;
++
++  AsmCpuid (CPUID_VERSION_INFO, NULL, NULL, NULL, &Edx.Uint32);
++  if (!Edx.Bits.MTRR) {
++    return;
++  }
++
++  DefType.Uint64    = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
++  DefType.Bits.Type = 6; /* write back */
++  DefType.Bits.E    = 1; /* enable */
++  AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
++}
++
+ VOID
+ EFIAPI
+ SecCoreStartupWithStack (
+@@ -942,6 +969,11 @@ SecCoreStartupWithStack (
+   InitializeApicTimer (0, MAX_UINT32, TRUE, 5);
+   DisableApicTimerInterrupt ();
+ 
++  //
++  // Initialize MTRR
++  //
++  SecMtrrSetup ();
++
+   //
+   // Initialize Debug Agent to support source level debug in SEC/PEI phases before memory ready.
+   //
+-- 
+2.39.3
+

SOURCES/edk2-OvmfPkg-Sec-use-cache-type-defines-from-Architectura.patch

@@ -0,0 +1,49 @@
+From 0e2a3df10d784fd38ceee2f6a733032d1333281f Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 30 Jan 2024 14:04:41 +0100
+Subject: [PATCH 9/9] OvmfPkg/Sec: use cache type #defines from
+ ArchitecturalMsr.h
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
+RH-Jira: RHEL-21704
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Commit: [4/4] 55f00e3e153ca945ca458e7abc26780a8d83ac85 (kraxel.rh/centos-src-edk2)
+
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-ID: <20240130130441.772484-5-kraxel@redhat.com>
+---
+ OvmfPkg/IntelTdx/Sec/SecMain.c | 2 +-
+ OvmfPkg/Sec/SecMain.c          | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/OvmfPkg/IntelTdx/Sec/SecMain.c b/OvmfPkg/IntelTdx/Sec/SecMain.c
+index 0daddac0a0..c00b852f0e 100644
+--- a/OvmfPkg/IntelTdx/Sec/SecMain.c
++++ b/OvmfPkg/IntelTdx/Sec/SecMain.c
+@@ -70,7 +70,7 @@ SecMtrrSetup (
+   }
+ 
+   DefType.Uint64    = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
+-  DefType.Bits.Type = 6; /* write back */
++  DefType.Bits.Type = MSR_IA32_MTRR_CACHE_WRITE_BACK;
+   DefType.Bits.E    = 1; /* enable */
+   AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
+ }
+diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
+index 3b7dc7205d..aa0fa1b1ec 100644
+--- a/OvmfPkg/Sec/SecMain.c
++++ b/OvmfPkg/Sec/SecMain.c
+@@ -766,7 +766,7 @@ SecMtrrSetup (
+   }
+ 
+   DefType.Uint64    = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
+-  DefType.Bits.Type = 6; /* write back */
++  DefType.Bits.Type = MSR_IA32_MTRR_CACHE_WRITE_BACK;
+   DefType.Bits.E    = 1; /* enable */
+   AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
+ }
+-- 
+2.39.3
+

SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-ValidateFvHeader-unwritten-s.patch

@@ -0,0 +1,48 @@
+From cfcef96bb3c63342d4fb87cf0cda8e9dcaef9b2b Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jan 2024 18:11:04 +0100
+Subject: [PATCH 5/6] OvmfPkg/VirtNorFlashDxe: ValidateFvHeader: unwritten
+ state is EOL too
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 52: OvmfPkg/VirtNorFlashDxe: backport more fixes.
+RH-Jira: RHEL-20963
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [5/6] 24a9f2d03eeaf61ea8f0ea5a40f0921994b08688 (kraxel.rh/centos-src-edk2)
+
+It is possible to find variable entries with State being 0xff, i.e. not
+updated since flash block erase.   This indicates the variable driver
+could not complete the header write while appending a new entry, and
+therefore State was not set to VAR_HEADER_VALID_ONLY.
+
+This can only happen at the end of the variable list, so treat this as
+additional "end of variable list" condition.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240116171105.37831-6-kraxel@redhat.com>
+(cherry picked from commit 735d0a5e2e25c1577bf9bea7826da937ca38169d)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+index 8fcd999ac6..c8b5e0be13 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
++++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+@@ -302,6 +302,11 @@ ValidateFvHeader (
+       break;
+     }
+ 
++    if (VarHeader->State == 0xff) {
++      DEBUG ((DEBUG_INFO, "%a: end of var list (unwritten state)\n", __func__));
++      break;
++    }
++
+     VarName = NULL;
+     switch (VarHeader->State) {
+       // usage: State = VAR_HEADER_VALID_ONLY
+-- 
+2.39.3
+

SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-add-a-loop-for-NorFlashWrite.patch

@@ -0,0 +1,74 @@
+From a82176278e664c3955197d1e076188471d88a422 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jan 2024 18:11:02 +0100
+Subject: [PATCH 3/6] OvmfPkg/VirtNorFlashDxe: add a loop for
+ NorFlashWriteBuffer calls.
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 52: OvmfPkg/VirtNorFlashDxe: backport more fixes.
+RH-Jira: RHEL-20963
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [3/6] 993426855451252f1126348e107e386b07314bfd (kraxel.rh/centos-src-edk2)
+
+Replace the two NorFlashWriteBuffer() calls with a loop containing a
+single NorFlashWriteBuffer() call.
+
+With the changes in place the code is able to handle updates larger
+than two P30_MAX_BUFFER_SIZE_IN_BYTES blocks, even though the patch
+does not actually change the size limit.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240116171105.37831-4-kraxel@redhat.com>
+(cherry picked from commit 28ffd726894f11a587a6ac7f71a4c4af341e24d2)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 21 ++++++++-------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 88a4d2c23f..3d1343b381 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
++++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -521,6 +521,7 @@ NorFlashWriteSingleBlock (
+   UINTN       BlockAddress;
+   UINT8       *OrigData;
+   UINTN       Start, End;
++  UINT32      Index, Count;
+ 
+   DEBUG ((DEBUG_BLKIO, "NorFlashWriteSingleBlock(Parameters: Lba=%ld, Offset=0x%x, *NumBytes=0x%x, Buffer @ 0x%08x)\n", Lba, Offset, *NumBytes, Buffer));
+ 
+@@ -621,23 +622,17 @@ NorFlashWriteSingleBlock (
+       goto Exit;
+     }
+ 
+-    Status = NorFlashWriteBuffer (
+-               Instance,
+-               BlockAddress + Start,
+-               P30_MAX_BUFFER_SIZE_IN_BYTES,
+-               Instance->ShadowBuffer
+-               );
+-    if (EFI_ERROR (Status)) {
+-      goto Exit;
+-    }
+-
+-    if ((End - Start) > P30_MAX_BUFFER_SIZE_IN_BYTES) {
++    Count = (End - Start) / P30_MAX_BUFFER_SIZE_IN_BYTES;
++    for (Index = 0; Index < Count; Index++) {
+       Status = NorFlashWriteBuffer (
+                  Instance,
+-                 BlockAddress + Start + P30_MAX_BUFFER_SIZE_IN_BYTES,
++                 BlockAddress + Start + Index * P30_MAX_BUFFER_SIZE_IN_BYTES,
+                  P30_MAX_BUFFER_SIZE_IN_BYTES,
+-                 Instance->ShadowBuffer + P30_MAX_BUFFER_SIZE_IN_BYTES
++                 Instance->ShadowBuffer + Index * P30_MAX_BUFFER_SIZE_IN_BYTES
+                  );
++      if (EFI_ERROR (Status)) {
++        goto Exit;
++      }
+     }
+ 
+ Exit:
+-- 
+2.39.3
+

SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-add-casts-to-UINTN-and-UINT3.patch

@@ -0,0 +1,56 @@
+From 74d2d4b58efe72b931bd2979254cb0fa02a38276 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jan 2024 18:11:00 +0100
+Subject: [PATCH 1/6] OvmfPkg/VirtNorFlashDxe: add casts to UINTN and UINT32
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 52: OvmfPkg/VirtNorFlashDxe: backport more fixes.
+RH-Jira: RHEL-20963
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [1/6] ad54e96a5f20907ac591fcfcc0961d353953c4f1 (kraxel.rh/centos-src-edk2)
+
+This is needed to avoid bit operations being applied to signed integers.
+
+Suggested-by: László Érsek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240116171105.37831-2-kraxel@redhat.com>
+(cherry picked from commit 0395045ae307c43a41f72ca9a8bf4eb8f16b2fe0)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 2 +-
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 1afd60ce66..7f4743b003 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
++++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -581,7 +581,7 @@ NorFlashWriteSingleBlock (
+     // contents, while checking whether the old version had any bits cleared
+     // that we want to set. In that case, we will need to erase the block first.
+     for (CurOffset = 0; CurOffset < *NumBytes; CurOffset++) {
+-      if (~OrigData[CurOffset] & Buffer[CurOffset]) {
++      if (~(UINT32)OrigData[CurOffset] & (UINT32)Buffer[CurOffset]) {
+         goto DoErase;
+       }
+ 
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h
+index b7f5d208b2..455eafacc2 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h
++++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.h
+@@ -61,7 +61,7 @@
+ #define P30_MAX_BUFFER_SIZE_IN_BYTES  ((UINTN)128)
+ #define P30_MAX_BUFFER_SIZE_IN_WORDS  (P30_MAX_BUFFER_SIZE_IN_BYTES/((UINTN)4))
+ #define MAX_BUFFERED_PROG_ITERATIONS  10000000
+-#define BOUNDARY_OF_32_WORDS          0x7F
++#define BOUNDARY_OF_32_WORDS          ((UINTN)0x7F)
+ 
+ // CFI Addresses
+ #define P30_CFI_ADDR_QUERY_UNIQUE_QRY  0x10
+-- 
+2.39.3
+

SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-allow-larger-writes-without-.patch

@@ -0,0 +1,66 @@
+From 75774a03a6e0d2f5ca8103bab8d7d31e40624edd Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jan 2024 18:11:03 +0100
+Subject: [PATCH 4/6] OvmfPkg/VirtNorFlashDxe: allow larger writes without
+ block erase
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 52: OvmfPkg/VirtNorFlashDxe: backport more fixes.
+RH-Jira: RHEL-20963
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [4/6] 4bc6828b395ef708201a49001348bb61a0108339 (kraxel.rh/centos-src-edk2)
+
+Raise the limit for writes without block erase from two to four
+P30_MAX_BUFFER_SIZE_IN_BYTES blocks.  With this in place almost all efi
+variable updates are handled without block erase.  With the old limit
+some variable updates (with device paths) took the block erase code
+path.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240116171105.37831-5-kraxel@redhat.com>
+(cherry picked from commit b25733c97442513890ae6bb8e10fd340f13844a7)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 3d1343b381..3d1d20daa1 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
++++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -550,13 +550,15 @@ NorFlashWriteSingleBlock (
+     return EFI_BAD_BUFFER_SIZE;
+   }
+ 
+-  // Pick P30_MAX_BUFFER_SIZE_IN_BYTES (== 128 bytes) as a good start for word
+-  // operations as opposed to erasing the block and writing the data regardless
+-  // if an erase is really needed.  It looks like most individual NV variable
+-  // writes are smaller than 128 bytes.
+-  // To avoid pathological cases were a 2 byte write is disregarded because it
+-  // occurs right at a 128 byte buffered write alignment boundary, permit up to
+-  // twice the max buffer size, and perform two writes if needed.
++  // Pick 4 * P30_MAX_BUFFER_SIZE_IN_BYTES (== 512 bytes) as a good
++  // start for word operations as opposed to erasing the block and
++  // writing the data regardless if an erase is really needed.
++  //
++  // Many NV variable updates are small enough for a a single
++  // P30_MAX_BUFFER_SIZE_IN_BYTES block write.  In case the update is
++  // larger than a single block, or the update crosses a
++  // P30_MAX_BUFFER_SIZE_IN_BYTES boundary (as shown in the diagram
++  // below), or both, we might have to write two or more blocks.
+   //
+   //    0               128              256
+   //    [----------------|----------------]
+@@ -578,7 +580,7 @@ NorFlashWriteSingleBlock (
+   Start = Offset & ~BOUNDARY_OF_32_WORDS;
+   End   = ALIGN_VALUE (Offset + *NumBytes, P30_MAX_BUFFER_SIZE_IN_BYTES);
+ 
+-  if ((End - Start) <= (2 * P30_MAX_BUFFER_SIZE_IN_BYTES)) {
++  if ((End - Start) <= (4 * P30_MAX_BUFFER_SIZE_IN_BYTES)) {
+     // Check to see if we need to erase before programming the data into NOR.
+     // If the destination bits are only changing from 1s to 0s we can just write.
+     // After a block is erased all bits in the block is set to 1.
+-- 
+2.39.3
+

SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-clarify-block-write-logic-fi.patch

@@ -0,0 +1,111 @@
+From ef99dec08d51bad7be0f84942443a8a0e1412c87 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jan 2024 18:11:01 +0100
+Subject: [PATCH 2/6] OvmfPkg/VirtNorFlashDxe: clarify block write logic & fix
+ shadowbuffer reads
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 52: OvmfPkg/VirtNorFlashDxe: backport more fixes.
+RH-Jira: RHEL-20963
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [2/6] e2f2231fd1b7b702aa5372e790c1d2c06ca79f74 (kraxel.rh/centos-src-edk2)
+
+Introduce 'Start' and 'End' variables to make it easier to follow the
+logic and code flow.  Also add a ascii art diagram (based on a
+suggestion by Laszlo).
+
+This also fixes the 'Size' calculation for the NorFlashRead() call.
+Without this patch the code will read only one instead of two
+P30_MAX_BUFFER_SIZE_IN_BYTES blocks in case '*NumBytes' is smaller than
+P30_MAX_BUFFER_SIZE_IN_BYTES but 'Offset + *NumBytes' is not, i.e. the
+update range crosses a P30_MAX_BUFFER_SIZE_IN_BYTES boundary.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240116171105.37831-3-kraxel@redhat.com>
+(cherry picked from commit 35d8ea8097794b522149688b5cfaf8364bc44d54)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 36 ++++++++++++++++++++------
+ 1 file changed, 28 insertions(+), 8 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 7f4743b003..88a4d2c23f 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
++++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -520,6 +520,7 @@ NorFlashWriteSingleBlock (
+   UINTN       BlockSize;
+   UINTN       BlockAddress;
+   UINT8       *OrigData;
++  UINTN       Start, End;
+ 
+   DEBUG ((DEBUG_BLKIO, "NorFlashWriteSingleBlock(Parameters: Lba=%ld, Offset=0x%x, *NumBytes=0x%x, Buffer @ 0x%08x)\n", Lba, Offset, *NumBytes, Buffer));
+ 
+@@ -555,7 +556,28 @@ NorFlashWriteSingleBlock (
+   // To avoid pathological cases were a 2 byte write is disregarded because it
+   // occurs right at a 128 byte buffered write alignment boundary, permit up to
+   // twice the max buffer size, and perform two writes if needed.
+-  if ((*NumBytes + (Offset & BOUNDARY_OF_32_WORDS)) <= (2 * P30_MAX_BUFFER_SIZE_IN_BYTES)) {
++  //
++  //    0               128              256
++  //    [----------------|----------------]
++  //    ^         ^             ^         ^
++  //    |         |             |         |
++  //    |         |             |        End, the next "word" boundary beyond
++  //    |         |             |        the (logical) update
++  //    |         |             |
++  //    |         |     (Offset & BOUNDARY_OF_32_WORDS) + NumBytes;
++  //    |         |     i.e., the relative offset inside (or just past)
++  //    |         |     the *double-word* such that it is the
++  //    |         |     *exclusive* end of the (logical) update.
++  //    |         |
++  //    |         Offset & BOUNDARY_OF_32_WORDS; i.e., Offset within the "word";
++  //    |         this is where the (logical) update is supposed to start
++  //    |
++  //    Start = Offset & ~BOUNDARY_OF_32_WORDS; i.e., Offset truncated to "word" boundary
++
++  Start = Offset & ~BOUNDARY_OF_32_WORDS;
++  End   = ALIGN_VALUE (Offset + *NumBytes, P30_MAX_BUFFER_SIZE_IN_BYTES);
++
++  if ((End - Start) <= (2 * P30_MAX_BUFFER_SIZE_IN_BYTES)) {
+     // Check to see if we need to erase before programming the data into NOR.
+     // If the destination bits are only changing from 1s to 0s we can just write.
+     // After a block is erased all bits in the block is set to 1.
+@@ -565,8 +587,8 @@ NorFlashWriteSingleBlock (
+     Status = NorFlashRead (
+                Instance,
+                Lba,
+-               Offset & ~BOUNDARY_OF_32_WORDS,
+-               (*NumBytes | BOUNDARY_OF_32_WORDS) + 1,
++               Start,
++               End - Start,
+                Instance->ShadowBuffer
+                );
+     if (EFI_ERROR (Status)) {
+@@ -601,7 +623,7 @@ NorFlashWriteSingleBlock (
+ 
+     Status = NorFlashWriteBuffer (
+                Instance,
+-               BlockAddress + (Offset & ~BOUNDARY_OF_32_WORDS),
++               BlockAddress + Start,
+                P30_MAX_BUFFER_SIZE_IN_BYTES,
+                Instance->ShadowBuffer
+                );
+@@ -609,12 +631,10 @@ NorFlashWriteSingleBlock (
+       goto Exit;
+     }
+ 
+-    if ((*NumBytes + (Offset & BOUNDARY_OF_32_WORDS)) > P30_MAX_BUFFER_SIZE_IN_BYTES) {
+-      BlockAddress += P30_MAX_BUFFER_SIZE_IN_BYTES;
+-
++    if ((End - Start) > P30_MAX_BUFFER_SIZE_IN_BYTES) {
+       Status = NorFlashWriteBuffer (
+                  Instance,
+-                 BlockAddress + (Offset & ~BOUNDARY_OF_32_WORDS),
++                 BlockAddress + Start + P30_MAX_BUFFER_SIZE_IN_BYTES,
+                  P30_MAX_BUFFER_SIZE_IN_BYTES,
+                  Instance->ShadowBuffer + P30_MAX_BUFFER_SIZE_IN_BYTES
+                  );
+-- 
+2.39.3
+

SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-move-DoErase-code-block-into.patch

@@ -0,0 +1,132 @@
+From 0429352edb21bd20b8192aec3f484361f4dc3b33 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 16 Jan 2024 18:11:05 +0100
+Subject: [PATCH 6/6] OvmfPkg/VirtNorFlashDxe: move DoErase code block into new
+ function
+
+RH-Author: Gerd Hoffmann <None>
+RH-MergeRequest: 52: OvmfPkg/VirtNorFlashDxe: backport more fixes.
+RH-Jira: RHEL-20963
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Commit: [6/6] 9a25dbbd0d9881664f8ce30efb95c63099785204 (kraxel.rh/centos-src-edk2)
+
+Move the DoErase code block into a separate function, call the function
+instead of jumping around with goto.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-Id: <20240116171105.37831-7-kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit b481b00f593ef37695ee14271453320ed02a1256)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c | 76 ++++++++++++++++++--------
+ 1 file changed, 52 insertions(+), 24 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+index 3d1d20daa1..e6aaed27ce 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
++++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlash.c
+@@ -502,6 +502,38 @@ NorFlashRead (
+   return EFI_SUCCESS;
+ }
+ 
++STATIC
++EFI_STATUS
++NorFlashWriteSingleBlockWithErase (
++  IN        NOR_FLASH_INSTANCE  *Instance,
++  IN        EFI_LBA             Lba,
++  IN        UINTN               Offset,
++  IN OUT    UINTN               *NumBytes,
++  IN        UINT8               *Buffer
++  )
++{
++  EFI_STATUS  Status;
++
++  // Read NOR Flash data into shadow buffer
++  Status = NorFlashReadBlocks (Instance, Lba, Instance->BlockSize, Instance->ShadowBuffer);
++  if (EFI_ERROR (Status)) {
++    // Return one of the pre-approved error statuses
++    return EFI_DEVICE_ERROR;
++  }
++
++  // Put the data at the appropriate location inside the buffer area
++  CopyMem ((VOID *)((UINTN)Instance->ShadowBuffer + Offset), Buffer, *NumBytes);
++
++  // Write the modified buffer back to the NorFlash
++  Status = NorFlashWriteBlocks (Instance, Lba, Instance->BlockSize, Instance->ShadowBuffer);
++  if (EFI_ERROR (Status)) {
++    // Return one of the pre-approved error statuses
++    return EFI_DEVICE_ERROR;
++  }
++
++  return EFI_SUCCESS;
++}
++
+ /*
+   Write a full or portion of a block. It must not span block boundaries; that is,
+   Offset + *NumBytes <= Instance->BlockSize.
+@@ -607,7 +639,14 @@ NorFlashWriteSingleBlock (
+     // that we want to set. In that case, we will need to erase the block first.
+     for (CurOffset = 0; CurOffset < *NumBytes; CurOffset++) {
+       if (~(UINT32)OrigData[CurOffset] & (UINT32)Buffer[CurOffset]) {
+-        goto DoErase;
++        Status = NorFlashWriteSingleBlockWithErase (
++                   Instance,
++                   Lba,
++                   Offset,
++                   NumBytes,
++                   Buffer
++                   );
++        return Status;
+       }
+ 
+       OrigData[CurOffset] = Buffer[CurOffset];
+@@ -636,33 +675,22 @@ NorFlashWriteSingleBlock (
+         goto Exit;
+       }
+     }
+-
+-Exit:
+-    // Put device back into Read Array mode
+-    SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_READ_ARRAY);
+-
++  } else {
++    Status = NorFlashWriteSingleBlockWithErase (
++               Instance,
++               Lba,
++               Offset,
++               NumBytes,
++               Buffer
++               );
+     return Status;
+   }
+ 
+-DoErase:
+-  // Read NOR Flash data into shadow buffer
+-  Status = NorFlashReadBlocks (Instance, Lba, BlockSize, Instance->ShadowBuffer);
+-  if (EFI_ERROR (Status)) {
+-    // Return one of the pre-approved error statuses
+-    return EFI_DEVICE_ERROR;
+-  }
+-
+-  // Put the data at the appropriate location inside the buffer area
+-  CopyMem ((VOID *)((UINTN)Instance->ShadowBuffer + Offset), Buffer, *NumBytes);
+-
+-  // Write the modified buffer back to the NorFlash
+-  Status = NorFlashWriteBlocks (Instance, Lba, BlockSize, Instance->ShadowBuffer);
+-  if (EFI_ERROR (Status)) {
+-    // Return one of the pre-approved error statuses
+-    return EFI_DEVICE_ERROR;
+-  }
++Exit:
++  // Put device back into Read Array mode
++  SEND_NOR_COMMAND (Instance->DeviceBaseAddress, 0, P30_CMD_READ_ARRAY);
+ 
+-  return EFI_SUCCESS;
++  return Status;
+ }
+ 
+ EFI_STATUS
+-- 
+2.39.3
+

SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variables.patch

@@ -0,0 +1,210 @@
+From d557e973e4a400325f68014e463201a5b48c1547 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 9 Jan 2024 12:29:02 +0100
+Subject: [PATCH 3/3] OvmfPkg/VirtNorFlashDxe: sanity-check variables
+
+Extend the ValidateFvHeader function, additionally to the header checks
+walk over the list of variables and sanity check them.
+
+In case we find inconsistencies indicating variable store corruption
+return EFI_NOT_FOUND so the variable store will be re-initialized.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-Id: <20240109112902.30002-4-kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+[lersek@redhat.com: fix StartId initialization/assignment coding style]
+(cherry picked from commit 4a443f73fd67ca8caaf0a3e1a01f8231b330d2e0)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf |   1 +
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c   | 149 +++++++++++++++++++-
+ 2 files changed, 145 insertions(+), 5 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+index 2a3d4a218e..f549400280 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
++++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashDxe.inf
+@@ -34,6 +34,7 @@
+   DxeServicesTableLib
+   HobLib
+   IoLib
++  SafeIntLib
+   UefiBootServicesTableLib
+   UefiDriverEntryPoint
+   UefiLib
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+index 9a614ae4b2..8fcd999ac6 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
++++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+@@ -12,6 +12,7 @@
+ #include <Library/BaseMemoryLib.h>
+ #include <Library/MemoryAllocationLib.h>
+ #include <Library/PcdLib.h>
++#include <Library/SafeIntLib.h>
+ #include <Library/UefiLib.h>
+ 
+ #include <Guid/NvVarStoreFormatted.h>
+@@ -185,11 +186,12 @@ ValidateFvHeader (
+   IN  NOR_FLASH_INSTANCE  *Instance
+   )
+ {
+-  UINT16                      Checksum;
+-  EFI_FIRMWARE_VOLUME_HEADER  *FwVolHeader;
+-  VARIABLE_STORE_HEADER       *VariableStoreHeader;
+-  UINTN                       VariableStoreLength;
+-  UINTN                       FvLength;
++  UINT16                            Checksum;
++  CONST EFI_FIRMWARE_VOLUME_HEADER  *FwVolHeader;
++  CONST VARIABLE_STORE_HEADER       *VariableStoreHeader;
++  UINTN                             VarOffset;
++  UINTN                             VariableStoreLength;
++  UINTN                             FvLength;
+ 
+   FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER *)Instance->RegionBaseAddress;
+ 
+@@ -258,6 +260,143 @@ ValidateFvHeader (
+     return EFI_NOT_FOUND;
+   }
+ 
++  //
++  // check variables
++  //
++  DEBUG ((DEBUG_INFO, "%a: checking variables\n", __func__));
++  VarOffset = sizeof (*VariableStoreHeader);
++  for ( ; ;) {
++    UINTN                                VarHeaderEnd;
++    UINTN                                VarNameEnd;
++    UINTN                                VarEnd;
++    UINTN                                VarPadding;
++    CONST AUTHENTICATED_VARIABLE_HEADER  *VarHeader;
++    CONST CHAR16                         *VarName;
++    CONST CHAR8                          *VarState;
++    RETURN_STATUS                        Status;
++
++    Status = SafeUintnAdd (VarOffset, sizeof (*VarHeader), &VarHeaderEnd);
++    if (RETURN_ERROR (Status)) {
++      DEBUG ((DEBUG_ERROR, "%a: integer overflow\n", __func__));
++      return EFI_NOT_FOUND;
++    }
++
++    if (VarHeaderEnd >= VariableStoreHeader->Size) {
++      if (VarOffset <= VariableStoreHeader->Size - sizeof (UINT16)) {
++        CONST UINT16  *StartId;
++
++        StartId = (VOID *)((UINTN)VariableStoreHeader + VarOffset);
++        if (*StartId == 0x55aa) {
++          DEBUG ((DEBUG_ERROR, "%a: startid at invalid location\n", __func__));
++          return EFI_NOT_FOUND;
++        }
++      }
++
++      DEBUG ((DEBUG_INFO, "%a: end of var list (no space left)\n", __func__));
++      break;
++    }
++
++    VarHeader = (VOID *)((UINTN)VariableStoreHeader + VarOffset);
++    if (VarHeader->StartId != 0x55aa) {
++      DEBUG ((DEBUG_INFO, "%a: end of var list (no startid)\n", __func__));
++      break;
++    }
++
++    VarName = NULL;
++    switch (VarHeader->State) {
++      // usage: State = VAR_HEADER_VALID_ONLY
++      case VAR_HEADER_VALID_ONLY:
++        VarState = "header-ok";
++        VarName  = L"<unknown>";
++        break;
++
++      // usage: State = VAR_ADDED
++      case VAR_ADDED:
++        VarState = "ok";
++        break;
++
++      // usage: State &= VAR_IN_DELETED_TRANSITION
++      case VAR_ADDED &VAR_IN_DELETED_TRANSITION:
++        VarState = "del-in-transition";
++        break;
++
++      // usage: State &= VAR_DELETED
++      case VAR_ADDED &VAR_DELETED:
++      case VAR_ADDED &VAR_DELETED &VAR_IN_DELETED_TRANSITION:
++        VarState = "deleted";
++        break;
++
++      default:
++        DEBUG ((
++          DEBUG_ERROR,
++          "%a: invalid variable state: 0x%x\n",
++          __func__,
++          VarHeader->State
++          ));
++        return EFI_NOT_FOUND;
++    }
++
++    Status = SafeUintnAdd (VarHeaderEnd, VarHeader->NameSize, &VarNameEnd);
++    if (RETURN_ERROR (Status)) {
++      DEBUG ((DEBUG_ERROR, "%a: integer overflow\n", __func__));
++      return EFI_NOT_FOUND;
++    }
++
++    Status = SafeUintnAdd (VarNameEnd, VarHeader->DataSize, &VarEnd);
++    if (RETURN_ERROR (Status)) {
++      DEBUG ((DEBUG_ERROR, "%a: integer overflow\n", __func__));
++      return EFI_NOT_FOUND;
++    }
++
++    if (VarEnd > VariableStoreHeader->Size) {
++      DEBUG ((
++        DEBUG_ERROR,
++        "%a: invalid variable size: 0x%Lx + 0x%Lx + 0x%x + 0x%x > 0x%x\n",
++        __func__,
++        (UINT64)VarOffset,
++        (UINT64)(sizeof (*VarHeader)),
++        VarHeader->NameSize,
++        VarHeader->DataSize,
++        VariableStoreHeader->Size
++        ));
++      return EFI_NOT_FOUND;
++    }
++
++    if (((VarHeader->NameSize & 1) != 0) ||
++        (VarHeader->NameSize < 4))
++    {
++      DEBUG ((DEBUG_ERROR, "%a: invalid name size\n", __func__));
++      return EFI_NOT_FOUND;
++    }
++
++    if (VarName == NULL) {
++      VarName = (VOID *)((UINTN)VariableStoreHeader + VarHeaderEnd);
++      if (VarName[VarHeader->NameSize / 2 - 1] != L'\0') {
++        DEBUG ((DEBUG_ERROR, "%a: name is not null terminated\n", __func__));
++        return EFI_NOT_FOUND;
++      }
++    }
++
++    DEBUG ((
++      DEBUG_VERBOSE,
++      "%a: +0x%04Lx: name=0x%x data=0x%x guid=%g '%s' (%a)\n",
++      __func__,
++      (UINT64)VarOffset,
++      VarHeader->NameSize,
++      VarHeader->DataSize,
++      &VarHeader->VendorGuid,
++      VarName,
++      VarState
++      ));
++
++    VarPadding = (4 - (VarEnd & 3)) & 3;
++    Status     = SafeUintnAdd (VarEnd, VarPadding, &VarOffset);
++    if (RETURN_ERROR (Status)) {
++      DEBUG ((DEBUG_ERROR, "%a: integer overflow\n", __func__));
++      return EFI_NOT_FOUND;
++    }
++  }
++
+   return EFI_SUCCESS;
+ }
+ 
+-- 
+2.39.3
+

SOURCES/edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariableG.patch

@@ -0,0 +1,42 @@
+From 77047a56601aaa955a12030343bdee973b9d393d Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 9 Jan 2024 12:29:01 +0100
+Subject: [PATCH 2/3] OvmfPkg/VirtNorFlashDxe: stop accepting gEfiVariableGuid
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Only accept gEfiAuthenticatedVariableGuid when checking the variable
+store header in ValidateFvHeader().
+
+The edk2 code base has been switched to use the authenticated varstore
+format unconditionally (even in case secure boot is not used or
+supported) a few years ago.
+
+Suggested-by: László Érsek <lersek@redhat.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Message-Id: <20240109112902.30002-3-kraxel@redhat.com>
+(cherry picked from commit ae22b2f136bcbd27135a5f4dd76d3a68a172d00e)
+---
+ OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+index 5ee98e9b59..9a614ae4b2 100644
+--- a/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
++++ b/OvmfPkg/VirtNorFlashDxe/VirtNorFlashFvb.c
+@@ -239,9 +239,7 @@ ValidateFvHeader (
+   VariableStoreHeader = (VARIABLE_STORE_HEADER *)((UINTN)FwVolHeader + FwVolHeader->HeaderLength);
+ 
+   // Check the Variable Store Guid
+-  if (!CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) &&
+-      !CompareGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid))
+-  {
++  if (!CompareGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid)) {
+     DEBUG ((
+       DEBUG_INFO,
+       "%a: Variable Store Guid non-compatible\n",
+-- 
+2.39.3
+

SOURCES/edk2-OvmfPkg-VirtioSerialDxe-Remove-noisy-debug-print-on-.patch

@@ -1,42 +0,0 @@
-From 60a5604388fa73872d67e9ed46a29c7fd0e4fc32 Mon Sep 17 00:00:00 2001
-From: Ard Biesheuvel <ardb@kernel.org>
-Date: Tue, 27 Jun 2023 13:14:06 +0200
-Subject: [PATCH 06/12] OvmfPkg/VirtioSerialDxe: Remove noisy debug print on
- supported() call
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-RH-Jira: RHEL-643
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [6/6] 62b611c1d82f1b87cac2a07655ca37117d438989 (kraxel/centos-edk2)
-
-The UEFI driver model invokes the supported() method on every driver
-every time a connection attempt is made on any handle, and so doing an
-unconditional DEBUG() print inside this method produced a lot of noise.
-
-So let's drop this DEBUG() call from the VirtioSerial driver's
-Supported() method.
-
-Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit ea7a3015a2404e1358218463dd25df5ae7615352)
----
- OvmfPkg/VirtioSerialDxe/VirtioSerial.c | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/OvmfPkg/VirtioSerialDxe/VirtioSerial.c b/OvmfPkg/VirtioSerialDxe/VirtioSerial.c
-index bfb2b324ea..9e27a519f4 100644
---- a/OvmfPkg/VirtioSerialDxe/VirtioSerial.c
-+++ b/OvmfPkg/VirtioSerialDxe/VirtioSerial.c
-@@ -510,8 +510,6 @@ VirtioSerialDriverBindingSupported (
-     Status = EFI_UNSUPPORTED;
-   }
- 
--  DEBUG ((DEBUG_INFO, "%a:%d: subsystem %d -> %r\n", __func__, __LINE__, VirtIo->SubSystemDeviceId, Status));
--
-   //
-   // We needed VirtIo access only transitorily, to see whether we support the
-   // device or not.
--- 
-2.39.3
-

