Update to internal 0.72

Signed-off-by: Jason M. Bills <jason.m.bills@linux.intel.com>

100 files changed, 3795 insertions, 621 deletions

diff --git a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/0045-Apply-WDT1-2-reset-mask-to-reset-needed-controller.patch b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/0045-Apply-WDT1-2-reset-mask-to-reset-needed-controller.patch
new file mode 100644
index 000000000..ea7a582df
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/0045-Apply-WDT1-2-reset-mask-to-reset-needed-controller.patch
@@ -0,0 +1,83 @@
+From 622df2804c7f8540587df26c81653b47809c9984 Mon Sep 17 00:00:00 2001
+From: Suryakanth Sekar <suryakanth.sekar@linux.intel.com>
+Date: Thu, 16 Jul 2020 11:02:53 +0530
+Subject: [PATCH] Apply WDT1-2 reset mask to reset needed controller
+
+Issue:
+BMC reset during BIOS serial port access causes BIOS hang.
+
+Root caused:
+BMC resetting the LPC controller during BMC warm reset.
+Which cause BIOS hang as BIOS cannot dump the BIOS serial data.
+
+Fix:
+WDT reset mask has been updated from default to proper value,
+such that controllers interacting with host will not be reset
+during wdt reset operation.
+This was missed earlier, causing BIOS to hang whenever BMC resets,
+as BIOS was accessing the serial port (LPC controller).
+De-coupling LPC controller will make sure BIOS serial port access
+is not disturbed.
+And also Reset mask is updated not to reset the following
+in order to avoid the host hang.
+1.  SDRAM controller
+2.  AHB Bridges
+3.  Graphics CRT controller
+4.  Reset Video Engine
+5.  LPC controller
+6.  CRT mode 2D Engine
+7.  PWM controller
+8.  MCTP Controller
+9.  X- DMA Controller
+10. SPI controller
+
+Quick Step to reproduce:
+ Stop the BMC in uboot and add below bootcmd command
+ setenv bootcmd "reset"
+ Do the System power ON or System warm reset.
+
+ For WDT2:
+ boot the BMC and ran the /usr/bin/watch_dog_reset.sh
+ Do the System Power ON or System warm reset.
+
+Tested:
+ 1. Ran overnight continous BIOS and BMC warm reset on two SUTs.
+
+ 2.Ran the TestApp which dump the BIOS serial port continously and
+   do the BMC reset.
+
+ 3.Stop the BMC in uboot and add below bootcmd command
+   setenv bootcmd "reset"
+   Do the System Power ON or System warm reset.
+
+ 4.Ran Over night AC cycle test. Completed +1000 in two systems.
+
+ 5.Stopped at u-boot.
+   Issue protect off all command
+   Issue erase all command.
+   BMC should not hang and able to complete the "erase all" command
+
+Signed-off-by: Suryakanth Sekar <suryakanth.sekar@linux.intel.com>
+---
+ arch/arm/mach-aspeed/platform_g5.S | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-aspeed/platform_g5.S b/arch/arm/mach-aspeed/platform_g5.S
+index b404353..97253f4 100644
+--- a/arch/arm/mach-aspeed/platform_g5.S
++++ b/arch/arm/mach-aspeed/platform_g5.S
+@@ -366,7 +366,10 @@ init_dram:
+     and   r1, r1, #0x01
+     str   r1, [r0]
+     ldr   r0, =0x1e78501c                        @ restore normal mask setting
+-    ldr   r1, =0x023FFFF3                        @ added 2016.09.06
++    ldr   r1, =0x023CD773                        @ Changed 2020.06.18
++    str   r1, [r0]
++    ldr   r0, =0x1e78503c                        @ restore normal mask setting
++    ldr   r1, =0x023CD773                        @ Changed 2020.07.08
+     str   r1, [r0]
+     b     bypass_first_reset
+ 
+-- 
+2.7.4
+
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/0046-Enable-FMC-DMA-for-memmove.patch b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/0046-Enable-FMC-DMA-for-memmove.patch
new file mode 100644
index 000000000..e75b732b1
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/0046-Enable-FMC-DMA-for-memmove.patch
@@ -0,0 +1,151 @@
+From 38d3fba3ac2d4240bab1e5427fc6ed71291e1cc8 Mon Sep 17 00:00:00 2001
+From: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+Date: Fri, 19 Jun 2020 16:30:47 -0700
+Subject: [PATCH] Enable FMC DMA for memmove
+
+This commit enables FMC DMA for memmove so that kernel loading can be
+completed quickly.
+
+Signed-off-by: Chia-Wei Wang <chiawei_wang@aspeedtech.com>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+---
+ arch/arm/mach-aspeed/Makefile |  2 +-
+ arch/arm/mach-aspeed/utils.S  | 53 +++++++++++++++++++++++++++++++++++++++++++
+ lib/Kconfig                   |  6 +++++
+ lib/string.c                  | 12 +++++++++-
+ 4 files changed, 71 insertions(+), 2 deletions(-)
+ create mode 100644 arch/arm/mach-aspeed/utils.S
+
+diff --git a/arch/arm/mach-aspeed/Makefile b/arch/arm/mach-aspeed/Makefile
+index 7d8930beb988..b9fcf41d8c97 100644
+--- a/arch/arm/mach-aspeed/Makefile
++++ b/arch/arm/mach-aspeed/Makefile
+@@ -11,7 +11,7 @@
+ #
+ 
+ 
+-obj-y += timer.o reset.o cpuinfo.o ast-scu.o ast-ahbc.o ast-sdmc.o
++obj-y += timer.o reset.o cpuinfo.o ast-scu.o ast-ahbc.o ast-sdmc.o utils.o
+ obj-$(CONFIG_AST_SPI_NOR) += flash.o
+ obj-$(CONFIG_ARCH_AST2500) += platform_g5.o
+ obj-$(CONFIG_ARCH_AST2400) += platform_g4.o
+diff --git a/arch/arm/mach-aspeed/utils.S b/arch/arm/mach-aspeed/utils.S
+new file mode 100644
+index 000000000000..a06d72552eef
+--- /dev/null
++++ b/arch/arm/mach-aspeed/utils.S
+@@ -0,0 +1,53 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (C) ASPEED Technology Inc.
++ * Chia-Wei Wang <chiawei_wang@aspeedtech.com>
++ */
++
++#include <config.h>
++#include <asm/armv7.h>
++#include <linux/linkage.h>
++
++#define AST_FMC_BASE		(0x1E620000)
++#define AST_FMC_INT_CTRL_STAT	(AST_FMC_BASE + 0x008)
++#define AST_FMC_DMA_CTRL	(AST_FMC_BASE + 0x080)
++#define AST_FMC_DMA_FLASH_ADDR	(AST_FMC_BASE + 0x084)
++#define AST_FMC_DMA_DRAM_ADDR	(AST_FMC_BASE + 0x088)
++#define AST_FMC_DMA_LENGTH	(AST_FMC_BASE + 0x08C)
++
++/*
++ * void aspeed_spi_fastcpy(u32 mem_addr, u32 spi_addr, u32 count)
++ *
++ * perform FMC SPI DMA to speed up flash copy.
++ * @dst: destination memory address
++ * @src: source SPI address
++ * @count: number of bytes to be copied, 4-byte aligned
++ *
++ * NOTE that the caller must ensure the validity of parameters.
++ */
++ENTRY(aspeed_spi_fastcpy)
++	ldr	r3, =AST_FMC_DMA_DRAM_ADDR
++	str	r0, [r3]
++
++	ldr	r3, =AST_FMC_DMA_FLASH_ADDR
++	str	r1, [r3]
++
++	ldr	r3, =AST_FMC_DMA_LENGTH
++	str	r2, [r3]
++
++	ldr	r0, =AST_FMC_DMA_CTRL
++	mov	r1, #1
++	str	r1, [r0]
++
++	ldr	r0, =AST_FMC_INT_CTRL_STAT
++polling:
++	ldr	r1, [r0]
++	tst	r1, #(1 << 11)
++	beq	polling
++
++	ldr	r0, =AST_FMC_DMA_CTRL
++	mov	r1, #0
++	str	r1, [r0]
++
++	mov	pc, lr
++ENDPROC(aspeed_spi_fastcpy)
+diff --git a/lib/Kconfig b/lib/Kconfig
+index 02ca4058d37e..8c8fde6b1b28 100644
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -149,6 +149,12 @@ config SPL_OF_LIBFDT
+ 	  particular compatible nodes. The library operates on a flattened
+ 	  version of the device tree.
+ 
++config ASPEED_FMC_DMA
++	bool "Enable Aspeed SPI DMA"
++	default n
++	help
++	  This enables fast memmove using FMC DMA on Aspeed SoCs.
++
+ source lib/efi/Kconfig
+ source lib/efi_loader/Kconfig
+ 
+diff --git a/lib/string.c b/lib/string.c
+index 0bf472f1f69e..f95b8e478fa6 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -15,11 +15,12 @@
+  *    reentrant and should be faster). Use only strsep() in new code, please.
+  */
+ 
++#include <config.h>
+ #include <linux/types.h>
+ #include <linux/string.h>
+ #include <linux/ctype.h>
+ #include <malloc.h>
+-
++#include <common.h>
+ 
+ /**
+  * strncasecmp - Case insensitive, length-limited string comparison
+@@ -497,6 +498,7 @@ void * memcpy(void *dest, const void *src, size_t count)
+ #endif
+ 
+ #ifndef __HAVE_ARCH_MEMMOVE
++extern void aspeed_spi_fastcpy(u32 mem_addr, u32 spi_addr, u32 count);
+ /**
+  * memmove - Copy one area of memory to another
+  * @dest: Where to copy to
+@@ -520,6 +522,14 @@ void *memmove(void *dest, const void *src, size_t count)
+ 	if (src == dest || !count)
+ 		return dest;
+ 
++#ifdef CONFIG_ASPEED_FMC_DMA
++	if ((u32)src >= AST_FMC_CS0_BASE && (u32)src < AST_SPI0_CS0_BASE) {
++		count = ((count + 3) / 4) * 4;
++		aspeed_spi_fastcpy((u32)dest, (u32)src, (u32)count);
