121 files changed, 2535 insertions, 6583 deletions
diff --git a/meta/recipes-bsp/acpid/acpid.inc b/meta/recipes-bsp/acpid/acpid.inc
index 1e43e7a9db..ba954563b6 100644
--- a/meta/recipes-bsp/acpid/acpid.inc
+++ b/meta/recipes-bsp/acpid/acpid.inc
@@ -8,31 +8,33 @@ admin."
 HOMEPAGE = "http://sourceforge.net/projects/acpid2"
 BUGTRACKER = "http://sourceforge.net/p/acpid2/tickets/?source=navbar"
 SECTION = "base"
-LICENSE = "GPLv2+"
+LICENSE = "GPL-2.0-or-later"
-SRC_URI = "${SOURCEFORGE_MIRROR}/acpid2/acpid-${PV}.tar.xz \
+SOURCEFORGE_PROJECT = "acpid2"
+SRC_URI = "${SOURCEFORGE_MIRROR}/${SOURCEFORGE_PROJECT}/acpid-${PV}.tar.xz \
           file://init \
           file://acpid.service \
-          "
+           file://0001-Replace-stat64-with-stat.patch \
+           "
 CVE_PRODUCT = "acpid2"
-inherit autotools update-rc.d systemd
+inherit autotools update-rc.d systemd sourceforge-releases
 INITSCRIPT_NAME = "acpid"
 INITSCRIPT_PARAMS = "defaults"
-SYSTEMD_SERVICE_${PN} = "acpid.service"
+SYSTEMD_SERVICE:${PN} = "acpid.service"
-do_install_append () {
+do_install:append () {
        install -d ${D}${sysconfdir}/init.d
-        sed -e 's,/usr/sbin,${sbindir},g' ${WORKDIR}/init > ${D}${sysconfdir}/init.d/acpid
+        sed -e 's,/usr/sbin,${sbindir},g' ${UNPACKDIR}/init > ${D}${sysconfdir}/init.d/acpid
        chmod 755 ${D}${sysconfdir}/init.d/acpid
        install -d ${D}${sysconfdir}/acpi
        install -d ${D}${sysconfdir}/acpi/events
-        install -d ${D}${systemd_unitdir}/system
+        install -d ${D}${systemd_system_unitdir}
-        install -m 0644 ${WORKDIR}/acpid.service ${D}${systemd_unitdir}/system
+        install -m 0644 ${UNPACKDIR}/acpid.service ${D}${systemd_system_unitdir}
-        sed -i -e 's,@SBINDIR@,${sbindir},g' ${D}${systemd_unitdir}/system/acpid.service
+        sed -i -e 's,@SBINDIR@,${sbindir},g' ${D}${systemd_system_unitdir}/acpid.service
 }
diff --git a/meta/recipes-bsp/acpid/acpid/0001-Replace-stat64-with-stat.patch b/meta/recipes-bsp/acpid/acpid/0001-Replace-stat64-with-stat.patch
new file mode 100644
index 0000000000..10abfc8388
--- /dev/null
+++ b/meta/recipes-bsp/acpid/acpid/0001-Replace-stat64-with-stat.patch
@@ -0,0 +1,31 @@
+From 4b729235a9e96f120feee7e3746818aad0f3b924 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Wed, 14 Dec 2022 15:04:30 -0800
+Subject: [PATCH] Replace stat64 with stat
+It already checks for largefile support in configure.ac via
+AC_SYS_LARGEFILE macro, which will ensure that 64bit elements
+are correctly setup for stat APIs on platforms needing large
+file support.
+Upstream-Status: Submitted [https://sourceforge.net/p/acpid2/code/merge-requests/5/]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ sock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/sock.c b/sock.c
+index 9e04501..3121fb7 100644
+--- a/sock.c
+++ b/sock.c
+@@ -54,8 +54,8 @@ int non_root_clients;
+ static int
+ isfdtype(int fd, int fdtype)
+ {
+-       struct stat64 st;
+-       if (fstat64(fd, &st) != 0)
+       struct stat st;
+       if (fstat(fd, &st) != 0)
+                return -1;
+        return ((st.st_mode & S_IFMT) == (mode_t)fdtype);
+ }
diff --git a/meta/recipes-bsp/acpid/acpid_2.0.32.bb b/meta/recipes-bsp/acpid/acpid_2.0.34.bb
index 227e4a4675..1e0a6d5f24 100644
--- a/meta/recipes-bsp/acpid/acpid_2.0.32.bb
+++ b/meta/recipes-bsp/acpid/acpid_2.0.34.bb
@@ -3,5 +3,4 @@ require acpid.inc
 LIC_FILES_CHKSUM = "file://COPYING;md5=8ca43cbc842c2336e835926c2166c28b \
                    file://acpid.h;endline=24;md5=324a9cf225ae69ddaad1bf9d942115b5"
-SRC_URI[md5sum] = "248995264b9d1cd8bdb923d5b190fd44"
+SRC_URI[sha256sum] = "2d095c8cfcbc847caec746d62cdc8d0bff1ec1bc72ef7c674c721e04da6ab333"
-SRC_URI[sha256sum] = "f2d2d30b3edc3234bd82f6f7186699a6aa3c85c8d20bc4e30e9b3c68a1ed157e"
diff --git a/meta/recipes-bsp/alsa-state/alsa-state.bb b/meta/recipes-bsp/alsa-state/alsa-state.bb
index cec2272c80..9452a1a4ce 100644
--- a/meta/recipes-bsp/alsa-state/alsa-state.bb
+++ b/meta/recipes-bsp/alsa-state/alsa-state.bb
@@ -8,10 +8,12 @@ SUMMARY = "Alsa scenario files to enable alsa state restoration"
 HOMEPAGE = "http://www.alsa-project.org/"
 DESCRIPTION = "Alsa Scenario Files - an init script and state files to restore \
 sound state at system boot and save it at system shut down."
-LICENSE = "MIT"
+LICENSE = "MIT & GPL-2.0-or-later"
-LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+LIC_FILES_CHKSUM = " \
+    file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420 \
+    file://alsa-state-init;beginline=3;endline=4;md5=3ff7ecbf534d7d503941abe8e268ef50 \
+"
 PV = "0.2.0"
-PR = "r5"
 SRC_URI = "\
  file://asound.conf \
@@ -19,7 +21,7 @@ SRC_URI = "\
  file://alsa-state-init \
 "
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 # As the recipe doesn't inherit systemd.bbclass, we need to set this variable
 # manually to avoid unnecessary postinst/preinst generated.
@@ -36,28 +38,28 @@ INITSCRIPT_PARAMS = "start 39 S . stop 31 0 6 ."
 do_install() {
    # Only install the init script when 'sysvinit' is in DISTRO_FEATURES.
    if ${@bb.utils.contains('DISTRO_FEATURES','sysvinit','true','false',d)}; then
-        sed -i -e "s:#STATEDIR#:${localstatedir}/lib/alsa:g" ${WORKDIR}/alsa-state-init
+        sed -i -e "s:#STATEDIR#:${localstatedir}/lib/alsa:g" ${S}/alsa-state-init
        install -d ${D}${sysconfdir}/init.d
-        install -m 0755 ${WORKDIR}/alsa-state-init ${D}${sysconfdir}/init.d/alsa-state
+        install -m 0755 ${S}/alsa-state-init ${D}${sysconfdir}/init.d/alsa-state
    fi
    install -d ${D}/${localstatedir}/lib/alsa
    install -d ${D}${sysconfdir}
-    install -m 0644 ${WORKDIR}/asound.conf ${D}${sysconfdir}
+    install -m 0644 ${S}/asound.conf ${D}${sysconfdir}
-    install -m 0644 ${WORKDIR}/*.state ${D}${localstatedir}/lib/alsa
+    install -m 0644 ${S}/*.state ${D}${localstatedir}/lib/alsa
 }
 PACKAGES += "alsa-states"
-RRECOMMENDS_alsa-state = "alsa-states"
+RRECOMMENDS:alsa-state = "alsa-states"
-RDEPENDS_${PN} = "alsa-utils-alsactl"
+RDEPENDS:${PN} = "alsa-utils-alsactl"
-FILES_${PN} = "${sysconfdir}/init.d ${sysconfdir}/asound.conf"
+FILES:${PN} = "${sysconfdir}/init.d ${sysconfdir}/asound.conf"
-CONFFILES_${PN} = "${sysconfdir}/asound.conf"
+CONFFILES:${PN} = "${sysconfdir}/asound.conf"
-FILES_alsa-states = "${localstatedir}/lib/alsa/*.state"
+FILES:alsa-states = "${localstatedir}/lib/alsa/*.state"
-pkg_postinst_${PN}() {
+pkg_postinst:${PN}() {
        if test -z "$D"
        then
                if test -x ${sbindir}/alsactl
diff --git a/meta/recipes-bsp/alsa-state/alsa-state/alsa-state-init b/meta/recipes-bsp/alsa-state/alsa-state/alsa-state-init
index eee59cb321..a04cc27004 100755
--- a/meta/recipes-bsp/alsa-state/alsa-state/alsa-state-init
+++ b/meta/recipes-bsp/alsa-state/alsa-state/alsa-state-init
@@ -1,10 +1,9 @@
 #! /bin/sh
 #
 # Copyright Matthias Hentges <devel@hentges.net> (c) 2007
-# License: GPL (see http://www.gnu.org/licenses/gpl.txt for a copy of the license)
+# SPDX-License-Identifier: GPL-2.0-or-later
 #
 # Filename: alsa-state
-# Date: 20070308 (YMD)
 # source function library
 . /etc/init.d/functions
diff --git a/meta/recipes-bsp/apmd/apmd/apmd.service b/meta/recipes-bsp/apmd/apmd/apmd.service
deleted file mode 100644
index ffab82334f..0000000000
--- a/meta/recipes-bsp/apmd/apmd/apmd.service
+++ /dev/null
@@ -1,7 +0,0 @@
-[Unit]
-Description=Advanced Power Management daemon
-After=remote-fs.target
-[Service]
-EnvironmentFile=-@SYSCONFDIR@/default/apmd
-ExecStart=@SBINDIR@/apmd -P @SYSCONFDIR@/apm/apmd_proxy $APMD
diff --git a/meta/recipes-bsp/apmd/apmd/apmd_proxy b/meta/recipes-bsp/apmd/apmd/apmd_proxy
deleted file mode 100644
index c48ee4e5d5..0000000000
--- a/meta/recipes-bsp/apmd/apmd/apmd_proxy
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/bin/sh
-# 
-# apmd_proxy - program dispatcher for APM daemon
-#
-# Written by Craig Markwardt (craigm@lheamail.gsfc.nasa.gov) 21 May 1999
-# Modified for Debian by Avery Pennarun
-#
-# This shell script is called by the APM daemon (apmd) when a power
-# management event occurs.  Its first and second arguments describe the
-# event.  For example, apmd will call "apmd_proxy suspend system" just
-# before the system is suspended.
-#
-# Here are the possible arguments:
-#
-# start              - APM daemon has started
-# stop               - APM daemon is shutting down
-# suspend critical   - APM system indicates critical suspend (++)
-# suspend system     - APM system has requested suspend mode
-# suspend user       - User has requested suspend mode
-# standby system     - APM system has requested standby mode 
-# standby user       - User has requested standby mode
-# resume suspend     - System has resumed from suspend mode
-# resume standby     - System has resumed from standby mode
-# resume critical    - System has resumed from critical suspend
-# change battery     - APM system reported low battery
-# change power       - APM system reported AC/battery change
-# change time        - APM system reported time change (*)
-# change capability  - APM system reported config. change (+)
-#
-# (*) - APM daemon may be configured to not call these sequences
-# (+) - Available if APM kernel supports it.
-# (++) - "suspend critical" is never passed to apmd from the kernel,
-#   so we will never see it here.  Scripts that process "resume
-#   critical" events need to take this into account.
-#
-# It is the proxy script's responsibility to examine the APM status
-# (via /proc/apm) or other status and to take appropriate actions.
-# For example, the script might unmount network drives before the
-# machine is suspended.
-#
-# In Debian, the usual way of adding functionality to the proxy is to
-# add a script to /etc/apm/event.d.  This script will be called by
-# apmd_proxy (via run-parts) with the same arguments.
-#
-# If it is important that a certain set of script be run in a certain
-# order on suspend and in a different order on resume, then put all
-# the scripts in /etc/apm/scripts.d instead of /etc/apm/event.d and
-# symlink to these from /etc/apm/suspend.d, /etc/apm/resume.d and
-# /etc/apm/other.d using names whose lexicographical order is the same
-# as the desired order of execution.
-#
-# If the kernel's APM driver supports it, apmd_proxy can return a non-zero
-# exit status on suspend and standby events, indicating that the suspend
-# or standby event should be rejected.
-#
-# *******************************************************************
-set -e
-# The following doesn't yet work, because current kernels (up to at least
-# 2.4.20) do not support rejection of APM events.  Supporting this would
-# require substantial modifications to the APM driver.  We will re-enable
-# this feature if the driver is ever modified.       -- cph@debian.org
-#
-#SUSPEND_ON_AC=false
-#[ -r /etc/apm/apmd_proxy.conf ] && . /etc/apm/apmd_proxy.conf
-#
-#if [ "${SUSPEND_ON_AC}" = "false" -a "${2}" = "system" ] \
-#       && on_ac_power >/dev/null; then
-#    # Reject system suspends and standbys if we are on AC power
-#    exit 1  # Reject (NOTE kernel support must be enabled)
-#fi
-if [ "${1}" = "suspend" -o "${1}" = "standby" ]; then
-    run-parts -a "${1}" -a "${2}" /etc/apm/event.d
-    if [ -d /etc/apm/suspend.d ]; then
-        run-parts -a "${1}" -a "${2}" /etc/apm/suspend.d
-    fi
-elif [ "${1}" = "resume" ]; then
-    if [ -d /etc/apm/resume.d ]; then
-        run-parts -a "${1}" -a "${2}" /etc/apm/resume.d
-    fi
-    run-parts -a "${1}" -a "${2}" /etc/apm/event.d
-else
-    run-parts -a "${1}" -a "${2}" /etc/apm/event.d
-    if [ -d /etc/apm/other.d ]; then
-        run-parts -a "${1}" -a "${2}" /etc/apm/other.d
-    fi
-fi
-exit 0
diff --git a/meta/recipes-bsp/apmd/apmd/apmd_proxy.conf b/meta/recipes-bsp/apmd/apmd/apmd_proxy.conf
deleted file mode 100644
index 751145c522..0000000000
--- a/meta/recipes-bsp/apmd/apmd/apmd_proxy.conf
+++ /dev/null
@@ -1,16 +0,0 @@
-# /etc/apm/apmd_proxy.conf: configuration file for apmd.
-#
-# This file is managed by debconf when installing or reconfiguring the
-# package.  It is generated by merging the answers gathered by debconf
-# into the template file "/usr/share/apmd/apmd_proxy.conf".
-# The following doesn't yet work, because current kernels (up to at least
-# 2.4.20) do not support rejection of APM events.  Supporting this would
-# require substantial modifications to the APM driver.  We will re-enable
-# this feature if the driver is ever modified.       -- cph@debian.org
-#
-# Set the following to "false" if you want to reject system suspend or
-# system standby requests when the computer is running on AC power.
-# Otherwise set this to "true".  Such requests are never rejected when
-# the computer is running on battery power.
-#SUSPEND_ON_AC=true
diff --git a/meta/recipes-bsp/apmd/apmd/default b/meta/recipes-bsp/apmd/apmd/default
deleted file mode 100644
index 4b7965abf8..0000000000
--- a/meta/recipes-bsp/apmd/apmd/default
+++ /dev/null
@@ -1,8 +0,0 @@
-#
-# Default for /etc/init.d/apmd
-#
-# As apmd can be called with arguments, we use the following variable
-# to store them, e.g., APMD="-w 5 -p 2".
-# See the manual page apmd(8) for details.
-APMD="--proxy-timeout 30"
diff --git a/meta/recipes-bsp/apmd/apmd/init b/meta/recipes-bsp/apmd/apmd/init
deleted file mode 100755
index c0b41aa9d1..0000000000
--- a/meta/recipes-bsp/apmd/apmd/init
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/bin/sh
-### BEGIN INIT INFO
-# Provides:          apmd
-# Required-Start:    $remote_fs
-# Required-Stop:     $remote_fs
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: Advanced Power Management daemon
-### END INIT INFO
-# Source function library.
-. /etc/init.d/functions
-PATH=/bin:/usr/bin:/sbin:/usr/sbin
-[ -f /etc/default/rcS ] && . /etc/default/rcS
-[ -f /etc/default/apmd ] && . /etc/default/apmd
-case "$1" in
-    start)
-        echo -n "Starting advanced power management daemon: "
-        start-stop-daemon -S -x /usr/sbin/apmd -- \
-                -P /etc/apm/apmd_proxy $APMD
-        if [ $? = 0 ]; then
-            echo "apmd."
-        else
-            echo "(failed.)"
-        fi
-        ;;
-    stop)
-        echo -n "Stopping advanced power management daemon: "
-        start-stop-daemon -K \
-                -x /usr/sbin/apmd
-        echo "apmd."
-        ;;
-    status)
-        status /usr/sbin/apmd;
-        exit $?
-        ;;
-    restart|force-reload) 
-        $0 stop
-        $0 start
-        exit
-        ;;
-    *)
-        echo "Usage: /etc/init.d/apmd {start|stop|status|restart|force-reload}"
-        exit 1
-        ;;
-esac
-exit 0
diff --git a/meta/recipes-bsp/apmd/apmd/legacy.patch b/meta/recipes-bsp/apmd/apmd/legacy.patch
deleted file mode 100644
index 8871311805..0000000000
--- a/meta/recipes-bsp/apmd/apmd/legacy.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From 3595933d221f0ba836917debc0776b8723972ec9 Mon Sep 17 00:00:00 2001
-From: Alexander Kanavin <alex.kanavin@gmail.com>
-Date: Tue, 11 Aug 2015 17:40:50 +0300
-Subject: [PATCH 1/3] Patch with fixes provided by Debian.
-This patch is taken from
-ftp://ftp.debian.org/debian/pool/main/a/apmd/apmd_3.2.2-15.debian.tar.xz
-Upstream-Status: Inappropriate [upstream is dead]
-Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
---
- Makefile |  2 +-
- apm.c    |  3 ++-
- apm.h    |  9 +++++++++
- apmd.c   | 15 ++++++++-------
- 4 files changed, 20 insertions(+), 9 deletions(-)
-diff --git a/Makefile b/Makefile
-index bf346d9..92fc0fd 100644
--- a/Makefile
-+++ b/Makefile
-@@ -43,7 +43,7 @@ DESTDIR=
- 
- CC=gcc
- CFLAGS=-O -g
-XTRACFLAGS=-Wall -pipe -I. -I/usr/src/linux/include \
-+XTRACFLAGS=-Wall -pipe -I. -I/usr/src/linux/include -I/usr/X11R6/include \
-                -I/usr/src/linux-2.2/include -I /usr/src/linux-2.0/include \
-                -DVERSION=\"$(VERSION)\" \
-                -DDEFAULT_PROXY_NAME=\"$(PROXY_DIR)/apmd_proxy\"
-diff --git a/apm.c b/apm.c
-index b21c057..0359b1c 100644
--- a/apm.c
-+++ b/apm.c
-@@ -219,12 +219,13 @@ int main(int argc, char **argv)
-                }
-        }
-                                                                                                            
-
-+#if 0
-     if (!(i.apm_flags & APM_32_BIT_SUPPORT))
-     {
-        fprintf(stderr, "32-bit APM interface not supported\n");
-        exit(1);
-     }
-+#endif
- 
-     if (verbose && (i.apm_flags & 0x10))
-        printf("APM BIOS Power Management is currently disabled\n");
-diff --git a/apm.h b/apm.h
-index fb24dfd..824cc06 100644
--- a/apm.h
-+++ b/apm.h
-@@ -20,6 +20,13 @@
-  * $Id: apm.h,v 1.7 1999/07/05 22:31:11 apenwarr Exp $
-  * 
-  */
-+#ifndef _APM_H
-+#define _APM_H 1
-+
-+#ifndef __KERNEL_STRICT_NAMES
-+#define __KERNEL_STRICT_NAMES
-+#endif
-+
- #include <linux/apm_bios.h>
- #include <sys/types.h>
- 
-@@ -93,3 +100,5 @@ extern int apm_reject(int fd);
- #else
- #define apm_reject(fd)   (-EINVAL)
- #endif
-+
-+#endif
-diff --git a/apmd.c b/apmd.c
-index 49ed3a1..560f536 100644
--- a/apmd.c
-+++ b/apmd.c
-@@ -343,7 +343,7 @@ static int call_proxy(apm_event_t event)
-                /* parent */
-                int status, retval;
-                ssize_t len;
-               time_t time_limit;
-+               time_t countdown;
- 
-                if (pid < 0) {
-                        /* Couldn't fork */
-@@ -356,8 +356,9 @@ static int call_proxy(apm_event_t event)
-                /* Capture the child's output, if any, but only until it terminates */
-                close(fds[1]);
-                fcntl(fds[0], F_SETFL, O_RDONLY|O_NONBLOCK);
-               time_limit = time(0) + proxy_timeout;
-+               countdown = proxy_timeout;
-                do {
-+                       countdown -= 1;
-                        while ((len = read(fds[0], line, sizeof(line)-1)) > 0) {
-                                line[len] = 0;
-                                APMD_SYSLOG(LOG_INFO, "+ %s", line);
-@@ -372,16 +373,16 @@ static int call_proxy(apm_event_t event)
-                                goto proxy_done;
-                        }
-                                
-                       sleep(1);
-+                       while (sleep(1) > 0) ;
-                } while (
-                       (time(0) < time_limit)
-+                       (countdown >= 0)
-                        || (proxy_timeout < 0)
-                );
- 
-                APMD_SYSLOG(LOG_NOTICE, "Proxy has been running more than %d seconds; killing it", proxy_timeout);
- 
-                kill(pid, SIGTERM);
-               time_limit = time(0) + 5;
-+               countdown = 5;
-                do {
-                        retval = waitpid(pid, &status, WNOHANG);
-                        if (retval == pid)
-@@ -392,9 +393,9 @@ static int call_proxy(apm_event_t event)
-                                goto proxy_done;
-                        }
- 
-                       sleep(1);
-+                       while (sleep(1) > 0) ;
- 
-               } while (time(0) < time_limit);
-+               } while (countdown >= 0);
- 
-                kill(pid, SIGKILL);
-                status = __W_EXITCODE(0, SIGKILL);
-- 
-2.1.4
diff --git a/meta/recipes-bsp/apmd/apmd/libtool.patch b/meta/recipes-bsp/apmd/apmd/libtool.patch
deleted file mode 100644
index 834ee080a1..0000000000
--- a/meta/recipes-bsp/apmd/apmd/libtool.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-Add by RP to address "unable to infer tagged configuration" error:
-   commit 35de05e61b88c0808a5e885bb0efdf420555d5ad
-   Author: Richard Purdie <rpurdie@rpsys.net>
-   Date:   Sun Jun 1 16:13:38 2008 +0000
-   apmd: Use libtool --tag options to avoid problems with libtool 2.2.4 (from poky)
-However I didn't see same issue with current libtool-2.2.10. Also per my understanding,
-the default tag, if not specified, falls back to CC. So disable it from patching, but
-keep it here. If we encounter similar issue in the future, we could then push upstream
-Comment added by Kevin Tian <kevin.tian@intel.com>, 2010-07-16
-Upstream-Status: Pending
-Signed-off-by: Scott Garman <scott.a.garman@intel.com>
-Index: apmd-3.2.2.orig/Makefile
-===================================================================
--- apmd-3.2.2.orig.orig/Makefile       2004-01-04 08:13:18.000000000 +0000
-+++ apmd-3.2.2.orig/Makefile    2008-04-21 17:10:03.000000000 +0100
-@@ -58,9 +57,8 @@
- #CFLAGS=-O3 -m486 -fomit-frame-pointer
- #LDFLAGS=-s
- 
-LIBTOOL=libtool --quiet
-LT_COMPILE = $(LIBTOOL) --mode=compile $(CC)
-LT_LINK = $(LIBTOOL) --mode=link $(CC)
-+LT_COMPILE = $(LIBTOOL) --tag=CC --mode=compile $(CC)
-+LT_LINK = $(LIBTOOL)  --tag=CC --mode=link $(CC)
- LT_INSTALL = $(LIBTOOL) --mode=install install
- LT_CLEAN = $(LIBTOOL) --mode=clean rm
- 
diff --git a/meta/recipes-bsp/apmd/apmd/linkage.patch b/meta/recipes-bsp/apmd/apmd/linkage.patch
deleted file mode 100644
index 3d32c49cd2..0000000000
--- a/meta/recipes-bsp/apmd/apmd/linkage.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-When building use the libtool intermediate .lo files instead of explicitly using
-the .o files. Under libtool foo.lo is the libtool intermediate wrapper, foo.o is
-a static build, and .libs/foo.o is a shared build.
-If static libraries have been disabled globally then libtool won't generate them
-and explicit references to foo.o won't be satisfied.
-Upstream-Status: Pending
-Signed-off-by: Ross Burton <ross.burton@intel.com>
-diff --git a/Makefile b/Makefile
-index bb695c6..5f60146 100644
--- a/Makefile
-+++ b/Makefile
-@@ -28,7 +28,7 @@ endif
- 
- .SUFFIXES:
- 
-OBJS=apmlib.o
-+OBJS=apmlib.lo
- EXES=apm apmd xapm apmsleep
- HEADERS=apm.h
- 
-@@ -66,22 +66,22 @@ all: $(EXES)
- 
- $(OBJS): $(HEADERS)
- 
-%.o: %.c
-+%.lo: %.c
-        $(LT_COMPILE) -c $(CPPFLAGS) $(CFLAGS) $(XTRACFLAGS) $<
- 
-%: %.o $(LIBAPM)
-+%: %.lo $(LIBAPM)
-        $(LT_LINK) -o $@ $< $(LDFLAGS) $(LIBAPM)
- 
-xapm.o: xapm.c
-+xapm.lo: xapm.c
-        $(LT_COMPILE) -c $(CPPFLAGS) $(CFLAGS) $(XTRACFLAGS) -DNARROWPROTO $<
- 
-apmd: apmd.o
-+apmd: apmd.lo
- 
-apmsleep: apmsleep.o
-+apmsleep: apmsleep.lo
- 
-apmexists: apmexists.o
-+apmexists: apmexists.lo
- 
-xapm: xapm.o $(LIBAPM)
-+xapm: xapm.lo $(LIBAPM)
-        $(LT_LINK) -o $@ $< $(LDFLAGS) $(LIBAPM) $(XLDFLAGS) $(XLIBS)
- 
- $(LIBAPM): apmlib.lo
diff --git a/meta/recipes-bsp/apmd/apmd/unlinux.patch b/meta/recipes-bsp/apmd/apmd/unlinux.patch
deleted file mode 100644
index ec8206cf17..0000000000
--- a/meta/recipes-bsp/apmd/apmd/unlinux.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-copy OE commit message here:
-   commit 9456cdc1cf43e3ba9e6d88c63560c1b6fdee4359
-   Author: Michael Krelin <hacker@klever.net>
-   Date:   Tue May 29 12:27:45 2007 +0000
-   apmd: prevent build from interferring with host kernel headers. Closes #1257
-comment added by Kevin Tian <kevin.tian@intel.com>, 2010-07-13
-Upstream-Status: Pending
-Signed-off-by: Scott Garman <scott.a.garman@intel.com>
--- apmd-3.2.2.orig/Makefile
-+++ apmd-3.2.2/Makefile
-@@ -43,8 +43,7 @@
- 
- CC=gcc
- CFLAGS=-O -g
-XTRACFLAGS=-Wall -pipe -I. -I/usr/src/linux/include -I/usr/X11R6/include \
-               -I/usr/src/linux-2.2/include -I /usr/src/linux-2.0/include \
-+XTRACFLAGS=-Wall -pipe -I. \
-                -DVERSION=\"$(VERSION)\" \
-                -DDEFAULT_PROXY_NAME=\"$(PROXY_DIR)/apmd_proxy\"
- LDFLAGS=
diff --git a/meta/recipes-bsp/apmd/apmd/wexitcode.patch b/meta/recipes-bsp/apmd/apmd/wexitcode.patch
deleted file mode 100644
index c5faa85fa7..0000000000
--- a/meta/recipes-bsp/apmd/apmd/wexitcode.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-Define non-posix W* funcitons
-C libraries like musl dont define them
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-Upstream-Status: Pending
-Index: apmd-3.2.2.orig/apmd.c
-===================================================================
--- apmd-3.2.2.orig.orig/apmd.c
-+++ apmd-3.2.2.orig/apmd.c
-@@ -55,6 +55,14 @@
- #define MINIMUM_RATE_CALC_TIME  120
- #endif
- 
-+#ifndef _POSIX_SOURCE
-+
-+#define        __WCOREFLAG  0200
-+#define __WCOREDUMP(x)  (_W_INT(x) & __WCOREFLAG)
-+#define        __W_EXITCODE(ret, sig) ((ret) << 8 | (sig))
-+
-+#endif
-+
- /*
-  * For the verbosity level feature to be useful,
-  * we rely on the fact that syslog.h assigns adjacent
diff --git a/meta/recipes-bsp/apmd/apmd_3.2.2-15.bb b/meta/recipes-bsp/apmd/apmd_3.2.2-15.bb
deleted file mode 100644
index 82c2649340..0000000000
--- a/meta/recipes-bsp/apmd/apmd_3.2.2-15.bb
+++ /dev/null
@@ -1,85 +0,0 @@
-SUMMARY = "Utilities for Advanced Power Management"
-DESCRIPTION = "The Advanced Power Management (APM) support provides \
-access to battery status information and a set of tools for managing \
-notebook power consumption."
-HOMEPAGE = "http://apenwarr.ca/apmd/"
-SECTION = "base"
-LICENSE = "GPLv2+"
-LIC_FILES_CHKSUM = "file://COPYING;md5=94d55d512a9ba36caa9b7df079bae19f \
-                    file://apm.h;beginline=6;endline=18;md5=7d4acc1250910a89f84ce3cc6557c4c2"
-DEPENDS = "libtool-cross"
-SRC_URI = "http://snapshot.debian.org/archive/debian/20160728T043443Z/pool/main/a/${BPN}/${BPN}_3.2.2.orig.tar.gz;name=tarball \
-           file://legacy.patch \
-           file://libtool.patch \
-           file://unlinux.patch \
-           file://wexitcode.patch \
-           file://linkage.patch \
-           file://init \
-           file://default \
-           file://apmd_proxy \
-           file://apmd_proxy.conf \
-           file://apmd.service"
-SRC_URI[tarball.md5sum] = "b1e6309e8331e0f4e6efd311c2d97fa8"
-SRC_URI[tarball.sha256sum] = "7f7d9f60b7766b852881d40b8ff91d8e39fccb0d1d913102a5c75a2dbb52332d"
-# for this package we're mostly interested in tracking debian patches,
-# and not in the upstream version where all development has effectively stopped
-UPSTREAM_CHECK_URI = "${DEBIAN_MIRROR}/main/a/apmd/"
-UPSTREAM_CHECK_REGEX = "(?P<pver>((\d+\.*)+)-((\d+\.*)+))\.(diff|debian\.tar)\.(gz|xz)"
-S = "${WORKDIR}/apmd-3.2.2.orig"
-inherit update-rc.d systemd
-INITSCRIPT_NAME = "apmd"
-INITSCRIPT_PARAMS = "defaults"
-SYSTEMD_SERVICE_${PN} = "apmd.service"
-SYSTEMD_AUTO_ENABLE = "disable"
-EXTRA_OEMAKE = "-e MAKEFLAGS="
-do_compile() {
-        # apmd doesn't use whole autotools. Just libtool for installation
-        oe_runmake "LIBTOOL=${STAGING_BINDIR_CROSS}/${HOST_SYS}-libtool" apm apmd
-}
-do_install() {
-        install -d ${D}${sysconfdir}
-        install -d ${D}${sysconfdir}/apm
-        install -d ${D}${sysconfdir}/apm/event.d
-        install -d ${D}${sysconfdir}/apm/other.d
-        install -d ${D}${sysconfdir}/apm/suspend.d
-        install -d ${D}${sysconfdir}/apm/resume.d
-        install -d ${D}${sysconfdir}/apm/scripts.d
-        install -d ${D}${sysconfdir}/default
-        install -d ${D}${sysconfdir}/init.d
-        install -d ${D}${sbindir}
-        install -d ${D}${bindir}
-        install -d ${D}${libdir}
-        install -d ${D}${datadir}/apmd
-        install -d ${D}${includedir}
-        install -m 4755 ${S}/.libs/apm ${D}${bindir}/apm
-        install -m 0755 ${S}/.libs/apmd ${D}${sbindir}/apmd
-        install -m 0755 ${WORKDIR}/apmd_proxy ${D}${sysconfdir}/apm/
-        install -m 0644 ${WORKDIR}/apmd_proxy.conf ${D}${datadir}/apmd/
-        install -m 0644 ${WORKDIR}/default ${D}${sysconfdir}/default/apmd
-        oe_libinstall -so libapm ${D}${libdir}
-        install -m 0644 apm.h ${D}${includedir}
-        sed -e 's,/usr/sbin,${sbindir},g; s,/etc,${sysconfdir},g;' ${WORKDIR}/init > ${D}${sysconfdir}/init.d/apmd
-        chmod 755 ${D}${sysconfdir}/init.d/apmd
-        install -d ${D}${systemd_unitdir}/system
-        install -m 0644 ${WORKDIR}/apmd.service ${D}${systemd_unitdir}/system/
-        sed -i -e 's,@SYSCONFDIR@,${sysconfdir},g' \
-                -e 's,@SBINDIR@,${sbindir},g' ${D}${systemd_unitdir}/system/apmd.service
-}
-PACKAGES =+ "libapm apm"
-FILES_libapm = "${libdir}/libapm${SOLIBS}"
-FILES_apm = "${bindir}/apm*"
diff --git a/meta/recipes-bsp/barebox/barebox-common.inc b/meta/recipes-bsp/barebox/barebox-common.inc
new file mode 100644
index 0000000000..67bc964188
--- /dev/null
+++ b/meta/recipes-bsp/barebox/barebox-common.inc
@@ -0,0 +1,8 @@
+HOMEPAGE = "https://barebox.org/"
+SECTION = "bootloaders"
+LIC_FILES_CHKSUM = "file://COPYING;md5=f5125d13e000b9ca1f0d3364286c4192"
+PV = "2025.06.0"
+SRC_URI = "https://barebox.org/download/barebox-${PV}.tar.bz2"
+SRC_URI[sha256sum] = "d05bc1f85dc1d95b0b6b6a52cac0a469148fbb8f1edb0d352c3ca3b632426941"
diff --git a/meta/recipes-bsp/barebox/barebox-tools.bb b/meta/recipes-bsp/barebox/barebox-tools.bb
new file mode 100644
index 0000000000..e519796c1d
--- /dev/null
+++ b/meta/recipes-bsp/barebox/barebox-tools.bb
@@ -0,0 +1,55 @@
+SUMMARY = "barebox bootloader tools"
+require barebox-common.inc
+LICENSE = "GPL-2.0-only"
+DEPENDS = "bison-native flex-native libusb1"
+S = "${UNPACKDIR}/barebox-${PV}"
+B = "${WORKDIR}/build"
+inherit pkgconfig
+EXTRA_OEMAKE = " \
+  ARCH=sandbox \
+  CROSS_COMPILE=${TARGET_PREFIX} -C ${S} O=${B} \
+  CROSS_PKG_CONFIG=pkg-config \
+  CC='${CC}' \
+  LD='${LD}' \
+  "
+do_compile:class-target () {
+    export userccflags="${HOST_CC_ARCH}${TOOLCHAIN_OPTIONS}"
+    export userldflags="${TARGET_LDFLAGS}${TOOLCHAIN_OPTIONS}"
+    oe_runmake targettools_defconfig
+    oe_runmake scripts
+}
+do_compile:class-native () {
+    oe_runmake hosttools_defconfig
+    oe_runmake scripts
+}
+BAREBOX_TOOLS = " \
+         bareboxenv \
+         bareboxcrc32 \
+         kernel-install \
+         bareboximd \
+         omap3-usb-loader \
+         omap4_usbboot \
+         imx/imx-usb-loader \
+         "
+BAREBOX_TOOLS_SUFFIX = ""
+BAREBOX_TOOLS_SUFFIX:class-target = "-target"
+do_install () {
+        install -d ${D}${bindir}
+        for tool in ${BAREBOX_TOOLS}; do
+                install -m 0755 scripts/${tool}${BAREBOX_TOOLS_SUFFIX} ${D}${bindir}/${tool##*/}
+        done
+}
+BBCLASSEXTEND = "native nativesdk"
diff --git a/meta/recipes-bsp/barebox/barebox.bb b/meta/recipes-bsp/barebox/barebox.bb
new file mode 100644
index 0000000000..a48d97941c
--- /dev/null
+++ b/meta/recipes-bsp/barebox/barebox.bb
@@ -0,0 +1,10 @@
+SUMMARY = "barebox is a bootloader designed for embedded systems. It runs on a variety of architectures including x86, ARM, MIPS, PowerPC and others."
+DESCRIPTION = "barebox aims to be a versatile and flexible bootloader not only for booting embedded Linux systems, \
+but also for initial hardware bringup and development. \
+Users should feel right at home with a shell with UNIX-like virtual file system access to hardware, \
+Linux kernel driver API for making driver porting easier, \
+and a subset of the POSIX C library for writing more command-line utilities."
+require barebox-common.inc
+inherit barebox
diff --git a/meta/recipes-bsp/efibootmgr/efibootmgr/0001-remove-extra-decl.patch b/meta/recipes-bsp/efibootmgr/efibootmgr/0001-remove-extra-decl.patch
deleted file mode 100644
index 42f3a8182d..0000000000
--- a/meta/recipes-bsp/efibootmgr/efibootmgr/0001-remove-extra-decl.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 99b578501643377e0b1994b2a068b790d189d5ad Mon Sep 17 00:00:00 2001
-From: Peter Jones <pjones@redhat.com>
-Date: Wed, 13 Jun 2018 09:41:01 -0400
-Subject: [PATCH] remove extra decl
-Signed-off-by: Peter Jones <pjones@redhat.com>
-Upstream-Status: Backport [git://github.com/rhinstaller/efibootmgr.git]
-Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
- src/efibootmgr.c | 3 ---
- 1 file changed, 3 deletions(-)
-diff --git a/src/efibootmgr.c b/src/efibootmgr.c
-index de38f01..4e1a680 100644
--- a/src/efibootmgr.c
-+++ b/src/efibootmgr.c
-@@ -1536,9 +1536,6 @@ parse_opts(int argc, char **argv)
-                                               "invalid numeric value %s\n",
-                                               optarg);
-                        }
-                        /* XXX efivar-36 accidentally doesn't have a public
-                         * header for this */
-                       extern int efi_set_verbose(int verbosity, FILE *errlog);
-                        efi_set_verbose(opts.verbose - 2, stderr);
-                        break;
-                case 'V':
-- 
-2.7.4
diff --git a/meta/recipes-bsp/efibootmgr/efibootmgr/97668ae0bce776a36ea2001dea63d376be8274ac.patch b/meta/recipes-bsp/efibootmgr/efibootmgr/97668ae0bce776a36ea2001dea63d376be8274ac.patch
deleted file mode 100644
index 9525ed8c54..0000000000
--- a/meta/recipes-bsp/efibootmgr/efibootmgr/97668ae0bce776a36ea2001dea63d376be8274ac.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-From 97668ae0bce776a36ea2001dea63d376be8274ac Mon Sep 17 00:00:00 2001
-From: Peter Jones <pjones@redhat.com>
-Date: Wed, 6 Mar 2019 13:08:33 -0500
-Subject: [PATCH] Make sure PKGS= is propogated into the submake for "make
- deps"
-When we're doing make deps with "$(CC) -MF", gcc and clang have different
-behavior, both broken in different ways, which we're hitting because of a
-missing -I argument for libefivar's includes.  On clang, when a header can't
-be found, it emits a rule with the header as a prerequisite without a path,
-such as efivar.h here:
-efibootmgr.o: efibootmgr.c fix_coverity.h efivar.h efiboot.h \
-  /home/pjones/devel/github.com/efibootmgr/master/src/include/list.h \
-  /home/pjones/devel/github.com/efibootmgr/master/src/include/efi.h \
-  /home/pjones/devel/github.com/efibootmgr/master/src/include/unparse_path.h \
-  /home/pjones/devel/github.com/efibootmgr/master/src/include/efibootmgr.h \
-  error.h
-Then the build that utilizes that rule will fail to find the
-prerequisite and tell you something like:
-make[1]: *** No rule to make target 'efivar.h', needed by 'efibootmgr.o'.  Stop.
-make[1]: Leaving directory '/home/pjones/devel/github.com/efibootmgr/master/src'
-With gcc, when a header can't be found, it emits a rule without that header
-as a prerequisite, as such (again with efivar.h):
-efibootmgr.o: efibootmgr.c fix_coverity.h \
- /home/pjones/devel/github.com/efibootmgr/master/src/include/list.h \
- /home/pjones/devel/github.com/efibootmgr/master/src/include/efi.h \
- /home/pjones/devel/github.com/efibootmgr/master/src/include/unparse_path.h \
- /home/pjones/devel/github.com/efibootmgr/master/src/include/efi.h \
- /home/pjones/devel/github.com/efibootmgr/master/src/include/efibootmgr.h \
- error.h
-And then your build will fail if you haven't adjusted CFLAGS to tell it
-where to find the header.
-Both of these would be better just erroring, but at least gcc's doesn't
-insert a *wrong* dependency.
-This patch adds "PKGS=efivar efibootmgr popt" for all deps under src/.
-Technically that's overkill, as efibootmgr itself doesn't need popt, but it
-doesn't hurt anything to have the extra part there.  The resulting
-.efibootmgr.d file has the prerequisites expressed correctly:
-efibootmgr.o: efibootmgr.c fix_coverity.h /usr/include/efivar/efivar.h \
- /usr/include/efivar/efiboot.h \
- /home/pjones/devel/github.com/efibootmgr/master/src/include/list.h \
- /home/pjones/devel/github.com/efibootmgr/master/src/include/efi.h \
- /home/pjones/devel/github.com/efibootmgr/master/src/include/unparse_path.h \
- /home/pjones/devel/github.com/efibootmgr/master/src/include/efi.h \
- /home/pjones/devel/github.com/efibootmgr/master/src/include/efibootmgr.h \
- error.h
-This fixes the issue described in github PR #96
-Signed-off-by: Peter Jones <pjones@redhat.com>
-Upstream-Status: Backport [https://github.com/rhboot/efibootmgr/commit/97668ae0bce776a36ea2001dea63d376be8274ac]
---
- src/Makefile | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-diff --git a/src/Makefile b/src/Makefile
-index 258bac1..32fa188 100644
--- a/src/Makefile
-+++ b/src/Makefile
-@@ -31,8 +31,13 @@ efibootdump : PKGS=efivar efiboot popt
- efibootnext : $(call objects-of,$(EFIBOOTNEXT_SOURCES))
- efibootnext : PKGS=efivar efiboot popt
- 
-+deps : PKGS=efivar efiboot popt
- deps : $(ALL_SOURCES)
-       $(MAKE) -f $(TOPDIR)/Make.deps deps SOURCES="$(ALL_SOURCES)" SUBDIR_CFLAGS="$(SUBDIR_CFLAGS)"
-+       $(MAKE) -f $(TOPDIR)/Make.deps \
-+               SOURCES="$(ALL_SOURCES)" \
-+               SUBDIR_CFLAGS="$(SUBDIR_CFLAGS)" \
-+               PKGS="$(PKGS)" \
-+               deps
- 
- clean :
-        @rm -rfv *.o *.a *.so $(TARGETS)
diff --git a/meta/recipes-bsp/efibootmgr/efibootmgr_17.bb b/meta/recipes-bsp/efibootmgr/efibootmgr_18.bb
index 5d6f200a73..6f4178216b 100644
--- a/meta/recipes-bsp/efibootmgr/efibootmgr_17.bb
+++ b/meta/recipes-bsp/efibootmgr/efibootmgr_18.bb
@@ -3,20 +3,15 @@ SUMMARY = "EFI Boot Manager"
 HOMEPAGE = "https://github.com/rhboot/efibootmgr"
 SECTION = "base"
-LICENSE = "GPLv2+"
+LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://COPYING;md5=0636e73ff0215e8d672dc4c32c317bb3"
 DEPENDS = "efivar popt"
 COMPATIBLE_HOST = "(i.86|x86_64|arm|aarch64).*-linux"
-SRC_URI = "git://github.com/rhinstaller/efibootmgr.git;protocol=https \
+SRC_URI = "git://github.com/rhinstaller/efibootmgr.git;protocol=https;branch=main"
-           file://0001-remove-extra-decl.patch \
+SRCREV = "c3f9f0534e32158f62c43564036878b93b9e0fd6"
-           file://97668ae0bce776a36ea2001dea63d376be8274ac.patch \
-          "
-SRCREV = "e067160ecef8208e1944002e5d50b275733211fb"
-S = "${WORKDIR}/git"
 inherit pkgconfig
diff --git a/meta/recipes-bsp/efivar/efivar/0001-docs-do-not-build-efisecdb-manpage.patch b/meta/recipes-bsp/efivar/efivar/0001-docs-do-not-build-efisecdb-manpage.patch
new file mode 100644
index 0000000000..cb30d3c430
--- /dev/null
+++ b/meta/recipes-bsp/efivar/efivar/0001-docs-do-not-build-efisecdb-manpage.patch
@@ -0,0 +1,26 @@
+From f39a1481a9e465387901d52b07ae56dedcc3838b Mon Sep 17 00:00:00 2001
+From: Alexander Kanavin <alex@linutronix.de>
+Date: Sun, 16 Jan 2022 18:25:33 +0100
+Subject: [PATCH] docs: do not build efisecdb manpage
+It requires mandoc, which oe-core does not have.
+Upstream-Status: Inappropriate [oe-core specific]
+Signed-off-by: Alexander Kanavin <alex@linutronix.de>
+---
+ docs/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/docs/Makefile b/docs/Makefile
+index c9bf585..91a6078 100644
+--- a/docs/Makefile
+++ b/docs/Makefile
+@@ -5,7 +5,7 @@ include $(TOPDIR)/src/include/version.mk
+ include $(TOPDIR)/src/include/rules.mk
+ include $(TOPDIR)/src/include/defaults.mk
+ 
+-MAN1TARGETS = efisecdb.1 \
+MAN1TARGETS = \
+              efivar.1
+ 
+ MAN3TARGETS = efi_append_variable.3 \
diff --git a/meta/recipes-bsp/efivar/efivar/determinism.patch b/meta/recipes-bsp/efivar/efivar/determinism.patch
deleted file mode 100644
index bdf6bfc4a8..0000000000
--- a/meta/recipes-bsp/efivar/efivar/determinism.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-Fix reproducibility issue caused by unsorted wildcard expansion.
-Upstream-Status: Pending
-RP 2021/3/1
-Index: git/src/Makefile
-===================================================================
--- git.orig/src/Makefile
-+++ git/src/Makefile
-@@ -15,7 +15,7 @@ TARGETS=$(LIBTARGETS) $(BINTARGETS) $(PC
- STATICTARGETS=$(STATICLIBTARGETS) $(STATICBINTARGETS)
- 
- LIBEFIBOOT_SOURCES = crc32.c creator.c disk.c gpt.c loadopt.c path-helpers.c \
-                    linux.c $(wildcard linux-*.c)
-+                    linux.c $(sort $(wildcard linux-*.c))
- LIBEFIBOOT_OBJECTS = $(patsubst %.c,%.o,$(LIBEFIBOOT_SOURCES))
- LIBEFIVAR_SOURCES = dp.c dp-acpi.c dp-hw.c dp-media.c dp-message.c \
-        efivarfs.c error.c export.c guid.c guids.S guid-symbols.c \
diff --git a/meta/recipes-bsp/efivar/efivar/no-werror.patch b/meta/recipes-bsp/efivar/efivar/no-werror.patch
deleted file mode 100644
index 50a0b1023a..0000000000
--- a/meta/recipes-bsp/efivar/efivar/no-werror.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-Don't use -Werror because newer compilers introduce newer warnings.
-Upstream-Status: Inappropriate [https://github.com/rhboot/efivar/issues/131]
-Signed-off-by: Ross Burton <ross.burton@intel.com>
-diff --git a/gcc.specs b/gcc.specs
-index 45d43d1..1baf11a 100644
--- a/gcc.specs
-+++ b/gcc.specs
-@@ -2,7 +2,7 @@
- + -D_GNU_SOURCE
- 
- *efivar_cpp_options:
- -Werror -Wall -std=gnu11 -Wextra
-+ -Wall -std=gnu11 -Wextra
- 
- *cpp_options:
- + %(efivar_cpp_options)
diff --git a/meta/recipes-bsp/efivar/efivar_37.bb b/meta/recipes-bsp/efivar/efivar_37.bb
deleted file mode 100644
index 5bf121ff6e..0000000000
--- a/meta/recipes-bsp/efivar/efivar_37.bb
+++ /dev/null
@@ -1,41 +0,0 @@
-SUMMARY = "Tools to manipulate UEFI variables"
-DESCRIPTION = "efivar provides a simple command line interface to the UEFI variable facility"
-HOMEPAGE = "https://github.com/rhboot/efivar"
-LICENSE = "LGPLv2.1+"
-LIC_FILES_CHKSUM = "file://COPYING;md5=6626bb1e20189cfa95f2c508ba286393"
-COMPATIBLE_HOST = "(i.86|x86_64|arm|aarch64).*-linux"
-SRC_URI = "git://github.com/rhinstaller/efivar.git \
-           file://determinism.patch \
-           file://no-werror.patch"
-SRCREV = "c1d6b10e1ed4ba2be07f385eae5bceb694478a10"
-S = "${WORKDIR}/git"
-inherit pkgconfig
-export CCLD_FOR_BUILD = "${BUILD_CCLD}"
-# Upstream uses --add-needed in gcc.specs which gold doesn't support, so
-# enforce BFD.
-LDFLAGS += "-fuse-ld=bfd"
-do_compile_prepend() {
-    # Remove when https://github.com/rhboot/efivar/issues/130 is fixed
-    oe_runmake \
-        CFLAGS="${BUILD_CFLAGS}" \
-        LDFLAGS="${BUILD_LDFLAGS}" \
-        -C src makeguids
-}
-do_install() {
-    oe_runmake install DESTDIR=${D}
-}
-BBCLASSEXTEND = "native"
-RRECOMMENDS_${PN}_class-target = "kernel-module-efivarfs"
-CLEANBROKEN = "1"
diff --git a/meta/recipes-bsp/efivar/efivar_39.bb b/meta/recipes-bsp/efivar/efivar_39.bb
new file mode 100644
index 0000000000..fb6b6b3821
--- /dev/null
+++ b/meta/recipes-bsp/efivar/efivar_39.bb
@@ -0,0 +1,31 @@
+SUMMARY = "Tools to manipulate UEFI variables"
+DESCRIPTION = "efivar provides a simple command line interface to the UEFI variable facility"
+HOMEPAGE = "https://github.com/rhboot/efivar"
+LICENSE = "LGPL-2.1-or-later"
+LIC_FILES_CHKSUM = "file://COPYING;md5=6626bb1e20189cfa95f2c508ba286393"
+COMPATIBLE_HOST = "(i.86|x86_64|arm|aarch64|riscv64).*-linux"
+SRC_URI = "git://github.com/rhinstaller/efivar.git;branch=main;protocol=https \
+           file://0001-docs-do-not-build-efisecdb-manpage.patch \
+           "
+SRCREV = "c47820c37ac26286559ec004de07d48d05f3308c"
+inherit pkgconfig
+export CCLD_FOR_BUILD = "${BUILD_CCLD}"
+do_compile() {
+    oe_runmake ERRORS= HOST_CFLAGS="${BUILD_CFLAGS}" HOST_LDFLAGS="${BUILD_LDFLAGS}"
+}
+do_install() {
+    oe_runmake install DESTDIR=${D}
+}
+BBCLASSEXTEND = "native"
+RRECOMMENDS:${PN}:class-target = "kernel-module-efivarfs"
+CLEANBROKEN = "1"
diff --git a/meta/recipes-bsp/formfactor/files/qemuppc64/machconfig b/meta/recipes-bsp/formfactor/files/qemuppc64/machconfig
new file mode 100755
index 0000000000..e4717730ea
--- /dev/null
+++ b/meta/recipes-bsp/formfactor/files/qemuppc64/machconfig
@@ -0,0 +1,10 @@
+HAVE_TOUCHSCREEN=0
+HAVE_KEYBOARD=0
+ 
+DISPLAY_CAN_ROTATE=0
+DISPLAY_ORIENTATION=0
+#DISPLAY_WIDTH_PIXELS=640
+#DISPLAY_HEIGHT_PIXELS=480
+#DISPLAY_BPP=16
+DISPLAY_DPI=150
+DISPLAY_SUBPIXEL_ORDER=vrgb
diff --git a/meta/recipes-bsp/formfactor/files/qemuriscv32/machconfig b/meta/recipes-bsp/formfactor/files/qemuriscv32/machconfig
new file mode 100755
index 0000000000..2789b5fc2a
--- /dev/null
+++ b/meta/recipes-bsp/formfactor/files/qemuriscv32/machconfig
@@ -0,0 +1,10 @@
+HAVE_TOUCHSCREEN=1
+HAVE_KEYBOARD=1
+DISPLAY_CAN_ROTATE=0
+DISPLAY_ORIENTATION=0
+DISPLAY_WIDTH_PIXELS=640
+DISPLAY_HEIGHT_PIXELS=480
+DISPLAY_BPP=16
+DISPLAY_DPI=150
+DISPLAY_SUBPIXEL_ORDER=vrgb
diff --git a/meta/recipes-bsp/formfactor/files/qemuriscv64/machconfig b/meta/recipes-bsp/formfactor/files/qemuriscv64/machconfig
new file mode 100755
index 0000000000..2789b5fc2a
--- /dev/null
+++ b/meta/recipes-bsp/formfactor/files/qemuriscv64/machconfig
@@ -0,0 +1,10 @@
+HAVE_TOUCHSCREEN=1
+HAVE_KEYBOARD=1
+DISPLAY_CAN_ROTATE=0
+DISPLAY_ORIENTATION=0
+DISPLAY_WIDTH_PIXELS=640
+DISPLAY_HEIGHT_PIXELS=480
+DISPLAY_BPP=16
+DISPLAY_DPI=150
+DISPLAY_SUBPIXEL_ORDER=vrgb
diff --git a/meta/recipes-bsp/formfactor/formfactor_0.0.bb b/meta/recipes-bsp/formfactor/formfactor_0.0.bb
index ea1fa4c754..f8d5613ffa 100644
--- a/meta/recipes-bsp/formfactor/formfactor_0.0.bb
+++ b/meta/recipes-bsp/formfactor/formfactor_0.0.bb
@@ -5,10 +5,10 @@ build system cannot obtain from other sources such as the kernel."
