diff --git a/0050-OvmfPkg-PlatformBootManagerLib-connect-consoles-unco.patch b/0050-OvmfPkg-PlatformBootManagerLib-connect-consoles-unco.patch
new file mode 100644
index 0000000..49c04e6
--- /dev/null
+++ b/0050-OvmfPkg-PlatformBootManagerLib-connect-consoles-unco.patch
@@ -0,0 +1,206 @@
+From f803c03cc2e0b6b0b0bed447a97ea2c61b04ed82 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Sun, 13 May 2018 00:13:53 +0200
+Subject: [PATCH] OvmfPkg/PlatformBootManagerLib: connect consoles
+ unconditionally
+
+If both ConIn and ConOut exist, but ConIn references none of the PS/2
+keyboard, the USB wild-card keyboard, and any serial ports, then
+PlatformInitializeConsole() currently allows the boot to proceed without
+any input devices at all. This makes for a bad user experience -- the
+firmware menu could only be entered through OsIndications, set by a guest
+OS.
+
+Do what ArmVirtQemu does already, namely connect the consoles, and add
+them to ConIn / ConOut / ErrOut, unconditionally. (The underlying
+EfiBootManagerUpdateConsoleVariable() function checks for duplicates.)
+
+The issue used to be masked by the EfiBootManagerConnectAll() call that
+got conditionalized in commit 245c643cc8b7.
+
+This patch is best viewed with "git show -b -W".
+
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Jordan Justen <jordan.l.justen@intel.com>
+Fixes: 245c643cc8b73240c3b88cb55b2911b285a8c10d
+Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1577546
+Contributed-under: TianoCore Contribution Agreement 1.1
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+---
+ .../PlatformBootManagerLib/BdsPlatform.c      | 127 ++++++------------
+ 1 file changed, 44 insertions(+), 83 deletions(-)
+
+diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+index 862fa6ebb4..004b753f4d 100644
+--- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
++++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+@@ -26,7 +26,6 @@ VOID          *mEfiDevPathNotifyReg;
+ EFI_EVENT     mEfiDevPathEvent;
+ VOID          *mEmuVariableEventReg;
+ EFI_EVENT     mEmuVariableEvent;
+-BOOLEAN       mDetectVgaOnly;
+ UINT16        mHostBridgeDevId;
+ 
+ //
+@@ -830,35 +829,33 @@ DetectAndPreparePlatformPciDevicePath (
+     );
+   ASSERT_EFI_ERROR (Status);
+ 
+-  if (!mDetectVgaOnly) {
++  //
++  // Here we decide whether it is LPC Bridge
++  //
++  if ((IS_PCI_LPC (Pci)) ||
++      ((IS_PCI_ISA_PDECODE (Pci)) &&
++       (Pci->Hdr.VendorId == 0x8086) &&
++       (Pci->Hdr.DeviceId == 0x7000)
++      )
++     ) {
+     //
+-    // Here we decide whether it is LPC Bridge
++    // Add IsaKeyboard to ConIn,
++    // add IsaSerial to ConOut, ConIn, ErrOut
+     //
+-    if ((IS_PCI_LPC (Pci)) ||
+-        ((IS_PCI_ISA_PDECODE (Pci)) &&
+-         (Pci->Hdr.VendorId == 0x8086) &&
+-         (Pci->Hdr.DeviceId == 0x7000)
+-        )
+-       ) {
+-      //
+-      // Add IsaKeyboard to ConIn,
+-      // add IsaSerial to ConOut, ConIn, ErrOut
+-      //
+-      DEBUG ((EFI_D_INFO, "Found LPC Bridge device\n"));
+-      PrepareLpcBridgeDevicePath (Handle);
+-      return EFI_SUCCESS;
+-    }
++    DEBUG ((EFI_D_INFO, "Found LPC Bridge device\n"));
++    PrepareLpcBridgeDevicePath (Handle);
++    return EFI_SUCCESS;
++  }
++  //
++  // Here we decide which Serial device to enable in PCI bus
++  //
++  if (IS_PCI_16550SERIAL (Pci)) {
+     //
+-    // Here we decide which Serial device to enable in PCI bus
++    // Add them to ConOut, ConIn, ErrOut.
+     //
+-    if (IS_PCI_16550SERIAL (Pci)) {
+-      //
+-      // Add them to ConOut, ConIn, ErrOut.
