21 changed files with 481 additions and 2131 deletions
--- a/0
+++ b/0
--- a/277
+++ b/277
@ -0,0 +1,277 @@
 A10-OLinuXino-Lime
 A10s-OLinuXino-M
 A13-OLinuXino
 A13-OLinuXinoM
 A20-Olimex-SOM-EVB
 A20-OLinuXino-Lime
 A20-OLinuXino-Lime2
 A20-OLinuXino_MICRO
 am335x_evm
 am57xx_evm
 Ampe_A76
 apalis_imx6
 arndale
 Auxtek-T003
 Auxtek-T004
 ba10_tv_box
 Bananapi
 bananapi_m1_plus
 bananapi_m2_berry
 Bananapi_m2m
 bananapi_m2_plus_h3
 Bananapi_M2_Ultra
 bananapi_m2_zero
 Bananapro
 chiliboard
 CHIP
 Chuwi_V7_CW0825
 clearfog
 cm_fx6
 Colombus
 colorfly_e708_q1
 CSQ_CS908
 Cubieboard
 Cubieboard2
 Cubieboard4
 Cubietruck
 Cubietruck_plus
 db-mv784mp-gp
 difrnce_dit4350
 dserve_dsrv9703c
 evb-rk3229
 firefly-rk3288
 helios4
 Hummingbird_A31
 Hyundai_A7HD
 i12-tvbox
 icnova-a20-swac
 inet1
 iNet_3F
 iNet_3W
 inet86dz
 iNet_86VS
 inet97fv2
 inet98v_rev2
 inet9f_rev03
 inet_q972
 Itead_Ibox_A20
 jesurun_q5
 jetson-tk1
 kc1
 Lamobo_R1
 libretech_all_h3_cc_h2_plus
 Linksprite_pcDuino
 Linksprite_pcDuino3
 Linksprite_pcDuino3_Nano
 liteboard
 marsboard
 Marsboard_A10
 Mele_A1000
 Mele_A1000G_quad
 Mele_I7
 Mele_M3
 Mele_M5
 Mele_M9
 Mini-X
 mk802
 mk802_a10s
 mk802ii
 MK808C
 MSI_Primo73
 MSI_Primo81
 mx6cuboxi
 nanopi_m1
 nanopi_m1_plus
 nanopi_neo
 novena
 odroid
 odroid-xu3
 omap3_beagle
 omap4_panda
 omap5_uevm
 Orangepi
 orangepi_2
 orangepi_lite
 Orangepi_mini
 orangepi_one
 orangepi_pc
 orangepi_pc_plus
 orangepi_plus
 orangepi_plus2e
 orangepi_r1
 orangepi_zero
 origen
 paz00
 polaroid_mid2809pxe04
 pov_protab2_ips9
 q8_a13_tablet
 q8_a23_tablet_800x480
 q8_a33_tablet_1024x600
 q8_a33_tablet_800x480
 qemu_arm
 r7-tv-dongle
 riotboard
 rock
 rock2
 rpi_2
 rpi_3_32b
 rpi_4_32b
 Sinlinx_SinA31s
 Sinovoip_BPI_M2
 Sinovoip_BPI_M3
 stih410-b2260
 sunxi_Gemei_G9
 tbs_a711
 tinker-rk3288
 trimslice
 udoo
 udoo_neo
 usbarmory
 UTOO_P66
 vexpress_ca15_tc2
 vexpress_ca9x4
 wandboard
 warp
 warp7
 Wexler_TAB7200
 Wits_Pro_A20_DKT
 Yones_Toptech_BS1078_V2
 xilinx_zynq_virtA10-OLinuXino-Lime
 A10s-OLinuXino-M
 A13-OLinuXino
 A13-OLinuXinoM
 A20-Olimex-SOM-EVB
 A20-OLinuXino-Lime
 A20-OLinuXino-Lime2
 A20-OLinuXino_MICRO
 am335x_evm
 am57xx_evm
 Ampe_A76
 apalis_imx6
 arndale
 Auxtek-T003
 Auxtek-T004
 ba10_tv_box
 Bananapi
 bananapi_m1_plus
 bananapi_m2_berry
 Bananapi_m2m
 bananapi_m2_plus_h3
 Bananapi_M2_Ultra
 bananapi_m2_zero
 Bananapro
 chiliboard
 CHIP
 Chuwi_V7_CW0825
 clearfog
 cm_fx6
 Colombus
 colorfly_e708_q1
 CSQ_CS908
 Cubieboard
 Cubieboard2
 Cubieboard4
 Cubietruck
 Cubietruck_plus
 db-mv784mp-gp
 difrnce_dit4350
 dserve_dsrv9703c
 evb-rk3229
 firefly-rk3288
 helios4
 Hummingbird_A31
 Hyundai_A7HD
 i12-tvbox
 icnova-a20-swac
 inet1
 iNet_3F
 iNet_3W
 inet86dz
 iNet_86VS
 inet97fv2
 inet98v_rev2
 inet9f_rev03
 inet_q972
 Itead_Ibox_A20
 jesurun_q5
 jetson-tk1
 kc1
 Lamobo_R1
 libretech_all_h3_cc_h2_plus
 Linksprite_pcDuino
 Linksprite_pcDuino3
 Linksprite_pcDuino3_Nano
 liteboard
 marsboard
 Marsboard_A10
 Mele_A1000
 Mele_A1000G_quad
 Mele_I7
 Mele_M3
 Mele_M5
 Mele_M9
 Mini-X
 mk802
 mk802_a10s
 mk802ii
 MK808C
 MSI_Primo73
 MSI_Primo81
 mx6cuboxi
 nanopi_m1
 nanopi_m1_plus
 nanopi_neo
 novena
 odroid
 odroid-xu3
 omap3_beagle
 omap4_panda
 omap5_uevm
 Orangepi
 orangepi_2
 orangepi_lite
 Orangepi_mini
 orangepi_one
 orangepi_pc
 orangepi_pc_plus
 orangepi_plus
 orangepi_plus2e
 orangepi_r1
 orangepi_zero
 origen
 paz00
 polaroid_mid2809pxe04
 pov_protab2_ips9
 q8_a13_tablet
 q8_a23_tablet_800x480
 q8_a33_tablet_1024x600
 q8_a33_tablet_800x480
 qemu_arm
 r7-tv-dongle
 riotboard
 rock
 rock2
 rpi_2
 rpi_3_32b
 rpi_4_32b
 Sinlinx_SinA31s
 Sinovoip_BPI_M2
 Sinovoip_BPI_M3
 stih410-b2260
 sunxi_Gemei_G9
 tbs_a711
 tinker-rk3288
 trimslice
 udoo
 udoo_neo
 usbarmory
 UTOO_P66
 vexpress_ca15_tc2
 vexpress_ca9x4
 wandboard
 warp
 warp7
 Wexler_TAB7200
 Wits_Pro_A20_DKT
 Yones_Toptech_BS1078_V2
 xilinx_zynq_virt
--- a/8
+++ b/8
@ -0,0 +1,8 @@
 chromebit_mickey_defconfig
 chromebook_jerry_defconfig
 chromebook_minnie_defconfig
 nyan-big_defconfig
 peach-pi_defconfig
 peach-pit_defconfig
 snow_defconfig
 spring_defconfig
--- a/backport-0001-CVE-2024-57258.patch
+++ b/backport-0001-CVE-2024-57258.patch
@ -1,40 +0,0 @@
 From 0a10b49206a29b4aa2f80233a3e53ca0466bb0b3 Mon Sep 17 00:00:00 2001
 From: Richard Weinberger <richard@nod.at>
 Date: Fri, 2 Aug 2024 12:08:45 +0200
 Subject: [PATCH] dlmalloc: Fix integer overflow in sbrk()
 Make sure that the new break is within mem_malloc_start
 and mem_malloc_end before making progress.
 ulong new = old + increment; can overflow for extremely large
 increment values and memset() can get wrongly called.
 Signed-off-by: Richard Weinberger <richard@nod.at>
 Reviewed-by: Simon Glass <sjg@chromium.org>
 ---
 common/dlmalloc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/common/dlmalloc.c b/common/dlmalloc.c
 index 48e83da6cbce..8e201ac0dc59 100644
 --- a/common/dlmalloc.c
 +++ b/common/dlmalloc.c
@@ -581,6 +581,9 @@ void *sbrk(ptrdiff_t increment)
 	ulong old = mem_malloc_brk;
 	ulong new = old + increment;
 +	if ((new < mem_malloc_start) || (new > mem_malloc_end))
 +		return (void *)MORECORE_FAILURE;
 +
 	/*
 	 * if we are giving memory back make sure we clear it out since
 	 * we set MORECORE_CLEARS to 1
@@ -588,9 +591,6 @@ void *sbrk(ptrdiff_t increment)
 	if (increment < 0)
 		memset((void *)new, 0, -increment);
 -	if ((new < mem_malloc_start) || (new > mem_malloc_end))
 -		return (void *)MORECORE_FAILURE;
 -
 	mem_malloc_brk = new;
 	return (void *)old;
--- a/backport-0002-CVE-2024-57258.patch
+++ b/backport-0002-CVE-2024-57258.patch
@ -1,36 +0,0 @@
 From 8642b2178d2c4002c99a0b69a845a48f2ae2706f Mon Sep 17 00:00:00 2001
 From: Richard Weinberger <richard@nod.at>
 Date: Fri, 2 Aug 2024 12:08:44 +0200
 Subject: [PATCH] dlmalloc: Fix integer overflow in request2size()
 req is of type size_t, casting it to long opens the door
 for an integer overflow.
 Values between LONG_MAX - (SIZE_SZ + MALLOC_ALIGN_MASK) - 1 and LONG_MAX
 cause and overflow such that request2size() returns MINSIZE.
 Fix by removing the cast.
 The origin of the cast is unclear, it's in u-boot and ppcboot since ever
 and predates the CVS history.
 Doug Lea's original dlmalloc implementation also doesn't have it.
 Signed-off-by: Richard Weinberger <richard@nod.at>
 Reviewed-by: Simon Glass <sjg@chromium.org>
 ---
 common/dlmalloc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/common/dlmalloc.c b/common/dlmalloc.c
 index 1e1602a24dec..48e83da6cbce 100644
 --- a/common/dlmalloc.c
 +++ b/common/dlmalloc.c
@@ -386,8 +386,8 @@ nextchunk-> +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 /* pad request bytes into a usable size */
 #define request2size(req) \
 - (((long)((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \
 -  (long)(MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \
 + ((((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) < \
 +  (MINSIZE + MALLOC_ALIGN_MASK)) ? MINSIZE : \
    (((req) + (SIZE_SZ + MALLOC_ALIGN_MASK)) & ~(MALLOC_ALIGN_MASK)))
 /* Check if m has acceptable alignment */
--- a/backport-0003-CVE-2024-57258.patch
+++ b/backport-0003-CVE-2024-57258.patch
@ -1,33 +0,0 @@
 From c17b2a05dd50a3ba437e6373093a0d6a359cdee0 Mon Sep 17 00:00:00 2001
 From: Richard Weinberger <richard@nod.at>
 Date: Fri, 2 Aug 2024 12:08:43 +0200
 Subject: [PATCH] x86: Fix ptrdiff_t for x86_64
 sbrk() assumes ptrdiff_t is large enough to enlarge/shrink the heap
 by LONG_MIN/LONG_MAX.
 So, use the long type, also to match the rest of the Linux ecosystem.
 Signed-off-by: Richard Weinberger <richard@nod.at>
 Reviewed-by: Simon Glass <sjg@chromium.org>
 ---
 arch/x86/include/asm/posix_types.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/arch/x86/include/asm/posix_types.h b/arch/x86/include/asm/posix_types.h
 index dbcea7f47ff9..e1ed9bcabc76 100644
 --- a/arch/x86/include/asm/posix_types.h
 +++ b/arch/x86/include/asm/posix_types.h
@@ -20,11 +20,12 @@ typedef unsigned short	__kernel_gid_t;
 #if defined(__x86_64__)
 typedef unsigned long	__kernel_size_t;
 typedef long		__kernel_ssize_t;
 +typedef long		__kernel_ptrdiff_t;
 #else
 typedef unsigned int	__kernel_size_t;
 typedef int		__kernel_ssize_t;
 -#endif
 typedef int		__kernel_ptrdiff_t;
 +#endif
 typedef long		__kernel_time_t;
 typedef long		__kernel_suseconds_t;
 typedef long		__kernel_clock_t;
--- a/backport-AllWinner-PineTab.patch
+++ b/backport-AllWinner-PineTab.patch
@ -0,0 +1,45 @@
 From 6bf15552c2b6becb48ce7732120e0ddb2078cb1a Mon Sep 17 00:00:00 2001
 From: Peter Robinson <pbrobinson@gmail.com>
 Date: Tue, 14 Apr 2020 09:53:07 +0100
 Subject: [PATCH 9/9] initial pinetab support
 Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
 ---
 configs/pinetab_defconfig | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 configs/pinetab_defconfig
 diff --git a/configs/pinetab_defconfig b/configs/pinetab_defconfig
 new file mode 100644
 index 0000000000..5b9620f3e5
 --- /dev/null
 +++ b/configs/pinetab_defconfig
@@ -0,0 +1,26 @@
 +CONFIG_ARM=y
 +CONFIG_ARCH_SUNXI=y
 +CONFIG_SPL=y
 +CONFIG_MACH_SUN50I=y
 +CONFIG_SUNXI_DRAM_LPDDR3_STOCK=y
 +CONFIG_DRAM_CLK=552
 +CONFIG_DRAM_ZQ=3881949
 +CONFIG_MMC_SUNXI_SLOT_EXTRA=2
 +CONFIG_R_I2C_ENABLE=y
 +CONFIG_SPL_SPI_SUNXI=y
 +# CONFIG_SYS_MALLOC_CLEAR_ON_INIT is not set
 +CONFIG_USE_PREBOOT=y
 +# CONFIG_SPL_DOS_PARTITION is not set
 +# CONFIG_SPL_EFI_PARTITION is not set
 +CONFIG_DEFAULT_DEVICE_TREE="sun50i-a64-pinetab"
 +CONFIG_OF_LIST="sun50i-a64-pinetab"
 +CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 +CONFIG_DM_REGULATOR=y
 +CONFIG_DM_REGULATOR_FIXED=y
 +CONFIG_DM_PWM=y
 +CONFIG_PWM_SUNXI=y
 +CONFIG_LED=y
 +CONFIG_LED_GPIO=y
 +CONFIG_USB_EHCI_HCD=y
 +CONFIG_USB_OHCI_HCD=y
 +CONFIG_SYS_USB_EVENT_POLL_VIA_INT_QUEUE=y
 -- 
 2.26.0
--- a/backport-CVE-2024-57254.patch
+++ b/backport-CVE-2024-57254.patch
@ -1,40 +0,0 @@
 From c8e929e5758999933f9e905049ef2bf3fe6b140d Mon Sep 17 00:00:00 2001
 From: Richard Weinberger <richard@nod.at>
 Date: Fri, 2 Aug 2024 18:36:45 +0200
 Subject: [PATCH] squashfs: Fix integer overflow in sqfs_inode_size()
 A carefully crafted squashfs filesystem can exhibit an extremly large
 inode size and overflow the calculation in sqfs_inode_size().