SOURCES/edk2-OvmfPkg-VirtioSerialDxe-use-TPL_NOTIFY.patch

@@ -1,45 +0,0 @@
-From 2ab130462062bfcd66d3047eaa6947a151296a21 Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Fri, 12 May 2023 16:23:06 +0200
-Subject: [PATCH 05/12] OvmfPkg/VirtioSerialDxe: use TPL_NOTIFY
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 39: ArmVirt: add VirtioSerialDxe to ArmVirtQemu builds
-RH-Jira: RHEL-643
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [5/6] 08998538804a8d62903e44e716bcafd9674d208f (kraxel/centos-edk2)
-
-Apparently TPL_CALLBACK is too low, code runs into an ASSERT
-complaining the new TPL is lower than the old TPL.
-
-Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
-(cherry picked from commit 4e5a804222415ec7b2bec90ea0300b8a9f60f131)
----
- OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c b/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
-index 522b25e969..e4a58deff1 100644
---- a/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
-+++ b/OvmfPkg/VirtioSerialDxe/VirtioSerialPort.c
-@@ -158,7 +158,7 @@ VirtioSerialIoWrite (
- 
-   VirtioSerialRingClearTx (SerialIo->Dev, PortTx (SerialIo->PortId));
- 
--  OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
-+  OldTpl = gBS->RaiseTPL (TPL_NOTIFY);
-   if (SerialIo->WriteOffset &&
-       (SerialIo->WriteOffset + *BufferSize > PORT_TX_BUFSIZE))
-   {
-@@ -201,7 +201,7 @@ VirtioSerialIoRead (
-     goto NoData;
-   }
- 
--  OldTpl = gBS->RaiseTPL (TPL_CALLBACK);
-+  OldTpl = gBS->RaiseTPL (TPL_NOTIFY);
-   if (SerialIo->WriteOffset) {
-     DEBUG ((DEBUG_VERBOSE, "%a:%d: WriteFlush %d\n", __func__, __LINE__, SerialIo->WriteOffset));
-     VirtioSerialRingSendBuffer (
--- 
-2.39.3
-

SOURCES/edk2-OvmfPkg-wire-up-RngDxe.patch

@@ -0,0 +1,330 @@
+From e22e11cc37c3bf3530ea8db1d18371c47c9e4440 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 10:34:22 -0400
+Subject: [PATCH 6/8] OvmfPkg: wire up RngDxe
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 75: NetworkPkg: SECURITY PATCH CVE-2023-45236 and CVE-2023-45237
+RH-Jira: RHEL-40270 RHEL-40272
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [6/8] 4adf88888386923ee824469cf836b4f63117807d
+
+JIRA: https://issues.redhat.com/browse/RHEL-40270
+Upstream: Merged
+CVE: CVE-2023-45237
+Conflicts: Cherry pick wanted to add include files from the
+           missing 'add ShellComponents' (commit 2cb466cc2cbf...)
+	   series. This had to be handled manually.
+
+commit 712797cf19acd292bf203522a79e40e7e13d268b
+Author: Gerd Hoffmann <kraxel@redhat.com>
+Date:   Fri May 24 12:51:17 2024 +0200
+
+    OvmfPkg: wire up RngDxe
+
+    Add OvmfRng include snippets with the random number generator
+    configuration for OVMF.  Include RngDxe, build with BaseRngLib,
+    so the rdrand instruction is used (if available).
+
+    Also move VirtioRng to the include snippets.
+
+    Use the new include snippets for OVMF builds.
+
+    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ OvmfPkg/AmdSev/AmdSevX64.dsc                  | 2 +-
+ OvmfPkg/AmdSev/AmdSevX64.fdf                  | 3 ++-
+ OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc | 9 +++++++++
+ OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc        | 6 ++++++
+ OvmfPkg/IntelTdx/IntelTdxX64.dsc              | 2 +-
+ OvmfPkg/IntelTdx/IntelTdxX64.fdf              | 3 ++-
+ OvmfPkg/Microvm/MicrovmX64.dsc                | 2 +-
+ OvmfPkg/Microvm/MicrovmX64.fdf                | 3 ++-
+ OvmfPkg/OvmfPkgIa32.dsc                       | 2 +-
+ OvmfPkg/OvmfPkgIa32.fdf                       | 3 ++-
+ OvmfPkg/OvmfPkgIa32X64.dsc                    | 2 +-
+ OvmfPkg/OvmfPkgIa32X64.fdf                    | 3 ++-
+ OvmfPkg/OvmfPkgX64.dsc                        | 2 +-
+ OvmfPkg/OvmfPkgX64.fdf                        | 3 ++-
+ 14 files changed, 33 insertions(+), 12 deletions(-)
+ create mode 100644 OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
+ create mode 100644 OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
+
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
+index 7bb6ffb3f0..5d50e77002 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
++++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
+@@ -651,7 +651,6 @@
+   OvmfPkg/Virtio10Dxe/Virtio10.inf
+   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -763,6 +762,7 @@
+       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
+   }
+ !endif
++!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
+ 
+   OvmfPkg/PlatformDxe/Platform.inf
+   OvmfPkg/AmdSevDxe/AmdSevDxe.inf {
+diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
+index 0e3d7bea2b..c94f2d34ee 100644
+--- a/OvmfPkg/AmdSev/AmdSevX64.fdf
++++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
+@@ -220,7 +220,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
+ INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
+ INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+ INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+ INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -316,6 +315,8 @@ INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
+ #
+ !include OvmfPkg/Include/Fdf/OvmfTpmDxe.fdf.inc
+ 
++!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
++
+ ################################################################################
+ 
+ [FV.FVMAIN_COMPACT]
+diff --git a/OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc b/OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
+new file mode 100644
+index 0000000000..68839a0caa
+--- /dev/null
++++ b/OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
+@@ -0,0 +1,9 @@
++##
++#    SPDX-License-Identifier: BSD-2-Clause-Patent
++##
++
++  SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf {
++    <LibraryClasses>
++      RngLib|MdePkg/Library/BaseRngLib/BaseRngLib.inf
++  }
++  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+diff --git a/OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc b/OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
+new file mode 100644
+index 0000000000..99cb4a32b1
+--- /dev/null
++++ b/OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
+@@ -0,0 +1,6 @@
++##
++#    SPDX-License-Identifier: BSD-2-Clause-Patent
++##
++
++INF  SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
++INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
+index fd6722499a..d38fed2171 100644
+--- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
++++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
+@@ -641,7 +641,6 @@
+   OvmfPkg/Virtio10Dxe/Virtio10.inf
+   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -752,6 +751,7 @@
+       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
+   }
+ !endif
++!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
+ 
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.fdf b/OvmfPkg/IntelTdx/IntelTdxX64.fdf
+index 69ed7a9bc6..077a5c8637 100644
+--- a/OvmfPkg/IntelTdx/IntelTdxX64.fdf
++++ b/OvmfPkg/IntelTdx/IntelTdxX64.fdf
+@@ -285,7 +285,6 @@ READ_LOCK_STATUS   = TRUE
+ #
+ INF  MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
+ INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+ INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+ !endif
+@@ -333,6 +332,8 @@ INF  OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf
+ INF  OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
+ INF  OvmfPkg/PlatformDxe/Platform.inf
+ 
++!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
++
+ ################################################################################
+ 
+ [FV.FVMAIN_COMPACT]
+diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
+index 79f14b5c05..ca6902971f 100644
+--- a/OvmfPkg/Microvm/MicrovmX64.dsc
++++ b/OvmfPkg/Microvm/MicrovmX64.dsc
+@@ -754,7 +754,6 @@
+   OvmfPkg/Virtio10Dxe/Virtio10.inf
+   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+   OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+   MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
+   MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
+@@ -880,6 +879,7 @@
+       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE
+       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
+   }
++!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
+ 
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+diff --git a/OvmfPkg/Microvm/MicrovmX64.fdf b/OvmfPkg/Microvm/MicrovmX64.fdf
+index eda24a3ec9..767ee4b338 100644
+--- a/OvmfPkg/Microvm/MicrovmX64.fdf
++++ b/OvmfPkg/Microvm/MicrovmX64.fdf
+@@ -204,7 +204,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
+ INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
+ INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+ INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ INF  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ 
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+@@ -303,6 +302,8 @@ INF  OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf
+ INF  MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
+ INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
+ 
++!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
++
+ ################################################################################
+ 
+ [FV.FVMAIN_COMPACT]
+diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
+index 83adecc374..4074aa382d 100644
+--- a/OvmfPkg/OvmfPkgIa32.dsc
++++ b/OvmfPkg/OvmfPkgIa32.dsc
+@@ -804,7 +804,6 @@
+   OvmfPkg/Virtio10Dxe/Virtio10.inf
+   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+   OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+@@ -942,6 +941,7 @@
+       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
+   }
+ !endif
++!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
+ 
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
+index 88c57ff5ff..20cfd2788e 100644
+--- a/OvmfPkg/OvmfPkgIa32.fdf
++++ b/OvmfPkg/OvmfPkgIa32.fdf
+@@ -236,7 +236,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
+ INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
+ INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+ INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ INF  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+ INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+@@ -367,6 +366,8 @@ INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
+ #
+ !include OvmfPkg/Include/Fdf/OvmfTpmDxe.fdf.inc
+ 
++!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
++
+ !if $(LOAD_X64_ON_IA32_ENABLE) == TRUE
+ INF  OvmfPkg/CompatImageLoaderDxe/CompatImageLoaderDxe.inf
+ !endif
+diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
+index b47cdf63e7..75ef19bc85 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.dsc
++++ b/OvmfPkg/OvmfPkgIa32X64.dsc
+@@ -822,7 +822,6 @@
+   OvmfPkg/Virtio10Dxe/Virtio10.inf
+   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+   OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+@@ -960,6 +959,7 @@
+       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
+   }
+ !endif
++!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
+ 
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
+index ab5a9bc306..8517c79ba2 100644
+--- a/OvmfPkg/OvmfPkgIa32X64.fdf
++++ b/OvmfPkg/OvmfPkgIa32X64.fdf
+@@ -237,7 +237,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
+ INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
+ INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+ INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ INF  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+ INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+@@ -374,6 +373,8 @@ INF  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
+ #
+ !include OvmfPkg/Include/Fdf/OvmfTpmDxe.fdf.inc
+ 
++!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
++
+ ################################################################################
+ 
+ [FV.FVMAIN_COMPACT]
+diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
+index be3824ec1e..631ff0c788 100644
+--- a/OvmfPkg/OvmfPkgX64.dsc
++++ b/OvmfPkg/OvmfPkgX64.dsc
+@@ -890,7 +890,6 @@
+   OvmfPkg/Virtio10Dxe/Virtio10.inf
+   OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+   OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+   OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+   OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+@@ -1028,6 +1027,7 @@
+       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000
+   }
+ !endif
++!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
+ 
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
+index 851399888f..7ecde357ce 100644
+--- a/OvmfPkg/OvmfPkgX64.fdf
++++ b/OvmfPkg/OvmfPkgX64.fdf
+@@ -262,7 +262,6 @@ INF  OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
+ INF  OvmfPkg/Virtio10Dxe/Virtio10.inf
+ INF  OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
+ INF  OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
+-INF  OvmfPkg/VirtioRngDxe/VirtioRng.inf
+ INF  OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
+ !if $(PVSCSI_ENABLE) == TRUE
+ INF  OvmfPkg/PvScsiDxe/PvScsiDxe.inf
+@@ -408,6 +407,8 @@ INF SecurityPkg/Tcg/TdTcg2Dxe/TdTcg2Dxe.inf
+ #
+ !include OvmfPkg/Include/Fdf/OvmfTpmDxe.fdf.inc
+ 
++!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
++
+ ################################################################################
+ 
+ [FV.FVMAIN_COMPACT]
+-- 
+2.39.3
+

SOURCES/edk2-Revert-OvmfPkg-disable-dynamic-mmio-window-rhel-only.patch

@@ -1,34 +0,0 @@
-From e4fe4b80159b7df136f419da69251f45b62f36ec Mon Sep 17 00:00:00 2001
-From: Gerd Hoffmann <kraxel@redhat.com>
-Date: Thu, 29 Jun 2023 13:37:33 +0200
-Subject: [PATCH 08/12] Revert "OvmfPkg: disable dynamic mmio window (rhel
- only)"
-
-RH-Author: Gerd Hoffmann <kraxel@redhat.com>
-RH-MergeRequest: 41: enable dynamic mmio window
-RH-Bugzilla: 2174749
-RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
-RH-Commit: [2/2] 10ace0e012602153f82fccee3c555be40b3c6753 (kraxel/centos-edk2)
-
-This reverts commit 218d3b32592bffe5ec7317c4838d29e92b4b86f0.
----
- OvmfPkg/Library/PlatformInitLib/MemDetect.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-index aab266399f..0482d8906d 100644
---- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-+++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
-@@ -682,8 +682,7 @@ PlatformDynamicMmioWindow (
-   AddrSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth);
-   MmioSpace = LShiftU64 (1, PlatformInfoHob->PhysMemAddressWidth - 3);
- 
--  if (FALSE /* disable for RHEL-9.2, libvirt is not ready yet */ &&
--      (PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
-+  if ((PlatformInfoHob->PcdPciMmio64Size < MmioSpace) &&
-       (PlatformInfoHob->PcdPciMmio64Base + MmioSpace < AddrSpace))
-   {
-     DEBUG ((DEBUG_INFO, "%a: using dynamic mmio window\n", __func__));
--- 
-2.39.3
-

SOURCES/edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch

@@ -0,0 +1,68 @@
+From b3a9b8a85e2782600b4fd26d08a4d15826cadcf7 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 17 Jan 2024 12:20:52 -0500
+Subject: [PATCH 3/3] SecurityPkg: : Adding CVE 2022-36763 to
+ SecurityFixes.yaml
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 51: SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117 - CVE 2022-36763
+RH-Jira: RHEL-21155
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [3/3] 0763dad29bb6b9b3832b166bbabe15e84ed7208c
+
+JIRA: https://issues.redhat.com/browse/RHEL-21155
+Upstream: Merged
+CVE: CVE-2022-36763
+
+commit 1ddcb9fc6b4164e882687b031e8beacfcf7df29e
+Author: Douglas Flick [MSFT] <doug.edk2@gmail.com>
+Date:   Fri Jan 12 02:16:03 2024 +0800
+
+    SecurityPkg: : Adding CVE 2022-36763 to SecurityFixes.yaml
+
+    This creates / adds a security file that tracks the security fixes
+    found in this package and can be used to find the fixes that were
+    applied.
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ SecurityPkg/SecurityFixes.yaml | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+ create mode 100644 SecurityPkg/SecurityFixes.yaml
+
+diff --git a/SecurityPkg/SecurityFixes.yaml b/SecurityPkg/SecurityFixes.yaml
+new file mode 100644
+index 0000000000..f9e3e7be74
+--- /dev/null
++++ b/SecurityPkg/SecurityFixes.yaml
+@@ -0,0 +1,22 @@
++## @file
++# Security Fixes for SecurityPkg
++#
++# Copyright (c) Microsoft Corporation
++# SPDX-License-Identifier: BSD-2-Clause-Patent
++##
++CVE_2022_36763:
++  commit_titles:
++    - "SecurityPkg: DxeTpm2Measurement: SECURITY PATCH 4117 - CVE 2022-36763"
++    - "SecurityPkg: DxeTpmMeasurement: SECURITY PATCH 4117 - CVE 2022-36763"
++    - "SecurityPkg: : Adding CVE 2022-36763 to SecurityFixes.yaml"
++  cve: CVE-2022-36763
++  date_reported: 2022-10-25 11:31 UTC
++  description: (CVE-2022-36763) - Heap Buffer Overflow in Tcg2MeasureGptTable()
++  note: This patch is related to and supersedes TCBZ2168
++  files_impacted:
++  - Library\DxeTpm2MeasureBootLib\DxeTpm2MeasureBootLib.c
++  - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
++  links:
++  - https://bugzilla.tianocore.org/show_bug.cgi?id=4117
++  - https://bugzilla.tianocore.org/show_bug.cgi?id=2168
++  - https://bugzilla.tianocore.org/show_bug.cgi?id=1990
+-- 
+2.39.3
+