+-      //
+-      DEBUG ((EFI_D_INFO, "Found PCI 16550 SERIAL device\n"));
+-      PreparePciSerialDevicePath (Handle);
+-      return EFI_SUCCESS;
+-    }
++    DEBUG ((EFI_D_INFO, "Found PCI 16550 SERIAL device\n"));
++    PreparePciSerialDevicePath (Handle);
++    return EFI_SUCCESS;
+   }
+ 
+   //
+@@ -877,26 +874,6 @@ DetectAndPreparePlatformPciDevicePath (
+ }
+ 
+ 
+-/**
+-  Do platform specific PCI Device check and add them to ConOut, ConIn, ErrOut
+-
+-  @param[in]  DetectVgaOnly - Only detect VGA device if it's TRUE.
+-
+-  @retval EFI_SUCCESS - PCI Device check and Console variable update
+-                        successfully.
+-  @retval EFI_STATUS - PCI Device check or Console variable update fail.
+-
+-**/
+-EFI_STATUS
+-DetectAndPreparePlatformPciDevicePaths (
+-  BOOLEAN DetectVgaOnly
+-  )
+-{
+-  mDetectVgaOnly = DetectVgaOnly;
+-  return VisitAllPciInstances (DetectAndPreparePlatformPciDevicePath);
+-}
+-
+-
+ /**
+   Connect the predefined platform default console device.
+ 
+@@ -910,50 +887,34 @@ PlatformInitializeConsole (
+   )
+ {
+   UINTN                              Index;
+-  EFI_DEVICE_PATH_PROTOCOL           *VarConout;
+-  EFI_DEVICE_PATH_PROTOCOL           *VarConin;
+ 
+   //
+-  // Connect RootBridge
++  // Do platform specific PCI Device check and add them to ConOut, ConIn,
++  // ErrOut
+   //
+-  GetEfiGlobalVariable2 (EFI_CON_OUT_VARIABLE_NAME, (VOID **) &VarConout,
+-    NULL);
+-  GetEfiGlobalVariable2 (EFI_CON_IN_VARIABLE_NAME, (VOID **) &VarConin, NULL);
+-
+-  if (VarConout == NULL || VarConin == NULL) {
+-    //
+-    // Do platform specific PCI Device check and add them to ConOut, ConIn,
+-    // ErrOut
+-    //
+-    DetectAndPreparePlatformPciDevicePaths (FALSE);
++  VisitAllPciInstances (DetectAndPreparePlatformPciDevicePath);
+ 
++  //
++  // Have chance to connect the platform default console,
++  // the platform default console is the minimum device group
++  // the platform should support
++  //
++  for (Index = 0; PlatformConsole[Index].DevicePath != NULL; ++Index) {
+     //
+-    // Have chance to connect the platform default console,
+-    // the platform default console is the minimum device group
+-    // the platform should support
++    // Update the console variable with the connect type
+     //
+-    for (Index = 0; PlatformConsole[Index].DevicePath != NULL; ++Index) {
+-      //
+-      // Update the console variable with the connect type
+-      //
+-      if ((PlatformConsole[Index].ConnectType & CONSOLE_IN) == CONSOLE_IN) {
+-        EfiBootManagerUpdateConsoleVariable (ConIn,
+-          PlatformConsole[Index].DevicePath, NULL);
+-      }
+-      if ((PlatformConsole[Index].ConnectType & CONSOLE_OUT) == CONSOLE_OUT) {
+-        EfiBootManagerUpdateConsoleVariable (ConOut,
+-          PlatformConsole[Index].DevicePath, NULL);
+-      }
+-      if ((PlatformConsole[Index].ConnectType & STD_ERROR) == STD_ERROR) {
+-        EfiBootManagerUpdateConsoleVariable (ErrOut,
+-          PlatformConsole[Index].DevicePath, NULL);
+-      }
++    if ((PlatformConsole[Index].ConnectType & CONSOLE_IN) == CONSOLE_IN) {
++      EfiBootManagerUpdateConsoleVariable (ConIn,
++        PlatformConsole[Index].DevicePath, NULL);
++    }
++    if ((PlatformConsole[Index].ConnectType & CONSOLE_OUT) == CONSOLE_OUT) {
++      EfiBootManagerUpdateConsoleVariable (ConOut,
++        PlatformConsole[Index].DevicePath, NULL);
++    }
++    if ((PlatformConsole[Index].ConnectType & STD_ERROR) == STD_ERROR) {
++      EfiBootManagerUpdateConsoleVariable (ErrOut,
++        PlatformConsole[Index].DevicePath, NULL);
+     }
+-  } else {
+-    //
+-    // Only detect VGA device and add them to ConOut
+-    //
+-    DetectAndPreparePlatformPciDevicePaths (TRUE);
+   }
+ }
+ 
+-- 
+2.17.0
+
diff --git a/0051-ArmVirtPkg-PlatformBootManagerLib-connect-Virtio-RNG.patch b/0051-ArmVirtPkg-PlatformBootManagerLib-connect-Virtio-RNG.patch
new file mode 100644
index 0000000..4a8f98b
--- /dev/null
+++ b/0051-ArmVirtPkg-PlatformBootManagerLib-connect-Virtio-RNG.patch
@@ -0,0 +1,199 @@
+From c4add6b6e971e0bb3f276ed3636a083e782e96cc Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Thu, 17 May 2018 21:51:11 +0200
+Subject: [PATCH] ArmVirtPkg/PlatformBootManagerLib: connect Virtio RNG devices
+ again
+
+Virtio RNG devices are never boot devices, so in commit ff1d0fbfbaec we
+stopped connecting them. This is a problem because an OS boot loader may
+depend on EFI_RNG_PROTOCOL to seed the OS's RNG.
