poky: subtree update:c8075ed8f1..7d0988966c
Adrian (1):
weston-init: Set $HOME variable for SysVinit manager
Alejandro Hernandez Samaniego (6):
bitbake: bitbake: Add Azure Storage fetcher implementation
bitbake: docs: Add Az fetcher documentation
bitbake: docs: Add AZ_SAS definition to glossary
ref-manual: Add Az fetcher documentation
sanity.bbclass: Add az fetcher to accepted URI protocols for mirrors sanity
devtool: Fix do_kernel_configme task
Alexander Kanavin (23):
core-image.bbclass: add a weston IMAGE_FEATURE, similar to x11-base
rootfs-postcommands: correctly set systemd target for weston images
oeqa/weston: correctly run wayland-info when systemd is in use
dnf: upgrade 4.5.2 -> 4.6.0
libdnf: update 0.55.2 -> 0.58.0
libdnf: replace a musl fix with a better one
librepo: update 1.12.1 -> 1.13.0
libical: update 3.0.8 -> 3.0.9
libical: drop the ad hoc native generator build
bmap-tools: upgrade 3.5 -> 3.6
procps: update 3.3.16 -> 3.3.17
libxcrypt: fix sporadic failures in nativesdk-libxcrypt-compat
bind: upgrade 9.16.11 -> 9.16.12
spirv-headers: update to latest revision
spirv-tools: upgrade 2020.6 -> 2020.7
mesa: update 20.3.4 -> 21.0.0
attr: update 2.4.48 -> 2.5.1
asciidoc: update 9.0.4 -> 9.1.0
libhandy: update 1.0.3 -> 1.2.0
strace: update 5.10 -> 5.11
automake: update 1.16.2 - > 1.16.3
xxhash: import from meta-oe
apt: update 1.8.2.2 -> 2.2.2
Alistair Francis (4):
openssl: Enable building for RISC-V 32-bit
linux-yocto: Add qemuriscv32 as a compatible machine
machine: Initial commit of qemuriscv32
u-boot: Add support for building for qemuriscv32
Andrei Gherzan (3):
gcr: Add support for building without x11
epiphany: Add package configuration for building in developer mode
glibc: Backport patch to fix _SC_LEVEL1_ICACHE_LINESIZE
Anton D. Kachalov (1):
run-postinsts: do not remove postinsts directory.
Awais Belal (2):
libsdl2: disable shared memory for native builds
rootfs.py: uninstall the run-postinsts package if not needed
Bartosz Golaszewski (1):
python3: make pydoc rdepend on python3-io
Bruce Ashfield (27):
linux-yocto/5.10: fix x86 32bit boot warnings
linux-yocto/5.10: fix qemumips testimage failures
linux-yocto/5.10: update to v5.10.17 and -rt31
linux-yocto/5.4: update to v5.4.99
linux-yocto/5.10: update to v5.10.19
linux-yocto/5.4: update to v5.4.101
perf: fix reproducibility issues
linux-yocto/5.4: update to v5.4.103
kern-tools: symbol-why fix and README update
linux-yocto/5.10: update to v5.10.21
linux-yocto/qemuarmv5: fix configuration warning
yocto-bsp: update reference platforms to latest 5.10
perf: reproducibility fixes for pmu-events.c
reproducibile: remove perf from exclusions
linux-yocto/5.10: fix SERIAL_OF_PLATFORM warning
linux-yocto/5.4: update to v5.4.105
linux-yocto/5.10: update to v5.10.23
linux-yocto/5.10: cfg: features/numa: Remove NODES_SPAN_OTHER_NODES option
lttng-modules: update devupstream to 2.12.5+
lttng-modules: backport patches to fix build against 5.12+ kernel
kernel-devsrc: fix on-target scripts/prepare for v5.12+
linux-yocto/5.10: cfg: fix ppc64 configuration warnings
linux-yocto-dev: bump to v5.12-rc
linux-yocto/5.10: update qemuriscv32 v5.10.23
linux-yocto/5.10: update to v5.10.25
linux-yocto/5.4: update to v5.4.107
linux-yocto-rt/5.10: update to -rt34
Changqing Li (1):
go-helloworld: disable module-aware mode
Charlie Davies (9):
bitbake-bblayers/create: Fix incorrect priority help message
bitbake-bblayers/create: Add optional layerid argument
bitbake: bitbake: providers: remove unneeded logging call
bitbake: bitbake: providers: consistent single line formatting between functions
bitbake: bitbake: providers: introduce logic for REQUIRED_VERSION variable
bitbake: bitbake: providers: check for REQUIRED_VERSION in _filterProviders
bitbake: bitbake: lib: add Required Version to Bitbake --show-versions command
bitbake: bitbake: cooker: Add REQUIRED_VERSION checks
multilib_global: handle REQUIRED_VERSION
Chen Qi (3):
python3-jinja2: set CVE_PRODUCT
bitbake: event.py: fix regression about INVALIDCONF
populate_sdk_ext: record METADATA_REVISION
Christopher Larson (2):
buildhistory: add missing vardepsexcludes
image,populate_sdk_base: move 'func' flag setting for sdk command vars
Diego Santa Cruz (2):
rpm: split build and extra functionality into separate packages
sstate-diff-machines.sh: support rpm, deb and tar package types in analysis
Dorinda (8):
meta/recipes-rt: Add HOMEPAGE / DESCRIPTION
meta-skeleton: Add HOMEPAGE / DESCRIPTION
meta/recipes-extended: Add HOMEPAGE / DESCRIPTION
meta/recipes-support: Add HOMEPAGE / DESCRIPTION
meta/recipes-kernel: Add HOMEPAGE / DESCRIPTION
meta/recipes-multimedia: Add HOMEPAGE / DESCRIPTION
meta/recipes-graphics: Add HOMEPAGE / DESCRIPTION
dev-manual/common-task.rst: Added documentation for debuginfod support
Dorinda Bassey (4):
meta/recipes-devtools: Add HOMEPAGE / DESCRIPTION
distrodata.py: Test to track recipes without HOMEPAGE or DESCRIPTION
meta-selftest: Add HOMEPAGE / DESCRIPTION
devshell.bbclass: Exceptions displayed within devpyshell
Douglas Royds (2):
cmake: Fully-qualified path to ar
externalsrc: Detect code changes in submodules
Jon Mason (5):
runqemu: use "raw" instead of "bin" for ovmf
runqemu: add QB_GRAPHICS
runqemu: correct forcing of ttyS0
runqemu: modify novga to conform to documentation
tune-cortexa32: Add hard FPU
Jose Quaresma (4):
spirv-tools: python3 is need not only for the tests
spirv-tools: cleanup an old patch that is not used anymore
gstreamer1.0: upgrade 1.18.3 -> 1.18.4
gstreamer1.0-plugins-good: fix rtpjitterbuffer regression
Kai Kang (2):
toolchain-scripts.bbclass: customize prompt string for SDKs
local.conf.sample.extended: sample value for SDK_PS1
Kevin Hao (1):
meta-yocto-bsp: beaglebone: Set a fixed size for boot partition in WIC image
Khairul Rohaizzat Jamaluddin (1):
glibc: Fix CVE-2021-27645
Khem Raj (33):
python3-cython: Check for files before editing
webkitgtk: Use linker options to reduce memory overhead during linking
webkitgtk: Enhance check for atomics to include 1 byte CAS
qemuppc64: Add a QEMU machine definition for ppc64
linux-yocto: Enable powerpc64le QEMU
formfactor: Add machine config for qemuppc64
inittab: Add getty launch on hvc0 for qemuppc64
parselogs: Allow expected kernel messages for qemuppc64
spirv-tools: Replace strncpy with memcpy
python3-setuptools: Upgrade 54.1.0 -> 54.1.1
perf: Remove libunwind for rv32
Enable qemu usermode on ppc64
cmake.bbclass: Create cmake arch mapping for ppc64le
libucontext: Recognize ppc64le architecture
libunwind: Do not assume libdir for ppc64
gcc: Package new module mapper tool
glib-2.0: Drop volatile qualifier
go: Update to 1.16.2
go-dep: Remove
libunwind: Link with libucontext on musl
libedit: upgrade 20191231-3.1 -> 20210216-3.1
webkitgtk: Reduce stack and heap sizes for jsc on musl
webkitgtk: Add packageconfig to chose between size and speed
webkitgtk: enable strlen and stpcpy on musl/linux too
gcc-sanitizers: Package up hwasan files
apt: Support old resolver as fallback
apt: Do not disable NLS
valgrind: Fix ptests on ppc64 LE
