[scarthgap][PATCH] u-boot-tools: use all patches from u-boot

[scarthgap][PATCH] u-boot-tools: use all patches from u-boot

[Peter Marko]

From: Peter Marko <peter.marko@siemens.com>

After sharing CVE_PRODUCT between u-boot and u-boot-tools CVEs
patched in u-boot showed-up in CVE reports for u-boot-tools.

It does not make much sense to share git repository but not share all
patches on top of it, so move adding all patches from u-boot recipe to a
common include file where also the git repository is defined.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 meta/recipes-bsp/u-boot/u-boot-common.inc       | 10 ++++++++++
 meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb |  2 --
 meta/recipes-bsp/u-boot/u-boot_2024.01.bb       | 12 ------------
 3 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index 27e6ac9db5b..6d388fadedc 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -18,6 +18,16 @@ SRCREV = "866ca972d6c3cabeaf6dbac431e8e08bb30b3c8e"
 
 SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master \
            file://CVE-2025-24857.patch \
+           file://CVE-2024-57254.patch \
+           file://CVE-2024-57255.patch \
+           file://CVE-2024-57256.patch \
+           file://CVE-2024-57257.patch \
+           file://CVE-2024-57258-1.patch \
+           file://CVE-2024-57258-2.patch \
+           file://CVE-2024-57258-3.patch \
+           file://CVE-2024-57259.patch \
+           file://CVE-2024-42040.patch \
+           file://CVE-2026-46728.patch \
 "
 
 S = "${WORKDIR}/git"
diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
index 4b6d89ed4e1..7eaf721ca83 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb
@@ -1,4 +1,2 @@
 require u-boot-common.inc
 require u-boot-tools.inc
-
-SRC_URI += "file://CVE-2026-46728.patch"
diff --git a/meta/recipes-bsp/u-boot/u-boot_2024.01.bb b/meta/recipes-bsp/u-boot/u-boot_2024.01.bb
index 7eaeed1004b..945398c90e4 100644
--- a/meta/recipes-bsp/u-boot/u-boot_2024.01.bb
+++ b/meta/recipes-bsp/u-boot/u-boot_2024.01.bb
@@ -2,15 +2,3 @@ require u-boot-common.inc
 require u-boot.inc
 
 DEPENDS += "bc-native dtc-native python3-pyelftools-native"
-
-SRC_URI += "file://CVE-2024-57254.patch \
-            file://CVE-2024-57255.patch \
-            file://CVE-2024-57256.patch \
-            file://CVE-2024-57257.patch \
-            file://CVE-2024-57258-1.patch \
-            file://CVE-2024-57258-2.patch \
-            file://CVE-2024-57258-3.patch \
-            file://CVE-2024-57259.patch \
-            file://CVE-2024-42040.patch \
-            file://CVE-2026-46728.patch \
-"

Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

[Yoann Congal]

On Wed Sep 23, 2026 at 7:38 PM CEST, Peter Marko via lists.openembedded.org wrote:
> From: Peter Marko <peter.marko@siemens.com>
>
> After sharing CVE_PRODUCT between u-boot and u-boot-tools CVEs
> patched in u-boot showed-up in CVE reports for u-boot-tools.
>
> It does not make much sense to share git repository but not share all
> patches on top of it, so move adding all patches from u-boot recipe to a
> common include file where also the git repository is defined.
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
>  meta/recipes-bsp/u-boot/u-boot-common.inc       | 10 ++++++++++
>  meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb |  2 --
>  meta/recipes-bsp/u-boot/u-boot_2024.01.bb       | 12 ------------
>  3 files changed, 10 insertions(+), 14 deletions(-)

Hello Peter, Hetvi,

There is a bit of back-and-forth around u-boot-common.inc. So I thought I
would give my vision and get your thoughts.

Fundamentally, there is confusion about the usage of this .inc file:
* This is the common part of u-boot and u-boot-tools recipes (what the
  above patch uses)
* But, also, this may be used by downstream layers to reuse u-boot
  recipe parts. We basically did the revert of Peter's patch a few month
  ago for this reason[0].

With Paul, we would like to have a single set of patches common for both
u-boot and u-boot-tools, but that can't be in u-boot-common.inc as there
is a risk of breaking downstream layers.

Our idea is to create a new inc file "u-boot-common-patches.inc" (I'm
not attached to the name) that contains only SRC_URI += "CVE_*.patch"
and a big warning explaining that is file is only supposed to be
included from layer-local recipes (namely u-boot and u-boot-tools).

This whole situation is not ideal but think the above would solve our
issues and still be acceptable under stable policy.

What do you think?

Regards,

[0]: u-boot: move CVE patches out of the common .inc file - openembedded-core - OpenEmbedded Core layer
     https://git.openembedded.org/openembedded-core/commit/?id=f4ced8ff03147dd532a88cf3ce08d61fab057522
-- 
Yoann Congal
Smile ECS

Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

[-- Attachment #1: Type: text/plain, Size: 3730 bytes --]

Hi Yoann, Peter,

Thanks, Yoann. Continuing the discussion here as suggested.

As i explained in the other thread [1], the existing u-boot fixes are not currently applied to u-boot-tools. My CVE_STATUS changes address cases where the affected code is not compiled into the tools build.

I understand that the proposed separate include would allow both recipes to share the CVE patches without adding them to u-boot-common.inc and affecting downstream users.

My concern is whether we need this additional include and shared patch list for cases that can be handled through recipe-specific CVE_STATUS entries. Could we consider the held exclusions on that basis?

If maintaining one shared source patch set is the preferred approach, could you clarify how we should handle patches 2–11 of my series? Should we revisit them after the shared include is settled and retain only the exclusions still needed?

[1] https://lists.openembedded.org/g/openembedded-core/message/247868

Regards,
Hetvi
________________________________
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
Sent: 16 October 2026 03:44
To: peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Cc: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>
Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

On Wed Sep 23, 2026 at 7:38 PM CEST, Peter Marko via lists.openembedded.org wrote:
> From: Peter Marko <peter.marko@siemens.com>
>
> After sharing CVE_PRODUCT between u-boot and u-boot-tools CVEs
> patched in u-boot showed-up in CVE reports for u-boot-tools.
>
> It does not make much sense to share git repository but not share all
> patches on top of it, so move adding all patches from u-boot recipe to a
> common include file where also the git repository is defined.
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
>  meta/recipes-bsp/u-boot/u-boot-common.inc       | 10 ++++++++++
>  meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb |  2 --
>  meta/recipes-bsp/u-boot/u-boot_2024.01.bb       | 12 ------------
>  3 files changed, 10 insertions(+), 14 deletions(-)

Hello Peter, Hetvi,

There is a bit of back-and-forth around u-boot-common.inc. So I thought I
would give my vision and get your thoughts.