+
+Connect Virtio RNG devices again. And, while commit ff1d0fbfbaec removed
+that from PlatformBootManagerAfterConsole(), reintroduce it now to
+PlatformBootManagerBeforeConsole() -- this way Driver#### options launched
+between both functions may access EFI_RNG_PROTOCOL too.
+
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Fixes: ff1d0fbfbaec55038ccf888759588fa4e21516f4
+Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1579518
+Contributed-under: TianoCore Contribution Agreement 1.1
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+---
+ .../PlatformBootManagerLib.inf                |   1 +
+ .../PlatformBootManagerLib/PlatformBm.c       | 129 ++++++++++++++++++
+ 2 files changed, 130 insertions(+)
+
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+index 1e22f8bb38..d6c1ef95dc 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
++++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBootManagerLib.inf
+@@ -83,3 +83,4 @@ [Protocols]
+   gEfiLoadedImageProtocolGuid
+   gEfiPciRootBridgeIoProtocolGuid
+   gEfiSimpleFileSystemProtocolGuid
++  gVirtioDeviceProtocolGuid
+diff --git a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+index 5d5e51d8c8..62cce6a01e 100644
+--- a/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
++++ b/ArmVirtPkg/Library/PlatformBootManagerLib/PlatformBm.c
+@@ -16,6 +16,7 @@
+ **/
+ 
+ #include <IndustryStandard/Pci22.h>
++#include <IndustryStandard/Virtio095.h>
+ #include <Library/BootLogoLib.h>
+ #include <Library/DevicePathLib.h>
+ #include <Library/PcdLib.h>
+@@ -27,6 +28,7 @@
+ #include <Protocol/LoadedImage.h>
+ #include <Protocol/PciIo.h>
+ #include <Protocol/PciRootBridgeIo.h>
++#include <Protocol/VirtioDevice.h>
+ #include <Guid/EventGroup.h>
+ #include <Guid/RootBridgesConnectedEventGroup.h>
+ 
+@@ -260,6 +262,121 @@ IsPciDisplay (
+ }
+ 
+ 
++/**
++  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
++  the VIRTIO_DEVICE_PROTOCOL level.
++**/
++STATIC
++BOOLEAN
++EFIAPI
++IsVirtioRng (
++  IN EFI_HANDLE   Handle,
++  IN CONST CHAR16 *ReportText
++  )
++{
++  EFI_STATUS             Status;
++  VIRTIO_DEVICE_PROTOCOL *VirtIo;
++
++  Status = gBS->HandleProtocol (Handle, &gVirtioDeviceProtocolGuid,
++                  (VOID**)&VirtIo);
++  if (EFI_ERROR (Status)) {
++    return FALSE;
++  }
++  return (BOOLEAN)(VirtIo->SubSystemDeviceId ==
++                   VIRTIO_SUBSYSTEM_ENTROPY_SOURCE);
++}
++
++
++/**
++  This FILTER_FUNCTION checks if a handle corresponds to a Virtio RNG device at
++  the EFI_PCI_IO_PROTOCOL level.