documentation-audit.sh: Fix typo in specifying LICENSE_FLAGS_WHITELIST
image-uefi: Set efi_file for rv32/rv64
grub2: Disable for RISCV32
grub-efi: Re-introduce lost cast to long
grub2: Enable on riscv32
Lee Chee Yang (2):
cve-update-db-native: consider version suffix when update CVE db
cve-check: CVE_VERSION_SUFFIX to work with patched release
Li Wang (1):
linux-dummy: add empty dependent packages
Luca Boccassi (2):
util-linux: split uuid in separate recipe to allow bootstrapping
util-linux: backport patch to skip build of unused objects
Manuel Leonhardt (1):
bitbake: tinfoil: Honor quiet when parsing recipes
Mark Hatle (2):
populate_sdk_ext: Avoid copying and producing .pyc files
populate_sdk_ext: Add support for PR service
Martin Jansa (7):
glib-2.0: call os.path.normpath on THISDIR
glib-2.0: show an error about --cross-file only when such file exists
busybox: refresh the defconfig from 1.33.0
busybox-inittab: rename for PV to match with busybox's PV
iso-codes: fix protocol in SRC_URI
packagegroup-core-weston.bb: add pam to REQUIRED_DISTRO_FEATURES
python3: fix PACKAGECONFIG handling
Michael Opdenacker (4):
bitbake: doc: Update links to documentation
Do not assume working from $HOME
Update documentation URL
documentation/README minor improvements
Michael Trensch (1):
linux-firmware: Fix packaging
Mikko Rapeli (1):
openssl: update to 1.1.1k to fix CVE-2021-3450 and CVE-2021-3449
Ming Liu (2):
kernel-fitimage.bbclass: support both KERNEL_DEVICETREE/EXTERNAL_KERNEL_DEVICETREE
initramfs-framework:rootfs: fix some conditional check
Mingli Yu (1):
libtool: make sure autoheader run before autoconf
Minjae Kim (3):
qemu: fix CVE-2021-20203
git: fix CVE-2021-21300
git: upgrade 2.30.1 -> 2.31.1
Naveen Saini (1):
grub: upgrade 2.04 -> 2.06~rc1
Oleksandr Kravchuk (1):
python3-setuptools: update to 54.1.0
Paul Gortmaker (1):
bitbake: gitignore: ignore runqueue-tests/bitbake-cookerdaemon.log
Peter Kjellerstedt (4):
meson: Correctly set uid/gid of installed files
uninative-tarball: Add a dependency on nativesdk-glibc-dbg
metadata_scm.bbclass: Use immediate expansion for the METADATA_* variables
license.bbclass: Improve parsing time when INCOMPATIBLE_LICENSES is big
Petr Vorel (1):
scripts/verify-bashisms: Update checkbashisms.pl URL
Purushottam Choudhary (1):
shadow: whitelist CVE-2013-4235
Randy MacLeod (2):
ffmpeg: upgrade 4.3.1 -> 4.3.2
zstd: upgrade 1.4.8 -> 1.4.9
Richard Purdie (33):
ltp: Fix another determinism issue
build-appliance-image: Drop kernel module handling
ltp: Further extend reproducibility patch
bitbake: runqueue: Fix task execution corruption issue
bitbake: runqueue: Add setscene task overlap sanity check
bitbake: __init__.py: Fix bitbake debug log handling
ltp: Fix determinism issue
ltp: Fix libswapon issue properly
bitbake: event: Fix multiconfig event handler change performance regressions
bitbake: event: Fix another 'if d' test to test for None explictly
bitbake: tests/color: Fix event register to pass the datastore
bitbake: bblayers/query: Update to handle REQUIRED_VERSION
scripts/contrib/list-packageconfig-flags: Upate for tinfoil API changes
layer.conf: Update for hardknott release series
layer.conf: Update for hardknott release series
build-appliance-image: Update to master head revision
layer.conf: Add gatesgarth back for now to allow for transition
build-appliance-image: Update to master head revision
meson: Work around determinism issue
lttng-tools: upgrade 2.12.2 -> 2.12.3
lttng-modules: upgrade 2.12.4 -> 2.12.5
sqlite3: upgrade 3.34.1 -> 3.35.0
sudo: upgrade 1.9.5p2 -> 1.9.6
selftest/reproducible: Drop ovmf exclusion
selftest/wic: Fix dependency issue in rawcopy test
layer.conf: Drop gatesgarth from the layer series names
bitbake: build: Add find_stale_stamps function
bitbake: runqueue/event: Add an event for notifying of stale setscene tasks
sstate: Remove stale objects before the main build
sstate: Add documentation for eventhandlers and tweak naming
site/elfutils/libunistring: Drop patching for iconv and set in site file
build-appliance-image: Update to master head revision
util-linux-libuuid: Simplify recipe and rename from util-linux-uuid
Robert P. J. Day (8):
bitbake-whatchanged: change ending quote to proper period
bitbake: doc: move BBFILES_DYNAMIC for alphabetical order
ref-manual: remove erroneous '\*' from variables list
bitbake: doc: mention that addtask handles multiple dependencies
bitbake: doc: fix glossary link for BB_INVALIDCONF variable
bitbake: doc: fix syntax error in layer.conf example
bitbake.conf: correct description of HOSTTOOLS_DIR
packagegroups: delete useless "PROVIDES" lines
Robert Yang (1):
image.bbclass: deltask do_packagedata
Ross Burton (13):
libinput: less parallism to increase chances the test suite works
ptest-packagelists: remove libinput-ptest
insane: don't check for a warning string that is never output
gcc: add an option for --enable-poison-system-directories to be fatal
gcc-cross: make use of the system include directories fatal
oeqa/selftest: add test to verify that poisoned sysroots are detected
ovmf: make output binaries reproducible
base: respect downloadfilename when sniffing the SRC_URI for dependencies
lib/oe/utils: add directory size function
classes/image: use oe.utils.directory_size() instead of du
bitbake.conf: ensure BUILD_* tools match target tools
meson: fix native/host confusion in gobject-introspection
meson: use native-file instead of environment variables
Sakib Sajal (2):
buildstats.bbclass: improve timeout handling
scripts: add oe-time-dd-test.sh
Scott Murray (1):
u-boot: Fix CVE-2021-27097, CVE-2021-27138
Stefan Ghinea (1):
wpa-supplicant: fix CVE-2021-27803
Stefan Schmidt (1):
systemd-conf: do not ask for DHCP if configured on kernel command line
Tomasz Dziendzielski (2):
bitbake: runqueue: Print pseudo.log if fakeroot task failed
bitbake: codeparser: Fix TypeError in bitbake debug mode
Ulrich ?lmann (1):
gstreamer1.0: add support for coretracers
Ulrich Ölmann (3):
common-tasks.rst: fix 'wic cp' command
common-tasks.rst: fix typo
local.conf.sample: fix typo
Vivien Didelot (6):
systemd-container: sort RRECOMMENDS alphabetically
systemd-container: recommend tar
systemd-container: recommends StartExecPre modules
poky: fix typos
poky: don't use space with +=
beaglebone-yocto: allow other virtual/bootloader
Wang Mingyu (20):
shaderc: upgrade 2020.4 -> 2020.5
stress-ng: upgrade 0.12.03 -> 0.12.04
taglib: upgrade 1.11.1 -> 1.12
vala: upgrade 0.50.3 -> 0.50.4
python3-pygments: upgrade 2.8.0 -> 2.8.1
python3-zipp: upgrade 3.4.0 -> 3.4.1
sysklogd: upgrade 2.2.1 -> 2.2.2
help2man: upgrade 1.48.1 -> 1.48.2
iso-codes: upgrade 4.5.0 -> 4.6.0
jquery: upgrade 3.5.1 -> 3.6.0
ovmf: upgrade 202011 -> 202102
msmtp: upgrade 1.8.14 -> 1.8.15
gptfdisk: upgrade 1.0.6 -> 1.0.7
vulkan-headers: upgrade 1.2.162.0 -> 1.2.170.0
vulkan-loader: upgrade 1.2.162.0 -> 1.2.170.0
vulkan-tools: upgrade 1.2.162.1 -> 1.2.170.0
gcc: Update patch to only patch files once
openssh: upgrade 8.4p1 -> 8.5p1
openssh: Improve LICENSE to show BSD license variants.
