* [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0
@ 2026-09-10 1:54 Ryan Eatmon
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 2/5] linux-ti-staging_6.6: Backport OpenSSL 4.0 patches Ryan Eatmon
` (6 more replies)
0 siblings, 7 replies; 11+ messages in thread
From: Ryan Eatmon @ 2026-09-10 1:54 UTC (permalink / raw)
To: Praneeth Bajjuri, Denys Dmytriyenko, meta-ti
With the recent move to OpenSSL 4.0 [1] we need to update the same code
in the various u-boot versions that we support.
[1] https://git.openembedded.org/openembedded-core/commit/?id=20bf704e5809e95036b998f0f45145cf7205b05b
Signed-off-by: Ryan Eatmon <reatmon@ti.com>
---
v2; No change.
...ort-for-OpenSSL-Provider-API-2024-04.patch | 300 ++++++++++++++++
...ort-for-OpenSSL-Provider-API-2025-01.patch | 300 ++++++++++++++++
...ort-for-OpenSSL-Provider-API-2026-01.patch | 340 ++++++++++++++++++
.../u-boot/u-boot-ti-staging_2024.04.bb | 6 +-
.../u-boot/u-boot-ti-staging_2025.01.bb | 1 +
.../u-boot/u-boot-ti-staging_2026.01.bb | 2 +
meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc | 1 +
7 files changed, 948 insertions(+), 2 deletions(-)
create mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch
create mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch
create mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch
diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch
new file mode 100644
index 00000000..9f67644b
--- /dev/null
+++ b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch
@@ -0,0 +1,300 @@
+From 401c19f6b0a7c63afad92e9d3f2cbb75d6ed8566 Mon Sep 17 00:00:00 2001
+From: Ryan Eatmon <reatmon@ti.com>
+Date: Wed, 9 Sep 2026 10:04:50 -0500
+Subject: [PATCH] Add support for OpenSSL Provider API
+
+Backport from 2026.01 patch [1] by Ryan Eatmon <reatmon@ti.com>
+
+Upsatream-Status: Inappropriate [OE-specific]
+
+The Engine API has been deprecated since the release of OpenSSL 3.0. End
+users have been advised to migrate to the new Provider interface.
+Several distributions have already removed support for engines, which is
+preventing U-Boot from being compiled in those environments.
+
+Add support for the Provider API while continuing to support the existing
+Engine API on distros shipping older releases of OpenSSL.
+
+This is based on similar work contributed by Jan Stancek updating Linux
+to use the Provider interface.
+
+ commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
+ Author: Jan Stancek <jstancek@redhat.com>
+ Date: Fri Sep 20 19:52:48 2024 +0300
+
+ sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
+
+The changes have been tested with the FIT signature verification vboot
+tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
+Engine library installed and with the Provider API.
+
+Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
+
+Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
+
+Note: Modified to make pkcs11 provider loading optional. The upstream
+patch unconditionally requires the pkcs11 provider, which is not
+available in the OE build environment. File-based key signing only needs
+the default provider; pkcs11 is only required for pkcs11: URI keys.
+Changes from upstream:
+ - Load default provider first (was pkcs11 first)
+ - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
+ of ERR(1, ...) which calls errx/abort)
+
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+
+Signed-off-by: Ryan Eatmon <reatmon@ti.com>
+---
+ lib/aes/aes-encrypt.c | 4 +-
+ lib/rsa/rsa-sign.c | 95 ++++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 97 insertions(+), 2 deletions(-)
+
+diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
+index e74e35eaa28..8a6f7715df9 100644
+--- a/lib/aes/aes-encrypt.c
++++ b/lib/aes/aes-encrypt.c
+@@ -16,7 +16,9 @@
+ #include <openssl/err.h>
+ #include <openssl/ssl.h>
+ #include <openssl/evp.h>
+-#include <openssl/engine.h>
++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
++# include <openssl/engine.h>
++#endif
+ #include <uboot_aes.h>
+
+ #if OPENSSL_VERSION_NUMBER >= 0x10000000L
+diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
+index 2304030e32f..29b3bd3dbb1 100644
+--- a/lib/rsa/rsa-sign.c
++++ b/lib/rsa/rsa-sign.c
+@@ -19,7 +19,47 @@
+ #include <openssl/err.h>
+ #include <openssl/ssl.h>
+ #include <openssl/evp.h>
+-#include <openssl/engine.h>
++#if OPENSSL_VERSION_MAJOR >= 3
++# define USE_PKCS11_PROVIDER
++# include <err.h>
++# include <openssl/provider.h>
++# include <openssl/store.h>
++#else
++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
++# define USE_PKCS11_ENGINE
++# include <openssl/engine.h>
++# endif
++#endif
++
++#ifdef USE_PKCS11_PROVIDER
++#define ERR(cond, fmt, ...) \
++ do { \
++ bool __cond = (cond); \
++ drain_openssl_errors(__LINE__, 0); \
++ if (__cond) { \
++ errx(1, fmt, ## __VA_ARGS__); \
++ } \
++ } while (0)
++
++static void drain_openssl_errors(int l, int silent)
++{
++ const char *file;
++ char buf[120];
++ int e, line;
++
++ if (ERR_peek_error() == 0)
++ return;
++ if (!silent)
++ fprintf(stderr, "At main.c:%d:\n", l);
++
++ while ((e = ERR_peek_error_line(&file, &line))) {
++ ERR_error_string(e, buf);
++ if (!silent)
++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
++ ERR_get_error();
++ }
++}
++#endif
+
+ static int rsa_err(const char *msg)
+ {
+@@ -98,6 +138,7 @@ err_cert:
+ * @evpp Returns EVP_PKEY object, or NULL on failure
+ * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+ */
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
+ ENGINE *engine, EVP_PKEY **evpp)
+ {
+@@ -157,6 +198,7 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
+
+ return 0;
+ }
++#endif
+
+ /**
+ * rsa_get_pub_key() - read a public key
+@@ -170,8 +212,10 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
+ static int rsa_get_pub_key(const char *keydir, const char *name,
+ ENGINE *engine, EVP_PKEY **evpp)
+ {
++#ifdef USE_PKCS11_ENGINE
+ if (engine)
+ return rsa_engine_get_pub_key(keydir, name, engine, evpp);
++#endif
+ return rsa_pem_get_pub_key(keydir, name, evpp);
+ }
+
+@@ -207,6 +251,38 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
+ return -ENOENT;
+ }
+
++#ifdef USE_PKCS11_PROVIDER
++ EVP_PKEY *private_key = NULL;
++ OSSL_STORE_CTX *store;
++
++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
++ ERR(1, "OSSL_PROVIDER_try_load(default)");
++ /* pkcs11 provider is optional; only needed for pkcs11: URIs */
++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
++ ERR_clear_error();
++
++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
++ ERR(!store, "OSSL_STORE_open");
++
++ while (!OSSL_STORE_eof(store)) {
++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
++
++ if (!info) {
++ drain_openssl_errors(__LINE__, 0);
++ continue;
++ }
++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
++ private_key = OSSL_STORE_INFO_get1_PKEY(info);
++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
++ }
++ OSSL_STORE_INFO_free(info);
++ if (private_key)
++ break;
++ }
++ OSSL_STORE_close(store);
++
++ *evpp = private_key;
++#else
+ if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
+ rsa_err("Failure reading private key");
+ fclose(f);
+@@ -214,6 +290,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
+ }
+ fclose(f);
+
++#endif
+ return 0;
+ }
+
+@@ -226,6 +303,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
+ * @evpp Returns EVP_PKEY object, or NULL on failure
+ * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+ */
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
+ const char *keyfile,
+ ENGINE *engine, EVP_PKEY **evpp)
+@@ -293,6 +371,7 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
+
+ return 0;
+ }
++#endif
+
+ /**
+ * rsa_get_priv_key() - read a private key
+@@ -306,9 +385,11 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
+ static int rsa_get_priv_key(const char *keydir, const char *name,
+ const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
+ {
++#ifdef USE_PKCS11_ENGINE
+ if (engine)
+ return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
+ evpp);
++#endif
+ return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
+ }
+
+@@ -325,6 +406,7 @@ static int rsa_init(void)
+ return 0;
+ }
+
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_init(const char *engine_id, ENGINE **pe)
+ {
+ const char *key_pass;
+@@ -372,6 +454,7 @@ err_engine_init:
+ ENGINE_free(e);
+ return ret;
+ }
++#endif
+
+ static void rsa_engine_remove(ENGINE *e)
+ {
+@@ -471,11 +554,13 @@ int rsa_sign(struct image_sign_info *info,
+ if (ret)
+ return ret;
+
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id) {
+ ret = rsa_engine_init(info->engine_id, &e);
+ if (ret)
+ return ret;
+ }
++#endif
+
+ ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
+ e, &pkey);
+@@ -487,16 +572,20 @@ int rsa_sign(struct image_sign_info *info,
+ goto err_sign;
+
+ EVP_PKEY_free(pkey);
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id)
+ rsa_engine_remove(e);
++#endif
+
+ return ret;
+
+ err_sign:
+ EVP_PKEY_free(pkey);
+ err_priv:
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id)
+ rsa_engine_remove(e);
++#endif
+ return ret;
+ }
+
+@@ -636,11 +725,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
+ ENGINE *e = NULL;
+
+ debug("%s: Getting verification data\n", __func__);
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id) {
+ ret = rsa_engine_init(info->engine_id, &e);
+ if (ret)
+ return ret;
+ }
++#endif
+ ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
+ if (ret)
+ goto err_get_pub_key;
+@@ -717,8 +808,10 @@ done:
+ err_get_params:
+ EVP_PKEY_free(pkey);
+ err_get_pub_key:
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id)
+ rsa_engine_remove(e);
++#endif
+
+ if (ret)
+ return ret;
+--
+2.43.0
+
diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch
new file mode 100644
index 00000000..c5f3655e
--- /dev/null
+++ b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch
@@ -0,0 +1,300 @@
+From 0525693750b1b7a8fb7228dbb97bf592a21322fc Mon Sep 17 00:00:00 2001
+From: Ryan Eatmon <reatmon@ti.com>
+Date: Wed, 9 Sep 2026 10:04:50 -0500
+Subject: [PATCH] Add support for OpenSSL Provider API
+
+Backport from 2026.01 patch [1] by Ryan Eatmon <reatmon@ti.com>
+
+Upsatream-Status: Inappropriate [OE-specific]
+
+The Engine API has been deprecated since the release of OpenSSL 3.0. End
+users have been advised to migrate to the new Provider interface.
+Several distributions have already removed support for engines, which is
+preventing U-Boot from being compiled in those environments.
+
+Add support for the Provider API while continuing to support the existing
+Engine API on distros shipping older releases of OpenSSL.
+
+This is based on similar work contributed by Jan Stancek updating Linux
+to use the Provider interface.
+
+ commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
+ Author: Jan Stancek <jstancek@redhat.com>
+ Date: Fri Sep 20 19:52:48 2024 +0300
+
+ sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
+
+The changes have been tested with the FIT signature verification vboot
+tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
+Engine library installed and with the Provider API.
+
+Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
+
+Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
+
+Note: Modified to make pkcs11 provider loading optional. The upstream
+patch unconditionally requires the pkcs11 provider, which is not
+available in the OE build environment. File-based key signing only needs
+the default provider; pkcs11 is only required for pkcs11: URI keys.
+Changes from upstream:
+ - Load default provider first (was pkcs11 first)
+ - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
+ of ERR(1, ...) which calls errx/abort)
+
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+
+Signed-off-by: Ryan Eatmon <reatmon@ti.com>
+---
+ lib/aes/aes-encrypt.c | 4 +-
+ lib/rsa/rsa-sign.c | 95 ++++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 97 insertions(+), 2 deletions(-)
+
+diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
+index e74e35eaa28..8a6f7715df9 100644
+--- a/lib/aes/aes-encrypt.c
++++ b/lib/aes/aes-encrypt.c
+@@ -16,7 +16,9 @@
+ #include <openssl/err.h>
+ #include <openssl/ssl.h>
+ #include <openssl/evp.h>
+-#include <openssl/engine.h>
++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
++# include <openssl/engine.h>
++#endif
+ #include <uboot_aes.h>
+
+ #if OPENSSL_VERSION_NUMBER >= 0x10000000L
+diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
+index fa9e143b4ca..af5b18e0c95 100644
+--- a/lib/rsa/rsa-sign.c
++++ b/lib/rsa/rsa-sign.c
+@@ -19,7 +19,47 @@
+ #include <openssl/err.h>
+ #include <openssl/ssl.h>
+ #include <openssl/evp.h>
+-#include <openssl/engine.h>
++#if OPENSSL_VERSION_MAJOR >= 3
++# define USE_PKCS11_PROVIDER
++# include <err.h>
++# include <openssl/provider.h>
++# include <openssl/store.h>
++#else
++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
++# define USE_PKCS11_ENGINE
++# include <openssl/engine.h>
++# endif
++#endif
++
++#ifdef USE_PKCS11_PROVIDER
++#define ERR(cond, fmt, ...) \
++ do { \
++ bool __cond = (cond); \
++ drain_openssl_errors(__LINE__, 0); \
++ if (__cond) { \
++ errx(1, fmt, ## __VA_ARGS__); \
++ } \
++ } while (0)
++
++static void drain_openssl_errors(int l, int silent)
++{
++ const char *file;
++ char buf[120];
++ int e, line;
++
++ if (ERR_peek_error() == 0)
++ return;
++ if (!silent)
++ fprintf(stderr, "At main.c:%d:\n", l);
++
++ while ((e = ERR_peek_error_line(&file, &line))) {
++ ERR_error_string(e, buf);
++ if (!silent)
++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
++ ERR_get_error();
++ }
++}
++#endif
+
+ static int rsa_err(const char *msg)
+ {
+@@ -98,6 +138,7 @@ err_cert:
+ * @evpp Returns EVP_PKEY object, or NULL on failure
+ * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+ */
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
+ ENGINE *engine, EVP_PKEY **evpp)
+ {
+@@ -157,6 +198,7 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
+
+ return 0;
+ }
++#endif
+
+ /**
+ * rsa_get_pub_key() - read a public key
+@@ -170,8 +212,10 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
+ static int rsa_get_pub_key(const char *keydir, const char *name,
+ ENGINE *engine, EVP_PKEY **evpp)
+ {
++#ifdef USE_PKCS11_ENGINE
+ if (engine)
+ return rsa_engine_get_pub_key(keydir, name, engine, evpp);
++#endif
+ return rsa_pem_get_pub_key(keydir, name, evpp);
+ }
+
+@@ -207,6 +251,38 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
+ return -ENOENT;
+ }
+
++#ifdef USE_PKCS11_PROVIDER
++ EVP_PKEY *private_key = NULL;
++ OSSL_STORE_CTX *store;
++
++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
++ ERR(1, "OSSL_PROVIDER_try_load(default)");
++ /* pkcs11 provider is optional; only needed for pkcs11: URIs */
++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
++ ERR_clear_error();
++
++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
++ ERR(!store, "OSSL_STORE_open");
++
++ while (!OSSL_STORE_eof(store)) {
++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
++
++ if (!info) {
++ drain_openssl_errors(__LINE__, 0);
++ continue;
++ }
++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
++ private_key = OSSL_STORE_INFO_get1_PKEY(info);
++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
++ }
++ OSSL_STORE_INFO_free(info);
++ if (private_key)
++ break;
++ }
++ OSSL_STORE_close(store);
++
++ *evpp = private_key;
++#else
+ if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
+ rsa_err("Failure reading private key");
+ fclose(f);
+@@ -214,6 +290,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
+ }
+ fclose(f);
+
++#endif
+ return 0;
+ }
+
+@@ -226,6 +303,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
+ * @evpp Returns EVP_PKEY object, or NULL on failure
+ * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+ */
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
+ const char *keyfile,
+ ENGINE *engine, EVP_PKEY **evpp)
+@@ -293,6 +371,7 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
+
+ return 0;
+ }
++#endif
+
+ /**
+ * rsa_get_priv_key() - read a private key
+@@ -306,9 +385,11 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
+ static int rsa_get_priv_key(const char *keydir, const char *name,
+ const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
+ {
++#ifdef USE_PKCS11_ENGINE
+ if (engine)
+ return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
+ evpp);
++#endif
+ return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
+ }
+
+@@ -325,6 +406,7 @@ static int rsa_init(void)
+ return 0;
+ }
+
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_init(const char *engine_id, ENGINE **pe)
+ {
+ const char *key_pass;
+@@ -372,6 +454,7 @@ err_engine_init:
+ ENGINE_free(e);
+ return ret;
+ }
++#endif
+
+ static void rsa_engine_remove(ENGINE *e)
+ {
+@@ -480,11 +563,13 @@ int rsa_sign(struct image_sign_info *info,
+ if (ret)
+ return ret;
+
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id) {
+ ret = rsa_engine_init(info->engine_id, &e);
+ if (ret)
+ return ret;
+ }
++#endif
+
+ ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
+ e, &pkey);
+@@ -496,16 +581,20 @@ int rsa_sign(struct image_sign_info *info,
+ goto err_sign;
+
+ EVP_PKEY_free(pkey);
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id)
+ rsa_engine_remove(e);
++#endif
+
+ return ret;
+
+ err_sign:
+ EVP_PKEY_free(pkey);
+ err_priv:
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id)
+ rsa_engine_remove(e);
++#endif
+ return ret;
+ }
+
+@@ -645,11 +734,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
+ ENGINE *e = NULL;
+
+ debug("%s: Getting verification data\n", __func__);
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id) {
+ ret = rsa_engine_init(info->engine_id, &e);
+ if (ret)
+ return ret;
+ }
++#endif
+ ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
+ if (ret)
+ goto err_get_pub_key;
+@@ -726,8 +817,10 @@ done:
+ err_get_params:
+ EVP_PKEY_free(pkey);
+ err_get_pub_key:
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id)
+ rsa_engine_remove(e);
++#endif
+
+ if (ret)
+ return ret;
+--
+2.43.0
+
diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch
new file mode 100644
index 00000000..346d0584
--- /dev/null
+++ b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch
@@ -0,0 +1,340 @@
+From a81cb0932dce109af44d7245d47489fe54ae390f Mon Sep 17 00:00:00 2001
+From: Eddie Kovsky <ewk@edkovsky.org>
+Date: Mon, 23 Feb 2026 09:43:22 -0700
+Subject: [PATCH] Add support for OpenSSL Provider API
+
+The Engine API has been deprecated since the release of OpenSSL 3.0. End
+users have been advised to migrate to the new Provider interface.
+Several distributions have already removed support for engines, which is
+preventing U-Boot from being compiled in those environments.
+
+Add support for the Provider API while continuing to support the existing
+Engine API on distros shipping older releases of OpenSSL.
+
+This is based on similar work contributed by Jan Stancek updating Linux
+to use the Provider interface.
+
+ commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
+ Author: Jan Stancek <jstancek@redhat.com>
+ Date: Fri Sep 20 19:52:48 2024 +0300
+
+ sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
+
+The changes have been tested with the FIT signature verification vboot
+tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
+Engine library installed and with the Provider API.
+
+Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
+
+Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
+
+Note: Modified to make pkcs11 provider loading optional. The upstream
+patch unconditionally requires the pkcs11 provider, which is not
+available in the OE build environment. File-based key signing only needs
+the default provider; pkcs11 is only required for pkcs11: URI keys.
+Changes from upstream:
+ - Load default provider first (was pkcs11 first)
+ - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
+ of ERR(1, ...) which calls errx/abort)
+
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ doc/build/gcc.rst | 4 +-
+ lib/aes/aes-encrypt.c | 4 +-
+ lib/rsa/rsa-sign.c | 102 +++++++++++++++++++++++++++++++++++++++---
+ tools/docker/Dockerfile | 1 +
+ 4 files changed, 103 insertions(+), 8 deletions(-)
+
+diff --git a/doc/build/gcc.rst b/doc/build/gcc.rst
+index 1fef718ceecb..29a6a632e7e3 100644
+--- a/doc/build/gcc.rst
++++ b/doc/build/gcc.rst
+@@ -25,8 +25,8 @@ Depending on the build targets further packages maybe needed
+
+ sudo apt-get install bc bison build-essential coccinelle \
+ device-tree-compiler dfu-util efitools flex gdisk graphviz imagemagick \
+- libgnutls28-dev libguestfs-tools libncurses-dev \
+- libpython3-dev libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl \
++ libgnutls28-dev libguestfs-tools libncurses-dev libpython3-dev \
++ libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl pkcs11-provider \
+ pkg-config python3 python3-asteval python3-coverage python3-filelock \
+ python3-pkg-resources python3-pycryptodome python3-pyelftools \
+ python3-pytest python3-pytest-xdist python3-sphinxcontrib.apidoc \
+diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
+index 90e1407b4f09..4fc4ce232478 100644
+--- a/lib/aes/aes-encrypt.c
++++ b/lib/aes/aes-encrypt.c
+@@ -16,7 +16,9 @@
+ #include <openssl/err.h>
+ #include <openssl/ssl.h>
+ #include <openssl/evp.h>
+-#include <openssl/engine.h>
++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
++# include <openssl/engine.h>
++#endif
+ #include <uboot_aes.h>
+
+ #if OPENSSL_VERSION_NUMBER >= 0x10000000L
+diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
+index 0e38c9e802fd..f456f3c58e65 100644
+--- a/lib/rsa/rsa-sign.c
++++ b/lib/rsa/rsa-sign.c
+@@ -19,7 +19,47 @@
+ #include <openssl/err.h>
+ #include <openssl/ssl.h>
+ #include <openssl/evp.h>
+-#include <openssl/engine.h>
++#if OPENSSL_VERSION_MAJOR >= 3
++# define USE_PKCS11_PROVIDER
++# include <err.h>
++# include <openssl/provider.h>
++# include <openssl/store.h>
++#else
++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
++# define USE_PKCS11_ENGINE
++# include <openssl/engine.h>
++# endif
++#endif
++
++#ifdef USE_PKCS11_PROVIDER
++#define ERR(cond, fmt, ...) \
++ do { \
++ bool __cond = (cond); \
++ drain_openssl_errors(__LINE__, 0); \
++ if (__cond) { \
++ errx(1, fmt, ## __VA_ARGS__); \
++ } \
++ } while (0)
++
++static void drain_openssl_errors(int l, int silent)
++{
++ const char *file;
++ char buf[120];
++ int e, line;
++
++ if (ERR_peek_error() == 0)
++ return;
++ if (!silent)
++ fprintf(stderr, "At main.c:%d:\n", l);
++
++ while ((e = ERR_peek_error_line(&file, &line))) {
++ ERR_error_string(e, buf);
++ if (!silent)
++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
++ ERR_get_error();
++ }
++}
++#endif
+
+ static int rsa_err(const char *msg)
+ {
+@@ -94,10 +134,11 @@ static int rsa_pem_get_pub_key(const char *keydir, const char *name, EVP_PKEY **
+ *
+ * @keydir: Key prefix
+ * @name Name of key
+- * @engine Engine to use
++ * @engine Engine to use or NULL when using pkcs11 provider
+ * @evpp Returns EVP_PKEY object, or NULL on failure
+ * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+ */
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
+ ENGINE *engine, EVP_PKEY **evpp)
+ {
+@@ -157,21 +198,24 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
+
+ return 0;
+ }
++#endif
+
+ /**
+ * rsa_get_pub_key() - read a public key
+ *
+ * @keydir: Directory containing the key (PEM file) or key prefix (engine)
+ * @name Name of key file (will have a .crt extension)
+- * @engine Engine to use
++ * @engine Engine to use or NULL when using pkcs11 provider
+ * @evpp Returns EVP_PKEY object, or NULL on failure
+ * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+ */
+ static int rsa_get_pub_key(const char *keydir, const char *name,
+ ENGINE *engine, EVP_PKEY **evpp)
+ {
++#ifdef USE_PKCS11_ENGINE
+ if (engine)
+ return rsa_engine_get_pub_key(keydir, name, engine, evpp);
++#endif
+ return rsa_pem_get_pub_key(keydir, name, evpp);
+ }
+
+@@ -207,13 +251,45 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
+ return -ENOENT;
+ }
+
++#ifdef USE_PKCS11_PROVIDER
++ EVP_PKEY *private_key = NULL;
++ OSSL_STORE_CTX *store;
++
++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
++ ERR(1, "OSSL_PROVIDER_try_load(default)");
++ /* pkcs11 provider is optional; only needed for pkcs11: URIs */
++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
++ ERR_clear_error();
++
++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
++ ERR(!store, "OSSL_STORE_open");
++
++ while (!OSSL_STORE_eof(store)) {
++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
++
++ if (!info) {
++ drain_openssl_errors(__LINE__, 0);
++ continue;
++ }
++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
++ private_key = OSSL_STORE_INFO_get1_PKEY(info);
++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
++ }
++ OSSL_STORE_INFO_free(info);
++ if (private_key)
++ break;
++ }
++ OSSL_STORE_close(store);
++
++ *evpp = private_key;
++#else
+ if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
+ rsa_err("Failure reading private key");
+ fclose(f);
+ return -EPROTO;
+ }
+ fclose(f);
+-
++#endif
+ return 0;
+ }
+
+@@ -226,6 +301,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
+ * @evpp Returns EVP_PKEY object, or NULL on failure
+ * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+ */
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
+ const char *keyfile,
+ ENGINE *engine, EVP_PKEY **evpp)
+@@ -293,22 +369,25 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
+
+ return 0;
+ }
++#endif
+
+ /**
+ * rsa_get_priv_key() - read a private key
+ *
+ * @keydir: Directory containing the key (PEM file) or key prefix (engine)
+ * @name Name of key
+- * @engine Engine to use for signing
++ * @engine Engine to use or NULL when using pkcs11 provider
+ * @evpp Returns EVP_PKEY object, or NULL on failure
+ * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+ */
+ static int rsa_get_priv_key(const char *keydir, const char *name,
+ const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
+ {
++#ifdef USE_PKCS11_ENGINE
+ if (engine)
+ return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
+ evpp);
++#endif
+ return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
+ }
+
+@@ -325,6 +404,7 @@ static int rsa_init(void)
+ return 0;
+ }
+
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_init(const char *engine_id, ENGINE **pe)
+ {
+ const char *key_pass;
+@@ -380,6 +460,7 @@ static void rsa_engine_remove(ENGINE *e)
+ ENGINE_free(e);
+ }
+ }
++#endif
+
+ static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo,
+ struct checksum_algo *checksum_algo,
+@@ -480,11 +561,13 @@ int rsa_sign(struct image_sign_info *info,
+ if (ret)
+ return ret;
+
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id) {
+ ret = rsa_engine_init(info->engine_id, &e);
+ if (ret)
+ return ret;
+ }
++#endif
+
+ ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
+ e, &pkey);
+@@ -496,16 +579,21 @@ int rsa_sign(struct image_sign_info *info,
+ goto err_sign;
+
+ EVP_PKEY_free(pkey);
++
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id)
+ rsa_engine_remove(e);
++#endif
+
+ return ret;
+
+ err_sign:
+ EVP_PKEY_free(pkey);
+ err_priv:
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id)
+ rsa_engine_remove(e);
++#endif
+ return ret;
+ }
+
+@@ -645,11 +733,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
+ ENGINE *e = NULL;
+
+ debug("%s: Getting verification data\n", __func__);
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id) {
+ ret = rsa_engine_init(info->engine_id, &e);
+ if (ret)
+ return ret;
+ }
++#endif
+ ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
+ if (ret)
+ goto err_get_pub_key;
+@@ -726,8 +816,10 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
+ err_get_params:
+ EVP_PKEY_free(pkey);
+ err_get_pub_key:
++#ifdef USE_PKCS11_ENGINE
+ if (info->engine_id)
+ rsa_engine_remove(e);
++#endif
+
+ if (ret)
+ return ret;
+diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
+index 73bf6cdd2c52..50e98e83dc20 100644
+--- a/tools/docker/Dockerfile
++++ b/tools/docker/Dockerfile
+@@ -122,6 +122,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+ openssl \
+ picocom \
+ parted \
++ pkcs11-provider \
+ pkg-config \
+ python-is-python3 \
+ python3 \
diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb
index d3a78d8b..5812b914 100644
--- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb
+++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb
@@ -4,6 +4,8 @@ PR = "r0"
BRANCH = "ti-u-boot-2024.04"
-SRC_URI += "file://0001-scripts-dtc-pylibfdt-libfdt.i_shipped-Use-SWIG_Appen.patch"
-
SRCREV_uboot = "29d0c23d67ee7b88e46fe1753cd020e2b04c2ef6"
+
+SRC_URI += "file://0001-scripts-dtc-pylibfdt-libfdt.i_shipped-Use-SWIG_Appen.patch"
+SRC_URI += "file://0001-binman-migrate-form-pkg_resources-to-importlib.patch"
+SRC_URI += "file://0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch"
diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb
index f7475c2b..af4b1b77 100644
--- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb
+++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb
@@ -7,3 +7,4 @@ BRANCH = "ti-u-boot-2025.01"
SRCREV_uboot = "4ca322ca563a21cccad8c9ba65e386b9fd34dd16"
SRC_URI += "file://0001-binman-migrate-form-pkg_resources-to-importlib.patch"
+SRC_URI += "file://0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch"
diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb
index 7637cfaf..d1ef241d 100644
--- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb
+++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb
@@ -5,3 +5,5 @@ PR = "r0"
BRANCH = "ti-u-boot-2026.01"
SRCREV_uboot = "2a85f4bcffc50ddc8b443d8e4162e9e46ed0f200"
+
+SRC_URI += "file://0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch"
diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
index 3d6769bf..8213ac60 100644
--- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
+++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
@@ -25,6 +25,7 @@ UBOOT_GIT_PROTOCOL ?= "https"
UBOOT_GIT_BRANCH ?= "branch=${BRANCH}"
SRC_URI = "${UBOOT_GIT_URI};protocol=${UBOOT_GIT_PROTOCOL};${UBOOT_GIT_BRANCH};name=uboot"
+SRC_URI:append:bsp-ti-6_6 = " file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch"
SRC_URI:append:bsp-ti-6_12 = " file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch"
SRC_URI:append:bsp-ti-6_18 = " file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch"
--
2.43.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [meta-ti][master][PATCH v2 2/5] linux-ti-staging_6.6: Backport OpenSSL 4.0 patches
2026-09-10 1:54 [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0 Ryan Eatmon
@ 2026-09-10 1:54 ` Ryan Eatmon
2026-09-10 5:50 ` Yogesh Hegde
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 3/5] mesa-pvr: Remove makedepend dependency Ryan Eatmon
` (5 subsequent siblings)
6 siblings, 1 reply; 11+ messages in thread
From: Ryan Eatmon @ 2026-09-10 1:54 UTC (permalink / raw)
To: Praneeth Bajjuri, Denys Dmytriyenko, meta-ti
Backport a set of kernel patches to 6.6 to fix the OpenSSL build
failures.
Signed-off-by: Ryan Eatmon <reatmon@ti.com>
---
v2; Added missing Upstream-Status.
| 205 ++++++++++++++++++
...-using-deprecated-ERR_get_error_line.patch | 121 +++++++++++
...-pkcs11-provider-for-OPENSSL-MAJOR-3.patch | 163 ++++++++++++++
.../linux/linux-ti-staging_6.6.bb | 6 +
4 files changed, 495 insertions(+)
create mode 100644 meta-ti-bsp/recipes-kernel/linux/files/0001-move-common-SSL-helper-functions-to-a-header.patch
create mode 100644 meta-ti-bsp/recipes-kernel/linux/files/0002-avoid-using-deprecated-ERR_get_error_line.patch
create mode 100644 meta-ti-bsp/recipes-kernel/linux/files/0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch
--git a/meta-ti-bsp/recipes-kernel/linux/files/0001-move-common-SSL-helper-functions-to-a-header.patch b/meta-ti-bsp/recipes-kernel/linux/files/0001-move-common-SSL-helper-functions-to-a-header.patch
new file mode 100644
index 00000000..6a58b5eb
--- /dev/null
+++ b/meta-ti-bsp/recipes-kernel/linux/files/0001-move-common-SSL-helper-functions-to-a-header.patch
@@ -0,0 +1,205 @@
+From 300e6d4116f956b035281ec94297dc4dc8d4e1d3 Mon Sep 17 00:00:00 2001
+From: Jan Stancek <jstancek@redhat.com>
+Date: Fri, 12 Jul 2024 09:11:14 +0200
+Subject: sign-file,extract-cert: move common SSL helper functions to a header
+
+Couple error handling helpers are repeated in both tools, so
+move them to a common header.
+
+Signed-off-by: Jan Stancek <jstancek@redhat.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+
+Upstream-Status: Inappropriate [OE specific]
+---
+ MAINTAINERS | 1 +
+ certs/Makefile | 2 +-
+ certs/extract-cert.c | 37 ++-----------------------------------
+ scripts/sign-file.c | 37 ++-----------------------------------
+ scripts/ssl-common.h | 39 +++++++++++++++++++++++++++++++++++++++
+ 5 files changed, 45 insertions(+), 71 deletions(-)
+ create mode 100644 scripts/ssl-common.h
+
+diff --git a/MAINTAINERS b/MAINTAINERS
+index 9278c30ef1d5a..23f9028848552 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -5204,6 +5204,7 @@ S: Maintained
+ F: Documentation/admin-guide/module-signing.rst
+ F: certs/
+ F: scripts/sign-file.c
++F: scripts/ssl-common.h
+ F: tools/certs/
+
+ CFAG12864B LCD DRIVER
+diff --git a/certs/Makefile b/certs/Makefile
+index 1094e3860c2a7..f6fa4d8d75e05 100644
+--- a/certs/Makefile
++++ b/certs/Makefile
+@@ -84,5 +84,5 @@ targets += x509_revocation_list
+
+ hostprogs := extract-cert
+
+-HOSTCFLAGS_extract-cert.o = $(shell $(HOSTPKG_CONFIG) --cflags libcrypto 2> /dev/null)
++HOSTCFLAGS_extract-cert.o = $(shell $(HOSTPKG_CONFIG) --cflags libcrypto 2> /dev/null) -I$(srctree)/scripts
+ HOSTLDLIBS_extract-cert = $(shell $(HOSTPKG_CONFIG) --libs libcrypto 2> /dev/null || echo -lcrypto)
+diff --git a/certs/extract-cert.c b/certs/extract-cert.c
+index 70e9ec89d87d3..8e7ba9974a1fa 100644
+--- a/certs/extract-cert.c
++++ b/certs/extract-cert.c
+@@ -23,6 +23,8 @@
+ #include <openssl/err.h>
+ #include <openssl/engine.h>
+
++#include "ssl-common.h"
++
+ /*
+ * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
+ *
+@@ -40,41 +42,6 @@ void format(void)
+ exit(2);
+ }
+
+-static void display_openssl_errors(int l)
+-{
+- const char *file;
+- char buf[120];
+- int e, line;
+-
+- if (ERR_peek_error() == 0)
+- return;
+- fprintf(stderr, "At main.c:%d:\n", l);
+-
+- while ((e = ERR_get_error_line(&file, &line))) {
+- ERR_error_string(e, buf);
+- fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
+- }
+-}
+-
+-static void drain_openssl_errors(void)
+-{
+- const char *file;
+- int line;
+-
+- if (ERR_peek_error() == 0)
+- return;
+- while (ERR_get_error_line(&file, &line)) {}
+-}
+-
+-#define ERR(cond, fmt, ...) \
+- do { \
+- bool __cond = (cond); \
+- display_openssl_errors(__LINE__); \
+- if (__cond) { \
+- err(1, fmt, ## __VA_ARGS__); \
+- } \
+- } while(0)
+-
+ static const char *key_pass;
+ static BIO *wb;
+ static char *cert_dst;
+diff --git a/scripts/sign-file.c b/scripts/sign-file.c
+index 3edb156ae52c3..39ba58db5d4ea 100644
+--- a/scripts/sign-file.c
++++ b/scripts/sign-file.c
+@@ -29,6 +29,8 @@
+ #include <openssl/err.h>
+ #include <openssl/engine.h>
+
++#include "ssl-common.h"
++
+ /*
+ * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
+ *
+@@ -83,41 +85,6 @@ void format(void)
+ exit(2);
+ }
+
+-static void display_openssl_errors(int l)
+-{
+- const char *file;
+- char buf[120];
+- int e, line;
+-
+- if (ERR_peek_error() == 0)
+- return;
+- fprintf(stderr, "At main.c:%d:\n", l);
+-
+- while ((e = ERR_get_error_line(&file, &line))) {
+- ERR_error_string(e, buf);
+- fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
+- }
+-}
+-
+-static void drain_openssl_errors(void)
+-{
+- const char *file;
+- int line;
+-
+- if (ERR_peek_error() == 0)
+- return;
+- while (ERR_get_error_line(&file, &line)) {}
+-}
+-
+-#define ERR(cond, fmt, ...) \
+- do { \
+- bool __cond = (cond); \
+- display_openssl_errors(__LINE__); \
+- if (__cond) { \
+- errx(1, fmt, ## __VA_ARGS__); \
+- } \
+- } while(0)
+-
+ static const char *key_pass;
+
+ static int pem_pw_cb(char *buf, int len, int w, void *v)
+diff --git a/scripts/ssl-common.h b/scripts/ssl-common.h
+new file mode 100644
+index 0000000000000..e6711c75ed913
+--- /dev/null
++++ b/scripts/ssl-common.h
+@@ -0,0 +1,39 @@
++/* SPDX-License-Identifier: LGPL-2.1+ */
++/*
++ * SSL helper functions shared by sign-file and extract-cert.
++ */
++
++static void display_openssl_errors(int l)
++{
++ const char *file;
++ char buf[120];
++ int e, line;
++
++ if (ERR_peek_error() == 0)
++ return;
++ fprintf(stderr, "At main.c:%d:\n", l);
++
++ while ((e = ERR_get_error_line(&file, &line))) {
++ ERR_error_string(e, buf);
++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
++ }
++}
++
++static void drain_openssl_errors(void)
++{
++ const char *file;
++ int line;
++
++ if (ERR_peek_error() == 0)
++ return;
++ while (ERR_get_error_line(&file, &line)) {}
++}
++
++#define ERR(cond, fmt, ...) \
++ do { \
++ bool __cond = (cond); \
++ display_openssl_errors(__LINE__); \
++ if (__cond) { \
++ errx(1, fmt, ## __VA_ARGS__); \
++ } \
++ } while (0)
+--
+cgit 1.3.1-korg
+
diff --git a/meta-ti-bsp/recipes-kernel/linux/files/0002-avoid-using-deprecated-ERR_get_error_line.patch b/meta-ti-bsp/recipes-kernel/linux/files/0002-avoid-using-deprecated-ERR_get_error_line.patch
new file mode 100644
index 00000000..993f6739
--- /dev/null
+++ b/meta-ti-bsp/recipes-kernel/linux/files/0002-avoid-using-deprecated-ERR_get_error_line.patch
@@ -0,0 +1,121 @@
+From 467d60eddf55588add232feda325da7215ddaf30 Mon Sep 17 00:00:00 2001
+From: Jan Stancek <jstancek@redhat.com>
+Date: Fri, 12 Jul 2024 09:11:15 +0200
+Subject: sign-file,extract-cert: avoid using deprecated ERR_get_error_line()
+
+ERR_get_error_line() is deprecated since OpenSSL 3.0.
+
+Use ERR_peek_error_line() instead, and combine display_openssl_errors()
+and drain_openssl_errors() to a single function where parameter decides
+if it should consume errors silently.
+
+Signed-off-by: Jan Stancek <jstancek@redhat.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+
+Upstream-Status: Inappropriate [OE-specifc]
+---
+ certs/extract-cert.c | 4 ++--
+ scripts/sign-file.c | 6 +++---
+ scripts/ssl-common.h | 23 ++++++++---------------
+ 3 files changed, 13 insertions(+), 20 deletions(-)
+
+diff --git a/certs/extract-cert.c b/certs/extract-cert.c
+index 8e7ba9974a1fa..61bbe00856717 100644
+--- a/certs/extract-cert.c
++++ b/certs/extract-cert.c
+@@ -99,11 +99,11 @@ int main(int argc, char **argv)
+ parms.cert = NULL;
+
+ ENGINE_load_builtin_engines();
+- drain_openssl_errors();
++ drain_openssl_errors(__LINE__, 1);
+ e = ENGINE_by_id("pkcs11");
+ ERR(!e, "Load PKCS#11 ENGINE");
+ if (ENGINE_init(e))
+- drain_openssl_errors();
++ drain_openssl_errors(__LINE__, 1);
+ else
+ ERR(1, "ENGINE_init");
+ if (key_pass)
+diff --git a/scripts/sign-file.c b/scripts/sign-file.c
+index 39ba58db5d4ea..bb3fdf1a617c2 100644
+--- a/scripts/sign-file.c
++++ b/scripts/sign-file.c
+@@ -114,11 +114,11 @@ static EVP_PKEY *read_private_key(const char *private_key_name)
+ ENGINE *e;
+
+ ENGINE_load_builtin_engines();
+- drain_openssl_errors();
++ drain_openssl_errors(__LINE__, 1);
+ e = ENGINE_by_id("pkcs11");
+ ERR(!e, "Load PKCS#11 ENGINE");
+ if (ENGINE_init(e))
+- drain_openssl_errors();
++ drain_openssl_errors(__LINE__, 1);
+ else
+ ERR(1, "ENGINE_init");
+ if (key_pass)
+@@ -273,7 +273,7 @@ int main(int argc, char **argv)
+
+ /* Digest the module data. */
+ OpenSSL_add_all_digests();
+- display_openssl_errors(__LINE__);
++ drain_openssl_errors(__LINE__, 0);
+ digest_algo = EVP_get_digestbyname(hash_algo);
+ ERR(!digest_algo, "EVP_get_digestbyname");
+
+diff --git a/scripts/ssl-common.h b/scripts/ssl-common.h
+index e6711c75ed913..2db0e181143cf 100644
+--- a/scripts/ssl-common.h
++++ b/scripts/ssl-common.h
+@@ -3,7 +3,7 @@
+ * SSL helper functions shared by sign-file and extract-cert.
+ */
+
+-static void display_openssl_errors(int l)
++static void drain_openssl_errors(int l, int silent)
+ {
+ const char *file;
+ char buf[120];
+@@ -11,28 +11,21 @@ static void display_openssl_errors(int l)
+
+ if (ERR_peek_error() == 0)
+ return;
+- fprintf(stderr, "At main.c:%d:\n", l);
++ if (!silent)
++ fprintf(stderr, "At main.c:%d:\n", l);
+
+- while ((e = ERR_get_error_line(&file, &line))) {
++ while ((e = ERR_peek_error_line(&file, &line))) {
+ ERR_error_string(e, buf);
+- fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
++ if (!silent)
++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
++ ERR_get_error();
+ }
+ }
+
+-static void drain_openssl_errors(void)
+-{
+- const char *file;
+- int line;
+-
+- if (ERR_peek_error() == 0)
+- return;
+- while (ERR_get_error_line(&file, &line)) {}
+-}
+-
+ #define ERR(cond, fmt, ...) \
+ do { \
+ bool __cond = (cond); \
+- display_openssl_errors(__LINE__); \
++ drain_openssl_errors(__LINE__, 0); \
+ if (__cond) { \
+ errx(1, fmt, ## __VA_ARGS__); \
+ } \
+--
+cgit 1.3.1-korg
+
diff --git a/meta-ti-bsp/recipes-kernel/linux/files/0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch b/meta-ti-bsp/recipes-kernel/linux/files/0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch
new file mode 100644
index 00000000..8f509895
--- /dev/null
+++ b/meta-ti-bsp/recipes-kernel/linux/files/0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch
@@ -0,0 +1,163 @@
+From 558bdc45dfb2669e1741384a0c80be9c82fa052c Mon Sep 17 00:00:00 2001
+From: Jan Stancek <jstancek@redhat.com>
+Date: Fri, 20 Sep 2024 19:52:48 +0300
+Subject: sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
+
+ENGINE API has been deprecated since OpenSSL version 3.0 [1].
+Distros have started dropping support from headers and in future
+it will likely disappear also from library.
+
+It has been superseded by the PROVIDER API, so use it instead
+for OPENSSL MAJOR >= 3.