++**/
++STATIC
++BOOLEAN
++EFIAPI
++IsVirtioPciRng (
++  IN EFI_HANDLE   Handle,
++  IN CONST CHAR16 *ReportText
++  )
++{
++  EFI_STATUS          Status;
++  EFI_PCI_IO_PROTOCOL *PciIo;
++  UINT16              VendorId;
++  UINT16              DeviceId;
++  UINT8               RevisionId;
++  BOOLEAN             Virtio10;
++  UINT16              SubsystemId;
++
++  Status = gBS->HandleProtocol (Handle, &gEfiPciIoProtocolGuid,
++                  (VOID**)&PciIo);
++  if (EFI_ERROR (Status)) {
++    return FALSE;
++  }
++
++  //
++  // Read and check VendorId.
++  //
++  Status = PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16, PCI_VENDOR_ID_OFFSET,
++                        1, &VendorId);
++  if (EFI_ERROR (Status)) {
++    goto PciError;
++  }
++  if (VendorId != VIRTIO_VENDOR_ID) {
++    return FALSE;
++  }
++
++  //
++  // Read DeviceId and RevisionId.
++  //
++  Status = PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16, PCI_DEVICE_ID_OFFSET,
++                        1, &DeviceId);
++  if (EFI_ERROR (Status)) {
++    goto PciError;
++  }
++  Status = PciIo->Pci.Read (PciIo, EfiPciIoWidthUint8, PCI_REVISION_ID_OFFSET,
++                        1, &RevisionId);
++  if (EFI_ERROR (Status)) {
++    goto PciError;
++  }
++
++  //
++  // From DeviceId and RevisionId, determine whether the device is a
++  // modern-only Virtio 1.0 device. In case of Virtio 1.0, DeviceId can
++  // immediately be restricted to VIRTIO_SUBSYSTEM_ENTROPY_SOURCE, and
++  // SubsystemId will only play a sanity-check role. Otherwise, DeviceId can
++  // only be sanity-checked, and SubsystemId will decide.
++  //
++  if (DeviceId == 0x1040 + VIRTIO_SUBSYSTEM_ENTROPY_SOURCE &&
++      RevisionId >= 0x01) {
++    Virtio10 = TRUE;
++  } else if (DeviceId >= 0x1000 && DeviceId <= 0x103F && RevisionId == 0x00) {
++    Virtio10 = FALSE;
++  } else {
++    return FALSE;
++  }
++
++  //
++  // Read and check SubsystemId as dictated by Virtio10.
++  //
++  Status = PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16,
++                        PCI_SUBSYSTEM_ID_OFFSET, 1, &SubsystemId);
++  if (EFI_ERROR (Status)) {
++    goto PciError;
++  }
++  if (Virtio10 && SubsystemId >= 0x40) {
++    return TRUE;
++  }
++  if (!Virtio10 && SubsystemId == VIRTIO_SUBSYSTEM_ENTROPY_SOURCE) {
++    return TRUE;
++  }
++  return FALSE;
++
++PciError:
++  DEBUG ((DEBUG_ERROR, "%a: %s: %r\n", __FUNCTION__, ReportText, Status));
++  return FALSE;
++}
++
++
+ /**
+   This CALLBACK_FUNCTION attempts to connect a handle non-recursively, asking
+   the matching driver to produce all first-level child handles.
+@@ -644,6 +761,18 @@ PlatformBootManagerBeforeConsole (
+   // Register platform-specific boot options and keyboard shortcuts.
+   //
+   PlatformRegisterOptionsAndKeys ();
++
++  //
++  // At this point, VIRTIO_DEVICE_PROTOCOL instances exist only for Virtio MMIO
++  // transports. Install EFI_RNG_PROTOCOL instances on Virtio MMIO RNG devices.
++  //
++  FilterAndProcess (&gVirtioDeviceProtocolGuid, IsVirtioRng, Connect);
++
++  //
++  // Install both VIRTIO_DEVICE_PROTOCOL and (dependent) EFI_RNG_PROTOCOL
++  // instances on Virtio PCI RNG devices.