Fundamentally, there is confusion about the usage of this .inc file:
* This is the common part of u-boot and u-boot-tools recipes (what the
  above patch uses)
* But, also, this may be used by downstream layers to reuse u-boot
  recipe parts. We basically did the revert of Peter's patch a few month
  ago for this reason[0].

With Paul, we would like to have a single set of patches common for both
u-boot and u-boot-tools, but that can't be in u-boot-common.inc as there
is a risk of breaking downstream layers.

Our idea is to create a new inc file "u-boot-common-patches.inc" (I'm
not attached to the name) that contains only SRC_URI += "CVE_*.patch"
and a big warning explaining that is file is only supposed to be
included from layer-local recipes (namely u-boot and u-boot-tools).

This whole situation is not ideal but think the above would solve our
issues and still be acceptable under stable policy.

What do you think?

Regards,

[0]: u-boot: move CVE patches out of the common .inc file - openembedded-core - OpenEmbedded Core layer
     https://git.openembedded.org/openembedded-core/commit/?id=f4ced8ff03147dd532a88cf3ce08d61fab057522
--
Yoann Congal
Smile ECS


[-- Attachment #2: Type: text/html, Size: 7694 bytes --]

Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

[Yoann Congal]

On Tue Oct 20, 2026 at 7:16 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Yoann, Peter,
>
> Thanks, Yoann. Continuing the discussion here as suggested.
>
> As i explained in the other thread [1], the existing u-boot fixes are
> not currently applied to u-boot-tools. My CVE_STATUS changes address
> cases where the affected code is not compiled into the tools build.
>
> I understand that the proposed separate include would allow both
> recipes to share the CVE patches without adding them to
> u-boot-common.inc and affecting downstream users.
>
> My concern is whether we need this additional include and shared patch
> list for cases that can be handled through recipe-specific CVE_STATUS
> entries. Could we consider the held exclusions on that basis?
>
> If maintaining one shared source patch set is the preferred approach,
> could you clarify how we should handle patches 2–11 of my series?
> Should we revisit them after the shared include is settled and retain
> only the exclusions still needed?

The general idea is that by sharing CVE patches with the main u-boot
recipe, CVE would be also "fixed" in u-boot-tools (even if said patch is
not compiled).

For 2-8, patches are in u-boot so no need to ignore them:
* [Patch 02/11] u-boot-tools: Ignore CVE-2024-42040
* [Patch 03/11] u-boot-tools: Ignore CVE-2024-57254
* [Patch 04/11] u-boot-tools: Ignore CVE-2024-57255
* [Patch 05/11] u-boot-tools: Ignore CVE-2024-57256
* [Patch 06/11] u-boot-tools: Ignore CVE-2024-57257
* [Patch 07/11] u-boot-tools: Ignore CVE-2024-57258
* [Patch 08/11] u-boot-tools: Ignore CVE-2024-57259

For 9-11, there are no u-boot patches so ignoring them in the
u-boot-tools recipe, would be fair (but patching them would be
preferable):
* [Patch 09/11] u-boot-tools: Ignore CVE-2026-29007
* [Patch 10/11] u-boot-tools: Ignore CVE-2026-29008
* [Patch 11/11] u-boot-tools: Ignore CVE-2026-29009

Regards,

>
> [1] https://lists.openembedded.org/g/openembedded-core/message/247868
>
> Regards,
> Hetvi
> ________________________________
> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
> Sent: 16 October 2026 03:44
> To: peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
> Cc: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>
> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>
> On Wed Sep 23, 2026 at 7:38 PM CEST, Peter Marko via lists.openembedded.org wrote:
>> From: Peter Marko <peter.marko@siemens.com>
>>
>> After sharing CVE_PRODUCT between u-boot and u-boot-tools CVEs
>> patched in u-boot showed-up in CVE reports for u-boot-tools.
>>
>> It does not make much sense to share git repository but not share all
>> patches on top of it, so move adding all patches from u-boot recipe to a
>> common include file where also the git repository is defined.
>>
>> Signed-off-by: Peter Marko <peter.marko@siemens.com>
>> ---
>>  meta/recipes-bsp/u-boot/u-boot-common.inc       | 10 ++++++++++
>>  meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb |  2 --
>>  meta/recipes-bsp/u-boot/u-boot_2024.01.bb       | 12 ------------
>>  3 files changed, 10 insertions(+), 14 deletions(-)
>
> Hello Peter, Hetvi,
>
> There is a bit of back-and-forth around u-boot-common.inc. So I thought I
> would give my vision and get your thoughts.
>
> Fundamentally, there is confusion about the usage of this .inc file:
> * This is the common part of u-boot and u-boot-tools recipes (what the
>   above patch uses)
> * But, also, this may be used by downstream layers to reuse u-boot
>   recipe parts. We basically did the revert of Peter's patch a few month
>   ago for this reason[0].
>
> With Paul, we would like to have a single set of patches common for both
> u-boot and u-boot-tools, but that can't be in u-boot-common.inc as there
> is a risk of breaking downstream layers.
>
> Our idea is to create a new inc file "u-boot-common-patches.inc" (I'm
> not attached to the name) that contains only SRC_URI += "CVE_*.patch"
> and a big warning explaining that is file is only supposed to be
> included from layer-local recipes (namely u-boot and u-boot-tools).
>
> This whole situation is not ideal but think the above would solve our
> issues and still be acceptable under stable policy.
>
> What do you think?
>
> Regards,
>
> [0]: u-boot: move CVE patches out of the common .inc file - openembedded-core - OpenEmbedded Core layer
>      https://git.openembedded.org/openembedded-core/commit/?id=f4ced8ff03147dd532a88cf3ce08d61fab057522
> --
> Yoann Congal
> Smile ECS


-- 
Yoann Congal
Smile ECS

Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

[-- Attachment #1: Type: text/plain, Size: 5762 bytes --]

Hi Yoann,

Thanks for clarifying. For patches 9–11, I understand that source fixes are preferred. However, networking is disabled in u-boot-tools, so building it would not compile or exercise the affected code. How should these fixes be verified?

Regards,
Hetvi

________________________________
From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
Sent: 28 October 2026 14:37
To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

On Tue Oct 20, 2026 at 7:16 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Yoann, Peter,
>
> Thanks, Yoann. Continuing the discussion here as suggested.
>
> As i explained in the other thread [1], the existing u-boot fixes are
> not currently applied to u-boot-tools. My CVE_STATUS changes address
> cases where the affected code is not compiled into the tools build.
>
> I understand that the proposed separate include would allow both
> recipes to share the CVE patches without adding them to
> u-boot-common.inc and affecting downstream users.
>
> My concern is whether we need this additional include and shared patch
> list for cases that can be handled through recipe-specific CVE_STATUS
> entries. Could we consider the held exclusions on that basis?
>
> If maintaining one shared source patch set is the preferred approach,
> could you clarify how we should handle patches 2–11 of my series?
> Should we revisit them after the shared include is settled and retain
> only the exclusions still needed?