gnutls: upgrade 3.7.0 -> 3.7.1
Yanfei Xu (1):
glibc: fix pthread_cond_destroy hangs with process-shared mutex
Yann Dirson (1):
ffmpeg: disable GPL features by default
Yi Fan Yu (1):
valgrind: Fix nlcontrolc.vgtest
jan (1):
cve-update-db-native: Allow to overrule the URL in a bbappend.
wangmy@fujitsu.com (1):
systemd: upgrade 247.3 -> 247.4
zhengruoqin (3):
sudo: upgrade 1.9.6 -> 1.9.6p1
liburi-perl: upgrade 1.74 -> 5.08
stress-ng: upgrade 0.12.04 -> 0.12.05
Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: I04195d4c610ca1674dd736eceeb6442d974cb711
diff --git a/poky/meta/recipes-bsp/u-boot/files/0001-add-valid-fdt-check.patch b/poky/meta/recipes-bsp/u-boot/files/0001-add-valid-fdt-check.patch
new file mode 100644
index 0000000..d4ac9e2
--- /dev/null
+++ b/poky/meta/recipes-bsp/u-boot/files/0001-add-valid-fdt-check.patch
@@ -0,0 +1,36 @@
+From ea1a9ec5f430359720d9a0621ed1acfbba6a142a Mon Sep 17 00:00:00 2001
+From: Heinrich Schuchardt <xypron.glpk@gmx.de>
+Date: Wed, 13 Jan 2021 02:09:12 +0100
+Subject: [PATCH] image-fit: fit_check_format check for valid FDT
+
+fit_check_format() must check that the buffer contains a flattened device
+tree before calling any device tree library functions.
+
+Failure to do may cause segmentation faults.
+
+Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
+
+Upstream-Status: Backport[https://github.com/u-boot/u-boot/commit/ea1a9ec5f430359720d9a0621ed1acfbba6a142a]
+Signed-off-by: Scott Murray <scott.murray@konsulko.com>
+
+---
+ common/image-fit.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/common/image-fit.c b/common/image-fit.c
+index 6a8787ca0a..21c44bdf69 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -1553,6 +1553,12 @@ int fit_image_check_comp(const void *fit, int noffset, uint8_t comp)
+ */
+ int fit_check_format(const void *fit)
+ {
++ /* A FIT image must be a valid FDT */
++ if (fdt_check_header(fit)) {
++ debug("Wrong FIT format: not a flattened device tree\n");
++ return 0;
++ }
++
+ /* mandatory / node 'description' property */
+ if (fdt_getprop(fit, 0, FIT_DESC_PROP, NULL) == NULL) {
+ debug("Wrong FIT format: no description\n");
diff --git a/poky/meta/recipes-bsp/u-boot/files/0001-riscv32-Use-double-float-ABI-for-rv32.patch b/poky/meta/recipes-bsp/u-boot/files/0001-riscv32-Use-double-float-ABI-for-rv32.patch
new file mode 100644
index 0000000..0ed3de4
--- /dev/null
+++ b/poky/meta/recipes-bsp/u-boot/files/0001-riscv32-Use-double-float-ABI-for-rv32.patch
@@ -0,0 +1,42 @@
+From 66dfe0fa886f6289add06d1af8642ce2b5302852 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Tue, 9 Feb 2021 16:40:12 -0800
+Subject: [PATCH] riscv32: Use double-float ABI for rv32
+
+So it can use libgcc built with OE toolchain
+Fixes
+error: "can't link hard-float modules with soft-float modules"
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+Upstream-Status: Inappropriate [embedded specific]
+---
+ arch/riscv/Makefile | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
+index 0b80eb8d86..7324946f48 100644
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -9,7 +9,9 @@ ifeq ($(CONFIG_ARCH_RV64I),y)
+ endif
+ ifeq ($(CONFIG_ARCH_RV32I),y)
+ ARCH_BASE = rv32im
+- ABI = ilp32
++ ABI = ilp32d
++ ARCH_D = d
++ ARCH_F = f
+ endif
+ ifeq ($(CONFIG_RISCV_ISA_A),y)
+ ARCH_A = a
+@@ -24,7 +26,7 @@ ifeq ($(CONFIG_CMODEL_MEDANY),y)
+ CMODEL = medany
+ endif
+
+-ARCH_FLAGS = -march=$(ARCH_BASE)$(ARCH_A)$(ARCH_C) -mabi=$(ABI) \
++ARCH_FLAGS = -march=$(ARCH_BASE)$(ARCH_A)$(ARCH_F)$(ARCH_D)$(ARCH_C) -mabi=$(ABI) \
+ -mcmodel=$(CMODEL)
+
+ PLATFORM_CPPFLAGS += $(ARCH_FLAGS)
+--
+2.30.0
+
diff --git a/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27097-1.patch b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27097-1.patch
new file mode 100644
index 0000000..98ec2c7
--- /dev/null
+++ b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27097-1.patch
@@ -0,0 +1,71 @@
+From 8a7d4cf9820ea16fabd25a6379351b4dc291204b Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Mon, 15 Feb 2021 17:08:05 -0700
+Subject: [PATCH] fdt_region: Check for a single root node of the correct name
+
+At present fdt_find_regions() assumes that the FIT is a valid devicetree.
+If the FIT has two root nodes this is currently not detected in this
+function, nor does libfdt's fdt_check_full() notice. Also it is possible
+for the root node to have a name even though it should not.
+
+Add checks for these and return -FDT_ERR_BADSTRUCTURE if a problem is
+detected.
+
+CVE-2021-27097
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Reported-by: Bruce Monroe <bruce.monroe@intel.com>
+Reported-by: Arie Haenel <arie.haenel@intel.com>
+Reported-by: Julien Lenoir <julien.lenoir@intel.com>
+
+CVE: CVE-2021-27097
+Upstream-Status: Backport[https://github.com/u-boot/u-boot/commit/8a7d4cf9820ea16fabd25a6379351b4dc291204b]
+Signed-off-by: Scott Murray <scott.murray@konsulko.com>
+
+---
+ common/fdt_region.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/common/fdt_region.c b/common/fdt_region.c
+index ff12c518e9..e4ef0ca770 100644
+--- a/common/fdt_region.c
++++ b/common/fdt_region.c
+@@ -43,6 +43,7 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
+ int depth = -1;
+ int want = 0;
+ int base = fdt_off_dt_struct(fdt);
++ bool expect_end = false;
+
+ end = path;
+ *end = '\0';
+@@ -59,6 +60,10 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
+ tag = fdt_next_tag(fdt, offset, &nextoffset);
+ stop_at = nextoffset;
+
++ /* If we see two root nodes, something is wrong */
++ if (expect_end && tag != FDT_END)
++ return -FDT_ERR_BADLAYOUT;
++
+ switch (tag) {
+ case FDT_PROP:
+ include = want >= 2;
+@@ -81,6 +86,10 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
+ if (depth == FDT_MAX_DEPTH)
+ return -FDT_ERR_BADSTRUCTURE;
+ name = fdt_get_name(fdt, offset, &len);
++
++ /* The root node must have an empty name */
++ if (!depth && *name)
++ return -FDT_ERR_BADLAYOUT;
+ if (end - path + 2 + len >= path_len)
+ return -FDT_ERR_NOSPACE;
+ if (end != path + 1)
+@@ -108,6 +117,8 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
+ while (end > path && *--end != '/')
+ ;
+ *end = '\0';
++ if (depth == -1)
++ expect_end = true;
+ break;
+
+ case FDT_END:
diff --git a/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27097-2.patch b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27097-2.patch
new file mode 100644
index 0000000..b13c44e
--- /dev/null
+++ b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27097-2.patch
@@ -0,0 +1,419 @@
+From c5819701a3de61e2ba2ef7ad0b616565b32305e5 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Mon, 15 Feb 2021 17:08:09 -0700
+Subject: [PATCH] image: Adjust the workings of fit_check_format()
+
+At present this function does not accept a size for the FIT. This means
+that it must be read from the FIT itself, introducing potential security
+risk. Update the function to include a size parameter, which can be
+invalid, in which case fit_check_format() calculates it.
+
+For now no callers pass the size, but this can be updated later.