+
+[1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md
+
+[jarkko: fixed up alignment issues reported by checkpatch.pl --strict]
+
+Signed-off-by: Jan Stancek <jstancek@redhat.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+
+Upstream-Status: Inappropriate [OE-specifc]
+---
+ certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++++++++---------------
+ 1 file changed, 73 insertions(+), 30 deletions(-)
+
+(limited to 'certs/extract-cert.c')
+
+diff --git a/certs/extract-cert.c b/certs/extract-cert.c
+index 61bbe00856717..7d6d468ed6129 100644
+--- a/certs/extract-cert.c
++++ b/certs/extract-cert.c
+@@ -21,17 +21,18 @@
+ #include <openssl/bio.h>
+ #include <openssl/pem.h>
+ #include <openssl/err.h>
+-#include <openssl/engine.h>
+-
++#if OPENSSL_VERSION_MAJOR >= 3
++# define USE_PKCS11_PROVIDER
++# include <openssl/provider.h>
++# include <openssl/store.h>
++#else
++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
++# define USE_PKCS11_ENGINE
++# include <openssl/engine.h>
++# endif
++#endif
+ #include "ssl-common.h"
+
+-/*
+- * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
+- *
+- * Remove this if/when that API is no longer used
+- */
+-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+-
+ #define PKEY_ID_PKCS7 2
+
+ static __attribute__((noreturn))
+@@ -61,6 +62,66 @@ static void write_cert(X509 *x509)
+ fprintf(stderr, "Extracted cert: %s\n", buf);
+ }
+
++static X509 *load_cert_pkcs11(const char *cert_src)
++{
++ X509 *cert = NULL;
++#ifdef USE_PKCS11_PROVIDER
++ OSSL_STORE_CTX *store;
++
++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
++ ERR(1, "OSSL_PROVIDER_try_load(pkcs11)");
++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
++ ERR(1, "OSSL_PROVIDER_try_load(default)");
++
++ store = OSSL_STORE_open(cert_src, NULL, NULL, NULL, NULL);
++ ERR(!store, "OSSL_STORE_open");
++
++ while (!OSSL_STORE_eof(store)) {
++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
++
++ if (!info) {
++ drain_openssl_errors(__LINE__, 0);
++ continue;
++ }
++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_CERT) {
++ cert = OSSL_STORE_INFO_get1_CERT(info);
++ ERR(!cert, "OSSL_STORE_INFO_get1_CERT");
++ }
++ OSSL_STORE_INFO_free(info);
++ if (cert)
++ break;
++ }
++ OSSL_STORE_close(store);
++#elif defined(USE_PKCS11_ENGINE)
++ ENGINE *e;
++ struct {
++ const char *cert_id;
++ X509 *cert;
++ } parms;
++
++ parms.cert_id = cert_src;
++ parms.cert = NULL;
++
++ ENGINE_load_builtin_engines();
++ drain_openssl_errors(__LINE__, 1);
++ e = ENGINE_by_id("pkcs11");
++ ERR(!e, "Load PKCS#11 ENGINE");
++ if (ENGINE_init(e))
++ drain_openssl_errors(__LINE__, 1);
++ else
++ ERR(1, "ENGINE_init");
++ if (key_pass)
++ ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
++ ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
++ ERR(!parms.cert, "Get X.509 from PKCS#11");
++ cert = parms.cert;
++#else
++ fprintf(stderr, "no pkcs11 engine/provider available\n");
++ exit(1);
++#endif
++ return cert;
++}
++
+ int main(int argc, char **argv)
+ {
+ char *cert_src;
+@@ -89,28 +150,10 @@ int main(int argc, char **argv)
+ fclose(f);
+ exit(0);
+ } else if (!strncmp(cert_src, "pkcs11:", 7)) {
+- ENGINE *e;
+- struct {
+- const char *cert_id;
+- X509 *cert;
+- } parms;
++ X509 *cert = load_cert_pkcs11(cert_src);
+
+- parms.cert_id = cert_src;
+- parms.cert = NULL;
+-
+- ENGINE_load_builtin_engines();
+- drain_openssl_errors(__LINE__, 1);
+- e = ENGINE_by_id("pkcs11");
+- ERR(!e, "Load PKCS#11 ENGINE");
+- if (ENGINE_init(e))
+- drain_openssl_errors(__LINE__, 1);
+- else
+- ERR(1, "ENGINE_init");
+- if (key_pass)
+- ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
+- ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
+- ERR(!parms.cert, "Get X.509 from PKCS#11");
+- write_cert(parms.cert);
++ ERR(!cert, "load_cert_pkcs11 failed");
++ write_cert(cert);
+ } else {
+ BIO *b;
+ X509 *x509;
+--
+cgit 1.3.1-korg
+
diff --git a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.6.bb b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.6.bb
index 9acc95c8..3d6b7007 100644
--- a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.6.bb
+++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.6.bb
@@ -28,6 +28,12 @@ KERNEL_REPRODUCIBILITY_PATCHES = " \
file://0001-vt-conmakehash-improve-reproducibility.patch \
"
+SRC_URI += "\
+ file://0001-move-common-SSL-helper-functions-to-a-header.patch \
+ file://0002-avoid-using-deprecated-ERR_get_error_line.patch \
+ file://0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch \
+"
+
# Special configuration for remoteproc/rpmsg IPC modules
module_conf_rpmsg_client_sample = "blacklist rpmsg_client_sample"
module_conf_ti_k3_r5_remoteproc = "softdep ti_k3_r5_remoteproc pre: virtio_rpmsg_bus"
--
2.43.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [meta-ti][master][PATCH v2 3/5] mesa-pvr: Remove makedepend dependency
2026-09-10 1:54 [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0 Ryan Eatmon
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 2/5] linux-ti-staging_6.6: Backport OpenSSL 4.0 patches Ryan Eatmon
@ 2026-09-10 1:54 ` Ryan Eatmon
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 4/5] libclc: Rollback to 22.1.8 Ryan Eatmon
` (4 subsequent siblings)
6 siblings, 0 replies; 11+ messages in thread
From: Ryan Eatmon @ 2026-09-10 1:54 UTC (permalink / raw)
To: Praneeth Bajjuri, Denys Dmytriyenko, meta-ti
Commit 7e696b1fa0 ("makedepend: remove recipe") removed the recipe from
oe-core. Makedepend was removed from mesa already in version 9.1.
Follow oe-core and remove the makedepend dependency from mesa-pvr.
Signed-off-by: Franz Schnyder <franz.schnyder@toradex.com>
Signed-off-by: Ryan Eatmon <reatmon@ti.com>
---
v2; No change.
meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-24.inc | 2 +-
meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.inc | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-24.inc b/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-24.inc
index 2c4299c7..a9c6b8b2 100644
--- a/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-24.inc
+++ b/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-24.inc
@@ -40,7 +40,7 @@ do_install:append() {
fi
}
-DEPENDS = "expat makedepend-native flex-native bison-native libxml2-native zlib chrpath-replacement-native python3-mako-native gettext-native"
+DEPENDS = "expat flex-native bison-native libxml2-native zlib chrpath-replacement-native python3-mako-native gettext-native"
DEPENDS:append:class-target = " ${@bb.utils.contains('PACKAGECONFIG', 'opencl', 'mesa-native', '', d)}"
EXTRANATIVEPATH += "chrpath-native"
PROVIDES = " \
diff --git a/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.inc b/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.inc
index fbb865ad..3be87b38 100644
--- a/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.inc
+++ b/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.inc
@@ -32,7 +32,7 @@ do_install:append() {
fi
}
-DEPENDS = "expat makedepend-native flex-native bison-native libxml2-native zlib chrpath-replacement-native python3-mako-native gettext-native python3-pyyaml-native"
+DEPENDS = "expat flex-native bison-native libxml2-native zlib chrpath-replacement-native python3-mako-native gettext-native python3-pyyaml-native"
EXTRANATIVEPATH += "chrpath-native"
inherit meson pkgconfig python3native gettext features_check rust
--
2.43.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [meta-ti][master][PATCH v2 4/5] libclc: Rollback to 22.1.8
2026-09-10 1:54 [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0 Ryan Eatmon
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 2/5] linux-ti-staging_6.6: Backport OpenSSL 4.0 patches Ryan Eatmon
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 3/5] mesa-pvr: Remove makedepend dependency Ryan Eatmon
@ 2026-09-10 1:54 ` Ryan Eatmon
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 5/5] mesa-pvr: Fix for building with new LLVM version Ryan Eatmon
` (3 subsequent siblings)
6 siblings, 0 replies; 11+ messages in thread
From: Ryan Eatmon @ 2026-09-10 1:54 UTC (permalink / raw)
To: Praneeth Bajjuri, Denys Dmytriyenko, meta-ti
Given that we are only including libclc for our mesa-pvr recipes, we
need to lock down the version to a known working version to avoid the
llvm version changes from causing build failures.
Signed-off-by: Ryan Eatmon <reatmon@ti.com>
---
v2; No change.
| 60 ++++
...-support-a-new-embedded-linux-target.patch | 309 ++++++++++++++++++
...lify-cross-compilation.-Don-t-use-na.patch | 44 +++
...-env-override-of-exe-and-libdir-path.patch | 71 ++++
...g-driver-Check-sysroot-for-ldso-path.patch | 78 +++++
...tools.cpp-Add-lssp_nonshared-on-musl.patch | 32 ++
...07-clang-Prepend-trailing-to-sysroot.patch | 39 +++
...efine-releative-gcc-installation-dir.patch | 123 +++++++
...ad-and-ldl-along-with-lunwind-for-st.patch | 35 ++
...1-Check-for-atomic-double-intrinsics.patch | 34 ++
...gure-for-packages-using-find_package.patch | 118 +++++++
...ce-dir-location-for-cross-toolchains.patch | 51 +++
...-dyld-prefix-when-checking-sysroot-f.patch | 79 +++++
...-clang-Use-python3-in-python-scripts.patch | 35 ++
...t-anchor-for-adding-OE-distro-vendor.patch | 184 +++++++++++
...ot-use-backtrace-APIs-on-non-glibc-l.patch | 68 ++++
...iple-for-non-debian-multiarch-linux-.patch | 29 ++
...libunwind-Added-unw_backtrace-method.patch | 56 ++++
...0020-lldb-Link-with-libatomic-on-x86.patch | 33 ++
...ompiler-rt-Enable-__int128-for-ppc32.patch | 70 ++++
...ot-use-cmake-infra-to-detect-libzstd.patch | 62 ++++
...t-Fix-stat-struct-s-size-for-O32-ABI.patch | 46 +++
....cpp-ARMLibDirs-search-also-in-lib32.patch | 81 +++++
...d-OE-specific-ABI-triple-for-N32-ABI.patch | 78 +++++
...unwind.pc.in-and-llvm-config-scripts.patch | 54 +++
...spect-LLVM_LIBDIR_SUFFIX-like-other-.patch | 89 +++++
...Do-not-pass-target-to-clang-compiler.patch | 29 ++
...r-sort-ClassInfo-lists-by-name-as-we.patch | 31 ++
...ove-LLVM_LDFLAGS-from-ldflags-output.patch | 32 ++
...ude-sync_fetch_and_-for-any-pre-ARMv.patch | 64 ++++
...code-uptr-sptr-typedefs-on-Mips-Linu.patch | 35 ++
| 36 ++
...ng-block-when-searching-for-noreturn.patch | 41 +++
...M_HAVE_OPT_VIEWER_MODULES-externally.patch | 27 ++
...-clang-tblgen-if-it-is-actually-need.patch | 32 ++
...symlink-path-for-libcc-when-LLVM_ENA.patch | 71 ++++
...UNKNOWN-elements-of-OffloadArch-enum.patch | 274 ++++++++++++++++
...e-__gnu_unwind_frame-in-cxa_personal.patch | 33 ++
...fix-sysroot-based-compiler-rt-search.patch | 105 ++++++
| 74 +++++
...te-exit-fold-candidates-in-determini.patch | 71 ++++
.../recipes-graphics/mesa/libclc_22.1.8.bb | 149 +++++++++
.../recipes-graphics/mesa/libclc_git.bb | 27 --
43 files changed, 3062 insertions(+), 27 deletions(-)
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0001-libcxxabi-Find-libunwind-headers-when-LIBCXXABI_LIBU.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0002-compiler-rt-support-a-new-embedded-linux-target.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0003-compiler-rt-Simplify-cross-compilation.-Don-t-use-na.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0004-llvm-allow-env-override-of-exe-and-libdir-path.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0005-clang-driver-Check-sysroot-for-ldso-path.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0006-clang-Driver-tools.cpp-Add-lssp_nonshared-on-musl.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0007-clang-Prepend-trailing-to-sysroot.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0009-clang-Define-releative-gcc-installation-dir.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0010-clang-Add-lpthread-and-ldl-along-with-lunwind-for-st.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0011-Check-for-atomic-double-intrinsics.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0012-cmake-Fix-configure-for-packages-using-find_package.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0013-clang-Fix-resource-dir-location-for-cross-toolchains.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0014-clang-driver-Add-dyld-prefix-when-checking-sysroot-f.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0015-clang-Use-python3-in-python-scripts.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0016-llvm-clang-Insert-anchor-for-adding-OE-distro-vendor.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0017-compiler-rt-Do-not-use-backtrace-APIs-on-non-glibc-l.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0018-clang-Fix-x86-triple-for-non-debian-multiarch-linux-.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0019-libunwind-Added-unw_backtrace-method.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0020-lldb-Link-with-libatomic-on-x86.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0021-compiler-rt-Enable-__int128-for-ppc32.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0022-llvm-Do-not-use-cmake-infra-to-detect-libzstd.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0023-compiler-rt-Fix-stat-struct-s-size-for-O32-ABI.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0024-ToolChains-Gnu.cpp-ARMLibDirs-search-also-in-lib32.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0025-clang-llvm-Add-OE-specific-ABI-triple-for-N32-ABI.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0026-llvm-Add-libunwind.pc.in-and-llvm-config-scripts.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0027-scan-build-py-respect-LLVM_LIBDIR_SUFFIX-like-other-.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0028-compiler-rt-Do-not-pass-target-to-clang-compiler.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0029-AsmMatcherEmitter-sort-ClassInfo-lists-by-name-as-we.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0030-llvm-config-remove-LLVM_LDFLAGS-from-ldflags-output.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0031-compiler-rt-Exclude-sync_fetch_and_-for-any-pre-ARMv.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0032-compiler-rt-Hardcode-uptr-sptr-typedefs-on-Mips-Linu.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0034-Revert-libc-Remap-headers-in-the-debug-info-when-bui.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0035-Prevent-revisiting-block-when-searching-for-noreturn.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0036-Don-t-expose-LLVM_HAVE_OPT_VIEWER_MODULES-externally.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0037-clang-Only-build-clang-tblgen-if-it-is-actually-need.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0038-llvm-libgcc-Fix-symlink-path-for-libcc-when-LLVM_ENA.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0039-Rename-UNUSED-and-UNKNOWN-elements-of-OffloadArch-enum.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0040-libcxxabi-declare-__gnu_unwind_frame-in-cxa_personal.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0041-Consolidate-and-fix-sysroot-based-compiler-rt-search.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0042-guard-clang-tools-extra-test.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0043-LoopUnroll-Iterate-exit-fold-candidates-in-determini.patch
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc_22.1.8.bb
delete mode 100644 meta-ti-bsp/recipes-graphics/mesa/libclc_git.bb
--git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0001-libcxxabi-Find-libunwind-headers-when-LIBCXXABI_LIBU.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0001-libcxxabi-Find-libunwind-headers-when-LIBCXXABI_LIBU.patch
new file mode 100644
index 00000000..43221274
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0001-libcxxabi-Find-libunwind-headers-when-LIBCXXABI_LIBU.patch
@@ -0,0 +1,60 @@
+From 97247b6a1df63a5f930d090a3952876eb67cf6fb Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sun, 27 Aug 2017 10:37:49 -0700
+Subject: [PATCH] libcxxabi: Find libunwind headers when
+ LIBCXXABI_LIBUNWIND_INCLUDES is set
+
+Currently, when LIBCXXABI_LIBUNWIND_INCLUDES is set via CMake arguments
+then it ends up not searching the specified dir and unwind.h is not found
+especially for ARM targets
+
+This patch makes the searching synthesized directories and then set
+LIBCXXABI_LIBUNWIND_INCLUDES if its there in environment
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ libcxxabi/CMakeLists.txt | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/libcxxabi/CMakeLists.txt b/libcxxabi/CMakeLists.txt
+index 2b67c5972339..45d84b404b30 100644
+--- a/libcxxabi/CMakeLists.txt
++++ b/libcxxabi/CMakeLists.txt
+@@ -476,7 +476,7 @@ set(LIBCXXABI_LIBUNWIND_PATH "${LIBCXXABI_LIBUNWIND_PATH}" CACHE PATH
+ "Specify path to libunwind source." FORCE)
+
+ if (LIBCXXABI_USE_LLVM_UNWINDER OR LLVM_NATIVE_ARCH MATCHES ARM)
+- find_path(LIBCXXABI_LIBUNWIND_INCLUDES_INTERNAL libunwind.h
++ find_path(LIBCXXABI_LIBUNWIND_INCLUDES libunwind.h
+ PATHS ${LIBCXXABI_LIBUNWIND_INCLUDES}
+ ${LIBCXXABI_LIBUNWIND_PATH}/include
+ ${CMAKE_BINARY_DIR}/${LIBCXXABI_LIBUNWIND_INCLUDES}
+@@ -487,18 +487,23 @@ if (LIBCXXABI_USE_LLVM_UNWINDER OR LLVM_NATIVE_ARCH MATCHES ARM)
+ NO_CMAKE_FIND_ROOT_PATH
+ )
+
+- if (LIBCXXABI_LIBUNWIND_INCLUDES_INTERNAL STREQUAL "LIBCXXABI_LIBUNWIND_INCLUDES_INTERNAL-NOTFOUND")
+- set(LIBCXXABI_LIBUNWIND_INCLUDES_INTERNAL "")
++ if (LIBCXXABI_LIBUNWIND_INCLUDES STREQUAL "LIBCXXABI_LIBUNWIND_INCLUDES-NOTFOUND")
++ set(LIBCXXABI_LIBUNWIND_INCLUDES "")
+ endif()
+ endif()
+
+-if (NOT "${LIBCXXABI_LIBUNWIND_INCLUDES_INTERNAL}" STREQUAL "")
+- include_directories("${LIBCXXABI_LIBUNWIND_INCLUDES_INTERNAL}")
++if (NOT "${LIBCXXABI_LIBUNWIND_INCLUDES}" STREQUAL "")
++ include_directories("${LIBCXXABI_LIBUNWIND_INCLUDES}")
+ endif()
+
+ add_custom_target(cxxabi-test-depends
+ COMMENT "Build dependencies required to run the libc++abi test suite.")
+
++set(LIBCXXABI_LIBUNWIND_INCLUDES "${LIBCXXABI_LIBUNWIND_INCLUDES}" CACHE PATH
++ "Specify path to libunwind includes." FORCE)
++set(LIBCXXABI_LIBUNWIND_PATH "${LIBCXXABI_LIBUNWIND_PATH}" CACHE PATH
++ "Specify path to libunwind source." FORCE)
++
+ # Add source code. This also contains all of the logic for deciding linker flags
+ # soname, etc...
+ add_subdirectory(include)
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0002-compiler-rt-support-a-new-embedded-linux-target.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0002-compiler-rt-support-a-new-embedded-linux-target.patch
new file mode 100644
index 00000000..5dcad6b0
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0002-compiler-rt-support-a-new-embedded-linux-target.patch
@@ -0,0 +1,309 @@
+From eae63772aacba29de729d9af5c52542cd8a043ee Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sun, 19 Apr 2015 15:16:23 -0700
+Subject: [PATCH] compiler-rt: support a new embedded linux target
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ .../make/platform/clang_linux_embedded.mk | 286 ++++++++++++++++++
+ .../clang_linux_embedded_test_input.c | 0
+ 2 files changed, 286 insertions(+)
+ create mode 100644 compiler-rt/make/platform/clang_linux_embedded.mk
+ create mode 100644 compiler-rt/make/platform/clang_linux_embedded_test_input.c
+
+diff --git a/compiler-rt/make/platform/clang_linux_embedded.mk b/compiler-rt/make/platform/clang_linux_embedded.mk
+new file mode 100644
+index 000000000000..d0a890075a1c
+--- /dev/null
++++ b/compiler-rt/make/platform/clang_linux_embedded.mk
+@@ -0,0 +1,286 @@
++# These are the functions which clang needs when it is targeting a previous
++# version of the OS. The issue is that the backend may use functions which were
++# not present in the libgcc that shipped on the platform. In such cases, we link
++# with a version of the library which contains private_extern definitions of all
++# the extra functions which might be referenced.
++
++Description := Static runtime libraries for embedded clang/Linux
++
++# A function that ensures we don't try to build for architectures that we
++# don't have working toolchains for.
++CheckArches = \
++ $(shell \
++ result=""; \
++ for arch in $(1); do \
++ if $(CC) -arch $$arch -c \
++ -integrated-as \
++ $(ProjSrcRoot)/make/platform/clang_linux_embedded_test_input.c \
++ -o /dev/null > /dev/null 2> /dev/null; then \
++ result="$$result$$arch "; \
++ else \
++ printf 1>&2 \
++ "warning: clang_linux_embedded.mk: dropping arch '$$arch' from lib '$(2)'\n"; \
++ fi; \
++ done; \
++ echo $$result)
++
++XCRun = \
++ $(shell \
++ result=`xcrun -find $(1) 2> /dev/null`; \
++ if [ "$$?" != "0" ]; then result=$(1); fi; \
++ echo $$result)
++
++###
++
++CC := $(call XCRun,clang)
++AR := $(call XCRun,ar)
++RANLIB := $(call XCRun,ranlib)
++STRIP := $(call XCRun,strip)
++LIPO := $(call XCRun,lipo)
++DSYMUTIL := $(call XCRun,dsymutil)
++Configs :=
++UniversalArchs :=
++
++# Soft-float version of the runtime. No floating-point instructions will be used
++# and the ABI (out of necessity) passes floating values in normal registers:
++# non-VFP variant of the AAPCS.
++UniversalArchs.soft_static := $(call CheckArches,arm armv7m armv7em armv7,soft_static)
++Configs += $(if $(UniversalArchs.soft_static),soft_static)
++
++# Hard-float version of the runtime. On ARM VFP instructions and registers are
++# allowed, and floating point values get passed in them. VFP variant of the
++# AAPCS.
++UniversalArchs.hard_static := $(call CheckArches,armv7em armv7 i386 x86_64,hard_static)
++Configs += $(if $(UniversalArchs.hard_static),hard_static)
++
++UniversalArchs.soft_pic := $(call CheckArches,armv6m armv7m armv7em armv7,soft_pic)
++Configs += $(if $(UniversalArchs.soft_pic),soft_pic)
++
++UniversalArchs.hard_pic := $(call CheckArches,armv7em armv7 i386 x86_64,hard_pic)
++Configs += $(if $(UniversalArchs.hard_pic),hard_pic)
++
++CFLAGS := -Wall -Werror -Oz -fomit-frame-pointer -ffreestanding
++
++PIC_CFLAGS := -fPIC
++STATIC_CFLAGS := -static
++
++CFLAGS_SOFT := -mfloat-abi=soft
++CFLAGS_HARD := -mfloat-abi=hard
++
++CFLAGS_I386 := -march=pentium
++
++CFLAGS.soft_static := $(CFLAGS) $(STATIC_CFLAGS) $(CFLAGS_SOFT)
++CFLAGS.hard_static := $(CFLAGS) $(STATIC_CFLAGS) $(CFLAGS_HARD)
++CFLAGS.soft_pic := $(CFLAGS) $(PIC_CFLAGS) $(CFLAGS_SOFT)
++CFLAGS.hard_pic := $(CFLAGS) $(PIC_CFLAGS) $(CFLAGS_HARD)
++
++CFLAGS.soft_static.armv7 := $(CFLAGS.soft_static) $(CFLAGS_ARMV7)
++CFLAGS.hard_static.armv7 := $(CFLAGS.hard_static) $(CFLAGS_ARMV7)
++CFLAGS.soft_pic.armv7 := $(CFLAGS.soft_pic) $(CFLAGS_ARMV7)
++CFLAGS.hard_pic.armv7 := $(CFLAGS.hard_pic) $(CFLAGS_ARMV7)
++
++# x86 platforms ignore -mfloat-abi options and complain about doing so. Despite
++# this they're hard-float.
++CFLAGS.hard_static.i386 := $(CFLAGS) $(STATIC_CFLAGS) $(CFLAGS_I386)
++CFLAGS.hard_pic.i386 := $(CFLAGS) $(PIC_CFLAGS) $(CFLAGS_I386)
++CFLAGS.hard_static.x86_64 := $(CFLAGS) $(STATIC_CFLAGS)
++CFLAGS.hard_pic.x86_64 := $(CFLAGS) $(PIC_CFLAGS)
++
++# Functions not wanted:
++# + eprintf is obsolete anyway
++# + *vfp: designed for Thumb1 CPUs with VFPv2
++
++COMMON_FUNCTIONS := \
++ absvdi2 \
++ absvsi2 \
++ addvdi3 \
++ addvsi3 \
++ ashldi3 \
++ ashrdi3 \
++ bswapdi2 \
++ bswapsi2 \
++ clzdi2 \
++ clzsi2 \
++ cmpdi2 \
++ ctzdi2 \
++ ctzsi2 \
++ divdc3 \
++ divdi3 \
++ divsc3 \
++ divmodsi4 \
++ udivmodsi4 \
++ do_global_dtors \
++ ffsdi2 \
++ fixdfdi \
++ fixsfdi \
++ fixunsdfdi \
++ fixunsdfsi \
++ fixunssfdi \
++ fixunssfsi \
++ floatdidf \
++ floatdisf \
++ floatundidf \
++ floatundisf \
++ gcc_bcmp \
++ lshrdi3 \
++ moddi3 \
++ muldc3 \
++ muldi3 \
++ mulsc3 \
++ mulvdi3 \
++ mulvsi3 \
++ negdi2 \
++ negvdi2 \
++ negvsi2 \
++ paritydi2 \
++ paritysi2 \
++ popcountdi2 \
++ popcountsi2 \
++ powidf2 \
++ powisf2 \
++ subvdi3 \
++ subvsi3 \
++ ucmpdi2 \
++ udiv_w_sdiv \
++ udivdi3 \
++ udivmoddi4 \
++ umoddi3 \
++ adddf3 \
++ addsf3 \
++ cmpdf2 \
++ cmpsf2 \
++ div0 \
++ divdf3 \
++ divsf3 \
++ divsi3 \
++ extendsfdf2 \
++ ffssi2 \
++ fixdfsi \
++ fixsfsi \
++ floatsidf \
++ floatsisf \
++ floatunsidf \
++ floatunsisf \
++ comparedf2 \
++ comparesf2 \
++ modsi3 \
++ muldf3 \
++ mulsf3 \
++ negdf2 \
++ negsf2 \
++ subdf3 \
++ subsf3 \
++ truncdfsf2 \
++ udivsi3 \
++ umodsi3 \
++ unorddf2 \
++ unordsf2
++
++ARM_FUNCTIONS := \
++ aeabi_cdcmpeq \
++ aeabi_cdrcmple \
++ aeabi_cfcmpeq \
++ aeabi_cfrcmple \
++ aeabi_dcmpeq \
++ aeabi_dcmpge \
++ aeabi_dcmpgt \
++ aeabi_dcmple \
++ aeabi_dcmplt \
++ aeabi_drsub \
++ aeabi_fcmpeq \
++ aeabi_fcmpge \
++ aeabi_fcmpgt \
++ aeabi_fcmple \
++ aeabi_fcmplt \
++ aeabi_frsub \
++ aeabi_idivmod \
++ aeabi_uidivmod \
++
++# ARM Assembly implementation which requires Thumb2 (i.e. won't work on v6M).
++THUMB2_FUNCTIONS := \
++ switch16 \
++ switch32 \
++ switch8 \
++ switchu8 \
++ sync_fetch_and_add_4 \
++ sync_fetch_and_sub_4 \
++ sync_fetch_and_and_4 \
++ sync_fetch_and_or_4 \
++ sync_fetch_and_xor_4 \
++ sync_fetch_and_nand_4 \
++ sync_fetch_and_max_4 \
++ sync_fetch_and_umax_4 \
++ sync_fetch_and_min_4 \
++ sync_fetch_and_umin_4 \
++ sync_fetch_and_add_8 \
++ sync_fetch_and_sub_8 \
++ sync_fetch_and_and_8 \
++ sync_fetch_and_or_8 \
++ sync_fetch_and_xor_8 \
++ sync_fetch_and_nand_8 \
++ sync_fetch_and_max_8 \
++ sync_fetch_and_umax_8 \
++ sync_fetch_and_min_8 \
++ sync_fetch_and_umin_8
++
++I386_FUNCTIONS := \
++ i686.get_pc_thunk.eax \
++ i686.get_pc_thunk.ebp \
++ i686.get_pc_thunk.ebx \
++ i686.get_pc_thunk.ecx \
++ i686.get_pc_thunk.edi \
++ i686.get_pc_thunk.edx \
++ i686.get_pc_thunk.esi
++
++# FIXME: Currently, compiler-rt is missing implementations for a number of the
++# functions. Filter them out for now.
++MISSING_FUNCTIONS := \
++ cmpdf2 cmpsf2 div0 \
++ ffssi2 \
++ udiv_w_sdiv unorddf2 unordsf2 bswapdi2 \
++ bswapsi2 \
++ gcc_bcmp \
++ do_global_dtors \
++ i686.get_pc_thunk.eax i686.get_pc_thunk.ebp i686.get_pc_thunk.ebx \
++ i686.get_pc_thunk.ecx i686.get_pc_thunk.edi i686.get_pc_thunk.edx \
++ i686.get_pc_thunk.esi \
++ aeabi_cdcmpeq aeabi_cdrcmple aeabi_cfcmpeq aeabi_cfrcmple aeabi_dcmpeq \
++ aeabi_dcmpge aeabi_dcmpgt aeabi_dcmple aeabi_dcmplt aeabi_drsub \
++ aeabi_fcmpeq \ aeabi_fcmpge aeabi_fcmpgt aeabi_fcmple aeabi_fcmplt \
++ aeabi_frsub aeabi_idivmod aeabi_uidivmod
++
++FUNCTIONS_ARMV6M := $(COMMON_FUNCTIONS) $(ARM_FUNCTIONS)
++FUNCTIONS_ARM_ALL := $(COMMON_FUNCTIONS) $(ARM_FUNCTIONS) $(THUMB2_FUNCTIONS)
++FUNCTIONS_I386 := $(COMMON_FUNCTIONS) $(I386_FUNCTIONS)
++FUNCTIONS_X86_64 := $(COMMON_FUNCTIONS)
++
++FUNCTIONS_ARMV6M := \
++ $(filter-out $(MISSING_FUNCTIONS),$(FUNCTIONS_ARMV6M))
++FUNCTIONS_ARM_ALL := \
++ $(filter-out $(MISSING_FUNCTIONS),$(FUNCTIONS_ARM_ALL))
++FUNCTIONS_I386 := \
++ $(filter-out $(MISSING_FUNCTIONS),$(FUNCTIONS_I386))
++FUNCTIONS_X86_64 := \
++ $(filter-out $(MISSING_FUNCTIONS),$(FUNCTIONS_X86_64))
++
++FUNCTIONS.soft_static.armv6m := $(FUNCTIONS_ARMV6M)
++FUNCTIONS.soft_pic.armv6m := $(FUNCTIONS_ARMV6M)
++
++FUNCTIONS.soft_static.armv7m := $(FUNCTIONS_ARM_ALL)
++FUNCTIONS.soft_pic.armv7m := $(FUNCTIONS_ARM_ALL)
++
++FUNCTIONS.soft_static.armv7em := $(FUNCTIONS_ARM_ALL)
++FUNCTIONS.hard_static.armv7em := $(FUNCTIONS_ARM_ALL)
++FUNCTIONS.soft_pic.armv7em := $(FUNCTIONS_ARM_ALL)
++FUNCTIONS.hard_pic.armv7em := $(FUNCTIONS_ARM_ALL)
++
++FUNCTIONS.soft_static.armv7 := $(FUNCTIONS_ARM_ALL)
++FUNCTIONS.hard_static.armv7 := $(FUNCTIONS_ARM_ALL)
++FUNCTIONS.soft_pic.armv7 := $(FUNCTIONS_ARM_ALL)
++FUNCTIONS.hard_pic.armv7 := $(FUNCTIONS_ARM_ALL)
++
++FUNCTIONS.hard_static.i386 := $(FUNCTIONS_I386)
++FUNCTIONS.hard_pic.i386 := $(FUNCTIONS_I386)
++
++FUNCTIONS.hard_static.x86_64 := $(FUNCTIONS_X86_64)
++FUNCTIONS.hard_pic.x86_64 := $(FUNCTIONS_X86_64)
+diff --git a/compiler-rt/make/platform/clang_linux_embedded_test_input.c b/compiler-rt/make/platform/clang_linux_embedded_test_input.c
+new file mode 100644
+index 000000000000..e69de29bb2d1
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0003-compiler-rt-Simplify-cross-compilation.-Don-t-use-na.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0003-compiler-rt-Simplify-cross-compilation.-Don-t-use-na.patch
new file mode 100644
index 00000000..896bbd11
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0003-compiler-rt-Simplify-cross-compilation.-Don-t-use-na.patch
@@ -0,0 +1,44 @@
+From 16b03fccab20cac13065ab99f36a7f0a77a62b92 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Thu, 19 May 2016 23:11:45 -0700
+Subject: [PATCH] compiler-rt: Simplify cross-compilation. Don't use
+ native-compiled llvm-config.
+
+ Note: AddLLVM.cmake does not expose the LLVM source directory.
+ So if you want to run the test suite, you need to either:
+
+ 1) set LLVM_MAIN_SRC_DIR explicitly (to find lit.py)
+ 2) change AddLLVM.cmake to point to an installed 'lit'.
+ 3) add_subdirectory(compiler-rt/test) from clang instead of compiler-rt.
+
+https://us.codeaurora.org/patches/quic/llvm/50683/compiler-rt-cross-compilation.patch
+
+Upstream-Status: Pending
+Signed-off-by: Greg Fitzgerald <gregf@codeaurora.org>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ compiler-rt/CMakeLists.txt | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/compiler-rt/CMakeLists.txt b/compiler-rt/CMakeLists.txt
+index a92258ae1244..98c4e9a681d5 100644
+--- a/compiler-rt/CMakeLists.txt
++++ b/compiler-rt/CMakeLists.txt
+@@ -109,7 +109,16 @@ if (COMPILER_RT_STANDALONE_BUILD)
+ set(CMAKE_CXX_EXTENSIONS NO)
+
+ if (NOT LLVM_RUNTIMES_BUILD)
+- load_llvm_config()
++ find_package(LLVM REQUIRED)
++ list(APPEND CMAKE_MODULE_PATH "${LLVM_CMAKE_DIR}")
++
++ # Variables that AddLLVM.cmake depends on (included by AddCompilerRT)
++ set(LLVM_TOOLS_BINARY_DIR "${LLVM_INSTALL_PREFIX}/bin")
++ set(LLVM_LIBRARY_DIR "${LLVM_INSTALL_PREFIX}/lib")
++
++ set(LLVM_LIBRARY_OUTPUT_INTDIR
++ ${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}/lib${LLVM_LIBDIR_SUFFIX})
++
+ endif()
+ if (TARGET intrinsics_gen)
+ # Loading the llvm config causes this target to be imported so place it
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0004-llvm-allow-env-override-of-exe-and-libdir-path.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0004-llvm-allow-env-override-of-exe-and-libdir-path.patch
new file mode 100644
index 00000000..3c7c2746
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0004-llvm-allow-env-override-of-exe-and-libdir-path.patch
@@ -0,0 +1,71 @@
+From d13464858866ff3c0026294d6842f74a11a0d625 Mon Sep 17 00:00:00 2001
+From: Martin Kelly <mkelly@xevo.com>
+Date: Fri, 19 May 2017 00:22:57 -0700
+Subject: [PATCH] llvm: allow env override of exe and libdir path
+
+When using a native llvm-config from inside a sysroot, we need llvm-config to
+return the libraries, include directories, etc. from inside the sysroot rather
+than from the native sysroot. Thus provide an env override for calling
+llvm-config from a target sysroot.
+
+Add YOCTO_ALTERNATE_LIBDIR and YOCTO_ALTERNATE_EXE_PATH env variables
+
+Upstream-Status: Inappropriate [OE-specific]
+
+Signed-off-by: Martin Kelly <mkelly@xevo.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ llvm/tools/llvm-config/llvm-config.cpp | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/llvm/tools/llvm-config/llvm-config.cpp b/llvm/tools/llvm-config/llvm-config.cpp
+index 24ea264419af..0a3f51ae2b83 100644
+--- a/llvm/tools/llvm-config/llvm-config.cpp
++++ b/llvm/tools/llvm-config/llvm-config.cpp
+@@ -248,6 +248,13 @@ Typical components:\n\
+
+ /// Compute the path to the main executable.
+ static std::string getExecutablePath(const char *Argv0) {
++ // Hack for Yocto: we need to override the root path when we are using
++ // llvm-config from within a target sysroot.
++ const char *Sysroot = std::getenv("YOCTO_ALTERNATE_EXE_PATH");
++ if (Sysroot != nullptr) {
++ return Sysroot;
++ }
++
+ // This just needs to be some symbol in the binary; C++ doesn't
+ // allow taking the address of ::main however.
+ void *P = (void *)(intptr_t)getExecutablePath;
+@@ -326,7 +333,7 @@ int main(int argc, char **argv) {
+ // Compute various directory locations based on the derived location
+ // information.
+ std::string ActivePrefix, ActiveBinDir, ActiveIncludeDir, ActiveLibDir,
+- ActiveCMakeDir;
++ ActiveCMakeDir, BaseLibDir;
+ std::vector<std::string> ActiveIncludeOptions;
+ if (IsInDevelopmentTree) {
+ ActiveIncludeDir = std::string(LLVM_SRC_ROOT) + "/include";
+@@ -367,12 +374,18 @@ int main(int argc, char **argv) {
+ sys::path::make_absolute(ActivePrefix, Path);
+ ActiveBinDir = std::string(Path);
+ }
+- ActiveLibDir = ActivePrefix + "/lib" + LLVM_LIBDIR_SUFFIX;
+- {
+- SmallString<256> Path(LLVM_INSTALL_PACKAGE_DIR);
+- sys::path::make_absolute(ActivePrefix, Path);
+- ActiveCMakeDir = std::string(Path);
++ // Hack for Yocto: we need to override the lib path when we are using
++ // llvm-config from within a target sysroot since LLVM_LIBDIR_SUFFIX
++ // maybe different for host llvm vs target e.g. ppc64 Libdir=lib64 but
++ // x86_64 Libdir = lib
++ const char *YoctoLibDir = std::getenv("YOCTO_ALTERNATE_LIBDIR");
++ if (YoctoLibDir != nullptr) {
++ BaseLibDir = std::string(YoctoLibDir);
++ } else {
++ BaseLibDir = std::string("/lib") + LLVM_LIBDIR_SUFFIX;
+ }
++ ActiveLibDir = ActivePrefix + BaseLibDir;
++ ActiveCMakeDir = ActiveLibDir + "/cmake/llvm";
+ ActiveIncludeOptions.push_back(ActiveIncludeDir);
+ }
+
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0005-clang-driver-Check-sysroot-for-ldso-path.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0005-clang-driver-Check-sysroot-for-ldso-path.patch
new file mode 100644
index 00000000..e4636d30
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0005-clang-driver-Check-sysroot-for-ldso-path.patch
@@ -0,0 +1,78 @@
+From 7a12ad3232dd6881ca40d94277ca8064a12d9df6 Mon Sep 17 00:00:00 2001
+From: Dan McGregor <dan.mcgregor@usask.ca>
+Date: Wed, 26 Apr 2017 20:29:41 -0600
+Subject: [PATCH] clang: driver: Check sysroot for ldso path
+
+when we build multilib the ldso has different paths than clangs defaults,
+every distro kind of does that so OE is not the only one,
+it happens especially on ppc64, where OE does not necessarily follow the
+default path for the dynamic linker, therefore adjust it for OE. Check
+for the default path, and if it isn't there, check /lib.
+
+Upstream-Status: Pending
+Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ clang/lib/Driver/ToolChains/Linux.cpp | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp
+index d525b417b4ea..1c31901ade74 100644
+--- a/clang/lib/Driver/ToolChains/Linux.cpp
++++ b/clang/lib/Driver/ToolChains/Linux.cpp
+@@ -630,8 +630,12 @@ std::string Linux::getDynamicLinker(const ArgList &Args) const {
+ Triple.getEnvironment() == llvm::Triple::GNUEABIHFT64 ||
+ tools::arm::getARMFloatABI(*this, Args) == tools::arm::FloatABI::Hard;
+
+- LibDir = "lib";
+ Loader = HF ? "ld-linux-armhf.so.3" : "ld-linux.so.3";
++ LibDir = "lib32";
++ if (!getVFS().exists(getDriver().SysRoot + "/" + LibDir + "/" + Loader) &&
++ getVFS().exists(getDriver().SysRoot + "/lib/" + Loader)) {
++ LibDir = "lib";
++ }
+ break;
+ }
+ case llvm::Triple::loongarch32: {
+@@ -685,11 +689,19 @@ std::string Linux::getDynamicLinker(const ArgList &Args) const {
+ LibDir = "lib64";
+ Loader =
+ (tools::ppc::hasPPCAbiArg(Args, "elfv2")) ? "ld64.so.2" : "ld64.so.1";
++ if (!getVFS().exists(getDriver().SysRoot + "/" + LibDir + "/" + Loader) &&
++ getVFS().exists(getDriver().SysRoot + "/lib/" + Loader)) {
++ LibDir = "lib";
++ }
+ break;
+ case llvm::Triple::ppc64le:
+ LibDir = "lib64";
+ Loader =
+ (tools::ppc::hasPPCAbiArg(Args, "elfv1")) ? "ld64.so.1" : "ld64.so.2";
++ if (!getVFS().exists(getDriver().SysRoot + "/" + LibDir + "/" + Loader) &&
++ getVFS().exists(getDriver().SysRoot + "/lib/" + Loader)) {
++ LibDir = "lib";
++ }
+ break;
+ case llvm::Triple::riscv32:
+ case llvm::Triple::riscv64: {
+@@ -707,6 +719,10 @@ std::string Linux::getDynamicLinker(const ArgList &Args) const {
+ case llvm::Triple::sparcv9:
+ LibDir = "lib64";
+ Loader = "ld-linux.so.2";
++ if (!getVFS().exists(getDriver().SysRoot + "/" + LibDir + "/" + Loader) &&
++ getVFS().exists(getDriver().SysRoot + "/lib/" + Loader)) {
++ LibDir = "lib";
++ }
+ break;
+ case llvm::Triple::systemz:
+ LibDir = "lib";
+@@ -721,6 +737,10 @@ std::string Linux::getDynamicLinker(const ArgList &Args) const {
+
+ LibDir = X32 ? "libx32" : "lib64";
+ Loader = X32 ? "ld-linux-x32.so.2" : "ld-linux-x86-64.so.2";
++ if (!getVFS().exists(getDriver().SysRoot + "/" + LibDir + "/" + Loader) &&
++ getVFS().exists(getDriver().SysRoot + "/lib/" + Loader)) {
++ LibDir = "lib";
++ }
+ break;
+ }
+ case llvm::Triple::ve:
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0006-clang-Driver-tools.cpp-Add-lssp_nonshared-on-musl.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0006-clang-Driver-tools.cpp-Add-lssp_nonshared-on-musl.patch
new file mode 100644
index 00000000..0269dece
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0006-clang-Driver-tools.cpp-Add-lssp_nonshared-on-musl.patch
@@ -0,0 +1,32 @@
+From 19b8ca2e1aa536e7d7f7eb379fc4e4d6f1efd07a Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Thu, 19 May 2016 21:11:06 -0700
+Subject: [PATCH] clang: Driver/tools.cpp: Add -lssp_nonshared on musl
+
+musl driver will need to add ssp_nonshared for stack_check_local
+on the linker cmdline when using stack protector commands on
+compiler cmdline
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ clang/lib/Driver/ToolChains/Gnu.cpp | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/clang/lib/Driver/ToolChains/Gnu.cpp b/clang/lib/Driver/ToolChains/Gnu.cpp
+index cb6a9b242421..8f126474b7d1 100644
+--- a/clang/lib/Driver/ToolChains/Gnu.cpp
++++ b/clang/lib/Driver/ToolChains/Gnu.cpp
+@@ -539,6 +539,12 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
+ if (IsIAMCU)
+ CmdArgs.push_back("-lgloss");
+
++ if (ToolChain.getTriple().isMusl() &&
++ (Args.hasArg(options::OPT_fstack_protector) ||
++ Args.hasArg(options::OPT_fstack_protector_strong) ||
++ Args.hasArg(options::OPT_fstack_protector_all))) {
++ CmdArgs.push_back("-lssp_nonshared");
++ }
+ if (IsStatic || IsStaticPIE)
+ CmdArgs.push_back("--end-group");
+ else
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0007-clang-Prepend-trailing-to-sysroot.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0007-clang-Prepend-trailing-to-sysroot.patch
new file mode 100644
index 00000000..321de79c
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0007-clang-Prepend-trailing-to-sysroot.patch
@@ -0,0 +1,39 @@
+From 1746960b385afbc9e8e355a3b7c66b43c946451b Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Thu, 16 Mar 2017 09:02:13 -0700
+Subject: [PATCH] clang: Prepend trailing '/' to sysroot
+
+This is needed to handle a case where clang
+isntall and target sysroot are perilously same
+
+e.g.
+
+sysroot = /mnt/clang/recipe-sysroot
+clang install = /mnt/clang/recipe-sysroot-native
+
+in this case it will mistakenly assume that
+clang is installed under the same sysroot dir
+and it will try to add relative ../lib paths
+to linker steps which would then be wrong
+since they will become relative to clang
+installation and not sysroot
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ clang/lib/Driver/ToolChains/Linux.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp
+index 1c31901ade74..f7f096c1ac0a 100644
+--- a/clang/lib/Driver/ToolChains/Linux.cpp
++++ b/clang/lib/Driver/ToolChains/Linux.cpp
+@@ -235,7 +235,7 @@ Linux::Linux(const Driver &D, const llvm::Triple &Triple, const ArgList &Args)
+ Multilibs = GCCInstallation.getMultilibs();
+ SelectedMultilibs.assign({GCCInstallation.getMultilib()});
+ llvm::Triple::ArchType Arch = Triple.getArch();
+- std::string SysRoot = computeSysRoot();
++ std::string SysRoot = computeSysRoot() + "/";
+ ToolChain::path_list &PPaths = getProgramPaths();
+
+ Generic_GCC::PushPPaths(PPaths);
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0009-clang-Define-releative-gcc-installation-dir.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0009-clang-Define-releative-gcc-installation-dir.patch
new file mode 100644
index 00000000..38470e98
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0009-clang-Define-releative-gcc-installation-dir.patch
@@ -0,0 +1,123 @@
+From bfba4232621e151cfc5dcb16ce5bf661f8c3d8f8 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sat, 20 Mar 2021 16:09:16 -0700
+Subject: [PATCH] clang: Define / releative gcc installation dir
+
+This is required for OE gcc installation to work.
+Without this its not able to find the paths for libgcc
+and other standard headers and libraries from gcc
+installation in OE
+
+* Do not use install relative libc++ headers
+In OE we use same clang for native and cross builds, therefore we need
+to ensure that native sysroot install of libc++ is not searched for
+headers when doing cross compile instead it searches the target sysroot
+this is especially troublesome when libcxx-native is staged along with
+libcxx e.g. chromium
+
+ * Fix lib paths for OpenEmbedded Host
+
+Under OpenEmbedded Host, while building with clang-native, it cannot find
+the GCCInstallPath, which causing following error:
+[snip]
+compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/bin/clang
+-target x86_64-linux
+-isystem/path/to/x86_64-linux/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/include
+-O2 -pipe
+/path/to/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/share/cmake-3.21/Modules/CMakeCCompilerABI.c`
+hosttools/ld: cannot find crtbeginS.o: No such file or directory
+[snip]
+
+Before this patch:
+compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/bin/clang
+clang version 13.0.1 (https://github.com/llvm/llvm-project 08e3a5ccd952edee36b3c002e3a29c6b1b5153de)
+Target: x86_64-unknown-linux-gnu
+Thread model: posix
+InstalledDir: /build/tmp-glibc/work/x86_64-linux/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/bin
+Found candidate GCC installation: /usr/lib/gcc/x86_64-wrs-linux/10.2.0
+
+After this patch:
+compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/bin/clang
+clang version 13.0.1 (https://github.com/llvm/llvm-project 08e3a5ccd952edee36b3c002e3a29c6b1b5153de)
+Thread model: posix
+InstalledDir: /build/tmp-glibc/work/x86_64-linux/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/bin
+Found candidate GCC installation: /usr/lib/gcc/x86_64-wrs-linux/10.2.0
+Found candidate GCC installation: /usr/lib/x86_64-wrs-linux/10.2.0
+Selected GCC installation: /usr/lib/x86_64-wrs-linux/10.2.0
+Candidate multilib: .;@m64
+Selected multilib: .;@m64
+
+For OpenEmbedded Host, sysroots are of the form<sysroot>/usr/lib/<triple>/x.y.z.