SOURCES/edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-2.patch

@@ -0,0 +1,273 @@
+From 31ebaa021650c9b23c27f3a7954d33c1ef1e1502 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 13 Feb 2024 16:30:10 -0500
+Subject: [PATCH 3/9] SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH
+ 4117/4118 symbol rename
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 53: SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764
+RH-Jira: RHEL-21157
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [3/5] d18f14e0a7df36223dab179bf7e9556db43f4c55
+
+JIRA: https://issues.redhat.com/browse/RHEL-21157
+CVE: CVE-2022-36764
+Upstream: Merged
+
+commit 40adbb7f628dee79156c679fb0857968b61b7620
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Wed Jan 17 14:47:20 2024 -0800
+
+    SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117/4118 symbol rename
+
+    Updates the sanitation function names to be lib unique names
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+    Cc: Rahul Kumar <rahul1.kumar@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Message-Id: <7b18434c8a8b561654efd40ced3becb8b378c8f1.1705529990.git.doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeTpm2MeasureBootLib.c                   |  8 +++---
+ .../DxeTpm2MeasureBootLibSanitization.c       |  8 +++---
+ .../DxeTpm2MeasureBootLibSanitization.h       |  8 +++---
+ .../DxeTpm2MeasureBootLibSanitizationTest.c   | 26 +++++++++----------
+ 4 files changed, 25 insertions(+), 25 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+index 714cc8e03e..73719f3b96 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
++++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+@@ -200,7 +200,7 @@ Tcg2MeasureGptTable (
+                      BlockIo->Media->BlockSize,
+                      (UINT8 *)PrimaryHeader
+                      );
+-  if (EFI_ERROR (Status) || EFI_ERROR (SanitizeEfiPartitionTableHeader (PrimaryHeader, BlockIo))) {
++  if (EFI_ERROR (Status) || EFI_ERROR (Tpm2SanitizeEfiPartitionTableHeader (PrimaryHeader, BlockIo))) {
+     DEBUG ((DEBUG_ERROR, "Failed to read Partition Table Header or invalid Partition Table Header!\n"));
+     FreePool (PrimaryHeader);
+     return EFI_DEVICE_ERROR;
+@@ -209,7 +209,7 @@ Tcg2MeasureGptTable (
+   //
+   // Read the partition entry.
+   //
+-  Status = SanitizePrimaryHeaderAllocationSize (PrimaryHeader, &AllocSize);
++  Status = Tpm2SanitizePrimaryHeaderAllocationSize (PrimaryHeader, &AllocSize);
+   if (EFI_ERROR (Status)) {
+     FreePool (PrimaryHeader);
+     return EFI_BAD_BUFFER_SIZE;
+@@ -250,7 +250,7 @@ Tcg2MeasureGptTable (
+   //
+   // Prepare Data for Measurement (CcProtocol and Tcg2Protocol)
+   //
+-  Status = SanitizePrimaryHeaderGptEventSize (PrimaryHeader, NumberOfPartition, &TcgEventSize);
++  Status = Tpm2SanitizePrimaryHeaderGptEventSize (PrimaryHeader, NumberOfPartition, &TcgEventSize);
+   if (EFI_ERROR (Status)) {
+     FreePool (PrimaryHeader);
+     FreePool (EntryPtr);
+@@ -420,7 +420,7 @@ Tcg2MeasurePeImage (
+   }
+ 
+   FilePathSize = (UINT32)GetDevicePathSize (FilePath);
+-  Status       = SanitizePeImageEventSize (FilePathSize, &EventSize);
++  Status       = Tpm2SanitizePeImageEventSize (FilePathSize, &EventSize);
+   if (EFI_ERROR (Status)) {
+     return EFI_UNSUPPORTED;
+   }
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
+index 2a4d52c6d5..809a3bfd89 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
++++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
+@@ -63,7 +63,7 @@
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizeEfiPartitionTableHeader (
++Tpm2SanitizeEfiPartitionTableHeader (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN CONST EFI_BLOCK_IO_PROTOCOL       *BlockIo
+   )
+@@ -169,7 +169,7 @@ SanitizeEfiPartitionTableHeader (
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizePrimaryHeaderAllocationSize (
++Tpm2SanitizePrimaryHeaderAllocationSize (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   OUT UINT32                           *AllocationSize
+   )
+@@ -221,7 +221,7 @@ SanitizePrimaryHeaderAllocationSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePrimaryHeaderGptEventSize (
++Tpm2SanitizePrimaryHeaderGptEventSize (
+   IN  CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN  UINTN                             NumberOfPartition,
+   OUT UINT32                            *EventSize
+@@ -292,7 +292,7 @@ SanitizePrimaryHeaderGptEventSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePeImageEventSize (
++Tpm2SanitizePeImageEventSize (
+   IN  UINT32  FilePathSize,
+   OUT UINT32  *EventSize
+   )
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
+index 8f72ba4240..8526bc7537 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
++++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
+@@ -54,7 +54,7 @@
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizeEfiPartitionTableHeader (
++Tpm2SanitizeEfiPartitionTableHeader (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN CONST EFI_BLOCK_IO_PROTOCOL       *BlockIo
+   );
+@@ -78,7 +78,7 @@ SanitizeEfiPartitionTableHeader (
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizePrimaryHeaderAllocationSize (
++Tpm2SanitizePrimaryHeaderAllocationSize (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   OUT UINT32                           *AllocationSize
+   );
+@@ -107,7 +107,7 @@ SanitizePrimaryHeaderAllocationSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePrimaryHeaderGptEventSize (
++Tpm2SanitizePrimaryHeaderGptEventSize (
+   IN  CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN  UINTN                             NumberOfPartition,
+   OUT UINT32                            *EventSize
+@@ -131,7 +131,7 @@ SanitizePrimaryHeaderGptEventSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePeImageEventSize (
++Tpm2SanitizePeImageEventSize (
+   IN  UINT32  FilePathSize,
+   OUT UINT32  *EventSize
+   );
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
+index 820e99aeb9..50a68e1076 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
++++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
+@@ -84,27 +84,27 @@ TestSanitizeEfiPartitionTableHeader (
+   PrimaryHeader.Header.CRC32 = CalculateCrc32 ((UINT8 *)&PrimaryHeader, PrimaryHeader.Header.HeaderSize);
+ 
+   // Test that a normal PrimaryHeader passes validation
+-  Status = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
++  Status = Tpm2SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_NOT_EFI_ERROR (Status);
+ 
+   // Test that when number of partition entries is 0, the function returns EFI_DEVICE_ERROR
+   // Should print "Invalid Partition Table Header NumberOfPartitionEntries!""
+   PrimaryHeader.NumberOfPartitionEntries = 0;
+-  Status                                 = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
++  Status                                 = Tpm2SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+   PrimaryHeader.NumberOfPartitionEntries = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+ 
+   // Test that when the header size is too small, the function returns EFI_DEVICE_ERROR
+   // Should print "Invalid Partition Table Header Size!"
+   PrimaryHeader.Header.HeaderSize = 0;
+-  Status                          = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
++  Status                          = Tpm2SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+   PrimaryHeader.Header.HeaderSize = sizeof (EFI_PARTITION_TABLE_HEADER);
+ 
+   // Test that when the SizeOfPartitionEntry is too small, the function returns EFI_DEVICE_ERROR
+   // should print: "SizeOfPartitionEntry shall be set to a value of 128 x 2^n where n is an integer greater than or equal to zero (e.g., 128, 256, 512, etc.)!"
+   PrimaryHeader.SizeOfPartitionEntry = 1;
+-  Status                             = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
++  Status                             = Tpm2SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+@@ -137,7 +137,7 @@ TestSanitizePrimaryHeaderAllocationSize (
+   PrimaryHeader.NumberOfPartitionEntries = 5;
+   PrimaryHeader.SizeOfPartitionEntry     = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+ 
+-  Status = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
++  Status = Tpm2SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_NOT_EFI_ERROR (Status);
+ 
+   // Test that the allocation size is correct compared to the existing logic
+@@ -146,19 +146,19 @@ TestSanitizePrimaryHeaderAllocationSize (
+   // Test that an overflow is detected
+   PrimaryHeader.NumberOfPartitionEntries = MAX_UINT32;
+   PrimaryHeader.SizeOfPartitionEntry     = 5;
+-  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
++  Status                                 = Tpm2SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   // Test the inverse
+   PrimaryHeader.NumberOfPartitionEntries = 5;
+   PrimaryHeader.SizeOfPartitionEntry     = MAX_UINT32;
+-  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
++  Status                                 = Tpm2SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   // Test the worst case scenario
+   PrimaryHeader.NumberOfPartitionEntries = MAX_UINT32;
+   PrimaryHeader.SizeOfPartitionEntry     = MAX_UINT32;
+-  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
++  Status                                 = Tpm2SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+@@ -196,7 +196,7 @@ TestSanitizePrimaryHeaderGptEventSize (
+   NumberOfPartition = 13;
+ 
+   // that the primary event size is correct
+-  Status = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
++  Status = Tpm2SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+   UT_ASSERT_NOT_EFI_ERROR (Status);
+ 
+   // Calculate the existing logic event size
+@@ -207,12 +207,12 @@ TestSanitizePrimaryHeaderGptEventSize (
+   UT_ASSERT_EQUAL (EventSize, ExistingLogicEventSize);
+ 
+   // Tests that the primary event size may not overflow
+-  Status = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, MAX_UINT32, &EventSize);
++  Status = Tpm2SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, MAX_UINT32, &EventSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   // Test that the size of partition entries may not overflow
+   PrimaryHeader.SizeOfPartitionEntry = MAX_UINT32;
+-  Status                             = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
++  Status                             = Tpm2SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+@@ -245,7 +245,7 @@ TestSanitizePeImageEventSize (
+   FilePathSize = 255;
+ 
+   // Test that a normal PE image passes validation
+-  Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
++  Status = Tpm2SanitizePeImageEventSize (FilePathSize, &EventSize);
+   UT_ASSERT_EQUAL (Status, EFI_SUCCESS);
+ 
+   // Test that the event size is correct compared to the existing logic
+@@ -258,7 +258,7 @@ TestSanitizePeImageEventSize (
+   }
+ 
+   // Test that the event size may not overflow
+-  Status = SanitizePeImageEventSize (MAX_UINT32, &EventSize);
++  Status = Tpm2SanitizePeImageEventSize (MAX_UINT32, &EventSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+-- 
+2.39.3
+

SOURCES/edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-4118.patch

@@ -0,0 +1,284 @@
+From 808551c1cb2ac9dc9a6287cbc85b167aa9eb2d7e Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 7 Feb 2024 15:43:10 -0500
+Subject: [PATCH 1/9] SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 -
+ CVE 2022-36764
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 53: SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764
+RH-Jira: RHEL-21157
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [1/5] 50edfd997d089549ac41b9592131ac1212fc3431
+
+JIRA: https://issues.redhat.com/browse/RHEL-21157
+CVE: CVE-2022-36764
+Upstream: Merged
+
+commit c7b27944218130cca3bbb20314ba5b88b5de4aa4
+Author: Douglas Flick [MSFT] <doug.edk2@gmail.com>
+Date:   Fri Jan 12 02:16:04 2024 +0800
+
+    SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764
+
+    This commit contains the patch files and tests for DxeTpm2MeasureBootLib
+    CVE 2022-36764.
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeTpm2MeasureBootLib.c                   | 12 ++--
+ .../DxeTpm2MeasureBootLibSanitization.c       | 46 +++++++++++++-
+ .../DxeTpm2MeasureBootLibSanitization.h       | 28 ++++++++-
+ .../DxeTpm2MeasureBootLibSanitizationTest.c   | 60 ++++++++++++++++---
+ 4 files changed, 131 insertions(+), 15 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+index 0475103d6e..714cc8e03e 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
++++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+@@ -378,7 +378,6 @@ Exit:
+   @retval EFI_OUT_OF_RESOURCES   No enough resource to measure image.
+   @retval EFI_UNSUPPORTED        ImageType is unsupported or PE image is mal-format.
+   @retval other error value
+-
+ **/
+ EFI_STATUS
+ EFIAPI
+@@ -405,6 +404,7 @@ Tcg2MeasurePeImage (
+   Status    = EFI_UNSUPPORTED;
+   ImageLoad = NULL;
+   EventPtr  = NULL;
++  Tcg2Event = NULL;
+ 
+   Tcg2Protocol = MeasureBootProtocols->Tcg2Protocol;
+   CcProtocol   = MeasureBootProtocols->CcProtocol;
+@@ -420,18 +420,22 @@ Tcg2MeasurePeImage (
+   }
+ 
+   FilePathSize = (UINT32)GetDevicePathSize (FilePath);
++  Status       = SanitizePeImageEventSize (FilePathSize, &EventSize);
++  if (EFI_ERROR (Status)) {
++    return EFI_UNSUPPORTED;
++  }
+ 
+   //
+   // Determine destination PCR by BootPolicy
+   //
+-  EventSize = sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
+-  EventPtr  = AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event));
++  // from a malicious GPT disk partition
++  EventPtr = AllocateZeroPool (EventSize);
+   if (EventPtr == NULL) {
+     return EFI_OUT_OF_RESOURCES;
+   }
+ 
+   Tcg2Event                       = (EFI_TCG2_EVENT *)EventPtr;
+-  Tcg2Event->Size                 = EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event);
++  Tcg2Event->Size                 = EventSize;
+   Tcg2Event->Header.HeaderSize    = sizeof (EFI_TCG2_EVENT_HEADER);
+   Tcg2Event->Header.HeaderVersion = EFI_TCG2_EVENT_HEADER_VERSION;
+   ImageLoad                       = (EFI_IMAGE_LOAD_EVENT *)Tcg2Event->Event;
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
+index e2309655d3..2a4d52c6d5 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
++++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
+@@ -151,7 +151,7 @@ SanitizeEfiPartitionTableHeader (
+ }
+ 
+ /**
+-  This function will validate that the allocation size from the primary header is sane
++ This function will validate that the allocation size from the primary header is sane
+   It will check the following:
+     - AllocationSize does not overflow
+ 
+@@ -273,3 +273,47 @@ SanitizePrimaryHeaderGptEventSize (
+ 
+   return EFI_SUCCESS;
+ }
++
++/**
++  This function will validate that the PeImage Event Size from the loaded image is sane
++  It will check the following:
++    - EventSize does not overflow
++
++  @param[in] FilePathSize - Size of the file path.
++  @param[out] EventSize - Pointer to the event size.
++
++  @retval EFI_SUCCESS
++    The event size is valid.
++
++  @retval EFI_OUT_OF_RESOURCES
++    Overflow would have occurred.
++
++  @retval EFI_INVALID_PARAMETER
++    One of the passed parameters was invalid.
++**/
++EFI_STATUS
++SanitizePeImageEventSize (
++  IN  UINT32  FilePathSize,
++  OUT UINT32  *EventSize
++  )
++{
++  EFI_STATUS  Status;
++
++  // Replacing logic:
++  // sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
++  Status = SafeUint32Add (OFFSET_OF (EFI_IMAGE_LOAD_EVENT, DevicePath), FilePathSize, EventSize);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_ERROR, "EventSize would overflow!\n"));
++    return EFI_BAD_BUFFER_SIZE;
++  }
++
++  // Replacing logic:
++  // EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event)
++  Status = SafeUint32Add (*EventSize, OFFSET_OF (EFI_TCG2_EVENT, Event), EventSize);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_ERROR, "EventSize would overflow!\n"));
++    return EFI_BAD_BUFFER_SIZE;
++  }
++
++  return EFI_SUCCESS;
++}
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
+index 048b738987..8f72ba4240 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
++++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
+@@ -9,6 +9,9 @@
+   Tcg2MeasureGptTable() function will receive untrusted GPT partition table, and parse
+   partition data carefully.
+ 
++  Tcg2MeasurePeImage() function will accept untrusted PE/COFF image and validate its
++  data structure within this image buffer before use.
++
+   Copyright (c) Microsoft Corporation.<BR>
+   SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
+@@ -110,4 +113,27 @@ SanitizePrimaryHeaderGptEventSize (
+   OUT UINT32                            *EventSize
+   );
+ 
+-#endif // DXE_TPM2_MEASURE_BOOT_LIB_SANITATION_
++/**
++  This function will validate that the PeImage Event Size from the loaded image is sane
++  It will check the following:
++    - EventSize does not overflow
++
++  @param[in] FilePathSize - Size of the file path.
++  @param[out] EventSize - Pointer to the event size.
++
++  @retval EFI_SUCCESS
++    The event size is valid.
++
++  @retval EFI_OUT_OF_RESOURCES
++    Overflow would have occurred.
++
++  @retval EFI_INVALID_PARAMETER
++    One of the passed parameters was invalid.
++**/
++EFI_STATUS
++SanitizePeImageEventSize (
++  IN  UINT32  FilePathSize,
++  OUT UINT32  *EventSize
++  );
++
++#endif // DXE_TPM2_MEASURE_BOOT_LIB_VALIDATION_
+diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
+index 3eb9763e3c..820e99aeb9 100644
+--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
++++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
+@@ -72,10 +72,10 @@ TestSanitizeEfiPartitionTableHeader (
+   PrimaryHeader.Header.Revision          = DEFAULT_PRIMARY_TABLE_HEADER_REVISION;
+   PrimaryHeader.Header.HeaderSize        = sizeof (EFI_PARTITION_TABLE_HEADER);
+   PrimaryHeader.MyLBA                    = 1;
+-  PrimaryHeader.AlternateLBA             = 2;
+-  PrimaryHeader.FirstUsableLBA           = 3;
+-  PrimaryHeader.LastUsableLBA            = 4;
+-  PrimaryHeader.PartitionEntryLBA        = 5;
++  PrimaryHeader.PartitionEntryLBA        = 2;
++  PrimaryHeader.AlternateLBA             = 3;
++  PrimaryHeader.FirstUsableLBA           = 4;
++  PrimaryHeader.LastUsableLBA            = 5;
+   PrimaryHeader.NumberOfPartitionEntries = DEFAULT_PRIMARY_TABLE_HEADER_NUMBER_OF_PARTITION_ENTRIES;
+   PrimaryHeader.SizeOfPartitionEntry     = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+   PrimaryHeader.PartitionEntryArrayCRC32 = 0; // Purposely invalid
+@@ -187,11 +187,6 @@ TestSanitizePrimaryHeaderGptEventSize (
+   EFI_STATUS                  Status;
+   EFI_PARTITION_TABLE_HEADER  PrimaryHeader;
+   UINTN                       NumberOfPartition;
+-  EFI_GPT_DATA                *GptData;
+-  EFI_TCG2_EVENT              *Tcg2Event;
+-
+-  Tcg2Event = NULL;
+-  GptData   = NULL;
+ 
+   // Test that a normal PrimaryHeader passes validation
+   PrimaryHeader.NumberOfPartitionEntries = 5;
+@@ -225,6 +220,52 @@ TestSanitizePrimaryHeaderGptEventSize (
+   return UNIT_TEST_PASSED;
+ }
+ 
++/**
++  This function tests the SanitizePeImageEventSize function.
++  It's intent is to test that the untrusted input from a file path when generating a
++  EFI_IMAGE_LOAD_EVENT structure will not cause an overflow when calculating
++  the event size when allocating space
++
++  @param[in] Context  The unit test context.
++
++  @retval UNIT_TEST_PASSED  The test passed.
++  @retval UNIT_TEST_ERROR_TEST_FAILED  The test failed.
++**/
++UNIT_TEST_STATUS
++EFIAPI
++TestSanitizePeImageEventSize (
++  IN UNIT_TEST_CONTEXT  Context
++  )
++{
++  UINT32      EventSize;
++  UINTN       ExistingLogicEventSize;
++  UINT32      FilePathSize;
++  EFI_STATUS  Status;
++
++  FilePathSize = 255;
++
++  // Test that a normal PE image passes validation
++  Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
++  UT_ASSERT_EQUAL (Status, EFI_SUCCESS);
++
++  // Test that the event size is correct compared to the existing logic
++  ExistingLogicEventSize  = OFFSET_OF (EFI_IMAGE_LOAD_EVENT, DevicePath) + FilePathSize;
++  ExistingLogicEventSize += OFFSET_OF (EFI_TCG2_EVENT, Event);
++
++  if (EventSize != ExistingLogicEventSize) {
++    UT_LOG_ERROR ("SanitizePeImageEventSize returned an incorrect event size. Expected %u, got %u\n", ExistingLogicEventSize, EventSize);
++    return UNIT_TEST_ERROR_TEST_FAILED;
++  }
++
++  // Test that the event size may not overflow
++  Status = SanitizePeImageEventSize (MAX_UINT32, &EventSize);
++  UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
++
++  DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
++
++  return UNIT_TEST_PASSED;
++}
++
+ // *--------------------------------------------------------------------*
+ // *  Unit Test Code Main Function
+ // *--------------------------------------------------------------------*
+@@ -267,6 +308,7 @@ UefiTestMain (
+   AddTestCase (Tcg2MeasureBootLibValidationTestSuite, "Tests Validating EFI Partition Table", "Common.Tcg2MeasureBootLibValidation", TestSanitizeEfiPartitionTableHeader, NULL, NULL, NULL);
+   AddTestCase (Tcg2MeasureBootLibValidationTestSuite, "Tests Primary header gpt event checks for overflow", "Common.Tcg2MeasureBootLibValidation", TestSanitizePrimaryHeaderAllocationSize, NULL, NULL, NULL);
+   AddTestCase (Tcg2MeasureBootLibValidationTestSuite, "Tests Primary header allocation size checks for overflow", "Common.Tcg2MeasureBootLibValidation", TestSanitizePrimaryHeaderGptEventSize, NULL, NULL, NULL);
++  AddTestCase (Tcg2MeasureBootLibValidationTestSuite, "Tests PE Image and FileSize checks for overflow", "Common.Tcg2MeasureBootLibValidation", TestSanitizePeImageEventSize, NULL, NULL, NULL);
+ 
+   Status = RunAllTestSuites (Framework);
+ 
+-- 
+2.39.3
+