+
+Also adjust the return value to an error code so that all the different
+types of problems can be distinguished by the user.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Reported-by: Bruce Monroe <bruce.monroe@intel.com>
+Reported-by: Arie Haenel <arie.haenel@intel.com>
+Reported-by: Julien Lenoir <julien.lenoir@intel.com>
+
+CVE: CVE-2021-27097 CVE-2021-27138
+Upstream-Status: Backport[https://github.com/u-boot/u-boot/commit/c5819701a3de61e2ba2ef7ad0b616565b32305e5]
+Signed-off-by: Scott Murray <scott.murray@konsulko.com>
+
+---
+ arch/arm/cpu/armv8/sec_firmware.c | 2 +-
+ cmd/bootm.c | 6 ++---
+ cmd/disk.c | 2 +-
+ cmd/fpga.c | 2 +-
+ cmd/nand.c | 2 +-
+ cmd/source.c | 2 +-
+ cmd/ximg.c | 2 +-
+ common/image-fdt.c | 2 +-
+ common/image-fit.c | 46 +++++++++++++++++---------------------
+ common/splash_source.c | 6 ++---
+ common/update.c | 4 ++--
+ drivers/fpga/socfpga_arria10.c | 6 ++---
+ drivers/net/fsl-mc/mc.c | 2 +-
+ drivers/net/pfe_eth/pfe_firmware.c | 2 +-
+ include/image.h | 21 ++++++++++++++++-
+ tools/fit_common.c | 3 ++-
+ tools/fit_image.c | 2 +-
+ tools/mkimage.h | 2 ++
+ 18 files changed, 65 insertions(+), 49 deletions(-)
+
+diff --git a/arch/arm/cpu/armv8/sec_firmware.c b/arch/arm/cpu/armv8/sec_firmware.c
+index bfc0fac3ef..0561f5efd1 100644
+--- a/arch/arm/cpu/armv8/sec_firmware.c
++++ b/arch/arm/cpu/armv8/sec_firmware.c
+@@ -316,7 +316,7 @@ __weak bool sec_firmware_is_valid(const void *sec_firmware_img)
+ return false;
+ }
+
+- if (!fit_check_format(sec_firmware_img)) {
++ if (fit_check_format(sec_firmware_img, IMAGE_SIZE_INVAL)) {
+ printf("SEC Firmware: Bad firmware image (bad FIT header)\n");
+ return false;
+ }
+diff --git a/cmd/bootm.c b/cmd/bootm.c
+index e6b0e04413..a0f823f968 100644
+--- a/cmd/bootm.c
++++ b/cmd/bootm.c
+@@ -291,7 +291,7 @@ static int image_info(ulong addr)
+ case IMAGE_FORMAT_FIT:
+ puts(" FIT image found\n");
+
+- if (!fit_check_format(hdr)) {
++ if (fit_check_format(hdr, IMAGE_SIZE_INVAL)) {
+ puts("Bad FIT image format!\n");
+ unmap_sysmem(hdr);
+ return 1;
+@@ -368,7 +368,7 @@ static int do_imls_nor(void)
+ #endif
+ #if defined(CONFIG_FIT)
+ case IMAGE_FORMAT_FIT:
+- if (!fit_check_format(hdr))
++ if (fit_check_format(hdr, IMAGE_SIZE_INVAL))
+ goto next_sector;
+
+ printf("FIT Image at %08lX:\n", (ulong)hdr);
+@@ -448,7 +448,7 @@ static int nand_imls_fitimage(struct mtd_info *mtd, int nand_dev, loff_t off,
+ return ret;
+ }
+
+- if (!fit_check_format(imgdata)) {
++ if (fit_check_format(imgdata, IMAGE_SIZE_INVAL)) {
+ free(imgdata);
+ return 0;
+ }
+diff --git a/cmd/disk.c b/cmd/disk.c
+index 8060e753eb..3195db9127 100644
+--- a/cmd/disk.c
++++ b/cmd/disk.c
+@@ -114,7 +114,7 @@ int common_diskboot(struct cmd_tbl *cmdtp, const char *intf, int argc,
+ /* This cannot be done earlier,
+ * we need complete FIT image in RAM first */
+ if (genimg_get_format((void *) addr) == IMAGE_FORMAT_FIT) {
+- if (!fit_check_format(fit_hdr)) {
++ if (fit_check_format(fit_hdr, IMAGE_SIZE_INVAL)) {
+ bootstage_error(BOOTSTAGE_ID_IDE_FIT_READ);
+ puts("** Bad FIT image format\n");
+ return 1;
+diff --git a/cmd/fpga.c b/cmd/fpga.c
+index 8ae1c936fb..51410a8e42 100644
+--- a/cmd/fpga.c
++++ b/cmd/fpga.c
+@@ -330,7 +330,7 @@ static int do_fpga_loadmk(struct cmd_tbl *cmdtp, int flag, int argc,
+ return CMD_RET_FAILURE;
+ }
+
+- if (!fit_check_format(fit_hdr)) {
++ if (fit_check_format(fit_hdr, IMAGE_SIZE_INVAL)) {
+ puts("Bad FIT image format\n");
+ return CMD_RET_FAILURE;
+ }
+diff --git a/cmd/nand.c b/cmd/nand.c
+index 92d039af8f..97e117a979 100644
+--- a/cmd/nand.c
++++ b/cmd/nand.c
+@@ -917,7 +917,7 @@ static int nand_load_image(struct cmd_tbl *cmdtp, struct mtd_info *mtd,
+ #if defined(CONFIG_FIT)
+ /* This cannot be done earlier, we need complete FIT image in RAM first */
+ if (genimg_get_format ((void *)addr) == IMAGE_FORMAT_FIT) {
+- if (!fit_check_format (fit_hdr)) {
++ if (fit_check_format(fit_hdr, IMAGE_SIZE_INVAL)) {
+ bootstage_error(BOOTSTAGE_ID_NAND_FIT_READ);
+ puts ("** Bad FIT image format\n");
+ return 1;
+diff --git a/cmd/source.c b/cmd/source.c
+index b6c709a3d2..71f71528ad 100644
+--- a/cmd/source.c
++++ b/cmd/source.c
+@@ -107,7 +107,7 @@ int image_source_script(ulong addr, const char *fit_uname)
+ #if defined(CONFIG_FIT)
+ case IMAGE_FORMAT_FIT:
+ fit_hdr = buf;
+- if (!fit_check_format (fit_hdr)) {
++ if (fit_check_format(fit_hdr, IMAGE_SIZE_INVAL)) {
+ puts ("Bad FIT image format\n");
+ return 1;
+ }
+diff --git a/cmd/ximg.c b/cmd/ximg.c
+index 159ba51648..ef738ebfa2 100644
+--- a/cmd/ximg.c
++++ b/cmd/ximg.c
+@@ -136,7 +136,7 @@ do_imgextract(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[])
+ "at %08lx ...\n", uname, addr);
+
+ fit_hdr = (const void *)addr;
+- if (!fit_check_format(fit_hdr)) {
++ if (fit_check_format(fit_hdr, IMAGE_SIZE_INVAL)) {
+ puts("Bad FIT image format\n");
+ return 1;
+ }
+diff --git a/common/image-fdt.c b/common/image-fdt.c
+index 327a8c4c39..4105259212 100644
+--- a/common/image-fdt.c
++++ b/common/image-fdt.c
+@@ -399,7 +399,7 @@ int boot_get_fdt(int flag, int argc, char *const argv[], uint8_t arch,
+ */
+ #if CONFIG_IS_ENABLED(FIT)
+ /* check FDT blob vs FIT blob */
+- if (fit_check_format(buf)) {
++ if (!fit_check_format(buf, IMAGE_SIZE_INVAL)) {
+ ulong load, len;
+
+ fdt_noffset = boot_get_fdt_fit(images,
+diff --git a/common/image-fit.c b/common/image-fit.c
+index 9637d747fb..402f08fc9d 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -8,6 +8,8 @@
+ * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
+ */
+
++#define LOG_CATEGORY LOGC_BOOT
++
+ #ifdef USE_HOSTCC
+ #include "mkimage.h"
+ #include <time.h>
+@@ -1550,49 +1552,41 @@ int fit_image_check_comp(const void *fit, int noffset, uint8_t comp)
+ return (comp == image_comp);
+ }
+
+-/**
+- * fit_check_format - sanity check FIT image format
+- * @fit: pointer to the FIT format image header
+- *
+- * fit_check_format() runs a basic sanity FIT image verification.