+Take x86-64 as example, the default triple is x86_64-unknown-linux-gnu.
+For clang-native, the target vendor is '-unknown', need to test current distro
+to follow above form.
+
+Upstream-Status: Inappropriate [oe specific]
+
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ clang/lib/Driver/ToolChains/Gnu.cpp | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/clang/lib/Driver/ToolChains/Gnu.cpp b/clang/lib/Driver/ToolChains/Gnu.cpp
+index 8f126474b7d1..c80980a7fb09 100644
+--- a/clang/lib/Driver/ToolChains/Gnu.cpp
++++ b/clang/lib/Driver/ToolChains/Gnu.cpp
+@@ -18,6 +18,7 @@
+ #include "clang/Config/config.h" // for GCC_INSTALL_PREFIX
+ #include "clang/Driver/CommonArgs.h"
+ #include "clang/Driver/Compilation.h"
++#include "clang/Driver/Distro.h"
+ #include "clang/Driver/Driver.h"
+ #include "clang/Driver/MultilibBuilder.h"
+ #include "clang/Driver/Tool.h"
+@@ -2847,6 +2848,7 @@ void Generic_GCC::GCCInstallationDetector::ScanLibDirForGCCTriple(
+ const llvm::Triple &TargetTriple, const ArgList &Args,
+ const std::string &LibDir, StringRef CandidateTriple,
+ bool NeedsBiarchSuffix, bool GCCDirExists, bool GCCCrossDirExists) {
++ Distro Distro(D.getVFS(), TargetTriple);
+ // Locations relative to the system lib directory where GCC's triple-specific
+ // directories might reside.
+ struct GCCLibSuffix {
+@@ -2858,19 +2860,20 @@ void Generic_GCC::GCCInstallationDetector::ScanLibDirForGCCTriple(
+ // Whether this library suffix is relevant for the triple.
+ bool Active;
+ } Suffixes[] = {
+- // This is the normal place.
+- {"gcc/" + CandidateTriple.str(), "../..", GCCDirExists},
+-
+- // Debian puts cross-compilers in gcc-cross.
+- {"gcc-cross/" + CandidateTriple.str(), "../..", GCCCrossDirExists},
+-
+ // The Freescale PPC SDK has the gcc libraries in
+ // <sysroot>/usr/lib/<triple>/x.y.z so have a look there as well. Only do
+ // this on Freescale triples, though, since some systems put a *lot* of
+ // files in that location, not just GCC installation data.
+ {CandidateTriple.str(), "..",
+ TargetTriple.getVendor() == llvm::Triple::Freescale ||
+- TargetTriple.getVendor() == llvm::Triple::OpenEmbedded}};
++ TargetTriple.getVendor() == llvm::Triple::OpenEmbedded ||
++ Distro.IsOpenEmbedded()},
++
++ // This is the normal place.
++ {"gcc/" + CandidateTriple.str(), "../..", GCCDirExists},
++
++ // Debian puts cross-compilers in gcc-cross.
++ {"gcc-cross/" + CandidateTriple.str(), "../..", GCCCrossDirExists}};
+
+ SmallVector<GCCInstallCandidate, 3> Installations;
+ for (auto &Suffix : Suffixes) {
+@@ -3273,8 +3276,11 @@ Generic_GCC::addLibCxxIncludePaths(const llvm::opt::ArgList &DriverArgs,
+ // incompatible with the NDK libraries.
+ SmallString<128> DriverIncludeDir(getDriver().Dir);
+ llvm::sys::path::append(DriverIncludeDir, "..", "include");
++
++ // do not add it when --sysroot is specified, since it would expect
++ // libc++ headers from sysroot and not relative to compiler install location
+ if (AddIncludePath(DriverIncludeDir,
+- /*TargetDirRequired=*/getTriple().isAndroid()))
++ /*TargetDirRequired=*/getTriple().isAndroid() | !computeSysRoot().empty()))
+ return;
+ // If this is a development, non-installed, clang, libcxx will
+ // not be found at ../include/c++ but it likely to be found at
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0010-clang-Add-lpthread-and-ldl-along-with-lunwind-for-st.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0010-clang-Add-lpthread-and-ldl-along-with-lunwind-for-st.patch
new file mode 100644
index 00000000..b338d0f5
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0010-clang-Add-lpthread-and-ldl-along-with-lunwind-for-st.patch
@@ -0,0 +1,35 @@
+From 03875620d0172a7c07e3cdc607a6877b06a130e9 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Wed, 31 Jul 2019 22:51:39 -0700
+Subject: [PATCH] clang: Add -lpthread and -ldl along with -lunwind for static
+ linking
+
+When doing static liking with --unwindlib=libunwind -static we encounter
+undefined symbols
+libunwind/src/RWMutex.hpp:68: undefined reference to `pthread_rwlock_wrlock'
+
+and
+
+libunwind/src/AddressSpace.hpp:597: undefined reference to `dladdr'
+
+therefore we need to link in libpthread and libdl to fill these symbols
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ clang/lib/Driver/ToolChains/CommonArgs.cpp | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/clang/lib/Driver/ToolChains/CommonArgs.cpp b/clang/lib/Driver/ToolChains/CommonArgs.cpp
+index 10a1a412eea0..a217897610c3 100644
+--- a/clang/lib/Driver/ToolChains/CommonArgs.cpp
++++ b/clang/lib/Driver/ToolChains/CommonArgs.cpp
+@@ -2415,6 +2415,8 @@ static void AddUnwindLibrary(const ToolChain &TC, const Driver &D,
+ CmdArgs.push_back("-lunwind");
+ } else if (LGT == LibGccType::StaticLibGcc) {
+ CmdArgs.push_back("-l:libunwind.a");
++ CmdArgs.push_back("-lpthread");
++ CmdArgs.push_back("-ldl");
+ } else if (LGT == LibGccType::SharedLibGcc) {
+ if (TC.getTriple().isOSCygMing())
+ CmdArgs.push_back("-l:libunwind.dll.a");
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0011-Check-for-atomic-double-intrinsics.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0011-Check-for-atomic-double-intrinsics.patch
new file mode 100644
index 00000000..ba6a5c15
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0011-Check-for-atomic-double-intrinsics.patch
@@ -0,0 +1,34 @@
+From ea4326b11976e48dde6d99605ac24df048cd3b10 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Mon, 18 Nov 2019 17:00:29 -0800
+Subject: [PATCH] Check for atomic<double> intrinsics
+
+On some architectures e.g. x86/32bit gcc decides to inline calls to
+double atomic variables but clang does not and defers it to libatomic
+therefore detect if clang can use built-ins for atomic<double> if not
+then link libatomic, this helps building clangd for x86 on linux systems
+with gcc runtime
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ llvm/cmake/modules/CheckAtomic.cmake | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/llvm/cmake/modules/CheckAtomic.cmake b/llvm/cmake/modules/CheckAtomic.cmake
+index f11cadf39ff6..80a18a92956a 100644
+--- a/llvm/cmake/modules/CheckAtomic.cmake
++++ b/llvm/cmake/modules/CheckAtomic.cmake
+@@ -30,10 +30,11 @@ function(check_working_cxx_atomics64 varname)
+ #include <atomic>
+ #include <cstdint>
+ std::atomic<uint64_t> x (0);
++std::atomic<double> y (0);
+ int main() {
+ uint64_t i = x.load(std::memory_order_relaxed);
+ (void)i;
+- return 0;
++ return int(y);
+ }
+ " ${varname})
+ set(CMAKE_REQUIRED_FLAGS ${OLD_CMAKE_REQUIRED_FLAGS})
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0012-cmake-Fix-configure-for-packages-using-find_package.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0012-cmake-Fix-configure-for-packages-using-find_package.patch
new file mode 100644
index 00000000..946eb166
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0012-cmake-Fix-configure-for-packages-using-find_package.patch
@@ -0,0 +1,118 @@
+From dc281691e778a61cc14bca4eb187792d2ffb384c Mon Sep 17 00:00:00 2001
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+Date: Fri, 31 Jan 2020 10:56:11 +0200
+Subject: [PATCH] cmake: Fix configure for packages using find_package()
+
+Currently, when a package (i.e. bcc [https://github.com/iovisor/bcc.git])
+that depends on LLVM/Clang tries to run cmake find_package() during
+do_configure, it will fail with a similar error:
+
+| The imported target "llvm-tblgen" references the file
+| ".../recipe-sysroot/usr/bin/llvm-tblgen"
+|
+| but this file does not exist. Possible reasons include:
+| * The file was deleted, renamed, or moved to another location.
+| * An install or uninstall procedure did not complete successfully.
+| * The installation package was faulty and contained
+| ".../recipe-sysroot/usr/lib/cmake/LLVMExports.cmake"
+| but not all the files it references.
+
+This is due to the fact that currently the cmake scripts look for target
+binaries in sysroot. Work around this by not exporting the target binaries in
+Exports-* cmake files.
+
+Upstream-Status: Inappropriate [oe-specific]
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+---
+ clang/cmake/modules/AddClang.cmake | 2 --
+ llvm/cmake/modules/AddLLVM.cmake | 9 ++-------
+ llvm/cmake/modules/TableGen.cmake | 6 ------
+ 3 files changed, 2 insertions(+), 15 deletions(-)
+
+diff --git a/clang/cmake/modules/AddClang.cmake b/clang/cmake/modules/AddClang.cmake
+index 4059fc3e986c..44d43aa8f25b 100644
+--- a/clang/cmake/modules/AddClang.cmake
++++ b/clang/cmake/modules/AddClang.cmake
+@@ -182,7 +182,6 @@ macro(add_clang_tool name)
+ if (CLANG_BUILD_TOOLS)
+ get_target_export_arg(${name} Clang export_to_clangtargets)
+ install(TARGETS ${name}
+- ${export_to_clangtargets}
+ RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}"
+ COMPONENT ${name})
+
+@@ -195,7 +194,6 @@ macro(add_clang_tool name)
+ DEPENDS ${name}
+ COMPONENT ${name})
+ endif()
+- set_property(GLOBAL APPEND PROPERTY CLANG_EXPORTS ${name})
+ endif()
+ endif()
+ set_target_properties(${name} PROPERTIES XCODE_GENERATE_SCHEME ON)
+diff --git a/llvm/cmake/modules/AddLLVM.cmake b/llvm/cmake/modules/AddLLVM.cmake
+index d938214f9d0d..4816f2127e14 100644
+--- a/llvm/cmake/modules/AddLLVM.cmake
++++ b/llvm/cmake/modules/AddLLVM.cmake
+@@ -1485,7 +1485,6 @@ macro(llvm_add_tool project name)
+ if( LLVM_BUILD_TOOLS )
+ get_target_export_arg(${name} ${project} export_to_llvmexports)
+ install(TARGETS ${name}
+- ${export_to_llvmexports}
+ RUNTIME DESTINATION ${${project}_TOOLS_INSTALL_DIR}
+ COMPONENT ${name})
+ if (LLVM_ENABLE_PDB)
+@@ -1501,10 +1500,8 @@ macro(llvm_add_tool project name)
+ endif()
+ endif()
+ endif()
+- if( LLVM_BUILD_TOOLS )
+- string(TOUPPER "${project}" project_upper)
+- set_property(GLOBAL APPEND PROPERTY ${project_upper}_EXPORTS ${name})
+- endif()
++ string(TOUPPER "${project}" project_upper)
++ set_target_properties(${name} PROPERTIES FOLDER "Tools")
+ endif()
+ get_subproject_title(subproject_title)
+ set_target_properties(${name} PROPERTIES FOLDER "${subproject_title}/Tools")
+@@ -1559,7 +1556,6 @@ macro(add_llvm_utility name)
+ if (LLVM_INSTALL_UTILS AND LLVM_BUILD_UTILS)
+ get_target_export_arg(${name} LLVM export_to_llvmexports)
+ install(TARGETS ${name}
+- ${export_to_llvmexports}
+ RUNTIME DESTINATION ${LLVM_UTILS_INSTALL_DIR}
+ COMPONENT ${name})
+ if (LLVM_ENABLE_PDB)
+@@ -1573,7 +1569,6 @@ macro(add_llvm_utility name)
+ DEPENDS ${name}
+ COMPONENT ${name})
+ endif()
+- set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS ${name})
+ elseif(LLVM_BUILD_UTILS)
+ set_property(GLOBAL APPEND PROPERTY LLVM_EXPORTS_BUILDTREE_ONLY ${name})
+ endif()
+diff --git a/llvm/cmake/modules/TableGen.cmake b/llvm/cmake/modules/TableGen.cmake
+index 84c03cd6432e..72da60ce3ca1 100644
+--- a/llvm/cmake/modules/TableGen.cmake
++++ b/llvm/cmake/modules/TableGen.cmake
+@@ -237,12 +237,7 @@ macro(add_tablegen target project)
+
+ if (ADD_TABLEGEN_DESTINATION AND NOT LLVM_INSTALL_TOOLCHAIN_ONLY AND
+ (LLVM_BUILD_UTILS OR ${target} IN_LIST LLVM_DISTRIBUTION_COMPONENTS))
+- set(export_arg)
+- if(ADD_TABLEGEN_EXPORT)
+- get_target_export_arg(${target} ${ADD_TABLEGEN_EXPORT} export_arg)
+- endif()
+ install(TARGETS ${target}
+- ${export_arg}
+ COMPONENT ${target}
+ RUNTIME DESTINATION "${ADD_TABLEGEN_DESTINATION}")
+ if(NOT LLVM_ENABLE_IDE)
+@@ -253,7 +248,6 @@ macro(add_tablegen target project)
+ endif()
+ if(ADD_TABLEGEN_EXPORT)
+ string(TOUPPER ${ADD_TABLEGEN_EXPORT} export_upper)
+- set_property(GLOBAL APPEND PROPERTY ${export_upper}_EXPORTS ${target})
+ endif()
+ endmacro()
+
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0013-clang-Fix-resource-dir-location-for-cross-toolchains.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0013-clang-Fix-resource-dir-location-for-cross-toolchains.patch
new file mode 100644
index 00000000..72b989c0
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0013-clang-Fix-resource-dir-location-for-cross-toolchains.patch
@@ -0,0 +1,51 @@
+From 248a51bece02c199d0f84d14fa7e2e2379c592a0 Mon Sep 17 00:00:00 2001
+From: Jim Broadus <jbroadus@xevo.com>
+Date: Thu, 26 Mar 2020 16:05:53 -0700
+Subject: [PATCH] clang: Fix resource dir location for cross toolchains
+
+When clang looks for the resources directory, it does so based on the binary
+location and assumes that the containing directory is a sibling to lib. The
+Yocto cross.bbclass defines the default bindir as
+${exec_prefix}/bin/${CROSS_TARGET_SYS_DIR}. ex: /usr/bin/aarch64-poky-linux/.
+This causes clang to form a path that looks like /usr/bin/lib/clang/...
+
+As a fix for this, check the parent directory name. If that is "bin", then
+use that directory's parent.
+
+Upstream-Status: Pending
+
+Signed-off-by: Jim Broadus <jbroadus@xevo.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ clang/lib/Options/OptionUtils.cpp | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/clang/lib/Options/OptionUtils.cpp b/clang/lib/Options/OptionUtils.cpp
+index e5aefa012f67..7c1b657ce2c1 100644
+--- a/clang/lib/Options/OptionUtils.cpp
++++ b/clang/lib/Options/OptionUtils.cpp
+@@ -213,6 +213,7 @@ std::string clang::GetResourcesPath(StringRef BinaryPath) {
+
+ // Dir is bin/ or lib/, depending on where BinaryPath is.
+ StringRef Dir = llvm::sys::path::parent_path(BinaryPath);
++ StringRef LastDirName = llvm::sys::path::filename(Dir);
+ SmallString<128> P(Dir);
+
+ StringRef ConfiguredResourceDir(CLANG_RESOURCE_DIR);
+@@ -229,9 +230,15 @@ std::string clang::GetResourcesPath(StringRef BinaryPath) {
+ // With a static-library build of libclang, LibClangPath will contain the
+ // path of the embedding binary, which for LLVM binaries will be in bin/.
+ // ../lib gets us to lib/ in both cases.
+- P = llvm::sys::path::parent_path(Dir);
+ // This search path is also created in the COFF driver of lld, so any
+ // changes here also needs to happen in lld/COFF/Driver.cpp
++
++ // OE cross toolchains are installed, by default, in a subdir of bin.
++ if (LastDirName == "bin") {
++ P = llvm::sys::path::parent_path(Dir);
++ } else {
++ P = llvm::sys::path::parent_path(llvm::sys::path::parent_path(Dir));
++ }
+ llvm::sys::path::append(P, CLANG_INSTALL_LIBDIR_BASENAME, "clang",
+ CLANG_VERSION_MAJOR_STRING);
+ }
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0014-clang-driver-Add-dyld-prefix-when-checking-sysroot-f.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0014-clang-driver-Add-dyld-prefix-when-checking-sysroot-f.patch
new file mode 100644
index 00000000..725d10a2
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0014-clang-driver-Add-dyld-prefix-when-checking-sysroot-f.patch
@@ -0,0 +1,79 @@
+From b3eea8bcdb792a7b19b879c76eac64f36d1fe012 Mon Sep 17 00:00:00 2001
+From: Oleksandr Ocheretnyi <oocheret@cisco.com>
+Date: Wed, 15 Apr 2020 00:08:39 +0300
+Subject: [PATCH] clang: driver: Add dyld-prefix when checking sysroot for ldso
+ path
+
+ * the dyld-prefix shall be taken into account when the default
+ path for the dynamic linker has to be checked.
+
+ * this patch shall be used as annex to the next patch:
+ 'clang: driver: Check sysroot for ldso path' which includes
+ the usrmerge scenario.
+
+Upstream-Status: Pending
+Signed-off-by: Oleksandr Ocheretnyi <oocheret@cisco.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ clang/lib/Driver/ToolChains/Linux.cpp | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp
+index f7f096c1ac0a..7b608a84a66e 100644
+--- a/clang/lib/Driver/ToolChains/Linux.cpp
++++ b/clang/lib/Driver/ToolChains/Linux.cpp
+@@ -632,8 +632,8 @@ std::string Linux::getDynamicLinker(const ArgList &Args) const {
+
+ Loader = HF ? "ld-linux-armhf.so.3" : "ld-linux.so.3";
+ LibDir = "lib32";
+- if (!getVFS().exists(getDriver().SysRoot + "/" + LibDir + "/" + Loader) &&
+- getVFS().exists(getDriver().SysRoot + "/lib/" + Loader)) {
++ if (!getVFS().exists(getDriver().SysRoot + getDriver().DyldPrefix + "/" + LibDir + "/" + Loader) &&
++ getVFS().exists(getDriver().SysRoot + getDriver().DyldPrefix + "/lib/" + Loader)) {
+ LibDir = "lib";
+ }
+ break;
+@@ -689,8 +689,8 @@ std::string Linux::getDynamicLinker(const ArgList &Args) const {
+ LibDir = "lib64";
+ Loader =
+ (tools::ppc::hasPPCAbiArg(Args, "elfv2")) ? "ld64.so.2" : "ld64.so.1";
+- if (!getVFS().exists(getDriver().SysRoot + "/" + LibDir + "/" + Loader) &&
+- getVFS().exists(getDriver().SysRoot + "/lib/" + Loader)) {
++ if (!getVFS().exists(getDriver().SysRoot + getDriver().DyldPrefix + "/" + LibDir + "/" + Loader) &&
++ getVFS().exists(getDriver().SysRoot + getDriver().DyldPrefix + "/lib/" + Loader)) {
+ LibDir = "lib";
+ }
+ break;
+@@ -698,8 +698,8 @@ std::string Linux::getDynamicLinker(const ArgList &Args) const {
+ LibDir = "lib64";
+ Loader =
+ (tools::ppc::hasPPCAbiArg(Args, "elfv1")) ? "ld64.so.1" : "ld64.so.2";
+- if (!getVFS().exists(getDriver().SysRoot + "/" + LibDir + "/" + Loader) &&
+- getVFS().exists(getDriver().SysRoot + "/lib/" + Loader)) {
++ if (!getVFS().exists(getDriver().SysRoot + getDriver().DyldPrefix + "/" + LibDir + "/" + Loader) &&
++ getVFS().exists(getDriver().SysRoot + getDriver().DyldPrefix + "/lib/" + Loader)) {
+ LibDir = "lib";
+ }
+ break;
+@@ -719,8 +719,8 @@ std::string Linux::getDynamicLinker(const ArgList &Args) const {
+ case llvm::Triple::sparcv9:
+ LibDir = "lib64";
+ Loader = "ld-linux.so.2";
+- if (!getVFS().exists(getDriver().SysRoot + "/" + LibDir + "/" + Loader) &&
+- getVFS().exists(getDriver().SysRoot + "/lib/" + Loader)) {
++ if (!getVFS().exists(getDriver().SysRoot + getDriver().DyldPrefix + "/" + LibDir + "/" + Loader) &&
++ getVFS().exists(getDriver().SysRoot + getDriver().DyldPrefix + "/lib/" + Loader)) {
+ LibDir = "lib";
+ }
+ break;
+@@ -737,8 +737,8 @@ std::string Linux::getDynamicLinker(const ArgList &Args) const {
+
+ LibDir = X32 ? "libx32" : "lib64";
+ Loader = X32 ? "ld-linux-x32.so.2" : "ld-linux-x86-64.so.2";
+- if (!getVFS().exists(getDriver().SysRoot + "/" + LibDir + "/" + Loader) &&
+- getVFS().exists(getDriver().SysRoot + "/lib/" + Loader)) {
++ if (!getVFS().exists(getDriver().SysRoot + getDriver().DyldPrefix + "/" + LibDir + "/" + Loader) &&
++ getVFS().exists(getDriver().SysRoot + getDriver().DyldPrefix + "/lib/" + Loader)) {
+ LibDir = "lib";
+ }
+ break;
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0015-clang-Use-python3-in-python-scripts.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0015-clang-Use-python3-in-python-scripts.patch
new file mode 100644
index 00000000..e29d23ca
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0015-clang-Use-python3-in-python-scripts.patch
@@ -0,0 +1,35 @@
+From 17e1af5e12a01296d2c032a768569d4d8b06505b Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Wed, 14 Oct 2020 22:19:57 -0700
+Subject: [PATCH] clang: Use python3 in python scripts
+
+Some scripts ask for python, but they work fine with python3
+and in OE python symlink is not exposed to build, only python3 is
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ .../find-all-symbols/tool/run-find-all-symbols.py | 2 +-
+ clang/tools/scan-view/bin/scan-view | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/clang-tools-extra/clang-include-fixer/find-all-symbols/tool/run-find-all-symbols.py b/clang-tools-extra/clang-include-fixer/find-all-symbols/tool/run-find-all-symbols.py
+index 49a1b1493264..6158876d15f7 100755
+--- a/clang-tools-extra/clang-include-fixer/find-all-symbols/tool/run-find-all-symbols.py
++++ b/clang-tools-extra/clang-include-fixer/find-all-symbols/tool/run-find-all-symbols.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python
++#!/usr/bin/env python3
+ #
+ # =- run-find-all-symbols.py - Parallel find-all-symbols runner -*- python -*-=#
+ #
+diff --git a/clang/tools/scan-view/bin/scan-view b/clang/tools/scan-view/bin/scan-view
+index d01aebb4029a..f3375804654d 100755
+--- a/clang/tools/scan-view/bin/scan-view
++++ b/clang/tools/scan-view/bin/scan-view
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python
++#!/usr/bin/env python3
+
+ from __future__ import print_function
+
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0016-llvm-clang-Insert-anchor-for-adding-OE-distro-vendor.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0016-llvm-clang-Insert-anchor-for-adding-OE-distro-vendor.patch
new file mode 100644
index 00000000..674a3b26
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0016-llvm-clang-Insert-anchor-for-adding-OE-distro-vendor.patch
@@ -0,0 +1,184 @@
+From 259d8eb2ed82c9248387a3cbb1befee358ecbb8e Mon Sep 17 00:00:00 2001
+From: Hongxu Jia <hongxu.jia@windriver.com>
+Date: Mon, 25 Jan 2021 16:14:35 +0800
+Subject: [PATCH] llvm/clang: Insert anchor for adding OE distro vendor names
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This helps in making right detection for OE built gcc toolchains
+
+The //CLANG_EXTRA_OE_VENDORS_CASES string is replaced with list of
+additional Ceses based on CLANG_EXTRA_OE_VENDORS variable in
+recipes-devtools/clang/llvm-project-source.inc:add_distro_vendor()
+
+* For x86_64, set Yocto based GCC install search path
+
+Under Yocto host, while using clang-native to build, it searches
+install host gcc failed which causing the include file not found
+[snip]
+|clang++ -target x86_64-linux -MMD -MF src/base/files/file_path_constants.o.d -I../../../tools/gn/src -I. \
+-isystem/tmp-glibc/work/x86_64-linux/gn-native/87.0.4280.141-r0/recipe-sysroot-native/usr/include -O2 -pipe \
+-std=c++17 -c ../../../tools/gn/src/base/files/file_path_constants.cc -o src/base/files/file_path_constants.o
+|../../../tools/gn/src/base/files/file_path_constants.cc:7:10: fatal error: 'iterator' file not found
+|#include <iterator>
+| ^~~~~~~~
+[snip]
+
+* Set three Yocto based GCC triple: poky, oe-core and wind river
+
+Before aplly the patch
+[snip]
+$ ../recipe-sysroot-native/usr/bin/clang++ -v
+clang version 11.0.1 (https://github.com/llvm/llvm-project 43ff75f2c3feef64f9d73328230d34dac8832a91)
+Target: x86_64-unknown-linux-gnu
+Thread model: posix
+InstalledDir:tmp-glibc/work/x86_64-linux/gn-native/87.0.4280.141-r0/chromium-87.0.4280.141/../recipe-sysroot-native/usr/bin
+[snip]
+
+After this patch:
+[snip]
+$ ../recipe-sysroot-native/usr/bin/clang++ -v
+clang version 11.0.1 (https://github.com/llvm/llvm-project 22c3241ff9a6224261df48d0258957fd8acc3d64)
+Target: x86_64-unknown-linux-gnu
+Thread model: posix
+InstalledDir:tmp-glibc/work/x86_64-linux/gn-native/87.0.4280.141-r0/chromium-87.0.4280.141/../recipe-sysroot-native/usr/bin
+Found candidate GCC installation: /usr/lib//x86_64-wrs-linux/10.1.0
+Found candidate GCC installation: /usr/lib/gcc/x86_64-wrs-linux/10.1.0
+Selected GCC installation: /usr/lib//x86_64-wrs-linux/10.1.0
+Candidate multilib: .;@m64
+Selected multilib: .;@m64
+[snip]
+
+BTW, it is hardly to insert a triple by the replacement of TARGET_SYS
+(=${TARGET_ARCH}${TARGET_VENDOR}-${TARGET_OS}), since TARGET_VENDOR
+is different between clang and clang-native
+
+* The //CLANG_EXTRA_OE_VENDORS_TRIPLES string is replaced with list of
+additional triples based on CLANG_EXTRA_OE_VENDORS variable in
+recipes-devtools/clang/llvm-project-source.inc:add_distro_vendor()
+
+* Correct library search path for OpenEmbedded Host
+
+For OpenEmbedded Host, the gcc install path is
+/usr/lib/x86_64-[distroname]-linux/[gcc-version].
+So the library search path is not found with default triple
+'x86_64-linux-gnu' for x86_64. Causing following error:
+[snip]
+compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/bin/clang
+-target x86_64-linux
+-isystem/path/to/x86_64-linux/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/include
+-O2 -pipe
+/path/to/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/share/cmake-3.21/Modules/CMakeCCompilerABI.c`
+| /build/tmp-glibc/hosttools/ld: cannot find -lgcc
+| /build/tmp-glibc/hosttools/ld: cannot find -lgcc
+| clang-13: error: linker command failed with exit code 1 (use -v to see invocation)
+[snip]
+
+before this patch:
+b59da142f2b0:$ /path/to/x86_64-linux/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/bin/clang --print-search-dirs
+programs: =/build/tmp-glibc/work/x86_64-linux/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/bin
+libraries: =/build/tmp-glibc/work/x86_64-linux/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/lib/clang/13.0.1:/build/tmp-glibc/work/x86_64-linux/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/bin/../lib://lib://usr/lib
+
+after this patch:
+b59da142f2b0:$ /path/to/x86_64-linux/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/bin/clang --print-search-dirs
+programs: =/build/tmp-glibc/work/x86_64-linux/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/bin
+libraries: =/build/tmp-glibc/work/x84_64-linux/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/lib/clang/13.0.1:/usr/lib/x86_64-wrs-linux/10.2.0://lib/x86_64-wrs-linux://usr/lib/x86_64-wrs-linux:/build/tmp-glibc/work/x86_64-linux/compiler-rt-native/13.0.1-r0/recipe-sysroot-native/usr/bin/../lib://lib://usr/lib
+
+[JM: add missing instance of Distro class in getMultiarchTriple(), at Linux.cpp]
+
+Upstream-Status: Inappropriate [oe specific]
+
+Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+Signed-off-by: Changqing Li <changqing.li@windriver.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
+---
+ clang/include/clang/Driver/Distro.h | 2 ++
+ clang/lib/Driver/Distro.cpp | 1 +
+ clang/lib/Driver/ToolChains/Gnu.cpp | 1 +
+ clang/lib/Driver/ToolChains/Linux.cpp | 2 ++
+ llvm/lib/TargetParser/Triple.cpp | 2 +-
+ 5 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/clang/include/clang/Driver/Distro.h b/clang/include/clang/Driver/Distro.h
+index 0e17b30eb..b449a62dc 100644
+--- a/clang/include/clang/Driver/Distro.h
++++ b/clang/include/clang/Driver/Distro.h
+@@ -45,6 +45,7 @@ public:
+ RHEL10,
+ Fedora,
+ Gentoo,
++ //CLANG_EXTRA_OE_DISTRO_NAME
+ OpenSUSE,
+ UbuntuQuantal,
+ UbuntuRaring,
+@@ -132,6 +133,7 @@ public:
+
+ bool IsGentoo() const { return DistroVal == Gentoo; }
+
++ //CLANG_EXTRA_OE_DISTRO_CHECK
+ /// @}
+ };
+
+diff --git a/clang/lib/Driver/Distro.cpp b/clang/lib/Driver/Distro.cpp
+index df10458d0..61dc127a4 100644
+--- a/clang/lib/Driver/Distro.cpp
++++ b/clang/lib/Driver/Distro.cpp
+@@ -43,6 +43,7 @@ static Distro::DistroType DetectOsRelease(llvm::vfs::FileSystem &VFS) {
+ .Case("sles", Distro::OpenSUSE)
+ .Case("opensuse", Distro::OpenSUSE)
+ .Case("exherbo", Distro::Exherbo)
++ //CLANG_EXTRA_OE_DISTRO_CASE
+ .Default(Distro::UnknownDistro);
+ return Version;
+ }
+diff --git a/clang/lib/Driver/ToolChains/Gnu.cpp b/clang/lib/Driver/ToolChains/Gnu.cpp
+index c80980a7f..80fd8058b 100644
+--- a/clang/lib/Driver/ToolChains/Gnu.cpp
++++ b/clang/lib/Driver/ToolChains/Gnu.cpp
+@@ -2370,6 +2370,7 @@ void Generic_GCC::GCCInstallationDetector::AddDefaultGCCPrefixes(
+ "x86_64-pc-linux-gnu", "x86_64-redhat-linux6E",
+ "x86_64-redhat-linux", "x86_64-suse-linux",
+ "x86_64-manbo-linux-gnu", "x86_64-slackware-linux",
++ "x86_64-oe-linux",//CLANG_EXTRA_OE_VENDORS_TRIPLES
+ "x86_64-unknown-linux", "x86_64-amazon-linux"};
+ static const char *const X32Triples[] = {"x86_64-linux-gnux32",
+ "x86_64-pc-linux-gnux32"};
+diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp
+index 7b608a84a..585a86a2d 100644
+--- a/clang/lib/Driver/ToolChains/Linux.cpp
++++ b/clang/lib/Driver/ToolChains/Linux.cpp
+@@ -45,6 +45,7 @@ std::string Linux::getMultiarchTriple(const Driver &D,
+ bool IsAndroid = TargetTriple.isAndroid();
+ bool IsMipsR6 = TargetTriple.getSubArch() == llvm::Triple::MipsSubArch_r6;
+ bool IsMipsN32Abi = TargetTriple.getEnvironment() == llvm::Triple::GNUABIN32;
++ Distro Distro(D.getVFS(), TargetTriple);
+
+ // For most architectures, just use whatever we have rather than trying to be
+ // clever.
+@@ -81,6 +82,7 @@ std::string Linux::getMultiarchTriple(const Driver &D,
+ return "x86_64-linux-android";
+ if (TargetEnvironment == llvm::Triple::GNUX32)
+ return "x86_64-linux-gnux32";
++ //CLANG_EXTRA_OE_DISTRO_TRIPLE
+ return "x86_64-linux-gnu";
+ case llvm::Triple::aarch64:
+ if (IsAndroid)
+diff --git a/llvm/lib/TargetParser/Triple.cpp b/llvm/lib/TargetParser/Triple.cpp
+index a4f9dd42c..86b74451e 100644
+--- a/llvm/lib/TargetParser/Triple.cpp
++++ b/llvm/lib/TargetParser/Triple.cpp
+@@ -702,7 +702,7 @@ static Triple::VendorType parseVendor(StringRef VendorName) {
+ .Case("suse", Triple::SUSE)
+ .Case("oe", Triple::OpenEmbedded)
+ .Case("intel", Triple::Intel)
+- .Case("meta", Triple::Meta)
++ .Case("meta", Triple::Meta) //CLANG_EXTRA_OE_VENDORS_CASES
+ .Default(Triple::UnknownVendor);
+ }
+
+--
+2.39.5
+
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0017-compiler-rt-Do-not-use-backtrace-APIs-on-non-glibc-l.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0017-compiler-rt-Do-not-use-backtrace-APIs-on-non-glibc-l.patch
new file mode 100644
index 00000000..3fa436d5
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0017-compiler-rt-Do-not-use-backtrace-APIs-on-non-glibc-l.patch
@@ -0,0 +1,68 @@
+From bc8371eb77cca413ccb4ebf8239c597f7be40006 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Wed, 19 May 2021 17:32:13 -0700
+Subject: [PATCH] compiler-rt: Do not use backtrace APIs on non-glibc linux
+
+musl e.g. does not provide backtrace APIs
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ .../lib/gwp_asan/optional/backtrace_linux_libc.cpp | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/compiler-rt/lib/gwp_asan/optional/backtrace_linux_libc.cpp b/compiler-rt/lib/gwp_asan/optional/backtrace_linux_libc.cpp
+index ea8e72be287d..0344074dd254 100644
+--- a/compiler-rt/lib/gwp_asan/optional/backtrace_linux_libc.cpp
++++ b/compiler-rt/lib/gwp_asan/optional/backtrace_linux_libc.cpp
+@@ -7,7 +7,9 @@
+ //===----------------------------------------------------------------------===//
+
+ #include <assert.h>
++#ifdef __GLIBC__
+ #include <execinfo.h>
++#endif
+ #include <stddef.h>
+ #include <stdint.h>
+ #include <stdlib.h>
+@@ -21,8 +23,11 @@
+ namespace {
+ size_t Backtrace(uintptr_t *TraceBuffer, size_t Size) {
+ static_assert(sizeof(uintptr_t) == sizeof(void *), "uintptr_t is not void*");
+-
++#ifdef __GLIBC__
+ return backtrace(reinterpret_cast<void **>(TraceBuffer), Size);
++#else
++ return -1;
++#endif
+ }
+
+ // We don't need any custom handling for the Segv backtrace - the libc unwinder
+@@ -30,7 +35,11 @@ size_t Backtrace(uintptr_t *TraceBuffer, size_t Size) {
+ // to avoid the additional frame.
+ GWP_ASAN_ALWAYS_INLINE size_t SegvBacktrace(uintptr_t *TraceBuffer, size_t Size,
+ void * /*Context*/) {
++#ifdef __GLIBC__
+ return Backtrace(TraceBuffer, Size);
++#else
++ return -1;
++#endif
+ }
+
+ static void PrintBacktrace(uintptr_t *Trace, size_t TraceLength,
+@@ -40,6 +49,7 @@ static void PrintBacktrace(uintptr_t *Trace, size_t TraceLength,
+ return;
+ }
+
++#ifdef __GLIBC__
+ char **BacktraceSymbols =
+ backtrace_symbols(reinterpret_cast<void **>(Trace), TraceLength);
+
+@@ -53,6 +63,7 @@ static void PrintBacktrace(uintptr_t *Trace, size_t TraceLength,
+ Printf("\n");
+ if (BacktraceSymbols)
+ free(BacktraceSymbols);
++#endif
+ }
+ } // anonymous namespace
+
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0018-clang-Fix-x86-triple-for-non-debian-multiarch-linux-.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0018-clang-Fix-x86-triple-for-non-debian-multiarch-linux-.patch
new file mode 100644
index 00000000..786ff426
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0018-clang-Fix-x86-triple-for-non-debian-multiarch-linux-.patch
@@ -0,0 +1,29 @@
+From 6839ba1413cf09eb14a24eeda44fb02c1c6809e1 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Wed, 19 May 2021 17:56:03 -0700
+Subject: [PATCH] clang: Fix x86 triple for non-debian multiarch linux distros
+
+OpenEmbedded does not hardcode mutli-arch like debian therefore ensure
+that it still uses the proper tuple
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ clang/lib/Driver/ToolChains/Linux.cpp | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp
+index 4a0adedce09a..9fed904c05c2 100644
+--- a/clang/lib/Driver/ToolChains/Linux.cpp
++++ b/clang/lib/Driver/ToolChains/Linux.cpp
+@@ -227,8 +227,9 @@ Linux::Linux(const Driver &D, const llvm::Triple &Triple, const ArgList &Args)
+ : Generic_ELF(D, Triple, Args) {
+ GCCInstallation.TripleToDebianMultiarch = [](const llvm::Triple &T) {
+ StringRef TripleStr = T.str();
++ // OpenEmbedded does not hardcode the triple to i386-linux-gnu like debian
+ StringRef DebianMultiarch =
+- T.getArch() == llvm::Triple::x86 ? "i386-linux-gnu" : TripleStr;
++ T.getArch() == llvm::Triple::x86 && T.getVendor() != llvm::Triple::OpenEmbedded ? "i386-linux-gnu" : TripleStr;
+ return DebianMultiarch;
+ };
+
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0019-libunwind-Added-unw_backtrace-method.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0019-libunwind-Added-unw_backtrace-method.patch
new file mode 100644
index 00000000..0b7966ee
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0019-libunwind-Added-unw_backtrace-method.patch
@@ -0,0 +1,56 @@
+From bf7c0933d65eb811c993ff32fdc6b65f6befc5af Mon Sep 17 00:00:00 2001
+From: Maksim Kita <maksim-kita@yandex-team.ru>
+Date: Sun, 23 May 2021 10:27:29 +0000
+Subject: [PATCH] libunwind: Added unw_backtrace method
+
+Source: https://github.com/ClickHouse-Extras/libunwind/commit/52f0f7861926cbfaef7e6c97d8a6d7ba2a1f6747#diff-a82fc885e2e4facf4b92d26171c13aa4aa5db296f77e1158ba2f8664e3bd1f5c
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ libunwind/include/libunwind.h | 1 +
+ libunwind/src/libunwind.cpp | 20 ++++++++++++++++++++
+ 2 files changed, 21 insertions(+)
+
+diff --git a/libunwind/include/libunwind.h b/libunwind/include/libunwind.h
+index 56ca7110274a..60a27f28100b 100644
+--- a/libunwind/include/libunwind.h
++++ b/libunwind/include/libunwind.h
+@@ -235,6 +235,7 @@ extern int unw_is_signal_frame(unw_cursor_t *) LIBUNWIND_AVAIL;
+ extern int unw_get_proc_name(unw_cursor_t *, char *, size_t, unw_word_t *) LIBUNWIND_AVAIL;
+ //extern int unw_get_save_loc(unw_cursor_t*, int, unw_save_loc_t*);
+ extern const char *unw_strerror(int) LIBUNWIND_AVAIL;
++extern int unw_backtrace(void **, int) LIBUNWIND_AVAIL;
+
+ extern unw_addr_space_t unw_local_addr_space;
+
+diff --git a/libunwind/src/libunwind.cpp b/libunwind/src/libunwind.cpp
+index 7ffffc2a30c0..ed0b394cb002 100644
+--- a/libunwind/src/libunwind.cpp
++++ b/libunwind/src/libunwind.cpp
+@@ -531,6 +531,26 @@ int __unw_remove_find_dynamic_unwind_sections(
+
+ #endif // __APPLE__
+
++int unw_backtrace(void **buffer, int size) {
++ unw_context_t context;
++ unw_cursor_t cursor;
++ if (unw_getcontext(&context) || unw_init_local(&cursor, &context)) {
++ return 0;
++ }
++
++ unw_word_t ip;
++ int current = 0;
++ while (unw_step(&cursor) > 0) {
++ if (current >= size || unw_get_reg(&cursor, UNW_REG_IP, &ip)) {
++ break;
++ }
++
++ buffer[current++] = reinterpret_cast<void *>(static_cast<uintptr_t>(ip));
++ }
++
++ return current;
++}
++
+ // Add logging hooks in Debug builds only
+ #ifndef NDEBUG
+ #include <stdlib.h>
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0020-lldb-Link-with-libatomic-on-x86.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0020-lldb-Link-with-libatomic-on-x86.patch
new file mode 100644
index 00000000..b9f7270f
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0020-lldb-Link-with-libatomic-on-x86.patch
@@ -0,0 +1,33 @@
+From 94c6e940ddc44922ee505993549477a0fa7ac50d Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Tue, 8 Feb 2022 01:31:26 -0800
+Subject: [PATCH] lldb: Link with libatomic on x86
+
+cmake atomic check is not sufficient for i686 target where clang14 still
+generates __atomic_store calls but the check does not entail this
+function and happily thinks that compiler can resolve all atomic via intrinsics
+on i686, but thats not the case, ideally the check for determining
+atomic operation should be make more robust but until then lets ask to
+link with libatomic on i686/linux
+
+Upstream-Status: Inappropriate [OE-Specific]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ lldb/source/Utility/CMakeLists.txt | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lldb/source/Utility/CMakeLists.txt b/lldb/source/Utility/CMakeLists.txt
+index 04f1692e53b3..da0a48d9da54 100644
+--- a/lldb/source/Utility/CMakeLists.txt
++++ b/lldb/source/Utility/CMakeLists.txt
+@@ -19,6 +19,10 @@ if (CMAKE_SYSTEM_NAME MATCHES "Windows")
+ list(APPEND LLDB_SYSTEM_LIBS ws2_32 rpcrt4)
+ endif ()
+
++if (CMAKE_SYSTEM_PROCESSOR MATCHES "i686" AND CMAKE_SYSTEM_NAME MATCHES "Linux")
++ list(APPEND LLDB_SYSTEM_LIBS atomic)
++endif()
++
+ if (NOT HAVE_CXX_ATOMICS64_WITHOUT_LIB )
+ list(APPEND LLDB_SYSTEM_LIBS atomic)
+ endif()
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0021-compiler-rt-Enable-__int128-for-ppc32.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0021-compiler-rt-Enable-__int128-for-ppc32.patch
new file mode 100644
index 00000000..89b492b8
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0021-compiler-rt-Enable-__int128-for-ppc32.patch
@@ -0,0 +1,70 @@
+From 968515d7aa2d7e4af5f318618c307dbe21538650 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Wed, 9 Mar 2022 16:28:16 -0800
+Subject: [PATCH] compiler-rt: Enable __int128 for ppc32
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ compiler-rt/lib/builtins/CMakeLists.txt | 13 ++++++-------
+ compiler-rt/lib/builtins/int_types.h | 2 +-
+ 2 files changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/compiler-rt/lib/builtins/CMakeLists.txt b/compiler-rt/lib/builtins/CMakeLists.txt
+index c3dbd65998f1..b3a44ea3c3b3 100644
+--- a/compiler-rt/lib/builtins/CMakeLists.txt
++++ b/compiler-rt/lib/builtins/CMakeLists.txt
+@@ -813,11 +813,9 @@ set(mips64el_SOURCES ${GENERIC_TF_SOURCES}
+
+ set(nvptx64_SOURCES ${GENERIC_SOURCES})
+
+-set(powerpc_SOURCES ${GENERIC_SOURCES})
+-
+ set(powerpcspe_SOURCES ${GENERIC_SOURCES})
+
+-set(powerpc64_SOURCES
++set(powerpc_SOURCES
+ ppc/divtc3.c
+ ppc/fixtfdi.c
+ ppc/fixunstfdi.c
+@@ -832,14 +830,15 @@ set(powerpc64_SOURCES
+ )
+ # These routines require __int128, which isn't supported on AIX.
+ if (NOT OS_NAME MATCHES "AIX")
+- set(powerpc64_SOURCES
++ set(powerpc_SOURCES
+ ppc/floattitf.c
+ ppc/fixtfti.c
+ ppc/fixunstfti.c
+- ${powerpc64_SOURCES}
++ ${powerpc_SOURCES}
+ )
+ endif()
+-set(powerpc64le_SOURCES ${powerpc64_SOURCES})
++set(powerpc64le_SOURCES ${powerpc_SOURCES})
++set(powerpc64_SOURCES ${powerpc_SOURCES})
+
+ set(riscv_SOURCES
+ cpu_model/riscv.c
+@@ -1014,7 +1013,7 @@ else ()
+
+ # For RISCV32 and 32-bit SPARC, we must force enable int128 for compiling long
+ # double routines.