 SECTION = "base"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
-PR = "r45"
 SRC_URI = "file://config file://machconfig"
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 PACKAGE_ARCH = "${MACHINE_ARCH}"
 INHIBIT_DEFAULT_DEPS = "1"
diff --git a/meta/recipes-bsp/gnu-efi/gnu-efi/0001-Do-not-treat-warnings-as-errors.patch b/meta/recipes-bsp/gnu-efi/gnu-efi/0001-Do-not-treat-warnings-as-errors.patch
new file mode 100644
index 0000000000..0c10e66a12
--- /dev/null
+++ b/meta/recipes-bsp/gnu-efi/gnu-efi/0001-Do-not-treat-warnings-as-errors.patch
@@ -0,0 +1,29 @@
+From 80e17bcdf45dcf40b8f356cf68389612407b9f7b Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Thu, 16 May 2024 21:38:32 +0800
+Subject: [PATCH] Do not treat warnings as errors
+There are additional warnings found with musl which are
+treated as errors and fails the build, we have more combinations
+then upstream supports to handle
+Upstream-Status: Inappropriate [OE specific]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ Make.defaults | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/Make.defaults b/Make.defaults
+index 6d3cf51..23b9383 100755
+--- a/Make.defaults
+++ b/Make.defaults
+@@ -267,7 +267,7 @@ CFLAGS  += $(ARCH3264) -g -O2 -Wall -Wextra -Werror \
+            -fno-strict-aliasing \
+            -ffreestanding -fno-stack-protector
+ else
+-CFLAGS  += $(ARCH3264) -g -O2 -Wall -Wextra -Werror \
+CFLAGS  += $(ARCH3264) -g -O2 -Wall -Wextra \
+            -fno-strict-aliasing \
+            -ffreestanding -fno-stack-protector \
+            $(if $(findstring 0,$(USING_CLANG)),-fno-merge-all-constants,)
diff --git a/meta/recipes-bsp/gnu-efi/gnu-efi/gnu-efi-3.0.9-fix-clang-build.patch b/meta/recipes-bsp/gnu-efi/gnu-efi/gnu-efi-3.0.9-fix-clang-build.patch
deleted file mode 100644
index c6d660095e..0000000000
--- a/meta/recipes-bsp/gnu-efi/gnu-efi/gnu-efi-3.0.9-fix-clang-build.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-Fix building with CLANG-9.0.0 
-Fixes
-clang-9: error: unknown argument: '-maccumulate-outgoing-args'
-Upstream-Status: Submitted [https://sourceforge.net/p/gnu-efi/patches/70/]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
--- a/Make.defaults
-+++ b/Make.defaults
-@@ -110,10 +110,10 @@
-                             || ( [ $(GCCVERSION) -eq "4" ]      \
-                                  && [ $(GCCMINOR) -ge "7" ] ) ) \
-                           && echo 1)
-  ifeq ($(GCCNEWENOUGH),1)
-    CPPFLAGS += -DGNU_EFI_USE_MS_ABI -maccumulate-outgoing-args --std=c11
-  else ifeq ($(USING_CLANG),clang)
-+  ifeq ($(USING_CLANG),clang)
-     CPPFLAGS += -DGNU_EFI_USE_MS_ABI --std=c11
-+  else ifeq ($(GCCNEWENOUGH),1)
-+    CPPFLAGS += -DGNU_EFI_USE_MS_ABI -maccumulate-outgoing-args --std=c11
-   endif
- 
-   CFLAGS += -mno-red-zone
diff --git a/meta/recipes-bsp/gnu-efi/gnu-efi/lib-Makefile-fix-parallel-issue.patch b/meta/recipes-bsp/gnu-efi/gnu-efi/lib-Makefile-fix-parallel-issue.patch
deleted file mode 100644
index dc00b8fa4d..0000000000
--- a/meta/recipes-bsp/gnu-efi/gnu-efi/lib-Makefile-fix-parallel-issue.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 3ec8c2a70304eabd5760937a4ec3fbc4068a77ed Mon Sep 17 00:00:00 2001
-From: Robert Yang <liezhi.yang@windriver.com>
-Date: Thu, 23 Apr 2015 01:49:31 -0700
-Subject: [PATCH 2/3] lib/Makefile: fix parallel issue
-Fixed:
-Assembler messages:
-Fatal error: can't create runtime/rtlock.o: No such file or directory
-Assembler messages:
-Fatal error: can't create runtime/rtdata.o: No such file or directory
-Assembler messages:
-Fatal error: can't create runtime/vm.o: No such file or directory
-Assembler messages:
-Fatal error: can't create runtime/efirtlib.o: No such file or directory
-Upstream-Status: Pending
-Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
---
- lib/Makefile | 2 ++
- 1 file changed, 2 insertions(+)
-diff --git a/lib/Makefile b/lib/Makefile
-index 048751a..ed39bbb 100644
--- a/lib/Makefile
-+++ b/lib/Makefile
-@@ -74,6 +74,8 @@ all: libsubdirs libefi.a
- libsubdirs:
-        for sdir in $(SUBDIRS); do mkdir -p $$sdir; done
- 
-+$(OBJS): libsubdirs
-+
- libefi.a: $(OBJS)
-        $(AR) $(ARFLAGS) $@ $(OBJS)
- 
-- 
-2.7.4
diff --git a/meta/recipes-bsp/gnu-efi/gnu-efi/parallel-make-archives.patch b/meta/recipes-bsp/gnu-efi/gnu-efi/parallel-make-archives.patch
deleted file mode 100644
index 8a0138bbe5..0000000000
--- a/meta/recipes-bsp/gnu-efi/gnu-efi/parallel-make-archives.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 48b2cdbcd761105e8ebad412fcbf23db1ac4ef7c Mon Sep 17 00:00:00 2001
-From: Saul Wold <sgw@linux.intel.com>
-Date: Sun, 9 Mar 2014 15:22:15 +0200
-Subject: [PATCH 1/3] Fix parallel make failure for archives
-Upstream-Status: Pending
-The lib and gnuefi makefiles were using the lib.a() form which compiles
-and ar's as a pair instead of compiling all and then ar'ing which can
-parallelize better. This was resulting in build failures on larger values
-of -j.
-See http://www.chemie.fu-berlin.de/chemnet/use/info/make/make_toc.html#TOC105
-for details.
-Signed-off-by: Saul Wold <sgw@linux.intel.com>
-Signed-off-by: Darren Hart <dvhart@linux.intel.com>
-[Rebased for 3.0.6]
-Signed-off-by: California Sullivan <california.l.sullivan@intel.com>
-[Rebased for 3.0.8]
-Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
-diff --git a/lib/Makefile b/lib/Makefile
-index 0e6410d..048751a 100644
--- a/lib/Makefile
-+++ b/lib/Makefile
-@@ -75,7 +75,7 @@ libsubdirs:
-        for sdir in $(SUBDIRS); do mkdir -p $$sdir; done
- 
- libefi.a: $(OBJS)
-       $(AR) $(ARFLAGS) $@ $^
-+       $(AR) $(ARFLAGS) $@ $(OBJS)
- 
- clean:
-        rm -f libefi.a *~ $(OBJS) */*.o
-- 
-2.7.4
diff --git a/meta/recipes-bsp/gnu-efi/gnu-efi_3.0.12.bb b/meta/recipes-bsp/gnu-efi/gnu-efi_4.0.1.bb
index d27126603f..10a4ab6800 100644
--- a/meta/recipes-bsp/gnu-efi/gnu-efi_3.0.12.bb
+++ b/meta/recipes-bsp/gnu-efi/gnu-efi_4.0.1.bb
@@ -2,30 +2,31 @@ SUMMARY = "Libraries for producing EFI binaries"
 HOMEPAGE = "http://sourceforge.net/projects/gnu-efi/"
 DESCRIPTION = "GNU-EFI aims to Develop EFI applications for ARM-64, ARM-32, x86_64, IA-64 (IPF), IA-32 (x86), and MIPS platforms using the GNU toolchain and the EFI development environment."
 SECTION = "devel"
-LICENSE = "GPLv2+ | BSD-2-Clause"
+LICENSE = "GPL-2.0-or-later & BSD-2-Clause"
-LIC_FILES_CHKSUM = "file://gnuefi/crt0-efi-arm.S;beginline=4;endline=16;md5=e582764a4776e60c95bf9ab617343d36 \
+LIC_FILES_CHKSUM = "file://gnuefi/crt0-efi-arm.S;beginline=4;endline=16;md5=8b0a86085b86eda7a3c7e8a1eb7ec753 \
-                    file://gnuefi/crt0-efi-aarch64.S;beginline=4;endline=16;md5=e582764a4776e60c95bf9ab617343d36 \
+                    file://gnuefi/crt0-efi-aarch64.S;beginline=4;endline=16;md5=8b0a86085b86eda7a3c7e8a1eb7ec753 \
-                    file://inc/efishellintf.h;beginline=13;endline=20;md5=202766b79d708eff3cc70fce15fb80c7 \
+                    file://inc/efishellintf.h;beginline=13;endline=20;md5=ee14c1530c341a7050837adead6bc9a5 \
-                    file://inc/efishellparm.h;beginline=4;endline=11;md5=468b1231b05bbc84bae3a0d5774e3bb5 \
+                    file://lib/arm/math.c;beginline=2;endline=15;md5=ccb5c6b51053d1ee7277539ec38513d7 \
-                    file://lib/arm/math.c;beginline=2;endline=15;md5=8ed772501da77b2b3345aa6df8744c9e \
+                    file://lib/arm/initplat.c;beginline=2;endline=15;md5=ccb5c6b51053d1ee7277539ec38513d7 \
-                    file://lib/arm/initplat.c;beginline=2;endline=15;md5=8ed772501da77b2b3345aa6df8744c9e \
+                    file://lib/aarch64/math.c;beginline=2;endline=15;md5=ccb5c6b51053d1ee7277539ec38513d7 \
-                    file://lib/aarch64/math.c;beginline=2;endline=15;md5=8ed772501da77b2b3345aa6df8744c9e \
+                    file://lib/aarch64/initplat.c;beginline=2;endline=15;md5=ccb5c6b51053d1ee7277539ec38513d7 \
-                    file://lib/aarch64/initplat.c;beginline=2;endline=15;md5=8ed772501da77b2b3345aa6df8744c9e \
                   "
-SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/files/${BP}.tar.bz2 \
+COMPATIBLE_HOST = "(x86_64.*|i.86.*|aarch64.*|arm.*|riscv64.*)-linux"
-           file://parallel-make-archives.patch \
+COMPATIBLE_HOST:armv4 = 'null'
-           file://lib-Makefile-fix-parallel-issue.patch \
-           file://gnu-efi-3.0.9-fix-clang-build.patch \
+SRC_URI = "git://github.com/ncroxon/gnu-efi;protocol=https;branch=master \
+           file://0001-Do-not-treat-warnings-as-errors.patch \
           "
+SRCREV = "00cdfa66e923ab2f6683bb52cab0d0d1a9083b16"
-SRC_URI[md5sum] = "926763ff37bc9db3a9035cec41eb2f45"
+# llvm-objcopy fails
-SRC_URI[sha256sum] = "0196f2e1fd3c334b66e610a608a0e59233474c7a01bec7bc53989639aa327669"
+# arm-poky-linux-gnueabi-llvm-objcopy: error: 't8.so': section '.dynstr' cannot be removed because it is referenced by the section '.dynamic'
+OBJCOPY:toolchain-clang = "${HOST_PREFIX}objcopy"
-COMPATIBLE_HOST = "(x86_64.*|i.86.*|aarch64.*|arm.*)-linux"
+inherit github-releases
-COMPATIBLE_HOST_armv4 = 'null'
-do_configure_linux-gnux32_prepend() {
+do_configure:linux-gnux32:prepend() {
        cp ${STAGING_INCDIR}/gnu/stubs-x32.h ${STAGING_INCDIR}/gnu/stubs-64.h
        cp ${STAGING_INCDIR}/bits/long-double-32.h ${STAGING_INCDIR}/bits/long-double-64.h
 }
@@ -37,8 +38,15 @@ def gnu_efi_arch(d):
        return "ia32"
    return tarch
-EXTRA_OEMAKE = "'ARCH=${@gnu_efi_arch(d)}' 'CC=${CC}' 'AS=${AS}' 'LD=${LD}' 'AR=${AR}' \
+do_compile:prepend() {
-                'RANLIB=${RANLIB}' 'OBJCOPY=${OBJCOPY}' 'PREFIX=${prefix}' 'LIBDIR=${libdir}' \
+    unset LDFLAGS
+}
+EXTRA_OEMAKE = "'V=1' 'ARCH=${@gnu_efi_arch(d)}' \
+                'HOSTCC=${BUILD_CC}' 'CC=${CC}' \
+                'AS=${AS}' 'LD=${LD}' 'AR=${AR}' \
+                'RANLIB=${RANLIB}' 'OBJCOPY=${OBJCOPY}' \
+                'PREFIX=${prefix}' 'LIBDIR=${libdir}' 'INCLUDEDIR=${includedir}' \
                "
 # gnu-efi's Makefile treats prefix as toolchain prefix, so don't
@@ -49,18 +57,18 @@ do_install() {
        oe_runmake install INSTALLROOT="${D}"
 }
-FILES_${PN} += "${libdir}/*.lds"
+FILES:${PN} += "${libdir}/*.lds ${libdir}/gnuefi/apps"
 # 64-bit binaries are expected for EFI when targeting X32
-INSANE_SKIP_${PN}-dev_append_linux-gnux32 = " arch"
+INSANE_SKIP:${PN}-dev:append:linux-gnux32 = " arch"
-INSANE_SKIP_${PN}-dev_append_linux-muslx32 = " arch"
+INSANE_SKIP:${PN}-dev:append:linux-muslx32 = " arch"
 BBCLASSEXTEND = "native"
 # It doesn't support sse, its make.defaults sets:
 # CFLAGS += -mno-mmx -mno-sse
 # So also remove -mfpmath=sse from TUNE_CCARGS
-TUNE_CCARGS_remove = "-mfpmath=sse"
+TUNE_CCARGS:remove = "-mfpmath=sse"
 python () {
    ccargs = d.getVar('TUNE_CCARGS').split()
diff --git a/meta/recipes-bsp/grub/files/0001-Disable-mfpmath-sse-as-well-when-SSE-is-disabled.patch b/meta/recipes-bsp/grub/files/0001-Disable-mfpmath-sse-as-well-when-SSE-is-disabled.patch
deleted file mode 100644
index 6b73878cc0..0000000000
--- a/meta/recipes-bsp/grub/files/0001-Disable-mfpmath-sse-as-well-when-SSE-is-disabled.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 96d9aa55d29b24e2490d5647a9efc66940fc400f Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Wed, 13 Jan 2016 19:17:31 +0000
-Subject: [PATCH] Disable -mfpmath=sse as well when SSE is disabled
-Fixes
-configure:20574: i586-poky-linux-gcc  -m32    -march=core2 -msse3
-mtune=generic -mfpmath=sse
--sysroot=/usr/local/dev/yocto/grubtest2/build/tmp/sysroots/emenlow -o
-conftest -O2 -pipe -g -feliminate-unused-debug-types -Wall -W -Wshadow
-Wpointer-arith -Wmissing-prototypes -Wundef -Wstrict-prototypes -g
-falign-jumps=1 -falign-loops=1 -falign-functions=1 -mno-mmx -mno-sse
-mno-sse2 -mno-3dnow -fno-dwarf2-cfi-asm -m32 -fno-stack-protector
-mno-stack-arg-probe -Werror -nostdlib -Wl,--defsym,___main=0x8100
-Wall -W -I$(top_srcdir)/include -I$(top_builddir)/include
-DGRUB_MACHINE_PCBIOS=1 -DGRUB_MACHINE=I386_PC -Wl,-O1
-Wl,--hash-style=gnu -Wl,--as-needed conftest.c  >&5
-conftest.c:1:0: error: SSE instruction set disabled, using 387
-arithmetics [-Werror]
-cc1: all warnings being treated as errors
-Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
-Upstream-Status: Pending
---
- configure.ac | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/configure.ac b/configure.ac
-index 7656f24..0868ea9 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -824,7 +824,7 @@ fi
- if ( test "x$target_cpu" = xi386 || test "x$target_cpu" = xx86_64 ) && test "x$platform" != xemu; then
-   # Some toolchains enable these features by default, but they need
-   # registers that aren't set up properly in GRUB.
-  TARGET_CFLAGS="$TARGET_CFLAGS -mno-mmx -mno-sse -mno-sse2 -mno-sse3 -mno-3dnow"
-+  TARGET_CFLAGS="$TARGET_CFLAGS -mno-mmx -mno-sse -mno-sse2 -mno-sse3 -mno-3dnow -mfpmath=387"
- fi
- 
- # GRUB doesn't use float or doubles at all. Yet some toolchains may decide
diff --git a/meta/recipes-bsp/grub/files/0001-RISC-V-Restore-the-typcast-to-long.patch b/meta/recipes-bsp/grub/files/0001-RISC-V-Restore-the-typcast-to-long.patch
new file mode 100644
index 0000000000..cafa711731
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/0001-RISC-V-Restore-the-typcast-to-long.patch
@@ -0,0 +1,37 @@
+From b47029e8e582d17c6874d2622fe1a5b834377dbb Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Fri, 26 Mar 2021 11:59:43 -0700
+Subject: [PATCH] RISC-V: Restore the typcast to 64bit type
+this makes the type promotions clear and explicit
+It was already typecasted to long but was accidentally dropped in [1]
+which stated to cause failures on riscv32 as reported in [2]
+[1] https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2bf40e9e5be9808b17852e688eead87acff14420
+[2] https://savannah.gnu.org/bugs/index.php?60283
+Upstream-Status: Submitted
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+Cc: Andreas Schwab <schwab@suse.de>
+Cc: Daniel Kiper <daniel.kiper@oracle.com>
+Cc: Chester Lin <clin@suse.com>
+Cc: Nikita Ermakov <arei@altlinux.org>
+Cc: Alistair Francis <alistair.francis@wdc.com>
+---
+ util/grub-mkimagexx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c
+index e50b295..2f09255 100644
+--- a/util/grub-mkimagexx.c
+++ b/util/grub-mkimagexx.c
+@@ -1310,7 +1310,7 @@ SUFFIX (relocate_addrs) (Elf_Ehdr *e, struct section_metadata *smd,
+                  */
+ 
+                 sym_addr += addend;
+-                off = sym_addr - target_section_addr - offset - image_target->vaddr_offset;
+                off = (grub_int64_t)sym_addr - target_section_addr - offset - image_target->vaddr_offset;
+ 
+                 switch (ELF_R_TYPE (info))
+                   {
diff --git a/meta/recipes-bsp/grub/files/0001-grub.d-10_linux.in-add-oe-s-kernel-name.patch b/meta/recipes-bsp/grub/files/0001-grub.d-10_linux.in-add-oe-s-kernel-name.patch
index 69b04aa56f..69dec7695a 100644
--- a/meta/recipes-bsp/grub/files/0001-grub.d-10_linux.in-add-oe-s-kernel-name.patch
+++ b/meta/recipes-bsp/grub/files/0001-grub.d-10_linux.in-add-oe-s-kernel-name.patch
@@ -1,4 +1,4 @@
-From 8f47ed4aaefba087b6ca76e59c9f832b6a0702bc Mon Sep 17 00:00:00 2001
+From a80592e20f6c4b928a22862f52f268ab9d9908b2 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 13 Jan 2016 19:28:00 +0000
 Subject: [PATCH] grub.d/10_linux.in: add oe's kernel name
@@ -20,10 +20,10 @@ Upstream-Status: Inappropriate [OE specific]
 2 files changed, 4 insertions(+), 4 deletions(-)
 diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
-index 4532266..cba2617 100644
+index cc393be..8545cb6 100644
 --- a/util/grub.d/10_linux.in
 +++ b/util/grub.d/10_linux.in
-@@ -164,12 +164,12 @@ machine=`uname -m`
+@@ -166,12 +166,12 @@ machine=`uname -m`
 case "x$machine" in
     xi?86 | xx86_64)
        list=
@@ -40,10 +40,10 @@ index 4532266..cba2617 100644
        done ;;
 esac
 diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in
-index 96179ea..98d16ae 100644
+index 94dd8be..36cd554 100644
 --- a/util/grub.d/20_linux_xen.in
 +++ b/util/grub.d/20_linux_xen.in
-@@ -154,7 +154,7 @@ EOF
+@@ -181,7 +181,7 @@ EOF
 }
 
 linux_list=
diff --git a/meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch b/meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch
new file mode 100644
index 0000000000..0ff6dff33a
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch
@@ -0,0 +1,68 @@
+From ea703528a8581a2ea7e0bad424a70fdf0aec7d8f Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Sat, 15 Jun 2024 02:33:08 +0100
+Subject: [PATCH 1/2] misc: Implement grub_strlcpy()
+grub_strlcpy() acts the same way as strlcpy() does on most *NIX,
+returning the length of src and ensuring dest is always NUL
+terminated except when size is 0.
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ include/grub/misc.h | 39 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+diff --git a/include/grub/misc.h b/include/grub/misc.h
+index 1578f36c3..14d8f37ac 100644
+--- a/include/grub/misc.h
+++ b/include/grub/misc.h
+@@ -64,6 +64,45 @@ grub_stpcpy (char *dest, const char *src)
+   return d - 1;
+ }
+ 
+static inline grub_size_t
+grub_strlcpy (char *dest, const char *src, grub_size_t size)
+{
+  char *d = dest;
+  grub_size_t res = 0;
+  /*
+   * We do not subtract one from size here to avoid dealing with underflowing
+   * the value, which is why to_copy is always checked to be greater than one
+   * throughout this function.
+   */
+  grub_size_t to_copy = size;
+
+  /* Copy size - 1 bytes to dest. */
+  if (to_copy > 1)
+    while ((*d++ = *src++) != '\0' && ++res && --to_copy > 1)
+      ;
+
+  /*
+   * NUL terminate if size != 0. The previous step may have copied a NUL byte
+   * if it reached the end of the string, but we know dest[size - 1] must always
+   * be a NUL byte.
+   */
+  if (size != 0)
+    dest[size - 1] = '\0';
+
+  /* If there is still space in dest, but are here, we reached the end of src. */
+  if (to_copy > 1)
+    return res;
+
+  /*
+   * If we haven't reached the end of the string, iterate through to determine
+   * the strings total length.
+   */
+  while (*src++ != '\0' && ++res)
+   ;
+
+  return res;
+}
+
+ /* XXX: If grub_memmove is too slow, we must implement grub_memcpy.  */
+ static inline void *
+ grub_memcpy (void *dest, const void *src, grub_size_t n)
diff --git a/meta/recipes-bsp/grub/files/6643507ce30f775008e093580f0c9499dfb2c485.patch b/meta/recipes-bsp/grub/files/6643507ce30f775008e093580f0c9499dfb2c485.patch
deleted file mode 100644
index 8aa2091444..0000000000
--- a/meta/recipes-bsp/grub/files/6643507ce30f775008e093580f0c9499dfb2c485.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 6643507ce30f775008e093580f0c9499dfb2c485 Mon Sep 17 00:00:00 2001
-From: Simon Hardy <simon.hardy@itdev.co.uk>
-Date: Tue, 24 Mar 2020 13:29:12 +0000
-Subject: build: Fix GRUB i386-pc build with Ubuntu gcc
-With recent versions of gcc on Ubuntu a very large lzma_decompress.img file is
-output. (e.g. 134479600 bytes instead of 2864.) This causes grub-mkimage to
-fail with: "error: Decompressor is too big."
-This seems to be caused by a section .note.gnu.property that is placed at an
-offset such that objcopy needs to pad the img file with zeros.
-This issue is present on:
-Ubuntu 19.10 with gcc (Ubuntu 8.3.0-26ubuntu1~19.10) 8.3.0
-Ubuntu 19.10 with gcc (Ubuntu 9.2.1-9ubuntu2) 9.2.1 20191008
-This issue is not present on:
-Ubuntu 19.10 with gcc (Ubuntu 7.5.0-3ubuntu1~19.10) 7.5.0
-RHEL 8.0 with gcc 8.3.1 20190507 (Red Hat 8.3.1-4)
-The issue can be fixed by removing the section using objcopy as shown in
-this patch.
-Signed-off-by: Simon Hardy <simon.hardy@itdev.co.uk>
-Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
- gentpl.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-Upstream-Status: Backport
-diff --git a/gentpl.py b/gentpl.py
-index 387588c05..c86550d4f 100644
--- a/gentpl.py
-+++ b/gentpl.py
-@@ -766,7 +766,7 @@ def image(defn, platform):
- if test x$(TARGET_APPLE_LINKER) = x1; then \
-   $(MACHO2IMG) $< $@; \
- else \
-  $(TARGET_OBJCOPY) $(""" + cname(defn) + """_OBJCOPYFLAGS) --strip-unneeded -R .note -R .comment -R .note.gnu.build-id -R .MIPS.abiflags -R .reginfo -R .rel.dyn -R .note.gnu.gold-version -R .ARM.exidx $< $@; \
-+  $(TARGET_OBJCOPY) $(""" + cname(defn) + """_OBJCOPYFLAGS) --strip-unneeded -R .note -R .comment -R .note.gnu.build-id -R .MIPS.abiflags -R .reginfo -R .rel.dyn -R .note.gnu.gold-version -R .note.gnu.property -R .ARM.exidx $< $@; \
- fi
- """)
- 
-- 
-cgit v1.2.1
diff --git a/meta/recipes-bsp/grub/files/CVE-2020-10713.patch b/meta/recipes-bsp/grub/files/CVE-2020-10713.patch
deleted file mode 100644
index c507ed3ea8..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2020-10713.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From a4d3fbdff1e3ca8f87642af2ac8752c30c617a3e Mon Sep 17 00:00:00 2001
-From: Peter Jones <pjones@redhat.com>
-Date: Wed, 15 Apr 2020 15:45:02 -0400
-Subject: yylex: Make lexer fatal errors actually be fatal
-When presented with a command that can't be tokenized to anything
-smaller than YYLMAX characters, the parser calls YY_FATAL_ERROR(errmsg),
-expecting that will stop further processing, as such:
-  #define YY_DO_BEFORE_ACTION \
-        yyg->yytext_ptr = yy_bp; \
-        yyleng = (int) (yy_cp - yy_bp); \
-        yyg->yy_hold_char = *yy_cp; \
-        *yy_cp = '\0'; \
-        if ( yyleng >= YYLMAX ) \
-                YY_FATAL_ERROR( "token too large, exceeds YYLMAX" ); \
-        yy_flex_strncpy( yytext, yyg->yytext_ptr, yyleng + 1 , yyscanner); \
-        yyg->yy_c_buf_p = yy_cp;
-The code flex generates expects that YY_FATAL_ERROR() will either return
-for it or do some form of longjmp(), or handle the error in some way at
-least, and so the strncpy() call isn't in an "else" clause, and thus if
-YY_FATAL_ERROR() is *not* actually fatal, it does the call with the
-questionable limit, and predictable results ensue.
-Unfortunately, our implementation of YY_FATAL_ERROR() is:
-   #define YY_FATAL_ERROR(msg)                     \
-     do {                                          \
-       grub_printf (_("fatal error: %s\n"), _(msg));     \
-     } while (0)
-The same pattern exists in yyless(), and similar problems exist in users
-of YY_INPUT(), several places in the main parsing loop,
-yy_get_next_buffer(), yy_load_buffer_state(), yyensure_buffer_stack,
-yy_scan_buffer(), etc.
-All of these callers expect YY_FATAL_ERROR() to actually be fatal, and
-the things they do if it returns after calling it are wildly unsafe.
-Fixes: CVE-2020-10713
-Signed-off-by: Peter Jones <pjones@redhat.com>
-Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
-Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=a4d3fbdff1e3ca8f87642af2ac8752c30c617a3e]
-CVE: CVE-2020-10713
-Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
---
- grub-core/script/yylex.l | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/grub-core/script/yylex.l b/grub-core/script/yylex.l
-index 7b44c37b7..b7203c823 100644
--- a/grub-core/script/yylex.l
-+++ b/grub-core/script/yylex.l
-@@ -37,11 +37,11 @@
- 
- /* 
-  * As we don't have access to yyscanner, we cannot do much except to
- * print the fatal error.
-+ * print the fatal error and exit.
-  */
- #define YY_FATAL_ERROR(msg)                     \
-   do {                                          \
-    grub_printf (_("fatal error: %s\n"), _(msg));     \
-+    grub_fatal (_("fatal error: %s\n"), _(msg));\
-   } while (0)
- 
- #define COPY(str, hint)                         \
-- 
-cgit v1.2.1
diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14308-calloc-Use-calloc-at-most-places.patch b/meta/recipes-bsp/grub/files/CVE-2020-14308-calloc-Use-calloc-at-most-places.patch
deleted file mode 100644
index 637e368cb0..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2020-14308-calloc-Use-calloc-at-most-places.patch
+++ /dev/null
@@ -1,1863 +0,0 @@
-From bcdd6a55952222ec9829a59348240a4f983b0b56 Mon Sep 17 00:00:00 2001
-From: Peter Jones <pjones@redhat.com>
-Date: Mon, 15 Jun 2020 12:26:01 -0400
-Subject: [PATCH 4/9] calloc: Use calloc() at most places
-This modifies most of the places we do some form of:
-  X = malloc(Y * Z);
-to use calloc(Y, Z) instead.
-Among other issues, this fixes:
-  - allocation of integer overflow in grub_png_decode_image_header()
-    reported by Chris Coulson,
-  - allocation of integer overflow in luks_recover_key()
-    reported by Chris Coulson,
-  - allocation of integer overflow in grub_lvm_detect()
-    reported by Chris Coulson.
-Fixes: CVE-2020-14308
-Signed-off-by: Peter Jones <pjones@redhat.com>
-Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
-Upstream-Status: Backport
-CVE: CVE-2020-14308
-Reference to upstream patch:
-https://git.savannah.gnu.org/cgit/grub.git/commit/?id=f725fa7cb2ece547c5af01eeeecfe8d95802ed41
-[YL: don't patch on grub-core/lib/json/json.c, which is not existing in grub 2.04]
-Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
---
- grub-core/bus/usb/usbhub.c                |  8 ++++----
- grub-core/commands/efi/lsefisystab.c      |  3 ++-
- grub-core/commands/legacycfg.c            |  6 +++---
- grub-core/commands/menuentry.c            |  2 +-
- grub-core/commands/nativedisk.c           |  2 +-
- grub-core/commands/parttool.c             | 12 +++++++++---
- grub-core/commands/regexp.c               |  2 +-
- grub-core/commands/search_wrap.c          |  2 +-
- grub-core/disk/diskfilter.c               |  4 ++--
- grub-core/disk/ieee1275/ofdisk.c          |  2 +-
- grub-core/disk/ldm.c                      | 14 +++++++-------
- grub-core/disk/luks.c                     |  2 +-
- grub-core/disk/lvm.c                      | 12 ++++++------
- grub-core/disk/xen/xendisk.c              |  2 +-
- grub-core/efiemu/loadcore.c               |  2 +-
- grub-core/efiemu/mm.c                     |  6 +++---
- grub-core/font/font.c                     |  3 +--
- grub-core/fs/affs.c                       |  6 +++---
- grub-core/fs/btrfs.c                      |  6 +++---
- grub-core/fs/hfs.c                        |  2 +-
- grub-core/fs/hfsplus.c                    |  6 +++---
- grub-core/fs/iso9660.c                    |  2 +-
- grub-core/fs/ntfs.c                       |  4 ++--
- grub-core/fs/sfs.c                        |  2 +-
- grub-core/fs/tar.c                        |  2 +-
- grub-core/fs/udf.c                        |  4 ++--
- grub-core/fs/zfs/zfs.c                    |  4 ++--
- grub-core/gfxmenu/gui_string_util.c       |  2 +-
- grub-core/gfxmenu/widget-box.c            |  4 ++--
- grub-core/io/gzio.c                       |  2 +-
- grub-core/kern/efi/efi.c                  |  6 +++---
- grub-core/kern/emu/hostdisk.c             |  2 +-
- grub-core/kern/fs.c                       |  2 +-
- grub-core/kern/misc.c                     |  2 +-
- grub-core/kern/parser.c                   |  2 +-
- grub-core/kern/uboot/uboot.c              |  2 +-
- grub-core/lib/libgcrypt/cipher/ac.c       |  8 ++++----
- grub-core/lib/libgcrypt/cipher/primegen.c |  4 ++--
- grub-core/lib/libgcrypt/cipher/pubkey.c   |  4 ++--
- grub-core/lib/priority_queue.c            |  2 +-
- grub-core/lib/reed_solomon.c              |  7 +++----
- grub-core/lib/relocator.c                 | 10 +++++-----
- grub-core/lib/zstd/fse_decompress.c       |  2 +-
- grub-core/loader/arm/linux.c              |  2 +-
- grub-core/loader/efi/chainloader.c        |  2 +-
- grub-core/loader/i386/bsdXX.c             |  2 +-
- grub-core/loader/i386/xnu.c               |  4 ++--
- grub-core/loader/macho.c                  |  2 +-
- grub-core/loader/multiboot_elfxx.c        |  2 +-
- grub-core/loader/xnu.c                    |  2 +-
- grub-core/mmap/mmap.c                     |  4 ++--
- grub-core/net/bootp.c                     |  2 +-
- grub-core/net/dns.c                       | 10 +++++-----
- grub-core/net/net.c                       |  4 ++--
- grub-core/normal/charset.c                | 10 +++++-----
- grub-core/normal/cmdline.c                | 14 +++++++-------
- grub-core/normal/menu_entry.c             | 14 +++++++-------
- grub-core/normal/menu_text.c              |  4 ++--
- grub-core/normal/term.c                   |  4 ++--
- grub-core/osdep/linux/getroot.c           |  6 +++---
- grub-core/osdep/unix/config.c             |  2 +-
- grub-core/osdep/windows/getroot.c         |  2 +-
- grub-core/osdep/windows/hostdisk.c        |  4 ++--
- grub-core/osdep/windows/init.c            |  2 +-
- grub-core/osdep/windows/platform.c        |  4 ++--
- grub-core/osdep/windows/relpath.c         |  2 +-
- grub-core/partmap/gpt.c                   |  2 +-
- grub-core/partmap/msdos.c                 |  2 +-
- grub-core/script/execute.c                |  2 +-
- grub-core/tests/fake_input.c              |  2 +-
- grub-core/tests/video_checksum.c          |  6 +++---
- grub-core/video/capture.c                 |  2 +-
- grub-core/video/emu/sdl.c                 |  2 +-
- grub-core/video/i386/pc/vga.c             |  2 +-
- grub-core/video/readers/png.c             |  2 +-
- include/grub/unicode.h                    |  4 ++--
- util/getroot.c                            |  2 +-
- util/grub-file.c                          |  2 +-
- util/grub-fstest.c                        |  4 ++--
- util/grub-install-common.c                |  2 +-
- util/grub-install.c                       |  4 ++--
- util/grub-mkimagexx.c                     |  6 ++----
- util/grub-mkrescue.c                      |  4 ++--
- util/grub-mkstandalone.c                  |  2 +-
- util/grub-pe2elf.c                        | 12 +++++-------
- util/grub-probe.c                         |  4 ++--
- 86 files changed, 178 insertions(+), 177 deletions(-)
-diff --git a/grub-core/bus/usb/usbhub.c b/grub-core/bus/usb/usbhub.c
-index 34a7ff1..a06cce3 100644
--- a/grub-core/bus/usb/usbhub.c
-+++ b/grub-core/bus/usb/usbhub.c
-@@ -149,8 +149,8 @@ grub_usb_add_hub (grub_usb_device_t dev)
-   grub_usb_set_configuration (dev, 1);
- 
-   dev->nports = hubdesc.portcnt;
-  dev->children = grub_zalloc (hubdesc.portcnt * sizeof (dev->children[0]));
-  dev->ports = grub_zalloc (dev->nports * sizeof (dev->ports[0]));
-+  dev->children = grub_calloc (hubdesc.portcnt, sizeof (dev->children[0]));
-+  dev->ports = grub_calloc (dev->nports, sizeof (dev->ports[0]));
-   if (!dev->children || !dev->ports)
-     {
-       grub_free (dev->children);
-@@ -268,8 +268,8 @@ grub_usb_controller_dev_register_iter (grub_usb_controller_t controller, void *d
- 
-   /* Query the number of ports the root Hub has.  */
-   hub->nports = controller->dev->hubports (controller);
-  hub->devices = grub_zalloc (sizeof (hub->devices[0]) * hub->nports);
-  hub->ports = grub_zalloc (sizeof (hub->ports[0]) * hub->nports);
-+  hub->devices = grub_calloc (hub->nports, sizeof (hub->devices[0]));
-+  hub->ports = grub_calloc (hub->nports, sizeof (hub->ports[0]));
-   if (!hub->devices || !hub->ports)
-     {
-       grub_free (hub->devices);
-diff --git a/grub-core/commands/efi/lsefisystab.c b/grub-core/commands/efi/lsefisystab.c
-index df10302..cd81507 100644
--- a/grub-core/commands/efi/lsefisystab.c
-+++ b/grub-core/commands/efi/lsefisystab.c
-@@ -71,7 +71,8 @@ grub_cmd_lsefisystab (struct grub_command *cmd __attribute__ ((unused)),
-     grub_printf ("Vendor: ");
-     
-     for (vendor_utf16 = st->firmware_vendor; *vendor_utf16; vendor_utf16++);
-    vendor = grub_malloc (4 * (vendor_utf16 - st->firmware_vendor) + 1);
-+    /* Allocate extra 3 bytes to simplify math. */
-+    vendor = grub_calloc (4, vendor_utf16 - st->firmware_vendor + 1);
-     if (!vendor)
-       return grub_errno;
-     *grub_utf16_to_utf8 ((grub_uint8_t *) vendor, st->firmware_vendor,
-diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c
-index db7a8f0..5e3ec0d 100644
--- a/grub-core/commands/legacycfg.c
-+++ b/grub-core/commands/legacycfg.c
-@@ -314,7 +314,7 @@ grub_cmd_legacy_kernel (struct grub_command *mycmd __attribute__ ((unused)),
-   if (argc < 2)
-     return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected"));
- 
-  cutargs = grub_malloc (sizeof (cutargs[0]) * (argc - 1));
-+  cutargs = grub_calloc (argc - 1, sizeof (cutargs[0]));
-   if (!cutargs)
-     return grub_errno;
-   cutargc = argc - 1;
-@@ -436,7 +436,7 @@ grub_cmd_legacy_kernel (struct grub_command *mycmd __attribute__ ((unused)),
-            {
-              char rbuf[3] = "-r";
-              bsdargc = cutargc + 2;
-             bsdargs = grub_malloc (sizeof (bsdargs[0]) * bsdargc);
-+             bsdargs = grub_calloc (bsdargc, sizeof (bsdargs[0]));
-              if (!bsdargs)
-                {
-                  err = grub_errno;
-@@ -559,7 +559,7 @@ grub_cmd_legacy_initrdnounzip (struct grub_command *mycmd __attribute__ ((unused
-        return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("can't find command `%s'"),
-                           "module");
- 
-      newargs = grub_malloc ((argc + 1) * sizeof (newargs[0]));
-+      newargs = grub_calloc (argc + 1, sizeof (newargs[0]));
-       if (!newargs)
-        return grub_errno;
-       grub_memcpy (newargs + 1, args, argc * sizeof (newargs[0]));
-diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
-index 2c5363d..9164df7 100644
--- a/grub-core/commands/menuentry.c
-+++ b/grub-core/commands/menuentry.c
-@@ -154,7 +154,7 @@ grub_normal_add_menu_entry (int argc, const char **args,
-     goto fail;
- 
-   /* Save argc, args to pass as parameters to block arg later. */
-  menu_args = grub_malloc (sizeof (char*) * (argc + 1));
-+  menu_args = grub_calloc (argc + 1, sizeof (char *));
-   if (! menu_args)
-     goto fail;
- 
-diff --git a/grub-core/commands/nativedisk.c b/grub-core/commands/nativedisk.c
-index 699447d..7c8f97f 100644
--- a/grub-core/commands/nativedisk.c
-+++ b/grub-core/commands/nativedisk.c
-@@ -195,7 +195,7 @@ grub_cmd_nativedisk (grub_command_t cmd __attribute__ ((unused)),
-   else
-     path_prefix = prefix;
- 
-  mods = grub_malloc (argc * sizeof (mods[0]));
-+  mods = grub_calloc (argc, sizeof (mods[0]));
-   if (!mods)
-     return grub_errno;
- 
-diff --git a/grub-core/commands/parttool.c b/grub-core/commands/parttool.c
-index 22b46b1..051e313 100644
--- a/grub-core/commands/parttool.c
-+++ b/grub-core/commands/parttool.c
-@@ -59,7 +59,13 @@ grub_parttool_register(const char *part_name,
-   for (nargs = 0; args[nargs].name != 0; nargs++);
-   cur->nargs = nargs;
-   cur->args = (struct grub_parttool_argdesc *)
-    grub_malloc ((nargs + 1) * sizeof (struct grub_parttool_argdesc));
-+    grub_calloc (nargs + 1, sizeof (struct grub_parttool_argdesc));
-+  if (!cur->args)
-+    {
-+      grub_free (cur);
-+      curhandle--;
-+      return -1;
-+    }
-   grub_memcpy (cur->args, args,
-               (nargs + 1) * sizeof (struct grub_parttool_argdesc));
- 
-@@ -257,7 +263,7 @@ grub_cmd_parttool (grub_command_t cmd __attribute__ ((unused)),
-        return err;
-       }
- 
-  parsed = (int *) grub_zalloc (argc * sizeof (int));
-+  parsed = (int *) grub_calloc (argc, sizeof (int));
- 
-   for (i = 1; i < argc; i++)
-     if (! parsed[i])
-@@ -290,7 +296,7 @@ grub_cmd_parttool (grub_command_t cmd __attribute__ ((unused)),
-          }
-        ptool = cur;
-        pargs = (struct grub_parttool_args *)
-         grub_zalloc (ptool->nargs * sizeof (struct grub_parttool_args));
-+         grub_calloc (ptool->nargs, sizeof (struct grub_parttool_args));
-        for (j = i; j < argc; j++)
-          if (! parsed[j])
-            {
-diff --git a/grub-core/commands/regexp.c b/grub-core/commands/regexp.c
-index f00b184..4019164 100644
--- a/grub-core/commands/regexp.c
-+++ b/grub-core/commands/regexp.c
-@@ -116,7 +116,7 @@ grub_cmd_regexp (grub_extcmd_context_t ctxt, int argc, char **args)
-   if (ret)
-     goto fail;
- 
-  matches = grub_zalloc (sizeof (*matches) * (regex.re_nsub + 1));
-+  matches = grub_calloc (regex.re_nsub + 1, sizeof (*matches));
-   if (! matches)
-     goto fail;
- 
-diff --git a/grub-core/commands/search_wrap.c b/grub-core/commands/search_wrap.c
-index d7fd26b..47fc8eb 100644
--- a/grub-core/commands/search_wrap.c
-+++ b/grub-core/commands/search_wrap.c
-@@ -122,7 +122,7 @@ grub_cmd_search (grub_extcmd_context_t ctxt, int argc, char **args)
-     for (i = 0; state[SEARCH_HINT_BAREMETAL].args[i]; i++)
-       nhints++;
- 
-  hints = grub_malloc (sizeof (hints[0]) * nhints);
-+  hints = grub_calloc (nhints, sizeof (hints[0]));
-   if (!hints)
-     return grub_errno;
-   j = 0;
-diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c
-index c3b578a..68ca9e0 100644
--- a/grub-core/disk/diskfilter.c
-+++ b/grub-core/disk/diskfilter.c
-@@ -1134,7 +1134,7 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb,
-   array->lvs->segments->node_count = nmemb;
-   array->lvs->segments->raid_member_size = disk_size;
-   array->lvs->segments->nodes
-    = grub_zalloc (nmemb * sizeof (array->lvs->segments->nodes[0]));
-+    = grub_calloc (nmemb, sizeof (array->lvs->segments->nodes[0]));
-   array->lvs->segments->stripe_size = stripe_size;
-   for (i = 0; i < nmemb; i++)
-     {
-@@ -1226,7 +1226,7 @@ insert_array (grub_disk_t disk, const struct grub_diskfilter_pv_id *id,
-          grub_partition_t p;
-          for (p = disk->partition; p; p = p->parent)
-            s++;
-         pv->partmaps = xmalloc (s * sizeof (pv->partmaps[0]));
-+         pv->partmaps = xcalloc (s, sizeof (pv->partmaps[0]));
-          s = 0;
-          for (p = disk->partition; p; p = p->parent)
-            pv->partmaps[s++] = xstrdup (p->partmap->name);
-diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c
-index f73257e..03674cb 100644
--- a/grub-core/disk/ieee1275/ofdisk.c
-+++ b/grub-core/disk/ieee1275/ofdisk.c
-@@ -297,7 +297,7 @@ dev_iterate (const struct grub_ieee1275_devalias *alias)
-       /* Power machines documentation specify 672 as maximum SAS disks in
-          one system. Using a slightly larger value to be safe. */
-       table_size = 768;
-      table = grub_malloc (table_size * sizeof (grub_uint64_t));
-+      table = grub_calloc (table_size, sizeof (grub_uint64_t));
- 
-       if (!table)
-         {
-diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c
-index 2a22d2d..e632370 100644
--- a/grub-core/disk/ldm.c
-+++ b/grub-core/disk/ldm.c
-@@ -323,8 +323,8 @@ make_vg (grub_disk_t disk,
-          lv->segments->type = GRUB_DISKFILTER_MIRROR;
-          lv->segments->node_count = 0;
-          lv->segments->node_alloc = 8;
-         lv->segments->nodes = grub_zalloc (sizeof (*lv->segments->nodes)
-                                            * lv->segments->node_alloc);
-+         lv->segments->nodes = grub_calloc (lv->segments->node_alloc,
-+                                            sizeof (*lv->segments->nodes));
-          if (!lv->segments->nodes)
-            goto fail2;
-          ptr = vblk[i].dynamic;
-@@ -543,8 +543,8 @@ make_vg (grub_disk_t disk,
-            {
-              comp->segment_alloc = 8;
-              comp->segment_count = 0;
-             comp->segments = grub_malloc (sizeof (*comp->segments)
-                                           * comp->segment_alloc);
-+             comp->segments = grub_calloc (comp->segment_alloc,
-+                                           sizeof (*comp->segments));
-              if (!comp->segments)
-                goto fail2;
-            }
-@@ -590,8 +590,8 @@ make_vg (grub_disk_t disk,
-                }
-              comp->segments->node_count = read_int (ptr + 1, *ptr);
-              comp->segments->node_alloc = comp->segments->node_count;
-             comp->segments->nodes = grub_zalloc (sizeof (*comp->segments->nodes)
-                                                  * comp->segments->node_alloc);
-+             comp->segments->nodes = grub_calloc (comp->segments->node_alloc,
-+                                                  sizeof (*comp->segments->nodes));
-              if (!lv->segments->nodes)
-                goto fail2;
-            }
-@@ -1017,7 +1017,7 @@ grub_util_ldm_embed (struct grub_disk *disk, unsigned int *nsectors,
-       *nsectors = lv->size;
-       if (*nsectors > max_nsectors)
-        *nsectors = max_nsectors;
-      *sectors = grub_malloc (*nsectors * sizeof (**sectors));
-+      *sectors = grub_calloc (*nsectors, sizeof (**sectors));
-       if (!*sectors)
-        return grub_errno;
-       for (i = 0; i < *nsectors; i++)
-diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c
-index 86c50c6..18b3a8b 100644
--- a/grub-core/disk/luks.c
-+++ b/grub-core/disk/luks.c
-@@ -336,7 +336,7 @@ luks_recover_key (grub_disk_t source,
-        && grub_be_to_cpu32 (header.keyblock[i].stripes) > max_stripes)
-       max_stripes = grub_be_to_cpu32 (header.keyblock[i].stripes);
- 
-  split_key = grub_malloc (keysize * max_stripes);
-+  split_key = grub_calloc (keysize, max_stripes);
-   if (!split_key)
-     return grub_errno;
- 
-diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
-index dc6b83b..7b5fbbc 100644
--- a/grub-core/disk/lvm.c
-+++ b/grub-core/disk/lvm.c
-@@ -209,7 +209,7 @@ grub_lvm_detect (grub_disk_t disk,
-      first one.  */
- 
-   /* Allocate buffer space for the circular worst-case scenario. */
-  metadatabuf = grub_malloc (2 * mda_size);
-+  metadatabuf = grub_calloc (2, mda_size);
-   if (! metadatabuf)
-     goto fail;
- 
-@@ -464,7 +464,7 @@ grub_lvm_detect (grub_disk_t disk,
- #endif
-                  goto lvs_fail;
-                }
-             lv->segments = grub_zalloc (sizeof (*seg) * lv->segment_count);
-+             lv->segments = grub_calloc (lv->segment_count, sizeof (*seg));
-              seg = lv->segments;
- 
-              for (i = 0; i < lv->segment_count; i++)
-@@ -521,8 +521,8 @@ grub_lvm_detect (grub_disk_t disk,
-                      if (seg->node_count != 1)
-                        seg->stripe_size = grub_lvm_getvalue (&p, "stripe_size = ");
- 
-                     seg->nodes = grub_zalloc (sizeof (*stripe)
-                                               * seg->node_count);
-+                     seg->nodes = grub_calloc (seg->node_count,
-+                                               sizeof (*stripe));
-                      stripe = seg->nodes;
- 
-                      p = grub_strstr (p, "stripes = [");
-@@ -898,7 +898,7 @@ grub_lvm_detect (grub_disk_t disk,
-                break;
-            if (lv)
-              {
-               cache->lv->segments = grub_malloc (lv->segment_count * sizeof (*lv->segments));
-+               cache->lv->segments = grub_calloc (lv->segment_count, sizeof (*lv->segments));
-                if (!cache->lv->segments)
-                  {
-                    grub_lvm_free_cache_lvs (cache_lvs);
-@@ -911,7 +911,7 @@ grub_lvm_detect (grub_disk_t disk,
-                    struct grub_diskfilter_node *nodes = lv->segments[i].nodes;
-                    grub_size_t node_count = lv->segments[i].node_count;
- 
-                   cache->lv->segments[i].nodes = grub_malloc (node_count * sizeof (*nodes));
-+                   cache->lv->segments[i].nodes = grub_calloc (node_count, sizeof (*nodes));
-                    if (!cache->lv->segments[i].nodes)
-                      {
-                        for (j = 0; j < i; ++j)
-diff --git a/grub-core/disk/xen/xendisk.c b/grub-core/disk/xen/xendisk.c
-index 48476cb..d6612ee 100644
--- a/grub-core/disk/xen/xendisk.c
-+++ b/grub-core/disk/xen/xendisk.c
-@@ -426,7 +426,7 @@ grub_xendisk_init (void)
-   if (!ctr)
-     return;
- 
-  virtdisks = grub_malloc (ctr * sizeof (virtdisks[0]));
-+  virtdisks = grub_calloc (ctr, sizeof (virtdisks[0]));
-   if (!virtdisks)
-     return;
-   if (grub_xenstore_dir ("device/vbd", fill, &ctr))
-diff --git a/grub-core/efiemu/loadcore.c b/grub-core/efiemu/loadcore.c
-index 44085ef..2b92462 100644
--- a/grub-core/efiemu/loadcore.c
-+++ b/grub-core/efiemu/loadcore.c
-@@ -201,7 +201,7 @@ grub_efiemu_count_symbols (const Elf_Ehdr *e)
- 
-   grub_efiemu_nelfsyms = (unsigned) s->sh_size / (unsigned) s->sh_entsize;
-   grub_efiemu_elfsyms = (struct grub_efiemu_elf_sym *)
-    grub_malloc (sizeof (struct grub_efiemu_elf_sym) * grub_efiemu_nelfsyms);
-+    grub_calloc (grub_efiemu_nelfsyms, sizeof (struct grub_efiemu_elf_sym));
- 
-   /* Relocators */
-   for (i = 0, s = (Elf_Shdr *) ((char *) e + e->e_shoff);
-diff --git a/grub-core/efiemu/mm.c b/grub-core/efiemu/mm.c
-index 52a032f..9b8e0d0 100644
--- a/grub-core/efiemu/mm.c
-+++ b/grub-core/efiemu/mm.c
-@@ -554,11 +554,11 @@ grub_efiemu_mmap_sort_and_uniq (void)
-   /* Initialize variables*/
-   grub_memset (present, 0, sizeof (int) * GRUB_EFI_MAX_MEMORY_TYPE);
-   scanline_events = (struct grub_efiemu_mmap_scan *)
-    grub_malloc (sizeof (struct grub_efiemu_mmap_scan) * 2 * mmap_num);
-+    grub_calloc (mmap_num, sizeof (struct grub_efiemu_mmap_scan) * 2);
- 
-   /* Number of chunks can't increase more than by factor of 2 */
-   result = (grub_efi_memory_descriptor_t *)
-    grub_malloc (sizeof (grub_efi_memory_descriptor_t) * 2 * mmap_num);
-+    grub_calloc (mmap_num, sizeof (grub_efi_memory_descriptor_t) * 2);
-   if (!result || !scanline_events)
-     {
-       grub_free (result);
-@@ -660,7 +660,7 @@ grub_efiemu_mm_do_alloc (void)
- 
-   /* Preallocate mmap */
-   efiemu_mmap = (grub_efi_memory_descriptor_t *)
-    grub_malloc (mmap_reserved_size * sizeof (grub_efi_memory_descriptor_t));
-+    grub_calloc (mmap_reserved_size, sizeof (grub_efi_memory_descriptor_t));
-   if (!efiemu_mmap)
-     {
-       grub_efiemu_unload ();
-diff --git a/grub-core/font/font.c b/grub-core/font/font.c
-index 85a2925..8e118b3 100644
--- a/grub-core/font/font.c
-+++ b/grub-core/font/font.c
-@@ -293,8 +293,7 @@ load_font_index (grub_file_t file, grub_uint32_t sect_length, struct
-   font->num_chars = sect_length / FONT_CHAR_INDEX_ENTRY_SIZE;
- 
-   /* Allocate the character index array.  */
-  font->char_index = grub_malloc (font->num_chars
-                                 * sizeof (struct char_index_entry));
-+  font->char_index = grub_calloc (font->num_chars, sizeof (struct char_index_entry));
-   if (!font->char_index)
-     return 1;
-   font->bmp_idx = grub_malloc (0x10000 * sizeof (grub_uint16_t));
-diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c
-index 6b6a2bc..220b371 100644
--- a/grub-core/fs/affs.c
-+++ b/grub-core/fs/affs.c
-@@ -301,7 +301,7 @@ grub_affs_read_symlink (grub_fshelp_node_t node)
-       return 0;
-     }
-   latin1[symlink_size] = 0;
-  utf8 = grub_malloc (symlink_size * GRUB_MAX_UTF8_PER_LATIN1 + 1);
-+  utf8 = grub_calloc (GRUB_MAX_UTF8_PER_LATIN1 + 1, symlink_size);
-   if (!utf8)
-     {
-       grub_free (latin1);
-@@ -422,7 +422,7 @@ grub_affs_iterate_dir (grub_fshelp_node_t dir,
-        return 1;
-     }
- 
-  hashtable = grub_zalloc (data->htsize * sizeof (*hashtable));
-+  hashtable = grub_calloc (data->htsize, sizeof (*hashtable));
-   if (!hashtable)
-     return 1;
- 
-@@ -628,7 +628,7 @@ grub_affs_label (grub_device_t device, char **label)
-       len = file.namelen;
-       if (len > sizeof (file.name))
-        len = sizeof (file.name);
-      *label = grub_malloc (len * GRUB_MAX_UTF8_PER_LATIN1 + 1);
-+      *label = grub_calloc (GRUB_MAX_UTF8_PER_LATIN1 + 1, len);
-       if (*label)
-        *grub_latin1_to_utf8 ((grub_uint8_t *) *label, file.name, len) = '\0';
-     }
-diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
-index 48bd3d0..11272ef 100644
--- a/grub-core/fs/btrfs.c
-+++ b/grub-core/fs/btrfs.c
-@@ -413,7 +413,7 @@ lower_bound (struct grub_btrfs_data *data,
-     {
-       desc->allocated = 16;
-       desc->depth = 0;
-      desc->data = grub_malloc (sizeof (desc->data[0]) * desc->allocated);
-+      desc->data = grub_calloc (desc->allocated, sizeof (desc->data[0]));
-       if (!desc->data)
-        return grub_errno;
-     }
-@@ -752,7 +752,7 @@ raid56_read_retry (struct grub_btrfs_data *data,
-   grub_err_t ret = GRUB_ERR_OUT_OF_MEMORY;
-   grub_uint64_t i, failed_devices;
- 
-  buffers = grub_zalloc (sizeof(*buffers) * nstripes);
-+  buffers = grub_calloc (nstripes, sizeof (*buffers));
-   if (!buffers)
-     goto cleanup;
- 
-@@ -2160,7 +2160,7 @@ grub_btrfs_embed (grub_device_t device __attribute__ ((unused)),
-   *nsectors = 64 * 2 - 1;
-   if (*nsectors > max_nsectors)
-     *nsectors = max_nsectors;
-  *sectors = grub_malloc (*nsectors * sizeof (**sectors));
-+  *sectors = grub_calloc (*nsectors, sizeof (**sectors));
-   if (!*sectors)
-     return grub_errno;
-   for (i = 0; i < *nsectors; i++)
-diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c
-index ac0a409..3fe842b 100644
--- a/grub-core/fs/hfs.c
-+++ b/grub-core/fs/hfs.c
-@@ -1360,7 +1360,7 @@ grub_hfs_label (grub_device_t device, char **label)
-       grub_size_t len = data->sblock.volname[0];
-       if (len > sizeof (data->sblock.volname) - 1)
-        len = sizeof (data->sblock.volname) - 1;
-      *label = grub_malloc (len * MAX_UTF8_PER_MAC_ROMAN + 1);
-+      *label = grub_calloc (MAX_UTF8_PER_MAC_ROMAN + 1, len);
-       if (*label)
-        macroman_to_utf8 (*label, data->sblock.volname + 1,
-                          len + 1, 0);
-diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c
-index 54786bb..dae43be 100644
--- a/grub-core/fs/hfsplus.c
-+++ b/grub-core/fs/hfsplus.c
-@@ -720,7 +720,7 @@ list_nodes (void *record, void *hook_arg)
-   if (! filename)
-     return 0;
- 
-  keyname = grub_malloc (grub_be_to_cpu16 (catkey->namelen) * sizeof (*keyname));
-+  keyname = grub_calloc (grub_be_to_cpu16 (catkey->namelen), sizeof (*keyname));
-   if (!keyname)
-     {
-       grub_free (filename);
-@@ -1007,7 +1007,7 @@ grub_hfsplus_label (grub_device_t device, char **label)
-     grub_hfsplus_btree_recptr (&data->catalog_tree, node, ptr);
- 
-   label_len = grub_be_to_cpu16 (catkey->namelen);
-  label_name = grub_malloc (label_len * sizeof (*label_name));
-+  label_name = grub_calloc (label_len, sizeof (*label_name));
-   if (!label_name)
-     {
-       grub_free (node);
-@@ -1029,7 +1029,7 @@ grub_hfsplus_label (grub_device_t device, char **label)
-        }
-     }
- 
-  *label = grub_malloc (label_len * GRUB_MAX_UTF8_PER_UTF16 + 1);
-+  *label = grub_calloc (label_len, GRUB_MAX_UTF8_PER_UTF16 + 1);
-   if (! *label)
-     {
-       grub_free (label_name);
-diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c
-index 49c0c63..4f1b52a 100644
--- a/grub-core/fs/iso9660.c
-+++ b/grub-core/fs/iso9660.c
-@@ -331,7 +331,7 @@ grub_iso9660_convert_string (grub_uint8_t *us, int len)
-   int i;
-   grub_uint16_t t[MAX_NAMELEN / 2 + 1];
- 
-  p = grub_malloc (len * GRUB_MAX_UTF8_PER_UTF16 + 1);
-+  p = grub_calloc (len, GRUB_MAX_UTF8_PER_UTF16 + 1);
-   if (! p)
-     return NULL;
- 
-diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
-index fc4e1f6..2f34f76 100644
--- a/grub-core/fs/ntfs.c
-+++ b/grub-core/fs/ntfs.c
-@@ -556,8 +556,8 @@ get_utf8 (grub_uint8_t *in, grub_size_t len)
-   grub_uint16_t *tmp;
-   grub_size_t i;
- 
-  buf = grub_malloc (len * GRUB_MAX_UTF8_PER_UTF16 + 1);
-  tmp = grub_malloc (len * sizeof (tmp[0]));
-+  buf = grub_calloc (len, GRUB_MAX_UTF8_PER_UTF16 + 1);
-+  tmp = grub_calloc (len, sizeof (tmp[0]));
-   if (!buf || !tmp)
-     {
-       grub_free (buf);
-diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c
-index 50c1fe7..90f7fb3 100644
--- a/grub-core/fs/sfs.c
-+++ b/grub-core/fs/sfs.c
-@@ -266,7 +266,7 @@ grub_sfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)