++  //
++  FilterAndProcess (&gEfiPciIoProtocolGuid, IsVirtioPciRng, Connect);
+ }
+ 
+ /**
+-- 
+2.17.0
+
diff --git a/0052-OvmfPkg-PlatformBootManagerLib-connect-Virtio-RNG-de.patch b/0052-OvmfPkg-PlatformBootManagerLib-connect-Virtio-RNG-de.patch
new file mode 100644
index 0000000..66f3469
--- /dev/null
+++ b/0052-OvmfPkg-PlatformBootManagerLib-connect-Virtio-RNG-de.patch
@@ -0,0 +1,172 @@
+From 7ebad830d6ab61f0395f6f4bae4156664bbd8086 Mon Sep 17 00:00:00 2001
+From: Laszlo Ersek <lersek@redhat.com>
+Date: Thu, 17 May 2018 21:51:11 +0200
+Subject: [PATCH] OvmfPkg/PlatformBootManagerLib: connect Virtio RNG devices
+ again
+
+Virtio RNG devices are never boot devices, so in commit 245c643cc8b7 we
+stopped connecting them. This is a problem because an OS boot loader may
+depend on EFI_RNG_PROTOCOL to seed the OS's RNG.
+
+Connect Virtio RNG devices again. And, while commit 245c643cc8b7 removed
+that from PlatformBootManagerAfterConsole(), reintroduce it now to
+PlatformBootManagerBeforeConsole() -- this way Driver#### options launched
+between both functions may access EFI_RNG_PROTOCOL too.
+
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Jordan Justen <jordan.l.justen@intel.com>
+Fixes: 245c643cc8b73240c3b88cb55b2911b285a8c10d
+Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1579518
+Contributed-under: TianoCore Contribution Agreement 1.1
+Signed-off-by: Laszlo Ersek <lersek@redhat.com>
+Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+---
+ .../PlatformBootManagerLib/BdsPlatform.h      |   1 +
+ .../PlatformBootManagerLib/BdsPlatform.c      | 105 ++++++++++++++++++
+ 2 files changed, 106 insertions(+)
+
+diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.h b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.h
+index 97ffbb5148..4948ca6518 100644
+--- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.h
++++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.h
+@@ -30,6 +30,7 @@ Abstract:
+ #include <IndustryStandard/Acpi.h>
+ #include <IndustryStandard/SmBios.h>
+ #include <IndustryStandard/PeImage.h>
++#include <IndustryStandard/Virtio095.h>
+ 
+ #include <Library/DebugLib.h>
+ #include <Library/BaseMemoryLib.h>
+diff --git a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+index 004b753f4d..5d4d323d73 100644
+--- a/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
++++ b/OvmfPkg/Library/PlatformBootManagerLib/BdsPlatform.c
+@@ -318,6 +318,15 @@ ConnectRootBridge (
+   IN VOID        *Context
+   );
+ 
++STATIC
++EFI_STATUS
++EFIAPI
++ConnectVirtioPciRng (
++  IN EFI_HANDLE Handle,
++  IN VOID       *Instance,
++  IN VOID       *Context
++  );
++
+ STATIC
+ VOID
+ SaveS3BootScript (
+@@ -399,6 +408,13 @@ PlatformBootManagerBeforeConsole (
+   ASSERT_RETURN_ERROR (PcdStatus);
+ 
+   PlatformRegisterOptionsAndKeys ();
++
++  //
++  // Install both VIRTIO_DEVICE_PROTOCOL and (dependent) EFI_RNG_PROTOCOL
++  // instances on Virtio PCI RNG devices.
++  //
++  VisitAllInstancesOfProtocol (&gEfiPciIoProtocolGuid, ConnectVirtioPciRng,
++    NULL);
+ }
+ 
+ 
+@@ -427,6 +443,95 @@ ConnectRootBridge (
+ }
+ 
+ 
++STATIC
++EFI_STATUS
++EFIAPI
++ConnectVirtioPciRng (
++  IN EFI_HANDLE Handle,
++  IN VOID       *Instance,
++  IN VOID       *Context
++  )
++{
++  EFI_PCI_IO_PROTOCOL *PciIo;
++  EFI_STATUS          Status;
++  UINT16              VendorId;
++  UINT16              DeviceId;
++  UINT8               RevisionId;
++  BOOLEAN             Virtio10;
++  UINT16              SubsystemId;
++
++  PciIo = Instance;
++
++  //
++  // Read and check VendorId.
++  //
++  Status = PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16, PCI_VENDOR_ID_OFFSET,
++                        1, &VendorId);
++  if (EFI_ERROR (Status)) {
++    goto Error;
++  }
++  if (VendorId != VIRTIO_VENDOR_ID) {
++    return EFI_SUCCESS;
++  }
++
++  //
++  // Read DeviceId and RevisionId.