+- * Routine checks for mandatory properties, nodes, etc.
+- *
+- * returns:
+- * 1, on success
+- * 0, on failure
+- */
+-int fit_check_format(const void *fit)
++int fit_check_format(const void *fit, ulong size)
+ {
++ int ret;
++
+ /* A FIT image must be a valid FDT */
+- if (fdt_check_header(fit)) {
+- debug("Wrong FIT format: not a flattened device tree\n");
+- return 0;
++ ret = fdt_check_header(fit);
++ if (ret) {
++ log_debug("Wrong FIT format: not a flattened device tree (err=%d)\n",
++ ret);
++ return -ENOEXEC;
+ }
+
+ /* mandatory / node 'description' property */
+- if (fdt_getprop(fit, 0, FIT_DESC_PROP, NULL) == NULL) {
+- debug("Wrong FIT format: no description\n");
+- return 0;
++ if (!fdt_getprop(fit, 0, FIT_DESC_PROP, NULL)) {
++ log_debug("Wrong FIT format: no description\n");
++ return -ENOMSG;
+ }
+
+ if (IMAGE_ENABLE_TIMESTAMP) {
+ /* mandatory / node 'timestamp' property */
+- if (fdt_getprop(fit, 0, FIT_TIMESTAMP_PROP, NULL) == NULL) {
+- debug("Wrong FIT format: no timestamp\n");
+- return 0;
++ if (!fdt_getprop(fit, 0, FIT_TIMESTAMP_PROP, NULL)) {
++ log_debug("Wrong FIT format: no timestamp\n");
++ return -ENODATA;
+ }
+ }
+
+ /* mandatory subimages parent '/images' node */
+ if (fdt_path_offset(fit, FIT_IMAGES_PATH) < 0) {
+- debug("Wrong FIT format: no images parent node\n");
+- return 0;
++ log_debug("Wrong FIT format: no images parent node\n");
++ return -ENOENT;
+ }
+
+- return 1;
++ return 0;
+ }
+
+-
+ /**
+ * fit_conf_find_compat
+ * @fit: pointer to the FIT format image header
+@@ -1929,7 +1923,7 @@ int fit_image_load(bootm_headers_t *images, ulong addr,
+ printf("## Loading %s from FIT Image at %08lx ...\n", prop_name, addr);
+
+ bootstage_mark(bootstage_id + BOOTSTAGE_SUB_FORMAT);
+- if (!fit_check_format(fit)) {
++ if (fit_check_format(fit, IMAGE_SIZE_INVAL)) {
+ printf("Bad FIT %s image format!\n", prop_name);
+ bootstage_error(bootstage_id + BOOTSTAGE_SUB_FORMAT);
+ return -ENOEXEC;
+diff --git a/common/splash_source.c b/common/splash_source.c
+index f51ca5ddf3..bad9a7790a 100644
+--- a/common/splash_source.c
++++ b/common/splash_source.c
+@@ -336,10 +336,10 @@ static int splash_load_fit(struct splash_location *location, u32 bmp_load_addr)
+ if (res < 0)
+ return res;
+
+- res = fit_check_format(fit_header);
+- if (!res) {
++ res = fit_check_format(fit_header, IMAGE_SIZE_INVAL);
++ if (res) {
+ debug("Could not find valid FIT image\n");
+- return -EINVAL;
++ return res;
+ }
+
+ /* Get the splash image node */
+diff --git a/common/update.c b/common/update.c
+index a5879cb52c..f0848954e5 100644
+--- a/common/update.c
++++ b/common/update.c
+@@ -286,7 +286,7 @@ int update_tftp(ulong addr, char *interface, char *devstring)
+ got_update_file:
+ fit = map_sysmem(addr, 0);
+
+- if (!fit_check_format((void *)fit)) {
++ if (fit_check_format((void *)fit, IMAGE_SIZE_INVAL)) {
+ printf("Bad FIT format of the update file, aborting "
+ "auto-update\n");
+ return 1;
+@@ -363,7 +363,7 @@ int fit_update(const void *fit)
+ if (!fit)
+ return -EINVAL;
+
+- if (!fit_check_format((void *)fit)) {
++ if (fit_check_format((void *)fit, IMAGE_SIZE_INVAL)) {
+ printf("Bad FIT format of the update file, aborting auto-update\n");
+ return -EINVAL;
+ }
+diff --git a/drivers/fpga/socfpga_arria10.c b/drivers/fpga/socfpga_arria10.c
+index 44e1ac54c3..18f99676d2 100644
+--- a/drivers/fpga/socfpga_arria10.c
++++ b/drivers/fpga/socfpga_arria10.c
+@@ -565,10 +565,10 @@ static int first_loading_rbf_to_buffer(struct udevice *dev,
+ if (ret < 0)
+ return ret;
+
+- ret = fit_check_format(buffer_p);
+- if (!ret) {
++ ret = fit_check_format(buffer_p, IMAGE_SIZE_INVAL);
++ if (ret) {
+ debug("FPGA: No valid FIT image was found.\n");
+- return -EBADF;
++ return ret;
+ }
+
+ confs_noffset = fdt_path_offset(buffer_p, FIT_CONFS_PATH);
+diff --git a/drivers/net/fsl-mc/mc.c b/drivers/net/fsl-mc/mc.c
+index 84db6be624..81265ee356 100644
+--- a/drivers/net/fsl-mc/mc.c
++++ b/drivers/net/fsl-mc/mc.c
+@@ -141,7 +141,7 @@ int parse_mc_firmware_fit_image(u64 mc_fw_addr,
+ return -EINVAL;
+ }
+
+- if (!fit_check_format(fit_hdr)) {
++ if (fit_check_format(fit_hdr, IMAGE_SIZE_INVAL)) {
+ printf("fsl-mc: ERR: Bad firmware image (bad FIT header)\n");
+ return -EINVAL;
+ }
+diff --git a/drivers/net/pfe_eth/pfe_firmware.c b/drivers/net/pfe_eth/pfe_firmware.c
+index 41999e176d..eee70a2e73 100644
+--- a/drivers/net/pfe_eth/pfe_firmware.c
++++ b/drivers/net/pfe_eth/pfe_firmware.c
+@@ -160,7 +160,7 @@ static int pfe_fit_check(void)
+ return ret;
+ }
+
+- if (!fit_check_format(pfe_fit_addr)) {
++ if (fit_check_format(pfe_fit_addr, IMAGE_SIZE_INVAL)) {
+ printf("PFE Firmware: Bad firmware image (bad FIT header)\n");
+ ret = -1;
+ return ret;
+diff --git a/include/image.h b/include/image.h
+index 41473dbb9c..8c152c5c5f 100644
+--- a/include/image.h
++++ b/include/image.h
+@@ -134,6 +134,9 @@ extern ulong image_load_addr; /* Default Load Address */
+ extern ulong image_save_addr; /* Default Save Address */
+ extern ulong image_save_size; /* Default Save Size */
+
++/* An invalid size, meaning that the image size is not known */
++#define IMAGE_SIZE_INVAL (-1UL)
++
+ enum ih_category {
+ IH_ARCH,
+ IH_COMP,
+@@ -1141,7 +1144,23 @@ int fit_image_check_os(const void *fit, int noffset, uint8_t os);
+ int fit_image_check_arch(const void *fit, int noffset, uint8_t arch);
+ int fit_image_check_type(const void *fit, int noffset, uint8_t type);
+ int fit_image_check_comp(const void *fit, int noffset, uint8_t comp);
+-int fit_check_format(const void *fit);
++
++/**
++ * fit_check_format() - Check that the FIT is valid
++ *
++ * This performs various checks on the FIT to make sure it is suitable for
++ * use, looking for mandatory properties, nodes, etc.
++ *
++ * If FIT_FULL_CHECK is enabled, it also runs it through libfdt to make
++ * sure that there are no strange tags or broken nodes in the FIT.