 As a consequence, the squashfs driver will read from wrong locations.
 Fix by using __builtin_add_overflow() to detect the overflow.
 Signed-off-by: Richard Weinberger <richard@nod.at>
 Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
 ---
 fs/squashfs/sqfs_inode.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)
 diff --git a/fs/squashfs/sqfs_inode.c b/fs/squashfs/sqfs_inode.c
 index d25cfb53e75d..bb3ccd37e33b 100644
 --- a/fs/squashfs/sqfs_inode.c
 +++ b/fs/squashfs/sqfs_inode.c
@@ -78,11 +78,16 @@ int sqfs_inode_size(struct squashfs_base_inode *inode, u32 blk_size)
 	case SQFS_SYMLINK_TYPE:
 	case SQFS_LSYMLINK_TYPE: {
 +		int size;
 +
 		struct squashfs_symlink_inode *symlink =
 			(struct squashfs_symlink_inode *)inode;
 -		return sizeof(*symlink) +
 -			get_unaligned_le32(&symlink->symlink_size);
 +		if (__builtin_add_overflow(sizeof(*symlink),
 +		    get_unaligned_le32(&symlink->symlink_size), &size))
 +			return -EINVAL;
 +
 +		return size;
 	}
 	case SQFS_BLKDEV_TYPE:
--- a/backport-CVE-2024-57255.patch
+++ b/backport-CVE-2024-57255.patch
@ -1,46 +0,0 @@
 From 233945eba63e24061dffeeaeb7cd6fe985278356 Mon Sep 17 00:00:00 2001
 From: Richard Weinberger <richard@nod.at>
 Date: Fri, 2 Aug 2024 18:36:44 +0200
 Subject: [PATCH] squashfs: Fix integer overflow in sqfs_resolve_symlink()
 A carefully crafted squashfs filesystem can exhibit an inode size of 0xffffffff,
 as a consequence malloc() will do a zero allocation.
 Later in the function the inode size is again used for copying data.
 So an attacker can overwrite memory.
 Avoid the overflow by using the __builtin_add_overflow() helper.
 Signed-off-by: Richard Weinberger <richard@nod.at>
 Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
 ---
 fs/squashfs/sqfs.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)
 diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
 index 1430e671a5a8..16a07c0622bd 100644
 --- a/fs/squashfs/sqfs.c
 +++ b/fs/squashfs/sqfs.c
@@ -422,8 +422,10 @@ static char *sqfs_resolve_symlink(struct squashfs_symlink_inode *sym,
 	char *resolved, *target;
 	u32 sz;
 -	sz = get_unaligned_le32(&sym->symlink_size);
 -	target = malloc(sz + 1);
 +	if (__builtin_add_overflow(get_unaligned_le32(&sym->symlink_size), 1, &sz))
 +		return NULL;
 +
 +	target = malloc(sz);
 	if (!target)
 		return NULL;
@@ -431,9 +433,9 @@ static char *sqfs_resolve_symlink(struct squashfs_symlink_inode *sym,
 	 * There is no trailling null byte in the symlink's target path, so a
 	 * copy is made and a '\0' is added at its end.
 	 */
 -	target[sz] = '\0';
 +	target[sz - 1] = '\0';
 	/* Get target name (relative path) */
 -	strncpy(target, sym->symlink, sz);
 +	strncpy(target, sym->symlink, sz - 1);
 	/* Relative -> absolute path conversion */
 	resolved = sqfs_get_abs_path(base_path, target);
--- a/backport-CVE-2024-57256.patch
+++ b/backport-CVE-2024-57256.patch
@ -1,44 +0,0 @@
 From 35f75d2a46e5859138c83a75cd2f4141c5479ab9 Mon Sep 17 00:00:00 2001
 From: Richard Weinberger <richard@nod.at>
 Date: Fri, 9 Aug 2024 11:54:28 +0200
 Subject: [PATCH] ext4: Fix integer overflow in ext4fs_read_symlink()
 While zalloc() takes a size_t type, adding 1 to the le32 variable
 will overflow.
 A carefully crafted ext4 filesystem can exhibit an inode size of 0xffffffff
 and as consequence zalloc() will do a zero allocation.
 Later in the function the inode size is again used for copying data.
 So an attacker can overwrite memory.
 Avoid the overflow by using the __builtin_add_overflow() helper.
 Signed-off-by: Richard Weinberger <richard@nod.at>
 ---
 fs/ext4/ext4_common.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
 diff --git a/fs/ext4/ext4_common.c b/fs/ext4/ext4_common.c
 index 7cf0160c408d..76f7102456e3 100644
 --- a/fs/ext4/ext4_common.c
 +++ b/fs/ext4/ext4_common.c
@@ -2181,13 +2181,18 @@ static char *ext4fs_read_symlink(struct ext2fs_node *node)
 	struct ext2fs_node *diro = node;
 	int status;
 	loff_t actread;
 +	size_t alloc_size;
 	if (!diro->inode_read) {
 		status = ext4fs_read_inode(diro->data, diro->ino, &diro->inode);
 		if (status == 0)
 			return NULL;
 	}
 -	symlink = zalloc(le32_to_cpu(diro->inode.size) + 1);
 +
 +	if (__builtin_add_overflow(le32_to_cpu(diro->inode.size), 1, &alloc_size))
 +		return NULL;
 +
 +	symlink = zalloc(alloc_size);
 	if (!symlink)
 		return NULL;
--- a/backport-CVE-2024-57257.patch
+++ b/backport-CVE-2024-57257.patch
@ -1,220 +0,0 @@
 From 4f5cc096bfd0a591f8a11e86999e3d90a9484c34 Mon Sep 17 00:00:00 2001
 From: Richard Weinberger <richard@nod.at>
 Date: Fri, 2 Aug 2024 18:36:47 +0200
 Subject: [PATCH] squashfs: Fix stack overflow while symlink resolving
 The squashfs driver blindly follows symlinks, and calls sqfs_size()
 recursively. So an attacker can create a crafted filesystem and with
 a deep enough nesting level a stack overflow can be achieved.
 Fix by limiting the nesting level to 8.
 Signed-off-by: Richard Weinberger <richard@nod.at>
 Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
 ---
 fs/squashfs/sqfs.c | 76 +++++++++++++++++++++++++++++++++++++---------
 1 file changed, 61 insertions(+), 15 deletions(-)
 diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
 index fa99d514f20f..af7ff80a7bdf 100644
 --- a/fs/squashfs/sqfs.c
 +++ b/fs/squashfs/sqfs.c
@@ -24,7 +24,12 @@
 #include "sqfs_filesystem.h"
 #include "sqfs_utils.h"
 +#define MAX_SYMLINK_NEST 8
 +
 static struct squashfs_ctxt ctxt;
 +static int symlinknest;
 +
 +static int sqfs_readdir_nest(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp);
 static int sqfs_disk_read(__u32 block, __u32 nr_blocks, void *buf)
 {
@@ -510,7 +515,7 @@ static int sqfs_search_dir(struct squashfs_dir_stream *dirs, char **token_list,
 			goto out;
 		}
 -		while (!sqfs_readdir(dirsp, &dent)) {
 +		while (!sqfs_readdir_nest(dirsp, &dent)) {
 			ret = strcmp(dent->name, token_list[j]);
 			if (!ret)
 				break;
@@ -537,6 +542,11 @@ static int sqfs_search_dir(struct squashfs_dir_stream *dirs, char **token_list,
 		/* Check for symbolic link and inode type sanity */
 		if (get_unaligned_le16(&dir->inode_type) == SQFS_SYMLINK_TYPE) {
 +			if (++symlinknest == MAX_SYMLINK_NEST) {
 +				ret = -ELOOP;
 +				goto out;
 +			}
 +
 			sym = (struct squashfs_symlink_inode *)table;
 			/* Get first j + 1 tokens */
 			path = sqfs_concat_tokens(token_list, j + 1);
@@ -884,7 +894,7 @@ static int sqfs_read_directory_table(unsigned char **dir_table, u32 **pos_list)
 	return metablks_count;
 }
 -int sqfs_opendir(const char *filename, struct fs_dir_stream **dirsp)
 +static int sqfs_opendir_nest(const char *filename, struct fs_dir_stream **dirsp)
 {
 	unsigned char *inode_table = NULL, *dir_table = NULL;
 	int j, token_count = 0, ret = 0, metablks_count;
@@ -979,7 +989,19 @@ int sqfs_opendir(const char *filename, struct fs_dir_stream **dirsp)
 	return ret;
 }
 +int sqfs_opendir(const char *filename, struct fs_dir_stream **dirsp)
 +{
 +	symlinknest = 0;
 +	return sqfs_opendir_nest(filename, dirsp);
 +}
 +
 int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
 +{
 +	symlinknest = 0;
 +	return sqfs_readdir_nest(fs_dirs, dentp);
 +}
 +
 +static int sqfs_readdir_nest(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
 {
 	struct squashfs_super_block *sblk = ctxt.sblk;
 	struct squashfs_dir_stream *dirs;
@@ -1325,8 +1347,8 @@ static int sqfs_get_lregfile_info(struct squashfs_lreg_inode *lreg,
 	return datablk_count;
 }
 -int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
 -	      loff_t *actread)
 +static int sqfs_read_nest(const char *filename, void *buf, loff_t offset,
 +			  loff_t len, loff_t *actread)
 {
 	char *dir = NULL, *fragment_block, *datablock = NULL;
 	char *fragment = NULL, *file = NULL, *resolved, *data;
@@ -1356,11 +1378,11 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
 	}
 	/*
 -	 * sqfs_opendir will uncompress inode and directory tables, and will
 +	 * sqfs_opendir_nest will uncompress inode and directory tables, and will
 	 * return a pointer to the directory that contains the requested file.
 	 */
 	sqfs_split_path(&file, &dir, filename);
 -	ret = sqfs_opendir(dir, &dirsp);
 +	ret = sqfs_opendir_nest(dir, &dirsp);
 	if (ret) {
 		goto out;
 	}
@@ -1368,7 +1390,7 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
 	dirs = (struct squashfs_dir_stream *)dirsp;
 	/* For now, only regular files are able to be loaded */
 -	while (!sqfs_readdir(dirsp, &dent)) {
 +	while (!sqfs_readdir_nest(dirsp, &dent)) {
 		ret = strcmp(dent->name, file);
 		if (!ret)
 			break;
@@ -1421,9 +1443,14 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
 		break;
 	case SQFS_SYMLINK_TYPE:
 	case SQFS_LSYMLINK_TYPE:
 +		if (++symlinknest == MAX_SYMLINK_NEST) {
 +			ret = -ELOOP;
 +			goto out;
 +		}
 +
 		symlink = (struct squashfs_symlink_inode *)ipos;
 		resolved = sqfs_resolve_symlink(symlink, filename);
 -		ret = sqfs_read(resolved, buf, offset, len, actread);
 +		ret = sqfs_read_nest(resolved, buf, offset, len, actread);
 		free(resolved);
 		goto out;
 	case SQFS_BLKDEV_TYPE:
@@ -1594,7 +1621,14 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
 	return ret;
 }
 -int sqfs_size(const char *filename, loff_t *size)
 +int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
 +	      loff_t *actread)
 +{
 +	symlinknest = 0;
 +	return sqfs_read_nest(filename, buf, offset, len, actread);
 +}
 +
 +static int sqfs_size_nest(const char *filename, loff_t *size)
 {
 	struct squashfs_super_block *sblk = ctxt.sblk;
 	struct squashfs_symlink_inode *symlink;
@@ -1610,10 +1644,10 @@ int sqfs_size(const char *filename, loff_t *size)
 	sqfs_split_path(&file, &dir, filename);
 	/*
 -	 * sqfs_opendir will uncompress inode and directory tables, and will
 +	 * sqfs_opendir_nest will uncompress inode and directory tables, and will
 	 * return a pointer to the directory that contains the requested file.
 	 */
 -	ret = sqfs_opendir(dir, &dirsp);
 +	ret = sqfs_opendir_nest(dir, &dirsp);
 	if (ret) {
 		ret = -EINVAL;
 		goto free_strings;
@@ -1621,7 +1655,7 @@ int sqfs_size(const char *filename, loff_t *size)
 	dirs = (struct squashfs_dir_stream *)dirsp;
 -	while (!sqfs_readdir(dirsp, &dent)) {
 +	while (!sqfs_readdir_nest(dirsp, &dent)) {
 		ret = strcmp(dent->name, file);
 		if (!ret)
 			break;
@@ -1661,6 +1695,11 @@ int sqfs_size(const char *filename, loff_t *size)
 		break;
 	case SQFS_SYMLINK_TYPE:
 	case SQFS_LSYMLINK_TYPE:
 +		if (++symlinknest == MAX_SYMLINK_NEST) {
 +			*size = 0;
 +			return -ELOOP;
 +		}
 +
 		symlink = (struct squashfs_symlink_inode *)ipos;
 		resolved = sqfs_resolve_symlink(symlink, filename);
 		ret = sqfs_size(resolved, size);
@@ -1700,10 +1739,11 @@ int sqfs_exists(const char *filename)
 	sqfs_split_path(&file, &dir, filename);
 	/*
 -	 * sqfs_opendir will uncompress inode and directory tables, and will
 +	 * sqfs_opendir_nest will uncompress inode and directory tables, and will
 	 * return a pointer to the directory that contains the requested file.