++		return dest;
++	}
++#endif
++
+ 	if (unaligned_src || unaligned_dst) {
+ 		if (unaligned_dst != unaligned_src) {
+ 			unaligned_header = count;
+-- 
+2.7.4
+
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/0047-ast2500-parse-reset-reason.patch b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/0047-ast2500-parse-reset-reason.patch
new file mode 100644
index 000000000..b1b525f99
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/0047-ast2500-parse-reset-reason.patch
@@ -0,0 +1,65 @@
+From 96eb25949b824af10cabd387cfdc6401d23ac04b Mon Sep 17 00:00:00 2001
+From: Kuiying Wang <kuiying.wang@intel.com>
+Date: Tue, 7 Jul 2020 13:41:48 +0800
+Subject: [PATCH] ast2500: parse reset reason.
+
+Signed-off-by: Kuiying Wang <kuiying.wang@intel.com>
+---
+ arch/arm/mach-aspeed/ast-scu.c | 39 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-aspeed/ast-scu.c b/arch/arm/mach-aspeed/ast-scu.c
+index 28c48c1154..ff90c0fc7e 100644
+--- a/arch/arm/mach-aspeed/ast-scu.c
++++ b/arch/arm/mach-aspeed/ast-scu.c
+@@ -596,9 +596,46 @@ void ast_scu_security_info(void)
+ void ast_scu_sys_rest_info(void)
+ {
+ 	u32 rest = ast_scu_read(AST_SCU_SYS_CTRL);
++	bool unknown_flag = true;
+ 
+ #ifdef AST_SOC_G5
+-	printf("RST : 0x%02x\n", rest);
++	printf("RST : 0x%02x (", rest);
++	if (rest & SCU_SYS_EXT_RESET_FLAG) {
++		unknown_flag = false;
++		printf("External");
++	}
++	if (rest & SCU_SYS_WDT_RESET_FLAG) {
++		if (unknown_flag)
++			printf("WDT1");
++		else
++			printf("|WDT1");
++		unknown_flag = false;
++	}
++	if (rest & SCU_SYS_WDT2_RESET_FLAG) {
++		if (unknown_flag)
++			printf("WDT2");
++		else
++			printf("|WDT2");
++		unknown_flag = false;
++	}
++	if (rest & SCU_SYS_WDT3_RESET_FLAG) {
++		if (unknown_flag)
++			printf("WDT3");
++		else
++			printf("|WDT3");
++		unknown_flag = false;
++	}
++	if (rest & SCU_SYS_PWR_RESET_FLAG) {
++		if (unknown_flag)
++			printf("Power On");
++		else
++			printf("|Power On");
++		unknown_flag = false;
++	}
++	if (unknown_flag) {
++		printf("Unknown");
++	}
++	printf(")\n");
+ #else
+ 	if (rest & SCU_SYS_EXT_RESET_FLAG) {
+ 		printf("RST : External\n");
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0001-image-Correct-comment-for-fit_conf_get_node.patch b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0001-image-Correct-comment-for-fit_conf_get_node.patch
new file mode 100644
index 000000000..7e1cd0351
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0001-image-Correct-comment-for-fit_conf_get_node.patch
@@ -0,0 +1,77 @@
+From 07867a17f8ed7ca621107550e218b1c916b9cc19 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] image: Correct comment for fit_conf_get_node()
+
+This should mention that conf_uname can be NULL and should be in the
+header file. Fix this.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ common/image-fit.c | 18 ------------------
+ include/image.h    | 19 +++++++++++++++++++
+ 2 files changed, 19 insertions(+), 18 deletions(-)
+
+diff --git a/common/image-fit.c b/common/image-fit.c
+index 6f920da22043..f31e93a36441 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -1375,24 +1375,6 @@ int fit_conf_find_compat(const void *fit, const void *fdt)
+ 	return best_match_offset;
+ }
+ 
+-/**
+- * fit_conf_get_node - get node offset for configuration of a given unit name
+- * @fit: pointer to the FIT format image header
+- * @conf_uname: configuration node unit name
+- *
+- * fit_conf_get_node() finds a configuration (within the '/configurations'
+- * parent node) of a provided unit name. If configuration is found its node
+- * offset is returned to the caller.
+- *
+- * When NULL is provided in second argument fit_conf_get_node() will search
+- * for a default configuration node instead. Default configuration node unit
+- * name is retrieved from FIT_DEFAULT_PROP property of the '/configurations'
+- * node.
+- *
+- * returns:
+- *     configuration node offset when found (>=0)
+- *     negative number on failure (FDT_ERR_* code)
+- */
+ int fit_conf_get_node(const void *fit, const char *conf_uname)
+ {
+ 	int noffset, confs_noffset;
+diff --git a/include/image.h b/include/image.h
+index a16187f874db..b05e8552cc5b 100644
+--- a/include/image.h
++++ b/include/image.h
+@@ -908,6 +908,25 @@ int fit_image_check_comp(const void *fit, int noffset, uint8_t comp);
+ int fit_check_format(const void *fit);
+ 
+ int fit_conf_find_compat(const void *fit, const void *fdt);
++
++/**
++ * fit_conf_get_node - get node offset for configuration of a given unit name
++ * @fit: pointer to the FIT format image header
++ * @conf_uname: configuration node unit name (NULL to use default)
++ *
++ * fit_conf_get_node() finds a configuration (within the '/configurations'
++ * parent node) of a provided unit name. If configuration is found its node
++ * offset is returned to the caller.
++ *
++ * When NULL is provided in second argument fit_conf_get_node() will search
++ * for a default configuration node instead. Default configuration node unit
++ * name is retrieved from FIT_DEFAULT_PROP property of the '/configurations'
++ * node.
++ *
++ * returns:
++ *     configuration node offset when found (>=0)
++ *     negative number on failure (FDT_ERR_* code)
++ */
+ int fit_conf_get_node(const void *fit, const char *conf_uname);
+ 
+ /**
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0002-image-Be-a-little-more-verbose-when-checking-signatu.patch b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0002-image-Be-a-little-more-verbose-when-checking-signatu.patch
new file mode 100644
index 000000000..16ac5fb59
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0002-image-Be-a-little-more-verbose-when-checking-signatu.patch
@@ -0,0 +1,45 @@
+From 3d7360b1b32f56e26bbc90bcff42d5f204d0b717 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] image: Be a little more verbose when checking signatures
+
+It is useful to be a little more specific about what is being checked.
+Update a few messages to help with this.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ common/image-fit.c | 2 +-
+ tools/image-host.c | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/common/image-fit.c b/common/image-fit.c
+index f31e93a36441..8a7c78f4c144 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -1637,7 +1637,7 @@ int fit_image_load(bootm_headers_t *images, ulong addr,
+ 		fit_uname = fit_get_name(fit, noffset, NULL);
+ 	}
+ 	if (noffset < 0) {
+-		puts("Could not find subimage node\n");
++		printf("Could not find subimage node type '%s'\n", prop_name);
+ 		bootstage_error(bootstage_id + BOOTSTAGE_SUB_SUBNODE);
+ 		return -ENOENT;
+ 	}
+diff --git a/tools/image-host.c b/tools/image-host.c
+index 7effb6cea59e..01fdec276da4 100644
+--- a/tools/image-host.c
++++ b/tools/image-host.c
+@@ -717,7 +717,8 @@ int fit_check_sign(const void *fit, const void *key)
+ 	if (!cfg_noffset)
+ 		return -1;
+ 
+-	printf("Verifying Hash Integrity ... ");
++	printf("Verifying Hash Integrity for node '%s'... ",
++	       fdt_get_name(fit, cfg_noffset, NULL));
+ 	ret = fit_config_verify(fit, cfg_noffset);
+ 	if (ret)
+ 		return ret;
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0003-image-Return-an-error-message-from-fit_config_verify.patch b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0003-image-Return-an-error-message-from-fit_config_verify.patch
new file mode 100644
index 000000000..fd8ceecf0
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0003-image-Return-an-error-message-from-fit_config_verify.patch
@@ -0,0 +1,39 @@
+From 647e43f0aee09ef33d2159ad95c7f3499d8fd8a4 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] image: Return an error message from fit_config_verify_sig()
+
+This function only returns an error message sometimes. Update it to always
+return an error message if one is available. This makes it easier to see
+what went wrong.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ common/image-sig.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/common/image-sig.c b/common/image-sig.c
