Merge pull request #924 from home-assistant/dev

Release 5.4

Documentation/network.md

@@ -10,6 +10,8 @@ Only a manual configuration using NetworkManager connection files is supported.
 
 You can read the [NetworkManager manual][nm-manual] or find many configuration examples across the internet. Keep in mind that the system is read-only. If you don't want the IP address to change on every boot, you should modify the UUID property to a generic [UUID4][uuid]. Inside the `\CONFIG\network\` directory on the USB drive or SD card, create a file called `my-network` and add the appropriate contents below:
 
+**NOTE: Please make sure to save this file with UNIX line endings (LF, and not Windows' default CRLF endings). You can do this using Notepad these days!**
+
 ### Default
 
 A preinstalled connection profile is provided by default:

Documentation/partition.md

@@ -1,8 +1,8 @@
 # Partition
 
-The partition layout is a bit different than for regular setups. We prefer GPT, if possible. With SoCs which don't support GPT, we use the hybrid GPT. For more details about this topic, please refer to the [development](development.md) documentation.
+The partition layout is a bit different than the typical setup. We prefer GPT, if possible. With SoCs which don't support GPT, we use a hybrid GPT. For more details about this topic, please refer to the [development](development.md) documentation.
 
-The system is designed to have as less as possible write operations on the storage media. Which means that we have basically only write during the OTA update and 5-6 times per week on the overlay part. The data partition is having I/O. This is the reason which is should be run on a different drive.
+The system is designed to have as few write operations to the storage media as possible. This means that we only write during the OTA updates and 5-6 times per week on the overlay partition. The data partition receives the main I/O operations and for this reason is ideal for placing on a different drive.
 
 A visual representation looks like this:
 
@@ -51,15 +51,7 @@ Log in as `root` to get to the Home Assistant CLI and then enter `login` to cont
 
 Confirm your USB SSD/HD is connected and recognized using `fdisk -l`.
 
-It is recommended to use fdisk to remove the existing partition(s) before proceeding.
-
-- Type `fdisk /dev/XXX` (replacing XXX with your drive)
-- Type `d` to delete a partition.
-- Continue if needed, then write the changes.
-
-Creating a new partition is not necessary.
-
-With the drive now prepared, use the below command (again, replacing XXX with your drive)
+Make sure the drive has no partition named `hassos-data` (or no partition at all). With the drive, use the below command (again, replacing XXX with your drive)
 
 ```sh
 $ datactl move /dev/xxx

buildroot-external/board/asus/tinker/patches/uboot/0001-SPL-modify-load-address-of-U-Boot.patch

@@ -1,8 +1,8 @@
-From 74e929bc4713b76f58a8df82019d74078b4b8d0c Mon Sep 17 00:00:00 2001
-Message-Id: <74e929bc4713b76f58a8df82019d74078b4b8d0c.1599227174.git.stefan@agner.ch>
+From cd1aac268ff58eea28153bbabfb33abc2df52b1f Mon Sep 17 00:00:00 2001
+Message-Id: <cd1aac268ff58eea28153bbabfb33abc2df52b1f.1602103621.git.stefan@agner.ch>
 From: Pascal Vizeli <pvizeli@syshack.ch>
 Date: Fri, 24 Apr 2020 12:41:50 +0000
-Subject: [PATCH 1/3] SPL: modify load address of U-Boot
+Subject: [PATCH 1/4] SPL: modify load address of U-Boot
 
 Default load address of U-Boot is at sector 16384, which is where HAOS
 has its first partition. Use 0x2000 (8192) instead.
@@ -15,16 +15,16 @@ Signed-off-by: Stefan Agner <stefan@agner.ch>
  2 files changed, 2 insertions(+)
 
 diff --git a/configs/tinker-rk3288_defconfig b/configs/tinker-rk3288_defconfig
-index 83c3450839..574a711a32 100644
+index d459c7f50d..e0682ed479 100644
 --- a/configs/tinker-rk3288_defconfig
 +++ b/configs/tinker-rk3288_defconfig
-@@ -84,3 +84,4 @@ CONFIG_USB_ETHER_ASIX=y
- CONFIG_USB_ETHER_SMSC95XX=y
+@@ -88,3 +88,4 @@ CONFIG_VIDEO_ROCKCHIP=y
+ CONFIG_DISPLAY_ROCKCHIP_HDMI=y
  CONFIG_CMD_DHRYSTONE=y
  CONFIG_ERRNO_STR=y
 +CONFIG_SYS_MMCSD_RAW_MODE_U_BOOT_SECTOR=0x2000
 diff --git a/configs/tinker-s-rk3288_defconfig b/configs/tinker-s-rk3288_defconfig
-index 4925b14821..df047785ea 100644
+index 68411d863b..1a285baf73 100644
 --- a/configs/tinker-s-rk3288_defconfig
 +++ b/configs/tinker-s-rk3288_defconfig
 @@ -90,3 +90,4 @@ CONFIG_DISPLAY_ROCKCHIP_HDMI=y

buildroot-external/board/asus/tinker/patches/uboot/0002-rockchip-dts-tinker-move-i2c-node-to-shared-device-t.patch

@@ -1,10 +1,10 @@
-From 683783c7253981c0d4c3b772aeb1f9bda833e2be Mon Sep 17 00:00:00 2001
-Message-Id: <683783c7253981c0d4c3b772aeb1f9bda833e2be.1599227174.git.stefan@agner.ch>
-In-Reply-To: <74e929bc4713b76f58a8df82019d74078b4b8d0c.1599227174.git.stefan@agner.ch>
-References: <74e929bc4713b76f58a8df82019d74078b4b8d0c.1599227174.git.stefan@agner.ch>
+From d49ad12ee89d0d64f1f594bcad7de0e4f9631add Mon Sep 17 00:00:00 2001
+Message-Id: <d49ad12ee89d0d64f1f594bcad7de0e4f9631add.1602103621.git.stefan@agner.ch>
+In-Reply-To: <cd1aac268ff58eea28153bbabfb33abc2df52b1f.1602103621.git.stefan@agner.ch>
+References: <cd1aac268ff58eea28153bbabfb33abc2df52b1f.1602103621.git.stefan@agner.ch>
 From: Stefan Agner <stefan@agner.ch>
 Date: Fri, 4 Sep 2020 15:40:55 +0200
-Subject: [PATCH 2/3] rockchip: dts: tinker: move i2c node to shared device
+Subject: [PATCH 2/4] rockchip: dts: tinker: move i2c node to shared device
  tree
 
 The I2C EEPROM is present on Tinker Board S as well. Move the i2c node

buildroot-external/board/asus/tinker/patches/uboot/0003-rockchip-dts-tinker-remove-unnecessary-node.patch

@@ -1,10 +1,10 @@
-From 2af46619bb66af62bbfd2a880fe57d6dd0ec43fe Mon Sep 17 00:00:00 2001
-Message-Id: <2af46619bb66af62bbfd2a880fe57d6dd0ec43fe.1599227174.git.stefan@agner.ch>
-In-Reply-To: <74e929bc4713b76f58a8df82019d74078b4b8d0c.1599227174.git.stefan@agner.ch>
-References: <74e929bc4713b76f58a8df82019d74078b4b8d0c.1599227174.git.stefan@agner.ch>
+From 07a02625ba95f68ba670b4c1cc98567acb390195 Mon Sep 17 00:00:00 2001
+Message-Id: <07a02625ba95f68ba670b4c1cc98567acb390195.1602103621.git.stefan@agner.ch>
+In-Reply-To: <cd1aac268ff58eea28153bbabfb33abc2df52b1f.1602103621.git.stefan@agner.ch>
+References: <cd1aac268ff58eea28153bbabfb33abc2df52b1f.1602103621.git.stefan@agner.ch>
 From: Stefan Agner <stefan@agner.ch>
 Date: Fri, 4 Sep 2020 15:44:38 +0200
-Subject: [PATCH 3/3] rockchip: dts: tinker: remove unnecessary node
+Subject: [PATCH 3/4] rockchip: dts: tinker: remove unnecessary node
 
 The property reg-shift with the same value is present in the base
 device tree already. Remove unnecessary node from rk3288-tinker.dts.

buildroot-external/board/asus/tinker/patches/uboot/0004-pmic-enable-LDO2-vcc33_mipi-at-bootup.patch

@@ -1,7 +1,10 @@
-From 4147d34a63f74f78a8ff9a3dcf2f4c9cd8d6be3a Mon Sep 17 00:00:00 2001
+From 549d98c233b2a8b7cd4b0d4eb9652ad60a8a0f75 Mon Sep 17 00:00:00 2001
+Message-Id: <549d98c233b2a8b7cd4b0d4eb9652ad60a8a0f75.1602103621.git.stefan@agner.ch>
+In-Reply-To: <cd1aac268ff58eea28153bbabfb33abc2df52b1f.1602103621.git.stefan@agner.ch>
+References: <cd1aac268ff58eea28153bbabfb33abc2df52b1f.1602103621.git.stefan@agner.ch>
 From: Pascal Vizeli <pvizeli@syshack.ch>
 Date: Fri, 24 Apr 2020 11:37:55 +0000
-Subject: [PATCH 1/1] pmic: enable LDO2 vcc33_mipi at bootup
+Subject: [PATCH 4/4] pmic: enable LDO2 vcc33_mipi at bootup
 
 Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
 ---
@@ -9,10 +12,10 @@ Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
  1 file changed, 37 insertions(+)
 
 diff --git a/board/rockchip/tinker_rk3288/tinker-rk3288.c b/board/rockchip/tinker_rk3288/tinker-rk3288.c
-index 7af39e10cd..f12409933d 100644
+index f85209c649..6fa1bb0c66 100644
 --- a/board/rockchip/tinker_rk3288/tinker-rk3288.c
 +++ b/board/rockchip/tinker_rk3288/tinker-rk3288.c
-@@ -12,6 +12,7 @@
+@@ -13,6 +13,7 @@
  #include <netdev.h>
  #include <asm/arch-rockchip/bootrom.h>
  #include <asm/io.h>
@@ -20,7 +23,7 @@ index 7af39e10cd..f12409933d 100644
  
  static int get_ethaddr_from_eeprom(u8 *addr)
  {
-@@ -47,3 +48,39 @@ int mmc_get_env_dev(void)
+@@ -48,3 +49,39 @@ int mmc_get_env_dev(void)
  
  	return 1;
  }
@@ -61,5 +64,5 @@ index 7af39e10cd..f12409933d 100644
 +}
 +#endif
 -- 
-2.17.1
+2.28.0
 

buildroot-external/board/hardkernel/patches/linux/0001-arm64-defconfig-enable-meson-gx-audio-as-module.patch

@@ -1,43 +0,0 @@
-From e2b93751cfd0722801b65b4603b588ab9df4c12b Mon Sep 17 00:00:00 2001
-From: Jerome Brunet <jbrunet@baylibre.com>
-Date: Tue, 21 Apr 2020 18:39:30 +0200
-Subject: [PATCH 2/8] arm64: defconfig: enable meson gx audio as module
-
-Enable the module config for the Amlogic GX audio card.
-This module will imply the internal components usually associated
-with it to make a functional sound card on these platforms.
-
-Also enable the simple amplifier module which often used on the
-output stage of those cards.
-
-Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
-Signed-off-by: Kevin Hilman <khilman@baylibre.com>
-Tested-by: Christian Hewitt <christianshewitt@gmail.com>
-Link: https://lore.kernel.org/r/20200421163935.775935-2-jbrunet@baylibre.com
----
- arch/arm64/configs/defconfig | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
-index 03d0189f7d68..ceb60ee9c340 100644
---- a/arch/arm64/configs/defconfig
-+++ b/arch/arm64/configs/defconfig
-@@ -644,6 +644,7 @@ CONFIG_SND_HDA_CODEC_HDMI=m
- CONFIG_SND_SOC=y
- CONFIG_SND_BCM2835_SOC_I2S=m
- CONFIG_SND_MESON_AXG_SOUND_CARD=m
-+CONFIG_SND_MESON_GX_SOUND_CARD=m
- CONFIG_SND_SOC_SDM845=m
- CONFIG_SND_SOC_ROCKCHIP=m
- CONFIG_SND_SOC_ROCKCHIP_SPDIF=m
-@@ -656,6 +657,7 @@ CONFIG_SND_SOC_AK4613=m
- CONFIG_SND_SOC_ES7134=m
- CONFIG_SND_SOC_ES7241=m
- CONFIG_SND_SOC_PCM3168A_I2C=m
-+CONFIG_SND_SOC_SIMPLE_AMPLIFIER=m
- CONFIG_SND_SOC_TAS571X=m
- CONFIG_SND_SOC_WCD934X=m
- CONFIG_SND_SOC_WSA881X=m
--- 
-2.17.1
-

buildroot-external/board/hardkernel/patches/linux/0001-arm64-dts-meson-convert-ODROID-N2-to-dtsi.patch

@@ -1,10 +1,8 @@
-From 9443f2cd21a8ebd08f0fb64f5b3a8ccb6cd77d8e Mon Sep 17 00:00:00 2001
-Message-Id: <9443f2cd21a8ebd08f0fb64f5b3a8ccb6cd77d8e.1596660075.git.stefan@agner.ch>
-In-Reply-To: <f72fc1866396fed30036e0f06007c15217e47f22.1596660075.git.stefan@agner.ch>
-References: <f72fc1866396fed30036e0f06007c15217e47f22.1596660075.git.stefan@agner.ch>
+From d35db3d5f943fea569dde8e83f15565254643385 Mon Sep 17 00:00:00 2001
+Message-Id: <d35db3d5f943fea569dde8e83f15565254643385.1602360581.git.stefan@agner.ch>
 From: Christian Hewitt <christianshewitt@gmail.com>
 Date: Sun, 19 Jul 2020 14:10:32 +0000
-Subject: [PATCH 08/10] arm64: dts: meson: convert ODROID-N2 to dtsi
+Subject: [PATCH 1/4] arm64: dts: meson: convert ODROID-N2 to dtsi
 
 Convert the current ODROID-N2 dts into a common dtsi in preparation
 for adding ODROID-N2+ support.
@@ -1283,5 +1281,5 @@ index 000000000000..e5bc132ce7d5
 +	phy-supply = <&hub_5v>;
 +};
 -- 
-2.27.0
+2.28.0
 

buildroot-external/board/hardkernel/patches/linux/0001-usb-cdc-acm-fix-cooldown-mechanism.patch

@@ -0,0 +1,124 @@
+From f6fce2e974fe091fd233301bd7c127ca18304039 Mon Sep 17 00:00:00 2001
+Message-Id: <f6fce2e974fe091fd233301bd7c127ca18304039.1603303549.git.stefan@agner.ch>
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Mon, 19 Oct 2020 19:07:02 +0200
+Subject: [PATCH] usb: cdc-acm: fix cooldown mechanism
+
+Commit a4e7279cd1d1 ("cdc-acm: introduce a cool down") is causing
+regression if there is some USB error, such as -EPROTO.
+
+This has been reported on some samples of the Odroid-N2 using the Combee II
+Zibgee USB dongle.
+
+> struct acm *acm = container_of(work, struct acm, work)
+
+is incorrect in case of a delayed work and causes warnings, usually from
+the workqueue:
+
+> WARNING: CPU: 0 PID: 0 at kernel/workqueue.c:1474 __queue_work+0x480/0x528.
+
+When this happens, USB eventually stops working completely after a while.
+Also the ACM_ERROR_DELAY bit is never set, so the cooldown mechanism
+previously introduced cannot be triggered and acm_submit_read_urb() is
+never called.
+
+This changes makes the cdc-acm driver use a single delayed work, fixing the
+pointer arithmetic in acm_softint() and set the ACM_ERROR_DELAY when the
+cooldown mechanism appear to be needed.
+
+Fixes: a4e7279cd1d1 ("cdc-acm: introduce a cool down")
+Reported-by: Pascal Vizeli <pascal.vizeli@nabucasa.com>
+Cc: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+---
+ drivers/usb/class/cdc-acm.c | 12 +++++-------
+ drivers/usb/class/cdc-acm.h |  3 +--
+ 2 files changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 7f6f3ab5b8a6..8f087499196a 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -507,6 +507,7 @@ static void acm_read_bulk_callback(struct urb *urb)
+ 			"%s - cooling babbling device\n", __func__);
+ 		usb_mark_last_busy(acm->dev);
+ 		set_bit(rb->index, &acm->urbs_in_error_delay);
++		set_bit(ACM_ERROR_DELAY, &acm->flags);
+ 		cooldown = true;
+ 		break;
+ 	default:
+@@ -532,7 +533,7 @@ static void acm_read_bulk_callback(struct urb *urb)
+ 
+ 	if (stopped || stalled || cooldown) {
+ 		if (stalled)
+-			schedule_work(&acm->work);
++			schedule_delayed_work(&acm->dwork, 0);
+ 		else if (cooldown)
+ 			schedule_delayed_work(&acm->dwork, HZ / 2);
+ 		return;
+@@ -562,13 +563,13 @@ static void acm_write_bulk(struct urb *urb)
+ 	acm_write_done(acm, wb);
+ 	spin_unlock_irqrestore(&acm->write_lock, flags);
+ 	set_bit(EVENT_TTY_WAKEUP, &acm->flags);
+-	schedule_work(&acm->work);
++	schedule_delayed_work(&acm->dwork, 0);
+ }
+ 
+ static void acm_softint(struct work_struct *work)
+ {
+ 	int i;
+-	struct acm *acm = container_of(work, struct acm, work);
++	struct acm *acm = container_of(work, struct acm, dwork.work);
+ 
+ 	if (test_bit(EVENT_RX_STALL, &acm->flags)) {
+ 		smp_mb(); /* against acm_suspend() */
+@@ -584,7 +585,7 @@ static void acm_softint(struct work_struct *work)
+ 	if (test_and_clear_bit(ACM_ERROR_DELAY, &acm->flags)) {
+ 		for (i = 0; i < acm->rx_buflimit; i++)
+ 			if (test_and_clear_bit(i, &acm->urbs_in_error_delay))
+-					acm_submit_read_urb(acm, i, GFP_NOIO);
++				acm_submit_read_urb(acm, i, GFP_KERNEL);
+ 	}
+ 
+ 	if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags))
+@@ -1352,7 +1353,6 @@ static int acm_probe(struct usb_interface *intf,
+ 	acm->ctrlsize = ctrlsize;
+ 	acm->readsize = readsize;
+ 	acm->rx_buflimit = num_rx_buf;
+-	INIT_WORK(&acm->work, acm_softint);
+ 	INIT_DELAYED_WORK(&acm->dwork, acm_softint);
+ 	init_waitqueue_head(&acm->wioctl);
+ 	spin_lock_init(&acm->write_lock);
+@@ -1562,7 +1562,6 @@ static void acm_disconnect(struct usb_interface *intf)
+ 	}
+ 
+ 	acm_kill_urbs(acm);
+-	cancel_work_sync(&acm->work);
+ 	cancel_delayed_work_sync(&acm->dwork);
+ 
+ 	tty_unregister_device(acm_tty_driver, acm->minor);
+@@ -1605,7 +1604,6 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message)
+ 		return 0;
+ 
+ 	acm_kill_urbs(acm);
+-	cancel_work_sync(&acm->work);
+ 	cancel_delayed_work_sync(&acm->dwork);
+ 	acm->urbs_in_error_delay = 0;
+ 
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index cd5e9d8ab237..b95ff769072e 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -112,8 +112,7 @@ struct acm {
+ #		define ACM_ERROR_DELAY	3
+ 	unsigned long urbs_in_error_delay;		/* these need to be restarted after a delay */
+ 	struct usb_cdc_line_coding line;		/* bits, stop, parity */
+-	struct work_struct work;			/* work queue entry for various purposes*/
+-	struct delayed_work dwork;			/* for cool downs needed in error recovery */
++	struct delayed_work dwork;		        /* work queue entry for various purposes */
+ 	unsigned int ctrlin;				/* input control lines (DCD, DSR, RI, break, overruns) */
+ 	unsigned int ctrlout;				/* output control lines (DTR, RTS) */
+ 	struct async_icount iocount;			/* counters for control line changes */
+-- 
+2.28.0
+

buildroot-external/board/hardkernel/patches/linux/0002-ASoC-meson-imply-acodec-glue-on-axg-sound-card.patch

@@ -1,28 +0,0 @@
-From 821b8ac21b1675910423ee69d37cb1977b8f271e Mon Sep 17 00:00:00 2001
-From: Jerome Brunet <jbrunet@baylibre.com>
-Date: Mon, 30 Mar 2020 17:39:04 +0200
-Subject: [PATCH 3/8] ASoC: meson: imply acodec glue on axg sound card
-
-When axg card driver support is enabled, lets enable the related
-internal DAC glue by default.
-
-Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
----
- sound/soc/meson/Kconfig | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/sound/soc/meson/Kconfig b/sound/soc/meson/Kconfig
-index 8b6295283989..363dc3b1bbe4 100644
---- a/sound/soc/meson/Kconfig
-+++ b/sound/soc/meson/Kconfig
-@@ -68,6 +68,7 @@ config SND_MESON_AXG_SOUND_CARD
- 	imply SND_MESON_AXG_SPDIFOUT
- 	imply SND_MESON_AXG_SPDIFIN
- 	imply SND_MESON_AXG_PDM
-+	imply SND_MESON_G12A_TOACODEC
- 	imply SND_MESON_G12A_TOHDMITX if DRM_MESON_DW_HDMI
- 	help
- 	  Select Y or M to add support for the AXG SoC sound card
--- 
-2.17.1
-

buildroot-external/board/hardkernel/patches/linux/0002-dt-bindings-arm-amlogic-add-support-for-the-ODROID-N.patch

@@ -1,11 +1,10 @@
-From 54d8ae2ae7a10dab6998b2d4ac507aec96c6f1da Mon Sep 17 00:00:00 2001
-Message-Id: <54d8ae2ae7a10dab6998b2d4ac507aec96c6f1da.1595882680.git.stefan@agner.ch>
-In-Reply-To: <d83d79b085486a605462fa91e3c6746e4ff0b263.1595882680.git.stefan@agner.ch>
-References: <d83d79b085486a605462fa91e3c6746e4ff0b263.1595882680.git.stefan@agner.ch>
+From 4b9d9159ed5a79ceac5b831012b3cb44cce2516c Mon Sep 17 00:00:00 2001
+Message-Id: <4b9d9159ed5a79ceac5b831012b3cb44cce2516c.1602360581.git.stefan@agner.ch>
+In-Reply-To: <d35db3d5f943fea569dde8e83f15565254643385.1602360581.git.stefan@agner.ch>
+References: <d35db3d5f943fea569dde8e83f15565254643385.1602360581.git.stefan@agner.ch>
 From: Christian Hewitt <christianshewitt@gmail.com>
 Date: Sun, 19 Jul 2020 14:10:33 +0000
-Subject: [PATCH 09/10] dt-bindings: arm: amlogic: add support for the
- ODROID-N2+
+Subject: [PATCH 2/4] dt-bindings: arm: amlogic: add support for the ODROID-N2+
 
 HardKernel ODROID-N2+ uses a revised Amlogic S922X v2 chip that supports
 higher cpu clock speeds than the original ODROID-N2.
@@ -16,17 +15,17 @@ Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
  1 file changed, 1 insertion(+)
 
 diff --git a/Documentation/devicetree/bindings/arm/amlogic.yaml b/Documentation/devicetree/bindings/arm/amlogic.yaml
-index f74aba48cec1..915ef4f355ad 100644
+index 5eba9f48823e..12ba8d074370 100644
 --- a/Documentation/devicetree/bindings/arm/amlogic.yaml
 +++ b/Documentation/devicetree/bindings/arm/amlogic.yaml
-@@ -149,6 +149,7 @@ properties:
-         items:
-           - enum:
+@@ -153,6 +153,7 @@ properties:
+               - azw,gtking
+               - azw,gtking-pro
                - hardkernel,odroid-n2
 +              - hardkernel,odroid-n2-plus
                - khadas,vim3
                - ugoos,am6
            - const: amlogic,s922x
 -- 
-2.27.0
+2.28.0
 

buildroot-external/board/hardkernel/patches/linux/0003-ASoC-meson-gx-card-fix-sound-dai-dt-schema.patch

@@ -1,47 +0,0 @@
-From 60164df03c6314d8f5f3afef56b0bf97962ec9ee Mon Sep 17 00:00:00 2001
-From: Jerome Brunet <jbrunet@baylibre.com>
-Date: Mon, 24 Feb 2020 14:35:17 +0100
-Subject: [PATCH 4/8] ASoC: meson: gx-card: fix sound-dai dt schema
-
-There is a fair amount of warnings when running 'make dtbs_check' with
-amlogic,gx-sound-card.yaml.
-
-Ex:
-arch/arm64/boot/dts/amlogic/meson-gxm-q200.dt.yaml: sound: dai-link-0:sound-dai:0:1: missing phandle tag in 0
-arch/arm64/boot/dts/amlogic/meson-gxm-q200.dt.yaml: sound: dai-link-0:sound-dai:0:2: missing phandle tag in 0
-arch/arm64/boot/dts/amlogic/meson-gxm-q200.dt.yaml: sound: dai-link-0:sound-dai:0: [66, 0, 0] is too long
-
-The reason is that the sound-dai phandle provided has cells, and in such
-case the schema should use 'phandle-array' instead of 'phandle'.
-
-Fixes: fd00366b8e41 ("ASoC: meson: gx: add sound card dt-binding documentation")
-Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
----
- .../devicetree/bindings/sound/amlogic,gx-sound-card.yaml      | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml
-index fb374c659be1..a48222e8cd08 100644
---- a/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml
-+++ b/Documentation/devicetree/bindings/sound/amlogic,gx-sound-card.yaml
-@@ -57,7 +57,7 @@ patternProperties:
-           rate
- 
-       sound-dai:
--        $ref: /schemas/types.yaml#/definitions/phandle
-+        $ref: /schemas/types.yaml#/definitions/phandle-array
-         description: phandle of the CPU DAI
- 
-     patternProperties:
-@@ -71,7 +71,7 @@ patternProperties:
- 
-         properties:
-           sound-dai:
--            $ref: /schemas/types.yaml#/definitions/phandle
-+            $ref: /schemas/types.yaml#/definitions/phandle-array
-             description: phandle of the codec DAI
- 
-         required:
--- 
-2.17.1
-

buildroot-external/board/hardkernel/patches/linux/0003-arm64-dts-meson-add-support-for-the-ODROID-N2.patch

@@ -1,10 +1,10 @@
-From 188bc924b34b7d845324eb2e0e7493a9eaeb2cb5 Mon Sep 17 00:00:00 2001
-Message-Id: <188bc924b34b7d845324eb2e0e7493a9eaeb2cb5.1595882680.git.stefan@agner.ch>
-In-Reply-To: <d83d79b085486a605462fa91e3c6746e4ff0b263.1595882680.git.stefan@agner.ch>
-References: <d83d79b085486a605462fa91e3c6746e4ff0b263.1595882680.git.stefan@agner.ch>
+From 81b5af6c3ce3e0f312be0897bec0b3c942e2ce97 Mon Sep 17 00:00:00 2001
+Message-Id: <81b5af6c3ce3e0f312be0897bec0b3c942e2ce97.1602360581.git.stefan@agner.ch>
+In-Reply-To: <d35db3d5f943fea569dde8e83f15565254643385.1602360581.git.stefan@agner.ch>
+References: <d35db3d5f943fea569dde8e83f15565254643385.1602360581.git.stefan@agner.ch>
 From: Christian Hewitt <christianshewitt@gmail.com>
 Date: Sun, 19 Jul 2020 14:10:34 +0000
-Subject: [PATCH 10/10] arm64: dts: meson: add support for the ODROID-N2+
+Subject: [PATCH 3/4] arm64: dts: meson: add support for the ODROID-N2+
 
 HardKernel ODROID-N2+ uses an Amlogic S922X rev. C chip capable of higher
 clock speeds than the original ODROID-N2. Hardkernel supports the big cpu
@@ -22,10 +22,10 @@ Signed-off-by: Stefan Agner <stefan@agner.ch>
  create mode 100644 arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2-plus.dts
 
 diff --git a/arch/arm64/boot/dts/amlogic/Makefile b/arch/arm64/boot/dts/amlogic/Makefile
-index eef0045320f2..7524cf9680f5 100644
+index 4e2239ffcaa5..b0b3d6791499 100644
 --- a/arch/arm64/boot/dts/amlogic/Makefile
 +++ b/arch/arm64/boot/dts/amlogic/Makefile
-@@ -6,6 +6,7 @@ dtb-$(CONFIG_ARCH_MESON) += meson-g12a-x96-max.dtb
+@@ -8,6 +8,7 @@ dtb-$(CONFIG_ARCH_MESON) += meson-g12b-gtking-pro.dtb
  dtb-$(CONFIG_ARCH_MESON) += meson-g12b-a311d-khadas-vim3.dtb
  dtb-$(CONFIG_ARCH_MESON) += meson-g12b-s922x-khadas-vim3.dtb
  dtb-$(CONFIG_ARCH_MESON) += meson-g12b-odroid-n2.dtb
@@ -93,5 +93,5 @@ index 000000000000..4ebb448d233f
 +};
 +
 -- 
-2.27.0
+2.28.0
 

buildroot-external/board/hardkernel/patches/linux/0004-arm64-dts-meson-g12-add-internal-DAC.patch

@@ -1,39 +0,0 @@
-From e128dd1ca079c5ee558ab100387d9f81bd4f3980 Mon Sep 17 00:00:00 2001
-From: Jerome Brunet <jbrunet@baylibre.com>
-Date: Thu, 7 May 2020 00:16:55 +0200
-Subject: [PATCH 5/8] arm64: dts: meson: g12: add internal DAC
-
-add internal audio DAC support on the g12 and sm1 SoC family
-
-Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
-Signed-off-by: Kevin Hilman <khilman@baylibre.com>
-Link: https://lore.kernel.org/r/20200506221656.477379-7-jbrunet@baylibre.com
----
- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
-diff --git a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
-index c0aef7d69117..593a006f4b7b 100644
---- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
-+++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
-@@ -250,6 +250,17 @@
- 				};
- 			};
- 
-+			acodec: audio-controller@32000 {
-+				compatible = "amlogic,t9015";
-+				reg = <0x0 0x32000 0x0 0x14>;
-+				#sound-dai-cells = <0>;
-+				sound-name-prefix = "ACODEC";
-+				clocks = <&clkc CLKID_AUDIO_CODEC>;
-+				clock-names = "pclk";
-+				resets = <&reset RESET_AUDIO_CODEC>;
-+				status = "disabled";
-+			};
-+
- 			periphs: bus@34400 {
- 				compatible = "simple-bus";
- 				reg = <0x0 0x34400 0x0 0x400>;
--- 
-2.17.1
-

buildroot-external/board/hardkernel/patches/linux/0004-clk-meson-g12a-mark-fclk_div2-as-critical.patch

@@ -1,10 +1,10 @@
-From c33df0ebe8be16b56741ce7f873221ab9087a0a6 Mon Sep 17 00:00:00 2001
-Message-Id: <c33df0ebe8be16b56741ce7f873221ab9087a0a6.1598564789.git.stefan@agner.ch>
-In-Reply-To: <f72fc1866396fed30036e0f06007c15217e47f22.1598564789.git.stefan@agner.ch>
-References: <f72fc1866396fed30036e0f06007c15217e47f22.1598564789.git.stefan@agner.ch>
+From 6a7c42785788faa862aeb7902cb2b3b08f033ca0 Mon Sep 17 00:00:00 2001
+Message-Id: <6a7c42785788faa862aeb7902cb2b3b08f033ca0.1602360581.git.stefan@agner.ch>
+In-Reply-To: <d35db3d5f943fea569dde8e83f15565254643385.1602360581.git.stefan@agner.ch>
+References: <d35db3d5f943fea569dde8e83f15565254643385.1602360581.git.stefan@agner.ch>
 From: Stefan Agner <stefan@agner.ch>
 Date: Thu, 27 Aug 2020 23:29:57 +0200
-Subject: [PATCH 11/11] clk: meson: g12a: mark fclk_div2 as critical
+Subject: [PATCH 4/4] clk: meson: g12a: mark fclk_div2 as critical
 
 On Amlogic Meson G12b platform, similar to fclk_div3, the fclk_div2
 seems to be necessary for the system to operate correctly as well.
@@ -22,7 +22,7 @@ Signed-off-by: Stefan Agner <stefan@agner.ch>
  1 file changed, 1 insertion(+)
 
 diff --git a/drivers/clk/meson/g12a.c b/drivers/clk/meson/g12a.c
-index fad616cac01e..2214b974f748 100644
+index 9803d44bb157..9a6722a1dc19 100644
 --- a/drivers/clk/meson/g12a.c
 +++ b/drivers/clk/meson/g12a.c
 @@ -298,6 +298,7 @@ static struct clk_regmap g12a_fclk_div2 = {

buildroot-external/board/hardkernel/patches/linux/0005-arm64-dts-meson-g12-add-internal-DAC-glue.patch

@@ -1,39 +0,0 @@
-From 5ea4085da165fd3f3aa211cb3664dd166d0d5fd7 Mon Sep 17 00:00:00 2001
-From: Jerome Brunet <jbrunet@baylibre.com>
-Date: Thu, 7 May 2020 00:16:56 +0200
-Subject: [PATCH 6/8] arm64: dts: meson: g12: add internal DAC glue
-
-add the internal DAC glue support on the g12 and sm1 family
-This glue connects the different TDM interfaces of the SoC to
-the internal audio DAC codec.