++ *
++ * @fit: pointer to the FIT format image header
++ * @return 0 if OK, -ENOEXEC if not an FDT file, -EINVAL if the full FDT check
++ * failed (e.g. due to bad structure), -ENOMSG if the description is
++ * missing, -ENODATA if the timestamp is missing, -ENOENT if the /images
++ * path is missing
++ */
++int fit_check_format(const void *fit, ulong size);
+
+ int fit_conf_find_compat(const void *fit, const void *fdt);
+
+diff --git a/tools/fit_common.c b/tools/fit_common.c
+index cdf987d3c1..52b63296f8 100644
+--- a/tools/fit_common.c
++++ b/tools/fit_common.c
+@@ -26,7 +26,8 @@
+ int fit_verify_header(unsigned char *ptr, int image_size,
+ struct image_tool_params *params)
+ {
+- if (fdt_check_header(ptr) != EXIT_SUCCESS || !fit_check_format(ptr))
++ if (fdt_check_header(ptr) != EXIT_SUCCESS ||
++ fit_check_format(ptr, IMAGE_SIZE_INVAL))
+ return EXIT_FAILURE;
+
+ return EXIT_SUCCESS;
+diff --git a/tools/fit_image.c b/tools/fit_image.c
+index 06faeda7c2..d440d143c6 100644
+--- a/tools/fit_image.c
++++ b/tools/fit_image.c
+@@ -883,7 +883,7 @@ static int fit_extract_contents(void *ptr, struct image_tool_params *params)
+ /* Indent string is defined in header image.h */
+ p = IMAGE_INDENT_STRING;
+
+- if (!fit_check_format(fit)) {
++ if (fit_check_format(fit, IMAGE_SIZE_INVAL)) {
+ printf("Bad FIT image format\n");
+ return -1;
+ }
+diff --git a/tools/mkimage.h b/tools/mkimage.h
+index 5b096a545b..0d3148444c 100644
+--- a/tools/mkimage.h
++++ b/tools/mkimage.h
+@@ -29,6 +29,8 @@
+ #define debug(fmt,args...)
+ #endif /* MKIMAGE_DEBUG */
+
++#define log_debug(fmt, args...) debug(fmt, ##args)
++
+ static inline void *map_sysmem(ulong paddr, unsigned long len)
+ {
+ return (void *)(uintptr_t)paddr;
diff --git a/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27097-3.patch b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27097-3.patch
new file mode 100644
index 0000000..86f7e8c
--- /dev/null
+++ b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27097-3.patch
@@ -0,0 +1,105 @@
+From 6f3c2d8aa5e6cbd80b5e869bbbddecb66c329d01 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Mon, 15 Feb 2021 17:08:10 -0700
+Subject: [PATCH] image: Add an option to do a full check of the FIT
+
+Some strange modifications of the FIT can introduce security risks. Add an
+option to check it thoroughly, using libfdt's fdt_check_full() function.
+
+Enable this by default if signature verification is enabled.
+
+CVE-2021-27097
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Reported-by: Bruce Monroe <bruce.monroe@intel.com>
+Reported-by: Arie Haenel <arie.haenel@intel.com>
+Reported-by: Julien Lenoir <julien.lenoir@intel.com>
+
+CVE: CVE-2021-27097
+Upstream-Status: Backport[https://github.com/u-boot/u-boot/commit/6f3c2d8aa5e6cbd80b5e869bbbddecb66c329d01]
+Signed-off-by: Scott Murray <scott.murray@konsulko.com>
+
+---
+ common/Kconfig.boot | 20 ++++++++++++++++++++
+ common/image-fit.c | 16 ++++++++++++++++
+ 2 files changed, 36 insertions(+)
+
+diff --git a/common/Kconfig.boot b/common/Kconfig.boot
+index 5eaabdfc27..7532e55edb 100644
+--- a/common/Kconfig.boot
++++ b/common/Kconfig.boot
+@@ -63,6 +63,15 @@ config FIT_ENABLE_SHA512_SUPPORT
+ SHA512 checksum is a 512-bit (64-byte) hash value used to check that
+ the image contents have not been corrupted.
+
++config FIT_FULL_CHECK
++ bool "Do a full check of the FIT before using it"
++ default y
++ help
++ Enable this do a full check of the FIT to make sure it is valid. This
++ helps to protect against carefully crafted FITs which take advantage
++ of bugs or omissions in the code. This includes a bad structure,
++ multiple root nodes and the like.
++
+ config FIT_SIGNATURE
+ bool "Enable signature verification of FIT uImages"
+ depends on DM
+@@ -70,6 +79,7 @@ config FIT_SIGNATURE
+ select RSA
+ select RSA_VERIFY
+ select IMAGE_SIGN_INFO
++ select FIT_FULL_CHECK
+ help
+ This option enables signature verification of FIT uImages,
+ using a hash signed and verified using RSA. If
+@@ -159,6 +169,15 @@ config SPL_FIT_PRINT
+ help
+ Support printing the content of the fitImage in a verbose manner in SPL.
+
++config SPL_FIT_FULL_CHECK
++ bool "Do a full check of the FIT before using it"
++ help
++ Enable this do a full check of the FIT to make sure it is valid. This
++ helps to protect against carefully crafted FITs which take advantage
++ of bugs or omissions in the code. This includes a bad structure,
++ multiple root nodes and the like.
++
++
+ config SPL_FIT_SIGNATURE
+ bool "Enable signature verification of FIT firmware within SPL"
+ depends on SPL_DM
+@@ -168,6 +187,7 @@ config SPL_FIT_SIGNATURE
+ select SPL_RSA
+ select SPL_RSA_VERIFY
+ select SPL_IMAGE_SIGN_INFO
++ select SPL_FIT_FULL_CHECK
+
+ config SPL_LOAD_FIT
+ bool "Enable SPL loading U-Boot as a FIT (basic fitImage features)"
+diff --git a/common/image-fit.c b/common/image-fit.c
+index f6c0428a96..bcf395f6a1 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -1580,6 +1580,22 @@ int fit_check_format(const void *fit, ulong size)
+ return -ENOEXEC;
+ }
+
++ if (CONFIG_IS_ENABLED(FIT_FULL_CHECK)) {
++ /*
++ * If we are not given the size, make do wtih calculating it.
++ * This is not as secure, so we should consider a flag to
++ * control this.
++ */
++ if (size == IMAGE_SIZE_INVAL)
++ size = fdt_totalsize(fit);
++ ret = fdt_check_full(fit, size);
++
++ if (ret) {
++ log_debug("FIT check error %d\n", ret);
++ return -EINVAL;
++ }
++ }
++
+ /* mandatory / node 'description' property */
+ if (!fdt_getprop(fit, 0, FIT_DESC_PROP, NULL)) {
+ log_debug("Wrong FIT format: no description\n");
diff --git a/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27097-4.patch b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27097-4.patch
new file mode 100644
index 0000000..060cac1
--- /dev/null
+++ b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27097-4.patch
@@ -0,0 +1,73 @@
+From 124c255731c76a2b09587378b2bcce561bcd3f2d Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Mon, 15 Feb 2021 17:08:11 -0700
+Subject: [PATCH] libfdt: Check for multiple/invalid root nodes
+
+It is possible to construct a devicetree blob with multiple root nodes.
+Update fdt_check_full() to check for this, along with a root node with an
+invalid name.
+
+CVE-2021-27097
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Reported-by: Bruce Monroe <bruce.monroe@intel.com>
+Reported-by: Arie Haenel <arie.haenel@intel.com>
+Reported-by: Julien Lenoir <julien.lenoir@intel.com>
+
+CVE: CVE-2021-27097
+Upstream-Status: Backport[https://github.com/u-boot/u-boot/commit/124c255731c76a2b09587378b2bcce561bcd3f2d]
+Signed-off-by: Scott Murray <scott.murray@konsulko.com>
+
+---
+ scripts/dtc/libfdt/fdt_ro.c | 17 +++++++++++++++++
+ test/py/tests/test_vboot.py | 3 ++-
+ 2 files changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/dtc/libfdt/fdt_ro.c b/scripts/dtc/libfdt/fdt_ro.c
+index d984bab036..efe7efe921 100644
+--- a/scripts/dtc/libfdt/fdt_ro.c
++++ b/scripts/dtc/libfdt/fdt_ro.c
+@@ -867,6 +867,7 @@ int fdt_check_full(const void *fdt, size_t bufsize)
+ unsigned depth = 0;
+ const void *prop;
+ const char *propname;
++ bool expect_end = false;
+
+ if (bufsize < FDT_V1_SIZE)
+ return -FDT_ERR_TRUNCATED;
+@@ -887,6 +888,10 @@ int fdt_check_full(const void *fdt, size_t bufsize)
+ if (nextoffset < 0)
+ return nextoffset;
+
++ /* If we see two root nodes, something is wrong */
++ if (expect_end && tag != FDT_END)
++ return -FDT_ERR_BADLAYOUT;
++
+ switch (tag) {
+ case FDT_NOP:
+ break;
+@@ -900,12 +905,24 @@ int fdt_check_full(const void *fdt, size_t bufsize)
+ depth++;
+ if (depth > INT_MAX)
+ return -FDT_ERR_BADSTRUCTURE;
++
++ /* The root node must have an empty name */
++ if (depth == 1) {
++ const char *name;
++ int len;
++
++ name = fdt_get_name(fdt, offset, &len);
++ if (*name || len)
++ return -FDT_ERR_BADLAYOUT;
++ }
+ break;
+
+ case FDT_END_NODE:
+ if (depth == 0)
+ return -FDT_ERR_BADSTRUCTURE;
+ depth--;
++ if (depth == 0)
++ expect_end = true;
+ break;
+
+ case FDT_PROP:
diff --git a/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27138-1.patch b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27138-1.patch
new file mode 100644
index 0000000..562f815
--- /dev/null
+++ b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27138-1.patch
@@ -0,0 +1,245 @@
+From 79af75f7776fc20b0d7eb6afe1e27c00fdb4b9b4 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Mon, 15 Feb 2021 17:08:06 -0700
+Subject: [PATCH] fit: Don't allow verification of images with @ nodes
+
+When searching for a node called 'fred', any unit address appended to the
+name is ignored by libfdt, meaning that 'fred' can match 'fred@1'. This
+means that we cannot be sure that the node originally intended is the one
+that is used.