+index eda5e1353ab0..a664f4a40945 100644
+--- a/common/image-sig.c
++++ b/common/image-sig.c
+@@ -415,13 +415,14 @@ static int fit_config_verify_sig(const void *fit, int conf_noffset,
+ 		goto error;
+ 	}
+ 
+-	return verified ? 0 : -EPERM;
++	if (verified)
++		return 0;
+ 
+ error:
+ 	printf(" error!\n%s for '%s' hash node in '%s' config node\n",
+ 	       err_msg, fit_get_name(fit, noffset, NULL),
+ 	       fit_get_name(fit, conf_noffset, NULL));
+-	return -1;
++	return -EPERM;
+ }
+ 
+ int fit_config_verify_required_sigs(const void *fit, int conf_noffset,
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0007-image-Check-hash-nodes-when-checking-configurations.patch b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0007-image-Check-hash-nodes-when-checking-configurations.patch
new file mode 100644
index 000000000..5a4bca485
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0007-image-Check-hash-nodes-when-checking-configurations.patch
@@ -0,0 +1,97 @@
+From ece10b3eac018240776bfec8aceb1e8f4947288b Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] image: Check hash-nodes when checking configurations
+
+It is currently possible to use a different configuration's signature and
+thus bypass the configuration check. Make sure that the configuration node
+that was hashed matches the one being checked, to catch this problem.
+
+Also add a proper function comment to fit_config_check_sig() and make it
+static.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ common/image-sig.c | 36 +++++++++++++++++++++++++++++++++---
+ 1 file changed, 33 insertions(+), 3 deletions(-)
+
+diff --git a/common/image-sig.c b/common/image-sig.c
+index a664f4a40945..057d654c17d4 100644
+--- a/common/image-sig.c
++++ b/common/image-sig.c
+@@ -283,20 +283,39 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
+ 	return 0;
+ }
+ 
+-int fit_config_check_sig(const void *fit, int noffset, int required_keynode,
+-			 char **err_msgp)
++/**
++ * fit_config_check_sig() - Check the signature of a config
++ *
++ * @fit: FIT to check
++ * @noffset: Offset of configuration node (e.g. /configurations/conf-1)
++ * @required_keynode:	Offset in the control FDT of the required key node,
++ *			if any. If this is given, then the configuration wil not
++ *			pass verification unless that key is used. If this is
++ *			-1 then any signature will do.
++ * @conf_noffset: Offset of the configuration subnode being checked (e.g.
++ *	 /configurations/conf-1/kernel)
++ * @err_msgp:		In the event of an error, this will be pointed to a
++ *			help error string to display to the user.
++ * @return 0 if all verified ok, <0 on error
++ */
++static int fit_config_check_sig(const void *fit, int noffset,
++				int required_keynode, int conf_noffset,
++				char **err_msgp)
+ {
+ 	char * const exc_prop[] = {"data"};
+ 	const char *prop, *end, *name;
+ 	struct image_sign_info info;
+ 	const uint32_t *strings;
++	const char *config_name;
+ 	uint8_t *fit_value;
+ 	int fit_value_len;
++	bool found_config;
+ 	int max_regions;
+ 	int i, prop_len;
+ 	char path[200];
+ 	int count;
+ 
++	config_name = fit_get_name(fit, conf_noffset, NULL);
+ 	debug("%s: fdt=%p, conf='%s', sig='%s'\n", __func__, gd_fdt_blob(),
+ 	      fit_get_name(fit, noffset, NULL),
+ 	      fit_get_name(gd_fdt_blob(), required_keynode, NULL));
+@@ -332,9 +351,20 @@ int fit_config_check_sig(const void *fit, int noffset, int required_keynode,
+ 	char *node_inc[count];
+ 
+ 	debug("Hash nodes (%d):\n", count);
++	found_config = false;
+ 	for (name = prop, i = 0; name < end; name += strlen(name) + 1, i++) {
+ 		debug("   '%s'\n", name);
+ 		node_inc[i] = (char *)name;
++		if (!strncmp(FIT_CONFS_PATH, name, strlen(FIT_CONFS_PATH)) &&
++		    name[sizeof(FIT_CONFS_PATH) - 1] == '/' &&
++		    !strcmp(name + sizeof(FIT_CONFS_PATH), config_name)) {
++			debug("      (found config node %s)", config_name);
++			found_config = true;
++		}
++	}
++	if (!found_config) {
++		*err_msgp = "Selected config not in hashed nodes";
++		return -1;
+ 	}
+ 
+ 	/*
+@@ -399,7 +429,7 @@ static int fit_config_verify_sig(const void *fit, int conf_noffset,
+ 		if (!strncmp(name, FIT_SIG_NODENAME,
+ 			     strlen(FIT_SIG_NODENAME))) {
+ 			ret = fit_config_check_sig(fit, noffset, sig_offset,
+-						   &err_msg);
++						   conf_noffset, &err_msg);
+ 			if (ret) {
+ 				puts("- ");
+ 			} else {
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0008-image-Load-the-correct-configuration-in-fit_check_si.patch b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0008-image-Load-the-correct-configuration-in-fit_check_si.patch
new file mode 100644
index 000000000..4701086bc
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0008-image-Load-the-correct-configuration-in-fit_check_si.patch
@@ -0,0 +1,51 @@
+From 738b8ba7ac971c10500d1322fda59ac6aa58e867 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] image: Load the correct configuration in fit_check_sign
+
+At present bootm_host_load_images() is passed the configuration that has
+been verified, but ignores it and just uses the default configuration.
+This may not be the same.
+
+Update this function to use the selected configuration.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ common/bootm.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/common/bootm.c b/common/bootm.c
+index 46909ecdbb1f..b39fd60c8c49 100644
+--- a/common/bootm.c
++++ b/common/bootm.c
+@@ -894,7 +894,8 @@ void memmove_wd(void *to, void *from, size_t len, ulong chunksz)
+ 	memmove(to, from, len);
+ }
+ 
+-static int bootm_host_load_image(const void *fit, int req_image_type)
++static int bootm_host_load_image(const void *fit, int req_image_type,
++				 int cfg_noffset)
+ {
+ 	const char *fit_uname_config = NULL;
+ 	ulong data, len;
+@@ -906,6 +907,7 @@ static int bootm_host_load_image(const void *fit, int req_image_type)
+ 	void *load_buf;
+ 	int ret;
+ 
++	fit_uname_config = fdt_get_name(fit, cfg_noffset, NULL);
+ 	memset(&images, '\0', sizeof(images));
+ 	images.verify = 1;
+ 	noffset = fit_image_load(&images, (ulong)fit,
+@@ -950,7 +952,7 @@ int bootm_host_load_images(const void *fit, int cfg_noffset)
+ 	for (i = 0; i < ARRAY_SIZE(image_types); i++) {
+ 		int ret;
+ 
+-		ret = bootm_host_load_image(fit, image_types[i]);
++		ret = bootm_host_load_image(fit, image_types[i], cfg_noffset);
+ 		if (!err && ret && ret != -ENOENT)
+ 			err = ret;
+ 	}
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0009-fit_check_sign-Allow-selecting-the-configuration-to-.patch b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0009-fit_check_sign-Allow-selecting-the-configuration-to-.patch
new file mode 100644
index 000000000..687946e4c
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0009-fit_check_sign-Allow-selecting-the-configuration-to-.patch
@@ -0,0 +1,101 @@
+From 86a746eecc231886fbca97db6c6544997b95e49a Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] fit_check_sign: Allow selecting the configuration to verify
+
+This tool always verifies the default configuration. It is useful to be
+able to verify a specific one. Add a command-line flag for this and plumb
+the logic through.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ tools/fdt_host.h       | 3 ++-
+ tools/fit_check_sign.c | 8 ++++++--
+ tools/image-host.c     | 6 ++++--
+ 3 files changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/tools/fdt_host.h b/tools/fdt_host.h
+index 134d9657139b..4eceab19dd3a 100644
+--- a/tools/fdt_host.h
++++ b/tools/fdt_host.h
+@@ -11,6 +11,7 @@
+ #include "../include/libfdt.h"
+ #include "../include/fdt_support.h"
+ 
+-int fit_check_sign(const void *working_fdt, const void *key);
++int fit_check_sign(const void *fit, const void *key,
++		   const char *fit_uname_config);
+ 
+ #endif /* __FDT_HOST_H__ */
+diff --git a/tools/fit_check_sign.c b/tools/fit_check_sign.c
+index d9361b00950c..e9a489db3920 100644
+--- a/tools/fit_check_sign.c
++++ b/tools/fit_check_sign.c
+@@ -42,6 +42,7 @@ int main(int argc, char **argv)