+- if (COMPILER_RT_ENABLE_SOFTWARE_INT128 OR ("${arch}" MATCHES "riscv32|sparc$"
++ if (COMPILER_RT_ENABLE_SOFTWARE_INT128 OR ("${arch}" MATCHES "riscv32|powerpc|sparc$"
+ AND NOT CMAKE_COMPILER_IS_GNUCC))
+ list(APPEND BUILTIN_CFLAGS_${arch} -fforce-enable-int128)
+ endif()
+diff --git a/compiler-rt/lib/builtins/int_types.h b/compiler-rt/lib/builtins/int_types.h
+index 7c7f8cb64aa9..81386f1b99b0 100644
+--- a/compiler-rt/lib/builtins/int_types.h
++++ b/compiler-rt/lib/builtins/int_types.h
+@@ -64,7 +64,7 @@ typedef union {
+ } udwords;
+
+ #if defined(__LP64__) || defined(__wasm__) || defined(__mips64) || \
+- defined(__SIZEOF_INT128__) || defined(_WIN64)
++ defined(__SIZEOF_INT128__) || defined(_WIN64) || defined(__powerpc__)
+ #define CRT_HAS_128BIT
+ #endif
+
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0022-llvm-Do-not-use-cmake-infra-to-detect-libzstd.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0022-llvm-Do-not-use-cmake-infra-to-detect-libzstd.patch
new file mode 100644
index 00000000..cccb1e98
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0022-llvm-Do-not-use-cmake-infra-to-detect-libzstd.patch
@@ -0,0 +1,62 @@
+From 8c5fc285de0051107aa9b7e2e269aa2667fd16f4 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Fri, 12 Aug 2022 11:50:57 -0700
+Subject: [PATCH] llvm: Do not use cmake infra to detect libzstd
+
+OE's version is build using plain make not cmake as a result we do not
+have the cmake support files and this probing method can get this info
+from build host and force linking with libzstd from /usr/lib which is
+not what we want when cross building.
+
+Fixes errors building llvm-config like
+/usr/lib/libzstd.so.1.5.2: error adding symbols: file in wrong
+format
+| clang-15: error: linker command failed with exit code 1 (use -v to see invocation)
+| ninja: build stopped: subcommand failed.
+
+Upstream-Status: Inappropriate [OE-Specific]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ llvm/lib/Support/CMakeLists.txt | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/llvm/lib/Support/CMakeLists.txt b/llvm/lib/Support/CMakeLists.txt
+index 099b0e55579b..8c35b8a31457 100644
+--- a/llvm/lib/Support/CMakeLists.txt
++++ b/llvm/lib/Support/CMakeLists.txt
+@@ -22,7 +22,7 @@ if (HAS_WERROR_GLOBAL_CTORS)
+ endif()
+
+ if(LLVM_ENABLE_ZLIB)
+- list(APPEND imported_libs ZLIB::ZLIB)
++ list(APPEND imported_libs z)
+ endif()
+
+ if(LLVM_ENABLE_ZSTD)
+@@ -34,7 +34,7 @@ if(LLVM_ENABLE_ZSTD)
+ endif()
+
+ if(LLVM_ENABLE_ZSTD)
+- list(APPEND imported_libs ${zstd_target})
++ list(APPEND imported_libs zstd)
+ endif()
+
+ if( WIN32 )
+@@ -351,7 +351,7 @@ if(LLVM_ENABLE_ZLIB)
+ get_property(zlib_library TARGET ZLIB::ZLIB PROPERTY LOCATION)
+ endif()
+ get_library_name(${zlib_library} zlib_library)
+- set(llvm_system_libs ${llvm_system_libs} "${zlib_library}")
++ set(llvm_system_libs ${llvm_system_libs} z)
+ endif()
+
+ if(LLVM_ENABLE_ZSTD)
+@@ -365,7 +365,7 @@ if(LLVM_ENABLE_ZSTD)
+ endif()
+ if (zstd_target STREQUAL zstd::libzstd_shared)
+ get_library_name(${zstd_library} zstd_library)
+- set(llvm_system_libs ${llvm_system_libs} "${zstd_library}")
++ set(llvm_system_libs ${llvm_system_libs} zstd)
+ else()
+ set(llvm_system_libs ${llvm_system_libs} "${zstd_STATIC_LIBRARY}")
+ endif()
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0023-compiler-rt-Fix-stat-struct-s-size-for-O32-ABI.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0023-compiler-rt-Fix-stat-struct-s-size-for-O32-ABI.patch
new file mode 100644
index 00000000..a498c36b
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0023-compiler-rt-Fix-stat-struct-s-size-for-O32-ABI.patch
@@ -0,0 +1,46 @@
+From 4a114f5fcd2ab8870b26ba3df4747fc066933f66 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Tue, 3 Jan 2023 18:44:34 -0800
+Subject: [PATCH] compiler-rt: Fix stat struct's size for O32 ABI
+
+stat struct size differs on glibc based on ABI choices e.g. 64bit off_t
+and/or 64bit time_t will make this size different. Therefore separate
+out the O32 case out, makes it more readable.
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ .../sanitizer_platform_limits_posix.h | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h b/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h
+index 05ebee49f2ab..89c4dcaf3e3d 100644
+--- a/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h
++++ b/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h
+@@ -100,6 +100,18 @@ const unsigned struct_kernel_stat64_sz = 104;
+ const unsigned struct_kernel_stat_sz = 144;
+ const unsigned struct_kernel_stat64_sz = 104;
+ # elif defined(__mips__)
++#if defined(__mips_o32) // O32 ABI
++#if _TIME_BITS == 64
++const unsigned struct_kernel_stat_sz = 112;
++const unsigned struct_kernel_stat64_sz = 112;
++#elif _FILE_OFFSET_BITS == 64
++const unsigned struct_kernel_stat_sz = 160;
++const unsigned struct_kernel_stat64_sz = 160;
++#else
++const unsigned struct_kernel_stat_sz = 144;
++const unsigned struct_kernel_stat64_sz = 160;
++#endif
++#else //__mips_o32
+ const unsigned struct_kernel_stat_sz = SANITIZER_ANDROID
+ ? FIRST_32_SECOND_64(104, 128)
+ # if defined(_ABIN32) && _MIPS_SIM == _ABIN32
+@@ -110,6 +122,7 @@ const unsigned struct_kernel_stat_sz = SANITIZER_ANDROID
+ : FIRST_32_SECOND_64(160, 216);
+ # endif
+ const unsigned struct_kernel_stat64_sz = 104;
++#endif
+ # elif defined(__s390__) && !defined(__s390x__)
+ const unsigned struct_kernel_stat_sz = 64;
+ const unsigned struct_kernel_stat64_sz = 104;
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0024-ToolChains-Gnu.cpp-ARMLibDirs-search-also-in-lib32.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0024-ToolChains-Gnu.cpp-ARMLibDirs-search-also-in-lib32.patch
new file mode 100644
index 00000000..09224af3
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0024-ToolChains-Gnu.cpp-ARMLibDirs-search-also-in-lib32.patch
@@ -0,0 +1,81 @@
+From 27e4b9755ddd3bec16a851cce0df48e909ae6438 Mon Sep 17 00:00:00 2001
+From: Martin Jansa <Martin.Jansa@gmail.com>
+Date: Thu, 31 Aug 2023 18:14:47 +0200
+Subject: [PATCH] ToolChains/Gnu.cpp: ARMLibDirs search also in lib32
+
+* in some strange multilib configs we build lib32-image where
+ 32bit libs are in /usr/lib32 and 64bit in /usr/lib64 but in such
+ setup the clang search for GCC candidate installation doesn't
+ check lib32 directory in sysroot and fails to find the installation
+
+ X86LibDirs was already searching in lib32 for very long time:
+ https://github.com/llvm/llvm-project/commit/621fed5f5a051a0333415aaed75b8f2ed2350dbd
+ but ARMLibDirs didn't include it for some reason.
+
+* if we don't add lib32 for arm in getOSLibDir(), then it will
+ find -lgcc, crtbeginS.o, crtendS.o, but still fail to find
+ -lgcc_s, -lc, Scrt1.o, crti.o, crtn.o
+
+* fixes lib32-compiler-rt build failure:
+
+-- Configuring incomplete, errors occurred!
+CMake Error at TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/recipe-sysroot-native/usr/share/cmake-3.26/Modules/CMakeTestCCompiler.cmake:67 (message):
+ The C compiler
+
+ "TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/recipe-sysroot-native/usr/bin/arm-oemllib32-linux-gnueabi/arm-oemllib32-linux-gnueabi-clang"
+
+ is not able to compile a simple test program.
+
+ It fails with the following output:
+
+ Change Dir: TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build/CMakeFiles/CMakeScratch/TryCompile-rWXyQZ
+
+ Run Build Command(s):ninja -v cmTC_84d18 && [1/2] TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/recipe-sysroot-native/usr/bin/arm-oemllib32-linux-gnueabi/arm-oemllib32-linux-gnueabi-clang --target=arm-oemllib32-linux-gnueabi --sysroot=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot -target arm-oemllib32-linux-gnueabi -march=armv7ve -mthumb -mfpu=neon-vfpv4 -mfloat-abi=softfp -mlittle-endian --dyld-prefix=/usr -Qunused-arguments -funwind-tables -fstack-protector-strong -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Werror=return-type -D_TIME_BITS=64 -D_FILE_OFFSET_BITS=64 --sysroot=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot -O2 -pipe -g -feliminate-unused-debug-types -fmacro-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/recipe-sysroot-native= -fPIE -MD -MT CMakeFiles/cmTC_84d18.dir/testCCompiler.c.o -MF CMakeFiles/cmTC_84d18.dir/testCCompiler.c.o.d -o CMakeFiles/cmTC_84d18.dir/testCCompiler.c.o -c TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build/CMakeFiles/CMakeScratch/TryCompile-rWXyQZ/testCCompiler.c
+ [2/2] : && TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/recipe-sysroot-native/usr/bin/arm-oemllib32-linux-gnueabi/arm-oemllib32-linux-gnueabi-clang --target=arm-oemllib32-linux-gnueabi --sysroot=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot -target arm-oemllib32-linux-gnueabi -march=armv7ve -mthumb -mfpu=neon-vfpv4 -mfloat-abi=softfp -mlittle-endian --dyld-prefix=/usr -Qunused-arguments -funwind-tables -fstack-protector-strong -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Werror=return-type -D_TIME_BITS=64 -D_FILE_OFFSET_BITS=64 --sysroot=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot -O2 -pipe -g -feliminate-unused-debug-types -fmacro-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/recipe-sysroot-native= -target arm-oemllib32-linux-gnueabi -march=armv7ve -mthumb -mfpu=neon-vfpv4 -mfloat-abi=softfp -mlittle-endian --dyld-prefix=/usr -Qunused-arguments -funwind-tables -fstack-protector-strong -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Werror=return-type -D_TIME_BITS=64 -D_FILE_OFFSET_BITS=64 --sysroot=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -fmacro-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/recipe-sysroot-native= -Wl,-z,relro,-z,now -unwindlib=libgcc -rtlib=libgcc -stdlib=libstdc++ -fuse-ld=lld -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -fmacro-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/recipe-sysroot-native= -Wl,-z,relro,-z,now -unwindlib=libgcc -rtlib=libgcc -stdlib=libstdc++ -fuse-ld=lld CMakeFiles/cmTC_84d18.dir/testCCompiler.c.o -o cmTC_84d18 && :
+ FAILED: cmTC_84d18
+ : && TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/recipe-sysroot-native/usr/bin/arm-oemllib32-linux-gnueabi/arm-oemllib32-linux-gnueabi-clang --target=arm-oemllib32-linux-gnueabi --sysroot=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot -target arm-oemllib32-linux-gnueabi -march=armv7ve -mthumb -mfpu=neon-vfpv4 -mfloat-abi=softfp -mlittle-endian --dyld-prefix=/usr -Qunused-arguments -funwind-tables -fstack-protector-strong -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Werror=return-type -D_TIME_BITS=64 -D_FILE_OFFSET_BITS=64 --sysroot=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot -O2 -pipe -g -feliminate-unused-debug-types -fmacro-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/recipe-sysroot-native= -target arm-oemllib32-linux-gnueabi -march=armv7ve -mthumb -mfpu=neon-vfpv4 -mfloat-abi=softfp -mlittle-endian --dyld-prefix=/usr -Qunused-arguments -funwind-tables -fstack-protector-strong -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Werror=return-type -D_TIME_BITS=64 -D_FILE_OFFSET_BITS=64 --sysroot=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -fmacro-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/recipe-sysroot-native= -Wl,-z,relro,-z,now -unwindlib=libgcc -rtlib=libgcc -stdlib=libstdc++ -fuse-ld=lld -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -fmacro-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work-shared/llvm-project-source-16.0.6-r0/git=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/build=/usr/src/debug/lib32-compiler-rt/16.0.6-r0 -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fmacro-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/lib32-recipe-sysroot= -fdebug-prefix-map=TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-compiler-rt/16.0.6/recipe-sysroot-native= -Wl,-z,relro,-z,now -unwindlib=libgcc -rtlib=libgcc -stdlib=libstdc++ -fuse-ld=lld CMakeFiles/cmTC_84d18.dir/testCCompiler.c.o -o cmTC_84d18 && :
+ arm-oemllib32-linux-gnueabi-ld.lld: error: cannot open Scrt1.o: No such file or directory
+ arm-oemllib32-linux-gnueabi-ld.lld: error: cannot open crti.o: No such file or directory
+ arm-oemllib32-linux-gnueabi-ld.lld: error: cannot open crtbeginS.o: No such file or directory
+ arm-oemllib32-linux-gnueabi-ld.lld: error: unable to find library -lgcc
+ arm-oemllib32-linux-gnueabi-ld.lld: error: unable to find library -lgcc_s
+ arm-oemllib32-linux-gnueabi-ld.lld: error: unable to find library -lc
+ arm-oemllib32-linux-gnueabi-ld.lld: error: unable to find library -lgcc
+ arm-oemllib32-linux-gnueabi-ld.lld: error: unable to find library -lgcc_s
+ arm-oemllib32-linux-gnueabi-ld.lld: error: cannot open crtendS.o: No such file or directory
+ arm-oemllib32-linux-gnueabi-ld.lld: error: cannot open crtn.o: No such file or directory
+ clang-16: error: linker command failed with exit code 1 (use -v to see invocation)
+ ninja: build stopped: subcommand failed.
+
+Upstream-Status: Pending
+Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
+---
+ clang/lib/Driver/ToolChains/Gnu.cpp | 2 +-
+ clang/lib/Driver/ToolChains/Linux.cpp | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/clang/lib/Driver/ToolChains/Gnu.cpp b/clang/lib/Driver/ToolChains/Gnu.cpp
+index 80fd8058bd98..37cb6cfdf2da 100644
+--- a/clang/lib/Driver/ToolChains/Gnu.cpp
++++ b/clang/lib/Driver/ToolChains/Gnu.cpp
+@@ -2346,7 +2346,7 @@ void Generic_GCC::GCCInstallationDetector::AddDefaultGCCPrefixes(
+ static const char *const AArch64beLibDirs[] = {"/lib"};
+ static const char *const AArch64beTriples[] = {"aarch64_be-none-linux-gnu"};
+
+- static const char *const ARMLibDirs[] = {"/lib"};
++ static const char *const ARMLibDirs[] = {"/lib", "/lib32"};
+ static const char *const ARMTriples[] = {"arm-linux-gnueabi"};
+ static const char *const ARMHFTriples[] = {"arm-linux-gnueabihf",
+ "armv7hl-redhat-linux-gnueabi",
+diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp
+index 9fed904c05c2..5bb66c9faa1f 100644
+--- a/clang/lib/Driver/ToolChains/Linux.cpp
++++ b/clang/lib/Driver/ToolChains/Linux.cpp
+@@ -198,6 +198,7 @@ static StringRef getOSLibDir(const llvm::Triple &Triple, const ArgList &Args) {
+ // reasoning about oslibdir spellings with the lib dir spellings in the
+ // GCCInstallationDetector, but that is a more significant refactoring.
+ if (Triple.getArch() == llvm::Triple::x86 || Triple.isPPC32() ||
++ Triple.getArch() == llvm::Triple::arm || Triple.getArch() == llvm::Triple::thumb ||
+ Triple.getArch() == llvm::Triple::sparc)
+ return "lib32";
+
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0025-clang-llvm-Add-OE-specific-ABI-triple-for-N32-ABI.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0025-clang-llvm-Add-OE-specific-ABI-triple-for-N32-ABI.patch
new file mode 100644
index 00000000..c93a9ec7
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0025-clang-llvm-Add-OE-specific-ABI-triple-for-N32-ABI.patch
@@ -0,0 +1,78 @@
+From 7023d17f81a472e72a5739e007b9e7148d105137 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sat, 3 Feb 2024 16:47:10 -0800
+Subject: [PATCH] clang/llvm: Add OE specific ABI triple for N32 ABI
+
+Its gnun32 when using OE
+
+Upstream-Status: Inappropriate [OE-Specific]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ clang/lib/Driver/ToolChains/Gnu.cpp | 1 +
+ clang/lib/Driver/ToolChains/Linux.cpp | 4 ++--
+ llvm/lib/TargetParser/Triple.cpp | 4 +++-
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/clang/lib/Driver/ToolChains/Gnu.cpp b/clang/lib/Driver/ToolChains/Gnu.cpp
+index 37cb6cfdf2da..bcd7d345c25a 100644
+--- a/clang/lib/Driver/ToolChains/Gnu.cpp
++++ b/clang/lib/Driver/ToolChains/Gnu.cpp
+@@ -2415,6 +2415,7 @@ void Generic_GCC::GCCInstallationDetector::AddDefaultGCCPrefixes(
+
+ static const char *const MIPSN32LibDirs[] = {"/lib32"};
+ static const char *const MIPSN32Triples[] = {"mips64-linux-gnuabin32",
++ "mips64-linux-gnun32",
+ "mipsisa64r6-linux-gnuabin32"};
+ static const char *const MIPSN32ELLibDirs[] = {"/lib32"};
+ static const char *const MIPSN32ELTriples[] = {
+diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp
+index 5bb66c9faa1f..c6d6e20dbc4d 100644
+--- a/clang/lib/Driver/ToolChains/Linux.cpp
++++ b/clang/lib/Driver/ToolChains/Linux.cpp
+@@ -138,7 +138,7 @@ std::string Linux::getMultiarchTriple(const Driver &D,
+ return IsMipsR6 ? "mipsisa32r6el-linux-gnu" : "mipsel-linux-gnu";
+ case llvm::Triple::mips64: {
+ std::string MT = std::string(IsMipsR6 ? "mipsisa64r6" : "mips64") +
+- "-linux-" + (IsMipsN32Abi ? "gnuabin32" : "gnuabi64");
++ "-linux-" + (IsMipsN32Abi ? "gnun32" : "gnu");
+ if (D.getVFS().exists(concat(SysRoot, "/lib", MT)))
+ return MT;
+ if (D.getVFS().exists(concat(SysRoot, "/lib/mips64-linux-gnu")))
+@@ -147,7 +147,7 @@ std::string Linux::getMultiarchTriple(const Driver &D,
+ }
+ case llvm::Triple::mips64el: {
+ std::string MT = std::string(IsMipsR6 ? "mipsisa64r6el" : "mips64el") +
+- "-linux-" + (IsMipsN32Abi ? "gnuabin32" : "gnuabi64");
++ "-linux-" + (IsMipsN32Abi ? "gnun32" : "gnu");
+ if (D.getVFS().exists(concat(SysRoot, "/lib", MT)))
+ return MT;
+ if (D.getVFS().exists(concat(SysRoot, "/lib/mips64el-linux-gnu")))
+diff --git a/llvm/lib/TargetParser/Triple.cpp b/llvm/lib/TargetParser/Triple.cpp
+index 86b74451ec0d..d94b7d44d11a 100644
+--- a/llvm/lib/TargetParser/Triple.cpp
++++ b/llvm/lib/TargetParser/Triple.cpp
+@@ -358,7 +358,7 @@ StringRef Triple::getEnvironmentTypeName(EnvironmentType Kind) {
+ case GNU: return "gnu";
+ case GNUT64: return "gnut64";
+ case GNUABI64: return "gnuabi64";
+- case GNUABIN32: return "gnuabin32";
++ case GNUABIN32: return "gnun32";
+ case GNUEABI: return "gnueabi";
+ case GNUEABIT64: return "gnueabit64";
+ case GNUEABIHF: return "gnueabihf";
+@@ -762,6 +762,7 @@ static Triple::EnvironmentType parseEnvironment(StringRef EnvironmentName) {
+ .StartsWith("eabihf", Triple::EABIHF)
+ .StartsWith("eabi", Triple::EABI)
+ .StartsWith("gnuabin32", Triple::GNUABIN32)
++ .StartsWith("gnun32", Triple::GNUABIN32)
+ .StartsWith("gnuabi64", Triple::GNUABI64)
+ .StartsWith("gnueabihft64", Triple::GNUEABIHFT64)
+ .StartsWith("gnueabihf", Triple::GNUEABIHF)
+@@ -1087,6 +1088,7 @@ Triple::Triple(std::string &&Str) : Data(std::move(Str)) {
+ Environment =
+ StringSwitch<Triple::EnvironmentType>(Components[0])
+ .StartsWith("mipsn32", Triple::GNUABIN32)
++ .StartsWith("mips64-n32", Triple::GNUABIN32)
+ .StartsWith("mips64", Triple::GNUABI64)
+ .StartsWith("mipsisa64", Triple::GNUABI64)
+ .StartsWith("mipsisa32", Triple::GNU)
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0026-llvm-Add-libunwind.pc.in-and-llvm-config-scripts.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0026-llvm-Add-libunwind.pc.in-and-llvm-config-scripts.patch
new file mode 100644
index 00000000..72ffdc6c
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0026-llvm-Add-libunwind.pc.in-and-llvm-config-scripts.patch
@@ -0,0 +1,54 @@
+From 17a1a4919c0ff554fc30bbb85a63b9d2a1164324 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Tue, 14 May 2024 22:04:43 -0700
+Subject: [PATCH] llvm: Add libunwind.pc.in and llvm-config scripts
+
+These are added by OE project
+
+Upstream-Status: Inappropriate [ OE-Specific ]
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
+---
+ libunwind/libunwind.pc.in | 9 ++++++
+ llvm/tools/llvm-config/llvm-config | 52 ++++++++++++++++++++++++++++++
+ 2 files changed, 61 insertions(+)
+ create mode 100644 libunwind/libunwind.pc.in
+ create mode 100644 llvm/tools/llvm-config/llvm-config
+
+diff --git a/libunwind/libunwind.pc.in b/libunwind/libunwind.pc.in
+new file mode 100644
+index 000000000000..a93d676604f9
+--- /dev/null
++++ b/libunwind/libunwind.pc.in
+@@ -0,0 +1,9 @@
++prefix=/usr
++exec_prefix=/usr
++libdir=@LIBDIR@
++includedir=/usr/include
++
++Name: libunwind
++Description: libunwind base library
++Version: @VERSION@
++Libs: -lunwind
+diff --git a/llvm/tools/llvm-config/llvm-config b/llvm/tools/llvm-config/llvm-config
+new file mode 100644
+index 000000000000..6a0dd54b8eab
+--- /dev/null
++++ b/llvm/tools/llvm-config/llvm-config
+@@ -0,0 +1,15 @@
++#!/bin/bash
++#
++# The llvm-config wrapper will act as a pure pass-through to the native llvm-config
++# while preserving Yocto-specific environment variables used for alternate executable
++# and library path resolution.
++#
++SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
++NEXT_LLVM_CONFIG="@LLVM_CONFIG_PATH@"
++export YOCTO_ALTERNATE_EXE_PATH="${YOCTO_ALTERNATE_EXE_PATH:="$(readlink -f "$SCRIPT_DIR/../llvm-config")"}"
++if [ -d "$(readlink -f "$SCRIPT_DIR/../../lib64")" ]; then
++ export YOCTO_ALTERNATE_LIBDIR="${YOCTO_ALTERNATE_LIBDIR:="/lib64"}"
++else
++ export YOCTO_ALTERNATE_LIBDIR="${YOCTO_ALTERNATE_LIBDIR:="/lib"}"
++fi
++exec "$NEXT_LLVM_CONFIG" "$@"
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0027-scan-build-py-respect-LLVM_LIBDIR_SUFFIX-like-other-.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0027-scan-build-py-respect-LLVM_LIBDIR_SUFFIX-like-other-.patch
new file mode 100644
index 00000000..934d5adc
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0027-scan-build-py-respect-LLVM_LIBDIR_SUFFIX-like-other-.patch
@@ -0,0 +1,89 @@
+From a2171be64a181e0b263fc8ec31a760193651203c Mon Sep 17 00:00:00 2001
+From: Martin Jansa <martin.jansa@gmail.com>
+Date: Fri, 13 Sep 2024 13:38:08 +0200
+Subject: [PATCH] scan-build-py: respect LLVM_LIBDIR_SUFFIX like other tools do
+
+* other libraries are installed in 'lib64' or 'lib32' based on
+ LLVM_LIBDIR_SUFFIX value, but libscanbuild files were always
+ installed in 'lib'
+
+Upstream-Status: Submitted [https://github.com/llvm/llvm-project/pull/108549]
+
+Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
+---
+ clang/tools/scan-build-py/CMakeLists.txt | 26 ++++++++++++------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+Index: llvm-project-22.1.2.src/clang/tools/scan-build-py/CMakeLists.txt
+===================================================================
+--- llvm-project-22.1.2.src.orig/clang/tools/scan-build-py/CMakeLists.txt
++++ llvm-project-22.1.2.src/clang/tools/scan-build-py/CMakeLists.txt
+@@ -80,52 +80,52 @@ if(CLANG_INSTALL_SCANBUILDPY)
+ endforeach()
+
+ foreach(lib ${LibScanbuild})
+- add_custom_command(OUTPUT ${CMAKE_BINARY_DIR}/lib/libscanbuild/${lib}
++ add_custom_command(OUTPUT ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libscanbuild/${lib}
+ COMMAND ${CMAKE_COMMAND} -E make_directory
+ ${CMAKE_BINARY_DIR}/lib
+ COMMAND ${CMAKE_COMMAND} -E make_directory
+- ${CMAKE_BINARY_DIR}/lib/libscanbuild
++ ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libscanbuild
+ COMMAND ${CMAKE_COMMAND} -E copy
+ ${CMAKE_CURRENT_SOURCE_DIR}/lib/libscanbuild/${lib}
+- ${CMAKE_BINARY_DIR}/lib/libscanbuild/
++ ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libscanbuild/
+ DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/lib/libscanbuild/${lib})
+- list(APPEND Depends ${CMAKE_BINARY_DIR}/lib/libscanbuild/${lib})
++ list(APPEND Depends ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libscanbuild/${lib})
+ install(FILES lib/libscanbuild/${lib}
+- DESTINATION lib/libscanbuild
++ DESTINATION lib${LLVM_LIBDIR_SUFFIX}/libscanbuild
+ COMPONENT scan-build-py)
+ endforeach()
+
+ foreach(resource ${LibScanbuildResources})
+- add_custom_command(OUTPUT ${CMAKE_BINARY_DIR}/lib/libscanbuild/resources/${resource}
++ add_custom_command(OUTPUT ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libscanbuild/resources/${resource}
+ COMMAND ${CMAKE_COMMAND} -E make_directory
+ ${CMAKE_BINARY_DIR}/lib
+ COMMAND ${CMAKE_COMMAND} -E make_directory
+- ${CMAKE_BINARY_DIR}/lib/libscanbuild
++ ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libscanbuild
+ COMMAND ${CMAKE_COMMAND} -E make_directory
+- ${CMAKE_BINARY_DIR}/lib/libscanbuild/resources
++ ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libscanbuild/resources
+ COMMAND ${CMAKE_COMMAND} -E copy
+ ${CMAKE_CURRENT_SOURCE_DIR}/lib/libscanbuild/resources/${resource}
+- ${CMAKE_BINARY_DIR}/lib/libscanbuild/resources
++ ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libscanbuild/resources
+ DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/lib/libscanbuild/resources/${resource})
+- list(APPEND Depends ${CMAKE_BINARY_DIR}/lib/libscanbuild/resources/${resource})
++ list(APPEND Depends ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libscanbuild/resources/${resource})
+ install(FILES lib/libscanbuild/resources/${resource}
+- DESTINATION lib/libscanbuild/resources
++ DESTINATION lib${LLVM_LIBDIR_SUFFIX}/libscanbuild/resources
+ COMPONENT scan-build-py)
+ endforeach()
+
+ foreach(lib ${LibEar})
+- add_custom_command(OUTPUT ${CMAKE_BINARY_DIR}/lib/libear/${lib}
++ add_custom_command(OUTPUT ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libear/${lib}
+ COMMAND ${CMAKE_COMMAND} -E make_directory
+ ${CMAKE_BINARY_DIR}/lib
+ COMMAND ${CMAKE_COMMAND} -E make_directory
+- ${CMAKE_BINARY_DIR}/lib/libear
++ ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libear
+ COMMAND ${CMAKE_COMMAND} -E copy
+ ${CMAKE_CURRENT_SOURCE_DIR}/lib/libear/${lib}
+- ${CMAKE_BINARY_DIR}/lib/libear/
++ ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libear/
+ DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/lib/libear/${lib})
+- list(APPEND Depends ${CMAKE_BINARY_DIR}/lib/libear/${lib})
++ list(APPEND Depends ${CMAKE_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/libear/${lib})
+ install(FILES lib/libear/${lib}
+- DESTINATION lib/libear
++ DESTINATION lib${LLVM_LIBDIR_SUFFIX}/libear
+ COMPONENT scan-build-py)
+ endforeach()
+
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0028-compiler-rt-Do-not-pass-target-to-clang-compiler.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0028-compiler-rt-Do-not-pass-target-to-clang-compiler.patch
new file mode 100644
index 00000000..fe24fe05
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0028-compiler-rt-Do-not-pass-target-to-clang-compiler.patch
@@ -0,0 +1,29 @@
+From 6b1f360c66b60c4bb639057590a8b2162d3bcf6b Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Thu, 13 Mar 2025 00:30:38 -0700
+Subject: [PATCH] compiler-rt: Do not pass --target to clang compiler
+
+In OE we use <tuple>-clang and <tuple>-clang++ which
+should resolve the --target correctly.
+
+Upstream-Status: Inappropriate [ OE-Specific ]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ compiler-rt/lib/fuzzer/CMakeLists.txt | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/compiler-rt/lib/fuzzer/CMakeLists.txt b/compiler-rt/lib/fuzzer/CMakeLists.txt
+index a57e2fe46245..2928ed2ab6d5 100644
+--- a/compiler-rt/lib/fuzzer/CMakeLists.txt
++++ b/compiler-rt/lib/fuzzer/CMakeLists.txt
+@@ -140,10 +140,6 @@ if(OS_NAME MATCHES "Android|Linux|Fuchsia" AND
+ COMPILER_RT_LIBCXXABI_PATH)
+ macro(partially_link_libcxx name dir arch)
+ get_target_flags_for_arch(${arch} target_cflags)
+- if(CMAKE_CXX_COMPILER_ID MATCHES Clang)
+- get_compiler_rt_target(${arch} target)
+- set(target_cflags --target=${target} ${target_cflags})
+- endif()
+ set(cxx_${arch}_merge_dir "${CMAKE_CURRENT_BINARY_DIR}/cxx_${arch}_merge.dir")
+ file(MAKE_DIRECTORY ${cxx_${arch}_merge_dir})
+ add_custom_command(TARGET clang_rt.${name}-${arch} POST_BUILD
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0029-AsmMatcherEmitter-sort-ClassInfo-lists-by-name-as-we.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0029-AsmMatcherEmitter-sort-ClassInfo-lists-by-name-as-we.patch
new file mode 100644
index 00000000..413bc3f2
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0029-AsmMatcherEmitter-sort-ClassInfo-lists-by-name-as-we.patch
@@ -0,0 +1,31 @@
+From 281cd05306cbfa5744e4a1f3ebf5c745324efe7a Mon Sep 17 00:00:00 2001
+From: Alexander Kanavin <alex.kanavin@gmail.com>
+Date: Fri, 27 Nov 2020 10:11:08 +0000
+Subject: [PATCH] AsmMatcherEmitter: sort ClassInfo lists by name as well
+
+Otherwise, there are instances which are identical in
+every other field and therefore sort non-reproducibly
+(which breaks binary and source reproducibiliy).
+
+Upstream-Status: Submitted [https://reviews.llvm.org/D97477]
+Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
+---
+ llvm/utils/TableGen/AsmMatcherEmitter.cpp | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/llvm/utils/TableGen/AsmMatcherEmitter.cpp b/llvm/utils/TableGen/AsmMatcherEmitter.cpp
+index e6085af5aa91..b0180638c754 100644
+--- a/llvm/utils/TableGen/AsmMatcherEmitter.cpp
++++ b/llvm/utils/TableGen/AsmMatcherEmitter.cpp
+@@ -384,7 +384,10 @@ public:
+ // name of a class shouldn't be significant. However, some of the backends
+ // accidentally rely on this behaviour, so it will have to stay like this
+ // until they are fixed.
+- return ValueName < RHS.ValueName;
++ if (ValueName != RHS.ValueName)
++ return ValueName < RHS.ValueName;
++ // All else being equal, we should sort by name, for source and binary reproducibility
++ return Name < RHS.Name;
+ }
+ };
+
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0030-llvm-config-remove-LLVM_LDFLAGS-from-ldflags-output.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0030-llvm-config-remove-LLVM_LDFLAGS-from-ldflags-output.patch
new file mode 100644
index 00000000..e0597488
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0030-llvm-config-remove-LLVM_LDFLAGS-from-ldflags-output.patch
@@ -0,0 +1,32 @@
+From cbc2595eed96fa7de77162e4c7b99681579d01ef Mon Sep 17 00:00:00 2001
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Date: Wed, 2 Apr 2025 17:05:17 +0300
+Subject: [PATCH] llvm-config: remove LLVM_LDFLAGS from --ldflags output
+
+On native OE builds the LLVM_LDFLAGS gets a lot of extra flags which may
+depend on exact build dir and as such be inappropriate to binaries
+shared through sstate-cache. It is not possible to override this
+behaviour in llvm-config since crossscripts are not being used for
+native builds. As a OE-specific modification ignore LLVM_LDFLAGS for
+native builds.
+
+Upstream-Status: Inappropriate [OE-Specific]
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ llvm/tools/llvm-config/llvm-config.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/llvm/tools/llvm-config/llvm-config.cpp b/llvm/tools/llvm-config/llvm-config.cpp
+index 0a3f51ae2b83..5c95a1f3ff24 100644
+--- a/llvm/tools/llvm-config/llvm-config.cpp
++++ b/llvm/tools/llvm-config/llvm-config.cpp
+@@ -576,7 +576,7 @@ int main(int argc, char **argv) {
+ HostTriple.isWindowsMSVCEnvironment() ? "-LIBPATH:" : "-L";
+ LDFlags += ActiveLibDir;
+ MaybePrintQuoted(LDFlags);
+- OS << ' ' << LLVM_LDFLAGS << '\n';
++ OS << '\n';
+ } else if (Arg == "--system-libs") {
+ PrintSystemLibs = true;
+ } else if (Arg == "--libs") {
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0031-compiler-rt-Exclude-sync_fetch_and_-for-any-pre-ARMv.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0031-compiler-rt-Exclude-sync_fetch_and_-for-any-pre-ARMv.patch
new file mode 100644
index 00000000..52bdeaf9
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0031-compiler-rt-Exclude-sync_fetch_and_-for-any-pre-ARMv.patch
@@ -0,0 +1,64 @@
+From 3a486a17b697c65cdc7d2c17d9e14f2bfc2be911 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sat, 10 May 2025 14:03:12 -0700
+Subject: [PATCH] compiler-rt: Exclude sync_fetch_and_* for any pre-ARMv6
+ targets
+
+Sometimes builds may happen where ABI is not indidated by host_triple
+e.g. on Yocto the compiler used is called arm-poky-linux-gnueabi-clang
+for all arm32 cross compilers, it passed the ABI flags on cmdline in
+addition. e.g.
+
+-march=armv5te -mfloat-abi=soft
+or
+-march=armv7-a -mfloat-abi=hard
+
+compiler-rt's makery tries to add arm to COMPILER_RT_SUPPORTED_ARCH
+deducing it from triple name.
+
+which ends up choosing `arm` as one of compiler-rt arch to build for.
+This arch is however using armv7+ defaults and then tried to build sync
+builtins using
+
+arm-poky-linux-gnueabi-clang -march=armv5te -mfloat-abi=soft ...
+
+Which does not compile correctly, in such cases it should simply
+remove the sync builtins from list of things to build similar to what
+is done when we use armv4t or armv5t
+
+set(armv4t_SOURCES ${arm_min_SOURCES})
+set(armv5te_SOURCES ${arm_min_SOURCES})
+
+This lets compiler-rt build for arm architectures without depending
+upong compiler triple, but instead of poking the compiler for what
+it is building for
+
+Upstream-Status: Submitted [https://github.com/llvm/llvm-project/pull/139411]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ compiler-rt/lib/builtins/CMakeLists.txt | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/compiler-rt/lib/builtins/CMakeLists.txt b/compiler-rt/lib/builtins/CMakeLists.txt
+index b3a44ea3c3b3..4a328ab0ca26 100644
+--- a/compiler-rt/lib/builtins/CMakeLists.txt
++++ b/compiler-rt/lib/builtins/CMakeLists.txt
+@@ -975,6 +975,18 @@ else ()
+ ${TARGET_${arch}_CFLAGS})
+ list(JOIN CMAKE_REQUIRED_FLAGS " " CMAKE_REQUIRED_FLAGS)
+ message(STATUS "Performing additional configure checks with target flags: ${CMAKE_REQUIRED_FLAGS}")
++ # For ARM archs, exclude any sync builtins if dmb or mcr p15, #0, r0, c7, c10, #5
++ # is not supported
++ if (${arch} MATCHES "^(arm|armhf)$")
++ try_compile_only(COMPILER_RT_HAS_${arch}_SYNC
++ SOURCE "#if __ARM_ARCH < 6
++ #error DMB is only supported on ARMv6+ !
++ #endif
++ int main(void) { return 0; }")
++ if(NOT COMPILER_RT_HAS_${arch}_SYNC)
++ list(REMOVE_ITEM ${arch}_SOURCES ${arm_sync_SOURCES})
++ endif()
++ endif()
+ # For ARM archs, exclude any VFP builtins if VFP is not supported
+ if (${arch} MATCHES "^(arm|armhf|armv7|armv7s|armv7k|armv7m|armv7em|armv8m.main|armv8.1m.main)$")
+ check_compile_definition(__ARM_FP "${CMAKE_C_FLAGS}" COMPILER_RT_HAS_${arch}_VFP)
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0032-compiler-rt-Hardcode-uptr-sptr-typedefs-on-Mips-Linu.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0032-compiler-rt-Hardcode-uptr-sptr-typedefs-on-Mips-Linu.patch
new file mode 100644
index 00000000..b0aae545
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0032-compiler-rt-Hardcode-uptr-sptr-typedefs-on-Mips-Linu.patch
@@ -0,0 +1,35 @@
+From b71c398a1b10b29886c2db2a920f476fec6f7de2 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Thu, 22 May 2025 21:50:45 -0700
+Subject: [PATCH] [compiler-rt] Hardcode uptr/sptr typedefs on Mips/Linux
+
+Sanitizer build on Mips/Linux faills to build due to assertion errors
+mismatched definitions. This is due to inconsistent definitions of
+`uptr` of either `unsigned long` or `unsigned int` in compiler-rt. This
+is caused by clang defining
+
+__UINTPTR_TYPE__ long unsigned int where as gcc defines it as
+unsigned int
+
+As a workaround, this hardcodes `uptr`/`sptr` in compiler-rt to
+`unsigned int`/`int` on Linux Mips, matching gcc.
+
+Upstream-Status: Submitted [https://github.com/llvm/llvm-project/pull/141201]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ compiler-rt/lib/sanitizer_common/sanitizer_internal_defs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_internal_defs.h b/compiler-rt/lib/sanitizer_common/sanitizer_internal_defs.h
+index c719e2a8ef60..60b997e653c4 100644
+--- a/compiler-rt/lib/sanitizer_common/sanitizer_internal_defs.h
++++ b/compiler-rt/lib/sanitizer_common/sanitizer_internal_defs.h
+@@ -139,7 +139,7 @@
+ namespace __sanitizer {
+
+ #if defined(__UINTPTR_TYPE__)
+-# if defined(__arm__) && defined(__linux__)
++# if (defined(__arm__) || _ABIO32 == 1) && defined(__linux__)
+ // Linux Arm headers redefine __UINTPTR_TYPE__ and disagree with clang/gcc.
+ typedef unsigned int uptr;
+ typedef int sptr;
--git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0034-Revert-libc-Remap-headers-in-the-debug-info-when-bui.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0034-Revert-libc-Remap-headers-in-the-debug-info-when-bui.patch
new file mode 100644
index 00000000..57003dcf
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0034-Revert-libc-Remap-headers-in-the-debug-info-when-bui.patch
@@ -0,0 +1,36 @@
+From 9ace97c0c2df52d823c9d5345cca0251bf2ccf16 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sun, 27 Jul 2025 19:12:13 -0700
+Subject: [PATCH] Revert "[libc++] Remap headers in the debug info when
+ building the library (#143004)"
+
+This reverts commit 4d50b405f1585ce172f87cb5f8daf3c1b4145215.
+
+There is a discussion on this issue on [1]
+I have discussed this on PR and also with developer on IRC, I am
+hoping that our position will be considered by 22.x release
+
+[1] https://github.com/llvm/llvm-project/pull/143004/
+
+Upstream-Status: Inappropriate [ OE-Specific ]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ libcxx/include/CMakeLists.txt | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/libcxx/include/CMakeLists.txt b/libcxx/include/CMakeLists.txt
+index 787cfffa5019..d73bcd852a1e 100644
+--- a/libcxx/include/CMakeLists.txt
++++ b/libcxx/include/CMakeLists.txt
+@@ -1718,11 +1718,6 @@ add_dependencies(cxx-headers generate-cxx-headers)
+ target_include_directories(cxx-headers INTERFACE ${LIBCXX_GENERATED_INCLUDE_TARGET_DIR}
+ ${LIBCXX_GENERATED_INCLUDE_DIR})
+
+-# Make sure to map the generated include directory back to libc++'s actual source directory when generating
+-# debug information. Otherwise, the debug information will refer to generated headers which are created during
+-# the build and generally not persistent.
+-target_add_compile_flags_if_supported(cxx-headers INTERFACE "-fdebug-prefix-map=${LIBCXX_GENERATED_INCLUDE_DIR}=${LIBCXX_SOURCE_DIR}/include")
+-
+ if (LIBCXX_INSTALL_HEADERS)
+ foreach(file ${files})
+ get_filename_component(dir ${file} DIRECTORY)
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0035-Prevent-revisiting-block-when-searching-for-noreturn.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0035-Prevent-revisiting-block-when-searching-for-noreturn.patch
new file mode 100644
index 00000000..6021f736
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0035-Prevent-revisiting-block-when-searching-for-noreturn.patch
@@ -0,0 +1,41 @@
+From 051b3bfa1e0e5cfed4a02318e330b38b0090cc49 Mon Sep 17 00:00:00 2001
+From: Serge Pavlov <sepavloff@gmail.com>
+Date: Fri, 25 Jul 2025 13:35:19 +0700
+Subject: [PATCH] Prevent revisiting block when searching for noreturn vars
+
+When searching for noreturn variable initializations, do not visit CFG
+blocks that are already visited, it prevents hanging the analysis.
+
+It must fix https://github.com/llvm/llvm-project/issues/150336.
+
+Upstream-Status: Submitted [https://github.com/llvm/llvm-project/pull/150582]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ clang/test/SemaCXX/noreturn-vars.cpp | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/clang/test/SemaCXX/noreturn-vars.cpp b/clang/test/SemaCXX/noreturn-vars.cpp
+index ca65fcf5ca31..1bf074149f04 100644
+--- a/clang/test/SemaCXX/noreturn-vars.cpp
++++ b/clang/test/SemaCXX/noreturn-vars.cpp
+@@ -225,3 +225,20 @@ extern void abc_02(func_type *);
+ abc_02(&func_ptr);
+ func_ptr();
+ } // expected-warning {{function declared 'noreturn' should not return}}
++
++namespace Issue150336 {
++void free(void *);
++typedef void (*sel_freefunc)(void *);
++struct gmx_ana_selmethod_t {
++ sel_freefunc free;
++ int nparams;
++ int *param;
++};
++void gmx_selelem_free_method(struct gmx_ana_selmethod_t* method, void* mdata) {
++ sel_freefunc free_func = 0;
++ for (int i = 0; i < method->nparams; ++i)
++ free(&method->param[i]);
++ if (mdata && free_func)
++ free_func(mdata);
++}
++}
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0036-Don-t-expose-LLVM_HAVE_OPT_VIEWER_MODULES-externally.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0036-Don-t-expose-LLVM_HAVE_OPT_VIEWER_MODULES-externally.patch
new file mode 100644
index 00000000..0cdb2ad6
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0036-Don-t-expose-LLVM_HAVE_OPT_VIEWER_MODULES-externally.patch
@@ -0,0 +1,27 @@
+From 53da129f7986c5bd310f4f4a8236987df7e073c6 Mon Sep 17 00:00:00 2001
+From: Ross Burton <ross.burton@arm.com>
+Date: Mon, 29 Sep 2025 14:44:05 +0100
+Subject: [PATCH] Don't expose LLVM_HAVE_OPT_VIEWER_MODULES externally
+
+This variable states whether at build-time some python modules were present,
+which is meaningless and simply introduces non-deterministic behaviour.