-       node->next_extent = node->block;
-       node->cache_size = 0;
- 
-      node->cache = grub_malloc (sizeof (node->cache[0]) * cache_size);
-+      node->cache = grub_calloc (cache_size, sizeof (node->cache[0]));
-       if (!node->cache)
-        {
-          grub_errno = 0;
-diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c
-index 7d63e0c..c551ed6 100644
--- a/grub-core/fs/tar.c
-+++ b/grub-core/fs/tar.c
-@@ -120,7 +120,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
-          if (data->linkname_alloc < linksize + 1)
-            {
-              char *n;
-             n = grub_malloc (2 * (linksize + 1));
-+             n = grub_calloc (2, linksize + 1);
-              if (!n)
-                return grub_errno;
-              grub_free (data->linkname);
-diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
-index dc8b6e2..a837616 100644
--- a/grub-core/fs/udf.c
-+++ b/grub-core/fs/udf.c
-@@ -873,7 +873,7 @@ read_string (const grub_uint8_t *raw, grub_size_t sz, char *outbuf)
-     {
-       unsigned i;
-       utf16len = sz - 1;
-      utf16 = grub_malloc (utf16len * sizeof (utf16[0]));
-+      utf16 = grub_calloc (utf16len, sizeof (utf16[0]));
-       if (!utf16)
-        return NULL;
-       for (i = 0; i < utf16len; i++)
-@@ -883,7 +883,7 @@ read_string (const grub_uint8_t *raw, grub_size_t sz, char *outbuf)
-     {
-       unsigned i;
-       utf16len = (sz - 1) / 2;
-      utf16 = grub_malloc (utf16len * sizeof (utf16[0]));
-+      utf16 = grub_calloc (utf16len, sizeof (utf16[0]));
-       if (!utf16)
-        return NULL;
-       for (i = 0; i < utf16len; i++)
-diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c
-index 2f72e42..381dde5 100644
--- a/grub-core/fs/zfs/zfs.c
-+++ b/grub-core/fs/zfs/zfs.c
-@@ -3325,7 +3325,7 @@ dnode_get_fullpath (const char *fullpath, struct subvolume *subvol,
-        }
-       subvol->nkeys = 0;
-       zap_iterate (&keychain_dn, 8, count_zap_keys, &ctx, data);
-      subvol->keyring = grub_zalloc (subvol->nkeys * sizeof (subvol->keyring[0]));
-+      subvol->keyring = grub_calloc (subvol->nkeys, sizeof (subvol->keyring[0]));
-       if (!subvol->keyring)
-        {
-          grub_free (fsname);
-@@ -4336,7 +4336,7 @@ grub_zfs_embed (grub_device_t device __attribute__ ((unused)),
-   *nsectors = (VDEV_BOOT_SIZE >> GRUB_DISK_SECTOR_BITS);
-   if (*nsectors > max_nsectors)
-     *nsectors = max_nsectors;
-  *sectors = grub_malloc (*nsectors * sizeof (**sectors));
-+  *sectors = grub_calloc (*nsectors, sizeof (**sectors));
-   if (!*sectors)
-     return grub_errno;
-   for (i = 0; i < *nsectors; i++)
-diff --git a/grub-core/gfxmenu/gui_string_util.c b/grub-core/gfxmenu/gui_string_util.c
-index a9a415e..ba1e1ea 100644
--- a/grub-core/gfxmenu/gui_string_util.c
-+++ b/grub-core/gfxmenu/gui_string_util.c
-@@ -55,7 +55,7 @@ canonicalize_path (const char *path)
-     if (*p == '/')
-       components++;
- 
-  char **path_array = grub_malloc (components * sizeof (*path_array));
-+  char **path_array = grub_calloc (components, sizeof (*path_array));
-   if (! path_array)
-     return 0;
- 
-diff --git a/grub-core/gfxmenu/widget-box.c b/grub-core/gfxmenu/widget-box.c
-index b606028..470597d 100644
--- a/grub-core/gfxmenu/widget-box.c
-+++ b/grub-core/gfxmenu/widget-box.c
-@@ -303,10 +303,10 @@ grub_gfxmenu_create_box (const char *pixmaps_prefix,
-   box->content_height = 0;
-   box->raw_pixmaps =
-     (struct grub_video_bitmap **)
-    grub_malloc (BOX_NUM_PIXMAPS * sizeof (struct grub_video_bitmap *));
-+    grub_calloc (BOX_NUM_PIXMAPS, sizeof (struct grub_video_bitmap *));
-   box->scaled_pixmaps =
-     (struct grub_video_bitmap **)
-    grub_malloc (BOX_NUM_PIXMAPS * sizeof (struct grub_video_bitmap *));
-+    grub_calloc (BOX_NUM_PIXMAPS, sizeof (struct grub_video_bitmap *));
- 
-   /* Initialize all pixmap pointers to NULL so that proper destruction can
-      be performed if an error is encountered partway through construction.  */
-diff --git a/grub-core/io/gzio.c b/grub-core/io/gzio.c
-index 6208a97..43d98a7 100644
--- a/grub-core/io/gzio.c
-+++ b/grub-core/io/gzio.c
-@@ -554,7 +554,7 @@ huft_build (unsigned *b,    /* code lengths in bits (all assumed <= BMAX) */
-              z = 1 << j;       /* table entries for j-bit table */
- 
-              /* allocate and link in new table */
-             q = (struct huft *) grub_zalloc ((z + 1) * sizeof (struct huft));
-+             q = (struct huft *) grub_calloc (z + 1, sizeof (struct huft));
-              if (! q)
-                {
-                  if (h)
-diff --git a/grub-core/kern/efi/efi.c b/grub-core/kern/efi/efi.c
-index 6e1ceb9..dc31caa 100644
--- a/grub-core/kern/efi/efi.c
-+++ b/grub-core/kern/efi/efi.c
-@@ -202,7 +202,7 @@ grub_efi_set_variable(const char *var, const grub_efi_guid_t *guid,
- 
-   len = grub_strlen (var);
-   len16 = len * GRUB_MAX_UTF16_PER_UTF8;
-  var16 = grub_malloc ((len16 + 1) * sizeof (var16[0]));
-+  var16 = grub_calloc (len16 + 1, sizeof (var16[0]));
-   if (!var16)
-     return grub_errno;
-   len16 = grub_utf8_to_utf16 (var16, len16, (grub_uint8_t *) var, len, NULL);
-@@ -237,7 +237,7 @@ grub_efi_get_variable (const char *var, const grub_efi_guid_t *guid,
- 
-   len = grub_strlen (var);
-   len16 = len * GRUB_MAX_UTF16_PER_UTF8;
-  var16 = grub_malloc ((len16 + 1) * sizeof (var16[0]));
-+  var16 = grub_calloc (len16 + 1, sizeof (var16[0]));
-   if (!var16)
-     return NULL;
-   len16 = grub_utf8_to_utf16 (var16, len16, (grub_uint8_t *) var, len, NULL);
-@@ -383,7 +383,7 @@ grub_efi_get_filename (grub_efi_device_path_t *dp0)
-          while (len > 0 && fp->path_name[len - 1] == 0)
-            len--;
- 
-         dup_name = grub_malloc (len * sizeof (*dup_name));
-+         dup_name = grub_calloc (len, sizeof (*dup_name));
-          if (!dup_name)
-            {
-              grub_free (name);
-diff --git a/grub-core/kern/emu/hostdisk.c b/grub-core/kern/emu/hostdisk.c
-index e9ec680..d975265 100644
--- a/grub-core/kern/emu/hostdisk.c
-+++ b/grub-core/kern/emu/hostdisk.c
-@@ -615,7 +615,7 @@ static char *
- grub_util_path_concat_real (size_t n, int ext, va_list ap)
- {
-   size_t totlen = 0;
-  char **l = xmalloc ((n + ext) * sizeof (l[0]));
-+  char **l = xcalloc (n + ext, sizeof (l[0]));
-   char *r, *p, *pi;
-   size_t i;
-   int first = 1;
-diff --git a/grub-core/kern/fs.c b/grub-core/kern/fs.c
-index 2b85f49..f90be65 100644
--- a/grub-core/kern/fs.c
-+++ b/grub-core/kern/fs.c
-@@ -151,7 +151,7 @@ grub_fs_blocklist_open (grub_file_t file, const char *name)
-   while (p);
- 
-   /* Allocate a block list.  */
-  blocks = grub_zalloc (sizeof (struct grub_fs_block) * (num + 1));
-+  blocks = grub_calloc (num + 1, sizeof (struct grub_fs_block));
-   if (! blocks)
-     return 0;
- 
-diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c
-index 3b633d5..a7abd36 100644
--- a/grub-core/kern/misc.c
-+++ b/grub-core/kern/misc.c
-@@ -690,7 +690,7 @@ parse_printf_args (const char *fmt0, struct printf_args *args,
-     args->ptr = args->prealloc;
-   else
-     {
-      args->ptr = grub_malloc (args->count * sizeof (args->ptr[0]));
-+      args->ptr = grub_calloc (args->count, sizeof (args->ptr[0]));
-       if (!args->ptr)
-        {
-          grub_errno = GRUB_ERR_NONE;
-diff --git a/grub-core/kern/parser.c b/grub-core/kern/parser.c
-index 78175aa..619db31 100644
--- a/grub-core/kern/parser.c
-+++ b/grub-core/kern/parser.c
-@@ -213,7 +213,7 @@ grub_parser_split_cmdline (const char *cmdline,
-     return grub_errno;
-   grub_memcpy (args, buffer, bp - buffer);
- 
-  *argv = grub_malloc (sizeof (char *) * (*argc + 1));
-+  *argv = grub_calloc (*argc + 1, sizeof (char *));
-   if (!*argv)
-     {
-       grub_free (args);
-diff --git a/grub-core/kern/uboot/uboot.c b/grub-core/kern/uboot/uboot.c
-index be4816f..aac8f9a 100644
--- a/grub-core/kern/uboot/uboot.c
-+++ b/grub-core/kern/uboot/uboot.c
-@@ -133,7 +133,7 @@ grub_uboot_dev_enum (void)
-     return num_devices;
- 
-   max_devices = 2;
-  enum_devices = grub_malloc (sizeof(struct device_info) * max_devices);
-+  enum_devices = grub_calloc (max_devices, sizeof(struct device_info));
-   if (!enum_devices)
-     return 0;
- 
-diff --git a/grub-core/lib/libgcrypt/cipher/ac.c b/grub-core/lib/libgcrypt/cipher/ac.c
-index f5e946a..63f6fcd 100644
--- a/grub-core/lib/libgcrypt/cipher/ac.c
-+++ b/grub-core/lib/libgcrypt/cipher/ac.c
-@@ -185,7 +185,7 @@ ac_data_mpi_copy (gcry_ac_mpi_t *data_mpis, unsigned int data_mpis_n,
-   gcry_mpi_t mpi;
-   char *label;
- 
-  data_mpis_new = gcry_malloc (sizeof (*data_mpis_new) * data_mpis_n);
-+  data_mpis_new = gcry_calloc (data_mpis_n, sizeof (*data_mpis_new));
-   if (! data_mpis_new)
-     {
-       err = gcry_error_from_errno (errno);
-@@ -572,7 +572,7 @@ _gcry_ac_data_to_sexp (gcry_ac_data_t data, gcry_sexp_t *sexp,
-     }
- 
-   /* Add MPI list.  */
-  arg_list = gcry_malloc (sizeof (*arg_list) * (data_n + 1));
-+  arg_list = gcry_calloc (data_n + 1, sizeof (*arg_list));
-   if (! arg_list)
-     {
-       err = gcry_error_from_errno (errno);
-@@ -1283,7 +1283,7 @@ ac_data_construct (const char *identifier, int include_flags,
-   /* We build a list of arguments to pass to
-      gcry_sexp_build_array().  */
-   data_length = _gcry_ac_data_length (data);
-  arg_list = gcry_malloc (sizeof (*arg_list) * (data_length * 2));
-+  arg_list = gcry_calloc (data_length, sizeof (*arg_list) * 2);
-   if (! arg_list)
-     {
-       err = gcry_error_from_errno (errno);
-@@ -1593,7 +1593,7 @@ _gcry_ac_key_pair_generate (gcry_ac_handle_t handle, unsigned int nbits,
-        arg_list_n += 2;
- 
-   /* Allocate list.  */
-  arg_list = gcry_malloc (sizeof (*arg_list) * arg_list_n);
-+  arg_list = gcry_calloc (arg_list_n, sizeof (*arg_list));
-   if (! arg_list)
-     {
-       err = gcry_error_from_errno (errno);
-diff --git a/grub-core/lib/libgcrypt/cipher/primegen.c b/grub-core/lib/libgcrypt/cipher/primegen.c
-index 2788e34..b12e79b 100644
--- a/grub-core/lib/libgcrypt/cipher/primegen.c
-+++ b/grub-core/lib/libgcrypt/cipher/primegen.c
-@@ -383,7 +383,7 @@ prime_generate_internal (int need_q_factor,
-     }
- 
-   /* Allocate an array to track pool usage. */
-  pool_in_use = gcry_malloc (n * sizeof *pool_in_use);
-+  pool_in_use = gcry_calloc (n, sizeof *pool_in_use);
-   if (!pool_in_use)
-     {
-       err = gpg_err_code_from_errno (errno);
-@@ -765,7 +765,7 @@ gen_prime (unsigned int nbits, int secret, int randomlevel,
-   if (nbits < 16)
-     log_fatal ("can't generate a prime with less than %d bits\n", 16);
- 
-  mods = gcry_xmalloc( no_of_small_prime_numbers * sizeof *mods );
-+  mods = gcry_xcalloc( no_of_small_prime_numbers, sizeof *mods);
-   /* Make nbits fit into gcry_mpi_t implementation. */
-   val_2  = mpi_alloc_set_ui( 2 );
-   val_3 = mpi_alloc_set_ui( 3);
-diff --git a/grub-core/lib/libgcrypt/cipher/pubkey.c b/grub-core/lib/libgcrypt/cipher/pubkey.c
-index 9109821..ca087ad 100644
--- a/grub-core/lib/libgcrypt/cipher/pubkey.c
-+++ b/grub-core/lib/libgcrypt/cipher/pubkey.c
-@@ -2941,7 +2941,7 @@ gcry_pk_encrypt (gcry_sexp_t *r_ciph, gcry_sexp_t s_data, gcry_sexp_t s_pkey)
-        * array to a format string, so we have to do it this way :-(.  */
-       /* FIXME: There is now such a format specifier, so we can
-          change the code to be more clear. */
-      arg_list = malloc (nelem * sizeof *arg_list);
-+      arg_list = calloc (nelem, sizeof *arg_list);
-       if (!arg_list)
-         {
-           rc = gpg_err_code_from_syserror ();
-@@ -3233,7 +3233,7 @@ gcry_pk_sign (gcry_sexp_t *r_sig, gcry_sexp_t s_hash, gcry_sexp_t s_skey)
-         }
-       strcpy (p, "))");
- 
-      arg_list = malloc (nelem * sizeof *arg_list);
-+      arg_list = calloc (nelem, sizeof *arg_list);
-       if (!arg_list)
-         {
-           rc = gpg_err_code_from_syserror ();
-diff --git a/grub-core/lib/priority_queue.c b/grub-core/lib/priority_queue.c
-index 659be0b..7d5e7c0 100644
--- a/grub-core/lib/priority_queue.c
-+++ b/grub-core/lib/priority_queue.c
-@@ -92,7 +92,7 @@ grub_priority_queue_new (grub_size_t elsize,
- {
-   struct grub_priority_queue *ret;
-   void *els;
-  els = grub_malloc (elsize * 8);
-+  els = grub_calloc (8, elsize);
-   if (!els)
-     return 0;
-   ret = (struct grub_priority_queue *) grub_malloc (sizeof (*ret));
-diff --git a/grub-core/lib/reed_solomon.c b/grub-core/lib/reed_solomon.c
-index ee9fa7b..467305b 100644
--- a/grub-core/lib/reed_solomon.c
-+++ b/grub-core/lib/reed_solomon.c
-@@ -20,6 +20,7 @@
- #include <stdio.h>
- #include <string.h>
- #include <stdlib.h>
-+#define xcalloc calloc
- #define xmalloc malloc
- #define grub_memset memset
- #define grub_memcpy memcpy
-@@ -158,11 +159,9 @@ rs_encode (gf_single_t *data, grub_size_t s, grub_size_t rs)
-   gf_single_t *rs_polynomial;
-   int i, j;
-   gf_single_t *m;
-  m = xmalloc ((s + rs) * sizeof (gf_single_t));
-+  m = xcalloc (s + rs, sizeof (gf_single_t));
-   grub_memcpy (m, data, s * sizeof (gf_single_t));
-  grub_memset (m + s, 0, rs * sizeof (gf_single_t));
-  rs_polynomial = xmalloc ((rs + 1) * sizeof (gf_single_t));
-  grub_memset (rs_polynomial, 0, (rs + 1) * sizeof (gf_single_t));
-+  rs_polynomial = xcalloc (rs + 1, sizeof (gf_single_t));
-   rs_polynomial[rs] = 1;
-   /* Multiply with X - a^r */
-   for (j = 0; j < rs; j++)
-diff --git a/grub-core/lib/relocator.c b/grub-core/lib/relocator.c
-index ea3ebc7..5847aac 100644
--- a/grub-core/lib/relocator.c
-+++ b/grub-core/lib/relocator.c
-@@ -495,9 +495,9 @@ malloc_in_range (struct grub_relocator *rel,
-   }
- #endif
- 
-  eventt = grub_malloc (maxevents * sizeof (events[0]));
-+  eventt = grub_calloc (maxevents, sizeof (events[0]));
-   counter = grub_malloc ((DIGITSORT_MASK + 2) * sizeof (counter[0]));
-  events = grub_malloc (maxevents * sizeof (events[0]));
-+  events = grub_calloc (maxevents, sizeof (events[0]));
-   if (!events || !eventt || !counter)
-     {
-       grub_dprintf ("relocator", "events or counter allocation failed %d\n",
-@@ -963,7 +963,7 @@ malloc_in_range (struct grub_relocator *rel,
- #endif
-     unsigned cural = 0;
-     int oom = 0;
-    res->subchunks = grub_malloc (sizeof (res->subchunks[0]) * nallocs);
-+    res->subchunks = grub_calloc (nallocs, sizeof (res->subchunks[0]));
-     if (!res->subchunks)
-       oom = 1;
-     res->nsubchunks = nallocs;
-@@ -1562,8 +1562,8 @@ grub_relocator_prepare_relocs (struct grub_relocator *rel, grub_addr_t addr,
-            count[(chunk->src & 0xff) + 1]++;
-          }
-     }
-    from = grub_malloc (nchunks * sizeof (sorted[0]));
-    to = grub_malloc (nchunks * sizeof (sorted[0]));
-+    from = grub_calloc (nchunks, sizeof (sorted[0]));
-+    to = grub_calloc (nchunks, sizeof (sorted[0]));
-     if (!from || !to)
-       {
-        grub_free (from);
-diff --git a/grub-core/lib/zstd/fse_decompress.c b/grub-core/lib/zstd/fse_decompress.c
-index 72bbead..2227b84 100644
--- a/grub-core/lib/zstd/fse_decompress.c
-+++ b/grub-core/lib/zstd/fse_decompress.c
-@@ -82,7 +82,7 @@
- FSE_DTable* FSE_createDTable (unsigned tableLog)
- {
-     if (tableLog > FSE_TABLELOG_ABSOLUTE_MAX) tableLog = FSE_TABLELOG_ABSOLUTE_MAX;
-    return (FSE_DTable*)malloc( FSE_DTABLE_SIZE_U32(tableLog) * sizeof (U32) );
-+    return (FSE_DTable*)calloc( FSE_DTABLE_SIZE_U32(tableLog), sizeof (U32) );
- }
- 
- void FSE_freeDTable (FSE_DTable* dt)
-diff --git a/grub-core/loader/arm/linux.c b/grub-core/loader/arm/linux.c
-index 5168491..d70c174 100644
--- a/grub-core/loader/arm/linux.c
-+++ b/grub-core/loader/arm/linux.c
-@@ -78,7 +78,7 @@ linux_prepare_atag (void *target_atag)
- 
-   /* some place for cmdline, initrd and terminator.  */
-   tmp_size = get_atag_size (atag_orig) + 20 + (arg_size) / 4;
-  tmp_atag = grub_malloc (tmp_size * sizeof (grub_uint32_t));
-+  tmp_atag = grub_calloc (tmp_size, sizeof (grub_uint32_t));
-   if (!tmp_atag)
-     return grub_errno;
- 
-diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
-index cd92ea3..daf8c6b 100644
--- a/grub-core/loader/efi/chainloader.c
-+++ b/grub-core/loader/efi/chainloader.c
-@@ -116,7 +116,7 @@ copy_file_path (grub_efi_file_path_device_path_t *fp,
-   fp->header.type = GRUB_EFI_MEDIA_DEVICE_PATH_TYPE;
-   fp->header.subtype = GRUB_EFI_FILE_PATH_DEVICE_PATH_SUBTYPE;
- 
-  path_name = grub_malloc (len * GRUB_MAX_UTF16_PER_UTF8 * sizeof (*path_name));
-+  path_name = grub_calloc (len, GRUB_MAX_UTF16_PER_UTF8 * sizeof (*path_name));
-   if (!path_name)
-     return;
- 
-diff --git a/grub-core/loader/i386/bsdXX.c b/grub-core/loader/i386/bsdXX.c
-index af6741d..a8d8bf7 100644
--- a/grub-core/loader/i386/bsdXX.c
-+++ b/grub-core/loader/i386/bsdXX.c
-@@ -48,7 +48,7 @@ read_headers (grub_file_t file, const char *filename, Elf_Ehdr *e, char **shdr)
-   if (e->e_ident[EI_CLASS] != SUFFIX (ELFCLASS))
-     return grub_error (GRUB_ERR_BAD_OS, N_("invalid arch-dependent ELF magic"));
- 
-  *shdr = grub_malloc ((grub_uint32_t) e->e_shnum * e->e_shentsize);
-+  *shdr = grub_calloc (e->e_shnum, e->e_shentsize);
-   if (! *shdr)
-     return grub_errno;
- 
-diff --git a/grub-core/loader/i386/xnu.c b/grub-core/loader/i386/xnu.c
-index e64ed08..b7d176b 100644
--- a/grub-core/loader/i386/xnu.c
-+++ b/grub-core/loader/i386/xnu.c
-@@ -295,7 +295,7 @@ grub_xnu_devprop_add_property_utf8 (struct grub_xnu_devprop_device_descriptor *d
-     return grub_errno;
- 
-   len = grub_strlen (name);
-  utf16 = grub_malloc (sizeof (grub_uint16_t) * len);
-+  utf16 = grub_calloc (len, sizeof (grub_uint16_t));
-   if (!utf16)
-     {
-       grub_free (utf8);
-@@ -331,7 +331,7 @@ grub_xnu_devprop_add_property_utf16 (struct grub_xnu_devprop_device_descriptor *
-   grub_uint16_t *utf16;
-   grub_err_t err;
- 
-  utf16 = grub_malloc (sizeof (grub_uint16_t) * namelen);
-+  utf16 = grub_calloc (namelen, sizeof (grub_uint16_t));
-   if (!utf16)
-     return grub_errno;
-   grub_memcpy (utf16, name, sizeof (grub_uint16_t) * namelen);
-diff --git a/grub-core/loader/macho.c b/grub-core/loader/macho.c
-index 085f9c6..05710c4 100644
--- a/grub-core/loader/macho.c
-+++ b/grub-core/loader/macho.c
-@@ -97,7 +97,7 @@ grub_macho_file (grub_file_t file, const char *filename, int is_64bit)
-       if (grub_file_seek (macho->file, sizeof (struct grub_macho_fat_header))
-          == (grub_off_t) -1)
-        goto fail;
-      archs = grub_malloc (sizeof (struct grub_macho_fat_arch) * narchs);
-+      archs = grub_calloc (narchs, sizeof (struct grub_macho_fat_arch));
-       if (!archs)
-        goto fail;
-       if (grub_file_read (macho->file, archs,
-diff --git a/grub-core/loader/multiboot_elfxx.c b/grub-core/loader/multiboot_elfxx.c
-index 70cd1db..cc68536 100644
--- a/grub-core/loader/multiboot_elfxx.c
-+++ b/grub-core/loader/multiboot_elfxx.c
-@@ -217,7 +217,7 @@ CONCAT(grub_multiboot_load_elf, XX) (mbi_load_data_t *mld)
-     {
-       grub_uint8_t *shdr, *shdrptr;
- 
-      shdr = grub_malloc ((grub_uint32_t) ehdr->e_shnum * ehdr->e_shentsize);
-+      shdr = grub_calloc (ehdr->e_shnum, ehdr->e_shentsize);
-       if (!shdr)
-        return grub_errno;
-       
-diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c
-index 7f74d1d..77d7060 100644
--- a/grub-core/loader/xnu.c
-+++ b/grub-core/loader/xnu.c
-@@ -800,7 +800,7 @@ grub_cmd_xnu_mkext (grub_command_t cmd __attribute__ ((unused)),
-   if (grub_be_to_cpu32 (head.magic) == GRUB_MACHO_FAT_MAGIC)
-     {
-       narchs = grub_be_to_cpu32 (head.nfat_arch);
-      archs = grub_malloc (sizeof (struct grub_macho_fat_arch) * narchs);
-+      archs = grub_calloc (narchs, sizeof (struct grub_macho_fat_arch));
-       if (! archs)
-        {
-          grub_file_close (file);
-diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c
-index 6a31cba..57b4e9a 100644
--- a/grub-core/mmap/mmap.c
-+++ b/grub-core/mmap/mmap.c
-@@ -143,9 +143,9 @@ grub_mmap_iterate (grub_memory_hook_t hook, void *hook_data)
- 
-   /* Initialize variables. */
-   ctx.scanline_events = (struct grub_mmap_scan *)
-    grub_malloc (sizeof (struct grub_mmap_scan) * 2 * mmap_num);
-+    grub_calloc (mmap_num, sizeof (struct grub_mmap_scan) * 2);
- 
-  present = grub_zalloc (sizeof (present[0]) * current_priority);
-+  present = grub_calloc (current_priority, sizeof (present[0]));
- 
-   if (! ctx.scanline_events || !present)
-     {
-diff --git a/grub-core/net/bootp.c b/grub-core/net/bootp.c
-index 04cfbb0..6539572 100644
--- a/grub-core/net/bootp.c
-+++ b/grub-core/net/bootp.c
-@@ -766,7 +766,7 @@ grub_cmd_bootp (struct grub_command *cmd __attribute__ ((unused)),
-   if (ncards == 0)
-     return grub_error (GRUB_ERR_NET_NO_CARD, N_("no network card found"));
- 
-  ifaces = grub_zalloc (ncards * sizeof (ifaces[0]));
-+  ifaces = grub_calloc (ncards, sizeof (ifaces[0]));
-   if (!ifaces)
-     return grub_errno;
- 
-diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c
-index 5d9afe0..e332d5e 100644
--- a/grub-core/net/dns.c
-+++ b/grub-core/net/dns.c
-@@ -285,8 +285,8 @@ recv_hook (grub_net_udp_socket_t sock __attribute__ ((unused)),
-       ptr++;
-       ptr += 4;
-     }
-  *data->addresses = grub_malloc (sizeof ((*data->addresses)[0])
-                                * grub_be_to_cpu16 (head->ancount));
-+  *data->addresses = grub_calloc (grub_be_to_cpu16 (head->ancount),
-+                                 sizeof ((*data->addresses)[0]));
-   if (!*data->addresses)
-     {
-       grub_errno = GRUB_ERR_NONE;
-@@ -406,8 +406,8 @@ recv_hook (grub_net_udp_socket_t sock __attribute__ ((unused)),
-       dns_cache[h].addresses = 0;
-       dns_cache[h].name = grub_strdup (data->oname);
-       dns_cache[h].naddresses = *data->naddresses;
-      dns_cache[h].addresses = grub_malloc (*data->naddresses
-                                           * sizeof (dns_cache[h].addresses[0]));
-+      dns_cache[h].addresses = grub_calloc (*data->naddresses,
-+                                           sizeof (dns_cache[h].addresses[0]));
-       dns_cache[h].limit_time = grub_get_time_ms () + 1000 * ttl_all;
-       if (!dns_cache[h].addresses || !dns_cache[h].name)
-        {
-@@ -479,7 +479,7 @@ grub_net_dns_lookup (const char *name,
-        }
-     }
- 
-  sockets = grub_malloc (sizeof (sockets[0]) * n_servers);
-+  sockets = grub_calloc (n_servers, sizeof (sockets[0]));
-   if (!sockets)
-     return grub_errno;
- 
-diff --git a/grub-core/net/net.c b/grub-core/net/net.c
-index d5d726a..38f19df 100644
--- a/grub-core/net/net.c
-+++ b/grub-core/net/net.c
-@@ -333,8 +333,8 @@ grub_cmd_ipv6_autoconf (struct grub_command *cmd __attribute__ ((unused)),
-     ncards++;
-   }
- 
-  ifaces = grub_zalloc (ncards * sizeof (ifaces[0]));
-  slaacs = grub_zalloc (ncards * sizeof (slaacs[0]));
-+  ifaces = grub_calloc (ncards, sizeof (ifaces[0]));
-+  slaacs = grub_calloc (ncards, sizeof (slaacs[0]));
-   if (!ifaces || !slaacs)
-     {
-       grub_free (ifaces);
-diff --git a/grub-core/normal/charset.c b/grub-core/normal/charset.c
-index b0ab47d..d57fb72 100644
--- a/grub-core/normal/charset.c
-+++ b/grub-core/normal/charset.c
-@@ -203,7 +203,7 @@ grub_utf8_to_ucs4_alloc (const char *msg, grub_uint32_t **unicode_msg,
- {
-   grub_size_t msg_len = grub_strlen (msg);
- 
-  *unicode_msg = grub_malloc (msg_len * sizeof (grub_uint32_t));
-+  *unicode_msg = grub_calloc (msg_len, sizeof (grub_uint32_t));
-  
-   if (!*unicode_msg)
-     return -1;
-@@ -488,7 +488,7 @@ grub_unicode_aglomerate_comb (const grub_uint32_t *in, grub_size_t inlen,
-            }
-          else
-            {
-             n = grub_malloc (sizeof (n[0]) * (out->ncomb + 1));
-+             n = grub_calloc (out->ncomb + 1, sizeof (n[0]));
-              if (!n)
-                {
-                  grub_errno = GRUB_ERR_NONE;
-@@ -842,7 +842,7 @@ grub_bidi_line_logical_to_visual (const grub_uint32_t *logical,
-       }                                                        \
-   }
- 
-  visual = grub_malloc (sizeof (visual[0]) * logical_len);
-+  visual = grub_calloc (logical_len, sizeof (visual[0]));
-   if (!visual)
-     return -1;
- 
-@@ -1165,8 +1165,8 @@ grub_bidi_logical_to_visual (const grub_uint32_t *logical,
- {
-   const grub_uint32_t *line_start = logical, *ptr;
-   struct grub_unicode_glyph *visual_ptr;
-  *visual_out = visual_ptr = grub_malloc (3 * sizeof (visual_ptr[0])
-                                         * (logical_len + 2));
-+  *visual_out = visual_ptr = grub_calloc (logical_len + 2,
-+                                         3 * sizeof (visual_ptr[0]));
-   if (!visual_ptr)
-     return -1;
-   for (ptr = logical; ptr <= logical + logical_len; ptr++)
-diff --git a/grub-core/normal/cmdline.c b/grub-core/normal/cmdline.c
-index c037d50..c57242e 100644
--- a/grub-core/normal/cmdline.c
-+++ b/grub-core/normal/cmdline.c
-@@ -41,7 +41,7 @@ grub_err_t
- grub_set_history (int newsize)
- {
-   grub_uint32_t **old_hist_lines = hist_lines;
-  hist_lines = grub_malloc (sizeof (grub_uint32_t *) * newsize);
-+  hist_lines = grub_calloc (newsize, sizeof (grub_uint32_t *));
- 
-   /* Copy the old lines into the new buffer.  */
-   if (old_hist_lines)
-@@ -114,7 +114,7 @@ static void
- grub_history_set (int pos, grub_uint32_t *s, grub_size_t len)
- {
-   grub_free (hist_lines[pos]);
-  hist_lines[pos] = grub_malloc ((len + 1) * sizeof (grub_uint32_t));
-+  hist_lines[pos] = grub_calloc (len + 1, sizeof (grub_uint32_t));
-   if (!hist_lines[pos])
-     {
-       grub_print_error ();
-@@ -349,7 +349,7 @@ grub_cmdline_get (const char *prompt_translated)
-   char *ret;
-   unsigned nterms;
- 
-  buf = grub_malloc (max_len * sizeof (grub_uint32_t));
-+  buf = grub_calloc (max_len, sizeof (grub_uint32_t));
-   if (!buf)
-     return 0;
- 
-@@ -377,7 +377,7 @@ grub_cmdline_get (const char *prompt_translated)
-     FOR_ACTIVE_TERM_OUTPUTS(cur)
-       nterms++;
- 
-    cl_terms = grub_malloc (sizeof (cl_terms[0]) * nterms);
-+    cl_terms = grub_calloc (nterms, sizeof (cl_terms[0]));
-     if (!cl_terms)
-       {
-        grub_free (buf);
-@@ -385,7 +385,7 @@ grub_cmdline_get (const char *prompt_translated)
-       }
-     cl_term_cur = cl_terms;
- 
-    unicode_msg = grub_malloc (msg_len * sizeof (grub_uint32_t));
-+    unicode_msg = grub_calloc (msg_len, sizeof (grub_uint32_t));
-     if (!unicode_msg)
-       {
-        grub_free (buf);
-@@ -495,7 +495,7 @@ grub_cmdline_get (const char *prompt_translated)
-                grub_uint32_t *insert;
- 
-                insertlen = grub_strlen (insertu8);
-               insert = grub_malloc ((insertlen + 1) * sizeof (grub_uint32_t));
-+               insert = grub_calloc (insertlen + 1, sizeof (grub_uint32_t));
-                if (!insert)
-                  {
-                    grub_free (insertu8);
-@@ -602,7 +602,7 @@ grub_cmdline_get (const char *prompt_translated)
- 
-              grub_free (kill_buf);
- 
-             kill_buf = grub_malloc ((n + 1) * sizeof(grub_uint32_t));
-+             kill_buf = grub_calloc (n + 1, sizeof (grub_uint32_t));
-              if (grub_errno)
-                {
-                  grub_print_error ();
-diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c
-index cdf3590..1993995 100644
--- a/grub-core/normal/menu_entry.c
-+++ b/grub-core/normal/menu_entry.c
-@@ -95,8 +95,8 @@ init_line (struct screen *screen, struct line *linep)
- {
-   linep->len = 0;
-   linep->max_len = 80;
-  linep->buf = grub_malloc ((linep->max_len + 1) * sizeof (linep->buf[0]));
-  linep->pos = grub_zalloc (screen->nterms * sizeof (linep->pos[0]));
-+  linep->buf = grub_calloc (linep->max_len + 1, sizeof (linep->buf[0]));
-+  linep->pos = grub_calloc (screen->nterms, sizeof (linep->pos[0]));
-   if (! linep->buf || !linep->pos)
-     {
-       grub_free (linep->buf);
-@@ -287,7 +287,7 @@ update_screen (struct screen *screen, struct per_term_screen *term_screen,
-          pos = linep->pos + (term_screen - screen->terms);
- 
-          if (!*pos)
-           *pos = grub_zalloc ((linep->len + 1) * sizeof (**pos));
-+           *pos = grub_calloc (linep->len + 1, sizeof (**pos));
- 
-          if (i == region_start || linep == screen->lines + screen->line
-              || (i > region_start && mode == ALL_LINES))
-@@ -471,7 +471,7 @@ insert_string (struct screen *screen, const char *s, int update)
- 
-          /* Insert the string.  */
-          current_linep = screen->lines + screen->line;
-         unicode_msg = grub_malloc ((p - s) * sizeof (grub_uint32_t));
-+         unicode_msg = grub_calloc (p - s, sizeof (grub_uint32_t));
- 
-          if (!unicode_msg)
-            return 0;
-@@ -1023,7 +1023,7 @@ complete (struct screen *screen, int continuous, int update)
-   if (completion_buffer.buf)
-     {
-       buflen = grub_strlen (completion_buffer.buf);
-      ucs4 = grub_malloc (sizeof (grub_uint32_t) * (buflen + 1));
-+      ucs4 = grub_calloc (buflen + 1, sizeof (grub_uint32_t));
-       
-       if (!ucs4)
-        {
-@@ -1268,7 +1268,7 @@ grub_menu_entry_run (grub_menu_entry_t entry)
-   for (i = 0; i < (unsigned) screen->num_lines; i++)
-     {
-       grub_free (screen->lines[i].pos);
-      screen->lines[i].pos = grub_zalloc (screen->nterms * sizeof (screen->lines[i].pos[0]));
-+      screen->lines[i].pos = grub_calloc (screen->nterms, sizeof (screen->lines[i].pos[0]));
-       if (! screen->lines[i].pos)
-        {
-          grub_print_error ();
-@@ -1278,7 +1278,7 @@ grub_menu_entry_run (grub_menu_entry_t entry)
-        }
-     }
- 
-  screen->terms = grub_zalloc (screen->nterms * sizeof (screen->terms[0]));
-+  screen->terms = grub_calloc (screen->nterms, sizeof (screen->terms[0]));
-   if (!screen->terms)
-     {
-       grub_print_error ();
-diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c
-index e22bb91..18240e7 100644
--- a/grub-core/normal/menu_text.c
-+++ b/grub-core/normal/menu_text.c
-@@ -78,7 +78,7 @@ grub_print_message_indented_real (const char *msg, int margin_left,
-   grub_size_t msg_len = grub_strlen (msg) + 2;
-   int ret = 0;
- 
-  unicode_msg = grub_malloc (msg_len * sizeof (grub_uint32_t));
-+  unicode_msg = grub_calloc (msg_len, sizeof (grub_uint32_t));
-  
-   if (!unicode_msg)
-     return 0;
-@@ -211,7 +211,7 @@ print_entry (int y, int highlight, grub_menu_entry_t entry,
- 
-   title = entry ? entry->title : "";
-   title_len = grub_strlen (title);
-  unicode_title = grub_malloc (title_len * sizeof (*unicode_title));
-+  unicode_title = grub_calloc (title_len, sizeof (*unicode_title));
-   if (! unicode_title)
-     /* XXX How to show this error?  */
-     return;
-diff --git a/grub-core/normal/term.c b/grub-core/normal/term.c
-index a1e5c5a..cc8c173 100644
--- a/grub-core/normal/term.c
-+++ b/grub-core/normal/term.c
-@@ -264,7 +264,7 @@ grub_term_save_pos (void)
-   FOR_ACTIVE_TERM_OUTPUTS(cur)
-     cnt++;
- 
-  ret = grub_malloc (cnt * sizeof (ret[0]));
-+  ret = grub_calloc (cnt, sizeof (ret[0]));
-   if (!ret)
-     return NULL;
- 
-@@ -1013,7 +1013,7 @@ grub_xnputs (const char *str, grub_size_t msg_len)
- 
-   grub_error_push ();
- 
-  unicode_str = grub_malloc (msg_len * sizeof (grub_uint32_t));
-+  unicode_str = grub_calloc (msg_len, sizeof (grub_uint32_t));
-  
-   grub_error_pop ();
- 
-diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c
-index 90d92d3..5b41ad0 100644
--- a/grub-core/osdep/linux/getroot.c
-+++ b/grub-core/osdep/linux/getroot.c
-@@ -168,7 +168,7 @@ grub_util_raid_getmembers (const char *name, int bootable)
-   if (ret != 0)
-     grub_util_error (_("ioctl GET_ARRAY_INFO error: %s"), strerror (errno));
- 
-  devicelist = xmalloc ((info.nr_disks + 1) * sizeof (char *));
-+  devicelist = xcalloc (info.nr_disks + 1, sizeof (char *));
- 
-   for (i = 0, j = 0; j < info.nr_disks; i++)
-     {
-@@ -241,7 +241,7 @@ grub_find_root_devices_from_btrfs (const char *dir)
-       return NULL;
-     }
- 
-  ret = xmalloc ((fsi.num_devices + 1) * sizeof (ret[0]));
-+  ret = xcalloc (fsi.num_devices + 1, sizeof (ret[0]));
- 
-   for (i = 1; i <= fsi.max_id && j < fsi.num_devices; i++)
-     {
-@@ -396,7 +396,7 @@ grub_find_root_devices_from_mountinfo (const char *dir, char **relroot)
-   if (relroot)
-     *relroot = NULL;
- 
-  entries = xmalloc (entry_max * sizeof (*entries));
-+  entries = xcalloc (entry_max, sizeof (*entries));
- 
- again:
-   fp = grub_util_fopen ("/proc/self/mountinfo", "r");
-diff --git a/grub-core/osdep/unix/config.c b/grub-core/osdep/unix/config.c
-index 65effa9..7d63251 100644
--- a/grub-core/osdep/unix/config.c
-+++ b/grub-core/osdep/unix/config.c
-@@ -89,7 +89,7 @@ grub_util_load_config (struct grub_util_config *cfg)
-   argv[0] = "sh";
-   argv[1] = "-c";
- 
-  script = xmalloc (4 * strlen (cfgfile) + 300);
-+  script = xcalloc (4, strlen (cfgfile) + 300);
- 
-   ptr = script;
-   memcpy (ptr, ". '", 3);
-diff --git a/grub-core/osdep/windows/getroot.c b/grub-core/osdep/windows/getroot.c
-index 661d954..eada663 100644
--- a/grub-core/osdep/windows/getroot.c
-+++ b/grub-core/osdep/windows/getroot.c
-@@ -59,7 +59,7 @@ grub_get_mount_point (const TCHAR *path)
- 
-   for (ptr = path; *ptr; ptr++);
-   allocsize = (ptr - path + 10) * 2;
-  out = xmalloc (allocsize * sizeof (out[0]));
-+  out = xcalloc (allocsize, sizeof (out[0]));
- 
-   /* When pointing to EFI system partition GetVolumePathName fails
-      for ESP root and returns abberant information for everything
-diff --git a/grub-core/osdep/windows/hostdisk.c b/grub-core/osdep/windows/hostdisk.c
-index 3551007..0be3273 100644
--- a/grub-core/osdep/windows/hostdisk.c
-+++ b/grub-core/osdep/windows/hostdisk.c
-@@ -111,7 +111,7 @@ grub_util_get_windows_path_real (const char *path)
- 
-   while (1)
-     {
-      fpa = xmalloc (alloc * sizeof (fpa[0]));
-+      fpa = xcalloc (alloc, sizeof (fpa[0]));
- 
-       len = GetFullPathName (tpath, alloc, fpa, NULL);
-       if (len >= alloc)
-@@ -399,7 +399,7 @@ grub_util_fd_opendir (const char *name)
-   for (l = 0; name_windows[l]; l++);
-   for (l--; l >= 0 && (name_windows[l] == '\\' || name_windows[l] == '/'); l--);
-   l++;
-  pattern = xmalloc ((l + 3) * sizeof (pattern[0]));
-+  pattern = xcalloc (l + 3, sizeof (pattern[0]));
-   memcpy (pattern, name_windows, l * sizeof (pattern[0]));
-   pattern[l] = '\\';
-   pattern[l + 1] = '*';
-diff --git a/grub-core/osdep/windows/init.c b/grub-core/osdep/windows/init.c
-index e8ffd62..6297de6 100644
--- a/grub-core/osdep/windows/init.c
-+++ b/grub-core/osdep/windows/init.c
-@@ -161,7 +161,7 @@ grub_util_host_init (int *argc __attribute__ ((unused)),
-   LPWSTR *targv;
- 
-   targv = CommandLineToArgvW (tcmdline, argc);
-  *argv = xmalloc ((*argc + 1) * sizeof (argv[0]));
-+  *argv = xcalloc (*argc + 1, sizeof (argv[0]));
- 
-   for (i = 0; i < *argc; i++)
-     (*argv)[i] = grub_util_tchar_to_utf8 (targv[i]); 
-diff --git a/grub-core/osdep/windows/platform.c b/grub-core/osdep/windows/platform.c
-index 7eb53fe..1ef86bf 100644
--- a/grub-core/osdep/windows/platform.c
-+++ b/grub-core/osdep/windows/platform.c
-@@ -225,8 +225,8 @@ grub_install_register_efi (grub_device_t efidir_grub_dev,
-     grub_util_error ("%s", _("no EFI routines are available when running in BIOS mode"));
- 
-   distrib8_len = grub_strlen (efi_distributor);
-  distributor16 = xmalloc ((distrib8_len + 1) * GRUB_MAX_UTF16_PER_UTF8
-                          * sizeof (grub_uint16_t));
-+  distributor16 = xcalloc (distrib8_len + 1,
-+                          GRUB_MAX_UTF16_PER_UTF8 * sizeof (grub_uint16_t));
-   distrib16_len = grub_utf8_to_utf16 (distributor16, distrib8_len * GRUB_MAX_UTF16_PER_UTF8,
-                                      (const grub_uint8_t *) efi_distributor,
-                                      distrib8_len, 0);
-diff --git a/grub-core/osdep/windows/relpath.c b/grub-core/osdep/windows/relpath.c
-index cb08617..478e8ef 100644
--- a/grub-core/osdep/windows/relpath.c
-+++ b/grub-core/osdep/windows/relpath.c
-@@ -72,7 +72,7 @@ grub_make_system_path_relative_to_its_root (const char *path)
-       if (dirwindows[0] && dirwindows[1] == ':')
-        offset = 2;
-     }
-  ret = xmalloc (sizeof (ret[0]) * (flen - offset + 2));
-+  ret = xcalloc (flen - offset + 2, sizeof (ret[0]));
-   if (dirwindows[offset] != '\\'
-       && dirwindows[offset] != '/'
-       && dirwindows[offset])
-diff --git a/grub-core/partmap/gpt.c b/grub-core/partmap/gpt.c
-index 103f679..72a2e37 100644
--- a/grub-core/partmap/gpt.c
-+++ b/grub-core/partmap/gpt.c
-@@ -199,7 +199,7 @@ gpt_partition_map_embed (struct grub_disk *disk, unsigned int *nsectors,
-   *nsectors = ctx.len;
-   if (*nsectors > max_nsectors)
-     *nsectors = max_nsectors;
-  *sectors = grub_malloc (*nsectors * sizeof (**sectors));
-+  *sectors = grub_calloc (*nsectors, sizeof (**sectors));
-   if (!*sectors)
-     return grub_errno;
-   for (i = 0; i < *nsectors; i++)
-diff --git a/grub-core/partmap/msdos.c b/grub-core/partmap/msdos.c
-index 7b8e450..ee3f249 100644
--- a/grub-core/partmap/msdos.c
-+++ b/grub-core/partmap/msdos.c
-@@ -337,7 +337,7 @@ pc_partition_map_embed (struct grub_disk *disk, unsigned int *nsectors,
-       avail_nsectors = *nsectors;
-       if (*nsectors > max_nsectors)
-        *nsectors = max_nsectors;
-      *sectors = grub_malloc (*nsectors * sizeof (**sectors));
-+      *sectors = grub_calloc (*nsectors, sizeof (**sectors));
-       if (!*sectors)
-        return grub_errno;
-       for (i = 0; i < *nsectors; i++)
-diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
-index ee299fd..c8d6806 100644
--- a/grub-core/script/execute.c
-+++ b/grub-core/script/execute.c
-@@ -553,7 +553,7 @@ gettext_append (struct grub_script_argv *result, const char *orig_str)
-   for (iptr = orig_str; *iptr; iptr++)
-     if (*iptr == '$')
-       dollar_cnt++;
-  ctx.allowed_strings = grub_malloc (sizeof (ctx.allowed_strings[0]) * dollar_cnt);
-+  ctx.allowed_strings = grub_calloc (dollar_cnt, sizeof (ctx.allowed_strings[0]));
- 
-   if (parse_string (orig_str, gettext_save_allow, &ctx, 0))
-     goto fail;
-diff --git a/grub-core/tests/fake_input.c b/grub-core/tests/fake_input.c
-index 2d60852..b5eb516 100644
--- a/grub-core/tests/fake_input.c
-+++ b/grub-core/tests/fake_input.c
-@@ -49,7 +49,7 @@ grub_terminal_input_fake_sequence (int *seq_in, int nseq_in)
-     saved = grub_term_inputs;
-   if (seq)
-     grub_free (seq);
-  seq = grub_malloc (nseq_in * sizeof (seq[0]));
-+  seq = grub_calloc (nseq_in, sizeof (seq[0]));
-   if (!seq)
-     return;
- 
-diff --git a/grub-core/tests/video_checksum.c b/grub-core/tests/video_checksum.c
-index 74d5b65..44d0810 100644
--- a/grub-core/tests/video_checksum.c
-+++ b/grub-core/tests/video_checksum.c
-@@ -336,7 +336,7 @@ grub_video_capture_write_bmp (const char *fname,
-     {
-     case 4:
-       {
-       grub_uint8_t *buffer = xmalloc (mode_info->width * 3);
-+       grub_uint8_t *buffer = xcalloc (3, mode_info->width);
-        grub_uint32_t rmask = ((1 << mode_info->red_mask_size) - 1);
-        grub_uint32_t gmask = ((1 << mode_info->green_mask_size) - 1);
-        grub_uint32_t bmask = ((1 << mode_info->blue_mask_size) - 1);
-@@ -367,7 +367,7 @@ grub_video_capture_write_bmp (const char *fname,
-       }
-     case 3:
-       {
-       grub_uint8_t *buffer = xmalloc (mode_info->width * 3);
-+       grub_uint8_t *buffer = xcalloc (3, mode_info->width);
-        grub_uint32_t rmask = ((1 << mode_info->red_mask_size) - 1);
-        grub_uint32_t gmask = ((1 << mode_info->green_mask_size) - 1);
-        grub_uint32_t bmask = ((1 << mode_info->blue_mask_size) - 1);
-@@ -407,7 +407,7 @@ grub_video_capture_write_bmp (const char *fname,
-       }
-     case 2:
-       {
-       grub_uint8_t *buffer = xmalloc (mode_info->width * 3);
-+       grub_uint8_t *buffer = xcalloc (3, mode_info->width);
-        grub_uint16_t rmask = ((1 << mode_info->red_mask_size) - 1);
-        grub_uint16_t gmask = ((1 << mode_info->green_mask_size) - 1);
-        grub_uint16_t bmask = ((1 << mode_info->blue_mask_size) - 1);
-diff --git a/grub-core/video/capture.c b/grub-core/video/capture.c
-index 4f83c74..4d3195e 100644
--- a/grub-core/video/capture.c
-+++ b/grub-core/video/capture.c
-@@ -89,7 +89,7 @@ grub_video_capture_start (const struct grub_video_mode_info *mode_info,
-   framebuffer.mode_info = *mode_info;
-   framebuffer.mode_info.blit_format = grub_video_get_blit_format (&framebuffer.mode_info);
- 
-  framebuffer.ptr = grub_malloc (framebuffer.mode_info.height * framebuffer.mode_info.pitch);
-+  framebuffer.ptr = grub_calloc (framebuffer.mode_info.height, framebuffer.mode_info.pitch);
-   if (!framebuffer.ptr)
-     return grub_errno;
-   
-diff --git a/grub-core/video/emu/sdl.c b/grub-core/video/emu/sdl.c
-index a2f639f..0ebab6f 100644
--- a/grub-core/video/emu/sdl.c
-+++ b/grub-core/video/emu/sdl.c
-@@ -172,7 +172,7 @@ grub_video_sdl_set_palette (unsigned int start, unsigned int count,
-       if (start + count > mode_info.number_of_colors)
-        count = mode_info.number_of_colors - start;
- 
-      tmp = grub_malloc (count * sizeof (tmp[0]));
-+      tmp = grub_calloc (count, sizeof (tmp[0]));
-       for (i = 0; i < count; i++)
-        {
-          tmp[i].r = palette_data[i].r;
-diff --git a/grub-core/video/i386/pc/vga.c b/grub-core/video/i386/pc/vga.c
-index 01f4711..b2f776c 100644
--- a/grub-core/video/i386/pc/vga.c
-+++ b/grub-core/video/i386/pc/vga.c
-@@ -127,7 +127,7 @@ grub_video_vga_setup (unsigned int width, unsigned int height,
- 
-   vga_height = height ? : 480;
- 
-  framebuffer.temporary_buffer = grub_malloc (vga_height * VGA_WIDTH);
-+  framebuffer.temporary_buffer = grub_calloc (vga_height, VGA_WIDTH);
-   framebuffer.front_page = 0;
-   framebuffer.back_page = 0;
-   if (!framebuffer.temporary_buffer)
-diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c
-index 777e713..61bd645 100644
--- a/grub-core/video/readers/png.c
-+++ b/grub-core/video/readers/png.c
-@@ -309,7 +309,7 @@ grub_png_decode_image_header (struct grub_png_data *data)
-   if (data->is_16bit || data->is_gray || data->is_palette)
- #endif
-     {
-      data->image_data = grub_malloc (data->image_height * data->row_bytes);
-+      data->image_data = grub_calloc (data->image_height, data->row_bytes);
-       if (grub_errno)
-         return grub_errno;
- 
-diff --git a/include/grub/unicode.h b/include/grub/unicode.h
-index a0403e9..4de986a 100644
--- a/include/grub/unicode.h
-+++ b/include/grub/unicode.h
-@@ -293,7 +293,7 @@ grub_unicode_glyph_dup (const struct grub_unicode_glyph *in)
-   grub_memcpy (out, in, sizeof (*in));
-   if (in->ncomb > ARRAY_SIZE (out->combining_inline))
-     {
-      out->combining_ptr = grub_malloc (in->ncomb * sizeof (out->combining_ptr[0]));
-+      out->combining_ptr = grub_calloc (in->ncomb, sizeof (out->combining_ptr[0]));
-       if (!out->combining_ptr)
-        {
-          grub_free (out);
-@@ -315,7 +315,7 @@ grub_unicode_set_glyph (struct grub_unicode_glyph *out,
-   grub_memcpy (out, in, sizeof (*in));
-   if (in->ncomb > ARRAY_SIZE (out->combining_inline))
-     {
-      out->combining_ptr = grub_malloc (in->ncomb * sizeof (out->combining_ptr[0]));
-+      out->combining_ptr = grub_calloc (in->ncomb, sizeof (out->combining_ptr[0]));
-       if (!out->combining_ptr)
-        return;
-       grub_memcpy (out->combining_ptr, in->combining_ptr,
-diff --git a/util/getroot.c b/util/getroot.c
-index 847406f..a5eaa64 100644
--- a/util/getroot.c
-+++ b/util/getroot.c
-@@ -200,7 +200,7 @@ make_device_name (const char *drive)
-   char *ret, *ptr;
-   const char *iptr;
- 
-  ret = xmalloc (strlen (drive) * 2);
-+  ret = xcalloc (2, strlen (drive));
-   ptr = ret;
-   for (iptr = drive; *iptr; iptr++)
-     {
-diff --git a/util/grub-file.c b/util/grub-file.c
-index 50c18b6..b2e7dd6 100644
--- a/util/grub-file.c
-+++ b/util/grub-file.c
-@@ -54,7 +54,7 @@ main (int argc, char *argv[])
- 
-   grub_util_host_init (&argc, &argv);
- 
-  argv2 = xmalloc (argc * sizeof (argv2[0]));
-+  argv2 = xcalloc (argc, sizeof (argv2[0]));
- 
-   if (argc == 2 && strcmp (argv[1], "--version") == 0)
-     {
-diff --git a/util/grub-fstest.c b/util/grub-fstest.c
-index f14e02d..57246af 100644
--- a/util/grub-fstest.c
-+++ b/util/grub-fstest.c
-@@ -650,7 +650,7 @@ argp_parser (int key, char *arg, struct argp_state *state)
-   if (args_count < num_disks)
-     {
-       if (args_count == 0)
-       images = xmalloc (num_disks * sizeof (images[0]));
-+       images = xcalloc (num_disks, sizeof (images[0]));
-       images[args_count] = grub_canonicalize_file_name (arg);
-       args_count++;
-       return 0;
-@@ -734,7 +734,7 @@ main (int argc, char *argv[])
- 
-   grub_util_host_init (&argc, &argv);
- 
-  args = xmalloc (argc * sizeof (args[0]));
-+  args = xcalloc (argc, sizeof (args[0]));
- 
-   argp_parse (&argp, argc, argv, 0, 0, 0);
- 
-diff --git a/util/grub-install-common.c b/util/grub-install-common.c
-index ca0ac61..0295d40 100644
--- a/util/grub-install-common.c
-+++ b/util/grub-install-common.c
-@@ -286,7 +286,7 @@ handle_install_list (struct install_list *il, const char *val,
-       il->n_entries++;
-     }
-   il->n_alloc = il->n_entries + 1;
-  il->entries = xmalloc (il->n_alloc * sizeof (il->entries[0]));
-+  il->entries = xcalloc (il->n_alloc, sizeof (il->entries[0]));
-   ptr = val;
-   for (ce = il->entries; ; ce++)
-     {
-diff --git a/util/grub-install.c b/util/grub-install.c
-index 8a55ad4..a82725f 100644
--- a/util/grub-install.c
-+++ b/util/grub-install.c
-@@ -626,7 +626,7 @@ device_map_check_duplicates (const char *dev_map)
-   if (! fp)
-     return;
- 
-  d = xmalloc (alloced * sizeof (d[0]));
-+  d = xcalloc (alloced, sizeof (d[0]));
- 
-   while (fgets (buf, sizeof (buf), fp))
-     {
-@@ -1260,7 +1260,7 @@ main (int argc, char *argv[])
-       ndev++;
-     }
- 
-  grub_drives = xmalloc (sizeof (grub_drives[0]) * (ndev + 1)); 
-+  grub_drives = xcalloc (ndev + 1, sizeof (grub_drives[0]));
- 
-   for (curdev = grub_devices, curdrive = grub_drives; *curdev; curdev++,
-        curdrive++)
-diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c
-index bc087c2..d97d0e7 100644
--- a/util/grub-mkimagexx.c
-+++ b/util/grub-mkimagexx.c
-@@ -2294,10 +2294,8 @@ SUFFIX (grub_mkimage_load_image) (const char *kernel_path,
-                      + grub_host_to_target16 (e->e_shstrndx) * smd.section_entsize);
-   smd.strtab = (char *) e + grub_host_to_target_addr (s->sh_offset);
- 
-  smd.addrs = xmalloc (sizeof (*smd.addrs) * smd.num_sections);
-  memset (smd.addrs, 0, sizeof (*smd.addrs) * smd.num_sections);
-  smd.vaddrs = xmalloc (sizeof (*smd.vaddrs) * smd.num_sections);
-  memset (smd.vaddrs, 0, sizeof (*smd.vaddrs) * smd.num_sections);
-+  smd.addrs = xcalloc (smd.num_sections, sizeof (*smd.addrs));
-+  smd.vaddrs = xcalloc (smd.num_sections, sizeof (*smd.vaddrs));
- 
-   SUFFIX (locate_sections) (e, kernel_path, &smd, layout, image_target);
- 
-diff --git a/util/grub-mkrescue.c b/util/grub-mkrescue.c
-index ce2cbc4..5183102 100644
--- a/util/grub-mkrescue.c
-+++ b/util/grub-mkrescue.c
-@@ -441,8 +441,8 @@ main (int argc, char *argv[])
-   xorriso = xstrdup ("xorriso");
-   label_font = grub_util_path_concat (2, pkgdatadir, "unicode.pf2");
- 
-  argp_argv = xmalloc (sizeof (argp_argv[0]) * argc);
-  xorriso_tail_argv = xmalloc (sizeof (argp_argv[0]) * argc);
-+  argp_argv = xcalloc (argc, sizeof (argp_argv[0]));
-+  xorriso_tail_argv = xcalloc (argc, sizeof (argp_argv[0]));
- 
-   xorriso_tail_argc = 0;
-   /* Program name */
-diff --git a/util/grub-mkstandalone.c b/util/grub-mkstandalone.c
-index 4907d44..edf3097 100644
--- a/util/grub-mkstandalone.c
-+++ b/util/grub-mkstandalone.c
-@@ -296,7 +296,7 @@ main (int argc, char *argv[])
-   grub_util_host_init (&argc, &argv);
-   grub_util_disable_fd_syncs ();
- 
-  files = xmalloc ((argc + 1) * sizeof (files[0]));
-+  files = xcalloc (argc + 1, sizeof (files[0]));
- 
-   argp_parse (&argp, argc, argv, 0, 0, 0);
- 
-diff --git a/util/grub-pe2elf.c b/util/grub-pe2elf.c
-index 0d4084a..1133129 100644
--- a/util/grub-pe2elf.c
-+++ b/util/grub-pe2elf.c
-@@ -100,9 +100,9 @@ write_section_data (FILE* fp, const char *name, char *image,
-   char *pe_strtab = (image + pe_chdr->symtab_offset
-                     + pe_chdr->num_symbols * sizeof (struct grub_pe32_symbol));
- 
-  section_map = xmalloc ((2 * pe_chdr->num_sections + 5) * sizeof (int));
-+  section_map = xcalloc (2 * pe_chdr->num_sections + 5, sizeof (int));
-   section_map[0] = 0;
-  shdr = xmalloc ((2 * pe_chdr->num_sections + 5) * sizeof (shdr[0]));
-+  shdr = xcalloc (2 * pe_chdr->num_sections + 5, sizeof (shdr[0]));
-   idx = 1;
-   idx_reloc = pe_chdr->num_sections + 1;
- 
-@@ -233,7 +233,7 @@ write_reloc_section (FILE* fp, const char *name, char *image,
- 
-       pe_sec = pe_shdr + shdr[i].sh_link;
-       pe_rel = (struct grub_pe32_reloc *) (image + pe_sec->relocations_offset);
-      rel = (elf_reloc_t *) xmalloc (pe_sec->num_relocations * sizeof (elf_reloc_t));
-+      rel = (elf_reloc_t *) xcalloc (pe_sec->num_relocations, sizeof (elf_reloc_t));
-       num_rels = 0;
-       modified = 0;
- 
-@@ -365,12 +365,10 @@ write_symbol_table (FILE* fp, const char *name, char *image,
-   pe_symtab = (struct grub_pe32_symbol *) (image + pe_chdr->symtab_offset);
-   pe_strtab = (char *) (pe_symtab + pe_chdr->num_symbols);
- 
-  symtab = (Elf_Sym *) xmalloc ((pe_chdr->num_symbols + 1) *
-                               sizeof (Elf_Sym));
-  memset (symtab, 0, (pe_chdr->num_symbols + 1) * sizeof (Elf_Sym));
-+  symtab = (Elf_Sym *) xcalloc (pe_chdr->num_symbols + 1, sizeof (Elf_Sym));
-   num_syms = 1;
- 
-  symtab_map = (int *) xmalloc (pe_chdr->num_symbols * sizeof (int));
-+  symtab_map = (int *) xcalloc (pe_chdr->num_symbols, sizeof (int));
- 
-   for (i = 0; i < (int) pe_chdr->num_symbols;
-        i += pe_symtab->num_aux + 1, pe_symtab += pe_symtab->num_aux + 1)
-diff --git a/util/grub-probe.c b/util/grub-probe.c
-index 81d27ee..cbe6ed9 100644
--- a/util/grub-probe.c
-+++ b/util/grub-probe.c
-@@ -361,8 +361,8 @@ probe (const char *path, char **device_names, char delim)
-       grub_util_pull_device (*curdev);
-       ndev++;
-     }
-  
-  drives_names = xmalloc (sizeof (drives_names[0]) * (ndev + 1)); 
-+
-+  drives_names = xcalloc (ndev + 1, sizeof (drives_names[0]));
- 
-   for (curdev = device_names, curdrive = drives_names; *curdev; curdev++,
-        curdrive++)
-- 
-2.14.4
diff --git a/meta/recipes-bsp/grub/files/CVE-2020-14309-CVE-2020-14310-CVE-2020-14311-malloc-Use-overflow-checking-primitives-where-we-do-.patch b/meta/recipes-bsp/grub/files/CVE-2020-14309-CVE-2020-14310-CVE-2020-14311-malloc-Use-overflow-checking-primitives-where-we-do-.patch
deleted file mode 100644
index 7214ead9a7..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2020-14309-CVE-2020-14310-CVE-2020-14311-malloc-Use-overflow-checking-primitives-where-we-do-.patch
+++ /dev/null
@@ -1,1330 +0,0 @@
-From eb77d1ef65e25746acff43545f62a71360b15eec Mon Sep 17 00:00:00 2001
-From: Peter Jones <pjones@redhat.com>
-Date: Mon, 15 Jun 2020 12:28:27 -0400
-Subject: [PATCH 6/9] malloc: Use overflow checking primitives where we do
- complex allocations
-This attempts to fix the places where we do the following where
-arithmetic_expr may include unvalidated data:
-  X = grub_malloc(arithmetic_expr);
-It accomplishes this by doing the arithmetic ahead of time using grub_add(),
-grub_sub(), grub_mul() and testing for overflow before proceeding.