-
-Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
-Signed-off-by: Kevin Hilman <khilman@baylibre.com>
-Link: https://lore.kernel.org/r/20200506221656.477379-8-jbrunet@baylibre.com
----
- arch/arm64/boot/dts/amlogic/meson-g12.dtsi | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/arch/arm64/boot/dts/amlogic/meson-g12.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12.dtsi
-index 55d39020ec72..0d14409f509c 100644
---- a/arch/arm64/boot/dts/amlogic/meson-g12.dtsi
-+++ b/arch/arm64/boot/dts/amlogic/meson-g12.dtsi
-@@ -343,6 +343,15 @@
- 			status = "disabled";
- 		};
- 
-+		toacodec: audio-controller@740 {
-+			compatible = "amlogic,g12a-toacodec";
-+			reg = <0x0 0x740 0x0 0x4>;
-+			#sound-dai-cells = <1>;
-+			sound-name-prefix = "TOACODEC";
-+			resets = <&clkc_audio AUD_RESET_TOACODEC>;
-+			status = "disabled";
-+		};
-+
- 		tohdmitx: audio-controller@744 {
- 			compatible = "amlogic,g12a-tohdmitx";
- 			reg = <0x0 0x744 0x0 0x4>;
--- 
-2.17.1
-

buildroot-external/board/hardkernel/patches/linux/0006-arm64-dts-meson-g12b-odroid-n2-enable-audio-loopback.patch

@@ -1,123 +0,0 @@
-From 15b3cef2ea75c4d81cb067264be1cf49c49f81b1 Mon Sep 17 00:00:00 2001
-From: Jerome Brunet <jbrunet@baylibre.com>
-Date: Mon, 15 Jun 2020 15:38:44 +0200
-Subject: [PATCH 7/8] arm64: dts: meson-g12b: odroid-n2: enable audio loopback
-
-Add capture pcm interfaces and loopback routes to the odroid-n2
-
-Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
----
- .../boot/dts/amlogic/meson-g12b-odroid-n2.dts | 65 +++++++++++++++++--
- 1 file changed, 61 insertions(+), 4 deletions(-)
-
-diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts
-index 169ea283d4ee..d4421ad164bd 100644
---- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts
-+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts
-@@ -209,11 +209,28 @@
- 	sound {
- 		compatible = "amlogic,axg-sound-card";
- 		model = "G12B-ODROID-N2";
--		audio-aux-devs = <&tdmout_b>;
-+		audio-aux-devs = <&tdmout_b>, <&tdmin_a>, <&tdmin_b>,
-+				 <&tdmin_c>, <&tdmin_lb>;
- 		audio-routing = "TDMOUT_B IN 0", "FRDDR_A OUT 1",
- 				"TDMOUT_B IN 1", "FRDDR_B OUT 1",
- 				"TDMOUT_B IN 2", "FRDDR_C OUT 1",
--				"TDM_B Playback", "TDMOUT_B OUT";
-+				"TDM_B Playback", "TDMOUT_B OUT",
-+				"TDMIN_A IN 4", "TDM_B Loopback",
-+				"TDMIN_B IN 4", "TDM_B Loopback",
-+				"TDMIN_C IN 4", "TDM_B Loopback",
-+				"TDMIN_LB IN 1", "TDM_B Loopback",
-+				"TODDR_A IN 0", "TDMIN_A OUT",
-+				"TODDR_B IN 0", "TDMIN_A OUT",
-+				"TODDR_C IN 0", "TDMIN_A OUT",
-+				"TODDR_A IN 1", "TDMIN_B OUT",
-+				"TODDR_B IN 1", "TDMIN_B OUT",
-+				"TODDR_C IN 1", "TDMIN_B OUT",
-+				"TODDR_A IN 2", "TDMIN_C OUT",
-+				"TODDR_B IN 2", "TDMIN_C OUT",
-+				"TODDR_C IN 2", "TDMIN_C OUT",
-+				"TODDR_A IN 6", "TDMIN_LB OUT",
-+				"TODDR_B IN 6", "TDMIN_LB OUT",
-+				"TODDR_C IN 6", "TDMIN_LB OUT";
- 
- 		assigned-clocks = <&clkc CLKID_MPLL2>,
- 				  <&clkc CLKID_MPLL0>,
-@@ -236,8 +253,20 @@
- 			sound-dai = <&frddr_c>;
- 		};
- 
--		/* 8ch hdmi interface */
- 		dai-link-3 {
-+			sound-dai = <&toddr_a>;
-+		};
-+
-+		dai-link-4 {
-+			sound-dai = <&toddr_b>;
-+		};
-+
-+		dai-link-5 {
-+			sound-dai = <&toddr_c>;
-+		};
-+
-+		/* 8ch hdmi interface */
-+		dai-link-6 {
- 			sound-dai = <&tdmif_b>;
- 			dai-format = "i2s";
- 			dai-tdm-slot-tx-mask-0 = <1 1>;
-@@ -252,7 +281,7 @@
- 		};
- 
- 		/* hdmi glue */
--		dai-link-4 {
-+		dai-link-7 {
- 			sound-dai = <&tohdmitx TOHDMITX_I2S_OUT>;
- 
- 			codec {
-@@ -476,6 +505,22 @@
- 	status = "okay";
- };
- 
-+&tdmin_a {
-+	status = "okay";
-+};
-+
-+&tdmin_b {
-+	status = "okay";
-+};
-+
-+&tdmin_c {
-+	status = "okay";
-+};
-+
-+&tdmin_lb {
-+	status = "okay";
-+};
-+
- &tdmout_b {
- 	status = "okay";
- };
-@@ -484,6 +529,18 @@
- 	status = "okay";
- };
- 
-+&toddr_a {
-+	status = "okay";
-+};
-+
-+&toddr_b {
-+	status = "okay";
-+};
-+
-+&toddr_c {
-+	status = "okay";
-+};
-+
- &uart_AO {
- 	status = "okay";
- 	pinctrl-0 = <&uart_ao_a_pins>;
--- 
-2.17.1
-

buildroot-external/board/hardkernel/patches/linux/0007-arm64-dts-meson-odroid-n2-add-jack-audio-output-supp.patch

@@ -1,168 +0,0 @@
-From 978cc250574b7f1ab45f494cc2a094e3c9fd1fa4 Mon Sep 17 00:00:00 2001
-From: Jerome Brunet <jbrunet@baylibre.com>
-Date: Mon, 15 Jun 2020 16:34:37 +0200
-Subject: [PATCH 8/8] arm64: dts: meson: odroid-n2: add jack audio output
- support
-
-Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
----
- .../boot/dts/amlogic/meson-g12b-odroid-n2.dts | 79 +++++++++++++++++--
- 1 file changed, 74 insertions(+), 5 deletions(-)
-
-diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts
-index d4421ad164bd..34fffa6d859d 100644
---- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts
-+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dts
-@@ -9,6 +9,7 @@
- #include "meson-g12b-s922x.dtsi"
- #include <dt-bindings/input/input.h>
- #include <dt-bindings/gpio/meson-g12a-gpio.h>
-+#include <dt-bindings/sound/meson-g12a-toacodec.h>
- #include <dt-bindings/sound/meson-g12a-tohdmitx.h>
- 
- / {
-@@ -20,6 +21,14 @@
- 		ethernet0 = &ethmac;
- 	};
- 
-+	dioo2133: audio-amplifier-0 {
-+		compatible = "simple-audio-amplifier";
-+		enable-gpios = <&gpio_ao GPIOAO_2 GPIO_ACTIVE_HIGH>;
-+		VCC-supply = <&vcc_5v>;
-+		sound-name-prefix = "U19";
-+		status = "okay";
-+	};
-+
- 	chosen {
- 		stdout-path = "serial0:115200n8";
- 	};
-@@ -209,16 +218,26 @@
- 	sound {
- 		compatible = "amlogic,axg-sound-card";
- 		model = "G12B-ODROID-N2";
--		audio-aux-devs = <&tdmout_b>, <&tdmin_a>, <&tdmin_b>,
--				 <&tdmin_c>, <&tdmin_lb>;
-+		audio-widgets = "Line", "Lineout";
-+		audio-aux-devs = <&tdmout_b>, <&tdmout_c>, <&tdmin_a>,
-+				 <&tdmin_b>, <&tdmin_c>, <&tdmin_lb>,
-+				 <&dioo2133>;
- 		audio-routing = "TDMOUT_B IN 0", "FRDDR_A OUT 1",
- 				"TDMOUT_B IN 1", "FRDDR_B OUT 1",
- 				"TDMOUT_B IN 2", "FRDDR_C OUT 1",
- 				"TDM_B Playback", "TDMOUT_B OUT",
-+				"TDMOUT_C IN 0", "FRDDR_A OUT 2",
-+				"TDMOUT_C IN 1", "FRDDR_B OUT 2",
-+				"TDMOUT_C IN 2", "FRDDR_C OUT 2",
-+				"TDM_C Playback", "TDMOUT_C OUT",
- 				"TDMIN_A IN 4", "TDM_B Loopback",
- 				"TDMIN_B IN 4", "TDM_B Loopback",
- 				"TDMIN_C IN 4", "TDM_B Loopback",
- 				"TDMIN_LB IN 1", "TDM_B Loopback",
-+				"TDMIN_A IN 5", "TDM_C Loopback",
-+				"TDMIN_B IN 5", "TDM_C Loopback",
-+				"TDMIN_C IN 5", "TDM_C Loopback",
-+				"TDMIN_LB IN 2", "TDM_C Loopback",
- 				"TODDR_A IN 0", "TDMIN_A OUT",
- 				"TODDR_B IN 0", "TDMIN_A OUT",
- 				"TODDR_C IN 0", "TDMIN_A OUT",
-@@ -230,7 +249,11 @@
- 				"TODDR_C IN 2", "TDMIN_C OUT",
- 				"TODDR_A IN 6", "TDMIN_LB OUT",
- 				"TODDR_B IN 6", "TDMIN_LB OUT",
--				"TODDR_C IN 6", "TDMIN_LB OUT";
-+				"TODDR_C IN 6", "TDMIN_LB OUT",
-+				"U19 INL", "ACODEC LOLP",
-+				"U19 INR", "ACODEC LORP",
-+				"Lineout", "U19 OUTL",
-+				"Lineout", "U19 OUTR";
- 
- 		assigned-clocks = <&clkc CLKID_MPLL2>,
- 				  <&clkc CLKID_MPLL0>,
-@@ -275,22 +298,56 @@
- 			dai-tdm-slot-tx-mask-3 = <1 1>;
- 			mclk-fs = <256>;
- 
--			codec {
-+			codec-0 {
- 				sound-dai = <&tohdmitx TOHDMITX_I2S_IN_B>;
- 			};
-+
-+			codec-1 {
-+				sound-dai = <&toacodec TOACODEC_IN_B>;
-+			};
- 		};
- 
--		/* hdmi glue */
-+		/* i2s jack output interface */
- 		dai-link-7 {
-+			sound-dai = <&tdmif_c>;
-+			dai-format = "i2s";
-+			dai-tdm-slot-tx-mask-0 = <1 1>;
-+			mclk-fs = <256>;
-+
-+			codec-0 {
-+				sound-dai = <&tohdmitx TOHDMITX_I2S_IN_C>;
-+			};
-+
-+			codec-1 {
-+				sound-dai = <&toacodec TOACODEC_IN_C>;
-+			};
-+		};
-+
-+		/* hdmi glue */
-+		dai-link-8 {
- 			sound-dai = <&tohdmitx TOHDMITX_I2S_OUT>;
- 
- 			codec {
- 				sound-dai = <&hdmi_tx>;
- 			};
- 		};
-+
-+		/* acodec glue */
-+		dai-link-9 {
-+			sound-dai = <&toacodec TOACODEC_OUT>;
-+
-+			codec {
-+				sound-dai = <&acodec>;
-+			};
-+		};
- 	};
- };
- 
-+&acodec {
-+	AVDD-supply = <&vddao_1v8>;
-+	status = "okay";
-+};
-+
- &arb {
- 	status = "okay";
- };
-@@ -505,6 +562,10 @@
- 	status = "okay";
- };
- 
-+&tdmif_c {
-+	status = "okay";
-+};
-+
- &tdmin_a {
- 	status = "okay";
- };
-@@ -525,6 +586,14 @@
- 	status = "okay";
- };
- 
-+&tdmout_c {
-+	status = "okay";
-+};
-+
-+&toacodec {
-+	status = "okay";
-+};
-+
- &tohdmitx {
- 	status = "okay";
- };
--- 
-2.17.1
-

buildroot-external/board/hardkernel/patches/uboot/0001-Amlogic-w400-read-ethaddr-from-efuse.patch

@@ -1,22 +1,25 @@
-From b93c598b1acfe59ffac342d114483af8a45a78ac Mon Sep 17 00:00:00 2001
+From f40f83d023b2e1dd82e751aee35c1f0d386b8b4f Mon Sep 17 00:00:00 2001
+Message-Id: <f40f83d023b2e1dd82e751aee35c1f0d386b8b4f.1602104035.git.stefan@agner.ch>
 From: Pascal Vizeli <pvizeli@syshack.ch>
 Date: Sat, 1 Feb 2020 20:55:39 +0000
-Subject: [PATCH 1/1] Amlogic w400: read ethaddr from efuse
+Subject: [PATCH 1/3] Amlogic w400: read ethaddr from efuse
 
 Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
 ---
- board/amlogic/w400/w400.c | 25 ++++++++++++++++++++++++-
- 1 file changed, 24 insertions(+), 1 deletion(-)
+ board/amlogic/w400/w400.c | 27 ++++++++++++++++++++++++---
+ 1 file changed, 24 insertions(+), 3 deletions(-)
 
 diff --git a/board/amlogic/w400/w400.c b/board/amlogic/w400/w400.c
-index e60dc3a622..d4028c6a39 100644
+index 47a51710dc..d74aab899a 100644
 --- a/board/amlogic/w400/w400.c
 +++ b/board/amlogic/w400/w400.c
-@@ -6,13 +6,36 @@
+@@ -6,15 +6,36 @@
  
  #include <common.h>
  #include <dm.h>
 -#include <env_internal.h>
+-#include <init.h>
+-#include <net.h>
 +#include <env.h>
  #include <asm/io.h>
 +#include <asm/arch/sm.h>
@@ -51,5 +54,5 @@ index e60dc3a622..d4028c6a39 100644
  	return 0;
  }
 -- 
-2.17.1
+2.28.0
 

buildroot-external/board/hardkernel/patches/uboot/0002-ARM-meson-isolate-loading-of-socinfo.patch

@@ -1,10 +1,10 @@
-From fb41bcaf0e61e78bc40addb1312040a2bc6a69b7 Mon Sep 17 00:00:00 2001
-Message-Id: <fb41bcaf0e61e78bc40addb1312040a2bc6a69b7.1598875349.git.stefan@agner.ch>
-In-Reply-To: <c12338d22649e46aed12ebe60d897112f045fda9.1598875349.git.stefan@agner.ch>
-References: <c12338d22649e46aed12ebe60d897112f045fda9.1598875349.git.stefan@agner.ch>
+From c67fb4dbb332ed38bc7fbee13079e5ea11390f4e Mon Sep 17 00:00:00 2001
+Message-Id: <c67fb4dbb332ed38bc7fbee13079e5ea11390f4e.1602104035.git.stefan@agner.ch>
+In-Reply-To: <f40f83d023b2e1dd82e751aee35c1f0d386b8b4f.1602104035.git.stefan@agner.ch>
+References: <f40f83d023b2e1dd82e751aee35c1f0d386b8b4f.1602104035.git.stefan@agner.ch>
 From: Stefan Agner <stefan@agner.ch>
 Date: Mon, 31 Aug 2020 13:40:18 +0200
-Subject: [PATCH 2/4] ARM: meson: isolate loading of socinfo
+Subject: [PATCH 2/3] ARM: meson: isolate loading of socinfo
 
 Move loading of socinfo into a separate function so the value can be
 reused later.
@@ -15,10 +15,10 @@ Signed-off-by: Stefan Agner <stefan@agner.ch>
  1 file changed, 18 insertions(+), 2 deletions(-)
 
 diff --git a/arch/arm/mach-meson/board-info.c b/arch/arm/mach-meson/board-info.c
-index 0d3b40a249..e305d60dca 100644
+index 3abb27e03b..cfcd5bbd3b 100644
 --- a/arch/arm/mach-meson/board-info.c
 +++ b/arch/arm/mach-meson/board-info.c
-@@ -123,12 +123,16 @@ static void print_board_model(void)
+@@ -126,12 +126,16 @@ static void print_board_model(void)
  	printf("Model: %s\n", model ? model : "Unknown");
  }
  
@@ -37,7 +37,7 @@ index 0d3b40a249..e305d60dca 100644
  
  	/* find the offset of compatible node */
  	nodeoffset = fdt_node_offset_by_compatible(gd->fdt_blob, -1,
-@@ -155,8 +159,20 @@ int show_board_info(void)
+@@ -158,8 +162,20 @@ int show_board_info(void)
  		return 0;
  	}
  

buildroot-external/board/hardkernel/patches/uboot/0003-meson-Add-board_rev-to-env.patch

@@ -1,10 +1,10 @@
-From 15ce807d420324bc209772b843d4004619e0cdaf Mon Sep 17 00:00:00 2001
-Message-Id: <15ce807d420324bc209772b843d4004619e0cdaf.1598875349.git.stefan@agner.ch>
-In-Reply-To: <c12338d22649e46aed12ebe60d897112f045fda9.1598875349.git.stefan@agner.ch>
-References: <c12338d22649e46aed12ebe60d897112f045fda9.1598875349.git.stefan@agner.ch>
+From bb86524d84909ffe5d1d6ff3afe41d26396ba561 Mon Sep 17 00:00:00 2001
+Message-Id: <bb86524d84909ffe5d1d6ff3afe41d26396ba561.1602104035.git.stefan@agner.ch>
+In-Reply-To: <f40f83d023b2e1dd82e751aee35c1f0d386b8b4f.1602104035.git.stefan@agner.ch>
+References: <f40f83d023b2e1dd82e751aee35c1f0d386b8b4f.1602104035.git.stefan@agner.ch>
 From: Pascal Vizeli <pvizeli@syshack.ch>
 Date: Tue, 4 Aug 2020 13:50:57 +0000
-Subject: [PATCH 3/4] meson: Add board_rev to env
+Subject: [PATCH 3/3] meson: Add board_rev to env
 
 Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
 Signed-off-by: Stefan Agner <stefan@agner.ch>
@@ -35,10 +35,10 @@ index a90fe55081..c67d12d06c 100644
 +
  #endif /* __MESON_BOOT_H__ */
 diff --git a/arch/arm/mach-meson/board-info.c b/arch/arm/mach-meson/board-info.c
-index e305d60dca..3c40d6cd27 100644
+index cfcd5bbd3b..3ea7eb7251 100644
 --- a/arch/arm/mach-meson/board-info.c
 +++ b/arch/arm/mach-meson/board-info.c
-@@ -183,3 +183,15 @@ int show_board_info(void)
+@@ -186,3 +186,15 @@ int show_board_info(void)
  
  	return 0;
  }

buildroot-external/board/intel/ova/kernel.config

@@ -37,4 +37,10 @@ CONFIG_HYPERV_KEYBOARD=m
 CONFIG_HYPERV_STORAGE=y
 CONFIG_HYPERV_NET=y
 CONFIG_HYPERV_VSOCKETS=m
+CONFIG_PCI_HYPERV=m
+CONFIG_PCI_HYPERV_INTERFACE=m
 CONFIG_FB_HYPERV=y
+
+CONFIG_IGBVF=m
+CONFIG_IXGBEVF=m
+CONFIG_I40EVF=m

buildroot-external/board/raspberrypi/boot-env.txt

@@ -9,6 +9,9 @@ kernel=u-boot.bin
 # uncomment for aarch64 bit support
 #arm_64bit=1
 
+# uncomment to enable primary UART console
+#enable_uart=1
+
 # uncomment if you get no picture on HDMI for a default "safe" mode
 #hdmi_safe=1
 
@@ -46,8 +49,8 @@ kernel=u-boot.bin
 # uncomment for composite PAL
 #sdtv_mode=2
 
-#uncomment to overclock the arm. 700 MHz is the default.
-#arm_freq=800
+# Uncomment to disable continous SD-card poll (for USB SSD)
+#dtparam=sd_poll_once=on
 
 # Uncomment some or all of these to enable the optional hardware interfaces
 #dtparam=i2c_arm=on

buildroot-external/board/raspberrypi/patches/uboot/0001-rpi-Use-CONFIG_OF_BOARD-instead-of-CONFIG_EMBED.patch

@@ -1,7 +1,8 @@
-From 0f45c3f2f46b62f767ef225b258f927ad88ca360 Mon Sep 17 00:00:00 2001
+From a04331a6ba7334282836bbaa76e979c4e6be3900 Mon Sep 17 00:00:00 2001
+Message-Id: <a04331a6ba7334282836bbaa76e979c4e6be3900.1602102849.git.stefan@agner.ch>
 From: Pascal Vizeli <pvizeli@syshack.ch>
 Date: Tue, 10 Dec 2019 09:48:46 +0000
-Subject: [PATCH 1/1] rpi: Use CONFIG_OF_BOARD instead of CONFIG_EMBED
+Subject: [PATCH 1/2] rpi: Use CONFIG_OF_BOARD instead of CONFIG_EMBED
 
 Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
 ---
@@ -13,7 +14,7 @@ Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
  5 files changed, 5 insertions(+), 5 deletions(-)
 
 diff --git a/configs/rpi_0_w_defconfig b/configs/rpi_0_w_defconfig
-index fe5a7763a6..ed7f9381e9 100644
+index bba5e12b12..0241f4c6d3 100644
 --- a/configs/rpi_0_w_defconfig
 +++ b/configs/rpi_0_w_defconfig
 @@ -17,7 +17,7 @@ CONFIG_CMD_GPIO=y
@@ -22,11 +23,11 @@ index fe5a7763a6..ed7f9381e9 100644
  CONFIG_CMD_FS_UUID=y
 -CONFIG_OF_EMBED=y
 +CONFIG_OF_BOARD=y
- CONFIG_DEFAULT_DEVICE_TREE="bcm2835-rpi-zero-w"
- CONFIG_ENV_FAT_INTERFACE="mmc"
  CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
+ CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+ CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 diff --git a/configs/rpi_2_defconfig b/configs/rpi_2_defconfig
-index bf331c0ad0..52e3c3b234 100644
+index 1c2bbb29ce..9573e475f4 100644
 --- a/configs/rpi_2_defconfig
 +++ b/configs/rpi_2_defconfig
 @@ -17,7 +17,7 @@ CONFIG_CMD_GPIO=y
@@ -35,11 +36,11 @@ index bf331c0ad0..52e3c3b234 100644
  CONFIG_CMD_FS_UUID=y
 -CONFIG_OF_EMBED=y
 +CONFIG_OF_BOARD=y
- CONFIG_DEFAULT_DEVICE_TREE="bcm2836-rpi-2-b"
- CONFIG_ENV_FAT_INTERFACE="mmc"
  CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
+ CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+ CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 diff --git a/configs/rpi_3_32b_defconfig b/configs/rpi_3_32b_defconfig
-index c2417a0ec9..191962f0f7 100644
+index b8a3d17f43..252df994e6 100644
 --- a/configs/rpi_3_32b_defconfig
 +++ b/configs/rpi_3_32b_defconfig
 @@ -18,7 +18,7 @@ CONFIG_CMD_GPIO=y
@@ -48,11 +49,11 @@ index c2417a0ec9..191962f0f7 100644
  CONFIG_CMD_FS_UUID=y
 -CONFIG_OF_EMBED=y
 +CONFIG_OF_BOARD=y
- CONFIG_DEFAULT_DEVICE_TREE="bcm2837-rpi-3-b"
- CONFIG_ENV_FAT_INTERFACE="mmc"
  CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
+ CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+ CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 diff --git a/configs/rpi_3_defconfig b/configs/rpi_3_defconfig
-index 4fa682539c..03a2356d3d 100644
+index 9b281a4f15..1e9ee6122e 100644
 --- a/configs/rpi_3_defconfig
 +++ b/configs/rpi_3_defconfig
 @@ -18,7 +18,7 @@ CONFIG_CMD_GPIO=y
@@ -61,11 +62,11 @@ index 4fa682539c..03a2356d3d 100644
  CONFIG_CMD_FS_UUID=y
 -CONFIG_OF_EMBED=y
 +CONFIG_OF_BOARD=y
- CONFIG_DEFAULT_DEVICE_TREE="bcm2837-rpi-3-b"
- CONFIG_ENV_FAT_INTERFACE="mmc"
  CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
+ CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+ CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 diff --git a/configs/rpi_defconfig b/configs/rpi_defconfig
-index 2c04b3334e..bf00d8b669 100644
+index b5ad53c37b..223fc03275 100644
 --- a/configs/rpi_defconfig
 +++ b/configs/rpi_defconfig
 @@ -17,7 +17,7 @@ CONFIG_CMD_GPIO=y
@@ -74,8 +75,9 @@ index 2c04b3334e..bf00d8b669 100644
  CONFIG_CMD_FS_UUID=y
 -CONFIG_OF_EMBED=y
 +CONFIG_OF_BOARD=y
- CONFIG_DEFAULT_DEVICE_TREE="bcm2835-rpi-b"
- CONFIG_ENV_FAT_INTERFACE="mmc"
  CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
+ CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+ CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 -- 
-2.17.1
+2.28.0
+

buildroot-external/board/raspberrypi/patches/uboot/0002-avoid-block-uart-write.patch

@@ -1,49 +0,0 @@
-From 5e960cc9b208c53d5385d5a2f6c7f380e9499d4c Mon Sep 17 00:00:00 2001
-From: Alexandru Costache <alexandru@balena.io>
-Date: Wed, 18 Mar 2020 16:54:28 +0100
-Subject: [PATCH] Add a retry limit when writing to uart console
-
-Seems that if the serial console is incorrectly
-configured in the dtb, writing to it may block indefinitely,
-thus preventing the board from booting.
-
-Let's add a retry count to unblock in such cases.
-
-Upstream-status: Inappropriate [configuration]
-Signed-off-by: Alexandru Costache <alexandru@balena.io>
----
- drivers/serial/serial_bcm283x_mu.c | 12 +++++++++---
- 1 file changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/serial/serial_bcm283x_mu.c b/drivers/serial/serial_bcm283x_mu.c
-index bd1d89ec83..bd033d14c4 100644
---- a/drivers/serial/serial_bcm283x_mu.c
-+++ b/drivers/serial/serial_bcm283x_mu.c
-@@ -49,7 +49,7 @@ struct bcm283x_mu_regs {
- struct bcm283x_mu_priv {
- 	struct bcm283x_mu_regs *regs;
- };
--
-+static uint16_t putc_retry = 0;
- static int bcm283x_mu_serial_getc(struct udevice *dev);
- 
- static int bcm283x_mu_serial_setbrg(struct udevice *dev, int baudrate)
-@@ -105,8 +105,14 @@ static int bcm283x_mu_serial_putc(struct udevice *dev, const char data)
- 	struct bcm283x_mu_regs *regs = priv->regs;
- 
- 	/* Wait until there is space in the FIFO */
--	if (!(readl(&regs->lsr) & BCM283X_MU_LSR_TX_EMPTY))
--		return -EAGAIN;
-+	if (!(readl(&regs->lsr) & BCM283X_MU_LSR_TX_EMPTY)) {
-+		if (++putc_retry) {
-+			return -EAGAIN;
-+		} else {
-+			/* Couldn't write for too long, drop char */
-+			return 0;
-+		}
-+	}
- 
- 	/* Send the character */
- 	writel(data, &regs->io);
--- 
-2.17.1

buildroot-external/board/raspberrypi/patches/uboot/0002-raspberrypi-Disable-simple-framebuffer-support.patch

@@ -1,7 +1,10 @@
-From 68e65b1e3859d4baf41d1e5f6525ff7ace778ba1 Mon Sep 17 00:00:00 2001
+From cc40a554b003df9b07f8a55f69a94d7393d81cbc Mon Sep 17 00:00:00 2001
+Message-Id: <cc40a554b003df9b07f8a55f69a94d7393d81cbc.1602102849.git.stefan@agner.ch>
+In-Reply-To: <a04331a6ba7334282836bbaa76e979c4e6be3900.1602102849.git.stefan@agner.ch>
+References: <a04331a6ba7334282836bbaa76e979c4e6be3900.1602102849.git.stefan@agner.ch>
 From: Florin Sarbu <florin@balena.io>
 Date: Thu, 12 Sep 2019 12:31:31 +0200
-Subject: [PATCH] raspberrypi: Disable simple framebuffer support
+Subject: [PATCH 2/2] raspberrypi: Disable simple framebuffer support
 
 On 4.19 kernels this u-boot driver clashes with bcm2708_fb.
 So let's disable it from here so that we have bcm2708_fb
@@ -17,10 +20,10 @@ Signed-off-by: Florin Sarbu <florin@balena.io>
  3 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c
-index 153a1fd..c7bd399 100644
+index 6b1fa5fc14..5cfee7c00a 100644
 --- a/board/raspberrypi/rpi/rpi.c
 +++ b/board/raspberrypi/rpi/rpi.c
-@@ -482,7 +482,7 @@ int ft_board_setup(void *blob, bd_t *bd)
+@@ -485,7 +485,7 @@ int ft_board_setup(void *blob, struct bd_info *bd)
  	 * should be more intelligent, and e.g. only do this if no enabled DT
  	 * node exists for the "real" graphics driver.
  	 */
@@ -30,7 +33,7 @@ index 153a1fd..c7bd399 100644
  #ifdef CONFIG_EFI_LOADER
  	/* Reserve the spin table */
 diff --git a/common/Makefile b/common/Makefile
-index 0de60b3..2848d98 100644
+index 2e7a090588..b3985cc04d 100644
 --- a/common/Makefile
 +++ b/common/Makefile
 @@ -50,7 +50,7 @@ ifndef CONFIG_DM_VIDEO
@@ -43,10 +46,10 @@ index 0de60b3..2848d98 100644
  obj-$(CONFIG_MENU) += menu.o
  obj-$(CONFIG_UPDATE_TFTP) += update.o
 diff --git a/include/configs/rpi.h b/include/configs/rpi.h
-index a38bf20..e2760b0 100644
+index 834f1cd236..19a0d611c4 100644
 --- a/include/configs/rpi.h
 +++ b/include/configs/rpi.h
-@@ -60,8 +60,8 @@
+@@ -65,8 +65,8 @@
  /* GPIO */
  #define CONFIG_BCM2835_GPIO
  /* LCD */
@@ -58,5 +61,5 @@ index a38bf20..e2760b0 100644
  #ifdef CONFIG_CMD_USB
  #define CONFIG_TFTP_TSIZE
 -- 
-2.7.4
+2.28.0
 

buildroot-external/board/raspberrypi/rootfs-overlay/usr/lib/udev/rules.d/99-com.rules

@@ -1,4 +1,5 @@
-KERNEL=="ttyAMA[01]", PROGRAM="/bin/sh -c '\
+
+KERNEL=="ttyAMA0", PROGRAM="/bin/sh -c '\
 	ALIASES=/proc/device-tree/aliases; \
 	if cmp -s $ALIASES/uart0 $ALIASES/serial0; then \
 		echo 0;\
@@ -9,6 +10,19 @@ KERNEL=="ttyAMA[01]", PROGRAM="/bin/sh -c '\
 	fi\
 '", SYMLINK+="serial%c"
 
+KERNEL=="ttyAMA1", PROGRAM="/bin/sh -c '\
+	ALIASES=/proc/device-tree/aliases; \
+	if [ -e /dev/ttyAMA0 ]; then \
+		exit 1; \
+	elif cmp -s $ALIASES/uart0 $ALIASES/serial0; then \
+		echo 0;\
+	elif cmp -s $ALIASES/uart0 $ALIASES/serial1; then \
+		echo 1; \
+	else \
+		exit 1; \
+	fi\
+'", SYMLINK+="serial%c"
+
 KERNEL=="ttyS0", PROGRAM="/bin/sh -c '\
 	ALIASES=/proc/device-tree/aliases; \
 	if cmp -s $ALIASES/uart1 $ALIASES/serial0; then \

buildroot-external/configs/odroid_c2_defconfig

@@ -22,7 +22,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-c2 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-c2/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.7.19"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.9.1"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/kernel-amlogic.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/device-support.config"
@@ -84,12 +84,12 @@ BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.01"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="odroid-c2"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/bootloader/uboot.config $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-c2/uboot.config"
 BR2_TARGET_UBOOT_BOOT_SCRIPT=y
 BR2_TARGET_UBOOT_BOOT_SCRIPT_SOURCE="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-c2/uboot-boot.ush"
-BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_7=y
+BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_4=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_GPTFDISK=y

buildroot-external/configs/odroid_n2_defconfig

@@ -22,7 +22,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-n2 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-n2/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.7.19"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.9.1"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/kernel-amlogic.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/device-support.config"
@@ -84,12 +84,12 @@ BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.01"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="odroid-n2"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/bootloader/uboot.config $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-n2/uboot.config"
 BR2_TARGET_UBOOT_BOOT_SCRIPT=y
 BR2_TARGET_UBOOT_BOOT_SCRIPT_SOURCE="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-n2/uboot-boot.ush"
-BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_7=y
+BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_4=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_GPTFDISK=y

buildroot-external/configs/odroid_xu4_defconfig

@@ -23,7 +23,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-xu4 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-xu4/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.7.19"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.9.1"
 BR2_LINUX_KERNEL_DEFCONFIG="exynos"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/device-support.config"
 BR2_LINUX_KERNEL_LZ4=y
@@ -86,14 +86,14 @@ BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.01"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="odroid-xu3"
 BR2_TARGET_UBOOT_NEEDS_DTC=y
 BR2_TARGET_UBOOT_FORMAT_DTB_BIN=y
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/bootloader/uboot.config $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-xu4/uboot.config"
 BR2_TARGET_UBOOT_BOOT_SCRIPT=y
 BR2_TARGET_UBOOT_BOOT_SCRIPT_SOURCE="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-xu4/uboot-boot.ush"
-BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_7=y
+BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_4=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_GPTFDISK=y

buildroot-external/configs/rpi0_w_defconfig

@@ -87,7 +87,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.01"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_0_w"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/bootloader/uboot.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/uboot.config"
 BR2_TARGET_UBOOT_BOOT_SCRIPT=y

buildroot-external/configs/rpi2_defconfig

@@ -86,7 +86,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.01"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_2"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/bootloader/uboot.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/uboot.config"
 BR2_TARGET_UBOOT_BOOT_SCRIPT=y

buildroot-external/configs/rpi3_64_defconfig

@@ -87,7 +87,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.01"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_3"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/bootloader/uboot.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/uboot.config"
 BR2_TARGET_UBOOT_BOOT_SCRIPT=y

buildroot-external/configs/rpi3_defconfig

@@ -87,7 +87,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.01"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_3_32b"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/bootloader/uboot.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/uboot.config"
 BR2_TARGET_UBOOT_BOOT_SCRIPT=y

buildroot-external/configs/rpi4_64_defconfig

@@ -88,7 +88,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.07"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_4"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/bootloader/uboot.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/uboot.config"
 BR2_TARGET_UBOOT_BOOT_SCRIPT=y

buildroot-external/configs/rpi4_defconfig

@@ -88,7 +88,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.01"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_4_32b"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/bootloader/uboot.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/uboot.config"
 BR2_TARGET_UBOOT_BOOT_SCRIPT=y

buildroot-external/configs/rpi_defconfig

@@ -86,7 +86,7 @@ BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.01"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/bootloader/uboot.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/uboot.config"
 BR2_TARGET_UBOOT_BOOT_SCRIPT=y

buildroot-external/configs/tinker_defconfig

@@ -88,14 +88,14 @@ BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
 BR2_TARGET_UBOOT=y
 BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.01"
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2020.10"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="tinker-s-rk3288"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/bootloader/uboot.config $(BR2_EXTERNAL_HASSOS_PATH)/board/asus/tinker/uboot.config"
 BR2_TARGET_UBOOT_FORMAT_DTB_BIN=y
 BR2_TARGET_UBOOT_FORMAT_DTB_IMG=y
 BR2_TARGET_UBOOT_NEEDS_PYLIBFDT=y
 BR2_TARGET_UBOOT_SPL=y
-BR2_TARGET_UBOOT_SPL_NAME="spl/u-boot-spl.bin tpl/u-boot-tpl.bin"
+BR2_TARGET_UBOOT_SPL_NAME="idbloader.img"
 BR2_TARGET_UBOOT_BOOT_SCRIPT=y
 BR2_TARGET_UBOOT_BOOT_SCRIPT_SOURCE="$(BR2_EXTERNAL_HASSOS_PATH)/board/asus/tinker/uboot-boot.ush"
 BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_4=y

buildroot-external/meta

@@ -1,5 +1,5 @@
 VERSION_MAJOR=5
-VERSION_BUILD=2
+VERSION_BUILD=4
 
 HASSOS_NAME="HassOS"
 HASSOS_ID="hassos"

buildroot-external/package/bluetooth-bcm43xx/bluetooth-bcm43xx.mk

@@ -11,8 +11,8 @@ BLUETOOTH_BCM43XX_SITE = $(BR2_EXTERNAL_HASSOS_PATH)/package/bluetooth-bcm43xx
 BLUETOOTH_BCM43XX_SITE_METHOD = local
 
 define BLUETOOTH_BCM43XX_BUILD_CMDS
-	curl -L -o $(@D)/BCM43430A1.hcd https://raw.githubusercontent.com/RPi-Distro/bluez-firmware/fff76cb15527c435ce99a9787848eacd6288282c/broadcom/BCM43430A1.hcd
-	curl -L -o $(@D)/BCM4345C0.hcd https://raw.githubusercontent.com/RPi-Distro/bluez-firmware/fff76cb15527c435ce99a9787848eacd6288282c/broadcom/BCM4345C0.hcd
+	curl -L -o $(@D)/BCM43430A1.hcd https://raw.githubusercontent.com/RPi-Distro/bluez-firmware/a4e08822e3f24a6211f6ac94bc98b7ef87700c70/broadcom/BCM43430A1.hcd
+	curl -L -o $(@D)/BCM4345C0.hcd https://raw.githubusercontent.com/RPi-Distro/bluez-firmware/a4e08822e3f24a6211f6ac94bc98b7ef87700c70/broadcom/BCM4345C0.hcd
 	curl -L -o $(@D)/btuart https://raw.githubusercontent.com/RPi-Distro/pi-bluetooth/cbdbcb66bcc5b9af05f1a9fffe2254c872bb0ace/usr/bin/btuart
 	curl -L -o $(@D)/bthelper https://raw.githubusercontent.com/RPi-Distro/pi-bluetooth/cbdbcb66bcc5b9af05f1a9fffe2254c872bb0ace/usr/bin/bthelper
 	curl -L -o $(@D)/90-pi-bluetooth.rules https://raw.githubusercontent.com/RPi-Distro/pi-bluetooth/cbdbcb66bcc5b9af05f1a9fffe2254c872bb0ace/lib/udev/rules.d/90-pi-bluetooth.rules

buildroot-external/package/hassio/builder/hostapp.sh

@@ -26,12 +26,14 @@ DNS="homeassistant/${ARCH}-hassio-dns"
 AUDIO="homeassistant/${ARCH}-hassio-audio"
 CLI="homeassistant/${ARCH}-hassio-cli"
 MULTICAST="homeassistant/${ARCH}-hassio-multicast"
+OBSERVER="homeassistant/${ARCH}-hassio-observer"
 
 SUPERVISOR_VERSION=$(curl -s ${VERSION_URL} | jq -e -r '.supervisor')
 DNS_VERSION=$(curl -s ${VERSION_URL} | jq -e -r '.dns')
 CLI_VERSION=$(curl -s ${VERSION_URL} | jq -e -r '.cli')
 AUDIO_VERSION=$(curl -s ${VERSION_URL} | jq -e -r '.audio')
 MULTICAST_VERSION=$(curl -s ${VERSION_URL} | jq -e -r '.multicast')
+OBSERVER_VERSION=$(curl -s ${VERSION_URL} | jq -e -r '.observer')
 
 # Make image
 dd if=/dev/zero of=${DATA_IMG} bs=1G count=1
@@ -72,6 +74,7 @@ docker pull "${CLI}:${CLI_VERSION}"
 docker pull "${DNS}:${DNS_VERSION}"
 docker pull "${AUDIO}:${AUDIO_VERSION}"
 docker pull "${MULTICAST}:${MULTICAST_VERSION}"
+docker pull "${OBSERVER}:${OBSERVER_VERSION}"
 
 # Setup AppArmor
 mkdir -p "/mnt/data/supervisor/apparmor"

buildroot-external/patches/systemd/0002-time-wait-sync-log-inotify-errors.patch

@@ -0,0 +1,23 @@
+From 4a4298ef78e943d36f3b8d8e78bfa21b1506961e Mon Sep 17 00:00:00 2001
+From: Aman Gupta Karmani <aman@tmm1.net>
+Date: Mon, 12 Oct 2020 13:39:26 -0700
+Subject: [PATCH] time-wait-sync: log errors trying to watch
+ /run/systemd/timesync
+
+---
+ src/time-wait-sync/time-wait-sync.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/time-wait-sync/time-wait-sync.c b/src/time-wait-sync/time-wait-sync.c
+index 96072445f6e..c8ec4850426 100644
+--- a/src/time-wait-sync/time-wait-sync.c
++++ b/src/time-wait-sync/time-wait-sync.c
+@@ -50,7 +50,7 @@ static void clock_state_release(ClockState *sp) {
+ static int clock_state_update(ClockState *sp, sd_event *event);
+ 
+ static int update_notify_run_systemd_timesync(ClockState *sp) {
+-        sp->run_systemd_timesync_wd = inotify_add_watch(sp->inotify_fd, "/run/systemd/timesync", IN_CREATE|IN_DELETE_SELF);
++        sp->run_systemd_timesync_wd = inotify_add_watch_and_warn(sp->inotify_fd, "/run/systemd/timesync", IN_CREATE|IN_DELETE_SELF);
+         return sp->run_systemd_timesync_wd;
+ }
+ 

buildroot-external/patches/systemd/0003-fix-inotify-watches.patch

@@ -0,0 +1,54 @@
+From f6f4f5fe5395a57f10dd446c7266c53f0673eaac Mon Sep 17 00:00:00 2001
+From: Balaji Punnuru <balaji_punnuru@cable.comcast.com>
+Date: Thu, 9 Apr 2020 12:21:49 -0400
+Subject: [PATCH] util: return the correct correct wd from inotify helpers
+
+We need to propagate the acquired watch descriptors because our callers
+are counting on them.