SOURCES/edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-411-3.patch

@@ -0,0 +1,280 @@
+From bf371de652c1132667666a9534ec2d91f9ea111d Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 13 Feb 2024 16:30:10 -0500
+Subject: [PATCH 4/9] SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH
+ 4117/4118 symbol rename
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 53: SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764
+RH-Jira: RHEL-21157
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [4/5] bf00b368887b50b1ff5578a4491550b5741e3e34
+
+JIRA: https://issues.redhat.com/browse/RHEL-21157
+CVE: CVE-2022-36764
+Upstream: Merged
+
+commit 326db0c9072004dea89427ea3a44393a84966f2b
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Wed Jan 17 14:47:21 2024 -0800
+
+    SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117/4118 symbol rename
+
+    Updates the sanitation function names to be lib unique names
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+    Cc: Rahul Kumar <rahul1.kumar@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Message-Id: <355aa846a99ca6ac0f7574cf5982661da0d9fea6.1705529990.git.doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeTpmMeasureBootLib.c                    |  8 +++---
+ .../DxeTpmMeasureBootLibSanitization.c        | 10 +++----
+ .../DxeTpmMeasureBootLibSanitization.h        |  8 +++---
+ .../DxeTpmMeasureBootLibSanitizationTest.c    | 26 +++++++++----------
+ 4 files changed, 26 insertions(+), 26 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+index a9fc440a09..ac855b8fbb 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+@@ -174,7 +174,7 @@ TcgMeasureGptTable (
+                      BlockIo->Media->BlockSize,
+                      (UINT8 *)PrimaryHeader
+                      );
+-  if (EFI_ERROR (Status) || EFI_ERROR (SanitizeEfiPartitionTableHeader (PrimaryHeader, BlockIo))) {
++  if (EFI_ERROR (Status) || EFI_ERROR (TpmSanitizeEfiPartitionTableHeader (PrimaryHeader, BlockIo))) {
+     DEBUG ((DEBUG_ERROR, "Failed to read Partition Table Header or invalid Partition Table Header!\n"));
+     FreePool (PrimaryHeader);
+     return EFI_DEVICE_ERROR;
+@@ -183,7 +183,7 @@ TcgMeasureGptTable (
+   //
+   // Read the partition entry.
+   //
+-  Status = SanitizePrimaryHeaderAllocationSize (PrimaryHeader, &AllocSize);
++  Status = TpmSanitizePrimaryHeaderAllocationSize (PrimaryHeader, &AllocSize);
+   if (EFI_ERROR (Status)) {
+     FreePool (PrimaryHeader);
+     return EFI_DEVICE_ERROR;
+@@ -224,7 +224,7 @@ TcgMeasureGptTable (
+   //
+   // Prepare Data for Measurement
+   //
+-  Status   = SanitizePrimaryHeaderGptEventSize (PrimaryHeader, NumberOfPartition, &EventSize);
++  Status   = TpmSanitizePrimaryHeaderGptEventSize (PrimaryHeader, NumberOfPartition, &EventSize);
+   TcgEvent = (TCG_PCR_EVENT *)AllocateZeroPool (EventSize);
+   if (TcgEvent == NULL) {
+     FreePool (PrimaryHeader);
+@@ -351,7 +351,7 @@ TcgMeasurePeImage (
+ 
+   // Determine destination PCR by BootPolicy
+   //
+-  Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
++  Status = TpmSanitizePeImageEventSize (FilePathSize, &EventSize);
+   if (EFI_ERROR (Status)) {
+     return EFI_UNSUPPORTED;
+   }
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+index c989851cec..070e4a2c1c 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+@@ -1,5 +1,5 @@
+ /** @file
+-  The library instance provides security service of TPM2 measure boot and
++  The library instance provides security service of TPM measure boot and
+   Confidential Computing (CC) measure boot.
+ 
+   Caution: This file requires additional review when modified.
+@@ -63,7 +63,7 @@
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizeEfiPartitionTableHeader (
++TpmSanitizeEfiPartitionTableHeader (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN CONST EFI_BLOCK_IO_PROTOCOL       *BlockIo
+   )
+@@ -145,7 +145,7 @@ SanitizeEfiPartitionTableHeader (
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizePrimaryHeaderAllocationSize (
++TpmSanitizePrimaryHeaderAllocationSize (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   OUT UINT32                           *AllocationSize
+   )
+@@ -194,7 +194,7 @@ SanitizePrimaryHeaderAllocationSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePrimaryHeaderGptEventSize (
++TpmSanitizePrimaryHeaderGptEventSize (
+   IN  CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN  UINTN                             NumberOfPartition,
+   OUT UINT32                            *EventSize
+@@ -258,7 +258,7 @@ SanitizePrimaryHeaderGptEventSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePeImageEventSize (
++TpmSanitizePeImageEventSize (
+   IN  UINT32  FilePathSize,
+   OUT UINT32  *EventSize
+   )
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+index 2248495813..db6e9c3752 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+@@ -53,7 +53,7 @@
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizeEfiPartitionTableHeader (
++TpmSanitizeEfiPartitionTableHeader (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN CONST EFI_BLOCK_IO_PROTOCOL       *BlockIo
+   );
+@@ -77,7 +77,7 @@ SanitizeEfiPartitionTableHeader (
+ **/
+ EFI_STATUS
+ EFIAPI
+-SanitizePrimaryHeaderAllocationSize (
++TpmSanitizePrimaryHeaderAllocationSize (
+   IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   OUT UINT32                           *AllocationSize
+   );
+@@ -105,7 +105,7 @@ SanitizePrimaryHeaderAllocationSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePrimaryHeaderGptEventSize (
++TpmSanitizePrimaryHeaderGptEventSize (
+   IN  CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
+   IN  UINTN                             NumberOfPartition,
+   OUT UINT32                            *EventSize
+@@ -129,7 +129,7 @@ SanitizePrimaryHeaderGptEventSize (
+     One of the passed parameters was invalid.
+ **/
+ EFI_STATUS
+-SanitizePeImageEventSize (
++TpmSanitizePeImageEventSize (
+   IN  UINT32  FilePathSize,
+   OUT UINT32  *EventSize
+   );
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+index c41498be45..de1740af41 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+@@ -83,27 +83,27 @@ TestSanitizeEfiPartitionTableHeader (
+   PrimaryHeader.Header.CRC32 = CalculateCrc32 ((UINT8 *)&PrimaryHeader, PrimaryHeader.Header.HeaderSize);
+ 
+   // Test that a normal PrimaryHeader passes validation
+-  Status = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
++  Status = TpmSanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_NOT_EFI_ERROR (Status);
+ 
+   // Test that when number of partition entries is 0, the function returns EFI_DEVICE_ERROR
+   // Should print "Invalid Partition Table Header NumberOfPartitionEntries!""
+   PrimaryHeader.NumberOfPartitionEntries = 0;
+-  Status                                 = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
++  Status                                 = TpmSanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+   PrimaryHeader.NumberOfPartitionEntries = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+ 
+   // Test that when the header size is too small, the function returns EFI_DEVICE_ERROR
+   // Should print "Invalid Partition Table Header Size!"
+   PrimaryHeader.Header.HeaderSize = 0;
+-  Status                          = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
++  Status                          = TpmSanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+   PrimaryHeader.Header.HeaderSize = sizeof (EFI_PARTITION_TABLE_HEADER);
+ 
+   // Test that when the SizeOfPartitionEntry is too small, the function returns EFI_DEVICE_ERROR
+   // should print: "SizeOfPartitionEntry shall be set to a value of 128 x 2^n where n is an integer greater than or equal to zero (e.g., 128, 256, 512, etc.)!"
+   PrimaryHeader.SizeOfPartitionEntry = 1;
+-  Status                             = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
++  Status                             = TpmSanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
+   UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+@@ -136,7 +136,7 @@ TestSanitizePrimaryHeaderAllocationSize (
+   PrimaryHeader.NumberOfPartitionEntries = 5;
+   PrimaryHeader.SizeOfPartitionEntry     = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
+ 
+-  Status = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
++  Status = TpmSanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_NOT_EFI_ERROR (Status);
+ 
+   // Test that the allocation size is correct compared to the existing logic
+@@ -145,19 +145,19 @@ TestSanitizePrimaryHeaderAllocationSize (
+   // Test that an overflow is detected
+   PrimaryHeader.NumberOfPartitionEntries = MAX_UINT32;
+   PrimaryHeader.SizeOfPartitionEntry     = 5;
+-  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
++  Status                                 = TpmSanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   // Test the inverse
+   PrimaryHeader.NumberOfPartitionEntries = 5;
+   PrimaryHeader.SizeOfPartitionEntry     = MAX_UINT32;
+-  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
++  Status                                 = TpmSanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   // Test the worst case scenario
+   PrimaryHeader.NumberOfPartitionEntries = MAX_UINT32;
+   PrimaryHeader.SizeOfPartitionEntry     = MAX_UINT32;
+-  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
++  Status                                 = TpmSanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+@@ -195,7 +195,7 @@ TestSanitizePrimaryHeaderGptEventSize (
+   NumberOfPartition = 13;
+ 
+   // that the primary event size is correct
+-  Status = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
++  Status = TpmSanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+   UT_ASSERT_NOT_EFI_ERROR (Status);
+ 
+   // Calculate the existing logic event size
+@@ -206,12 +206,12 @@ TestSanitizePrimaryHeaderGptEventSize (
+   UT_ASSERT_EQUAL (EventSize, ExistingLogicEventSize);
+ 
+   // Tests that the primary event size may not overflow
+-  Status = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, MAX_UINT32, &EventSize);
++  Status = TpmSanitizePrimaryHeaderGptEventSize (&PrimaryHeader, MAX_UINT32, &EventSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   // Test that the size of partition entries may not overflow
+   PrimaryHeader.SizeOfPartitionEntry = MAX_UINT32;
+-  Status                             = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
++  Status                             = TpmSanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
+   UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
+ 
+   DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
+@@ -269,7 +269,7 @@ TestSanitizePeImageEventSize (
+   FilePathSize = 255;
+ 
+   // Test that a normal PE image passes validation
+-  Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
++  Status = TpmSanitizePeImageEventSize (FilePathSize, &EventSize);
+   if (EFI_ERROR (Status)) {
+     UT_LOG_ERROR ("SanitizePeImageEventSize failed with %r\n", Status);
+     goto Exit;
+@@ -285,7 +285,7 @@ TestSanitizePeImageEventSize (
+   }
+ 
+   // Test that the event size may not overflow
+-  Status = SanitizePeImageEventSize (MAX_UINT32, &EventSize);
++  Status = TpmSanitizePeImageEventSize (MAX_UINT32, &EventSize);
+   if (Status != EFI_BAD_BUFFER_SIZE) {
+     UT_LOG_ERROR ("SanitizePeImageEventSize succeded when it was supposed to fail with %r\n", Status);
+     goto Exit;
+-- 
+2.39.3
+