+ 	void *fit_blob;
+ 	char *fdtfile = NULL;
+ 	char *keyfile = NULL;
++	char *config_name = NULL;
+ 	char cmdname[256];
+ 	int ret;
+ 	void *key_blob;
+@@ -49,7 +50,7 @@ int main(int argc, char **argv)
+ 
+ 	strncpy(cmdname, *argv, sizeof(cmdname) - 1);
+ 	cmdname[sizeof(cmdname) - 1] = '\0';
+-	while ((c = getopt(argc, argv, "f:k:")) != -1)
++	while ((c = getopt(argc, argv, "f:k:c:")) != -1)
+ 		switch (c) {
+ 		case 'f':
+ 			fdtfile = optarg;
+@@ -57,6 +58,9 @@ int main(int argc, char **argv)
+ 		case 'k':
+ 			keyfile = optarg;
+ 			break;
++		case 'c':
++			config_name = optarg;
++			break;
+ 		default:
+ 			usage(cmdname);
+ 			break;
+@@ -79,7 +83,7 @@ int main(int argc, char **argv)
+ 		return EXIT_FAILURE;
+ 
+ 	image_set_host_blob(key_blob);
+-	ret = fit_check_sign(fit_blob, key_blob);
++	ret = fit_check_sign(fit_blob, key_blob, config_name);
+ 	if (!ret) {
+ 		ret = EXIT_SUCCESS;
+ 		fprintf(stderr, "Signature check OK\n");
+diff --git a/tools/image-host.c b/tools/image-host.c
+index 01fdec276da4..da374eeabf5e 100644
+--- a/tools/image-host.c
++++ b/tools/image-host.c
+@@ -708,12 +708,13 @@ int fit_add_verification_data(const char *keydir, void *keydest, void *fit,
+ }
+ 
+ #ifdef CONFIG_FIT_SIGNATURE
+-int fit_check_sign(const void *fit, const void *key)
++int fit_check_sign(const void *fit, const void *key,
++		   const char *fit_uname_config)
+ {
+ 	int cfg_noffset;
+ 	int ret;
+ 
+-	cfg_noffset = fit_conf_get_node(fit, NULL);
++	cfg_noffset = fit_conf_get_node(fit, fit_uname_config);
+ 	if (!cfg_noffset)
+ 		return -1;
+ 
+@@ -722,6 +723,7 @@ int fit_check_sign(const void *fit, const void *key)
+ 	ret = fit_config_verify(fit, cfg_noffset);
+ 	if (ret)
+ 		return ret;
++	printf("Verified OK, loading images\n");
+ 	ret = bootm_host_load_images(fit, cfg_noffset);
+ 
+ 	return ret;
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0012-image-Use-constants-for-required-and-key-name-hint.patch b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0012-image-Use-constants-for-required-and-key-name-hint.patch
new file mode 100644
index 000000000..4f5704e7c
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/CVE-2020-10648/0012-image-Use-constants-for-required-and-key-name-hint.patch
@@ -0,0 +1,152 @@
+From 82d0b38436fd44bc54372ebe3f3d3fef63835b83 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] image: Use constants for 'required' and 'key-name-hint'
+
+These are used in multiple places so update them to use a shared #define.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ common/image-fit.c | 6 +++---
+ common/image-sig.c | 8 +++++---
+ include/image.h    | 4 +++-
+ lib/rsa/rsa-sign.c | 6 +++---
+ tools/image-host.c | 6 +++---
+ 5 files changed, 17 insertions(+), 13 deletions(-)
+
+diff --git a/common/image-fit.c b/common/image-fit.c
+index 8a7c78f4c144..322fde728b50 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -264,7 +264,7 @@ static void fit_image_print_data(const void *fit, int noffset, const char *p,
+ 	uint8_t *value;
+ 	int value_len;
+ 	char *algo;
+-	int required;
++	bool required;
+ 	int ret, i;
+ 
+ 	debug("%s  %s node:    '%s'\n", p, type,
+@@ -275,8 +275,8 @@ static void fit_image_print_data(const void *fit, int noffset, const char *p,
+ 		return;
+ 	}
+ 	printf("%s", algo);
+-	keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
+-	required = fdt_getprop(fit, noffset, "required", NULL) != NULL;
++	keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
++	required = fdt_getprop(fit, noffset, FIT_KEY_REQUIRED, NULL) != NULL;
+ 	if (keyname)
+ 		printf(":%s", keyname);
+ 	if (required)
+diff --git a/common/image-sig.c b/common/image-sig.c
+index 057d654c17d4..b49732117927 100644
+--- a/common/image-sig.c
++++ b/common/image-sig.c
+@@ -156,7 +156,7 @@ static int fit_image_setup_verify(struct image_sign_info *info,
+ 		return -1;
+ 	}
+ 	memset(info, '\0', sizeof(*info));
+-	info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
++	info->keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
+ 	info->fit = (void *)fit;
+ 	info->node_offset = noffset;
+ 	info->algo = image_get_sig_algo(algo_name);
+@@ -264,7 +264,8 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
+ 		const char *required;
+ 		int ret;
+ 
+-		required = fdt_getprop(sig_blob, noffset, "required", NULL);
++		required = fdt_getprop(sig_blob, noffset, FIT_KEY_REQUIRED,
++				       NULL);
+ 		if (!required || strcmp(required, "image"))
+ 			continue;
+ 		ret = fit_image_verify_sig(fit, image_noffset, data, size,
+@@ -473,7 +474,8 @@ int fit_config_verify_required_sigs(const void *fit, int conf_noffset,
+ 		const char *required;
+ 		int ret;
+ 
+-		required = fdt_getprop(sig_blob, noffset, "required", NULL);
++		required = fdt_getprop(sig_blob, noffset, FIT_KEY_REQUIRED,
++				       NULL);
+ 		if (!required || strcmp(required, "conf"))
+ 			continue;
+ 		ret = fit_config_verify_sig(fit, conf_noffset, sig_blob,
+diff --git a/include/image.h b/include/image.h
+index b05e8552cc5b..2c6ef4de259d 100644
+--- a/include/image.h
++++ b/include/image.h
+@@ -782,12 +782,14 @@ int bootz_setup(ulong image, ulong *start, ulong *end);
+ #define FIT_IMAGES_PATH		"/images"
+ #define FIT_CONFS_PATH		"/configurations"
+ 
+-/* hash/signature node */
++/* hash/signature/key node */
+ #define FIT_HASH_NODENAME	"hash"
+ #define FIT_ALGO_PROP		"algo"
+ #define FIT_VALUE_PROP		"value"
+ #define FIT_IGNORE_PROP		"uboot-ignore"
+ #define FIT_SIG_NODENAME	"signature"
++#define FIT_KEY_REQUIRED	"required"
++#define FIT_KEY_HINT		"key-name-hint"
+ 
+ /* image node */
+ #define FIT_DATA_PROP		"data"
+diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
+index 5d9716f01349..972af6b8a7e2 100644
+--- a/lib/rsa/rsa-sign.c
++++ b/lib/rsa/rsa-sign.c
+@@ -486,8 +486,8 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
+ 	}
+ 
+ 	if (!ret) {
+-		ret = fdt_setprop_string(keydest, node, "key-name-hint",
+-				 info->keyname);
++		ret = fdt_setprop_string(keydest, node, FIT_KEY_HINT,
++					 info->keyname);
+ 	}
+ 	if (!ret)
+ 		ret = fdt_setprop_u32(keydest, node, "rsa,num-bits", bits);
+@@ -509,7 +509,7 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
+ 					 info->algo->name);
+ 	}
+ 	if (info->require_keys) {
+-		ret = fdt_setprop_string(keydest, node, "required",
++		ret = fdt_setprop_string(keydest, node, FIT_KEY_REQUIRED,
+ 					 info->require_keys);
+ 	}
+ done:
+diff --git a/tools/image-host.c b/tools/image-host.c
+index da374eeabf5e..afeba22a09be 100644
+--- a/tools/image-host.c
++++ b/tools/image-host.c
+@@ -161,7 +161,7 @@ static int fit_image_setup_sig(struct image_sign_info *info,
+ 
+ 	memset(info, '\0', sizeof(*info));
+ 	info->keydir = keydir;
+-	info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
++	info->keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
+ 	info->fit = fit;
+ 	info->node_offset = noffset;
+ 	info->algo = image_get_sig_algo(algo_name);
+@@ -234,7 +234,7 @@ static int fit_image_process_sig(const char *keydir, void *keydest,
+ 	free(value);
+ 
+ 	/* Get keyname again, as FDT has changed and invalidated our pointer */
+-	info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
++	info.keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
+ 
+ 	/* Write the public key into the supplied FDT file */
+ 	if (keydest && info.algo->add_verify_data(&info, keydest)) {
+@@ -605,7 +605,7 @@ static int fit_config_process_sig(const char *keydir, void *keydest,
+ 	free(region_prop);
+ 
+ 	/* Get keyname again, as FDT has changed and invalidated our pointer */
+-	info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
++	info.keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
+ 
+ 	/* Write the public key into the supplied FDT file */
+ 	if (keydest) {
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/intel.cfg b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/intel.cfg
new file mode 100644
index 000000000..e59d585de
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/files/intel.cfg
@@ -0,0 +1,3 @@
+CONFIG_ASPEED_FMC_DMA=y