+
+[Lennart: this is split out of #15381 and simplified]
+---
+ src/basic/fs-util.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/src/basic/fs-util.c b/src/basic/fs-util.c
+index 558cafbcaf5..ef3b5a51842 100644
+--- a/src/basic/fs-util.c
++++ b/src/basic/fs-util.c
+@@ -692,28 +692,30 @@ int unlink_or_warn(const char *filename) {
+ 
+ int inotify_add_watch_fd(int fd, int what, uint32_t mask) {
+         char path[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int) + 1];
+-        int r;
++        int wd;
+ 
+         /* This is like inotify_add_watch(), except that the file to watch is not referenced by a path, but by an fd */
+         xsprintf(path, "/proc/self/fd/%i", what);
+ 
+-        r = inotify_add_watch(fd, path, mask);
+-        if (r < 0)
++        wd = inotify_add_watch(fd, path, mask);
++        if (wd < 0)
+                 return -errno;
+ 
+-        return r;
++        return wd;
+ }
+ 
+ int inotify_add_watch_and_warn(int fd, const char *pathname, uint32_t mask) {
++        int wd;
+ 
+-        if (inotify_add_watch(fd, pathname, mask) < 0) {
++        wd = inotify_add_watch(fd, pathname, mask);
++        if (wd < 0) {
+                 if (errno == ENOSPC)
+                         return log_error_errno(errno, "Failed to add a watch for %s: inotify watch limit reached", pathname);
+ 
+                 return log_error_errno(errno, "Failed to add a watch for %s: %m", pathname);
+         }
+ 
+-        return 0;
++        return wd;
+ }
+ 
+ static bool unsafe_transition(const struct stat *a, const struct stat *b) {

buildroot-external/patches/uboot/2020.07/0002-usb-xhci-Add-missing-cache-flush-in-the-scratchpad-a.patch

@@ -1,41 +0,0 @@
-From b39cd5ba642ddba46268e8d873b952604844c047 Mon Sep 17 00:00:00 2001
-Message-Id: <b39cd5ba642ddba46268e8d873b952604844c047.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Sylwester Nawrocki <s.nawrocki@samsung.com>
-Date: Mon, 25 May 2020 13:39:51 +0200
-Subject: [PATCH 02/20] usb: xhci: Add missing cache flush in the scratchpad
- array initialization
-
-In current code there is no cache flush after initializing the scratchpad
-buffer array with the scratchpad buffer pointers. This leads to a failure
-of the "slot enable" command on the rpi4 board (Broadcom STB PCIe
-controller + VL805 USB hub) - the very first TRB transfer on the command
-ring fails and there is a timeout while waiting for the command completion
-event. After adding the missing cache flush everything seems to be working
-as expected.
-
-Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
----
- drivers/usb/host/xhci-mem.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
-index 2d968aafb0..f446520528 100644
---- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -395,6 +395,9 @@ static int xhci_scratchpad_alloc(struct xhci_ctrl *ctrl)
- 		scratchpad->sp_array[i] = cpu_to_le64(ptr);
- 	}
- 
-+	xhci_flush_cache((uintptr_t)scratchpad->sp_array,
-+			 sizeof(u64) * num_sp);
-+
- 	return 0;
- 
- fail_sp3:
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0003-usb-xhci-Use-only-32-bit-accesses-in-xhci_writeq-xhc.patch

@@ -1,69 +0,0 @@
-From 71343be3dd8d7f04cea781c8369aa77a36ae7123 Mon Sep 17 00:00:00 2001
-Message-Id: <71343be3dd8d7f04cea781c8369aa77a36ae7123.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Sylwester Nawrocki <s.nawrocki@samsung.com>
-Date: Mon, 25 May 2020 13:39:52 +0200
-Subject: [PATCH 03/20] usb: xhci: Use only 32-bit accesses in
- xhci_writeq/xhci_readq
-
-There might be hardware configurations where 64-bit data accesses
-to XHCI registers are not supported properly.  This patch removes
-the readq/writeq so always two 32-bit accesses are used to read/write
-64-bit XHCI registers, similarly as it is done in Linux kernel.
-
-This patch fixes operation of the XHCI controller on RPI4 Broadcom
-BCM2711 SoC based board, where the VL805 USB XHCI controller is
-connected to the PCIe Root Complex, which is attached to the system
-through the SCB bridge.
-
-Even though the architecture is 64-bit the PCIe BAR is 32-bit and likely
-the 64-bit wide register accesses initiated by the CPU are not properly
-translated to a sequence of 32-bit PCIe accesses.
-xhci_readq(), for example, always returns same value in upper and lower
-32-bits, e.g. 0xabcd1234abcd1234 instead of 0x00000000abcd1234.
-
-Cc: Sergey Temerkhanov <s.temerkhanov@gmail.com>
-Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
----
- include/usb/xhci.h | 8 --------
- 1 file changed, 8 deletions(-)
-
-diff --git a/include/usb/xhci.h b/include/usb/xhci.h
-index 20e4a21066..1170c0ac69 100644
---- a/include/usb/xhci.h
-+++ b/include/usb/xhci.h
-@@ -1114,28 +1114,20 @@ static inline void xhci_writel(uint32_t volatile *regs, const unsigned int val)
-  */
- static inline u64 xhci_readq(__le64 volatile *regs)
- {
--#if BITS_PER_LONG == 64
--	return readq(regs);
--#else
- 	__u32 *ptr = (__u32 *)regs;
- 	u64 val_lo = readl(ptr);
- 	u64 val_hi = readl(ptr + 1);
- 	return val_lo + (val_hi << 32);
--#endif
- }
- 
- static inline void xhci_writeq(__le64 volatile *regs, const u64 val)
- {
--#if BITS_PER_LONG == 64
--	writeq(val, regs);
--#else
- 	__u32 *ptr = (__u32 *)regs;
- 	u32 val_lo = lower_32_bits(val);
- 	/* FIXME */
- 	u32 val_hi = upper_32_bits(val);
- 	writel(val_lo, ptr);
- 	writel(val_hi, ptr + 1);
--#endif
- }
- 
- int xhci_hcd_init(int index, struct xhci_hccr **ret_hccr,
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0004-pci-Move-some-PCIe-register-offset-definitions-to-a-.patch

@@ -1,85 +0,0 @@
-From 82024c95e4d00b555f93d93b9f706c4d995ab302 Mon Sep 17 00:00:00 2001
-Message-Id: <82024c95e4d00b555f93d93b9f706c4d995ab302.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Sylwester Nawrocki <s.nawrocki@samsung.com>
-Date: Mon, 25 May 2020 13:39:53 +0200
-Subject: [PATCH 04/20] pci: Move some PCIe register offset definitions to a
- common header
-
-Some PCI Express register offsets are currently defined in multiple
-drivers, move them to a common header to avoid re-definitions and
-as a pre-requisite for adding new PCIe driver.
-While at it replace some spaces with tabs.
-
-Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
----
- drivers/pci/pci-rcar-gen3.c   |  8 --------
- drivers/pci/pcie_intel_fpga.c |  3 ---
- include/pci.h                 | 13 +++++++++++--
- 3 files changed, 11 insertions(+), 13 deletions(-)
-
-diff --git a/drivers/pci/pci-rcar-gen3.c b/drivers/pci/pci-rcar-gen3.c
-index df7b37a592..1f51854ccc 100644
---- a/drivers/pci/pci-rcar-gen3.c
-+++ b/drivers/pci/pci-rcar-gen3.c
-@@ -118,14 +118,6 @@
- #define RCAR_PCI_MAX_RESOURCES	4
- #define MAX_NR_INBOUND_MAPS	6
- 
--#define PCI_EXP_FLAGS		2		/* Capabilities register */
--#define PCI_EXP_FLAGS_TYPE	0x00f0		/* Device/Port type */
--#define PCI_EXP_TYPE_ROOT_PORT	0x4		/* Root Port */
--#define PCI_EXP_LNKCAP		12		/* Link Capabilities */
--#define PCI_EXP_LNKCAP_DLLLARC	0x00100000	/* Data Link Layer Link Active Reporting Capable */
--#define PCI_EXP_SLTCAP		20		/* Slot Capabilities */
--#define PCI_EXP_SLTCAP_PSN	0xfff80000	/* Physical Slot Number */
--
- enum {
- 	RCAR_PCI_ACCESS_READ,
- 	RCAR_PCI_ACCESS_WRITE,
-diff --git a/drivers/pci/pcie_intel_fpga.c b/drivers/pci/pcie_intel_fpga.c
-index aa1903e547..9f102c64c6 100644
---- a/drivers/pci/pcie_intel_fpga.c
-+++ b/drivers/pci/pcie_intel_fpga.c
-@@ -67,9 +67,6 @@
- #define IS_ROOT_PORT(pcie, bdf)				\
- 		((PCI_BUS(bdf) == pcie->first_busno) ? true : false)
- 
--#define PCI_EXP_LNKSTA		18	/* Link Status */
--#define PCI_EXP_LNKSTA_DLLLA	0x2000	/* Data Link Layer Link Active */
--
- /**
-  * struct intel_fpga_pcie - Intel FPGA PCIe controller state
-  * @bus: Pointer to the PCI bus
-diff --git a/include/pci.h b/include/pci.h
-index 19c9244b94..9cd8564436 100644
---- a/include/pci.h
-+++ b/include/pci.h
-@@ -471,10 +471,19 @@
- #define  PCI_EA_FIELD_MASK	0xfffffffc	/* For Base & Max Offset */
- 
- /* PCI Express capabilities */
-+#define PCI_EXP_FLAGS		2	/* Capabilities register */
-+#define  PCI_EXP_FLAGS_TYPE	0x00f0	/* Device/Port type */
-+#define  PCI_EXP_TYPE_ROOT_PORT 0x4	/* Root Port */
- #define PCI_EXP_DEVCAP		4	/* Device capabilities */
--#define  PCI_EXP_DEVCAP_FLR     0x10000000 /* Function Level Reset */
-+#define  PCI_EXP_DEVCAP_FLR	0x10000000 /* Function Level Reset */
- #define PCI_EXP_DEVCTL		8	/* Device Control */
--#define  PCI_EXP_DEVCTL_BCR_FLR 0x8000  /* Bridge Configuration Retry / FLR */
-+#define  PCI_EXP_DEVCTL_BCR_FLR	0x8000  /* Bridge Configuration Retry / FLR */
-+#define PCI_EXP_LNKCAP		12	/* Link Capabilities */
-+#define  PCI_EXP_LNKCAP_DLLLARC	0x00100000 /* Data Link Layer Link Active Reporting Capable */
-+#define PCI_EXP_LNKSTA		18	/* Link Status */
-+#define  PCI_EXP_LNKSTA_DLLLA	0x2000	/* Data Link Layer Link Active */
-+#define PCI_EXP_SLTCAP		20	/* Slot Capabilities */
-+#define  PCI_EXP_SLTCAP_PSN	0xfff80000 /* Physical Slot Number */
- 
- /* Include the ID list */
- 
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0005-rpi4-shorten-a-mapping-for-the-DRAM.patch

@@ -1,33 +0,0 @@
-From 5dddca0c2ca5de72b74a5fca0d3ea67251add760 Mon Sep 17 00:00:00 2001
-Message-Id: <5dddca0c2ca5de72b74a5fca0d3ea67251add760.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-Date: Mon, 25 May 2020 13:39:54 +0200
-Subject: [PATCH 05/20] rpi4: shorten a mapping for the DRAM
-
-Remove the overlap between DRAM and device's IO area.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
-Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
----
- arch/arm/mach-bcm283x/init.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/arm/mach-bcm283x/init.c b/arch/arm/mach-bcm283x/init.c
-index f4d00d892d..f9a5209480 100644
---- a/arch/arm/mach-bcm283x/init.c
-+++ b/arch/arm/mach-bcm283x/init.c
-@@ -39,7 +39,7 @@ static struct mm_region bcm2711_mem_map[] = {
- 	{
- 		.virt = 0x00000000UL,
- 		.phys = 0x00000000UL,
--		.size = 0xfe000000UL,
-+		.size = 0xfc000000UL,
- 		.attrs = PTE_BLOCK_MEMTYPE(MT_NORMAL) |
- 			 PTE_BLOCK_INNER_SHARE
- 	}, {
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0006-rpi4-add-a-mapping-for-the-PCIe-XHCI-controller-MMIO.patch

@@ -1,76 +0,0 @@
-From a326f58940f16b2dc3740fd9e87eb485da939ae5 Mon Sep 17 00:00:00 2001
-Message-Id: <a326f58940f16b2dc3740fd9e87eb485da939ae5.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-Date: Mon, 25 May 2020 13:39:55 +0200
-Subject: [PATCH 06/20] rpi4: add a mapping for the PCIe XHCI controller MMIO
- registers (ARM 64bit)
-
-Create a non-cacheable mapping for the 0x600000000 physical memory region,
-where MMIO registers for the PCIe XHCI controller are instantiated by the
-PCIe bridge.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
-Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
----
- arch/arm/mach-bcm283x/init.c | 18 +++++++++++++++---
- 1 file changed, 15 insertions(+), 3 deletions(-)
-
-diff --git a/arch/arm/mach-bcm283x/init.c b/arch/arm/mach-bcm283x/init.c
-index f9a5209480..cf4c5b245d 100644
---- a/arch/arm/mach-bcm283x/init.c
-+++ b/arch/arm/mach-bcm283x/init.c
-@@ -12,10 +12,15 @@
- #include <dm/device.h>
- #include <fdt_support.h>
- 
-+#define BCM2711_RPI4_PCIE_XHCI_MMIO_PHYS	0x600000000UL
-+#define BCM2711_RPI4_PCIE_XHCI_MMIO_SIZE	0x800000UL
-+
- #ifdef CONFIG_ARM64
- #include <asm/armv8/mmu.h>
- 
--static struct mm_region bcm283x_mem_map[] = {
-+#define MEM_MAP_MAX_ENTRIES (4)
-+
-+static struct mm_region bcm283x_mem_map[MEM_MAP_MAX_ENTRIES] = {
- 	{
- 		.virt = 0x00000000UL,
- 		.phys = 0x00000000UL,
-@@ -35,7 +40,7 @@ static struct mm_region bcm283x_mem_map[] = {
- 	}
- };
- 
--static struct mm_region bcm2711_mem_map[] = {
-+static struct mm_region bcm2711_mem_map[MEM_MAP_MAX_ENTRIES] = {
- 	{
- 		.virt = 0x00000000UL,
- 		.phys = 0x00000000UL,
-@@ -49,6 +54,13 @@ static struct mm_region bcm2711_mem_map[] = {
- 		.attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
- 			 PTE_BLOCK_NON_SHARE |
- 			 PTE_BLOCK_PXN | PTE_BLOCK_UXN
-+	}, {
-+		.virt = BCM2711_RPI4_PCIE_XHCI_MMIO_PHYS,
-+		.phys = BCM2711_RPI4_PCIE_XHCI_MMIO_PHYS,
-+		.size = BCM2711_RPI4_PCIE_XHCI_MMIO_SIZE,
-+		.attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
-+			 PTE_BLOCK_NON_SHARE |
-+			 PTE_BLOCK_PXN | PTE_BLOCK_UXN
- 	}, {
- 		/* List terminator */
- 		0,
-@@ -72,7 +84,7 @@ static void _rpi_update_mem_map(struct mm_region *pd)
- {
- 	int i;
- 
--	for (i = 0; i < 2; i++) {
-+	for (i = 0; i < MEM_MAP_MAX_ENTRIES; i++) {
- 		mem_map[i].virt = pd[i].virt;
- 		mem_map[i].phys = pd[i].phys;
- 		mem_map[i].size = pd[i].size;
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0007-linux-bitfield.h-Add-primitives-for-manipulating-bit.patch

@@ -1,85 +0,0 @@
-From 9c761488487ce27517e2a9e425f4ed0777708c53 Mon Sep 17 00:00:00 2001
-Message-Id: <9c761488487ce27517e2a9e425f4ed0777708c53.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
-Date: Mon, 25 May 2020 13:39:56 +0200
-Subject: [PATCH 07/20] linux/bitfield.h: Add primitives for manipulating
- bitfields both in host- and fixed-endian
-
-Imports Al Viro's original Linux commit 00b0c9b82663a, which contains
-an in depth explanation and two fixes from Johannes Berg:
- e7d4a95da86e0 "bitfield: fix *_encode_bits()",
- 37a3862e12382 "bitfield: add u8 helpers".
-
-Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
-[s.nawrocki: added empty lines between functions and macros]
-Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
----
- include/linux/bitfield.h | 52 ++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 52 insertions(+)
-
-diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
-index 8b9d6fff00..7ad8b088ed 100644
---- a/include/linux/bitfield.h
-+++ b/include/linux/bitfield.h
-@@ -103,4 +103,56 @@
- 		(typeof(_mask))(((_reg) & (_mask)) >> __bf_shf(_mask));	\
- 	})
- 
-+extern void __compiletime_error("value doesn't fit into mask")
-+__field_overflow(void);
-+extern void __compiletime_error("bad bitfield mask")
-+__bad_mask(void);
-+
-+static __always_inline u64 field_multiplier(u64 field)
-+{
-+	if ((field | (field - 1)) & ((field | (field - 1)) + 1))
-+		__bad_mask();
-+	return field & -field;
-+}
-+
-+static __always_inline u64 field_mask(u64 field)
-+{
-+	return field / field_multiplier(field);
-+}
-+
-+#define ____MAKE_OP(type, base, to, from)				\
-+static __always_inline __##type type##_encode_bits(base v, base field)	\
-+{									\
-+	if (__builtin_constant_p(v) && (v & ~field_mask(field)))	\
-+		__field_overflow();					\
-+	return to((v & field_mask(field)) * field_multiplier(field));	\
-+}									\
-+static __always_inline __##type type##_replace_bits(__##type old,	\
-+					base val, base field)		\
-+{									\
-+	return (old & ~to(field)) | type##_encode_bits(val, field);	\
-+}									\
-+static __always_inline void type##p_replace_bits(__##type * p,		\
-+					base val, base field)		\
-+{									\
-+	*p = (*p & ~to(field)) | type##_encode_bits(val, field);	\
-+}									\
-+static __always_inline base type##_get_bits(__##type v, base field)	\
-+{									\
-+	return (from(v) & field) / field_multiplier(field);		\
-+}
-+
-+#define __MAKE_OP(size)							\
-+	____MAKE_OP(le##size, u##size, cpu_to_le##size, le##size##_to_cpu) \
-+	____MAKE_OP(be##size, u##size, cpu_to_be##size, be##size##_to_cpu) \
-+	____MAKE_OP(u##size, u##size, ,)
-+
-+____MAKE_OP(u8, u8, ,)
-+__MAKE_OP(16)
-+__MAKE_OP(32)
-+__MAKE_OP(64)
-+
-+#undef __MAKE_OP
-+#undef ____MAKE_OP
-+
- #endif
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0008-pci-Add-some-PCI-Express-capability-register-offset-.patch

@@ -1,47 +0,0 @@
-From 376bd33efa69abfc6102eb5a56b700c0f1981cf4 Mon Sep 17 00:00:00 2001
-Message-Id: <376bd33efa69abfc6102eb5a56b700c0f1981cf4.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Sylwester Nawrocki <s.nawrocki@samsung.com>
-Date: Mon, 25 May 2020 13:39:57 +0200
-Subject: [PATCH 08/20] pci: Add some PCI Express capability register offset
- definitions
-
-Add PCI Express capability definitions required by the Broadcom
-STB PCIe controller driver.
-
-Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
----
- include/pci.h | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/include/pci.h b/include/pci.h
-index 9cd8564436..281f353916 100644
---- a/include/pci.h
-+++ b/include/pci.h
-@@ -479,11 +479,20 @@
- #define PCI_EXP_DEVCTL		8	/* Device Control */
- #define  PCI_EXP_DEVCTL_BCR_FLR	0x8000  /* Bridge Configuration Retry / FLR */
- #define PCI_EXP_LNKCAP		12	/* Link Capabilities */
-+#define  PCI_EXP_LNKCAP_SLS	0x0000000f /* Supported Link Speeds */
-+#define  PCI_EXP_LNKCAP_MLW	0x000003f0 /* Maximum Link Width */
- #define  PCI_EXP_LNKCAP_DLLLARC	0x00100000 /* Data Link Layer Link Active Reporting Capable */
- #define PCI_EXP_LNKSTA		18	/* Link Status */
-+#define  PCI_EXP_LNKSTA_CLS	0x000f	/* Current Link Speed */
-+#define  PCI_EXP_LNKSTA_CLS_2_5GB 0x0001 /* Current Link Speed 2.5GT/s */
-+#define  PCI_EXP_LNKSTA_CLS_5_0GB 0x0002 /* Current Link Speed 5.0GT/s */
-+#define  PCI_EXP_LNKSTA_CLS_8_0GB 0x0003 /* Current Link Speed 8.0GT/s */
-+#define  PCI_EXP_LNKSTA_NLW	0x03f0	/* Negotiated Link Width */
-+#define  PCI_EXP_LNKSTA_NLW_SHIFT 4	/* start of NLW mask in link status */
- #define  PCI_EXP_LNKSTA_DLLLA	0x2000	/* Data Link Layer Link Active */
- #define PCI_EXP_SLTCAP		20	/* Slot Capabilities */
- #define  PCI_EXP_SLTCAP_PSN	0xfff80000 /* Physical Slot Number */
-+#define PCI_EXP_LNKCTL2		48	/* Link Control 2 */
- 
- /* Include the ID list */
- 
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0009-pci-Add-driver-for-Broadcom-BCM2711-SoC-PCIe-control.patch

@@ -1,686 +0,0 @@
-From 21a9b72b4a28398c9511f3d9e3c1adc1439a8870 Mon Sep 17 00:00:00 2001
-Message-Id: <21a9b72b4a28398c9511f3d9e3c1adc1439a8870.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Sylwester Nawrocki <s.nawrocki@samsung.com>
-Date: Mon, 25 May 2020 13:39:58 +0200
-Subject: [PATCH 09/20] pci: Add driver for Broadcom BCM2711 SoC PCIe
- controller
-
-This patch adds basic driver PCI Express controller found on Broadcom
-set-top-box SoCs, e.g. BCM2711.
-The code is based on Linux upstream driver (pcie-brcmstb.c) with MSI
-handling removed. The inbound access memory region is not currently
-parsed from dma-ranges DT property and a fixed 3GB region is used.
-
-The patch has been tested on RPI4 board, i.e. on BCM2711 SoC with VL805
-USB Host Controller.
-
-Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
-Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
----
- drivers/pci/Kconfig        |   9 +
- drivers/pci/Makefile       |   1 +
- drivers/pci/pcie_brcmstb.c | 623 +++++++++++++++++++++++++++++++++++++
- 3 files changed, 633 insertions(+)
- create mode 100644 drivers/pci/pcie_brcmstb.c
-
-diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig
-index 6d8c22aacf..7e1e51d9ea 100644
---- a/drivers/pci/Kconfig
-+++ b/drivers/pci/Kconfig
-@@ -205,4 +205,13 @@ config PCIE_ROCKCHIP
- 	  Say Y here if you want to enable PCIe controller support on
- 	  Rockchip SoCs.
- 
-+config PCI_BRCMSTB
-+	bool "Broadcom STB PCIe controller"
-+	depends on DM_PCI
-+	depends on ARCH_BCM283X
-+	help
-+	  Say Y here if you want to enable support for PCIe controller
-+	  on Broadcom set-top-box (STB) SoCs.
-+	  This driver currently supports only BCM2711 SoC and RC mode
-+	  of the controller.
- endif
-diff --git a/drivers/pci/Makefile b/drivers/pci/Makefile
-index 955351c5c2..29092916a6 100644
---- a/drivers/pci/Makefile
-+++ b/drivers/pci/Makefile
-@@ -44,3 +44,4 @@ obj-$(CONFIG_PCIE_INTEL_FPGA) += pcie_intel_fpga.o
- obj-$(CONFIG_PCI_KEYSTONE) += pcie_dw_ti.o
- obj-$(CONFIG_PCIE_MEDIATEK) += pcie_mediatek.o
- obj-$(CONFIG_PCIE_ROCKCHIP) += pcie_rockchip.o pcie_rockchip_phy.o
-+obj-$(CONFIG_PCI_BRCMSTB) += pcie_brcmstb.o
-diff --git a/drivers/pci/pcie_brcmstb.c b/drivers/pci/pcie_brcmstb.c
-new file mode 100644
-index 0000000000..dade79e9c8
---- /dev/null
-+++ b/drivers/pci/pcie_brcmstb.c
-@@ -0,0 +1,623 @@
-+// SPDX-License-Identifier: GPL-2.0
-+/*
-+ * Broadcom STB PCIe controller driver
-+ *
-+ * Copyright (C) 2020 Samsung Electronics Co., Ltd.
-+ *
-+ * Based on upstream Linux kernel driver:
-+ * drivers/pci/controller/pcie-brcmstb.c
-+ * Copyright (C) 2009 - 2017 Broadcom
-+ *
-+ * Based driver by Nicolas Saenz Julienne
-+ * Copyright (C) 2020 Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
-+ */
-+
-+#include <common.h>
-+#include <errno.h>
-+#include <dm.h>
-+#include <dm/ofnode.h>
-+#include <pci.h>
-+#include <asm/io.h>
-+#include <linux/bitfield.h>
-+#include <linux/log2.h>
-+#include <linux/iopoll.h>
-+
-+/* Offset of the mandatory PCIe capability config registers */
-+#define BRCM_PCIE_CAP_REGS				0x00ac
-+
-+/* The PCIe controller register offsets */
-+#define PCIE_RC_CFG_VENDOR_SPECIFIC_REG1		0x0188
-+#define  VENDOR_SPECIFIC_REG1_ENDIAN_MODE_BAR2_MASK	0xc
-+#define  VENDOR_SPECIFIC_REG1_LITTLE_ENDIAN		0x0
-+
-+#define PCIE_RC_CFG_PRIV1_ID_VAL3			0x043c
-+#define  CFG_PRIV1_ID_VAL3_CLASS_CODE_MASK		0xffffff
-+
-+#define PCIE_RC_DL_MDIO_ADDR				0x1100
-+#define PCIE_RC_DL_MDIO_WR_DATA				0x1104
-+#define PCIE_RC_DL_MDIO_RD_DATA				0x1108
-+
-+#define PCIE_MISC_MISC_CTRL				0x4008
-+#define  MISC_CTRL_SCB_ACCESS_EN_MASK			0x1000
-+#define  MISC_CTRL_CFG_READ_UR_MODE_MASK		0x2000
-+#define  MISC_CTRL_MAX_BURST_SIZE_MASK			0x300000
-+#define  MISC_CTRL_MAX_BURST_SIZE_128			0x0
-+#define  MISC_CTRL_SCB0_SIZE_MASK			0xf8000000
-+
-+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LO		0x400c
-+#define PCIE_MEM_WIN0_LO(win)	\
-+		PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LO + ((win) * 4)
-+
-+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_HI		0x4010
-+#define PCIE_MEM_WIN0_HI(win)	\
-+		PCIE_MISC_CPU_2_PCIE_MEM_WIN0_HI + ((win) * 4)
-+
-+#define PCIE_MISC_RC_BAR1_CONFIG_LO			0x402c
-+#define  RC_BAR1_CONFIG_LO_SIZE_MASK			0x1f
-+
-+#define PCIE_MISC_RC_BAR2_CONFIG_LO			0x4034
-+#define  RC_BAR2_CONFIG_LO_SIZE_MASK			0x1f
-+#define PCIE_MISC_RC_BAR2_CONFIG_HI			0x4038
-+
-+#define PCIE_MISC_RC_BAR3_CONFIG_LO			0x403c
-+#define  RC_BAR3_CONFIG_LO_SIZE_MASK			0x1f
-+
-+#define PCIE_MISC_PCIE_STATUS				0x4068
-+#define  STATUS_PCIE_PORT_MASK				0x80
-+#define  STATUS_PCIE_PORT_SHIFT				7
-+#define  STATUS_PCIE_DL_ACTIVE_MASK			0x20
-+#define  STATUS_PCIE_DL_ACTIVE_SHIFT			5
-+#define  STATUS_PCIE_PHYLINKUP_MASK			0x10
-+#define  STATUS_PCIE_PHYLINKUP_SHIFT			4
-+
-+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_LIMIT	0x4070
-+#define  MEM_WIN0_BASE_LIMIT_LIMIT_MASK			0xfff00000
-+#define  MEM_WIN0_BASE_LIMIT_BASE_MASK			0xfff0
-+#define  MEM_WIN0_BASE_LIMIT_BASE_HI_SHIFT		12
-+#define PCIE_MEM_WIN0_BASE_LIMIT(win)	\
-+	 PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_LIMIT + ((win) * 4)
-+
-+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_HI		0x4080
-+#define  MEM_WIN0_BASE_HI_BASE_MASK			0xff
-+#define PCIE_MEM_WIN0_BASE_HI(win)	\
-+	 PCIE_MISC_CPU_2_PCIE_MEM_WIN0_BASE_HI + ((win) * 8)
-+
-+#define PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LIMIT_HI		0x4084
-+#define  PCIE_MEM_WIN0_LIMIT_HI_LIMIT_MASK		0xff
-+#define PCIE_MEM_WIN0_LIMIT_HI(win)	\
-+	 PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LIMIT_HI + ((win) * 8)
-+
-+#define PCIE_MISC_HARD_PCIE_HARD_DEBUG			0x4204
-+#define  PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK	0x2
-+#define  PCIE_HARD_DEBUG_SERDES_IDDQ_MASK		0x08000000
-+
-+#define PCIE_MSI_INTR2_CLR				0x4508
-+#define PCIE_MSI_INTR2_MASK_SET				0x4510
-+
-+#define PCIE_EXT_CFG_DATA				0x8000
-+
-+#define PCIE_EXT_CFG_INDEX				0x9000
-+#define  PCIE_EXT_BUSNUM_SHIFT				20
-+#define  PCIE_EXT_SLOT_SHIFT				15
-+#define  PCIE_EXT_FUNC_SHIFT				12
-+
-+#define PCIE_RGR1_SW_INIT_1				0x9210
-+#define  RGR1_SW_INIT_1_PERST_MASK			0x1
-+#define  RGR1_SW_INIT_1_INIT_MASK			0x2
-+
-+/* PCIe parameters */
-+#define BRCM_NUM_PCIE_OUT_WINS				4
-+
-+/* MDIO registers */
-+#define MDIO_PORT0					0x0
-+#define MDIO_DATA_MASK					0x7fffffff
-+#define MDIO_DATA_SHIFT					0
-+#define MDIO_PORT_MASK					0xf0000
-+#define MDIO_PORT_SHIFT					16
-+#define MDIO_REGAD_MASK					0xffff
-+#define MDIO_REGAD_SHIFT				0
-+#define MDIO_CMD_MASK					0xfff00000
-+#define MDIO_CMD_SHIFT					20
-+#define MDIO_CMD_READ					0x1
-+#define MDIO_CMD_WRITE					0x0
-+#define MDIO_DATA_DONE_MASK				0x80000000
-+#define SSC_REGS_ADDR					0x1100
-+#define SET_ADDR_OFFSET					0x1f
-+#define SSC_CNTL_OFFSET					0x2
-+#define SSC_CNTL_OVRD_EN_MASK				0x8000
-+#define SSC_CNTL_OVRD_VAL_MASK				0x4000
-+#define SSC_STATUS_OFFSET				0x1
-+#define SSC_STATUS_SSC_MASK				0x400
-+#define SSC_STATUS_SSC_SHIFT				10
-+#define SSC_STATUS_PLL_LOCK_MASK			0x800
-+#define SSC_STATUS_PLL_LOCK_SHIFT			11
-+
-+/**
-+ * struct brcm_pcie - the PCIe controller state
-+ * @base: Base address of memory mapped IO registers of the controller
-+ * @gen: Non-zero value indicates limitation of the PCIe controller operation
-+ *       to a specific generation (1, 2 or 3)
-+ * @ssc: true indicates active Spread Spectrum Clocking operation
-+ */
-+struct brcm_pcie {
-+	void __iomem		*base;
-+
-+	int			gen;
-+	bool			ssc;
-+};
-+
-+/**
-+ * brcm_pcie_encode_ibar_size() - Encode the inbound "BAR" region size
-+ * @size: The inbound region size
-+ *
-+ * This function converts size of the inbound "BAR" region to the non-linear
-+ * values of the PCIE_MISC_RC_BAR[123]_CONFIG_LO register SIZE field.
-+ *
-+ * Return: The encoded inbound region size
-+ */
-+static int brcm_pcie_encode_ibar_size(u64 size)
-+{
-+	int log2_in = ilog2(size);
-+
-+	if (log2_in >= 12 && log2_in <= 15)
-+		/* Covers 4KB to 32KB (inclusive) */
-+		return (log2_in - 12) + 0x1c;
-+	else if (log2_in >= 16 && log2_in <= 37)
-+		/* Covers 64KB to 32GB, (inclusive) */
-+		return log2_in - 15;
-+
-+	/* Something is awry so disable */
-+	return 0;
-+}
-+
-+/**
-+ * brcm_pcie_rc_mode() - Check if PCIe controller is in RC mode
-+ * @pcie: Pointer to the PCIe controller state
-+ *
-+ * The controller is capable of serving in both RC and EP roles.
-+ *
-+ * Return: true for RC mode, false for EP mode.
-+ */
-+static bool brcm_pcie_rc_mode(struct brcm_pcie *pcie)
-+{
-+	u32 val;
-+
-+	val = readl(pcie->base + PCIE_MISC_PCIE_STATUS);
-+
-+	return (val & STATUS_PCIE_PORT_MASK) >> STATUS_PCIE_PORT_SHIFT;
-+}
-+
-+/**
-+ * brcm_pcie_link_up() - Check whether the PCIe link is up
-+ * @pcie: Pointer to the PCIe controller state
-+ *
-+ * Return: true if the link is up, false otherwise.
-+ */
-+static bool brcm_pcie_link_up(struct brcm_pcie *pcie)
-+{
-+	u32 val, dla, plu;
-+
-+	val = readl(pcie->base + PCIE_MISC_PCIE_STATUS);
-+	dla = (val & STATUS_PCIE_DL_ACTIVE_MASK) >> STATUS_PCIE_DL_ACTIVE_SHIFT;
-+	plu = (val & STATUS_PCIE_PHYLINKUP_MASK) >> STATUS_PCIE_PHYLINKUP_SHIFT;
-+
-+	return dla && plu;
-+}
-+
-+static int brcm_pcie_config_address(const struct udevice *dev, pci_dev_t bdf,
-+				    uint offset, void **paddress)
-+{
-+	struct brcm_pcie *pcie = dev_get_priv(dev);
-+	unsigned int pci_bus = PCI_BUS(bdf);
-+	unsigned int pci_dev = PCI_DEV(bdf);
-+	unsigned int pci_func = PCI_FUNC(bdf);
-+	int idx;
-+
-+	/*
-+	 * Busses 0 (host PCIe bridge) and 1 (its immediate child)
-+	 * are limited to a single device each
-+	 */
-+	if (pci_bus < 2 && pci_dev > 0)
-+		return -EINVAL;
-+
-+	/* Accesses to the RC go right to the RC registers */
-+	if (pci_bus == 0) {
-+		*paddress = pcie->base + offset;
-+		return 0;
-+	}
-+
-+	/* For devices, write to the config space index register */
-+	idx = (pci_bus << PCIE_EXT_BUSNUM_SHIFT)
-+		| (pci_dev << PCIE_EXT_SLOT_SHIFT)
-+		| (pci_func << PCIE_EXT_FUNC_SHIFT);
-+
-+	writel(idx, pcie->base + PCIE_EXT_CFG_INDEX);
-+	*paddress = pcie->base + PCIE_EXT_CFG_DATA + offset;
-+
-+	return 0;
-+}
-+
-+static int brcm_pcie_read_config(const struct udevice *bus, pci_dev_t bdf,
-+				 uint offset, ulong *valuep,
-+				 enum pci_size_t size)
-+{
-+	return pci_generic_mmap_read_config(bus, brcm_pcie_config_address,
-+					    bdf, offset, valuep, size);
-+}
-+
-+static int brcm_pcie_write_config(struct udevice *bus, pci_dev_t bdf,
-+				  uint offset, ulong value,
-+				  enum pci_size_t size)
-+{
-+	return pci_generic_mmap_write_config(bus, brcm_pcie_config_address,
-+					     bdf, offset, value, size);
-+}
-+
-+static const char *link_speed_to_str(unsigned int cls)
-+{
-+	switch (cls) {
-+	case PCI_EXP_LNKSTA_CLS_2_5GB: return "2.5";
-+	case PCI_EXP_LNKSTA_CLS_5_0GB: return "5.0";
-+	case PCI_EXP_LNKSTA_CLS_8_0GB: return "8.0";
-+	default:
-+		break;
-+	}
-+
-+	return "??";
-+}
-+
-+static u32 brcm_pcie_mdio_form_pkt(unsigned int port, unsigned int regad,
-+				   unsigned int cmd)
-+{
-+	u32 pkt;
-+
-+	pkt = (port << MDIO_PORT_SHIFT) & MDIO_PORT_MASK;
-+	pkt |= (regad << MDIO_REGAD_SHIFT) & MDIO_REGAD_MASK;
-+	pkt |= (cmd << MDIO_CMD_SHIFT) & MDIO_CMD_MASK;
-+
-+	return pkt;
-+}
-+
-+/**
-+ * brcm_pcie_mdio_read() - Perform a register read on the internal MDIO bus
-+ * @base: Pointer to the PCIe controller IO registers
-+ * @port: The MDIO port number
-+ * @regad: The register address
-+ * @val: A pointer at which to store the read value
-+ *
-+ * Return: 0 on success and register value in @val, negative error value
-+ *         on failure.
-+ */
-+static int brcm_pcie_mdio_read(void __iomem *base, unsigned int port,
-+			       unsigned int regad, u32 *val)
-+{
-+	u32 data, addr;
-+	int ret;
-+
-+	addr = brcm_pcie_mdio_form_pkt(port, regad, MDIO_CMD_READ);
-+	writel(addr, base + PCIE_RC_DL_MDIO_ADDR);
-+	readl(base + PCIE_RC_DL_MDIO_ADDR);
-+
-+	ret = readl_poll_timeout(base + PCIE_RC_DL_MDIO_RD_DATA, data,
-+				 (data & MDIO_DATA_DONE_MASK), 100);
-+
-+	*val = data & MDIO_DATA_MASK;
-+
-+	return ret;
-+}
-+
-+/**
-+ * brcm_pcie_mdio_write() - Perform a register write on the internal MDIO bus
-+ * @base: Pointer to the PCIe controller IO registers
-+ * @port: The MDIO port number
-+ * @regad: Address of the register
-+ * @wrdata: The value to write
-+ *
-+ * Return: 0 on success, negative error value on failure.