 	 */
 -	ret = sqfs_opendir(dir, &dirsp);
 +	symlinknest = 0;
 +	ret = sqfs_opendir_nest(dir, &dirsp);
 	if (ret) {
 		ret = -EINVAL;
 		goto free_strings;
@@ -1711,7 +1751,7 @@ int sqfs_exists(const char *filename)
 	dirs = (struct squashfs_dir_stream *)dirsp;
 -	while (!sqfs_readdir(dirsp, &dent)) {
 +	while (!sqfs_readdir_nest(dirsp, &dent)) {
 		ret = strcmp(dent->name, file);
 		if (!ret)
 			break;
@@ -1728,6 +1768,12 @@ int sqfs_exists(const char *filename)
 	return ret == 0;
 }
 +int sqfs_size(const char *filename, loff_t *size)
 +{
 +	symlinknest = 0;
 +	return sqfs_size_nest(filename, size);
 +}
 +
 void sqfs_close(void)
 {
 	sqfs_decompressor_cleanup(&ctxt);
--- a/backport-CVE-2024-57259.patch
+++ b/backport-CVE-2024-57259.patch
@ -1,34 +0,0 @@
 From 048d795bb5b3d9c5701b4855f5e74bcf6849bf5e Mon Sep 17 00:00:00 2001
 From: Richard Weinberger <richard@nod.at>
 Date: Fri, 2 Aug 2024 22:05:09 +0200
 Subject: [PATCH] squashfs: Fix heap corruption in sqfs_search_dir()
 res needs to be large enough to store both strings rem and target,
 plus the path separator and the terminator.
 Currently the space for the path separator is not accounted, so
 the heap is corrupted by one byte.
 Signed-off-by: Richard Weinberger <richard@nod.at>
 Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
 ---
 fs/squashfs/sqfs.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
 index af7ff80a7bdf..b9314019b1bc 100644
 --- a/fs/squashfs/sqfs.c
 +++ b/fs/squashfs/sqfs.c
@@ -567,8 +567,11 @@ static int sqfs_search_dir(struct squashfs_dir_stream *dirs, char **token_list,
 				ret = -ENOMEM;
 				goto out;
 			}
 -			/* Concatenate remaining tokens and symlink's target */
 -			res = malloc(strlen(rem) + strlen(target) + 1);
 +			/*
 +			 * Concatenate remaining tokens and symlink's target.
 +			 * Allocate enough space for rem, target, '/' and '\0'.
 +			 */
 +			res = malloc(strlen(rem) + strlen(target) + 2);
 			if (!res) {
 				ret = -ENOMEM;
 				goto out;
--- a/backport-Provide-a-fallback-to-smbios-tables.patch
+++ b/backport-Provide-a-fallback-to-smbios-tables.patch
@ -1,686 +0,0 @@
 From patchwork Thu Dec  7 09:18:49 2023
 Content-Type: text/plain; charset="utf-8"
 MIME-Version: 1.0
 Content-Transfer-Encoding: 7bit
 X-Patchwork-Submitter: Ilias Apalodimas <ilias.apalodimas@linaro.org>
 X-Patchwork-Id: 1873089
 Return-Path: <u-boot-bounces@lists.denx.de>
 X-Original-To: incoming@patchwork.ozlabs.org
 Delivered-To: patchwork-incoming@legolas.ozlabs.org
 Authentication-Results: legolas.ozlabs.org;
 	dkim=pass (2048-bit key;
 unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256
 header.s=google header.b=SyQQL6ZG;
 	dkim-atps=neutral
 Authentication-Results: legolas.ozlabs.org;
 spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de
 (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;
 envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)
 Received: from phobos.denx.de (phobos.denx.de
 [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])
 	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 	 key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384)
 	(No client certificate requested)
 	by legolas.ozlabs.org (Postfix) with ESMTPS id 4Sm7xz1DLXz23nD
 	for <incoming@patchwork.ozlabs.org>; Thu,  7 Dec 2023 20:19:19 +1100 (AEDT)
 Received: from h2850616.stratoserver.net (localhost [IPv6:::1])
 	by phobos.denx.de (Postfix) with ESMTP id 83BF287243;
 	Thu,  7 Dec 2023 10:19:05 +0100 (CET)
 Authentication-Results: phobos.denx.de;
 dmarc=pass (p=none dis=none) header.from=linaro.org
 Authentication-Results: phobos.denx.de;
 spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de
 Authentication-Results: phobos.denx.de;
 	dkim=pass (2048-bit key;
 unprotected) header.d=linaro.org header.i=@linaro.org header.b="SyQQL6ZG";
 	dkim-atps=neutral
 Received: by phobos.denx.de (Postfix, from userid 109)
 id 46C3C87243; Thu,  7 Dec 2023 10:19:04 +0100 (CET)
 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de
 X-Spam-Level: 
 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
 DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS,
 T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2
 Received: from mail-wm1-x330.google.com (mail-wm1-x330.google.com
 [IPv6:2a00:1450:4864:20::330])
 (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits))
 (No client certificate requested)
 by phobos.denx.de (Postfix) with ESMTPS id 21B8586FFE
 for <u-boot@lists.denx.de>; Thu,  7 Dec 2023 10:19:02 +0100 (CET)
 Authentication-Results: phobos.denx.de;
 dmarc=pass (p=none dis=none) header.from=linaro.org
 Authentication-Results: phobos.denx.de;
 spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org
 Received: by mail-wm1-x330.google.com with SMTP id
 5b1f17b1804b1-40c2c65e6aaso1041145e9.2
 for <u-boot@lists.denx.de>; Thu, 07 Dec 2023 01:19:02 -0800 (PST)
 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=linaro.org; s=google; t=1701940741; x=1702545541; darn=lists.denx.de;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:from:to:cc:subject:date
 :message-id:reply-to;
 bh=vcf8Uy8SIKdN9TXuCeQubka7IJIfrvGMGj1JoUebFs0=;
 b=SyQQL6ZGyEFpFFqauSbHRSSNY+KOw9ohESTeXyy7RkWEEIFaK7yPwRRy9NZX+DJLAJ
 ECaT3Bchk61s+E1ZsuxrqdlxEYWDULw+4O2hm22gVZjL5L6r4+NwNgCHwzYW/bcro87o
 KEGRF7CXG50v6mvrjAOHoy2LbojZLR9d7fjO4gmGtihdnTMOW1cjtrX/3Seiy99QoTK6
 5Hs119W/hO0/5AE1VVSiIxV1Xx+qYcAHvQqcEEkBCKR2MpHTauUEonUf1LC5LKK2gKG5
 UEzq7XLrPki8hih4EcWsoctpdPp4kBtvpVSSshji9yxDX3EXKzcfA8xyqrB+5qKJU100
 zZ7A==
 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1701940741; x=1702545541;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
 :subject:date:message-id:reply-to;
 bh=vcf8Uy8SIKdN9TXuCeQubka7IJIfrvGMGj1JoUebFs0=;
 b=L6Ejctx8u+W0IeEi5FfC1q0ah2NYKTScSheLqomwMY3Q4/BPiEUP7KUarxUKsRwI/3
 yP4rTVAXqlGbT6kFKq3jrxXlRS4HIRZxtFbgHZEKuBnXpkHCQpvQwKUcYY9QkbfdZEir
 5YYfONEv2yTHHfoiBZiVmcPARIQ5+2ra+k493og2Bm0Hk5dVWyaHn/YY6Y+FCWH7ZYn0
 Eq1M9Ng8YB3oMx63KwV9XHBURccH8UdCqwsNDvk2gWLKdSvrjlFD7ExiySd90+i9+6vN
 CMLoNESSYj2K9qW/sxbIDgUv1JwYCWgJrDejTzilfagawcPlKY2XtTnOlUsRryYrsPoq
 RbZg==
 X-Gm-Message-State: AOJu0YxG7g4q8NdX+N/0Mp5YNkHEVHntPyakSqHCtdqDzgaRcQCbtF0q
 2APTVIQc7yNsT16/19bvkV1NRw3x7lZmC4YcT+s=
 X-Google-Smtp-Source: 
 AGHT+IFwnHtGX5IWm5lG5rRTsz6nU13lqUMnEUb8xEq/mngZuRtpzcNdrO7fNaBiIDDQLuKd+Y07Tw==
 X-Received: by 2002:a05:600c:2184:b0:40b:dd1f:6dd1 with SMTP id
 e4-20020a05600c218400b0040bdd1f6dd1mr1312043wme.240.1701940741617;
 Thu, 07 Dec 2023 01:19:01 -0800 (PST)
 Received: from localhost.localdomain (ppp046103111243.access.hol.gr.
 [46.103.111.243]) by smtp.gmail.com with ESMTPSA id
 u21-20020a05600c139500b00405d9a950a2sm1299003wmf.28.2023.12.07.01.19.00
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Thu, 07 Dec 2023 01:19:01 -0800 (PST)
 From: Ilias Apalodimas <ilias.apalodimas@linaro.org>
 To: trini@konsulko.com,
 	sjg@chromium.org
 Cc: sean.anderson@seco.com, neil.armstrong@linaro.org,
 heinrich.schuchardt@canonical.com, mark.kettenis@xs4all.nl,
 Ilias Apalodimas <ilias.apalodimas@linaro.org>, u-boot@lists.denx.de
 Subject: [PATCH 1/2 v3] smbios: Simplify reporting of unknown values
 Date: Thu,  7 Dec 2023 11:18:49 +0200
 Message-Id: <20231207091850.17776-2-ilias.apalodimas@linaro.org>
 X-Mailer: git-send-email 2.40.1
 In-Reply-To: <20231207091850.17776-1-ilias.apalodimas@linaro.org>
 References: <20231207091850.17776-1-ilias.apalodimas@linaro.org>
 MIME-Version: 1.0
 X-BeenThere: u-boot@lists.denx.de
 X-Mailman-Version: 2.1.39
 Precedence: list
 List-Id: U-Boot discussion <u-boot.lists.denx.de>
 List-Unsubscribe: <https://lists.denx.de/options/u-boot>,
 <mailto:u-boot-request@lists.denx.de?subject=unsubscribe>
 List-Archive: <https://lists.denx.de/pipermail/u-boot/>
 List-Post: <mailto:u-boot@lists.denx.de>
 List-Help: <mailto:u-boot-request@lists.denx.de?subject=help>
 List-Subscribe: <https://lists.denx.de/listinfo/u-boot>,
 <mailto:u-boot-request@lists.denx.de?subject=subscribe>
 Errors-To: u-boot-bounces@lists.denx.de
 Sender: "U-Boot" <u-boot-bounces@lists.denx.de>
 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de
 X-Virus-Status: Clean
 If a value is not valid during the DT or SYSINFO parsing,  we explicitly
 set that to "Unknown Product" and "Unknown" for the product and
 manufacturer respectively.  It's cleaner if we move the checks insisde
 smbios_add_prop_si() and provide an alternative string in case the
 primary is NULL or empty
 pre-patch dmidecode
 <snip>
 Handle 0x0001, DMI type 1, 27 bytes
 System Information
        Manufacturer: Unknown
        Product Name: Unknown Product
        Version: Not Specified
        Serial Number: Not Specified
        UUID: Not Settable
        Wake-up Type: Reserved
        SKU Number: Not Specified
        Family: Not Specified
 [...]
 post-patch dmidecode:
 Handle 0x0001, DMI type 1, 27 bytes
 System Information
        Manufacturer: Unknown
        Product Name: Unknown
        Version: Unknown
        Serial Number: Unknown
        UUID: Not Settable
        Wake-up Type: Reserved
        SKU Number: Unknown
        Family: Unknown
 [...]
 While at it make smbios_add_prop_si() add a string directly if the prop
 node is NULL and replace smbios_add_string() calls with
 smbios_add_prop_si(ctx, NULL, ....)
 Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
 ---
 Changes since v2:
 - refactor even more code and remove the smbios_add_string calls from the
  main code. Instead use smbios_add_prop() foir everything and add a
  default value, in case the parsed one is NULL or emtpy
 Changes since v1:
 - None
 lib/smbios.c | 73 +++++++++++++++++++++++++---------------------------
 1 file changed, 35 insertions(+), 38 deletions(-)
 --
 2.40.1
 diff --git a/lib/smbios.c b/lib/smbios.c
 index d7f4999e8b2a..444aa245a273 100644
 --- a/lib/smbios.c
 +++ b/lib/smbios.c
@@ -102,9 +102,6 @@ static int smbios_add_string(struct smbios_ctx *ctx, const char *str)
 	int i = 1;
 	char *p = ctx->eos;
 -	if (!*str)
 -		str = "Unknown";
 -
 	for (;;) {
 		if (!*p) {
 			ctx->last_str = p;
@@ -134,11 +131,18 @@ static int smbios_add_string(struct smbios_ctx *ctx, const char *str)
  *
  * @ctx:	context for writing the tables
  * @prop:	property to write
 + * @dval:	Default value to use if the string is not found or is empty
  * Return:	0 if not found, else SMBIOS string number (1 or more)
  */
 static int smbios_add_prop_si(struct smbios_ctx *ctx, const char *prop,
 -			      int sysinfo_id)
 +			      int sysinfo_id, const char *dval)
 {
 +	if (!dval || !*dval)
 +		dval = "Unknown";
 +
 +	if (!prop)
 +		return smbios_add_string(ctx, dval);
 +
 	if (sysinfo_id && ctx->dev) {
 		char val[SMBIOS_STR_MAX];
 		int ret;
@@ -151,8 +155,8 @@ static int smbios_add_prop_si(struct smbios_ctx *ctx, const char *prop,
 		const char *str;
 		str = ofnode_read_string(ctx->node, prop);
 -		if (str)
 -			return smbios_add_string(ctx, str);
 +
 +		return smbios_add_string(ctx, str ? str : dval);
 	}
 	return 0;
@@ -161,12 +165,15 @@ static int smbios_add_prop_si(struct smbios_ctx *ctx, const char *prop,
 /**
  * smbios_add_prop() - Add a property from the devicetree
  *
 - * @prop:	property to write
 + * @prop:	property to write. The default string will be written if
 + *		prop is NULL
 + * @dval:	Default value to use if the string is not found or is empty
  * Return:	0 if not found, else SMBIOS string number (1 or more)
  */
 -static int smbios_add_prop(struct smbios_ctx *ctx, const char *prop)
 +static int smbios_add_prop(struct smbios_ctx *ctx, const char *prop,
 +			   const char *dval)
 {
 -	return smbios_add_prop_si(ctx, prop, SYSINFO_ID_NONE);
 +	return smbios_add_prop_si(ctx, prop, SYSINFO_ID_NONE, dval);
 }
 static void smbios_set_eos(struct smbios_ctx *ctx, char *eos)
@@ -228,11 +235,9 @@ static int smbios_write_type0(ulong *current, int handle,
 	memset(t, 0, sizeof(struct smbios_type0));
 	fill_smbios_header(t, SMBIOS_BIOS_INFORMATION, len, handle);
 	smbios_set_eos(ctx, t->eos);
 -	t->vendor = smbios_add_string(ctx, "U-Boot");
 +	t->vendor = smbios_add_prop(ctx, NULL, "U-Boot");
 -	t->bios_ver = smbios_add_prop(ctx, "version");
 -	if (!t->bios_ver)
 -		t->bios_ver = smbios_add_string(ctx, PLAIN_VERSION);
 +	t->bios_ver = smbios_add_prop(ctx, "version", PLAIN_VERSION);
 	if (t->bios_ver)
 		gd->smbios_version = ctx->last_str;
 	log_debug("smbios_version = %p: '%s'\n", gd->smbios_version,
@@ -241,7 +246,7 @@ static int smbios_write_type0(ulong *current, int handle,
 	print_buffer((ulong)gd->smbios_version, gd->smbios_version,
 		     1, strlen(gd->smbios_version) + 1, 0);
 #endif
 -	t->bios_release_date = smbios_add_string(ctx, U_BOOT_DMI_DATE);
 +	t->bios_release_date = smbios_add_prop(ctx, NULL, U_BOOT_DMI_DATE);
 #ifdef CONFIG_ROM_SIZE
 	t->bios_rom_size = (CONFIG_ROM_SIZE / 65536) - 1;
 #endif
@@ -280,22 +285,19 @@ static int smbios_write_type1(ulong *current, int handle,
 	memset(t, 0, sizeof(struct smbios_type1));
 	fill_smbios_header(t, SMBIOS_SYSTEM_INFORMATION, len, handle);
 	smbios_set_eos(ctx, t->eos);
 -	t->manufacturer = smbios_add_prop(ctx, "manufacturer");
 -	if (!t->manufacturer)
 -		t->manufacturer = smbios_add_string(ctx, "Unknown");
 -	t->product_name = smbios_add_prop(ctx, "product");
 -	if (!t->product_name)
 -		t->product_name = smbios_add_string(ctx, "Unknown Product");
 +	t->manufacturer = smbios_add_prop(ctx, "manufacturer", "Unknown");
 +	t->product_name = smbios_add_prop(ctx, "product", "Unknown");
 	t->version = smbios_add_prop_si(ctx, "version",
 -					SYSINFO_ID_SMBIOS_SYSTEM_VERSION);
 +					SYSINFO_ID_SMBIOS_SYSTEM_VERSION,
 +					"Unknown");
 	if (serial_str) {
 -		t->serial_number = smbios_add_string(ctx, serial_str);
 +		t->serial_number = smbios_add_prop(ctx, NULL, serial_str);
 		strncpy((char *)t->uuid, serial_str, sizeof(t->uuid));
 	} else {
 -		t->serial_number = smbios_add_prop(ctx, "serial");
 +		t->serial_number = smbios_add_prop(ctx, "serial", "Unknown");
 	}
 -	t->sku_number = smbios_add_prop(ctx, "sku");
 -	t->family = smbios_add_prop(ctx, "family");
 +	t->sku_number = smbios_add_prop(ctx, "sku", "Unknown");
 +	t->family = smbios_add_prop(ctx, "family", "Unknown");
 	len = t->length + smbios_string_table_len(ctx);
 	*current += len;
@@ -314,15 +316,12 @@ static int smbios_write_type2(ulong *current, int handle,
 	memset(t, 0, sizeof(struct smbios_type2));
 	fill_smbios_header(t, SMBIOS_BOARD_INFORMATION, len, handle);
 	smbios_set_eos(ctx, t->eos);
 -	t->manufacturer = smbios_add_prop(ctx, "manufacturer");
 -	if (!t->manufacturer)
 -		t->manufacturer = smbios_add_string(ctx, "Unknown");
 -	t->product_name = smbios_add_prop(ctx, "product");
 -	if (!t->product_name)
 -		t->product_name = smbios_add_string(ctx, "Unknown Product");
 +	t->manufacturer = smbios_add_prop(ctx, "manufacturer", "Unknown");
 +	t->product_name = smbios_add_prop(ctx, "product", "Unknown");
 	t->version = smbios_add_prop_si(ctx, "version",
 -					SYSINFO_ID_SMBIOS_BASEBOARD_VERSION);
 -	t->asset_tag_number = smbios_add_prop(ctx, "asset-tag");
 +					SYSINFO_ID_SMBIOS_BASEBOARD_VERSION,
 +					"Unknown");
 +	t->asset_tag_number = smbios_add_prop(ctx, "asset-tag", "Unknown");
 	t->feature_flags = SMBIOS_BOARD_FEATURE_HOSTING;
 	t->board_type = SMBIOS_BOARD_MOTHERBOARD;
@@ -343,9 +342,7 @@ static int smbios_write_type3(ulong *current, int handle,
 	memset(t, 0, sizeof(struct smbios_type3));
 	fill_smbios_header(t, SMBIOS_SYSTEM_ENCLOSURE, len, handle);
 	smbios_set_eos(ctx, t->eos);
 -	t->manufacturer = smbios_add_prop(ctx, "manufacturer");
 -	if (!t->manufacturer)
 -		t->manufacturer = smbios_add_string(ctx, "Unknown");
 +	t->manufacturer = smbios_add_prop(ctx, "manufacturer", "Unknown");
 	t->chassis_type = SMBIOS_ENCLOSURE_DESKTOP;
 	t->bootup_state = SMBIOS_STATE_SAFE;
 	t->power_supply_state = SMBIOS_STATE_SAFE;
@@ -388,8 +385,8 @@ static void smbios_write_type4_dm(struct smbios_type4 *t,
 #endif
 	t->processor_family = processor_family;
 -	t->processor_manufacturer = smbios_add_string(ctx, vendor);
 -	t->processor_version = smbios_add_string(ctx, name);
 +	t->processor_manufacturer = smbios_add_prop(ctx, NULL, vendor);
 +	t->processor_version = smbios_add_prop(ctx, NULL, name);
 }
 static int smbios_write_type4(ulong *current, int handle,
 From patchwork Thu Dec  7 09:18:50 2023
 Content-Type: text/plain; charset="utf-8"
 MIME-Version: 1.0
 Content-Transfer-Encoding: 7bit
 X-Patchwork-Submitter: Ilias Apalodimas <ilias.apalodimas@linaro.org>
 X-Patchwork-Id: 1873090
 Return-Path: <u-boot-bounces@lists.denx.de>
 X-Original-To: incoming@patchwork.ozlabs.org
 Delivered-To: patchwork-incoming@legolas.ozlabs.org
 Authentication-Results: legolas.ozlabs.org;
 	dkim=pass (2048-bit key;
 unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256
 header.s=google header.b=KcFhbOkM;
 	dkim-atps=neutral
 Authentication-Results: legolas.ozlabs.org;
 spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de
 (client-ip=85.214.62.61; helo=phobos.denx.de;
 envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)
 Received: from phobos.denx.de (phobos.denx.de [85.214.62.61])
 	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 	 key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384)
 	(No client certificate requested)
 	by legolas.ozlabs.org (Postfix) with ESMTPS id 4Sm7yF71l9z23nD
 	for <incoming@patchwork.ozlabs.org>; Thu,  7 Dec 2023 20:19:33 +1100 (AEDT)
 Received: from h2850616.stratoserver.net (localhost [IPv6:::1])
 	by phobos.denx.de (Postfix) with ESMTP id 7D6CB87483;
 	Thu,  7 Dec 2023 10:19:07 +0100 (CET)
 Authentication-Results: phobos.denx.de;
 dmarc=pass (p=none dis=none) header.from=linaro.org
 Authentication-Results: phobos.denx.de;
 spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de
 Authentication-Results: phobos.denx.de;
 	dkim=pass (2048-bit key;
 unprotected) header.d=linaro.org header.i=@linaro.org header.b="KcFhbOkM";
 	dkim-atps=neutral
 Received: by phobos.denx.de (Postfix, from userid 109)
 id B1E298745E; Thu,  7 Dec 2023 10:19:05 +0100 (CET)
 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de
 X-Spam-Level: 
 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
 DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS,
 T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2
 Received: from mail-wr1-x433.google.com (mail-wr1-x433.google.com
 [IPv6:2a00:1450:4864:20::433])
 (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits))
 (No client certificate requested)
 by phobos.denx.de (Postfix) with ESMTPS id 792A8871BB
 for <u-boot@lists.denx.de>; Thu,  7 Dec 2023 10:19:03 +0100 (CET)
 Authentication-Results: phobos.denx.de;
 dmarc=pass (p=none dis=none) header.from=linaro.org
 Authentication-Results: phobos.denx.de;
 spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org
 Received: by mail-wr1-x433.google.com with SMTP id
 ffacd0b85a97d-3334a701cbbso717814f8f.0
 for <u-boot@lists.denx.de>; Thu, 07 Dec 2023 01:19:03 -0800 (PST)
 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=linaro.org; s=google; t=1701940743; x=1702545543; darn=lists.denx.de;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:from:to:cc:subject:date
 :message-id:reply-to;
 bh=JIRbBgzEcdaHWJ7fVa5JIsDJda65F2tSuL1aji2tJ5U=;
 b=KcFhbOkMkvXbThdeAeI92+uSdN5LvKdwae+36Z/jz0Hg0yPDs5v8UqeDt2d+NaSlh9
 GERy8kIMCopTcJ13FoUM8Ok4PBSMRSDxbJo4lLaGIbddw7hcit4uxhJfTAL8zKxnboMU
 YBZPC/E2NjWklmJx6p4zmLeXS5IzncTaDE9z2XFMRGrJ/KLqpTvwOp/nf57jP/kdIxpe
 Q7vWAhVY8gC19ogSD41RB4ixA0HefI6xKq6fAl2GwvRlOvCEGAcVdpbl8aj5R8qEOSVT
 BsuqzbDXHlQI6L9Y++Yqe89LcKMRoAWqHrgOuO3eBwnEp2jjjzV8G24mTFD+4wso1ERo
 mIkQ==
 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1701940743; x=1702545543;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
 :subject:date:message-id:reply-to;
 bh=JIRbBgzEcdaHWJ7fVa5JIsDJda65F2tSuL1aji2tJ5U=;
 b=pee1V3/z6lW4enMw0ueHvBJJXGhNLq7KccXmY4QkXfVRLXGBOedbBwQH1KXDxj/gJs
 RZ/KhsEvPN4qeqrqpeOnQoDBQs3QarjlsMHmlhnlBZMpgPKTJyg5MEpZPAlnfqZJkd4A
 vMMYc1fZ+alT5gfZjdzpLypC2sOj9yC3ktb8ZYXQGQzN7yCYrQnBHgiYn3vDDaHMaQNH
 n73RxiQNWJs9Ekow2hxk4l2FDpvlwuiFr9y+dnuzo5TvpbgaDbj64tcqxalnusBw3jKC
 fE6r5cob553rh/ZM/bVJD/PIXP+LOSUHyiqJG+7KpEpSAY984EIHkKFRRbLHSIuwBAK+
 wTIw==
 X-Gm-Message-State: AOJu0YwQcpf2rvKZHAPWsPT7fH7x3sa+mhF5kDJ557Oe9zwmQc4v6NzO
 ZFEgE8KlljYnqibJKd2JdRCP6A==
 X-Google-Smtp-Source: 
 AGHT+IEfJolrJ5g6Qgn465DsdBpMZMW+cn6kVgLvehQIXNT7VcXYfkBvC8Hf5zXnl7Q5Yto7bS2tOg==
 X-Received: by 2002:a05:600c:d5:b0:40b:5e59:99c6 with SMTP id
 u21-20020a05600c00d500b0040b5e5999c6mr940484wmm.230.1701940742953;
 Thu, 07 Dec 2023 01:19:02 -0800 (PST)
 Received: from localhost.localdomain (ppp046103111243.access.hol.gr.
 [46.103.111.243]) by smtp.gmail.com with ESMTPSA id
 u21-20020a05600c139500b00405d9a950a2sm1299003wmf.28.2023.12.07.01.19.01
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Thu, 07 Dec 2023 01:19:02 -0800 (PST)
 From: Ilias Apalodimas <ilias.apalodimas@linaro.org>
 To: trini@konsulko.com,
 	sjg@chromium.org
 Cc: sean.anderson@seco.com, neil.armstrong@linaro.org,
 heinrich.schuchardt@canonical.com, mark.kettenis@xs4all.nl,
 Ilias Apalodimas <ilias.apalodimas@linaro.org>, u-boot@lists.denx.de
 Subject: [PATCH 2/2 v3] smbios: Fallback to the default DT if sysinfo nodes
 are missing
 Date: Thu,  7 Dec 2023 11:18:50 +0200
 Message-Id: <20231207091850.17776-3-ilias.apalodimas@linaro.org>
 X-Mailer: git-send-email 2.40.1
 In-Reply-To: <20231207091850.17776-1-ilias.apalodimas@linaro.org>
 References: <20231207091850.17776-1-ilias.apalodimas@linaro.org>
 MIME-Version: 1.0
 X-BeenThere: u-boot@lists.denx.de
 X-Mailman-Version: 2.1.39
 Precedence: list
 List-Id: U-Boot discussion <u-boot.lists.denx.de>
 List-Unsubscribe: <https://lists.denx.de/options/u-boot>,
 <mailto:u-boot-request@lists.denx.de?subject=unsubscribe>
 List-Archive: <https://lists.denx.de/pipermail/u-boot/>
 List-Post: <mailto:u-boot@lists.denx.de>
 List-Help: <mailto:u-boot-request@lists.denx.de?subject=help>
 List-Subscribe: <https://lists.denx.de/listinfo/u-boot>,
 <mailto:u-boot-request@lists.denx.de?subject=subscribe>
 Errors-To: u-boot-bounces@lists.denx.de
 Sender: "U-Boot" <u-boot-bounces@lists.denx.de>
 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de
 X-Virus-Status: Clean
 In order to fill in the SMBIOS tables U-Boot currently relies on a
 "u-boot,sysinfo-smbios" compatible node.  This is fine for the boards
 that already include such nodes.  However with some recent EFI changes,
 the majority of boards can boot up distros, which usually rely on
 things like dmidecode etc for their reporting.  For boards that
 lack this special node the SMBIOS output looks like:
 System Information
        Manufacturer: Unknown
        Product Name: Unknown
        Version: Unknown
        Serial Number: Unknown
        UUID: Not Settable
        Wake-up Type: Reserved
        SKU Number: Unknown
        Family: Unknown
 This looks problematic since most of the info are "Unknown".  The DT spec
 specifies standard properties containing relevant information like
 'model' and 'compatible' for which the suggested format is
 <manufacturer,model>. Unfortunately the 'model' string found in DTs is
 usually lacking the manufacturer so we can't use it for both
 'Manufacturer' and 'Product Name' SMBIOS entries reliably.