++  //
++  Status = PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16, PCI_DEVICE_ID_OFFSET,
++                        1, &DeviceId);
++  if (EFI_ERROR (Status)) {
++    goto Error;
++  }
++  Status = PciIo->Pci.Read (PciIo, EfiPciIoWidthUint8, PCI_REVISION_ID_OFFSET,
++                        1, &RevisionId);
++  if (EFI_ERROR (Status)) {
++    goto Error;
++  }
++
++  //
++  // From DeviceId and RevisionId, determine whether the device is a
++  // modern-only Virtio 1.0 device. In case of Virtio 1.0, DeviceId can
++  // immediately be restricted to VIRTIO_SUBSYSTEM_ENTROPY_SOURCE, and
++  // SubsystemId will only play a sanity-check role. Otherwise, DeviceId can
++  // only be sanity-checked, and SubsystemId will decide.
++  //
++  if (DeviceId == 0x1040 + VIRTIO_SUBSYSTEM_ENTROPY_SOURCE &&
++      RevisionId >= 0x01) {
++    Virtio10 = TRUE;
++  } else if (DeviceId >= 0x1000 && DeviceId <= 0x103F && RevisionId == 0x00) {
++    Virtio10 = FALSE;
++  } else {
++    return EFI_SUCCESS;
++  }
++
++  //
++  // Read and check SubsystemId as dictated by Virtio10.
++  //
++  Status = PciIo->Pci.Read (PciIo, EfiPciIoWidthUint16,
++                        PCI_SUBSYSTEM_ID_OFFSET, 1, &SubsystemId);
++  if (EFI_ERROR (Status)) {
++    goto Error;
++  }
++  if ((Virtio10 && SubsystemId >= 0x40) ||
++      (!Virtio10 && SubsystemId == VIRTIO_SUBSYSTEM_ENTROPY_SOURCE)) {
++    Status = gBS->ConnectController (
++                    Handle, // ControllerHandle
++                    NULL,   // DriverImageHandle -- connect all drivers
++                    NULL,   // RemainingDevicePath -- produce all child handles
++                    FALSE   // Recursive -- don't follow child handles
++                    );
++    if (EFI_ERROR (Status)) {
++      goto Error;
++    }
++  }
++  return EFI_SUCCESS;
++
++Error:
++  DEBUG ((DEBUG_ERROR, "%a: %r\n", __FUNCTION__, Status));
++  return Status;
++}
++
++
+ /**
+   Add IsaKeyboard to ConIn; add IsaSerial to ConOut, ConIn, ErrOut.
+ 
+-- 
+2.17.0
+
diff --git a/edk2.spec b/edk2.spec
index 78da3bc..546d3dd 100644
--- a/edk2.spec
+++ b/edk2.spec
@@ -35,7 +35,7 @@
 
 Name:           edk2
 Version:        %{edk2_date}git%{edk2_githash}
-Release:        1%{dist}
+Release:        2%{dist}
 Summary:        EFI Development Kit II
 
 Group:          Applications/Emulators
@@ -68,7 +68,10 @@ Patch0014: 0014-ArmPlatformPkg-introduce-fixed-PCD-for-early-hello-m.patch
 Patch0015: 0015-ArmPlatformPkg-PrePeiCore-write-early-hello-message-.patch
 Patch0016: 0016-ArmVirtPkg-set-early-hello-message-RH-only.patch
 
-# upstream backports - None! :)
+# upstream backports
+Patch0050: 0050-OvmfPkg-PlatformBootManagerLib-connect-consoles-unco.patch
+Patch0051: 0051-ArmVirtPkg-PlatformBootManagerLib-connect-Virtio-RNG.patch
+Patch0052: 0052-OvmfPkg-PlatformBootManagerLib-connect-Virtio-RNG-de.patch
 
 %if 0%{?cross:1}
 # Tweak the tools_def to support cross-compiling.
@@ -507,8 +510,12 @@ install qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator %{buildroot}%{_
 
 
 %changelog
+* Wed Jun 20 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-2
+- Backport two bug fixes from RHEL: connect again virtio-rng devices, and
+  connect consoles unconditionally in OVMF (ARM firmware already did it)
+
 * Tue May 29 2018 Paolo Bonzini <pbonzini@redhat.com> - 20180529gitee3198e672e2-1
-- Bump release for new build
+- Rebase to ee3198e672e2
 
 * Tue May 01 2018 Cole Robinson <crobinso@redhat.com> - 20171011git92d07e4-7
 - Bump release for new build