SOURCES/edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch

@@ -0,0 +1,914 @@
+From 8876f4f55b37e84f918282aba190fdd36eeb5f2a Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 17 Jan 2024 12:20:52 -0500
+Subject: [PATCH 2/3] SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117 -
+ CVE 2022-36763
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 51: SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117 - CVE 2022-36763
+RH-Jira: RHEL-21155
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [2/3] 50a9b8392352266a5f0b7af2d6c82f829da8983b
+
+JIRA: https://issues.redhat.com/browse/RHEL-21155
+Upstream: Merged
+CVE: CVE-2022-36763
+
+commit 4776a1b39ee08fc45c70c1eab5a0195f325000d3
+Author: Douglas Flick [MSFT] <doug.edk2@gmail.com>
+Date:   Fri Jan 12 02:16:02 2024 +0800
+
+    SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117 - CVE 2022-36763
+
+    This commit contains the patch files and tests for DxeTpmMeasureBootLib
+    CVE 2022-36763.
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeTpmMeasureBootLib.c                    |  40 ++-
+ .../DxeTpmMeasureBootLib.inf                  |   4 +-
+ .../DxeTpmMeasureBootLibSanitization.c        | 241 ++++++++++++++
+ .../DxeTpmMeasureBootLibSanitization.h        | 114 +++++++
+ .../DxeTpmMeasureBootLibSanitizationTest.c    | 301 ++++++++++++++++++
+ ...eTpmMeasureBootLibSanitizationTestHost.inf |  28 ++
+ SecurityPkg/SecurityPkg.ci.yaml               |   1 +
+ SecurityPkg/Test/SecurityPkgHostTest.dsc      |   1 +
+ 8 files changed, 716 insertions(+), 14 deletions(-)
+ create mode 100644 SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+ create mode 100644 SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+ create mode 100644 SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+ create mode 100644 SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTestHost.inf
+
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+index 220393dd2b..669ab19134 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+@@ -18,6 +18,8 @@
+ Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+ 
++Copyright (c) Microsoft Corporation.<BR>
++SPDX-License-Identifier: BSD-2-Clause-Patent
+ **/
+ 
+ #include <PiDxe.h>
+@@ -40,6 +42,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
+ #include <Library/SecurityManagementLib.h>
+ #include <Library/HobLib.h>
+ 
++#include "DxeTpmMeasureBootLibSanitization.h"
++
+ //
+ // Flag to check GPT partition. It only need be measured once.
+ //
+@@ -136,6 +140,9 @@ TcgMeasureGptTable (
+   UINT32                      EventSize;
+   UINT32                      EventNumber;
+   EFI_PHYSICAL_ADDRESS        EventLogLastEntry;
++  UINT32                      AllocSize;
++
++  GptData = NULL;
+ 
+   if (mMeasureGptCount > 0) {
+     return EFI_SUCCESS;
+@@ -166,8 +173,8 @@ TcgMeasureGptTable (
+                      BlockIo->Media->BlockSize,
+                      (UINT8 *)PrimaryHeader
+                      );
+-  if (EFI_ERROR (Status)) {
+-    DEBUG ((DEBUG_ERROR, "Failed to Read Partition Table Header!\n"));
++  if (EFI_ERROR (Status) || EFI_ERROR (SanitizeEfiPartitionTableHeader (PrimaryHeader, BlockIo))) {
++    DEBUG ((DEBUG_ERROR, "Failed to read Partition Table Header or invalid Partition Table Header!\n"));
+     FreePool (PrimaryHeader);
+     return EFI_DEVICE_ERROR;
+   }
+@@ -175,7 +182,13 @@ TcgMeasureGptTable (
+   //
+   // Read the partition entry.
+   //
+-  EntryPtr = (UINT8 *)AllocatePool (PrimaryHeader->NumberOfPartitionEntries * PrimaryHeader->SizeOfPartitionEntry);
++  Status = SanitizePrimaryHeaderAllocationSize (PrimaryHeader, &AllocSize);
++  if (EFI_ERROR (Status)) {
++    FreePool (PrimaryHeader);
++    return EFI_DEVICE_ERROR;
++  }
++
++  EntryPtr = (UINT8 *)AllocatePool (AllocSize);
+   if (EntryPtr == NULL) {
+     FreePool (PrimaryHeader);
+     return EFI_OUT_OF_RESOURCES;
+@@ -185,7 +198,7 @@ TcgMeasureGptTable (
+                      DiskIo,
+                      BlockIo->Media->MediaId,
+                      MultU64x32 (PrimaryHeader->PartitionEntryLBA, BlockIo->Media->BlockSize),
+-                     PrimaryHeader->NumberOfPartitionEntries * PrimaryHeader->SizeOfPartitionEntry,
++                     AllocSize,
+                      EntryPtr
+                      );
+   if (EFI_ERROR (Status)) {
+@@ -210,9 +223,8 @@ TcgMeasureGptTable (
+   //
+   // Prepare Data for Measurement
+   //
+-  EventSize = (UINT32)(sizeof (EFI_GPT_DATA) - sizeof (GptData->Partitions)
+-                       + NumberOfPartition * PrimaryHeader->SizeOfPartitionEntry);
+-  TcgEvent = (TCG_PCR_EVENT *)AllocateZeroPool (EventSize + sizeof (TCG_PCR_EVENT_HDR));
++  Status   = SanitizePrimaryHeaderGptEventSize (PrimaryHeader, NumberOfPartition, &EventSize);
++  TcgEvent = (TCG_PCR_EVENT *)AllocateZeroPool (EventSize);
+   if (TcgEvent == NULL) {
+     FreePool (PrimaryHeader);
+     FreePool (EntryPtr);
+@@ -221,7 +233,7 @@ TcgMeasureGptTable (
+ 
+   TcgEvent->PCRIndex  = 5;
+   TcgEvent->EventType = EV_EFI_GPT_EVENT;
+-  TcgEvent->EventSize = EventSize;
++  TcgEvent->EventSize = EventSize - sizeof (TCG_PCR_EVENT_HDR);
+   GptData             = (EFI_GPT_DATA *)TcgEvent->Event;
+ 
+   //
+@@ -361,11 +373,13 @@ TcgMeasurePeImage (
+       TcgEvent->PCRIndex  = 2;
+       break;
+     default:
+-      DEBUG ((
+-        DEBUG_ERROR,
+-        "TcgMeasurePeImage: Unknown subsystem type %d",
+-        ImageType
+-        ));
++      DEBUG (
++        (
++         DEBUG_ERROR,
++         "TcgMeasurePeImage: Unknown subsystem type %d",
++         ImageType
++        )
++        );
+       goto Finish;
+   }
+ 
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf
+index ebab6f7c1e..414c654d15 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.inf
+@@ -32,6 +32,8 @@
+ 
+ [Sources]
+   DxeTpmMeasureBootLib.c
++  DxeTpmMeasureBootLibSanitization.c
++  DxeTpmMeasureBootLibSanitization.h
+ 
+ [Packages]
+   MdePkg/MdePkg.dec
+@@ -41,6 +43,7 @@
+ 
+ [LibraryClasses]
+   BaseMemoryLib
++  SafeIntLib
+   DebugLib
+   MemoryAllocationLib
+   DevicePathLib
+@@ -59,4 +62,3 @@
+   gEfiFirmwareVolumeBlockProtocolGuid   ## SOMETIMES_CONSUMES
+   gEfiBlockIoProtocolGuid               ## SOMETIMES_CONSUMES
+   gEfiDiskIoProtocolGuid                ## SOMETIMES_CONSUMES
+-
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+new file mode 100644
+index 0000000000..a3fa46f5e6
+--- /dev/null
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+@@ -0,0 +1,241 @@
++/** @file
++  The library instance provides security service of TPM2 measure boot and
++  Confidential Computing (CC) measure boot.
++
++  Caution: This file requires additional review when modified.
++  This library will have external input - PE/COFF image and GPT partition.
++  This external input must be validated carefully to avoid security issue like
++  buffer overflow, integer overflow.
++
++  This file will pull out the validation logic from the following functions, in an
++  attempt to validate the untrusted input in the form of unit tests
++
++  These are those functions:
++
++  DxeTpmMeasureBootLibImageRead() function will make sure the PE/COFF image content
++  read is within the image buffer.
++
++  Tcg2MeasureGptTable() function will receive untrusted GPT partition table, and parse
++  partition data carefully.
++
++  Copyright (c) Microsoft Corporation.<BR>
++  SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++#include <Uefi.h>
++#include <Uefi/UefiSpec.h>
++#include <Library/SafeIntLib.h>
++#include <Library/UefiLib.h>
++#include <Library/DebugLib.h>
++#include <Library/BaseLib.h>
++#include <IndustryStandard/UefiTcgPlatform.h>
++#include <Protocol/BlockIo.h>
++#include <Library/MemoryAllocationLib.h>
++
++#include "DxeTpmMeasureBootLibSanitization.h"
++
++#define GPT_HEADER_REVISION_V1  0x00010000
++
++/**
++  This function will validate the EFI_PARTITION_TABLE_HEADER structure is safe to parse
++  However this function will not attempt to verify the validity of the GPT partition
++  It will check the following:
++    - Signature
++    - Revision
++    - AlternateLBA
++    - FirstUsableLBA
++    - LastUsableLBA
++    - PartitionEntryLBA
++    - NumberOfPartitionEntries
++    - SizeOfPartitionEntry
++    - BlockIo
++
++  @param[in] PrimaryHeader
++    Pointer to the EFI_PARTITION_TABLE_HEADER structure.
++
++  @param[in] BlockIo
++    Pointer to the EFI_BLOCK_IO_PROTOCOL structure.
++
++  @retval EFI_SUCCESS
++    The EFI_PARTITION_TABLE_HEADER structure is valid.
++
++  @retval EFI_INVALID_PARAMETER
++    The EFI_PARTITION_TABLE_HEADER structure is invalid.
++**/
++EFI_STATUS
++EFIAPI
++SanitizeEfiPartitionTableHeader (
++  IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
++  IN CONST EFI_BLOCK_IO_PROTOCOL       *BlockIo
++  )
++{
++  // Verify that the input parameters are safe to use
++  if (PrimaryHeader == NULL) {
++    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header!\n"));
++    return EFI_INVALID_PARAMETER;
++  }
++
++  if ((BlockIo == NULL) || (BlockIo->Media == NULL)) {
++    DEBUG ((DEBUG_ERROR, "Invalid BlockIo!\n"));
++    return EFI_INVALID_PARAMETER;
++  }
++
++  // The signature must be EFI_PTAB_HEADER_ID ("EFI PART" in ASCII)
++  if (PrimaryHeader->Header.Signature != EFI_PTAB_HEADER_ID) {
++    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header!\n"));
++    return EFI_DEVICE_ERROR;
++  }
++
++  // The version must be GPT_HEADER_REVISION_V1 (0x00010000)
++  if (PrimaryHeader->Header.Revision != GPT_HEADER_REVISION_V1) {
++    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header Revision!\n"));
++    return EFI_DEVICE_ERROR;
++  }
++
++  // The HeaderSize must be greater than or equal to 92 and must be less than or equal to the logical block size
++  if ((PrimaryHeader->Header.HeaderSize < sizeof (EFI_PARTITION_TABLE_HEADER)) || (PrimaryHeader->Header.HeaderSize > BlockIo->Media->BlockSize)) {
++    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header HeaderSize!\n"));
++    return EFI_DEVICE_ERROR;
++  }
++
++  // check that the PartitionEntryLBA greater than the Max LBA
++  // This will be used later for multiplication
++  if (PrimaryHeader->PartitionEntryLBA > DivU64x32 (MAX_UINT64, BlockIo->Media->BlockSize)) {
++    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header PartitionEntryLBA!\n"));
++    return EFI_DEVICE_ERROR;
++  }
++
++  // Check that the number of partition entries is greater than zero
++  if (PrimaryHeader->NumberOfPartitionEntries == 0) {
++    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header NumberOfPartitionEntries!\n"));
++    return EFI_DEVICE_ERROR;
++  }
++
++  // SizeOfPartitionEntry must be 128, 256, 512... improper size may lead to accessing uninitialized memory
++  if ((PrimaryHeader->SizeOfPartitionEntry < 128) || ((PrimaryHeader->SizeOfPartitionEntry & (PrimaryHeader->SizeOfPartitionEntry - 1)) != 0)) {
++    DEBUG ((DEBUG_ERROR, "SizeOfPartitionEntry shall be set to a value of 128 x 2^n where n is an integer greater than or equal to zero (e.g., 128, 256, 512, etc.)!\n"));
++    return EFI_DEVICE_ERROR;
++  }
++
++  // This check is to prevent overflow when calculating the allocation size for the partition entries
++  // This check will be used later for multiplication
++  if (PrimaryHeader->NumberOfPartitionEntries > DivU64x32 (MAX_UINT64, PrimaryHeader->SizeOfPartitionEntry)) {
++    DEBUG ((DEBUG_ERROR, "Invalid Partition Table Header NumberOfPartitionEntries!\n"));
++    return EFI_DEVICE_ERROR;
++  }
++
++  return EFI_SUCCESS;
++}
++
++/**
++  This function will validate that the allocation size from the primary header is sane
++  It will check the following:
++    - AllocationSize does not overflow
++
++  @param[in] PrimaryHeader
++    Pointer to the EFI_PARTITION_TABLE_HEADER structure.
++
++  @param[out] AllocationSize
++    Pointer to the allocation size.
++
++  @retval EFI_SUCCESS
++    The allocation size is valid.
++
++  @retval EFI_OUT_OF_RESOURCES
++    The allocation size is invalid.
++**/
++EFI_STATUS
++EFIAPI
++SanitizePrimaryHeaderAllocationSize (
++  IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
++  OUT UINT32                           *AllocationSize
++  )
++{
++  EFI_STATUS  Status;
++
++  if (PrimaryHeader == NULL) {
++    return EFI_INVALID_PARAMETER;
++  }
++
++  if (AllocationSize == NULL) {
++    return EFI_INVALID_PARAMETER;
++  }
++
++  // Replacing logic:
++  // PrimaryHeader->NumberOfPartitionEntries * PrimaryHeader->SizeOfPartitionEntry;
++  Status = SafeUint32Mult (PrimaryHeader->NumberOfPartitionEntries, PrimaryHeader->SizeOfPartitionEntry, AllocationSize);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_ERROR, "Allocation Size would have overflowed!\n"));
++    return EFI_BAD_BUFFER_SIZE;
++  }
++
++  return EFI_SUCCESS;
++}
++
++/**
++  This function will validate that the Gpt Event Size calculated from the primary header is sane
++  It will check the following:
++    - EventSize does not overflow
++
++  Important: This function includes the entire length of the allocated space, including the
++  TCG_PCR_EVENT_HDR. When hashing the buffer allocated with this size, the caller must subtract
++  the size of the TCG_PCR_EVENT_HDR from the size of the buffer before hashing.
++
++  @param[in] PrimaryHeader - Pointer to the EFI_PARTITION_TABLE_HEADER structure.
++  @param[in] NumberOfPartition - Number of partitions.
++  @param[out] EventSize - Pointer to the event size.
++
++  @retval EFI_SUCCESS
++    The event size is valid.
++
++  @retval EFI_OUT_OF_RESOURCES
++    Overflow would have occurred.
++
++  @retval EFI_INVALID_PARAMETER
++    One of the passed parameters was invalid.
++**/
++EFI_STATUS
++SanitizePrimaryHeaderGptEventSize (
++  IN  CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
++  IN  UINTN                             NumberOfPartition,
++  OUT UINT32                            *EventSize
++  )
++{
++  EFI_STATUS  Status;
++  UINT32      SafeNumberOfPartitions;
++
++  if (PrimaryHeader == NULL) {
++    return EFI_INVALID_PARAMETER;
++  }
++
++  if (EventSize == NULL) {
++    return EFI_INVALID_PARAMETER;
++  }
++
++  // We shouldn't even attempt to perform the multiplication if the number of partitions is greater than the maximum value of UINT32
++  Status = SafeUintnToUint32 (NumberOfPartition, &SafeNumberOfPartitions);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_ERROR, "NumberOfPartition would have overflowed!\n"));
++    return EFI_INVALID_PARAMETER;
++  }
++
++  // Replacing logic:
++  // (UINT32)(sizeof (EFI_GPT_DATA) - sizeof (GptData->Partitions) + NumberOfPartition * PrimaryHeader.SizeOfPartitionEntry + sizeof (TCG_PCR_EVENT_HDR));
++  Status = SafeUint32Mult (SafeNumberOfPartitions, PrimaryHeader->SizeOfPartitionEntry, EventSize);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_ERROR, "Event Size would have overflowed!\n"));
++    return EFI_BAD_BUFFER_SIZE;
++  }
++
++  Status = SafeUint32Add (
++             sizeof (TCG_PCR_EVENT_HDR) +
++             OFFSET_OF (EFI_GPT_DATA, Partitions),
++             *EventSize,
++             EventSize
++             );
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_ERROR, "Event Size would have overflowed because of GPTData!\n"));
++    return EFI_BAD_BUFFER_SIZE;
++  }
++
++  return EFI_SUCCESS;
++}
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+new file mode 100644
+index 0000000000..0d9d00c281
+--- /dev/null
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+@@ -0,0 +1,114 @@
++/** @file
++  This file includes the function prototypes for the sanitization functions.
++
++  These are those functions:
++
++  DxeTpmMeasureBootLibImageRead() function will make sure the PE/COFF image content
++  read is within the image buffer.
++
++  TcgMeasurePeImage() function will accept untrusted PE/COFF image and validate its
++  data structure within this image buffer before use.
++
++  TcgMeasureGptTable() function will receive untrusted GPT partition table, and parse
++  partition data carefully.
++
++  Copyright (c) Microsoft Corporation.<BR>
++  SPDX-License-Identifier: BSD-2-Clause-Patent
++
++**/
++
++#ifndef DXE_TPM_MEASURE_BOOT_LIB_VALIDATION_
++#define DXE_TPM_MEASURE_BOOT_LIB_VALIDATION_
++
++#include <Uefi.h>
++#include <Uefi/UefiSpec.h>
++#include <Protocol/BlockIo.h>
++#include <IndustryStandard/UefiTcgPlatform.h>
++
++/**
++  This function will validate the EFI_PARTITION_TABLE_HEADER structure is safe to parse
++  However this function will not attempt to verify the validity of the GPT partition
++  It will check the following:
++    - Signature
++    - Revision
++    - AlternateLBA
++    - FirstUsableLBA
++    - LastUsableLBA
++    - PartitionEntryLBA
++    - NumberOfPartitionEntries
++    - SizeOfPartitionEntry
++    - BlockIo