The general idea is that by sharing CVE patches with the main u-boot
recipe, CVE would be also "fixed" in u-boot-tools (even if said patch is
not compiled).

For 2-8, patches are in u-boot so no need to ignore them:
* [Patch 02/11] u-boot-tools: Ignore CVE-2024-42040
* [Patch 03/11] u-boot-tools: Ignore CVE-2024-57254
* [Patch 04/11] u-boot-tools: Ignore CVE-2024-57255
* [Patch 05/11] u-boot-tools: Ignore CVE-2024-57256
* [Patch 06/11] u-boot-tools: Ignore CVE-2024-57257
* [Patch 07/11] u-boot-tools: Ignore CVE-2024-57258
* [Patch 08/11] u-boot-tools: Ignore CVE-2024-57259

For 9-11, there are no u-boot patches so ignoring them in the
u-boot-tools recipe, would be fair (but patching them would be
preferable):
* [Patch 09/11] u-boot-tools: Ignore CVE-2026-29007
* [Patch 10/11] u-boot-tools: Ignore CVE-2026-29008
* [Patch 11/11] u-boot-tools: Ignore CVE-2026-29009

Regards,

>
> [1] https://lists.openembedded.org/g/openembedded-core/message/247868
>
> Regards,
> Hetvi
> ________________________________
> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
> Sent: 16 October 2026 03:44
> To: peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
> Cc: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>
> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>
> On Wed Sep 23, 2026 at 7:38 PM CEST, Peter Marko via lists.openembedded.org wrote:
>> From: Peter Marko <peter.marko@siemens.com>
>>
>> After sharing CVE_PRODUCT between u-boot and u-boot-tools CVEs
>> patched in u-boot showed-up in CVE reports for u-boot-tools.
>>
>> It does not make much sense to share git repository but not share all
>> patches on top of it, so move adding all patches from u-boot recipe to a
>> common include file where also the git repository is defined.
>>
>> Signed-off-by: Peter Marko <peter.marko@siemens.com>
>> ---
>>  meta/recipes-bsp/u-boot/u-boot-common.inc       | 10 ++++++++++
>>  meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb |  2 --
>>  meta/recipes-bsp/u-boot/u-boot_2024.01.bb       | 12 ------------
>>  3 files changed, 10 insertions(+), 14 deletions(-)
>
> Hello Peter, Hetvi,
>
> There is a bit of back-and-forth around u-boot-common.inc. So I thought I
> would give my vision and get your thoughts.
>
> Fundamentally, there is confusion about the usage of this .inc file:
> * This is the common part of u-boot and u-boot-tools recipes (what the
>   above patch uses)
> * But, also, this may be used by downstream layers to reuse u-boot
>   recipe parts. We basically did the revert of Peter's patch a few month
>   ago for this reason[0].
>
> With Paul, we would like to have a single set of patches common for both
> u-boot and u-boot-tools, but that can't be in u-boot-common.inc as there
> is a risk of breaking downstream layers.
>
> Our idea is to create a new inc file "u-boot-common-patches.inc" (I'm
> not attached to the name) that contains only SRC_URI += "CVE_*.patch"
> and a big warning explaining that is file is only supposed to be
> included from layer-local recipes (namely u-boot and u-boot-tools).
>
> This whole situation is not ideal but think the above would solve our
> issues and still be acceptable under stable policy.
>
> What do you think?
>
> Regards,
>
> [0]: u-boot: move CVE patches out of the common .inc file - openembedded-core - OpenEmbedded Core layer
>      https://git.openembedded.org/openembedded-core/commit/?id=f4ced8ff03147dd532a88cf3ce08d61fab057522
> --
> Yoann Congal
> Smile ECS


--
Yoann Congal
Smile ECS


[-- Attachment #2: Type: text/html, Size: 8854 bytes --]

Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

[Yoann Congal]

On Wed Oct 28, 2026 at 11:04 AM CET, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Yoann,
>
> Thanks for clarifying. For patches 9–11, I understand that source
> fixes are preferred. However, networking is disabled in u-boot-tools,
> so building it would not compile or exercise the affected code. How
> should these fixes be verified?

By sharing the sources with u-boot which will compile those parts.

>
> Regards,
> Hetvi
>
> ________________________________
> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
> Sent: 28 October 2026 14:37
> To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>
> On Tue Oct 20, 2026 at 7:16 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
>> Hi Yoann, Peter,
>>
>> Thanks, Yoann. Continuing the discussion here as suggested.
>>
>> As i explained in the other thread [1], the existing u-boot fixes are
>> not currently applied to u-boot-tools. My CVE_STATUS changes address
>> cases where the affected code is not compiled into the tools build.
>>
>> I understand that the proposed separate include would allow both
>> recipes to share the CVE patches without adding them to
>> u-boot-common.inc and affecting downstream users.
>>
>> My concern is whether we need this additional include and shared patch
>> list for cases that can be handled through recipe-specific CVE_STATUS
>> entries. Could we consider the held exclusions on that basis?
>>
>> If maintaining one shared source patch set is the preferred approach,
>> could you clarify how we should handle patches 2–11 of my series?
>> Should we revisit them after the shared include is settled and retain
>> only the exclusions still needed?
>
> The general idea is that by sharing CVE patches with the main u-boot
> recipe, CVE would be also "fixed" in u-boot-tools (even if said patch is
> not compiled).
>
> For 2-8, patches are in u-boot so no need to ignore them:
> * [Patch 02/11] u-boot-tools: Ignore CVE-2024-42040
> * [Patch 03/11] u-boot-tools: Ignore CVE-2024-57254
> * [Patch 04/11] u-boot-tools: Ignore CVE-2024-57255
> * [Patch 05/11] u-boot-tools: Ignore CVE-2024-57256
> * [Patch 06/11] u-boot-tools: Ignore CVE-2024-57257
> * [Patch 07/11] u-boot-tools: Ignore CVE-2024-57258
> * [Patch 08/11] u-boot-tools: Ignore CVE-2024-57259
>
> For 9-11, there are no u-boot patches so ignoring them in the
> u-boot-tools recipe, would be fair (but patching them would be
> preferable):
> * [Patch 09/11] u-boot-tools: Ignore CVE-2026-29007
> * [Patch 10/11] u-boot-tools: Ignore CVE-2026-29008
> * [Patch 11/11] u-boot-tools: Ignore CVE-2026-29009
>
> Regards,
>
>>
>> [1] https://lists.openembedded.org/g/openembedded-core/message/247868
>>
>> Regards,
>> Hetvi
>> ________________________________
>> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
>> Sent: 16 October 2026 03:44
>> To: peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
>> Cc: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>
>> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>>
>> On Wed Sep 23, 2026 at 7:38 PM CEST, Peter Marko via lists.openembedded.org wrote:
>>> From: Peter Marko <peter.marko@siemens.com>
>>>
>>> After sharing CVE_PRODUCT between u-boot and u-boot-tools CVEs
>>> patched in u-boot showed-up in CVE reports for u-boot-tools.
>>>
>>> It does not make much sense to share git repository but not share all
>>> patches on top of it, so move adding all patches from u-boot recipe to a
>>> common include file where also the git repository is defined.
>>>
>>> Signed-off-by: Peter Marko <peter.marko@siemens.com>
>>> ---
>>>  meta/recipes-bsp/u-boot/u-boot-common.inc       | 10 ++++++++++
>>>  meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb |  2 --
>>>  meta/recipes-bsp/u-boot/u-boot_2024.01.bb       | 12 ------------
>>>  3 files changed, 10 insertions(+), 14 deletions(-)
>>
>> Hello Peter, Hetvi,
>>
>> There is a bit of back-and-forth around u-boot-common.inc. So I thought I
>> would give my vision and get your thoughts.
>>
>> Fundamentally, there is confusion about the usage of this .inc file:
>> * This is the common part of u-boot and u-boot-tools recipes (what the
>>   above patch uses)
>> * But, also, this may be used by downstream layers to reuse u-boot
>>   recipe parts. We basically did the revert of Peter's patch a few month
>>   ago for this reason[0].
>>
>> With Paul, we would like to have a single set of patches common for both
>> u-boot and u-boot-tools, but that can't be in u-boot-common.inc as there
>> is a risk of breaking downstream layers.
>>
>> Our idea is to create a new inc file "u-boot-common-patches.inc" (I'm
>> not attached to the name) that contains only SRC_URI += "CVE_*.patch"
>> and a big warning explaining that is file is only supposed to be
>> included from layer-local recipes (namely u-boot and u-boot-tools).
>>
>> This whole situation is not ideal but think the above would solve our
>> issues and still be acceptable under stable policy.
>>
>> What do you think?
>>
>> Regards,
>>
>> [0]: u-boot: move CVE patches out of the common .inc file - openembedded-core - OpenEmbedded Core layer
>>      https://git.openembedded.org/openembedded-core/commit/?id=f4ced8ff03147dd532a88cf3ce08d61fab057522
>> --
>> Yoann Congal
>> Smile ECS
>
>
> --
> Yoann Congal
> Smile ECS