+
+Disallow use of nodes with unit addresses.
+
+Update the forge test also, since it uses @ addresses.
+
+CVE-2021-27138
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Reported-by: Bruce Monroe <bruce.monroe@intel.com>
+Reported-by: Arie Haenel <arie.haenel@intel.com>
+Reported-by: Julien Lenoir <julien.lenoir@intel.com>
+
+CVE: CVE-2021-27138
+Upstream-Status: Backport[https://github.com/u-boot/u-boot/commit/79af75f7776fc20b0d7eb6afe1e27c00fdb4b9b4]
+Signed-off-by: Scott Murray <scott.murray@konsulko.com>
+
+---
+ common/image-fit-sig.c | 22 ++++++++++++++++++++--
+ common/image-fit.c | 20 +++++++++++++++-----
+ test/py/tests/test_fit.py | 24 ++++++++++++------------
+ test/py/tests/vboot_forge.py | 12 ++++++------
+ 4 files changed, 53 insertions(+), 25 deletions(-)
+
+diff --git a/common/image-fit-sig.c b/common/image-fit-sig.c
+index 897e04c7a3..34ebb8edfe 100644
+--- a/common/image-fit-sig.c
++++ b/common/image-fit-sig.c
+@@ -149,6 +149,14 @@ static int fit_image_verify_sig(const void *fit, int image_noffset,
+ fdt_for_each_subnode(noffset, fit, image_noffset) {
+ const char *name = fit_get_name(fit, noffset, NULL);
+
++ /*
++ * We don't support this since libfdt considers names with the
++ * name root but different @ suffix to be equal
++ */
++ if (strchr(name, '@')) {
++ err_msg = "Node name contains @";
++ goto error;
++ }
+ if (!strncmp(name, FIT_SIG_NODENAME,
+ strlen(FIT_SIG_NODENAME))) {
+ ret = fit_image_check_sig(fit, noffset, data,
+@@ -398,9 +406,10 @@ error:
+ return -EPERM;
+ }
+
+-int fit_config_verify_required_sigs(const void *fit, int conf_noffset,
+- const void *sig_blob)
++static int fit_config_verify_required_sigs(const void *fit, int conf_noffset,
++ const void *sig_blob)
+ {
++ const char *name = fit_get_name(fit, conf_noffset, NULL);
+ int noffset;
+ int sig_node;
+ int verified = 0;
+@@ -408,6 +417,15 @@ int fit_config_verify_required_sigs(const void *fit, int conf_noffset,
+ bool reqd_policy_all = true;
+ const char *reqd_mode;
+
++ /*
++ * We don't support this since libfdt considers names with the
++ * name root but different @ suffix to be equal
++ */
++ if (strchr(name, '@')) {
++ printf("Configuration node '%s' contains '@'\n", name);
++ return -EPERM;
++ }
++
+ /* Work out what we need to verify */
+ sig_node = fdt_subnode_offset(sig_blob, 0, FIT_SIG_NODENAME);
+ if (sig_node < 0) {
+diff --git a/common/image-fit.c b/common/image-fit.c
+index adc3e551de..c3dc814115 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -1369,21 +1369,31 @@ error:
+ */
+ int fit_image_verify(const void *fit, int image_noffset)
+ {
++ const char *name = fit_get_name(fit, image_noffset, NULL);
+ const void *data;
+ size_t size;
+- int noffset = 0;
+ char *err_msg = "";
+
++ if (strchr(name, '@')) {
++ /*
++ * We don't support this since libfdt considers names with the
++ * name root but different @ suffix to be equal
++ */
++ err_msg = "Node name contains @";
++ goto err;
++ }
+ /* Get image data and data length */
+ if (fit_image_get_data_and_size(fit, image_noffset, &data, &size)) {
+ err_msg = "Can't get image data/size";
+- printf("error!\n%s for '%s' hash node in '%s' image node\n",
+- err_msg, fit_get_name(fit, noffset, NULL),
+- fit_get_name(fit, image_noffset, NULL));
+- return 0;
++ goto err;
+ }
+
+ return fit_image_verify_with_data(fit, image_noffset, data, size);
++
++err:
++ printf("error!\n%s in '%s' image node\n", err_msg,
++ fit_get_name(fit, image_noffset, NULL));
++ return 0;
+ }
+
+ /**
+diff --git a/test/py/tests/test_fit.py b/test/py/tests/test_fit.py
+index 84b3f95850..6d5b43c3ba 100755
+--- a/test/py/tests/test_fit.py
++++ b/test/py/tests/test_fit.py
+@@ -17,7 +17,7 @@ base_its = '''
+ #address-cells = <1>;
+
+ images {
+- kernel@1 {
++ kernel-1 {
+ data = /incbin/("%(kernel)s");
+ type = "kernel";
+ arch = "sandbox";
+@@ -26,7 +26,7 @@ base_its = '''
+ load = <0x40000>;
+ entry = <0x8>;
+ };
+- kernel@2 {
++ kernel-2 {
+ data = /incbin/("%(loadables1)s");
+ type = "kernel";
+ arch = "sandbox";
+@@ -35,19 +35,19 @@ base_its = '''
+ %(loadables1_load)s
+ entry = <0x0>;
+ };
+- fdt@1 {
++ fdt-1 {
+ description = "snow";
+ data = /incbin/("%(fdt)s");
+ type = "flat_dt";
+ arch = "sandbox";
+ %(fdt_load)s
+ compression = "%(compression)s";
+- signature@1 {
++ signature-1 {
+ algo = "sha1,rsa2048";
+ key-name-hint = "dev";
+ };
+ };
+- ramdisk@1 {
++ ramdisk-1 {
+ description = "snow";
+ data = /incbin/("%(ramdisk)s");
+ type = "ramdisk";
+@@ -56,7 +56,7 @@ base_its = '''
+ %(ramdisk_load)s
+ compression = "%(compression)s";
+ };
+- ramdisk@2 {
++ ramdisk-2 {
+ description = "snow";
+ data = /incbin/("%(loadables2)s");
+ type = "ramdisk";
+@@ -67,10 +67,10 @@ base_its = '''
+ };
+ };
+ configurations {
+- default = "conf@1";
+- conf@1 {
+- kernel = "kernel@1";
+- fdt = "fdt@1";
++ default = "conf-1";
++ conf-1 {
++ kernel = "kernel-1";
++ fdt = "fdt-1";
+ %(ramdisk_config)s
+ %(loadables_config)s
+ };
+@@ -410,7 +410,7 @@ def test_fit(u_boot_console):
+
+ # Try a ramdisk
+ with cons.log.section('Kernel + FDT + Ramdisk load'):
+- params['ramdisk_config'] = 'ramdisk = "ramdisk@1";'
++ params['ramdisk_config'] = 'ramdisk = "ramdisk-1";'
+ params['ramdisk_load'] = 'load = <%#x>;' % params['ramdisk_addr']
+ fit = make_fit(mkimage, params)
+ cons.restart_uboot()
+@@ -419,7 +419,7 @@ def test_fit(u_boot_console):
+
+ # Configuration with some Loadables
+ with cons.log.section('Kernel + FDT + Ramdisk load + Loadables'):
+- params['loadables_config'] = 'loadables = "kernel@2", "ramdisk@2";'
++ params['loadables_config'] = 'loadables = "kernel-2", "ramdisk-2";'
+ params['loadables1_load'] = ('load = <%#x>;' %
+ params['loadables1_addr'])
+ params['loadables2_load'] = ('load = <%#x>;' %
+diff --git a/test/py/tests/vboot_forge.py b/test/py/tests/vboot_forge.py
+index 0fb7ef4024..b41105bd0e 100644
+--- a/test/py/tests/vboot_forge.py
++++ b/test/py/tests/vboot_forge.py
+@@ -376,12 +376,12 @@ def manipulate(root, strblock):
+ """
+ Maliciously manipulates the structure to create a crafted FIT file