++
++  @param[in] PrimaryHeader
++    Pointer to the EFI_PARTITION_TABLE_HEADER structure.
++
++  @param[in] BlockIo
++    Pointer to the EFI_BLOCK_IO_PROTOCOL structure.
++
++  @retval EFI_SUCCESS
++    The EFI_PARTITION_TABLE_HEADER structure is valid.
++
++  @retval EFI_INVALID_PARAMETER
++    The EFI_PARTITION_TABLE_HEADER structure is invalid.
++**/
++EFI_STATUS
++EFIAPI
++SanitizeEfiPartitionTableHeader (
++  IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
++  IN CONST EFI_BLOCK_IO_PROTOCOL       *BlockIo
++  );
++
++/**
++  This function will validate that the allocation size from the primary header is sane
++  It will check the following:
++    - AllocationSize does not overflow
++
++  @param[in] PrimaryHeader
++    Pointer to the EFI_PARTITION_TABLE_HEADER structure.
++
++  @param[out] AllocationSize
++    Pointer to the allocation size.
++
++  @retval EFI_SUCCESS
++    The allocation size is valid.
++
++  @retval EFI_OUT_OF_RESOURCES
++    The allocation size is invalid.
++**/
++EFI_STATUS
++EFIAPI
++SanitizePrimaryHeaderAllocationSize (
++  IN CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
++  OUT UINT32                           *AllocationSize
++  );
++
++/**
++  This function will validate that the Gpt Event Size calculated from the primary header is sane
++  It will check the following:
++    - EventSize does not overflow
++
++  Important: This function includes the entire length of the allocated space, including the
++  TCG_PCR_EVENT_HDR. When hashing the buffer allocated with this size, the caller must subtract
++  the size of the TCG_PCR_EVENT_HDR from the size of the buffer before hashing.
++
++  @param[in] PrimaryHeader - Pointer to the EFI_PARTITION_TABLE_HEADER structure.
++  @param[in] NumberOfPartition - Number of partitions.
++  @param[out] EventSize - Pointer to the event size.
++
++  @retval EFI_SUCCESS
++    The event size is valid.
++
++  @retval EFI_OUT_OF_RESOURCES
++    Overflow would have occurred.
++
++  @retval EFI_INVALID_PARAMETER
++    One of the passed parameters was invalid.
++**/
++EFI_STATUS
++SanitizePrimaryHeaderGptEventSize (
++  IN  CONST EFI_PARTITION_TABLE_HEADER  *PrimaryHeader,
++  IN  UINTN                             NumberOfPartition,
++  OUT UINT32                            *EventSize
++  );
++
++#endif // DXE_TPM_MEASURE_BOOT_LIB_VALIDATION_
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+new file mode 100644
+index 0000000000..eeb928cdb0
+--- /dev/null
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+@@ -0,0 +1,301 @@
++/** @file
++This file includes the unit test cases for the DxeTpmMeasureBootLibSanitizationTest.c.
++
++Copyright (c) Microsoft Corporation.<BR>
++SPDX-License-Identifier: BSD-2-Clause-Patent
++**/
++
++#include <Uefi.h>
++#include <Library/UefiLib.h>
++#include <Library/DebugLib.h>
++#include <Library/UnitTestLib.h>
++#include <Protocol/BlockIo.h>
++#include <Library/MemoryAllocationLib.h>
++#include <Library/BaseMemoryLib.h>
++#include <IndustryStandard/UefiTcgPlatform.h>
++
++#include "../DxeTpmMeasureBootLibSanitization.h"
++
++#define UNIT_TEST_NAME     "DxeTpmMeasureBootLibSanitizationTest"
++#define UNIT_TEST_VERSION  "1.0"
++
++#define DEFAULT_PRIMARY_TABLE_HEADER_REVISION                     0x00010000
++#define DEFAULT_PRIMARY_TABLE_HEADER_NUMBER_OF_PARTITION_ENTRIES  1
++#define DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY      128
++
++/**
++  This function tests the SanitizeEfiPartitionTableHeader function.
++  It's intent is to test that a malicious EFI_PARTITION_TABLE_HEADER
++  structure will not cause undefined or unexpected behavior.
++
++  In general the TPM should still be able to measure the data, but
++  be the header should be sanitized to prevent any unexpected behavior.
++
++  @param[in] Context  The unit test context.
++
++  @retval UNIT_TEST_PASSED  The test passed.
++  @retval UNIT_TEST_ERROR_TEST_FAILED  The test failed.
++**/
++UNIT_TEST_STATUS
++EFIAPI
++TestSanitizeEfiPartitionTableHeader (
++  IN UNIT_TEST_CONTEXT  Context
++  )
++{
++  EFI_STATUS                  Status;
++  EFI_PARTITION_TABLE_HEADER  PrimaryHeader;
++  EFI_BLOCK_IO_PROTOCOL       BlockIo;
++  EFI_BLOCK_IO_MEDIA          BlockMedia;
++
++  // Generate EFI_BLOCK_IO_MEDIA test data
++  BlockMedia.MediaId          = 1;
++  BlockMedia.RemovableMedia   = FALSE;
++  BlockMedia.MediaPresent     = TRUE;
++  BlockMedia.LogicalPartition = FALSE;
++  BlockMedia.ReadOnly         = FALSE;
++  BlockMedia.WriteCaching     = FALSE;
++  BlockMedia.BlockSize        = 512;
++  BlockMedia.IoAlign          = 1;
++  BlockMedia.LastBlock        = 0;
++
++  // Generate EFI_BLOCK_IO_PROTOCOL test data
++  BlockIo.Revision    = 1;
++  BlockIo.Media       = &BlockMedia;
++  BlockIo.Reset       = NULL;
++  BlockIo.ReadBlocks  = NULL;
++  BlockIo.WriteBlocks = NULL;
++  BlockIo.FlushBlocks = NULL;
++
++  // Geneate EFI_PARTITION_TABLE_HEADER test data
++  PrimaryHeader.Header.Signature         = EFI_PTAB_HEADER_ID;
++  PrimaryHeader.Header.Revision          = DEFAULT_PRIMARY_TABLE_HEADER_REVISION;
++  PrimaryHeader.Header.HeaderSize        = sizeof (EFI_PARTITION_TABLE_HEADER);
++  PrimaryHeader.MyLBA                    = 1;
++  PrimaryHeader.AlternateLBA             = 2;
++  PrimaryHeader.FirstUsableLBA           = 3;
++  PrimaryHeader.LastUsableLBA            = 4;
++  PrimaryHeader.PartitionEntryLBA        = 5;
++  PrimaryHeader.NumberOfPartitionEntries = DEFAULT_PRIMARY_TABLE_HEADER_NUMBER_OF_PARTITION_ENTRIES;
++  PrimaryHeader.SizeOfPartitionEntry     = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
++  PrimaryHeader.PartitionEntryArrayCRC32 = 0; // Purposely invalid
++
++  // Calculate the CRC32 of the PrimaryHeader
++  PrimaryHeader.Header.CRC32 = CalculateCrc32 ((UINT8 *)&PrimaryHeader, PrimaryHeader.Header.HeaderSize);
++
++  // Test that a normal PrimaryHeader passes validation
++  Status = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
++  UT_ASSERT_NOT_EFI_ERROR (Status);
++
++  // Test that when number of partition entries is 0, the function returns EFI_DEVICE_ERROR
++  // Should print "Invalid Partition Table Header NumberOfPartitionEntries!""
++  PrimaryHeader.NumberOfPartitionEntries = 0;
++  Status                                 = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
++  UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
++  PrimaryHeader.NumberOfPartitionEntries = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
++
++  // Test that when the header size is too small, the function returns EFI_DEVICE_ERROR
++  // Should print "Invalid Partition Table Header Size!"
++  PrimaryHeader.Header.HeaderSize = 0;
++  Status                          = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
++  UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
++  PrimaryHeader.Header.HeaderSize = sizeof (EFI_PARTITION_TABLE_HEADER);
++
++  // Test that when the SizeOfPartitionEntry is too small, the function returns EFI_DEVICE_ERROR
++  // should print: "SizeOfPartitionEntry shall be set to a value of 128 x 2^n where n is an integer greater than or equal to zero (e.g., 128, 256, 512, etc.)!"
++  PrimaryHeader.SizeOfPartitionEntry = 1;
++  Status                             = SanitizeEfiPartitionTableHeader (&PrimaryHeader, &BlockIo);
++  UT_ASSERT_EQUAL (Status, EFI_DEVICE_ERROR);
++
++  DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
++
++  return UNIT_TEST_PASSED;
++}
++
++/**
++  This function tests the SanitizePrimaryHeaderAllocationSize function.
++  It's intent is to test that the untrusted input from a EFI_PARTITION_TABLE_HEADER
++  structure will not cause an overflow when calculating the allocation size.
++
++  @param[in] Context  The unit test context.
++
++  @retval UNIT_TEST_PASSED  The test passed.
++  @retval UNIT_TEST_ERROR_TEST_FAILED  The test failed.
++**/
++UNIT_TEST_STATUS
++EFIAPI
++TestSanitizePrimaryHeaderAllocationSize (
++  IN UNIT_TEST_CONTEXT  Context
++  )
++{
++  UINT32  AllocationSize;
++
++  EFI_STATUS                  Status;
++  EFI_PARTITION_TABLE_HEADER  PrimaryHeader;
++
++  // Test that a normal PrimaryHeader passes validation
++  PrimaryHeader.NumberOfPartitionEntries = 5;
++  PrimaryHeader.SizeOfPartitionEntry     = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
++
++  Status = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
++  UT_ASSERT_NOT_EFI_ERROR (Status);
++
++  // Test that the allocation size is correct compared to the existing logic
++  UT_ASSERT_EQUAL (AllocationSize, PrimaryHeader.NumberOfPartitionEntries * PrimaryHeader.SizeOfPartitionEntry);
++
++  // Test that an overflow is detected
++  PrimaryHeader.NumberOfPartitionEntries = MAX_UINT32;
++  PrimaryHeader.SizeOfPartitionEntry     = 5;
++  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
++  UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
++
++  // Test the inverse
++  PrimaryHeader.NumberOfPartitionEntries = 5;
++  PrimaryHeader.SizeOfPartitionEntry     = MAX_UINT32;
++  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
++  UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
++
++  // Test the worst case scenario
++  PrimaryHeader.NumberOfPartitionEntries = MAX_UINT32;
++  PrimaryHeader.SizeOfPartitionEntry     = MAX_UINT32;
++  Status                                 = SanitizePrimaryHeaderAllocationSize (&PrimaryHeader, &AllocationSize);
++  UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
++
++  DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
++
++  return UNIT_TEST_PASSED;
++}
++
++/**
++  This function tests the SanitizePrimaryHeaderGptEventSize function.
++  It's intent is to test that the untrusted input from a EFI_GPT_DATA structure
++  will not cause an overflow when calculating the event size.
++
++  @param[in] Context  The unit test context.
++
++  @retval UNIT_TEST_PASSED  The test passed.
++  @retval UNIT_TEST_ERROR_TEST_FAILED  The test failed.
++**/
++UNIT_TEST_STATUS
++EFIAPI
++TestSanitizePrimaryHeaderGptEventSize (
++  IN UNIT_TEST_CONTEXT  Context
++  )
++{
++  UINT32                      EventSize;
++  UINT32                      ExistingLogicEventSize;
++  EFI_STATUS                  Status;
++  EFI_PARTITION_TABLE_HEADER  PrimaryHeader;
++  UINTN                       NumberOfPartition;
++  EFI_GPT_DATA                *GptData;
++
++  GptData = NULL;
++
++  // Test that a normal PrimaryHeader passes validation
++  PrimaryHeader.NumberOfPartitionEntries = 5;
++  PrimaryHeader.SizeOfPartitionEntry     = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
++
++  // set the number of partitions
++  NumberOfPartition = 13;
++
++  // that the primary event size is correct
++  Status = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
++  UT_ASSERT_NOT_EFI_ERROR (Status);
++
++  // Calculate the existing logic event size
++  ExistingLogicEventSize = (UINT32)(sizeof (TCG_PCR_EVENT_HDR) + OFFSET_OF (EFI_GPT_DATA, Partitions)
++                                    + NumberOfPartition * PrimaryHeader.SizeOfPartitionEntry);
++
++  // Check that the event size is correct
++  UT_ASSERT_EQUAL (EventSize, ExistingLogicEventSize);
++
++  // Tests that the primary event size may not overflow
++  Status = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, MAX_UINT32, &EventSize);
++  UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
++
++  // Test that the size of partition entries may not overflow
++  PrimaryHeader.SizeOfPartitionEntry = MAX_UINT32;
++  Status                             = SanitizePrimaryHeaderGptEventSize (&PrimaryHeader, NumberOfPartition, &EventSize);
++  UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
++
++  DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
++
++  return UNIT_TEST_PASSED;
++}
++
++// *--------------------------------------------------------------------*
++// *  Unit Test Code Main Function
++// *--------------------------------------------------------------------*
++
++/**
++  This function acts as the entry point for the unit tests.
++
++  @param argc - The number of command line arguments
++  @param argv - The command line arguments
++
++  @return int - The status of the test
++**/
++EFI_STATUS
++EFIAPI
++UefiTestMain (
++  VOID
++  )
++{
++  EFI_STATUS                  Status;
++  UNIT_TEST_FRAMEWORK_HANDLE  Framework;
++  UNIT_TEST_SUITE_HANDLE      TcgMeasureBootLibValidationTestSuite;
++
++  Framework = NULL;
++
++  DEBUG ((DEBUG_INFO, "%a: TestMain() - Start\n", UNIT_TEST_NAME));
++
++  Status = InitUnitTestFramework (&Framework, UNIT_TEST_NAME, gEfiCallerBaseName, UNIT_TEST_VERSION);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_ERROR, "%a: Failed in InitUnitTestFramework. Status = %r\n", UNIT_TEST_NAME, Status));
++    goto EXIT;
++  }
++
++  Status = CreateUnitTestSuite (&TcgMeasureBootLibValidationTestSuite, Framework, "TcgMeasureBootLibValidationTestSuite", "Common.TcgMeasureBootLibValidation", NULL, NULL);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_ERROR, "%s: Failed in CreateUnitTestSuite for TcgMeasureBootLibValidationTestSuite\n", UNIT_TEST_NAME));
++    Status = EFI_OUT_OF_RESOURCES;
++    goto EXIT;
++  }
++
++  // -----------Suite---------------------------------Description----------------------------Class----------------------------------Test Function------------------------Pre---Clean-Context
++  AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Validating EFI Partition Table", "Common.TcgMeasureBootLibValidation", TestSanitizeEfiPartitionTableHeader, NULL, NULL, NULL);
++  AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Primary header gpt event checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePrimaryHeaderAllocationSize, NULL, NULL, NULL);
++  AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Primary header allocation size checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePrimaryHeaderGptEventSize, NULL, NULL, NULL);
++
++  Status = RunAllTestSuites (Framework);
++
++EXIT:
++  if (Framework != NULL) {
++    FreeUnitTestFramework (Framework);
++  }
++
++  DEBUG ((DEBUG_INFO, "%a: TestMain() - End\n", UNIT_TEST_NAME));
++  return Status;
++}
++
++///
++/// Avoid ECC error for function name that starts with lower case letter
++///
++#define DxeTpmMeasureBootLibUnitTestMain  main
++
++/**
++  Standard POSIX C entry point for host based unit test execution.
++
++  @param[in] Argc  Number of arguments
++  @param[in] Argv  Array of pointers to arguments
++
++  @retval 0      Success
++  @retval other  Error
++**/
++INT32
++DxeTpmMeasureBootLibUnitTestMain (
++  IN INT32  Argc,
++  IN CHAR8  *Argv[]
++  )
++{
++  return (INT32)UefiTestMain ();
++}
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTestHost.inf b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTestHost.inf
+new file mode 100644
+index 0000000000..47b0811b00
+--- /dev/null
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTestHost.inf
+@@ -0,0 +1,28 @@
++## @file
++# This file builds the unit tests for DxeTpmMeasureBootLib
++#
++# Copyright (C) Microsoft Corporation.<BR>
++# SPDX-License-Identifier: BSD-2-Clause-Patent
++##
++
++[Defines]
++  INF_VERSION                    = 0x00010006
++  BASE_NAME                      = DxeTpmMeasuredBootLibTest
++  FILE_GUID                      = eb01bc38-309c-4d3e-967e-9f078c90772f
++  MODULE_TYPE                    = HOST_APPLICATION
++  VERSION_STRING                 = 1.0
++  ENTRY_POINT                    = main
++
++[Sources]
++  DxeTpmMeasureBootLibSanitizationTest.c
++  ../DxeTpmMeasureBootLibSanitization.c
++
++[Packages]
++  MdePkg/MdePkg.dec
++
++[LibraryClasses]
++  BaseLib
++  DebugLib
++  UnitTestLib
++  PrintLib
++  SafeIntLib
+diff --git a/SecurityPkg/SecurityPkg.ci.yaml b/SecurityPkg/SecurityPkg.ci.yaml
+index 24389531af..53e5b1fd8e 100644
+--- a/SecurityPkg/SecurityPkg.ci.yaml
++++ b/SecurityPkg/SecurityPkg.ci.yaml
+@@ -17,6 +17,7 @@
+         "ExceptionList": [
+             "8005", "gRT",
+             "8001", "DxeTpm2MeasureBootLibUnitTestMain",
++            "8001", "DxeTpmMeasureBootLibUnitTestMain"
+         ],
+         ## Both file path and directory path are accepted.
+         "IgnoreFiles": [
+diff --git a/SecurityPkg/Test/SecurityPkgHostTest.dsc b/SecurityPkg/Test/SecurityPkgHostTest.dsc
+index 788c1ab6fe..1655e573ea 100644
+--- a/SecurityPkg/Test/SecurityPkgHostTest.dsc
++++ b/SecurityPkg/Test/SecurityPkgHostTest.dsc
+@@ -27,6 +27,7 @@
+   SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
+   SecurityPkg/Test/Mock/Library/GoogleTest/MockPlatformPKProtectionLib/MockPlatformPKProtectionLib.inf
+   SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTestHost.inf
++  SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTestHost.inf
+ 
+   #
+   # Build SecurityPkg HOST_APPLICATION Tests
+-- 
+2.39.3
+