-+ */
-+static int brcm_pcie_mdio_write(void __iomem *base, unsigned int port,
-+				unsigned int regad, u16 wrdata)
-+{
-+	u32 data, addr;
-+
-+	addr = brcm_pcie_mdio_form_pkt(port, regad, MDIO_CMD_WRITE);
-+	writel(addr, base + PCIE_RC_DL_MDIO_ADDR);
-+	readl(base + PCIE_RC_DL_MDIO_ADDR);
-+	writel(MDIO_DATA_DONE_MASK | wrdata, base + PCIE_RC_DL_MDIO_WR_DATA);
-+
-+	return readl_poll_timeout(base + PCIE_RC_DL_MDIO_WR_DATA, data,
-+				  !(data & MDIO_DATA_DONE_MASK), 100);
-+}
-+
-+/**
-+ * brcm_pcie_set_ssc() - Configure the controller for Spread Spectrum Clocking
-+ * @base: pointer to the PCIe controller IO registers
-+ *
-+ * Return: 0 on success, negative error value on failure.
-+ */
-+static int brcm_pcie_set_ssc(void __iomem *base)
-+{
-+	int pll, ssc;
-+	int ret;
-+	u32 tmp;
-+
-+	ret = brcm_pcie_mdio_write(base, MDIO_PORT0, SET_ADDR_OFFSET,
-+				   SSC_REGS_ADDR);
-+	if (ret < 0)
-+		return ret;
-+
-+	ret = brcm_pcie_mdio_read(base, MDIO_PORT0, SSC_CNTL_OFFSET, &tmp);
-+	if (ret < 0)
-+		return ret;
-+
-+	tmp |= (SSC_CNTL_OVRD_EN_MASK | SSC_CNTL_OVRD_VAL_MASK);
-+
-+	ret = brcm_pcie_mdio_write(base, MDIO_PORT0, SSC_CNTL_OFFSET, tmp);
-+	if (ret < 0)
-+		return ret;
-+
-+	udelay(1000);
-+	ret = brcm_pcie_mdio_read(base, MDIO_PORT0, SSC_STATUS_OFFSET, &tmp);
-+	if (ret < 0)
-+		return ret;
-+
-+	ssc = (tmp & SSC_STATUS_SSC_MASK) >> SSC_STATUS_SSC_SHIFT;
-+	pll = (tmp & SSC_STATUS_PLL_LOCK_MASK) >> SSC_STATUS_PLL_LOCK_SHIFT;
-+
-+	return ssc && pll ? 0 : -EIO;
-+}
-+
-+/**
-+ * brcm_pcie_set_gen() - Limits operation to a specific generation (1, 2 or 3)
-+ * @pcie: pointer to the PCIe controller state
-+ * @gen: PCIe generation to limit the controller's operation to
-+ */
-+static void brcm_pcie_set_gen(struct brcm_pcie *pcie, unsigned int gen)
-+{
-+	void __iomem *cap_base = pcie->base + BRCM_PCIE_CAP_REGS;
-+
-+	u16 lnkctl2 = readw(cap_base + PCI_EXP_LNKCTL2);
-+	u32 lnkcap = readl(cap_base + PCI_EXP_LNKCAP);
-+
-+	lnkcap = (lnkcap & ~PCI_EXP_LNKCAP_SLS) | gen;
-+	writel(lnkcap, cap_base + PCI_EXP_LNKCAP);
-+
-+	lnkctl2 = (lnkctl2 & ~0xf) | gen;
-+	writew(lnkctl2, cap_base + PCI_EXP_LNKCTL2);
-+}
-+
-+static void brcm_pcie_set_outbound_win(struct brcm_pcie *pcie,
-+				       unsigned int win, u64 phys_addr,
-+				       u64 pcie_addr, u64 size)
-+{
-+	void __iomem *base = pcie->base;
-+	u32 phys_addr_mb_high, limit_addr_mb_high;
-+	phys_addr_t phys_addr_mb, limit_addr_mb;
-+	int high_addr_shift;
-+	u32 tmp;
-+
-+	/* Set the base of the pcie_addr window */
-+	writel(lower_32_bits(pcie_addr), base + PCIE_MEM_WIN0_LO(win));
-+	writel(upper_32_bits(pcie_addr), base + PCIE_MEM_WIN0_HI(win));
-+
-+	/* Write the addr base & limit lower bits (in MBs) */
-+	phys_addr_mb = phys_addr / SZ_1M;
-+	limit_addr_mb = (phys_addr + size - 1) / SZ_1M;
-+
-+	tmp = readl(base + PCIE_MEM_WIN0_BASE_LIMIT(win));
-+	u32p_replace_bits(&tmp, phys_addr_mb,
-+			  MEM_WIN0_BASE_LIMIT_BASE_MASK);
-+	u32p_replace_bits(&tmp, limit_addr_mb,
-+			  MEM_WIN0_BASE_LIMIT_LIMIT_MASK);
-+	writel(tmp, base + PCIE_MEM_WIN0_BASE_LIMIT(win));
-+
-+	/* Write the cpu & limit addr upper bits */
-+	high_addr_shift = MEM_WIN0_BASE_LIMIT_BASE_HI_SHIFT;
-+	phys_addr_mb_high = phys_addr_mb >> high_addr_shift;
-+	tmp = readl(base + PCIE_MEM_WIN0_BASE_HI(win));
-+	u32p_replace_bits(&tmp, phys_addr_mb_high,
-+			  MEM_WIN0_BASE_HI_BASE_MASK);
-+	writel(tmp, base + PCIE_MEM_WIN0_BASE_HI(win));
-+
-+	limit_addr_mb_high = limit_addr_mb >> high_addr_shift;
-+	tmp = readl(base + PCIE_MEM_WIN0_LIMIT_HI(win));
-+	u32p_replace_bits(&tmp, limit_addr_mb_high,
-+			  PCIE_MEM_WIN0_LIMIT_HI_LIMIT_MASK);
-+	writel(tmp, base + PCIE_MEM_WIN0_LIMIT_HI(win));
-+}
-+
-+static int brcm_pcie_probe(struct udevice *dev)
-+{
-+	struct udevice *ctlr = pci_get_controller(dev);
-+	struct pci_controller *hose = dev_get_uclass_priv(ctlr);
-+	struct brcm_pcie *pcie = dev_get_priv(dev);
-+	void __iomem *base = pcie->base;
-+	bool ssc_good = false;
-+	int num_out_wins = 0;
-+	u64 rc_bar2_offset, rc_bar2_size;
-+	unsigned int scb_size_val;
-+	int i, ret;
-+	u16 nlw, cls, lnksta;
-+	u32 tmp;
-+
-+	/*
-+	 * Reset the bridge, assert the fundamental reset. Note for some SoCs,
-+	 * e.g. BCM7278, the fundamental reset should not be asserted here.
-+	 * This will need to be changed when support for other SoCs is added.
-+	 */
-+	setbits_le32(base + PCIE_RGR1_SW_INIT_1,
-+		     RGR1_SW_INIT_1_INIT_MASK | RGR1_SW_INIT_1_PERST_MASK);
-+	/*
-+	 * The delay is a safety precaution to preclude the reset signal
-+	 * from looking like a glitch.
-+	 */
-+	udelay(100);
-+
-+	/* Take the bridge out of reset */
-+	clrbits_le32(base + PCIE_RGR1_SW_INIT_1, RGR1_SW_INIT_1_INIT_MASK);
-+
-+	clrbits_le32(base + PCIE_MISC_HARD_PCIE_HARD_DEBUG,
-+		     PCIE_HARD_DEBUG_SERDES_IDDQ_MASK);
-+
-+	/* Wait for SerDes to be stable */
-+	udelay(100);
-+
-+	/* Set SCB_MAX_BURST_SIZE, CFG_READ_UR_MODE, SCB_ACCESS_EN */
-+	clrsetbits_le32(base + PCIE_MISC_MISC_CTRL,
-+			MISC_CTRL_MAX_BURST_SIZE_MASK,
-+			MISC_CTRL_SCB_ACCESS_EN_MASK |
-+			MISC_CTRL_CFG_READ_UR_MODE_MASK |
-+			MISC_CTRL_MAX_BURST_SIZE_128);
-+	/*
-+	 * TODO: When support for other SoCs than BCM2711 is added we may
-+	 * need to use the base address and size(s) provided in the dma-ranges
-+	 * property.
-+	 */
-+	rc_bar2_offset = 0;
-+	rc_bar2_size = 0xc0000000;
-+
-+	tmp = lower_32_bits(rc_bar2_offset);
-+	u32p_replace_bits(&tmp, brcm_pcie_encode_ibar_size(rc_bar2_size),
-+			  RC_BAR2_CONFIG_LO_SIZE_MASK);
-+	writel(tmp, base + PCIE_MISC_RC_BAR2_CONFIG_LO);
-+	writel(upper_32_bits(rc_bar2_offset),
-+	       base + PCIE_MISC_RC_BAR2_CONFIG_HI);
-+
-+	scb_size_val = rc_bar2_size ?
-+		       ilog2(rc_bar2_size) - 15 : 0xf; /* 0xf is 1GB */
-+
-+	tmp = readl(base + PCIE_MISC_MISC_CTRL);
-+	u32p_replace_bits(&tmp, scb_size_val,
-+			  MISC_CTRL_SCB0_SIZE_MASK);
-+	writel(tmp, base + PCIE_MISC_MISC_CTRL);
-+
-+	/* Disable the PCIe->GISB memory window (RC_BAR1) */
-+	clrbits_le32(base + PCIE_MISC_RC_BAR1_CONFIG_LO,
-+		     RC_BAR1_CONFIG_LO_SIZE_MASK);
-+
-+	/* Disable the PCIe->SCB memory window (RC_BAR3) */
-+	clrbits_le32(base + PCIE_MISC_RC_BAR3_CONFIG_LO,
-+		     RC_BAR3_CONFIG_LO_SIZE_MASK);
-+
-+	/* Mask all interrupts since we are not handling any yet */
-+	writel(0xffffffff, base + PCIE_MSI_INTR2_MASK_SET);
-+
-+	/* Clear any interrupts we find on boot */
-+	writel(0xffffffff, base + PCIE_MSI_INTR2_CLR);
-+
-+	if (pcie->gen)
-+		brcm_pcie_set_gen(pcie, pcie->gen);
-+
-+	/* Unassert the fundamental reset */
-+	clrbits_le32(pcie->base + PCIE_RGR1_SW_INIT_1,
-+		     RGR1_SW_INIT_1_PERST_MASK);
-+
-+	/* Give the RC/EP time to wake up, before trying to configure RC.
-+	 * Intermittently check status for link-up, up to a total of 100ms.
-+	 */
-+	for (i = 0; i < 100 && !brcm_pcie_link_up(pcie); i += 5)
-+		mdelay(5);
-+
-+	if (!brcm_pcie_link_up(pcie)) {
-+		printf("PCIe BRCM: link down\n");
-+		return -EINVAL;
-+	}
-+
-+	if (!brcm_pcie_rc_mode(pcie)) {
-+		printf("PCIe misconfigured; is in EP mode\n");
-+		return -EINVAL;
-+	}
-+
-+	for (i = 0; i < hose->region_count; i++) {
-+		struct pci_region *reg = &hose->regions[i];
-+
-+		if (reg->flags != PCI_REGION_MEM)
-+			continue;
-+
-+		if (num_out_wins >= BRCM_NUM_PCIE_OUT_WINS)
-+			return -EINVAL;
-+
-+		brcm_pcie_set_outbound_win(pcie, num_out_wins, reg->phys_start,
-+					   reg->bus_start, reg->size);
-+
-+		num_out_wins++;
-+	}
-+
-+	/*
-+	 * For config space accesses on the RC, show the right class for
-+	 * a PCIe-PCIe bridge (the default setting is to be EP mode).
-+	 */
-+	clrsetbits_le32(base + PCIE_RC_CFG_PRIV1_ID_VAL3,
-+			CFG_PRIV1_ID_VAL3_CLASS_CODE_MASK, 0x060400);
-+
-+	if (pcie->ssc) {
-+		ret = brcm_pcie_set_ssc(pcie->base);
-+		if (!ret)
-+			ssc_good = true;
-+		else
-+			printf("PCIe BRCM: failed attempt to enter SSC mode\n");
-+	}
-+
-+	lnksta = readw(base + BRCM_PCIE_CAP_REGS + PCI_EXP_LNKSTA);
-+	cls = lnksta & PCI_EXP_LNKSTA_CLS;
-+	nlw = (lnksta & PCI_EXP_LNKSTA_NLW) >> PCI_EXP_LNKSTA_NLW_SHIFT;
-+
-+	printf("PCIe BRCM: link up, %s Gbps x%u %s\n", link_speed_to_str(cls),
-+	       nlw, ssc_good ? "(SSC)" : "(!SSC)");
-+
-+	/* PCIe->SCB endian mode for BAR */
-+	clrsetbits_le32(base + PCIE_RC_CFG_VENDOR_SPECIFIC_REG1,
-+			VENDOR_SPECIFIC_REG1_ENDIAN_MODE_BAR2_MASK,
-+			VENDOR_SPECIFIC_REG1_LITTLE_ENDIAN);
-+	/*
-+	 * Refclk from RC should be gated with CLKREQ# input when ASPM L0s,L1
-+	 * is enabled => setting the CLKREQ_DEBUG_ENABLE field to 1.
-+	 */
-+	setbits_le32(base + PCIE_MISC_HARD_PCIE_HARD_DEBUG,
-+		     PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK);
-+
-+	return 0;
-+}
-+
-+static int brcm_pcie_ofdata_to_platdata(struct udevice *dev)
-+{
-+	struct brcm_pcie *pcie = dev_get_priv(dev);
-+	ofnode dn = dev_ofnode(dev);
-+	u32 max_link_speed;
-+	int ret;
-+
-+	/* Get the controller base address */
-+	pcie->base = dev_read_addr_ptr(dev);
-+	if (!pcie->base)
-+		return -EINVAL;
-+
-+	pcie->ssc = ofnode_read_bool(dn, "brcm,enable-ssc");
-+
-+	ret = ofnode_read_u32(dn, "max-link-speed", &max_link_speed);
-+	if (ret < 0 || max_link_speed > 4)
-+		pcie->gen = 0;
-+	else
-+		pcie->gen = max_link_speed;
-+
-+	return 0;
-+}
-+
-+static const struct dm_pci_ops brcm_pcie_ops = {
-+	.read_config	= brcm_pcie_read_config,
-+	.write_config	= brcm_pcie_write_config,
-+};
-+
-+static const struct udevice_id brcm_pcie_ids[] = {
-+	{ .compatible = "brcm,bcm2711-pcie" },
-+	{ }
-+};
-+
-+U_BOOT_DRIVER(pcie_brcm_base) = {
-+	.name			= "pcie_brcm",
-+	.id			= UCLASS_PCI,
-+	.ops			= &brcm_pcie_ops,
-+	.of_match		= brcm_pcie_ids,
-+	.probe			= brcm_pcie_probe,
-+	.ofdata_to_platdata	= brcm_pcie_ofdata_to_platdata,
-+	.priv_auto_alloc_size	= sizeof(struct brcm_pcie),
-+};
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0010-configs-Enable-support-for-the-XHCI-controller-on-RP.patch

@@ -1,102 +0,0 @@
-From 66537b5984af81b5add420df9eb64c508268f581 Mon Sep 17 00:00:00 2001
-Message-Id: <66537b5984af81b5add420df9eb64c508268f581.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-Date: Mon, 25 May 2020 13:39:59 +0200
-Subject: [PATCH 10/20] configs: Enable support for the XHCI controller on RPI4
- board (ARM 64-bit)
-
-This requires enabling BRCMSTB PCIe and XHCI_PCI drivers as well as PCI
-and USB commands. To get it working one has to call the following commands:
-"pci enum; usb start;", thus such commands have been added to the default
-"preboot" environment variable. One has to update their environment if it
-is already configured to get this feature working out of the box.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
----
- configs/rpi_4_defconfig     | 9 +++++++++
- configs/rpi_arm64_defconfig | 8 +++++++-
- 2 files changed, 16 insertions(+), 1 deletion(-)
-
-diff --git a/configs/rpi_4_defconfig b/configs/rpi_4_defconfig
-index f0301dc8bc..b42efe6072 100644
---- a/configs/rpi_4_defconfig
-+++ b/configs/rpi_4_defconfig
-@@ -6,6 +6,8 @@ CONFIG_SYS_MALLOC_F_LEN=0x2000
- CONFIG_ENV_SIZE=0x4000
- CONFIG_DISTRO_DEFAULTS=y
- CONFIG_OF_BOARD_SETUP=y
-+CONFIG_USE_PREBOOT=y
-+CONFIG_PREBOOT="pci enum; usb start;"
- CONFIG_MISC_INIT_R=y
- # CONFIG_DISPLAY_CPUINFO is not set
- # CONFIG_DISPLAY_BOARDINFO is not set
-@@ -13,6 +15,8 @@ CONFIG_SYS_PROMPT="U-Boot> "
- CONFIG_CMD_DFU=y
- CONFIG_CMD_GPIO=y
- CONFIG_CMD_MMC=y
-+CONFIG_CMD_PCI=y
-+CONFIG_CMD_USB=y
- CONFIG_CMD_FS_UUID=y
- CONFIG_OF_BOARD=y
- CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
-@@ -26,12 +30,17 @@ CONFIG_MMC_SDHCI_SDMA=y
- CONFIG_MMC_SDHCI_BCM2835=y
- CONFIG_DM_ETH=y
- CONFIG_BCMGENET=y
-+CONFIG_PCI=y
-+CONFIG_DM_PCI=y
-+CONFIG_PCI_BRCMSTB=y
- CONFIG_PINCTRL=y
- # CONFIG_PINCTRL_GENERIC is not set
- # CONFIG_REQUIRE_SERIAL_CONSOLE is not set
- CONFIG_USB=y
- CONFIG_DM_USB=y
- CONFIG_DM_USB_GADGET=y
-+CONFIG_USB_XHCI_HCD=y
-+CONFIG_USB_XHCI_PCI=y
- CONFIG_USB_GADGET=y
- CONFIG_USB_GADGET_MANUFACTURER="FSL"
- CONFIG_USB_GADGET_VENDOR_NUM=0x0525
-diff --git a/configs/rpi_arm64_defconfig b/configs/rpi_arm64_defconfig
-index d16c2388af..0feea7f0be 100644
---- a/configs/rpi_arm64_defconfig
-+++ b/configs/rpi_arm64_defconfig
-@@ -7,13 +7,14 @@ CONFIG_ENV_SIZE=0x4000
- CONFIG_DISTRO_DEFAULTS=y
- CONFIG_OF_BOARD_SETUP=y
- CONFIG_USE_PREBOOT=y
--CONFIG_PREBOOT="usb start"
-+CONFIG_PREBOOT="pci enum; usb start;"
- CONFIG_MISC_INIT_R=y
- # CONFIG_DISPLAY_CPUINFO is not set
- # CONFIG_DISPLAY_BOARDINFO is not set
- CONFIG_SYS_PROMPT="U-Boot> "
- CONFIG_CMD_GPIO=y
- CONFIG_CMD_MMC=y
-+CONFIG_CMD_PCI=y
- CONFIG_CMD_USB=y
- CONFIG_CMD_FS_UUID=y
- CONFIG_OF_BOARD=y
-@@ -26,11 +27,16 @@ CONFIG_MMC_SDHCI_SDMA=y
- CONFIG_MMC_SDHCI_BCM2835=y
- CONFIG_DM_ETH=y
- CONFIG_BCMGENET=y
-+CONFIG_PCI=y
-+CONFIG_DM_PCI=y
-+CONFIG_PCI_BRCMSTB=y
- CONFIG_PINCTRL=y
- # CONFIG_PINCTRL_GENERIC is not set
- # CONFIG_REQUIRE_SERIAL_CONSOLE is not set
- CONFIG_USB=y
- CONFIG_DM_USB=y
-+CONFIG_USB_XHCI_HCD=y
-+CONFIG_USB_XHCI_PCI=y
- CONFIG_USB_DWC2=y
- CONFIG_USB_KEYBOARD=y
- CONFIG_USB_HOST_ETHER=y
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0011-arm-rpi-Add-function-to-trigger-VL805-s-firmware-loa.patch

@@ -1,131 +0,0 @@
-From 2899e2cbe5412ee6f6a01855467fa37534ffc2be Mon Sep 17 00:00:00 2001
-Message-Id: <2899e2cbe5412ee6f6a01855467fa37534ffc2be.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
-Date: Mon, 29 Jun 2020 18:37:22 +0200
-Subject: [PATCH 11/20] arm: rpi: Add function to trigger VL805's firmware load
-
-On the Raspberry Pi 4, after a PCI reset, VL805's (a xHCI chip) firmware
-may either be loaded directly from an EEPROM or, if not present, by the
-SoC's VideCore (the SoC's co-processor). Introduce the function that
-informs VideCore that VL805 may need its firmware loaded.
-
-Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
----
- arch/arm/mach-bcm283x/include/mach/mbox.h | 13 +++++++
- arch/arm/mach-bcm283x/include/mach/msg.h  |  7 ++++
- arch/arm/mach-bcm283x/msg.c               | 46 +++++++++++++++++++++++
- 3 files changed, 66 insertions(+)
-
-diff --git a/arch/arm/mach-bcm283x/include/mach/mbox.h b/arch/arm/mach-bcm283x/include/mach/mbox.h
-index 60e226ce1d..2ae2d3d97c 100644
---- a/arch/arm/mach-bcm283x/include/mach/mbox.h
-+++ b/arch/arm/mach-bcm283x/include/mach/mbox.h
-@@ -491,6 +491,19 @@ struct bcm2835_mbox_tag_set_palette {
- 	} body;
- };
- 
-+#define BCM2835_MBOX_TAG_NOTIFY_XHCI_RESET          0x00030058
-+
-+struct bcm2835_mbox_tag_pci_dev_addr {
-+	struct bcm2835_mbox_tag_hdr tag_hdr;
-+	union {
-+		struct {
-+			u32 dev_addr;
-+		} req;
-+		struct {
-+		} resp;
-+	} body;
-+};
-+
- /*
-  * Pass a raw u32 message to the VC, and receive a raw u32 back.
-  *
-diff --git a/arch/arm/mach-bcm283x/include/mach/msg.h b/arch/arm/mach-bcm283x/include/mach/msg.h
-index 4afb08631b..e45c1bf010 100644
---- a/arch/arm/mach-bcm283x/include/mach/msg.h
-+++ b/arch/arm/mach-bcm283x/include/mach/msg.h
-@@ -48,4 +48,11 @@ int bcm2835_set_video_params(int *widthp, int *heightp, int depth_bpp,
- 			     int pixel_order, int alpha_mode, ulong *fb_basep,
- 			     ulong *fb_sizep, int *pitchp);
- 
-+/**
-+ * bcm2711_load_vl805_firmware() - get vl805's firmware loaded
-+ *
-+ * @return 0 if OK, -EIO on error
-+ */
-+int bcm2711_notify_vl805_reset(void);
-+
- #endif
-diff --git a/arch/arm/mach-bcm283x/msg.c b/arch/arm/mach-bcm283x/msg.c
-index 94b75283f8..347aece3cd 100644
---- a/arch/arm/mach-bcm283x/msg.c
-+++ b/arch/arm/mach-bcm283x/msg.c
-@@ -7,6 +7,7 @@
- #include <memalign.h>
- #include <phys2bus.h>
- #include <asm/arch/mbox.h>
-+#include <linux/delay.h>
- 
- struct msg_set_power_state {
- 	struct bcm2835_mbox_hdr hdr;
-@@ -40,6 +41,12 @@ struct msg_setup {
- 	u32 end_tag;
- };
- 
-+struct msg_notify_vl805_reset {
-+	struct bcm2835_mbox_hdr hdr;
-+	struct bcm2835_mbox_tag_pci_dev_addr dev_addr;
-+	u32 end_tag;
-+};
-+
- int bcm2835_power_on_module(u32 module)
- {
- 	ALLOC_CACHE_ALIGN_BUFFER(struct msg_set_power_state, msg_pwr, 1);
-@@ -151,3 +158,42 @@ int bcm2835_set_video_params(int *widthp, int *heightp, int depth_bpp,
- 
- 	return 0;
- }
-+
-+/*
-+ * On the Raspberry Pi 4, after a PCI reset, VL805's (the xHCI chip) firmware
-+ * may either be loaded directly from an EEPROM or, if not present, by the
-+ * SoC's VideoCore. This informs VideoCore that VL805 needs its firmware
-+ * loaded.
-+ */
-+int bcm2711_notify_vl805_reset(void)
-+{
-+	ALLOC_CACHE_ALIGN_BUFFER(struct msg_notify_vl805_reset,
-+				 msg_notify_vl805_reset, 1);
-+	int ret;
-+
-+	BCM2835_MBOX_INIT_HDR(msg_notify_vl805_reset);
-+	BCM2835_MBOX_INIT_TAG(&msg_notify_vl805_reset->dev_addr,
-+			      NOTIFY_XHCI_RESET);
-+
-+	/*
-+	 * The pci device address is expected like this:
-+	 *
-+	 *   PCI_BUS << 20 | PCI_SLOT << 15 | PCI_FUNC << 12
-+	 *
-+	 * But since RPi4's PCIe setup is hardwired, we know the address in
-+	 * advance.
-+	 */
-+	msg_notify_vl805_reset->dev_addr.body.req.dev_addr = 0x100000;
-+
-+	ret = bcm2835_mbox_call_prop(BCM2835_MBOX_PROP_CHAN,
-+				     &msg_notify_vl805_reset->hdr);
-+	if (ret) {
-+		printf("bcm2711: Faild to load vl805's firmware, %d\n", ret);
-+		return -EIO;
-+	}
-+
-+	udelay(200);
-+
-+	return 0;
-+}
-+
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0012-reset-Add-Raspberry-Pi-4-firmware-reset-controller.patch

@@ -1,140 +0,0 @@
-From e9925f97c2c31253e1ff62de4049d90e19884f55 Mon Sep 17 00:00:00 2001
-Message-Id: <e9925f97c2c31253e1ff62de4049d90e19884f55.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
-Date: Mon, 29 Jun 2020 18:37:23 +0200
-Subject: [PATCH 12/20] reset: Add Raspberry Pi 4 firmware reset controller
-
-Raspberry Pi 4's co-processor controls some of the board's HW
-initialization process, but it's up to Linux to trigger it when
-relevant. Introduce a reset controller capable of interfacing with
-RPi4's co-processor that models these firmware initialization routines as
-reset lines.
-
-Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
----
- drivers/reset/Kconfig                         | 10 ++++
- drivers/reset/Makefile                        |  1 +
- drivers/reset/reset-raspberrypi.c             | 60 +++++++++++++++++++
- .../reset/raspberrypi,firmware-reset.h        | 13 ++++
- 4 files changed, 84 insertions(+)
- create mode 100644 drivers/reset/reset-raspberrypi.c
- create mode 100644 include/dt-bindings/reset/raspberrypi,firmware-reset.h
-
-diff --git a/drivers/reset/Kconfig b/drivers/reset/Kconfig
-index 88d3be1593..d02c1522e5 100644
---- a/drivers/reset/Kconfig
-+++ b/drivers/reset/Kconfig
-@@ -148,4 +148,14 @@ config RESET_IMX7
- 	help
- 	  Support for reset controller on i.MX7/8 SoCs.
- 
-+config RESET_RASPBERRYPI
-+	bool "Raspberry Pi 4 Firmware Reset Controller Driver"
-+	depends on DM_RESET && ARCH_BCM283X
-+	default USB_XHCI_PCI
-+	help
-+	  Raspberry Pi 4's co-processor controls some of the board's HW
-+	  initialization process, but it's up to Linux to trigger it when
-+	  relevant. This driver provides a reset controller capable of
-+	  interfacing with RPi4's co-processor and model these firmware
-+	  initialization routines as reset lines.
- endmenu
-diff --git a/drivers/reset/Makefile b/drivers/reset/Makefile
-index 0a044d5d8c..be54dae725 100644
---- a/drivers/reset/Makefile
-+++ b/drivers/reset/Makefile
-@@ -23,3 +23,4 @@ obj-$(CONFIG_RESET_MTMIPS) += reset-mtmips.o
- obj-$(CONFIG_RESET_SUNXI) += reset-sunxi.o
- obj-$(CONFIG_RESET_HISILICON) += reset-hisilicon.o
- obj-$(CONFIG_RESET_IMX7) += reset-imx7.o
-+obj-$(CONFIG_RESET_RASPBERRYPI) += reset-raspberrypi.o
-diff --git a/drivers/reset/reset-raspberrypi.c b/drivers/reset/reset-raspberrypi.c
-new file mode 100644
-index 0000000000..e2d284e5ac
---- /dev/null
-+++ b/drivers/reset/reset-raspberrypi.c
-@@ -0,0 +1,60 @@
-+// SPDX-License-Identifier: GPL-2.0
-+/*
-+ * Raspberry Pi 4 firmware reset driver
-+ *
-+ * Copyright (C) 2020 Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
-+ */
-+#include <common.h>
-+#include <dm.h>
-+#include <reset-uclass.h>
-+#include <asm/arch/msg.h>
-+#include <dt-bindings/reset/raspberrypi,firmware-reset.h>
-+
-+static int raspberrypi_reset_request(struct reset_ctl *reset_ctl)
-+{
-+	if (reset_ctl->id >= RASPBERRYPI_FIRMWARE_RESET_NUM_IDS)
-+		return -EINVAL;
-+
-+	return 0;
-+}
-+
-+static int raspberrypi_reset_free(struct reset_ctl *reset_ctl)
-+{
-+	return 0;
-+}
-+
-+static int raspberrypi_reset_assert(struct reset_ctl *reset_ctl)
-+{
-+	switch (reset_ctl->id) {
-+	case RASPBERRYPI_FIRMWARE_RESET_ID_USB:
-+		bcm2711_notify_vl805_reset();
-+		return 0;
-+	default:
-+		return -EINVAL;
-+	}
-+}
-+
-+static int raspberrypi_reset_deassert(struct reset_ctl *reset_ctl)
-+{
-+	return 0;
-+}
-+
-+struct reset_ops raspberrypi_reset_ops = {
-+	.request = raspberrypi_reset_request,
-+	.rfree = raspberrypi_reset_free,
-+	.rst_assert = raspberrypi_reset_assert,
-+	.rst_deassert = raspberrypi_reset_deassert,
-+};
-+
-+static const struct udevice_id raspberrypi_reset_ids[] = {
-+	{ .compatible = "raspberrypi,firmware-reset" },
-+	{ }
-+};
-+
-+U_BOOT_DRIVER(raspberrypi_reset) = {
-+	.name = "raspberrypi-reset",
-+	.id = UCLASS_RESET,
-+	.of_match = raspberrypi_reset_ids,
-+	.ops = &raspberrypi_reset_ops,
-+};
-+
-diff --git a/include/dt-bindings/reset/raspberrypi,firmware-reset.h b/include/dt-bindings/reset/raspberrypi,firmware-reset.h
-new file mode 100644
-index 0000000000..1a4f4c7927
---- /dev/null
-+++ b/include/dt-bindings/reset/raspberrypi,firmware-reset.h
-@@ -0,0 +1,13 @@
-+/* SPDX-License-Identifier: GPL-2.0 */
-+/*
-+ * Copyright (c) 2020 Nicolas Saenz Julienne
-+ * Author: Nicolas Saenz Julienne <nsaenzjulienne@suse.com>
-+ */
-+
-+#ifndef _DT_BINDINGS_RASPBERRYPI_FIRMWARE_RESET_H
-+#define _DT_BINDINGS_RASPBERRYPI_FIRMWARE_RESET_H
-+
-+#define RASPBERRYPI_FIRMWARE_RESET_ID_USB	0
-+#define RASPBERRYPI_FIRMWARE_RESET_NUM_IDS	1
-+
-+#endif
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0013-configs-Enable-support-for-reset-controllers-on-RPi4.patch

@@ -1,57 +0,0 @@
-From d32b13ba58aa59a5ec0b71cfc2005bf1efd84ddf Mon Sep 17 00:00:00 2001
-Message-Id: <d32b13ba58aa59a5ec0b71cfc2005bf1efd84ddf.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
-Date: Mon, 29 Jun 2020 18:37:24 +0200
-Subject: [PATCH 13/20] configs: Enable support for reset controllers on RPi4
-
-This is required in order to access the reset controller used to
-initialize the board's xHCI chip.
-
-Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
----
- configs/rpi_4_32b_defconfig | 1 +
- configs/rpi_4_defconfig     | 1 +
- configs/rpi_arm64_defconfig | 1 +
- 3 files changed, 3 insertions(+)
-
-diff --git a/configs/rpi_4_32b_defconfig b/configs/rpi_4_32b_defconfig
-index a36a249540..0df5c17d6e 100644
---- a/configs/rpi_4_32b_defconfig
-+++ b/configs/rpi_4_32b_defconfig
-@@ -28,6 +28,7 @@ CONFIG_DM_ETH=y
- CONFIG_BCMGENET=y
- CONFIG_PINCTRL=y
- # CONFIG_PINCTRL_GENERIC is not set
-+CONFIG_DM_RESET=y
- # CONFIG_REQUIRE_SERIAL_CONSOLE is not set
- CONFIG_USB=y
- CONFIG_DM_USB=y
-diff --git a/configs/rpi_4_defconfig b/configs/rpi_4_defconfig
-index b42efe6072..f641ad3dfa 100644
---- a/configs/rpi_4_defconfig
-+++ b/configs/rpi_4_defconfig
-@@ -35,6 +35,7 @@ CONFIG_DM_PCI=y
- CONFIG_PCI_BRCMSTB=y
- CONFIG_PINCTRL=y
- # CONFIG_PINCTRL_GENERIC is not set
-+CONFIG_DM_RESET=y
- # CONFIG_REQUIRE_SERIAL_CONSOLE is not set
- CONFIG_USB=y
- CONFIG_DM_USB=y
-diff --git a/configs/rpi_arm64_defconfig b/configs/rpi_arm64_defconfig
-index 0feea7f0be..4ce8469f43 100644
---- a/configs/rpi_arm64_defconfig
-+++ b/configs/rpi_arm64_defconfig
-@@ -32,6 +32,7 @@ CONFIG_DM_PCI=y
- CONFIG_PCI_BRCMSTB=y
- CONFIG_PINCTRL=y
- # CONFIG_PINCTRL_GENERIC is not set
-+CONFIG_DM_RESET=y
- # CONFIG_REQUIRE_SERIAL_CONSOLE is not set
- CONFIG_USB=y
- CONFIG_DM_USB=y
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0014-usb-xhci-Add-reset-controller-support.patch

@@ -1,106 +0,0 @@
-From a39dcf665d8867875b104661bd6a6325f502c5f2 Mon Sep 17 00:00:00 2001
-Message-Id: <a39dcf665d8867875b104661bd6a6325f502c5f2.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
-Date: Mon, 29 Jun 2020 18:37:25 +0200
-Subject: [PATCH 14/20] usb: xhci: Add reset controller support
-
-Some atypical users of xhci might need to manually reset their xHCI
-controller before starting the HCD setup. Check if a reset controller
-device is available to the PCI bus and trigger a reset.
-
-Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
----
- drivers/usb/host/xhci-mem.c |  2 ++
- drivers/usb/host/xhci.c     | 33 +++++++++++++++++++++++++++++++++
- include/usb/xhci.h          |  2 ++
- 3 files changed, 37 insertions(+)
-
-diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
-index f446520528..108f4bd8cf 100644
---- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -180,6 +180,8 @@ void xhci_cleanup(struct xhci_ctrl *ctrl)
- 	xhci_free_virt_devices(ctrl);
- 	free(ctrl->erst.entries);
- 	free(ctrl->dcbaa);
-+	if (reset_valid(&ctrl->reset))
-+		reset_free(&ctrl->reset);
- 	memset(ctrl, '\0', sizeof(struct xhci_ctrl));
- }
- 
-diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
-index ebd2954571..e252964d0d 100644
---- a/drivers/usb/host/xhci.c
-+++ b/drivers/usb/host/xhci.c
-@@ -190,6 +190,35 @@ static int xhci_start(struct xhci_hcor *hcor)
- 	return ret;
- }
- 
-+/**
-+ * Resets XHCI Hardware
-+ *
-+ * @param ctrl	pointer to host controller
-+ * @return 0 if OK, or a negative error code.
-+ */
-+static int xhci_reset_hw(struct xhci_ctrl *ctrl)
-+{
-+	int ret;
-+
-+	ret = reset_get_by_index(ctrl->dev, 0, &ctrl->reset);
-+	if (ret && ret != -ENOENT && ret != -ENOTSUPP) {
-+		dev_err(ctrl->dev, "failed to get reset\n");
-+		return ret;
-+	}
-+
-+	if (reset_valid(&ctrl->reset)) {
-+		ret = reset_assert(&ctrl->reset);
-+		if (ret)
-+			return ret;
-+
-+		ret = reset_deassert(&ctrl->reset);
-+		if (ret)
-+			return ret;
-+	}
-+
-+	return 0;
-+}
-+
- /**
-  * Resets the XHCI Controller
-  *
-@@ -1508,6 +1537,10 @@ int xhci_register(struct udevice *dev, struct xhci_hccr *hccr,
- 
- 	ctrl->dev = dev;
- 
-+	ret = xhci_reset_hw(ctrl);
-+	if (ret)
-+		goto err;
-+
- 	/*
- 	 * XHCI needs to issue a Address device command to setup
- 	 * proper device context structures, before it can interact
-diff --git a/include/usb/xhci.h b/include/usb/xhci.h
-index 1170c0ac69..7d34103fd5 100644
---- a/include/usb/xhci.h
-+++ b/include/usb/xhci.h
-@@ -16,6 +16,7 @@
- #ifndef HOST_XHCI_H_
- #define HOST_XHCI_H_
- 
-+#include <reset.h>
- #include <asm/types.h>
- #include <asm/cache.h>
- #include <asm/io.h>
-@@ -1209,6 +1210,7 @@ struct xhci_ctrl {
- #if CONFIG_IS_ENABLED(DM_USB)
- 	struct udevice *dev;
- #endif
-+	struct reset_ctl reset;
- 	struct xhci_hccr *hccr;	/* R/O registers, not need for volatile */
- 	struct xhci_hcor *hcor;
- 	struct xhci_doorbell_array *dba;
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0016-arm-update-comments-to-the-common-style.patch

@@ -1,88 +0,0 @@
-From 32d72ef4331597864189b73b309490ac48f4ac05 Mon Sep 17 00:00:00 2001
-Message-Id: <32d72ef4331597864189b73b309490ac48f4ac05.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-Date: Wed, 3 Jun 2020 14:43:41 +0200
-Subject: [PATCH 16/20] arm: update comments to the common style
-
-Update the comments in include/asm/system.h to the common style.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Reviewed-by: Tom Rini <trini@konsulko.com>
----
- arch/arm/include/asm/system.h | 23 ++++++++++++++---------
- 1 file changed, 14 insertions(+), 9 deletions(-)
-
-diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
-index 7a40b56acd..0243f76e76 100644
---- a/arch/arm/include/asm/system.h
-+++ b/arch/arm/include/asm/system.h
-@@ -205,7 +205,7 @@ int __asm_invalidate_l3_icache(void);
- void __asm_switch_ttbr(u64 new_ttbr);
- 
- /*
-- * Switch from EL3 to EL2 for ARMv8
-+ * armv8_switch_to_el2() - switch from EL3 to EL2 for ARMv8
-  *
-  * @args:        For loading 64-bit OS, fdt address.