-- 
Yoann Congal
Smile ECS

Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

[-- Attachment #1: Type: text/plain, Size: 7923 bytes --]

Hi Yoann,

My reason for adding CVE_STATUS for is that u-boot-tools uses tools-only_defconfig, which disables networking. The affected TCP and NFS code is therefore not compiled into the tools. not-applicable-config accurately describes this configuration.

I understand the preference for sharing source patches between u-boot and u-boot-tools. However, the tools remain unaffected by these CVEs regardless of whether the source fixes are applied, so I believe the configuration exclusions are technically valid.

The same approach is already used in the wrynose branch [1], which excludes all three CVEs. The fix for CVE-2026-29009 was also applied separately to u-boot on wrynose [2].
Additionally, For CVE-2026-29007 and CVE-2026-29008, I have not located a merged upstream fix or a formal patch submission for either CVE in the U-Boot community.

For these reasons, I believe retaining the CVE_STATUS entries is appropriate for u-boot-tools on Scarthgap. They accurately reflect the configuration being built and keep the CVE assessment consistent with the approach already accepted for Wrynose.

[1] https://github.com/openembedded/openembedded-core/blob/wrynose/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
[2] https://git.openembedded.org/openembedded-core/commit/?h=wrynose&id=dff41dcd5e54cad46ba91ecc45faefb0c8db9089

Regards,
Hetvi
________________________________
From: Yoann Congal <yoann.congal@smile.fr>
Sent: 28 October 2026 16:26
To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

On Wed Oct 28, 2026 at 11:04 AM CET, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Yoann,
>
> Thanks for clarifying. For patches 9–11, I understand that source
> fixes are preferred. However, networking is disabled in u-boot-tools,
> so building it would not compile or exercise the affected code. How
> should these fixes be verified?

By sharing the sources with u-boot which will compile those parts.

>
> Regards,
> Hetvi
>
> ________________________________
> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
> Sent: 28 October 2026 14:37
> To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>
> On Tue Oct 20, 2026 at 7:16 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
>> Hi Yoann, Peter,
>>
>> Thanks, Yoann. Continuing the discussion here as suggested.
>>
>> As i explained in the other thread [1], the existing u-boot fixes are
>> not currently applied to u-boot-tools. My CVE_STATUS changes address
>> cases where the affected code is not compiled into the tools build.
>>
>> I understand that the proposed separate include would allow both
>> recipes to share the CVE patches without adding them to
>> u-boot-common.inc and affecting downstream users.
>>
>> My concern is whether we need this additional include and shared patch
>> list for cases that can be handled through recipe-specific CVE_STATUS
>> entries. Could we consider the held exclusions on that basis?
>>
>> If maintaining one shared source patch set is the preferred approach,
>> could you clarify how we should handle patches 2–11 of my series?
>> Should we revisit them after the shared include is settled and retain
>> only the exclusions still needed?
>
> The general idea is that by sharing CVE patches with the main u-boot
> recipe, CVE would be also "fixed" in u-boot-tools (even if said patch is
> not compiled).
>
> For 2-8, patches are in u-boot so no need to ignore them:
> * [Patch 02/11] u-boot-tools: Ignore CVE-2024-42040
> * [Patch 03/11] u-boot-tools: Ignore CVE-2024-57254
> * [Patch 04/11] u-boot-tools: Ignore CVE-2024-57255
> * [Patch 05/11] u-boot-tools: Ignore CVE-2024-57256
> * [Patch 06/11] u-boot-tools: Ignore CVE-2024-57257
> * [Patch 07/11] u-boot-tools: Ignore CVE-2024-57258
> * [Patch 08/11] u-boot-tools: Ignore CVE-2024-57259
>
> For 9-11, there are no u-boot patches so ignoring them in the
> u-boot-tools recipe, would be fair (but patching them would be
> preferable):
> * [Patch 09/11] u-boot-tools: Ignore CVE-2026-29007
> * [Patch 10/11] u-boot-tools: Ignore CVE-2026-29008
> * [Patch 11/11] u-boot-tools: Ignore CVE-2026-29009
>
> Regards,
>
>>
>> [1] https://lists.openembedded.org/g/openembedded-core/message/247868
>>
>> Regards,
>> Hetvi
>> ________________________________
>> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
>> Sent: 16 October 2026 03:44
>> To: peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
>> Cc: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>
>> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>>
>> On Wed Sep 23, 2026 at 7:38 PM CEST, Peter Marko via lists.openembedded.org wrote:
>>> From: Peter Marko <peter.marko@siemens.com>
>>>
>>> After sharing CVE_PRODUCT between u-boot and u-boot-tools CVEs
>>> patched in u-boot showed-up in CVE reports for u-boot-tools.
>>>
>>> It does not make much sense to share git repository but not share all
>>> patches on top of it, so move adding all patches from u-boot recipe to a
>>> common include file where also the git repository is defined.
>>>
>>> Signed-off-by: Peter Marko <peter.marko@siemens.com>
>>> ---
>>>  meta/recipes-bsp/u-boot/u-boot-common.inc       | 10 ++++++++++
>>>  meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb |  2 --
>>>  meta/recipes-bsp/u-boot/u-boot_2024.01.bb       | 12 ------------
>>>  3 files changed, 10 insertions(+), 14 deletions(-)
>>
>> Hello Peter, Hetvi,
>>
>> There is a bit of back-and-forth around u-boot-common.inc. So I thought I
>> would give my vision and get your thoughts.
>>
>> Fundamentally, there is confusion about the usage of this .inc file:
>> * This is the common part of u-boot and u-boot-tools recipes (what the
>>   above patch uses)
>> * But, also, this may be used by downstream layers to reuse u-boot
>>   recipe parts. We basically did the revert of Peter's patch a few month
>>   ago for this reason[0].
>>
>> With Paul, we would like to have a single set of patches common for both
>> u-boot and u-boot-tools, but that can't be in u-boot-common.inc as there
>> is a risk of breaking downstream layers.
>>
>> Our idea is to create a new inc file "u-boot-common-patches.inc" (I'm
>> not attached to the name) that contains only SRC_URI += "CVE_*.patch"
>> and a big warning explaining that is file is only supposed to be
>> included from layer-local recipes (namely u-boot and u-boot-tools).
>>
>> This whole situation is not ideal but think the above would solve our
>> issues and still be acceptable under stable policy.
>>
>> What do you think?
>>
>> Regards,
>>
>> [0]: u-boot: move CVE patches out of the common .inc file - openembedded-core - OpenEmbedded Core layer
>>      https://git.openembedded.org/openembedded-core/commit/?id=f4ced8ff03147dd532a88cf3ce08d61fab057522
>> --
>> Yoann Congal
>> Smile ECS
>
>
> --
> Yoann Congal
> Smile ECS