-Among other issues, this fixes:
-  - allocation of integer overflow in grub_video_bitmap_create()
-    reported by Chris Coulson,
-  - allocation of integer overflow in grub_png_decode_image_header()
-    reported by Chris Coulson,
-  - allocation of integer overflow in grub_squash_read_symlink()
-    reported by Chris Coulson,
-  - allocation of integer overflow in grub_ext2_read_symlink()
-    reported by Chris Coulson,
-  - allocation of integer overflow in read_section_as_string()
-    reported by Chris Coulson.
-Fixes: CVE-2020-14309, CVE-2020-14310, CVE-2020-14311
-Signed-off-by: Peter Jones <pjones@redhat.com>
-Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
-Upstream-Status: Backport
-CVE: CVE-2020-14309 CVE-2020-14310 CVE-2020-14311
-Reference to upstream patch:
-https://git.savannah.gnu.org/cgit/grub.git/commit/?id=3f05d693d1274965ffbe4ba99080dc2c570944c6
-Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
---
- grub-core/commands/legacycfg.c | 29 +++++++++++++++++++-----
- grub-core/commands/wildcard.c  | 36 ++++++++++++++++++++++++-----
- grub-core/disk/ldm.c           | 32 ++++++++++++++++++--------
- grub-core/font/font.c          |  7 +++++-
- grub-core/fs/btrfs.c           | 28 +++++++++++++++--------
- grub-core/fs/ext2.c            | 10 ++++++++-
- grub-core/fs/iso9660.c         | 51 +++++++++++++++++++++++++++++-------------
- grub-core/fs/sfs.c             | 27 +++++++++++++++++-----
- grub-core/fs/squash4.c         | 45 ++++++++++++++++++++++++++++---------
- grub-core/fs/udf.c             | 41 +++++++++++++++++++++------------
- grub-core/fs/xfs.c             | 11 +++++----
- grub-core/fs/zfs/zfs.c         | 22 ++++++++++++------
- grub-core/fs/zfs/zfscrypt.c    |  7 +++++-
- grub-core/lib/arg.c            | 20 +++++++++++++++--
- grub-core/loader/i386/bsd.c    |  8 ++++++-
- grub-core/net/dns.c            |  9 +++++++-
- grub-core/normal/charset.c     | 10 +++++++--
- grub-core/normal/cmdline.c     | 14 ++++++++++--
- grub-core/normal/menu_entry.c  | 13 +++++++++--
- grub-core/script/argv.c        | 16 +++++++++++--
- grub-core/script/lexer.c       | 21 ++++++++++++++---
- grub-core/video/bitmap.c       | 25 +++++++++++++--------
- grub-core/video/readers/png.c  | 13 +++++++++--
- 23 files changed, 382 insertions(+), 113 deletions(-)
-diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c
-index 5e3ec0d..cc5971f 100644
--- a/grub-core/commands/legacycfg.c
-+++ b/grub-core/commands/legacycfg.c
-@@ -32,6 +32,7 @@
- #include <grub/auth.h>
- #include <grub/disk.h>
- #include <grub/partition.h>
-+#include <grub/safemath.h>
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-@@ -104,13 +105,22 @@ legacy_file (const char *filename)
-        if (newsuffix)
-          {
-            char *t;
-           
-+           grub_size_t sz;
-+
-+           if (grub_add (grub_strlen (suffix), grub_strlen (newsuffix), &sz) ||
-+               grub_add (sz, 1, &sz))
-+             {
-+               grub_errno = GRUB_ERR_OUT_OF_RANGE;
-+               goto fail_0;
-+             }
-+
-            t = suffix;
-           suffix = grub_realloc (suffix, grub_strlen (suffix)
-                                  + grub_strlen (newsuffix) + 1);
-+           suffix = grub_realloc (suffix, sz);
-            if (!suffix)
-              {
-                grub_free (t);
-+
-+ fail_0:
-                grub_free (entrysrc);
-                grub_free (parsed);
-                grub_free (newsuffix);
-@@ -154,13 +164,22 @@ legacy_file (const char *filename)
-          else
-            {
-              char *t;
-+             grub_size_t sz;
-+
-+             if (grub_add (grub_strlen (entrysrc), grub_strlen (parsed), &sz) ||
-+                 grub_add (sz, 1, &sz))
-+               {
-+                 grub_errno = GRUB_ERR_OUT_OF_RANGE;
-+                 goto fail_1;
-+               }
- 
-              t = entrysrc;
-             entrysrc = grub_realloc (entrysrc, grub_strlen (entrysrc)
-                                      + grub_strlen (parsed) + 1);
-+             entrysrc = grub_realloc (entrysrc, sz);
-              if (!entrysrc)
-                {
-                  grub_free (t);
-+
-+ fail_1:
-                  grub_free (parsed);
-                  grub_free (suffix);
-                  return grub_errno;
-diff --git a/grub-core/commands/wildcard.c b/grub-core/commands/wildcard.c
-index 4a106ca..cc32903 100644
--- a/grub-core/commands/wildcard.c
-+++ b/grub-core/commands/wildcard.c
-@@ -23,6 +23,7 @@
- #include <grub/file.h>
- #include <grub/device.h>
- #include <grub/script_sh.h>
-+#include <grub/safemath.h>
- 
- #include <regex.h>
- 
-@@ -48,6 +49,7 @@ merge (char **dest, char **ps)
-   int i;
-   int j;
-   char **p;
-+  grub_size_t sz;
- 
-   if (! dest)
-     return ps;
-@@ -60,7 +62,12 @@ merge (char **dest, char **ps)
-   for (j = 0; ps[j]; j++)
-     ;
- 
-  p = grub_realloc (dest, sizeof (char*) * (i + j + 1));
-+  if (grub_add (i, j, &sz) ||
-+      grub_add (sz, 1, &sz) ||
-+      grub_mul (sz, sizeof (char *), &sz))
-+    return dest;
-+
-+  p = grub_realloc (dest, sz);
-   if (! p)
-     {
-       grub_free (dest);
-@@ -115,8 +122,15 @@ make_regex (const char *start, const char *end, regex_t *regexp)
-   char ch;
-   int i = 0;
-   unsigned len = end - start;
-  char *buffer = grub_malloc (len * 2 + 2 + 1); /* worst case size. */
-+  char *buffer;
-+  grub_size_t sz;
- 
-+  /* Worst case size is (len * 2 + 2 + 1). */
-+  if (grub_mul (len, 2, &sz) ||
-+      grub_add (sz, 3, &sz))
-+    return 1;
-+
-+  buffer = grub_malloc (sz);
-   if (! buffer)
-     return 1;
- 
-@@ -226,6 +240,7 @@ match_devices_iter (const char *name, void *data)
-   struct match_devices_ctx *ctx = data;
-   char **t;
-   char *buffer;
-+  grub_size_t sz;
- 
-   /* skip partitions if asked to. */
-   if (ctx->noparts && grub_strchr (name, ','))
-@@ -239,11 +254,16 @@ match_devices_iter (const char *name, void *data)
-   if (regexec (ctx->regexp, buffer, 0, 0, 0))
-     {
-       grub_dprintf ("expand", "not matched\n");
-+ fail:
-       grub_free (buffer);
-       return 0;
-     }
- 
-  t = grub_realloc (ctx->devs, sizeof (char*) * (ctx->ndev + 2));
-+  if (grub_add (ctx->ndev, 2, &sz) ||
-+      grub_mul (sz, sizeof (char *), &sz))
-+    goto fail;
-+
-+  t = grub_realloc (ctx->devs, sz);
-   if (! t)
-     {
-       grub_free (buffer);
-@@ -300,6 +320,7 @@ match_files_iter (const char *name,
-   struct match_files_ctx *ctx = data;
-   char **t;
-   char *buffer;
-+  grub_size_t sz;
- 
-   /* skip . and .. names */
-   if (grub_strcmp(".", name) == 0 || grub_strcmp("..", name) == 0)
-@@ -315,9 +336,14 @@ match_files_iter (const char *name,
-   if (! buffer)
-     return 1;
- 
-  t = grub_realloc (ctx->files, sizeof (char*) * (ctx->nfile + 2));
-  if (! t)
-+  if (grub_add (ctx->nfile, 2, &sz) ||
-+      grub_mul (sz, sizeof (char *), &sz))
-+    goto fail;
-+
-+  t = grub_realloc (ctx->files, sz);
-+  if (!t)
-     {
-+ fail:
-       grub_free (buffer);
-       return 1;
-     }
-diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c
-index e632370..58f8a53 100644
--- a/grub-core/disk/ldm.c
-+++ b/grub-core/disk/ldm.c
-@@ -25,6 +25,7 @@
- #include <grub/msdos_partition.h>
- #include <grub/gpt_partition.h>
- #include <grub/i18n.h>
-+#include <grub/safemath.h>
- 
- #ifdef GRUB_UTIL
- #include <grub/emu/misc.h>
-@@ -289,6 +290,7 @@ make_vg (grub_disk_t disk,
-       struct grub_ldm_vblk vblk[GRUB_DISK_SECTOR_SIZE
-                                / sizeof (struct grub_ldm_vblk)];
-       unsigned i;
-+      grub_size_t sz;
-       err = grub_disk_read (disk, cursec, 0,
-                            sizeof(vblk), &vblk);
-       if (err)
-@@ -350,7 +352,13 @@ make_vg (grub_disk_t disk,
-              grub_free (lv);
-              goto fail2;
-            }
-         lv->name = grub_malloc (*ptr + 1);
-+         if (grub_add (*ptr, 1, &sz))
-+           {
-+             grub_free (lv->internal_id);
-+             grub_free (lv);
-+             goto fail2;
-+           }
-+         lv->name = grub_malloc (sz);
-          if (!lv->name)
-            {
-              grub_free (lv->internal_id);
-@@ -599,10 +607,13 @@ make_vg (grub_disk_t disk,
-          if (lv->segments->node_alloc == lv->segments->node_count)
-            {
-              void *t;
-             lv->segments->node_alloc *= 2; 
-             t = grub_realloc (lv->segments->nodes,
-                               sizeof (*lv->segments->nodes)
-                               * lv->segments->node_alloc);
-+             grub_size_t sz;
-+
-+             if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) ||
-+                 grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz))
-+               goto fail2;
-+
-+             t = grub_realloc (lv->segments->nodes, sz);
-              if (!t)
-                goto fail2;
-              lv->segments->nodes = t;
-@@ -723,10 +734,13 @@ make_vg (grub_disk_t disk,
-              if (comp->segment_alloc == comp->segment_count)
-                {
-                  void *t;
-                 comp->segment_alloc *= 2;
-                 t = grub_realloc (comp->segments,
-                                   comp->segment_alloc
-                                   * sizeof (*comp->segments));
-+                 grub_size_t sz;
-+
-+                 if (grub_mul (comp->segment_alloc, 2, &comp->segment_alloc) ||
-+                     grub_mul (comp->segment_alloc, sizeof (*comp->segments), &sz))
-+                   goto fail2;
-+
-+                 t = grub_realloc (comp->segments, sz);
-                  if (!t)
-                    goto fail2;
-                  comp->segments = t;
-diff --git a/grub-core/font/font.c b/grub-core/font/font.c
-index 8e118b3..5edb477 100644
--- a/grub-core/font/font.c
-+++ b/grub-core/font/font.c
-@@ -30,6 +30,7 @@
- #include <grub/unicode.h>
- #include <grub/fontformat.h>
- #include <grub/env.h>
-+#include <grub/safemath.h>
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-@@ -360,9 +361,13 @@ static char *
- read_section_as_string (struct font_file_section *section)
- {
-   char *str;
-+  grub_size_t sz;
-   grub_ssize_t ret;
- 
-  str = grub_malloc (section->length + 1);
-+  if (grub_add (section->length, 1, &sz))
-+    return NULL;
-+
-+  str = grub_malloc (sz);
-   if (!str)
-     return 0;
- 
-diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
-index 11272ef..2b65bd5 100644
--- a/grub-core/fs/btrfs.c
-+++ b/grub-core/fs/btrfs.c
-@@ -40,6 +40,7 @@
- #include <grub/btrfs.h>
- #include <grub/crypto.h>
- #include <grub/diskfilter.h>
-+#include <grub/safemath.h>
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-@@ -329,9 +330,13 @@ save_ref (struct grub_btrfs_leaf_descriptor *desc,
-   if (desc->allocated < desc->depth)
-     {
-       void *newdata;
-      desc->allocated *= 2;
-      newdata = grub_realloc (desc->data, sizeof (desc->data[0])
-                             * desc->allocated);
-+      grub_size_t sz;
-+
-+      if (grub_mul (desc->allocated, 2, &desc->allocated) ||
-+         grub_mul (desc->allocated, sizeof (desc->data[0]), &sz))
-+       return GRUB_ERR_OUT_OF_RANGE;
-+
-+      newdata = grub_realloc (desc->data, sz);
-       if (!newdata)
-        return grub_errno;
-       desc->data = newdata;
-@@ -622,16 +627,21 @@ find_device (struct grub_btrfs_data *data, grub_uint64_t id)
-   if (data->n_devices_attached > data->n_devices_allocated)
-     {
-       void *tmp;
-      data->n_devices_allocated = 2 * data->n_devices_attached + 1;
-      data->devices_attached
-       = grub_realloc (tmp = data->devices_attached,
-                       data->n_devices_allocated
-                       * sizeof (data->devices_attached[0]));
-+      grub_size_t sz;
-+
-+      if (grub_mul (data->n_devices_attached, 2, &data->n_devices_allocated) ||
-+         grub_add (data->n_devices_allocated, 1, &data->n_devices_allocated) ||
-+         grub_mul (data->n_devices_allocated, sizeof (data->devices_attached[0]), &sz))
-+       goto fail;
-+
-+      data->devices_attached = grub_realloc (tmp = data->devices_attached, sz);
-       if (!data->devices_attached)
-        {
-+         data->devices_attached = tmp;
-+
-+ fail:
-          if (ctx.dev_found)
-            grub_device_close (ctx.dev_found);
-         data->devices_attached = tmp;
-          return NULL;
-        }
-     }
-diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c
-index 9b38980..ac33bcd 100644
--- a/grub-core/fs/ext2.c
-+++ b/grub-core/fs/ext2.c
-@@ -46,6 +46,7 @@
- #include <grub/dl.h>
- #include <grub/types.h>
- #include <grub/fshelp.h>
-+#include <grub/safemath.h>
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-@@ -703,6 +704,7 @@ grub_ext2_read_symlink (grub_fshelp_node_t node)
- {
-   char *symlink;
-   struct grub_fshelp_node *diro = node;
-+  grub_size_t sz;
- 
-   if (! diro->inode_read)
-     {
-@@ -717,7 +719,13 @@ grub_ext2_read_symlink (grub_fshelp_node_t node)
-        }
-     }
- 
-  symlink = grub_malloc (grub_le_to_cpu32 (diro->inode.size) + 1);
-+  if (grub_add (grub_le_to_cpu32 (diro->inode.size), 1, &sz))
-+    {
-+      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
-+      return NULL;
-+    }
-+
-+  symlink = grub_malloc (sz);
-   if (! symlink)
-     return 0;
- 
-diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c
-index 4f1b52a..7ba5b30 100644
--- a/grub-core/fs/iso9660.c
-+++ b/grub-core/fs/iso9660.c
-@@ -28,6 +28,7 @@
- #include <grub/fshelp.h>
- #include <grub/charset.h>
- #include <grub/datetime.h>
-+#include <grub/safemath.h>
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-@@ -531,8 +532,13 @@ add_part (struct iterate_dir_ctx *ctx,
-          int len2)
- {
-   int size = ctx->symlink ? grub_strlen (ctx->symlink) : 0;
-+  grub_size_t sz;
- 
-  ctx->symlink = grub_realloc (ctx->symlink, size + len2 + 1);
-+  if (grub_add (size, len2, &sz) ||
-+      grub_add (sz, 1, &sz))
-+    return;
-+
-+  ctx->symlink = grub_realloc (ctx->symlink, sz);
-   if (! ctx->symlink)
-     return;
- 
-@@ -560,17 +566,24 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry,
-        {
-          grub_size_t off = 0, csize = 1;
-          char *old;
-+         grub_size_t sz;
-+
-          csize = entry->len - 5;
-          old = ctx->filename;
-          if (ctx->filename_alloc)
-            {
-              off = grub_strlen (ctx->filename);
-             ctx->filename = grub_realloc (ctx->filename, csize + off + 1);
-+             if (grub_add (csize, off, &sz) ||
-+                 grub_add (sz, 1, &sz))
-+               return GRUB_ERR_OUT_OF_RANGE;
-+             ctx->filename = grub_realloc (ctx->filename, sz);
-            }
-          else
-            {
-              off = 0;
-             ctx->filename = grub_zalloc (csize + 1);
-+             if (grub_add (csize, 1, &sz))
-+               return GRUB_ERR_OUT_OF_RANGE;
-+             ctx->filename = grub_zalloc (sz);
-            }
-          if (!ctx->filename)
-            {
-@@ -776,14 +789,18 @@ grub_iso9660_iterate_dir (grub_fshelp_node_t dir,
-            if (node->have_dirents >= node->alloc_dirents)
-              {
-                struct grub_fshelp_node *new_node;
-               node->alloc_dirents *= 2;
-               new_node = grub_realloc (node, 
-                                        sizeof (struct grub_fshelp_node)
-                                        + ((node->alloc_dirents
-                                            - ARRAY_SIZE (node->dirents))
-                                           * sizeof (node->dirents[0])));
-+               grub_size_t sz;
-+
-+               if (grub_mul (node->alloc_dirents, 2, &node->alloc_dirents) ||
-+                   grub_sub (node->alloc_dirents, ARRAY_SIZE (node->dirents), &sz) ||
-+                   grub_mul (sz, sizeof (node->dirents[0]), &sz) ||
-+                   grub_add (sz, sizeof (struct grub_fshelp_node), &sz))
-+                 goto fail_0;
-+
-+               new_node = grub_realloc (node, sz);
-                if (!new_node)
-                  {
-+ fail_0:
-                    if (ctx.filename_alloc)
-                      grub_free (ctx.filename);
-                    grub_free (node);
-@@ -799,14 +816,18 @@ grub_iso9660_iterate_dir (grub_fshelp_node_t dir,
-                * sizeof (node->dirents[0]) < grub_strlen (ctx.symlink) + 1)
-              {
-                struct grub_fshelp_node *new_node;
-               new_node = grub_realloc (node,
-                                        sizeof (struct grub_fshelp_node)
-                                        + ((node->alloc_dirents
-                                            - ARRAY_SIZE (node->dirents))
-                                           * sizeof (node->dirents[0]))
-                                        + grub_strlen (ctx.symlink) + 1);
-+               grub_size_t sz;
-+
-+               if (grub_sub (node->alloc_dirents, ARRAY_SIZE (node->dirents), &sz) ||
-+                   grub_mul (sz, sizeof (node->dirents[0]), &sz) ||
-+                   grub_add (sz, sizeof (struct grub_fshelp_node) + 1, &sz) ||
-+                   grub_add (sz, grub_strlen (ctx.symlink), &sz))
-+                 goto fail_1;
-+
-+               new_node = grub_realloc (node, sz);
-                if (!new_node)
-                  {
-+ fail_1:
-                    if (ctx.filename_alloc)
-                      grub_free (ctx.filename);
-                    grub_free (node);
-diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c
-index 90f7fb3..de2b107 100644
--- a/grub-core/fs/sfs.c
-+++ b/grub-core/fs/sfs.c
-@@ -26,6 +26,7 @@
- #include <grub/types.h>
- #include <grub/fshelp.h>
- #include <grub/charset.h>
-+#include <grub/safemath.h>
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-@@ -307,10 +308,15 @@ grub_sfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock)
-       if (node->cache && node->cache_size >= node->cache_allocated)
-        {
-          struct cache_entry *e = node->cache;
-         e = grub_realloc (node->cache,node->cache_allocated * 2
-                           * sizeof (e[0]));
-+         grub_size_t sz;
-+
-+         if (grub_mul (node->cache_allocated, 2 * sizeof (e[0]), &sz))
-+           goto fail;
-+
-+         e = grub_realloc (node->cache, sz);
-          if (!e)
-            {
-+ fail:
-              grub_errno = 0;
-              grub_free (node->cache);
-              node->cache = 0;
-@@ -477,10 +483,16 @@ grub_sfs_create_node (struct grub_fshelp_node **node,
-   grub_size_t len = grub_strlen (name);
-   grub_uint8_t *name_u8;
-   int ret;
-+  grub_size_t sz;
-+
-+  if (grub_mul (len, GRUB_MAX_UTF8_PER_LATIN1, &sz) ||
-+      grub_add (sz, 1, &sz))
-+    return 1;
-+
-   *node = grub_malloc (sizeof (**node));
-   if (!*node)
-     return 1;
-  name_u8 = grub_malloc (len * GRUB_MAX_UTF8_PER_LATIN1 + 1);
-+  name_u8 = grub_malloc (sz);
-   if (!name_u8)
-     {
-       grub_free (*node);
-@@ -724,8 +736,13 @@ grub_sfs_label (grub_device_t device, char **label)
-   data = grub_sfs_mount (disk);
-   if (data)
-     {
-      grub_size_t len = grub_strlen (data->label);
-      *label = grub_malloc (len * GRUB_MAX_UTF8_PER_LATIN1 + 1);
-+      grub_size_t sz, len = grub_strlen (data->label);
-+
-+      if (grub_mul (len, GRUB_MAX_UTF8_PER_LATIN1, &sz) ||
-+         grub_add (sz, 1, &sz))
-+       return GRUB_ERR_OUT_OF_RANGE;
-+
-+      *label = grub_malloc (sz);
-       if (*label)
-        *grub_latin1_to_utf8 ((grub_uint8_t *) *label,
-                              (const grub_uint8_t *) data->label,
-diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c
-index 95d5c1e..7851238 100644
--- a/grub-core/fs/squash4.c
-+++ b/grub-core/fs/squash4.c
-@@ -26,6 +26,7 @@
- #include <grub/types.h>
- #include <grub/fshelp.h>
- #include <grub/deflate.h>
-+#include <grub/safemath.h>
- #include <minilzo.h>
- 
- #include "xz.h"
-@@ -459,7 +460,17 @@ grub_squash_read_symlink (grub_fshelp_node_t node)
- {
-   char *ret;
-   grub_err_t err;
-  ret = grub_malloc (grub_le_to_cpu32 (node->ino.symlink.namelen) + 1);
-+  grub_size_t sz;
-+
-+  if (grub_add (grub_le_to_cpu32 (node->ino.symlink.namelen), 1, &sz))
-+    {
-+      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
-+      return NULL;
-+    }
-+
-+  ret = grub_malloc (sz);
-+  if (!ret)
-+    return NULL;
- 
-   err = read_chunk (node->data, ret,
-                    grub_le_to_cpu32 (node->ino.symlink.namelen),
-@@ -506,11 +517,16 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir,
- 
-   {
-     grub_fshelp_node_t node;
-    node = grub_malloc (sizeof (*node) + dir->stsize * sizeof (dir->stack[0]));
-+    grub_size_t sz;
-+
-+    if (grub_mul (dir->stsize, sizeof (dir->stack[0]), &sz) ||
-+       grub_add (sz, sizeof (*node), &sz))
-+      return 0;
-+
-+    node = grub_malloc (sz);
-     if (!node)
-       return 0;
-    grub_memcpy (node, dir,
-                sizeof (*node) + dir->stsize * sizeof (dir->stack[0]));
-+    grub_memcpy (node, dir, sz);
-     if (hook (".", GRUB_FSHELP_DIR, node, hook_data))
-       return 1;
- 
-@@ -518,12 +534,15 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir,
-       {
-        grub_err_t err;
- 
-       node = grub_malloc (sizeof (*node) + dir->stsize * sizeof (dir->stack[0]));
-+       if (grub_mul (dir->stsize, sizeof (dir->stack[0]), &sz) ||
-+           grub_add (sz, sizeof (*node), &sz))
-+         return 0;
-+
-+       node = grub_malloc (sz);
-        if (!node)
-          return 0;
- 
-       grub_memcpy (node, dir,
-                    sizeof (*node) + dir->stsize * sizeof (dir->stack[0]));
-+       grub_memcpy (node, dir, sz);
- 
-        node->stsize--;
-        err = read_chunk (dir->data, &node->ino, sizeof (node->ino),
-@@ -557,6 +576,7 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir,
-          enum grub_fshelp_filetype filetype = GRUB_FSHELP_REG;
-          struct grub_squash_dirent di;
-          struct grub_squash_inode ino;
-+         grub_size_t sz;
- 
-          err = read_chunk (dir->data, &di, sizeof (di),
-                            grub_le_to_cpu64 (dir->data->sb.diroffset)
-@@ -589,13 +609,16 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir,
-          if (grub_le_to_cpu16 (di.type) == SQUASH_TYPE_SYMLINK)
-            filetype = GRUB_FSHELP_SYMLINK;
- 
-         node = grub_malloc (sizeof (*node)
-                             + (dir->stsize + 1) * sizeof (dir->stack[0]));
-+         if (grub_add (dir->stsize, 1, &sz) ||
-+             grub_mul (sz, sizeof (dir->stack[0]), &sz) ||
-+             grub_add (sz, sizeof (*node), &sz))
-+           return 0;
-+
-+         node = grub_malloc (sz);
-          if (! node)
-            return 0;
- 
-         grub_memcpy (node, dir,
-                      sizeof (*node) + dir->stsize * sizeof (dir->stack[0]));
-+         grub_memcpy (node, dir, sz - sizeof(dir->stack[0]));
- 
-          node->ino = ino;
-          node->stack[node->stsize].ino_chunk = grub_le_to_cpu32 (dh.ino_chunk);
-diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
-index a837616..21ac7f4 100644
--- a/grub-core/fs/udf.c
-+++ b/grub-core/fs/udf.c
-@@ -28,6 +28,7 @@
- #include <grub/charset.h>
- #include <grub/datetime.h>
- #include <grub/udf.h>
-+#include <grub/safemath.h>
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-@@ -890,9 +891,19 @@ read_string (const grub_uint8_t *raw, grub_size_t sz, char *outbuf)
-        utf16[i] = (raw[2 * i + 1] << 8) | raw[2*i + 2];
-     }
-   if (!outbuf)
-    outbuf = grub_malloc (utf16len * GRUB_MAX_UTF8_PER_UTF16 + 1);
-+    {
-+      grub_size_t size;
-+
-+      if (grub_mul (utf16len, GRUB_MAX_UTF8_PER_UTF16, &size) ||
-+         grub_add (size, 1, &size))
-+       goto fail;
-+
-+      outbuf = grub_malloc (size);
-+    }
-   if (outbuf)
-     *grub_utf16_to_utf8 ((grub_uint8_t *) outbuf, utf16, utf16len) = '\0';
-+
-+ fail:
-   grub_free (utf16);
-   return outbuf;
- }
-@@ -1005,7 +1016,7 @@ grub_udf_read_symlink (grub_fshelp_node_t node)
-   grub_size_t sz = U64 (node->block.fe.file_size);
-   grub_uint8_t *raw;
-   const grub_uint8_t *ptr;
-  char *out, *optr;
-+  char *out = NULL, *optr;
- 
-   if (sz < 4)
-     return NULL;
-@@ -1013,14 +1024,16 @@ grub_udf_read_symlink (grub_fshelp_node_t node)
-   if (!raw)
-     return NULL;
-   if (grub_udf_read_file (node, NULL, NULL, 0, sz, (char *) raw) < 0)
-    {
-      grub_free (raw);
-      return NULL;
-    }
-+    goto fail_1;
- 
-  out = grub_malloc (sz * 2 + 1);
-+  if (grub_mul (sz, 2, &sz) ||
-+      grub_add (sz, 1, &sz))
-+    goto fail_0;
-+
-+  out = grub_malloc (sz);
-   if (!out)
-     {
-+ fail_0:
-       grub_free (raw);
-       return NULL;
-     }
-@@ -1031,17 +1044,17 @@ grub_udf_read_symlink (grub_fshelp_node_t node)
-     {
-       grub_size_t s;
-       if ((grub_size_t) (ptr - raw + 4) > sz)
-       goto fail;
-+       goto fail_1;
-       if (!(ptr[2] == 0 && ptr[3] == 0))
-       goto fail;
-+       goto fail_1;
-       s = 4 + ptr[1];
-       if ((grub_size_t) (ptr - raw + s) > sz)
-       goto fail;
-+       goto fail_1;
-       switch (*ptr)
-        {
-        case 1:
-          if (ptr[1])
-           goto fail;
-+           goto fail_1;
-          /* Fallthrough.  */
-        case 2:
-          /* in 4 bytes. out: 1 byte.  */
-@@ -1066,11 +1079,11 @@ grub_udf_read_symlink (grub_fshelp_node_t node)
-          if (optr != out)
-            *optr++ = '/';
-          if (!read_string (ptr + 4, s - 4, optr))
-           goto fail;
-+           goto fail_1;
-          optr += grub_strlen (optr);
-          break;
-        default:
-         goto fail;
-+         goto fail_1;
-        }
-       ptr += s;
-     }
-@@ -1078,7 +1091,7 @@ grub_udf_read_symlink (grub_fshelp_node_t node)
-   grub_free (raw);
-   return out;
- 
- fail:
-+ fail_1:
-   grub_free (raw);
-   grub_free (out);
-   grub_error (GRUB_ERR_BAD_FS, "invalid symlink");
-diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c
-index 96ffecb..ea65902 100644
--- a/grub-core/fs/xfs.c
-+++ b/grub-core/fs/xfs.c
-@@ -25,6 +25,7 @@
- #include <grub/dl.h>
- #include <grub/types.h>
- #include <grub/fshelp.h>
-+#include <grub/safemath.h>
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-@@ -899,6 +900,7 @@ static struct grub_xfs_data *
- grub_xfs_mount (grub_disk_t disk)
- {
-   struct grub_xfs_data *data = 0;
-+  grub_size_t sz;
- 
-   data = grub_zalloc (sizeof (struct grub_xfs_data));
-   if (!data)
-@@ -913,10 +915,11 @@ grub_xfs_mount (grub_disk_t disk)
-   if (!grub_xfs_sb_valid(data))
-     goto fail;
- 
-  data = grub_realloc (data,
-                      sizeof (struct grub_xfs_data)
-                      - sizeof (struct grub_xfs_inode)
-                      + grub_xfs_inode_size(data) + 1);
-+  if (grub_add (grub_xfs_inode_size (data),
-+      sizeof (struct grub_xfs_data) - sizeof (struct grub_xfs_inode) + 1, &sz))
-+    goto fail;
-+
-+  data = grub_realloc (data, sz);
- 
-   if (! data)
-     goto fail;
-diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c
-index 381dde5..36d0373 100644
--- a/grub-core/fs/zfs/zfs.c
-+++ b/grub-core/fs/zfs/zfs.c
-@@ -55,6 +55,7 @@
- #include <grub/deflate.h>
- #include <grub/crypto.h>
- #include <grub/i18n.h>
-+#include <grub/safemath.h>
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-@@ -773,11 +774,14 @@ fill_vdev_info (struct grub_zfs_data *data,
-   if (data->n_devices_attached > data->n_devices_allocated)
-     {
-       void *tmp;
-      data->n_devices_allocated = 2 * data->n_devices_attached + 1;
-      data->devices_attached
-       = grub_realloc (tmp = data->devices_attached,
-                       data->n_devices_allocated
-                       * sizeof (data->devices_attached[0]));
-+      grub_size_t sz;
-+
-+      if (grub_mul (data->n_devices_attached, 2, &data->n_devices_allocated) ||
-+         grub_add (data->n_devices_allocated, 1, &data->n_devices_allocated) ||
-+         grub_mul (data->n_devices_allocated, sizeof (data->devices_attached[0]), &sz))
-+       return GRUB_ERR_OUT_OF_RANGE;
-+
-+      data->devices_attached = grub_realloc (tmp = data->devices_attached, sz);
-       if (!data->devices_attached)
-        {
-          data->devices_attached = tmp;
-@@ -3468,14 +3472,18 @@ grub_zfs_nvlist_lookup_nvlist (const char *nvlist, const char *name)
- {
-   char *nvpair;
-   char *ret;
-  grub_size_t size;
-+  grub_size_t size, sz;
-   int found;
- 
-   found = nvlist_find_value (nvlist, name, DATA_TYPE_NVLIST, &nvpair,
-                             &size, 0);
-   if (!found)
-     return 0;
-  ret = grub_zalloc (size + 3 * sizeof (grub_uint32_t));
-+
-+  if (grub_add (size, 3 * sizeof (grub_uint32_t), &sz))
-+      return 0;
-+
-+  ret = grub_zalloc (sz);
-   if (!ret)
-     return 0;
-   grub_memcpy (ret, nvlist, sizeof (grub_uint32_t));
-diff --git a/grub-core/fs/zfs/zfscrypt.c b/grub-core/fs/zfs/zfscrypt.c
-index 1402e0b..de3b015 100644
--- a/grub-core/fs/zfs/zfscrypt.c
-+++ b/grub-core/fs/zfs/zfscrypt.c
-@@ -22,6 +22,7 @@
- #include <grub/misc.h>
- #include <grub/disk.h>
- #include <grub/partition.h>
-+#include <grub/safemath.h>
- #include <grub/dl.h>
- #include <grub/types.h>
- #include <grub/zfs/zfs.h>
-@@ -82,9 +83,13 @@ grub_zfs_add_key (grub_uint8_t *key_in,
-                  int passphrase)
- {
-   struct grub_zfs_wrap_key *key;
-+  grub_size_t sz;
-+
-   if (!passphrase && keylen > 32)
-     keylen = 32;
-  key = grub_malloc (sizeof (*key) + keylen);
-+  if (grub_add (sizeof (*key), keylen, &sz))
-+    return GRUB_ERR_OUT_OF_RANGE;
-+  key = grub_malloc (sz);
-   if (!key)
-     return grub_errno;
-   key->is_passphrase = passphrase;
-diff --git a/grub-core/lib/arg.c b/grub-core/lib/arg.c
-index fd7744a..3288609 100644
--- a/grub-core/lib/arg.c
-+++ b/grub-core/lib/arg.c
-@@ -23,6 +23,7 @@
- #include <grub/term.h>
- #include <grub/extcmd.h>
- #include <grub/i18n.h>
-+#include <grub/safemath.h>
- 
- /* Built-in parser for default options.  */
- static const struct grub_arg_option help_options[] =
-@@ -216,7 +217,13 @@ static inline grub_err_t
- add_arg (char ***argl, int *num, char *s)
- {
-   char **p = *argl;
-  *argl = grub_realloc (*argl, (++(*num) + 1) * sizeof (char *));
-+  grub_size_t sz;
-+
-+  if (grub_add (++(*num), 1, &sz) ||
-+      grub_mul (sz, sizeof (char *), &sz))
-+    return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
-+
-+  *argl = grub_realloc (*argl, sz);
-   if (! *argl)
-     {
-       grub_free (p);
-@@ -431,6 +438,7 @@ grub_arg_list_alloc(grub_extcmd_t extcmd, int argc,
-   grub_size_t argcnt;
-   struct grub_arg_list *list;
-   const struct grub_arg_option *options;
-+  grub_size_t sz0, sz1;
- 
-   options = extcmd->options;
-   if (! options)
-@@ -443,7 +451,15 @@ grub_arg_list_alloc(grub_extcmd_t extcmd, int argc,
-        argcnt += ((grub_size_t) argc + 1) / 2 + 1; /* max possible for any option */
-     }
- 
-  list = grub_zalloc (sizeof (*list) * i + sizeof (char*) * argcnt);
-+  if (grub_mul (sizeof (*list), i, &sz0) ||
-+      grub_mul (sizeof (char *), argcnt, &sz1) ||
-+      grub_add (sz0, sz1, &sz0))
-+    {
-+      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
-+      return 0;
-+    }
-+
-+  list = grub_zalloc (sz0);
-   if (! list)
-     return 0;
- 
-diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c
-index 3730ed3..b92cbe9 100644
--- a/grub-core/loader/i386/bsd.c
-+++ b/grub-core/loader/i386/bsd.c
-@@ -35,6 +35,7 @@
- #include <grub/ns8250.h>
- #include <grub/bsdlabel.h>
- #include <grub/crypto.h>
-+#include <grub/safemath.h>
- #include <grub/verify.h>
- #ifdef GRUB_MACHINE_PCBIOS
- #include <grub/machine/int.h>
-@@ -1012,11 +1013,16 @@ grub_netbsd_add_modules (void)
-   struct grub_netbsd_btinfo_modules *mods;
-   unsigned i;
-   grub_err_t err;
-+  grub_size_t sz;
- 
-   for (mod = netbsd_mods; mod; mod = mod->next)
-     modcnt++;
- 
-  mods = grub_malloc (sizeof (*mods) + sizeof (mods->mods[0]) * modcnt);
-+  if (grub_mul (modcnt, sizeof (mods->mods[0]), &sz) ||
-+      grub_add (sz, sizeof (*mods), &sz))
-+    return GRUB_ERR_OUT_OF_RANGE;
-+
-+  mods = grub_malloc (sz);
-   if (!mods)
-     return grub_errno;
- 
-diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c
-index e332d5e..906ec7d 100644
--- a/grub-core/net/dns.c
-+++ b/grub-core/net/dns.c
-@@ -22,6 +22,7 @@
- #include <grub/i18n.h>
- #include <grub/err.h>
- #include <grub/time.h>
-+#include <grub/safemath.h>
- 
- struct dns_cache_element
- {
-@@ -51,9 +52,15 @@ grub_net_add_dns_server (const struct grub_net_network_level_address *s)
-     {
-       int na = dns_servers_alloc * 2;
-       struct grub_net_network_level_address *ns;
-+      grub_size_t sz;
-+
-       if (na < 8)
-        na = 8;
-      ns = grub_realloc (dns_servers, na * sizeof (ns[0]));
-+
-+      if (grub_mul (na, sizeof (ns[0]), &sz))
-+       return GRUB_ERR_OUT_OF_RANGE;
-+
-+      ns = grub_realloc (dns_servers, sz);
-       if (!ns)
-        return grub_errno;
-       dns_servers_alloc = na;
-diff --git a/grub-core/normal/charset.c b/grub-core/normal/charset.c
-index d57fb72..4dfcc31 100644
--- a/grub-core/normal/charset.c
-+++ b/grub-core/normal/charset.c
-@@ -48,6 +48,7 @@
- #include <grub/unicode.h>
- #include <grub/term.h>
- #include <grub/normal.h>
-+#include <grub/safemath.h>
- 
- #if HAVE_FONT_SOURCE
- #include "widthspec.h"
-@@ -464,6 +465,7 @@ grub_unicode_aglomerate_comb (const grub_uint32_t *in, grub_size_t inlen,
-        {
-          struct grub_unicode_combining *n;
-          unsigned j;
-+         grub_size_t sz;
- 
-          if (!haveout)
-            continue;
-@@ -477,10 +479,14 @@ grub_unicode_aglomerate_comb (const grub_uint32_t *in, grub_size_t inlen,
-            n = out->combining_inline;
-          else if (out->ncomb > (int) ARRAY_SIZE (out->combining_inline))
-            {
-             n = grub_realloc (out->combining_ptr,
-                               sizeof (n[0]) * (out->ncomb + 1));
-+             if (grub_add (out->ncomb, 1, &sz) ||
-+                 grub_mul (sz, sizeof (n[0]), &sz))
-+               goto fail;
-+
-+             n = grub_realloc (out->combining_ptr, sz);
-              if (!n)
-                {
-+ fail:
-                  grub_errno = GRUB_ERR_NONE;
-                  continue;
-                }
-diff --git a/grub-core/normal/cmdline.c b/grub-core/normal/cmdline.c
-index c57242e..de03fe6 100644
--- a/grub-core/normal/cmdline.c
-+++ b/grub-core/normal/cmdline.c
-@@ -28,6 +28,7 @@
- #include <grub/env.h>
- #include <grub/i18n.h>
- #include <grub/charset.h>
-+#include <grub/safemath.h>
- 
- static grub_uint32_t *kill_buf;
- 
-@@ -307,12 +308,21 @@ cl_insert (struct cmdline_term *cl_terms, unsigned nterms,
-   if (len + (*llen) >= (*max_len))
-     {
-       grub_uint32_t *nbuf;
-      (*max_len) *= 2;
-      nbuf = grub_realloc ((*buf), sizeof (grub_uint32_t) * (*max_len));
-+      grub_size_t sz;
-+
-+      if (grub_mul (*max_len, 2, max_len) ||
-+         grub_mul (*max_len, sizeof (grub_uint32_t), &sz))
-+       {
-+         grub_errno = GRUB_ERR_OUT_OF_RANGE;
-+         goto fail;
-+       }
-+
-+      nbuf = grub_realloc ((*buf), sz);
-       if (nbuf)
-        (*buf) = nbuf;
-       else
-        {
-+ fail:
-          grub_print_error ();
-          grub_errno = GRUB_ERR_NONE;
-          (*max_len) /= 2;
-diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c
-index 1993995..50eef91 100644
--- a/grub-core/normal/menu_entry.c
-+++ b/grub-core/normal/menu_entry.c
-@@ -27,6 +27,7 @@
- #include <grub/auth.h>
- #include <grub/i18n.h>
- #include <grub/charset.h>
-+#include <grub/safemath.h>
- 
- enum update_mode
-   {
-@@ -113,10 +114,18 @@ ensure_space (struct line *linep, int extra)
- {
-   if (linep->max_len < linep->len + extra)
-     {
-      linep->max_len = 2 * (linep->len + extra);
-      linep->buf = grub_realloc (linep->buf, (linep->max_len + 1) * sizeof (linep->buf[0]));
-+      grub_size_t sz0, sz1;
-+
-+      if (grub_add (linep->len, extra, &sz0) ||
-+         grub_mul (sz0, 2, &sz0) ||
-+         grub_add (sz0, 1, &sz1) ||
-+         grub_mul (sz1, sizeof (linep->buf[0]), &sz1))
-+       return 0;
-+
-+      linep->buf = grub_realloc (linep->buf, sz1);
-       if (! linep->buf)
-        return 0;
-+      linep->max_len = sz0;
-     }
- 
-   return 1;
-diff --git a/grub-core/script/argv.c b/grub-core/script/argv.c
-index 217ec5d..5751fdd 100644
--- a/grub-core/script/argv.c
-+++ b/grub-core/script/argv.c
-@@ -20,6 +20,7 @@
- #include <grub/mm.h>
- #include <grub/misc.h>
- #include <grub/script_sh.h>
-+#include <grub/safemath.h>
- 
- /* Return nearest power of two that is >= v.  */
- static unsigned
-@@ -81,11 +82,16 @@ int
- grub_script_argv_next (struct grub_script_argv *argv)
- {
-   char **p = argv->args;
-+  grub_size_t sz;
- 
-   if (argv->args && argv->argc && argv->args[argv->argc - 1] == 0)
-     return 0;
- 
-  p = grub_realloc (p, round_up_exp ((argv->argc + 2) * sizeof (char *)));
-+  if (grub_add (argv->argc, 2, &sz) ||
-+      grub_mul (sz, sizeof (char *), &sz))
-+    return 1;
-+
-+  p = grub_realloc (p, round_up_exp (sz));
-   if (! p)
-     return 1;
- 
-@@ -105,13 +111,19 @@ grub_script_argv_append (struct grub_script_argv *argv, const char *s,
- {
-   grub_size_t a;
-   char *p = argv->args[argv->argc - 1];
-+  grub_size_t sz;
- 
-   if (! s)
-     return 0;
- 
-   a = p ? grub_strlen (p) : 0;
- 
-  p = grub_realloc (p, round_up_exp ((a + slen + 1) * sizeof (char)));
-+  if (grub_add (a, slen, &sz) ||
-+      grub_add (sz, 1, &sz) ||
-+      grub_mul (sz, sizeof (char), &sz))
-+    return 1;
-+
-+  p = grub_realloc (p, round_up_exp (sz));
-   if (! p)
-     return 1;
- 
-diff --git a/grub-core/script/lexer.c b/grub-core/script/lexer.c
-index c6bd317..5fb0cbd 100644
--- a/grub-core/script/lexer.c
-+++ b/grub-core/script/lexer.c
-@@ -24,6 +24,7 @@
- #include <grub/mm.h>
- #include <grub/script_sh.h>
- #include <grub/i18n.h>
-+#include <grub/safemath.h>
- 
- #define yytext_ptr char *
- #include "grub_script.tab.h"
-@@ -110,10 +111,14 @@ grub_script_lexer_record (struct grub_parser_param *parser, char *str)
-       old = lexer->recording;
-       if (lexer->recordlen < len)
-        lexer->recordlen = len;
-      lexer->recordlen *= 2;
-+
-+      if (grub_mul (lexer->recordlen, 2, &lexer->recordlen))
-+       goto fail;
-+
-       lexer->recording = grub_realloc (lexer->recording, lexer->recordlen);
-       if (!lexer->recording)
-        {
-+ fail:
-          grub_free (old);
-          lexer->recordpos = 0;
-          lexer->recordlen = 0;
-@@ -130,7 +135,7 @@ int
- grub_script_lexer_yywrap (struct grub_parser_param *parserstate,
-                          const char *input)
- {
-  grub_size_t len = 0;
-+  grub_size_t len = 0, sz;
-   char *p = 0;
-   char *line = 0;
-   YY_BUFFER_STATE buffer;
-@@ -168,12 +173,22 @@ grub_script_lexer_yywrap (struct grub_parser_param *parserstate,
-     }
-   else if (len && line[len - 1] != '\n')
-     {
-      p = grub_realloc (line, len + 2);
-+      if (grub_add (len, 2, &sz))
-+       {
-+         grub_free (line);
-+         grub_script_yyerror (parserstate, N_("overflow is detected"));
-+         return 1;
-+       }
-+
-+      p = grub_realloc (line, sz);
-       if (p)
-        {
-          p[len++] = '\n';
-          p[len] = '\0';
-        }
-+      else
-+       grub_free (line);
-+
-       line = p;
-     }
- 
-diff --git a/grub-core/video/bitmap.c b/grub-core/video/bitmap.c
-index b2e0315..6256e20 100644
--- a/grub-core/video/bitmap.c
-+++ b/grub-core/video/bitmap.c
-@@ -23,6 +23,7 @@
- #include <grub/mm.h>
- #include <grub/misc.h>
- #include <grub/i18n.h>
-+#include <grub/safemath.h>
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-@@ -58,7 +59,7 @@ grub_video_bitmap_create (struct grub_video_bitmap **bitmap,
-                           enum grub_video_blit_format blit_format)
- {
-   struct grub_video_mode_info *mode_info;
-  unsigned int size;
-+  grub_size_t size;
- 
-   if (!bitmap)
-     return grub_error (GRUB_ERR_BUG, "invalid argument");
-@@ -137,19 +138,25 @@ grub_video_bitmap_create (struct grub_video_bitmap **bitmap,
- 
-   mode_info->pitch = width * mode_info->bytes_per_pixel;
- 
-  /* Calculate size needed for the data.  */
-  size = (width * mode_info->bytes_per_pixel) * height;
-+  /* Calculate size needed for the data. */
-+  if (grub_mul (width, mode_info->bytes_per_pixel, &size) ||
-+      grub_mul (size, height, &size))
-+    {
-+      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
-+      goto fail;
-+    }
- 
-   (*bitmap)->data = grub_zalloc (size);
-   if (! (*bitmap)->data)
-    {
-      grub_free (*bitmap);
-      *bitmap = 0;
-
-      return grub_errno;
-    }
-+    goto fail;
- 
-   return GRUB_ERR_NONE;
-+
-+ fail:
-+  grub_free (*bitmap);
-+  *bitmap = NULL;
-+
-+  return grub_errno;
- }
- 
- /* Frees all resources allocated by bitmap.  */
-diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c
-index 61bd645..0157ff7 100644
--- a/grub-core/video/readers/png.c
-+++ b/grub-core/video/readers/png.c
-@@ -23,6 +23,7 @@
- #include <grub/mm.h>
- #include <grub/misc.h>
- #include <grub/bufio.h>
-+#include <grub/safemath.h>
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-@@ -301,9 +302,17 @@ grub_png_decode_image_header (struct grub_png_data *data)
-       data->bpp <<= 1;
- 
-   data->color_bits = color_bits;
-  data->row_bytes = data->image_width * data->bpp;
-+
-+  if (grub_mul (data->image_width, data->bpp, &data->row_bytes))
-+    return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
-+
-   if (data->color_bits <= 4)
-    data->row_bytes = (data->image_width * data->color_bits + 7) / 8;
-+    {
-+      if (grub_mul (data->image_width, data->color_bits + 7, &data->row_bytes))
-+       return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
-+
-+      data->row_bytes >>= 3;
-+    }
- 
- #ifndef GRUB_CPU_WORDS_BIGENDIAN
-   if (data->is_16bit || data->is_gray || data->is_palette)
-- 
-2.14.4
diff --git a/meta/recipes-bsp/grub/files/CVE-2020-15706-script-Avoid-a-use-after-free-when-redefining-a-func.patch b/meta/recipes-bsp/grub/files/CVE-2020-15706-script-Avoid-a-use-after-free-when-redefining-a-func.patch
deleted file mode 100644
index 329e554a68..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2020-15706-script-Avoid-a-use-after-free-when-redefining-a-func.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-From c65fc7e75b7b7e880d90766057040011701e97f4 Mon Sep 17 00:00:00 2001
-From: Chris Coulson <chris.coulson@canonical.com>
-Date: Fri, 10 Jul 2020 14:41:45 +0100
-Subject: [PATCH 8/9] script: Avoid a use-after-free when redefining a function
- during execution
-Defining a new function with the same name as a previously defined
-function causes the grub_script and associated resources for the
-previous function to be freed. If the previous function is currently
-executing when a function with the same name is defined, this results
-in use-after-frees when processing subsequent commands in the original
-function.