-  *               For loading 32-bit OS, zero.
-@@ -220,7 +220,7 @@ void __asm_switch_ttbr(u64 new_ttbr);
- void __noreturn armv8_switch_to_el2(u64 args, u64 mach_nr, u64 fdt_addr,
- 				    u64 arg4, u64 entry_point, u64 es_flag);
- /*
-- * Switch from EL2 to EL1 for ARMv8
-+ * armv8_switch_to_el1() - switch from EL2 to EL1 for ARMv8
-  *
-  * @args:        For loading 64-bit OS, fdt address.
-  *               For loading 32-bit OS, zero.
-@@ -246,11 +246,12 @@ void flush_l3_cache(void);
- void mmu_change_region_attr(phys_addr_t start, size_t size, u64 attrs);
- 
- /*
-- *Issue a secure monitor call in accordance with ARM "SMC Calling convention",
-+ * smc_call() - issue a secure monitor call
-+ *
-+ * Issue a secure monitor call in accordance with ARM "SMC Calling convention",
-  * DEN0028A
-  *
-  * @args: input and output arguments
-- *
-  */
- void smc_call(struct pt_regs *args);
- 
-@@ -519,10 +520,12 @@ enum {
- #endif
- 
- /**
-+ * mmu_page_table_flush() - register an update to page tables
-+ *
-  * Register an update to the page tables, and flush the TLB
-  *
-- * \param start		start address of update in page table
-- * \param stop		stop address of update in page table
-+ * @start:	start address of update in page table
-+ * @stop:	stop address of update in page table
-  */
- void mmu_page_table_flush(unsigned long start, unsigned long stop);
- 
-@@ -583,11 +586,13 @@ s32 psci_features(u32 function_id, u32 psci_fid);
- void save_boot_params_ret(void);
- 
- /**
-+ * mmu_set_region_dcache_behaviour() - set cache settings
-+ *
-  * Change the cache settings for a region.
-  *
-- * \param start		start address of memory region to change
-- * \param size		size of memory region to change
-- * \param option	dcache option to select
-+ * @start:	start address of memory region to change
-+ * @size:	size of memory region to change
-+ * @option:	dcache option to select
-  */
- void mmu_set_region_dcache_behaviour(phys_addr_t start, size_t size,
- 				     enum dcache_option option);
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0017-arm-provide-a-function-for-boards-init-code-to-modif.patch

@@ -1,130 +0,0 @@
-From 82a944e4d1356e9ab3c87e6dc57b1b7213cbb233 Mon Sep 17 00:00:00 2001
-Message-Id: <82a944e4d1356e9ab3c87e6dc57b1b7213cbb233.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-Date: Wed, 3 Jun 2020 14:43:42 +0200
-Subject: [PATCH 17/20] arm: provide a function for boards init code to modify
- MMU virtual-physical map
-
-Provide function for setting arbitrary virtual-physical MMU mapping
-and cache settings for the given region.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
-Reviewed-by: Tom Rini <trini@konsulko.com>
----
- arch/arm/include/asm/mmu.h    |  8 ++++++++
- arch/arm/include/asm/system.h | 13 +++++++++++++
- arch/arm/lib/cache-cp15.c     | 24 ++++++++++++++++++------
- 3 files changed, 39 insertions(+), 6 deletions(-)
- create mode 100644 arch/arm/include/asm/mmu.h
-
-diff --git a/arch/arm/include/asm/mmu.h b/arch/arm/include/asm/mmu.h
-new file mode 100644
-index 0000000000..9ac16f599e
---- /dev/null
-+++ b/arch/arm/include/asm/mmu.h
-@@ -0,0 +1,8 @@
-+/* SPDX-License-Identifier: GPL-2.0+ */
-+
-+#ifndef __ASM_ARM_MMU_H
-+#define __ASM_ARM_MMU_H
-+
-+void init_addr_map(void);
-+
-+#endif
-diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
-index 0243f76e76..f9290fa9b6 100644
---- a/arch/arm/include/asm/system.h
-+++ b/arch/arm/include/asm/system.h
-@@ -585,6 +585,19 @@ s32 psci_features(u32 function_id, u32 psci_fid);
-  */
- void save_boot_params_ret(void);
- 
-+/**
-+ * mmu_set_region_dcache_behaviour_phys() - set virt/phys mapping
-+ *
-+ * Change the virt/phys mapping and cache settings for a region.
-+ *
-+ * @virt:	virtual start address of memory region to change
-+ * @phys:	physical address for the memory region to set
-+ * @size:	size of memory region to change
-+ * @option:	dcache option to select
-+ */
-+void mmu_set_region_dcache_behaviour_phys(phys_addr_t virt, phys_addr_t phys,
-+					size_t size, enum dcache_option option);
-+
- /**
-  * mmu_set_region_dcache_behaviour() - set cache settings
-  *
-diff --git a/arch/arm/lib/cache-cp15.c b/arch/arm/lib/cache-cp15.c
-index 1da2e92fe2..39717610d4 100644
---- a/arch/arm/lib/cache-cp15.c
-+++ b/arch/arm/lib/cache-cp15.c
-@@ -25,7 +25,8 @@ __weak void arm_init_domains(void)
- {
- }
- 
--void set_section_dcache(int section, enum dcache_option option)
-+static void set_section_phys(int section, phys_addr_t phys,
-+			     enum dcache_option option)
- {
- #ifdef CONFIG_ARMV7_LPAE
- 	u64 *page_table = (u64 *)gd->arch.tlb_addr;
-@@ -37,7 +38,7 @@ void set_section_dcache(int section, enum dcache_option option)
- #endif
- 
- 	/* Add the page offset */
--	value |= ((u32)section << MMU_SECTION_SHIFT);
-+	value |= phys;
- 
- 	/* Add caching bits */
- 	value |= option;
-@@ -46,13 +47,18 @@ void set_section_dcache(int section, enum dcache_option option)
- 	page_table[section] = value;
- }
- 
-+void set_section_dcache(int section, enum dcache_option option)
-+{
-+	set_section_phys(section, (u32)section << MMU_SECTION_SHIFT, option);
-+}
-+
- __weak void mmu_page_table_flush(unsigned long start, unsigned long stop)
- {
- 	debug("%s: Warning: not implemented\n", __func__);
- }
- 
--void mmu_set_region_dcache_behaviour(phys_addr_t start, size_t size,
--				     enum dcache_option option)
-+void mmu_set_region_dcache_behaviour_phys(phys_addr_t start, phys_addr_t phys,
-+					size_t size, enum dcache_option option)
- {
- #ifdef CONFIG_ARMV7_LPAE
- 	u64 *page_table = (u64 *)gd->arch.tlb_addr;
-@@ -74,8 +80,8 @@ void mmu_set_region_dcache_behaviour(phys_addr_t start, size_t size,
- 	debug("%s: start=%pa, size=%zu, option=0x%x\n", __func__, &start, size,
- 	      option);
- #endif
--	for (upto = start; upto < end; upto++)
--		set_section_dcache(upto, option);
-+	for (upto = start; upto < end; upto++, phys += MMU_SECTION_SIZE)
-+		set_section_phys(upto, phys, option);
- 
- 	/*
- 	 * Make sure range is cache line aligned
-@@ -90,6 +96,12 @@ void mmu_set_region_dcache_behaviour(phys_addr_t start, size_t size,
- 	mmu_page_table_flush(startpt, stoppt);
- }
- 
-+void mmu_set_region_dcache_behaviour(phys_addr_t start, size_t size,
-+				     enum dcache_option option)
-+{
-+	mmu_set_region_dcache_behaviour_phys(start, start, size, option);
-+}
-+
- __weak void dram_bank_mmu_setup(int bank)
- {
- 	bd_t *bd = gd->bd;
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0018-mmc-bcm283x-fix-int-to-pointer-cast.patch

@@ -1,33 +0,0 @@
-From 2904bea082a1524b13af6afed08a7f5ee9faf0ae Mon Sep 17 00:00:00 2001
-Message-Id: <2904bea082a1524b13af6afed08a7f5ee9faf0ae.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Seung-Woo Kim <sw0312.kim@samsung.com>
-Date: Wed, 3 Jun 2020 14:43:43 +0200
-Subject: [PATCH 18/20] mmc: bcm283x: fix int to pointer cast
-
-On build with 32 bit, there is a warning for int-to-pointer-cast.
-Fix the int to pointer cast by using uintptr_t.
-
-Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
----
- drivers/mmc/bcm2835_sdhci.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/mmc/bcm2835_sdhci.c b/drivers/mmc/bcm2835_sdhci.c
-index dc3dffb657..5cdf3c506f 100644
---- a/drivers/mmc/bcm2835_sdhci.c
-+++ b/drivers/mmc/bcm2835_sdhci.c
-@@ -210,7 +210,7 @@ static int bcm2835_sdhci_probe(struct udevice *dev)
- 	priv->last_write = 0;
- 
- 	host->name = dev->name;
--	host->ioaddr = (void *)base;
-+	host->ioaddr = (void *)(uintptr_t)base;
- 	host->quirks = SDHCI_QUIRK_BROKEN_VOLTAGE | SDHCI_QUIRK_BROKEN_R1B |
- 		SDHCI_QUIRK_WAIT_SEND_CMD | SDHCI_QUIRK_NO_HISPD_BIT;
- 	host->max_clk = emmc_freq;
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0019-rpi4-add-a-mapping-for-the-PCIe-XHCI-controller-MMIO.patch

@@ -1,85 +0,0 @@
-From a8c492ef2a3a73d435765ce28944efebce5cfa17 Mon Sep 17 00:00:00 2001
-Message-Id: <a8c492ef2a3a73d435765ce28944efebce5cfa17.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-Date: Wed, 3 Jun 2020 14:43:44 +0200
-Subject: [PATCH 19/20] rpi4: add a mapping for the PCIe XHCI controller MMIO
- registers (ARM 32bit)
-
-Create a non-cacheable mapping for the 0x600000000 physical memory region,
-where MMIO registers for the PCIe XHCI controller are instantiated by the
-PCIe bridge. Due to 32bit limit in the CPU virtual address space in ARM
-32bit mode, this region is mapped at 0xff800000 CPU virtual address.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
----
- arch/arm/mach-bcm283x/Kconfig             |  1 +
- arch/arm/mach-bcm283x/include/mach/base.h |  8 ++++++++
- arch/arm/mach-bcm283x/init.c              | 21 +++++++++++++++++++++
- 3 files changed, 30 insertions(+)
-
-diff --git a/arch/arm/mach-bcm283x/Kconfig b/arch/arm/mach-bcm283x/Kconfig
-index e6eb904e7f..b3287ce8bc 100644
---- a/arch/arm/mach-bcm283x/Kconfig
-+++ b/arch/arm/mach-bcm283x/Kconfig
-@@ -36,6 +36,7 @@ config BCM2711_32B
- 	select BCM2711
- 	select ARMV7_LPAE
- 	select CPU_V7A
-+	select PHYS_64BIT
- 
- config BCM2711_64B
- 	bool "Broadcom BCM2711 SoC 64-bit support"
-diff --git a/arch/arm/mach-bcm283x/include/mach/base.h b/arch/arm/mach-bcm283x/include/mach/base.h
-index c4ae39852f..4ccaf69693 100644
---- a/arch/arm/mach-bcm283x/include/mach/base.h
-+++ b/arch/arm/mach-bcm283x/include/mach/base.h
-@@ -8,4 +8,12 @@
- 
- extern unsigned long rpi_bcm283x_base;
- 
-+#ifdef CONFIG_ARMV7_LPAE
-+#ifdef CONFIG_TARGET_RPI_4_32B
-+#include <addr_map.h>
-+#define phys_to_virt addrmap_phys_to_virt
-+#define virt_to_phys addrmap_virt_to_phys
-+#endif
-+#endif
-+
- #endif
-diff --git a/arch/arm/mach-bcm283x/init.c b/arch/arm/mach-bcm283x/init.c
-index cf4c5b245d..f2a5411623 100644
---- a/arch/arm/mach-bcm283x/init.c
-+++ b/arch/arm/mach-bcm283x/init.c
-@@ -146,6 +146,27 @@ int mach_cpu_init(void)
- }
- 
- #ifdef CONFIG_ARMV7_LPAE
-+#ifdef CONFIG_TARGET_RPI_4_32B
-+#define BCM2711_RPI4_PCIE_XHCI_MMIO_VIRT	0xff800000UL
-+#include <addr_map.h>
-+#include <asm/system.h>
-+
-+void init_addr_map(void)
-+{
-+	mmu_set_region_dcache_behaviour_phys(BCM2711_RPI4_PCIE_XHCI_MMIO_VIRT,
-+					     BCM2711_RPI4_PCIE_XHCI_MMIO_PHYS,
-+					     BCM2711_RPI4_PCIE_XHCI_MMIO_SIZE,
-+					     DCACHE_OFF);
-+
-+	/* identity mapping for 0..BCM2711_RPI4_PCIE_XHCI_MMIO_VIRT */
-+	addrmap_set_entry(0, 0, BCM2711_RPI4_PCIE_XHCI_MMIO_VIRT, 0);
-+	/* XHCI MMIO on PCIe at BCM2711_RPI4_PCIE_XHCI_MMIO_VIRT */
-+	addrmap_set_entry(BCM2711_RPI4_PCIE_XHCI_MMIO_VIRT,
-+			  BCM2711_RPI4_PCIE_XHCI_MMIO_PHYS,
-+			  BCM2711_RPI4_PCIE_XHCI_MMIO_SIZE, 1);
-+}
-+#endif
-+
- void enable_caches(void)
- {
- 	dcache_enable();
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.07/0020-config-Enable-support-for-the-XHCI-controller-on-RPI.patch

@@ -1,71 +0,0 @@
-From 52d942897bcf2c775c3c5dff9f811e1a28f3fd7d Mon Sep 17 00:00:00 2001
-Message-Id: <52d942897bcf2c775c3c5dff9f811e1a28f3fd7d.1595101389.git.stefan@agner.ch>
-In-Reply-To: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-References: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595101389.git.stefan@agner.ch>
-From: Marek Szyprowski <m.szyprowski@samsung.com>
-Date: Wed, 3 Jun 2020 14:43:45 +0200
-Subject: [PATCH 20/20] config: Enable support for the XHCI controller on RPI4
- board
-
-This requires enabling BRCMSTB PCIe and XHCI_PCI drivers as well as PCI
-and USB commands. To get it working one has to call the following commands:
-"pci enum; usb start;", thus such commands have been added to the default
-"preboot" environment variable. One has to update their environment if it
-is already configured to get this feature working out of the box.
-
-Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
----
- configs/rpi_4_32b_defconfig | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
-diff --git a/configs/rpi_4_32b_defconfig b/configs/rpi_4_32b_defconfig
-index 0df5c17d6e..db7b781976 100644
---- a/configs/rpi_4_32b_defconfig
-+++ b/configs/rpi_4_32b_defconfig
-@@ -6,6 +6,8 @@ CONFIG_SYS_MALLOC_F_LEN=0x2000
- CONFIG_ENV_SIZE=0x4000
- CONFIG_DISTRO_DEFAULTS=y
- CONFIG_OF_BOARD_SETUP=y
-+CONFIG_USE_PREBOOT=y
-+CONFIG_PREBOOT="pci enum; usb start;"
- CONFIG_MISC_INIT_R=y
- # CONFIG_DISPLAY_CPUINFO is not set
- # CONFIG_DISPLAY_BOARDINFO is not set
-@@ -13,6 +15,8 @@ CONFIG_SYS_PROMPT="U-Boot> "
- CONFIG_CMD_DFU=y
- CONFIG_CMD_GPIO=y
- CONFIG_CMD_MMC=y
-+CONFIG_CMD_PCI=y
-+CONFIG_CMD_USB=y
- CONFIG_CMD_FS_UUID=y
- CONFIG_OF_BOARD=y
- CONFIG_ENV_FAT_DEVICE_AND_PART="0:1"
-@@ -26,6 +30,9 @@ CONFIG_MMC_SDHCI_SDMA=y
- CONFIG_MMC_SDHCI_BCM2835=y
- CONFIG_DM_ETH=y
- CONFIG_BCMGENET=y
-+CONFIG_PCI=y
-+CONFIG_DM_PCI=y
-+CONFIG_PCI_BRCMSTB=y
- CONFIG_PINCTRL=y
- # CONFIG_PINCTRL_GENERIC is not set
- CONFIG_DM_RESET=y
-@@ -33,6 +40,8 @@ CONFIG_DM_RESET=y
- CONFIG_USB=y
- CONFIG_DM_USB=y
- CONFIG_DM_USB_GADGET=y
-+CONFIG_USB_XHCI_HCD=y
-+CONFIG_USB_XHCI_PCI=y
- CONFIG_USB_GADGET=y
- CONFIG_USB_GADGET_MANUFACTURER="FSL"
- CONFIG_USB_GADGET_VENDOR_NUM=0x0525
-@@ -45,4 +54,6 @@ CONFIG_DM_VIDEO=y
- CONFIG_SYS_WHITE_ON_BLACK=y
- CONFIG_CONSOLE_SCROLL_LINES=10
- CONFIG_PHYS_TO_BUS=y
-+CONFIG_ADDR_MAP=y
-+CONFIG_SYS_NUM_ADDR_MAP=2
- CONFIG_OF_LIBFDT_OVERLAY=y
--- 
-2.27.0
-

buildroot-external/patches/uboot/2020.10/0001-CMD-read-string-from-fileinto-env.patch

@@ -1,8 +1,8 @@
-From 040a141f84f2f84bf8be18f85b4cdb34bf066df0 Mon Sep 17 00:00:00 2001
-Message-Id: <040a141f84f2f84bf8be18f85b4cdb34bf066df0.1595086593.git.stefan@agner.ch>
+From 8a77e2b9f56c8973273b8dc6a7cfa1ed0330d058 Mon Sep 17 00:00:00 2001
+Message-Id: <8a77e2b9f56c8973273b8dc6a7cfa1ed0330d058.1602102685.git.stefan@agner.ch>
 From: Pascal Vizeli <pvizeli@syshack.ch>
 Date: Sun, 5 Aug 2018 20:43:03 +0000
-Subject: [PATCH 1/1] CMD: read string from fileinto env
+Subject: [PATCH] CMD: read string from fileinto env
 
 Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
 ---
@@ -13,10 +13,10 @@ Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
  create mode 100644 cmd/fileenv.c
 
 diff --git a/cmd/Kconfig b/cmd/Kconfig
-index 192b3b262f..b44cd64215 100644
+index 0c984d735d..0dfd82d0a3 100644
 --- a/cmd/Kconfig
 +++ b/cmd/Kconfig
-@@ -1388,6 +1388,11 @@ config CMD_SETEXPR
+@@ -1448,6 +1448,11 @@ config CMD_SETEXPR
  	  Also supports loading the value at a memory location into a variable.
  	  If CONFIG_REGEX is enabled, setexpr also supports a gsub function.
  
@@ -29,10 +29,10 @@ index 192b3b262f..b44cd64215 100644
  
  menu "Android support commands"
 diff --git a/cmd/Makefile b/cmd/Makefile
-index 974ad48b0a..287887e97f 100644
+index 3a9c9747c9..9ccb63e248 100644
 --- a/cmd/Makefile
 +++ b/cmd/Makefile
-@@ -128,6 +128,7 @@ obj-$(CONFIG_CMD_SF) += sf.o
+@@ -133,6 +133,7 @@ obj-$(CONFIG_CMD_SF) += sf.o
  obj-$(CONFIG_CMD_SCSI) += scsi.o disk.o
  obj-$(CONFIG_CMD_SHA1SUM) += sha1sum.o
  obj-$(CONFIG_CMD_SETEXPR) += setexpr.o
@@ -92,5 +92,5 @@ index 0000000000..af24d22d0e
 +	"    - Read file from fat32 and store it as env."
 +);
 -- 
-2.27.0
+2.28.0
 

buildroot-external/rootfs-overlay/usr/lib/systemd/system/hassos-supervisor.service

@@ -1,11 +1,13 @@
 [Unit]
 Description=HassOS supervisor
-Requires=docker.service
+Requires=docker.service rauc.service dbus.service
 Wants=network-online.target
-After=docker.service rauc.service dbus.socket network-online.target
+After=docker.service rauc.service dbus.service network-online.target
 RequiresMountsFor=/mnt/data /mnt/boot /mnt/overlay
 StartLimitIntervalSec=60
 StartLimitBurst=5
+ConditionPathExists=/run/dbus/system_bus_socket
+ConditionPathExists=/run/docker.sock
 
 [Service]
 Type=simple

buildroot-external/rootfs-overlay/usr/lib/systemd/system/var-lib-NetworkManager.mount

@@ -1,7 +1,7 @@
 [Unit]
 Description=NetworkManager persistent data
-Requires=mnt-data.mount
-After=mnt-data.mount
+Requires=mnt-overlay.mount
+After=mnt-overlay.mount hassos-overlay.service
 Before=NetworkManager.service
 
 [Mount]

buildroot-external/rootfs-overlay/usr/sbin/hassos-cli

@@ -3,6 +3,12 @@
 # Run logging cli
 # ==============================================================================
 
+# Setup terminal size on serial console
+if [ "${TERM}" = "vt220" ] || [ "${TERM}" = "vt102" ] || \
+   [ "${TERM}" = "vt100" ]; then
+	resize
+fi
+
 # Run CLI container
 if [ "$(docker ps -q -f name=hassio_cli)" ]; then
     docker container exec \

buildroot-patches/0002-rpi-firmware-Bump-firmware.patch

@@ -16,7 +16,7 @@ index 59ab1da0c6..e3ba1bf99c 100644
 @@ -1,3 +1,3 @@
  # Locally computed
 -sha256 31a84340be08be319570a9d1439f25c0e3513fed73065a56aa5dd61dd605d5d9 rpi-firmware-01ecfd2ba2b7cf3a2f4aa75ada895ee4a3e729f5.tar.gz
-+sha256 4789d4422b3bc7eab157471ba36aebd54efc2a6de4c937f5cfdb4392af04fe80 rpi-firmware-7caead9416f64b2d33361c703fb243b8e157eba4.tar.gz
++sha256 6e5f1bf068995078d4d6a01899a7f7fe094b92a4f5cc19f0d4f67040a3175aa9 rpi-firmware-2b41f509710d99758a5b8efa88d95dd0e9169c0a.tar.gz
  sha256 c7283ff51f863d93a275c66e3b4cb08021a5dd4d8c1e7acc47d872fbe52d3d6b boot/LICENCE.broadcom
 diff --git a/package/rpi-firmware/rpi-firmware.mk b/package/rpi-firmware/rpi-firmware.mk
 index 6fee60b08c..2177ca9859 100644
@@ -27,7 +27,7 @@ index 6fee60b08c..2177ca9859 100644
  ################################################################################
  
 -RPI_FIRMWARE_VERSION = 01ecfd2ba2b7cf3a2f4aa75ada895ee4a3e729f5
-+RPI_FIRMWARE_VERSION = 7caead9416f64b2d33361c703fb243b8e157eba4
++RPI_FIRMWARE_VERSION = 2b41f509710d99758a5b8efa88d95dd0e9169c0a
  RPI_FIRMWARE_SITE = $(call github,raspberrypi,firmware,$(RPI_FIRMWARE_VERSION))
  RPI_FIRMWARE_LICENSE = BSD-3-Clause
  RPI_FIRMWARE_LICENSE_FILES = boot/LICENCE.broadcom

buildroot-patches/0008-Linux-5.7.patch

@@ -1,68 +0,0 @@
-From e36dc9a2a030204b5b6c6868348878b596f88de3 Mon Sep 17 00:00:00 2001
-From: Pascal Vizeli <pvizeli@syshack.ch>
-Date: Fri, 5 Jun 2020 14:18:26 +0000
-Subject: [PATCH 1/1] Linux 5.7
-
-Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
----
- package/linux-headers/Config.in.host               | 4 ++++
- toolchain/Config.in                                | 5 +++++
- .../toolchain-external-custom/Config.in.options    | 4 ++++
- 3 files changed, 13 insertions(+)
-
-diff --git a/package/linux-headers/Config.in.host b/package/linux-headers/Config.in.host
-index 95e85a00..88b9ff99 100644
---- a/package/linux-headers/Config.in.host
-+++ b/package/linux-headers/Config.in.host
-@@ -127,6 +127,10 @@ choice
- 	  If your kernel headers are more recent than the latest version
- 	  in the choice, then select the latest version.
- 
-+config BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_7
-+	bool "5.7.x or later"
-+	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_7
-+
- config BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_4
- 	bool "5.4.x or later"
- 	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4
-diff --git a/toolchain/Config.in b/toolchain/Config.in
-index bff57280..c07a92ce 100644
---- a/toolchain/Config.in
-+++ b/toolchain/Config.in
-@@ -470,6 +470,10 @@ config BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4
- 	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_3
- 	select BR2_TOOLCHAIN_HEADERS_LATEST
- 
-+config BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_7
-+	bool
-+	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4
-+
- # This should be selected by the latest version, above, to indicate that
- # Buildroot does not know of more recent headers than the ones selected.
- # This allows using toolchains with headers more recent than Buildroot
-@@ -481,6 +485,7 @@ config BR2_TOOLCHAIN_HEADERS_LATEST
- # stops affecting a value on the first matching default.
- config BR2_TOOLCHAIN_HEADERS_AT_LEAST
- 	string
-+	default "5.7"  if BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_7
- 	default "5.4"  if BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4
- 	default "5.3"  if BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_3
- 	default "5.2"  if BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_2
-diff --git a/toolchain/toolchain-external/toolchain-external-custom/Config.in.options b/toolchain/toolchain-external/toolchain-external-custom/Config.in.options
-index 8c38dd9f..b49231e1 100644
---- a/toolchain/toolchain-external/toolchain-external-custom/Config.in.options
-+++ b/toolchain/toolchain-external/toolchain-external-custom/Config.in.options
-@@ -115,6 +115,10 @@ choice
- 	  If your toolchain uses headers newer than the latest version
- 	  in the choice, then select the latest version.
- 
-+config BR2_TOOLCHAIN_EXTERNAL_HEADERS_5_7
-+	bool "5.7.x or later"
-+	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_7
-+
- config BR2_TOOLCHAIN_EXTERNAL_HEADERS_5_4
- 	bool "5.4.x or later"
- 	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4
--- 
-2.17.1
-

buildroot/.gitlab-ci.yml

@@ -4,12 +4,13 @@
 # It needs to be regenerated every time a defconfig is added, using
 # "make .gitlab-ci.yml".
 
-image: buildroot/base:20191027.2027
+image: buildroot/base:20200814.2228
 
 .check_base:
-    except:
-        - /^.*-.*_defconfig$/
-        - /^.*-tests\..*$/
+    rules:
+        - if: '$CI_COMMIT_REF_NAME =~ /^.*-.*_defconfig$/ || $CI_COMMIT_REF_NAME =~ /^.*-tests\..*$/'
+          when: never
+        - when: always
 
 check-DEVELOPERS:
     extends: .check_base
@@ -27,7 +28,7 @@ check-flake8:
         - find * -type f -print0 | xargs -0 file | grep 'Python script' | cut -d':' -f1 >> files.txt
         - sort -u files.txt | tee files.processed
     script:
-        - python -m flake8 --statistics --count --max-line-length=132 $(cat files.processed)
+        - python3 -m flake8 --statistics --count --max-line-length=132 $(cat files.processed)
     after_script:
         - wc -l files.processed
 
@@ -69,17 +70,21 @@ check-package:
     extends: .defconfig_base
     # Running the defconfigs for every push is too much, so limit to
     # explicit triggers through the API.
-    only:
-        - triggers
-        - tags
-        - /-defconfigs$/
+    rules:
+        # For tags, create a pipeline.
+        - if: '$CI_COMMIT_TAG'
+        # For pipeline created by using a trigger token.
+        - if: '$CI_PIPELINE_TRIGGERED'
+        # For the branch or tag name named *-defconfigs, create a pipeline.
+        - if: '$CI_COMMIT_REF_NAME =~ /^.*-defconfigs$/'
     before_script:
         - DEFCONFIG_NAME=${CI_JOB_NAME}
 
 one-defconfig:
     extends: .defconfig_base
-    only:
-        - /^.*-.*_defconfig$/
+    rules:
+        # For the branch or tag name named *-*_defconfigs, create a pipeline.
+        - if: '$CI_COMMIT_REF_NAME =~ /^.*-.*_defconfig$/'
     before_script:
         - DEFCONFIG_NAME=$(echo ${CI_COMMIT_REF_NAME} | sed -e 's,^.*-,,g')
 
@@ -103,17 +108,20 @@ one-defconfig:
     extends: .runtime_test_base
     # Running the runtime tests for every push is too much, so limit to
     # explicit triggers through the API.
-    only:
-        - triggers
-        - tags
-        - /-runtime-tests$/
+    rules:
+        # For tags, create a pipeline.
+        - if: '$CI_COMMIT_TAG'
+        # For pipeline created by using a trigger token.
+        - if: '$CI_PIPELINE_TRIGGERED'
+        # For the branch or tag name named *-runtime-tests, create a pipeline.
+        - if: '$CI_COMMIT_REF_NAME =~ /^.*-runtime-tests$/'
     before_script:
         - TEST_CASE_NAME=${CI_JOB_NAME}
 
 one-runtime_test:
     extends: .runtime_test_base
-    only:
-        - /^.*-tests\..*$/
+    rules:
+        - if: '$CI_COMMIT_REF_NAME =~ /^.*-tests\..*$/'
     before_script:
         - TEST_CASE_NAME=$(echo ${CI_COMMIT_REF_NAME} | sed -e 's,^.*-,,g')
 aarch64_efi_defconfig: { extends: .defconfig }

buildroot/.gitlab-ci.yml.in

@@ -4,12 +4,13 @@
 # It needs to be regenerated every time a defconfig is added, using
 # "make .gitlab-ci.yml".
 
-image: buildroot/base:20191027.2027
+image: buildroot/base:20200814.2228
 
 .check_base:
-    except:
-        - /^.*-.*_defconfig$/
-        - /^.*-tests\..*$/
+    rules:
+        - if: '$CI_COMMIT_REF_NAME =~ /^.*-.*_defconfig$/ || $CI_COMMIT_REF_NAME =~ /^.*-tests\..*$/'
+          when: never
+        - when: always
 
 check-DEVELOPERS:
     extends: .check_base
@@ -27,7 +28,7 @@ check-flake8:
         - find * -type f -print0 | xargs -0 file | grep 'Python script' | cut -d':' -f1 >> files.txt
         - sort -u files.txt | tee files.processed
     script:
-        - python -m flake8 --statistics --count --max-line-length=132 $(cat files.processed)
+        - python3 -m flake8 --statistics --count --max-line-length=132 $(cat files.processed)
     after_script:
         - wc -l files.processed
 
@@ -69,17 +70,21 @@ check-package:
     extends: .defconfig_base
     # Running the defconfigs for every push is too much, so limit to
     # explicit triggers through the API.
-    only:
-        - triggers
-        - tags
-        - /-defconfigs$/
+    rules:
+        # For tags, create a pipeline.
+        - if: '$CI_COMMIT_TAG'
+        # For pipeline created by using a trigger token.
+        - if: '$CI_PIPELINE_TRIGGERED'
+        # For the branch or tag name named *-defconfigs, create a pipeline.
+        - if: '$CI_COMMIT_REF_NAME =~ /^.*-defconfigs$/'
     before_script:
         - DEFCONFIG_NAME=${CI_JOB_NAME}
 
 one-defconfig:
     extends: .defconfig_base
-    only:
-        - /^.*-.*_defconfig$/
+    rules:
+        # For the branch or tag name named *-*_defconfigs, create a pipeline.
+        - if: '$CI_COMMIT_REF_NAME =~ /^.*-.*_defconfig$/'
     before_script:
         - DEFCONFIG_NAME=$(echo ${CI_COMMIT_REF_NAME} | sed -e 's,^.*-,,g')
 
@@ -103,16 +108,19 @@ one-defconfig:
     extends: .runtime_test_base
     # Running the runtime tests for every push is too much, so limit to
     # explicit triggers through the API.
-    only:
-        - triggers
-        - tags
-        - /-runtime-tests$/
+    rules:
+        # For tags, create a pipeline.
+        - if: '$CI_COMMIT_TAG'
+        # For pipeline created by using a trigger token.
+        - if: '$CI_PIPELINE_TRIGGERED'
+        # For the branch or tag name named *-runtime-tests, create a pipeline.
+        - if: '$CI_COMMIT_REF_NAME =~ /^.*-runtime-tests$/'
     before_script:
         - TEST_CASE_NAME=${CI_JOB_NAME}
 
 one-runtime_test:
     extends: .runtime_test_base
-    only:
-        - /^.*-tests\..*$/
+    rules:
+        - if: '$CI_COMMIT_REF_NAME =~ /^.*-tests\..*$/'
     before_script:
         - TEST_CASE_NAME=$(echo ${CI_COMMIT_REF_NAME} | sed -e 's,^.*-,,g')

buildroot/CHANGES

@@ -1,3 +1,94 @@
+2020.02.7, released October 12th, 2020
+
+	Important / security related fixes.
+
+	meson: Correct SDK cross-compilation.conf file when
+	per-package builds were used to build SDK.
+
+	systemd: Use /run rather than /var/run for PID files in units.
+
+	Toolchain: use Secure-PLT rather than BSS-PLT for PowerPC 32.
+
+	support/script/pycompile: Rework logic to ensure .pyc files
+	contain absolute target paths, fixing code inspection at
+	runtime when executed with cwd != '/'.
+
+	support/scripts/setlocalversion: Correct Mercurial output to
+	match behaviour with Git.
+
+	support/scripts/apply-patches.sh: Use patch
+	--no-backup-if-mismatch, so we no longer blindly have to
+	remove *.orig files after patching, fixing issues with
+	packages containing such files.
+
+	Updated/fixed packages: bandwidthd, barebox, bash, bison,
+	brotli, cifs-utils, cryptsetup, dhcpcd, dhcpdump, docker-cli,
+	docker-engine, ecryptfs-utils, efl, fail2ban, freetype, gcc,
+	gdb, ghostscript, gnutls, go, gst1-plugins-base,
+	gst1-plugins-ugly, ipmitool, libhtp, libraw, libssh, libxml2,
+	libxml-parser-perl, localedef, lua, memcached, mesa3d, meson,
+	minidlna, nginx, nodejs, nss-pam-ldapd, openvmtools, php,
+	postgresql, python, python-aenum, python-autobahn,
+	python-engineio, python-fire, python-pymodbus, python-scapy,
+	python-semver, python-sentry-sdk, python-socketio,
+	python-texttable, python-tinyrpc, python-txtorcon, python3,
+	qt5base, runc, samba4, strace, supertux, suricata, systemd,
+	vlc, wayland-protocols, wireguard-linux-compat, wireshark,
+	xserver_xorg-server, zeromq, zstd
+
+	Issues resolved (http://bugs.uclibc.org):
+
+	#12911: usb_modeswitch installation race condition
+	#13251: cryptsetup does not work on branch 2020.02 following..
+
+2020.02.6, released September 5th, 2020
+
+	Important / security related fixes.
+
+	Fix a 2020.02.5 build regression in busybox when systemd (and
+	not less) are enabled because of missing infrastructure.
+
+	Updated/fixed packages: alsa-utils, avahi, busybox, cups,
+	docker-cli, graphite2, imagemagick, libeXosip2, mbedtls,
+	nvidia-driver, paho-mqtt-c, python-django, systemd, uclibc,
+	usb_modeswitch, wolfssl
+
+	Issues resolved (http://bugs.uclibc.org):
+
+	#12911: usb_modeswitch installation race condition
+
+2020.02.5, released August 29th, 2020
+
+	Important / security related fixes.
+
+	Infrastructure: Ensure RPATH entries that may be needed for
+	dlopen() are not dropped by patchelf.
+
+	BR_VERSION_FULL/setlocalversion (used by make print-version
+	and /etc/os-release): Properly handle local git tags
+
+	Updated/fixed packages: apache, at91bootstrap3, bind, boost,
+	busybox, capnproto, chrony, collectd, cpio, cryptsetup, cups,
+	cvs, dbus, docker-engine, domoticz, dovecot,
+	dovecot-pigeonhole, dropbear, efl, elixir, f2fs-tools, ffmpeg,
+	gd, gdk-pixbuf, ghostscript, glibc, grub2, gst1-plugins-bad,
+	hostapd, iputils, jasper, json-c, libcurl, libwebsockets,
+	linux, live555, mesa3d, mosquitto, mpv, nodejs, opencv,
+	opencv3, openjpeg, patchelf, perl, php, postgresql,
+	python-django, python-gunicorn, python-matplotlib, ripgrep,
+	rtl8188eu, rtl8821au, ruby, shadowsocks-libev, squid,
+	tpm2-abrmd, tpm2-tools, trousers, uacme, webkitgtk, wireshark,
+	wolfssl, wpa_supplicant, wpewebkit, xen, xlib_libX11,
+	xserver_xorg-server
+
+	Issues resolved (http://bugs.uclibc.org):
+
+	#12876: nodejs fails to build when host-icu has been built before
+	#13111: python-gunicorn: missing dependency on python-setuptools
+	#13121: wpa_supplicant fails to build without libopenssl enabled
+	#13141: Target-finalize fail with "depmod: ERROR: Bad version passed"
+	#13156: package live555 new license
+
 2020.02.4, released July 26th, 2020
 
 	Important / security related fixes.