 So let's add a last resort to our current smbios parsing.  If none of
 the sysinfo properties are found, scan for those information in the
 root node of the device tree. Use the 'model' to fill the 'Product
 Name' and the first value of 'compatible' for the 'Manufacturer', since
 that always contains one.
 pre-patch:
 Handle 0x0001, DMI type 1, 27 bytes
 System Information
        Manufacturer: Unknown
        Product Name: Unknown
        Version: Unknown
        Serial Number: 100000000bb24ceb
        UUID: 30303031-3030-3030-3061-613234636435
        Wake-up Type: Reserved
        SKU Number: Unknown
        Family: Unknown
 [...]
 and post patch:
 Handle 0x0001, DMI type 1, 27 bytes
 System Information
        Manufacturer: raspberrypi
        Product Name: Raspberry Pi 4 Model B Rev 1.1
        Version: Unknown
        Serial Number: 100000000bb24ceb
        UUID: 30303031-3030-3030-3061-613234636435
        Wake-up Type: Reserved
        SKU Number: Unknown
        Family: Unknown
 [...]
 Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
 ---
 Simon, I'll work with tou on the refactoring you wanted and
 remove the EFI requirement of SMBIOS in !x86 platforms.
 Since this code has no tests, I'll add some once the refactoring
 is done
 Changes since v2:
 - Spelling mistakes
 - rebase on top of patch #1 changes
 Changes since v1:
 - Tokenize the DT node entry and use the appropriate value instead of
  the entire string
 - Removed Peters tested/reviewed-by tags due to the above
 lib/smbios.c | 94 +++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 89 insertions(+), 5 deletions(-)
 --
 2.40.1
 diff --git a/lib/smbios.c b/lib/smbios.c
 index 444aa245a273..3f0e1d529537 100644
 --- a/lib/smbios.c
 +++ b/lib/smbios.c
@@ -9,11 +9,14 @@
 #include <dm.h>
 #include <env.h>
 #include <linux/stringify.h>
 +#include <linux/string.h>
 #include <mapmem.h>
 #include <smbios.h>
 #include <sysinfo.h>
 #include <tables_csum.h>
 #include <version.h>
 +#include <malloc.h>
 +#include <dm/ofnode.h>
 #ifdef CONFIG_CPU
 #include <cpu.h>
 #include <dm/uclass-internal.h>
@@ -43,6 +46,25 @@
 DECLARE_GLOBAL_DATA_PTR;
 +/**
 + * struct map_sysinfo - Mapping of sysinfo strings to DT
 + *
 + * @sysinfo_str: sysinfo string
 + * @dt_str: DT string
 + * @max: Max index of the tokenized string to pick. Counting starts from 0
 + *
 + */
 +struct map_sysinfo {
 +	const char *sysinfo_str;
 +	const char *dt_str;
 +	int max;
 +};
 +
 +static const struct map_sysinfo sysinfo_to_dt[] = {
 +	{ .sysinfo_str = "product", .dt_str = "model", 2 },
 +	{ .sysinfo_str = "manufacturer", .dt_str = "compatible", 1 },
 +};
 +
 /**
  * struct smbios_ctx - context for writing SMBIOS tables
  *
@@ -87,6 +109,18 @@ struct smbios_write_method {
 	const char *subnode_name;
 };
 +static const struct map_sysinfo *convert_sysinfo_to_dt(const char *sysinfo_str)
 +{
 +	int i;
 +
 +	for (i = 0; i < ARRAY_SIZE(sysinfo_to_dt); i++) {
 +		if (!strcmp(sysinfo_str, sysinfo_to_dt[i].sysinfo_str))
 +			return &sysinfo_to_dt[i];
 +	}
 +
 +	return NULL;
 +}
 +
 /**
  * smbios_add_string() - add a string to the string area
  *
@@ -124,6 +158,42 @@ static int smbios_add_string(struct smbios_ctx *ctx, const char *str)
 	}
 }
 +/**
 + * get_str_from_dt - Get a substring from a DT property.
 + *                   After finding the property in the DT, the function
 + *                   will parse comma-separated values and return the value.
 + *                   If nprop->max exceeds the number of comma-separated
 + *                   elements, the last non NULL value will be returned.
 + *                   Counting starts from zero.
 + *
 + * @nprop: sysinfo property to use
 + * @str: pointer to fill with data
 + * @size: str buffer length
 + */
 +static
 +void get_str_from_dt(const struct map_sysinfo *nprop, char *str, size_t size)
 +{
 +	const char *dt_str;
 +	int cnt = 0;
 +	char *token;
 +
 +	memset(str, 0, size);
 +	if (!nprop || !nprop->max)
 +		return;
 +
 +	dt_str = ofnode_read_string(ofnode_root(), nprop->dt_str);
 +	if (!dt_str)
 +		return;
 +
 +	memcpy(str, dt_str, size);
 +	token = strtok(str, ",");
 +	while (token && cnt < nprop->max) {
 +		strlcpy(str, token, strlen(token) + 1);
 +		token = strtok(NULL, ",");
 +		cnt++;
 +	}
 +}
 +
 /**
  * smbios_add_prop_si() - Add a property from the devicetree or sysinfo
  *
@@ -137,6 +207,8 @@ static int smbios_add_string(struct smbios_ctx *ctx, const char *str)
 static int smbios_add_prop_si(struct smbios_ctx *ctx, const char *prop,
 			      int sysinfo_id, const char *dval)
 {
 +	int ret;
 +
 	if (!dval || !*dval)
 		dval = "Unknown";
@@ -145,18 +217,30 @@ static int smbios_add_prop_si(struct smbios_ctx *ctx, const char *prop,
 	if (sysinfo_id && ctx->dev) {
 		char val[SMBIOS_STR_MAX];
 -		int ret;
 		ret = sysinfo_get_str(ctx->dev, sysinfo_id, sizeof(val), val);
 		if (!ret)
 			return smbios_add_string(ctx, val);
 	}
 	if (IS_ENABLED(CONFIG_OF_CONTROL)) {
 -		const char *str;
 -
 -		str = ofnode_read_string(ctx->node, prop);
 +		const char *str = NULL;
 +		char str_dt[128] = { 0 };
 +		/*
 +		 * If the node is not valid fallback and try the entire DT
 +		 * so we can at least fill in manufacturer and board type
 +		 */
 +		if (ofnode_valid(ctx->node)) {
 +			str = ofnode_read_string(ctx->node, prop);
 +		} else {
 +			const struct map_sysinfo *nprop;
 +
 +			nprop = convert_sysinfo_to_dt(prop);
 +			get_str_from_dt(nprop, str_dt, sizeof(str_dt));
 +			str = (const char *)str_dt;
 +		}
 -		return smbios_add_string(ctx, str ? str : dval);
 +		ret = smbios_add_string(ctx, str && *str ? str : dval);
 +		return ret;
 	}
 	return 0;
--- a/backport-disable-VBE-by-default.patch
+++ b/backport-disable-VBE-by-default.patch
@ -1,27 +0,0 @@
 From 02513d9ecc38d11ffc051ed59529e11f82164785 Mon Sep 17 00:00:00 2001
 From: Peter Robinson <pbrobinson@gmail.com>
 Date: Fri, 18 Aug 2023 13:28:05 +0100
 Subject: [PATCH] disable VBE by default
 Fedora doesn't support the VBE boot method, disable it
 to reduce size and remove a possible boot attack vector.
 Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
 ---
 boot/Kconfig | 1 -
 1 file changed, 1 deletion(-)
 diff --git a/boot/Kconfig b/boot/Kconfig
 index e8fb03b8016..467b09e2350 100644
 --- a/boot/Kconfig
 +++ b/boot/Kconfig
@@ -526,7 +526,6 @@ config BOOTMETH_EFILOADER
 config BOOTMETH_VBE
 	bool "Bootdev support for Verified Boot for Embedded"
 	depends on FIT
 -	default y
 	select BOOTMETH_GLOBAL
 	select EVENT
 	help
 -- 
 2.41.0
--- a/backport-enable-bootmenu-by-default.patch
+++ b/backport-enable-bootmenu-by-default.patch
@ -1,49 +0,0 @@
 From a956480a6d52ae90ef4a46275c2ee29a4074de36 Mon Sep 17 00:00:00 2001
 From: Peter Robinson <pbrobinson@gmail.com>
 Date: Fri, 18 Aug 2023 23:10:42 +0100
 Subject: [PATCH] enable bootmenu by default
 We want the boot menu on all Fedora devices as it makes
 it a whole lot more user friendly.
 Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
 ---
 boot/Kconfig | 2 ++
 cmd/Kconfig  | 1 +
 2 files changed, 3 insertions(+)
 diff --git a/boot/Kconfig b/boot/Kconfig
 index 467b09e2350..ad67b1f65a6 100644
 --- a/boot/Kconfig
 +++ b/boot/Kconfig
@@ -1281,6 +1281,7 @@ config BOOTDELAY
 config AUTOBOOT_KEYED
 	bool "Stop autobooting via specific input key / string"
 +	default y
 	help
 	  This option enables stopping (aborting) of the automatic
 	  boot feature only by issuing a specific input key or
@@ -1433,6 +1434,7 @@ config AUTOBOOT_MENUKEY
 config AUTOBOOT_MENU_SHOW
 	bool "Show a menu on boot"
 +	default y
 	depends on CMD_BOOTMENU
 	help
 	  This enables the boot menu, controlled by environment variables
 diff --git a/cmd/Kconfig b/cmd/Kconfig
 index 43ca10f69cc..3d39f2914cc 100644
 --- a/cmd/Kconfig
 +++ b/cmd/Kconfig
@@ -413,6 +413,7 @@ source lib/efi_selftest/Kconfig
 config CMD_BOOTMENU
 	bool "bootmenu"
 +	default y
 	select MENU
 	select CHARSET
 	help
 -- 
 2.41.0
--- a/backport-rockchip-Add-initial-support-for-the-PinePhone-Pro.patch
+++ b/backport-rockchip-Add-initial-support-for-the-PinePhone-Pro.patch
@ -1,236 +0,0 @@
 From 72400858605c085cf94a6cf5599269c8c39e3e72 Mon Sep 17 00:00:00 2001
 From: Peter Robinson <pbrobinson@gmail.com>
 Date: Tue, 14 Mar 2023 12:30:36 +0000
 Subject: [PATCH] rockchip: pinephone pro: add initial display support
 Add proposed upstream DT patches for display, disable edp,
 enable mipi and backlight, add required clocks.
 Clocks may not be required based on upstream review. Still
 need to add panel pieces, the rk3288-evb has an example for
 panel DT for u-boot, or may need to do a mipi addition to
 simple-panel, or something else.
 Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
 ---
 arch/arm/dts/rk3399-pinephone-pro.dts  | 123 +++++++++++++++++++++++++
 configs/pinephone-pro-rk3399_defconfig |   3 +-
 include/dt-bindings/clock/rk3399-cru.h |   2 +
 3 files changed, 127 insertions(+), 1 deletion(-)
 diff --git a/arch/arm/dts/rk3399-pinephone-pro.dts b/arch/arm/dts/rk3399-pinephone-pro.dts
 index 04403a76238..d0609d1b534 100644
 --- a/arch/arm/dts/rk3399-pinephone-pro.dts
 +++ b/arch/arm/dts/rk3399-pinephone-pro.dts
@@ -29,6 +29,12 @@
 		stdout-path = "serial2:115200n8";
 	};
 +	backlight: backlight {
 +		compatible = "pwm-backlight";
 +		pwms = <&pwm0 0 1000000 0>;
 +		pwm-delay-us = <10000>;
 +	};
 +
 	gpio-keys {
 		compatible = "gpio-keys";
 		pinctrl-names = "default";
@@ -102,6 +108,32 @@
 		/* WL_REG_ON on module */
 		reset-gpios = <&gpio0 RK_PB2 GPIO_ACTIVE_LOW>;
 	};
 +
 +	/* MIPI DSI panel 1.8v supply */
 +	vcc1v8_lcd: vcc1v8-lcd-regulator {
 +		compatible = "regulator-fixed";
 +		enable-active-high;
 +		regulator-name = "vcc1v8_lcd";
 +		regulator-min-microvolt = <1800000>;
 +		regulator-max-microvolt = <1800000>;
 +		vin-supply = <&vcc3v3_sys>;
 +		gpio = <&gpio3 RK_PA5 GPIO_ACTIVE_HIGH>;
 +		pinctrl-names = "default";
 +		pinctrl-0 = <&display_pwren1>;
 +	};
 +
 +	/* MIPI DSI panel 2.8v supply */
 +	vcc2v8_lcd: vcc2v8-lcd-regulator {
 +		compatible = "regulator-fixed";
 +		enable-active-high;
 +		regulator-name = "vcc2v8_lcd";
 +		regulator-min-microvolt = <2800000>;
 +		regulator-max-microvolt = <2800000>;
 +		vin-supply = <&vcc3v3_sys>;
 +		gpio = <&gpio3 RK_PA1 GPIO_ACTIVE_HIGH>;
 +		pinctrl-names = "default";
 +		pinctrl-0 = <&display_pwren>;
 +	};
 };
 &cpu_l0 {
@@ -132,6 +164,11 @@
 	status = "okay";
 };
 +&gpu {
 +	mali-supply = <&vdd_gpu>;
 +	status = "okay";
 +};
 +
 &i2c0 {
 	clock-frequency = <400000>;
 	i2c-scl-rising-time-ns = <168>;
@@ -214,6 +251,9 @@
 				regulator-name = "vcc3v0_touch";
 				regulator-min-microvolt = <3000000>;
 				regulator-max-microvolt = <3000000>;
 +				regulator-state-mem {
 +					regulator-off-in-suspend;
 +				};
 			};
 			vcca1v8_codec: LDO_REG3 {
@@ -347,6 +387,25 @@
 	};
 };
 +&i2c3 {
 +	i2c-scl-rising-time-ns = <450>;
 +	i2c-scl-falling-time-ns = <15>;
 +	status = "okay";
 +
 +	touchscreen@14 {
 +		compatible = "goodix,gt917s";
 +		reg = <0x14>;
 +		interrupt-parent = <&gpio3>;
 +		interrupts = <RK_PB5 IRQ_TYPE_EDGE_RISING>;
 +		irq-gpios = <&gpio3 RK_PB5 GPIO_ACTIVE_HIGH>;
 +		reset-gpios = <&gpio3 RK_PB4 GPIO_ACTIVE_HIGH>;
 +		AVDD28-supply = <&vcc3v0_touch>;
 +		VDDIO-supply = <&vcc3v0_touch>;
 +		touchscreen-size-x = <720>;
 +		touchscreen-size-y = <1440>;
 +	};
 +};
 +
 &io_domains {
 	bt656-supply = <&vcc1v8_dvp>;
 	audio-supply = <&vcca1v8_codec>;
@@ -355,6 +414,40 @@
 	status = "okay";
 };
 +&mipi_dsi {
 +	status = "okay";
 +	clock-master;
 +
 +	ports {
 +		mipi_out: port@1 {
 +			#address-cells = <0>;
 +			#size-cells = <0>;
 +			reg = <1>;
 +
 +			mipi_out_panel: endpoint {
 +				remote-endpoint = <&mipi_in_panel>;
 +			};
 +		};
 +	};
 +
 +	panel@0 {
 +		compatible = "hannstar,hsd060bhw4";
 +		reg = <0>;
 +		backlight = <&backlight>;
 +		reset-gpios = <&gpio4 RK_PD1 GPIO_ACTIVE_LOW>;
 +		vcc-supply = <&vcc2v8_lcd>;
 +		iovcc-supply = <&vcc1v8_lcd>;
 +		pinctrl-names = "default";
 +		pinctrl-0 = <&display_rst_l>;
 +
 +		port {
 +			mipi_in_panel: endpoint {
 +				remote-endpoint = <&mipi_out_panel>;
 +			};
 +		};
 +	};
 +};
 +
 &pmu_io_domains {
 	pmu1830-supply = <&vcc_1v8>;
 	status = "okay";
@@ -387,6 +480,20 @@
 		};
 	};
 +	dsi {
 +		display_rst_l: display-rst-l {
 +			rockchip,pins = <4 RK_PD1 RK_FUNC_GPIO &pcfg_pull_down>;
 +		};
 +
 +		display_pwren: display-pwren {
 +			rockchip,pins = <3 RK_PA1 RK_FUNC_GPIO &pcfg_pull_down>;
 +		};
 +
 +		display_pwren1: display-pwren1 {
 +			rockchip,pins = <3 RK_PA5 RK_FUNC_GPIO &pcfg_pull_down>;
 +		};
 +	};
 +
 	sound {
 		vcc1v8_codec_en: vcc1v8-codec-en {
 			rockchip,pins = <3 RK_PA4 RK_FUNC_GPIO &pcfg_pull_down>;
@@ -422,6 +529,10 @@
 	status = "okay";
 };
 +&pwm0 {
 +	status = "okay";
 +};
 +
 &sdmmc {
 	bus-width = <4>;
 	cap-sd-highspeed;
@@ -472,3 +583,15 @@
 &uart2 {
 	status = "okay";
 };
 +
 +&vopb {
 +	status = "okay";
 +	assigned-clocks = <&cru DCLK_VOP0_DIV>, <&cru DCLK_VOP0>,
 +			  <&cru ACLK_VOP0>, <&cru HCLK_VOP0>;
 +	assigned-clock-rates = <0>, <0>, <400000000>, <100000000>;
 +	assigned-clock-parents = <&cru PLL_CPLL>, <&cru DCLK_VOP0_FRAC>;
 +};
 +
 +&vopb_mmu {
 +	status = "okay";
 +};
 diff --git a/configs/pinephone-pro-rk3399_defconfig b/configs/pinephone-pro-rk3399_defconfig
 index 54f9b90536c..1982131c805 100644
 --- a/configs/pinephone-pro-rk3399_defconfig
 +++ b/configs/pinephone-pro-rk3399_defconfig
@@ -96,6 +96,7 @@ CONFIG_USB_ETHER_RTL8152=y
 CONFIG_VIDEO=y
 CONFIG_DISPLAY=y
 CONFIG_VIDEO_ROCKCHIP=y
 -CONFIG_DISPLAY_ROCKCHIP_EDP=y
 +CONFIG_DISPLAY_ROCKCHIP_MIPI=y
 +CONFIG_BACKLIGHT_PWM=y
 CONFIG_SPL_TINY_MEMSET=y
 CONFIG_ERRNO_STR=y
 diff --git a/include/dt-bindings/clock/rk3399-cru.h b/include/dt-bindings/clock/rk3399-cru.h
 index 211faf8fa89..7866e5266d2 100644
 --- a/include/dt-bindings/clock/rk3399-cru.h
 +++ b/include/dt-bindings/clock/rk3399-cru.h
@@ -131,6 +131,8 @@
 #define DCLK_VOP0_DIV			182
 #define DCLK_VOP1_DIV			183
 #define DCLK_M0_PERILP			184
 +#define DCLK_VOP0_FRAC                 185
 +#define DCLK_VOP1_FRAC                 186
 #define FCLK_CM0S			190
 -- 
 2.39.2
--- a/backport-rpi-Enable-using-the-DT-provided-by-the-Raspberry-Pi.patch
+++ b/backport-rpi-Enable-using-the-DT-provided-by-the-Raspberry-Pi.patch
@ -0,0 +1,95 @@
 From 7389a936fbd5ccaae7c39d38d1440e0359f9d0e5 Mon Sep 17 00:00:00 2001
 From: Peter Robinson <pbrobinson@gmail.com>
 Date: Tue, 12 May 2020 08:14:26 +0100
 Subject: [PATCH] rpi: Use firmware provided device tree
 Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
 ---
 configs/rpi_0_w_defconfig      | 2 +-
 configs/rpi_2_defconfig        | 2 +-
 configs/rpi_3_32b_defconfig    | 2 +-
 configs/rpi_3_b_plus_defconfig | 2 +-
 configs/rpi_3_defconfig        | 2 +-
 configs/rpi_defconfig          | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)
 diff --git a/configs/rpi_0_w_defconfig b/configs/rpi_0_w_defconfig
 index bba5e12b12..0241f4c6d3 100644
 --- a/configs/rpi_0_w_defconfig
 +++ b/configs/rpi_0_w_defconfig
@@ -17,7 +17,7 @@ CONFIG_CMD_GPIO=y
 CONFIG_CMD_MMC=y
 CONFIG_CMD_USB=y
 CONFIG_CMD_FS_UUID=y
 -CONFIG_OF_EMBED=y
 +CONFIG_OF_BOARD=y
 CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
 CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 diff --git a/configs/rpi_2_defconfig b/configs/rpi_2_defconfig
 index 1c2bbb29ce..9573e475f4 100644
 --- a/configs/rpi_2_defconfig
 +++ b/configs/rpi_2_defconfig
@@ -17,7 +17,7 @@ CONFIG_CMD_GPIO=y
 CONFIG_CMD_MMC=y
 CONFIG_CMD_USB=y
 CONFIG_CMD_FS_UUID=y
 -CONFIG_OF_EMBED=y
 +CONFIG_OF_BOARD=y
 CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
 CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 diff --git a/configs/rpi_3_32b_defconfig b/configs/rpi_3_32b_defconfig
 index b8a3d17f43..252df994e6 100644
 --- a/configs/rpi_3_32b_defconfig
 +++ b/configs/rpi_3_32b_defconfig
@@ -18,7 +18,7 @@ CONFIG_CMD_GPIO=y
 CONFIG_CMD_MMC=y
 CONFIG_CMD_USB=y
 CONFIG_CMD_FS_UUID=y
 -CONFIG_OF_EMBED=y
 +CONFIG_OF_BOARD=y
 CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
 CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 diff --git a/configs/rpi_3_b_plus_defconfig b/configs/rpi_3_b_plus_defconfig
 index 4c361438fa..3b2996a2f9 100644
 --- a/configs/rpi_3_b_plus_defconfig
 +++ b/configs/rpi_3_b_plus_defconfig
@@ -18,7 +18,7 @@ CONFIG_CMD_GPIO=y
 CONFIG_CMD_MMC=y
 CONFIG_CMD_USB=y
 CONFIG_CMD_FS_UUID=y
 -CONFIG_OF_EMBED=y
 +CONFIG_OF_BOARD=y
 CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
 CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 diff --git a/configs/rpi_3_defconfig b/configs/rpi_3_defconfig
 index 9b281a4f15..1e9ee6122e 100644
 --- a/configs/rpi_3_defconfig
 +++ b/configs/rpi_3_defconfig
@@ -18,7 +18,7 @@ CONFIG_CMD_GPIO=y
 CONFIG_CMD_MMC=y
 CONFIG_CMD_USB=y
 CONFIG_CMD_FS_UUID=y
 -CONFIG_OF_EMBED=y
 +CONFIG_OF_BOARD=y
 CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
 CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 diff --git a/configs/rpi_defconfig b/configs/rpi_defconfig
 index b5ad53c37b..223fc03275 100644
 --- a/configs/rpi_defconfig
 +++ b/configs/rpi_defconfig
@@ -17,7 +17,7 @@ CONFIG_CMD_GPIO=y
 CONFIG_CMD_MMC=y
 CONFIG_CMD_USB=y
 CONFIG_CMD_FS_UUID=y
 -CONFIG_OF_EMBED=y
 +CONFIG_OF_BOARD=y
 CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
 CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 -- 
--- a/backport-uefi-Boot-var-automatic-management-for-removable-medias.patch
+++ b/backport-uefi-Boot-var-automatic-management-for-removable-medias.patch
@ -1,574 +0,0 @@
 From patchwork Fri Nov 10 04:25:37 2023
 Content-Type: text/plain; charset="utf-8"
 MIME-Version: 1.0
 Content-Transfer-Encoding: 8bit
 X-Patchwork-Submitter: Masahisa Kojima <masahisa.kojima@linaro.org>
 X-Patchwork-Id: 1862317
 X-Patchwork-Delegate: apalos@gmail.com
 Return-Path: <u-boot-bounces@lists.denx.de>
 X-Original-To: incoming@patchwork.ozlabs.org
 Delivered-To: patchwork-incoming@legolas.ozlabs.org
 Authentication-Results: legolas.ozlabs.org;
 	dkim=pass (2048-bit key;
 unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256
 header.s=google header.b=muA1rcXE;
 	dkim-atps=neutral
 Authentication-Results: legolas.ozlabs.org;
 spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de
 (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;
 envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)
 Received: from phobos.denx.de (phobos.denx.de
 [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])
 	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 	 key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384)
 	(No client certificate requested)
 	by legolas.ozlabs.org (Postfix) with ESMTPS id 4SRQnL1SNCz1yRF
 	for <incoming@patchwork.ozlabs.org>; Fri, 10 Nov 2023 15:28:54 +1100 (AEDT)
 Received: from h2850616.stratoserver.net (localhost [IPv6:::1])
 	by phobos.denx.de (Postfix) with ESMTP id 4C150877A0;
 	Fri, 10 Nov 2023 05:27:39 +0100 (CET)
 Authentication-Results: phobos.denx.de;
 dmarc=pass (p=none dis=none) header.from=linaro.org
 Authentication-Results: phobos.denx.de;
 spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de
 Authentication-Results: phobos.denx.de;
 	dkim=pass (2048-bit key;
 unprotected) header.d=linaro.org header.i=@linaro.org header.b="muA1rcXE";
 	dkim-atps=neutral
 Received: by phobos.denx.de (Postfix, from userid 109)
 id 9DA4487796; Fri, 10 Nov 2023 05:27:28 +0100 (CET)
 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de
 X-Spam-Level: 
 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
 DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS,
 T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2
 Received: from mail-qv1-xf30.google.com (mail-qv1-xf30.google.com
 [IPv6:2607:f8b0:4864:20::f30])
 (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits))
 (No client certificate requested)
 by phobos.denx.de (Postfix) with ESMTPS id E1AE487795
 for <u-boot@lists.denx.de>; Fri, 10 Nov 2023 05:27:22 +0100 (CET)
 Authentication-Results: phobos.denx.de;
 dmarc=pass (p=none dis=none) header.from=linaro.org
 Authentication-Results: phobos.denx.de;
 spf=pass smtp.mailfrom=masahisa.kojima@linaro.org
 Received: by mail-qv1-xf30.google.com with SMTP id
 6a1803df08f44-66d09b6d007so10800236d6.1
 for <u-boot@lists.denx.de>; Thu, 09 Nov 2023 20:27:22 -0800 (PST)
 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=linaro.org; s=google; t=1699590441; x=1700195241; darn=lists.denx.de;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:from:to:cc:subject:date
 :message-id:reply-to;
 bh=TMp02tF2/jn50c0fdB6OUXNmWJ9Af2C5T6zhn2D5BPI=;
 b=muA1rcXEW1UV0ytByrk/oz/vuO7kL/M5Szuv8+JLohfHHFY3sZW5v5q4Tn1coMbMKW
 6+JvY0qla9DiPjvWA90QSopUCqBoggSNPTIlTn4YSs0zA/+Aa9ufsx25M+rq4pdYGAZq
 ujAG9mRgWMuq7W+eZZWfQo6eFqEo14D6RbQL5NFW/G0Wkle6TwLwu7dp19DOw7hH/jPq
 sq9/5/DA4FEI+4sRDsPBAQ48VTq05vuMv2PMU0t4d7SXPVCEk1lW+JFZB4wooN2XotQ+
 ni+S40bdTeGBscZ+sajQQgtDd49nxGSB518samtlg5SGdhDB9WKak39uPeWU4WFYc01J
 R7BQ==
 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1699590441; x=1700195241;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
 :subject:date:message-id:reply-to;
 bh=TMp02tF2/jn50c0fdB6OUXNmWJ9Af2C5T6zhn2D5BPI=;
 b=o5TY9c0iL/aKbWJtamq+fAKn5twYwIcXo5Z8lxIo1/WL8jhCu3973LiJ6l2rbP6I26
 wEUpA97eZRYjRnp6Pfb9nJ5+Ip11akGFqY+UNFjwNues+jYvCmrhtbzt3RIwwRMopasI
 IvpvSU+Vk0opNS2b96ZRak7X34ZoUNZVcjTBCSqx3UgQcaMOxrP5u7LholG/3rTttkkF
 gdIAWrm7wPUrREhnt8opfpTWbusAkgJ1lAa0uqcfb4TRE7fKsiX3du3TwgJNsvACBXxW
 W4w5nDy5AXlY05IOsmMvxjIudLF0aDB3y/aUT1K7/NyAO77e5CPoGEIRF4JnpngLM7yx
 RcEw==
 X-Gm-Message-State: AOJu0YwKFnJ+XRzaRWdr9TK+didg99ZRC2gUKVvYvCLFFGqfG4yFbCXC
 IsubnJ6RTNtZqmONUFojqVLmrQYm513MFxxhCLg=
 X-Google-Smtp-Source: 
 AGHT+IE/39rKwHRMrxLkfDXIlyOXct/rRbXebKb2Lc3eaLeJaCt4Vmnxn7CrXnlXXLzUgocEmJUKcA==
 X-Received: by 2002:a05:6214:d44:b0:675:667d:a1b6 with SMTP id
 4-20020a0562140d4400b00675667da1b6mr7212832qvr.0.1699590440388;
 Thu, 09 Nov 2023 20:27:20 -0800 (PST)
 Received: from localhost ([164.70.16.189]) by smtp.gmail.com with ESMTPSA id
 n18-20020a170902e55200b001c0bf60ba5csm4304818plf.272.2023.11.09.20.27.19
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Thu, 09 Nov 2023 20:27:19 -0800 (PST)
 From: Masahisa Kojima <masahisa.kojima@linaro.org>
 To: u-boot@lists.denx.de
 Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>,
 Ilias Apalodimas <ilias.apalodimas@linaro.org>,
 Simon Glass <sjg@chromium.org>,
 Takahiro Akashi <takahiro.akashi@linaro.org>,
 Michal Simek <michal.simek@amd.com>, Raymond Mao <raymond.mao@linaro.org>,
 Masahisa Kojima <masahisa.kojima@linaro.org>,
 Joao Marcos Costa <jmcosta944@gmail.com>,
 Huang Jianan <jnhuang95@gmail.com>,
 Thomas Petazzoni <thomas.petazzoni@bootlin.com>,
 Miquel Raynal <miquel.raynal@bootlin.com>, linux-erofs@lists.ozlabs.org
 Subject: [PATCH v12 4/9] efi_loader: Boot var automatic management
 Date: Fri, 10 Nov 2023 13:25:37 +0900
 Message-Id: <20231110042542.3797301-5-masahisa.kojima@linaro.org>
 X-Mailer: git-send-email 2.34.1
 In-Reply-To: <20231110042542.3797301-1-masahisa.kojima@linaro.org>
 References: <20231110042542.3797301-1-masahisa.kojima@linaro.org>
 MIME-Version: 1.0
 X-BeenThere: u-boot@lists.denx.de
 X-Mailman-Version: 2.1.39
 Precedence: list
 List-Id: U-Boot discussion <u-boot.lists.denx.de>
 List-Unsubscribe: <https://lists.denx.de/options/u-boot>,
 <mailto:u-boot-request@lists.denx.de?subject=unsubscribe>
 List-Archive: <https://lists.denx.de/pipermail/u-boot/>
 List-Post: <mailto:u-boot@lists.denx.de>
 List-Help: <mailto:u-boot-request@lists.denx.de?subject=help>
 List-Subscribe: <https://lists.denx.de/listinfo/u-boot>,
 <mailto:u-boot-request@lists.denx.de?subject=subscribe>
 Errors-To: u-boot-bounces@lists.denx.de
 Sender: "U-Boot" <u-boot-bounces@lists.denx.de>
 X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de
 X-Virus-Status: Clean
 From: Raymond Mao <raymond.mao@linaro.org>
 Changes for complying to EFI spec ยง3.5.1.1
 'Removable Media Boot Behavior'.