+CONFIG_NETCONSOLE=n

+CONFIG_CMD_NFS=n
\ No newline at end of file
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/u-boot-aspeed_%.bbappend b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/u-boot-aspeed_%.bbappend
index 5be160cb1..f5b54893f 100644
--- a/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/u-boot-aspeed_%.bbappend
+++ b/meta-openbmc-mods/meta-ast2500/recipes-bsp/u-boot/u-boot-aspeed_%.bbappend
@@ -1,11 +1,13 @@
 COMPATIBLE_MACHINE = "intel-ast2500"
 FILESEXTRAPATHS_append_intel-ast2500:= "${THISDIR}/files:"
+FILESEXTRAPATHS_append_intel-ast2500:= "${THISDIR}/files/CVE-2020-10648:"
 
 # the meta-phosphor layer adds this patch, which conflicts
 # with the intel layout for environment
 SRC_URI_remove_intel-ast2500 = " file://0001-configs-ast-Add-redundnant-env.patch"
 
 SRC_URI_append_intel-ast2500 = " \
+    file://intel.cfg \
     file://0001-flash-use-readX-writeX-not-udelay.patch \
     file://0002-intel-layout-environment-addr.patch \
     file://0004-Make-sure-debug-uart-is-using-24MHz-clock-source.patch \
@@ -41,6 +43,19 @@ SRC_URI_append_intel-ast2500 = " \
     file://0038-Increase-default-fan-speed-for-cooper-city.patch \
     file://0040-Initialize-the-BMC-host-mailbox-at-reset-time.patch \
     file://0044-net-phy-realtek-Change-LED-configuration.patch \
+    file://0045-Apply-WDT1-2-reset-mask-to-reset-needed-controller.patch \
+    file://0046-Enable-FMC-DMA-for-memmove.patch \
+    file://0047-ast2500-parse-reset-reason.patch \
+    "
+# CVE-2020-10648 vulnerability fix
+SRC_URI_append_intel-ast2500 = " \
+    file://0001-image-Correct-comment-for-fit_conf_get_node.patch \
+    file://0002-image-Be-a-little-more-verbose-when-checking-signatu.patch \
+    file://0003-image-Return-an-error-message-from-fit_config_verify.patch \
+    file://0007-image-Check-hash-nodes-when-checking-configurations.patch \
+    file://0008-image-Load-the-correct-configuration-in-fit_check_si.patch \
+    file://0009-fit_check_sign-Allow-selecting-the-configuration-to-.patch \
+    file://0012-image-Use-constants-for-required-and-key-name-hint.patch \
     "
 PFR_SRC_URI = " \
     file://0022-u-boot-env-change-for-PFR-image.patch \
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/configuration/entity-manager/CPC-Baseboard.json b/meta-openbmc-mods/meta-ast2500/recipes-phosphor/configuration/entity-manager/CPC-Baseboard.json
index 793c790c8..44eda0e66 100644
--- a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/configuration/entity-manager/CPC-Baseboard.json
+++ b/meta-openbmc-mods/meta-ast2500/recipes-phosphor/configuration/entity-manager/CPC-Baseboard.json
@@ -1884,6 +1884,12 @@
                 "PinType": "PIN_NONE"
             },
             "Type": "ASD"
+        },
+        {
+            "Address": "0x38",
+            "Bus": 4,
+            "Name": "PFR",
+            "Type": "PFR"
         }
     ],
     "Name": "CPC Baseboard",
@@ -1906,4 +1912,4 @@
         "ProductId": 157
     },
     "xyz.openbmc_project.Inventory.Item.System": {}
-}
\ No newline at end of file
+}
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/configuration/entity-manager/WC-Baseboard.json b/meta-openbmc-mods/meta-ast2500/recipes-phosphor/configuration/entity-manager/WC-Baseboard.json
index 041787147..12790632e 100644
--- a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/configuration/entity-manager/WC-Baseboard.json
+++ b/meta-openbmc-mods/meta-ast2500/recipes-phosphor/configuration/entity-manager/WC-Baseboard.json
@@ -1045,6 +1045,30 @@
             "Type": "IpmbSensor"
         },
         {
+            "Address": 190,
+            "Class": "MESensor",
+            "Name": "Host Cpu Utilization",
+            "SensorType": "utilization",
+            "ScaleValue": 0.392,
+            "Type": "IpmbSensor"
+        },
+        {
+            "Address": 191,
+            "Class": "MESensor",
+            "Name": "Host Pci Bandwidth Utilization",
+            "SensorType": "utilization",
+            "ScaleValue": 0.392,
+            "Type": "IpmbSensor"
+        },
+        {
+            "Address": 192,
+            "Class": "MESensor",
+            "Name": "Host Memory Bandwidth Utilization",
+            "SensorType": "utilization",
+            "ScaleValue": 0.392,
+            "Type": "IpmbSensor"
+        },
+        {
             "EthIndex": 0,
             "Name": "Dedicated Management NIC",
             "Type": "NIC"
@@ -1918,9 +1942,9 @@
             "ILimitMax": 100,
             "ILimitMin": 30,
             "Inputs": [
-                "DIMM [ABC]\\d+ CPU1"
+                "DIMM [ABCD]\\d+ CPU1"
             ],
-            "Name": "CPU1 DIMM ABC",
+            "Name": "CPU1 DIMM ABCD",
             "NegativeHysteresis": 5.0,
             "OutLimitMax": 100,
             "OutLimitMin": 30,
@@ -1944,9 +1968,9 @@
             "ILimitMax": 100,
             "ILimitMin": 30,
             "Inputs": [
-                "DIMM [DEF]\\d+ CPU1"
+                "DIMM [EFGH]\\d+ CPU1"
             ],
-            "Name": "CPU1 DIMM DEF",
+            "Name": "CPU1 DIMM EFGH",
             "NegativeHysteresis": 5.0,
             "OutLimitMax": 100,
             "OutLimitMin": 30,
@@ -1969,9 +1993,9 @@
             "ILimitMax": 100,
             "ILimitMin": 30,
             "Inputs": [
-                "DIMM [ABC]\\d+ CPU2"
+                "DIMM [ABCD]\\d+ CPU2"
             ],
-            "Name": "CPU2 DIMM ABC",
+            "Name": "CPU2 DIMM ABCD",
             "NegativeHysteresis": 5.0,
             "OutLimitMax": 100,
             "OutLimitMin": 30,
@@ -1995,9 +2019,9 @@
             "ILimitMax": 100,
             "ILimitMin": 30,
             "Inputs": [
-                "DIMM [DEF]\\d+ CPU2"
+                "DIMM [EFGH]\\d+ CPU2"
             ],
-            "Name": "CPU2 DIMM DEF",
+            "Name": "CPU2 DIMM EFGH",
             "NegativeHysteresis": 5.0,
             "OutLimitMax": 100,
             "OutLimitMin": 30,
@@ -2399,6 +2423,12 @@
                 }
             ],
             "Type": "XeonCPU"
+        },
+        {
+            "Address": "0x38",
+            "Bus": 4,
+            "Name": "PFR",
+            "Type": "PFR"
         }
     ],
     "Name": "WC Baseboard",
@@ -2421,4 +2451,4 @@
         "ProductId": 145
     },
     "xyz.openbmc_project.Inventory.Item.System": {}
-}
+}
\ No newline at end of file
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/configuration/entity-manager/WC-Chassis.json b/meta-openbmc-mods/meta-ast2500/recipes-phosphor/configuration/entity-manager/WC-Chassis.json
index a30626daa..12c2e6084 100644
--- a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/configuration/entity-manager/WC-Chassis.json
+++ b/meta-openbmc-mods/meta-ast2500/recipes-phosphor/configuration/entity-manager/WC-Chassis.json
@@ -205,6 +205,11 @@
             "Type": "ExitAirTempSensor"
         },
         {
+            "AllowedFailures": 1,
+            "Name": "FanRedundancy",
+            "Type": "FanRedundancy"
+        },
+        {
             "Class": "temp",
             "FFGainCoefficient": 0.0,
             "FFOffCoefficient": 0.0,
@@ -452,4 +457,4 @@
     "xyz.openbmc_project.Inventory.Decorator.AssetTag": {
         "AssetTag": "$PRODUCT_ASSET_TAG"
     }
-}
\ No newline at end of file
+}
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0004-AST2600-Adjust-default-GPIO-settings.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0004-AST2600-Adjust-default-GPIO-settings.patch
index 8659e4bfc..3a15830f7 100644
--- a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0004-AST2600-Adjust-default-GPIO-settings.patch
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0004-AST2600-Adjust-default-GPIO-settings.patch
@@ -1,4 +1,4 @@
-From 0381bd2a345dade03721a1244fa30eed4fade9fa Mon Sep 17 00:00:00 2001
+From 538ebb0466d1063963e0d3a489b98c5fb8b62fb2 Mon Sep 17 00:00:00 2001
 From: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
 Date: Fri, 3 Jan 2020 15:14:09 -0800
 Subject: [PATCH] AST2600: Adjust default GPIO settings
@@ -11,14 +11,14 @@ Subject: [PATCH] AST2600: Adjust default GPIO settings
 
 Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
 ---
- board/aspeed/ast2600_intel/intel.c | 56 ++++++++++++++++++++++++++++++++++++++
- 1 file changed, 56 insertions(+)
+ board/aspeed/ast2600_intel/intel.c | 55 ++++++++++++++++++++++++++++++
+ 1 file changed, 55 insertions(+)
 
 diff --git a/board/aspeed/ast2600_intel/intel.c b/board/aspeed/ast2600_intel/intel.c
-index d1ac8651ac6c..45f01a095340 100644
+index d1ac8651ac6c..fc4745a11585 100644
 --- a/board/aspeed/ast2600_intel/intel.c
 +++ b/board/aspeed/ast2600_intel/intel.c
-@@ -162,6 +162,60 @@ static void sgpio_init(void)
+@@ -162,6 +162,59 @@ static void sgpio_init(void)
  	       SCU_BASE | SCU_414);
  }
  
@@ -69,17 +69,16 @@ index d1ac8651ac6c..45f01a095340 100644
 +	writel(readl(AST_GPIO_BASE | GPIO_004) & ~GPIO_C5,
 +	       AST_GPIO_BASE | GPIO_004);
 +
++	/* GPIO G6 is also an open-drain output so set it as an input. */
 +#define GPIO_G6			BIT(22)
-+	writel(readl(AST_GPIO_BASE | GPIO_024) | GPIO_G6,
++	writel(readl(AST_GPIO_BASE | GPIO_024) & ~GPIO_G6,
 +	       AST_GPIO_BASE | GPIO_024);
-+	writel(readl(AST_GPIO_BASE | GPIO_020) | GPIO_G6,
-+	       AST_GPIO_BASE | GPIO_020);
 +}
 +
  static void timer_handler(void *regs)
  {
  	printf("+");
-@@ -175,6 +229,8 @@ int board_early_init_f(void)
+@@ -175,6 +228,8 @@ int board_early_init_f(void)
  	 * I am not sure if it actually does anything... */
  	arch_interrupt_init_early();
  
@@ -89,5 +88,5 @@ index d1ac8651ac6c..45f01a095340 100644
  
  	port80h_snoop_init();
 -- 
-2.7.4
+2.17.1
 
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0008-AST2600-Add-TPM-pulse-trigger.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0008-AST2600-Add-TPM-pulse-trigger.patch
index 19606ee38..edad150af 100644
--- a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0008-AST2600-Add-TPM-pulse-trigger.patch
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0008-AST2600-Add-TPM-pulse-trigger.patch
@@ -1,4 +1,4 @@
-From b7f02c074c0dee6b5d6d1c1f632993f7b0e3e952 Mon Sep 17 00:00:00 2001
+From 627e49e75963fb372f1d6cd2297c8f73d6ec91e0 Mon Sep 17 00:00:00 2001
 From: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
 Date: Wed, 25 Mar 2020 15:04:26 -0700
 Subject: [PATCH] AST2600: Add TPM pulse trigger
@@ -11,11 +11,11 @@ Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
  1 file changed, 17 insertions(+)
 
 diff --git a/board/aspeed/ast2600_intel/intel.c b/board/aspeed/ast2600_intel/intel.c
-index 22a377d2cb77..47e5ad21d66d 100644
+index e1fd06a142b9..63af3d0f9034 100644
 --- a/board/aspeed/ast2600_intel/intel.c
 +++ b/board/aspeed/ast2600_intel/intel.c
-@@ -204,6 +204,21 @@ static void set_gpio_default_state(void)
- 	       AST_GPIO_BASE | GPIO_020);
+@@ -215,6 +215,21 @@ static void set_gpio_default_state(void)
+ 	       AST_GPIO_BASE | GPIO_024);
  }
  
 +void enable_onboard_tpm(void)
@@ -36,7 +36,7 @@ index 22a377d2cb77..47e5ad21d66d 100644
  static void timer_handler(void *regs)
  {
  	printf("+");
-@@ -234,6 +249,8 @@ int board_early_init_r(void)
+@@ -245,6 +260,8 @@ int board_early_init_r(void)
  	debug("board_early_init_r\n");
  	/* timer_enable(0, 1, timer_handler); */
  