buildroot/DEVELOPERS

@@ -186,18 +186,25 @@ F:	package/rauc/
 
 N:	Angelo Compagnucci <angelo.compagnucci@gmail.com>
 F:	package/corkscrew/
+F:	package/cups/
+F:	package/cups-filters/
 F:	package/fail2ban/
+F:	package/grep/
 F:	package/i2c-tools/
+F:	package/jq/
+F:	package/libb64/
 F:	package/mender/
 F:	package/mender-artifact/
 F:	package/mono/
 F:	package/mono-gtksharp3/
 F:	package/monolite/
+F:	package/openjpeg/
 F:	package/python-can/
 F:	package/python-pillow/
 F:	package/python-pydal/
 F:	package/python-spidev/
 F:	package/python-web2py/
+F:	package/sam-ba/
 F:	package/sshguard/
 F:	package/sunwait/
 F:	package/sysdig/
@@ -211,6 +218,8 @@ N:	Anthony Viallard <viallard@syscom-instruments.com>
 F:	package/gnuplot/
 
 N:	Antoine Ténart <antoine.tenart@bootlin.com>
+F:	package/libselinux/
+F:	package/refpolicy/
 F:	package/wf111/
 
 N:	Antony Pavlov <antonynpavlov@gmail.com>
@@ -1035,6 +1044,7 @@ N:	Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
 F:	package/gnuradio/
 F:	package/gqrx/
 F:	package/gr-osmosdr/
+F:	package/librtlsdr/
 F:	package/libusbgx/
 F:	package/python-cheetah/
 F:	package/python-markdown/
@@ -1713,9 +1723,6 @@ F:	package/systemd-bootchart/
 F:	package/tinyalsa/
 F:	package/tinyxml/
 
-N:	Maxime Ripard <maxime.ripard@bootlin.com>
-F:	package/kmsxx/
-
 N:	Michael Durrant <mdurrant@arcturusnetworks.com>
 F:	board/arcturus/
 F:	configs/arcturus_ucp1020_defconfig
@@ -1810,6 +1817,7 @@ F:	package/tpm-tools/
 F:	package/trousers/
 
 N:	Norbert Lange <nolange79@gmail.com>
+F:	package/systemd/
 F:	package/tcf-agent/
 
 N:	Nylon Chen <nylon7@andestech.com>
@@ -2135,6 +2143,7 @@ F:	package/davfs2/
 
 N:	Ryan Barnett <ryan.barnett@rockwellcollins.com>
 F:	package/atftp/
+F:	package/c-periphery/
 F:	package/miraclecast/
 F:	package/python-pyasn/
 F:	package/python-pysnmp/

buildroot/Makefile

@@ -92,9 +92,9 @@ all:
 .PHONY: all
 
 # Set and export the version string
-export BR2_VERSION := 2020.02.4
+export BR2_VERSION := 2020.02.7
 # Actual time the release is cut (for reproducible builds)
-BR2_VERSION_EPOCH = 1595750000
+BR2_VERSION_EPOCH = 1602538000
 
 # Save running make version since it's clobbered by the make package
 RUNNING_MAKE_VERSION := $(MAKE_VERSION)
@@ -113,7 +113,13 @@ DATE := $(shell date +%Y%m%d)
 
 # Compute the full local version string so packages can use it as-is
 # Need to export it, so it can be got from environment in children (eg. mconf)
-export BR2_VERSION_FULL := $(BR2_VERSION)$(shell $(TOPDIR)/support/scripts/setlocalversion)
+
+BR2_LOCALVERSION := $(shell $(TOPDIR)/support/scripts/setlocalversion)
+ifeq ($(BR2_LOCALVERSION),)
+export BR2_VERSION_FULL := $(BR2_VERSION)
+else
+export BR2_VERSION_FULL := $(BR2_LOCALVERSION)
+endif
 
 # List of targets and target patterns for which .config doesn't need to be read in
 noconfig_targets := menuconfig nconfig gconfig xconfig config oldconfig randconfig \
@@ -793,9 +799,9 @@ endif
 # counterparts are appropriately setup as symlinks ones to the others.
 ifeq ($(BR2_ROOTFS_MERGED_USR),y)
 
-	@$(foreach d, $(call qstrip,$(BR2_ROOTFS_OVERLAY)), \
-		$(call MESSAGE,"Sanity check in overlay $(d)"); \
-		not_merged_dirs="$$(support/scripts/check-merged-usr.sh $(d))"; \
+	$(foreach d, $(call qstrip,$(BR2_ROOTFS_OVERLAY)), \
+		@$(call MESSAGE,"Sanity check in overlay $(d)")$(sep) \
+		$(Q)not_merged_dirs="$$(support/scripts/check-merged-usr.sh $(d))"; \
 		test -n "$$not_merged_dirs" && { \
 			echo "ERROR: The overlay in $(d) is not" \
 				"using a merged /usr for the following directories:" \
@@ -805,20 +811,20 @@ ifeq ($(BR2_ROOTFS_MERGED_USR),y)
 
 endif # merged /usr
 
-	@$(foreach d, $(call qstrip,$(BR2_ROOTFS_OVERLAY)), \
-		$(call MESSAGE,"Copying overlay $(d)"); \
-		$(call SYSTEM_RSYNC,$(d),$(TARGET_DIR))$(sep))
+	$(foreach d, $(call qstrip,$(BR2_ROOTFS_OVERLAY)), \
+		@$(call MESSAGE,"Copying overlay $(d)")$(sep) \
+		$(Q)$(call SYSTEM_RSYNC,$(d),$(TARGET_DIR))$(sep))
 
-	$(if $(TARGET_DIR_FILES_LISTS), \
+	$(Q)$(if $(TARGET_DIR_FILES_LISTS), \
 		cat $(TARGET_DIR_FILES_LISTS)) > $(BUILD_DIR)/packages-file-list.txt
-	$(if $(HOST_DIR_FILES_LISTS), \
+	$(Q)$(if $(HOST_DIR_FILES_LISTS), \
 		cat $(HOST_DIR_FILES_LISTS)) > $(BUILD_DIR)/packages-file-list-host.txt
-	$(if $(STAGING_DIR_FILES_LISTS), \
+	$(Q)$(if $(STAGING_DIR_FILES_LISTS), \
 		cat $(STAGING_DIR_FILES_LISTS)) > $(BUILD_DIR)/packages-file-list-staging.txt
 
-	@$(foreach s, $(call qstrip,$(BR2_ROOTFS_POST_BUILD_SCRIPT)), \
-		$(call MESSAGE,"Executing post-build script $(s)"); \
-		$(EXTRA_ENV) $(s) $(TARGET_DIR) $(call qstrip,$(BR2_ROOTFS_POST_SCRIPT_ARGS))$(sep))
+	$(foreach s, $(call qstrip,$(BR2_ROOTFS_POST_BUILD_SCRIPT)), \
+		@$(call MESSAGE,"Executing post-build script $(s)")$(sep) \
+		$(Q)$(EXTRA_ENV) $(s) $(TARGET_DIR) $(call qstrip,$(BR2_ROOTFS_POST_SCRIPT_ARGS))$(sep))
 
 	touch $(TARGET_DIR)/usr
 

buildroot/boot/at91bootstrap3/Config.in

@@ -1,6 +1,6 @@
 config BR2_TARGET_AT91BOOTSTRAP3
 	bool "AT91 Bootstrap 3"
-	depends on BR2_arm926t || BR2_cortex_a5
+	depends on BR2_arm926t || BR2_cortex_a5 || BR2_cortex_a7
 	help
 	  AT91Bootstrap is a first level bootloader for the Atmel AT91
 	  devices. It integrates algorithms for:

buildroot/boot/barebox/barebox.mk

@@ -88,13 +88,6 @@ $(1)_KCONFIG_DEPENDENCIES = \
 	$(BR2_BISON_HOST_DEPENDENCY) \
 	$(BR2_FLEX_HOST_DEPENDENCY)
 
-ifeq ($$(BR2_TARGET_$(1)_BAREBOXENV),y)
-define $(1)_BUILD_BAREBOXENV_CMDS
-	$$(TARGET_CC) $$(TARGET_CFLAGS) $$(TARGET_LDFLAGS) -o $$(@D)/bareboxenv \
-		$$(@D)/scripts/bareboxenv.c
-endef
-endif
-
 ifeq ($$(BR2_TARGET_$(1)_CUSTOM_ENV),y)
 $(1)_ENV_NAME = $$(notdir $$(call qstrip,\
 	$$(BR2_TARGET_$(1)_CUSTOM_ENV_PATH)))
@@ -109,12 +102,23 @@ endef
 endif
 
 ifneq ($$($(1)_CUSTOM_EMBEDDED_ENV_PATH),)
-define $(1)_KCONFIG_FIXUP_CMDS
-	$$(call KCONFIG_ENABLE_OPT,CONFIG_DEFAULT_ENVIRONMENT,$$(@D)/.config)
-	$$(call KCONFIG_SET_OPT,CONFIG_DEFAULT_ENVIRONMENT_PATH,"$$($(1)_CUSTOM_EMBEDDED_ENV_PATH)",$$(@D)/.config)
+define $(1)_KCONFIG_FIXUP_CUSTOM_EMBEDDED_ENV_PATH
+	$$(call KCONFIG_ENABLE_OPT,CONFIG_DEFAULT_ENVIRONMENT)
+	$$(call KCONFIG_SET_OPT,CONFIG_DEFAULT_ENVIRONMENT_PATH,"$$($(1)_CUSTOM_EMBEDDED_ENV_PATH)")
 endef
 endif
 
+define $(1)_KCONFIG_FIXUP_BAREBOXENV
+	$$(if $$(BR2_TARGET_$(1)_BAREBOXENV),\
+		$$(call KCONFIG_ENABLE_OPT,CONFIG_BAREBOXENV_TARGET),\
+		$$(call KCONFIG_DISABLE_OPT,CONFIG_BAREBOXENV_TARGET))
+endef
+
+define $(1)_KCONFIG_FIXUP_CMDS
+	$$($(1)_KCONFIG_FIXUP_CUSTOM_EMBEDDED_ENV_PATH)
+	$$($(1)_KCONFIG_FIXUP_BAREBOXENV)
+endef
+
 define $(1)_BUILD_CMDS
 	$$($(1)_BUILD_BAREBOXENV_CMDS)
 	$$(TARGET_MAKE_ENV) $$(MAKE) $$($(1)_MAKE_FLAGS) -C $$(@D)
@@ -136,7 +140,7 @@ endef
 
 ifeq ($$(BR2_TARGET_$(1)_BAREBOXENV),y)
 define $(1)_INSTALL_TARGET_CMDS
-	cp $$(@D)/bareboxenv $$(TARGET_DIR)/usr/bin
+	cp $$(@D)/scripts/bareboxenv-target $$(TARGET_DIR)/usr/bin/bareboxenv
 endef
 endif
 

buildroot/boot/grub2/0002-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch

@@ -0,0 +1,73 @@
+From a7ab0cc98fa89a3d5098c29cbe44bcd24b0a6454 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Wed, 15 Apr 2020 15:45:02 -0400
+Subject: [PATCH] yylex: Make lexer fatal errors actually be fatal
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When presented with a command that can't be tokenized to anything
+smaller than YYLMAX characters, the parser calls YY_FATAL_ERROR(errmsg),
+expecting that will stop further processing, as such:
+
+  #define YY_DO_BEFORE_ACTION \
+        yyg->yytext_ptr = yy_bp; \
+        yyleng = (int) (yy_cp - yy_bp); \
+        yyg->yy_hold_char = *yy_cp; \
+        *yy_cp = '\0'; \
+        if ( yyleng >= YYLMAX ) \
+                YY_FATAL_ERROR( "token too large, exceeds YYLMAX" ); \
+        yy_flex_strncpy( yytext, yyg->yytext_ptr, yyleng + 1 , yyscanner); \
+        yyg->yy_c_buf_p = yy_cp;
+
+The code flex generates expects that YY_FATAL_ERROR() will either return
+for it or do some form of longjmp(), or handle the error in some way at
+least, and so the strncpy() call isn't in an "else" clause, and thus if
+YY_FATAL_ERROR() is *not* actually fatal, it does the call with the
+questionable limit, and predictable results ensue.
+
+Unfortunately, our implementation of YY_FATAL_ERROR() is:
+
+   #define YY_FATAL_ERROR(msg)                     \
+     do {                                          \
+       grub_printf (_("fatal error: %s\n"), _(msg));     \
+     } while (0)
+
+The same pattern exists in yyless(), and similar problems exist in users
+of YY_INPUT(), several places in the main parsing loop,
+yy_get_next_buffer(), yy_load_buffer_state(), yyensure_buffer_stack,
+yy_scan_buffer(), etc.
+
+All of these callers expect YY_FATAL_ERROR() to actually be fatal, and
+the things they do if it returns after calling it are wildly unsafe.
+
+Fixes: CVE-2020-10713
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/script/yylex.l | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/script/yylex.l b/grub-core/script/yylex.l
+index 7b44c37b7..b7203c823 100644
+--- a/grub-core/script/yylex.l
++++ b/grub-core/script/yylex.l
+@@ -37,11 +37,11 @@
+ 
+ /* 
+  * As we don't have access to yyscanner, we cannot do much except to
+- * print the fatal error.
++ * print the fatal error and exit.
+  */
+ #define YY_FATAL_ERROR(msg)                     \
+   do {                                          \
+-    grub_printf (_("fatal error: %s\n"), _(msg));     \
++    grub_fatal (_("fatal error: %s\n"), _(msg));\
+   } while (0)
+ 
+ #define COPY(str, hint)                         \
+-- 
+2.26.2
+

buildroot/boot/grub2/0003-safemath-Add-some-arithmetic-primitives-that-check-f.patch

@@ -0,0 +1,128 @@
+From 782a4580a5e347793443aa8e9152db1bf4a0fff8 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Mon, 15 Jun 2020 10:58:42 -0400
+Subject: [PATCH] safemath: Add some arithmetic primitives that check for
+ overflow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This adds a new header, include/grub/safemath.h, that includes easy to
+use wrappers for __builtin_{add,sub,mul}_overflow() declared like:
+
+  bool OP(a, b, res)
+
+where OP is grub_add, grub_sub or grub_mul. OP() returns true in the
+case where the operation would overflow and res is not modified.
+Otherwise, false is returned and the operation is executed.
+
+These arithmetic primitives require newer compiler versions. So, bump
+these requirements in the INSTALL file too.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ INSTALL                 | 22 ++--------------------
+ include/grub/compiler.h |  8 ++++++++
+ include/grub/safemath.h | 37 +++++++++++++++++++++++++++++++++++++
+ 3 files changed, 47 insertions(+), 20 deletions(-)
+ create mode 100644 include/grub/safemath.h
+
+diff --git a/INSTALL b/INSTALL
+index 8acb40902..dcb9b7d7b 100644
+--- a/INSTALL
++++ b/INSTALL
+@@ -11,27 +11,9 @@ GRUB depends on some software packages installed into your system. If
+ you don't have any of them, please obtain and install them before
+ configuring the GRUB.
+ 
+-* GCC 4.1.3 or later
+-  Note: older versions may work but support is limited
+-
+-  Experimental support for clang 3.3 or later (results in much bigger binaries)
++* GCC 5.1.0 or later
++  Experimental support for clang 3.8.0 or later (results in much bigger binaries)
+   for i386, x86_64, arm (including thumb), arm64, mips(el), powerpc, sparc64
+-  Note: clang 3.2 or later works for i386 and x86_64 targets but results in
+-        much bigger binaries.
+-	earlier versions not tested
+-  Note: clang 3.2 or later works for arm
+-	earlier versions not tested
+-  Note: clang on arm64 is not supported due to
+-	https://llvm.org/bugs/show_bug.cgi?id=26030
+-  Note: clang 3.3 or later works for mips(el)
+-	earlier versions fail to generate .reginfo and hence gprel relocations
+-	fail.
+-  Note: clang 3.2 or later works for powerpc
+-	earlier versions not tested
+-  Note: clang 3.5 or later works for sparc64
+-        earlier versions return "error: unable to interface with target machine"
+-  Note: clang has no support for ia64 and hence you can't compile GRUB
+-	for ia64 with clang
+ * GNU Make
+ * GNU Bison 2.3 or later
+ * GNU gettext 0.17 or later
+diff --git a/include/grub/compiler.h b/include/grub/compiler.h
+index c9e1d7a73..8f3be3ae7 100644
+--- a/include/grub/compiler.h
++++ b/include/grub/compiler.h
+@@ -48,4 +48,12 @@
+ #  define WARN_UNUSED_RESULT
+ #endif
+ 
++#if defined(__clang__) && defined(__clang_major__) && defined(__clang_minor__)
++#  define CLANG_PREREQ(maj,min) \
++          ((__clang_major__ > (maj)) || \
++	   (__clang_major__ == (maj) && __clang_minor__ >= (min)))
++#else
++#  define CLANG_PREREQ(maj,min) 0
++#endif
++
+ #endif /* ! GRUB_COMPILER_HEADER */
+diff --git a/include/grub/safemath.h b/include/grub/safemath.h
+new file mode 100644
+index 000000000..c17b89bba
+--- /dev/null
++++ b/include/grub/safemath.h
+@@ -0,0 +1,37 @@
++/*
++ *  GRUB  --  GRand Unified Bootloader
++ *  Copyright (C) 2020  Free Software Foundation, Inc.
++ *
++ *  GRUB is free software: you can redistribute it and/or modify
++ *  it under the terms of the GNU General Public License as published by
++ *  the Free Software Foundation, either version 3 of the License, or
++ *  (at your option) any later version.
++ *
++ *  GRUB is distributed in the hope that it will be useful,
++ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
++ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ *  GNU General Public License for more details.
++ *
++ *  You should have received a copy of the GNU General Public License
++ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
++ *
++ *  Arithmetic operations that protect against overflow.
++ */
++
++#ifndef GRUB_SAFEMATH_H
++#define GRUB_SAFEMATH_H 1
++
++#include <grub/compiler.h>
++
++/* These appear in gcc 5.1 and clang 3.8. */
++#if GNUC_PREREQ(5, 1) || CLANG_PREREQ(3, 8)
++
++#define grub_add(a, b, res)	__builtin_add_overflow(a, b, res)
++#define grub_sub(a, b, res)	__builtin_sub_overflow(a, b, res)
++#define grub_mul(a, b, res)	__builtin_mul_overflow(a, b, res)
++
++#else
++#error gcc 5.1 or newer or clang 3.8 or newer is required
++#endif
++
++#endif /* GRUB_SAFEMATH_H */
+-- 
+2.26.2
+

buildroot/boot/grub2/0004-calloc-Make-sure-we-always-have-an-overflow-checking.patch

@@ -0,0 +1,246 @@
+From 5775eb40862b67468ced816e6d7560dbe22a3670 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Mon, 15 Jun 2020 12:15:29 -0400
+Subject: [PATCH] calloc: Make sure we always have an overflow-checking
+ calloc() available
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This tries to make sure that everywhere in this source tree, we always have
+an appropriate version of calloc() (i.e. grub_calloc(), xcalloc(), etc.)
+available, and that they all safely check for overflow and return NULL when
+it would occur.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/kern/emu/misc.c          | 12 +++++++++
+ grub-core/kern/emu/mm.c            | 10 ++++++++
+ grub-core/kern/mm.c                | 40 ++++++++++++++++++++++++++++++
+ grub-core/lib/libgcrypt_wrap/mem.c | 11 ++++++--
+ grub-core/lib/posix_wrap/stdlib.h  |  8 +++++-
+ include/grub/emu/misc.h            |  1 +
+ include/grub/mm.h                  |  6 +++++
+ 7 files changed, 85 insertions(+), 3 deletions(-)
+
+diff --git a/grub-core/kern/emu/misc.c b/grub-core/kern/emu/misc.c
+index 65db79baa..dfd8a8ec4 100644
+--- a/grub-core/kern/emu/misc.c
++++ b/grub-core/kern/emu/misc.c
+@@ -85,6 +85,18 @@ grub_util_error (const char *fmt, ...)
+   exit (1);
+ }
+ 
++void *
++xcalloc (grub_size_t nmemb, grub_size_t size)
++{
++  void *p;
++
++  p = calloc (nmemb, size);
++  if (!p)
++    grub_util_error ("%s", _("out of memory"));
++
++  return p;
++}
++
+ void *
+ xmalloc (grub_size_t size)
+ {
+diff --git a/grub-core/kern/emu/mm.c b/grub-core/kern/emu/mm.c
+index f262e95e3..145b01d37 100644
+--- a/grub-core/kern/emu/mm.c
++++ b/grub-core/kern/emu/mm.c
+@@ -25,6 +25,16 @@
+ #include <string.h>
+ #include <grub/i18n.h>
+ 
++void *
++grub_calloc (grub_size_t nmemb, grub_size_t size)
++{
++  void *ret;
++  ret = calloc (nmemb, size);
++  if (!ret)
++    grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory"));
++  return ret;
++}
++
+ void *
+ grub_malloc (grub_size_t size)
+ {
+diff --git a/grub-core/kern/mm.c b/grub-core/kern/mm.c
+index ee88ff611..f2822a836 100644
+--- a/grub-core/kern/mm.c
++++ b/grub-core/kern/mm.c
+@@ -67,8 +67,10 @@
+ #include <grub/dl.h>
+ #include <grub/i18n.h>
+ #include <grub/mm_private.h>
++#include <grub/safemath.h>
+ 
+ #ifdef MM_DEBUG
++# undef grub_calloc
+ # undef grub_malloc
+ # undef grub_zalloc
+ # undef grub_realloc
+@@ -375,6 +377,30 @@ grub_memalign (grub_size_t align, grub_size_t size)
+   return 0;
+ }
+ 
++/*
++ * Allocate NMEMB instances of SIZE bytes and return the pointer, or error on
++ * integer overflow.
++ */
++void *
++grub_calloc (grub_size_t nmemb, grub_size_t size)
++{
++  void *ret;
++  grub_size_t sz = 0;
++
++  if (grub_mul (nmemb, size, &sz))
++    {
++      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
++      return NULL;
++    }
++
++  ret = grub_memalign (0, sz);
++  if (!ret)
++    return NULL;
++
++  grub_memset (ret, 0, sz);
++  return ret;
++}
++
+ /* Allocate SIZE bytes and return the pointer.  */
+ void *
+ grub_malloc (grub_size_t size)
+@@ -561,6 +587,20 @@ grub_mm_dump (unsigned lineno)
+   grub_printf ("\n");
+ }
+ 
++void *
++grub_debug_calloc (const char *file, int line, grub_size_t nmemb, grub_size_t size)
++{
++  void *ptr;
++
++  if (grub_mm_debug)
++    grub_printf ("%s:%d: calloc (0x%" PRIxGRUB_SIZE ", 0x%" PRIxGRUB_SIZE ") = ",
++		 file, line, size);
++  ptr = grub_calloc (nmemb, size);
++  if (grub_mm_debug)
++    grub_printf ("%p\n", ptr);
++  return ptr;
++}
++
+ void *
+ grub_debug_malloc (const char *file, int line, grub_size_t size)
+ {
+diff --git a/grub-core/lib/libgcrypt_wrap/mem.c b/grub-core/lib/libgcrypt_wrap/mem.c
+index beeb661a3..74c6eafe5 100644
+--- a/grub-core/lib/libgcrypt_wrap/mem.c
++++ b/grub-core/lib/libgcrypt_wrap/mem.c
+@@ -4,6 +4,7 @@
+ #include <grub/crypto.h>
+ #include <grub/dl.h>
+ #include <grub/env.h>
++#include <grub/safemath.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -36,7 +37,10 @@ void *
+ gcry_xcalloc (size_t n, size_t m)
+ {
+   void *ret;
+-  ret = grub_zalloc (n * m);
++  size_t sz;
++  if (grub_mul (n, m, &sz))
++    grub_fatal ("gcry_xcalloc would overflow");
++  ret = grub_zalloc (sz);
+   if (!ret)
+     grub_fatal ("gcry_xcalloc failed");
+   return ret;
+@@ -56,7 +60,10 @@ void *
+ gcry_xcalloc_secure (size_t n, size_t m)
+ {
+   void *ret;
+-  ret = grub_zalloc (n * m);
++  size_t sz;
++  if (grub_mul (n, m, &sz))
++    grub_fatal ("gcry_xcalloc would overflow");
++  ret = grub_zalloc (sz);
+   if (!ret)
+     grub_fatal ("gcry_xcalloc failed");
+   return ret;
+diff --git a/grub-core/lib/posix_wrap/stdlib.h b/grub-core/lib/posix_wrap/stdlib.h
+index 3b46f47ff..7a8d385e9 100644
+--- a/grub-core/lib/posix_wrap/stdlib.h
++++ b/grub-core/lib/posix_wrap/stdlib.h
+@@ -21,6 +21,7 @@
+ 
+ #include <grub/mm.h>
+ #include <grub/misc.h>
++#include <grub/safemath.h>
+ 
+ static inline void 
+ free (void *ptr)
+@@ -37,7 +38,12 @@ malloc (grub_size_t size)
+ static inline void *
+ calloc (grub_size_t size, grub_size_t nelem)
+ {
+-  return grub_zalloc (size * nelem);
++  grub_size_t sz;
++
++  if (grub_mul (size, nelem, &sz))
++    return NULL;
++
++  return grub_zalloc (sz);
+ }
+ 
+ static inline void *
+diff --git a/include/grub/emu/misc.h b/include/grub/emu/misc.h
+index ce464cfd0..ff9c48a64 100644
+--- a/include/grub/emu/misc.h
++++ b/include/grub/emu/misc.h
+@@ -47,6 +47,7 @@ grub_util_device_is_mapped (const char *dev);
+ #define GRUB_HOST_PRIuLONG_LONG "llu"
+ #define GRUB_HOST_PRIxLONG_LONG "llx"
+ 
++void * EXPORT_FUNC(xcalloc) (grub_size_t nmemb, grub_size_t size) WARN_UNUSED_RESULT;
+ void * EXPORT_FUNC(xmalloc) (grub_size_t size) WARN_UNUSED_RESULT;
+ void * EXPORT_FUNC(xrealloc) (void *ptr, grub_size_t size) WARN_UNUSED_RESULT;
+ char * EXPORT_FUNC(xstrdup) (const char *str) WARN_UNUSED_RESULT;
+diff --git a/include/grub/mm.h b/include/grub/mm.h
+index 28e2e53eb..9c38dd3ca 100644
+--- a/include/grub/mm.h
++++ b/include/grub/mm.h
+@@ -29,6 +29,7 @@
+ #endif
+ 
+ void grub_mm_init_region (void *addr, grub_size_t size);
++void *EXPORT_FUNC(grub_calloc) (grub_size_t nmemb, grub_size_t size);
+ void *EXPORT_FUNC(grub_malloc) (grub_size_t size);
+ void *EXPORT_FUNC(grub_zalloc) (grub_size_t size);
+ void EXPORT_FUNC(grub_free) (void *ptr);
+@@ -48,6 +49,9 @@ extern int EXPORT_VAR(grub_mm_debug);
+ void grub_mm_dump_free (void);
+ void grub_mm_dump (unsigned lineno);
+ 
++#define grub_calloc(nmemb, size)	\
++  grub_debug_calloc (GRUB_FILE, __LINE__, nmemb, size)
++
+ #define grub_malloc(size)	\
+   grub_debug_malloc (GRUB_FILE, __LINE__, size)
+ 
+@@ -63,6 +67,8 @@ void grub_mm_dump (unsigned lineno);
+ #define grub_free(ptr)	\
+   grub_debug_free (GRUB_FILE, __LINE__, ptr)
+ 
++void *EXPORT_FUNC(grub_debug_calloc) (const char *file, int line,
++				      grub_size_t nmemb, grub_size_t size);
+ void *EXPORT_FUNC(grub_debug_malloc) (const char *file, int line,
+ 				      grub_size_t size);
+ void *EXPORT_FUNC(grub_debug_zalloc) (const char *file, int line,
+-- 
+2.26.2
+

buildroot/boot/grub2/0007-iso9660-Don-t-leak-memory-on-realloc-failures.patch

@@ -0,0 +1,72 @@
+From e0dd17a3ce79c6622dc78c96e1f2ef1b20e2bf7b Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Sat, 4 Jul 2020 12:25:09 -0400
+Subject: [PATCH] iso9660: Don't leak memory on realloc() failures
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/fs/iso9660.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c
+index 7ba5b300b..5ec4433b8 100644
+--- a/grub-core/fs/iso9660.c
++++ b/grub-core/fs/iso9660.c
+@@ -533,14 +533,20 @@ add_part (struct iterate_dir_ctx *ctx,
+ {
+   int size = ctx->symlink ? grub_strlen (ctx->symlink) : 0;
+   grub_size_t sz;
++  char *new;
+ 
+   if (grub_add (size, len2, &sz) ||
+       grub_add (sz, 1, &sz))
+     return;
+ 
+-  ctx->symlink = grub_realloc (ctx->symlink, sz);
+-  if (! ctx->symlink)
+-    return;
++  new = grub_realloc (ctx->symlink, sz);
++  if (!new)
++    {
++      grub_free (ctx->symlink);
++      ctx->symlink = NULL;
++      return;
++    }
++  ctx->symlink = new;
+ 
+   grub_memcpy (ctx->symlink + size, part, len2);
+   ctx->symlink[size + len2] = 0;  
+@@ -634,7 +640,12 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry,
+ 		   is the length.  Both are part of the `Component
+ 		   Record'.  */
+ 		if (ctx->symlink && !ctx->was_continue)
+-		  add_part (ctx, "/", 1);
++		  {
++		    add_part (ctx, "/", 1);
++		    if (grub_errno)
++		      return grub_errno;
++		  }
++
+ 		add_part (ctx, (char *) &entry->data[pos + 2],
+ 			  entry->data[pos + 1]);
+ 		ctx->was_continue = (entry->data[pos] & 1);
+@@ -653,6 +664,11 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry,
+ 	      add_part (ctx, "/", 1);
+ 	      break;
+ 	    }
++
++	  /* Check if grub_realloc() failed in add_part(). */
++	  if (grub_errno)
++	    return grub_errno;
++
+ 	  /* In pos + 1 the length of the `Component Record' is
+ 	     stored.  */
+ 	  pos += entry->data[pos + 1] + 2;
+-- 
+2.26.2
+

buildroot/boot/grub2/0008-font-Do-not-load-more-than-one-NAME-section.patch

@@ -0,0 +1,41 @@
+From 73bc7a964c9496d5b0f00dbd69959dacf5adcebe Mon Sep 17 00:00:00 2001
+From: Daniel Kiper <daniel.kiper@oracle.com>
+Date: Tue, 7 Jul 2020 15:36:26 +0200
+Subject: [PATCH] font: Do not load more than one NAME section
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The GRUB font file can have one NAME section only. Though if somebody
+crafts a broken font file with many NAME sections and loads it then the
+GRUB leaks memory. So, prevent against that by loading first NAME
+section and failing in controlled way on following one.
+
+Reported-by: Chris Coulson <chris.coulson@canonical.com>
+Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com>
+Reviewed-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/font/font.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/grub-core/font/font.c b/grub-core/font/font.c
+index 5edb477ac..d09bb38d8 100644
+--- a/grub-core/font/font.c
++++ b/grub-core/font/font.c
+@@ -532,6 +532,12 @@ grub_font_load (const char *filename)
+       if (grub_memcmp (section.name, FONT_FORMAT_SECTION_NAMES_FONT_NAME,
+ 		       sizeof (FONT_FORMAT_SECTION_NAMES_FONT_NAME) - 1) == 0)
+ 	{
++	  if (font->name != NULL)
++	    {
++	      grub_error (GRUB_ERR_BAD_FONT, "invalid font file: too many NAME sections");
++	      goto fail;
++	    }
++
+ 	  font->name = read_section_as_string (&section);
+ 	  if (!font->name)
+ 	    goto fail;
+-- 
+2.26.2
+

buildroot/boot/grub2/0009-gfxmenu-Fix-double-free-in-load_image.patch

@@ -0,0 +1,39 @@
+From 9ff609f0e7798bc5fb04f791131c98e7693bdd9b Mon Sep 17 00:00:00 2001
+From: Alexey Makhalov <amakhalov@vmware.com>
+Date: Wed, 8 Jul 2020 20:41:56 +0000
+Subject: [PATCH] gfxmenu: Fix double free in load_image()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+self->bitmap should be zeroed after free. Otherwise, there is a chance
+to double free (USE_AFTER_FREE) it later in rescale_image().
+
+Fixes: CID 292472
+
+Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/gfxmenu/gui_image.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/gfxmenu/gui_image.c b/grub-core/gfxmenu/gui_image.c
+index 29784ed2d..6b2e976f1 100644
+--- a/grub-core/gfxmenu/gui_image.c
++++ b/grub-core/gfxmenu/gui_image.c
+@@ -195,7 +195,10 @@ load_image (grub_gui_image_t self, const char *path)
+     return grub_errno;
+ 
+   if (self->bitmap && (self->bitmap != self->raw_bitmap))
+-    grub_video_bitmap_destroy (self->bitmap);
++    {
++      grub_video_bitmap_destroy (self->bitmap);
++      self->bitmap = 0;
++    }
+   if (self->raw_bitmap)
+     grub_video_bitmap_destroy (self->raw_bitmap);
+ 
+-- 
+2.26.2
+

buildroot/boot/grub2/0010-xnu-Fix-double-free-in-grub_xnu_devprop_add_property.patch

@@ -0,0 +1,58 @@
+From dc9777dc17697b196c415c53187a55861d41fd2a Mon Sep 17 00:00:00 2001
+From: Alexey Makhalov <amakhalov@vmware.com>
+Date: Wed, 8 Jul 2020 21:30:43 +0000
+Subject: [PATCH] xnu: Fix double free in grub_xnu_devprop_add_property()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+grub_xnu_devprop_add_property() should not free utf8 and utf16 as it get
+allocated and freed in the caller.
+
+Minor improvement: do prop fields initialization after memory allocations.
+
+Fixes: CID 292442, CID 292457, CID 292460, CID 292466
+
+Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/loader/i386/xnu.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/grub-core/loader/i386/xnu.c b/grub-core/loader/i386/xnu.c
+index b7d176b5d..e9e119259 100644
+--- a/grub-core/loader/i386/xnu.c
++++ b/grub-core/loader/i386/xnu.c
+@@ -262,20 +262,19 @@ grub_xnu_devprop_add_property (struct grub_xnu_devprop_device_descriptor *dev,
+   if (!prop)
+     return grub_errno;
+ 
+-  prop->name = utf8;
+-  prop->name16 = utf16;
+-  prop->name16len = utf16len;
+-
+-  prop->length = datalen;
+-  prop->data = grub_malloc (prop->length);
++  prop->data = grub_malloc (datalen);
+   if (!prop->data)
+     {
+-      grub_free (prop->name);
+-      grub_free (prop->name16);
+       grub_free (prop);
+       return grub_errno;
+     }
+-  grub_memcpy (prop->data, data, prop->length);
++  grub_memcpy (prop->data, data, datalen);
++
++  prop->name = utf8;
++  prop->name16 = utf16;
++  prop->name16len = utf16len;
++  prop->length = datalen;
++
+   grub_list_push (GRUB_AS_LIST_P (&dev->properties),
+ 		  GRUB_AS_LIST (prop));
+   return GRUB_ERR_NONE;
+-- 
+2.26.2
+

buildroot/boot/grub2/0011-lzma-Make-sure-we-don-t-dereference-past-array.patch

@@ -0,0 +1,55 @@
+From 78829f0c230680e386fff9f420bb1631bc20f761 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Thu, 9 Jul 2020 03:05:23 +0000
+Subject: [PATCH] lzma: Make sure we don't dereference past array
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The two dimensional array p->posSlotEncoder[4][64] is being dereferenced
+using the GetLenToPosState() macro which checks if len is less than 5,
+and if so subtracts 2 from it. If len = 0, that is 0 - 2 = 4294967294.
+Obviously we don't want to dereference that far out so we check if the
+position found is greater or equal kNumLenToPosStates (4) and bail out.
+
+N.B.: Upstream LZMA 18.05 and later has this function completely rewritten
+without any history.
+
+Fixes: CID 51526
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/lib/LzmaEnc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/lib/LzmaEnc.c b/grub-core/lib/LzmaEnc.c
+index f2ec04a8c..753e56a95 100644
+--- a/grub-core/lib/LzmaEnc.c
++++ b/grub-core/lib/LzmaEnc.c
+@@ -1877,13 +1877,19 @@ static SRes LzmaEnc_CodeOneBlock(CLzmaEnc *p, Bool useLimits, UInt32 maxPackSize
+       }
+       else
+       {
+-        UInt32 posSlot;
++        UInt32 posSlot, lenToPosState;
+         RangeEnc_EncodeBit(&p->rc, &p->isRep[p->state], 0);
+         p->state = kMatchNextStates[p->state];
+         LenEnc_Encode2(&p->lenEnc, &p->rc, len - LZMA_MATCH_LEN_MIN, posState, !p->fastMode, p->ProbPrices);
+         pos -= LZMA_NUM_REPS;
+         GetPosSlot(pos, posSlot);
+-        RcTree_Encode(&p->rc, p->posSlotEncoder[GetLenToPosState(len)], kNumPosSlotBits, posSlot);
++        lenToPosState = GetLenToPosState(len);
++        if (lenToPosState >= kNumLenToPosStates)
++        {
++          p->result = SZ_ERROR_DATA;
++          return CheckErrors(p);
++        }
++        RcTree_Encode(&p->rc, p->posSlotEncoder[lenToPosState], kNumPosSlotBits, posSlot);
+ 
+         if (posSlot >= kStartPosModelIndex)
+         {
+-- 
+2.26.2
+

buildroot/boot/grub2/0012-term-Fix-overflow-on-user-inputs.patch

@@ -0,0 +1,69 @@
+From 8d3b6f9da468f666e3a7976657f2ab5c52762a21 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Tue, 7 Jul 2020 15:12:25 -0400
+Subject: [PATCH] term: Fix overflow on user inputs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This requires a very weird input from the serial interface but can cause
+an overflow in input_buf (keys) overwriting the next variable (npending)
+with the user choice:
+
+(pahole output)
+
+struct grub_terminfo_input_state {
+        int                        input_buf[6];         /*     0    24 */
+        int                        npending;             /*    24     4 */ <- CORRUPT
+        ...snip...