SOURCES/edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch

@@ -0,0 +1,294 @@
+From c5580cd68acf14c9e8660f6ee2842654479089ae Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Wed, 7 Feb 2024 15:43:10 -0500
+Subject: [PATCH 2/9] SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4118 -
+ CVE 2022-36764
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 53: SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764
+RH-Jira: RHEL-21157
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [2/5] 3945cfd0838c822a3b2cc4b4e315c39a779a7344
+
+JIRA: https://issues.redhat.com/browse/RHEL-21157
+CVE: CVE-2022-36764
+Upstream: Merged
+
+commit 0d341c01eeabe0ab5e76693b36e728b8f538a40e
+Author: Douglas Flick [MSFT] <doug.edk2@gmail.com>
+Date:   Fri Jan 12 02:16:05 2024 +0800
+
+    SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764
+
+    This commit contains the patch files and tests for DxeTpmMeasureBootLib
+    CVE 2022-36764.
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ .../DxeTpmMeasureBootLib.c                    | 13 ++-
+ .../DxeTpmMeasureBootLibSanitization.c        | 44 +++++++++
+ .../DxeTpmMeasureBootLibSanitization.h        | 23 +++++
+ .../DxeTpmMeasureBootLibSanitizationTest.c    | 98 +++++++++++++++++--
+ 4 files changed, 168 insertions(+), 10 deletions(-)
+
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+index 669ab19134..a9fc440a09 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
+@@ -17,6 +17,7 @@
+ 
+ Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
++Copyright (c) Microsoft Corporation.<BR>
+ 
+ Copyright (c) Microsoft Corporation.<BR>
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+@@ -345,18 +346,22 @@ TcgMeasurePeImage (
+   ImageLoad     = NULL;
+   SectionHeader = NULL;
+   Sha1Ctx       = NULL;
++  TcgEvent      = NULL;
+   FilePathSize  = (UINT32)GetDevicePathSize (FilePath);
+ 
+-  //
+   // Determine destination PCR by BootPolicy
+   //
+-  EventSize = sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
+-  TcgEvent  = AllocateZeroPool (EventSize + sizeof (TCG_PCR_EVENT));
++  Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
++  if (EFI_ERROR (Status)) {
++    return EFI_UNSUPPORTED;
++  }
++
++  TcgEvent = AllocateZeroPool (EventSize);
+   if (TcgEvent == NULL) {
+     return EFI_OUT_OF_RESOURCES;
+   }
+ 
+-  TcgEvent->EventSize = EventSize;
++  TcgEvent->EventSize = EventSize - sizeof (TCG_PCR_EVENT_HDR);
+   ImageLoad           = (EFI_IMAGE_LOAD_EVENT *)TcgEvent->Event;
+ 
+   switch (ImageType) {
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+index a3fa46f5e6..c989851cec 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
+@@ -239,3 +239,47 @@ SanitizePrimaryHeaderGptEventSize (
+ 
+   return EFI_SUCCESS;
+ }
++
++/**
++  This function will validate that the PeImage Event Size from the loaded image is sane
++  It will check the following:
++    - EventSize does not overflow
++
++  @param[in] FilePathSize - Size of the file path.
++  @param[out] EventSize - Pointer to the event size.
++
++  @retval EFI_SUCCESS
++    The event size is valid.
++
++  @retval EFI_OUT_OF_RESOURCES
++    Overflow would have occurred.
++
++  @retval EFI_INVALID_PARAMETER
++    One of the passed parameters was invalid.
++**/
++EFI_STATUS
++SanitizePeImageEventSize (
++  IN  UINT32  FilePathSize,
++  OUT UINT32  *EventSize
++  )
++{
++  EFI_STATUS  Status;
++
++  // Replacing logic:
++  // sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
++  Status = SafeUint32Add (OFFSET_OF (EFI_IMAGE_LOAD_EVENT, DevicePath), FilePathSize, EventSize);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_ERROR, "EventSize would overflow!\n"));
++    return EFI_BAD_BUFFER_SIZE;
++  }
++
++  // Replacing logic:
++  // EventSize + sizeof (TCG_PCR_EVENT_HDR)
++  Status = SafeUint32Add (*EventSize, sizeof (TCG_PCR_EVENT_HDR), EventSize);
++  if (EFI_ERROR (Status)) {
++    DEBUG ((DEBUG_ERROR, "EventSize would overflow!\n"));
++    return EFI_BAD_BUFFER_SIZE;
++  }
++
++  return EFI_SUCCESS;
++}
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+index 0d9d00c281..2248495813 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
+@@ -111,4 +111,27 @@ SanitizePrimaryHeaderGptEventSize (
+   OUT UINT32                            *EventSize
+   );
+ 
++/**
++  This function will validate that the PeImage Event Size from the loaded image is sane
++  It will check the following:
++    - EventSize does not overflow
++
++  @param[in] FilePathSize - Size of the file path.
++  @param[out] EventSize - Pointer to the event size.
++
++  @retval EFI_SUCCESS
++    The event size is valid.
++
++  @retval EFI_OUT_OF_RESOURCES
++    Overflow would have occurred.
++
++  @retval EFI_INVALID_PARAMETER
++    One of the passed parameters was invalid.
++**/
++EFI_STATUS
++SanitizePeImageEventSize (
++  IN  UINT32  FilePathSize,
++  OUT UINT32  *EventSize
++  );
++
+ #endif // DXE_TPM_MEASURE_BOOT_LIB_VALIDATION_
+diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+index eeb928cdb0..c41498be45 100644
+--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
++++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
+@@ -1,8 +1,8 @@
+ /** @file
+-This file includes the unit test cases for the DxeTpmMeasureBootLibSanitizationTest.c.
++  This file includes the unit test cases for the DxeTpmMeasureBootLibSanitizationTest.c.
+ 
+-Copyright (c) Microsoft Corporation.<BR>
+-SPDX-License-Identifier: BSD-2-Clause-Patent
++  Copyright (c) Microsoft Corporation.<BR>
++  SPDX-License-Identifier: BSD-2-Clause-Patent
+ **/
+ 
+ #include <Uefi.h>
+@@ -186,9 +186,6 @@ TestSanitizePrimaryHeaderGptEventSize (
+   EFI_STATUS                  Status;
+   EFI_PARTITION_TABLE_HEADER  PrimaryHeader;
+   UINTN                       NumberOfPartition;
+-  EFI_GPT_DATA                *GptData;
+-
+-  GptData = NULL;
+ 
+   // Test that a normal PrimaryHeader passes validation
+   PrimaryHeader.NumberOfPartitionEntries = 5;
+@@ -222,6 +219,94 @@ TestSanitizePrimaryHeaderGptEventSize (
+   return UNIT_TEST_PASSED;
+ }
+ 
++/**
++  This function tests the SanitizePeImageEventSize function.
++  It's intent is to test that the untrusted input from a file path for an
++  EFI_IMAGE_LOAD_EVENT structure will not cause an overflow when calculating
++  the event size when allocating space.
++
++  @param[in] Context  The unit test context.
++
++  @retval UNIT_TEST_PASSED  The test passed.
++  @retval UNIT_TEST_ERROR_TEST_FAILED  The test failed.
++**/
++UNIT_TEST_STATUS
++EFIAPI
++TestSanitizePeImageEventSize (
++  IN UNIT_TEST_CONTEXT  Context
++  )
++{
++  UINT32                    EventSize;
++  UINTN                     ExistingLogicEventSize;
++  UINT32                    FilePathSize;
++  EFI_STATUS                Status;
++  EFI_DEVICE_PATH_PROTOCOL  DevicePath;
++  EFI_IMAGE_LOAD_EVENT      *ImageLoadEvent;
++  UNIT_TEST_STATUS          TestStatus;
++
++  TestStatus = UNIT_TEST_ERROR_TEST_FAILED;
++
++  // Generate EFI_DEVICE_PATH_PROTOCOL test data
++  DevicePath.Type      = 0;
++  DevicePath.SubType   = 0;
++  DevicePath.Length[0] = 0;
++  DevicePath.Length[1] = 0;
++
++  // Generate EFI_IMAGE_LOAD_EVENT test data
++  ImageLoadEvent = AllocateZeroPool (sizeof (EFI_IMAGE_LOAD_EVENT) + sizeof (EFI_DEVICE_PATH_PROTOCOL));
++  if (ImageLoadEvent == NULL) {
++    DEBUG ((DEBUG_ERROR, "%a: AllocateZeroPool failed\n", __func__));
++    goto Exit;
++  }
++
++  // Populate EFI_IMAGE_LOAD_EVENT54 test data
++  ImageLoadEvent->ImageLocationInMemory = (EFI_PHYSICAL_ADDRESS)0x12345678;
++  ImageLoadEvent->ImageLengthInMemory   = 0x1000;
++  ImageLoadEvent->ImageLinkTimeAddress  = (UINTN)ImageLoadEvent;
++  ImageLoadEvent->LengthOfDevicePath    = sizeof (EFI_DEVICE_PATH_PROTOCOL);
++  CopyMem (ImageLoadEvent->DevicePath, &DevicePath, sizeof (EFI_DEVICE_PATH_PROTOCOL));
++
++  FilePathSize = 255;
++
++  // Test that a normal PE image passes validation
++  Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
++  if (EFI_ERROR (Status)) {
++    UT_LOG_ERROR ("SanitizePeImageEventSize failed with %r\n", Status);
++    goto Exit;
++  }
++
++  // Test that the event size is correct compared to the existing logic
++  ExistingLogicEventSize  = OFFSET_OF (EFI_IMAGE_LOAD_EVENT, DevicePath) + FilePathSize;
++  ExistingLogicEventSize += sizeof (TCG_PCR_EVENT_HDR);
++
++  if (EventSize != ExistingLogicEventSize) {
++    UT_LOG_ERROR ("SanitizePeImageEventSize returned an incorrect event size. Expected %u, got %u\n", ExistingLogicEventSize, EventSize);
++    goto Exit;
++  }
++
++  // Test that the event size may not overflow
++  Status = SanitizePeImageEventSize (MAX_UINT32, &EventSize);
++  if (Status != EFI_BAD_BUFFER_SIZE) {
++    UT_LOG_ERROR ("SanitizePeImageEventSize succeded when it was supposed to fail with %r\n", Status);
++    goto Exit;
++  }
++
++  TestStatus = UNIT_TEST_PASSED;
++Exit:
++
++  if (ImageLoadEvent != NULL) {
++    FreePool (ImageLoadEvent);
++  }
++
++  if (TestStatus == UNIT_TEST_ERROR_TEST_FAILED) {
++    DEBUG ((DEBUG_ERROR, "%a: Test failed\n", __func__));
++  } else {
++    DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
++  }
++
++  return TestStatus;
++}
++
+ // *--------------------------------------------------------------------*
+ // *  Unit Test Code Main Function
+ // *--------------------------------------------------------------------*
+@@ -265,6 +350,7 @@ UefiTestMain (
+   AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Validating EFI Partition Table", "Common.TcgMeasureBootLibValidation", TestSanitizeEfiPartitionTableHeader, NULL, NULL, NULL);
+   AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Primary header gpt event checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePrimaryHeaderAllocationSize, NULL, NULL, NULL);
+   AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Primary header allocation size checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePrimaryHeaderGptEventSize, NULL, NULL, NULL);
++  AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests PE Image and FileSize checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePeImageEventSize, NULL, NULL, NULL);
+ 
+   Status = RunAllTestSuites (Framework);
+ 
+-- 
+2.39.3
+

SOURCES/edk2-SecurityPkg-RngDxe-add-rng-test.patch

@@ -0,0 +1,71 @@
+From 7719d41979ef6e376d183c70cd47951ff5bf6ef1 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Thu, 20 Jun 2024 10:33:43 -0400
+Subject: [PATCH 5/8] SecurityPkg/RngDxe: add rng test
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 75: NetworkPkg: SECURITY PATCH CVE-2023-45236 and CVE-2023-45237
+RH-Jira: RHEL-40270 RHEL-40272
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [5/8] 84a58daaed0ee81ebed501392be33338da575df6
+
+JIRA: https://issues.redhat.com/browse/RHEL-40270
+Upstream: Merged
+CVE: CVE-2023-45237
+
+commit a61bc0accb8a76edba4f073fdc7bafc908df045d
+Author: Gerd Hoffmann <kraxel@redhat.com>
+Date:   Fri May 31 09:49:13 2024 +0200
+
+    SecurityPkg/RngDxe: add rng test
+
+    Check whenever RngLib actually returns random numbers, only return
+    a non-zero number of Algorithms if that is the case.
+
+    This has the effect that RndDxe loads and installs EFI_RNG_PROTOCOL
+    only in case it can actually deliver random numbers.
+
+    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+
+Check whenever RngLib actually returns random numbers, only return
+a non-zero number of Algorithms if that is the case.
+
+This has the effect that RndDxe loads and installs EFI_RNG_PROTOCOL
+only in case it can actually deliver random numbers.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+index 7e06e16e4b..285b5f46e7 100644
+--- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
++++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
+@@ -23,6 +23,7 @@
+ 
+ #include <Library/BaseLib.h>
+ #include <Library/BaseMemoryLib.h>
++#include <Library/RngLib.h>
+ 
+ #include "RngDxeInternals.h"
+ 
+@@ -43,7 +44,12 @@ GetAvailableAlgorithms (
+   VOID
+   )
+ {
+-  mAvailableAlgoArrayCount = RNG_ALGORITHM_COUNT;
++  UINT64  RngTest;
++
++  if (GetRandomNumber64 (&RngTest)) {
++    mAvailableAlgoArrayCount = RNG_ALGORITHM_COUNT;
++  }
++
+   return EFI_SUCCESS;
+ }
+ 
+-- 
+2.39.3
+

SOURCES/edk2-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch

@@ -0,0 +1,85 @@
+From 95697612d2f1953c691b0914a1669e0fcf179767 Mon Sep 17 00:00:00 2001
+From: Jon Maloy <jmaloy@redhat.com>
+Date: Tue, 13 Feb 2024 16:30:10 -0500
+Subject: [PATCH 5/9] SecurityPkg: : Updating SecurityFixes.yaml after symbol
+ rename
+
+RH-Author: Jon Maloy <jmaloy@redhat.com>
+RH-MergeRequest: 53: SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764
+RH-Jira: RHEL-21157
+RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
+RH-Acked-by: Gerd Hoffmann <None>
+RH-Commit: [5/5] 8e0c9c8c6b6ad05454f138397036954fe36c778c
+
+JIRA: https://issues.redhat.com/browse/RHEL-21157
+CVE: CVE-2022-36764
+Upstream: Merged
+
+commit 264636d8e6983e0f6dc6be2fca9d84ec81315954
+Author: Doug Flick <dougflick@microsoft.com>
+Date:   Wed Jan 17 14:47:22 2024 -0800
+
+    SecurityPkg: : Updating SecurityFixes.yaml after symbol rename
+
+    Adding the new commit titles for the symbol renames
+
+    Cc: Jiewen Yao <jiewen.yao@intel.com>
+    Cc: Rahul Kumar <rahul1.kumar@intel.com>
+
+    Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
+    Message-Id: <5e0e851e97459e183420178888d4fcdadc2f1ae1.1705529990.git.doug.edk2@gmail.com>
+    Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
+
+Signed-off-by: Jon Maloy <jmaloy@redhat.com>
+---
+ SecurityPkg/SecurityFixes.yaml | 31 ++++++++++++++++++++++++++-----
+ 1 file changed, 26 insertions(+), 5 deletions(-)
+
+diff --git a/SecurityPkg/SecurityFixes.yaml b/SecurityPkg/SecurityFixes.yaml
+index f9e3e7be74..dc1bb83489 100644
+--- a/SecurityPkg/SecurityFixes.yaml
++++ b/SecurityPkg/SecurityFixes.yaml
+@@ -9,14 +9,35 @@ CVE_2022_36763:
+     - "SecurityPkg: DxeTpm2Measurement: SECURITY PATCH 4117 - CVE 2022-36763"
+     - "SecurityPkg: DxeTpmMeasurement: SECURITY PATCH 4117 - CVE 2022-36763"
+     - "SecurityPkg: : Adding CVE 2022-36763 to SecurityFixes.yaml"
++    - "SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117/4118 symbol rename"
++    - "SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117/4118 symbol rename"
++    - "SecurityPkg: : Updating SecurityFixes.yaml after symbol rename"
+   cve: CVE-2022-36763
+   date_reported: 2022-10-25 11:31 UTC
+   description: (CVE-2022-36763) - Heap Buffer Overflow in Tcg2MeasureGptTable()
+   note: This patch is related to and supersedes TCBZ2168
+   files_impacted:
+-  - Library\DxeTpm2MeasureBootLib\DxeTpm2MeasureBootLib.c
+-  - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
++    - Library\DxeTpm2MeasureBootLib\DxeTpm2MeasureBootLib.c
++    - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
+   links:
+-  - https://bugzilla.tianocore.org/show_bug.cgi?id=4117
+-  - https://bugzilla.tianocore.org/show_bug.cgi?id=2168
+-  - https://bugzilla.tianocore.org/show_bug.cgi?id=1990
++    - https://bugzilla.tianocore.org/show_bug.cgi?id=4117
++    - https://bugzilla.tianocore.org/show_bug.cgi?id=2168
++    - https://bugzilla.tianocore.org/show_bug.cgi?id=1990
++CVE_2022_36764:
++  commit_titles:
++    - "SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764"
++    - "SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764"
++    - "SecurityPkg: : Adding CVE 2022-36764 to SecurityFixes.yaml"
++    - "SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4117/4118 symbol rename"
++    - "SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4117/4118 symbol rename"
++    - "SecurityPkg: : Updating SecurityFixes.yaml after symbol rename"
++  cve: CVE-2022-36764
++  date_reported: 2022-10-25 12:23 UTC
++  description: Heap Buffer Overflow in Tcg2MeasurePeImage()
++  note:
++  files_impacted:
++    - Library\DxeTpm2MeasureBootLib\DxeTpm2MeasureBootLib.c
++    - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
++  links:
++    - https://bugzilla.tianocore.org/show_bug.cgi?id=4118
++
+-- 
+2.39.3
+