-Instead, reject a new function definition if it has the same name as
-a previously defined function, and that function is currently being
-executed. Although a behavioural change, this should be backwards
-compatible with existing configurations because they can't be
-dependent on the current behaviour without being broken.
-Fixes: CVE-2020-15706
-Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
-Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
-Upstream-Status: Backport
-CVE: CVE-2020-15706
-Reference to upstream patch:
-https://git.savannah.gnu.org/cgit/grub.git/commit/?id=426f57383d647406ae9c628c472059c27cd6e040
-Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
---
- grub-core/script/execute.c  |  2 ++
- grub-core/script/function.c | 16 +++++++++++++---
- grub-core/script/parser.y   |  3 ++-
- include/grub/script_sh.h    |  2 ++
- 4 files changed, 19 insertions(+), 4 deletions(-)
-diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
-index c8d6806..7e028e1 100644
--- a/grub-core/script/execute.c
-+++ b/grub-core/script/execute.c
-@@ -838,7 +838,9 @@ grub_script_function_call (grub_script_function_t func, int argc, char **args)
-   old_scope = scope;
-   scope = &new_scope;
- 
-+  func->executing++;
-   ret = grub_script_execute (func->func);
-+  func->executing--;
- 
-   function_return = 0;
-   active_loops = loops;
-diff --git a/grub-core/script/function.c b/grub-core/script/function.c
-index d36655e..3aad04b 100644
--- a/grub-core/script/function.c
-+++ b/grub-core/script/function.c
-@@ -34,6 +34,7 @@ grub_script_function_create (struct grub_script_arg *functionname_arg,
-   func = (grub_script_function_t) grub_malloc (sizeof (*func));
-   if (! func)
-     return 0;
-+  func->executing = 0;
- 
-   func->name = grub_strdup (functionname_arg->str);
-   if (! func->name)
-@@ -60,10 +61,19 @@ grub_script_function_create (struct grub_script_arg *functionname_arg,
-       grub_script_function_t q;
- 
-       q = *p;
-      grub_script_free (q->func);
-      q->func = cmd;
-       grub_free (func);
-      func = q;
-+      if (q->executing > 0)
-+        {
-+          grub_error (GRUB_ERR_BAD_ARGUMENT,
-+                     N_("attempt to redefine a function being executed"));
-+          func = NULL;
-+        }
-+      else
-+        {
-+          grub_script_free (q->func);
-+          q->func = cmd;
-+          func = q;
-+        }
-     }
-   else
-     {
-diff --git a/grub-core/script/parser.y b/grub-core/script/parser.y
-index 4f0ab83..f80b86b 100644
--- a/grub-core/script/parser.y
-+++ b/grub-core/script/parser.y
-@@ -289,7 +289,8 @@ function: "function" "name"
-              grub_script_mem_free (state->func_mem);
-            else {
-              script->children = state->scripts;
-             grub_script_function_create ($2, script);
-+             if (!grub_script_function_create ($2, script))
-+               grub_script_free (script);
-            }
- 
-            state->scripts = $<scripts>3;
-diff --git a/include/grub/script_sh.h b/include/grub/script_sh.h
-index b382bcf..6c48e07 100644
--- a/include/grub/script_sh.h
-+++ b/include/grub/script_sh.h
-@@ -361,6 +361,8 @@ struct grub_script_function
- 
-   /* The next element.  */
-   struct grub_script_function *next;
-+
-+  unsigned executing;
- };
- typedef struct grub_script_function *grub_script_function_t;
- 
-- 
-2.14.4
diff --git a/meta/recipes-bsp/grub/files/CVE-2020-15707-linux-Fix-integer-overflows-in-initrd-size-handling.patch b/meta/recipes-bsp/grub/files/CVE-2020-15707-linux-Fix-integer-overflows-in-initrd-size-handling.patch
deleted file mode 100644
index d4f9300c0a..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2020-15707-linux-Fix-integer-overflows-in-initrd-size-handling.patch
+++ /dev/null
@@ -1,177 +0,0 @@
-From 68a09a74f6d726d79709847f3671c0a08e4fb5a0 Mon Sep 17 00:00:00 2001
-From: Colin Watson <cjwatson@debian.org>
-Date: Sat, 25 Jul 2020 12:15:37 +0100
-Subject: [PATCH 9/9] linux: Fix integer overflows in initrd size handling
-These could be triggered by a crafted filesystem with very large files.
-Fixes: CVE-2020-15707
-Signed-off-by: Colin Watson <cjwatson@debian.org>
-Reviewed-by: Jan Setje-Eilers <jan.setjeeilers@oracle.com>
-Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
-Upstream-Status: Backport
-CVE: CVE-2020-15707
-Reference to upstream patch:
-https://git.savannah.gnu.org/cgit/grub.git/commit/?id=e7b8856f8be3292afdb38d2e8c70ad8d62a61e10
-Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
---
- grub-core/loader/linux.c | 74 +++++++++++++++++++++++++++++++++++-------------
- 1 file changed, 54 insertions(+), 20 deletions(-)
-diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c
-index 471b214..8c8565a 100644
--- a/grub-core/loader/linux.c
-+++ b/grub-core/loader/linux.c
-@@ -4,6 +4,7 @@
- #include <grub/misc.h>
- #include <grub/file.h>
- #include <grub/mm.h>
-+#include <grub/safemath.h>
- 
- struct newc_head
- {
-@@ -98,13 +99,13 @@ free_dir (struct dir *root)
-   grub_free (root);
- }
- 
-static grub_size_t
-+static grub_err_t
- insert_dir (const char *name, struct dir **root,
-           grub_uint8_t *ptr)
-+           grub_uint8_t *ptr, grub_size_t *size)
- {
-   struct dir *cur, **head = root;
-   const char *cb, *ce = name;
-  grub_size_t size = 0;
-+  *size = 0;
-   while (1)
-     {
-       for (cb = ce; *cb == '/'; cb++);
-@@ -130,14 +131,22 @@ insert_dir (const char *name, struct dir **root,
-              ptr = make_header (ptr, name, ce - name,
-                                 040777, 0);
-            }
-         size += ALIGN_UP ((ce - (char *) name)
-                           + sizeof (struct newc_head), 4);
-+         if (grub_add (*size,
-+                       ALIGN_UP ((ce - (char *) name)
-+                                 + sizeof (struct newc_head), 4),
-+                       size))
-+           {
-+             grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
-+             grub_free (n->name);
-+             grub_free (n);
-+             return grub_errno;
-+           }
-          *head = n;
-          cur = n;
-        }
-       root = &cur->next;
-     }
-  return size;
-+  return GRUB_ERR_NONE;
- }
- 
- grub_err_t
-@@ -173,26 +182,33 @@ grub_initrd_init (int argc, char *argv[],
-          eptr = grub_strchr (ptr, ':');
-          if (eptr)
-            {
-+             grub_size_t dir_size, name_len;
-+
-              initrd_ctx->components[i].newc_name = grub_strndup (ptr, eptr - ptr);
-             if (!initrd_ctx->components[i].newc_name)
-+             if (!initrd_ctx->components[i].newc_name ||
-+                 insert_dir (initrd_ctx->components[i].newc_name, &root, 0,
-+                             &dir_size))
-                {
-                  grub_initrd_close (initrd_ctx);
-                  return grub_errno;
-                }
-             initrd_ctx->size
-               += ALIGN_UP (sizeof (struct newc_head)
-                           + grub_strlen (initrd_ctx->components[i].newc_name),
-                            4);
-             initrd_ctx->size += insert_dir (initrd_ctx->components[i].newc_name,
-                                             &root, 0);
-+             name_len = grub_strlen (initrd_ctx->components[i].newc_name);
-+             if (grub_add (initrd_ctx->size,
-+                           ALIGN_UP (sizeof (struct newc_head) + name_len, 4),
-+                           &initrd_ctx->size) ||
-+                 grub_add (initrd_ctx->size, dir_size, &initrd_ctx->size))
-+               goto overflow;
-              newc = 1;
-              fname = eptr + 1;
-            }
-        }
-       else if (newc)
-        {
-         initrd_ctx->size += ALIGN_UP (sizeof (struct newc_head)
-                                       + sizeof ("TRAILER!!!") - 1, 4);
-+         if (grub_add (initrd_ctx->size,
-+                       ALIGN_UP (sizeof (struct newc_head)
-+                                 + sizeof ("TRAILER!!!") - 1, 4),
-+                       &initrd_ctx->size))
-+           goto overflow;
-          free_dir (root);
-          root = 0;
-          newc = 0;
-@@ -208,19 +224,29 @@ grub_initrd_init (int argc, char *argv[],
-       initrd_ctx->nfiles++;
-       initrd_ctx->components[i].size
-        = grub_file_size (initrd_ctx->components[i].file);
-      initrd_ctx->size += initrd_ctx->components[i].size;
-+      if (grub_add (initrd_ctx->size, initrd_ctx->components[i].size,
-+                   &initrd_ctx->size))
-+       goto overflow;
-     }
- 
-   if (newc)
-     {
-       initrd_ctx->size = ALIGN_UP (initrd_ctx->size, 4);
-      initrd_ctx->size += ALIGN_UP (sizeof (struct newc_head)
-                                   + sizeof ("TRAILER!!!") - 1, 4);
-+      if (grub_add (initrd_ctx->size,
-+                   ALIGN_UP (sizeof (struct newc_head)
-+                             + sizeof ("TRAILER!!!") - 1, 4),
-+                   &initrd_ctx->size))
-+       goto overflow;
-       free_dir (root);
-       root = 0;
-     }
-   
-   return GRUB_ERR_NONE;
-+
-+ overflow:
-+  free_dir (root);
-+  grub_initrd_close (initrd_ctx);
-+  return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
- }
- 
- grub_size_t
-@@ -261,8 +287,16 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx,
- 
-       if (initrd_ctx->components[i].newc_name)
-        {
-         ptr += insert_dir (initrd_ctx->components[i].newc_name,
-                            &root, ptr);
-+         grub_size_t dir_size;
-+
-+         if (insert_dir (initrd_ctx->components[i].newc_name, &root, ptr,
-+                         &dir_size))
-+           {
-+             free_dir (root);
-+             grub_initrd_close (initrd_ctx);
-+             return grub_errno;
-+           }
-+         ptr += dir_size;
-          ptr = make_header (ptr, initrd_ctx->components[i].newc_name,
-                             grub_strlen (initrd_ctx->components[i].newc_name),
-                             0100777,
-- 
-2.14.4
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45774.patch b/meta/recipes-bsp/grub/files/CVE-2024-45774.patch
new file mode 100644
index 0000000000..55aecc17d7
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45774.patch
@@ -0,0 +1,37 @@
+From 2c34af908ebf4856051ed29e46d88abd2b20387f Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Fri, 8 Mar 2024 22:47:20 +1100
+Subject: [PATCH] video/readers/jpeg: Do not permit duplicate SOF0 markers in
+ JPEG
+Otherwise a subsequent header could change the height and width
+allowing future OOB writes.
+Fixes: CVE-2024-45774
+Reported-by: Nils Langius <nils@langius.de>
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2024-45774
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2c34af908ebf4856051ed29e46d88abd2b20387f]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/video/readers/jpeg.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
+index ae634fd41..631a89356 100644
+--- a/grub-core/video/readers/jpeg.c
+++ b/grub-core/video/readers/jpeg.c
+@@ -339,6 +339,10 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data)
+   if (grub_errno != GRUB_ERR_NONE)
+     return grub_errno;
+ 
+  if (data->image_height != 0 || data->image_width != 0)
+    return grub_error (GRUB_ERR_BAD_FILE_TYPE,
+                      "jpeg: cannot have duplicate SOF0 markers");
+
+   if (grub_jpeg_get_byte (data) != 8)
+     return grub_error (GRUB_ERR_BAD_FILE_TYPE,
+                       "jpeg: only 8-bit precision is supported");
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45775.patch b/meta/recipes-bsp/grub/files/CVE-2024-45775.patch
new file mode 100644
index 0000000000..70492b8c2e
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45775.patch
@@ -0,0 +1,38 @@
+From 05be856a8c3aae41f5df90cab7796ab7ee34b872 Mon Sep 17 00:00:00 2001
+From: Lidong Chen <lidong.chen@oracle.com>
+Date: Fri, 22 Nov 2024 06:27:55 +0000
+Subject: [PATCH] commands/extcmd: Missing check for failed allocation
+The grub_extcmd_dispatcher() calls grub_arg_list_alloc() to allocate
+a grub_arg_list struct but it does not verify the allocation was successful.
+In case of failed allocation the NULL state pointer can be accessed in
+parse_option() through grub_arg_parse() which may lead to a security issue.
+Fixes: CVE-2024-45775
+Reported-by: Nils Langius <nils@langius.de>
+Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
+CVE: CVE-2024-45775
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/commands/extcmd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c
+index 90a5ca24a..c236be13a 100644
+--- a/grub-core/commands/extcmd.c
+++ b/grub-core/commands/extcmd.c
+@@ -49,6 +49,9 @@ grub_extcmd_dispatcher (struct grub_command *cmd, int argc, char **args,
+     }
+ 
+   state = grub_arg_list_alloc (ext, argc, args);
+  if (state == NULL)
+    return grub_errno;
+
+   if (grub_arg_parse (ext, argc, args, state, &new_args, &new_argc))
+     {
+       context.state = state;
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45776.patch b/meta/recipes-bsp/grub/files/CVE-2024-45776.patch
new file mode 100644
index 0000000000..8deea958b8
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45776.patch
@@ -0,0 +1,39 @@
+From 09bd6eb58b0f71ec273916070fa1e2de16897a91 Mon Sep 17 00:00:00 2001
+From: Lidong Chen <lidong.chen@oracle.com>
+Date: Fri, 22 Nov 2024 06:27:56 +0000
+Subject: [PATCH] gettext: Integer overflow leads to heap OOB write or read
+Calculation of ctx->grub_gettext_msg_list size in grub_mofile_open() may
+overflow leading to subsequent OOB write or read. This patch fixes the
+issue by replacing grub_zalloc() and explicit multiplication with
+grub_calloc() which does the same thing in safe manner.
+Fixes: CVE-2024-45776
+Reported-by: Nils Langius <nils@langius.de>
+Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
+CVE: CVE-2024-45776
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/gettext/gettext.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
+index e4f4f8ee6..63bb1ab73 100644
+--- a/grub-core/gettext/gettext.c
+++ b/grub-core/gettext/gettext.c
+@@ -323,8 +323,8 @@ grub_mofile_open (struct grub_gettext_context *ctx,
+   for (ctx->grub_gettext_max_log = 0; ctx->grub_gettext_max >> ctx->grub_gettext_max_log;
+        ctx->grub_gettext_max_log++);
+ 
+-  ctx->grub_gettext_msg_list = grub_zalloc (ctx->grub_gettext_max
+-                                           * sizeof (ctx->grub_gettext_msg_list[0]));
+  ctx->grub_gettext_msg_list = grub_calloc (ctx->grub_gettext_max,
+                                           sizeof (ctx->grub_gettext_msg_list[0]));
+   if (!ctx->grub_gettext_msg_list)
+     {
+       grub_file_close (fd);
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45777.patch b/meta/recipes-bsp/grub/files/CVE-2024-45777.patch
new file mode 100644
index 0000000000..0305a95fd5
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45777.patch
@@ -0,0 +1,57 @@
+From b970a5ed967816bbca8225994cd0ee2557bad515 Mon Sep 17 00:00:00 2001
+From: Lidong Chen <lidong.chen@oracle.com>
+Date: Fri, 22 Nov 2024 06:27:57 +0000
+Subject: [PATCH] gettext: Integer overflow leads to heap OOB write
+The size calculation of the translation buffer in
+grub_gettext_getstr_from_position() may overflow
+to 0 leading to heap OOB write. This patch fixes
+the issue by using grub_add() and checking for
+an overflow.
+Fixes: CVE-2024-45777
+Reported-by: Nils Langius <nils@langius.de>
+Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
+CVE: CVE-2024-45777
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=b970a5ed967816bbca8225994cd0ee2557bad515]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/gettext/gettext.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
+index 63bb1ab73..9ffc73428 100644
+--- a/grub-core/gettext/gettext.c
+++ b/grub-core/gettext/gettext.c
+@@ -26,6 +26,7 @@
+ #include <grub/file.h>
+ #include <grub/kernel.h>
+ #include <grub/i18n.h>
+#include <grub/safemath.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -99,6 +100,7 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx,
+   char *translation;
+   struct string_descriptor desc;
+   grub_err_t err;
+  grub_size_t alloc_sz;
+ 
+   internal_position = (off + position * sizeof (desc));
+ 
+@@ -109,7 +111,10 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx,
+   length = grub_cpu_to_le32 (desc.length);
+   offset = grub_cpu_to_le32 (desc.offset);
+ 
+-  translation = grub_malloc (length + 1);
+  if (grub_add (length, 1, &alloc_sz))
+    return NULL;
+
+  translation = grub_malloc (alloc_sz);
+   if (!translation)
+     return NULL;
+ 
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch b/meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch
new file mode 100644
index 0000000000..eba013897f
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch
@@ -0,0 +1,55 @@
+From 26db6605036bd9e5b16d9068a8cc75be63b8b630 Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Sat, 23 Mar 2024 15:59:43 +1100
+Subject: [PATCH] fs/bfs: Disable under lockdown
+The BFS is not fuzz-clean. Don't allow it to be loaded under lockdown.
+This will also disable the AFS.
+Fixes: CVE-2024-45778
+Fixes: CVE-2024-45779
+Reported-by: Nils Langius <nils@langius.de>
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2024-45778
+CVE: CVE-2024-45779
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/bfs.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c
+index 022f69fe2..78aeb051f 100644
+--- a/grub-core/fs/bfs.c
+++ b/grub-core/fs/bfs.c
+@@ -30,6 +30,7 @@
+ #include <grub/types.h>
+ #include <grub/i18n.h>
+ #include <grub/fshelp.h>
+#include <grub/lockdown.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -1106,7 +1107,10 @@ GRUB_MOD_INIT (bfs)
+ {
+   COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE ==
+                       sizeof (struct grub_bfs_extent));
+-  grub_fs_register (&grub_bfs_fs);
+  if (!grub_is_lockdown ())
+    {
+      grub_fs_register (&grub_bfs_fs);
+    }
+ }
+ 
+ #ifdef MODE_AFS
+@@ -1115,5 +1119,6 @@ GRUB_MOD_FINI (afs)
+ GRUB_MOD_FINI (bfs)
+ #endif
+ {
+-  grub_fs_unregister (&grub_bfs_fs);
+  if (!grub_is_lockdown ())
+    grub_fs_unregister (&grub_bfs_fs);
+ }
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45780.patch b/meta/recipes-bsp/grub/files/CVE-2024-45780.patch
new file mode 100644
index 0000000000..1de0099f94
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45780.patch
@@ -0,0 +1,93 @@
+From 0087bc6902182fe5cedce2d034c75a79cf6dd4f3 Mon Sep 17 00:00:00 2001
+From: Lidong Chen <lidong.chen@oracle.com>
+Date: Fri, 22 Nov 2024 06:27:58 +0000
+Subject: [PATCH] fs/tar: Integer overflow leads to heap OOB write
+Both namesize and linksize are derived from hd.size, a 12-digit octal
+number parsed by read_number(). Later direct arithmetic calculation like
+"namesize + 1" and "linksize + 1" may exceed the maximum value of
+grub_size_t leading to heap OOB write. This patch fixes the issue by
+using grub_add() and checking for an overflow.
+Fixes: CVE-2024-45780
+Reported-by: Nils Langius <nils@langius.de>
+Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
+CVE: CVE-2024-45780
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/tar.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c
+index 646bce5eb..386c09022 100644
+--- a/grub-core/fs/tar.c
+++ b/grub-core/fs/tar.c
+@@ -25,6 +25,7 @@
+ #include <grub/mm.h>
+ #include <grub/dl.h>
+ #include <grub/i18n.h>
+#include <grub/safemath.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -76,6 +77,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
+ {
+   struct head hd;
+   int reread = 0, have_longname = 0, have_longlink = 0;
+  grub_size_t sz;
+ 
+   data->hofs = data->next_hofs;
+ 
+@@ -97,7 +99,11 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
+        {
+          grub_err_t err;
+          grub_size_t namesize = read_number (hd.size, sizeof (hd.size));
+-         *name = grub_malloc (namesize + 1);
+
+         if (grub_add (namesize, 1, &sz))
+           return grub_error (GRUB_ERR_BAD_FS, N_("name size overflow"));
+
+         *name = grub_malloc (sz);
+          if (*name == NULL)
+            return grub_errno;
+          err = grub_disk_read (data->disk, 0,
+@@ -117,15 +123,19 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
+        {
+          grub_err_t err;
+          grub_size_t linksize = read_number (hd.size, sizeof (hd.size));
+-         if (data->linkname_alloc < linksize + 1)
+
+         if (grub_add (linksize, 1, &sz))
+           return grub_error (GRUB_ERR_BAD_FS, N_("link size overflow"));
+
+         if (data->linkname_alloc < sz)
+            {
+              char *n;
+-             n = grub_calloc (2, linksize + 1);
+             n = grub_calloc (2, sz);
+              if (!n)
+                return grub_errno;
+              grub_free (data->linkname);
+              data->linkname = n;
+-             data->linkname_alloc = 2 * (linksize + 1);
+             data->linkname_alloc = 2 * (sz);
+            }
+ 
+          err = grub_disk_read (data->disk, 0,
+@@ -148,7 +158,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
+          while (extra_size < sizeof (hd.prefix)
+                 && hd.prefix[extra_size])
+            extra_size++;
+-         *name = grub_malloc (sizeof (hd.name) + extra_size + 2);
+
+         if (grub_add (sizeof (hd.name) + 2, extra_size, &sz))
+           return grub_error (GRUB_ERR_BAD_FS, N_("long name size overflow"));
+         *name = grub_malloc (sz);
+          if (*name == NULL)
+            return grub_errno;
+          if (hd.prefix[0])
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45781.patch b/meta/recipes-bsp/grub/files/CVE-2024-45781.patch
new file mode 100644
index 0000000000..bd0b6aa04a
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45781.patch
@@ -0,0 +1,35 @@
+From c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Sun, 12 May 2024 02:03:33 +0100
+Subject: [PATCH 2/2] fs/ufs: Fix a heap OOB write
+grub_strcpy() was used to copy a symlink name from the filesystem
+image to a heap allocated buffer. This led to a OOB write to adjacent
+heap allocations. Fix by using grub_strlcpy().
+Fixes: CVE-2024-45781
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2024-45781
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/ufs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c
+index a354c92d9..01235101b 100644
+--- a/grub-core/fs/ufs.c
+++ b/grub-core/fs/ufs.c
+@@ -463,7 +463,7 @@ grub_ufs_lookup_symlink (struct grub_ufs_data *data, int ino)
+   /* Check against zero is paylindromic, no need to swap.  */
+   if (data->inode.nblocks == 0
+       && INODE_SIZE (data) <= sizeof (data->inode.symlink))
+-    grub_strcpy (symlink, (char *) data->inode.symlink);
+    grub_strlcpy (symlink, (char *) data->inode.symlink, sz);
+   else
+     {
+       if (grub_ufs_read_file (data, 0, 0, 0, sz, symlink) < 0)
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch b/meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch
new file mode 100644
index 0000000000..41cc025b81
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch
@@ -0,0 +1,36 @@
+From 417547c10410b714e43f08f74137c24015f8f4c3 Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Sun, 12 May 2024 02:48:33 +0100
+Subject: [PATCH] fs/hfs: Fix stack OOB write with grub_strcpy()
+Replaced with grub_strlcpy().
+Fixes: CVE-2024-45782
+Fixes: CVE-2024-56737
+Fixes: https://savannah.gnu.org/bugs/?66599
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2024-45782
+CVE: CVE-2024-56737
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=417547c10410b714e43f08f74137c24015f8f4c3]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/hfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c
+index 91dc0e69c..920112b03 100644
+--- a/grub-core/fs/hfs.c
+++ b/grub-core/fs/hfs.c
+@@ -379,7 +379,7 @@ grub_hfs_mount (grub_disk_t disk)
+      volume name.  */
+   key.parent_dir = grub_cpu_to_be32_compile_time (1);
+   key.strlen = data->sblock.volname[0];
+-  grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1));
+  grub_strlcpy ((char *) key.str, (char *) (data->sblock.volname + 1), sizeof (key.str));
+ 
+   if (grub_hfs_find_node (data, (char *) &key, data->cat_root,
+                          0, (char *) &dir, sizeof (dir)) == 0)
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45783.patch b/meta/recipes-bsp/grub/files/CVE-2024-45783.patch
new file mode 100644
index 0000000000..99c769961b
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45783.patch
@@ -0,0 +1,39 @@
+From f7c070a2e28dfab7137db0739fb8db1dc02d8898 Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Sun, 12 May 2024 06:22:51 +0100
+Subject: [PATCH] fs/hfsplus: Set a grub_errno if mount fails
+It was possible for mount to fail but not set grub_errno. This led to
+a possible double decrement of the module reference count if the NULL
+page was mapped.
+Fixing in general as a similar bug was fixed in commit 61b13c187
+(fs/hfsplus: Set grub_errno to prevent NULL pointer access) and there
+are likely more variants around.
+Fixes: CVE-2024-45783
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2024-45783
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/hfsplus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c
+index 295822f69..de71fd486 100644
+--- a/grub-core/fs/hfsplus.c
+++ b/grub-core/fs/hfsplus.c
+@@ -405,7 +405,7 @@ grub_hfsplus_mount (grub_disk_t disk)
+ 
+  fail:
+ 
+-  if (grub_errno == GRUB_ERR_OUT_OF_RANGE)
+  if (grub_errno == GRUB_ERR_OUT_OF_RANGE || grub_errno == GRUB_ERR_NONE)
+     grub_error (GRUB_ERR_BAD_FS, "not a HFS+ filesystem");
+ 
+   grub_free (data);
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch b/meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch
new file mode 100644
index 0000000000..09dbfce5f8
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch
@@ -0,0 +1,35 @@
+From 2123c5bca7e21fbeb0263df4597ddd7054700726 Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Fri, 1 Nov 2024 19:24:29 +0000
+Subject: [PATCH 1/3] commands/pgp: Unregister the "check_signatures" hooks on
+ module unload
+If the hooks are not removed they can be called after the module has
+been unloaded leading to an use-after-free.
+Fixes: CVE-2025-0622
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2025-0622
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2123c5bca7e21fbeb0263df4597ddd7054700726]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/commands/pgp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c
+index c6766f044..5fadc33c4 100644
+--- a/grub-core/commands/pgp.c
+++ b/grub-core/commands/pgp.c
+@@ -1010,6 +1010,8 @@ GRUB_MOD_INIT(pgp)
+ 
+ GRUB_MOD_FINI(pgp)
+ {
+  grub_register_variable_hook ("check_signatures", NULL, NULL);
+  grub_env_unset ("check_signatures");
+   grub_verifier_unregister (&grub_pubkey_verifier);
+   grub_unregister_extcmd (cmd);
+   grub_unregister_extcmd (cmd_trust);
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch b/meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch
new file mode 100644
index 0000000000..be01da3355
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch
@@ -0,0 +1,41 @@
+From 9c16197734ada8d0838407eebe081117799bfe67 Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Fri, 1 Nov 2024 23:46:55 +0000
+Subject: [PATCH 2/3] normal: Remove variables hooks on module unload
+The normal module does not entirely cleanup after itself in
+its GRUB_MOD_FINI() leaving a few variables hooks in place.
+It is not possible to unload normal module now but fix the
+issues for completeness.
+On the occasion replace 0s with NULLs for "pager" variable
+hooks unregister.
+Fixes: CVE-2025-0622
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2025-0622
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=9c16197734ada8d0838407eebe081117799bfe67]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/normal/main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
+index 838f57fa5..04d058f55 100644
+--- a/grub-core/normal/main.c
+++ b/grub-core/normal/main.c
+@@ -582,7 +582,9 @@ GRUB_MOD_FINI(normal)
+   grub_xputs = grub_xputs_saved;
+ 
+   grub_set_history (0);
+-  grub_register_variable_hook ("pager", 0, 0);
+  grub_register_variable_hook ("pager", NULL, NULL);
+  grub_register_variable_hook ("color_normal", NULL, NULL);
+  grub_register_variable_hook ("color_highlight", NULL, NULL);
+   grub_fs_autoload_hook = 0;
+   grub_unregister_command (cmd_clear);
+ }
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch b/meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch
new file mode 100644
index 0000000000..79078a4350
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch
@@ -0,0 +1,38 @@
+From 7580addfc8c94cedb0cdfd7a1fd65b539215e637 Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Fri, 1 Nov 2024 23:52:06 +0000
+Subject: [PATCH 3/3] gettext: Remove variables hooks on module unload
+The gettext module does not entirely cleanup after itself in
+its GRUB_MOD_FINI() leaving a few variables hooks in place.
+It is not possible to unload gettext module because normal
+module depends on it. Though fix the issues for completeness.
+Fixes: CVE-2025-0622
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2025-0622
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/gettext/gettext.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
+index 7a1c14e4f..e4f4f8ee6 100644
+--- a/grub-core/gettext/gettext.c
+++ b/grub-core/gettext/gettext.c
+@@ -535,6 +535,10 @@ GRUB_MOD_INIT (gettext)
+ 
+ GRUB_MOD_FINI (gettext)
+ {
+  grub_register_variable_hook ("locale_dir", NULL, NULL);
+  grub_register_variable_hook ("secondary_locale_dir", NULL, NULL);
+  grub_register_variable_hook ("lang", NULL, NULL);
+
+   grub_gettext_delete_list (&main_context);
+   grub_gettext_delete_list (&secondary_context);
+ 
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0624.patch b/meta/recipes-bsp/grub/files/CVE-2025-0624.patch
new file mode 100644
index 0000000000..229fe6399e
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0624.patch
@@ -0,0 +1,84 @@
+From 5eef88152833062a3f7e017535372d64ac8ef7e1 Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Fri, 15 Nov 2024 13:12:09 +0000
+Subject: [PATCH] net: Fix OOB write in grub_net_search_config_file()
+The function included a call to grub_strcpy() which copied data from an
+environment variable to a buffer allocated in grub_cmd_normal(). The
+grub_cmd_normal() didn't consider the length of the environment variable.
+So, the copy operation could exceed the allocation and lead to an OOB
+write. Fix the issue by replacing grub_strcpy() with grub_strlcpy() and
+pass the underlying buffers size to the grub_net_search_config_file().
+Fixes: CVE-2025-0624
+Reported-by: B Horn <b@horn.uk>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2025-0624
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=5eef88152833062a3f7e017535372d64ac8ef7e1]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/net/net.c     | 7 ++++---
+ grub-core/normal/main.c | 2 +-
+ include/grub/net.h      | 2 +-
+ 3 files changed, 6 insertions(+), 5 deletions(-)
+diff --git a/grub-core/net/net.c b/grub-core/net/net.c
+index 0e41e21a5..9939ff601 100644
+--- a/grub-core/net/net.c
+++ b/grub-core/net/net.c
+@@ -1909,14 +1909,15 @@ grub_config_search_through (char *config, char *suffix,
+ }
+ 
+ grub_err_t
+-grub_net_search_config_file (char *config)
+grub_net_search_config_file (char *config, grub_size_t config_buf_len)
+ {
+-  grub_size_t config_len;
+  grub_size_t config_len, suffix_len;
+   char *suffix;
+ 
+   config_len = grub_strlen (config);
+   config[config_len] = '-';
+   suffix = config + config_len + 1;
+  suffix_len = config_buf_len - (config_len + 1);
+ 
+   struct grub_net_network_level_interface *inf;
+   FOR_NET_NETWORK_LEVEL_INTERFACES (inf)
+@@ -1942,7 +1943,7 @@ grub_net_search_config_file (char *config)
+ 
+       if (client_uuid)
+         {
+-          grub_strcpy (suffix, client_uuid);
+          grub_strlcpy (suffix, client_uuid, suffix_len);
+           if (grub_config_search_through (config, suffix, 1, 0) == 0)
+             return GRUB_ERR_NONE;
+         }
+diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
+index 90879dc21..838f57fa5 100644
+--- a/grub-core/normal/main.c
+++ b/grub-core/normal/main.c
+@@ -344,7 +344,7 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)),
+ 
+           if (grub_strncmp (prefix + 1, "tftp", sizeof ("tftp") - 1) == 0 &&
+               !disable_net_search)
+-            grub_net_search_config_file (config);
+            grub_net_search_config_file (config, config_len);
+ 
+          grub_enter_normal_mode (config);
+          grub_free (config);
+diff --git a/include/grub/net.h b/include/grub/net.h
+index 228d04963..58a4f83fc 100644
+--- a/include/grub/net.h
+++ b/include/grub/net.h
+@@ -579,7 +579,7 @@ void
+ grub_net_remove_dns_server (const struct grub_net_network_level_address *s);
+ 
+ grub_err_t
+-grub_net_search_config_file (char *config);
+grub_net_search_config_file (char *config, grub_size_t config_buf_len);
+ 
+ extern char *grub_net_default_server;
+ 
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch b/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch
new file mode 100644
index 0000000000..d5563cecc4
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch
@@ -0,0 +1,377 @@
+From 47b2dfc7953f70f98ddf35dfdd6e7f4f20283b10 Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Sat, 23 Mar 2024 16:20:45 +1100
+Subject: [PATCH] fs: Disable many filesystems under lockdown
+The idea is to permit the following: btrfs, cpio, exfat, ext, f2fs, fat,
+hfsplus, iso9660, squash4, tar, xfs and zfs.
+The JFS, ReiserFS, romfs, UDF and UFS security vulnerabilities were
+reported by Jonathan Bar Or <jonathanbaror@gmail.com>.
+Fixes: CVE-2025-0677
+Fixes: CVE-2025-0684
+Fixes: CVE-2025-0685
+Fixes: CVE-2025-0686
+Fixes: CVE-2025-0689
+Suggested-by: Daniel Axtens <dja@axtens.net>
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2025-0677
+CVE: CVE-2025-0684
+CVE: CVE-2025-0685
+CVE: CVE-2025-0686
+CVE: CVE-2025-0689
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=47b2dfc7953f70f98ddf35dfdd6e7f4f20283b10]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/affs.c     | 9 +++++++--
+ grub-core/fs/cbfs.c     | 9 +++++++--
+ grub-core/fs/jfs.c      | 9 +++++++--
+ grub-core/fs/minix.c    | 9 +++++++--
+ grub-core/fs/nilfs2.c   | 9 +++++++--
+ grub-core/fs/ntfs.c     | 9 +++++++--
+ grub-core/fs/reiserfs.c | 9 +++++++--
+ grub-core/fs/romfs.c    | 9 +++++++--
+ grub-core/fs/sfs.c      | 9 +++++++--
+ grub-core/fs/udf.c      | 9 +++++++--
+ grub-core/fs/ufs.c      | 9 +++++++--
+ 11 files changed, 77 insertions(+), 22 deletions(-)
+diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c
+index ed606b3f1..352f5d232 100644
+--- a/grub-core/fs/affs.c
+++ b/grub-core/fs/affs.c
+@@ -26,6 +26,7 @@
+ #include <grub/types.h>
+ #include <grub/fshelp.h>
+ #include <grub/charset.h>
+#include <grub/lockdown.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -703,11 +704,15 @@ static struct grub_fs grub_affs_fs =
+ 
+ GRUB_MOD_INIT(affs)
+ {
+-  grub_fs_register (&grub_affs_fs);
+  if (!grub_is_lockdown ())
+    {
+      grub_fs_register (&grub_affs_fs);
+    }
+   my_mod = mod;
+ }
+ 
+ GRUB_MOD_FINI(affs)
+ {
+-  grub_fs_unregister (&grub_affs_fs);
+  if (!grub_is_lockdown ())
+    grub_fs_unregister (&grub_affs_fs);
+ }
+diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c
+index 8ab7106af..f6349df34 100644
+--- a/grub-core/fs/cbfs.c
+++ b/grub-core/fs/cbfs.c
+@@ -26,6 +26,7 @@
+ #include <grub/dl.h>
+ #include <grub/i18n.h>
+ #include <grub/cbfs_core.h>
+#include <grub/lockdown.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -390,12 +391,16 @@ GRUB_MOD_INIT (cbfs)
+ #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN)
+   init_cbfsdisk ();
+ #endif
+-  grub_fs_register (&grub_cbfs_fs);
+  if (!grub_is_lockdown ())
+    {
+      grub_fs_register (&grub_cbfs_fs);
+    }
+ }
+ 
+ GRUB_MOD_FINI (cbfs)
+ {
+-  grub_fs_unregister (&grub_cbfs_fs);
+  if (!grub_is_lockdown ())
+    grub_fs_unregister (&grub_cbfs_fs);
+ #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN)
+   fini_cbfsdisk ();
+ #endif
+diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
+index 6f7c43904..c0bbab8a9 100644
+--- a/grub-core/fs/jfs.c
+++ b/grub-core/fs/jfs.c
+@@ -26,6 +26,7 @@
+ #include <grub/types.h>
+ #include <grub/charset.h>
+ #include <grub/i18n.h>
+#include <grub/lockdown.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -963,11 +964,15 @@ static struct grub_fs grub_jfs_fs =
+ 
+ GRUB_MOD_INIT(jfs)
+ {
+-  grub_fs_register (&grub_jfs_fs);
+  if (!grub_is_lockdown ())
+    {
+      grub_fs_register (&grub_jfs_fs);
+    }
+   my_mod = mod;
+ }
+ 
+ GRUB_MOD_FINI(jfs)
+ {
+-  grub_fs_unregister (&grub_jfs_fs);
+  if (!grub_is_lockdown ())
+    grub_fs_unregister (&grub_jfs_fs);
+ }
+diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c
+index 5354951d1..c267298b5 100644
+--- a/grub-core/fs/minix.c
+++ b/grub-core/fs/minix.c
+@@ -25,6 +25,7 @@
+ #include <grub/dl.h>
+ #include <grub/types.h>
+ #include <grub/i18n.h>
+#include <grub/lockdown.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -734,7 +735,10 @@ GRUB_MOD_INIT(minix)
+ #endif
+ #endif
+ {
+-  grub_fs_register (&grub_minix_fs);
+  if (!grub_is_lockdown ())
+    {
+      grub_fs_register (&grub_minix_fs);
+    }
+   my_mod = mod;
+ }
+ 
+@@ -756,5 +760,6 @@ GRUB_MOD_FINI(minix)
+ #endif
+ #endif
+ {
+-  grub_fs_unregister (&grub_minix_fs);
+  if (!grub_is_lockdown ())
+    grub_fs_unregister (&grub_minix_fs);
+ }
+diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c
+index fc7374ead..08abf173f 100644
+--- a/grub-core/fs/nilfs2.c
+++ b/grub-core/fs/nilfs2.c
+@@ -34,6 +34,7 @@
+ #include <grub/dl.h>
+ #include <grub/types.h>
+ #include <grub/fshelp.h>
+#include <grub/lockdown.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -1231,11 +1232,15 @@ GRUB_MOD_INIT (nilfs2)
+                                  grub_nilfs2_dat_entry));
+   COMPILE_TIME_ASSERT (1 << LOG_INODE_SIZE
+                       == sizeof (struct grub_nilfs2_inode));
+-  grub_fs_register (&grub_nilfs2_fs);
+  if (!grub_is_lockdown ())
+    {
+      grub_fs_register (&grub_nilfs2_fs);
+    }
+   my_mod = mod;
+ }
+ 
+ GRUB_MOD_FINI (nilfs2)
+ {
+-  grub_fs_unregister (&grub_nilfs2_fs);
+  if (!grub_is_lockdown ())
+    grub_fs_unregister (&grub_nilfs2_fs);
+ }
+diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
+index de435aa14..8cc2ba3d5 100644
+--- a/grub-core/fs/ntfs.c
+++ b/grub-core/fs/ntfs.c
+@@ -27,6 +27,7 @@
+ #include <grub/fshelp.h>
+ #include <grub/ntfs.h>
+ #include <grub/charset.h>
+#include <grub/lockdown.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -1320,11 +1321,15 @@ static struct grub_fs grub_ntfs_fs =
+ 
+ GRUB_MOD_INIT (ntfs)
+ {
+-  grub_fs_register (&grub_ntfs_fs);
+  if (!grub_is_lockdown ())
+    {
+      grub_fs_register (&grub_ntfs_fs);
+    }
+   my_mod = mod;
+ }
+ 
+ GRUB_MOD_FINI (ntfs)
+ {
+-  grub_fs_unregister (&grub_ntfs_fs);
+  if (!grub_is_lockdown ())
+    grub_fs_unregister (&grub_ntfs_fs);
+ }
+diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c
+index 36b26ac98..cdef2eba0 100644
+--- a/grub-core/fs/reiserfs.c
+++ b/grub-core/fs/reiserfs.c
+@@ -39,6 +39,7 @@
+ #include <grub/types.h>
+ #include <grub/fshelp.h>
+ #include <grub/i18n.h>
+#include <grub/lockdown.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -1417,11 +1418,15 @@ static struct grub_fs grub_reiserfs_fs =
+ 
+ GRUB_MOD_INIT(reiserfs)
+ {
+-  grub_fs_register (&grub_reiserfs_fs);
+  if (!grub_is_lockdown ())
+    {
+      grub_fs_register (&grub_reiserfs_fs);
+    }
+   my_mod = mod;
+ }
+ 
+ GRUB_MOD_FINI(reiserfs)
+ {
+-  grub_fs_unregister (&grub_reiserfs_fs);
+  if (!grub_is_lockdown ())
+    grub_fs_unregister (&grub_reiserfs_fs);
+ }
+diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c
+index 1f7dcfca1..acf8dd21e 100644
+--- a/grub-core/fs/romfs.c
+++ b/grub-core/fs/romfs.c
+@@ -23,6 +23,7 @@
+ #include <grub/disk.h>
+ #include <grub/fs.h>
+ #include <grub/fshelp.h>
+#include <grub/lockdown.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -475,10 +476,14 @@ static struct grub_fs grub_romfs_fs =
+ 
+ GRUB_MOD_INIT(romfs)
+ {
+-  grub_fs_register (&grub_romfs_fs);
+  if (!grub_is_lockdown ())
+    {
+      grub_fs_register (&grub_romfs_fs);
+    }
+ }
+ 
+ GRUB_MOD_FINI(romfs)
+ {
+-  grub_fs_unregister (&grub_romfs_fs);
+  if (!grub_is_lockdown ())
+    grub_fs_unregister (&grub_romfs_fs);
+ }
+diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c
+index 983e88008..f64bdd2df 100644
+--- a/grub-core/fs/sfs.c
+++ b/grub-core/fs/sfs.c
+@@ -26,6 +26,7 @@
+ #include <grub/types.h>
+ #include <grub/fshelp.h>
+ #include <grub/charset.h>
+#include <grub/lockdown.h>
+ #include <grub/safemath.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+@@ -779,11 +780,15 @@ static struct grub_fs grub_sfs_fs =
+ 
+ GRUB_MOD_INIT(sfs)
+ {
+-  grub_fs_register (&grub_sfs_fs);
+  if (!grub_is_lockdown ())
+    {
+      grub_fs_register (&grub_sfs_fs);
+    }
+   my_mod = mod;
+ }
+ 
+ GRUB_MOD_FINI(sfs)
+ {
+-  grub_fs_unregister (&grub_sfs_fs);
+  if (!grub_is_lockdown ())
+    grub_fs_unregister (&grub_sfs_fs);
+ }
+diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
+index b836e6107..a60643be1 100644
+--- a/grub-core/fs/udf.c
+++ b/grub-core/fs/udf.c
+@@ -27,6 +27,7 @@
+ #include <grub/fshelp.h>
+ #include <grub/charset.h>
+ #include <grub/datetime.h>
+#include <grub/lockdown.h>
+ #include <grub/udf.h>
+ #include <grub/safemath.h>
+ 
+@@ -1455,11 +1456,15 @@ static struct grub_fs grub_udf_fs = {
+ 
+ GRUB_MOD_INIT (udf)
+ {
+-  grub_fs_register (&grub_udf_fs);
+  if (!grub_is_lockdown ())
+    {
+      grub_fs_register (&grub_udf_fs);
+    }
+   my_mod = mod;
+ }
+ 
+ GRUB_MOD_FINI (udf)
+ {
+-  grub_fs_unregister (&grub_udf_fs);
+  if (!grub_is_lockdown ())
+    grub_fs_unregister (&grub_udf_fs);
+ }
+diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c
+index 01235101b..6b496e7b8 100644
+--- a/grub-core/fs/ufs.c
+++ b/grub-core/fs/ufs.c
+@@ -25,6 +25,7 @@
+ #include <grub/dl.h>
+ #include <grub/types.h>
+ #include <grub/i18n.h>
+#include <grub/lockdown.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -899,7 +900,10 @@ GRUB_MOD_INIT(ufs1)
+ #endif
+ #endif
+ {
+-  grub_fs_register (&grub_ufs_fs);
+  if (!grub_is_lockdown ())
+    {
+      grub_fs_register (&grub_ufs_fs);
+    }
+   my_mod = mod;
+ }
+ 
+@@ -913,6 +917,7 @@ GRUB_MOD_FINI(ufs1)
+ #endif
+ #endif
+ {
+-  grub_fs_unregister (&grub_ufs_fs);
+  if (!grub_is_lockdown ())
+    grub_fs_unregister (&grub_ufs_fs);
+ }
+ 
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch b/meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch
new file mode 100644
index 0000000000..14e67cf35b
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch
@@ -0,0 +1,87 @@
+From 84bc0a9a68835952ae69165c11709811dae7634e Mon Sep 17 00:00:00 2001
+From: Lidong Chen <lidong.chen@oracle.com>
+Date: Tue, 21 Jan 2025 19:02:37 +0000
+Subject: [PATCH] fs: Prevent overflows when allocating memory for arrays
+Use grub_calloc() when allocating memory for arrays to ensure proper
+overflow checks are in place.
+The HFS+ and squash4 security vulnerabilities were reported by
+Jonathan Bar Or <jonathanbaror@gmail.com>.
+Fixes: CVE-2025-0678
+Fixes: CVE-2025-1125
+Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2025-0678
+CVE: CVE-2025-1125
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=84bc0a9a68835952ae69165c11709811dae7634e]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/fs/btrfs.c       | 4 ++--
+ grub-core/fs/hfspluscomp.c | 9 +++++++--
+ grub-core/fs/squash4.c     | 8 ++++----
+ 3 files changed, 13 insertions(+), 8 deletions(-)
+diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
+index 0625b1166..9c1e925c9 100644
+--- a/grub-core/fs/btrfs.c
+++ b/grub-core/fs/btrfs.c
+@@ -1276,8 +1276,8 @@ grub_btrfs_mount (grub_device_t dev)
+     }
+ 
+   data->n_devices_allocated = 16;
+-  data->devices_attached = grub_malloc (sizeof (data->devices_attached[0])
+-                                       * data->n_devices_allocated);
+  data->devices_attached = grub_calloc (data->n_devices_allocated,
+                                       sizeof (data->devices_attached[0]));
+   if (!data->devices_attached)
+     {
+       grub_free (data);
+diff --git a/grub-core/fs/hfspluscomp.c b/grub-core/fs/hfspluscomp.c
+index 48ae438d8..a80954ee6 100644
+--- a/grub-core/fs/hfspluscomp.c
+++ b/grub-core/fs/hfspluscomp.c
+@@ -244,14 +244,19 @@ hfsplus_open_compressed_real (struct grub_hfsplus_file *node)
+          return 0;
+        }
+       node->compress_index_size = grub_le_to_cpu32 (index_size);
+-      node->compress_index = grub_malloc (node->compress_index_size
+-                                         * sizeof (node->compress_index[0]));
+      node->compress_index = grub_calloc (node->compress_index_size,
+                                         sizeof (node->compress_index[0]));
+       if (!node->compress_index)
+        {
+          node->compressed = 0;
+          grub_free (attr_node);
+          return grub_errno;
+        }
+
+      /*
+       * The node->compress_index_size * sizeof (node->compress_index[0]) is safe here
+       * due to relevant checks done in grub_calloc() above.
+       */
+       if (grub_hfsplus_read_file (node, 0, 0,
+                                  0x104 + sizeof (index_size),
+                                  node->compress_index_size
+diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c
+index f91ff3bfa..cf2bca822 100644
+--- a/grub-core/fs/squash4.c
+++ b/grub-core/fs/squash4.c
+@@ -816,10 +816,10 @@ direct_read (struct grub_squash_data *data,
+          break;
+        }
+       total_blocks = ((total_size + data->blksz - 1) >> data->log2_blksz);
+-      ino->block_sizes = grub_malloc (total_blocks
+-                                     * sizeof (ino->block_sizes[0]));
+-      ino->cumulated_block_sizes = grub_malloc (total_blocks
+-                                               * sizeof (ino->cumulated_block_sizes[0]));
+      ino->block_sizes = grub_calloc (total_blocks,
+                                     sizeof (ino->block_sizes[0]));
+      ino->cumulated_block_sizes = grub_calloc (total_blocks,
+                                               sizeof (ino->cumulated_block_sizes[0]));
+       if (!ino->block_sizes || !ino->cumulated_block_sizes)
+        {
+          grub_free (ino->block_sizes);
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0690.patch b/meta/recipes-bsp/grub/files/CVE-2025-0690.patch
new file mode 100644
index 0000000000..be585c96ad
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0690.patch
@@ -0,0 +1,73 @@
+From dad8f502974ed9ad0a70ae6820d17b4b142558fc Mon Sep 17 00:00:00 2001
+From: Jonathan Bar Or <jonathanbaror@gmail.com>
+Date: Thu, 23 Jan 2025 19:17:05 +0100
+Subject: [PATCH] commands/read: Fix an integer overflow when supplying more
+ than 2^31 characters
+The grub_getline() function currently has a signed integer variable "i"
+that can be overflown when user supplies more than 2^31 characters.
+It results in a memory corruption of the allocated line buffer as well
+as supplying large negative values to grub_realloc().
+Fixes: CVE-2025-0690
+Reported-by: Jonathan Bar Or <jonathanbaror@gmail.com>
+Signed-off-by: Jonathan Bar Or <jonathanbaror@gmail.com>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2025-0690
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/commands/read.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+diff --git a/grub-core/commands/read.c b/grub-core/commands/read.c
+index 597c90706..8d72e45c9 100644
+--- a/grub-core/commands/read.c
+++ b/grub-core/commands/read.c
+@@ -25,6 +25,7 @@
+ #include <grub/types.h>
+ #include <grub/extcmd.h>
+ #include <grub/i18n.h>
+#include <grub/safemath.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+ 
+@@ -37,13 +38,14 @@ static const struct grub_arg_option options[] =
+ static char *
+ grub_getline (int silent)
+ {
+-  int i;
+  grub_size_t i;
+   char *line;
+   char *tmp;
+   int c;
+  grub_size_t alloc_size;
+ 
+   i = 0;
+-  line = grub_malloc (1 + i + sizeof('\0'));
+  line = grub_malloc (1 + sizeof('\0'));
+   if (! line)
+     return NULL;
+ 
+@@ -59,8 +61,17 @@ grub_getline (int silent)
+       line[i] = (char) c;
+       if (!silent)
+        grub_printf ("%c", c);
+-      i++;
+-      tmp = grub_realloc (line, 1 + i + sizeof('\0'));
+      if (grub_add (i, 1, &i))
+        {
+          grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
+          return NULL;
+        }
+      if (grub_add (i, 1 + sizeof('\0'), &alloc_size))
+        {
+          grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
+          return NULL;
+        }
+      tmp = grub_realloc (line, alloc_size);
+       if (! tmp)
+        {
+          grub_free (line);
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-1118.patch b/meta/recipes-bsp/grub/files/CVE-2025-1118.patch
new file mode 100644
index 0000000000..e6906d909c
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-1118.patch
@@ -0,0 +1,37 @@
+From 34824806ac6302f91e8cabaa41308eaced25725f Mon Sep 17 00:00:00 2001
+From: B Horn <b@horn.uk>
+Date: Thu, 18 Apr 2024 20:29:39 +0100
+Subject: [PATCH] commands/minicmd: Block the dump command in lockdown mode
+The dump enables a user to read memory which should not be possible
+in lockdown mode.