+
+The magic string requires causing this is "ESC,O,],0,1,2,q" and we overflow
+npending with "q" (aka increase npending to 161). The simplest fix is to
+just to disallow overwrites input_buf, which exactly what this patch does.
+
+Fixes: CID 292449
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/term/terminfo.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/grub-core/term/terminfo.c b/grub-core/term/terminfo.c
+index d317efa36..5fa94c0c3 100644
+--- a/grub-core/term/terminfo.c
++++ b/grub-core/term/terminfo.c
+@@ -398,7 +398,7 @@ grub_terminfo_getwh (struct grub_term_output *term)
+ }
+ 
+ static void
+-grub_terminfo_readkey (struct grub_term_input *term, int *keys, int *len,
++grub_terminfo_readkey (struct grub_term_input *term, int *keys, int *len, int max_len,
+ 		       int (*readkey) (struct grub_term_input *term))
+ {
+   int c;
+@@ -414,6 +414,9 @@ grub_terminfo_readkey (struct grub_term_input *term, int *keys, int *len,
+     if (c == -1)						\
+       return;							\
+ 								\
++    if (*len >= max_len)                                       \
++      return;                                                   \
++                                                                \
+     keys[*len] = c;						\
+     (*len)++;							\
+   }
+@@ -602,8 +605,8 @@ grub_terminfo_getkey (struct grub_term_input *termi)
+       return ret;
+     }
+ 
+-  grub_terminfo_readkey (termi, data->input_buf,
+-			 &data->npending, data->readkey);
++  grub_terminfo_readkey (termi, data->input_buf, &data->npending,
++			 GRUB_TERMINFO_READKEY_MAX_LEN, data->readkey);
+ 
+ #if defined(__powerpc__) && defined(GRUB_MACHINE_IEEE1275)
+   if (data->npending == 1 && data->input_buf[0] == GRUB_TERM_ESC
+-- 
+2.26.2
+

buildroot/boot/grub2/0013-udf-Fix-memory-leak.patch

@@ -0,0 +1,59 @@
+From 748b691761d31bfff7e9d0d210caa606294c2b52 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Tue, 7 Jul 2020 22:02:31 -0400
+Subject: [PATCH] udf: Fix memory leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes: CID 73796
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Reviewed-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/fs/udf.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
+index 21ac7f446..2ac5c1d00 100644
+--- a/grub-core/fs/udf.c
++++ b/grub-core/fs/udf.c
+@@ -965,8 +965,10 @@ grub_udf_iterate_dir (grub_fshelp_node_t dir,
+ 	    return 0;
+ 
+           if (grub_udf_read_icb (dir->data, &dirent.icb, child))
+-	    return 0;
+-
++	    {
++	      grub_free (child);
++	      return 0;
++	    }
+           if (dirent.characteristics & GRUB_UDF_FID_CHAR_PARENT)
+ 	    {
+ 	      /* This is the parent directory.  */
+@@ -988,11 +990,18 @@ grub_udf_iterate_dir (grub_fshelp_node_t dir,
+ 				       dirent.file_ident_length,
+ 				       (char *) raw))
+ 		  != dirent.file_ident_length)
+-		return 0;
++		{
++		  grub_free (child);
++		  return 0;
++		}
+ 
+ 	      filename = read_string (raw, dirent.file_ident_length, 0);
+ 	      if (!filename)
+-		grub_print_error ();
++		{
++		  /* As the hook won't get called. */
++		  grub_free (child);
++		  grub_print_error ();
++		}
+ 
+ 	      if (filename && hook (filename, type, child, hook_data))
+ 		{
+-- 
+2.26.2
+

buildroot/boot/grub2/0014-multiboot2-Fix-memory-leak-if-grub_create_loader_cmd.patch

@@ -0,0 +1,38 @@
+From 49bf3faa106498e151306fc780c63194a14751e3 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Fri, 26 Jun 2020 10:51:43 -0400
+Subject: [PATCH] multiboot2: Fix memory leak if
+ grub_create_loader_cmdline() fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes: CID 292468
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/loader/multiboot_mbi2.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/loader/multiboot_mbi2.c b/grub-core/loader/multiboot_mbi2.c
+index 53da78615..0efc66062 100644
+--- a/grub-core/loader/multiboot_mbi2.c
++++ b/grub-core/loader/multiboot_mbi2.c
+@@ -1070,7 +1070,11 @@ grub_multiboot2_add_module (grub_addr_t start, grub_size_t size,
+   err = grub_create_loader_cmdline (argc, argv, newmod->cmdline,
+ 				    newmod->cmdline_size, GRUB_VERIFY_MODULE_CMDLINE);
+   if (err)
+-    return err;
++    {
++      grub_free (newmod->cmdline);
++      grub_free (newmod);
++      return err;
++    }
+ 
+   if (modules_last)
+     modules_last->next = newmod;
+-- 
+2.26.2
+

buildroot/boot/grub2/0015-tftp-Do-not-use-priority-queue.patch

@@ -0,0 +1,283 @@
+From b6c4a1b204740fe52b32e7f530831a59f4038e20 Mon Sep 17 00:00:00 2001
+From: Alexey Makhalov <amakhalov@vmware.com>
+Date: Thu, 9 Jul 2020 08:10:40 +0000
+Subject: [PATCH] tftp: Do not use priority queue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+There is not need to reassemble the order of blocks. Per RFC 1350,
+server must wait for the ACK, before sending next block. Data packets
+can be served immediately without putting them to priority queue.
+
+Logic to handle incoming packet is this:
+  - if packet block id equal to expected block id, then
+    process the packet,
+  - if packet block id is less than expected - this is retransmit
+    of old packet, then ACK it and drop the packet,
+  - if packet block id is more than expected - that shouldn't
+    happen, just drop the packet.
+
+It makes the tftp receive path code simpler, smaller and faster.
+As a benefit, this change fixes CID# 73624 and CID# 96690, caused
+by following while loop:
+
+  while (cmp_block (grub_be_to_cpu16 (tftph->u.data.block), data->block + 1) == 0)
+
+where tftph pointer is not moving from one iteration to another, causing
+to serve same packet again. Luckily, double serving didn't happen due to
+data->block++ during the first iteration.
+
+Fixes: CID 73624, CID 96690
+
+Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/net/tftp.c | 168 ++++++++++++++-----------------------------
+ 1 file changed, 53 insertions(+), 115 deletions(-)
+
+diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c
+index 7d90bf66e..b4297bc8d 100644
+--- a/grub-core/net/tftp.c
++++ b/grub-core/net/tftp.c
+@@ -25,7 +25,6 @@
+ #include <grub/mm.h>
+ #include <grub/dl.h>
+ #include <grub/file.h>
+-#include <grub/priority_queue.h>
+ #include <grub/i18n.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+@@ -106,31 +105,8 @@ typedef struct tftp_data
+   int have_oack;
+   struct grub_error_saved save_err;
+   grub_net_udp_socket_t sock;
+-  grub_priority_queue_t pq;
+ } *tftp_data_t;
+ 
+-static int
+-cmp_block (grub_uint16_t a, grub_uint16_t b)
+-{
+-  grub_int16_t i = (grub_int16_t) (a - b);
+-  if (i > 0)
+-    return +1;
+-  if (i < 0)
+-    return -1;
+-  return 0;
+-}
+-
+-static int
+-cmp (const void *a__, const void *b__)
+-{
+-  struct grub_net_buff *a_ = *(struct grub_net_buff **) a__;
+-  struct grub_net_buff *b_ = *(struct grub_net_buff **) b__;
+-  struct tftphdr *a = (struct tftphdr *) a_->data;
+-  struct tftphdr *b = (struct tftphdr *) b_->data;
+-  /* We want the first elements to be on top.  */
+-  return -cmp_block (grub_be_to_cpu16 (a->u.data.block), grub_be_to_cpu16 (b->u.data.block));
+-}
+-
+ static grub_err_t
+ ack (tftp_data_t data, grub_uint64_t block)
+ {
+@@ -207,73 +183,60 @@ tftp_receive (grub_net_udp_socket_t sock __attribute__ ((unused)),
+ 	  return GRUB_ERR_NONE;
+ 	}
+ 
+-      err = grub_priority_queue_push (data->pq, &nb);
+-      if (err)
+-	return err;
+-
+-      {
+-	struct grub_net_buff **nb_top_p, *nb_top;
+-	while (1)
+-	  {
+-	    nb_top_p = grub_priority_queue_top (data->pq);
+-	    if (!nb_top_p)
+-	      return GRUB_ERR_NONE;
+-	    nb_top = *nb_top_p;
+-	    tftph = (struct tftphdr *) nb_top->data;
+-	    if (cmp_block (grub_be_to_cpu16 (tftph->u.data.block), data->block + 1) >= 0)
+-	      break;
+-	    ack (data, grub_be_to_cpu16 (tftph->u.data.block));
+-	    grub_netbuff_free (nb_top);
+-	    grub_priority_queue_pop (data->pq);
+-	  }
+-	while (cmp_block (grub_be_to_cpu16 (tftph->u.data.block), data->block + 1) == 0)
+-	  {
+-	    unsigned size;
+-
+-	    grub_priority_queue_pop (data->pq);
+-
+-	    if (file->device->net->packs.count < 50)
++      /* Ack old/retransmitted block. */
++      if (grub_be_to_cpu16 (tftph->u.data.block) < data->block + 1)
++	ack (data, grub_be_to_cpu16 (tftph->u.data.block));
++      /* Ignore unexpected block. */
++      else if (grub_be_to_cpu16 (tftph->u.data.block) > data->block + 1)
++	grub_dprintf ("tftp", "TFTP unexpected block # %d\n", tftph->u.data.block);
++      else
++	{
++	  unsigned size;
++
++	  if (file->device->net->packs.count < 50)
++	    {
+ 	      err = ack (data, data->block + 1);
+-	    else
+-	      {
+-		file->device->net->stall = 1;
+-		err = 0;
+-	      }
+-	    if (err)
+-	      return err;
+-
+-	    err = grub_netbuff_pull (nb_top, sizeof (tftph->opcode) +
+-				     sizeof (tftph->u.data.block));
+-	    if (err)
+-	      return err;
+-	    size = nb_top->tail - nb_top->data;
+-
+-	    data->block++;
+-	    if (size < data->block_size)
+-	      {
+-		if (data->ack_sent < data->block)
+-		  ack (data, data->block);
+-		file->device->net->eof = 1;
+-		file->device->net->stall = 1;
+-		grub_net_udp_close (data->sock);
+-		data->sock = NULL;
+-	      }
+-	    /* Prevent garbage in broken cards. Is it still necessary
+-	       given that IP implementation has been fixed?
+-	     */
+-	    if (size > data->block_size)
+-	      {
+-		err = grub_netbuff_unput (nb_top, size - data->block_size);
+-		if (err)
+-		  return err;
+-	      }
+-	    /* If there is data, puts packet in socket list. */
+-	    if ((nb_top->tail - nb_top->data) > 0)
+-	      grub_net_put_packet (&file->device->net->packs, nb_top);
+-	    else
+-	      grub_netbuff_free (nb_top);
+-	  }
+-      }
++	      if (err)
++		return err;
++	    }
++	  else
++	    file->device->net->stall = 1;
++
++	  err = grub_netbuff_pull (nb, sizeof (tftph->opcode) +
++				   sizeof (tftph->u.data.block));
++	  if (err)
++	    return err;
++	  size = nb->tail - nb->data;
++
++	  data->block++;
++	  if (size < data->block_size)
++	    {
++	      if (data->ack_sent < data->block)
++		ack (data, data->block);
++	      file->device->net->eof = 1;
++	      file->device->net->stall = 1;
++	      grub_net_udp_close (data->sock);
++	      data->sock = NULL;
++	    }
++	  /*
++	   * Prevent garbage in broken cards. Is it still necessary
++	   * given that IP implementation has been fixed?
++	   */
++	  if (size > data->block_size)
++	    {
++	      err = grub_netbuff_unput (nb, size - data->block_size);
++	      if (err)
++		return err;
++	    }
++	  /* If there is data, puts packet in socket list. */
++	  if ((nb->tail - nb->data) > 0)
++	    {
++	      grub_net_put_packet (&file->device->net->packs, nb);
++	      /* Do not free nb. */
++	      return GRUB_ERR_NONE;
++	    }
++	}
++      grub_netbuff_free (nb);
+       return GRUB_ERR_NONE;
+     case TFTP_ERROR:
+       data->have_oack = 1;
+@@ -287,19 +250,6 @@ tftp_receive (grub_net_udp_socket_t sock __attribute__ ((unused)),
+     }
+ }
+ 
+-static void
+-destroy_pq (tftp_data_t data)
+-{
+-  struct grub_net_buff **nb_p;
+-  while ((nb_p = grub_priority_queue_top (data->pq)))
+-    {
+-      grub_netbuff_free (*nb_p);
+-      grub_priority_queue_pop (data->pq);
+-    }
+-
+-  grub_priority_queue_destroy (data->pq);
+-}
+-
+ static grub_err_t
+ tftp_open (struct grub_file *file, const char *filename)
+ {
+@@ -372,17 +322,9 @@ tftp_open (struct grub_file *file, const char *filename)
+   file->not_easily_seekable = 1;
+   file->data = data;
+ 
+-  data->pq = grub_priority_queue_new (sizeof (struct grub_net_buff *), cmp);
+-  if (!data->pq)
+-    {
+-      grub_free (data);
+-      return grub_errno;
+-    }
+-
+   err = grub_net_resolve_address (file->device->net->server, &addr);
+   if (err)
+     {
+-      destroy_pq (data);
+       grub_free (data);
+       return err;
+     }
+@@ -392,7 +334,6 @@ tftp_open (struct grub_file *file, const char *filename)
+ 				  file);
+   if (!data->sock)
+     {
+-      destroy_pq (data);
+       grub_free (data);
+       return grub_errno;
+     }
+@@ -406,7 +347,6 @@ tftp_open (struct grub_file *file, const char *filename)
+       if (err)
+ 	{
+ 	  grub_net_udp_close (data->sock);
+-	  destroy_pq (data);
+ 	  grub_free (data);
+ 	  return err;
+ 	}
+@@ -423,7 +363,6 @@ tftp_open (struct grub_file *file, const char *filename)
+   if (grub_errno)
+     {
+       grub_net_udp_close (data->sock);
+-      destroy_pq (data);
+       grub_free (data);
+       return grub_errno;
+     }
+@@ -466,7 +405,6 @@ tftp_close (struct grub_file *file)
+ 	grub_print_error ();
+       grub_net_udp_close (data->sock);
+     }
+-  destroy_pq (data);
+   grub_free (data);
+   return GRUB_ERR_NONE;
+ }
+-- 
+2.26.2
+

buildroot/boot/grub2/0016-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch

@@ -0,0 +1,153 @@
+From 1c7b619c84f229c1602c1958bcd054b6d9937562 Mon Sep 17 00:00:00 2001
+From: Alexey Makhalov <amakhalov@vmware.com>
+Date: Wed, 15 Jul 2020 06:42:37 +0000
+Subject: [PATCH] relocator: Protect grub_relocator_alloc_chunk_addr()
+ input args against integer underflow/overflow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Use arithmetic macros from safemath.h to accomplish it. In this commit,
+I didn't want to be too paranoid to check every possible math equation
+for overflow/underflow. Only obvious places (with non zero chance of
+overflow/underflow) were refactored.
+
+Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/loader/i386/linux.c    |  9 +++++++--
+ grub-core/loader/i386/pc/linux.c |  9 +++++++--
+ grub-core/loader/i386/xen.c      | 12 ++++++++++--
+ grub-core/loader/xnu.c           | 11 +++++++----
+ 4 files changed, 31 insertions(+), 10 deletions(-)
+
+diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
+index d0501e229..02a73463a 100644
+--- a/grub-core/loader/i386/linux.c
++++ b/grub-core/loader/i386/linux.c
+@@ -36,6 +36,7 @@
+ #include <grub/lib/cmdline.h>
+ #include <grub/linux.h>
+ #include <grub/machine/kernel.h>
++#include <grub/safemath.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -547,9 +548,13 @@ grub_linux_boot (void)
+ 
+   {
+     grub_relocator_chunk_t ch;
++    grub_size_t sz;
++
++    if (grub_add (ctx.real_size, efi_mmap_size, &sz))
++      return GRUB_ERR_OUT_OF_RANGE;
++
+     err = grub_relocator_alloc_chunk_addr (relocator, &ch,
+-					   ctx.real_mode_target,
+-					   (ctx.real_size + efi_mmap_size));
++					   ctx.real_mode_target, sz);
+     if (err)
+      return err;
+     real_mode_mem = get_virtual_current_address (ch);
+diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
+index 47ea2945e..31f09922b 100644
+--- a/grub-core/loader/i386/pc/linux.c
++++ b/grub-core/loader/i386/pc/linux.c
+@@ -35,6 +35,7 @@
+ #include <grub/i386/floppy.h>
+ #include <grub/lib/cmdline.h>
+ #include <grub/linux.h>
++#include <grub/safemath.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -218,8 +219,12 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)),
+     setup_sects = GRUB_LINUX_DEFAULT_SETUP_SECTS;
+ 
+   real_size = setup_sects << GRUB_DISK_SECTOR_BITS;
+-  grub_linux16_prot_size = grub_file_size (file)
+-    - real_size - GRUB_DISK_SECTOR_SIZE;
++  if (grub_sub (grub_file_size (file), real_size, &grub_linux16_prot_size) ||
++      grub_sub (grub_linux16_prot_size, GRUB_DISK_SECTOR_SIZE, &grub_linux16_prot_size))
++    {
++      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
++      goto fail;
++    }
+ 
+   if (! grub_linux_is_bzimage
+       && GRUB_LINUX_ZIMAGE_ADDR + grub_linux16_prot_size
+diff --git a/grub-core/loader/i386/xen.c b/grub-core/loader/i386/xen.c
+index 8f662c8ac..cd24874ca 100644
+--- a/grub-core/loader/i386/xen.c
++++ b/grub-core/loader/i386/xen.c
+@@ -41,6 +41,7 @@
+ #include <grub/linux.h>
+ #include <grub/i386/memory.h>
+ #include <grub/verify.h>
++#include <grub/safemath.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -636,6 +637,7 @@ grub_cmd_xen (grub_command_t cmd __attribute__ ((unused)),
+   grub_relocator_chunk_t ch;
+   grub_addr_t kern_start;
+   grub_addr_t kern_end;
++  grub_size_t sz;
+ 
+   if (argc == 0)
+     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
+@@ -703,8 +705,14 @@ grub_cmd_xen (grub_command_t cmd __attribute__ ((unused)),
+ 
+   xen_state.max_addr = ALIGN_UP (kern_end, PAGE_SIZE);
+ 
+-  err = grub_relocator_alloc_chunk_addr (xen_state.relocator, &ch, kern_start,
+-					 kern_end - kern_start);
++
++  if (grub_sub (kern_end, kern_start, &sz))
++    {
++      err = GRUB_ERR_OUT_OF_RANGE;
++      goto fail;
++    }
++
++  err = grub_relocator_alloc_chunk_addr (xen_state.relocator, &ch, kern_start, sz);
+   if (err)
+     goto fail;
+   kern_chunk_src = get_virtual_current_address (ch);
+diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c
+index 77d7060e1..9ae4ceb35 100644
+--- a/grub-core/loader/xnu.c
++++ b/grub-core/loader/xnu.c
+@@ -34,6 +34,7 @@
+ #include <grub/env.h>
+ #include <grub/i18n.h>
+ #include <grub/verify.h>
++#include <grub/safemath.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -59,15 +60,17 @@ grub_xnu_heap_malloc (int size, void **src, grub_addr_t *target)
+ {
+   grub_err_t err;
+   grub_relocator_chunk_t ch;
++  grub_addr_t tgt;
++
++  if (grub_add (grub_xnu_heap_target_start, grub_xnu_heap_size, &tgt))
++    return GRUB_ERR_OUT_OF_RANGE;
+   
+-  err = grub_relocator_alloc_chunk_addr (grub_xnu_relocator, &ch,
+-					 grub_xnu_heap_target_start
+-					 + grub_xnu_heap_size, size);
++  err = grub_relocator_alloc_chunk_addr (grub_xnu_relocator, &ch, tgt, size);
+   if (err)
+     return err;
+ 
+   *src = get_virtual_current_address (ch);
+-  *target = grub_xnu_heap_target_start + grub_xnu_heap_size;
++  *target = tgt;
+   grub_xnu_heap_size += size;
+   grub_dprintf ("xnu", "val=%p\n", *src);
+   return GRUB_ERR_NONE;
+-- 
+2.26.2
+

buildroot/boot/grub2/0017-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch

@@ -0,0 +1,341 @@
+From 0cfbbca3ccd84d36ffb1bcd6644ada7c73b19fc0 Mon Sep 17 00:00:00 2001
+From: Alexey Makhalov <amakhalov@vmware.com>
+Date: Wed, 8 Jul 2020 01:44:38 +0000
+Subject: [PATCH] relocator: Protect grub_relocator_alloc_chunk_align()
+ max_addr against integer underflow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This commit introduces integer underflow mitigation in max_addr calculation
+in grub_relocator_alloc_chunk_align() invocation.
+
+It consists of 2 fixes:
+  1. Introduced grub_relocator_alloc_chunk_align_safe() wrapper function to perform
+     sanity check for min/max and size values, and to make safe invocation of
+     grub_relocator_alloc_chunk_align() with validated max_addr value. Replace all
+     invocations such as grub_relocator_alloc_chunk_align(..., min_addr, max_addr - size, size, ...)
+     by grub_relocator_alloc_chunk_align_safe(..., min_addr, max_addr, size, ...).
+  2. Introduced UP_TO_TOP32(s) macro for the cases where max_addr is 32-bit top
+     address (0xffffffff - size + 1) or similar.
+
+Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/lib/i386/relocator.c        | 28 ++++++++++----------------
+ grub-core/lib/mips/relocator.c        |  6 ++----
+ grub-core/lib/powerpc/relocator.c     |  6 ++----
+ grub-core/lib/x86_64/efi/relocator.c  |  7 +++----
+ grub-core/loader/i386/linux.c         |  5 ++---
+ grub-core/loader/i386/multiboot_mbi.c |  7 +++----
+ grub-core/loader/i386/pc/linux.c      |  6 ++----
+ grub-core/loader/mips/linux.c         |  9 +++------
+ grub-core/loader/multiboot.c          |  2 +-
+ grub-core/loader/multiboot_elfxx.c    | 10 ++++-----
+ grub-core/loader/multiboot_mbi2.c     | 10 ++++-----
+ grub-core/loader/xnu_resume.c         |  2 +-
+ include/grub/relocator.h              | 29 +++++++++++++++++++++++++++
+ 13 files changed, 69 insertions(+), 58 deletions(-)
+
+diff --git a/grub-core/lib/i386/relocator.c b/grub-core/lib/i386/relocator.c
+index 71dd4f0ab..34cbe834f 100644
+--- a/grub-core/lib/i386/relocator.c
++++ b/grub-core/lib/i386/relocator.c
+@@ -83,11 +83,10 @@ grub_relocator32_boot (struct grub_relocator *rel,
+   /* Specific memory range due to Global Descriptor Table for use by payload
+      that we will store in returned chunk.  The address range and preference
+      are based on "THE LINUX/x86 BOOT PROTOCOL" specification.  */
+-  err = grub_relocator_alloc_chunk_align (rel, &ch, 0x1000,
+-					  0x9a000 - RELOCATOR_SIZEOF (32),
+-					  RELOCATOR_SIZEOF (32), 16,
+-					  GRUB_RELOCATOR_PREFERENCE_LOW,
+-					  avoid_efi_bootservices);
++  err = grub_relocator_alloc_chunk_align_safe (rel, &ch, 0x1000, 0x9a000,
++					       RELOCATOR_SIZEOF (32), 16,
++					       GRUB_RELOCATOR_PREFERENCE_LOW,
++					       avoid_efi_bootservices);
+   if (err)
+     return err;
+ 
+@@ -125,13 +124,10 @@ grub_relocator16_boot (struct grub_relocator *rel,
+   grub_relocator_chunk_t ch;
+ 
+   /* Put it higher than the byte it checks for A20 check.  */
+-  err = grub_relocator_alloc_chunk_align (rel, &ch, 0x8010,
+-					  0xa0000 - RELOCATOR_SIZEOF (16)
+-					  - GRUB_RELOCATOR16_STACK_SIZE,
+-					  RELOCATOR_SIZEOF (16)
+-					  + GRUB_RELOCATOR16_STACK_SIZE, 16,
+-					  GRUB_RELOCATOR_PREFERENCE_NONE,
+-					  0);
++  err = grub_relocator_alloc_chunk_align_safe (rel, &ch, 0x8010, 0xa0000,
++					       RELOCATOR_SIZEOF (16) +
++					       GRUB_RELOCATOR16_STACK_SIZE, 16,
++					       GRUB_RELOCATOR_PREFERENCE_NONE, 0);
+   if (err)
+     return err;
+ 
+@@ -183,11 +179,9 @@ grub_relocator64_boot (struct grub_relocator *rel,
+   void *relst;
+   grub_relocator_chunk_t ch;
+ 
+-  err = grub_relocator_alloc_chunk_align (rel, &ch, min_addr,
+-					  max_addr - RELOCATOR_SIZEOF (64),
+-					  RELOCATOR_SIZEOF (64), 16,
+-					  GRUB_RELOCATOR_PREFERENCE_NONE,
+-					  0);
++  err = grub_relocator_alloc_chunk_align_safe (rel, &ch, min_addr, max_addr,
++					       RELOCATOR_SIZEOF (64), 16,
++					       GRUB_RELOCATOR_PREFERENCE_NONE, 0);
+   if (err)
+     return err;
+ 
+diff --git a/grub-core/lib/mips/relocator.c b/grub-core/lib/mips/relocator.c
+index 9d5f49cb9..743b213e6 100644
+--- a/grub-core/lib/mips/relocator.c
++++ b/grub-core/lib/mips/relocator.c
+@@ -120,10 +120,8 @@ grub_relocator32_boot (struct grub_relocator *rel,
+   unsigned i;
+   grub_addr_t vtarget;
+ 
+-  err = grub_relocator_alloc_chunk_align (rel, &ch, 0,
+-					  (0xffffffff - stateset_size)
+-					  + 1, stateset_size,
+-					  sizeof (grub_uint32_t),
++  err = grub_relocator_alloc_chunk_align (rel, &ch, 0, UP_TO_TOP32 (stateset_size),
++					  stateset_size, sizeof (grub_uint32_t),
+ 					  GRUB_RELOCATOR_PREFERENCE_NONE, 0);
+   if (err)
+     return err;
+diff --git a/grub-core/lib/powerpc/relocator.c b/grub-core/lib/powerpc/relocator.c
+index bdf2b111b..8ffb8b686 100644
+--- a/grub-core/lib/powerpc/relocator.c
++++ b/grub-core/lib/powerpc/relocator.c
+@@ -115,10 +115,8 @@ grub_relocator32_boot (struct grub_relocator *rel,
+   unsigned i;
+   grub_relocator_chunk_t ch;
+ 
+-  err = grub_relocator_alloc_chunk_align (rel, &ch, 0,
+-					  (0xffffffff - stateset_size)
+-					  + 1, stateset_size,
+-					  sizeof (grub_uint32_t),
++  err = grub_relocator_alloc_chunk_align (rel, &ch, 0, UP_TO_TOP32 (stateset_size),
++					  stateset_size, sizeof (grub_uint32_t),
+ 					  GRUB_RELOCATOR_PREFERENCE_NONE, 0);
+   if (err)
+     return err;
+diff --git a/grub-core/lib/x86_64/efi/relocator.c b/grub-core/lib/x86_64/efi/relocator.c
+index 3caef7a40..7d200a125 100644
+--- a/grub-core/lib/x86_64/efi/relocator.c
++++ b/grub-core/lib/x86_64/efi/relocator.c
+@@ -50,10 +50,9 @@ grub_relocator64_efi_boot (struct grub_relocator *rel,
+    * 64-bit relocator code may live above 4 GiB quite well.
+    * However, I do not want ask for problems. Just in case.
+    */
+-  err = grub_relocator_alloc_chunk_align (rel, &ch, 0,
+-					  0x100000000 - RELOCATOR_SIZEOF (64_efi),
+-					  RELOCATOR_SIZEOF (64_efi), 16,
+-					  GRUB_RELOCATOR_PREFERENCE_NONE, 1);
++  err = grub_relocator_alloc_chunk_align_safe (rel, &ch, 0, 0x100000000,
++					       RELOCATOR_SIZEOF (64_efi), 16,
++					       GRUB_RELOCATOR_PREFERENCE_NONE, 1);
+   if (err)
+     return err;
+ 
+diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c
+index 02a73463a..efbb99307 100644
+--- a/grub-core/loader/i386/linux.c
++++ b/grub-core/loader/i386/linux.c
+@@ -181,9 +181,8 @@ allocate_pages (grub_size_t prot_size, grub_size_t *align,
+ 	for (; err && *align + 1 > min_align; (*align)--)
+ 	  {
+ 	    grub_errno = GRUB_ERR_NONE;
+-	    err = grub_relocator_alloc_chunk_align (relocator, &ch,
+-						    0x1000000,
+-						    0xffffffff & ~prot_size,
++	    err = grub_relocator_alloc_chunk_align (relocator, &ch, 0x1000000,
++						    UP_TO_TOP32 (prot_size),
+ 						    prot_size, 1 << *align,
+ 						    GRUB_RELOCATOR_PREFERENCE_LOW,
+ 						    1);
+diff --git a/grub-core/loader/i386/multiboot_mbi.c b/grub-core/loader/i386/multiboot_mbi.c
+index ad3cc292f..a67d9d0a8 100644
+--- a/grub-core/loader/i386/multiboot_mbi.c
++++ b/grub-core/loader/i386/multiboot_mbi.c
+@@ -466,10 +466,9 @@ grub_multiboot_make_mbi (grub_uint32_t *target)
+ 
+   bufsize = grub_multiboot_get_mbi_size ();
+ 
+-  err = grub_relocator_alloc_chunk_align (grub_multiboot_relocator, &ch,
+-					  0x10000, 0xa0000 - bufsize,
+-					  bufsize, 4,
+-					  GRUB_RELOCATOR_PREFERENCE_NONE, 0);
++  err = grub_relocator_alloc_chunk_align_safe (grub_multiboot_relocator, &ch,
++					       0x10000, 0xa0000, bufsize, 4,
++					       GRUB_RELOCATOR_PREFERENCE_NONE, 0);
+   if (err)
+     return err;
+   ptrorig = get_virtual_current_address (ch);
+diff --git a/grub-core/loader/i386/pc/linux.c b/grub-core/loader/i386/pc/linux.c
+index 31f09922b..5fed5ffdf 100644
+--- a/grub-core/loader/i386/pc/linux.c
++++ b/grub-core/loader/i386/pc/linux.c
+@@ -453,10 +453,8 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
+ 
+   {
+     grub_relocator_chunk_t ch;
+-    err = grub_relocator_alloc_chunk_align (relocator, &ch,
+-					    addr_min, addr_max - size,
+-					    size, 0x1000,
+-					    GRUB_RELOCATOR_PREFERENCE_HIGH, 0);
++    err = grub_relocator_alloc_chunk_align_safe (relocator, &ch, addr_min, addr_max, size,
++						 0x1000, GRUB_RELOCATOR_PREFERENCE_HIGH, 0);
+     if (err)
+       return err;
+     initrd_chunk = get_virtual_current_address (ch);
+diff --git a/grub-core/loader/mips/linux.c b/grub-core/loader/mips/linux.c
+index 7b723bf18..e4ed95921 100644
+--- a/grub-core/loader/mips/linux.c
++++ b/grub-core/loader/mips/linux.c
+@@ -442,12 +442,9 @@ grub_cmd_initrd (grub_command_t cmd __attribute__ ((unused)),
+   {
+     grub_relocator_chunk_t ch;
+ 
+-    err = grub_relocator_alloc_chunk_align (relocator, &ch,
+-					    (target_addr & 0x1fffffff)
+-					    + linux_size + 0x10000,
+-					    (0x10000000 - size),
+-					    size, 0x10000,
+-					    GRUB_RELOCATOR_PREFERENCE_NONE, 0);
++    err = grub_relocator_alloc_chunk_align_safe (relocator, &ch, (target_addr & 0x1fffffff) +
++						 linux_size + 0x10000, 0x10000000, size,
++						 0x10000, GRUB_RELOCATOR_PREFERENCE_NONE, 0);
+ 
+     if (err)
+       goto fail;
+diff --git a/grub-core/loader/multiboot.c b/grub-core/loader/multiboot.c
+index 4a98d7082..facb13f3d 100644
+--- a/grub-core/loader/multiboot.c
++++ b/grub-core/loader/multiboot.c
+@@ -403,7 +403,7 @@ grub_cmd_module (grub_command_t cmd __attribute__ ((unused)),
+   {
+     grub_relocator_chunk_t ch;
+     err = grub_relocator_alloc_chunk_align (GRUB_MULTIBOOT (relocator), &ch,
+-					    lowest_addr, (0xffffffff - size) + 1,
++					    lowest_addr, UP_TO_TOP32 (size),
+ 					    size, MULTIBOOT_MOD_ALIGN,
+ 					    GRUB_RELOCATOR_PREFERENCE_NONE, 1);
+     if (err)
+diff --git a/grub-core/loader/multiboot_elfxx.c b/grub-core/loader/multiboot_elfxx.c
+index cc6853692..f2318e0d1 100644
+--- a/grub-core/loader/multiboot_elfxx.c
++++ b/grub-core/loader/multiboot_elfxx.c
+@@ -109,10 +109,10 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld)
+       if (load_size > mld->max_addr || mld->min_addr > mld->max_addr - load_size)
+ 	return grub_error (GRUB_ERR_BAD_OS, "invalid min/max address and/or load size");
+ 
+-      err = grub_relocator_alloc_chunk_align (GRUB_MULTIBOOT (relocator), &ch,
+-					      mld->min_addr, mld->max_addr - load_size,
+-					      load_size, mld->align ? mld->align : 1,
+-					      mld->preference, mld->avoid_efi_boot_services);
++      err = grub_relocator_alloc_chunk_align_safe (GRUB_MULTIBOOT (relocator), &ch,
++						   mld->min_addr, mld->max_addr,
++						   load_size, mld->align ? mld->align : 1,
++						   mld->preference, mld->avoid_efi_boot_services);
+ 
+       if (err)
+         {
+@@ -256,7 +256,7 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld)
+ 	    continue;
+ 
+ 	  err = grub_relocator_alloc_chunk_align (GRUB_MULTIBOOT (relocator), &ch, 0,
+-						  (0xffffffff - sh->sh_size) + 1,
++						  UP_TO_TOP32 (sh->sh_size),
+ 						  sh->sh_size, sh->sh_addralign,
+ 						  GRUB_RELOCATOR_PREFERENCE_NONE,
+ 						  mld->avoid_efi_boot_services);
+diff --git a/grub-core/loader/multiboot_mbi2.c b/grub-core/loader/multiboot_mbi2.c
+index 0efc66062..03967839c 100644
+--- a/grub-core/loader/multiboot_mbi2.c
++++ b/grub-core/loader/multiboot_mbi2.c
+@@ -295,10 +295,10 @@ grub_multiboot2_load (grub_file_t file, const char *filename)
+ 	      return grub_error (GRUB_ERR_BAD_OS, "invalid min/max address and/or load size");
+ 	    }
+ 
+-	  err = grub_relocator_alloc_chunk_align (grub_multiboot2_relocator, &ch,
+-						  mld.min_addr, mld.max_addr - code_size,
+-						  code_size, mld.align ? mld.align : 1,
+-						  mld.preference, keep_bs);
++	  err = grub_relocator_alloc_chunk_align_safe (grub_multiboot2_relocator, &ch,
++						       mld.min_addr, mld.max_addr,
++						       code_size, mld.align ? mld.align : 1,
++						       mld.preference, keep_bs);
+ 	}
+       else
+ 	err = grub_relocator_alloc_chunk_addr (grub_multiboot2_relocator,
+@@ -708,7 +708,7 @@ grub_multiboot2_make_mbi (grub_uint32_t *target)
+   COMPILE_TIME_ASSERT (MULTIBOOT_TAG_ALIGN % sizeof (grub_properly_aligned_t) == 0);
+ 
+   err = grub_relocator_alloc_chunk_align (grub_multiboot2_relocator, &ch,
+-					  0, 0xffffffff - bufsize,
++					  0, UP_TO_TOP32 (bufsize),
+ 					  bufsize, MULTIBOOT_TAG_ALIGN,
+ 					  GRUB_RELOCATOR_PREFERENCE_NONE, 1);
+   if (err)
+diff --git a/grub-core/loader/xnu_resume.c b/grub-core/loader/xnu_resume.c
+index 8089804d4..d648ef0cd 100644
+--- a/grub-core/loader/xnu_resume.c
++++ b/grub-core/loader/xnu_resume.c
+@@ -129,7 +129,7 @@ grub_xnu_resume (char *imagename)
+   {
+     grub_relocator_chunk_t ch;
+     err = grub_relocator_alloc_chunk_align (grub_xnu_relocator, &ch, 0,
+-					    (0xffffffff - hibhead.image_size) + 1,
++					    UP_TO_TOP32 (hibhead.image_size),
+ 					    hibhead.image_size,
+ 					    GRUB_XNU_PAGESIZE,
+ 					    GRUB_RELOCATOR_PREFERENCE_NONE, 0);
+diff --git a/include/grub/relocator.h b/include/grub/relocator.h
+index 24d8672d2..1b3bdd92a 100644
+--- a/include/grub/relocator.h
++++ b/include/grub/relocator.h
+@@ -49,6 +49,35 @@ grub_relocator_alloc_chunk_align (struct grub_relocator *rel,
+ 				  int preference,
+ 				  int avoid_efi_boot_services);
+ 
++/*
++ * Wrapper for grub_relocator_alloc_chunk_align() with purpose of
++ * protecting against integer underflow.
++ *
++ * Compare to its callee, max_addr has different meaning here.
++ * It covers entire chunk and not just start address of the chunk.