 Boot variables can be automatically generated during a removable
 media is probed. At the same time, unused boot variables will be
 detected and removed.
 Please note that currently the function 'efi_disk_remove' has no
 ability to distinguish below two scenarios
 a) Unplugging of a removable media under U-Boot
 b) U-Boot exiting and booting an OS
 Thus currently the boot variables management is not added into
 'efi_disk_remove' to avoid boot options being added/erased
 repeatedly under scenario b) during power cycles
 See TODO comments under function 'efi_disk_remove' for more details
 The original efi_secboot tests expect that BootOrder EFI variable
 is not defined. With this commit, the BootOrder EFI variable is
 automatically added when the disk is detected. The original
 efi_secboot tests end up with unexpected failure.
 The efi_secboot tests need to be modified to explicitly set
 the BootOrder EFI variable.
 squashfs and erofs ls tests are also affected by this modification,
 need to clear the previous state before squashfs ls test starts.
 Co-developed-by: Masahisa Kojima <masahisa.kojima@linaro.org>
 Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
 Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
 Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
 Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
 Reviewed-by: Joao Marcos Costa <jmcosta944@gmail.com>
 ---
 lib/efi_loader/efi_disk.c                     | 18 ++++++++
 lib/efi_loader/efi_setup.c                    |  7 ++++
 test/py/tests/test_efi_secboot/test_signed.py | 42 +++++++++----------
 .../test_efi_secboot/test_signed_intca.py     | 14 +++----
 .../tests/test_efi_secboot/test_unsigned.py   | 14 +++----
 test/py/tests/test_fs/test_erofs.py           |  9 ++++
 .../test_fs/test_squashfs/test_sqfs_ls.py     |  9 ++++
 7 files changed, 78 insertions(+), 35 deletions(-)
 diff --git a/lib/efi_loader/efi_disk.c b/lib/efi_loader/efi_disk.c
 index f0d76113b0..b808a7fe62 100644
 --- a/lib/efi_loader/efi_disk.c
 +++ b/lib/efi_loader/efi_disk.c
@@ -690,6 +690,13 @@ int efi_disk_probe(void *ctx, struct event *event)
 			return -1;
 	}
 +	/* only do the boot option management when UEFI sub-system is initialized */
 +	if (IS_ENABLED(CONFIG_CMD_BOOTEFI_BOOTMGR) && efi_obj_list_initialized == EFI_SUCCESS) {
 +		ret = efi_bootmgr_update_media_device_boot_option();
 +		if (ret != EFI_SUCCESS)
 +			return -1;
 +	}
 +
 	return 0;
 }
@@ -742,6 +749,17 @@ int efi_disk_remove(void *ctx, struct event *event)
 	dev_tag_del(dev, DM_TAG_EFI);
 	return 0;
 +
 +	/*
 +	 * TODO A flag to distinguish below 2 different scenarios of this
 +	 * function call is needed:
 +	 * a) Unplugging of a removable media under U-Boot
 +	 * b) U-Boot exiting and booting an OS
 +	 * In case of scenario a), efi_bootmgr_update_media_device_boot_option()
 +	 * needs to be invoked here to update the boot options and remove the
 +	 * unnecessary ones.
 +	 */
 +
 }
 /**
 diff --git a/lib/efi_loader/efi_setup.c b/lib/efi_loader/efi_setup.c
 index ad719afd63..c02569cb6d 100644
 --- a/lib/efi_loader/efi_setup.c
 +++ b/lib/efi_loader/efi_setup.c
@@ -245,6 +245,13 @@ efi_status_t efi_init_obj_list(void)
 	if (ret != EFI_SUCCESS)
 		goto out;
 +	if (IS_ENABLED(CONFIG_CMD_BOOTEFI_BOOTMGR)) {
 +		/* update boot option after variable service initialized */
 +		ret = efi_bootmgr_update_media_device_boot_option();
 +		if (ret != EFI_SUCCESS)
 +			goto out;
 +	}
 +
 	/* Define supported languages */
 	ret = efi_init_platform_lang();
 	if (ret != EFI_SUCCESS)
 diff --git a/test/py/tests/test_efi_secboot/test_signed.py b/test/py/tests/test_efi_secboot/test_signed.py
 index ca52e853d8..2f862a259a 100644
 --- a/test/py/tests/test_efi_secboot/test_signed.py
 +++ b/test/py/tests/test_efi_secboot/test_signed.py
@@ -29,7 +29,7 @@ class TestEfiSignedImage(object):
             output = u_boot_console.run_command_list([
                 'host bind 0 %s' % disk_img,
                 'efidebug boot add -b 1 HELLO1 host 0:1 /helloworld.efi.signed -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'bootefi bootmgr'])
             assert 'Hello, world!' in ''.join(output)
@@ -37,7 +37,7 @@ class TestEfiSignedImage(object):
             # Test Case 1b, run unsigned image if no PK
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 2 HELLO2 host 0:1 /helloworld.efi -s ""',
 -                'efidebug boot next 2',
 +                'efidebug boot order 2',
                 'bootefi bootmgr'])
             assert 'Hello, world!' in ''.join(output)
@@ -59,13 +59,13 @@ class TestEfiSignedImage(object):
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO1 host 0:1 /helloworld.efi.signed -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert('\'HELLO1\' failed' in ''.join(output))
             assert('efi_start_image() returned: 26' in ''.join(output))
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 2 HELLO2 host 0:1 /helloworld.efi -s ""',
 -                'efidebug boot next 2',
 +                'efidebug boot order 2',
                 'efidebug test bootmgr'])
             assert '\'HELLO2\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -77,12 +77,12 @@ class TestEfiSignedImage(object):
                 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db'])
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
 -                'efidebug boot next 2',
 +                'efidebug boot order 2',
                 'efidebug test bootmgr'])
             assert '\'HELLO2\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
             output = u_boot_console.run_command_list([
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'bootefi bootmgr'])
             assert 'Hello, world!' in ''.join(output)
@@ -105,7 +105,7 @@ class TestEfiSignedImage(object):
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -117,7 +117,7 @@ class TestEfiSignedImage(object):
                 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db'])
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -143,7 +143,7 @@ class TestEfiSignedImage(object):
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -170,7 +170,7 @@ class TestEfiSignedImage(object):
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed_2sigs -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert 'Hello, world!' in ''.join(output)
@@ -181,7 +181,7 @@ class TestEfiSignedImage(object):
                 'setenv -e -nv -bs -rt -at -a -i 4000000:$filesize db'])
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert 'Hello, world!' in ''.join(output)
@@ -193,7 +193,7 @@ class TestEfiSignedImage(object):
                 'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx'])
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -205,7 +205,7 @@ class TestEfiSignedImage(object):
                 'setenv -e -nv -bs -rt -at -a -i 4000000:$filesize dbx'])
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -230,7 +230,7 @@ class TestEfiSignedImage(object):
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed_2sigs -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -254,7 +254,7 @@ class TestEfiSignedImage(object):
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'bootefi bootmgr'])
             assert 'Hello, world!' in ''.join(output)
@@ -265,7 +265,7 @@ class TestEfiSignedImage(object):
                 'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx'])
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -279,7 +279,7 @@ class TestEfiSignedImage(object):
                 'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx'])
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -307,7 +307,7 @@ class TestEfiSignedImage(object):
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed_2sigs -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -330,7 +330,7 @@ class TestEfiSignedImage(object):
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed_2sigs -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -349,7 +349,7 @@ class TestEfiSignedImage(object):
             output = u_boot_console.run_command_list([
                 'host bind 0 %s' % disk_img,
                 'efidebug boot add -b 1 HELLO1 host 0:1 /helloworld_forged.efi.signed -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert('hELLO, world!' in ''.join(output))
@@ -364,7 +364,7 @@ class TestEfiSignedImage(object):
                 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
             assert 'Failed to set EFI variable' not in ''.join(output)
             output = u_boot_console.run_command_list([
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert(not 'hELLO, world!' in ''.join(output))
             assert('\'HELLO1\' failed' in ''.join(output))
 diff --git a/test/py/tests/test_efi_secboot/test_signed_intca.py b/test/py/tests/test_efi_secboot/test_signed_intca.py
 index d8d599d22f..8d9a5f3e7f 100644
 --- a/test/py/tests/test_efi_secboot/test_signed_intca.py
 +++ b/test/py/tests/test_efi_secboot/test_signed_intca.py
@@ -40,7 +40,7 @@ class TestEfiSignedImageIntca(object):
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO_a host 0:1 /helloworld.efi.signed_a -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO_a\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -49,7 +49,7 @@ class TestEfiSignedImageIntca(object):
             # Test Case 1b, signed and authenticated by root CA
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 2 HELLO_ab host 0:1 /helloworld.efi.signed_ab -s ""',
 -                'efidebug boot next 2',
 +                'efidebug boot order 2',
                 'bootefi bootmgr'])
             assert 'Hello, world!' in ''.join(output)
@@ -71,7 +71,7 @@ class TestEfiSignedImageIntca(object):
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO_abc\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -81,7 +81,7 @@ class TestEfiSignedImageIntca(object):
             output = u_boot_console.run_command_list([
                 'fatload host 0:1 4000000 db_b.auth',
                 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO_abc\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
@@ -91,7 +91,7 @@ class TestEfiSignedImageIntca(object):
             output = u_boot_console.run_command_list([
                 'fatload host 0:1 4000000 db_c.auth',
                 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert 'Hello, world!' in ''.join(output)
@@ -117,7 +117,7 @@ class TestEfiSignedImageIntca(object):
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert 'Hello, world!' in ''.join(output)
             # Or,
@@ -129,7 +129,7 @@ class TestEfiSignedImageIntca(object):
             output = u_boot_console.run_command_list([
                 'fatload host 0:1 4000000 dbx_c.auth',
                 'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert '\'HELLO_abc\' failed' in ''.join(output)
             assert 'efi_start_image() returned: 26' in ''.join(output)
 diff --git a/test/py/tests/test_efi_secboot/test_unsigned.py b/test/py/tests/test_efi_secboot/test_unsigned.py
 index df63f0df08..7c078f220d 100644
 --- a/test/py/tests/test_efi_secboot/test_unsigned.py
 +++ b/test/py/tests/test_efi_secboot/test_unsigned.py
@@ -36,11 +36,11 @@ class TestEfiUnsignedImage(object):
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'bootefi bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             output = u_boot_console.run_command_list([
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert 'efi_start_image() returned: 26' in ''.join(output)
             assert 'Hello, world!' not in ''.join(output)
@@ -65,7 +65,7 @@ class TestEfiUnsignedImage(object):
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'bootefi bootmgr'])
             assert 'Hello, world!' in ''.join(output)
@@ -89,11 +89,11 @@ class TestEfiUnsignedImage(object):
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'bootefi bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             output = u_boot_console.run_command_list([
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert 'efi_start_image() returned: 26' in ''.join(output)
             assert 'Hello, world!' not in ''.join(output)
@@ -107,11 +107,11 @@ class TestEfiUnsignedImage(object):
             output = u_boot_console.run_command_list([
                 'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi -s ""',
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'bootefi bootmgr'])
             assert '\'HELLO\' failed' in ''.join(output)
             output = u_boot_console.run_command_list([
 -                'efidebug boot next 1',
 +                'efidebug boot order 1',
                 'efidebug test bootmgr'])
             assert 'efi_start_image() returned: 26' in ''.join(output)
             assert 'Hello, world!' not in ''.join(output)
 diff --git a/test/py/tests/test_fs/test_erofs.py b/test/py/tests/test_fs/test_erofs.py
 index 458a52ba79..87ad8f2d5f 100644
 --- a/test/py/tests/test_fs/test_erofs.py
 +++ b/test/py/tests/test_fs/test_erofs.py
@@ -196,6 +196,15 @@ def test_erofs(u_boot_console):
     """
     build_dir = u_boot_console.config.build_dir
 +    # If the EFI subsystem is enabled and initialized, EFI subsystem tries to
 +    # add EFI boot option when the new disk is detected. If there is no EFI
 +    # System Partition exists, EFI subsystem outputs error messages and
 +    # it ends up with test failure.