@@ -46,5 +46,5 @@ index 22a377d2cb77..47e5ad21d66d 100644
  }
  
 -- 
-2.7.4
+2.17.1
 
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0016-Add-system-reset-status-support.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0016-Add-system-reset-status-support.patch
new file mode 100644
index 000000000..89a8808eb
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0016-Add-system-reset-status-support.patch
@@ -0,0 +1,154 @@
+From 0a2511d407ad9294b8c08f5228d85e042c104aaa Mon Sep 17 00:00:00 2001
+From: Yong Li <yong.b.li@linux.intel.com>
+Date: Tue, 9 Apr 2019 14:42:05 +0800
+Subject: [PATCH] Add system reset status support
+
+Will display the reset reasons and other CPU information in u-boot,
+and save the reset reasons into kernel command line,
+for applications to query.
+
+Change-Id: I87ada3ecf14368519e4d09035bb1e09fdc05469b
+Signed-off-by: Yong Li <yong.b.li@linux.intel.com>
+Signed-off-by: AppaRao Puli <apparao.puli@linux.intel.com>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+---
+ arch/arm/mach-aspeed/ast2600/scu_info.c |  4 ++
+ board/aspeed/ast2600_intel/intel.c      | 65 +++++++++++++++++++++++++++++++++
+ include/asm-generic/global_data.h       |  3 ++
+ 3 files changed, 72 insertions(+)
+
+diff --git a/arch/arm/mach-aspeed/ast2600/scu_info.c b/arch/arm/mach-aspeed/ast2600/scu_info.c
+index 2ee88b4dd39b..2cc6c3652bab 100644
+--- a/arch/arm/mach-aspeed/ast2600/scu_info.c
++++ b/arch/arm/mach-aspeed/ast2600/scu_info.c
+@@ -9,6 +9,8 @@
+ #include <asm/io.h>
+ #include <asm/arch/aspeed_scu_info.h>
+ 
++DECLARE_GLOBAL_DATA_PTR;
++
+ /* SoC mapping Table */
+ #define SOC_ID(str, rev) { .name = str, .rev_id = rev, }
+ 
+@@ -237,6 +239,8 @@ void aspeed_print_sysrst_info(void)
+ 			writel(SYS_EXT_RESET, ASPEED_SYS_RESET_CTRL);
+ 		}	
+ 	}
++
++	gd->reset_reason = rest;
+ }
+ 
+ #define SOC_FW_INIT_DRAM		BIT(7)
+diff --git a/board/aspeed/ast2600_intel/intel.c b/board/aspeed/ast2600_intel/intel.c
+index 05872b439361..95e5492009d7 100644
+--- a/board/aspeed/ast2600_intel/intel.c
++++ b/board/aspeed/ast2600_intel/intel.c
+@@ -5,6 +5,7 @@
+ #include <common.h>
+ #include <asm/gpio.h>
+ #include <asm/io.h>
++#include <malloc.h>
+ 
+ /* use GPIOC0 on intel boards */
+ #define FFUJ_GPIO "gpio@1e78000016"
+@@ -274,6 +275,65 @@ int board_early_init_r(void)
+ 	return 0;
+ }
+ 
++static void update_bootargs_cmd(const char *key, const char *value)
++{
++	int buf_len;
++	char *buf;
++	char *cmdline;
++	char comp_key[128];
++
++	if (!key || (key[0] == '\0')) {
++		printf("%s - Empty key not allowed\n", __func__);
++		return;
++	}
++
++	cmdline = env_get("bootargs");
++
++	/* Allocate space for maximum possible new command line */
++	if (value)
++		buf_len = strlen(cmdline) + strlen(key) + 3 + strlen(value);
++	else
++		buf_len = strlen(cmdline) + strlen(key) + 3;
++
++	buf = malloc(buf_len);
++	if (!buf) {
++		printf("%s: out of memory\n", __func__);
++		return;
++	}
++	memset(buf, 0, buf_len);
++
++	if (!cmdline) {
++		/* lets add key-value, though bootargs are empty */
++		snprintf(buf, buf_len, "%s=%s", key, (value ? value : ""));
++		env_set("bootargs", buf);
++		free(buf);
++		return;
++	}
++
++	snprintf(comp_key, sizeof(comp_key), "%s=", key);
++	char *start = strstr(cmdline, comp_key);
++
++	/* Check for full word match. Match should be start of cmdline
++	 * or there should be space before match */
++	if (start && ((start == cmdline) || (*(start-1) == ' '))) {
++		char *end = strchr(start, ' ');
++		strncpy(buf, cmdline, (start - cmdline));
++
++		if (end)
++			snprintf(buf, buf_len, "%s%s=%s %s", buf, key,
++				 (value ? value : ""), end+1);
++		else
++			snprintf(buf, buf_len, "%s%s=%s", buf, key,
++				 (value ? value : ""));
++	} else {
++		snprintf(buf, buf_len, "%s %s=%s", cmdline, key,
++			 (value ? value : ""));
++	}
++
++	env_set("bootargs", buf);
++	free(buf);
++}
++
+ extern void espi_init(void);
+ extern void kcs_init(void);
+ extern void timer_enable(int n, u32 interval_us, interrupt_handler_t *handler,
+@@ -283,12 +343,17 @@ int board_late_init(void)
+ #define SCU_014			0x014		/* Silicon Revision ID */
+ #define REV_ID_AST2600A0	0x05000303	/* AST2600 A0 */
+ #define ONE_MSEC_IN_USEC	1000
++	char value[11];
+ 
+ 	if (readl(SCU_BASE | SCU_014) == REV_ID_AST2600A0)
+ 		timer_enable(0, ONE_MSEC_IN_USEC, timer_callback, (void *)0);
+ 
+ 	espi_init();
+ 
++	/* Add reset reason to bootargs */
++	snprintf(value, sizeof(value), "0x%x", gd->reset_reason);
++	update_bootargs_cmd("resetreason", value);
++
+ 	if (read_ffuj())
+ 		kcs_init();
+ 
+diff --git a/include/asm-generic/global_data.h b/include/asm-generic/global_data.h
+index 78dcf40bff48..fa51e384520f 100644
+--- a/include/asm-generic/global_data.h
++++ b/include/asm-generic/global_data.h
+@@ -133,6 +133,9 @@ typedef struct global_data {
+ 	struct spl_handoff *spl_handoff;
+ # endif
+ #endif
++#ifdef CONFIG_ARCH_ASPEED
++	u32 reset_reason;
++#endif
+ } gd_t;
+ #endif
+ 
+-- 
+2.7.4
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0017-Manufacturing-mode-physical-presence-detection.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0017-Manufacturing-mode-physical-presence-detection.patch
new file mode 100644
index 000000000..0b0fb466d
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0017-Manufacturing-mode-physical-presence-detection.patch
@@ -0,0 +1,106 @@
+From 8bfaae756740589ec9644a5ddcd8b19d7d7b9b73 Mon Sep 17 00:00:00 2001
+From: AppaRao Puli <apparao.puli@linux.intel.com>
+Date: Thu, 20 Jun 2019 18:11:43 +0530
+Subject: [PATCH] Manufacturing mode physical presence detection
+
+Support for physical presence of manufacturing mode added.
+Front panel power button press for 15 seconds will be detected
+and marked as special mode for manufacturing request.
+//TODO:
+//There will be 10 second Status LED blink for 10 seconds to
+//do the physical indication to the user. This indicates the
+//user that he has pressed power button long enough for
+//manufacturing mode detection.
+
+Tested:
+1. Verified by holding the power button when u-boot boots for
+15 seconds, and confirmed that bootargs passed to linux has
+special=mfg string and status led blink physical indication
+has been provided
+2. Verified in normal condition special=mfg string is not passed
+and no physical indication has been provided
+
+Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>
+Signed-off-by: AppaRao Puli <apparao.puli@linux.intel.com>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+---
+ board/aspeed/ast2600_intel/intel.c | 49 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 49 insertions(+)
+
+diff --git a/board/aspeed/ast2600_intel/intel.c b/board/aspeed/ast2600_intel/intel.c
+index 95e5492009d7..367657df56d1 100644
+--- a/board/aspeed/ast2600_intel/intel.c
++++ b/board/aspeed/ast2600_intel/intel.c
+@@ -39,6 +39,26 @@ int gpio_abort(void)
+ 	return value <= 0 ? 0 : 1;
+ }
+ 
++int read_frontpanel_power_button(void)
++{
++#define FP_PWRBTN_GPIO "gpio@1e780000122" /* GPIOP2 */
++	struct gpio_desc desc;
++	int ret;
++
++	ret = dm_gpio_lookup_name(FP_PWRBTN_GPIO, &desc);
++	if (ret)
++		return ret;
++	ret = dm_gpio_request(&desc, "fp_pwrbtn");
++	if (ret)
++		return ret;
++	ret = dm_gpio_set_dir_flags(&desc, GPIOD_ACTIVE_LOW);
++	if (ret)
++		return ret;
++	ret = dm_gpio_get_value(&desc);
++	dm_gpio_free(desc.dev, &desc);
++	return ret;
++}
++
+ #define SCU_BASE 0x1E6E2000
+ #define SCU_338 0x338 //Generate UART 24 MHz Reference from UXCLK
+ #define SCU_33C 0x33c //Generate UART 24 MHz Reference from HUXCLK
+@@ -334,6 +354,31 @@ static void update_bootargs_cmd(const char *key, const char *value)
+ 	free(buf);
+ }
+ 
++static bool is_mfg_mode_phy_req(void)
++{
++	/*
++	 * Assume mfg mode physical request is made, if power button
++	 * is pressed continously for 15 seconds, indicate the
++	 * same in bootargs
++	 */
++	const uint32_t delay_in_ms = 100;
++	const uint32_t read_count = ((15 * 1000) / delay_in_ms);
++	const uint32_t delay_for_indication = 10 * 1000;