+
+Upstream-Status: Pending [https://github.com/llvm/llvm-project/issues/161199]
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ llvm/cmake/modules/LLVMConfig.cmake.in | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/llvm/cmake/modules/LLVMConfig.cmake.in b/llvm/cmake/modules/LLVMConfig.cmake.in
+index 70c807abea98..5603c9215332 100644
+--- a/llvm/cmake/modules/LLVMConfig.cmake.in
++++ b/llvm/cmake/modules/LLVMConfig.cmake.in
+@@ -137,7 +137,6 @@ set(LLVM_DEFINITIONS "@LLVM_DEFINITIONS@")
+ set(LLVM_BINARY_DIR "@LLVM_CONFIG_BINARY_DIR@")
+ set(LLVM_CMAKE_DIR "@LLVM_CONFIG_CMAKE_DIR@")
+ set(LLVM_TOOLS_BINARY_DIR "@LLVM_CONFIG_TOOLS_BINARY_DIR@")
+-set(LLVM_HAVE_OPT_VIEWER_MODULES @LLVM_HAVE_OPT_VIEWER_MODULES@)
+ set(LLVM_CONFIGURATION_TYPES @CMAKE_CONFIGURATION_TYPES@)
+ set(LLVM_ENABLE_SHARED_LIBS @BUILD_SHARED_LIBS@)
+
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0037-clang-Only-build-clang-tblgen-if-it-is-actually-need.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0037-clang-Only-build-clang-tblgen-if-it-is-actually-need.patch
new file mode 100644
index 00000000..5efe043e
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0037-clang-Only-build-clang-tblgen-if-it-is-actually-need.patch
@@ -0,0 +1,32 @@
+From de58b9bbc8c52299ff22c4f0ab21e3878d411669 Mon Sep 17 00:00:00 2001
+From: Ross Burton <ross.burton@arm.com>
+Date: Sat, 11 Oct 2025 16:01:50 -0700
+Subject: [PATCH] [clang] Only build clang-tblgen if it is actually needed
+
+It's possible to build clang with an existing clang-tblgen (common when
+cross-compiling, for instance) by setting CLANG_TABLEGEN_EXE. If this
+is the case there's no need to build it, as it won't be used.
+
+Upstream-Status: Submitted [https://github.com/llvm/llvm-project/pull/161952]
+
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ clang/CMakeLists.txt | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/clang/CMakeLists.txt b/clang/CMakeLists.txt
+index e4cb1a359620..b650b3b986f4 100644
+--- a/clang/CMakeLists.txt
++++ b/clang/CMakeLists.txt
+@@ -479,7 +479,9 @@ option(CLANG_ENABLE_HLSL "Include HLSL build products" Off)
+ # While HLSL support is experimental this should stay hidden.
+ mark_as_advanced(CLANG_ENABLE_HLSL)
+
+-add_subdirectory(utils/TableGen)
++if (NOT DEFINED CLANG_TABLEGEN_EXE OR CLANG_INCLUDE_TESTS)
++ add_subdirectory(utils/TableGen)
++endif()
+
+ # Export CLANG_TABLEGEN_EXE for use by flang docs.
+ set(CLANG_TABLEGEN_EXE "${CLANG_TABLEGEN_EXE}" CACHE INTERNAL "")
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0038-llvm-libgcc-Fix-symlink-path-for-libcc-when-LLVM_ENA.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0038-llvm-libgcc-Fix-symlink-path-for-libcc-when-LLVM_ENA.patch
new file mode 100644
index 00000000..583e91e4
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0038-llvm-libgcc-Fix-symlink-path-for-libcc-when-LLVM_ENA.patch
@@ -0,0 +1,71 @@
+From bca77d818187e68989dfa9e386b38632b76a477e Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Tue, 28 Oct 2025 15:44:49 -0700
+Subject: [PATCH] llvm-libgcc: Fix symlink path for libcc when
+ LLVM_ENABLE_PER_TARGET_RUNTIME_DIR is unset
+
+current logic fails when LLVM_ENABLE_PER_TARGET_RUNTIME_DIR = OFF
+and it ends up with symlinks e.g.
+
+libgcc.a -> ..//usr/lib/clang/21.1.4/lib/linux/libclang_rt.builtins.a
+
+the real library is at
+../lib/clang/21.1.4/lib/linux/libclang_rt.builtins-aarch64.a
+
+The relative path is incorrect and its missing to add -arch suffix
+as well.
+
+So we make checks a bit more explicit to cover this case.
+
+The symlink for libgcc_so.1.0 is made to point to libunwind.so
+which is functionally correct but it fails some linux distro packaging
+complain because libunwind.so is made part of -dev package but
+libgcc_so.1.0 ends up in the real package, and creates an unneeded
+package -> dev dependency
+
+create the symlink to point to libunwind.so.1 instead then the boundaries
+of packaging are not crossed and all is well.
+
+Upstream-Status: Submitted [https://github.com/llvm/llvm-project/pull/165487]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ llvm-libgcc/CMakeLists.txt | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/llvm-libgcc/CMakeLists.txt b/llvm-libgcc/CMakeLists.txt
+index 47208fc19869..54009c1104c3 100644
+--- a/llvm-libgcc/CMakeLists.txt
++++ b/llvm-libgcc/CMakeLists.txt
+@@ -124,11 +124,21 @@ target_link_libraries(unwind_shared PUBLIC
+ #===============================================================================
+
+ get_compiler_rt_install_dir(${COMPILER_RT_DEFAULT_TARGET_ARCH} install_dir_builtins)
++
++# Drop a leading "lib/" if present so we don't duplicate lib/lib
+ string(REGEX REPLACE "^lib/" "" install_dir_builtins "${install_dir_builtins}")
+-string(FIND "${install_dir_builtins}" "clang" install_path_contains_triple)
+-if(install_path_contains_triple EQUAL -1)
++
++# Decide based on the actual CMake option, not on guessing from the path.
++if (NOT LLVM_ENABLE_PER_TARGET_RUNTIME_DIR)
++ # Flat-ish layout, e.g. usr/lib/clang/21.1.4/lib/linux/
++ # Libraries are named libclang_rt.builtins-<arch>.a
+ set(builtins_suffix "-${COMPILER_RT_DEFAULT_TARGET_ARCH}")
++ # Do NOT prepend "../"
+ else()
++ # Per-target layout, e.g.
++ # usr/lib/clang/21.1.4/lib/aarch64-unknown-linux-gnu/
++ # Libraries are just libclang_rt.builtins.a
++ set(builtins_suffix "")
+ string(PREPEND install_dir_builtins "../")
+ endif()
+ set(LLVM_LIBGCC_COMPILER_RT ${install_dir_builtins}/libclang_rt.builtins${builtins_suffix}.a)
+@@ -137,7 +147,7 @@ add_custom_target(llvm-libgcc ALL
+ DEPENDS unwind_shared unwind_static clang_rt.builtins-${COMPILER_RT_DEFAULT_TARGET_ARCH}
+ COMMAND ${CMAKE_COMMAND} -E create_symlink ${LLVM_LIBGCC_COMPILER_RT} libgcc.a
+ COMMAND ${CMAKE_COMMAND} -E create_symlink libunwind.a libgcc_eh.a
+- COMMAND ${CMAKE_COMMAND} -E create_symlink libunwind.so libgcc_s.so.1.0
++ COMMAND ${CMAKE_COMMAND} -E create_symlink libunwind.so.1 libgcc_s.so.1.0
+ COMMAND ${CMAKE_COMMAND} -E create_symlink libgcc_s.so.1.0 libgcc_s.so.1
+ COMMAND ${CMAKE_COMMAND} -E create_symlink libgcc_s.so.1 libgcc_s.so
+ )
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0039-Rename-UNUSED-and-UNKNOWN-elements-of-OffloadArch-enum.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0039-Rename-UNUSED-and-UNKNOWN-elements-of-OffloadArch-enum.patch
new file mode 100644
index 00000000..493948ac
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0039-Rename-UNUSED-and-UNKNOWN-elements-of-OffloadArch-enum.patch
@@ -0,0 +1,274 @@
+From 82f18b02d9fec1bcc225a92251466ffee82f56b5 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Fri, 20 Mar 2026 14:22:17 -0700
+Subject: [PATCH] [Clang] Rename UNUSED and UNKNOWN elements of OffloadArch enum to avoid
+ macro collisions
+
+OffloadArch uses enumerator named `UNUSED` `UNKNOWN`, which are common macro name
+in external codebases (e.g. Mesa defines UNUSED as an attribute helper). If such
+a macro is visible when including clang/Basic/OffloadArch.h, the preprocessor
+expands the token inside the enum and breaks compilation of the installed Clang
+headers.
+
+Rename the enumerator to `Unused` and `Unknown` and update all in-tree references. This is a
+spelling-only change (no behavioral impact) and mirrors the existing approach
+used for SM_32_ to avoid macro clashes.
+
+Upstream-Status: Backport [https://github.com/llvm/llvm-project/commit/5bc3d1966b2d0b300c338d85bb38e356f0d12a8c]
+Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
+
+diff --git a/clang/include/clang/Basic/OffloadArch.h b/clang/include/clang/Basic/OffloadArch.h
+index ea665b1..970487c 100644
+--- a/clang/include/clang/Basic/OffloadArch.h
++++ b/clang/include/clang/Basic/OffloadArch.h
+@@ -16,8 +16,8 @@ class StringRef;
+ namespace clang {
+
+ enum class OffloadArch {
+- UNUSED,
+- UNKNOWN,
++ Unused,
++ Unknown,
+ // TODO: Deprecate and remove GPU architectures older than sm_52.
+ SM_20,
+ SM_21,
+@@ -145,7 +145,7 @@ const char *OffloadArchToString(OffloadArch A);
+ const char *OffloadArchToVirtualArchString(OffloadArch A);
+
+ // Convert a string to an OffloadArch enum value. Returns
+-// OffloadArch::UNKNOWN if the string is not recognized.
++// OffloadArch::Unknown if the string is not recognized.
+ OffloadArch StringToOffloadArch(llvm::StringRef S);
+
+ } // namespace clang
+diff --git a/clang/lib/Basic/Cuda.cpp b/clang/lib/Basic/Cuda.cpp
+index 514fa2f..7884910 100644
+--- a/clang/lib/Basic/Cuda.cpp
++++ b/clang/lib/Basic/Cuda.cpp
+@@ -75,7 +75,7 @@ CudaVersion ToCudaVersion(llvm::VersionTuple Version) {
+ }
+
+ CudaVersion MinVersionForOffloadArch(OffloadArch A) {
+- if (A == OffloadArch::UNKNOWN)
++ if (A == OffloadArch::Unknown)
+ return CudaVersion::UNKNOWN;
+
+ // AMD GPUs do not depend on CUDA versions.
+@@ -141,7 +141,7 @@ CudaVersion MaxVersionForOffloadArch(OffloadArch A) {
+ return CudaVersion::NEW;
+
+ switch (A) {
+- case OffloadArch::UNKNOWN:
++ case OffloadArch::Unknown:
+ return CudaVersion::UNKNOWN;
+ case OffloadArch::SM_20:
+ case OffloadArch::SM_21:
+diff --git a/clang/lib/Basic/OffloadArch.cpp b/clang/lib/Basic/OffloadArch.cpp
+index 05177f1..f3bbe64 100644
+--- a/clang/lib/Basic/OffloadArch.cpp
++++ b/clang/lib/Basic/OffloadArch.cpp
+@@ -17,7 +17,7 @@ struct OffloadArchToStringMap {
+ #define GFX(gpu) {OffloadArch::GFX##gpu, "gfx" #gpu, "compute_amdgcn"}
+ static const OffloadArchToStringMap ArchNames[] = {
+ // clang-format off
+- {OffloadArch::UNUSED, "", ""},
++ {OffloadArch::Unused, "", ""},
+ SM(20), {OffloadArch::SM_21, "sm_21", "compute_20"}, // Fermi
+ SM(30), {OffloadArch::SM_32_, "sm_32", "compute_32"}, SM(35), SM(37), // Kepler
+ SM(50), SM(52), SM(53), // Maxwell
+@@ -132,7 +132,7 @@ OffloadArch StringToOffloadArch(llvm::StringRef S) {
+ return S == Map.ArchName;
+ });
+ if (Result == std::end(ArchNames))
+- return OffloadArch::UNKNOWN;
++ return OffloadArch::Unknown;
+ return Result->Arch;
+ }
+
+diff --git a/clang/lib/Basic/Targets/NVPTX.cpp b/clang/lib/Basic/Targets/NVPTX.cpp
+index 6526eef..9584f8a 100644
+--- a/clang/lib/Basic/Targets/NVPTX.cpp
++++ b/clang/lib/Basic/Targets/NVPTX.cpp
+@@ -64,7 +64,7 @@ NVPTXTargetInfo::NVPTXTargetInfo(const llvm::Triple &Triple,
+ // Define available target features
+ // These must be defined in sorted order!
+ NoAsmVariants = true;
+- GPU = OffloadArch::UNUSED;
++ GPU = OffloadArch::Unused;
+
+ // PTX supports f16 as a fundamental type.
+ HasFastHalfType = true;
+diff --git a/clang/lib/Basic/Targets/NVPTX.h b/clang/lib/Basic/Targets/NVPTX.h
+index 9bd0cc3..eeffb0e 100644
+--- a/clang/lib/Basic/Targets/NVPTX.h
++++ b/clang/lib/Basic/Targets/NVPTX.h
+@@ -87,7 +87,7 @@ public:
+ initFeatureMap(llvm::StringMap<bool> &Features, DiagnosticsEngine &Diags,
+ StringRef CPU,
+ const std::vector<std::string> &FeaturesVec) const override {
+- if (GPU != OffloadArch::UNUSED)
++ if (GPU != OffloadArch::Unused)
+ Features[OffloadArchToString(GPU)] = true;
+ // Only add PTX feature if explicitly requested. Otherwise, let the backend
+ // use the minimum required PTX version for the target SM.
+@@ -146,7 +146,7 @@ public:
+ }
+
+ bool isValidCPUName(StringRef Name) const override {
+- return StringToOffloadArch(Name) != OffloadArch::UNKNOWN;
++ return StringToOffloadArch(Name) != OffloadArch::Unknown;
+ }
+
+ void fillValidCPUList(SmallVectorImpl<StringRef> &Values) const override {
+@@ -157,7 +157,7 @@ public:
+
+ bool setCPU(const std::string &Name) override {
+ GPU = StringToOffloadArch(Name);
+- return GPU != OffloadArch::UNKNOWN;
++ return GPU != OffloadArch::Unknown;
+ }
+
+ void setSupportedOpenCLOpts() override {
+diff --git a/clang/lib/CodeGen/CGOpenMPRuntimeGPU.cpp b/clang/lib/CodeGen/CGOpenMPRuntimeGPU.cpp
+index db0d56d..f78047d 100644
+--- a/clang/lib/CodeGen/CGOpenMPRuntimeGPU.cpp
++++ b/clang/lib/CodeGen/CGOpenMPRuntimeGPU.cpp
+@@ -2266,15 +2266,15 @@ bool CGOpenMPRuntimeGPU::hasAllocateAttributeForGlobalVar(const VarDecl *VD,
+ // Get current OffloadArch and ignore any unknown values
+ static OffloadArch getOffloadArch(CodeGenModule &CGM) {
+ if (!CGM.getTarget().hasFeature("ptx"))
+- return OffloadArch::UNKNOWN;
++ return OffloadArch::Unknown;
+ for (const auto &Feature : CGM.getTarget().getTargetOpts().FeatureMap) {
+ if (Feature.getValue()) {
+ OffloadArch Arch = StringToOffloadArch(Feature.getKey());
+- if (Arch != OffloadArch::UNKNOWN)
++ if (Arch != OffloadArch::Unknown)
+ return Arch;
+ }
+ }
+- return OffloadArch::UNKNOWN;
++ return OffloadArch::Unknown;
+ }
+
+ /// Check to see if target architecture supports unified addressing which is
+@@ -2382,8 +2382,8 @@ void CGOpenMPRuntimeGPU::processRequiresDirective(const OMPRequiresDecl *D) {
+ case OffloadArch::Generic:
+ case OffloadArch::GRANITERAPIDS:
+ case OffloadArch::BMG_G21:
+- case OffloadArch::UNUSED:
+- case OffloadArch::UNKNOWN:
++ case OffloadArch::Unused:
++ case OffloadArch::Unknown:
+ break;
+ case OffloadArch::LAST:
+ llvm_unreachable("Unexpected GPU arch.");
+diff --git a/clang/lib/Driver/Driver.cpp b/clang/lib/Driver/Driver.cpp
+index eb3f9cb..c8894a1 100644
+--- a/clang/lib/Driver/Driver.cpp
++++ b/clang/lib/Driver/Driver.cpp
+@@ -946,7 +946,7 @@ inferOffloadToolchains(Compilation &C, Action::OffloadKind Kind) {
+ llvm::DenseSet<llvm::StringRef> Triples;
+ for (llvm::StringRef Arch : Archs) {
+ OffloadArch ID = StringToOffloadArch(Arch);
+- if (ID == OffloadArch::UNKNOWN)
++ if (ID == OffloadArch::Unknown)
+ ID = StringToOffloadArch(
+ getProcessorFromTargetID(llvm::Triple("amdgcn-amd-amdhsa"), Arch));
+
+@@ -961,12 +961,12 @@ inferOffloadToolchains(Compilation &C, Action::OffloadKind Kind) {
+ return llvm::DenseSet<llvm::StringRef>();
+ }
+ if (Kind == Action::OFK_OpenMP &&
+- (ID == OffloadArch::UNKNOWN || ID == OffloadArch::UNUSED)) {
++ (ID == OffloadArch::Unknown || ID == OffloadArch::Unused)) {
+ C.getDriver().Diag(clang::diag::err_drv_failed_to_deduce_target_from_arch)
+ << Arch;
+ return llvm::DenseSet<llvm::StringRef>();
+ }
+- if (ID == OffloadArch::UNKNOWN || ID == OffloadArch::UNUSED) {
++ if (ID == OffloadArch::Unknown || ID == OffloadArch::Unused) {
+ C.getDriver().Diag(clang::diag::err_drv_offload_bad_gpu_arch)
+ << "offload" << Arch;
+ return llvm::DenseSet<llvm::StringRef>();
+@@ -3305,7 +3305,7 @@ class OffloadingActionBuilder final {
+ bool Relocatable = false;
+
+ /// Default GPU architecture if there's no one specified.
+- OffloadArch DefaultOffloadArch = OffloadArch::UNKNOWN;
++ OffloadArch DefaultOffloadArch = OffloadArch::Unknown;
+
+ /// Compilation unit ID specified by option '-fuse-cuid=' or'-cuid='.
+ const CUIDOptions &CUIDOpts;
+@@ -3407,7 +3407,7 @@ class OffloadingActionBuilder final {
+
+ // If we have a fat binary, add it to the list.
+ if (CudaFatBinary) {
+- AddTopLevel(CudaFatBinary, OffloadArch::UNUSED);
++ AddTopLevel(CudaFatBinary, OffloadArch::Unused);
+ CudaDeviceActions.clear();
+ CudaFatBinary = nullptr;
+ return;
+@@ -4669,12 +4669,12 @@ static StringRef getCanonicalArchString(Compilation &C,
+ OffloadArch Arch =
+ StringToOffloadArch(getProcessorFromTargetID(Triple, ArchStr));
+ if (Triple.isNVPTX() &&
+- (Arch == OffloadArch::UNKNOWN || !IsNVIDIAOffloadArch(Arch))) {
++ (Arch == OffloadArch::Unknown || !IsNVIDIAOffloadArch(Arch))) {
+ C.getDriver().Diag(clang::diag::err_drv_offload_bad_gpu_arch)
+ << "CUDA" << ArchStr;
+ return StringRef();
+ } else if (Triple.isAMDGPU() &&
+- (Arch == OffloadArch::UNKNOWN || !IsAMDOffloadArch(Arch))) {
++ (Arch == OffloadArch::Unknown || !IsAMDOffloadArch(Arch))) {
+ C.getDriver().Diag(clang::diag::err_drv_offload_bad_gpu_arch)
+ << "HIP" << ArchStr;
+ return StringRef();
+diff --git a/clang/lib/Driver/OffloadBundler.cpp b/clang/lib/Driver/OffloadBundler.cpp
+index f69ac41..6d446f2 100644
+--- a/clang/lib/Driver/OffloadBundler.cpp
++++ b/clang/lib/Driver/OffloadBundler.cpp
+@@ -95,7 +95,7 @@ OffloadTargetInfo::OffloadTargetInfo(const StringRef Target,
+ Components.size() == 6 ? Components.back() : "";
+ StringRef TargetId = TargetIdWithFeature.split(':').first;
+ if (!TargetId.empty() &&
+- clang::StringToOffloadArch(TargetId) != clang::OffloadArch::UNKNOWN)
++ clang::StringToOffloadArch(TargetId) != clang::OffloadArch::Unknown)
+ this->TargetID = TargetIdWithFeature;
+ else
+ this->TargetID = "";
+diff --git a/clang/lib/Driver/ToolChains/Cuda.cpp b/clang/lib/Driver/ToolChains/Cuda.cpp
+index 6cc73ff..d97b926 100644
+--- a/clang/lib/Driver/ToolChains/Cuda.cpp
++++ b/clang/lib/Driver/ToolChains/Cuda.cpp
+@@ -319,7 +319,7 @@ void CudaInstallationDetector::AddCudaIncludeArgs(
+
+ void CudaInstallationDetector::CheckCudaVersionSupportsArch(
+ OffloadArch Arch) const {
+- if (Arch == OffloadArch::UNKNOWN || Version == CudaVersion::UNKNOWN ||
++ if (Arch == OffloadArch::Unknown || Version == CudaVersion::UNKNOWN ||
+ ArchsWithBadVersion[(int)Arch])
+ return;
+
+@@ -408,7 +408,7 @@ void NVPTX::Assembler::ConstructJob(Compilation &C, const JobAction &JA,
+
+ // Obtain architecture from the action.
+ OffloadArch gpu_arch = StringToOffloadArch(GPUArchName);
+- assert(gpu_arch != OffloadArch::UNKNOWN &&
++ assert(gpu_arch != OffloadArch::Unknown &&
+ "Device action expected to have an architecture.");
+
+ // Check that our installation's ptxas supports gpu_arch.
+diff --git a/clang/lib/Sema/SemaDeclAttr.cpp b/clang/lib/Sema/SemaDeclAttr.cpp
+index 3f0ea5c..e6d3516 100644
+--- a/clang/lib/Sema/SemaDeclAttr.cpp
++++ b/clang/lib/Sema/SemaDeclAttr.cpp
+@@ -5732,7 +5732,7 @@ Sema::CreateLaunchBoundsAttr(const AttributeCommonInfo &CI, Expr *MaxThreads,
+ if (MaxBlocks) {
+ // '.maxclusterrank' ptx directive requires .target sm_90 or higher.
+ auto SM = getOffloadArch(Context.getTargetInfo());
+- if (SM == OffloadArch::UNKNOWN || SM < OffloadArch::SM_90) {
++ if (SM == OffloadArch::Unknown || SM < OffloadArch::SM_90) {
+ Diag(MaxBlocks->getBeginLoc(), diag::warn_cuda_maxclusterrank_sm_90)
+ << OffloadArchToString(SM) << CI << MaxBlocks->getSourceRange();
+ // Ignore it by setting MaxBlocks to null;
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0040-libcxxabi-declare-__gnu_unwind_frame-in-cxa_personal.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0040-libcxxabi-declare-__gnu_unwind_frame-in-cxa_personal.patch
new file mode 100644
index 00000000..f458fd0c
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0040-libcxxabi-declare-__gnu_unwind_frame-in-cxa_personal.patch
@@ -0,0 +1,33 @@
+From 5dbd0a05f64a43849a7edde95a0e5f2323cd1f9d Mon Sep 17 00:00:00 2001
+From: Khem Raj <khem.raj@oss.qualcomm.com>
+Date: Tue, 31 Mar 2026 19:33:29 -0700
+Subject: [PATCH] libcxxabi: declare __gnu_unwind_frame in cxa_personality
+
+ARM EHABI builds of libcxxabi fail with clang-22+ because
+cxa_personality.cpp calls __gnu_unwind_frame without a visible
+declaration, triggering:
+
+ error: use of undeclared identifier '__gnu_unwind_frame'
+
+Add an extern "C" forward declaration before the EHABI unwind helper
+so the source compiles correctly.
+
+Upstream-Status: Submitted [https://github.com/llvm/llvm-project/pull/189787]
+Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
+---
+ libcxxabi/src/cxa_personality.cpp | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/libcxxabi/src/cxa_personality.cpp b/libcxxabi/src/cxa_personality.cpp
+index 35f4e3807724..ddff277cc7b8 100644
+--- a/libcxxabi/src/cxa_personality.cpp
++++ b/libcxxabi/src/cxa_personality.cpp
+@@ -1116,6 +1116,8 @@ __gxx_personality_seh0(PEXCEPTION_RECORD ms_exc, void *this_frame,
+
+ #else
+
++extern "C" _Unwind_Reason_Code __gnu_unwind_frame(_Unwind_Exception*,
++ _Unwind_Context*);
+ // Helper function to unwind one frame.
+ // ARM EHABI 7.3 and 7.4: If the personality function returns _URC_CONTINUE_UNWIND, the
+ // personality routine should update the virtual register set (VRS) according to the
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0041-Consolidate-and-fix-sysroot-based-compiler-rt-search.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0041-Consolidate-and-fix-sysroot-based-compiler-rt-search.patch
new file mode 100644
index 00000000..a2a7fa80
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0041-Consolidate-and-fix-sysroot-based-compiler-rt-search.patch
@@ -0,0 +1,105 @@
+From b818a92ac171e80e39ad9e99d1f862d23f2bb5b3 Mon Sep 17 00:00:00 2001
+From: "mark.yang" <mark.yang@lge.com>
+Date: Tue, 14 Apr 2026 16:17:01 +0900
+Subject: [PATCH] Consolidate and fix sysroot-based compiler-rt search paths
+
+Consolidate patches 0008 and 0033 into a single patch with a fix for
+native builds.
+
+Background:
+In Yocto/OE, compiler-rt and libc++ are built as separate recipes and
+installed into the target sysroot, not into clang's resource directory
+(which is relative to the clang driver installation).
+Patches 0008 (getCompilerRTPath, Khem Raj, 2017) and 0033 (getRuntimePath and
+getArchSpecificLibPaths, Khem Raj, 2025) addressed this by changing the
+runtime library search base from ResourceDir to SysRoot-based paths.
+
+Problem:
+The patches unconditionally replaced ResourceDir with a SysRoot-based
+path using CLANG_VERSION_STRING. In native/standalone builds where
+SysRoot is empty, this produces invalid absolute paths like
+"/usr/lib/clang/<full-version>/" pointing to the host filesystem instead of the
+build tree's resource directory. This breaks PGO bootstrap and any other
+native workflow that depends on compiler-rt runtime libraries
+(e.g., -fprofile-generate cannot find libclang_rt.profile.a).
+
+Fix:
+Use SysRoot-based paths only when SysRoot is actually set (i.e., during
+cross-compilation). When SysRoot is empty (native/standalone builds),
+fall back to the upstream default ResourceDir, which correctly resolves
+to the build tree's resource directory.
+
+The following functions are updated with this conditional logic:
+- getCompilerRTPath()
+- getRuntimePath()
+- getArchSpecificLibPaths()
+
+Upstream-Status: Inappropriate [OE-Specific]
+Signed-off-by: mark.yang <mark.yang@lge.com>
+---
+ clang/lib/Driver/ToolChain.cpp | 31 ++++++++++++++++++++++++++++---
+ 1 file changed, 28 insertions(+), 3 deletions(-)
+
+diff --git a/clang/lib/Driver/ToolChain.cpp b/clang/lib/Driver/ToolChain.cpp
+index 77a2c73f0..ac28b51c4 100644
+--- a/clang/lib/Driver/ToolChain.cpp
++++ b/clang/lib/Driver/ToolChain.cpp
+@@ -15,6 +15,7 @@
+ #include "ToolChains/InterfaceStubs.h"
+ #include "clang/Basic/ObjCRuntime.h"
+ #include "clang/Basic/Sanitizers.h"
++#include "clang/Basic/Version.h"
+ #include "clang/Config/config.h"
+ #include "clang/Driver/Action.h"
+ #include "clang/Driver/CommonArgs.h"
+@@ -723,7 +724,15 @@ StringRef ToolChain::getOSLibName() const {
+ }
+
+ std::string ToolChain::getCompilerRTPath() const {
+- SmallString<128> Path(getDriver().ResourceDir);
++ SmallString<128> Path;
++ if (!getDriver().SysRoot.empty()) {
++ Path = getDriver().SysRoot;
++ StringRef ClangLibdirBasename(CLANG_INSTALL_LIBDIR_BASENAME);
++ llvm::sys::path::append(Path, "/usr/", ClangLibdirBasename, "clang",
++ CLANG_VERSION_STRING);
++ } else {
++ Path = getDriver().ResourceDir;
++ }
+ if (isBareMetal()) {
+ llvm::sys::path::append(Path, "lib", getOSLibName());
+ if (!SelectedMultilibs.empty()) {
+@@ -1021,7 +1030,15 @@ ToolChain::getTargetSubDirPath(StringRef BaseDir) const {
+ }
+
+ std::optional<std::string> ToolChain::getRuntimePath() const {
+- SmallString<128> P(D.ResourceDir);
++ SmallString<128> P;
++ if (!D.SysRoot.empty()) {
++ P = D.SysRoot;
++ StringRef ClangLibdirBasename(CLANG_INSTALL_LIBDIR_BASENAME);
++ llvm::sys::path::append(P, "/usr/", ClangLibdirBasename, "clang",
++ CLANG_VERSION_STRING);
++ } else {
++ P = D.ResourceDir;
++ }
+ llvm::sys::path::append(P, "lib");
+ if (auto Ret = getTargetSubDirPath(P))
+ return Ret;
+@@ -1049,7 +1066,15 @@ ToolChain::path_list ToolChain::getArchSpecificLibPaths() const {
+ path_list Paths;
+
+ auto AddPath = [&](const ArrayRef<StringRef> &SS) {
+- SmallString<128> Path(getDriver().ResourceDir);
++ SmallString<128> Path;
++ if (!getDriver().SysRoot.empty()) {
++ Path = getDriver().SysRoot;
++ StringRef ClangLibdirBasename(CLANG_INSTALL_LIBDIR_BASENAME);
++ llvm::sys::path::append(Path, "/usr/", ClangLibdirBasename, "clang",
++ CLANG_VERSION_STRING);
++ } else {
++ Path = getDriver().ResourceDir;
++ }
+ llvm::sys::path::append(Path, "lib");
+ for (auto &S : SS)
+ llvm::sys::path::append(Path, S);
--git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0042-guard-clang-tools-extra-test.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0042-guard-clang-tools-extra-test.patch
new file mode 100644
index 00000000..9b4e29ff
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0042-guard-clang-tools-extra-test.patch
@@ -0,0 +1,74 @@
+clang-tools-extra tests depend on the llvm-bcanalyzer CMake target, which
+exists in LLVM's CMake project but is not visible when Clang is built
+separately. To run clang tests, disable clang-tools-extra tests for now.
+
+Without this patch when CLANG_INCLUDE_TESTS is ON got the following error
+
+--------------------------------------------------------------------------------
+| CMake Error at ../clang/21.1.8/recipe-sysroot/usr/lib/cmake/llvm/AddLLVM.cmake:2113 (add_dependencies):
+| The dependency target "llvm-bcanalyzer" of target
+| "check-clang-extra-clang-tidy-infrastructure-header-filter-from-config-file-simple"
+| does not exist.
+| Call Stack (most recent call first):
+| ../clang/21.1.8/recipe-sysroot/usr/lib/cmake/llvm/AddLLVM.cmake:2221 (add_lit_target)
+| tools/extra/test/CMakeLists.txt:87 (add_lit_testsuites)
+|
+| CMake Error at ../clang/21.1.8/recipe-sysroot/usr/lib/cmake/llvm/AddLLVM.cmake:2113 (add_dependencies):
+| The dependency target "llvm-bcanalyzer" of target
+| "check-clang-extra-modularize" does not exist.
+| Call Stack (most recent call first):
+| ../clang/21.1.8/recipe-sysroot/usr/lib/cmake/llvm/AddLLVM.cmake:2221 (add_lit_target)
+| tools/extra/test/CMakeLists.txt:87 (add_lit_testsuites)
+-------------------------------------------------------------------------------
+
+Upstream-Status: Inappropriate [OE-Specific]
+Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
+
+diff --git a/clang-tools-extra/CMakeLists.txt b/clang-tools-extra/CMakeLists.txt
+index 6b6f2b1..26e4c10 100644
+--- a/clang-tools-extra/CMakeLists.txt
++++ b/clang-tools-extra/CMakeLists.txt
+@@ -8,7 +8,7 @@ include(GNUInstallDirs)
+ option(CLANG_TIDY_ENABLE_QUERY_BASED_CUSTOM_CHECKS
+ "Enable query-based custom checks in clang-tidy" ON)
+
+-if(CLANG_INCLUDE_TESTS)
++if(CLANG_TOOLS_EXTRA_INCLUDE_TESTS)
+ umbrella_lit_testsuite_begin(check-clang-tools)
+
+ option(CLANG_TOOLS_TEST_USE_VG "Run Clang tools' tests under Valgrind" OFF)
+@@ -45,7 +45,7 @@ if (CLANG_ENABLE_CLANGD)
+ endif()
+
+ # Add the common testsuite after all the tools.
+-if(CLANG_INCLUDE_TESTS)
++if(CLANG_TOOLS_EXTRA_INCLUDE_TESTS)
+ add_subdirectory(test)
+ add_subdirectory(unittests)
+ umbrella_lit_testsuite_end(check-clang-tools)
+diff --git a/clang-tools-extra/include-cleaner/CMakeLists.txt b/clang-tools-extra/include-cleaner/CMakeLists.txt
+index dc147f9..4855577 100644
+--- a/clang-tools-extra/include-cleaner/CMakeLists.txt
++++ b/clang-tools-extra/include-cleaner/CMakeLists.txt
+@@ -1,7 +1,7 @@
+ include_directories(include)
+ add_subdirectory(lib)
+ add_subdirectory(tool)
+-if(CLANG_INCLUDE_TESTS)
++if(CLANG_TOOLS_EXTRA_INCLUDE_TESTS)
+ add_subdirectory(test)
+ add_subdirectory(unittests)
+ endif()
+diff --git a/clang-tools-extra/clangd/CMakeLists.txt b/clang-tools-extra/clangd/CMakeLists.txt
+index a1e9da4..94dcb96 100644
+--- a/clang-tools-extra/clangd/CMakeLists.txt
++++ b/clang-tools-extra/clangd/CMakeLists.txt
+@@ -215,7 +215,7 @@ endif()
+ option(CLANGD_BUILD_DEXP "Build the dexp tool as part of Clangd" ON)
+ llvm_canonicalize_cmake_booleans(CLANGD_BUILD_DEXP)
+
+-if(CLANG_INCLUDE_TESTS)
++if(CLANG_TOOLS_EXTRA_INCLUDE_TESTS)
+ add_subdirectory(test)
+ add_subdirectory(unittests)
+ endif()
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0043-LoopUnroll-Iterate-exit-fold-candidates-in-determini.patch b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0043-LoopUnroll-Iterate-exit-fold-candidates-in-determini.patch
new file mode 100644
index 00000000..39e27ac1
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc-22.1.8/0043-LoopUnroll-Iterate-exit-fold-candidates-in-determini.patch
@@ -0,0 +1,71 @@
+From 965f9d87adb0a7376454374fbc140ab69bd796a9 Mon Sep 17 00:00:00 2001
+From: Florian Hahn <flo@fhahn.com>
+Date: Fri, 27 Mar 2026 13:02:51 +0000
+Subject: [PATCH] [LoopUnroll] Use MapVector for deterministic iteration order.
+ (#188821)
+
+NonLoopBlocksIDom determines the order we adjust the DT, impacting DRT
+child ordering.
+
+Similarly, ExitInfos order impacts the order of SetDest, which applies
+DT updates.
+
+The order impacts collectChildrenInLoop, which in turn impacts the we
+process BBs in LICM. And this in turn impacts the order in which we
+perform alias queries.
+
+If the order is not deterministic, we sometimes get different NumNoAlias
+statistic counts, and possibly also different IR, although I have not
+confirmed the latter.
+
+Upstream-Status: Backport [https://github.com/llvm/llvm-project/commit/965f9d87adb0a7376454374fbc140ab69bd796a9]
+Signed-off-by: Sunilkumar Dora <sunilkumar.dora@windriver.com>
+Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
+
+---
+ llvm/lib/Transforms/Utils/LoopPeel.cpp | 3 ++-
+ llvm/lib/Transforms/Utils/LoopUnroll.cpp | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/llvm/lib/Transforms/Utils/LoopPeel.cpp b/llvm/lib/Transforms/Utils/LoopPeel.cpp
+index 91737b5c30533..4c67d5a9ae680 100644
+--- a/llvm/lib/Transforms/Utils/LoopPeel.cpp
++++ b/llvm/lib/Transforms/Utils/LoopPeel.cpp
+@@ -11,6 +11,7 @@
+
+ #include "llvm/Transforms/Utils/LoopPeel.h"
+ #include "llvm/ADT/DenseMap.h"
++#include "llvm/ADT/MapVector.h"
+ #include "llvm/ADT/SmallVector.h"
+ #include "llvm/ADT/Statistic.h"
+ #include "llvm/Analysis/Loads.h"
+@@ -1121,7 +1122,7 @@ void llvm::peelLoop(Loop *L, unsigned PeelCount, bool PeelLast, LoopInfo *LI,
+ // later. Immediate dominator of such block might change, because we add more
+ // routes which can lead to the exit: we can reach it from the peeled
+ // iterations too.
+- DenseMap<BasicBlock *, BasicBlock *> NonLoopBlocksIDom;
++ MapVector<BasicBlock *, BasicBlock *> NonLoopBlocksIDom;
+ for (auto *BB : L->blocks()) {
+ auto *BBDomNode = DT.getNode(BB);
+ SmallVector<BasicBlock *, 16> ChildrenToUpdate;
+diff --git a/llvm/lib/Transforms/Utils/LoopUnroll.cpp b/llvm/lib/Transforms/Utils/LoopUnroll.cpp
+index 6a2ccbea996bf..ab35d217f0d93 100644
+--- a/llvm/lib/Transforms/Utils/LoopUnroll.cpp
++++ b/llvm/lib/Transforms/Utils/LoopUnroll.cpp
+@@ -17,6 +17,7 @@
+
+ #include "llvm/ADT/ArrayRef.h"
+ #include "llvm/ADT/DenseMap.h"
++#include "llvm/ADT/MapVector.h"
+ #include "llvm/ADT/STLExtras.h"
+ #include "llvm/ADT/ScopedHashTable.h"
+ #include "llvm/ADT/SetVector.h"
+@@ -515,7 +516,7 @@ llvm::UnrollLoop(Loop *L, UnrollLoopOptions ULO, LoopInfo *LI,
+ BasicBlock *FirstExitingBlock = nullptr;
+ SmallVector<BasicBlock *> ExitingBlocks;
+ };
+- DenseMap<BasicBlock *, ExitInfo> ExitInfos;
++ MapVector<BasicBlock *, ExitInfo> ExitInfos;
+ SmallVector<BasicBlock *, 4> ExitingBlocks;
+ L->getExitingBlocks(ExitingBlocks);
+ for (auto *ExitingBlock : ExitingBlocks) {
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc_22.1.8.bb b/meta-ti-bsp/recipes-graphics/mesa/libclc_22.1.8.bb
new file mode 100644
index 00000000..57eb1d6a
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/libclc_22.1.8.bb
@@ -0,0 +1,149 @@
+SUMMARY = "Implementation of the library requirements of the OpenCL C programming language."
+HOMEPAGE = "https://libclc.llvm.org"
+SECTION = "devel"
+
+FILESEXTRAPATHS =. "${FILE_DIRNAME}/${PN}:"
+
+LLVM_RELEASE = ""
+LLVM_DIR = "llvm${LLVM_RELEASE}"
+
+LLVM_HTTP ?= "https://github.com/llvm"
+
+MAJOR_VER = "22"
+MINOR_VER = "1"
+PATCH_VER = "8"
+# could be 'rcX' or 'git' or empty ( for release )
+VER_SUFFIX = ""
+
+PV = "${MAJOR_VER}.${MINOR_VER}.${PATCH_VER}"
+
+LLVMMD5SUM = "8a15a0759ef07f2682d2ba4b893c9afe"
+CLANGMD5SUM = "ff42885ed2ab98f1ecb8c1fc41205343"
+LLDMD5SUM = "ae7dc7c027b1fa89b5b013d391d3ee2b"
+LLDBMD5SUM = "2e0d44968471fcde980034dbb826bea9"
+
+LLVM_LIBDIR_SUFFIX = "${@d.getVar('baselib').replace('lib', '')}"
+
+# set the default pigz thread
+export PIGZ = "-p ${@oe.utils.cpu_count(at_least=2)}"
+
+def get_clang_arch(bb, d, arch_var):
+ import re
+ a = d.getVar(arch_var)
+ if re.match('(i.86|athlon|x86.64)$', a): return 'X86'
+ elif re.match('arm$', a): return 'ARM'
+ elif re.match('armeb$', a): return 'ARM'
+ elif re.match('aarch64$', a): return 'AArch64'
+ elif re.match('aarch64_be$', a): return 'AArch64'
+ elif re.match('mips(isa|)(32|64|)(r6|)(el|)$', a): return 'Mips'
+ elif re.match('riscv32$', a): return 'RISCV'
+ elif re.match('riscv64$', a): return 'RISCV'
+ elif re.match('p(pc|owerpc)(|64)', a): return 'PowerPC'
+ elif re.match('loongarch64$', a): return 'LoongArch'
+ else:
+ bb.fatal("Unhandled architecture %s" % arch_var)
+ return ""
+
+def get_clang_host_arch(bb, d):
+ return get_clang_arch(bb, d, 'HOST_ARCH')
+
+def get_clang_target_arch(bb, d):
+ return get_clang_arch(bb, d, 'TARGET_ARCH')
+
+# Don't put build-time RPATHs in the binaries, whilst they'll be stripped on
+# install they cause non-deterministic binaries.
+EXTRA_OECMAKE += "-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON"
+
+# Don't embed found git information into the version string as this
+# will include the git server URL.
+EXTRA_OECMAKE += "-DLLVM_APPEND_VC_REV=OFF"
+
+LIC_FILES_CHKSUM = "file://llvm/LICENSE.TXT;md5=${LLVMMD5SUM} \
+ file://clang/LICENSE.TXT;md5=${CLANGMD5SUM} \
+"
+LICENSE = "Apache-2.0 WITH LLVM-exception"
+
+# Snapshot
+#RELEASE ?= "108df0694cc12fa496f63faa3a8762e7cc1a3b37"
+#BASEURI ?= "https://api.github.com/repos/llvm/llvm-project/tarball/${RELEASE};downloadfilename=llvm-${PV}-${RELEASE}.tar.gz"
+#SOURCEDIR ?= "llvm-llvm-project-${@'${RELEASE}'[0:7]}"
+#SRC_URI[sha256sum] = "f19bc6ed902e30413a8a034a024fae228ca57339b450d3682fd7437fb2573378"
+
+# GA Release
+RELEASE ?= "${PV}"
+BASEURI ?= "${LLVM_HTTP}/llvm-project/releases/download/llvmorg-${PV}${VER_SUFFIX}/llvm-project-${PV}${VER_SUFFIX}.src.tar.xz"
+UPSTREAM_CHECK_URI = "${LLVM_HTTP}/llvm-project/releases/"
+UPSTREAM_CHECK_REGEX = "releases/tag/llvmorg-?(?P<pver>\d+(\.\d+)+)"
+SOURCEDIR ?= "llvm-project-${PV}${VER_SUFFIX}.src"
+SRC_URI[sha256sum] = "ab1f0e3ec52448c33e8782eaf0422504b87c7b016b22514653ee0d8fcee479ff"
+
+SRC_URI = "\
+ ${BASEURI} \
+ file://0001-libcxxabi-Find-libunwind-headers-when-LIBCXXABI_LIBU.patch \
+ file://0002-compiler-rt-support-a-new-embedded-linux-target.patch \
+ file://0003-compiler-rt-Simplify-cross-compilation.-Don-t-use-na.patch \
+ file://0004-llvm-allow-env-override-of-exe-and-libdir-path.patch \
+ file://0005-clang-driver-Check-sysroot-for-ldso-path.patch \
+ file://0006-clang-Driver-tools.cpp-Add-lssp_nonshared-on-musl.patch \
+ file://0007-clang-Prepend-trailing-to-sysroot.patch \
+ file://0009-clang-Define-releative-gcc-installation-dir.patch \
+ file://0010-clang-Add-lpthread-and-ldl-along-with-lunwind-for-st.patch \
+ file://0011-Check-for-atomic-double-intrinsics.patch \
+ file://0012-cmake-Fix-configure-for-packages-using-find_package.patch \
+ file://0013-clang-Fix-resource-dir-location-for-cross-toolchains.patch \
+ file://0014-clang-driver-Add-dyld-prefix-when-checking-sysroot-f.patch \
+ file://0015-clang-Use-python3-in-python-scripts.patch \
+ file://0016-llvm-clang-Insert-anchor-for-adding-OE-distro-vendor.patch \
+ file://0017-compiler-rt-Do-not-use-backtrace-APIs-on-non-glibc-l.patch \
+ file://0018-clang-Fix-x86-triple-for-non-debian-multiarch-linux-.patch \
+ file://0019-libunwind-Added-unw_backtrace-method.patch \
+ file://0020-lldb-Link-with-libatomic-on-x86.patch \
+ file://0021-compiler-rt-Enable-__int128-for-ppc32.patch \
+ file://0022-llvm-Do-not-use-cmake-infra-to-detect-libzstd.patch \
+ file://0023-compiler-rt-Fix-stat-struct-s-size-for-O32-ABI.patch \
+ file://0024-ToolChains-Gnu.cpp-ARMLibDirs-search-also-in-lib32.patch \
+ file://0025-clang-llvm-Add-OE-specific-ABI-triple-for-N32-ABI.patch \
+ file://0026-llvm-Add-libunwind.pc.in-and-llvm-config-scripts.patch \
+ file://0027-scan-build-py-respect-LLVM_LIBDIR_SUFFIX-like-other-.patch \
+ file://0028-compiler-rt-Do-not-pass-target-to-clang-compiler.patch \
+ file://0029-AsmMatcherEmitter-sort-ClassInfo-lists-by-name-as-we.patch \
+ file://0030-llvm-config-remove-LLVM_LDFLAGS-from-ldflags-output.patch \
+ file://0031-compiler-rt-Exclude-sync_fetch_and_-for-any-pre-ARMv.patch \
+ file://0032-compiler-rt-Hardcode-uptr-sptr-typedefs-on-Mips-Linu.patch \
+ file://0034-Revert-libc-Remap-headers-in-the-debug-info-when-bui.patch \
+ file://0035-Prevent-revisiting-block-when-searching-for-noreturn.patch \
+ file://0036-Don-t-expose-LLVM_HAVE_OPT_VIEWER_MODULES-externally.patch \
+ file://0037-clang-Only-build-clang-tblgen-if-it-is-actually-need.patch \
+ file://0038-llvm-libgcc-Fix-symlink-path-for-libcc-when-LLVM_ENA.patch \
+ file://0039-Rename-UNUSED-and-UNKNOWN-elements-of-OffloadArch-enum.patch \
+ file://0040-libcxxabi-declare-__gnu_unwind_frame-in-cxa_personal.patch \
+ file://0041-Consolidate-and-fix-sysroot-based-compiler-rt-search.patch \
+ file://0042-guard-clang-tools-extra-test.patch \
+ file://0043-LoopUnroll-Iterate-exit-fold-candidates-in-determini.patch \
+"
+# Fallback to no-PIE if not set
+GCCPIE ??= ""
+
+SRC_URI[sha256sum] = "922f1817a0df7b1489272d18134ee0087a8b068828f87ac63b9861b1a9965888"
+
+S = "${UNPACKDIR}/llvm-project-${PV}.src"
+B ?= "${WORKDIR}/llvm-project-source-${PV}/build.${HOST_SYS}.${TARGET_SYS}"
+
+inherit cmake pkgconfig
+
+# Depend explicitly on clang-native instead of using TOOLCHAIN as the build
+# objects from this recipe are build explicitly using clang for GPU targets.