+Fixes: CVE-2025-1118
+Reported-by: B Horn <b@horn.uk>
+Reported-by: Jonathan Bar Or <jonathanbaror@gmail.com>
+Signed-off-by: B Horn <b@horn.uk>
+Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
+CVE: CVE-2025-1118
+Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=34824806ac6302f91e8cabaa41308eaced25725f]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ grub-core/commands/minicmd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c
+index 286290866..8c5ee3e60 100644
+--- a/grub-core/commands/minicmd.c
+++ b/grub-core/commands/minicmd.c
+@@ -203,8 +203,8 @@ GRUB_MOD_INIT(minicmd)
+     grub_register_command ("help", grub_mini_cmd_help,
+                           0, N_("Show this message."));
+   cmd_dump =
+-    grub_register_command ("dump", grub_mini_cmd_dump,
+-                          N_("ADDR [SIZE]"), N_("Show memory contents."));
+    grub_register_command_lockdown ("dump", grub_mini_cmd_dump,
+                                   N_("ADDR [SIZE]"), N_("Show memory contents."));
+   cmd_rmmod =
+     grub_register_command ("rmmod", grub_mini_cmd_rmmod,
+                           N_("MODULE"), N_("Remove a module."));
diff --git a/meta/recipes-bsp/grub/files/autogen.sh-exclude-pc.patch b/meta/recipes-bsp/grub/files/autogen.sh-exclude-pc.patch
index faa7fde232..f8dfda90ab 100644
--- a/meta/recipes-bsp/grub/files/autogen.sh-exclude-pc.patch
+++ b/meta/recipes-bsp/grub/files/autogen.sh-exclude-pc.patch
@@ -1,6 +1,6 @@
-From 72c30928d3d461e0e2d20c5ff33bd96b6991d585 Mon Sep 17 00:00:00 2001
+From 14c1d0459fb3561e627d3a5f6e91a0d2f7b4aa45 Mon Sep 17 00:00:00 2001
-From: Robert Yang <liezhi.yang@windriver.com>
+From: Naveen Saini <naveen.kumar.saini@intel.com>
-Date: Sat, 25 Jan 2014 23:49:44 -0500
+Date: Mon, 15 Mar 2021 14:44:15 +0800
 Subject: [PATCH] autogen.sh: exclude .pc from po/POTFILES.in
 Exclude the .pc from po/POTFILES.in since quilt uses "patch --backup",
@@ -13,23 +13,22 @@ Upstream-Status: Inappropriate [OE specific]
 Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
 Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
+Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
 ---
 autogen.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/autogen.sh b/autogen.sh
-index ef43270..a7067a7 100755
+index 195daa5..773b7b4 100755
 --- a/autogen.sh
 +++ b/autogen.sh
-@@ -13,7 +13,7 @@ fi
+@@ -26,7 +26,7 @@ fi
 export LC_COLLATE=C
 unset LC_ALL
 
-find . -iname '*.[ch]' ! -ipath './grub-core/lib/libgcrypt-grub/*' ! -ipath './build-aux/*' ! -ipath './grub-core/lib/libgcrypt/src/misc.c' ! -ipath './grub-core/lib/libgcrypt/src/global.c' ! -ipath './grub-core/lib/libgcrypt/src/secmem.c'  ! -ipath './util/grub-gen-widthspec.c' ! -ipath './util/grub-gen-asciih.c' ! -ipath './gnulib/*' ! -iname './grub-core/lib/gnulib/*' |sort > po/POTFILES.in
+-find . -iname '*.[ch]' ! -ipath './grub-core/lib/libgcrypt-grub/*' ! -ipath './build-aux/*' ! -ipath './grub-core/lib/libgcrypt/src/misc.c' ! -ipath './grub-core/lib/libgcrypt/src/global.c' ! -ipath './grub-core/lib/libgcrypt/src/secmem.c'  ! -ipath './util/grub-gen-widthspec.c' ! -ipath './util/grub-gen-asciih.c' ! -ipath './gnulib/*' ! -ipath './grub-core/lib/gnulib/*' |sort > po/POTFILES.in
-+find . -iname '*.[ch]' ! -ipath './grub-core/lib/libgcrypt-grub/*' ! -ipath './build-aux/*' ! -ipath './grub-core/lib/libgcrypt/src/misc.c' ! -ipath './grub-core/lib/libgcrypt/src/global.c' ! -ipath './grub-core/lib/libgcrypt/src/secmem.c'  ! -ipath './util/grub-gen-widthspec.c' ! -ipath './util/grub-gen-asciih.c' ! -ipath './gnulib/*' ! -iname './grub-core/lib/gnulib/*' ! -path './.pc/*' |sort > po/POTFILES.in
+find . -iname '*.[ch]' ! -ipath './grub-core/lib/libgcrypt-grub/*' ! -ipath './build-aux/*' ! -ipath './grub-core/lib/libgcrypt/src/misc.c' ! -ipath './grub-core/lib/libgcrypt/src/global.c' ! -ipath './grub-core/lib/libgcrypt/src/secmem.c'  ! -ipath './util/grub-gen-widthspec.c' ! -ipath './util/grub-gen-asciih.c' ! -ipath './gnulib/*' ! -ipath './grub-core/lib/gnulib/*' ! -path './.pc/*' |sort > po/POTFILES.in
 find util -iname '*.in' ! -name Makefile.in  |sort > po/POTFILES-shell.in
 
 echo "Importing unicode..."
-- 
-2.7.4
diff --git a/meta/recipes-bsp/grub/files/calloc-Make-sure-we-always-have-an-overflow-checking.patch b/meta/recipes-bsp/grub/files/calloc-Make-sure-we-always-have-an-overflow-checking.patch
deleted file mode 100644
index c9536e68ef..0000000000
--- a/meta/recipes-bsp/grub/files/calloc-Make-sure-we-always-have-an-overflow-checking.patch
+++ /dev/null
@@ -1,246 +0,0 @@
-From c005f62f5c4b26a77b916c8f76a852324439ecb3 Mon Sep 17 00:00:00 2001
-From: Peter Jones <pjones@redhat.com>
-Date: Mon, 15 Jun 2020 12:15:29 -0400
-Subject: [PATCH 2/9] calloc: Make sure we always have an overflow-checking
- calloc() available
-This tries to make sure that everywhere in this source tree, we always have
-an appropriate version of calloc() (i.e. grub_calloc(), xcalloc(), etc.)
-available, and that they all safely check for overflow and return NULL when
-it would occur.
-Upstream-Status: Backport [commit 64e26162ebfe68317c143ca5ec996c892019f8f8
-from https://git.savannah.gnu.org/git/grub.git]
-Signed-off-by: Peter Jones <pjones@redhat.com>
-Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
-Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
---
- grub-core/kern/emu/misc.c          | 12 ++++++++++++
- grub-core/kern/emu/mm.c            | 10 ++++++++++
- grub-core/kern/mm.c                | 40 ++++++++++++++++++++++++++++++++++++++
- grub-core/lib/libgcrypt_wrap/mem.c | 11 +++++++++--
- grub-core/lib/posix_wrap/stdlib.h  |  8 +++++++-
- include/grub/emu/misc.h            |  1 +
- include/grub/mm.h                  |  6 ++++++
- 7 files changed, 85 insertions(+), 3 deletions(-)
-diff --git a/grub-core/kern/emu/misc.c b/grub-core/kern/emu/misc.c
-index 65db79b..dfd8a8e 100644
--- a/grub-core/kern/emu/misc.c
-+++ b/grub-core/kern/emu/misc.c
-@@ -85,6 +85,18 @@ grub_util_error (const char *fmt, ...)
-   exit (1);
- }
- 
-+void *
-+xcalloc (grub_size_t nmemb, grub_size_t size)
-+{
-+  void *p;
-+
-+  p = calloc (nmemb, size);
-+  if (!p)
-+    grub_util_error ("%s", _("out of memory"));
-+
-+  return p;
-+}
-+
- void *
- xmalloc (grub_size_t size)
- {
-diff --git a/grub-core/kern/emu/mm.c b/grub-core/kern/emu/mm.c
-index f262e95..145b01d 100644
--- a/grub-core/kern/emu/mm.c
-+++ b/grub-core/kern/emu/mm.c
-@@ -25,6 +25,16 @@
- #include <string.h>
- #include <grub/i18n.h>
- 
-+void *
-+grub_calloc (grub_size_t nmemb, grub_size_t size)
-+{
-+  void *ret;
-+  ret = calloc (nmemb, size);
-+  if (!ret)
-+    grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory"));
-+  return ret;
-+}
-+
- void *
- grub_malloc (grub_size_t size)
- {
-diff --git a/grub-core/kern/mm.c b/grub-core/kern/mm.c
-index ee88ff6..f2822a8 100644
--- a/grub-core/kern/mm.c
-+++ b/grub-core/kern/mm.c
-@@ -67,8 +67,10 @@
- #include <grub/dl.h>
- #include <grub/i18n.h>
- #include <grub/mm_private.h>
-+#include <grub/safemath.h>
- 
- #ifdef MM_DEBUG
-+# undef grub_calloc
- # undef grub_malloc
- # undef grub_zalloc
- # undef grub_realloc
-@@ -375,6 +377,30 @@ grub_memalign (grub_size_t align, grub_size_t size)
-   return 0;
- }
- 
-+/*
-+ * Allocate NMEMB instances of SIZE bytes and return the pointer, or error on
-+ * integer overflow.
-+ */
-+void *
-+grub_calloc (grub_size_t nmemb, grub_size_t size)
-+{
-+  void *ret;
-+  grub_size_t sz = 0;
-+
-+  if (grub_mul (nmemb, size, &sz))
-+    {
-+      grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
-+      return NULL;
-+    }
-+
-+  ret = grub_memalign (0, sz);
-+  if (!ret)
-+    return NULL;
-+
-+  grub_memset (ret, 0, sz);
-+  return ret;
-+}
-+
- /* Allocate SIZE bytes and return the pointer.  */
- void *
- grub_malloc (grub_size_t size)
-@@ -561,6 +587,20 @@ grub_mm_dump (unsigned lineno)
-   grub_printf ("\n");
- }
- 
-+void *
-+grub_debug_calloc (const char *file, int line, grub_size_t nmemb, grub_size_t size)
-+{
-+  void *ptr;
-+
-+  if (grub_mm_debug)
-+    grub_printf ("%s:%d: calloc (0x%" PRIxGRUB_SIZE ", 0x%" PRIxGRUB_SIZE ") = ",
-+                file, line, size);
-+  ptr = grub_calloc (nmemb, size);
-+  if (grub_mm_debug)
-+    grub_printf ("%p\n", ptr);
-+  return ptr;
-+}
-+
- void *
- grub_debug_malloc (const char *file, int line, grub_size_t size)
- {
-diff --git a/grub-core/lib/libgcrypt_wrap/mem.c b/grub-core/lib/libgcrypt_wrap/mem.c
-index beeb661..74c6eaf 100644
--- a/grub-core/lib/libgcrypt_wrap/mem.c
-+++ b/grub-core/lib/libgcrypt_wrap/mem.c
-@@ -4,6 +4,7 @@
- #include <grub/crypto.h>
- #include <grub/dl.h>
- #include <grub/env.h>
-+#include <grub/safemath.h>
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-@@ -36,7 +37,10 @@ void *
- gcry_xcalloc (size_t n, size_t m)
- {
-   void *ret;
-  ret = grub_zalloc (n * m);
-+  size_t sz;
-+  if (grub_mul (n, m, &sz))
-+    grub_fatal ("gcry_xcalloc would overflow");
-+  ret = grub_zalloc (sz);
-   if (!ret)
-     grub_fatal ("gcry_xcalloc failed");
-   return ret;
-@@ -56,7 +60,10 @@ void *
- gcry_xcalloc_secure (size_t n, size_t m)
- {
-   void *ret;
-  ret = grub_zalloc (n * m);
-+  size_t sz;
-+  if (grub_mul (n, m, &sz))
-+    grub_fatal ("gcry_xcalloc would overflow");
-+  ret = grub_zalloc (sz);
-   if (!ret)
-     grub_fatal ("gcry_xcalloc failed");
-   return ret;
-diff --git a/grub-core/lib/posix_wrap/stdlib.h b/grub-core/lib/posix_wrap/stdlib.h
-index 3b46f47..7a8d385 100644
--- a/grub-core/lib/posix_wrap/stdlib.h
-+++ b/grub-core/lib/posix_wrap/stdlib.h
-@@ -21,6 +21,7 @@
- 
- #include <grub/mm.h>
- #include <grub/misc.h>
-+#include <grub/safemath.h>
- 
- static inline void 
- free (void *ptr)
-@@ -37,7 +38,12 @@ malloc (grub_size_t size)
- static inline void *
- calloc (grub_size_t size, grub_size_t nelem)
- {
-  return grub_zalloc (size * nelem);
-+  grub_size_t sz;
-+
-+  if (grub_mul (size, nelem, &sz))
-+    return NULL;
-+
-+  return grub_zalloc (sz);
- }
- 
- static inline void *
-diff --git a/include/grub/emu/misc.h b/include/grub/emu/misc.h
-index ce464cf..ff9c48a 100644
--- a/include/grub/emu/misc.h
-+++ b/include/grub/emu/misc.h
-@@ -47,6 +47,7 @@ grub_util_device_is_mapped (const char *dev);
- #define GRUB_HOST_PRIuLONG_LONG "llu"
- #define GRUB_HOST_PRIxLONG_LONG "llx"
- 
-+void * EXPORT_FUNC(xcalloc) (grub_size_t nmemb, grub_size_t size) WARN_UNUSED_RESULT;
- void * EXPORT_FUNC(xmalloc) (grub_size_t size) WARN_UNUSED_RESULT;
- void * EXPORT_FUNC(xrealloc) (void *ptr, grub_size_t size) WARN_UNUSED_RESULT;
- char * EXPORT_FUNC(xstrdup) (const char *str) WARN_UNUSED_RESULT;
-diff --git a/include/grub/mm.h b/include/grub/mm.h
-index 28e2e53..9c38dd3 100644
--- a/include/grub/mm.h
-+++ b/include/grub/mm.h
-@@ -29,6 +29,7 @@
- #endif
- 
- void grub_mm_init_region (void *addr, grub_size_t size);
-+void *EXPORT_FUNC(grub_calloc) (grub_size_t nmemb, grub_size_t size);
- void *EXPORT_FUNC(grub_malloc) (grub_size_t size);
- void *EXPORT_FUNC(grub_zalloc) (grub_size_t size);
- void EXPORT_FUNC(grub_free) (void *ptr);
-@@ -48,6 +49,9 @@ extern int EXPORT_VAR(grub_mm_debug);
- void grub_mm_dump_free (void);
- void grub_mm_dump (unsigned lineno);
- 
-+#define grub_calloc(nmemb, size)       \
-+  grub_debug_calloc (GRUB_FILE, __LINE__, nmemb, size)
-+
- #define grub_malloc(size)      \
-   grub_debug_malloc (GRUB_FILE, __LINE__, size)
- 
-@@ -63,6 +67,8 @@ void grub_mm_dump (unsigned lineno);
- #define grub_free(ptr) \
-   grub_debug_free (GRUB_FILE, __LINE__, ptr)
- 
-+void *EXPORT_FUNC(grub_debug_calloc) (const char *file, int line,
-+                                     grub_size_t nmemb, grub_size_t size);
- void *EXPORT_FUNC(grub_debug_malloc) (const char *file, int line,
-                                      grub_size_t size);
- void *EXPORT_FUNC(grub_debug_zalloc) (const char *file, int line,
-- 
-2.14.4
diff --git a/meta/recipes-bsp/grub/files/determinism.patch b/meta/recipes-bsp/grub/files/determinism.patch
deleted file mode 100644
index 3c1f562c71..0000000000
--- a/meta/recipes-bsp/grub/files/determinism.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-The output in moddep.lst generated from syminfo.lst using genmoddep.awk is
-not deterministic since the order of the dependencies on each line can vary
-depending on how awk sorts the values in the array.
-Be deterministic in the output by sorting the dependencies on each line.
-Also, the output of the SOURCES lines in grub-core/Makefile.core.am, generated
-from grub-core/Makefile.core.def with gentpl.py is not deterministic due to
-missing sorting of the list used to generate it. Add such a sort.
-Also ensure the generated unidata.c file is deterministic by sorting the
-keys of the dict.
-Upstream-Status: Pending
-Richard Purdie <richard.purdie@linuxfoundation.org>
-Index: grub-2.04/grub-core/genmoddep.awk
-===================================================================
--- grub-2.04.orig/grub-core/genmoddep.awk
-+++ grub-2.04/grub-core/genmoddep.awk
-@@ -59,7 +59,9 @@ END {
-     }
-     modlist = ""
-     depcount[mod] = 0
-    for (depmod in uniqmods) {
-+    n = asorti(uniqmods, w)
-+    for (i = 1; i <= n; i++) {
-+      depmod = w[i]
-       modlist = modlist " " depmod;
-       inverse_dependencies[depmod] = inverse_dependencies[depmod] " " mod
-       depcount[mod]++
-Index: grub-2.04/gentpl.py
-===================================================================
--- grub-2.04.orig/gentpl.py
-+++ grub-2.04/gentpl.py
-@@ -568,6 +568,7 @@ def foreach_platform_value(defn, platfor
-     for group in RMAP[platform]:
-         for value in defn.find_all(group + suffix):
-             r.append(closure(value))
-+    r.sort()
-     return ''.join(r)
- 
- def platform_conditional(platform, closure):
-Index: grub-2.04/util/import_unicode.py
-===================================================================
--- grub-2.04.orig/util/import_unicode.py
-+++ grub-2.04/util/import_unicode.py
-@@ -174,7 +174,7 @@ infile.close ()
- 
- outfile.write ("struct grub_unicode_arabic_shape grub_unicode_arabic_shapes[] = {\n ")
- 
-for x in arabicsubst:
-+for x in sorted(arabicsubst):
-     try:
-         if arabicsubst[x]['join'] == "DUAL":
-             outfile.write ("{0x%x, 0x%x, 0x%x, 0x%x, 0x%x},\n " % (arabicsubst[x][0], arabicsubst[x][1], arabicsubst[x][2], arabicsubst[x][3], arabicsubst[x][4]))
diff --git a/meta/recipes-bsp/grub/files/grub-module-explicitly-keeps-symbole-.module_license.patch b/meta/recipes-bsp/grub/files/grub-module-explicitly-keeps-symbole-.module_license.patch
index 26890261b7..7c8770ce8b 100644
--- a/meta/recipes-bsp/grub/files/grub-module-explicitly-keeps-symbole-.module_license.patch
+++ b/meta/recipes-bsp/grub/files/grub-module-explicitly-keeps-symbole-.module_license.patch
@@ -1,4 +1,4 @@
-From 917133acc701dbc4636165d3b08d15dc5829a06f Mon Sep 17 00:00:00 2001
+From b316ed326bd492106006d78f5bfcd767b49a4f2e Mon Sep 17 00:00:00 2001
 From: Hongxu Jia <hongxu.jia@windriver.com>
 Date: Wed, 17 Aug 2016 04:06:34 -0400
 Subject: [PATCH] grub module explicitly keeps symbole .module_license
@@ -8,7 +8,7 @@ it stripped symbol table:
 ---------------
 root@localhost:~# objdump -t all_video.mod
- 
 all_video.mod:     file format elf64-x86-64
 SYMBOL TABLE:
@@ -37,15 +37,16 @@ SYMBOL TABLE:
 0000000000000000 l    d  .modname       0000000000000000 .modname
 --------------
-Upstream-Status: Pending
+Upstream-Status: Inappropriate [workaround that needs investigation into @TARGET_STRIP@ behaviour in oe-core vs toolchain used by upstream]
 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
 ---
 grub-core/genmod.sh.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/grub-core/genmod.sh.in b/grub-core/genmod.sh.in
-index 1250589..dd14308 100644
+index e57c4d9..42bb1ba 100644
 --- a/grub-core/genmod.sh.in
 +++ b/grub-core/genmod.sh.in
 @@ -56,7 +56,7 @@ if test x@TARGET_APPLE_LINKER@ != x1; then
diff --git a/meta/recipes-bsp/grub/files/lvm-Add-LVM-cache-logical-volume-handling.patch b/meta/recipes-bsp/grub/files/lvm-Add-LVM-cache-logical-volume-handling.patch
deleted file mode 100644
index 2b8157f592..0000000000
--- a/meta/recipes-bsp/grub/files/lvm-Add-LVM-cache-logical-volume-handling.patch
+++ /dev/null
@@ -1,287 +0,0 @@
-From 8eb02bcb5897b238b29ff762402bb0c3028f0eab Mon Sep 17 00:00:00 2001
-From: Michael Chang <mchang@suse.com>
-Date: Thu, 19 Mar 2020 13:56:13 +0800
-Subject: [PATCH 3/9] lvm: Add LVM cache logical volume handling
-The LVM cache logical volume is the logical volume consisting of the original
-and the cache pool logical volume. The original is usually on a larger and
-slower storage device while the cache pool is on a smaller and faster one. The
-performance of the original volume can be improved by storing the frequently
-used data on the cache pool to utilize the greater performance of faster
-device.
-The default cache mode "writethrough" ensures that any data written will be
-stored both in the cache and on the origin LV, therefore grub can be straight
-to read the original lv as no data loss is guarenteed.
-The second cache mode is "writeback", which delays writing from the cache pool
-back to the origin LV to have increased performance. The drawback is potential
-data loss if losing the associated cache device.
-During the boot time grub reads the LVM offline i.e. LVM volumes are not
-activated and mounted, hence it should be fine to read directly from original
-lv since all cached data should have been flushed back in the process of taking
-it offline.
-It is also not much helpful to the situation by adding fsync calls to the
-install code. The fsync did not force to write back dirty cache to the original
-device and rather it would update associated cache metadata to complete the
-write transaction with the cache device. IOW the writes to cached blocks still
-go only to the cache device.
-To write back dirty cache, as LVM cache did not support dirty cache flush per
-block range, there'no way to do it for file. On the other hand the "cleaner"
-policy is implemented and can be used to write back "all" dirty blocks in a
-cache, which effectively drain all dirty cache gradually to attain and last in
-the "clean" state, which can be useful for shrinking or decommissioning a
-cache. The result and effect is not what we are looking for here.
-In conclusion, as it seems no way to enforce file writes to the original
-device, grub may suffer from power failure as it cannot assemble the cache
-device and read the dirty data from it. However since the case is only
-applicable to writeback mode which is sensitive to data lost in nature, I'd
-still like to propose my (relatively simple) patch and treat reading dirty
-cache as improvement.
-Upstream-Status: Backport [commit 0454b0445393aafc5600e92ef0c39494e333b135
-from https://git.savannah.gnu.org/git/grub.git]
-Signed-off-by: Michael Chang <mchang@suse.com>
-Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
-Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
---
- grub-core/disk/lvm.c | 190 +++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 190 insertions(+)
-diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
-index 7b265c7..dc6b83b 100644
--- a/grub-core/disk/lvm.c
-+++ b/grub-core/disk/lvm.c
-@@ -33,6 +33,14 @@
- 
- GRUB_MOD_LICENSE ("GPLv3+");
- 
-+struct cache_lv
-+{
-+  struct grub_diskfilter_lv *lv;
-+  char *cache_pool;
-+  char *origin;
-+  struct cache_lv *next;
-+};
-+
- 
- /* Go the string STR and return the number after STR.  *P will point
-    at the number.  In case STR is not found, *P will be NULL and the
-@@ -95,6 +103,34 @@ grub_lvm_check_flag (char *p, const char *str, const char *flag)
-     }
- }
- 
-+static void
-+grub_lvm_free_cache_lvs (struct cache_lv *cache_lvs)
-+{
-+  struct cache_lv *cache;
-+
-+  while ((cache = cache_lvs))
-+    {
-+      cache_lvs = cache_lvs->next;
-+
-+      if (cache->lv)
-+       {
-+         unsigned int i;
-+
-+         for (i = 0; i < cache->lv->segment_count; ++i)
-+           if (cache->lv->segments)
-+             grub_free (cache->lv->segments[i].nodes);
-+         grub_free (cache->lv->segments);
-+         grub_free (cache->lv->fullname);
-+         grub_free (cache->lv->idname);
-+         grub_free (cache->lv->name);
-+       }
-+      grub_free (cache->lv);
-+      grub_free (cache->origin);
-+      grub_free (cache->cache_pool);
-+      grub_free (cache);
-+    }
-+}
-+
- static struct grub_diskfilter_vg * 
- grub_lvm_detect (grub_disk_t disk,
-                 struct grub_diskfilter_pv_id *id,
-@@ -242,6 +278,8 @@ grub_lvm_detect (grub_disk_t disk,
- 
-   if (! vg)
-     {
-+      struct cache_lv *cache_lvs = NULL;
-+
-       /* First time we see this volume group. We've to create the
-         whole volume group structure. */
-       vg = grub_malloc (sizeof (*vg));
-@@ -671,6 +709,106 @@ grub_lvm_detect (grub_disk_t disk,
-                          seg->nodes[seg->node_count - 1].name = tmp;
-                        }
-                    }
-+                 else if (grub_memcmp (p, "cache\"",
-+                                  sizeof ("cache\"") - 1) == 0)
-+                   {
-+                     struct cache_lv *cache = NULL;
-+
-+                     char *p2, *p3;
-+                     grub_size_t sz;
-+
-+                     cache = grub_zalloc (sizeof (*cache));
-+                     if (!cache)
-+                       goto cache_lv_fail;
-+                     cache->lv = grub_zalloc (sizeof (*cache->lv));
-+                     if (!cache->lv)
-+                       goto cache_lv_fail;
-+                     grub_memcpy (cache->lv, lv, sizeof (*cache->lv));
-+
-+                     if (lv->fullname)
-+                       {
-+                         cache->lv->fullname = grub_strdup (lv->fullname);
-+                         if (!cache->lv->fullname)
-+                           goto cache_lv_fail;
-+                       }
-+                     if (lv->idname)
-+                       {
-+                         cache->lv->idname = grub_strdup (lv->idname);
-+                         if (!cache->lv->idname)
-+                           goto cache_lv_fail;
-+                       }
-+                     if (lv->name)
-+                       {
-+                         cache->lv->name = grub_strdup (lv->name);
-+                         if (!cache->lv->name)
-+                           goto cache_lv_fail;
-+                       }
-+
-+                     skip_lv = 1;
-+
-+                     p2 = grub_strstr (p, "cache_pool = \"");
-+                     if (!p2)
-+                       goto cache_lv_fail;
-+
-+                     p2 = grub_strchr (p2, '"');
-+                     if (!p2)
-+                       goto cache_lv_fail;
-+
-+                     p3 = ++p2;
-+                     p3 = grub_strchr (p3, '"');
-+                     if (!p3)
-+                       goto cache_lv_fail;
-+
-+                     sz = p3 - p2;
-+
-+                     cache->cache_pool = grub_malloc (sz + 1);
-+                     if (!cache->cache_pool)
-+                       goto cache_lv_fail;
-+                     grub_memcpy (cache->cache_pool, p2, sz);
-+                     cache->cache_pool[sz] = '\0';
-+
-+                     p2 = grub_strstr (p, "origin = \"");
-+                     if (!p2)
-+                       goto cache_lv_fail;
-+
-+                     p2 = grub_strchr (p2, '"');
-+                     if (!p2)
-+                       goto cache_lv_fail;
-+
-+                     p3 = ++p2;
-+                     p3 = grub_strchr (p3, '"');
-+                     if (!p3)
-+                       goto cache_lv_fail;
-+
-+                     sz = p3 - p2;
-+
-+                     cache->origin = grub_malloc (sz + 1);
-+                     if (!cache->origin)
-+                       goto cache_lv_fail;
-+                     grub_memcpy (cache->origin, p2, sz);
-+                     cache->origin[sz] = '\0';
-+
-+                     cache->next = cache_lvs;
-+                     cache_lvs = cache;
-+                     break;
-+
-+                   cache_lv_fail:
-+                     if (cache)
-+                       {
-+                         grub_free (cache->origin);
-+                         grub_free (cache->cache_pool);
-+                         if (cache->lv)
-+                           {
-+                             grub_free (cache->lv->fullname);
-+                             grub_free (cache->lv->idname);
-+                             grub_free (cache->lv->name);
-+                           }
-+                         grub_free (cache->lv);
-+                         grub_free (cache);
-+                       }
-+                     grub_lvm_free_cache_lvs (cache_lvs);
-+                     goto fail4;
-+                   }
-                  else
-                    {
- #ifdef GRUB_UTIL
-@@ -747,6 +885,58 @@ grub_lvm_detect (grub_disk_t disk,
-              }
-        
-       }
-+
-+      {
-+       struct cache_lv *cache;
-+
-+       for (cache = cache_lvs; cache; cache = cache->next)
-+         {
-+           struct grub_diskfilter_lv *lv;
-+
-+           for (lv = vg->lvs; lv; lv = lv->next)
-+             if (grub_strcmp (lv->name, cache->origin) == 0)
-+               break;
-+           if (lv)
-+             {
-+               cache->lv->segments = grub_malloc (lv->segment_count * sizeof (*lv->segments));
-+               if (!cache->lv->segments)
-+                 {
-+                   grub_lvm_free_cache_lvs (cache_lvs);
-+                   goto fail4;
-+                 }
-+               grub_memcpy (cache->lv->segments, lv->segments, lv->segment_count * sizeof (*lv->segments));
-+
-+               for (i = 0; i < lv->segment_count; ++i)
-+                 {
-+                   struct grub_diskfilter_node *nodes = lv->segments[i].nodes;
-+                   grub_size_t node_count = lv->segments[i].node_count;
-+
-+                   cache->lv->segments[i].nodes = grub_malloc (node_count * sizeof (*nodes));
-+                   if (!cache->lv->segments[i].nodes)
-+                     {
-+                       for (j = 0; j < i; ++j)
-+                         grub_free (cache->lv->segments[j].nodes);
-+                       grub_free (cache->lv->segments);
-+                       cache->lv->segments = NULL;
-+                       grub_lvm_free_cache_lvs (cache_lvs);
-+                       goto fail4;
-+                     }
-+                   grub_memcpy (cache->lv->segments[i].nodes, nodes, node_count * sizeof (*nodes));
-+                 }
-+
-+               if (cache->lv->segments)
-+                 {
-+                   cache->lv->segment_count = lv->segment_count;
-+                   cache->lv->vg = vg;
-+                   cache->lv->next = vg->lvs;
-+                   vg->lvs = cache->lv;
-+                   cache->lv = NULL;
-+                 }
-+             }
-+         }
-+      }
-+
-+      grub_lvm_free_cache_lvs (cache_lvs);
-       if (grub_diskfilter_vg_register (vg))
-        goto fail4;
-     }
-- 
-2.14.4
diff --git a/meta/recipes-bsp/grub/files/safemath-Add-some-arithmetic-primitives-that-check-f.patch b/meta/recipes-bsp/grub/files/safemath-Add-some-arithmetic-primitives-that-check-f.patch
deleted file mode 100644
index 29021e8d8f..0000000000
--- a/meta/recipes-bsp/grub/files/safemath-Add-some-arithmetic-primitives-that-check-f.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 06c361a71c4998635493610e5d76d0d223925251 Mon Sep 17 00:00:00 2001
-From: Peter Jones <pjones@redhat.com>
-Date: Mon, 15 Jun 2020 10:58:42 -0400
-Subject: [PATCH 5/9] safemath: Add some arithmetic primitives that check for
- overflow
-This adds a new header, include/grub/safemath.h, that includes easy to
-use wrappers for __builtin_{add,sub,mul}_overflow() declared like:
-  bool OP(a, b, res)
-where OP is grub_add, grub_sub or grub_mul. OP() returns true in the
-case where the operation would overflow and res is not modified.
-Otherwise, false is returned and the operation is executed.
-These arithmetic primitives require newer compiler versions. So, bump
-these requirements in the INSTALL file too.
-Upstream-Status: Backport [commit 68708c4503018d61dbcce7ac11cbb511d6425f4d
-from https://git.savannah.gnu.org/git/grub.git]
-Signed-off-by: Peter Jones <pjones@redhat.com>
-Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
-[YL: omit the change to INSTALL from original patch]
-Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
---
- include/grub/compiler.h |  8 ++++++++
- include/grub/safemath.h | 37 +++++++++++++++++++++++++++++++++++++
- 2 files changed, 45 insertions(+)
- create mode 100644 include/grub/safemath.h
-diff --git a/include/grub/compiler.h b/include/grub/compiler.h
-index c9e1d7a..8f3be3a 100644
--- a/include/grub/compiler.h
-+++ b/include/grub/compiler.h
-@@ -48,4 +48,12 @@
- #  define WARN_UNUSED_RESULT
- #endif
- 
-+#if defined(__clang__) && defined(__clang_major__) && defined(__clang_minor__)
-+#  define CLANG_PREREQ(maj,min) \
-+          ((__clang_major__ > (maj)) || \
-+          (__clang_major__ == (maj) && __clang_minor__ >= (min)))
-+#else
-+#  define CLANG_PREREQ(maj,min) 0
-+#endif
-+
- #endif /* ! GRUB_COMPILER_HEADER */
-diff --git a/include/grub/safemath.h b/include/grub/safemath.h
-new file mode 100644
-index 0000000..c17b89b
--- /dev/null
-+++ b/include/grub/safemath.h
-@@ -0,0 +1,37 @@
-+/*
-+ *  GRUB  --  GRand Unified Bootloader
-+ *  Copyright (C) 2020  Free Software Foundation, Inc.
-+ *
-+ *  GRUB is free software: you can redistribute it and/or modify
-+ *  it under the terms of the GNU General Public License as published by
-+ *  the Free Software Foundation, either version 3 of the License, or
-+ *  (at your option) any later version.
-+ *
-+ *  GRUB is distributed in the hope that it will be useful,
-+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ *  GNU General Public License for more details.
-+ *
-+ *  You should have received a copy of the GNU General Public License
-+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
-+ *
-+ *  Arithmetic operations that protect against overflow.
-+ */
-+
-+#ifndef GRUB_SAFEMATH_H
-+#define GRUB_SAFEMATH_H 1
-+
-+#include <grub/compiler.h>
-+
-+/* These appear in gcc 5.1 and clang 3.8. */
-+#if GNUC_PREREQ(5, 1) || CLANG_PREREQ(3, 8)
-+
-+#define grub_add(a, b, res)    __builtin_add_overflow(a, b, res)
-+#define grub_sub(a, b, res)    __builtin_sub_overflow(a, b, res)
-+#define grub_mul(a, b, res)    __builtin_mul_overflow(a, b, res)
-+
-+#else
-+#error gcc 5.1 or newer or clang 3.8 or newer is required
-+#endif
-+
-+#endif /* GRUB_SAFEMATH_H */
-- 
-2.14.4
diff --git a/meta/recipes-bsp/grub/files/script-Remove-unused-fields-from-grub_script_functio.patch b/meta/recipes-bsp/grub/files/script-Remove-unused-fields-from-grub_script_functio.patch
deleted file mode 100644
index 84a80d5ffd..0000000000
--- a/meta/recipes-bsp/grub/files/script-Remove-unused-fields-from-grub_script_functio.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From e219bad8cee67b2bb21712df8f055706f8da25d2 Mon Sep 17 00:00:00 2001
-From: Chris Coulson <chris.coulson@canonical.com>
-Date: Fri, 10 Jul 2020 11:21:14 +0100
-Subject: [PATCH 7/9] script: Remove unused fields from grub_script_function
- struct
-Upstream-Status: Backport [commit 1a8d9c9b4ab6df7669b5aa36a56477f297825b96
-from https://git.savannah.gnu.org/git/grub.git]
-Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
-Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
-Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com>
---
- include/grub/script_sh.h | 5 -----
- 1 file changed, 5 deletions(-)
-diff --git a/include/grub/script_sh.h b/include/grub/script_sh.h
-index 360c2be..b382bcf 100644
--- a/include/grub/script_sh.h
-+++ b/include/grub/script_sh.h
-@@ -359,13 +359,8 @@ struct grub_script_function
-   /* The script function.  */
-   struct grub_script *func;
- 
-  /* The flags.  */
-  unsigned flags;
-
-   /* The next element.  */
-   struct grub_script_function *next;
-
-  int references;
- };
- typedef struct grub_script_function *grub_script_function_t;
- 
-- 
-2.14.4
diff --git a/meta/recipes-bsp/grub/grub-bootconf_1.00.bb b/meta/recipes-bsp/grub/grub-bootconf_1.00.bb
index 572580313b..0b4005e5bf 100644
--- a/meta/recipes-bsp/grub/grub-bootconf_1.00.bb
+++ b/meta/recipes-bsp/grub/grub-bootconf_1.00.bb
@@ -5,13 +5,13 @@ DESCRIPTION = "Grub might require different configuration file for \
 different machines."
 HOMEPAGE = "https://www.gnu.org/software/grub/manual/grub/grub.html#Configuration"
-RPROVIDES_${PN} += "virtual/grub-bootconf"
+RPROVIDES:${PN} += "virtual-grub-bootconf"
 inherit grub-efi-cfg
 require conf/image-uefi.conf
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 GRUB_CFG = "${S}/grub-bootconf"
 LABELS = "boot"
@@ -22,11 +22,11 @@ python do_configure() {
    bb.build.exec_func('build_efi_cfg', d)
 }
-do_configure[vardeps] += "APPEND ROOT"
+do_configure[vardeps] += "APPEND ROOT GRUB_TITLE"
 do_install() {
        install -d ${D}${EFI_FILES_PATH}
        install grub-bootconf ${D}${EFI_FILES_PATH}/grub.cfg
 }
-FILES_${PN} = "${EFI_FILES_PATH}/grub.cfg"
+FILES:${PN} = "${EFI_FILES_PATH}/grub.cfg"
diff --git a/meta/recipes-bsp/grub/grub-efi_2.04.bb b/meta/recipes-bsp/grub/grub-efi_2.12.bb
index 287845c507..6354b43989 100644
--- a/meta/recipes-bsp/grub/grub-efi_2.04.bb
+++ b/meta/recipes-bsp/grub/grub-efi_2.12.bb
@@ -4,14 +4,14 @@ require conf/image-uefi.conf
 GRUBPLATFORM = "efi"
-DEPENDS_append = " grub-native"
+DEPENDS:append = " grub-native"
-RDEPENDS_${PN} = "grub-common virtual/grub-bootconf"
+RDEPENDS:${PN} = "grub-common virtual-grub-bootconf"
 SRC_URI += " \
           file://cfg \
          "
-S = "${WORKDIR}/grub-${PV}"
+S = "${UNPACKDIR}/grub-${PV}"
 # Determine the target arch for the grub modules
 python __anonymous () {
@@ -30,6 +30,8 @@ python __anonymous () {
        grubtarget = 'riscv64'
    elif re.match('riscv32', target):
        grubtarget = 'riscv32'
+    elif re.match('loongarch64', target):
+        grubtarget = 'loongarch64'
    else:
        raise bb.parse.SkipRecipe("grub-efi is incompatible with target %s" % target)
    grubimage = prefix + d.getVar("EFI_BOOT_IMAGE")
@@ -44,13 +46,26 @@ inherit deploy
 CACHED_CONFIGUREVARS += "ac_cv_path_HELP2MAN="
 EXTRA_OECONF += "--enable-efiemu=no"
+# Define GRUB_MKIMAGE_OPTS variable for additional grub-mkimage options (e.g., disabling shim lock)
+GRUB_MKIMAGE_OPTS ?= ""
 do_mkimage() {
        cd ${B}
+        GRUB_MKIMAGE_MODULES="${GRUB_BUILDIN}"
+        # If 'all' is included in GRUB_BUILDIN we will include all available grub2 modules
+        if [ "${@ bb.utils.contains('GRUB_BUILDIN', 'all', 'True', 'False', d)}" = "True" ]; then
+                bbdebug 1 "Including all available modules"
+                # Get the list of all .mod files in grub-core build directory
+                GRUB_MKIMAGE_MODULES=$(find ${B}/grub-core/ -type f -name "*.mod" -exec basename {} .mod \;)
+        fi
        # Search for the grub.cfg on the local boot media by using the
        # built in cfg file provided via this recipe
-        grub-mkimage -c ../cfg -p ${EFIDIR} -d ./grub-core/ \
+        grub-mkimage -v -c ${UNPACKDIR}/cfg -p ${EFIDIR} -d ./grub-core/ \
                       -O ${GRUB_TARGET}-efi -o ./${GRUB_IMAGE_PREFIX}${GRUB_IMAGE} \
-                       ${GRUB_BUILDIN}
+                       ${GRUB_MKIMAGE_OPTS} ${GRUB_MKIMAGE_MODULES}
 }
 addtask mkimage before do_install after do_compile
@@ -70,22 +85,26 @@ do_install() {
    install -m 644 ${B}/${GRUB_IMAGE_PREFIX}${GRUB_IMAGE} ${D}${EFI_FILES_PATH}/${GRUB_IMAGE}
 }
+# To include all available modules, add 'all' to GRUB_BUILDIN
 GRUB_BUILDIN ?= "boot linux ext2 fat serial part_msdos part_gpt normal \
                 efi_gop iso9660 configfile search loadenv test"
+# 'xen_boot' is a module valid only for aarch64
+GRUB_BUILDIN:append:aarch64 = "${@bb.utils.contains('DISTRO_FEATURES', 'xen', ' xen_boot', '', d)}"
 do_deploy() {
        install -m 644 ${B}/${GRUB_IMAGE_PREFIX}${GRUB_IMAGE} ${DEPLOYDIR}
 }
 addtask deploy after do_install before do_build
-FILES_${PN} = "${libdir}/grub/${GRUB_TARGET}-efi \
+FILES:${PN} = "${libdir}/grub/${GRUB_TARGET}-efi \
               ${datadir}/grub \
               ${EFI_FILES_PATH}/${GRUB_IMAGE} \
               "
 # 64-bit binaries are expected for the bootloader with an x32 userland
-INSANE_SKIP_${PN}_append_linux-gnux32 = " arch"
+INSANE_SKIP:${PN}:append:linux-gnux32 = " arch"
-INSANE_SKIP_${PN}-dbg_append_linux-gnux32 = " arch"
+INSANE_SKIP:${PN}-dbg:append:linux-gnux32 = " arch"
-INSANE_SKIP_${PN}_append_linux-muslx32 = " arch"
+INSANE_SKIP:${PN}:append:linux-muslx32 = " arch"
-INSANE_SKIP_${PN}-dbg_append_linux-muslx32 = " arch"
+INSANE_SKIP:${PN}-dbg:append:linux-muslx32 = " arch"
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index f870d41f6a..ffa04e415d 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -8,48 +8,70 @@ standard, which allows for flexible loading of multiple boot images."
 HOMEPAGE = "http://www.gnu.org/software/grub/"
 SECTION = "bootloaders"
-LICENSE = "GPLv3"
+LICENSE = "GPL-3.0-only"
 LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
 CVE_PRODUCT = "grub2"
 SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
-           file://0001-Disable-mfpmath-sse-as-well-when-SSE-is-disabled.patch \
           file://autogen.sh-exclude-pc.patch \
           file://grub-module-explicitly-keeps-symbole-.module_license.patch \
           file://0001-grub.d-10_linux.in-add-oe-s-kernel-name.patch \
-           file://CVE-2020-10713.patch \
+           file://0001-RISC-V-Restore-the-typcast-to-long.patch \
-           file://calloc-Make-sure-we-always-have-an-overflow-checking.patch \
+           file://0001-misc-Implement-grub_strlcpy.patch \
-           file://lvm-Add-LVM-cache-logical-volume-handling.patch \
+           file://CVE-2024-45781.patch \
-           file://CVE-2020-14308-calloc-Use-calloc-at-most-places.patch \
+           file://CVE-2024-45782_CVE-2024-56737.patch \
-           file://safemath-Add-some-arithmetic-primitives-that-check-f.patch \
+           file://CVE-2024-45780.patch \
-           file://CVE-2020-14309-CVE-2020-14310-CVE-2020-14311-malloc-Use-overflow-checking-primitives-where-we-do-.patch \
+           file://CVE-2024-45783.patch \
-           file://script-Remove-unused-fields-from-grub_script_functio.patch \
+           file://CVE-2025-0624.patch \
-           file://CVE-2020-15706-script-Avoid-a-use-after-free-when-redefining-a-func.patch \
+           file://CVE-2024-45774.patch \
-           file://CVE-2020-15707-linux-Fix-integer-overflows-in-initrd-size-handling.patch \
+           file://CVE-2024-45775.patch \
-           file://6643507ce30f775008e093580f0c9499dfb2c485.patch \
+           file://CVE-2025-0622-01.patch \
-           file://determinism.patch \
+           file://CVE-2025-0622-02.patch \
+           file://CVE-2025-0622-03.patch \
+           file://CVE-2024-45776.patch \
+           file://CVE-2024-45777.patch \
+           file://CVE-2025-0690.patch \
+           file://CVE-2025-1118.patch \
+           file://CVE-2024-45778_CVE-2024-45779.patch \
+           file://CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch \
+           file://CVE-2025-0678_CVE-2025-1125.patch \
 "
-SRC_URI[md5sum] = "5ce674ca6b2612d8939b9e6abed32934"
-SRC_URI[sha256sum] = "f10c85ae3e204dbaec39ae22fa3c5e99f0665417e91c2cb49b7e5031658ba6ea"
+SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
+CVE_STATUS[CVE-2019-14865] = "not-applicable-platform: applies only to RHEL"
+CVE_STATUS[CVE-2023-4001]  = "not-applicable-platform: Applies only to RHEL/Fedora"
+CVE_STATUS[CVE-2024-1048]  = "not-applicable-platform: Applies only to RHEL/Fedora"
 DEPENDS = "flex-native bison-native gettext-native"
-COMPATIBLE_HOST = '(x86_64.*|i.86.*|arm.*|aarch64.*|riscv.*)-(linux.*|freebsd.*)'
+GRUB_COMPATIBLE_HOST = '(x86_64.*|i.86.*|arm.*|aarch64.*|loongarch64.*|riscv.*)-(linux.*|freebsd.*)'
-COMPATIBLE_HOST_armv7a = 'null'
+COMPATIBLE_HOST = "${GRUB_COMPATIBLE_HOST}"
-COMPATIBLE_HOST_armv7ve = 'null'
+# Grub doesn't support hard float toolchain and won't be able to forcefully
+# disable it on some of the target CPUs. See 'configure.ac' for
+# supported/unsupported CPUs in hardfp.
+COMPATIBLE_HOST:armv7a = "${@'null' if bb.utils.contains('TUNE_CCARGS_MFLOAT', 'hard', True, False, d) else d.getVar('GRUB_COMPATIBLE_HOST')}"
+COMPATIBLE_HOST:armv7ve = "${@'null' if bb.utils.contains('TUNE_CCARGS_MFLOAT', 'hard', True, False, d) else d.getVar('GRUB_COMPATIBLE_HOST')}"
 # configure.ac has code to set this automagically from the target tuple
 # but the OE freeform one (core2-foo-bar-linux) don't work with that.
-GRUBPLATFORM_arm = "efi"
+GRUBPLATFORM:arm = "efi"
-GRUBPLATFORM_aarch64 = "efi"
+GRUBPLATFORM:aarch64 = "efi"
-GRUBPLATFORM_riscv32 = "efi"
+GRUBPLATFORM:loongarch64 = "efi"
-GRUBPLATFORM_riscv64 = "efi"
+GRUBPLATFORM:riscv32 = "efi"
+GRUBPLATFORM:riscv64 = "efi"
 GRUBPLATFORM ??= "pc"
 inherit autotools gettext texinfo pkgconfig
+CFLAGS:remove = "-O2"
+# It doesn't support sse, its make.defaults sets:
+# CFLAGS += -mno-mmx -mno-sse
+# So also remove -mfpmath=sse from TUNE_CCARGS
+TUNE_CCARGS:remove = "-mfpmath=sse"
 EXTRA_OECONF = "--with-platform=${GRUBPLATFORM} \
                --disable-grub-mkfont \
                --program-prefix="" \
@@ -74,8 +96,17 @@ BUILD_LDFLAGS = ""
 export PYTHON = "python3"
-do_configure_prepend() {
+do_configure:prepend() {
        cd ${S}
+        # Remove in next version.
+        # See: https://git.savannah.gnu.org/cgit/grub.git/commit/?id=b835601c7639ed1890f2d3db91900a8506011a8e
+        echo "depends bli part_gpt" > ${S}/grub-core/extra_deps.lst
        FROM_BOOTSTRAP=1 ${S}/autogen.sh
        cd ${B}
 }
+# | aarch64-poky-linux-clang: error: invalid argument '-mcmodel=large' only allowed with '-fno-pic'
+# see - https://bugs.gentoo.org/942843
+TOOLCHAIN:aarch64 = "gcc"
diff --git a/meta/recipes-bsp/grub/grub_2.04.bb b/meta/recipes-bsp/grub/grub_2.12.bb
index d4e09faa40..05d462785c 100644
--- a/meta/recipes-bsp/grub/grub_2.04.bb
+++ b/meta/recipes-bsp/grub/grub_2.12.bb
@@ -1,24 +1,24 @@
 require grub2.inc
-RDEPENDS_${PN}-common += "${PN}-editenv"
+RDEPENDS:${PN}-common += "${PN}-editenv"
-RDEPENDS_${PN} += "${PN}-common"
+RDEPENDS:${PN} += "${PN}-common"
-RDEPENDS_${PN}_class-native = ""
+RDEPENDS:${PN}:class-native = ""
-RPROVIDES_${PN}-editenv += "${PN}-efi-editenv"
+RPROVIDES:${PN}-editenv += "${PN}-efi-editenv"
-PROVIDES_append_class-native = " grub-efi-native"
+PROVIDES:append:class-native = " grub-efi-native"
 PACKAGES =+ "${PN}-editenv ${PN}-common"
-FILES_${PN}-editenv = "${bindir}/grub-editenv"
+FILES:${PN}-editenv = "${bindir}/grub-editenv"
-FILES_${PN}-common = " \
+FILES:${PN}-common = " \
    ${bindir} \
    ${sysconfdir} \
    ${sbindir} \
    ${datadir}/grub \
 "
-ALLOW_EMPTY_${PN} = "1"
+ALLOW_EMPTY:${PN} = "1"
-do_install_append () {
+do_install:append () {
    # Avoid conflicts with the EFI package for systems such as arm64 where we
    # need to build grub and grub-efi but only EFI is supported by removing EFI
    # from this package.
@@ -35,7 +35,7 @@ do_install_append () {
        {} +
 }
-INSANE_SKIP_${PN} = "arch"
+INSANE_SKIP:${PN} = "arch"
-INSANE_SKIP_${PN}-dbg = "arch"
+INSANE_SKIP:${PN}-dbg = "arch"
 BBCLASSEXTEND = "native nativesdk"
diff --git a/meta/recipes-bsp/keymaps/files/GPLv2.patch b/meta/recipes-bsp/keymaps/files/GPLv2.patch
deleted file mode 100644
index 1ee8181f12..0000000000
--- a/meta/recipes-bsp/keymaps/files/GPLv2.patch
+++ /dev/null
@@ -1,347 +0,0 @@
-Upstream-Status: Inappropriate [licensing]
-diff --git a/COPYING b/COPYING
-new file mode 100644
-index 0000000..d511905
--- /dev/null
-+++ b/COPYING
-@@ -0,0 +1,339 @@
-+                   GNU GENERAL PUBLIC LICENSE
-+                      Version 2, June 1991
-+
-+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
-+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-+ Everyone is permitted to copy and distribute verbatim copies
-+ of this license document, but changing it is not allowed.
-+
-+                           Preamble
-+
-+  The licenses for most software are designed to take away your
-+freedom to share and change it.  By contrast, the GNU General Public
-+License is intended to guarantee your freedom to share and change free
-+software--to make sure the software is free for all its users.  This
-+General Public License applies to most of the Free Software
-+Foundation's software and to any other program whose authors commit to
-+using it.  (Some other Free Software Foundation software is covered by
-+the GNU Lesser General Public License instead.)  You can apply it to
-+your programs, too.
-+
-+  When we speak of free software, we are referring to freedom, not
-+price.  Our General Public Licenses are designed to make sure that you
-+have the freedom to distribute copies of free software (and charge for
-+this service if you wish), that you receive source code or can get it
-+if you want it, that you can change the software or use pieces of it
-+in new free programs; and that you know you can do these things.
-+
-+  To protect your rights, we need to make restrictions that forbid
-+anyone to deny you these rights or to ask you to surrender the rights.
-+These restrictions translate to certain responsibilities for you if you
-+distribute copies of the software, or if you modify it.
-+
-+  For example, if you distribute copies of such a program, whether
-+gratis or for a fee, you must give the recipients all the rights that
-+you have.  You must make sure that they, too, receive or can get the
-+source code.  And you must show them these terms so they know their
-+rights.
-+
-+  We protect your rights with two steps: (1) copyright the software, and
-+(2) offer you this license which gives you legal permission to copy,
-+distribute and/or modify the software.
-+
-+  Also, for each author's protection and ours, we want to make certain
-+that everyone understands that there is no warranty for this free
-+software.  If the software is modified by someone else and passed on, we
-+want its recipients to know that what they have is not the original, so
-+that any problems introduced by others will not reflect on the original
-+authors' reputations.
-+
-+  Finally, any free program is threatened constantly by software
-+patents.  We wish to avoid the danger that redistributors of a free
-+program will individually obtain patent licenses, in effect making the
-+program proprietary.  To prevent this, we have made it clear that any
-+patent must be licensed for everyone's free use or not licensed at all.
-+
-+  The precise terms and conditions for copying, distribution and
-+modification follow.
-+
-+                   GNU GENERAL PUBLIC LICENSE
-+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-+
-+  0. This License applies to any program or other work which contains
-+a notice placed by the copyright holder saying it may be distributed
-+under the terms of this General Public License.  The "Program", below,
-+refers to any such program or work, and a "work based on the Program"
-+means either the Program or any derivative work under copyright law:
-+that is to say, a work containing the Program or a portion of it,
-+either verbatim or with modifications and/or translated into another
-+language.  (Hereinafter, translation is included without limitation in
-+the term "modification".)  Each licensee is addressed as "you".
-+
-+Activities other than copying, distribution and modification are not
-+covered by this License; they are outside its scope.  The act of
-+running the Program is not restricted, and the output from the Program
-+is covered only if its contents constitute a work based on the
-+Program (independent of having been made by running the Program).
-+Whether that is true depends on what the Program does.
-+
-+  1. You may copy and distribute verbatim copies of the Program's
-+source code as you receive it, in any medium, provided that you
-+conspicuously and appropriately publish on each copy an appropriate
-+copyright notice and disclaimer of warranty; keep intact all the
-+notices that refer to this License and to the absence of any warranty;
-+and give any other recipients of the Program a copy of this License
-+along with the Program.
-+
-+You may charge a fee for the physical act of transferring a copy, and
-+you may at your option offer warranty protection in exchange for a fee.
-+
-+  2. You may modify your copy or copies of the Program or any portion
-+of it, thus forming a work based on the Program, and copy and
-+distribute such modifications or work under the terms of Section 1
-+above, provided that you also meet all of these conditions:
-+
-+    a) You must cause the modified files to carry prominent notices
-+    stating that you changed the files and the date of any change.
-+
-+    b) You must cause any work that you distribute or publish, that in
-+    whole or in part contains or is derived from the Program or any
-+    part thereof, to be licensed as a whole at no charge to all third
-+    parties under the terms of this License.
-+
-+    c) If the modified program normally reads commands interactively
-+    when run, you must cause it, when started running for such
-+    interactive use in the most ordinary way, to print or display an
-+    announcement including an appropriate copyright notice and a
-+    notice that there is no warranty (or else, saying that you provide
-+    a warranty) and that users may redistribute the program under
-+    these conditions, and telling the user how to view a copy of this
-+    License.  (Exception: if the Program itself is interactive but
-+    does not normally print such an announcement, your work based on
-+    the Program is not required to print an announcement.)
-+
-+These requirements apply to the modified work as a whole.  If
-+identifiable sections of that work are not derived from the Program,
-+and can be reasonably considered independent and separate works in
-+themselves, then this License, and its terms, do not apply to those
-+sections when you distribute them as separate works.  But when you
-+distribute the same sections as part of a whole which is a work based
-+on the Program, the distribution of the whole must be on the terms of
-+this License, whose permissions for other licensees extend to the
-+entire whole, and thus to each and every part regardless of who wrote it.
-+
-+Thus, it is not the intent of this section to claim rights or contest
-+your rights to work written entirely by you; rather, the intent is to
-+exercise the right to control the distribution of derivative or
-+collective works based on the Program.
-+
-+In addition, mere aggregation of another work not based on the Program
-+with the Program (or with a work based on the Program) on a volume of
-+a storage or distribution medium does not bring the other work under
-+the scope of this License.
-+
-+  3. You may copy and distribute the Program (or a work based on it,
-+under Section 2) in object code or executable form under the terms of
-+Sections 1 and 2 above provided that you also do one of the following:
-+
-+    a) Accompany it with the complete corresponding machine-readable
-+    source code, which must be distributed under the terms of Sections
-+    1 and 2 above on a medium customarily used for software interchange; or,
-+
-+    b) Accompany it with a written offer, valid for at least three
-+    years, to give any third party, for a charge no more than your
-+    cost of physically performing source distribution, a complete
-+    machine-readable copy of the corresponding source code, to be
-+    distributed under the terms of Sections 1 and 2 above on a medium
-+    customarily used for software interchange; or,
-+
-+    c) Accompany it with the information you received as to the offer
-+    to distribute corresponding source code.  (This alternative is
-+    allowed only for noncommercial distribution and only if you
-+    received the program in object code or executable form with such
-+    an offer, in accord with Subsection b above.)
-+
-+The source code for a work means the preferred form of the work for
-+making modifications to it.  For an executable work, complete source
-+code means all the source code for all modules it contains, plus any
-+associated interface definition files, plus the scripts used to
-+control compilation and installation of the executable.  However, as a
-+special exception, the source code distributed need not include
-+anything that is normally distributed (in either source or binary
-+form) with the major components (compiler, kernel, and so on) of the
-+operating system on which the executable runs, unless that component
-+itself accompanies the executable.
-+
-+If distribution of executable or object code is made by offering
-+access to copy from a designated place, then offering equivalent
-+access to copy the source code from the same place counts as
-+distribution of the source code, even though third parties are not
-+compelled to copy the source along with the object code.
-+
-+  4. You may not copy, modify, sublicense, or distribute the Program
-+except as expressly provided under this License.  Any attempt
-+otherwise to copy, modify, sublicense or distribute the Program is
-+void, and will automatically terminate your rights under this License.
-+However, parties who have received copies, or rights, from you under
-+this License will not have their licenses terminated so long as such
-+parties remain in full compliance.