--
Yoann Congal
Smile ECS


[-- Attachment #2: Type: text/html, Size: 13011 bytes --]

Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

[Yoann Congal]

On Tue Nov 3, 2026 at 6:33 AM CET, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Yoann,
>
> My reason for adding CVE_STATUS for is that u-boot-tools uses
> tools-only_defconfig, which disables networking. The affected TCP and
> NFS code is therefore not compiled into the tools.
> not-applicable-config accurately describes this configuration.
>
> I understand the preference for sharing source patches between u-boot
> and u-boot-tools. However, the tools remain unaffected by these CVEs
> regardless of whether the source fixes are applied, so I believe the
> configuration exclusions are technically valid.
>
> The same approach is already used in the wrynose branch [1], which
> excludes all three CVEs. The fix for CVE-2026-29009 was also applied
> separately to u-boot on wrynose [2].
> Additionally, For CVE-2026-29007 and CVE-2026-29008, I have not
> located a merged upstream fix or a formal patch submission for either
> CVE in the U-Boot community.
>
> For these reasons, I believe retaining the CVE_STATUS entries is
> appropriate for u-boot-tools on Scarthgap. They accurately reflect the
> configuration being built and keep the CVE assessment consistent with
> the approach already accepted for Wrynose.

The new proposed approach would have to be deployed on wrynose as well
(if applicable, I have not checked).

I think that having the precise reason for a non-applicable CVE is not
worth doing the CVE work twice (once with a patch, once with the
CVE_STATUS). If we can fix both u-boot/u-boot-tools with a single patch
it's more efficient.

I still think we should merge the sources (upstream+patches) between
u-boot/u-boot-tools and fix the CVEs only once if possible.