+ """
+- # locate /images/kernel@1 (frankly, it just expects it to be the first one)
++ # locate /images/kernel-1 (frankly, it just expects it to be the first one)
+ kernel_node = root[0][0]
+ # clone it to save time filling all the properties
+ fake_kernel = kernel_node.clone()
+ # rename the node
+- fake_kernel.name = b'kernel@2'
++ fake_kernel.name = b'kernel-2'
+ # get rid of signatures/hashes
+ fake_kernel.children = []
+ # NOTE: this simply replaces the first prop... either description or data
+@@ -391,13 +391,13 @@ def manipulate(root, strblock):
+ root[0].children.append(fake_kernel)
+
+ # modify the default configuration
+- root[1].props[0].value = b'conf@2\x00'
++ root[1].props[0].value = b'conf-2\x00'
+ # clone the first (only?) configuration
+ fake_conf = root[1][0].clone()
+ # rename and change kernel and fdt properties to select the crafted kernel
+- fake_conf.name = b'conf@2'
+- fake_conf.props[0].value = b'kernel@2\x00'
+- fake_conf.props[1].value = b'fdt@1\x00'
++ fake_conf.name = b'conf-2'
++ fake_conf.props[0].value = b'kernel-2\x00'
++ fake_conf.props[1].value = b'fdt-1\x00'
+ # insert the new configuration under /configurations
+ root[1].children.append(fake_conf)
+
diff --git a/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27138-2.patch b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27138-2.patch
new file mode 100644
index 0000000..946196c
--- /dev/null
+++ b/poky/meta/recipes-bsp/u-boot/files/CVE-2021-27138-2.patch
@@ -0,0 +1,109 @@
+From 3f04db891a353f4b127ed57279279f851c6b4917 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Mon, 15 Feb 2021 17:08:12 -0700
+Subject: [PATCH] image: Check for unit addresses in FITs
+
+Using unit addresses in a FIT is a security risk. Add a check for this
+and disallow it.
+
+CVE-2021-27138
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Reported-by: Bruce Monroe <bruce.monroe@intel.com>
+Reported-by: Arie Haenel <arie.haenel@intel.com>
+Reported-by: Julien Lenoir <julien.lenoir@intel.com>
+
+CVE: CVE-2021-27138
+Upstream-Status: Backport[https://github.com/u-boot/u-boot/commit/3f04db891a353f4b127ed57279279f851c6b4917]
+Signed-off-by: Scott Murray <scott.murray@konsulko.com>
+
+---
+ common/image-fit.c | 56 +++++++++++++++++++++++++++++++++++++++++----
+ test/py/tests/test_vboot.py | 9 ++++----
+ 2 files changed, 57 insertions(+), 8 deletions(-)
+
+diff --git a/common/image-fit.c b/common/image-fit.c
+index bcf395f6a1..28b3d2b191 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -1568,6 +1568,34 @@ int fit_image_check_comp(const void *fit, int noffset, uint8_t comp)
+ return (comp == image_comp);
+ }
+
++/**
++ * fdt_check_no_at() - Check for nodes whose names contain '@'
++ *
++ * This checks the parent node and all subnodes recursively
++ *
++ * @fit: FIT to check
++ * @parent: Parent node to check
++ * @return 0 if OK, -EADDRNOTAVAIL is a node has a name containing '@'
++ */
++static int fdt_check_no_at(const void *fit, int parent)
++{
++ const char *name;
++ int node;
++ int ret;
++
++ name = fdt_get_name(fit, parent, NULL);
++ if (!name || strchr(name, '@'))
++ return -EADDRNOTAVAIL;
++
++ fdt_for_each_subnode(node, fit, parent) {
++ ret = fdt_check_no_at(fit, node);
++ if (ret)
++ return ret;
++ }
++
++ return 0;
++}
++
+ int fit_check_format(const void *fit, ulong size)
+ {
+ int ret;
+@@ -1589,10 +1617,27 @@ int fit_check_format(const void *fit, ulong size)
+ if (size == IMAGE_SIZE_INVAL)
+ size = fdt_totalsize(fit);
+ ret = fdt_check_full(fit, size);
++ if (ret)
++ ret = -EINVAL;
++
++ /*
++ * U-Boot stopped using unit addressed in 2017. Since libfdt
++ * can match nodes ignoring any unit address, signature
++ * verification can see the wrong node if one is inserted with
++ * the same name as a valid node but with a unit address
++ * attached. Protect against this by disallowing unit addresses.
++ */
++ if (!ret && CONFIG_IS_ENABLED(FIT_SIGNATURE)) {
++ ret = fdt_check_no_at(fit, 0);
+
++ if (ret) {
++ log_debug("FIT check error %d\n", ret);
++ return ret;
++ }
++ }
+ if (ret) {
+ log_debug("FIT check error %d\n", ret);
+- return -EINVAL;
++ return ret;
+ }
+ }
+
+@@ -1955,10 +2000,13 @@ int fit_image_load(bootm_headers_t *images, ulong addr,
+ printf("## Loading %s from FIT Image at %08lx ...\n", prop_name, addr);
+
+ bootstage_mark(bootstage_id + BOOTSTAGE_SUB_FORMAT);
+- if (fit_check_format(fit, IMAGE_SIZE_INVAL)) {
+- printf("Bad FIT %s image format!\n", prop_name);
++ ret = fit_check_format(fit, IMAGE_SIZE_INVAL);
++ if (ret) {
++ printf("Bad FIT %s image format! (err=%d)\n", prop_name, ret);
++ if (CONFIG_IS_ENABLED(FIT_SIGNATURE) && ret == -EADDRNOTAVAIL)
++ printf("Signature checking prevents use of unit addresses (@) in nodes\n");
+ bootstage_error(bootstage_id + BOOTSTAGE_SUB_FORMAT);
+- return -ENOEXEC;
++ return ret;
+ }
+ bootstage_mark(bootstage_id + BOOTSTAGE_SUB_FORMAT_OK);
+ if (fit_uname) {
diff --git a/poky/meta/recipes-bsp/u-boot/u-boot-common.inc b/poky/meta/recipes-bsp/u-boot/u-boot-common.inc
index 5a8035f..993478a 100644
--- a/poky/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/poky/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -15,6 +15,13 @@
SRCREV = "c4fddedc48f336eabc4ce3f74940e6aa372de18c"
SRC_URI = "git://git.denx.de/u-boot.git \
+ file://0001-add-valid-fdt-check.patch \
+ file://CVE-2021-27097-1.patch \
+ file://CVE-2021-27097-2.patch \
+ file://CVE-2021-27097-3.patch \
+ file://CVE-2021-27097-4.patch \
+ file://CVE-2021-27138-1.patch \
+ file://CVE-2021-27138-2.patch \
"
S = "${WORKDIR}/git"
diff --git a/poky/meta/recipes-bsp/u-boot/u-boot_2021.01.bb b/poky/meta/recipes-bsp/u-boot/u-boot_2021.01.bb
index 2eef1e9..bbbc99b 100644
--- a/poky/meta/recipes-bsp/u-boot/u-boot_2021.01.bb
+++ b/poky/meta/recipes-bsp/u-boot/u-boot_2021.01.bb
@@ -1,4 +1,6 @@
require u-boot-common.inc
require u-boot.inc
+SRC_URI_append = " file://0001-riscv32-Use-double-float-ABI-for-rv32.patch"
+
DEPENDS += "bc-native dtc-native python3-setuptools-native"