++ */
++static inline grub_err_t
++grub_relocator_alloc_chunk_align_safe (struct grub_relocator *rel,
++				       grub_relocator_chunk_t *out,
++				       grub_phys_addr_t min_addr,
++				       grub_phys_addr_t max_addr,
++				       grub_size_t size, grub_size_t align,
++				       int preference,
++				       int avoid_efi_boot_services)
++{
++  /* Sanity check and ensure following equation (max_addr - size) is safe. */
++  if (max_addr < size || (max_addr - size) < min_addr)
++    return GRUB_ERR_OUT_OF_RANGE;
++
++  return grub_relocator_alloc_chunk_align (rel, out, min_addr,
++					   max_addr - size,
++					   size, align, preference,
++					   avoid_efi_boot_services);
++}
++
++/* Top 32-bit address minus s bytes and plus 1 byte. */
++#define UP_TO_TOP32(s)	((~(s) & 0xffffffff) + 1)
++
+ #define GRUB_RELOCATOR_PREFERENCE_NONE 0
+ #define GRUB_RELOCATOR_PREFERENCE_LOW 1
+ #define GRUB_RELOCATOR_PREFERENCE_HIGH 2
+-- 
+2.26.2
+

buildroot/boot/grub2/0018-script-Remove-unused-fields-from-grub_script_functio.patch

@@ -0,0 +1,37 @@
+From 73aa0776457066ee6ebc93486c3cf0e6b755d1b8 Mon Sep 17 00:00:00 2001
+From: Chris Coulson <chris.coulson@canonical.com>
+Date: Fri, 10 Jul 2020 11:21:14 +0100
+Subject: [PATCH] script: Remove unused fields from grub_script_function
+ struct
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ include/grub/script_sh.h | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/include/grub/script_sh.h b/include/grub/script_sh.h
+index 360c2be1f..b382bcf09 100644
+--- a/include/grub/script_sh.h
++++ b/include/grub/script_sh.h
+@@ -359,13 +359,8 @@ struct grub_script_function
+   /* The script function.  */
+   struct grub_script *func;
+ 
+-  /* The flags.  */
+-  unsigned flags;
+-
+   /* The next element.  */
+   struct grub_script_function *next;
+-
+-  int references;
+ };
+ typedef struct grub_script_function *grub_script_function_t;
+ 
+-- 
+2.26.2
+

buildroot/boot/grub2/0019-script-Avoid-a-use-after-free-when-redefining-a-func.patch

@@ -0,0 +1,113 @@
+From 26349fcf80982b4d0120b73b2836e88bcf16853c Mon Sep 17 00:00:00 2001
+From: Chris Coulson <chris.coulson@canonical.com>
+Date: Fri, 10 Jul 2020 14:41:45 +0100
+Subject: [PATCH] script: Avoid a use-after-free when redefining a
+ function during execution
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Defining a new function with the same name as a previously defined
+function causes the grub_script and associated resources for the
+previous function to be freed. If the previous function is currently
+executing when a function with the same name is defined, this results
+in use-after-frees when processing subsequent commands in the original
+function.
+
+Instead, reject a new function definition if it has the same name as
+a previously defined function, and that function is currently being
+executed. Although a behavioural change, this should be backwards
+compatible with existing configurations because they can't be
+dependent on the current behaviour without being broken.
+
+Fixes: CVE-2020-15706
+
+Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/script/execute.c  |  2 ++
+ grub-core/script/function.c | 16 +++++++++++++---
+ grub-core/script/parser.y   |  3 ++-
+ include/grub/script_sh.h    |  2 ++
+ 4 files changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
+index c8d6806fe..7e028e135 100644
+--- a/grub-core/script/execute.c
++++ b/grub-core/script/execute.c
+@@ -838,7 +838,9 @@ grub_script_function_call (grub_script_function_t func, int argc, char **args)
+   old_scope = scope;
+   scope = &new_scope;
+ 
++  func->executing++;
+   ret = grub_script_execute (func->func);
++  func->executing--;
+ 
+   function_return = 0;
+   active_loops = loops;
+diff --git a/grub-core/script/function.c b/grub-core/script/function.c
+index d36655e51..3aad04bf9 100644
+--- a/grub-core/script/function.c
++++ b/grub-core/script/function.c
+@@ -34,6 +34,7 @@ grub_script_function_create (struct grub_script_arg *functionname_arg,
+   func = (grub_script_function_t) grub_malloc (sizeof (*func));
+   if (! func)
+     return 0;
++  func->executing = 0;
+ 
+   func->name = grub_strdup (functionname_arg->str);
+   if (! func->name)
+@@ -60,10 +61,19 @@ grub_script_function_create (struct grub_script_arg *functionname_arg,
+       grub_script_function_t q;
+ 
+       q = *p;
+-      grub_script_free (q->func);
+-      q->func = cmd;
+       grub_free (func);
+-      func = q;
++      if (q->executing > 0)
++        {
++          grub_error (GRUB_ERR_BAD_ARGUMENT,
++		      N_("attempt to redefine a function being executed"));
++          func = NULL;
++        }
++      else
++        {
++          grub_script_free (q->func);
++          q->func = cmd;
++          func = q;
++        }
+     }
+   else
+     {
+diff --git a/grub-core/script/parser.y b/grub-core/script/parser.y
+index 4f0ab8319..f80b86b6f 100644
+--- a/grub-core/script/parser.y
++++ b/grub-core/script/parser.y
+@@ -289,7 +289,8 @@ function: "function" "name"
+ 	      grub_script_mem_free (state->func_mem);
+ 	    else {
+ 	      script->children = state->scripts;
+-	      grub_script_function_create ($2, script);
++	      if (!grub_script_function_create ($2, script))
++		grub_script_free (script);
+ 	    }
+ 
+ 	    state->scripts = $<scripts>3;
+diff --git a/include/grub/script_sh.h b/include/grub/script_sh.h
+index b382bcf09..6c48e0751 100644
+--- a/include/grub/script_sh.h
++++ b/include/grub/script_sh.h
+@@ -361,6 +361,8 @@ struct grub_script_function
+ 
+   /* The next element.  */
+   struct grub_script_function *next;
++
++  unsigned executing;
+ };
+ typedef struct grub_script_function *grub_script_function_t;
+ 
+-- 
+2.26.2
+

buildroot/boot/grub2/0020-relocator-Fix-grub_relocator_alloc_chunk_align-top-m.patch

@@ -0,0 +1,49 @@
+From 06aa91f79f902752cb7e5d22ac0ea8e13bffd056 Mon Sep 17 00:00:00 2001
+From: Alexey Makhalov <amakhalov@vmware.com>
+Date: Fri, 17 Jul 2020 05:17:26 +0000
+Subject: [PATCH] relocator: Fix grub_relocator_alloc_chunk_align() top
+ memory allocation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Current implementation of grub_relocator_alloc_chunk_align()
+does not allow allocation of the top byte.
+
+Assuming input args are:
+  max_addr = 0xfffff000;
+  size = 0x1000;
+
+And this is valid. But following overflow protection will
+unnecessarily move max_addr one byte down (to 0xffffefff):
+  if (max_addr > ~size)
+    max_addr = ~size;
+
+~size + 1 will fix the situation. In addition, check size
+for non zero to do not zero max_addr.
+
+Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/lib/relocator.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/lib/relocator.c b/grub-core/lib/relocator.c
+index 5847aac36..f2c1944c2 100644
+--- a/grub-core/lib/relocator.c
++++ b/grub-core/lib/relocator.c
+@@ -1386,8 +1386,8 @@ grub_relocator_alloc_chunk_align (struct grub_relocator *rel,
+   };
+   grub_addr_t min_addr2 = 0, max_addr2;
+ 
+-  if (max_addr > ~size)
+-    max_addr = ~size;
++  if (size && (max_addr > ~size))
++    max_addr = ~size + 1;
+ 
+ #ifdef GRUB_MACHINE_PCBIOS
+   if (min_addr < 0x1000)
+-- 
+2.26.2
+

buildroot/boot/grub2/0021-hfsplus-Fix-two-more-overflows.patch

@@ -0,0 +1,61 @@
+From feec993673d8e13fcf22fe2389ac29222b6daebd Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Sun, 19 Jul 2020 14:43:31 -0400
+Subject: [PATCH] hfsplus: Fix two more overflows
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Both node->size and node->namelen come from the supplied filesystem,
+which may be user-supplied. We can't trust them for the math unless we
+know they don't overflow. Making sure they go through grub_add() or
+grub_calloc() first will give us that.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/fs/hfsplus.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c
+index dae43becc..9c4e4c88c 100644
+--- a/grub-core/fs/hfsplus.c
++++ b/grub-core/fs/hfsplus.c
+@@ -31,6 +31,7 @@
+ #include <grub/hfs.h>
+ #include <grub/charset.h>
+ #include <grub/hfsplus.h>
++#include <grub/safemath.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -475,8 +476,12 @@ grub_hfsplus_read_symlink (grub_fshelp_node_t node)
+ {
+   char *symlink;
+   grub_ssize_t numread;
++  grub_size_t sz = node->size;
+ 
+-  symlink = grub_malloc (node->size + 1);
++  if (grub_add (sz, 1, &sz))
++    return NULL;
++
++  symlink = grub_malloc (sz);
+   if (!symlink)
+     return 0;
+ 
+@@ -715,8 +720,8 @@ list_nodes (void *record, void *hook_arg)
+   if (type == GRUB_FSHELP_UNKNOWN)
+     return 0;
+ 
+-  filename = grub_malloc (grub_be_to_cpu16 (catkey->namelen)
+-			  * GRUB_MAX_UTF8_PER_UTF16 + 1);
++  filename = grub_calloc (grub_be_to_cpu16 (catkey->namelen),
++			  GRUB_MAX_UTF8_PER_UTF16 + 1);
+   if (! filename)
+     return 0;
+ 
+-- 
+2.26.2
+

buildroot/boot/grub2/0022-lvm-Fix-two-more-potential-data-dependent-alloc-over.patch

@@ -0,0 +1,116 @@
+From a1845e90fc19fb5e904091bad8a378f458798e4a Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Sun, 19 Jul 2020 15:48:20 -0400
+Subject: [PATCH] lvm: Fix two more potential data-dependent alloc
+ overflows
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It appears to be possible to make a (possibly invalid) lvm PV with
+a metadata size field that overflows our type when adding it to the
+address we've allocated. Even if it doesn't, it may be possible to do so
+with the math using the outcome of that as an operand. Check them both.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/disk/lvm.c | 48 ++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 40 insertions(+), 8 deletions(-)
+
+diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
+index d1df640b3..139fafd47 100644
+--- a/grub-core/disk/lvm.c
++++ b/grub-core/disk/lvm.c
+@@ -25,6 +25,7 @@
+ #include <grub/lvm.h>
+ #include <grub/partition.h>
+ #include <grub/i18n.h>
++#include <grub/safemath.h>
+ 
+ #ifdef GRUB_UTIL
+ #include <grub/emu/misc.h>
+@@ -102,10 +103,11 @@ grub_lvm_detect (grub_disk_t disk,
+ {
+   grub_err_t err;
+   grub_uint64_t mda_offset, mda_size;
++  grub_size_t ptr;
+   char buf[GRUB_LVM_LABEL_SIZE];
+   char vg_id[GRUB_LVM_ID_STRLEN+1];
+   char pv_id[GRUB_LVM_ID_STRLEN+1];
+-  char *metadatabuf, *p, *q, *vgname;
++  char *metadatabuf, *p, *q, *mda_end, *vgname;
+   struct grub_lvm_label_header *lh = (struct grub_lvm_label_header *) buf;
+   struct grub_lvm_pv_header *pvh;
+   struct grub_lvm_disk_locn *dlocn;
+@@ -205,19 +207,31 @@ grub_lvm_detect (grub_disk_t disk,
+ 		   grub_le_to_cpu64 (rlocn->size) -
+ 		   grub_le_to_cpu64 (mdah->size));
+     }
+-  p = q = metadatabuf + grub_le_to_cpu64 (rlocn->offset);
+ 
+-  while (*q != ' ' && q < metadatabuf + mda_size)
+-    q++;
+-
+-  if (q == metadatabuf + mda_size)
++  if (grub_add ((grub_size_t)metadatabuf,
++		(grub_size_t)grub_le_to_cpu64 (rlocn->offset),
++		&ptr))
+     {
++ error_parsing_metadata:
+ #ifdef GRUB_UTIL
+       grub_util_info ("error parsing metadata");
+ #endif
+       goto fail2;
+     }
+ 
++  p = q = (char *)ptr;
++
++  if (grub_add ((grub_size_t)metadatabuf, (grub_size_t)mda_size, &ptr))
++    goto error_parsing_metadata;
++
++  mda_end = (char *)ptr;
++
++  while (*q != ' ' && q < mda_end)
++    q++;
++
++  if (q == mda_end)
++    goto error_parsing_metadata;
++
+   vgname_len = q - p;
+   vgname = grub_malloc (vgname_len + 1);
+   if (!vgname)
+@@ -367,8 +381,26 @@ grub_lvm_detect (grub_disk_t disk,
+ 	      {
+ 		const char *iptr;
+ 		char *optr;
+-		lv->fullname = grub_malloc (sizeof ("lvm/") - 1 + 2 * vgname_len
+-					    + 1 + 2 * s + 1);
++
++		/*
++		 * This is kind of hard to read with our safe (but rather
++		 * baroque) math primatives, but it boils down to:
++		 *
++		 *   sz0 = vgname_len * 2 + 1 +
++		 *         s * 2 + 1 +
++		 *         sizeof ("lvm/") - 1;
++		 */
++		grub_size_t sz0 = vgname_len, sz1 = s;
++
++		if (grub_mul (sz0, 2, &sz0) ||
++		    grub_add (sz0, 1, &sz0) ||
++		    grub_mul (sz1, 2, &sz1) ||
++		    grub_add (sz1, 1, &sz1) ||
++		    grub_add (sz0, sz1, &sz0) ||
++		    grub_add (sz0, sizeof ("lvm/") - 1, &sz0))
++		  goto lvs_fail;
++
++		lv->fullname = grub_malloc (sz0);
+ 		if (!lv->fullname)
+ 		  goto lvs_fail;
+ 
+-- 
+2.26.2
+

buildroot/boot/grub2/0023-emu-Make-grub_free-NULL-safe.patch

@@ -0,0 +1,38 @@
+From 320e86747a32e4d46d24ee4b64493741c161da50 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Sun, 19 Jul 2020 16:08:08 -0400
+Subject: [PATCH] emu: Make grub_free(NULL) safe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The grub_free() implementation in grub-core/kern/mm.c safely handles
+NULL pointers, and code at many places depends on this. We don't know
+that the same is true on all host OSes, so we need to handle the same
+behavior in grub-emu's implementation.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/kern/emu/mm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/grub-core/kern/emu/mm.c b/grub-core/kern/emu/mm.c
+index 145b01d37..4d1046a21 100644
+--- a/grub-core/kern/emu/mm.c
++++ b/grub-core/kern/emu/mm.c
+@@ -60,7 +60,8 @@ grub_zalloc (grub_size_t size)
+ void
+ grub_free (void *ptr)
+ {
+-  free (ptr);
++  if (ptr)
++    free (ptr);
+ }
+ 
+ void *
+-- 
+2.26.2
+

buildroot/boot/grub2/0024-efi-Fix-some-malformed-device-path-arithmetic-errors.patch

@@ -0,0 +1,239 @@
+From c330aa099a38bc5c4d3066954fe35767cc06adb1 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Sun, 19 Jul 2020 16:53:27 -0400
+Subject: [PATCH] efi: Fix some malformed device path arithmetic errors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Several places we take the length of a device path and subtract 4 from
+it, without ever checking that it's >= 4. There are also cases where
+this kind of malformation will result in unpredictable iteration,
+including treating the length from one dp node as the type in the next
+node. These are all errors, no matter where the data comes from.
+
+This patch adds a checking macro, GRUB_EFI_DEVICE_PATH_VALID(), which
+can be used in several places, and makes GRUB_EFI_NEXT_DEVICE_PATH()
+return NULL and GRUB_EFI_END_ENTIRE_DEVICE_PATH() evaluate as true when
+the length is too small. Additionally, it makes several places in the
+code check for and return errors in these cases.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/kern/efi/efi.c           | 64 +++++++++++++++++++++++++-----
+ grub-core/loader/efi/chainloader.c | 13 +++++-
+ grub-core/loader/i386/xnu.c        |  9 +++--
+ include/grub/efi/api.h             | 14 ++++---
+ 4 files changed, 79 insertions(+), 21 deletions(-)
+
+diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
+index dc31caa21..c97969a65 100644
+--- a/grub-core/kern/efi/efi.c
++++ b/grub-core/kern/efi/efi.c
+@@ -332,7 +332,7 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0)
+ 
+   dp = dp0;
+ 
+-  while (1)
++  while (dp)
+     {
+       grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp);
+       grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp);
+@@ -342,9 +342,15 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0)
+       if (type == GRUB_EFI_MEDIA_DEVICE_PATH_TYPE
+ 	       && subtype == GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE)
+ 	{
+-	  grub_efi_uint16_t len;
+-	  len = ((GRUB_EFI_DEVICE_PATH_LENGTH (dp) - 4)
+-		 / sizeof (grub_efi_char16_t));
++	  grub_efi_uint16_t len = GRUB_EFI_DEVICE_PATH_LENGTH (dp);
++
++	  if (len < 4)
++	    {
++	      grub_error (GRUB_ERR_OUT_OF_RANGE,
++			  "malformed EFI Device Path node has length=%d", len);
++	      return NULL;
++	    }
++	  len = (len - 4) / sizeof (grub_efi_char16_t);
+ 	  filesize += GRUB_MAX_UTF8_PER_UTF16 * len + 2;
+ 	}
+ 
+@@ -360,7 +366,7 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0)
+   if (!name)
+     return NULL;
+ 
+-  while (1)
++  while (dp)
+     {
+       grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp);
+       grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp);
+@@ -376,8 +382,15 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0)
+ 
+ 	  *p++ = '/';
+ 
+-	  len = ((GRUB_EFI_DEVICE_PATH_LENGTH (dp) - 4)
+-		 / sizeof (grub_efi_char16_t));
++	  len = GRUB_EFI_DEVICE_PATH_LENGTH (dp);
++	  if (len < 4)
++	    {
++	      grub_error (GRUB_ERR_OUT_OF_RANGE,
++			  "malformed EFI Device Path node has length=%d", len);
++	      return NULL;
++	    }
++
++	  len = (len - 4) / sizeof (grub_efi_char16_t);
+ 	  fp = (grub_efi_file_path_device_path_t *) dp;
+ 	  /* According to EFI spec Path Name is NULL terminated */
+ 	  while (len > 0 && fp->path_name[len - 1] == 0)
+@@ -452,7 +465,26 @@ grub_efi_duplicate_device_path (const grub_efi_device_path_t *dp)
+        ;
+        p = GRUB_EFI_NEXT_DEVICE_PATH (p))
+     {
+-      total_size += GRUB_EFI_DEVICE_PATH_LENGTH (p);
++      grub_size_t len = GRUB_EFI_DEVICE_PATH_LENGTH (p);
++
++      /*
++       * In the event that we find a node that's completely garbage, for
++       * example if we get to 0x7f 0x01 0x02 0x00 ... (EndInstance with a size
++       * of 2), GRUB_EFI_END_ENTIRE_DEVICE_PATH() will be true and
++       * GRUB_EFI_NEXT_DEVICE_PATH() will return NULL, so we won't continue,
++       * and neither should our consumers, but there won't be any error raised
++       * even though the device path is junk.
++       *
++       * This keeps us from passing junk down back to our caller.
++       */
++      if (len < 4)
++	{
++	  grub_error (GRUB_ERR_OUT_OF_RANGE,
++		      "malformed EFI Device Path node has length=%d", len);
++	  return NULL;
++	}
++
++      total_size += len;
+       if (GRUB_EFI_END_ENTIRE_DEVICE_PATH (p))
+ 	break;
+     }
+@@ -497,7 +529,7 @@ dump_vendor_path (const char *type, grub_efi_vendor_device_path_t *vendor)
+ void
+ grub_efi_print_device_path (grub_efi_device_path_t *dp)
+ {
+-  while (1)
++  while (GRUB_EFI_DEVICE_PATH_VALID (dp))
+     {
+       grub_efi_uint8_t type = GRUB_EFI_DEVICE_PATH_TYPE (dp);
+       grub_efi_uint8_t subtype = GRUB_EFI_DEVICE_PATH_SUBTYPE (dp);
+@@ -909,7 +941,10 @@ grub_efi_compare_device_paths (const grub_efi_device_path_t *dp1,
+     /* Return non-zero.  */
+     return 1;
+ 
+-  while (1)
++  if (dp1 == dp2)
++    return 0;
++
++  while (GRUB_EFI_DEVICE_PATH_VALID (dp1) && GRUB_EFI_DEVICE_PATH_VALID (dp2))
+     {
+       grub_efi_uint8_t type1, type2;
+       grub_efi_uint8_t subtype1, subtype2;
+@@ -945,5 +980,14 @@ grub_efi_compare_device_paths (const grub_efi_device_path_t *dp1,
+       dp2 = (grub_efi_device_path_t *) ((char *) dp2 + len2);
+     }
+ 
++  /*
++   * There's no "right" answer here, but we probably don't want to call a valid
++   * dp and an invalid dp equal, so pick one way or the other.
++   */
++  if (GRUB_EFI_DEVICE_PATH_VALID (dp1) && !GRUB_EFI_DEVICE_PATH_VALID (dp2))
++    return 1;
++  else if (!GRUB_EFI_DEVICE_PATH_VALID (dp1) && GRUB_EFI_DEVICE_PATH_VALID (dp2))
++    return -1;
++
+   return 0;
+ }
+diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
+index daf8c6b54..a8d7b9155 100644
+--- a/grub-core/loader/efi/chainloader.c
++++ b/grub-core/loader/efi/chainloader.c
+@@ -156,9 +156,18 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename)
+ 
+   size = 0;
+   d = dp;
+-  while (1)
++  while (d)
+     {
+-      size += GRUB_EFI_DEVICE_PATH_LENGTH (d);
++      grub_size_t len = GRUB_EFI_DEVICE_PATH_LENGTH (d);
++
++      if (len < 4)
++	{
++	  grub_error (GRUB_ERR_OUT_OF_RANGE,
++		      "malformed EFI Device Path node has length=%d", len);
++	  return NULL;
++	}
++
++      size += len;
+       if ((GRUB_EFI_END_ENTIRE_DEVICE_PATH (d)))
+ 	break;
+       d = GRUB_EFI_NEXT_DEVICE_PATH (d);
+diff --git a/grub-core/loader/i386/xnu.c b/grub-core/loader/i386/xnu.c
+index e9e119259..a70093607 100644
+--- a/grub-core/loader/i386/xnu.c
++++ b/grub-core/loader/i386/xnu.c
+@@ -515,14 +515,15 @@ grub_cmd_devprop_load (grub_command_t cmd __attribute__ ((unused)),
+ 
+       devhead = buf;
+       buf = devhead + 1;
+-      dpstart = buf;
++      dp = dpstart = buf;
+ 
+-      do
++      while (GRUB_EFI_DEVICE_PATH_VALID (dp) && buf < bufend)
+ 	{
+-	  dp = buf;
+ 	  buf = (char *) buf + GRUB_EFI_DEVICE_PATH_LENGTH (dp);
++	  if (GRUB_EFI_END_ENTIRE_DEVICE_PATH (dp))
++	    break;
++	  dp = buf;
+ 	}
+-      while (!GRUB_EFI_END_ENTIRE_DEVICE_PATH (dp) && buf < bufend);
+ 
+       dev = grub_xnu_devprop_add_device (dpstart, (char *) buf
+ 					 - (char *) dpstart);
+diff --git a/include/grub/efi/api.h b/include/grub/efi/api.h
+index addcbfa8f..cf1355a8c 100644
+--- a/include/grub/efi/api.h
++++ b/include/grub/efi/api.h
+@@ -625,6 +625,7 @@ typedef struct grub_efi_device_path grub_efi_device_path_protocol_t;
+ #define GRUB_EFI_DEVICE_PATH_TYPE(dp)		((dp)->type & 0x7f)
+ #define GRUB_EFI_DEVICE_PATH_SUBTYPE(dp)	((dp)->subtype)
+ #define GRUB_EFI_DEVICE_PATH_LENGTH(dp)		((dp)->length)
++#define GRUB_EFI_DEVICE_PATH_VALID(dp)		((dp) != NULL && GRUB_EFI_DEVICE_PATH_LENGTH (dp) >= 4)
+ 
+ /* The End of Device Path nodes.  */
+ #define GRUB_EFI_END_DEVICE_PATH_TYPE			(0xff & 0x7f)
+@@ -633,13 +634,16 @@ typedef struct grub_efi_device_path grub_efi_device_path_protocol_t;
+ #define GRUB_EFI_END_THIS_DEVICE_PATH_SUBTYPE		0x01
+ 
+ #define GRUB_EFI_END_ENTIRE_DEVICE_PATH(dp)	\
+-  (GRUB_EFI_DEVICE_PATH_TYPE (dp) == GRUB_EFI_END_DEVICE_PATH_TYPE \
+-   && (GRUB_EFI_DEVICE_PATH_SUBTYPE (dp) \
+-       == GRUB_EFI_END_ENTIRE_DEVICE_PATH_SUBTYPE))
++  (!GRUB_EFI_DEVICE_PATH_VALID (dp) || \
++   (GRUB_EFI_DEVICE_PATH_TYPE (dp) == GRUB_EFI_END_DEVICE_PATH_TYPE \
++    && (GRUB_EFI_DEVICE_PATH_SUBTYPE (dp) \
++	== GRUB_EFI_END_ENTIRE_DEVICE_PATH_SUBTYPE)))
+ 
+ #define GRUB_EFI_NEXT_DEVICE_PATH(dp)	\
+-  ((grub_efi_device_path_t *) ((char *) (dp) \
+-                               + GRUB_EFI_DEVICE_PATH_LENGTH (dp)))
++  (GRUB_EFI_DEVICE_PATH_VALID (dp) \
++   ? ((grub_efi_device_path_t *) \
++      ((char *) (dp) + GRUB_EFI_DEVICE_PATH_LENGTH (dp))) \
++   : NULL)
+ 
+ /* Hardware Device Path.  */
+ #define GRUB_EFI_HARDWARE_DEVICE_PATH_TYPE		1
+-- 
+2.26.2
+

buildroot/boot/grub2/0025-efi-chainloader-Propagate-errors-from-copy_file_path.patch

@@ -0,0 +1,78 @@
+From fb55bc37dd510911df4eaf649da939f5fafdc7ce Mon Sep 17 00:00:00 2001
+From: Daniel Kiper <daniel.kiper@oracle.com>
+Date: Wed, 29 Jul 2020 13:38:31 +0200
+Subject: [PATCH] efi/chainloader: Propagate errors from copy_file_path()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Without any error propagated to the caller, make_file_path()
+would then try to advance the invalid device path node with
+GRUB_EFI_NEXT_DEVICE_PATH(), which would fail, returning a NULL
+pointer that would subsequently be dereferenced. Hence, propagate
+errors from copy_file_path().
+
+Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/loader/efi/chainloader.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
+index a8d7b9155..7b31c3fb9 100644
+--- a/grub-core/loader/efi/chainloader.c
++++ b/grub-core/loader/efi/chainloader.c
+@@ -106,7 +106,7 @@ grub_chainloader_boot (void)
+   return grub_errno;
+ }
+ 
+-static void
++static grub_err_t
+ copy_file_path (grub_efi_file_path_device_path_t *fp,
+ 		const char *str, grub_efi_uint16_t len)
+ {
+@@ -118,7 +118,7 @@ copy_file_path (grub_efi_file_path_device_path_t *fp,
+ 
+   path_name = grub_calloc (len, GRUB_MAX_UTF16_PER_UTF8 * sizeof (*path_name));
+   if (!path_name)
+-    return;
++    return grub_error (GRUB_ERR_OUT_OF_MEMORY, "failed to allocate path buffer");
+ 
+   size = grub_utf8_to_utf16 (path_name, len * GRUB_MAX_UTF16_PER_UTF8,
+ 			     (const grub_uint8_t *) str, len, 0);
+@@ -131,6 +131,7 @@ copy_file_path (grub_efi_file_path_device_path_t *fp,
+   fp->path_name[size++] = '\0';
+   fp->header.length = size * sizeof (grub_efi_char16_t) + sizeof (*fp);
+   grub_free (path_name);
++  return GRUB_ERR_NONE;
+ }
+ 
+ static grub_efi_device_path_t *
+@@ -189,13 +190,19 @@ make_file_path (grub_efi_device_path_t *dp, const char *filename)
+   d = (grub_efi_device_path_t *) ((char *) file_path
+ 				  + ((char *) d - (char *) dp));
+   grub_efi_print_device_path (d);
+-  copy_file_path ((grub_efi_file_path_device_path_t *) d,
+-		  dir_start, dir_end - dir_start);
++  if (copy_file_path ((grub_efi_file_path_device_path_t *) d,
++		      dir_start, dir_end - dir_start) != GRUB_ERR_NONE)
++    {
++ fail:
++      grub_free (file_path);
++      return 0;
++    }
+ 
+   /* Fill the file path for the file.  */
+   d = GRUB_EFI_NEXT_DEVICE_PATH (d);
+-  copy_file_path ((grub_efi_file_path_device_path_t *) d,
+-		  dir_end + 1, grub_strlen (dir_end + 1));
++  if (copy_file_path ((grub_efi_file_path_device_path_t *) d,
++		      dir_end + 1, grub_strlen (dir_end + 1)) != GRUB_ERR_NONE)
++    goto fail;
+ 
+   /* Fill the end of device path nodes.  */
+   d = GRUB_EFI_NEXT_DEVICE_PATH (d);
+-- 
+2.26.2
+

buildroot/boot/grub2/0026-efi-Fix-use-after-free-in-halt-reboot-path.patch

@@ -0,0 +1,183 @@
+From 8a6d6299efcffd14c1130942195e6c0d9b50cacd Mon Sep 17 00:00:00 2001
+From: Alexey Makhalov <amakhalov@vmware.com>
+Date: Mon, 20 Jul 2020 23:03:05 +0000
+Subject: [PATCH] efi: Fix use-after-free in halt/reboot path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 92bfc33db984 ("efi: Free malloc regions on exit")
+introduced memory freeing in grub_efi_fini(), which is
+used not only by exit path but by halt/reboot one as well.
+As result of memory freeing, code and data regions used by
+modules, such as halt, reboot, acpi (used by halt) also got
+freed. After return to module code, CPU executes, filled
+by UEFI firmware (tested with edk2), 0xAFAFAFAF pattern as
+a code. Which leads to #UD exception later.
+
+grub> halt
+!!!! X64 Exception Type - 06(#UD - Invalid Opcode)  CPU Apic ID - 00000000 !!!!
+RIP  - 0000000003F4EC28, CS  - 0000000000000038, RFLAGS - 0000000000200246
+RAX  - 0000000000000000, RCX - 00000000061DA188, RDX - 0A74C0854DC35D41
+RBX  - 0000000003E10E08, RSP - 0000000007F0F860, RBP - 0000000000000000
+RSI  - 00000000064DB768, RDI - 000000000832C5C3
+R8   - 0000000000000002, R9  - 0000000000000000, R10 - 00000000061E2E52
+R11  - 0000000000000020, R12 - 0000000003EE5C1F, R13 - 00000000061E0FF4
+R14  - 0000000003E10D80, R15 - 00000000061E2F60
+DS   - 0000000000000030, ES  - 0000000000000030, FS  - 0000000000000030
+GS   - 0000000000000030, SS  - 0000000000000030
+CR0  - 0000000080010033, CR2 - 0000000000000000, CR3 - 0000000007C01000
+CR4  - 0000000000000668, CR8 - 0000000000000000
+DR0  - 0000000000000000, DR1 - 0000000000000000, DR2 - 0000000000000000
+DR3  - 0000000000000000, DR6 - 00000000FFFF0FF0, DR7 - 0000000000000400
+GDTR - 00000000079EEA98 0000000000000047, LDTR - 0000000000000000
+IDTR - 0000000007598018 0000000000000FFF,   TR - 0000000000000000
+FXSAVE_STATE - 0000000007F0F4C0
+
+Proposal here is to continue to free allocated memory for
+exit boot services path but keep it for halt/reboot path
+as it won't be much security concern here.
+Introduced GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY
+loader flag to be used by efi halt/reboot path.
+
+Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
+Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
+---
+ grub-core/kern/arm/efi/init.c   | 3 +++
+ grub-core/kern/arm64/efi/init.c | 3 +++
+ grub-core/kern/efi/efi.c        | 3 ++-
+ grub-core/kern/efi/init.c       | 1 -
+ grub-core/kern/i386/efi/init.c  | 9 +++++++--
+ grub-core/kern/ia64/efi/init.c  | 9 +++++++--
+ grub-core/kern/riscv/efi/init.c | 3 +++
+ grub-core/lib/efi/halt.c        | 3 ++-
+ include/grub/loader.h           | 1 +
+ 9 files changed, 28 insertions(+), 7 deletions(-)
+
+diff --git a/grub-core/kern/arm/efi/init.c b/grub-core/kern/arm/efi/init.c
+index 06df60e2f..40c3b467f 100644
+--- a/grub-core/kern/arm/efi/init.c
++++ b/grub-core/kern/arm/efi/init.c
+@@ -71,4 +71,7 @@ grub_machine_fini (int flags)
+   efi_call_1 (b->close_event, tmr_evt);
+ 
+   grub_efi_fini ();
++
++  if (!(flags & GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY))
++    grub_efi_memory_fini ();
+ }
+diff --git a/grub-core/kern/arm64/efi/init.c b/grub-core/kern/arm64/efi/init.c
+index 6224999ec..5010caefd 100644
+--- a/grub-core/kern/arm64/efi/init.c
++++ b/grub-core/kern/arm64/efi/init.c
+@@ -57,4 +57,7 @@ grub_machine_fini (int flags)
+     return;
+ 
+   grub_efi_fini ();
++
++  if (!(flags & GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY))
++    grub_efi_memory_fini ();
+ }
+diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
+index c97969a65..9cfd88d77 100644
+--- a/grub-core/kern/efi/efi.c
++++ b/grub-core/kern/efi/efi.c
+@@ -157,7 +157,8 @@ grub_efi_get_loaded_image (grub_efi_handle_t image_handle)
+ void
+ grub_reboot (void)
+ {
+-  grub_machine_fini (GRUB_LOADER_FLAG_NORETURN);
++  grub_machine_fini (GRUB_LOADER_FLAG_NORETURN |
++		     GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY);
+   efi_call_4 (grub_efi_system_table->runtime_services->reset_system,
+               GRUB_EFI_RESET_COLD, GRUB_EFI_SUCCESS, 0, NULL);
+   for (;;) ;
+diff --git a/grub-core/kern/efi/init.c b/grub-core/kern/efi/init.c
+index 3dfdf2d22..2c31847bf 100644
+--- a/grub-core/kern/efi/init.c
++++ b/grub-core/kern/efi/init.c
+@@ -80,5 +80,4 @@ grub_efi_fini (void)
+ {
+   grub_efidisk_fini ();
+   grub_console_fini ();
+-  grub_efi_memory_fini ();
+ }
+diff --git a/grub-core/kern/i386/efi/init.c b/grub-core/kern/i386/efi/init.c
+index da499aba0..deb2eacd8 100644
+--- a/grub-core/kern/i386/efi/init.c
++++ b/grub-core/kern/i386/efi/init.c
+@@ -39,6 +39,11 @@ grub_machine_init (void)
+ void
+ grub_machine_fini (int flags)
+ {
+-  if (flags & GRUB_LOADER_FLAG_NORETURN)
+-    grub_efi_fini ();
++  if (!(flags & GRUB_LOADER_FLAG_NORETURN))
++    return;
++
++  grub_efi_fini ();
++
++  if (!(flags & GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY))
++    grub_efi_memory_fini ();
+ }
+diff --git a/grub-core/kern/ia64/efi/init.c b/grub-core/kern/ia64/efi/init.c
+index b5ecbd091..f1965571b 100644
+--- a/grub-core/kern/ia64/efi/init.c
++++ b/grub-core/kern/ia64/efi/init.c
+@@ -70,6 +70,11 @@ grub_machine_init (void)
+ void
+ grub_machine_fini (int flags)
+ {
+-  if (flags & GRUB_LOADER_FLAG_NORETURN)
+-    grub_efi_fini ();
++  if (!(flags & GRUB_LOADER_FLAG_NORETURN))
++    return;
++
++  grub_efi_fini ();
++
++  if (!(flags & GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY))
++    grub_efi_memory_fini ();
+ }
+diff --git a/grub-core/kern/riscv/efi/init.c b/grub-core/kern/riscv/efi/init.c
+index 7eb1969d0..38795fe67 100644
+--- a/grub-core/kern/riscv/efi/init.c
++++ b/grub-core/kern/riscv/efi/init.c
+@@ -73,4 +73,7 @@ grub_machine_fini (int flags)
+     return;
+ 
+   grub_efi_fini ();
++
++  if (!(flags & GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY))
++    grub_efi_memory_fini ();
+ }
+diff --git a/grub-core/lib/efi/halt.c b/grub-core/lib/efi/halt.c
+index 5859f0498..29d413641 100644
+--- a/grub-core/lib/efi/halt.c
++++ b/grub-core/lib/efi/halt.c
+@@ -28,7 +28,8 @@
+ void
+ grub_halt (void)
+ {
+-  grub_machine_fini (GRUB_LOADER_FLAG_NORETURN);
++  grub_machine_fini (GRUB_LOADER_FLAG_NORETURN |
++		     GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY);
+ #if !defined(__ia64__) && !defined(__arm__) && !defined(__aarch64__) && \
+     !defined(__riscv)
+   grub_acpi_halt ();
+diff --git a/include/grub/loader.h b/include/grub/loader.h
+index 7f82a499f..b20864282 100644
+--- a/include/grub/loader.h
++++ b/include/grub/loader.h
+@@ -33,6 +33,7 @@ enum
+ {
+   GRUB_LOADER_FLAG_NORETURN = 1,
+   GRUB_LOADER_FLAG_PXE_NOT_UNLOAD = 2,
++  GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY = 4,
+ };
+ 
+ void EXPORT_FUNC (grub_loader_set) (grub_err_t (*boot) (void),
+-- 
+2.26.2
+