>
> [1] https://github.com/openembedded/openembedded-core/blob/wrynose/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
> [2] https://git.openembedded.org/openembedded-core/commit/?h=wrynose&id=dff41dcd5e54cad46ba91ecc45faefb0c8db9089
>
> Regards,
> Hetvi
> ________________________________
> From: Yoann Congal <yoann.congal@smile.fr>
> Sent: 28 October 2026 16:26
> To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>
> On Wed Oct 28, 2026 at 11:04 AM CET, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
>> Hi Yoann,
>>
>> Thanks for clarifying. For patches 9–11, I understand that source
>> fixes are preferred. However, networking is disabled in u-boot-tools,
>> so building it would not compile or exercise the affected code. How
>> should these fixes be verified?
>
> By sharing the sources with u-boot which will compile those parts.
>
>>
>> Regards,
>> Hetvi
>>
>> ________________________________
>> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
>> Sent: 28 October 2026 14:37
>> To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
>> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>>
>> On Tue Oct 20, 2026 at 7:16 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
>>> Hi Yoann, Peter,
>>>
>>> Thanks, Yoann. Continuing the discussion here as suggested.
>>>
>>> As i explained in the other thread [1], the existing u-boot fixes are
>>> not currently applied to u-boot-tools. My CVE_STATUS changes address
>>> cases where the affected code is not compiled into the tools build.
>>>
>>> I understand that the proposed separate include would allow both
>>> recipes to share the CVE patches without adding them to
>>> u-boot-common.inc and affecting downstream users.
>>>
>>> My concern is whether we need this additional include and shared patch
>>> list for cases that can be handled through recipe-specific CVE_STATUS
>>> entries. Could we consider the held exclusions on that basis?
>>>
>>> If maintaining one shared source patch set is the preferred approach,
>>> could you clarify how we should handle patches 2–11 of my series?
>>> Should we revisit them after the shared include is settled and retain
>>> only the exclusions still needed?
>>
>> The general idea is that by sharing CVE patches with the main u-boot
>> recipe, CVE would be also "fixed" in u-boot-tools (even if said patch is
>> not compiled).
>>
>> For 2-8, patches are in u-boot so no need to ignore them:
>> * [Patch 02/11] u-boot-tools: Ignore CVE-2024-42040
>> * [Patch 03/11] u-boot-tools: Ignore CVE-2024-57254
>> * [Patch 04/11] u-boot-tools: Ignore CVE-2024-57255
>> * [Patch 05/11] u-boot-tools: Ignore CVE-2024-57256
>> * [Patch 06/11] u-boot-tools: Ignore CVE-2024-57257
>> * [Patch 07/11] u-boot-tools: Ignore CVE-2024-57258
>> * [Patch 08/11] u-boot-tools: Ignore CVE-2024-57259
>>
>> For 9-11, there are no u-boot patches so ignoring them in the
>> u-boot-tools recipe, would be fair (but patching them would be
>> preferable):
>> * [Patch 09/11] u-boot-tools: Ignore CVE-2026-29007
>> * [Patch 10/11] u-boot-tools: Ignore CVE-2026-29008
>> * [Patch 11/11] u-boot-tools: Ignore CVE-2026-29009
>>
>> Regards,
>>
>>>
>>> [1] https://lists.openembedded.org/g/openembedded-core/message/247868
>>>
>>> Regards,
>>> Hetvi
>>> ________________________________
>>> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
>>> Sent: 16 October 2026 03:44
>>> To: peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
>>> Cc: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>
>>> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>>>
>>> On Wed Sep 23, 2026 at 7:38 PM CEST, Peter Marko via lists.openembedded.org wrote:
>>>> From: Peter Marko <peter.marko@siemens.com>
>>>>
>>>> After sharing CVE_PRODUCT between u-boot and u-boot-tools CVEs
>>>> patched in u-boot showed-up in CVE reports for u-boot-tools.
>>>>
>>>> It does not make much sense to share git repository but not share all
>>>> patches on top of it, so move adding all patches from u-boot recipe to a
>>>> common include file where also the git repository is defined.
>>>>
>>>> Signed-off-by: Peter Marko <peter.marko@siemens.com>
>>>> ---
>>>>  meta/recipes-bsp/u-boot/u-boot-common.inc       | 10 ++++++++++
>>>>  meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb |  2 --
>>>>  meta/recipes-bsp/u-boot/u-boot_2024.01.bb       | 12 ------------
>>>>  3 files changed, 10 insertions(+), 14 deletions(-)
>>>
>>> Hello Peter, Hetvi,
>>>
>>> There is a bit of back-and-forth around u-boot-common.inc. So I thought I
>>> would give my vision and get your thoughts.
>>>
>>> Fundamentally, there is confusion about the usage of this .inc file:
>>> * This is the common part of u-boot and u-boot-tools recipes (what the
>>>   above patch uses)
>>> * But, also, this may be used by downstream layers to reuse u-boot
>>>   recipe parts. We basically did the revert of Peter's patch a few month
>>>   ago for this reason[0].
>>>
>>> With Paul, we would like to have a single set of patches common for both
>>> u-boot and u-boot-tools, but that can't be in u-boot-common.inc as there
>>> is a risk of breaking downstream layers.
>>>
>>> Our idea is to create a new inc file "u-boot-common-patches.inc" (I'm
>>> not attached to the name) that contains only SRC_URI += "CVE_*.patch"
>>> and a big warning explaining that is file is only supposed to be
>>> included from layer-local recipes (namely u-boot and u-boot-tools).
>>>
>>> This whole situation is not ideal but think the above would solve our
>>> issues and still be acceptable under stable policy.
>>>
>>> What do you think?
>>>
>>> Regards,
>>>
>>> [0]: u-boot: move CVE patches out of the common .inc file - openembedded-core - OpenEmbedded Core layer
>>>      https://git.openembedded.org/openembedded-core/commit/?id=f4ced8ff03147dd532a88cf3ce08d61fab057522
>>> --
>>> Yoann Congal
>>> Smile ECS
>>
>>
>> --
>> Yoann Congal
>> Smile ECS
>
>
> --
> Yoann Congal
> Smile ECS


-- 
Yoann Congal
Smile ECS

Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

[-- Attachment #1: Type: text/plain, Size: 9529 bytes --]

Hi Yoann,
I will prepare and submit the updated patch as discussed.
Could you also please confirm whether we need to revert all the earlier patches proposed by Paul, as discussed in the thread below?
https://lists.openembedded.org/g/openembedded-core/topic/121397520
Regards,
Hetvi

________________________________
From: Yoann Congal via openembedded-core <yoann.congal=smile.fr@lists.openembedded.org>
Sent: Tuesday, November 03, 2026 14:52
To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

On Tue Nov 3, 2026 at 6:33 AM CET, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Yoann,
>
> My reason for adding CVE_STATUS for is that u-boot-tools uses
> tools-only_defconfig, which disables networking. The affected TCP and
> NFS code is therefore not compiled into the tools.
> not-applicable-config accurately describes this configuration.
>
> I understand the preference for sharing source patches between u-boot
> and u-boot-tools. However, the tools remain unaffected by these CVEs
> regardless of whether the source fixes are applied, so I believe the
> configuration exclusions are technically valid.
>
> The same approach is already used in the wrynose branch [1], which
> excludes all three CVEs. The fix for CVE-2026-29009 was also applied
> separately to u-boot on wrynose [2].
> Additionally, For CVE-2026-29007 and CVE-2026-29008, I have not
> located a merged upstream fix or a formal patch submission for either
> CVE in the U-Boot community.
>
> For these reasons, I believe retaining the CVE_STATUS entries is
> appropriate for u-boot-tools on Scarthgap. They accurately reflect the
> configuration being built and keep the CVE assessment consistent with
> the approach already accepted for Wrynose.

The new proposed approach would have to be deployed on wrynose as well
(if applicable, I have not checked).

I think that having the precise reason for a non-applicable CVE is not
worth doing the CVE work twice (once with a patch, once with the
CVE_STATUS). If we can fix both u-boot/u-boot-tools with a single patch
it's more efficient.

I still think we should merge the sources (upstream+patches) between
u-boot/u-boot-tools and fix the CVEs only once if possible.