+# We could INHIBIT_DEFAULT_DEPS to avoid any other toolchain but then we need
+# to wrestle CMake to configure without a toolchain.
+DEPENDS += "clang-native spirv-llvm-translator-native"
+
+OECMAKE_SOURCEPATH = "${S}/libclc"
+
+# Semicolon-separated list of targets to build
+LIBCLC_TARGETS ?= "all"
+
+EXTRA_OECMAKE += "-DLIBCLC_TARGETS_TO_BUILD='${LIBCLC_TARGETS}'"
+
+FILES:${PN} += "${datadir}/clc"
+
+BBCLASSEXTEND = "native nativesdk"
diff --git a/meta-ti-bsp/recipes-graphics/mesa/libclc_git.bb b/meta-ti-bsp/recipes-graphics/mesa/libclc_git.bb
deleted file mode 100644
index e8645d4b..00000000
--- a/meta-ti-bsp/recipes-graphics/mesa/libclc_git.bb
+++ /dev/null
@@ -1,27 +0,0 @@
-SUMMARY = "Implementation of the library requirements of the OpenCL C programming language."
-HOMEPAGE = "https://libclc.llvm.org"
-SECTION = "devel"
-
-require recipes-devtools/clang/common-clang.inc
-require recipes-devtools/clang/common-source.inc
-
-LIC_FILES_CHKSUM = "file://libclc/LICENSE.TXT;md5=7cc795f6cbb2d801d84336b83c8017db"
-
-inherit cmake pkgconfig
-
-# Depend explicitly on clang-native instead of using TOOLCHAIN as the build
-# objects from this recipe are build explicitly using clang for GPU targets.
-# We could INHIBIT_DEFAULT_DEPS to avoid any other toolchain but then we need
-# to wrestle CMake to configure without a toolchain.
-DEPENDS += "clang-native spirv-llvm-translator-native"
-
-OECMAKE_SOURCEPATH = "${S}/libclc"
-
-# Semicolon-separated list of targets to build
-LIBCLC_TARGETS ?= "all"
-
-EXTRA_OECMAKE += "-DLIBCLC_TARGETS_TO_BUILD='${LIBCLC_TARGETS}'"
-
-FILES:${PN} += "${datadir}/clc"
-
-BBCLASSEXTEND = "native nativesdk"
--
2.43.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [meta-ti][master][PATCH v2 5/5] mesa-pvr: Fix for building with new LLVM version
2026-09-10 1:54 [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0 Ryan Eatmon
` (2 preceding siblings ...)
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 4/5] libclc: Rollback to 22.1.8 Ryan Eatmon
@ 2026-09-10 1:54 ` Ryan Eatmon
2026-09-10 5:43 ` Yogesh Hegde
2026-09-10 2:00 ` [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0 PRC Automation
` (2 subsequent siblings)
6 siblings, 1 reply; 11+ messages in thread
From: Ryan Eatmon @ 2026-09-10 1:54 UTC (permalink / raw)
To: Praneeth Bajjuri, Denys Dmytriyenko, meta-ti
A recnet version change [1] caused a build failure. Backport a patch
from the mesa repo to address it [2].
[1] https://git.openembedded.org/openembedded-core/commit/?id=d1575787a815fbe1ca60b20664665f92a95b2264
[2] https://gitlab.freedesktop.org/mesa/mesa/-/commit/f958ad11955638758c19170d9df4d67bf1ff8bcb
Signed-off-by: Ryan Eatmon <reatmon@ti.com>
---
v2; No change.
.../0001-clc-fix-build-with-LLVM13.patch | 45 +++++++++++++++++++
.../recipes-graphics/mesa/mesa-pvr_25.2.8.bb | 4 +-
2 files changed, 48 insertions(+), 1 deletion(-)
create mode 100644 meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.2.8/0001-clc-fix-build-with-LLVM13.patch
diff --git a/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.2.8/0001-clc-fix-build-with-LLVM13.patch b/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.2.8/0001-clc-fix-build-with-LLVM13.patch
new file mode 100644
index 00000000..77bd993a
--- /dev/null
+++ b/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.2.8/0001-clc-fix-build-with-LLVM13.patch
@@ -0,0 +1,45 @@
+From f958ad11955638758c19170d9df4d67bf1ff8bcb Mon Sep 17 00:00:00 2001
+From: Lone_Wolf <lone_wolf@klaas-de-kat.nl>
+Date: Wed, 13 May 2026 22:54:45 +0200
+Subject: [PATCH] clc: fix build with LLVM23 (TargetRegistry::lookupTarget)
+
+See https://github.com/llvm/llvm-project/commit/d50631faad3003e73589528c83d3bbbad7ba72f1
+
+Closes: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/15471
+Cc: mesa-stable
+Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/41558>
+
+Upstream-Status: Inappropriate [OE-specific]
+
+---
+ src/compiler/clc/clc_helpers.cpp | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/src/compiler/clc/clc_helpers.cpp b/src/compiler/clc/clc_helpers.cpp
+index 66d4af43a36a..e5c3d158b290 100644
+--- a/src/compiler/clc/clc_helpers.cpp
++++ b/src/compiler/clc/clc_helpers.cpp
+@@ -1186,15 +1186,14 @@ llvm_mod_to_spirv(std::unique_ptr<::llvm::Module> mod,
+ if (args->use_llvm_spirv_target) {
+ const char *triple = args->address_bits == 32 ? "spirv-unknown-unknown" : "spirv64-unknown-unknown";
+ std::string error_msg("");
+- auto target = TargetRegistry::lookupTarget(triple, error_msg);
+- if (target) {
+- auto TM = target->createTargetMachine(
+ #if LLVM_VERSION_MAJOR >= 21
+- llvm::Triple(triple),
++ auto temp_triple = llvm::Triple(triple);
+ #else
+- triple,
++ auto temp_triple = triple;
+ #endif
+- "", "", {}, std::nullopt, std::nullopt,
++ auto target = TargetRegistry::lookupTarget(temp_triple, error_msg);
++ if (target) {
++ auto TM = target->createTargetMachine(temp_triple, "", "", {}, std::nullopt, std::nullopt,
+ #if LLVM_VERSION_MAJOR >= 18
+ ::llvm::CodeGenOptLevel::None
+ #else
+--
+GitLab
+
diff --git a/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr_25.2.8.bb b/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr_25.2.8.bb
index 03b0b9bf..cd622864 100644
--- a/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr_25.2.8.bb
+++ b/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr_25.2.8.bb
@@ -11,7 +11,9 @@ LIC_FILES_CHKSUM = "file://docs/license.rst;md5=ffe678546d4337b732cfd12262e6af11
BRANCH = "powervr/${PV}"
SRC_URI = "git://github.com/TexasInstruments/mesa.git;protocol=https;branch=${BRANCH} \
- file://0001-meson-misdetects-64bit-atomics-on-mips-clang.patch"
+ file://0001-meson-misdetects-64bit-atomics-on-mips-clang.patch \
+ file://0001-clc-fix-build-with-LLVM13.patch \
+ "
SRCREV = "7b6e8de7b0acdaff684f1109c6acb575644a93ea"
PV = "25.2.8"
--
2.43.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0
2026-09-10 1:54 [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0 Ryan Eatmon
` (3 preceding siblings ...)
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 5/5] mesa-pvr: Fix for building with new LLVM version Ryan Eatmon
@ 2026-09-10 2:00 ` PRC Automation
2026-09-10 5:36 ` Yogesh Hegde
2026-09-10 18:13 ` Denys Dmytriyenko
6 siblings, 0 replies; 11+ messages in thread
From: PRC Automation @ 2026-09-10 2:00 UTC (permalink / raw)
To: Ryan Eatmon; +Cc: Praneeth Bajjuri, Denys Dmytriyenko, meta-ti
meta-ti / na / 20260910015454.2933250-1-reatmon
PRC Results: FAIL
=========================================================
check-yocto-patches: PASS
=========================================================
Patches
----------------------------------------
WARN - [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0
WARN: Revised patch missing a comment. (REVISION-1)
patch
For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
WARN - [meta-ti][master][PATCH v2 2/5] linux-ti-staging_6.6: Backport OpenSSL 4.0 patches
WARN: Revised patch missing a comment. (REVISION-1)
patch
For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
WARN - [meta-ti][master][PATCH v2 3/5] mesa-pvr: Remove makedepend dependency
WARN: Commit message does not include file/recipe name: mesa-pvr: Remove makedepend dependency. (COMMIT-MESSAGE-2)
patch
WARN: Revised patch missing a comment. (REVISION-1)
patch
For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
WARN - [meta-ti][master][PATCH v2 4/5] libclc: Rollback to 22.1.8
WARN: Revised patch missing a comment. (REVISION-1)
patch
For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
WARN - [meta-ti][master][PATCH v2 5/5] mesa-pvr: Fix for building with new LLVM version
WARN: Revised patch missing a comment. (REVISION-1)
patch
For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
=========================================================
apply-yocto-patch: PASS
=========================================================
master
=====================
Summary:
- Patch Series: [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0
- Submitter: From: Ryan Eatmon <reatmon@ti.com>
+From: Ryan Eatmon <reatmon@ti.com>
+From: Ryan Eatmon <reatmon@ti.com>
+From: Eddie Kovsky <ewk@edkovsky.org>
- Date: Date: Wed, 9 Sep 2026 20:54:48 -0500
+Date: Wed, 9 Sep 2026 10:04:50 -0500
+ Date: Fri Sep 20 19:52:48 2024 +0300
+Date: Wed, 9 Sep 2026 10:04:50 -0500
+ Date: Fri Sep 20 19:52:48 2024 +0300
+Date: Mon, 23 Feb 2026 09:43:22 -0700
+ Date: Fri Sep 20 19:52:48 2024 +0300
- Num Patches: 5
- Mailing List (public inbox) Commit SHA: aa0658289984ef6e2cfa1aad5d36661d41fb74cb
Applied to:
- Repository: lcpd-prc-meta-ti
- Base Branch: master-next
- Commit Author: LCPD Automation Script <lcpdbld@list.ti.com>
- Commit Subject: CI/CD Auto-Merger: cicd.master.202609011013
- Commit SHA: 0424eea6b0f3f37e57500b6a65a24cbe39427ad8
Patches
----------------------------------------
All patches applied
=========================================================
check-yocto-repo: FAIL
=========================================================
master
=====================
FAIL
ERROR: SUMMARY cannot be longer than 72 characters. (SUMMARY-2)
meta-ti-bsp/recipes-graphics/mesa/libclc_22.1.8.bb
For details on the above errors/warnings visit: https://lists.yoctoproject.org/g/meta-ti/wiki/40887
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0
2026-09-10 1:54 [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0 Ryan Eatmon
` (4 preceding siblings ...)
2026-09-10 2:00 ` [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0 PRC Automation
@ 2026-09-10 5:36 ` Yogesh Hegde
2026-09-10 18:13 ` Denys Dmytriyenko
6 siblings, 0 replies; 11+ messages in thread
From: Yogesh Hegde @ 2026-09-10 5:36 UTC (permalink / raw)
To: reatmon; +Cc: Praneeth Bajjuri, Denys Dmytriyenko, meta-ti
Hi Ryan,
On 20:54-20260909, Ryan Eatmon via lists.yoctoproject.org wrote:
> With the recent move to OpenSSL 4.0 [1] we need to update the same code
> in the various u-boot versions that we support.
>
> [1] https://git.openembedded.org/openembedded-core/commit/?id=20bf704e5809e95036b998f0f45145cf7205b05b
>
> Signed-off-by: Ryan Eatmon <reatmon@ti.com>
> ---
> v2; No change.
>
> ...ort-for-OpenSSL-Provider-API-2024-04.patch | 300 ++++++++++++++++
> ...ort-for-OpenSSL-Provider-API-2025-01.patch | 300 ++++++++++++++++
> ...ort-for-OpenSSL-Provider-API-2026-01.patch | 340 ++++++++++++++++++
> .../u-boot/u-boot-ti-staging_2024.04.bb | 6 +-
> .../u-boot/u-boot-ti-staging_2025.01.bb | 1 +
> .../u-boot/u-boot-ti-staging_2026.01.bb | 2 +
> meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc | 1 +
> 7 files changed, 948 insertions(+), 2 deletions(-)
> create mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch
> create mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch
> create mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch
>
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch
> new file mode 100644
> index 00000000..9f67644b
> --- /dev/null
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch
> @@ -0,0 +1,300 @@
> +From 401c19f6b0a7c63afad92e9d3f2cbb75d6ed8566 Mon Sep 17 00:00:00 2001
> +From: Ryan Eatmon <reatmon@ti.com>
> +Date: Wed, 9 Sep 2026 10:04:50 -0500
> +Subject: [PATCH] Add support for OpenSSL Provider API
> +
> +Backport from 2026.01 patch [1] by Ryan Eatmon <reatmon@ti.com>
> +
> +Upsatream-Status: Inappropriate [OE-specific]
Typo
> +
> +The Engine API has been deprecated since the release of OpenSSL 3.0. End
> +users have been advised to migrate to the new Provider interface.
> +Several distributions have already removed support for engines, which is
> +preventing U-Boot from being compiled in those environments.
> +
> +Add support for the Provider API while continuing to support the existing
> +Engine API on distros shipping older releases of OpenSSL.
> +
> +This is based on similar work contributed by Jan Stancek updating Linux
> +to use the Provider interface.
> +
> + commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
> + Author: Jan Stancek <jstancek@redhat.com>
> + Date: Fri Sep 20 19:52:48 2024 +0300
> +
> + sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
> +
> +The changes have been tested with the FIT signature verification vboot
> +tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
> +Engine library installed and with the Provider API.
> +
> +Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
> +
> +Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
> +
> +Note: Modified to make pkcs11 provider loading optional. The upstream
> +patch unconditionally requires the pkcs11 provider, which is not
> +available in the OE build environment. File-based key signing only needs
> +the default provider; pkcs11 is only required for pkcs11: URI keys.
> +Changes from upstream:
> + - Load default provider first (was pkcs11 first)
> + - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
> + of ERR(1, ...) which calls errx/abort)
> +
> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> +
> +Signed-off-by: Ryan Eatmon <reatmon@ti.com>
> +---
> + lib/aes/aes-encrypt.c | 4 +-
> + lib/rsa/rsa-sign.c | 95 ++++++++++++++++++++++++++++++++++++++++++-
> + 2 files changed, 97 insertions(+), 2 deletions(-)
> +
> +diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
> +index e74e35eaa28..8a6f7715df9 100644
> +--- a/lib/aes/aes-encrypt.c
> ++++ b/lib/aes/aes-encrypt.c
> +@@ -16,7 +16,9 @@
> + #include <openssl/err.h>
> + #include <openssl/ssl.h>
> + #include <openssl/evp.h>
> +-#include <openssl/engine.h>
> ++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# include <openssl/engine.h>
> ++#endif
> + #include <uboot_aes.h>
> +
> + #if OPENSSL_VERSION_NUMBER >= 0x10000000L
> +diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
> +index 2304030e32f..29b3bd3dbb1 100644
> +--- a/lib/rsa/rsa-sign.c
> ++++ b/lib/rsa/rsa-sign.c
> +@@ -19,7 +19,47 @@
> + #include <openssl/err.h>
> + #include <openssl/ssl.h>
> + #include <openssl/evp.h>
> +-#include <openssl/engine.h>
> ++#if OPENSSL_VERSION_MAJOR >= 3
> ++# define USE_PKCS11_PROVIDER
> ++# include <err.h>
> ++# include <openssl/provider.h>
> ++# include <openssl/store.h>
> ++#else
> ++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# define USE_PKCS11_ENGINE
> ++# include <openssl/engine.h>
> ++# endif
> ++#endif
> ++
> ++#ifdef USE_PKCS11_PROVIDER
> ++#define ERR(cond, fmt, ...) \
> ++ do { \
> ++ bool __cond = (cond); \
> ++ drain_openssl_errors(__LINE__, 0); \
> ++ if (__cond) { \
> ++ errx(1, fmt, ## __VA_ARGS__); \
> ++ } \
> ++ } while (0)
> ++
> ++static void drain_openssl_errors(int l, int silent)
> ++{
> ++ const char *file;
> ++ char buf[120];
> ++ int e, line;
> ++
> ++ if (ERR_peek_error() == 0)
> ++ return;
> ++ if (!silent)
> ++ fprintf(stderr, "At main.c:%d:\n", l);
> ++
> ++ while ((e = ERR_peek_error_line(&file, &line))) {
> ++ ERR_error_string(e, buf);
> ++ if (!silent)
> ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
> ++ ERR_get_error();
> ++ }
> ++}
> ++#endif
> +
> + static int rsa_err(const char *msg)
> + {
> +@@ -98,6 +138,7 @@ err_cert:
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> + ENGINE *engine, EVP_PKEY **evpp)
> + {
> +@@ -157,6 +198,7 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> +
> + return 0;
> + }
> ++#endif
> +
> + /**
> + * rsa_get_pub_key() - read a public key
> +@@ -170,8 +212,10 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> + static int rsa_get_pub_key(const char *keydir, const char *name,
> + ENGINE *engine, EVP_PKEY **evpp)
> + {
> ++#ifdef USE_PKCS11_ENGINE
> + if (engine)
> + return rsa_engine_get_pub_key(keydir, name, engine, evpp);
> ++#endif
> + return rsa_pem_get_pub_key(keydir, name, evpp);
> + }
> +
> +@@ -207,6 +251,38 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + return -ENOENT;
> + }
> +
> ++#ifdef USE_PKCS11_PROVIDER
> ++ EVP_PKEY *private_key = NULL;
> ++ OSSL_STORE_CTX *store;
> ++
> ++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
> ++ ERR(1, "OSSL_PROVIDER_try_load(default)");
> ++ /* pkcs11 provider is optional; only needed for pkcs11: URIs */
> ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
> ++ ERR_clear_error();
> ++
> ++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
> ++ ERR(!store, "OSSL_STORE_open");
> ++
> ++ while (!OSSL_STORE_eof(store)) {
> ++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
> ++
> ++ if (!info) {
> ++ drain_openssl_errors(__LINE__, 0);
> ++ continue;
> ++ }
> ++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
> ++ private_key = OSSL_STORE_INFO_get1_PKEY(info);
> ++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
> ++ }
> ++ OSSL_STORE_INFO_free(info);
> ++ if (private_key)
> ++ break;
> ++ }
> ++ OSSL_STORE_close(store);
> ++
> ++ *evpp = private_key;
> ++#else
> + if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
> + rsa_err("Failure reading private key");
> + fclose(f);
> +@@ -214,6 +290,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + }
> + fclose(f);
> +
> ++#endif
> + return 0;
> + }
> +
> +@@ -226,6 +303,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> + const char *keyfile,
> + ENGINE *engine, EVP_PKEY **evpp)
> +@@ -293,6 +371,7 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> +
> + return 0;
> + }
> ++#endif
> +
> + /**
> + * rsa_get_priv_key() - read a private key
> +@@ -306,9 +385,11 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> + static int rsa_get_priv_key(const char *keydir, const char *name,
> + const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
> + {
> ++#ifdef USE_PKCS11_ENGINE
> + if (engine)
> + return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
> + evpp);
> ++#endif
> + return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
> + }
> +
> +@@ -325,6 +406,7 @@ static int rsa_init(void)
> + return 0;
> + }
> +
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_init(const char *engine_id, ENGINE **pe)
> + {
> + const char *key_pass;
> +@@ -372,6 +454,7 @@ err_engine_init:
> + ENGINE_free(e);
> + return ret;
> + }
> ++#endif
> +
> + static void rsa_engine_remove(ENGINE *e)
> + {
> +@@ -471,11 +554,13 @@ int rsa_sign(struct image_sign_info *info,
> + if (ret)
> + return ret;
> +
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id) {
> + ret = rsa_engine_init(info->engine_id, &e);
> + if (ret)
> + return ret;
> + }
> ++#endif
> +
> + ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
> + e, &pkey);
> +@@ -487,16 +572,20 @@ int rsa_sign(struct image_sign_info *info,
> + goto err_sign;
> +
> + EVP_PKEY_free(pkey);
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> +
> + return ret;
> +
> + err_sign:
> + EVP_PKEY_free(pkey);
> + err_priv:
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> + return ret;
> + }
> +
> +@@ -636,11 +725,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
> + ENGINE *e = NULL;
> +
> + debug("%s: Getting verification data\n", __func__);
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id) {
> + ret = rsa_engine_init(info->engine_id, &e);
> + if (ret)
> + return ret;
> + }
> ++#endif
> + ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
> + if (ret)
> + goto err_get_pub_key;
> +@@ -717,8 +808,10 @@ done:
> + err_get_params:
> + EVP_PKEY_free(pkey);
> + err_get_pub_key:
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> +
> + if (ret)
> + return ret;
> +--
> +2.43.0
> +
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch
> new file mode 100644
> index 00000000..c5f3655e
> --- /dev/null
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch
> @@ -0,0 +1,300 @@
> +From 0525693750b1b7a8fb7228dbb97bf592a21322fc Mon Sep 17 00:00:00 2001
> +From: Ryan Eatmon <reatmon@ti.com>
> +Date: Wed, 9 Sep 2026 10:04:50 -0500
> +Subject: [PATCH] Add support for OpenSSL Provider API
> +
> +Backport from 2026.01 patch [1] by Ryan Eatmon <reatmon@ti.com>
> +
> +Upsatream-Status: Inappropriate [OE-specific]
Typo
> +
> +The Engine API has been deprecated since the release of OpenSSL 3.0. End
> +users have been advised to migrate to the new Provider interface.
> +Several distributions have already removed support for engines, which is
> +preventing U-Boot from being compiled in those environments.
> +
> +Add support for the Provider API while continuing to support the existing
> +Engine API on distros shipping older releases of OpenSSL.
> +
> +This is based on similar work contributed by Jan Stancek updating Linux
> +to use the Provider interface.
> +
> + commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
> + Author: Jan Stancek <jstancek@redhat.com>
> + Date: Fri Sep 20 19:52:48 2024 +0300
> +
> + sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
> +
> +The changes have been tested with the FIT signature verification vboot
> +tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
> +Engine library installed and with the Provider API.
> +
> +Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
> +
> +Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
> +
> +Note: Modified to make pkcs11 provider loading optional. The upstream
> +patch unconditionally requires the pkcs11 provider, which is not
> +available in the OE build environment. File-based key signing only needs
> +the default provider; pkcs11 is only required for pkcs11: URI keys.
> +Changes from upstream:
> + - Load default provider first (was pkcs11 first)
> + - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
> + of ERR(1, ...) which calls errx/abort)
> +
> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> +
> +Signed-off-by: Ryan Eatmon <reatmon@ti.com>
> +---
> + lib/aes/aes-encrypt.c | 4 +-
> + lib/rsa/rsa-sign.c | 95 ++++++++++++++++++++++++++++++++++++++++++-
> + 2 files changed, 97 insertions(+), 2 deletions(-)
> +
> +diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
> +index e74e35eaa28..8a6f7715df9 100644
> +--- a/lib/aes/aes-encrypt.c
> ++++ b/lib/aes/aes-encrypt.c
> +@@ -16,7 +16,9 @@
> + #include <openssl/err.h>
> + #include <openssl/ssl.h>
> + #include <openssl/evp.h>
> +-#include <openssl/engine.h>
> ++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# include <openssl/engine.h>
> ++#endif
> + #include <uboot_aes.h>
> +
> + #if OPENSSL_VERSION_NUMBER >= 0x10000000L
> +diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
> +index fa9e143b4ca..af5b18e0c95 100644
> +--- a/lib/rsa/rsa-sign.c
> ++++ b/lib/rsa/rsa-sign.c
> +@@ -19,7 +19,47 @@
> + #include <openssl/err.h>
> + #include <openssl/ssl.h>
> + #include <openssl/evp.h>
> +-#include <openssl/engine.h>
> ++#if OPENSSL_VERSION_MAJOR >= 3
> ++# define USE_PKCS11_PROVIDER
> ++# include <err.h>
> ++# include <openssl/provider.h>
> ++# include <openssl/store.h>
> ++#else
> ++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# define USE_PKCS11_ENGINE
> ++# include <openssl/engine.h>
> ++# endif
> ++#endif
> ++
> ++#ifdef USE_PKCS11_PROVIDER
> ++#define ERR(cond, fmt, ...) \
> ++ do { \
> ++ bool __cond = (cond); \
> ++ drain_openssl_errors(__LINE__, 0); \
> ++ if (__cond) { \
> ++ errx(1, fmt, ## __VA_ARGS__); \
> ++ } \
> ++ } while (0)
> ++
> ++static void drain_openssl_errors(int l, int silent)
> ++{
> ++ const char *file;
> ++ char buf[120];
> ++ int e, line;
> ++
> ++ if (ERR_peek_error() == 0)
> ++ return;
> ++ if (!silent)
> ++ fprintf(stderr, "At main.c:%d:\n", l);
> ++
> ++ while ((e = ERR_peek_error_line(&file, &line))) {
> ++ ERR_error_string(e, buf);
> ++ if (!silent)
> ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
> ++ ERR_get_error();
> ++ }
> ++}
> ++#endif
> +
> + static int rsa_err(const char *msg)
> + {
> +@@ -98,6 +138,7 @@ err_cert:
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> + ENGINE *engine, EVP_PKEY **evpp)
> + {
> +@@ -157,6 +198,7 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> +
> + return 0;
> + }
> ++#endif
> +
> + /**
> + * rsa_get_pub_key() - read a public key
> +@@ -170,8 +212,10 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> + static int rsa_get_pub_key(const char *keydir, const char *name,
> + ENGINE *engine, EVP_PKEY **evpp)
> + {
> ++#ifdef USE_PKCS11_ENGINE
> + if (engine)
> + return rsa_engine_get_pub_key(keydir, name, engine, evpp);
> ++#endif
> + return rsa_pem_get_pub_key(keydir, name, evpp);
> + }
> +
> +@@ -207,6 +251,38 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + return -ENOENT;
> + }
> +
> ++#ifdef USE_PKCS11_PROVIDER
> ++ EVP_PKEY *private_key = NULL;
> ++ OSSL_STORE_CTX *store;
> ++
> ++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
> ++ ERR(1, "OSSL_PROVIDER_try_load(default)");
> ++ /* pkcs11 provider is optional; only needed for pkcs11: URIs */
> ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
> ++ ERR_clear_error();
> ++
> ++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
> ++ ERR(!store, "OSSL_STORE_open");
> ++
> ++ while (!OSSL_STORE_eof(store)) {
> ++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
> ++
> ++ if (!info) {
> ++ drain_openssl_errors(__LINE__, 0);
> ++ continue;
> ++ }
> ++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
> ++ private_key = OSSL_STORE_INFO_get1_PKEY(info);
> ++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
> ++ }
> ++ OSSL_STORE_INFO_free(info);
> ++ if (private_key)
> ++ break;
> ++ }
> ++ OSSL_STORE_close(store);
> ++
> ++ *evpp = private_key;
> ++#else
> + if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
> + rsa_err("Failure reading private key");
> + fclose(f);
> +@@ -214,6 +290,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + }
> + fclose(f);
> +
> ++#endif
> + return 0;
> + }
> +
> +@@ -226,6 +303,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> + const char *keyfile,
> + ENGINE *engine, EVP_PKEY **evpp)
> +@@ -293,6 +371,7 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> +
> + return 0;
> + }
> ++#endif
> +
> + /**
> + * rsa_get_priv_key() - read a private key
> +@@ -306,9 +385,11 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> + static int rsa_get_priv_key(const char *keydir, const char *name,
> + const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
> + {
> ++#ifdef USE_PKCS11_ENGINE
> + if (engine)
> + return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
> + evpp);
> ++#endif
> + return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
> + }
> +
> +@@ -325,6 +406,7 @@ static int rsa_init(void)
> + return 0;
> + }
> +
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_init(const char *engine_id, ENGINE **pe)
> + {
> + const char *key_pass;
> +@@ -372,6 +454,7 @@ err_engine_init:
> + ENGINE_free(e);
> + return ret;
> + }
> ++#endif
> +
> + static void rsa_engine_remove(ENGINE *e)
> + {
> +@@ -480,11 +563,13 @@ int rsa_sign(struct image_sign_info *info,
> + if (ret)
> + return ret;
> +
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id) {
> + ret = rsa_engine_init(info->engine_id, &e);
> + if (ret)
> + return ret;
> + }
> ++#endif
> +
> + ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
> + e, &pkey);
> +@@ -496,16 +581,20 @@ int rsa_sign(struct image_sign_info *info,
> + goto err_sign;
> +
> + EVP_PKEY_free(pkey);
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> +
> + return ret;
> +
> + err_sign:
> + EVP_PKEY_free(pkey);
> + err_priv:
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> + return ret;
> + }
> +
> +@@ -645,11 +734,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
> + ENGINE *e = NULL;
> +
> + debug("%s: Getting verification data\n", __func__);
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id) {
> + ret = rsa_engine_init(info->engine_id, &e);
> + if (ret)
> + return ret;
> + }
> ++#endif
> + ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
> + if (ret)
> + goto err_get_pub_key;
> +@@ -726,8 +817,10 @@ done:
> + err_get_params:
> + EVP_PKEY_free(pkey);
> + err_get_pub_key:
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> +
> + if (ret)
> + return ret;
> +--
> +2.43.0
> +
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch
> new file mode 100644
> index 00000000..346d0584
> --- /dev/null
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch
> @@ -0,0 +1,340 @@
> +From a81cb0932dce109af44d7245d47489fe54ae390f Mon Sep 17 00:00:00 2001
> +From: Eddie Kovsky <ewk@edkovsky.org>
> +Date: Mon, 23 Feb 2026 09:43:22 -0700
> +Subject: [PATCH] Add support for OpenSSL Provider API
> +
> +The Engine API has been deprecated since the release of OpenSSL 3.0. End
> +users have been advised to migrate to the new Provider interface.
> +Several distributions have already removed support for engines, which is
> +preventing U-Boot from being compiled in those environments.
> +
> +Add support for the Provider API while continuing to support the existing
> +Engine API on distros shipping older releases of OpenSSL.
> +
> +This is based on similar work contributed by Jan Stancek updating Linux
> +to use the Provider interface.
> +
> + commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
> + Author: Jan Stancek <jstancek@redhat.com>
> + Date: Fri Sep 20 19:52:48 2024 +0300
> +
> + sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
> +
> +The changes have been tested with the FIT signature verification vboot
> +tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
> +Engine library installed and with the Provider API.
> +
> +Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
> +
> +Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
> +
> +Note: Modified to make pkcs11 provider loading optional. The upstream
> +patch unconditionally requires the pkcs11 provider, which is not
> +available in the OE build environment. File-based key signing only needs
> +the default provider; pkcs11 is only required for pkcs11: URI keys.
> +Changes from upstream:
> + - Load default provider first (was pkcs11 first)
> + - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
> + of ERR(1, ...) which calls errx/abort)
> +
> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> +---
> + doc/build/gcc.rst | 4 +-
> + lib/aes/aes-encrypt.c | 4 +-
> + lib/rsa/rsa-sign.c | 102 +++++++++++++++++++++++++++++++++++++++---
> + tools/docker/Dockerfile | 1 +
> + 4 files changed, 103 insertions(+), 8 deletions(-)
> +
> +diff --git a/doc/build/gcc.rst b/doc/build/gcc.rst
> +index 1fef718ceecb..29a6a632e7e3 100644
> +--- a/doc/build/gcc.rst
> ++++ b/doc/build/gcc.rst
> +@@ -25,8 +25,8 @@ Depending on the build targets further packages maybe needed
> +
> + sudo apt-get install bc bison build-essential coccinelle \
> + device-tree-compiler dfu-util efitools flex gdisk graphviz imagemagick \
> +- libgnutls28-dev libguestfs-tools libncurses-dev \
> +- libpython3-dev libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl \
> ++ libgnutls28-dev libguestfs-tools libncurses-dev libpython3-dev \
> ++ libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl pkcs11-provider \
> + pkg-config python3 python3-asteval python3-coverage python3-filelock \
> + python3-pkg-resources python3-pycryptodome python3-pyelftools \
> + python3-pytest python3-pytest-xdist python3-sphinxcontrib.apidoc \
> +diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
> +index 90e1407b4f09..4fc4ce232478 100644
> +--- a/lib/aes/aes-encrypt.c
> ++++ b/lib/aes/aes-encrypt.c
> +@@ -16,7 +16,9 @@
> + #include <openssl/err.h>
> + #include <openssl/ssl.h>
> + #include <openssl/evp.h>
> +-#include <openssl/engine.h>
> ++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# include <openssl/engine.h>
> ++#endif
> + #include <uboot_aes.h>
> +
> + #if OPENSSL_VERSION_NUMBER >= 0x10000000L
> +diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
> +index 0e38c9e802fd..f456f3c58e65 100644
> +--- a/lib/rsa/rsa-sign.c
> ++++ b/lib/rsa/rsa-sign.c
> +@@ -19,7 +19,47 @@
> + #include <openssl/err.h>
> + #include <openssl/ssl.h>
> + #include <openssl/evp.h>
> +-#include <openssl/engine.h>
> ++#if OPENSSL_VERSION_MAJOR >= 3
> ++# define USE_PKCS11_PROVIDER
> ++# include <err.h>
> ++# include <openssl/provider.h>
> ++# include <openssl/store.h>
> ++#else
> ++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# define USE_PKCS11_ENGINE
> ++# include <openssl/engine.h>
> ++# endif
> ++#endif
> ++
> ++#ifdef USE_PKCS11_PROVIDER
> ++#define ERR(cond, fmt, ...) \
> ++ do { \
> ++ bool __cond = (cond); \
> ++ drain_openssl_errors(__LINE__, 0); \
> ++ if (__cond) { \
> ++ errx(1, fmt, ## __VA_ARGS__); \
> ++ } \
> ++ } while (0)
> ++
> ++static void drain_openssl_errors(int l, int silent)
> ++{
> ++ const char *file;
> ++ char buf[120];
> ++ int e, line;
> ++
> ++ if (ERR_peek_error() == 0)
> ++ return;
> ++ if (!silent)
> ++ fprintf(stderr, "At main.c:%d:\n", l);
> ++
> ++ while ((e = ERR_peek_error_line(&file, &line))) {
> ++ ERR_error_string(e, buf);
> ++ if (!silent)
> ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
> ++ ERR_get_error();
> ++ }
> ++}
> ++#endif
> +
> + static int rsa_err(const char *msg)
> + {
> +@@ -94,10 +134,11 @@ static int rsa_pem_get_pub_key(const char *keydir, const char *name, EVP_PKEY **
> + *
> + * @keydir: Key prefix
> + * @name Name of key
> +- * @engine Engine to use
> ++ * @engine Engine to use or NULL when using pkcs11 provider
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> + ENGINE *engine, EVP_PKEY **evpp)
> + {
> +@@ -157,21 +198,24 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> +
> + return 0;
> + }
> ++#endif
> +
> + /**
> + * rsa_get_pub_key() - read a public key
> + *
> + * @keydir: Directory containing the key (PEM file) or key prefix (engine)
> + * @name Name of key file (will have a .crt extension)
> +- * @engine Engine to use
> ++ * @engine Engine to use or NULL when using pkcs11 provider
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> + static int rsa_get_pub_key(const char *keydir, const char *name,
> + ENGINE *engine, EVP_PKEY **evpp)
> + {
> ++#ifdef USE_PKCS11_ENGINE
> + if (engine)
> + return rsa_engine_get_pub_key(keydir, name, engine, evpp);
> ++#endif
> + return rsa_pem_get_pub_key(keydir, name, evpp);
> + }
> +
> +@@ -207,13 +251,45 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + return -ENOENT;
> + }
> +
> ++#ifdef USE_PKCS11_PROVIDER
> ++ EVP_PKEY *private_key = NULL;
> ++ OSSL_STORE_CTX *store;
> ++
> ++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
> ++ ERR(1, "OSSL_PROVIDER_try_load(default)");
> ++ /* pkcs11 provider is optional; only needed for pkcs11: URIs */
> ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
> ++ ERR_clear_error();
> ++
> ++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
> ++ ERR(!store, "OSSL_STORE_open");
> ++
> ++ while (!OSSL_STORE_eof(store)) {
> ++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
> ++
> ++ if (!info) {
> ++ drain_openssl_errors(__LINE__, 0);
> ++ continue;
> ++ }
> ++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
> ++ private_key = OSSL_STORE_INFO_get1_PKEY(info);
> ++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
> ++ }
> ++ OSSL_STORE_INFO_free(info);
> ++ if (private_key)
> ++ break;
> ++ }
> ++ OSSL_STORE_close(store);
> ++
> ++ *evpp = private_key;
> ++#else
> + if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
> + rsa_err("Failure reading private key");
> + fclose(f);
> + return -EPROTO;
> + }
> + fclose(f);
> +-
> ++#endif
> + return 0;
> + }
> +
> +@@ -226,6 +301,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> + const char *keyfile,
> + ENGINE *engine, EVP_PKEY **evpp)
> +@@ -293,22 +369,25 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> +
> + return 0;
> + }
> ++#endif
> +
> + /**
> + * rsa_get_priv_key() - read a private key
> + *
> + * @keydir: Directory containing the key (PEM file) or key prefix (engine)
> + * @name Name of key
> +- * @engine Engine to use for signing
> ++ * @engine Engine to use or NULL when using pkcs11 provider
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> + static int rsa_get_priv_key(const char *keydir, const char *name,
> + const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
> + {
> ++#ifdef USE_PKCS11_ENGINE
> + if (engine)
> + return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
> + evpp);
> ++#endif
> + return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
> + }
> +
> +@@ -325,6 +404,7 @@ static int rsa_init(void)
> + return 0;
> + }
> +
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_init(const char *engine_id, ENGINE **pe)
> + {
> + const char *key_pass;
> +@@ -380,6 +460,7 @@ static void rsa_engine_remove(ENGINE *e)
> + ENGINE_free(e);
> + }
> + }
> ++#endif
> +
> + static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo,
> + struct checksum_algo *checksum_algo,
> +@@ -480,11 +561,13 @@ int rsa_sign(struct image_sign_info *info,
> + if (ret)
> + return ret;
> +
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id) {
> + ret = rsa_engine_init(info->engine_id, &e);
> + if (ret)
> + return ret;
> + }
> ++#endif
> +
> + ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
> + e, &pkey);
> +@@ -496,16 +579,21 @@ int rsa_sign(struct image_sign_info *info,
> + goto err_sign;
> +
> + EVP_PKEY_free(pkey);
> ++
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> +
> + return ret;
> +
> + err_sign:
> + EVP_PKEY_free(pkey);
> + err_priv:
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> + return ret;
> + }
> +
> +@@ -645,11 +733,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
> + ENGINE *e = NULL;
> +
> + debug("%s: Getting verification data\n", __func__);
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id) {
> + ret = rsa_engine_init(info->engine_id, &e);
> + if (ret)
> + return ret;
> + }
> ++#endif
> + ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
> + if (ret)
> + goto err_get_pub_key;
> +@@ -726,8 +816,10 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
> + err_get_params:
> + EVP_PKEY_free(pkey);
> + err_get_pub_key:
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> +
> + if (ret)
> + return ret;
> +diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
> +index 73bf6cdd2c52..50e98e83dc20 100644
> +--- a/tools/docker/Dockerfile
> ++++ b/tools/docker/Dockerfile
> +@@ -122,6 +122,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
> + openssl \
> + picocom \
> + parted \
> ++ pkcs11-provider \
> + pkg-config \
> + python-is-python3 \
> + python3 \
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb
> index d3a78d8b..5812b914 100644
> --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb
> @@ -4,6 +4,8 @@ PR = "r0"
>
> BRANCH = "ti-u-boot-2024.04"
>
> -SRC_URI += "file://0001-scripts-dtc-pylibfdt-libfdt.i_shipped-Use-SWIG_Appen.patch"
> -
> SRCREV_uboot = "29d0c23d67ee7b88e46fe1753cd020e2b04c2ef6"
> +
> +SRC_URI += "file://0001-scripts-dtc-pylibfdt-libfdt.i_shipped-Use-SWIG_Appen.patch"
> +SRC_URI += "file://0001-binman-migrate-form-pkg_resources-to-importlib.patch"
> +SRC_URI += "file://0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch"
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb
> index f7475c2b..af4b1b77 100644
> --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb
> @@ -7,3 +7,4 @@ BRANCH = "ti-u-boot-2025.01"
> SRCREV_uboot = "4ca322ca563a21cccad8c9ba65e386b9fd34dd16"
>
> SRC_URI += "file://0001-binman-migrate-form-pkg_resources-to-importlib.patch"
> +SRC_URI += "file://0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch"
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb
> index 7637cfaf..d1ef241d 100644
> --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb
> @@ -5,3 +5,5 @@ PR = "r0"
> BRANCH = "ti-u-boot-2026.01"
>
> SRCREV_uboot = "2a85f4bcffc50ddc8b443d8e4162e9e46ed0f200"
> +
> +SRC_URI += "file://0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch"
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
> index 3d6769bf..8213ac60 100644
> --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
> @@ -25,6 +25,7 @@ UBOOT_GIT_PROTOCOL ?= "https"
> UBOOT_GIT_BRANCH ?= "branch=${BRANCH}"
> SRC_URI = "${UBOOT_GIT_URI};protocol=${UBOOT_GIT_PROTOCOL};${UBOOT_GIT_BRANCH};name=uboot"
>
> +SRC_URI:append:bsp-ti-6_6 = " file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch"
> SRC_URI:append:bsp-ti-6_12 = " file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch"
> SRC_URI:append:bsp-ti-6_18 = " file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch"
>
> --
> 2.43.0
>
-- Yogesh
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [meta-ti][master][PATCH v2 5/5] mesa-pvr: Fix for building with new LLVM version
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 5/5] mesa-pvr: Fix for building with new LLVM version Ryan Eatmon
@ 2026-09-10 5:43 ` Yogesh Hegde
0 siblings, 0 replies; 11+ messages in thread
From: Yogesh Hegde @ 2026-09-10 5:43 UTC (permalink / raw)
To: reatmon; +Cc: Praneeth Bajjuri, Denys Dmytriyenko, meta-ti
Hi Ryan,
On 20:54-20260909, Ryan Eatmon via lists.yoctoproject.org wrote:
> A recnet version change [1] caused a build failure. Backport a patch
Typo in recent.
> from the mesa repo to address it [2].
>
> [1] https://git.openembedded.org/openembedded-core/commit/?id=d1575787a815fbe1ca60b20664665f92a95b2264
> [2] https://gitlab.freedesktop.org/mesa/mesa/-/commit/f958ad11955638758c19170d9df4d67bf1ff8bcb
>
> Signed-off-by: Ryan Eatmon <reatmon@ti.com>
> ---
> v2; No change.
>
> .../0001-clc-fix-build-with-LLVM13.patch | 45 +++++++++++++++++++
> .../recipes-graphics/mesa/mesa-pvr_25.2.8.bb | 4 +-
> 2 files changed, 48 insertions(+), 1 deletion(-)
> create mode 100644 meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.2.8/0001-clc-fix-build-with-LLVM13.patch
>
> diff --git a/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.2.8/0001-clc-fix-build-with-LLVM13.patch b/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.2.8/0001-clc-fix-build-with-LLVM13.patch
> new file mode 100644
> index 00000000..77bd993a
> --- /dev/null
> +++ b/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr-25.2.8/0001-clc-fix-build-with-LLVM13.patch
> @@ -0,0 +1,45 @@
> +From f958ad11955638758c19170d9df4d67bf1ff8bcb Mon Sep 17 00:00:00 2001
> +From: Lone_Wolf <lone_wolf@klaas-de-kat.nl>
> +Date: Wed, 13 May 2026 22:54:45 +0200
> +Subject: [PATCH] clc: fix build with LLVM23 (TargetRegistry::lookupTarget)
> +
> +See https://github.com/llvm/llvm-project/commit/d50631faad3003e73589528c83d3bbbad7ba72f1
> +
> +Closes: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/15471
> +Cc: mesa-stable
> +Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/41558>
> +
> +Upstream-Status: Inappropriate [OE-specific]
> +
> +---
> + src/compiler/clc/clc_helpers.cpp | 11 +++++------
> + 1 file changed, 5 insertions(+), 6 deletions(-)
> +
> +diff --git a/src/compiler/clc/clc_helpers.cpp b/src/compiler/clc/clc_helpers.cpp
> +index 66d4af43a36a..e5c3d158b290 100644
> +--- a/src/compiler/clc/clc_helpers.cpp
> ++++ b/src/compiler/clc/clc_helpers.cpp
> +@@ -1186,15 +1186,14 @@ llvm_mod_to_spirv(std::unique_ptr<::llvm::Module> mod,
> + if (args->use_llvm_spirv_target) {
> + const char *triple = args->address_bits == 32 ? "spirv-unknown-unknown" : "spirv64-unknown-unknown";
> + std::string error_msg("");
> +- auto target = TargetRegistry::lookupTarget(triple, error_msg);
> +- if (target) {
> +- auto TM = target->createTargetMachine(
> + #if LLVM_VERSION_MAJOR >= 21
> +- llvm::Triple(triple),
> ++ auto temp_triple = llvm::Triple(triple);
> + #else
> +- triple,
> ++ auto temp_triple = triple;
> + #endif
> +- "", "", {}, std::nullopt, std::nullopt,
> ++ auto target = TargetRegistry::lookupTarget(temp_triple, error_msg);
> ++ if (target) {
> ++ auto TM = target->createTargetMachine(temp_triple, "", "", {}, std::nullopt, std::nullopt,
> + #if LLVM_VERSION_MAJOR >= 18
> + ::llvm::CodeGenOptLevel::None
> + #else
> +--
> +GitLab
> +
> diff --git a/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr_25.2.8.bb b/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr_25.2.8.bb
> index 03b0b9bf..cd622864 100644
> --- a/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr_25.2.8.bb
> +++ b/meta-ti-bsp/recipes-graphics/mesa/mesa-pvr_25.2.8.bb
> @@ -11,7 +11,9 @@ LIC_FILES_CHKSUM = "file://docs/license.rst;md5=ffe678546d4337b732cfd12262e6af11
> BRANCH = "powervr/${PV}"
>
> SRC_URI = "git://github.com/TexasInstruments/mesa.git;protocol=https;branch=${BRANCH} \
> - file://0001-meson-misdetects-64bit-atomics-on-mips-clang.patch"
> + file://0001-meson-misdetects-64bit-atomics-on-mips-clang.patch \
> + file://0001-clc-fix-build-with-LLVM13.patch \
> + "
>
> SRCREV = "7b6e8de7b0acdaff684f1109c6acb575644a93ea"
> PV = "25.2.8"
> --
> 2.43.0
>
-- Yogesh
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [meta-ti][master][PATCH v2 2/5] linux-ti-staging_6.6: Backport OpenSSL 4.0 patches
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 2/5] linux-ti-staging_6.6: Backport OpenSSL 4.0 patches Ryan Eatmon
@ 2026-09-10 5:50 ` Yogesh Hegde
0 siblings, 0 replies; 11+ messages in thread
From: Yogesh Hegde @ 2026-09-10 5:50 UTC (permalink / raw)
To: reatmon; +Cc: Praneeth Bajjuri, Denys Dmytriyenko, meta-ti
Hi Ryan,
On 20:54-20260909, Ryan Eatmon via lists.yoctoproject.org wrote:
> Backport a set of kernel patches to 6.6 to fix the OpenSSL build
> failures.