-+
-+  5. You are not required to accept this License, since you have not
-+signed it.  However, nothing else grants you permission to modify or
-+distribute the Program or its derivative works.  These actions are
-+prohibited by law if you do not accept this License.  Therefore, by
-+modifying or distributing the Program (or any work based on the
-+Program), you indicate your acceptance of this License to do so, and
-+all its terms and conditions for copying, distributing or modifying
-+the Program or works based on it.
-+
-+  6. Each time you redistribute the Program (or any work based on the
-+Program), the recipient automatically receives a license from the
-+original licensor to copy, distribute or modify the Program subject to
-+these terms and conditions.  You may not impose any further
-+restrictions on the recipients' exercise of the rights granted herein.
-+You are not responsible for enforcing compliance by third parties to
-+this License.
-+
-+  7. If, as a consequence of a court judgment or allegation of patent
-+infringement or for any other reason (not limited to patent issues),
-+conditions are imposed on you (whether by court order, agreement or
-+otherwise) that contradict the conditions of this License, they do not
-+excuse you from the conditions of this License.  If you cannot
-+distribute so as to satisfy simultaneously your obligations under this
-+License and any other pertinent obligations, then as a consequence you
-+may not distribute the Program at all.  For example, if a patent
-+license would not permit royalty-free redistribution of the Program by
-+all those who receive copies directly or indirectly through you, then
-+the only way you could satisfy both it and this License would be to
-+refrain entirely from distribution of the Program.
-+
-+If any portion of this section is held invalid or unenforceable under
-+any particular circumstance, the balance of the section is intended to
-+apply and the section as a whole is intended to apply in other
-+circumstances.
-+
-+It is not the purpose of this section to induce you to infringe any
-+patents or other property right claims or to contest validity of any
-+such claims; this section has the sole purpose of protecting the
-+integrity of the free software distribution system, which is
-+implemented by public license practices.  Many people have made
-+generous contributions to the wide range of software distributed
-+through that system in reliance on consistent application of that
-+system; it is up to the author/donor to decide if he or she is willing
-+to distribute software through any other system and a licensee cannot
-+impose that choice.
-+
-+This section is intended to make thoroughly clear what is believed to
-+be a consequence of the rest of this License.
-+
-+  8. If the distribution and/or use of the Program is restricted in
-+certain countries either by patents or by copyrighted interfaces, the
-+original copyright holder who places the Program under this License
-+may add an explicit geographical distribution limitation excluding
-+those countries, so that distribution is permitted only in or among
-+countries not thus excluded.  In such case, this License incorporates
-+the limitation as if written in the body of this License.
-+
-+  9. The Free Software Foundation may publish revised and/or new versions
-+of the General Public License from time to time.  Such new versions will
-+be similar in spirit to the present version, but may differ in detail to
-+address new problems or concerns.
-+
-+Each version is given a distinguishing version number.  If the Program
-+specifies a version number of this License which applies to it and "any
-+later version", you have the option of following the terms and conditions
-+either of that version or of any later version published by the Free
-+Software Foundation.  If the Program does not specify a version number of
-+this License, you may choose any version ever published by the Free Software
-+Foundation.
-+
-+  10. If you wish to incorporate parts of the Program into other free
-+programs whose distribution conditions are different, write to the author
-+to ask for permission.  For software which is copyrighted by the Free
-+Software Foundation, write to the Free Software Foundation; we sometimes
-+make exceptions for this.  Our decision will be guided by the two goals
-+of preserving the free status of all derivatives of our free software and
-+of promoting the sharing and reuse of software generally.
-+
-+                           NO WARRANTY
-+
-+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-+REPAIR OR CORRECTION.
-+
-+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-+POSSIBILITY OF SUCH DAMAGES.
-+
-+                    END OF TERMS AND CONDITIONS
-+
-+           How to Apply These Terms to Your New Programs
-+
-+  If you develop a new program, and you want it to be of the greatest
-+possible use to the public, the best way to achieve this is to make it
-+free software which everyone can redistribute and change under these terms.
-+
-+  To do so, attach the following notices to the program.  It is safest
-+to attach them to the start of each source file to most effectively
-+convey the exclusion of warranty; and each file should have at least
-+the "copyright" line and a pointer to where the full notice is found.
-+
-+    <one line to give the program's name and a brief idea of what it does.>
-+    Copyright (C) <year>  <name of author>
-+
-+    This program is free software; you can redistribute it and/or modify
-+    it under the terms of the GNU General Public License as published by
-+    the Free Software Foundation; either version 2 of the License, or
-+    (at your option) any later version.
-+
-+    This program is distributed in the hope that it will be useful,
-+    but WITHOUT ANY WARRANTY; without even the implied warranty of
-+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+    GNU General Public License for more details.
-+
-+    You should have received a copy of the GNU General Public License along
-+    with this program; if not, write to the Free Software Foundation, Inc.,
-+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-+
-+Also add information on how to contact you by electronic and paper mail.
-+
-+If the program is interactive, make it output a short notice like this
-+when it starts in an interactive mode:
-+
-+    Gnomovision version 69, Copyright (C) year name of author
-+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-+    This is free software, and you are welcome to redistribute it
-+    under certain conditions; type `show c' for details.
-+
-+The hypothetical commands `show w' and `show c' should show the appropriate
-+parts of the General Public License.  Of course, the commands you use may
-+be called something other than `show w' and `show c'; they could even be
-+mouse-clicks or menu items--whatever suits your program.
-+
-+You should also get your employer (if you work as a programmer) or your
-+school, if any, to sign a "copyright disclaimer" for the program, if
-+necessary.  Here is a sample; alter the names:
-+
-+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-+
-+  <signature of Ty Coon>, 1 April 1989
-+  Ty Coon, President of Vice
-+
-+This General Public License does not permit incorporating your program into
-+proprietary programs.  If your program is a subroutine library, you may
-+consider it more useful to permit linking proprietary applications with the
-+library.  If this is what you want to do, use the GNU Lesser General
-+Public License instead of this License.
diff --git a/meta/recipes-bsp/keymaps/files/keymap.sh b/meta/recipes-bsp/keymaps/files/keymap.sh
index 6ebc634266..26bda60408 100755
--- a/meta/recipes-bsp/keymaps/files/keymap.sh
+++ b/meta/recipes-bsp/keymaps/files/keymap.sh
@@ -1,6 +1,9 @@
 #!/bin/sh
 #
 # load keymap, if existing
+#
+# SPDX-License-Identifier: GPL-2.0-only
+#
 KERNEL_MAJMIN=`uname -r | cut -d '.' -f 1,2`
 if [ -e /etc/keymap-$KERNEL_MAJMIN.map ]; then
diff --git a/meta/recipes-bsp/keymaps/keymaps_1.0.bb b/meta/recipes-bsp/keymaps/keymaps_1.0.bb
index 24b13f920f..ab2d68d6a1 100644
--- a/meta/recipes-bsp/keymaps/keymaps_1.0.bb
+++ b/meta/recipes-bsp/keymaps/keymaps_1.0.bb
@@ -2,12 +2,11 @@ SUMMARY = "Keyboard maps"
 DESCRIPTION = "Keymaps and initscript to set the keymap on bootup."
 SECTION = "base"
-RDEPENDS_${PN} = "kbd"
+RDEPENDS:${PN} = "kbd"
-LICENSE = "GPLv2"
+LICENSE = "GPL-2.0-only"
-LIC_FILES_CHKSUM = "file://COPYING;md5=751419260aa954499f7abaabaa882bbe"
+LIC_FILES_CHKSUM = "file://keymap.sh;beginline=5;endline=5;md5=829e563511c9a1d6d41f17a7a4989d6a"
 PACKAGE_ARCH = "${MACHINE_ARCH}"
-PR = "r31"
 INHIBIT_DEFAULT_DEPS = "1"
@@ -20,25 +19,24 @@ python __anonymous() {
 inherit update-rc.d
-SRC_URI = "file://keymap.sh \
+SRC_URI = "file://keymap.sh"
-           file://GPLv2.patch"
 INITSCRIPT_NAME = "keymap.sh"
 INITSCRIPT_PARAMS = "start 01 S ."
-S = "${WORKDIR}"
+S = "${UNPACKDIR}"
 do_install () {
    # Only install the script if 'sysvinit' is in DISTRO_FEATURES
    # THe ulitity this script provides could be achieved by systemd-vconsole-setup.service
    if ${@bb.utils.contains('DISTRO_FEATURES','sysvinit','true','false',d)}; then
        install -d ${D}${sysconfdir}/init.d/
-        install -m 0755 ${WORKDIR}/keymap.sh ${D}${sysconfdir}/init.d/
+        install -m 0755 ${S}/keymap.sh ${D}${sysconfdir}/init.d/
    fi
 }
-PACKAGE_WRITE_DEPS_append = " ${@bb.utils.contains('DISTRO_FEATURES','systemd sysvinit','systemd-systemctl-native','',d)}"
+PACKAGE_WRITE_DEPS:append = " ${@bb.utils.contains('DISTRO_FEATURES','systemd sysvinit','systemd-systemctl-native','',d)}"
-pkg_postinst_${PN} () {
+pkg_postinst:${PN} () {
        if ${@bb.utils.contains('DISTRO_FEATURES','systemd sysvinit','true','false',d)}; then
                if [ -n "$D" ]; then
                        OPTS="--root=$D"
@@ -47,4 +45,4 @@ pkg_postinst_${PN} () {
        fi
 }
-ALLOW_EMPTY_${PN} = "1"
+ALLOW_EMPTY:${PN} = "1"
diff --git a/meta/recipes-bsp/libacpi/files/0001-libacpi-Fix-build-witth-fno-commom.patch b/meta/recipes-bsp/libacpi/files/0001-libacpi-Fix-build-witth-fno-commom.patch
index 32808fb92a..e8ff78082c 100644
--- a/meta/recipes-bsp/libacpi/files/0001-libacpi-Fix-build-witth-fno-commom.patch
+++ b/meta/recipes-bsp/libacpi/files/0001-libacpi-Fix-build-witth-fno-commom.patch
@@ -3,7 +3,7 @@ From: Khem Raj <raj.khem@gmail.com>
 Date: Wed, 5 Aug 2020 12:06:01 -0700
 Subject: [PATCH] libacpi: Fix build witth -fno-commom
-Upstream-Status: Pending
+Upstream-Status: Inactive-Upstream [last release before 2008, no vcs]
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
 ---
diff --git a/meta/recipes-bsp/libacpi/files/ldflags.patch b/meta/recipes-bsp/libacpi/files/ldflags.patch
index a7424c39da..db0974104b 100644
--- a/meta/recipes-bsp/libacpi/files/ldflags.patch
+++ b/meta/recipes-bsp/libacpi/files/ldflags.patch
@@ -1,7 +1,6 @@
 libacpi: Remove QA warning: No GNU_HASH in the elf binary
-Upstream-Status: Inappropriate [other]
+Upstream-Status: Inactive-Upstream [last release before 2008, no vcs]
-  Useful within bitbake environment only.
 Signed-off-by: Muhammad Shakeel <muhammad_shakeel@mentor.com>
diff --git a/meta/recipes-bsp/libacpi/files/libacpi_fix_for_x32.patch b/meta/recipes-bsp/libacpi/files/libacpi_fix_for_x32.patch
index 06f20e5a78..955a175c96 100644
--- a/meta/recipes-bsp/libacpi/files/libacpi_fix_for_x32.patch
+++ b/meta/recipes-bsp/libacpi/files/libacpi_fix_for_x32.patch
@@ -1,4 +1,4 @@
-Upstream-Status: Pending
+Upstream-Status: Inactive-Upstream [last release before 2008, no vcs]
 Fix libacpi for x32
    
diff --git a/meta/recipes-bsp/libacpi/files/makefile-fix.patch b/meta/recipes-bsp/libacpi/files/makefile-fix.patch
index c34ef34e09..3b91bfaee1 100644
--- a/meta/recipes-bsp/libacpi/files/makefile-fix.patch
+++ b/meta/recipes-bsp/libacpi/files/makefile-fix.patch
@@ -1,4 +1,4 @@
-Upstream-Status: Pending
+Upstream-Status: Inactive-Upstream [last release before 2008, no vcs]
 ---
 Makefile  |    6 +++---
diff --git a/meta/recipes-bsp/libacpi/files/use_correct_strip_in_cross_environment.patch b/meta/recipes-bsp/libacpi/files/use_correct_strip_in_cross_environment.patch
index ef376aa316..901e5fa3b4 100644
--- a/meta/recipes-bsp/libacpi/files/use_correct_strip_in_cross_environment.patch
+++ b/meta/recipes-bsp/libacpi/files/use_correct_strip_in_cross_environment.patch
@@ -1,4 +1,4 @@
-Upstream-Status: Pending
+Upstream-Status: Inactive-Upstream [last release before 2008, no vcs]
 Used the cross strip instead of host strip to avoid this build error:
diff --git a/meta/recipes-bsp/libacpi/libacpi_0.2.bb b/meta/recipes-bsp/libacpi/libacpi_0.2.bb
index fa9e3d4894..f939d11f4c 100644
--- a/meta/recipes-bsp/libacpi/libacpi_0.2.bb
+++ b/meta/recipes-bsp/libacpi/libacpi_0.2.bb
@@ -5,7 +5,6 @@ SECTION = "base"
 HOMEPAGE = "http://www.ngolde.de/libacpi.html"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=fec17f82f16630adf2dfb7d2a46f21c5"
-PR = "r6"
 SRC_URI = "http://www.ngolde.de/download/libacpi-${PV}.tar.gz \
           file://makefile-fix.patch \
@@ -15,14 +14,13 @@ SRC_URI = "http://www.ngolde.de/download/libacpi-${PV}.tar.gz \
           file://0001-libacpi-Fix-build-witth-fno-commom.patch \
           "
-SRC_URI[md5sum] = "05b53dd7bead66dda35fec502b91066c"
 SRC_URI[sha256sum] = "13086e31d428b9c125954d48ac497b754bbbce2ef34ea29ecd903e82e25bad29"
 UPSTREAM_CHECK_URI = "http://www.ngolde.de/libacpi.html"
 inherit lib_package
-COMPATIBLE_HOST = '(x86_64|i.86).*-(linux|freebsd.*)'
+COMPATIBLE_HOST = '(x86_64|i.86|aarch64).*-(linux|freebsd.*)'
 CFLAGS += "-fPIC"
 EXTRA_OEMAKE = '-e MAKEFLAGS= STRIP="echo"'
diff --git a/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/0001-Fix-build-with-GCC-15.patch b/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/0001-Fix-build-with-GCC-15.patch
new file mode 100644
index 0000000000..e5e9125eea
--- /dev/null
+++ b/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/0001-Fix-build-with-GCC-15.patch
@@ -0,0 +1,186 @@
+From 3739faa41f60841d5277344b17ddc69e78ed8996 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sat, 22 Mar 2025 22:58:33 -0700
+Subject: [PATCH] Fix build with GCC 15
+This is collection of changes needed to get compiling with gcc-15
+which switched to use C23 as default std.
+Upstream-Status: Submitted [https://github.com/UweOhse/lrzsz/pull/8]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ lib/error.c        | 2 +-
+ lib/getopt.h       | 2 +-
+ lib/long-options.c | 4 ++--
+ lib/long-options.h | 2 +-
+ lib/xstrtol.c      | 2 --
+ src/lrz.c          | 8 +-------
+ src/lsz.c          | 8 +-------
+ src/tcp.c          | 2 +-
+ src/zglobal.h      | 2 +-
+ src/zreadline.c    | 2 +-
+ 10 files changed, 10 insertions(+), 24 deletions(-)
+diff --git a/lib/error.c b/lib/error.c
+index 8f679c7..4632c9c 100644
+--- a/lib/error.c
+++ b/lib/error.c
+@@ -73,7 +73,7 @@ extern char *program_name;
+ 
+ # if HAVE_STRERROR
+ #  ifndef strerror             /* On some systems, strerror is a macro */
+-char *strerror ();
+char *strerror (int);
+ #  endif
+ # else
+ static char *
+diff --git a/lib/getopt.h b/lib/getopt.h
+index 4ac33b7..46971cb 100644
+--- a/lib/getopt.h
+++ b/lib/getopt.h
+@@ -101,7 +101,7 @@ struct option
+    errors, only prototype getopt for the GNU C library.  */
+ extern int getopt (int argc, char *const *argv, const char *shortopts);
+ #else /* not __GNU_LIBRARY__ */
+-extern int getopt ();
+extern int getopt (int, char * const [], const char *);
+ #endif /* __GNU_LIBRARY__ */
+ extern int getopt_long (int argc, char *const *argv, const char *shortopts,
+                        const struct option *longopts, int *longind);
+diff --git a/lib/long-options.c b/lib/long-options.c
+index 9ee8f66..2c8d267 100644
+--- a/lib/long-options.c
+++ b/lib/long-options.c
+@@ -40,7 +40,7 @@ parse_long_options (argc, argv,version, usage)
+      int argc;
+      char **argv;
+      void (*version)();
+-     void (*usage)();
+     void (*usage)(int);
+ {
+   int c;
+   int saved_opterr;
+@@ -61,7 +61,7 @@ parse_long_options (argc, argv,version, usage)
+          (*usage) (0);
+ 
+        case 'v':
+-         (*version) (0);
+         (*version) ();
+          /* printf ("%s (%s) %s\n", command_name, package, version_string); */
+          exit (0);
+ 
+diff --git a/lib/long-options.h b/lib/long-options.h
+index 14459cd..3fb8fa6 100644
+--- a/lib/long-options.h
+++ b/lib/long-options.h
+@@ -6,5 +6,5 @@
+ #endif
+ 
+ void parse_long_options __P ((int _argc, char **_argv, 
+-                                                         void (*_version) (void), 
+                                                         void (*_version) (), 
+                                                          void (*_usage) (int)));
+diff --git a/lib/xstrtol.c b/lib/xstrtol.c
+index 8755cf4..0ab337d 100644
+--- a/lib/xstrtol.c
+++ b/lib/xstrtol.c
+@@ -65,8 +65,6 @@ extern int errno;
+        }                                                               \
+       while (0)
+ 
+-__unsigned long int __strtol ();
+-
+ /* FIXME: comment.  */
+ 
+ strtol_error
+diff --git a/src/lrz.c b/src/lrz.c
+index b3cf1d5..ae3c62d 100644
+--- a/src/lrz.c
+++ b/src/lrz.c
+@@ -41,12 +41,6 @@
+ #include "xstrtoul.h"
+ #include "error.h"
+ 
+-#ifndef STRICT_PROTOTYPES
+-extern time_t time();
+-extern char *strerror();
+-extern char *strstr();
+-#endif
+-
+ #ifndef HAVE_ERRNO_DECLARATION
+ extern int errno;
+ #endif
+@@ -191,7 +185,7 @@ int enable_syslog=FALSE;
+ 
+ 
+ /* called by signal interrupt or terminate to clean things up */
+-RETSIGTYPE
+void
+ bibi(int n)
+ {
+        if (zmodem_requested)
+diff --git a/src/lsz.c b/src/lsz.c
+index e9e4660..69f4fb8 100644
+--- a/src/lsz.c
+++ b/src/lsz.c
+@@ -50,12 +50,6 @@ void *mm_addr=NULL;
+ #include "xstrtoul.h"
+ #include "error.h"
+ 
+-#ifndef STRICT_PROTOTYPES
+-extern time_t time();
+-extern char *strerror();
+-extern char *strstr();
+-#endif
+-
+ #ifndef HAVE_ERRNO_DECLARATION
+ extern int errno;
+ #endif
+@@ -218,7 +212,7 @@ static int zrqinits_sent=0;
+ static int play_with_sigint=0;
+ 
+ /* called by signal interrupt or terminate to clean things up */
+-RETSIGTYPE
+void
+ bibi (int n)
+ {
+        canit(STDOUT_FILENO);
+diff --git a/src/tcp.c b/src/tcp.c
+index 137f94c..a885d5b 100644
+--- a/src/tcp.c
+++ b/src/tcp.c
+@@ -38,7 +38,7 @@
+ #include <stdlib.h>
+ #include "error.h"
+ 
+-static RETSIGTYPE
+static void
+ tcp_alarm_handler(int dummy LRZSZ_ATTRIB_UNUSED)
+ {
+     /* doesn't need to do anything */
+diff --git a/src/zglobal.h b/src/zglobal.h
+index 573b461..55bd58f 100644
+--- a/src/zglobal.h
+++ b/src/zglobal.h
+@@ -357,7 +357,7 @@ extern int no_timeout;
+ extern int Zctlesc;    /* Encode control characters */
+ extern int under_rsh;
+ 
+-RETSIGTYPE bibi __P ((int n));
+void bibi __P ((int n));
+ 
+ #define sendline(c) putchar((c) & 0377)
+ #define xsendline(c) putchar(c)
+diff --git a/src/zreadline.c b/src/zreadline.c
+index aeda95c..c8f8263 100644
+--- a/src/zreadline.c
+++ b/src/zreadline.c
+@@ -43,7 +43,7 @@ static char *readline_buffer;
+ int readline_left=0;
+ char *readline_ptr;
+ 
+-static RETSIGTYPE
+static void
+ zreadline_alarm_handler(int dummy LRZSZ_ATTRIB_UNUSED)
+ {
+        /* doesn't need to do anything */
diff --git a/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/0001-Fix-cross-compilation-using-autoconf-detected-AR.patch b/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/0001-Fix-cross-compilation-using-autoconf-detected-AR.patch
index 47c7ec4170..c8f0e2c4fe 100644
--- a/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/0001-Fix-cross-compilation-using-autoconf-detected-AR.patch
+++ b/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/0001-Fix-cross-compilation-using-autoconf-detected-AR.patch
@@ -6,7 +6,7 @@ Subject: [PATCH] Fix cross compilation using autoconf detected AR
 currently its using 'ar' program from build host, which is not expected,
 we need to respect AR passed in environment
-Upstream-Status: Pending
+Upstream-Status: Inappropriate [upstream hasn't been active since 1998]
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
 ---
diff --git a/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/autotools-update.patch b/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/autotools-update.patch
index 33af38b4a8..ebd4a88081 100644
--- a/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/autotools-update.patch
+++ b/meta/recipes-bsp/lrzsz/lrzsz-0.12.20/autotools-update.patch
@@ -1,6 +1,6 @@
 Update autotools infrastructure (including gettext) to modern versions.
-Upstream-Status: Pending
+Upstream-Status: Inappropriate [upstream hasn't been active since 1998]
 Signed-off-by: Phil Blundell <pb@pbcl.net>
 diff -uprN clean/lrzsz-0.12.20/configure.in lrzsz-0.12.20/configure.in
diff --git a/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb b/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb
index 54c431eeb3..777560bd22 100644
--- a/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb
+++ b/meta/recipes-bsp/lrzsz/lrzsz_0.12.20.bb
@@ -5,24 +5,22 @@ These programs use error correcting protocols ({z,x,y}modem) to send (sz, sx, sb
 receive (rz, rx, rb) files over a dial-in serial port from a variety of programs \
 running under various operating systems. "
 HOMEPAGE = "http://www.ohse.de/uwe/software/lrzsz.html"
-LICENSE = "GPLv2+"
+LICENSE = "GPL-2.0-or-later"
 LIC_FILES_CHKSUM = "file://COPYING;md5=0636e73ff0215e8d672dc4c32c317bb3 \
                        file://src/lrz.c;beginline=1;endline=10;md5=5276956373ff7d8758837f6399a1045f"
 SECTION = "console/network"
 DEPENDS = ""
-PR = "r6"
-SRC_URI = "http://www.ohse.de/uwe/releases/lrzsz-${PV}.tar.gz \
+SRC_URI = "https://www.ohse.de/uwe/releases/lrzsz-${PV}.tar.gz \
           file://autotools-update.patch \
-           file://autotools.patch \
+           file://autotools.patch \
-           file://makefile.patch \
+           file://makefile.patch \
           file://lrzsz-check-locale.h.patch \
           file://cve-2018-10195.patch \
           file://include.patch \
           file://0001-Fix-cross-compilation-using-autoconf-detected-AR.patch \
+           file://0001-Fix-build-with-GCC-15.patch \
           "
-SRC_URI[md5sum] = "b5ce6a74abc9b9eb2af94dffdfd372a4"
 SRC_URI[sha256sum] = "c28b36b14bddb014d9e9c97c52459852f97bd405f89113f30bee45ed92728ff1"
 UPSTREAM_CHECK_URI = "http://ohse.de/uwe/software/lrzsz.html"
@@ -38,7 +36,7 @@ inherit update-alternatives
 ALTERNATIVE_PRIORITY = "100"
-ALTERNATIVE_${PN} = "rz rx rb sz sx sb"
+ALTERNATIVE:${PN} = "rz rx rb sz sx sb"
 ALTERNATIVE_TARGET[rz] = "${bindir}/lrz"
 ALTERNATIVE_TARGET[rx] = "${bindir}/lrz"
@@ -47,3 +45,9 @@ ALTERNATIVE_TARGET[rb] = "${bindir}/lrz"
 ALTERNATIVE_TARGET[sz] = "${bindir}/lsz"
 ALTERNATIVE_TARGET[sx] = "${bindir}/lsz"
 ALTERNATIVE_TARGET[sb] = "${bindir}/lsz"
+# http://errors.yoctoproject.org/Errors/Details/766929/
+# lrzsz-0.12.20/src/tcp.c:75:56: error: passing argument 3 of 'getsockname' from incompatible pointer type [-Wincompatible-pointer-types]
+# lrzsz-0.12.20/src/tcp.c:83:52: error: passing argument 3 of 'getsockname' from incompatible pointer type [-Wincompatible-pointer-types]
+# lrzsz-0.12.20/src/tcp.c:103:51: error: passing argument 3 of 'accept' from incompatible pointer type [-Wincompatible-pointer-types]
+CFLAGS += "-Wno-error=incompatible-pointer-types"
diff --git a/meta/recipes-bsp/opensbi/files/0001-Makefile-Don-t-specify-mabi-or-march.patch b/meta/recipes-bsp/opensbi/files/0001-Makefile-Don-t-specify-mabi-or-march.patch
deleted file mode 100644
index d2a8048e87..0000000000
--- a/meta/recipes-bsp/opensbi/files/0001-Makefile-Don-t-specify-mabi-or-march.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From fe9860fd85e49a75bef545e5d9914070491e8002 Mon Sep 17 00:00:00 2001
-From: Alistair Francis <alistair.francis@wdc.com>
-Date: Fri, 15 Feb 2019 14:57:41 -0800
-Subject: [PATCH] Makefile: Don't specify mabi or march
-To avoid
-    can't link double-float modules with soft-float modules
-errors when building 32-bit openSBI don't specify mabi or march.
-Upstream-Status: Inappropriate [Fixes a 32-bit OE flow bug]
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
- Makefile | 2 --
- 1 file changed, 2 deletions(-)
-diff --git a/Makefile b/Makefile
-index ccf8ea3..69e5b38 100644
--- a/Makefile
-+++ b/Makefile
-@@ -169,7 +169,6 @@ GENFLAGS    +=      $(firmware-genflags-y)
- CFLAGS         =       -g -Wall -Werror -ffreestanding -nostdlib -fno-strict-aliasing -O2
- CFLAGS         +=      -fno-omit-frame-pointer -fno-optimize-sibling-calls
- CFLAGS         +=      -mno-save-restore -mstrict-align
-CFLAGS         +=      -mabi=$(PLATFORM_RISCV_ABI) -march=$(PLATFORM_RISCV_ISA)
- CFLAGS         +=      -mcmodel=$(PLATFORM_RISCV_CODE_MODEL)
- CFLAGS         +=      $(GENFLAGS)
- CFLAGS         +=      $(platform-cflags-y)
-@@ -183,7 +182,6 @@ CPPFLAGS    +=      $(firmware-cppflags-y)
- ASFLAGS                =       -g -Wall -nostdlib -D__ASSEMBLY__
- ASFLAGS                +=      -fno-omit-frame-pointer -fno-optimize-sibling-calls
- ASFLAGS                +=      -mno-save-restore -mstrict-align
-ASFLAGS                +=      -mabi=$(PLATFORM_RISCV_ABI) -march=$(PLATFORM_RISCV_ISA)
- ASFLAGS                +=      -mcmodel=$(PLATFORM_RISCV_CODE_MODEL)
- ASFLAGS                +=      $(GENFLAGS)
- ASFLAGS                +=      $(platform-asflags-y)
diff --git a/meta/recipes-bsp/opensbi/opensbi-payloads.inc b/meta/recipes-bsp/opensbi/opensbi-payloads.inc
index 2e32943245..a55679632e 100644
--- a/meta/recipes-bsp/opensbi/opensbi-payloads.inc
+++ b/meta/recipes-bsp/opensbi/opensbi-payloads.inc
@@ -1,21 +1,38 @@
 def riscv_get_extra_oemake_image(d):
    sbi_payload = d.getVar('RISCV_SBI_PAYLOAD')
-    deploy_dir = d.getVar('DEPLOY_DIR_IMAGE')
    if sbi_payload is None:
        return ""
+    deploy_dir = d.getVar('DEPLOY_DIR_IMAGE')
    return "FW_PAYLOAD_PATH=" + deploy_dir + "/" + sbi_payload
-def riscv_get_do_compile_depends(d):
+def riscv_get_extra_oemake_fdt(d):
-    sbi_payload = d.getVar('RISCV_SBI_PAYLOAD')
+    if d.getVar('RISCV_SBI_PAYLOAD') is None:
+        return ""
+    sbi_fdt = d.getVar('RISCV_SBI_FDT')
+    deploy_dir = d.getVar('DEPLOY_DIR_IMAGE')
-    if sbi_payload is None:
+    if sbi_fdt is None:
+        return ""
+    return "FW_FDT_PATH=" + deploy_dir + "/" + sbi_fdt
+def riscv_get_do_compile_depends(d):
+    sbi_payload = d.getVar('RISCV_SBI_PAYLOAD') or ""
+    if sbi_payload == "":
        return ""
+    sbi_fdt = d.getVar('RISCV_SBI_FDT') or ""
+    if sbi_fdt != "" and 'u-boot.bin' in sbi_payload:
+        return "virtual/kernel:do_deploy virtual/bootloader:do_deploy"
    if 'linux' in sbi_payload or 'Image' in sbi_payload:
        return "virtual/kernel:do_deploy"
    if 'u-boot.bin' in sbi_payload:
        return "virtual/bootloader:do_deploy"
+    if sbi_fdt != "":
+        return "virtual/kernel:do_deploy"
    return ""
diff --git a/meta/recipes-bsp/opensbi/opensbi_0.9.bb b/meta/recipes-bsp/opensbi/opensbi_1.7.bb
index cb1c3f2ebf..a460062e93 100644
--- a/meta/recipes-bsp/opensbi/opensbi_0.9.bb
+++ b/meta/recipes-bsp/opensbi/opensbi_1.7.bb
@@ -6,23 +6,31 @@ LIC_FILES_CHKSUM = "file://COPYING.BSD;md5=42dd9555eb177f35150cf9aa240b61e5"
 require opensbi-payloads.inc
-inherit autotools-brokensep deploy
+inherit deploy
-SRCREV = "234ed8e427f4d92903123199f6590d144e0d9351"
+SRCREV = "a32a91069119e7a5aa31e6bc51d5e00860be3d80"
-SRC_URI = "git://github.com/riscv/opensbi.git;branch=master \
+SRC_URI = "git://github.com/riscv/opensbi.git;branch=master;protocol=https"
-           file://0001-Makefile-Don-t-specify-mabi-or-march.patch \
-          "
-S = "${WORKDIR}/git"
+TARGET_DBGSRC_DIR = "/share/opensbi/*/generic/firmware/"
-EXTRA_OEMAKE += "PLATFORM=${RISCV_SBI_PLAT} I=${D}"
+TARGET_CC_ARCH += "${LDFLAGS}"
+RISCV_SBI_FW_TEXT_START ??= "0x80000000"
+EXTRA_OEMAKE += "REPRODUCIBLE=y CROSS_COMPILE=${HOST_PREFIX} ELFFLAGS="${LDFLAGS}" PLATFORM=${RISCV_SBI_PLAT} I=${D} FW_TEXT_START=${RISCV_SBI_FW_TEXT_START}"
+EXTRA_OEMAKE:append:toolchain-clang = " LLVM=y"
 # If RISCV_SBI_PAYLOAD is set then include it as a payload
-EXTRA_OEMAKE_append = " ${@riscv_get_extra_oemake_image(d)}"
+EXTRA_OEMAKE:append = " ${@riscv_get_extra_oemake_image(d)}"
+EXTRA_OEMAKE:append = " ${@riscv_get_extra_oemake_fdt(d)}"
 # Required if specifying a custom payload
 do_compile[depends] += "${@riscv_get_do_compile_depends(d)}"
-do_install_append() {
+do_compile() {
+        oe_runmake
+}
+do_install() {
+        oe_runmake DESTDIR=${D} install
        # In the future these might be required as a dependency for other packages.
        # At the moment just delete them to avoid warnings
        rm -r ${D}/include
@@ -38,11 +46,8 @@ do_deploy () {
 addtask deploy before do_build after do_install
-FILES_${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_jump.*"
+FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_jump.*"
-FILES_${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_payload.*"
+FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_payload.*"
-FILES_${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_dynamic.*"
+FILES:${PN} += "/share/opensbi/*/${RISCV_SBI_PLAT}/firmware/fw_dynamic.*"
 COMPATIBLE_HOST = "(riscv64|riscv32).*"
-INHIBIT_PACKAGE_STRIP = "1"
-SECURITY_CFLAGS = ""
diff --git a/meta/recipes-bsp/pciutils/pciutils/configure.patch b/meta/recipes-bsp/pciutils/pciutils/configure.patch
deleted file mode 100644
index e444c13975..0000000000
--- a/meta/recipes-bsp/pciutils/pciutils/configure.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-This patch:
-* ensures we link correctly
-* allows us to optionally pass target information to configure rather than using uname
-* select linux as the platform in most cases we care about
-This is a merge of various tweaks to allow us to build pciutils including 
-work from:
-7/30/2010 - Qing He <qing.he@intel.com>
-1/22/2012 - Shane Wang <shane.wang@intel.com>
-Ionut Radu <ionutx.radu@intel.com>
-2017/6/15 - RP - Cleanups and merging patches
-Upstream-Status: Inappropriate [embedded specific]
-Index: pciutils-3.5.6/Makefile
-===================================================================
--- pciutils-3.5.6.orig/Makefile
-+++ pciutils-3.5.6/Makefile
-@@ -96,7 +96,7 @@ example: example.o lib/$(PCILIB)
- example.o: example.c $(PCIINC)
- 
- %: %.o
-       $(CC) $(LDFLAGS) $(TARGET_ARCH) $^ $(LDLIBS) -o $@
-+       $(CC) $(LDFLAGS) $(TARGET_ARCH) $^ $(LIB_LDLIBS) $(LDLIBS) -o $@
- 
- %.8 %.7 %.5: %.man
-        M=`echo $(DATE) | sed 's/-01-/-January-/;s/-02-/-February-/;s/-03-/-March-/;s/-04-/-April-/;s/-05-/-May-/;s/-06-/-June-/;s/-07-/-July-/;s/-08-/-August-/;s/-09-/-September-/;s/-10-/-October-/;s/-11-/-November-/;s/-12-/-December-/;s/\(.*\)-\(.*\)-\(.*\)/\3 \2 \1/'` ; sed <$< >$@ "s/@TODAY@/$$M/;s/@VERSION@/pciutils-$(VERSION)/;s#@IDSDIR@#$(IDSDIR)#"
-Index: pciutils-3.5.6/lib/configure
-===================================================================
--- pciutils-3.5.6.orig/lib/configure
-+++ pciutils-3.5.6/lib/configure
-@@ -9,6 +9,10 @@ echo_n() {
-        printf '%s' "$*"
- }
- 
-+VERSION=$1
-+IDSDIR=$2
-+DNS=yes
-+
- if [ -z "$VERSION" -o -z "$IDSDIR" ] ; then
-        echo >&2 "Please run the configure script from the top-level Makefile"
-        exit 1
-@@ -16,8 +20,8 @@ fi
- 
- echo_n "Configuring libpci for your system..."
- if [ -z "$HOST" ] ; then
-       sys=`uname -s`
-       rel=`uname -r`
-+       sys=${3:-`uname -s`}
-+       rel=
-        realsys="$sys"
-        if [ "$sys" = "AIX" -a -x /usr/bin/oslevel -a -x /usr/sbin/lsattr ]
-        then
-@@ -25,7 +29,7 @@ if [ -z "$HOST" ] ; then
-                proc=`/usr/sbin/lsdev -C -c processor -S available -F name | head -1`
-                cpu=`/usr/sbin/lsattr -F value -l $proc -a type | sed 's/_.*//'`
-        else
-               cpu=`uname -m | sed 's/^i.86$/i386/;s/^sun4u$/sparc64/;s/^i86pc$/i386/;s/^BePC$/i386/;s/^BeMac$/powerpc/;s/^BeBox$/powerpc/'`
-+               cpu=${4:-`uname -m | sed 's/^i.86$/i386/;s/^sun4u$/sparc64/;s/^i86pc$/i386/;s/^BePC$/i386/;s/^BeMac$/powerpc/;s/^BeBox$/powerpc/'`}
-        fi
-        if [ "$sys" = "GNU/kFreeBSD" -o "$sys" = "DragonFly" ]
-        then
-@@ -35,7 +39,7 @@ if [ -z "$HOST" ] ; then
-        then
-                sys=cygwin
-        fi
-       HOST=${3:-$cpu-$sys}
-+       HOST=$cpu-$sys
- fi
- [ -n "$RELEASE" ] && rel="${RELEASE}"
- # CAVEAT: tr on Solaris is a bit weird and the extra [] is otherwise harmless.
-@@ -44,6 +48,8 @@ cpu=`echo $host | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\1/'`
- sys=`echo $host | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\3/'`
- echo " $host $rel $cpu $sys"
- 
-+{ echo "$host" | grep linux; } && sys=linux
-+
- c=config.h
- m=config.mk
- echo >$c '#define PCI_CONFIG_H'
diff --git a/meta/recipes-bsp/pciutils/pciutils_3.14.0.bb b/meta/recipes-bsp/pciutils/pciutils_3.14.0.bb
new file mode 100644
index 0000000000..a267ea34b7
--- /dev/null
+++ b/meta/recipes-bsp/pciutils/pciutils_3.14.0.bb
@@ -0,0 +1,55 @@
+SUMMARY = "PCI utilities"
+DESCRIPTION = 'The PCI Utilities package contains a library for portable access \
+to PCI bus configuration space and several utilities based on this library.'
+HOMEPAGE = "https://mj.ucw.cz/sw/pciutils/"
+SECTION = "console/utils"
+LICENSE = "GPL-2.0-or-later"
+LIC_FILES_CHKSUM = "file://COPYING;md5=751419260aa954499f7abaabaa882bbe"
+# Can drop make-native when all systems have make 4.3
+# https://git.savannah.gnu.org/cgit/make.git/commit/?id=b90fabc8d6f34fb37d428dc0fb1b8b1951a9fbed
+# causes space issues in lib/libpci.pc
+DEPENDS = "make-native"
+SRC_URI = "${KERNELORG_MIRROR}/software/utils/pciutils/pciutils-${PV}.tar.xz"
+SRC_URI[sha256sum] = "e7713409882813991d2269d125e40dad1f54a019a52b78b3962941c1d4a6f86f"
+inherit multilib_header pkgconfig update-alternatives
+PACKAGECONFIG ??= "hwdb kmod zlib"
+PACKAGECONFIG[hwdb] = "HWDB=yes,HWDB=no,udev"
+PACKAGECONFIG[kmod] = "LIBKMOD=yes,LIBKMOD=no,kmod"
+PACKAGECONFIG[zlib] = "ZLIB=yes,ZLIB=no,zlib"
+# Configuration options
+EXTRA_OEMAKE += "${PACKAGECONFIG_CONFARGS} DNS=yes SHARED=yes"
+# Construct a HOST that matches what lib/configure expects
+EXTRA_OEMAKE += "HOST="${HOST_ARCH}-${HOST_OS}""
+# Toolchain. We need to pass CFLAGS via CC as this is the only variable
+# available to the caller without clobbering assignments (notably, -fPIC)
+EXTRA_OEMAKE += "CC="${CC} ${CFLAGS}" AR="${AR}" STRIP= LDFLAGS="${LDFLAGS}""
+# Paths
+EXTRA_OEMAKE += "PREFIX=${prefix} LIBDIR=${libdir} SBINDIR=${sbindir} SHAREDIR=${datadir} MANDIR=${mandir}"
+do_install () {
+        # Do these in separate calls as they expose a race in pseudo when creating
+        # symlinks when ran in parallel.
+        oe_runmake DESTDIR=${D} install
+        oe_runmake DESTDIR=${D} install-lib
+        install -d ${D}${bindir}
+        oe_multilib_header pci/config.h
+}
+PACKAGES =+ "${PN}-ids libpci"
+FILES:${PN}-ids = "${datadir}/pci.ids*"
+SUMMARY:${PN}-ids = "PCI utilities - device ID database"
+DESCRIPTION:${PN}-ids = "Package providing the PCI device ID database for pciutils."
+RDEPENDS:${PN} += "${PN}-ids"
+FILES:libpci = "${libdir}/libpci.so.*"
+ALTERNATIVE:${PN} = "lspci"
+ALTERNATIVE_PRIORITY = "100"
diff --git a/meta/recipes-bsp/pciutils/pciutils_3.7.0.bb b/meta/recipes-bsp/pciutils/pciutils_3.7.0.bb
deleted file mode 100644
index 4f0edc01ed..0000000000
--- a/meta/recipes-bsp/pciutils/pciutils_3.7.0.bb
+++ /dev/null
@@ -1,59 +0,0 @@
-SUMMARY = "PCI utilities"
-DESCRIPTION = 'The PCI Utilities package contains a library for portable access \
-to PCI bus configuration space and several utilities based on this library.'
-HOMEPAGE = "http://atrey.karlin.mff.cuni.cz/~mj/pciutils.shtml"
-SECTION = "console/utils"
-LICENSE = "GPLv2+"
-LIC_FILES_CHKSUM = "file://COPYING;md5=751419260aa954499f7abaabaa882bbe"
-DEPENDS = "zlib kmod"
-SRC_URI = "${KERNELORG_MIRROR}/software/utils/pciutils/pciutils-${PV}.tar.xz \
-           file://configure.patch"
-SRC_URI[sha256sum] = "9d40b97be8b6a2cdf96aead5a61881d1f7e4e0da9544a9bac4fba1ae9dcd40eb"
-inherit multilib_header pkgconfig
-PACKAGECONFIG ??= "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'hwdb', '', d)}"
-PACKAGECONFIG[hwdb] = "HWDB=yes,HWDB=no,udev"
-PCI_CONF_FLAG = "ZLIB=yes DNS=yes SHARED=yes STRIP= LIBDIR=${libdir}"
-# see configure.patch
-do_configure () {
-        (
-          cd lib && \
-          # PACKAGECONFIG_CONFARGS for this recipe could only possibly contain 'HWDB=yes/no',
-          # so we put it before ./configure
-          ${PCI_CONF_FLAG} ${PACKAGECONFIG_CONFARGS} ./configure ${PV} ${datadir} ${TARGET_OS} ${TARGET_ARCH}
-        )
-}
-export PREFIX = "${prefix}"
-export SBINDIR = "${sbindir}"
-export SHAREDIR = "${datadir}"
-export MANDIR = "${mandir}"
-EXTRA_OEMAKE = "-e MAKEFLAGS= ${PCI_CONF_FLAG}"
-ASNEEDED = ""
-# The configure script breaks if the HOST variable is set
-HOST[unexport] = "1"
-do_install () {
-        oe_runmake DESTDIR=${D} install install-lib
-        install -d ${D}${bindir}
-        ln -s ../sbin/lspci ${D}${bindir}/lspci
-        oe_multilib_header pci/config.h
-}
-PACKAGES =+ "${PN}-ids libpci"
-FILES_${PN}-ids = "${datadir}/pci.ids*"
-FILES_libpci = "${libdir}/libpci.so.*"
-SUMMARY_${PN}-ids = "PCI utilities - device ID database"
-DESCRIPTION_${PN}-ids = "Package providing the PCI device ID database for pciutils."
-RDEPENDS_${PN} += "${PN}-ids"
diff --git a/meta/recipes-bsp/pm-utils/pm-utils_1.4.1.bb b/meta/recipes-bsp/pm-utils/pm-utils_1.4.1.bb
index cac09101c4..8756511c17 100644
--- a/meta/recipes-bsp/pm-utils/pm-utils_1.4.1.bb
+++ b/meta/recipes-bsp/pm-utils/pm-utils_1.4.1.bb
@@ -2,26 +2,26 @@ SECTION = "base"
 SUMMARY = "Utilities and scripts for power management"
 DESCRIPTION = "Simple shell command line tools to suspend and hibernate."
 HOMEPAGE = "http://pm-utils.freedesktop.org/wiki/"
-LICENSE = "GPLv2"
+LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://COPYING;md5=94d55d512a9ba36caa9b7df079bae19f \
                    file://src/pm-pmu.c;beginline=1;endline=22;md5=3c1ddbc54e735fb4a0386e14c78a3147"
-PR = "r1"
 SRC_URI = "http://pm-utils.freedesktop.org/releases/pm-utils-${PV}.tar.gz"
-SRC_URI[md5sum] = "1742a556089c36c3a89eb1b957da5a60"
 SRC_URI[sha256sum] = "8ed899032866d88b2933a1d34cc75e8ae42dcde20e1cc21836baaae3d4370c0b"
 inherit pkgconfig autotools manpages
 PACKAGECONFIG[manpages] = "--enable-doc, --disable-doc, libxslt-native xmlto-native"
-RDEPENDS_${PN} = "grep bash"
+RDEPENDS:${PN} = "bash"
+EXTRA_OECONF = "--libdir=${nonarch_libdir}"
-do_configure_prepend () {
+do_configure:prepend () {
        ( cd ${S}; autoreconf -f -i -s )
 }
-FILES_${PN} += "${libdir}/${BPN}/*"
+FILES:${PN} += "${nonarch_libdir}/${BPN}/*"
-FILES_${PN}-dbg += "${datadir}/doc/pm-utils/README.debugging"
+FILES:${PN}-dbg += "${datadir}/doc/pm-utils/README.debugging"
+FILES:${PN}-dev += "${nonarch_libdir}/pkgconfig/pm-utils.pc"
diff --git a/meta/recipes-bsp/setserial/setserial/0001-setserial.c-Add-needed-system-headers-for-ioctl-and-.patch b/meta/recipes-bsp/setserial/setserial/0001-setserial.c-Add-needed-system-headers-for-ioctl-and-.patch
new file mode 100644
index 0000000000..10c6ae881b
--- /dev/null
+++ b/meta/recipes-bsp/setserial/setserial/0001-setserial.c-Add-needed-system-headers-for-ioctl-and-.patch
@@ -0,0 +1,41 @@
+From 9bbb342f5d9ad5dc75486fd35ada8e287ba19299 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Mon, 15 Aug 2022 13:03:17 -0700
+Subject: [PATCH] setserial.c: Add needed system headers for ioctl() and
+ close() calls
+Add int return type for main() function
+Fixes
+error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int]
+error: call to undeclared function 'close'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declarat
+ion]
+Upstream-Status: Submitted [https://sourceforge.net/p/setserial/discussion/7060/thread/95d874c12c/]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ setserial.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/setserial.c b/setserial.c
+index bfda8fd..6a95513 100644
+--- a/setserial.c
+++ b/setserial.c
+@@ -16,6 +16,8 @@
+ #include <termios.h>
+ #include <string.h>
+ #include <errno.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+ 
+ #ifdef HAVE_ASM_IOCTLS_H
+ #include <asm/ioctls.h>
+@@ -715,7 +717,7 @@ fprintf(stderr, "\t* port\t\tset the I/O port\n");
+        exit(1);
+ }
+ 
+-main(int argc, char **argv)
+int main(int argc, char **argv)
+ {
+        int     get_flag = 0, wild_intr_flag = 0;
+        int     c;
diff --git a/meta/recipes-bsp/setserial/setserial_2.17.bb b/meta/recipes-bsp/setserial/setserial_2.17.bb
index 8dbddd7dc5..e1e80e31ae 100644
--- a/meta/recipes-bsp/setserial/setserial_2.17.bb
+++ b/meta/recipes-bsp/setserial/setserial_2.17.bb
@@ -1,23 +1,21 @@
 SUMMARY = "Controls the configuration of serial ports"
 DESCRIPTION = "setserial is a program designed to set and/or report the configuration information associated with a serial port"
 HOMEPAGE = "http://setserial.sourceforge.net"
-AUTHOR = "Theodore Ts'o <tytso@mit.edu>"
 SECTION = "console/utils"
-LICENSE = "GPLv2.0"
+LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://version.h;beginline=1;endline=6;md5=2e7c59cb9e57e356ae81f50f4e4dfd99"
-PR = "r3"
 DEPENDS += "groff-native"
-inherit autotools-brokensep
+inherit autotools-brokensep sourceforge-releases
 SRC_URI = "${SOURCEFORGE_MIRROR}/setserial/${BPN}-${PV}.tar.gz \
           file://add_stdlib.patch \
           file://ldflags.patch \
-          "
+           file://0001-setserial.c-Add-needed-system-headers-for-ioctl-and-.patch \
+           "
-SRC_URI[md5sum] = "c4867d72c41564318e0107745eb7a0f2"
 SRC_URI[sha256sum] = "7e4487d320ac31558563424189435d396ddf77953bb23111a17a3d1487b5794a"
 do_install() {
diff --git a/meta/recipes-bsp/u-boot/files/disable-CONFIG_BLOBLIST.cfg b/meta/recipes-bsp/u-boot/files/disable-CONFIG_BLOBLIST.cfg
new file mode 100644
index 0000000000..d01d3d12d8
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/disable-CONFIG_BLOBLIST.cfg
@@ -0,0 +1 @@
+# CONFIG_BLOBLIST is not set
diff --git a/meta/recipes-bsp/u-boot/files/disable_CONFIG_USB.cfg b/meta/recipes-bsp/u-boot/files/disable_CONFIG_USB.cfg
new file mode 100644
index 0000000000..1d2509982b
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/disable_CONFIG_USB.cfg
@@ -0,0 +1 @@
+# CONFIG_USB is not set
diff --git a/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_a.cfg b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_a.cfg
new file mode 100644
index 0000000000..fc45b64480
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_a.cfg
@@ -0,0 +1 @@
+CONFIG_RISCV_ISA_A=y
diff --git a/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_c.cfg b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_c.cfg
new file mode 100644
index 0000000000..1cb459f636
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_c.cfg
@@ -0,0 +1 @@
+CONFIG_RISCV_ISA_C=y
diff --git a/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_clear.cfg b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_clear.cfg
new file mode 100644
index 0000000000..ce90da23ce
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_clear.cfg
@@ -0,0 +1,6 @@
+# CONFIG_RISCV_ISA_C is not set
+# CONFIG_RISCV_ISA_F is not set
+# CONFIG_RISCV_ISA_D is not set
+# CONFIG_RISCV_ISA_ZBB is not set
+# CONFIG_RISCV_ISA_A is not set
+# CONFIG_RISCV_ISA_ZICBOM is not set
diff --git a/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_d.cfg b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_d.cfg
new file mode 100644
index 0000000000..fd25fa4e89
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_d.cfg
@@ -0,0 +1 @@
+CONFIG_RISCV_ISA_D=y
diff --git a/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_f.cfg b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_f.cfg
new file mode 100644
index 0000000000..dfa9876f82
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_f.cfg
@@ -0,0 +1 @@
+CONFIG_RISCV_ISA_F=y
diff --git a/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_zbb.cfg b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_zbb.cfg
new file mode 100644
index 0000000000..2b71b016f8
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_zbb.cfg
@@ -0,0 +1 @@
+CONFIG_RISCV_ISA_ZBB=y
diff --git a/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_zicbom.cfg b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_zicbom.cfg
new file mode 100644
index 0000000000..96daf04b20
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/u-boot-riscv-isa_zicbom.cfg
@@ -0,0 +1 @@
+CONFIG_RISCV_ISA_ZICBOM=y
diff --git a/meta/recipes-bsp/u-boot/libubootenv/0001-Update-cmake_minimum_required-to-3.5.patch b/meta/recipes-bsp/u-boot/libubootenv/0001-Update-cmake_minimum_required-to-3.5.patch
new file mode 100644
index 0000000000..ee174ca59e
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/libubootenv/0001-Update-cmake_minimum_required-to-3.5.patch
@@ -0,0 +1,50 @@
+From cd12d9dd2bea8e4580f458df77229477fc55ba70 Mon Sep 17 00:00:00 2001
+From: James Hilliard <james.hilliard1@gmail.com>
+Date: Wed, 14 May 2025 14:17:40 -0600
+Subject: [PATCH] Update cmake_minimum_required to 3.5
+This supports compilation with cmake-4.0.0.
+Fixes:
+CMake Error at CMakeLists.txt:5 (cmake_minimum_required):
+  Compatibility with CMake < 3.5 has been removed from CMake.
+  Update the VERSION argument <min> value.  Or, use the <min>...<max> syntax
+  to tell CMake that the project requires at least <min> but has been updated
+  to work with policies introduced by <max> or earlier.
+  Or, add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to try configuring anyway.
+Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
+Upstream-Status: Backport [cd12d9dd2bea8e4580f458df77229477fc55ba70]
+---
+ CMakeLists.txt     | 2 +-
+ src/CMakeLists.txt | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 796d7bc..0a11730 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -2,7 +2,7 @@
+ #
+ # SPDX-License-Identifier:     LGPL-2.1-or-later
+-cmake_minimum_required (VERSION 2.6)
+cmake_minimum_required (VERSION 3.5)
+ project (libubootenv C)
+ # The version number.
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index c56d0c7..3370232 100644
+--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
+@@ -1,7 +1,7 @@
+ # SPDX-FileCopyrightText: 2019-2021 Stefano Babic <stefano.babic@swupdate.org>
+ #
+ # SPDX-License-Identifier:     LGPL-2.1-or-later
+-cmake_minimum_required (VERSION 2.6)
+cmake_minimum_required (VERSION 3.5)
+ # Sources and private headers
+ SET(libubootenv_SOURCES
+   uboot_env.c
diff --git a/meta/recipes-bsp/u-boot/libubootenv_0.3.1.bb b/meta/recipes-bsp/u-boot/libubootenv_0.3.1.bb
deleted file mode 100644
index 613e3161fb..0000000000
--- a/meta/recipes-bsp/u-boot/libubootenv_0.3.1.bb
+++ /dev/null
@@ -1,30 +0,0 @@
-SUMMARY = "U-Boot libraries and tools to access environment"
-DESCRIPTION = "This package contains tools and libraries to read \
-and modify U-Boot environment. \
-It provides a hardware-independent replacement for fw_printenv/setenv utilities \
-provided by U-Boot"
-HOMEPAGE = "https://github.com/sbabic/libubootenv"
-LICENSE = "LGPL-2.1"
-LIC_FILES_CHKSUM = "file://Licenses/lgpl-2.1.txt;md5=4fbd65380cdd255951079008b364516c"
-SECTION = "libs"
-SRC_URI = "git://github.com/sbabic/libubootenv;protocol=https"
-SRCREV = "824551ac77bab1d0f7ae34d7a7c77b155240e754"
-S = "${WORKDIR}/git"
-inherit uboot-config cmake lib_package
-EXTRA_OECMAKE = "-DCMAKE_BUILD_TYPE=Release"
-DEPENDS = "zlib"
-PROVIDES += "u-boot-fw-utils"
-RPROVIDES_${PN}-bin += "u-boot-fw-utils"
-PACKAGE_ARCH = "${MACHINE_ARCH}"
-RRECOMMENDS_${PN}-bin_append_class-target = " u-boot-default-env"
-BBCLASSEXTEND = "native"
diff --git a/meta/recipes-bsp/u-boot/libubootenv_0.3.6.bb b/meta/recipes-bsp/u-boot/libubootenv_0.3.6.bb
new file mode 100644
index 0000000000..b63b8ff87d
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/libubootenv_0.3.6.bb
@@ -0,0 +1,26 @@
+SUMMARY = "U-Boot libraries and tools to access environment"
+DESCRIPTION = "This package contains tools and libraries to read \
+and modify U-Boot environment. \
+It provides a hardware-independent replacement for fw_printenv/setenv utilities \
+provided by U-Boot"
+HOMEPAGE = "https://github.com/sbabic/libubootenv"
+LICENSE = "LGPL-2.1-or-later"
+LIC_FILES_CHKSUM = "file://LICENSES/LGPL-2.1-or-later.txt;md5=4fbd65380cdd255951079008b364516c"
+SECTION = "libs"
+SRC_URI = "git://github.com/sbabic/libubootenv;protocol=https;branch=master \
+           file://0001-Update-cmake_minimum_required-to-3.5.patch \
+           "
+SRCREV = "5507339628b5caf244e1ff9d58cb3fa534b16beb"
+inherit cmake lib_package
+EXTRA_OECMAKE = "-DCMAKE_BUILD_TYPE=Release"
+DEPENDS = "zlib libyaml"
+PROVIDES += "u-boot-fw-utils"
+RPROVIDES:${PN}-bin += "u-boot-fw-utils"
+BBCLASSEXTEND = "native"
diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index 5a8035f432..8600d4bab6 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -4,19 +4,32 @@ ARM, MIPS and several other processors, which can be installed in a boot \
 ROM and used to initialize and test the hardware or to download and run \
 application code."