>
> [1] https://github.com/openembedded/openembedded-core/blob/wrynose/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
> [2] https://git.openembedded.org/openembedded-core/commit/?h=wrynose&id=dff41dcd5e54cad46ba91ecc45faefb0c8db9089
>
> Regards,
> Hetvi
> ________________________________
> From: Yoann Congal <yoann.congal@smile.fr>
> Sent: 28 October 2026 16:26
> To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>
> On Wed Oct 28, 2026 at 11:04 AM CET, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
>> Hi Yoann,
>>
>> Thanks for clarifying. For patches 9–11, I understand that source
>> fixes are preferred. However, networking is disabled in u-boot-tools,
>> so building it would not compile or exercise the affected code. How
>> should these fixes be verified?
>
> By sharing the sources with u-boot which will compile those parts.
>
>>
>> Regards,
>> Hetvi
>>
>> ________________________________
>> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
>> Sent: 28 October 2026 14:37
>> To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
>> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>>
>> On Tue Oct 20, 2026 at 7:16 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
>>> Hi Yoann, Peter,
>>>
>>> Thanks, Yoann. Continuing the discussion here as suggested.
>>>
>>> As i explained in the other thread [1], the existing u-boot fixes are
>>> not currently applied to u-boot-tools. My CVE_STATUS changes address
>>> cases where the affected code is not compiled into the tools build.
>>>
>>> I understand that the proposed separate include would allow both
>>> recipes to share the CVE patches without adding them to
>>> u-boot-common.inc and affecting downstream users.
>>>
>>> My concern is whether we need this additional include and shared patch
>>> list for cases that can be handled through recipe-specific CVE_STATUS
>>> entries. Could we consider the held exclusions on that basis?
>>>
>>> If maintaining one shared source patch set is the preferred approach,
>>> could you clarify how we should handle patches 2–11 of my series?
>>> Should we revisit them after the shared include is settled and retain
>>> only the exclusions still needed?
>>
>> The general idea is that by sharing CVE patches with the main u-boot
>> recipe, CVE would be also "fixed" in u-boot-tools (even if said patch is
>> not compiled).
>>
>> For 2-8, patches are in u-boot so no need to ignore them:
>> * [Patch 02/11] u-boot-tools: Ignore CVE-2024-42040
>> * [Patch 03/11] u-boot-tools: Ignore CVE-2024-57254
>> * [Patch 04/11] u-boot-tools: Ignore CVE-2024-57255
>> * [Patch 05/11] u-boot-tools: Ignore CVE-2024-57256
>> * [Patch 06/11] u-boot-tools: Ignore CVE-2024-57257
>> * [Patch 07/11] u-boot-tools: Ignore CVE-2024-57258
>> * [Patch 08/11] u-boot-tools: Ignore CVE-2024-57259
>>
>> For 9-11, there are no u-boot patches so ignoring them in the
>> u-boot-tools recipe, would be fair (but patching them would be
>> preferable):
>> * [Patch 09/11] u-boot-tools: Ignore CVE-2026-29007
>> * [Patch 10/11] u-boot-tools: Ignore CVE-2026-29008
>> * [Patch 11/11] u-boot-tools: Ignore CVE-2026-29009
>>
>> Regards,
>>
>>>
>>> [1] https://lists.openembedded.org/g/openembedded-core/message/247868
>>>
>>> Regards,
>>> Hetvi
>>> ________________________________
>>> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
>>> Sent: 16 October 2026 03:44
>>> To: peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
>>> Cc: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>
>>> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>>>
>>> On Wed Sep 23, 2026 at 7:38 PM CEST, Peter Marko via lists.openembedded.org wrote:
>>>> From: Peter Marko <peter.marko@siemens.com>
>>>>
>>>> After sharing CVE_PRODUCT between u-boot and u-boot-tools CVEs
>>>> patched in u-boot showed-up in CVE reports for u-boot-tools.
>>>>
>>>> It does not make much sense to share git repository but not share all
>>>> patches on top of it, so move adding all patches from u-boot recipe to a
>>>> common include file where also the git repository is defined.
>>>>
>>>> Signed-off-by: Peter Marko <peter.marko@siemens.com>
>>>> ---
>>>>  meta/recipes-bsp/u-boot/u-boot-common.inc       | 10 ++++++++++
>>>>  meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb |  2 --
>>>>  meta/recipes-bsp/u-boot/u-boot_2024.01.bb       | 12 ------------
>>>>  3 files changed, 10 insertions(+), 14 deletions(-)
>>>
>>> Hello Peter, Hetvi,
>>>
>>> There is a bit of back-and-forth around u-boot-common.inc. So I thought I
>>> would give my vision and get your thoughts.
>>>
>>> Fundamentally, there is confusion about the usage of this .inc file:
>>> * This is the common part of u-boot and u-boot-tools recipes (what the
>>>   above patch uses)
>>> * But, also, this may be used by downstream layers to reuse u-boot
>>>   recipe parts. We basically did the revert of Peter's patch a few month
>>>   ago for this reason[0].
>>>
>>> With Paul, we would like to have a single set of patches common for both
>>> u-boot and u-boot-tools, but that can't be in u-boot-common.inc as there
>>> is a risk of breaking downstream layers.
>>>
>>> Our idea is to create a new inc file "u-boot-common-patches.inc" (I'm
>>> not attached to the name) that contains only SRC_URI += "CVE_*.patch"
>>> and a big warning explaining that is file is only supposed to be
>>> included from layer-local recipes (namely u-boot and u-boot-tools).
>>>
>>> This whole situation is not ideal but think the above would solve our
>>> issues and still be acceptable under stable policy.
>>>
>>> What do you think?
>>>
>>> Regards,
>>>
>>> [0]: u-boot: move CVE patches out of the common .inc file - openembedded-core - OpenEmbedded Core layer
>>>      https://git.openembedded.org/openembedded-core/commit/?id=f4ced8ff03147dd532a88cf3ce08d61fab057522
>>> --
>>> Yoann Congal
>>> Smile ECS
>>
>>
>> --
>> Yoann Congal
>> Smile ECS
>
>
> --
> Yoann Congal
> Smile ECS


--
Yoann Congal
Smile ECS


[-- Attachment #2: Type: text/html, Size: 14643 bytes --]

Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

[-- Attachment #1: Type: text/plain, Size: 10078 bytes --]

Hi Yoann,

Any updates on this ?

Regards,
Hetvi



________________________________
From: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) via openembedded-core <hthakar=cisco.com@lists.openembedded.org>
Sent: Wednesday, November 04, 2026 17:41
To: peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>; yoann.congal@smile.fr <yoann.congal@smile.fr>
Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

Hi Yoann,
I will prepare and submit the updated patch as discussed.
Could you also please confirm whether we need to revert all the earlier patches proposed by Peter, as discussed in the thread below?
https://lists.openembedded.org/g/openembedded-core/topic/121397520
Regards,
Hetvi

________________________________
From: Yoann Congal via openembedded-core <yoann.congal=smile.fr@lists.openembedded.org>
Sent: Tuesday, November 03, 2026 14:52
To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot

On Tue Nov 3, 2026 at 6:33 AM CET, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Yoann,
>
> My reason for adding CVE_STATUS for is that u-boot-tools uses
> tools-only_defconfig, which disables networking. The affected TCP and
> NFS code is therefore not compiled into the tools.
> not-applicable-config accurately describes this configuration.
>
> I understand the preference for sharing source patches between u-boot
> and u-boot-tools. However, the tools remain unaffected by these CVEs
> regardless of whether the source fixes are applied, so I believe the
> configuration exclusions are technically valid.
>
> The same approach is already used in the wrynose branch [1], which
> excludes all three CVEs. The fix for CVE-2026-29009 was also applied
> separately to u-boot on wrynose [2].
> Additionally, For CVE-2026-29007 and CVE-2026-29008, I have not
> located a merged upstream fix or a formal patch submission for either
> CVE in the U-Boot community.
>
> For these reasons, I believe retaining the CVE_STATUS entries is
> appropriate for u-boot-tools on Scarthgap. They accurately reflect the
> configuration being built and keep the CVE assessment consistent with
> the approach already accepted for Wrynose.

The new proposed approach would have to be deployed on wrynose as well
(if applicable, I have not checked).

I think that having the precise reason for a non-applicable CVE is not
worth doing the CVE work twice (once with a patch, once with the
CVE_STATUS). If we can fix both u-boot/u-boot-tools with a single patch
it's more efficient.