 +    # Restart U-Boot to clear the previous state.
 +    # TODO: Ideally EFI test cases need to be fixed, but it will
 +    # increase the number of system reset.
 +    u_boot_console.restart_uboot()
 +
     try:
         # setup test environment
         make_erofs_image(build_dir)
 diff --git a/test/py/tests/test_fs/test_squashfs/test_sqfs_ls.py b/test/py/tests/test_fs/test_squashfs/test_sqfs_ls.py
 index 527a556ed8..a20a7d1a66 100644
 --- a/test/py/tests/test_fs/test_squashfs/test_sqfs_ls.py
 +++ b/test/py/tests/test_fs/test_squashfs/test_sqfs_ls.py
@@ -118,6 +118,15 @@ def test_sqfs_ls(u_boot_console):
     """
     build_dir = u_boot_console.config.build_dir
 +    # If the EFI subsystem is enabled and initialized, EFI subsystem tries to
 +    # add EFI boot option when the new disk is detected. If there is no EFI
 +    # System Partition exists, EFI subsystem outputs error messages and
 +    # it ends up with test failure.
 +    # Restart U-Boot to clear the previous state.
 +    # TODO: Ideally EFI test cases need to be fixed, but it will
 +    # increase the number of system reset.
 +    u_boot_console.restart_uboot()
 +
     # setup test environment
     check_mksquashfs_version()
     generate_sqfs_src_dir(build_dir)
--- a/backport-uefi-distro-load-FDT-from-any-partition-on-boot-device.patch
+++ b/backport-uefi-distro-load-FDT-from-any-partition-on-boot-device.patch
@ -1,35 +1,35 @@
-From 4306c538d4a00dd1aa46c55c3c4005c2b0bf7cd5 Mon Sep 17 00:00:00 2001
+From 67c05a07288ef24b3ac9d013f35a0868d26a34c7 Mon Sep 17 00:00:00 2001
 From: Peter Robinson <pbrobinson@gmail.com>
-Date: Thu, 24 Nov 2022 12:57:55 +0000
+Date: Tue, 18 Jun 2019 11:51:21 +0100
-Subject: [PATCH] distro: load FDT from any partition on boot device
+Subject: [PATCH 1/2] distro: load FDT from any partition on boot device
- 
+
 In the EFI_LOADER boot path, we were only checking the FAT partition
 containing the EFI payload for dtb files.  But this is somewhat of a
 fiction.  In reality there will be one small (V)FAT partition containing
 grub (or whatever the payload may be), and a second boot partition
 containing kernel/initrd/fdt (typically ext4).  It is this second
 partition where we should be looking for a FDT to load.
- 
+
 So instead scan all the partitions of the disk containing the EFI
 payload.  This matches where grub looks for kernel/initrd (barring
 custom grub.cfg, in which case the user can use grub's 'devicetree'
 command to load the correct FDT).
- 
+
 The other option is somehow passing the ${fdtfile} to grub so that it
 can load the FDT based on selected kernel version location (which grub
 knows) and SoC/board specific ${fdtfile} (which grub does not know).
- 
+
 Signed-off-by: Rob Clark <robdclark@gmail.com>
 Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
 ---
- include/config_distro_bootcmd.h | 37 +++++++++++++++++++++------------
+ include/config_distro_bootcmd.h | 35 ++++++++++++++++++++++-----------
- 1 file changed, 24 insertions(+), 13 deletions(-)
+ 1 file changed, 23 insertions(+), 12 deletions(-)
 diff --git a/include/config_distro_bootcmd.h b/include/config_distro_bootcmd.h
-index fcb319a20ae..e71004fad9c 100644
+index 2627c2a6a5..eadd1080b3 100644
 --- a/include/config_distro_bootcmd.h
 +++ b/include/config_distro_bootcmd.h
-@@ -155,28 +155,39 @@
+@@ -148,26 +148,37 @@
 		"fi\0"                                                    \
 	\
 	"load_efi_dtb="                                                   \
@ -44,13 +44,11 @@ index fcb319a20ae..e71004fad9c 100644
 +	"scan_dev_for_dtb="                                               \
 		"setenv efi_fdtfile ${fdtfile}; "                         \
 		BOOTENV_EFI_SET_FDTFILE_FALLBACK                          \
 		BOOTENV_RUN_EXTENSION_INIT                                \
 -		"for prefix in ${efi_dtb_prefixes}; do "                  \
 -			"if test -e ${devtype} "                          \
 -					"${devnum}:${distro_bootpart} "   \
 -					"${prefix}${efi_fdtfile}; then "  \
 -				"run load_efi_dtb; "                      \
 -				BOOTENV_RUN_EXTENSION_APPLY               \
 -			"fi;"                                             \
 -		"done;"                                                   \
 -		"run boot_efi_bootmgr;"                                   \
@ -67,7 +65,6 @@ index fcb319a20ae..e71004fad9c 100644
 +						"${devnum}:${dtb_devp} "  \
 +						"${prefix}${efi_fdtfile};"\
 +					"run load_efi_dtb; "              \
 +					BOOTENV_RUN_EXTENSION_APPLY       \
 +				"fi;"                                     \
 +			"done; "                                          \
 +		"done; "                                                  \
@ -82,6 +79,4 @@ index fcb319a20ae..e71004fad9c 100644
 				"echo EFI LOAD FAILED: continuing...; "   \
 		"fi; "                                                    \
 		"setenv efi_fdtfile\0"
-- 
+-- 
 2.38.1
--- a/u-boot-2021.10.tar.bz2
+++ b/u-boot-2021.10.tar.bz2
--- a/uboot-tools.spec
+++ b/uboot-tools.spec
@ -2,40 +2,36 @@
 %global with_armv8 1
 Name:           uboot-tools
-Version:        2024.01
+Version:        2021.10
-Release:        2
+Release:        4
 Summary:        tools for U-Boot
 License:        GPL-2.0-or-later and Public Domain and GPL-2.0-only
 URL:            http://www.denx.de/wiki/U-Boot
 Source0:        https://ftp.denx.de/pub/u-boot/u-boot-%{version}.tar.bz2
-Source1:        aarch64-boards
+Source1:        arm-boards
-Source2:        10-devicetree.install
+Source2:        arm-chromebooks
 Source3:        aarch64-boards
 Source4:        aarch64-chromebooks
 Source5:        10-devicetree.install
-Patch1:         backport-uefi-distro-load-FDT-from-any-partition-on-boot-device.patch
+Patch6000:      backport-uefi-distro-load-FDT-from-any-partition-on-boot-device.patch
-Patch2:         backport-disable-VBE-by-default.patch   
+# RPi4llWinner improvements
-Patch3:         backport-Provide-a-fallback-to-smbios-tables.patch
+Patch6001:      backport-AllWinner-PineTab.patch
-Patch4:         backport-enable-bootmenu-by-default.patch
+# RPI4
-Patch5:         backport-uefi-Boot-var-automatic-management-for-removable-medias.patch
+Patch6002:      backport-rpi-Enable-using-the-DT-provided-by-the-Raspberry-Pi.patch
 Patch6:         backport-rockchip-Add-initial-support-for-the-PinePhone-Pro.patch
 Patch7:         backport-CVE-2024-57254.patch
 Patch8:         backport-CVE-2024-57255.patch
 Patch9:         backport-CVE-2024-57256.patch
 Patch10:        backport-CVE-2024-57257.patch
 Patch11:        backport-0001-CVE-2024-57258.patch
 Patch12:        backport-0002-CVE-2024-57258.patch
 Patch13:        backport-0003-CVE-2024-57258.patch
 Patch14:        backport-CVE-2024-57259.patch
 BuildRequires:  bc dtc gcc make flex bison git-core openssl-devel
 BuildRequires:  python3-unversioned-command python3-devel python3-setuptools
-BuildRequires:  python3-libfdt python3-pyelftools SDL2-devel swig
+BuildRequires:  python3-libfdt python3-pyelftools SDL-devel swig
-BuildRequires:  perl gnutls-devel ncurses-devel libuuid-devel
+BuildRequires:  perl
 # this required when /usr/bin/python link to python3
 BuildRequires:  python3-devel
 %if %{with_armv8}
 %ifarch %{arm}  aarch64
 BuildRequires:  vboot-utils
 %endif
 %ifarch aarch64
 BuildRequires:  arm-trusted-firmware-armv8
 BuildRequires:  python3-pyelftools
 %endif
 %endif
@ -84,14 +80,11 @@ u-boot bootloader ELF images for use with qemu and other platforms
 %prep
 %autosetup -p1 -n u-boot-%{version}
-cp %SOURCE1 .
+cp %SOURCE1 %SOURCE2 %SOURCE3 %SOURCE4 .
 %build
 mkdir builds
 %make_build HOSTCC="gcc $RPM_OPT_FLAGS" CROSS_COMPILE="" tools-only_defconfig O=builds/
 %make_build HOSTCC="gcc $RPM_OPT_FLAGS" CROSS_COMPILE="" tools-all O=builds/
 %if %{with_armv8}
 %ifarch aarch64 %{arm}
 for board in $(cat %{_arch}-boards)
@ -124,12 +117,15 @@ do
    cp /usr/share/arm-trusted-firmware/rk3399/* builds/$(echo $board)/
  fi
  # End ATF
-  BINMAN_ALLOW_MISSING=1 make $(echo $board)_defconfig O=builds/$(echo $board)/
+  make $(echo $board)_defconfig O=builds/$(echo $board)/
-  BINMAN_ALLOW_MISSING=1 %make_build HOSTCC="gcc $RPM_OPT_FLAGS" CROSS_COMPILE="" O=builds/$(echo $board)/
+  make HOSTCC="gcc $RPM_OPT_FLAGS" CROSS_COMPILE="" %{?_smp_mflags} V=1 O=builds/$(echo $board)/
 done
 %endif
 %endif
 make HOSTCC="gcc $RPM_OPT_FLAGS" %{?_smp_mflags} CROSS_COMPILE="" defconfig V=1 O=builds/ -j16
 make HOSTCC="gcc $RPM_OPT_FLAGS" %{?_smp_mflags} CROSS_COMPILE="" tools-all V=1 O=builds/ -j16
 %install
 mkdir -p %{buildroot}%{_bindir}
 mkdir -p %{buildroot}%{_sysconfdir}
@ -181,7 +177,7 @@ done
 %endif
 %endif
-for tool in dumpimage env/fw_printenv fit_check_sign fit_info gdb/gdbcont gdb/gdbsend gen_eth_addr gen_ethaddr_crc ifwitool img2srec kwboot mkeficapsule mkenvimage mkimage mksunxiboot ncb proftool sunxi-spl-image-builder
+for tool in bmp_logo dumpimage env/fw_printenv fit_check_sign fit_info gdb/gdbcont gdb/gdbsend gen_eth_addr gen_ethaddr_crc img2srec mkenvimage mkimage mksunxiboot ncb proftool sunxi-spl-image-builder ubsha1 xway-swap-bytes
 do
 install -p -m 0755 builds/tools/$tool %{buildroot}%{_bindir}
 done
@ -193,8 +189,23 @@ install -p -m 0755 builds/tools/env/fw_printenv %{buildroot}%{_bindir}
 install -p -m 0644 tools/env/fw_env.config %{buildroot}%{_sysconfdir}
 mkdir -p %{buildroot}/lib/kernel/install.d/
-install -p -m 0755 %{SOURCE2} %{buildroot}/lib/kernel/install.d/
+install -p -m 0755 %{SOURCE5} %{buildroot}/lib/kernel/install.d/
 mkdir -p builds/docs
 cp -p board/hisilicon/hikey/README builds/docs/README.hikey
 cp -p board/hisilicon/hikey/README builds/docs/README.hikey
 cp -p board/Marvell/db-88f6820-gp/README builds/docs/README.mvebu-db-88f6820
 cp -p board/rockchip/evb_rk3399/README builds/docs/README.evb_rk3399
 cp -p board/solidrun/clearfog/README builds/docs/README.clearfog
 cp -p board/solidrun/mx6cuboxi/README builds/docs/README.mx6cuboxi
 cp -p board/sunxi/README.sunxi64 builds/docs/README.sunxi64
 cp -p board/sunxi/README.nand builds/docs/README.sunxi-nand
 cp -p board/ti/am335x/README builds/docs/README.am335x
 cp -p board/ti/omap5_uevm/README builds/docs/README.omap5_uevm
 cp -p board/udoo/README builds/docs/README.udoo
 cp -p board/wandboard/README builds/docs/README.wandboard
 cp -p board/warp/README builds/docs/README.warp
 cp -p board/warp7/README builds/docs/README.warp7
 %files
 %defattr(-,root,root)
@ -224,29 +235,13 @@ install -p -m 0755 %{SOURCE2} %{buildroot}/lib/kernel/install.d/
 %endif
 %files help
-%doc README doc/develop/distro.rst doc/README.gpt
+%doc README doc/README.kwbimage doc/README.distro doc/README.gpt
-%doc doc/develop/uefi doc/usage doc/arch/arm64.rst
+%doc doc/README.odroid doc/README.rockchip doc/uImage.FIT
 %doc builds/docs/* doc/arch/arm64.rst
 %doc doc/board/amlogic/ doc/board/rockchip/
 %{_mandir}/man1/mkimage.1*
 %changelog
 * Wed Feb 19 2025 lingsheng <lingsheng1@h-partners.com> - 2024.01-2
 - fix CVE-2024-57254 CVE-2024-57255 CVE-2024-57256 CVE-2024-57257 CVE-2024-57258 CVE-2024-57259
 * Thu Feb 29 2024 xingwei <xingwei14@h-partners.com> - 2024.01-1
 - Type:requirement
 - ID:NA
 - SUG:NA
 - update to 2024.01
 * Wed Sep 28 2022 zhouwenpei <zhouwenpei1@h-partners.com> - 2021.10-7
 - fix CVE-2022-30767
 * Wed Jul 20 2022 cenhuilin <cenhuilin@kylinos.cn> - 2021.10-6
 - fix CVE-2022-33967
 * Tue Jul 12 2022 zhouwenpei <zhouwenpei1@h-partners.com> - 2021.10-5
 - fix CVE-2022-34835
 * Wed May 11 2022 liuyumeng <liuyumeng5@h-partners.com> - 2021.10-4
 - fix license error