>
> Signed-off-by: Ryan Eatmon <reatmon@ti.com>
> ---
> v2; Added missing Upstream-Status.
>
> ...mon-SSL-helper-functions-to-a-header.patch | 205 ++++++++++++++++++
> ...-using-deprecated-ERR_get_error_line.patch | 121 +++++++++++
> ...-pkcs11-provider-for-OPENSSL-MAJOR-3.patch | 163 ++++++++++++++
> .../linux/linux-ti-staging_6.6.bb | 6 +
> 4 files changed, 495 insertions(+)
> create mode 100644 meta-ti-bsp/recipes-kernel/linux/files/0001-move-common-SSL-helper-functions-to-a-header.patch
> create mode 100644 meta-ti-bsp/recipes-kernel/linux/files/0002-avoid-using-deprecated-ERR_get_error_line.patch
> create mode 100644 meta-ti-bsp/recipes-kernel/linux/files/0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch
>
> diff --git a/meta-ti-bsp/recipes-kernel/linux/files/0001-move-common-SSL-helper-functions-to-a-header.patch b/meta-ti-bsp/recipes-kernel/linux/files/0001-move-common-SSL-helper-functions-to-a-header.patch
> new file mode 100644
> index 00000000..6a58b5eb
> --- /dev/null
> +++ b/meta-ti-bsp/recipes-kernel/linux/files/0001-move-common-SSL-helper-functions-to-a-header.patch
> @@ -0,0 +1,205 @@
> +From 300e6d4116f956b035281ec94297dc4dc8d4e1d3 Mon Sep 17 00:00:00 2001
> +From: Jan Stancek <jstancek@redhat.com>
> +Date: Fri, 12 Jul 2024 09:11:14 +0200
> +Subject: sign-file,extract-cert: move common SSL helper functions to a header
> +
> +Couple error handling helpers are repeated in both tools, so
> +move them to a common header.
> +
> +Signed-off-by: Jan Stancek <jstancek@redhat.com>
> +Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> +Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
> +Reviewed-by: Neal Gompa <neal@gompa.dev>
> +Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> +
> +Upstream-Status: Inappropriate [OE specific]
> +---
> + MAINTAINERS | 1 +
> + certs/Makefile | 2 +-
> + certs/extract-cert.c | 37 ++-----------------------------------
> + scripts/sign-file.c | 37 ++-----------------------------------
> + scripts/ssl-common.h | 39 +++++++++++++++++++++++++++++++++++++++
> + 5 files changed, 45 insertions(+), 71 deletions(-)
> + create mode 100644 scripts/ssl-common.h
> +
> +diff --git a/MAINTAINERS b/MAINTAINERS
> +index 9278c30ef1d5a..23f9028848552 100644
> +--- a/MAINTAINERS
> ++++ b/MAINTAINERS
> +@@ -5204,6 +5204,7 @@ S: Maintained
> + F: Documentation/admin-guide/module-signing.rst
> + F: certs/
> + F: scripts/sign-file.c
> ++F: scripts/ssl-common.h
> + F: tools/certs/
> +
> + CFAG12864B LCD DRIVER
> +diff --git a/certs/Makefile b/certs/Makefile
> +index 1094e3860c2a7..f6fa4d8d75e05 100644
> +--- a/certs/Makefile
> ++++ b/certs/Makefile
> +@@ -84,5 +84,5 @@ targets += x509_revocation_list
> +
> + hostprogs := extract-cert
> +
> +-HOSTCFLAGS_extract-cert.o = $(shell $(HOSTPKG_CONFIG) --cflags libcrypto 2> /dev/null)
> ++HOSTCFLAGS_extract-cert.o = $(shell $(HOSTPKG_CONFIG) --cflags libcrypto 2> /dev/null) -I$(srctree)/scripts
> + HOSTLDLIBS_extract-cert = $(shell $(HOSTPKG_CONFIG) --libs libcrypto 2> /dev/null || echo -lcrypto)
> +diff --git a/certs/extract-cert.c b/certs/extract-cert.c
> +index 70e9ec89d87d3..8e7ba9974a1fa 100644
> +--- a/certs/extract-cert.c
> ++++ b/certs/extract-cert.c
> +@@ -23,6 +23,8 @@
> + #include <openssl/err.h>
> + #include <openssl/engine.h>
> +
> ++#include "ssl-common.h"
> ++
> + /*
> + * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
> + *
> +@@ -40,41 +42,6 @@ void format(void)
> + exit(2);
> + }
> +
> +-static void display_openssl_errors(int l)
> +-{
> +- const char *file;
> +- char buf[120];
> +- int e, line;
> +-
> +- if (ERR_peek_error() == 0)
> +- return;
> +- fprintf(stderr, "At main.c:%d:\n", l);
> +-
> +- while ((e = ERR_get_error_line(&file, &line))) {
> +- ERR_error_string(e, buf);
> +- fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
> +- }
> +-}
> +-
> +-static void drain_openssl_errors(void)
> +-{
> +- const char *file;
> +- int line;
> +-
> +- if (ERR_peek_error() == 0)
> +- return;
> +- while (ERR_get_error_line(&file, &line)) {}
> +-}
> +-
> +-#define ERR(cond, fmt, ...) \
> +- do { \
> +- bool __cond = (cond); \
> +- display_openssl_errors(__LINE__); \
> +- if (__cond) { \
> +- err(1, fmt, ## __VA_ARGS__); \
> +- } \
> +- } while(0)
> +-
> + static const char *key_pass;
> + static BIO *wb;
> + static char *cert_dst;
> +diff --git a/scripts/sign-file.c b/scripts/sign-file.c
> +index 3edb156ae52c3..39ba58db5d4ea 100644
> +--- a/scripts/sign-file.c
> ++++ b/scripts/sign-file.c
> +@@ -29,6 +29,8 @@
> + #include <openssl/err.h>
> + #include <openssl/engine.h>
> +
> ++#include "ssl-common.h"
> ++
> + /*
> + * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
> + *
> +@@ -83,41 +85,6 @@ void format(void)
> + exit(2);
> + }
> +
> +-static void display_openssl_errors(int l)
> +-{
> +- const char *file;
> +- char buf[120];
> +- int e, line;
> +-
> +- if (ERR_peek_error() == 0)
> +- return;
> +- fprintf(stderr, "At main.c:%d:\n", l);
> +-
> +- while ((e = ERR_get_error_line(&file, &line))) {
> +- ERR_error_string(e, buf);
> +- fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
> +- }
> +-}
> +-
> +-static void drain_openssl_errors(void)
> +-{
> +- const char *file;
> +- int line;
> +-
> +- if (ERR_peek_error() == 0)
> +- return;
> +- while (ERR_get_error_line(&file, &line)) {}
> +-}
> +-
> +-#define ERR(cond, fmt, ...) \
> +- do { \
> +- bool __cond = (cond); \
> +- display_openssl_errors(__LINE__); \
> +- if (__cond) { \
> +- errx(1, fmt, ## __VA_ARGS__); \
> +- } \
> +- } while(0)
> +-
> + static const char *key_pass;
> +
> + static int pem_pw_cb(char *buf, int len, int w, void *v)
> +diff --git a/scripts/ssl-common.h b/scripts/ssl-common.h
> +new file mode 100644
> +index 0000000000000..e6711c75ed913
> +--- /dev/null
> ++++ b/scripts/ssl-common.h
> +@@ -0,0 +1,39 @@
> ++/* SPDX-License-Identifier: LGPL-2.1+ */
> ++/*
> ++ * SSL helper functions shared by sign-file and extract-cert.
> ++ */
> ++
> ++static void display_openssl_errors(int l)
> ++{
> ++ const char *file;
> ++ char buf[120];
> ++ int e, line;
> ++
> ++ if (ERR_peek_error() == 0)
> ++ return;
> ++ fprintf(stderr, "At main.c:%d:\n", l);
> ++
> ++ while ((e = ERR_get_error_line(&file, &line))) {
> ++ ERR_error_string(e, buf);
> ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
> ++ }
> ++}
> ++
> ++static void drain_openssl_errors(void)
> ++{
> ++ const char *file;
> ++ int line;
> ++
> ++ if (ERR_peek_error() == 0)
> ++ return;
> ++ while (ERR_get_error_line(&file, &line)) {}
> ++}
> ++
> ++#define ERR(cond, fmt, ...) \
> ++ do { \
> ++ bool __cond = (cond); \
> ++ display_openssl_errors(__LINE__); \
> ++ if (__cond) { \
> ++ errx(1, fmt, ## __VA_ARGS__); \
> ++ } \
> ++ } while (0)
> +--
> +cgit 1.3.1-korg
> +
> diff --git a/meta-ti-bsp/recipes-kernel/linux/files/0002-avoid-using-deprecated-ERR_get_error_line.patch b/meta-ti-bsp/recipes-kernel/linux/files/0002-avoid-using-deprecated-ERR_get_error_line.patch
> new file mode 100644
> index 00000000..993f6739
> --- /dev/null
> +++ b/meta-ti-bsp/recipes-kernel/linux/files/0002-avoid-using-deprecated-ERR_get_error_line.patch
> @@ -0,0 +1,121 @@
> +From 467d60eddf55588add232feda325da7215ddaf30 Mon Sep 17 00:00:00 2001
> +From: Jan Stancek <jstancek@redhat.com>
> +Date: Fri, 12 Jul 2024 09:11:15 +0200
> +Subject: sign-file,extract-cert: avoid using deprecated ERR_get_error_line()
> +
> +ERR_get_error_line() is deprecated since OpenSSL 3.0.
> +
> +Use ERR_peek_error_line() instead, and combine display_openssl_errors()
> +and drain_openssl_errors() to a single function where parameter decides
> +if it should consume errors silently.
> +
> +Signed-off-by: Jan Stancek <jstancek@redhat.com>
> +Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> +Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
> +Reviewed-by: Neal Gompa <neal@gompa.dev>
> +Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> +
> +Upstream-Status: Inappropriate [OE-specifc]
Typo in "specific".
> +---
> + certs/extract-cert.c | 4 ++--
> + scripts/sign-file.c | 6 +++---
> + scripts/ssl-common.h | 23 ++++++++---------------
> + 3 files changed, 13 insertions(+), 20 deletions(-)
> +
> +diff --git a/certs/extract-cert.c b/certs/extract-cert.c
> +index 8e7ba9974a1fa..61bbe00856717 100644
> +--- a/certs/extract-cert.c
> ++++ b/certs/extract-cert.c
> +@@ -99,11 +99,11 @@ int main(int argc, char **argv)
> + parms.cert = NULL;
> +
> + ENGINE_load_builtin_engines();
> +- drain_openssl_errors();
> ++ drain_openssl_errors(__LINE__, 1);
> + e = ENGINE_by_id("pkcs11");
> + ERR(!e, "Load PKCS#11 ENGINE");
> + if (ENGINE_init(e))
> +- drain_openssl_errors();
> ++ drain_openssl_errors(__LINE__, 1);
> + else
> + ERR(1, "ENGINE_init");
> + if (key_pass)
> +diff --git a/scripts/sign-file.c b/scripts/sign-file.c
> +index 39ba58db5d4ea..bb3fdf1a617c2 100644
> +--- a/scripts/sign-file.c
> ++++ b/scripts/sign-file.c
> +@@ -114,11 +114,11 @@ static EVP_PKEY *read_private_key(const char *private_key_name)
> + ENGINE *e;
> +
> + ENGINE_load_builtin_engines();
> +- drain_openssl_errors();
> ++ drain_openssl_errors(__LINE__, 1);
> + e = ENGINE_by_id("pkcs11");
> + ERR(!e, "Load PKCS#11 ENGINE");
> + if (ENGINE_init(e))
> +- drain_openssl_errors();
> ++ drain_openssl_errors(__LINE__, 1);
> + else
> + ERR(1, "ENGINE_init");
> + if (key_pass)
> +@@ -273,7 +273,7 @@ int main(int argc, char **argv)
> +
> + /* Digest the module data. */
> + OpenSSL_add_all_digests();
> +- display_openssl_errors(__LINE__);
> ++ drain_openssl_errors(__LINE__, 0);
> + digest_algo = EVP_get_digestbyname(hash_algo);
> + ERR(!digest_algo, "EVP_get_digestbyname");
> +
> +diff --git a/scripts/ssl-common.h b/scripts/ssl-common.h
> +index e6711c75ed913..2db0e181143cf 100644
> +--- a/scripts/ssl-common.h
> ++++ b/scripts/ssl-common.h
> +@@ -3,7 +3,7 @@
> + * SSL helper functions shared by sign-file and extract-cert.
> + */
> +
> +-static void display_openssl_errors(int l)
> ++static void drain_openssl_errors(int l, int silent)
> + {
> + const char *file;
> + char buf[120];
> +@@ -11,28 +11,21 @@ static void display_openssl_errors(int l)
> +
> + if (ERR_peek_error() == 0)
> + return;
> +- fprintf(stderr, "At main.c:%d:\n", l);
> ++ if (!silent)
> ++ fprintf(stderr, "At main.c:%d:\n", l);
> +
> +- while ((e = ERR_get_error_line(&file, &line))) {
> ++ while ((e = ERR_peek_error_line(&file, &line))) {
> + ERR_error_string(e, buf);
> +- fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
> ++ if (!silent)
> ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
> ++ ERR_get_error();
> + }
> + }
> +
> +-static void drain_openssl_errors(void)
> +-{
> +- const char *file;
> +- int line;
> +-
> +- if (ERR_peek_error() == 0)
> +- return;
> +- while (ERR_get_error_line(&file, &line)) {}
> +-}
> +-
> + #define ERR(cond, fmt, ...) \
> + do { \
> + bool __cond = (cond); \
> +- display_openssl_errors(__LINE__); \
> ++ drain_openssl_errors(__LINE__, 0); \
> + if (__cond) { \
> + errx(1, fmt, ## __VA_ARGS__); \
> + } \
> +--
> +cgit 1.3.1-korg
> +
> diff --git a/meta-ti-bsp/recipes-kernel/linux/files/0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch b/meta-ti-bsp/recipes-kernel/linux/files/0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch
> new file mode 100644
> index 00000000..8f509895
> --- /dev/null
> +++ b/meta-ti-bsp/recipes-kernel/linux/files/0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch
> @@ -0,0 +1,163 @@
> +From 558bdc45dfb2669e1741384a0c80be9c82fa052c Mon Sep 17 00:00:00 2001
> +From: Jan Stancek <jstancek@redhat.com>
> +Date: Fri, 20 Sep 2024 19:52:48 +0300
> +Subject: sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
> +
> +ENGINE API has been deprecated since OpenSSL version 3.0 [1].
> +Distros have started dropping support from headers and in future
> +it will likely disappear also from library.
> +
> +It has been superseded by the PROVIDER API, so use it instead
> +for OPENSSL MAJOR >= 3.
> +
> +[1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md
> +
> +[jarkko: fixed up alignment issues reported by checkpatch.pl --strict]
> +
> +Signed-off-by: Jan Stancek <jstancek@redhat.com>
> +Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> +Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com>
> +Reviewed-by: Neal Gompa <neal@gompa.dev>
> +Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> +
> +Upstream-Status: Inappropriate [OE-specifc]
Nitpicking here, Typo in "specific", I don't think these typos affect anything major.
> +---
> + certs/extract-cert.c | 103 ++++++++++++++++++++++++++++++++++++---------------
> + 1 file changed, 73 insertions(+), 30 deletions(-)
> +
> +(limited to 'certs/extract-cert.c')
> +
> +diff --git a/certs/extract-cert.c b/certs/extract-cert.c
> +index 61bbe00856717..7d6d468ed6129 100644
> +--- a/certs/extract-cert.c
> ++++ b/certs/extract-cert.c
> +@@ -21,17 +21,18 @@
> + #include <openssl/bio.h>
> + #include <openssl/pem.h>
> + #include <openssl/err.h>
> +-#include <openssl/engine.h>
> +-
> ++#if OPENSSL_VERSION_MAJOR >= 3
> ++# define USE_PKCS11_PROVIDER
> ++# include <openssl/provider.h>
> ++# include <openssl/store.h>
> ++#else
> ++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# define USE_PKCS11_ENGINE
> ++# include <openssl/engine.h>
> ++# endif
> ++#endif
> + #include "ssl-common.h"
> +
> +-/*
> +- * OpenSSL 3.0 deprecates the OpenSSL's ENGINE API.
> +- *
> +- * Remove this if/when that API is no longer used
> +- */
> +-#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
> +-
> + #define PKEY_ID_PKCS7 2
> +
> + static __attribute__((noreturn))
> +@@ -61,6 +62,66 @@ static void write_cert(X509 *x509)
> + fprintf(stderr, "Extracted cert: %s\n", buf);
> + }
> +
> ++static X509 *load_cert_pkcs11(const char *cert_src)
> ++{
> ++ X509 *cert = NULL;
> ++#ifdef USE_PKCS11_PROVIDER
> ++ OSSL_STORE_CTX *store;
> ++
> ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
> ++ ERR(1, "OSSL_PROVIDER_try_load(pkcs11)");
> ++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
> ++ ERR(1, "OSSL_PROVIDER_try_load(default)");
> ++
> ++ store = OSSL_STORE_open(cert_src, NULL, NULL, NULL, NULL);
> ++ ERR(!store, "OSSL_STORE_open");
> ++
> ++ while (!OSSL_STORE_eof(store)) {
> ++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
> ++
> ++ if (!info) {
> ++ drain_openssl_errors(__LINE__, 0);
> ++ continue;
> ++ }
> ++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_CERT) {
> ++ cert = OSSL_STORE_INFO_get1_CERT(info);
> ++ ERR(!cert, "OSSL_STORE_INFO_get1_CERT");
> ++ }
> ++ OSSL_STORE_INFO_free(info);
> ++ if (cert)
> ++ break;
> ++ }
> ++ OSSL_STORE_close(store);
> ++#elif defined(USE_PKCS11_ENGINE)
> ++ ENGINE *e;
> ++ struct {
> ++ const char *cert_id;
> ++ X509 *cert;
> ++ } parms;
> ++
> ++ parms.cert_id = cert_src;
> ++ parms.cert = NULL;
> ++
> ++ ENGINE_load_builtin_engines();
> ++ drain_openssl_errors(__LINE__, 1);
> ++ e = ENGINE_by_id("pkcs11");
> ++ ERR(!e, "Load PKCS#11 ENGINE");
> ++ if (ENGINE_init(e))
> ++ drain_openssl_errors(__LINE__, 1);
> ++ else
> ++ ERR(1, "ENGINE_init");
> ++ if (key_pass)
> ++ ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
> ++ ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
> ++ ERR(!parms.cert, "Get X.509 from PKCS#11");
> ++ cert = parms.cert;
> ++#else
> ++ fprintf(stderr, "no pkcs11 engine/provider available\n");
> ++ exit(1);
> ++#endif
> ++ return cert;
> ++}
> ++
> + int main(int argc, char **argv)
> + {
> + char *cert_src;
> +@@ -89,28 +150,10 @@ int main(int argc, char **argv)
> + fclose(f);
> + exit(0);
> + } else if (!strncmp(cert_src, "pkcs11:", 7)) {
> +- ENGINE *e;
> +- struct {
> +- const char *cert_id;
> +- X509 *cert;
> +- } parms;
> ++ X509 *cert = load_cert_pkcs11(cert_src);
> +
> +- parms.cert_id = cert_src;
> +- parms.cert = NULL;
> +-
> +- ENGINE_load_builtin_engines();
> +- drain_openssl_errors(__LINE__, 1);
> +- e = ENGINE_by_id("pkcs11");
> +- ERR(!e, "Load PKCS#11 ENGINE");
> +- if (ENGINE_init(e))
> +- drain_openssl_errors(__LINE__, 1);
> +- else
> +- ERR(1, "ENGINE_init");
> +- if (key_pass)
> +- ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0), "Set PKCS#11 PIN");
> +- ENGINE_ctrl_cmd(e, "LOAD_CERT_CTRL", 0, &parms, NULL, 1);
> +- ERR(!parms.cert, "Get X.509 from PKCS#11");
> +- write_cert(parms.cert);
> ++ ERR(!cert, "load_cert_pkcs11 failed");
> ++ write_cert(cert);
> + } else {
> + BIO *b;
> + X509 *x509;
> +--
> +cgit 1.3.1-korg
> +
> diff --git a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.6.bb b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.6.bb
> index 9acc95c8..3d6b7007 100644
> --- a/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.6.bb
> +++ b/meta-ti-bsp/recipes-kernel/linux/linux-ti-staging_6.6.bb
> @@ -28,6 +28,12 @@ KERNEL_REPRODUCIBILITY_PATCHES = " \
> file://0001-vt-conmakehash-improve-reproducibility.patch \
> "
>
> +SRC_URI += "\
> + file://0001-move-common-SSL-helper-functions-to-a-header.patch \
> + file://0002-avoid-using-deprecated-ERR_get_error_line.patch \
> + file://0003-use-pkcs11-provider-for-OPENSSL-MAJOR-3.patch \
> +"
> +
> # Special configuration for remoteproc/rpmsg IPC modules
> module_conf_rpmsg_client_sample = "blacklist rpmsg_client_sample"
> module_conf_ti_k3_r5_remoteproc = "softdep ti_k3_r5_remoteproc pre: virtio_rpmsg_bus"
> --
> 2.43.0
>
-- Yogesh
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0
2026-09-10 1:54 [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0 Ryan Eatmon
` (5 preceding siblings ...)
2026-09-10 5:36 ` Yogesh Hegde
@ 2026-09-10 18:13 ` Denys Dmytriyenko
2026-09-11 13:51 ` Ryan Eatmon
6 siblings, 1 reply; 11+ messages in thread
From: Denys Dmytriyenko @ 2026-09-10 18:13 UTC (permalink / raw)
To: reatmon; +Cc: Praneeth Bajjuri, Denys Dmytriyenko, meta-ti
On Wed, Sep 09, 2026 at 08:54:48PM -0500, Ryan Eatmon via lists.yoctoproject.org wrote:
> With the recent move to OpenSSL 4.0 [1] we need to update the same code
> in the various u-boot versions that we support.
>
> [1] https://git.openembedded.org/openembedded-core/commit/?id=20bf704e5809e95036b998f0f45145cf7205b05b
>
> Signed-off-by: Ryan Eatmon <reatmon@ti.com>
> ---
> v2; No change.
>
> ...ort-for-OpenSSL-Provider-API-2024-04.patch | 300 ++++++++++++++++
> ...ort-for-OpenSSL-Provider-API-2025-01.patch | 300 ++++++++++++++++
> ...ort-for-OpenSSL-Provider-API-2026-01.patch | 340 ++++++++++++++++++
> .../u-boot/u-boot-ti-staging_2024.04.bb | 6 +-
> .../u-boot/u-boot-ti-staging_2025.01.bb | 1 +
> .../u-boot/u-boot-ti-staging_2026.01.bb | 2 +
> meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc | 1 +
> 7 files changed, 948 insertions(+), 2 deletions(-)
> create mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch
> create mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch
> create mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch
For the old U-Boot versions, instead of massaging the patch heavily and
carrying multiple copies of it, should we just use the workaraound, like
meta-arm[1] does? And 2026.10 will have this fixed upstream...
https://patchwork.yoctoproject.org/project/arm/patch/20260909180341.3858400-1-ross.burton@arm.com/
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch
> new file mode 100644
> index 00000000..9f67644b
> --- /dev/null
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch
> @@ -0,0 +1,300 @@
> +From 401c19f6b0a7c63afad92e9d3f2cbb75d6ed8566 Mon Sep 17 00:00:00 2001
> +From: Ryan Eatmon <reatmon@ti.com>
> +Date: Wed, 9 Sep 2026 10:04:50 -0500
> +Subject: [PATCH] Add support for OpenSSL Provider API
> +
> +Backport from 2026.01 patch [1] by Ryan Eatmon <reatmon@ti.com>
> +
> +Upsatream-Status: Inappropriate [OE-specific]
> +
> +The Engine API has been deprecated since the release of OpenSSL 3.0. End
> +users have been advised to migrate to the new Provider interface.
> +Several distributions have already removed support for engines, which is
> +preventing U-Boot from being compiled in those environments.
> +
> +Add support for the Provider API while continuing to support the existing
> +Engine API on distros shipping older releases of OpenSSL.
> +
> +This is based on similar work contributed by Jan Stancek updating Linux
> +to use the Provider interface.
> +
> + commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
> + Author: Jan Stancek <jstancek@redhat.com>
> + Date: Fri Sep 20 19:52:48 2024 +0300
> +
> + sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
> +
> +The changes have been tested with the FIT signature verification vboot
> +tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
> +Engine library installed and with the Provider API.
> +
> +Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
> +
> +Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
> +
> +Note: Modified to make pkcs11 provider loading optional. The upstream
> +patch unconditionally requires the pkcs11 provider, which is not
> +available in the OE build environment. File-based key signing only needs
> +the default provider; pkcs11 is only required for pkcs11: URI keys.
> +Changes from upstream:
> + - Load default provider first (was pkcs11 first)
> + - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
> + of ERR(1, ...) which calls errx/abort)
> +
> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> +
> +Signed-off-by: Ryan Eatmon <reatmon@ti.com>
> +---
> + lib/aes/aes-encrypt.c | 4 +-
> + lib/rsa/rsa-sign.c | 95 ++++++++++++++++++++++++++++++++++++++++++-
> + 2 files changed, 97 insertions(+), 2 deletions(-)
> +
> +diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
> +index e74e35eaa28..8a6f7715df9 100644
> +--- a/lib/aes/aes-encrypt.c
> ++++ b/lib/aes/aes-encrypt.c
> +@@ -16,7 +16,9 @@
> + #include <openssl/err.h>
> + #include <openssl/ssl.h>
> + #include <openssl/evp.h>
> +-#include <openssl/engine.h>
> ++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# include <openssl/engine.h>
> ++#endif
> + #include <uboot_aes.h>
> +
> + #if OPENSSL_VERSION_NUMBER >= 0x10000000L
> +diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
> +index 2304030e32f..29b3bd3dbb1 100644
> +--- a/lib/rsa/rsa-sign.c
> ++++ b/lib/rsa/rsa-sign.c
> +@@ -19,7 +19,47 @@
> + #include <openssl/err.h>
> + #include <openssl/ssl.h>
> + #include <openssl/evp.h>
> +-#include <openssl/engine.h>
> ++#if OPENSSL_VERSION_MAJOR >= 3
> ++# define USE_PKCS11_PROVIDER
> ++# include <err.h>
> ++# include <openssl/provider.h>
> ++# include <openssl/store.h>
> ++#else
> ++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# define USE_PKCS11_ENGINE
> ++# include <openssl/engine.h>
> ++# endif
> ++#endif
> ++
> ++#ifdef USE_PKCS11_PROVIDER
> ++#define ERR(cond, fmt, ...) \
> ++ do { \
> ++ bool __cond = (cond); \
> ++ drain_openssl_errors(__LINE__, 0); \
> ++ if (__cond) { \
> ++ errx(1, fmt, ## __VA_ARGS__); \
> ++ } \
> ++ } while (0)
> ++
> ++static void drain_openssl_errors(int l, int silent)
> ++{
> ++ const char *file;
> ++ char buf[120];
> ++ int e, line;
> ++
> ++ if (ERR_peek_error() == 0)
> ++ return;
> ++ if (!silent)
> ++ fprintf(stderr, "At main.c:%d:\n", l);
> ++
> ++ while ((e = ERR_peek_error_line(&file, &line))) {
> ++ ERR_error_string(e, buf);
> ++ if (!silent)
> ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
> ++ ERR_get_error();
> ++ }
> ++}
> ++#endif
> +
> + static int rsa_err(const char *msg)
> + {
> +@@ -98,6 +138,7 @@ err_cert:
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> + ENGINE *engine, EVP_PKEY **evpp)
> + {
> +@@ -157,6 +198,7 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> +
> + return 0;
> + }
> ++#endif
> +
> + /**
> + * rsa_get_pub_key() - read a public key
> +@@ -170,8 +212,10 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> + static int rsa_get_pub_key(const char *keydir, const char *name,
> + ENGINE *engine, EVP_PKEY **evpp)
> + {
> ++#ifdef USE_PKCS11_ENGINE
> + if (engine)
> + return rsa_engine_get_pub_key(keydir, name, engine, evpp);
> ++#endif
> + return rsa_pem_get_pub_key(keydir, name, evpp);
> + }
> +
> +@@ -207,6 +251,38 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + return -ENOENT;
> + }
> +
> ++#ifdef USE_PKCS11_PROVIDER
> ++ EVP_PKEY *private_key = NULL;
> ++ OSSL_STORE_CTX *store;
> ++
> ++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
> ++ ERR(1, "OSSL_PROVIDER_try_load(default)");
> ++ /* pkcs11 provider is optional; only needed for pkcs11: URIs */
> ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
> ++ ERR_clear_error();
> ++
> ++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
> ++ ERR(!store, "OSSL_STORE_open");
> ++
> ++ while (!OSSL_STORE_eof(store)) {
> ++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
> ++
> ++ if (!info) {
> ++ drain_openssl_errors(__LINE__, 0);
> ++ continue;
> ++ }
> ++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
> ++ private_key = OSSL_STORE_INFO_get1_PKEY(info);
> ++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
> ++ }
> ++ OSSL_STORE_INFO_free(info);
> ++ if (private_key)
> ++ break;
> ++ }
> ++ OSSL_STORE_close(store);
> ++
> ++ *evpp = private_key;
> ++#else
> + if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
> + rsa_err("Failure reading private key");
> + fclose(f);
> +@@ -214,6 +290,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + }
> + fclose(f);
> +
> ++#endif
> + return 0;
> + }
> +
> +@@ -226,6 +303,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> + const char *keyfile,
> + ENGINE *engine, EVP_PKEY **evpp)
> +@@ -293,6 +371,7 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> +
> + return 0;
> + }
> ++#endif
> +
> + /**
> + * rsa_get_priv_key() - read a private key
> +@@ -306,9 +385,11 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> + static int rsa_get_priv_key(const char *keydir, const char *name,
> + const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
> + {
> ++#ifdef USE_PKCS11_ENGINE
> + if (engine)
> + return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
> + evpp);
> ++#endif
> + return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
> + }
> +
> +@@ -325,6 +406,7 @@ static int rsa_init(void)
> + return 0;
> + }
> +
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_init(const char *engine_id, ENGINE **pe)
> + {
> + const char *key_pass;
> +@@ -372,6 +454,7 @@ err_engine_init:
> + ENGINE_free(e);
> + return ret;
> + }
> ++#endif
> +
> + static void rsa_engine_remove(ENGINE *e)
> + {
> +@@ -471,11 +554,13 @@ int rsa_sign(struct image_sign_info *info,
> + if (ret)
> + return ret;
> +
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id) {
> + ret = rsa_engine_init(info->engine_id, &e);
> + if (ret)
> + return ret;
> + }
> ++#endif
> +
> + ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
> + e, &pkey);
> +@@ -487,16 +572,20 @@ int rsa_sign(struct image_sign_info *info,
> + goto err_sign;
> +
> + EVP_PKEY_free(pkey);
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> +
> + return ret;
> +
> + err_sign:
> + EVP_PKEY_free(pkey);
> + err_priv:
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> + return ret;
> + }
> +
> +@@ -636,11 +725,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
> + ENGINE *e = NULL;
> +
> + debug("%s: Getting verification data\n", __func__);
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id) {
> + ret = rsa_engine_init(info->engine_id, &e);
> + if (ret)
> + return ret;
> + }
> ++#endif
> + ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
> + if (ret)
> + goto err_get_pub_key;
> +@@ -717,8 +808,10 @@ done:
> + err_get_params:
> + EVP_PKEY_free(pkey);
> + err_get_pub_key:
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> +
> + if (ret)
> + return ret;
> +--
> +2.43.0
> +
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch
> new file mode 100644
> index 00000000..c5f3655e
> --- /dev/null
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch
> @@ -0,0 +1,300 @@
> +From 0525693750b1b7a8fb7228dbb97bf592a21322fc Mon Sep 17 00:00:00 2001
> +From: Ryan Eatmon <reatmon@ti.com>
> +Date: Wed, 9 Sep 2026 10:04:50 -0500
> +Subject: [PATCH] Add support for OpenSSL Provider API
> +
> +Backport from 2026.01 patch [1] by Ryan Eatmon <reatmon@ti.com>
> +
> +Upsatream-Status: Inappropriate [OE-specific]
> +
> +The Engine API has been deprecated since the release of OpenSSL 3.0. End
> +users have been advised to migrate to the new Provider interface.
> +Several distributions have already removed support for engines, which is
> +preventing U-Boot from being compiled in those environments.
> +
> +Add support for the Provider API while continuing to support the existing
> +Engine API on distros shipping older releases of OpenSSL.
> +
> +This is based on similar work contributed by Jan Stancek updating Linux
> +to use the Provider interface.
> +
> + commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
> + Author: Jan Stancek <jstancek@redhat.com>
> + Date: Fri Sep 20 19:52:48 2024 +0300
> +
> + sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
> +
> +The changes have been tested with the FIT signature verification vboot
> +tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
> +Engine library installed and with the Provider API.
> +
> +Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
> +
> +Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
> +
> +Note: Modified to make pkcs11 provider loading optional. The upstream
> +patch unconditionally requires the pkcs11 provider, which is not
> +available in the OE build environment. File-based key signing only needs
> +the default provider; pkcs11 is only required for pkcs11: URI keys.
> +Changes from upstream:
> + - Load default provider first (was pkcs11 first)
> + - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
> + of ERR(1, ...) which calls errx/abort)
> +
> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> +
> +Signed-off-by: Ryan Eatmon <reatmon@ti.com>
> +---
> + lib/aes/aes-encrypt.c | 4 +-
> + lib/rsa/rsa-sign.c | 95 ++++++++++++++++++++++++++++++++++++++++++-
> + 2 files changed, 97 insertions(+), 2 deletions(-)
> +
> +diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
> +index e74e35eaa28..8a6f7715df9 100644
> +--- a/lib/aes/aes-encrypt.c
> ++++ b/lib/aes/aes-encrypt.c
> +@@ -16,7 +16,9 @@
> + #include <openssl/err.h>
> + #include <openssl/ssl.h>
> + #include <openssl/evp.h>
> +-#include <openssl/engine.h>
> ++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# include <openssl/engine.h>
> ++#endif
> + #include <uboot_aes.h>
> +
> + #if OPENSSL_VERSION_NUMBER >= 0x10000000L
> +diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
> +index fa9e143b4ca..af5b18e0c95 100644
> +--- a/lib/rsa/rsa-sign.c
> ++++ b/lib/rsa/rsa-sign.c
> +@@ -19,7 +19,47 @@
> + #include <openssl/err.h>
> + #include <openssl/ssl.h>
> + #include <openssl/evp.h>
> +-#include <openssl/engine.h>
> ++#if OPENSSL_VERSION_MAJOR >= 3
> ++# define USE_PKCS11_PROVIDER
> ++# include <err.h>
> ++# include <openssl/provider.h>
> ++# include <openssl/store.h>
> ++#else
> ++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# define USE_PKCS11_ENGINE
> ++# include <openssl/engine.h>
> ++# endif
> ++#endif
> ++
> ++#ifdef USE_PKCS11_PROVIDER
> ++#define ERR(cond, fmt, ...) \
> ++ do { \
> ++ bool __cond = (cond); \
> ++ drain_openssl_errors(__LINE__, 0); \
> ++ if (__cond) { \
> ++ errx(1, fmt, ## __VA_ARGS__); \
> ++ } \
> ++ } while (0)
> ++
> ++static void drain_openssl_errors(int l, int silent)
> ++{
> ++ const char *file;
> ++ char buf[120];
> ++ int e, line;
> ++
> ++ if (ERR_peek_error() == 0)
> ++ return;
> ++ if (!silent)
> ++ fprintf(stderr, "At main.c:%d:\n", l);
> ++
> ++ while ((e = ERR_peek_error_line(&file, &line))) {
> ++ ERR_error_string(e, buf);
> ++ if (!silent)
> ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
> ++ ERR_get_error();
> ++ }
> ++}
> ++#endif
> +
> + static int rsa_err(const char *msg)
> + {
> +@@ -98,6 +138,7 @@ err_cert:
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> + ENGINE *engine, EVP_PKEY **evpp)
> + {
> +@@ -157,6 +198,7 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> +
> + return 0;
> + }
> ++#endif
> +
> + /**
> + * rsa_get_pub_key() - read a public key
> +@@ -170,8 +212,10 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> + static int rsa_get_pub_key(const char *keydir, const char *name,
> + ENGINE *engine, EVP_PKEY **evpp)
> + {
> ++#ifdef USE_PKCS11_ENGINE
> + if (engine)
> + return rsa_engine_get_pub_key(keydir, name, engine, evpp);
> ++#endif
> + return rsa_pem_get_pub_key(keydir, name, evpp);
> + }
> +
> +@@ -207,6 +251,38 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + return -ENOENT;
> + }
> +
> ++#ifdef USE_PKCS11_PROVIDER
> ++ EVP_PKEY *private_key = NULL;
> ++ OSSL_STORE_CTX *store;
> ++
> ++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
> ++ ERR(1, "OSSL_PROVIDER_try_load(default)");
> ++ /* pkcs11 provider is optional; only needed for pkcs11: URIs */
> ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
> ++ ERR_clear_error();
> ++
> ++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
> ++ ERR(!store, "OSSL_STORE_open");
> ++
> ++ while (!OSSL_STORE_eof(store)) {
> ++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
> ++
> ++ if (!info) {
> ++ drain_openssl_errors(__LINE__, 0);
> ++ continue;
> ++ }
> ++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
> ++ private_key = OSSL_STORE_INFO_get1_PKEY(info);
> ++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
> ++ }
> ++ OSSL_STORE_INFO_free(info);
> ++ if (private_key)
> ++ break;
> ++ }
> ++ OSSL_STORE_close(store);
> ++
> ++ *evpp = private_key;
> ++#else
> + if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
> + rsa_err("Failure reading private key");
> + fclose(f);
> +@@ -214,6 +290,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + }
> + fclose(f);
> +
> ++#endif
> + return 0;
> + }
> +
> +@@ -226,6 +303,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> + const char *keyfile,
> + ENGINE *engine, EVP_PKEY **evpp)
> +@@ -293,6 +371,7 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> +
> + return 0;
> + }
> ++#endif
> +
> + /**
> + * rsa_get_priv_key() - read a private key
> +@@ -306,9 +385,11 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> + static int rsa_get_priv_key(const char *keydir, const char *name,
> + const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
> + {
> ++#ifdef USE_PKCS11_ENGINE
> + if (engine)
> + return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
> + evpp);
> ++#endif
> + return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
> + }
> +
> +@@ -325,6 +406,7 @@ static int rsa_init(void)
> + return 0;
> + }
> +
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_init(const char *engine_id, ENGINE **pe)
> + {
> + const char *key_pass;
> +@@ -372,6 +454,7 @@ err_engine_init:
> + ENGINE_free(e);
> + return ret;
> + }
> ++#endif
> +
> + static void rsa_engine_remove(ENGINE *e)
> + {
> +@@ -480,11 +563,13 @@ int rsa_sign(struct image_sign_info *info,
> + if (ret)
> + return ret;
> +
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id) {
> + ret = rsa_engine_init(info->engine_id, &e);
> + if (ret)
> + return ret;
> + }
> ++#endif
> +
> + ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
> + e, &pkey);
> +@@ -496,16 +581,20 @@ int rsa_sign(struct image_sign_info *info,
> + goto err_sign;
> +
> + EVP_PKEY_free(pkey);
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> +
> + return ret;
> +
> + err_sign:
> + EVP_PKEY_free(pkey);
> + err_priv:
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> + return ret;
> + }
> +
> +@@ -645,11 +734,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
> + ENGINE *e = NULL;
> +
> + debug("%s: Getting verification data\n", __func__);
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id) {
> + ret = rsa_engine_init(info->engine_id, &e);
> + if (ret)
> + return ret;
> + }
> ++#endif
> + ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
> + if (ret)
> + goto err_get_pub_key;
> +@@ -726,8 +817,10 @@ done:
> + err_get_params:
> + EVP_PKEY_free(pkey);
> + err_get_pub_key:
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> +
> + if (ret)
> + return ret;
> +--
> +2.43.0
> +
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch
> new file mode 100644
> index 00000000..346d0584
> --- /dev/null
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch
> @@ -0,0 +1,340 @@
> +From a81cb0932dce109af44d7245d47489fe54ae390f Mon Sep 17 00:00:00 2001
> +From: Eddie Kovsky <ewk@edkovsky.org>
> +Date: Mon, 23 Feb 2026 09:43:22 -0700
> +Subject: [PATCH] Add support for OpenSSL Provider API
> +
> +The Engine API has been deprecated since the release of OpenSSL 3.0. End
> +users have been advised to migrate to the new Provider interface.
> +Several distributions have already removed support for engines, which is
> +preventing U-Boot from being compiled in those environments.
> +
> +Add support for the Provider API while continuing to support the existing
> +Engine API on distros shipping older releases of OpenSSL.
> +
> +This is based on similar work contributed by Jan Stancek updating Linux
> +to use the Provider interface.
> +
> + commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
> + Author: Jan Stancek <jstancek@redhat.com>
> + Date: Fri Sep 20 19:52:48 2024 +0300
> +
> + sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
> +
> +The changes have been tested with the FIT signature verification vboot
> +tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
> +Engine library installed and with the Provider API.
> +
> +Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
> +
> +Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
> +
> +Note: Modified to make pkcs11 provider loading optional. The upstream
> +patch unconditionally requires the pkcs11 provider, which is not
> +available in the OE build environment. File-based key signing only needs
> +the default provider; pkcs11 is only required for pkcs11: URI keys.