I still think we should merge the sources (upstream+patches) between
u-boot/u-boot-tools and fix the CVEs only once if possible.

>
> [1] https://github.com/openembedded/openembedded-core/blob/wrynose/meta/recipes-bsp/u-boot/u-boot-tools_2026.01.bb
> [2] https://git.openembedded.org/openembedded-core/commit/?h=wrynose&id=dff41dcd5e54cad46ba91ecc45faefb0c8db9089
>
> Regards,
> Hetvi
> ________________________________
> From: Yoann Congal <yoann.congal@smile.fr>
> Sent: 28 October 2026 16:26
> To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>
> On Wed Oct 28, 2026 at 11:04 AM CET, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
>> Hi Yoann,
>>
>> Thanks for clarifying. For patches 9–11, I understand that source
>> fixes are preferred. However, networking is disabled in u-boot-tools,
>> so building it would not compile or exercise the affected code. How
>> should these fixes be verified?
>
> By sharing the sources with u-boot which will compile those parts.
>
>>
>> Regards,
>> Hetvi
>>
>> ________________________________
>> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
>> Sent: 28 October 2026 14:37
>> To: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>; peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
>> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>>
>> On Tue Oct 20, 2026 at 7:16 AM CEST, Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
>>> Hi Yoann, Peter,
>>>
>>> Thanks, Yoann. Continuing the discussion here as suggested.
>>>
>>> As i explained in the other thread [1], the existing u-boot fixes are
>>> not currently applied to u-boot-tools. My CVE_STATUS changes address
>>> cases where the affected code is not compiled into the tools build.
>>>
>>> I understand that the proposed separate include would allow both
>>> recipes to share the CVE patches without adding them to
>>> u-boot-common.inc and affecting downstream users.
>>>
>>> My concern is whether we need this additional include and shared patch
>>> list for cases that can be handled through recipe-specific CVE_STATUS
>>> entries. Could we consider the held exclusions on that basis?
>>>
>>> If maintaining one shared source patch set is the preferred approach,
>>> could you clarify how we should handle patches 2–11 of my series?
>>> Should we revisit them after the shared include is settled and retain
>>> only the exclusions still needed?
>>
>> The general idea is that by sharing CVE patches with the main u-boot
>> recipe, CVE would be also "fixed" in u-boot-tools (even if said patch is
>> not compiled).
>>
>> For 2-8, patches are in u-boot so no need to ignore them:
>> * [Patch 02/11] u-boot-tools: Ignore CVE-2024-42040
>> * [Patch 03/11] u-boot-tools: Ignore CVE-2024-57254
>> * [Patch 04/11] u-boot-tools: Ignore CVE-2024-57255
>> * [Patch 05/11] u-boot-tools: Ignore CVE-2024-57256
>> * [Patch 06/11] u-boot-tools: Ignore CVE-2024-57257
>> * [Patch 07/11] u-boot-tools: Ignore CVE-2024-57258
>> * [Patch 08/11] u-boot-tools: Ignore CVE-2024-57259
>>
>> For 9-11, there are no u-boot patches so ignoring them in the
>> u-boot-tools recipe, would be fair (but patching them would be
>> preferable):
>> * [Patch 09/11] u-boot-tools: Ignore CVE-2026-29007
>> * [Patch 10/11] u-boot-tools: Ignore CVE-2026-29008
>> * [Patch 11/11] u-boot-tools: Ignore CVE-2026-29009
>>
>> Regards,
>>
>>>
>>> [1] https://lists.openembedded.org/g/openembedded-core/message/247868
>>>
>>> Regards,
>>> Hetvi
>>> ________________________________
>>> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> on behalf of Yoann Congal via lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
>>> Sent: 16 October 2026 03:44
>>> To: peter.marko@siemens.com <peter.marko@siemens.com>; openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
>>> Cc: Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) <hthakar@cisco.com>
>>> Subject: Re: [OE-core] [scarthgap][PATCH] u-boot-tools: use all patches from u-boot
>>>
>>> On Wed Sep 23, 2026 at 7:38 PM CEST, Peter Marko via lists.openembedded.org wrote:
>>>> From: Peter Marko <peter.marko@siemens.com>
>>>>
>>>> After sharing CVE_PRODUCT between u-boot and u-boot-tools CVEs
>>>> patched in u-boot showed-up in CVE reports for u-boot-tools.
>>>>
>>>> It does not make much sense to share git repository but not share all
>>>> patches on top of it, so move adding all patches from u-boot recipe to a
>>>> common include file where also the git repository is defined.
>>>>
>>>> Signed-off-by: Peter Marko <peter.marko@siemens.com>
>>>> ---
>>>>  meta/recipes-bsp/u-boot/u-boot-common.inc       | 10 ++++++++++
>>>>  meta/recipes-bsp/u-boot/u-boot-tools_2024.01.bb |  2 --
>>>>  meta/recipes-bsp/u-boot/u-boot_2024.01.bb       | 12 ------------
>>>>  3 files changed, 10 insertions(+), 14 deletions(-)
>>>
>>> Hello Peter, Hetvi,
>>>
>>> There is a bit of back-and-forth around u-boot-common.inc. So I thought I
>>> would give my vision and get your thoughts.
>>>
>>> Fundamentally, there is confusion about the usage of this .inc file:
>>> * This is the common part of u-boot and u-boot-tools recipes (what the
>>>   above patch uses)
>>> * But, also, this may be used by downstream layers to reuse u-boot
>>>   recipe parts. We basically did the revert of Peter's patch a few month
>>>   ago for this reason[0].
>>>
>>> With Paul, we would like to have a single set of patches common for both
>>> u-boot and u-boot-tools, but that can't be in u-boot-common.inc as there
>>> is a risk of breaking downstream layers.
>>>
>>> Our idea is to create a new inc file "u-boot-common-patches.inc" (I'm
>>> not attached to the name) that contains only SRC_URI += "CVE_*.patch"
>>> and a big warning explaining that is file is only supposed to be
>>> included from layer-local recipes (namely u-boot and u-boot-tools).
>>>
>>> This whole situation is not ideal but think the above would solve our
>>> issues and still be acceptable under stable policy.
>>>
>>> What do you think?
>>>
>>> Regards,
>>>
>>> [0]: u-boot: move CVE patches out of the common .inc file - openembedded-core - OpenEmbedded Core layer
>>>      https://git.openembedded.org/openembedded-core/commit/?id=f4ced8ff03147dd532a88cf3ce08d61fab057522
>>> --
>>> Yoann Congal
>>> Smile ECS
>>
>>
>> --
>> Yoann Congal
>> Smile ECS
>
>
> --
> Yoann Congal
> Smile ECS


--
Yoann Congal
Smile ECS


[-- Attachment #2: Type: text/html, Size: 16826 bytes --]