 SECTION = "bootloaders"
-DEPENDS += "flex-native bison-native"
+DEPENDS += "flex-native bison-native python3-setuptools-native"
-LICENSE = "GPLv2+"
+LICENSE = "GPL-2.0-or-later"
-LIC_FILES_CHKSUM = "file://Licenses/README;md5=5a7450c57ffe5ae63fd732446b988025"
+LIC_FILES_CHKSUM = "file://Licenses/README;md5=2ca5f2c35c8cc335f0a19756634782f1"
 PE = "1"
 # We use the revision in order to avoid having to fetch it from the
 # repo during parse
-SRCREV = "c4fddedc48f336eabc4ce3f74940e6aa372de18c"
+SRCREV = "34820924edbc4ec7803eb89d9852f4b870fa760a"
-SRC_URI = "git://git.denx.de/u-boot.git \
+SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master;tag=v${PV}"
-          "
+SRC_URI_RISCV = "\
+    file://u-boot-riscv-isa_clear.cfg \
+    ${@bb.utils.contains    ("TUNE_FEATURES", "a",      "file://u-boot-riscv-isa_a.cfg", "", d)} \
+    ${@bb.utils.contains    ("TUNE_FEATURES", "f",      "file://u-boot-riscv-isa_f.cfg", "", d)} \
+    ${@bb.utils.contains    ("TUNE_FEATURES", "d",      "file://u-boot-riscv-isa_d.cfg", "", d)} \
+    ${@bb.utils.contains_any("TUNE_FEATURES", "b zbb",  "file://u-boot-riscv-isa_zbb.cfg", "", d)} \
+    ${@bb.utils.contains    ("TUNE_FEATURES", "zicbom", "file://u-boot-riscv-isa_zicbom.cfg", "", d)} \
+    "
+SRC_URI:append:riscv32 = "${SRC_URI_RISCV}"
+SRC_URI:append:riscv64 = "${SRC_URI_RISCV}"
-S = "${WORKDIR}/git"
 B = "${WORKDIR}/build"
+inherit pkgconfig
 do_configure[cleandirs] = "${B}"
diff --git a/meta/recipes-bsp/u-boot/u-boot-configure.inc b/meta/recipes-bsp/u-boot/u-boot-configure.inc
new file mode 100644
index 0000000000..a15511f8b2
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/u-boot-configure.inc
@@ -0,0 +1,52 @@
+# This provides the logic for creating the desired u-boot config,
+# accounting for any *.cfg files added to SRC_URI.  It's separated
+# from u-boot.inc for use by recipes that need u-boot properly
+# configured but aren't doing a full build of u-boot itself (such as
+# its companion tools).
+inherit uboot-config cml1
+DEPENDS += "kern-tools-native"
+CONFIGURE_FILES = "${@d.getVar('UBOOT_MACHINE') or '.config'}"
+do_configure () {
+    if [ -n "${UBOOT_CONFIG}" ]; then
+        unset i j
+        for config in ${UBOOT_MACHINE}; do
+            i=$(expr $i + 1);
+            for type in ${UBOOT_CONFIG}; do
+                j=$(expr $j + 1);
+                if [ $j -eq $i ]; then
+                    uboot_configure_config $config $type
+                fi
+            done
+            unset j
+        done
+        unset i
+    else
+        uboot_configure
+    fi
+}
+uboot_configure_config () {
+    config=$1
+    type=$2
+    oe_runmake -C ${S} O=${B}/${config} ${config}
+    if [ -n "${@' '.join(find_cfgs(d))}" ]; then
+        merge_config.sh -m -O ${B}/${config} ${B}/${config}/.config ${@" ".join(find_cfgs(d))}
+        oe_runmake -C ${S} O=${B}/${config} oldconfig
+    fi
+}
+uboot_configure () {
+    if [ -n "${UBOOT_MACHINE}" ]; then
+        oe_runmake -C ${S} O=${B} ${UBOOT_MACHINE}
+    else
+        oe_runmake -C ${S} O=${B} oldconfig
+    fi
+    merge_config.sh -m .config ${@" ".join(find_cfgs(d))}
+    cml1_do_configure
+}
diff --git a/meta/recipes-bsp/u-boot/u-boot-tools.inc b/meta/recipes-bsp/u-boot/u-boot-tools.inc
index 4ed936a70d..4e4f7fa092 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-tools.inc
@@ -1,26 +1,30 @@
 SUMMARY = "U-Boot bootloader tools"
-DEPENDS += "openssl"
+DEPENDS += "gnutls openssl util-linux swig-native"
-PROVIDES = "${MLPREFIX}u-boot-mkimage ${MLPREFIX}u-boot-mkenvimage"
+inherit python3native
-PROVIDES_class-native = "u-boot-mkimage-native u-boot-mkenvimage-native"
+export STAGING_INCDIR = "${STAGING_INCDIR_NATIVE}"
-PACKAGES += "${PN}-mkimage ${PN}-mkenvimage"
+PROVIDES = "${MLPREFIX}u-boot-mkimage ${MLPREFIX}u-boot-mkenvimage ${MLPREFIX}u-boot-mkeficapsule"
+PROVIDES:class-native = "u-boot-mkimage-native u-boot-mkenvimage-native u-boot-mkeficapsule-native"
+PACKAGES += "${PN}-mkimage ${PN}-mkenvimage ${PN}-mkeficapsule"
 # Required for backward compatibility with "u-boot-mkimage-xxx.bb"
-RPROVIDES_${PN}-mkimage = "u-boot-mkimage"
+RPROVIDES:${PN}-mkimage = "u-boot-mkimage"
-RREPLACES_${PN}-mkimage = "u-boot-mkimage"
+RREPLACES:${PN}-mkimage = "u-boot-mkimage"
-RCONFLICTS_${PN}-mkimage = "u-boot-mkimage"
+RCONFLICTS:${PN}-mkimage = "u-boot-mkimage"
-EXTRA_OEMAKE_class-target = 'CROSS_COMPILE="${TARGET_PREFIX}" CC="${CC} ${CFLAGS} ${LDFLAGS}" HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}" STRIP=true V=1'
+EXTRA_OEMAKE:class-target = 'CROSS_COMPILE="${TARGET_PREFIX}" CC="${CC} ${CFLAGS} ${LDFLAGS}" HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}" STRIP=true V=1'
-EXTRA_OEMAKE_class-native = 'CC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}" HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}" STRIP=true V=1'
+EXTRA_OEMAKE:class-native = 'CC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}" HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}" STRIP=true V=1'
-EXTRA_OEMAKE_class-nativesdk = 'CROSS_COMPILE="${HOST_PREFIX}" CC="${CC} ${CFLAGS} ${LDFLAGS}" HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}" STRIP=true V=1'
+EXTRA_OEMAKE:class-nativesdk = 'CROSS_COMPILE="${HOST_PREFIX}" CC="${CC} ${CFLAGS} ${LDFLAGS}" HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}" STRIP=true V=1'
 SED_CONFIG_EFI = '-e "s/CONFIG_EFI_LOADER=.*/# CONFIG_EFI_LOADER is not set/"'
-SED_CONFIG_EFI_x86 = ''
+SED_CONFIG_EFI:x86 = ''
-SED_CONFIG_EFI_x86-64 = ''
+SED_CONFIG_EFI:x86-64 = ''
-SED_CONFIG_EFI_arm = ''
+SED_CONFIG_EFI:arm = ''
-SED_CONFIG_EFI_armeb = ''
+SED_CONFIG_EFI:armeb = ''
-SED_CONFIG_EFI_aarch64 = ''
+SED_CONFIG_EFI:aarch64 = ''
+SED_CONFIG_EFI:loongarch64 = ''
 do_compile () {
        # Yes, this is crazy. If you build on a system with git < 2.14 from scratch, the tree will
@@ -38,7 +42,7 @@ do_compile () {
        # (i.e. creating a hardlink dirties the index)
        cd ${S}; git diff; cd ${B}
-        oe_runmake -C ${S} sandbox_defconfig O=${B}
+        oe_runmake -C ${S} tools-only_defconfig O=${B}
        # Disable CONFIG_CMD_LICENSE, license.h is not used by tools and
        # generating it requires bin2header tool, which for target build
@@ -66,16 +70,21 @@ do_install () {
        # fit_check_sign
        install -m 0755 tools/fit_check_sign ${D}${bindir}/uboot-fit_check_sign
        ln -sf uboot-fit_check_sign ${D}${bindir}/fit_check_sign
+        # mkeficapsule
+        install -m 0755 tools/mkeficapsule ${D}${bindir}/uboot-mkeficapsule
+        ln -sf uboot-mkeficapsule ${D}${bindir}/mkeficapsule
 }
-ALLOW_EMPTY_${PN} = "1"
+ALLOW_EMPTY:${PN} = "1"
-FILES_${PN} = ""
+FILES:${PN} = ""
-FILES_${PN}-mkimage = "${bindir}/uboot-mkimage ${bindir}/mkimage ${bindir}/uboot-dumpimage ${bindir}/dumpimage ${bindir}/uboot-fit_check_sign ${bindir}/fit_check_sign"
+FILES:${PN}-mkimage = "${bindir}/uboot-mkimage ${bindir}/mkimage ${bindir}/uboot-dumpimage ${bindir}/dumpimage ${bindir}/uboot-fit_check_sign ${bindir}/fit_check_sign"
-FILES_${PN}-mkenvimage = "${bindir}/uboot-mkenvimage ${bindir}/mkenvimage"
+FILES:${PN}-mkenvimage = "${bindir}/uboot-mkenvimage ${bindir}/mkenvimage"
+FILES:${PN}-mkeficapsule = "${bindir}/uboot-mkeficapsule ${bindir}/mkeficapsule"
-RDEPENDS_${PN}-mkimage += "dtc"
+RDEPENDS:${PN}-mkimage += "dtc"
-RDEPENDS_${PN} += "${PN}-mkimage ${PN}-mkenvimage"
+RDEPENDS:${PN} += "${PN}-mkimage ${PN}-mkenvimage ${PN}-mkeficapsule"
-RDEPENDS_${PN}_class-native = ""
+RDEPENDS:${PN}:class-native = ""
 BBCLASSEXTEND = "native nativesdk"
diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2021.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2025.04.bb
index ef386f76e6..7eaf721ca8 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2021.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2025.04.bb
@@ -1,3 +1,2 @@
 require u-boot-common.inc
 require u-boot-tools.inc
diff --git a/meta/recipes-bsp/u-boot/u-boot.inc b/meta/recipes-bsp/u-boot/u-boot.inc
index 251178db33..b7242de5de 100644
--- a/meta/recipes-bsp/u-boot/u-boot.inc
+++ b/meta/recipes-bsp/u-boot/u-boot.inc
@@ -3,13 +3,14 @@ PROVIDES = "virtual/bootloader"
 PACKAGE_ARCH = "${MACHINE_ARCH}"
-DEPENDS += "kern-tools-native"
+DEPENDS += "${@bb.utils.contains('UBOOT_ENV_SUFFIX', 'scr', 'u-boot-mkimage-native', '', d)}"
-inherit uboot-config uboot-extlinux-config uboot-sign deploy cml1 python3native
+inherit uboot-config uboot-extlinux-config uboot-sign deploy python3native kernel-arch
 DEPENDS += "swig-native"
-EXTRA_OEMAKE = 'CROSS_COMPILE=${TARGET_PREFIX} CC="${TARGET_PREFIX}gcc ${TOOLCHAIN_OPTIONS}" V=1'
+EXTRA_OEMAKE = 'CROSS_COMPILE=${TARGET_PREFIX} V=1'
+EXTRA_OEMAKE += 'CC="${TARGET_PREFIX}gcc ${TOOLCHAIN_OPTIONS} ${DEBUG_PREFIX_MAP}"'
 EXTRA_OEMAKE += 'HOSTCC="${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_LDFLAGS}"'
 EXTRA_OEMAKE += 'STAGING_INCDIR=${STAGING_INCDIR_NATIVE} STAGING_LIBDIR=${STAGING_LIBDIR_NATIVE}'
@@ -19,92 +20,21 @@ PACKAGECONFIG ??= "openssl"
 # a host build dependency.
 PACKAGECONFIG[openssl] = ",,openssl-native"
+CVE_PRODUCT = "denx:u-boot"
 # Allow setting an additional version string that will be picked up by the
 # u-boot build system and appended to the u-boot version.  If the .scmversion
 # file already exists it will not be overwritten.
 UBOOT_LOCALVERSION ?= ""
-# Some versions of u-boot use .bin and others use .img.  By default use .bin
-# but enable individual recipes to change this value.
-UBOOT_SUFFIX ??= "bin"
-UBOOT_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.${UBOOT_SUFFIX}"
-UBOOT_SYMLINK ?= "u-boot-${MACHINE}.${UBOOT_SUFFIX}"
-UBOOT_MAKE_TARGET ?= "all"
-# Output the ELF generated. Some platforms can use the ELF file and directly
-# load it (JTAG booting, QEMU) additionally the ELF can be used for debugging
-# purposes.
-UBOOT_ELF ?= ""
-UBOOT_ELF_SUFFIX ?= "elf"
-UBOOT_ELF_IMAGE ?= "u-boot-${MACHINE}-${PV}-${PR}.${UBOOT_ELF_SUFFIX}"
-UBOOT_ELF_BINARY ?= "u-boot.${UBOOT_ELF_SUFFIX}"
-UBOOT_ELF_SYMLINK ?= "u-boot-${MACHINE}.${UBOOT_ELF_SUFFIX}"
-# Some versions of u-boot build an SPL (Second Program Loader) image that
-# should be packaged along with the u-boot binary as well as placed in the
-# deploy directory.  For those versions they can set the following variables
-# to allow packaging the SPL.
-SPL_BINARY ?= ""
-SPL_BINARYNAME ?= "${@os.path.basename(d.getVar("SPL_BINARY"))}"
-SPL_IMAGE ?= "${SPL_BINARYNAME}-${MACHINE}-${PV}-${PR}"
-SPL_SYMLINK ?= "${SPL_BINARYNAME}-${MACHINE}"
-# Additional environment variables or a script can be installed alongside
-# u-boot to be used automatically on boot.  This file, typically 'uEnv.txt'
-# or 'boot.scr', should be packaged along with u-boot as well as placed in the
-# deploy directory.  Machine configurations needing one of these files should
-# include it in the SRC_URI and set the UBOOT_ENV parameter.
-UBOOT_ENV_SUFFIX ?= "txt"
-UBOOT_ENV ?= ""
-UBOOT_ENV_BINARY ?= "${UBOOT_ENV}.${UBOOT_ENV_SUFFIX}"
-UBOOT_ENV_IMAGE ?= "${UBOOT_ENV}-${MACHINE}-${PV}-${PR}.${UBOOT_ENV_SUFFIX}"
-UBOOT_ENV_SYMLINK ?= "${UBOOT_ENV}-${MACHINE}.${UBOOT_ENV_SUFFIX}"
 # Default name of u-boot initial env, but enable individual recipes to change
 # this value.
 UBOOT_INITIAL_ENV ?= "${PN}-initial-env"
-# U-Boot EXTLINUX variables. U-Boot searches for /boot/extlinux/extlinux.conf
+require u-boot-configure.inc
-# to find EXTLINUX conf file.
-UBOOT_EXTLINUX_INSTALL_DIR ?= "/boot/extlinux"
-UBOOT_EXTLINUX_CONF_NAME ?= "extlinux.conf"
-UBOOT_EXTLINUX_SYMLINK ?= "${UBOOT_EXTLINUX_CONF_NAME}-${MACHINE}-${PR}"
-do_configure () {
-    if [ -n "${UBOOT_CONFIG}" ]; then
-        unset i j
-        for config in ${UBOOT_MACHINE}; do
-            i=$(expr $i + 1);
-            for type in ${UBOOT_CONFIG}; do
-                j=$(expr $j + 1);
-                if [ $j -eq $i ]; then
-                    oe_runmake -C ${S} O=${B}/${config} ${config}
-                    if [ -n "${@' '.join(find_cfgs(d))}" ]; then
-                        merge_config.sh -m -O ${B}/${config} ${B}/${config}/.config ${@" ".join(find_cfgs(d))}
-                        oe_runmake -C ${S} O=${B}/${config} oldconfig
-                    fi
-                fi
-            done
-            unset j
-        done
-        unset i
-        DEVTOOL_DISABLE_MENUCONFIG=true
-    else
-        if [ -n "${UBOOT_MACHINE}" ]; then
-            oe_runmake -C ${S} O=${B} ${UBOOT_MACHINE}
-        else
-            oe_runmake -C ${S} O=${B} oldconfig
-        fi
-        merge_config.sh -m .config ${@" ".join(find_cfgs(d))}
-        cml1_do_configure
-    fi
-}
+UBOOT_ARCH_DIR = "${@'arm' if d.getVar('UBOOT_ARCH').startswith('arm') else d.getVar('UBOOT_ARCH')}"
 do_compile () {
-    if [ "${@bb.utils.filter('DISTRO_FEATURES', 'ld-is-gold', d)}" ]; then
-        sed -i 's/$(CROSS_COMPILE)ld$/$(CROSS_COMPILE)ld.bfd/g' ${S}/config.mk
-    fi
    unset LDFLAGS
    unset CFLAGS
    unset CPPFLAGS
@@ -117,40 +47,66 @@ do_compile () {
    if [ -n "${UBOOT_CONFIG}" -o -n "${UBOOT_DELTA_CONFIG}" ]
    then
-        unset i j k
+        unset i j
        for config in ${UBOOT_MACHINE}; do
            i=$(expr $i + 1);
            for type in ${UBOOT_CONFIG}; do
                j=$(expr $j + 1);
                if [ $j -eq $i ]
                then
-                    oe_runmake -C ${S} O=${B}/${config} ${UBOOT_MAKE_TARGET}
+                    uboot_compile_config $i $config $type
-                    for binary in ${UBOOT_BINARIES}; do
-                        k=$(expr $k + 1);
-                        if [ $k -eq $i ]; then
-                            cp ${B}/${config}/${binary} ${B}/${config}/u-boot-${type}.${UBOOT_SUFFIX}
-                        fi
-                    done
-                    # Generate the uboot-initial-env
-                    if [ -n "${UBOOT_INITIAL_ENV}" ]; then
-                        oe_runmake -C ${S} O=${B}/${config} u-boot-initial-env
-                        cp ${B}/${config}/u-boot-initial-env ${B}/${config}/u-boot-initial-env-${type}
-                    fi
-                    unset k
                fi
            done
            unset j
        done
        unset i
    else
-        oe_runmake -C ${S} O=${B} ${UBOOT_MAKE_TARGET}
+        uboot_compile
+    fi
+    if [ -n "${UBOOT_ENV}" ] && [ "${UBOOT_ENV_SUFFIX}" = "scr" ]
+    then
+        ${UBOOT_MKIMAGE} -C none -A ${UBOOT_ARCH} -T script -d ${UNPACKDIR}/${UBOOT_ENV_SRC} ${B}/${UBOOT_ENV_BINARY}
+    fi
+}
+uboot_compile_config () {
+    i=$1
+    config=$2
+    type=$3
-        # Generate the uboot-initial-env
+    oe_runmake -C ${S} O=${B}/${config} ${UBOOT_MAKE_TARGET}
-        if [ -n "${UBOOT_INITIAL_ENV}" ]; then
-            oe_runmake -C ${S} O=${B} u-boot-initial-env
+    unset k
+    for binary in ${UBOOT_BINARIES}; do
+        k=$(expr $k + 1);
+        if [ $k -eq $i ]; then
+            uboot_compile_config_copy_binary $config $type $binary
        fi
+    done
+    unset k
+    # Generate the uboot-initial-env
+    if [ -n "${UBOOT_INITIAL_ENV}" ]; then
+        oe_runmake -C ${S} O=${B}/${config} u-boot-initial-env
+        cp ${B}/${config}/u-boot-initial-env ${B}/${config}/u-boot-initial-env-${type}
+    fi
+}
+uboot_compile_config_copy_binary () {
+    config=$1
+    type=$2
+    binary=$3
+    cp ${B}/${config}/${binary} ${B}/${config}/${UBOOT_BINARYNAME}-${type}.${UBOOT_SUFFIX}
+}
+uboot_compile () {
+    oe_runmake -C ${S} O=${B} ${UBOOT_MAKE_TARGET}
+    # Generate the uboot-initial-env
+    if [ -n "${UBOOT_INITIAL_ENV}" ]; then
+        oe_runmake -C ${S} O=${B} u-boot-initial-env
    fi
 }
@@ -163,32 +119,14 @@ do_install () {
                j=$(expr $j + 1);
                if [ $j -eq $i ]
                then
-                    install -D -m 644 ${B}/${config}/u-boot-${type}.${UBOOT_SUFFIX} ${D}/boot/u-boot-${type}-${PV}-${PR}.${UBOOT_SUFFIX}
+                    uboot_install_config $config $type
-                    ln -sf u-boot-${type}-${PV}-${PR}.${UBOOT_SUFFIX} ${D}/boot/${UBOOT_BINARY}-${type}
-                    ln -sf u-boot-${type}-${PV}-${PR}.${UBOOT_SUFFIX} ${D}/boot/${UBOOT_BINARY}
-                    # Install the uboot-initial-env
-                    if [ -n "${UBOOT_INITIAL_ENV}" ]; then
-                        install -D -m 644 ${B}/${config}/u-boot-initial-env-${type} ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${PV}-${PR}
-                        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${PV}-${PR} ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}-${MACHINE}-${type}
-                        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${PV}-${PR} ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}-${type}
-                        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${PV}-${PR} ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}
-                    fi
                fi
            done
            unset j
        done
        unset i
    else
-        install -D -m 644 ${B}/${UBOOT_BINARY} ${D}/boot/${UBOOT_IMAGE}
+        uboot_install
-        ln -sf ${UBOOT_IMAGE} ${D}/boot/${UBOOT_BINARY}
-        # Install the uboot-initial-env
-        if [ -n "${UBOOT_INITIAL_ENV}" ]; then
-            install -D -m 644 ${B}/u-boot-initial-env ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}-${MACHINE}-${PV}-${PR}
-            ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${PV}-${PR} ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}-${MACHINE}
-            ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${PV}-${PR} ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}
-        fi
    fi
    if [ -n "${UBOOT_ELF}" ]
@@ -201,23 +139,20 @@ do_install () {
                    j=$(expr $j + 1);
                    if [ $j -eq $i ]
                    then
-                        install -m 644 ${B}/${config}/${UBOOT_ELF} ${D}/boot/u-boot-${type}-${PV}-${PR}.${UBOOT_ELF_SUFFIX}
+                        uboot_install_elf_config $config $type
-                        ln -sf u-boot-${type}-${PV}-${PR}.${UBOOT_ELF_SUFFIX} ${D}/boot/${UBOOT_BINARY}-${type}
-                        ln -sf u-boot-${type}-${PV}-${PR}.${UBOOT_ELF_SUFFIX} ${D}/boot/${UBOOT_BINARY}
                    fi
                done
                unset j
            done
            unset i
        else
-            install -m 644 ${B}/${UBOOT_ELF} ${D}/boot/${UBOOT_ELF_IMAGE}
+            uboot_install_elf
-            ln -sf ${UBOOT_ELF_IMAGE} ${D}/boot/${UBOOT_ELF_BINARY}
        fi
    fi
-    if [ -e ${WORKDIR}/fw_env.config ] ; then
+    if [ -e ${UNPACKDIR}/fw_env.config ] ; then
        install -d ${D}${sysconfdir}
-        install -m 644 ${WORKDIR}/fw_env.config ${D}${sysconfdir}/fw_env.config
+        install -m 644 ${UNPACKDIR}/fw_env.config ${D}${sysconfdir}/fw_env.config
    fi
    if [ -n "${SPL_BINARY}" ]
@@ -230,23 +165,20 @@ do_install () {
                    j=$(expr $j + 1);
                    if [ $j -eq $i ]
                    then
-                         install -m 644 ${B}/${config}/${SPL_BINARY} ${D}/boot/${SPL_IMAGE}-${type}-${PV}-${PR}
+                        uboot_install_spl_config $config $type
-                         ln -sf ${SPL_IMAGE}-${type}-${PV}-${PR} ${D}/boot/${SPL_BINARYNAME}-${type}
-                         ln -sf ${SPL_IMAGE}-${type}-${PV}-${PR} ${D}/boot/${SPL_BINARYNAME}
                    fi
                done
                unset j
            done
            unset i
        else
-            install -m 644 ${B}/${SPL_BINARY} ${D}/boot/${SPL_IMAGE}
+            uboot_install_spl
-            ln -sf ${SPL_IMAGE} ${D}/boot/${SPL_BINARYNAME}
        fi
    fi
    if [ -n "${UBOOT_ENV}" ]
    then
-        install -m 644 ${WORKDIR}/${UBOOT_ENV_BINARY} ${D}/boot/${UBOOT_ENV_IMAGE}
+        install -m 644 ${B}/${UBOOT_ENV_BINARY} ${D}/boot/${UBOOT_ENV_IMAGE}
        ln -sf ${UBOOT_ENV_IMAGE} ${D}/boot/${UBOOT_ENV_BINARY}
    fi
@@ -256,68 +188,104 @@ do_install () {
    fi
 }
-PACKAGE_BEFORE_PN += "${PN}-env"
+uboot_install_config () {
+    config=$1
+    type=$2
+    install -D -m 644 ${B}/${config}/${UBOOT_BINARYNAME}-${type}.${UBOOT_SUFFIX} ${D}/boot/${UBOOT_BINARYNAME}-${type}-${UBOOT_VERSION}.${UBOOT_SUFFIX}
+    ln -sf ${UBOOT_BINARYNAME}-${type}-${UBOOT_VERSION}.${UBOOT_SUFFIX} ${D}/boot/${UBOOT_BINARY}-${type}
+    ln -sf ${UBOOT_BINARYNAME}-${type}-${UBOOT_VERSION}.${UBOOT_SUFFIX} ${D}/boot/${UBOOT_BINARY}
-RPROVIDES_${PN}-env += "u-boot-default-env"
+    # Install the uboot-initial-env
-ALLOW_EMPTY_${PN}-env = "1"
+    if [ -n "${UBOOT_INITIAL_ENV}" ]; then
-FILES_${PN}-env = " \
+        install -D -m 644 ${B}/${config}/u-boot-initial-env-${type} ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${UBOOT_VERSION}
+        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${UBOOT_VERSION} ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}-${MACHINE}-${type}
+        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${UBOOT_VERSION} ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}-${type}
+        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${UBOOT_VERSION} ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}
+    fi
+}
+uboot_install () {
+    install -D -m 644 ${B}/${UBOOT_BINARY} ${D}/boot/${UBOOT_IMAGE}
+    ln -sf ${UBOOT_IMAGE} ${D}/boot/${UBOOT_BINARY}
+    # Install the uboot-initial-env
+    if [ -n "${UBOOT_INITIAL_ENV}" ]; then
+        install -D -m 644 ${B}/u-boot-initial-env ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}-${MACHINE}-${UBOOT_VERSION}
+        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${UBOOT_VERSION} ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}-${MACHINE}
+        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${UBOOT_VERSION} ${D}/${sysconfdir}/${UBOOT_INITIAL_ENV}
+    fi
+}
+uboot_install_elf_config () {
+    config=$1
+    type=$2
+    install -m 644 ${B}/${config}/${UBOOT_ELF} ${D}/boot/u-boot-${type}-${UBOOT_VERSION}.${UBOOT_ELF_SUFFIX}
+    ln -sf u-boot-${type}-${UBOOT_VERSION}.${UBOOT_ELF_SUFFIX} ${D}/boot/${UBOOT_BINARY}-${type}
+    ln -sf u-boot-${type}-${UBOOT_VERSION}.${UBOOT_ELF_SUFFIX} ${D}/boot/${UBOOT_BINARY}
+}
+uboot_install_elf () {
+    install -m 644 ${B}/${UBOOT_ELF} ${D}/boot/${UBOOT_ELF_IMAGE}
+    ln -sf ${UBOOT_ELF_IMAGE} ${D}/boot/${UBOOT_ELF_BINARY}
+}
+uboot_install_spl_config () {
+    config=$1
+    type=$2
+    install -m 644 ${B}/${config}/${SPL_BINARY} ${D}/boot/${SPL_BINARYNAME}-${type}-${UBOOT_VERSION}${SPL_DELIMITER}${SPL_SUFFIX}
+    ln -sf ${SPL_BINARYNAME}-${type}-${UBOOT_VERSION}${SPL_DELIMITER}${SPL_SUFFIX} ${D}/boot/${SPL_BINARYFILE}-${type}
+    ln -sf ${SPL_BINARYNAME}-${type}-${UBOOT_VERSION}${SPL_DELIMITER}${SPL_SUFFIX} ${D}/boot/${SPL_BINARYFILE}
+}
+uboot_install_spl () {
+    install -m 644 ${B}/${SPL_BINARY} ${D}/boot/${SPL_IMAGE}
+    ln -sf ${SPL_IMAGE} ${D}/boot/${SPL_BINARYFILE}
+}
+PACKAGE_BEFORE_PN += "${PN}-env ${PN}-extlinux"
+RPROVIDES:${PN}-env += "u-boot-default-env"
+ALLOW_EMPTY:${PN}-env = "1"
+FILES:${PN}-env = " \
    ${@ '${sysconfdir}/${UBOOT_INITIAL_ENV}*' if d.getVar('UBOOT_INITIAL_ENV') else ''} \
    ${sysconfdir}/fw_env.config \
 "
-FILES_${PN} = "/boot ${datadir}"
+FILES:${PN}-extlinux = "${UBOOT_EXTLINUX_INSTALL_DIR}/${UBOOT_EXTLINUX_CONF_NAME}"
-RDEPENDS_${PN} += "${PN}-env"
+RDEPENDS:${PN} += "${@bb.utils.contains('UBOOT_EXTLINUX', '1', '${PN}-extlinux', '', d)}"
+SYSROOT_DIRS += "/boot"
+FILES:${PN} = "/boot ${datadir}"
+RDEPENDS:${PN} += "${PN}-env"
 do_deploy () {
    if [ -n "${UBOOT_CONFIG}" ]
    then
+        unset i j
        for config in ${UBOOT_MACHINE}; do
            i=$(expr $i + 1);
            for type in ${UBOOT_CONFIG}; do
                j=$(expr $j + 1);
                if [ $j -eq $i ]
                then
-                    install -D -m 644 ${B}/${config}/u-boot-${type}.${UBOOT_SUFFIX} ${DEPLOYDIR}/u-boot-${type}-${PV}-${PR}.${UBOOT_SUFFIX}
+                    uboot_deploy_config $config $type
-                    cd ${DEPLOYDIR}
-                    ln -sf u-boot-${type}-${PV}-${PR}.${UBOOT_SUFFIX} ${UBOOT_SYMLINK}-${type}
-                    ln -sf u-boot-${type}-${PV}-${PR}.${UBOOT_SUFFIX} ${UBOOT_SYMLINK}
-                    ln -sf u-boot-${type}-${PV}-${PR}.${UBOOT_SUFFIX} ${UBOOT_BINARY}-${type}
-                    ln -sf u-boot-${type}-${PV}-${PR}.${UBOOT_SUFFIX} ${UBOOT_BINARY}
-                    # Deploy the uboot-initial-env
-                    if [ -n "${UBOOT_INITIAL_ENV}" ]; then
-                        install -D -m 644 ${B}/${config}/u-boot-initial-env-${type} ${DEPLOYDIR}/${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${PV}-${PR}
-                        cd ${DEPLOYDIR}
-                        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${PV}-${PR} ${UBOOT_INITIAL_ENV}-${MACHINE}-${type}
-                        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${PV}-${PR} ${UBOOT_INITIAL_ENV}-${type}
-                    fi
                fi
            done
            unset j
        done
        unset i
    else
-        install -D -m 644 ${B}/${UBOOT_BINARY} ${DEPLOYDIR}/${UBOOT_IMAGE}
+        uboot_deploy
-        cd ${DEPLOYDIR}
-        rm -f ${UBOOT_BINARY} ${UBOOT_SYMLINK}
-        ln -sf ${UBOOT_IMAGE} ${UBOOT_SYMLINK}
-        ln -sf ${UBOOT_IMAGE} ${UBOOT_BINARY}
-        # Deploy the uboot-initial-env
-        if [ -n "${UBOOT_INITIAL_ENV}" ]; then
-            install -D -m 644 ${B}/u-boot-initial-env ${DEPLOYDIR}/${UBOOT_INITIAL_ENV}-${MACHINE}-${PV}-${PR}
-            cd ${DEPLOYDIR}
-            ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${PV}-${PR} ${UBOOT_INITIAL_ENV}-${MACHINE}
-            ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${PV}-${PR} ${UBOOT_INITIAL_ENV}
-        fi
    fi
-    if [ -e ${WORKDIR}/fw_env.config ] ; then
+    if [ -e ${UNPACKDIR}/fw_env.config ] ; then
-        install -D -m 644 ${WORKDIR}/fw_env.config ${DEPLOYDIR}/fw_env.config-${MACHINE}-${PV}-${PR}
+        install -D -m 644 ${UNPACKDIR}/fw_env.config ${DEPLOYDIR}/fw_env.config-${MACHINE}-${UBOOT_VERSION}
        cd ${DEPLOYDIR}
-        ln -sf fw_env.config-${MACHINE}-${PV}-${PR} fw_env.config-${MACHINE}
+        ln -sf fw_env.config-${MACHINE}-${UBOOT_VERSION} fw_env.config-${MACHINE}
-        ln -sf fw_env.config-${MACHINE}-${PV}-${PR} fw_env.config
+        ln -sf fw_env.config-${MACHINE}-${UBOOT_VERSION} fw_env.config
    fi
    if [ -n "${UBOOT_ELF}" ]
@@ -330,24 +298,17 @@ do_deploy () {
                    j=$(expr $j + 1);
                    if [ $j -eq $i ]
                    then
-                        install -m 644 ${B}/${config}/${UBOOT_ELF} ${DEPLOYDIR}/u-boot-${type}-${PV}-${PR}.${UBOOT_ELF_SUFFIX}
+                        uboot_deploy_elf_config $config $type
-                        ln -sf u-boot-${type}-${PV}-${PR}.${UBOOT_ELF_SUFFIX} ${DEPLOYDIR}/${UBOOT_ELF_BINARY}-${type}
-                        ln -sf u-boot-${type}-${PV}-${PR}.${UBOOT_ELF_SUFFIX} ${DEPLOYDIR}/${UBOOT_ELF_BINARY}
-                        ln -sf u-boot-${type}-${PV}-${PR}.${UBOOT_ELF_SUFFIX} ${DEPLOYDIR}/${UBOOT_ELF_SYMLINK}-${type}
-                        ln -sf u-boot-${type}-${PV}-${PR}.${UBOOT_ELF_SUFFIX} ${DEPLOYDIR}/${UBOOT_ELF_SYMLINK}
                    fi
                done
                unset j
            done
            unset i
        else
-            install -m 644 ${B}/${UBOOT_ELF} ${DEPLOYDIR}/${UBOOT_ELF_IMAGE}
+            uboot_deploy_elf
-            ln -sf ${UBOOT_ELF_IMAGE} ${DEPLOYDIR}/${UBOOT_ELF_BINARY}
-            ln -sf ${UBOOT_ELF_IMAGE} ${DEPLOYDIR}/${UBOOT_ELF_SYMLINK}
        fi
    fi
     if [ -n "${SPL_BINARY}" ]
     then
        if [ -n "${UBOOT_CONFIG}" ]
@@ -358,30 +319,20 @@ do_deploy () {
                    j=$(expr $j + 1);
                    if [ $j -eq $i ]
                    then
-                        install -m 644 ${B}/${config}/${SPL_BINARY} ${DEPLOYDIR}/${SPL_IMAGE}-${type}-${PV}-${PR}
+                        uboot_deploy_spl_config $config $type
-                        rm -f ${DEPLOYDIR}/${SPL_BINARYNAME} ${DEPLOYDIR}/${SPL_SYMLINK}-${type}
-                        ln -sf ${SPL_IMAGE}-${type}-${PV}-${PR} ${DEPLOYDIR}/${SPL_BINARYNAME}-${type}
-                        ln -sf ${SPL_IMAGE}-${type}-${PV}-${PR} ${DEPLOYDIR}/${SPL_BINARYNAME}
-                        ln -sf ${SPL_IMAGE}-${type}-${PV}-${PR} ${DEPLOYDIR}/${SPL_SYMLINK}-${type}
-                        ln -sf ${SPL_IMAGE}-${type}-${PV}-${PR} ${DEPLOYDIR}/${SPL_SYMLINK}
                    fi
                done
                unset j
            done
            unset i
        else
-            install -m 644 ${B}/${SPL_BINARY} ${DEPLOYDIR}/${SPL_IMAGE}
+            uboot_deploy_spl
-            rm -f ${DEPLOYDIR}/${SPL_BINARYNAME} ${DEPLOYDIR}/${SPL_SYMLINK}
-            ln -sf ${SPL_IMAGE} ${DEPLOYDIR}/${SPL_BINARYNAME}
-            ln -sf ${SPL_IMAGE} ${DEPLOYDIR}/${SPL_SYMLINK}
        fi
    fi
    if [ -n "${UBOOT_ENV}" ]
    then
-        install -m 644 ${WORKDIR}/${UBOOT_ENV_BINARY} ${DEPLOYDIR}/${UBOOT_ENV_IMAGE}
+        install -m 644 ${B}/${UBOOT_ENV_BINARY} ${DEPLOYDIR}/${UBOOT_ENV_IMAGE}
-        rm -f ${DEPLOYDIR}/${UBOOT_ENV_BINARY} ${DEPLOYDIR}/${UBOOT_ENV_SYMLINK}
        ln -sf ${UBOOT_ENV_IMAGE} ${DEPLOYDIR}/${UBOOT_ENV_BINARY}
        ln -sf ${UBOOT_ENV_IMAGE} ${DEPLOYDIR}/${UBOOT_ENV_SYMLINK}
    fi
@@ -392,6 +343,83 @@ do_deploy () {
        ln -sf ${UBOOT_EXTLINUX_SYMLINK} ${DEPLOYDIR}/${UBOOT_EXTLINUX_CONF_NAME}-${MACHINE}
        ln -sf ${UBOOT_EXTLINUX_SYMLINK} ${DEPLOYDIR}/${UBOOT_EXTLINUX_CONF_NAME}
    fi
+    if [ -n "${UBOOT_DTB}" ]
+    then
+        install -m 644 ${B}/arch/${UBOOT_ARCH_DIR}/dts/${UBOOT_DTB_BINARY} ${DEPLOYDIR}/
+    fi
+}
+uboot_deploy_config () {
+    config=$1
+    type=$2
+    install -D -m 644 ${B}/${config}/${UBOOT_BINARYNAME}-${type}.${UBOOT_SUFFIX} ${DEPLOYDIR}/${UBOOT_BINARYNAME}-${type}-${UBOOT_VERSION}.${UBOOT_SUFFIX}
+    cd ${DEPLOYDIR}
+    ln -sf ${UBOOT_BINARYNAME}-${type}-${UBOOT_VERSION}.${UBOOT_SUFFIX} ${UBOOT_SYMLINK}-${type}
+    ln -sf ${UBOOT_BINARYNAME}-${type}-${UBOOT_VERSION}.${UBOOT_SUFFIX} ${UBOOT_SYMLINK}
+    ln -sf ${UBOOT_BINARYNAME}-${type}-${UBOOT_VERSION}.${UBOOT_SUFFIX} ${UBOOT_BINARY}-${type}
+    ln -sf ${UBOOT_BINARYNAME}-${type}-${UBOOT_VERSION}.${UBOOT_SUFFIX} ${UBOOT_BINARY}
+    # Deploy the uboot-initial-env
+    if [ -n "${UBOOT_INITIAL_ENV}" ]; then
+        install -D -m 644 ${B}/${config}/u-boot-initial-env-${type} ${DEPLOYDIR}/${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${UBOOT_VERSION}
+        cd ${DEPLOYDIR}
+        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${UBOOT_VERSION} ${UBOOT_INITIAL_ENV}-${MACHINE}-${type}
+        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${type}-${UBOOT_VERSION} ${UBOOT_INITIAL_ENV}-${type}
+    fi
+}
+uboot_deploy () {
+    install -D -m 644 ${B}/${UBOOT_BINARY} ${DEPLOYDIR}/${UBOOT_IMAGE}
+    cd ${DEPLOYDIR}
+    rm -f ${UBOOT_BINARY} ${UBOOT_SYMLINK}
+    ln -sf ${UBOOT_IMAGE} ${UBOOT_SYMLINK}
+    ln -sf ${UBOOT_IMAGE} ${UBOOT_BINARY}
+    # Deploy the uboot-initial-env
+    if [ -n "${UBOOT_INITIAL_ENV}" ]; then
+        install -D -m 644 ${B}/u-boot-initial-env ${DEPLOYDIR}/${UBOOT_INITIAL_ENV}-${MACHINE}-${UBOOT_VERSION}
+        cd ${DEPLOYDIR}
+        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${UBOOT_VERSION} ${UBOOT_INITIAL_ENV}-${MACHINE}
+        ln -sf ${UBOOT_INITIAL_ENV}-${MACHINE}-${UBOOT_VERSION} ${UBOOT_INITIAL_ENV}
+    fi
+}
+uboot_deploy_elf_config () {
+    config=$1
+    type=$2
+    install -m 644 ${B}/${config}/${UBOOT_ELF} ${DEPLOYDIR}/u-boot-${type}-${UBOOT_VERSION}.${UBOOT_ELF_SUFFIX}
+    ln -sf u-boot-${type}-${UBOOT_VERSION}.${UBOOT_ELF_SUFFIX} ${DEPLOYDIR}/${UBOOT_ELF_BINARY}-${type}
+    ln -sf u-boot-${type}-${UBOOT_VERSION}.${UBOOT_ELF_SUFFIX} ${DEPLOYDIR}/${UBOOT_ELF_BINARY}
+    ln -sf u-boot-${type}-${UBOOT_VERSION}.${UBOOT_ELF_SUFFIX} ${DEPLOYDIR}/${UBOOT_ELF_SYMLINK}-${type}
+    ln -sf u-boot-${type}-${UBOOT_VERSION}.${UBOOT_ELF_SUFFIX} ${DEPLOYDIR}/${UBOOT_ELF_SYMLINK}
+}
+uboot_deploy_elf () {
+    install -m 644 ${B}/${UBOOT_ELF} ${DEPLOYDIR}/${UBOOT_ELF_IMAGE}
+    ln -sf ${UBOOT_ELF_IMAGE} ${DEPLOYDIR}/${UBOOT_ELF_BINARY}
+    ln -sf ${UBOOT_ELF_IMAGE} ${DEPLOYDIR}/${UBOOT_ELF_SYMLINK}
+}
+uboot_deploy_spl_config () {
+    config=$1
+    type=$2
+    install -m 644 ${B}/${config}/${SPL_BINARY} ${DEPLOYDIR}/${SPL_BINARYNAME}-${type}-${UBOOT_VERSION}${SPL_DELIMITER}${SPL_SUFFIX}
+    rm -f ${DEPLOYDIR}/${SPL_BINARYFILE} ${DEPLOYDIR}/${SPL_SYMLINK}
+    ln -sf ${SPL_BINARYNAME}-${type}-${UBOOT_VERSION}${SPL_DELIMITER}${SPL_SUFFIX} ${DEPLOYDIR}/${SPL_BINARYFILE}-${type}
+    ln -sf ${SPL_BINARYNAME}-${type}-${UBOOT_VERSION}${SPL_DELIMITER}${SPL_SUFFIX} ${DEPLOYDIR}/${SPL_BINARYFILE}
+    ln -sf ${SPL_BINARYNAME}-${type}-${UBOOT_VERSION}${SPL_DELIMITER}${SPL_SUFFIX} ${DEPLOYDIR}/${SPL_SYMLINK}-${type}
+    ln -sf ${SPL_BINARYNAME}-${type}-${UBOOT_VERSION}${SPL_DELIMITER}${SPL_SUFFIX} ${DEPLOYDIR}/${SPL_SYMLINK}
+}
+uboot_deploy_spl () {
+    install -m 644 ${B}/${SPL_BINARY} ${DEPLOYDIR}/${SPL_IMAGE}
+    ln -sf ${SPL_IMAGE} ${DEPLOYDIR}/${SPL_BINARYNAME}
+    ln -sf ${SPL_IMAGE} ${DEPLOYDIR}/${SPL_SYMLINK}
 }
 addtask deploy before do_build after do_compile
diff --git a/meta/recipes-bsp/u-boot/u-boot_2021.01.bb b/meta/recipes-bsp/u-boot/u-boot_2021.01.bb
deleted file mode 100644
index 2eef1e900e..0000000000
--- a/meta/recipes-bsp/u-boot/u-boot_2021.01.bb
+++ /dev/null
@@ -1,4 +0,0 @@
-require u-boot-common.inc
-require u-boot.inc
-DEPENDS += "bc-native dtc-native python3-setuptools-native"
diff --git a/meta/recipes-bsp/u-boot/u-boot_2025.04.bb b/meta/recipes-bsp/u-boot/u-boot_2025.04.bb
new file mode 100644
index 0000000000..89e964f627
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/u-boot_2025.04.bb
@@ -0,0 +1,8 @@
+require u-boot-common.inc
+require u-boot.inc
+DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native"
+# workarounds for aarch64 kvm qemu boot regressions
+SRC_URI:append:qemuarm64 = " file://disable-CONFIG_BLOBLIST.cfg file://disable_CONFIG_USB.cfg"
+SRC_URI:append:genericarm64 = " file://disable-CONFIG_BLOBLIST.cfg file://disable_CONFIG_USB.cfg"
diff --git a/meta/recipes-bsp/usbinit/usbinit.bb b/meta/recipes-bsp/usbinit/usbinit.bb
deleted file mode 100644
index ef98f0bf62..0000000000
--- a/meta/recipes-bsp/usbinit/usbinit.bb
+++ /dev/null
@@ -1,25 +0,0 @@
-SUMMARY = "Initscript for enabling USB gadget Ethernet"
-DESCRIPTION = "This module allows ethernet emulation over USB, allowing for \
-all sorts of nifty things like SSH and NFS in one go plus charging over the \
-same wire, at higher speeds than most Wifi connections."
-HOMEPAGE = "http://linux-sunxi.org/USB_Gadget/Ethernet"
-LICENSE = "GPLv2"
-LIC_FILES_CHKSUM = "file://${WORKDIR}/COPYING.GPL;md5=751419260aa954499f7abaabaa882bbe"
-PR = "r3"
-SRC_URI = "file://usb-gether \
-           file://COPYING.GPL"
-S = "${WORKDIR}"
-do_install() {
-    install -d ${D}${sysconfdir}
-    install -d ${D}${sysconfdir}/init.d
-    install usb-gether ${D}${sysconfdir}/init.d
-}
-inherit update-rc.d allarch
-INITSCRIPT_NAME = "usb-gether"
-INITSCRIPT_PARAMS = "start 99 5 2 . stop 20 0 1 6 ."
diff --git a/meta/recipes-bsp/usbinit/usbinit/COPYING.GPL b/meta/recipes-bsp/usbinit/usbinit/COPYING.GPL
deleted file mode 100644
index d511905c16..0000000000
--- a/meta/recipes-bsp/usbinit/usbinit/COPYING.GPL
+++ /dev/null
@@ -1,339 +0,0 @@
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 2, June 1991
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-                            Preamble
-  The licenses for most software are designed to take away your
-freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Lesser General Public License instead.)  You can apply it to
-your programs, too.
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
-  To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
-  The precise terms and conditions for copying, distribution and
-modification follow.
-                    GNU GENERAL PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
-Activities other than copying, distribution and modification are not
-covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
-distribute such modifications or work under the terms of Section 1
-above, provided that you also meet all of these conditions:
-    a) You must cause the modified files to carry prominent notices
-    stating that you changed the files and the date of any change.
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
-and can be reasonably considered independent and separate works in
-themselves, then this License, and its terms, do not apply to those
-sections when you distribute them as separate works.  But when you
-distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
-this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
-Thus, it is not the intent of this section to claim rights or contest
-your rights to work written entirely by you; rather, the intent is to
-exercise the right to control the distribution of derivative or
-collective works based on the Program.
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
-a storage or distribution medium does not bring the other work under
-the scope of this License.
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
-  5. You are not required to accept this License, since you have not
-signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
-prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
-all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
-restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
-this License.
-  7. If, as a consequence of a court judgment or allegation of patent
-infringement or for any other reason (not limited to patent issues),
-conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot
-distribute so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
-all those who receive copies directly or indirectly through you, then
-the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
-It is not the purpose of this section to induce you to infringe any
-patents or other property right claims or to contest validity of any
-such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
-implemented by public license practices.  Many people have made
-generous contributions to the wide range of software distributed
-through that system in reliance on consistent application of that
-system; it is up to the author/donor to decide if he or she is willing
-to distribute software through any other system and a licensee cannot
-impose that choice.
-This section is intended to make thoroughly clear what is believed to
-be a consequence of the rest of this License.
-  8. If the distribution and/or use of the Program is restricted in
-certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
-                            NO WARRANTY
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
-                     END OF TERMS AND CONDITIONS
-            How to Apply These Terms to Your New Programs
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-    You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-Also add information on how to contact you by electronic and paper mail.
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-    Gnomovision version 69, Copyright (C) year name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
-necessary.  Here is a sample; alter the names:
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.
diff --git a/meta/recipes-bsp/usbinit/usbinit/usb-gether b/meta/recipes-bsp/usbinit/usbinit/usb-gether
deleted file mode 100755
index e80a0bb30e..0000000000
--- a/meta/recipes-bsp/usbinit/usbinit/usb-gether
+++ /dev/null
@@ -1,23 +0,0 @@
-#! /bin/sh
-#
-# usb-ether     Start up the gadget usb ethernet interface.
-#
-case "$1" in
-        start|"")
-                test "$VERBOSE" != no && echo "Initializing g_ether gadget..."
-                modprobe g_ether
-                ifup usb0
-                ;;
-        stop)
-                test "$VERBOSE" != no && echo "Disabling g_ether..."
-                ifdown usb0
-                rmmod g_ether
-                ;;
-        *)
-                echo "Usage: usb-ether {start|stop}" >&2
-                exit 1
-                ;;
-esac
-exit 0
diff --git a/meta/recipes-bsp/usbutils/usbutils_013.bb b/meta/recipes-bsp/usbutils/usbutils_013.bb
deleted file mode 100644
index 51f909b795..0000000000
--- a/meta/recipes-bsp/usbutils/usbutils_013.bb
+++ /dev/null
@@ -1,30 +0,0 @@
-SUMMARY = "Host side USB console utilities"
-DESCRIPTION = "Contains the lsusb utility for inspecting the devices connected to the USB bus."
-HOMEPAGE = "http://www.linux-usb.org"
-SECTION = "base"
-LICENSE = "GPLv2+ & (GPLv2 | GPLv3)"
-# License files went missing in 010, when 011 is released add LICENSES/* back
-LIC_FILES_CHKSUM = "file://lsusb.c;endline=1;md5=7d4861d978ff5ba7cb2b319ed1d4afe3 \
-                    file://lsusb.py.in;beginline=2;endline=2;md5=194d6a0226bf90f4f683e8968878b6cd"
-DEPENDS = "libusb1 virtual/libiconv udev"
-SRC_URI = "${KERNELORG_MIRROR}/linux/utils/usb/usbutils/usbutils-${PV}.tar.gz \
-          "
-SRC_URI[sha256sum] = "efdfd5403dbdd7412de6bb897d5fbaae65ef3eb4332032c0e1f216216618e9a9"
-inherit autotools pkgconfig update-alternatives
-ALTERNATIVE_${PN} = "lsusb"
-ALTERNATIVE_PRIORITY = "100"
-# The binaries are mostly GPLv2+ apart from lsusb.py which is GPLv2 or v3.
-LICENSE_${PN} = "GPLv2+"
-LICENSE_${PN}-python = "GPLv2 | GPLv3"
-RRECOMMENDS_${PN} = "udev-hwdb"
-PACKAGE_BEFORE_PN =+ "${PN}-python"
-FILES_${PN}-python += "${bindir}/lsusb.py"
-RDEPENDS_${PN}-python = "python3-core"
diff --git a/meta/recipes-bsp/usbutils/usbutils_018.bb b/meta/recipes-bsp/usbutils/usbutils_018.bb
new file mode 100644
index 0000000000..b96a1b4f19
--- /dev/null
+++ b/meta/recipes-bsp/usbutils/usbutils_018.bb
@@ -0,0 +1,34 @@
+SUMMARY = "Host side USB console utilities"
+DESCRIPTION = "Contains the lsusb utility for inspecting the devices connected to the USB bus."
+HOMEPAGE = "http://www.linux-usb.org"
+SECTION = "base"
+LICENSE = "GPL-2.0-or-later & (GPL-2.0-only | GPL-3.0-only) & CC0-1.0 & LGPL-2.1-or-later & MIT"
+LIC_FILES_CHKSUM = "file://LICENSES/CC0-1.0.txt;md5=cf1af55fc6f5b9a23e12086005298dcd \
+                    file://LICENSES/GPL-2.0-only.txt;md5=c89d4ad08368966d8df5a90ea96bebe4 \
+                    file://LICENSES/GPL-2.0-or-later.txt;md5=c89d4ad08368966d8df5a90ea96bebe4 \
+                    file://LICENSES/GPL-3.0-only.txt;md5=050f496cfea7876fc13cdea643e041e0 \
+                    file://LICENSES/LGPL-2.1-or-later.txt;md5=8c6e7513c570546f65ae570dae278c17 \
+                    file://LICENSES/MIT.txt;md5=e8f57dd048e186199433be2c41bd3d6d \
+                   "
+DEPENDS = "libusb1 virtual/libiconv udev"
+SRC_URI = "${KERNELORG_MIRROR}/linux/utils/usb/usbutils/usbutils-${PV}.tar.gz \
+          "
+SRC_URI[sha256sum] = "0048d2d8518fb0cc7c0516e16e52af023e52b55ddb3b2068a77041b5ef285768"
+inherit meson pkgconfig update-alternatives
+ALTERNATIVE:${PN} = "lsusb"
+ALTERNATIVE_PRIORITY = "100"
+# The binaries are mostly GPL-2.0-or-later apart from lsusb.py which is
+# GPL-2.0-only or GPL-3.0-only.
+LICENSE:${PN} = "GPL-2.0-or-later"
+LICENSE:${PN}-python = "GPL-2.0-only | GPL-3.0-only"
+RRECOMMENDS:${PN} = "udev-hwdb"
+PACKAGE_BEFORE_PN =+ "${PN}-python"
+FILES:${PN}-python += "${bindir}/lsusb.py"
+RDEPENDS:${PN}-python = "python3-core"
diff --git a/meta/recipes-bsp/v86d/v86d_0.1.10.bb b/meta/recipes-bsp/v86d/v86d_0.1.10.bb
index e614de0c48..3bc9b24487 100644
--- a/meta/recipes-bsp/v86d/v86d_0.1.10.bb
+++ b/meta/recipes-bsp/v86d/v86d_0.1.10.bb
@@ -3,12 +3,10 @@ HOMEPAGE = "https://tracker.debian.org/pkg/v86d"
 DESCRIPTION = "v86d provides a backend for kernel drivers that need to execute x86 BIOS code. The code is executed in a controlled environment and the results are passed back to the kernel via the netlink interface."
 # the copyright info is at the bottom of README, expect break
-LICENSE = "GPLv2"
+LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://README;md5=94ac1971e4f2309dc322d598e7b1f7dd"
-DEPENDS = "virtual/kernel"
+RRECOMMENDS:${PN} = "kernel-module-uvesafb"
-RRECOMMENDS_${PN} = "kernel-module-uvesafb"
-PR = "r2"
 SRC_URI = "http://snapshot.debian.org/archive/debian/20110427T035506Z/pool/main/v/${BPN}/${BPN}_${PV}.orig.tar.gz \
           file://Update-x86emu-from-X.org.patch \
@@ -16,7 +14,6 @@ SRC_URI = "http://snapshot.debian.org/archive/debian/20110427T035506Z/pool/main/
           file://Support-for-cross-compilation.patch \
 "
-SRC_URI[md5sum] = "889686ec8424468fe0d205742e77a4c2"
 SRC_URI[sha256sum] = "93575c82e4307d8c4c370ec6b767f5cf87e527b2378146d652a6d8e25d5bdbc5"
 PACKAGE_ARCH = "${MACHINE_ARCH}"