> +Changes from upstream:
> + - Load default provider first (was pkcs11 first)
> + - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
> + of ERR(1, ...) which calls errx/abort)
> +
> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> +---
> + doc/build/gcc.rst | 4 +-
> + lib/aes/aes-encrypt.c | 4 +-
> + lib/rsa/rsa-sign.c | 102 +++++++++++++++++++++++++++++++++++++++---
> + tools/docker/Dockerfile | 1 +
> + 4 files changed, 103 insertions(+), 8 deletions(-)
> +
> +diff --git a/doc/build/gcc.rst b/doc/build/gcc.rst
> +index 1fef718ceecb..29a6a632e7e3 100644
> +--- a/doc/build/gcc.rst
> ++++ b/doc/build/gcc.rst
> +@@ -25,8 +25,8 @@ Depending on the build targets further packages maybe needed
> +
> + sudo apt-get install bc bison build-essential coccinelle \
> + device-tree-compiler dfu-util efitools flex gdisk graphviz imagemagick \
> +- libgnutls28-dev libguestfs-tools libncurses-dev \
> +- libpython3-dev libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl \
> ++ libgnutls28-dev libguestfs-tools libncurses-dev libpython3-dev \
> ++ libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl pkcs11-provider \
> + pkg-config python3 python3-asteval python3-coverage python3-filelock \
> + python3-pkg-resources python3-pycryptodome python3-pyelftools \
> + python3-pytest python3-pytest-xdist python3-sphinxcontrib.apidoc \
> +diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
> +index 90e1407b4f09..4fc4ce232478 100644
> +--- a/lib/aes/aes-encrypt.c
> ++++ b/lib/aes/aes-encrypt.c
> +@@ -16,7 +16,9 @@
> + #include <openssl/err.h>
> + #include <openssl/ssl.h>
> + #include <openssl/evp.h>
> +-#include <openssl/engine.h>
> ++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# include <openssl/engine.h>
> ++#endif
> + #include <uboot_aes.h>
> +
> + #if OPENSSL_VERSION_NUMBER >= 0x10000000L
> +diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
> +index 0e38c9e802fd..f456f3c58e65 100644
> +--- a/lib/rsa/rsa-sign.c
> ++++ b/lib/rsa/rsa-sign.c
> +@@ -19,7 +19,47 @@
> + #include <openssl/err.h>
> + #include <openssl/ssl.h>
> + #include <openssl/evp.h>
> +-#include <openssl/engine.h>
> ++#if OPENSSL_VERSION_MAJOR >= 3
> ++# define USE_PKCS11_PROVIDER
> ++# include <err.h>
> ++# include <openssl/provider.h>
> ++# include <openssl/store.h>
> ++#else
> ++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
> ++# define USE_PKCS11_ENGINE
> ++# include <openssl/engine.h>
> ++# endif
> ++#endif
> ++
> ++#ifdef USE_PKCS11_PROVIDER
> ++#define ERR(cond, fmt, ...) \
> ++ do { \
> ++ bool __cond = (cond); \
> ++ drain_openssl_errors(__LINE__, 0); \
> ++ if (__cond) { \
> ++ errx(1, fmt, ## __VA_ARGS__); \
> ++ } \
> ++ } while (0)
> ++
> ++static void drain_openssl_errors(int l, int silent)
> ++{
> ++ const char *file;
> ++ char buf[120];
> ++ int e, line;
> ++
> ++ if (ERR_peek_error() == 0)
> ++ return;
> ++ if (!silent)
> ++ fprintf(stderr, "At main.c:%d:\n", l);
> ++
> ++ while ((e = ERR_peek_error_line(&file, &line))) {
> ++ ERR_error_string(e, buf);
> ++ if (!silent)
> ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
> ++ ERR_get_error();
> ++ }
> ++}
> ++#endif
> +
> + static int rsa_err(const char *msg)
> + {
> +@@ -94,10 +134,11 @@ static int rsa_pem_get_pub_key(const char *keydir, const char *name, EVP_PKEY **
> + *
> + * @keydir: Key prefix
> + * @name Name of key
> +- * @engine Engine to use
> ++ * @engine Engine to use or NULL when using pkcs11 provider
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> + ENGINE *engine, EVP_PKEY **evpp)
> + {
> +@@ -157,21 +198,24 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
> +
> + return 0;
> + }
> ++#endif
> +
> + /**
> + * rsa_get_pub_key() - read a public key
> + *
> + * @keydir: Directory containing the key (PEM file) or key prefix (engine)
> + * @name Name of key file (will have a .crt extension)
> +- * @engine Engine to use
> ++ * @engine Engine to use or NULL when using pkcs11 provider
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> + static int rsa_get_pub_key(const char *keydir, const char *name,
> + ENGINE *engine, EVP_PKEY **evpp)
> + {
> ++#ifdef USE_PKCS11_ENGINE
> + if (engine)
> + return rsa_engine_get_pub_key(keydir, name, engine, evpp);
> ++#endif
> + return rsa_pem_get_pub_key(keydir, name, evpp);
> + }
> +
> +@@ -207,13 +251,45 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + return -ENOENT;
> + }
> +
> ++#ifdef USE_PKCS11_PROVIDER
> ++ EVP_PKEY *private_key = NULL;
> ++ OSSL_STORE_CTX *store;
> ++
> ++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
> ++ ERR(1, "OSSL_PROVIDER_try_load(default)");
> ++ /* pkcs11 provider is optional; only needed for pkcs11: URIs */
> ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
> ++ ERR_clear_error();
> ++
> ++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
> ++ ERR(!store, "OSSL_STORE_open");
> ++
> ++ while (!OSSL_STORE_eof(store)) {
> ++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
> ++
> ++ if (!info) {
> ++ drain_openssl_errors(__LINE__, 0);
> ++ continue;
> ++ }
> ++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
> ++ private_key = OSSL_STORE_INFO_get1_PKEY(info);
> ++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
> ++ }
> ++ OSSL_STORE_INFO_free(info);
> ++ if (private_key)
> ++ break;
> ++ }
> ++ OSSL_STORE_close(store);
> ++
> ++ *evpp = private_key;
> ++#else
> + if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
> + rsa_err("Failure reading private key");
> + fclose(f);
> + return -EPROTO;
> + }
> + fclose(f);
> +-
> ++#endif
> + return 0;
> + }
> +
> +@@ -226,6 +301,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> + const char *keyfile,
> + ENGINE *engine, EVP_PKEY **evpp)
> +@@ -293,22 +369,25 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
> +
> + return 0;
> + }
> ++#endif
> +
> + /**
> + * rsa_get_priv_key() - read a private key
> + *
> + * @keydir: Directory containing the key (PEM file) or key prefix (engine)
> + * @name Name of key
> +- * @engine Engine to use for signing
> ++ * @engine Engine to use or NULL when using pkcs11 provider
> + * @evpp Returns EVP_PKEY object, or NULL on failure
> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
> + */
> + static int rsa_get_priv_key(const char *keydir, const char *name,
> + const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
> + {
> ++#ifdef USE_PKCS11_ENGINE
> + if (engine)
> + return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
> + evpp);
> ++#endif
> + return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
> + }
> +
> +@@ -325,6 +404,7 @@ static int rsa_init(void)
> + return 0;
> + }
> +
> ++#ifdef USE_PKCS11_ENGINE
> + static int rsa_engine_init(const char *engine_id, ENGINE **pe)
> + {
> + const char *key_pass;
> +@@ -380,6 +460,7 @@ static void rsa_engine_remove(ENGINE *e)
> + ENGINE_free(e);
> + }
> + }
> ++#endif
> +
> + static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo,
> + struct checksum_algo *checksum_algo,
> +@@ -480,11 +561,13 @@ int rsa_sign(struct image_sign_info *info,
> + if (ret)
> + return ret;
> +
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id) {
> + ret = rsa_engine_init(info->engine_id, &e);
> + if (ret)
> + return ret;
> + }
> ++#endif
> +
> + ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
> + e, &pkey);
> +@@ -496,16 +579,21 @@ int rsa_sign(struct image_sign_info *info,
> + goto err_sign;
> +
> + EVP_PKEY_free(pkey);
> ++
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> +
> + return ret;
> +
> + err_sign:
> + EVP_PKEY_free(pkey);
> + err_priv:
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> + return ret;
> + }
> +
> +@@ -645,11 +733,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
> + ENGINE *e = NULL;
> +
> + debug("%s: Getting verification data\n", __func__);
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id) {
> + ret = rsa_engine_init(info->engine_id, &e);
> + if (ret)
> + return ret;
> + }
> ++#endif
> + ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
> + if (ret)
> + goto err_get_pub_key;
> +@@ -726,8 +816,10 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
> + err_get_params:
> + EVP_PKEY_free(pkey);
> + err_get_pub_key:
> ++#ifdef USE_PKCS11_ENGINE
> + if (info->engine_id)
> + rsa_engine_remove(e);
> ++#endif
> +
> + if (ret)
> + return ret;
> +diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
> +index 73bf6cdd2c52..50e98e83dc20 100644
> +--- a/tools/docker/Dockerfile
> ++++ b/tools/docker/Dockerfile
> +@@ -122,6 +122,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
> + openssl \
> + picocom \
> + parted \
> ++ pkcs11-provider \
> + pkg-config \
> + python-is-python3 \
> + python3 \
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb
> index d3a78d8b..5812b914 100644
> --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb
> @@ -4,6 +4,8 @@ PR = "r0"
>
> BRANCH = "ti-u-boot-2024.04"
>
> -SRC_URI += "file://0001-scripts-dtc-pylibfdt-libfdt.i_shipped-Use-SWIG_Appen.patch"
> -
> SRCREV_uboot = "29d0c23d67ee7b88e46fe1753cd020e2b04c2ef6"
> +
> +SRC_URI += "file://0001-scripts-dtc-pylibfdt-libfdt.i_shipped-Use-SWIG_Appen.patch"
> +SRC_URI += "file://0001-binman-migrate-form-pkg_resources-to-importlib.patch"
> +SRC_URI += "file://0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch"
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb
> index f7475c2b..af4b1b77 100644
> --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb
> @@ -7,3 +7,4 @@ BRANCH = "ti-u-boot-2025.01"
> SRCREV_uboot = "4ca322ca563a21cccad8c9ba65e386b9fd34dd16"
>
> SRC_URI += "file://0001-binman-migrate-form-pkg_resources-to-importlib.patch"
> +SRC_URI += "file://0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch"
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb
> index 7637cfaf..d1ef241d 100644
> --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb
> @@ -5,3 +5,5 @@ PR = "r0"
> BRANCH = "ti-u-boot-2026.01"
>
> SRCREV_uboot = "2a85f4bcffc50ddc8b443d8e4162e9e46ed0f200"
> +
> +SRC_URI += "file://0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch"
> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
> index 3d6769bf..8213ac60 100644
> --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
> +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
> @@ -25,6 +25,7 @@ UBOOT_GIT_PROTOCOL ?= "https"
> UBOOT_GIT_BRANCH ?= "branch=${BRANCH}"
> SRC_URI = "${UBOOT_GIT_URI};protocol=${UBOOT_GIT_PROTOCOL};${UBOOT_GIT_BRANCH};name=uboot"
>
> +SRC_URI:append:bsp-ti-6_6 = " file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch"
> SRC_URI:append:bsp-ti-6_12 = " file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch"
> SRC_URI:append:bsp-ti-6_18 = " file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch"
>
> --
> 2.43.0
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0
2026-09-10 18:13 ` Denys Dmytriyenko
@ 2026-09-11 13:51 ` Ryan Eatmon
0 siblings, 0 replies; 11+ messages in thread
From: Ryan Eatmon @ 2026-09-11 13:51 UTC (permalink / raw)
To: Denys Dmytriyenko; +Cc: Praneeth Bajjuri, Denys Dmytriyenko, meta-ti
On 9/10/2026 1:13 PM, Denys Dmytriyenko wrote:
> On Wed, Sep 09, 2026 at 08:54:48PM -0500, Ryan Eatmon via lists.yoctoproject.org wrote:
>> With the recent move to OpenSSL 4.0 [1] we need to update the same code
>> in the various u-boot versions that we support.
>>
>> [1] https://git.openembedded.org/openembedded-core/commit/?id=20bf704e5809e95036b998f0f45145cf7205b05b
>>
>> Signed-off-by: Ryan Eatmon <reatmon@ti.com>
>> ---
>> v2; No change.
>>
>> ...ort-for-OpenSSL-Provider-API-2024-04.patch | 300 ++++++++++++++++
>> ...ort-for-OpenSSL-Provider-API-2025-01.patch | 300 ++++++++++++++++
>> ...ort-for-OpenSSL-Provider-API-2026-01.patch | 340 ++++++++++++++++++
>> .../u-boot/u-boot-ti-staging_2024.04.bb | 6 +-
>> .../u-boot/u-boot-ti-staging_2025.01.bb | 1 +
>> .../u-boot/u-boot-ti-staging_2026.01.bb | 2 +
>> meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc | 1 +
>> 7 files changed, 948 insertions(+), 2 deletions(-)
>> create mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch
>> create mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch
>> create mode 100644 meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch
>
> For the old U-Boot versions, instead of massaging the patch heavily and
> carrying multiple copies of it, should we just use the workaraound, like
> meta-arm[1] does? And 2026.10 will have this fixed upstream...
>
> https://patchwork.yoctoproject.org/project/arm/patch/20260909180341.3858400-1-ross.burton@arm.com/
Didn't know that was an option. Well, the patches have already passed
CICD and made it to master, so if this is better then I can send another
patch with this approach. I'll test things out and see.
>
>> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch
>> new file mode 100644
>> index 00000000..9f67644b
>> --- /dev/null
>> +++ b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch
>> @@ -0,0 +1,300 @@
>> +From 401c19f6b0a7c63afad92e9d3f2cbb75d6ed8566 Mon Sep 17 00:00:00 2001
>> +From: Ryan Eatmon <reatmon@ti.com>
>> +Date: Wed, 9 Sep 2026 10:04:50 -0500
>> +Subject: [PATCH] Add support for OpenSSL Provider API
>> +
>> +Backport from 2026.01 patch [1] by Ryan Eatmon <reatmon@ti.com>
>> +
>> +Upsatream-Status: Inappropriate [OE-specific]
>> +
>> +The Engine API has been deprecated since the release of OpenSSL 3.0. End
>> +users have been advised to migrate to the new Provider interface.
>> +Several distributions have already removed support for engines, which is
>> +preventing U-Boot from being compiled in those environments.
>> +
>> +Add support for the Provider API while continuing to support the existing
>> +Engine API on distros shipping older releases of OpenSSL.
>> +
>> +This is based on similar work contributed by Jan Stancek updating Linux
>> +to use the Provider interface.
>> +
>> + commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
>> + Author: Jan Stancek <jstancek@redhat.com>
>> + Date: Fri Sep 20 19:52:48 2024 +0300
>> +
>> + sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
>> +
>> +The changes have been tested with the FIT signature verification vboot
>> +tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
>> +Engine library installed and with the Provider API.
>> +
>> +Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
>> +
>> +Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
>> +
>> +Note: Modified to make pkcs11 provider loading optional. The upstream
>> +patch unconditionally requires the pkcs11 provider, which is not
>> +available in the OE build environment. File-based key signing only needs
>> +the default provider; pkcs11 is only required for pkcs11: URI keys.
>> +Changes from upstream:
>> + - Load default provider first (was pkcs11 first)
>> + - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
>> + of ERR(1, ...) which calls errx/abort)
>> +
>> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
>> +
>> +Signed-off-by: Ryan Eatmon <reatmon@ti.com>
>> +---
>> + lib/aes/aes-encrypt.c | 4 +-
>> + lib/rsa/rsa-sign.c | 95 ++++++++++++++++++++++++++++++++++++++++++-
>> + 2 files changed, 97 insertions(+), 2 deletions(-)
>> +
>> +diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
>> +index e74e35eaa28..8a6f7715df9 100644
>> +--- a/lib/aes/aes-encrypt.c
>> ++++ b/lib/aes/aes-encrypt.c
>> +@@ -16,7 +16,9 @@
>> + #include <openssl/err.h>
>> + #include <openssl/ssl.h>
>> + #include <openssl/evp.h>
>> +-#include <openssl/engine.h>
>> ++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
>> ++# include <openssl/engine.h>
>> ++#endif
>> + #include <uboot_aes.h>
>> +
>> + #if OPENSSL_VERSION_NUMBER >= 0x10000000L
>> +diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
>> +index 2304030e32f..29b3bd3dbb1 100644
>> +--- a/lib/rsa/rsa-sign.c
>> ++++ b/lib/rsa/rsa-sign.c
>> +@@ -19,7 +19,47 @@
>> + #include <openssl/err.h>
>> + #include <openssl/ssl.h>
>> + #include <openssl/evp.h>
>> +-#include <openssl/engine.h>
>> ++#if OPENSSL_VERSION_MAJOR >= 3
>> ++# define USE_PKCS11_PROVIDER
>> ++# include <err.h>
>> ++# include <openssl/provider.h>
>> ++# include <openssl/store.h>
>> ++#else
>> ++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
>> ++# define USE_PKCS11_ENGINE
>> ++# include <openssl/engine.h>
>> ++# endif
>> ++#endif
>> ++
>> ++#ifdef USE_PKCS11_PROVIDER
>> ++#define ERR(cond, fmt, ...) \
>> ++ do { \
>> ++ bool __cond = (cond); \
>> ++ drain_openssl_errors(__LINE__, 0); \
>> ++ if (__cond) { \
>> ++ errx(1, fmt, ## __VA_ARGS__); \
>> ++ } \
>> ++ } while (0)
>> ++
>> ++static void drain_openssl_errors(int l, int silent)
>> ++{
>> ++ const char *file;
>> ++ char buf[120];
>> ++ int e, line;
>> ++
>> ++ if (ERR_peek_error() == 0)
>> ++ return;
>> ++ if (!silent)
>> ++ fprintf(stderr, "At main.c:%d:\n", l);
>> ++
>> ++ while ((e = ERR_peek_error_line(&file, &line))) {
>> ++ ERR_error_string(e, buf);
>> ++ if (!silent)
>> ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
>> ++ ERR_get_error();
>> ++ }
>> ++}
>> ++#endif
>> +
>> + static int rsa_err(const char *msg)
>> + {
>> +@@ -98,6 +138,7 @@ err_cert:
>> + * @evpp Returns EVP_PKEY object, or NULL on failure
>> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
>> + */
>> ++#ifdef USE_PKCS11_ENGINE
>> + static int rsa_engine_get_pub_key(const char *keydir, const char *name,
>> + ENGINE *engine, EVP_PKEY **evpp)
>> + {
>> +@@ -157,6 +198,7 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
>> +
>> + return 0;
>> + }
>> ++#endif
>> +
>> + /**
>> + * rsa_get_pub_key() - read a public key
>> +@@ -170,8 +212,10 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
>> + static int rsa_get_pub_key(const char *keydir, const char *name,
>> + ENGINE *engine, EVP_PKEY **evpp)
>> + {
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (engine)
>> + return rsa_engine_get_pub_key(keydir, name, engine, evpp);
>> ++#endif
>> + return rsa_pem_get_pub_key(keydir, name, evpp);
>> + }
>> +
>> +@@ -207,6 +251,38 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
>> + return -ENOENT;
>> + }
>> +
>> ++#ifdef USE_PKCS11_PROVIDER
>> ++ EVP_PKEY *private_key = NULL;
>> ++ OSSL_STORE_CTX *store;
>> ++
>> ++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
>> ++ ERR(1, "OSSL_PROVIDER_try_load(default)");
>> ++ /* pkcs11 provider is optional; only needed for pkcs11: URIs */
>> ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
>> ++ ERR_clear_error();
>> ++
>> ++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
>> ++ ERR(!store, "OSSL_STORE_open");
>> ++
>> ++ while (!OSSL_STORE_eof(store)) {
>> ++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
>> ++
>> ++ if (!info) {
>> ++ drain_openssl_errors(__LINE__, 0);
>> ++ continue;
>> ++ }
>> ++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
>> ++ private_key = OSSL_STORE_INFO_get1_PKEY(info);
>> ++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
>> ++ }
>> ++ OSSL_STORE_INFO_free(info);
>> ++ if (private_key)
>> ++ break;
>> ++ }
>> ++ OSSL_STORE_close(store);
>> ++
>> ++ *evpp = private_key;
>> ++#else
>> + if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
>> + rsa_err("Failure reading private key");
>> + fclose(f);
>> +@@ -214,6 +290,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
>> + }
>> + fclose(f);
>> +
>> ++#endif
>> + return 0;
>> + }
>> +
>> +@@ -226,6 +303,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
>> + * @evpp Returns EVP_PKEY object, or NULL on failure
>> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
>> + */
>> ++#ifdef USE_PKCS11_ENGINE
>> + static int rsa_engine_get_priv_key(const char *keydir, const char *name,
>> + const char *keyfile,
>> + ENGINE *engine, EVP_PKEY **evpp)
>> +@@ -293,6 +371,7 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
>> +
>> + return 0;
>> + }
>> ++#endif
>> +
>> + /**
>> + * rsa_get_priv_key() - read a private key
>> +@@ -306,9 +385,11 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
>> + static int rsa_get_priv_key(const char *keydir, const char *name,
>> + const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
>> + {
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (engine)
>> + return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
>> + evpp);
>> ++#endif
>> + return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
>> + }
>> +
>> +@@ -325,6 +406,7 @@ static int rsa_init(void)
>> + return 0;
>> + }
>> +
>> ++#ifdef USE_PKCS11_ENGINE
>> + static int rsa_engine_init(const char *engine_id, ENGINE **pe)
>> + {
>> + const char *key_pass;
>> +@@ -372,6 +454,7 @@ err_engine_init:
>> + ENGINE_free(e);
>> + return ret;
>> + }
>> ++#endif
>> +
>> + static void rsa_engine_remove(ENGINE *e)
>> + {
>> +@@ -471,11 +554,13 @@ int rsa_sign(struct image_sign_info *info,
>> + if (ret)
>> + return ret;
>> +
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id) {
>> + ret = rsa_engine_init(info->engine_id, &e);
>> + if (ret)
>> + return ret;
>> + }
>> ++#endif
>> +
>> + ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
>> + e, &pkey);
>> +@@ -487,16 +572,20 @@ int rsa_sign(struct image_sign_info *info,
>> + goto err_sign;
>> +
>> + EVP_PKEY_free(pkey);
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id)
>> + rsa_engine_remove(e);
>> ++#endif
>> +
>> + return ret;
>> +
>> + err_sign:
>> + EVP_PKEY_free(pkey);
>> + err_priv:
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id)
>> + rsa_engine_remove(e);
>> ++#endif
>> + return ret;
>> + }
>> +
>> +@@ -636,11 +725,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
>> + ENGINE *e = NULL;
>> +
>> + debug("%s: Getting verification data\n", __func__);
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id) {
>> + ret = rsa_engine_init(info->engine_id, &e);
>> + if (ret)
>> + return ret;
>> + }
>> ++#endif
>> + ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
>> + if (ret)
>> + goto err_get_pub_key;
>> +@@ -717,8 +808,10 @@ done:
>> + err_get_params:
>> + EVP_PKEY_free(pkey);
>> + err_get_pub_key:
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id)
>> + rsa_engine_remove(e);
>> ++#endif
>> +
>> + if (ret)
>> + return ret;
>> +--
>> +2.43.0
>> +
>> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch
>> new file mode 100644
>> index 00000000..c5f3655e
>> --- /dev/null
>> +++ b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch
>> @@ -0,0 +1,300 @@
>> +From 0525693750b1b7a8fb7228dbb97bf592a21322fc Mon Sep 17 00:00:00 2001
>> +From: Ryan Eatmon <reatmon@ti.com>
>> +Date: Wed, 9 Sep 2026 10:04:50 -0500
>> +Subject: [PATCH] Add support for OpenSSL Provider API
>> +
>> +Backport from 2026.01 patch [1] by Ryan Eatmon <reatmon@ti.com>
>> +
>> +Upsatream-Status: Inappropriate [OE-specific]
>> +
>> +The Engine API has been deprecated since the release of OpenSSL 3.0. End
>> +users have been advised to migrate to the new Provider interface.
>> +Several distributions have already removed support for engines, which is
>> +preventing U-Boot from being compiled in those environments.
>> +
>> +Add support for the Provider API while continuing to support the existing
>> +Engine API on distros shipping older releases of OpenSSL.
>> +
>> +This is based on similar work contributed by Jan Stancek updating Linux
>> +to use the Provider interface.
>> +
>> + commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
>> + Author: Jan Stancek <jstancek@redhat.com>
>> + Date: Fri Sep 20 19:52:48 2024 +0300
>> +
>> + sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
>> +
>> +The changes have been tested with the FIT signature verification vboot
>> +tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
>> +Engine library installed and with the Provider API.
>> +
>> +Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
>> +
>> +Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
>> +
>> +Note: Modified to make pkcs11 provider loading optional. The upstream
>> +patch unconditionally requires the pkcs11 provider, which is not
>> +available in the OE build environment. File-based key signing only needs
>> +the default provider; pkcs11 is only required for pkcs11: URI keys.
>> +Changes from upstream:
>> + - Load default provider first (was pkcs11 first)
>> + - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
>> + of ERR(1, ...) which calls errx/abort)
>> +
>> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
>> +
>> +Signed-off-by: Ryan Eatmon <reatmon@ti.com>
>> +---
>> + lib/aes/aes-encrypt.c | 4 +-
>> + lib/rsa/rsa-sign.c | 95 ++++++++++++++++++++++++++++++++++++++++++-
>> + 2 files changed, 97 insertions(+), 2 deletions(-)
>> +
>> +diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
>> +index e74e35eaa28..8a6f7715df9 100644
>> +--- a/lib/aes/aes-encrypt.c
>> ++++ b/lib/aes/aes-encrypt.c
>> +@@ -16,7 +16,9 @@
>> + #include <openssl/err.h>
>> + #include <openssl/ssl.h>
>> + #include <openssl/evp.h>
>> +-#include <openssl/engine.h>
>> ++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
>> ++# include <openssl/engine.h>
>> ++#endif
>> + #include <uboot_aes.h>
>> +
>> + #if OPENSSL_VERSION_NUMBER >= 0x10000000L
>> +diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
>> +index fa9e143b4ca..af5b18e0c95 100644
>> +--- a/lib/rsa/rsa-sign.c
>> ++++ b/lib/rsa/rsa-sign.c
>> +@@ -19,7 +19,47 @@
>> + #include <openssl/err.h>
>> + #include <openssl/ssl.h>
>> + #include <openssl/evp.h>
>> +-#include <openssl/engine.h>
>> ++#if OPENSSL_VERSION_MAJOR >= 3
>> ++# define USE_PKCS11_PROVIDER
>> ++# include <err.h>
>> ++# include <openssl/provider.h>
>> ++# include <openssl/store.h>
>> ++#else
>> ++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
>> ++# define USE_PKCS11_ENGINE
>> ++# include <openssl/engine.h>
>> ++# endif
>> ++#endif
>> ++
>> ++#ifdef USE_PKCS11_PROVIDER
>> ++#define ERR(cond, fmt, ...) \
>> ++ do { \
>> ++ bool __cond = (cond); \
>> ++ drain_openssl_errors(__LINE__, 0); \
>> ++ if (__cond) { \
>> ++ errx(1, fmt, ## __VA_ARGS__); \
>> ++ } \
>> ++ } while (0)
>> ++
>> ++static void drain_openssl_errors(int l, int silent)
>> ++{
>> ++ const char *file;
>> ++ char buf[120];
>> ++ int e, line;
>> ++
>> ++ if (ERR_peek_error() == 0)
>> ++ return;
>> ++ if (!silent)
>> ++ fprintf(stderr, "At main.c:%d:\n", l);
>> ++
>> ++ while ((e = ERR_peek_error_line(&file, &line))) {
>> ++ ERR_error_string(e, buf);
>> ++ if (!silent)
>> ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
>> ++ ERR_get_error();
>> ++ }
>> ++}
>> ++#endif
>> +
>> + static int rsa_err(const char *msg)
>> + {
>> +@@ -98,6 +138,7 @@ err_cert:
>> + * @evpp Returns EVP_PKEY object, or NULL on failure
>> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
>> + */
>> ++#ifdef USE_PKCS11_ENGINE
>> + static int rsa_engine_get_pub_key(const char *keydir, const char *name,
>> + ENGINE *engine, EVP_PKEY **evpp)
>> + {
>> +@@ -157,6 +198,7 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
>> +
>> + return 0;
>> + }
>> ++#endif
>> +
>> + /**
>> + * rsa_get_pub_key() - read a public key
>> +@@ -170,8 +212,10 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
>> + static int rsa_get_pub_key(const char *keydir, const char *name,
>> + ENGINE *engine, EVP_PKEY **evpp)
>> + {
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (engine)
>> + return rsa_engine_get_pub_key(keydir, name, engine, evpp);
>> ++#endif
>> + return rsa_pem_get_pub_key(keydir, name, evpp);
>> + }
>> +
>> +@@ -207,6 +251,38 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
>> + return -ENOENT;
>> + }
>> +
>> ++#ifdef USE_PKCS11_PROVIDER
>> ++ EVP_PKEY *private_key = NULL;
>> ++ OSSL_STORE_CTX *store;
>> ++
>> ++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
>> ++ ERR(1, "OSSL_PROVIDER_try_load(default)");
>> ++ /* pkcs11 provider is optional; only needed for pkcs11: URIs */
>> ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
>> ++ ERR_clear_error();
>> ++
>> ++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
>> ++ ERR(!store, "OSSL_STORE_open");
>> ++
>> ++ while (!OSSL_STORE_eof(store)) {
>> ++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
>> ++
>> ++ if (!info) {
>> ++ drain_openssl_errors(__LINE__, 0);
>> ++ continue;
>> ++ }
>> ++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
>> ++ private_key = OSSL_STORE_INFO_get1_PKEY(info);
>> ++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
>> ++ }
>> ++ OSSL_STORE_INFO_free(info);
>> ++ if (private_key)
>> ++ break;
>> ++ }
>> ++ OSSL_STORE_close(store);
>> ++
>> ++ *evpp = private_key;
>> ++#else
>> + if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
>> + rsa_err("Failure reading private key");
>> + fclose(f);
>> +@@ -214,6 +290,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
>> + }
>> + fclose(f);
>> +
>> ++#endif
>> + return 0;
>> + }
>> +
>> +@@ -226,6 +303,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
>> + * @evpp Returns EVP_PKEY object, or NULL on failure
>> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
>> + */
>> ++#ifdef USE_PKCS11_ENGINE
>> + static int rsa_engine_get_priv_key(const char *keydir, const char *name,
>> + const char *keyfile,
>> + ENGINE *engine, EVP_PKEY **evpp)
>> +@@ -293,6 +371,7 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
>> +
>> + return 0;
>> + }
>> ++#endif
>> +
>> + /**
>> + * rsa_get_priv_key() - read a private key
>> +@@ -306,9 +385,11 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
>> + static int rsa_get_priv_key(const char *keydir, const char *name,
>> + const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
>> + {
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (engine)
>> + return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
>> + evpp);
>> ++#endif
>> + return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
>> + }
>> +
>> +@@ -325,6 +406,7 @@ static int rsa_init(void)
>> + return 0;
>> + }
>> +
>> ++#ifdef USE_PKCS11_ENGINE
>> + static int rsa_engine_init(const char *engine_id, ENGINE **pe)
>> + {
>> + const char *key_pass;
>> +@@ -372,6 +454,7 @@ err_engine_init:
>> + ENGINE_free(e);
>> + return ret;
>> + }
>> ++#endif
>> +
>> + static void rsa_engine_remove(ENGINE *e)
>> + {
>> +@@ -480,11 +563,13 @@ int rsa_sign(struct image_sign_info *info,
>> + if (ret)
>> + return ret;
>> +
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id) {
>> + ret = rsa_engine_init(info->engine_id, &e);
>> + if (ret)
>> + return ret;
>> + }
>> ++#endif
>> +
>> + ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
>> + e, &pkey);
>> +@@ -496,16 +581,20 @@ int rsa_sign(struct image_sign_info *info,
>> + goto err_sign;
>> +
>> + EVP_PKEY_free(pkey);
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id)
>> + rsa_engine_remove(e);
>> ++#endif
>> +
>> + return ret;
>> +
>> + err_sign:
>> + EVP_PKEY_free(pkey);
>> + err_priv:
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id)
>> + rsa_engine_remove(e);
>> ++#endif
>> + return ret;
>> + }
>> +
>> +@@ -645,11 +734,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
>> + ENGINE *e = NULL;
>> +
>> + debug("%s: Getting verification data\n", __func__);
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id) {
>> + ret = rsa_engine_init(info->engine_id, &e);
>> + if (ret)
>> + return ret;
>> + }
>> ++#endif
>> + ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
>> + if (ret)
>> + goto err_get_pub_key;
>> +@@ -726,8 +817,10 @@ done:
>> + err_get_params:
>> + EVP_PKEY_free(pkey);
>> + err_get_pub_key:
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id)
>> + rsa_engine_remove(e);
>> ++#endif
>> +
>> + if (ret)
>> + return ret;
>> +--
>> +2.43.0
>> +
>> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch
>> new file mode 100644
>> index 00000000..346d0584
>> --- /dev/null
>> +++ b/meta-ti-bsp/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch
>> @@ -0,0 +1,340 @@
>> +From a81cb0932dce109af44d7245d47489fe54ae390f Mon Sep 17 00:00:00 2001
>> +From: Eddie Kovsky <ewk@edkovsky.org>
>> +Date: Mon, 23 Feb 2026 09:43:22 -0700
>> +Subject: [PATCH] Add support for OpenSSL Provider API
>> +
>> +The Engine API has been deprecated since the release of OpenSSL 3.0. End
>> +users have been advised to migrate to the new Provider interface.
>> +Several distributions have already removed support for engines, which is
>> +preventing U-Boot from being compiled in those environments.
>> +
>> +Add support for the Provider API while continuing to support the existing
>> +Engine API on distros shipping older releases of OpenSSL.
>> +
>> +This is based on similar work contributed by Jan Stancek updating Linux
>> +to use the Provider interface.
>> +
>> + commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
>> + Author: Jan Stancek <jstancek@redhat.com>
>> + Date: Fri Sep 20 19:52:48 2024 +0300
>> +
>> + sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
>> +
>> +The changes have been tested with the FIT signature verification vboot
>> +tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
>> +Engine library installed and with the Provider API.
>> +
>> +Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
>> +
>> +Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
>> +
>> +Note: Modified to make pkcs11 provider loading optional. The upstream
>> +patch unconditionally requires the pkcs11 provider, which is not
>> +available in the OE build environment. File-based key signing only needs
>> +the default provider; pkcs11 is only required for pkcs11: URI keys.
>> +Changes from upstream:
>> + - Load default provider first (was pkcs11 first)
>> + - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
>> + of ERR(1, ...) which calls errx/abort)
>> +
>> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
>> +---
>> + doc/build/gcc.rst | 4 +-
>> + lib/aes/aes-encrypt.c | 4 +-
>> + lib/rsa/rsa-sign.c | 102 +++++++++++++++++++++++++++++++++++++++---
>> + tools/docker/Dockerfile | 1 +
>> + 4 files changed, 103 insertions(+), 8 deletions(-)
>> +
>> +diff --git a/doc/build/gcc.rst b/doc/build/gcc.rst
>> +index 1fef718ceecb..29a6a632e7e3 100644
>> +--- a/doc/build/gcc.rst
>> ++++ b/doc/build/gcc.rst
>> +@@ -25,8 +25,8 @@ Depending on the build targets further packages maybe needed
>> +
>> + sudo apt-get install bc bison build-essential coccinelle \
>> + device-tree-compiler dfu-util efitools flex gdisk graphviz imagemagick \
>> +- libgnutls28-dev libguestfs-tools libncurses-dev \
>> +- libpython3-dev libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl \
>> ++ libgnutls28-dev libguestfs-tools libncurses-dev libpython3-dev \
>> ++ libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl pkcs11-provider \
>> + pkg-config python3 python3-asteval python3-coverage python3-filelock \
>> + python3-pkg-resources python3-pycryptodome python3-pyelftools \
>> + python3-pytest python3-pytest-xdist python3-sphinxcontrib.apidoc \
>> +diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
>> +index 90e1407b4f09..4fc4ce232478 100644
>> +--- a/lib/aes/aes-encrypt.c
>> ++++ b/lib/aes/aes-encrypt.c
>> +@@ -16,7 +16,9 @@
>> + #include <openssl/err.h>
>> + #include <openssl/ssl.h>
>> + #include <openssl/evp.h>
>> +-#include <openssl/engine.h>
>> ++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
>> ++# include <openssl/engine.h>
>> ++#endif
>> + #include <uboot_aes.h>
>> +
>> + #if OPENSSL_VERSION_NUMBER >= 0x10000000L
>> +diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
>> +index 0e38c9e802fd..f456f3c58e65 100644
>> +--- a/lib/rsa/rsa-sign.c
>> ++++ b/lib/rsa/rsa-sign.c
>> +@@ -19,7 +19,47 @@
>> + #include <openssl/err.h>
>> + #include <openssl/ssl.h>
>> + #include <openssl/evp.h>
>> +-#include <openssl/engine.h>
>> ++#if OPENSSL_VERSION_MAJOR >= 3
>> ++# define USE_PKCS11_PROVIDER
>> ++# include <err.h>
>> ++# include <openssl/provider.h>
>> ++# include <openssl/store.h>
>> ++#else
>> ++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
>> ++# define USE_PKCS11_ENGINE
>> ++# include <openssl/engine.h>
>> ++# endif
>> ++#endif
>> ++
>> ++#ifdef USE_PKCS11_PROVIDER
>> ++#define ERR(cond, fmt, ...) \
>> ++ do { \
>> ++ bool __cond = (cond); \
>> ++ drain_openssl_errors(__LINE__, 0); \
>> ++ if (__cond) { \
>> ++ errx(1, fmt, ## __VA_ARGS__); \
>> ++ } \
>> ++ } while (0)
>> ++
>> ++static void drain_openssl_errors(int l, int silent)
>> ++{
>> ++ const char *file;
>> ++ char buf[120];
>> ++ int e, line;
>> ++
>> ++ if (ERR_peek_error() == 0)
>> ++ return;
>> ++ if (!silent)
>> ++ fprintf(stderr, "At main.c:%d:\n", l);
>> ++
>> ++ while ((e = ERR_peek_error_line(&file, &line))) {
>> ++ ERR_error_string(e, buf);
>> ++ if (!silent)
>> ++ fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
>> ++ ERR_get_error();
>> ++ }
>> ++}
>> ++#endif
>> +
>> + static int rsa_err(const char *msg)
>> + {
>> +@@ -94,10 +134,11 @@ static int rsa_pem_get_pub_key(const char *keydir, const char *name, EVP_PKEY **
>> + *
>> + * @keydir: Key prefix
>> + * @name Name of key
>> +- * @engine Engine to use
>> ++ * @engine Engine to use or NULL when using pkcs11 provider
>> + * @evpp Returns EVP_PKEY object, or NULL on failure
>> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
>> + */
>> ++#ifdef USE_PKCS11_ENGINE
>> + static int rsa_engine_get_pub_key(const char *keydir, const char *name,
>> + ENGINE *engine, EVP_PKEY **evpp)
>> + {
>> +@@ -157,21 +198,24 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
>> +
>> + return 0;
>> + }
>> ++#endif
>> +
>> + /**
>> + * rsa_get_pub_key() - read a public key
>> + *
>> + * @keydir: Directory containing the key (PEM file) or key prefix (engine)
>> + * @name Name of key file (will have a .crt extension)
>> +- * @engine Engine to use
>> ++ * @engine Engine to use or NULL when using pkcs11 provider
>> + * @evpp Returns EVP_PKEY object, or NULL on failure
>> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
>> + */
>> + static int rsa_get_pub_key(const char *keydir, const char *name,
>> + ENGINE *engine, EVP_PKEY **evpp)
>> + {
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (engine)
>> + return rsa_engine_get_pub_key(keydir, name, engine, evpp);
>> ++#endif
>> + return rsa_pem_get_pub_key(keydir, name, evpp);
>> + }
>> +
>> +@@ -207,13 +251,45 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
>> + return -ENOENT;
>> + }
>> +
>> ++#ifdef USE_PKCS11_PROVIDER
>> ++ EVP_PKEY *private_key = NULL;
>> ++ OSSL_STORE_CTX *store;
>> ++
>> ++ if (!OSSL_PROVIDER_try_load(NULL, "default", true))
>> ++ ERR(1, "OSSL_PROVIDER_try_load(default)");
>> ++ /* pkcs11 provider is optional; only needed for pkcs11: URIs */
>> ++ if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
>> ++ ERR_clear_error();
>> ++
>> ++ store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
>> ++ ERR(!store, "OSSL_STORE_open");
>> ++
>> ++ while (!OSSL_STORE_eof(store)) {
>> ++ OSSL_STORE_INFO *info = OSSL_STORE_load(store);
>> ++
>> ++ if (!info) {
>> ++ drain_openssl_errors(__LINE__, 0);
>> ++ continue;
>> ++ }
>> ++ if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
>> ++ private_key = OSSL_STORE_INFO_get1_PKEY(info);
>> ++ ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
>> ++ }
>> ++ OSSL_STORE_INFO_free(info);
>> ++ if (private_key)
>> ++ break;
>> ++ }
>> ++ OSSL_STORE_close(store);
>> ++
>> ++ *evpp = private_key;
>> ++#else
>> + if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
>> + rsa_err("Failure reading private key");
>> + fclose(f);
>> + return -EPROTO;
>> + }
>> + fclose(f);
>> +-
>> ++#endif
>> + return 0;
>> + }
>> +
>> +@@ -226,6 +301,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
>> + * @evpp Returns EVP_PKEY object, or NULL on failure
>> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
>> + */
>> ++#ifdef USE_PKCS11_ENGINE
>> + static int rsa_engine_get_priv_key(const char *keydir, const char *name,
>> + const char *keyfile,
>> + ENGINE *engine, EVP_PKEY **evpp)
>> +@@ -293,22 +369,25 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
>> +
>> + return 0;
>> + }
>> ++#endif
>> +
>> + /**
>> + * rsa_get_priv_key() - read a private key
>> + *
>> + * @keydir: Directory containing the key (PEM file) or key prefix (engine)
>> + * @name Name of key
>> +- * @engine Engine to use for signing
>> ++ * @engine Engine to use or NULL when using pkcs11 provider
>> + * @evpp Returns EVP_PKEY object, or NULL on failure
>> + * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
>> + */
>> + static int rsa_get_priv_key(const char *keydir, const char *name,
>> + const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
>> + {
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (engine)
>> + return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
>> + evpp);
>> ++#endif
>> + return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
>> + }
>> +
>> +@@ -325,6 +404,7 @@ static int rsa_init(void)
>> + return 0;
>> + }
>> +
>> ++#ifdef USE_PKCS11_ENGINE
>> + static int rsa_engine_init(const char *engine_id, ENGINE **pe)
>> + {
>> + const char *key_pass;
>> +@@ -380,6 +460,7 @@ static void rsa_engine_remove(ENGINE *e)
>> + ENGINE_free(e);
>> + }
>> + }
>> ++#endif
>> +
>> + static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo,
>> + struct checksum_algo *checksum_algo,
>> +@@ -480,11 +561,13 @@ int rsa_sign(struct image_sign_info *info,
>> + if (ret)
>> + return ret;
>> +
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id) {
>> + ret = rsa_engine_init(info->engine_id, &e);
>> + if (ret)
>> + return ret;
>> + }
>> ++#endif
>> +
>> + ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
>> + e, &pkey);
>> +@@ -496,16 +579,21 @@ int rsa_sign(struct image_sign_info *info,
>> + goto err_sign;
>> +
>> + EVP_PKEY_free(pkey);
>> ++
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id)
>> + rsa_engine_remove(e);
>> ++#endif
>> +
>> + return ret;
>> +
>> + err_sign:
>> + EVP_PKEY_free(pkey);
>> + err_priv:
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id)
>> + rsa_engine_remove(e);
>> ++#endif
>> + return ret;
>> + }
>> +
>> +@@ -645,11 +733,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
>> + ENGINE *e = NULL;
>> +
>> + debug("%s: Getting verification data\n", __func__);
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id) {
>> + ret = rsa_engine_init(info->engine_id, &e);
>> + if (ret)
>> + return ret;
>> + }
>> ++#endif
>> + ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
>> + if (ret)
>> + goto err_get_pub_key;
>> +@@ -726,8 +816,10 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
>> + err_get_params:
>> + EVP_PKEY_free(pkey);
>> + err_get_pub_key:
>> ++#ifdef USE_PKCS11_ENGINE
>> + if (info->engine_id)
>> + rsa_engine_remove(e);
>> ++#endif
>> +
>> + if (ret)
>> + return ret;
>> +diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
>> +index 73bf6cdd2c52..50e98e83dc20 100644
>> +--- a/tools/docker/Dockerfile
>> ++++ b/tools/docker/Dockerfile
>> +@@ -122,6 +122,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
>> + openssl \
>> + picocom \
>> + parted \
>> ++ pkcs11-provider \
>> + pkg-config \
>> + python-is-python3 \
>> + python3 \
>> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb
>> index d3a78d8b..5812b914 100644
>> --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb
>> +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2024.04.bb
>> @@ -4,6 +4,8 @@ PR = "r0"
>>
>> BRANCH = "ti-u-boot-2024.04"
>>
>> -SRC_URI += "file://0001-scripts-dtc-pylibfdt-libfdt.i_shipped-Use-SWIG_Appen.patch"
>> -
>> SRCREV_uboot = "29d0c23d67ee7b88e46fe1753cd020e2b04c2ef6"
>> +
>> +SRC_URI += "file://0001-scripts-dtc-pylibfdt-libfdt.i_shipped-Use-SWIG_Appen.patch"
>> +SRC_URI += "file://0001-binman-migrate-form-pkg_resources-to-importlib.patch"
>> +SRC_URI += "file://0001-Add-support-for-OpenSSL-Provider-API-2024-04.patch"
>> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb
>> index f7475c2b..af4b1b77 100644
>> --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb
>> +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2025.01.bb
>> @@ -7,3 +7,4 @@ BRANCH = "ti-u-boot-2025.01"
>> SRCREV_uboot = "4ca322ca563a21cccad8c9ba65e386b9fd34dd16"
>>
>> SRC_URI += "file://0001-binman-migrate-form-pkg_resources-to-importlib.patch"
>> +SRC_URI += "file://0001-Add-support-for-OpenSSL-Provider-API-2025-01.patch"
>> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb
>> index 7637cfaf..d1ef241d 100644
>> --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb
>> +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti-staging_2026.01.bb
>> @@ -5,3 +5,5 @@ PR = "r0"
>> BRANCH = "ti-u-boot-2026.01"
>>
>> SRCREV_uboot = "2a85f4bcffc50ddc8b443d8e4162e9e46ed0f200"
>> +
>> +SRC_URI += "file://0001-Add-support-for-OpenSSL-Provider-API-2026-01.patch"
>> diff --git a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
>> index 3d6769bf..8213ac60 100644
>> --- a/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
>> +++ b/meta-ti-bsp/recipes-bsp/u-boot/u-boot-ti.inc
>> @@ -25,6 +25,7 @@ UBOOT_GIT_PROTOCOL ?= "https"
>> UBOOT_GIT_BRANCH ?= "branch=${BRANCH}"
>> SRC_URI = "${UBOOT_GIT_URI};protocol=${UBOOT_GIT_PROTOCOL};${UBOOT_GIT_BRANCH};name=uboot"
>>
>> +SRC_URI:append:bsp-ti-6_6 = " file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch"
>> SRC_URI:append:bsp-ti-6_12 = " file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch"
>> SRC_URI:append:bsp-ti-6_18 = " file://0001-pylibfdt-Replace-removed-SWIG-Python-2-compatibility.patch"
>>
>> --
>> 2.43.0
--
Ryan Eatmon reatmon@ti.com
-----------------------------------------
Texas Instruments, Inc. - LCPD - MGTS
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2026-09-11 13:52 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-10 1:54 [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0 Ryan Eatmon
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 2/5] linux-ti-staging_6.6: Backport OpenSSL 4.0 patches Ryan Eatmon
2026-09-10 5:50 ` Yogesh Hegde
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 3/5] mesa-pvr: Remove makedepend dependency Ryan Eatmon
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 4/5] libclc: Rollback to 22.1.8 Ryan Eatmon
2026-09-10 1:54 ` [meta-ti][master][PATCH v2 5/5] mesa-pvr: Fix for building with new LLVM version Ryan Eatmon
2026-09-10 5:43 ` Yogesh Hegde
2026-09-10 2:00 ` [meta-ti][master][PATCH v2 1/5] u-boot-ti-staging: Fixes for OpenSSL 4.0 PRC Automation
2026-09-10 5:36 ` Yogesh Hegde
2026-09-10 18:13 ` Denys Dmytriyenko
2026-09-11 13:51 ` Ryan Eatmon
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.