++	for (uint32_t count = 0; count < read_count; ++count) {
++		if (read_frontpanel_power_button() != 1)
++			return false;
++
++		mdelay(delay_in_ms);
++	}
++	debug("is_mfg_mode_phy_req : detected mfg mode request\n");
++	// TODO: enable id led control
++	//id_led_control(GPIO_GREEN_LED, EIDLED_Blink_3HZ);
++	/* Delay the boot to do physical indication for mfg mode */
++	mdelay(delay_for_indication);
++
++	return true;
++}
++
+ extern void espi_init(void);
+ extern void kcs_init(void);
+ extern void timer_enable(int n, u32 interval_us, interrupt_handler_t *handler,
+@@ -354,6 +399,10 @@ int board_late_init(void)
+ 	snprintf(value, sizeof(value), "0x%x", gd->reset_reason);
+ 	update_bootargs_cmd("resetreason", value);
+ 
++	/* Update the special mode in bootargs */
++	if (is_mfg_mode_phy_req())
++		update_bootargs_cmd("special", "mfg");
++
+ 	if (read_ffuj())
+ 		kcs_init();
+ 
+-- 
+2.7.4
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0018-Add-a-workaround-to-cover-VGA-memory-size-bug-in-A0.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0018-Add-a-workaround-to-cover-VGA-memory-size-bug-in-A0.patch
new file mode 100644
index 000000000..2ae8978e6
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0018-Add-a-workaround-to-cover-VGA-memory-size-bug-in-A0.patch
@@ -0,0 +1,52 @@
+From 28f797376ec5d9bf62a12a6c91686588cf73d09a Mon Sep 17 00:00:00 2001
+From: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+Date: Thu, 18 Jun 2020 15:08:57 -0700
+Subject: [PATCH] Add a workaround to cover VGA memory size bug in A0
+
+AST2600 A0 has a silicon bug which requires setting of VGA memory
+size limit. This commit add VGA memory size setting of 8MB for A0
+and 16MB for A1.
+
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+---
+ arch/arm/mach-aspeed/ast2600/platform.S | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/arch/arm/mach-aspeed/ast2600/platform.S b/arch/arm/mach-aspeed/ast2600/platform.S
+index 0316e5364b78..d881ba8565f2 100644
+--- a/arch/arm/mach-aspeed/ast2600/platform.S
++++ b/arch/arm/mach-aspeed/ast2600/platform.S
+@@ -183,6 +183,12 @@ do_primary_core_setup:
+ 
+ 	bne	0f
+ 
++	/* limit VGA memory size to 8MB (A0 bug) */
++	ldr	r0, =AST_SCU_HW_STRAP1_CLR
++	movw	r1, #0x6000
++	movt	r1, #0x0000
++	str	r1, [r0]
++
+ 	/* tune up CPU clocks (A0 only) */
+ 	ldr	r0, =AST_SCU_HW_STRAP1
+ 	ldr	r1, [r0]
+@@ -234,6 +240,17 @@ wait_lock:
+ 	orr	r1, #0x40
+ 	str	r1, [r0]
+ 
++	/* set VGA memory size to 16MB (A1 only) */
++	ldr	r0, =AST_SCU_HW_STRAP1_CLR
++	movw	r1, #0x4000
++	movt	r1, #0x0000
++	str	r1, [r0]
++
++	ldr	r0, =AST_SCU_HW_STRAP1
++	ldr	r1, [r0]
++	orr	r1, #0x2000
++	str	r1, [r0]
++
+ 	/* disable DMA arbitration on MAC1 (A1 bug) */
+ 	ldr	r0, =AST_MAC1_CTRL2
+ 	ldr	r1, [r0]
+-- 
+2.7.4
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0019-Apply-WDT-reset-mask-to-reset-needed-controller.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0019-Apply-WDT-reset-mask-to-reset-needed-controller.patch
new file mode 100644
index 000000000..b68975c40
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0019-Apply-WDT-reset-mask-to-reset-needed-controller.patch
@@ -0,0 +1,78 @@
+From 5179bc2cba159b9167fee90a2c6a7ea2824df8ad Mon Sep 17 00:00:00 2001
+From: Suryakanth Sekar <suryakanth.sekar@linux.intel.com>
+Date: Thu, 18 Jun 2020 05:32:48 +0530
+Subject: [PATCH] Apply WDT reset mask to reset needed controller
+
+Issue:
+Whenever BIOS and BMC warm reset happens at a time.
+BIOS is not booting.
+
+Root caused:
+BMC resetting the LPC controller during BMC warm reset.
+Which cause BIOS hang as BIOS cannot dump the BIOS serial data.
+
+Fix:
+WDT reset mask has been updated from default to proper value,
+such that controllers interacting with host will not be reset
+during wdt reset operation.
+This was missed earlier, causing BIOS to hang whenever BMC resets,
+as BIOS was accessing the serial port (LPC controller).
+De-coupling LPC controller will make sure BIOS serial port access
+is not disturbed.
+Reset mask is updated not to reset the following controllers
+additionally on the default mask setting.
+1. LPC controller
+2. PWM controller
+3. GPIO controller
+
+Quick Step to reproduce:
+Stop the BMC in uboot and add below bootcmd command
+setenv bootcmd "reset"
+Do the System power ON or System warm reset.
+
+Tested:
+1. Ran overnight continous BIOS and BMC warm reset on two SUTs.
+
+2. Ran the TestApp which dump the BIOS serial port continously and
+do the BMC reset.
+
+3. Stop the BMC in uboot and add below bootcmd command
+setenv bootcmd "reset"
+Do the System Power ON or System warm reset.
+
+Signed-off-by: Suryakanth Sekar <suryakanth.sekar@linux.intel.com>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+---
+ arch/arm/mach-aspeed/ast2600/platform.S | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm/mach-aspeed/ast2600/platform.S b/arch/arm/mach-aspeed/ast2600/platform.S
+index d881ba8565f2..68eb0000922a 100644
+--- a/arch/arm/mach-aspeed/ast2600/platform.S
++++ b/arch/arm/mach-aspeed/ast2600/platform.S
+@@ -66,6 +66,9 @@
+ #define AST_MAC2_BASE		(0x1E680000)
+ #define AST_MAC2_CTRL2		(AST_MAC2_BASE + 0x058)
+ 
++#define AST_WDT1_BASE		0x1E785000
++#define AST_WDT1_RESET_MASK2	(AST_WDT1_BASE + 0x020)
++
+ #define AST_GPIO_BASE		(0x1E780000)
+ #define AST_GPIOYZ_DATA_VALUE	(AST_GPIO_BASE + 0x1E0)
+ 
+@@ -264,6 +267,12 @@ wait_lock:
+ 	str	r1, [r0]
+ 
+ 1:
++	/* disable LPC, PWM and GPIO2 resets on WDT1 reset */
++	ldr	r0, =AST_WDT1_RESET_MASK2
++	ldr	r1, [r0]
++	bic	r1, #0x2A00
++	str	r1, [r0]
++
+ 	/* release display port reset */
+ 	ldr	r0, =AST_SCU_SYSRST_CTRL_CLR
+ 	movw	r1, #0x0000
+-- 
+2.7.4
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0020-Add-BMC-running-indicator-LED-control.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0020-Add-BMC-running-indicator-LED-control.patch
new file mode 100644
index 000000000..a30f7a7b8
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0020-Add-BMC-running-indicator-LED-control.patch
@@ -0,0 +1,62 @@
+From 5029f400e62981278957f62c5f8b4e22c2faecd9 Mon Sep 17 00:00:00 2001
+From: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+Date: Fri, 26 Jun 2020 14:35:47 -0700
+Subject: [PATCH] Add BMC running indicator LED control
+
+HBLED cannot be enabled due to a conflict with PWM15 pin and H/W
+team is not going to change board layout for supporting HBLED to
+keep compatibility between board revisions. Instead, we are going
+to use the LED connected to GPIO V5 as BMC running indicator LED.
+This commit adds the LED control.
+
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+---
+ board/aspeed/ast2600_intel/intel.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/board/aspeed/ast2600_intel/intel.c b/board/aspeed/ast2600_intel/intel.c
+index e93ef57dabed..565893777ffc 100644
+--- a/board/aspeed/ast2600_intel/intel.c
++++ b/board/aspeed/ast2600_intel/intel.c
+@@ -192,6 +192,8 @@ static void sgpio_init(void)
+ #define GPIO_024		0x024 /* GPIO E/F/G/H Direction */
+ #define GPIO_070		0x070 /* GPIO I/J/K/L Value */
+ #define GPIO_074		0x074 /* GPIO I/J/K/L Direction */
++#define GPIO_088		0x088 /* GPIO U/V/W/X Value */
++#define GPIO_08C		0x08C /* GPIO U/V/W/X Direction */
+ 
+ static void set_gpio_default_state(void)
+ {
+@@ -252,6 +254,20 @@ void enable_onboard_tpm(void)
+ 	       AST_GPIO_BASE | GPIO_000);
+ }
+ 
++void bmc_running_indicator(bool on)
++{
++#define GPIO_V5			BIT(13)
++
++	writel(readl(AST_GPIO_BASE | GPIO_08C) | GPIO_V5,
++	       AST_GPIO_BASE | GPIO_08C);
++	if (on)
++		writel(readl(AST_GPIO_BASE | GPIO_088) & ~GPIO_V5,
++		       AST_GPIO_BASE | GPIO_088);
++	else
++		writel(readl(AST_GPIO_BASE | GPIO_088) | GPIO_V5,
++		       AST_GPIO_BASE | GPIO_088);
++}
++
+ static void timer_callback(void *cookie)
+ {
+ 	uint timer_nr = (uint)cookie;
+@@ -292,6 +308,8 @@ int board_early_init_r(void)
+ 
+ 	enable_onboard_tpm();
+ 
++	bmc_running_indicator(true);
++
+ 	return 0;
+ }
+ 
+-- 
+2.7.4
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0022-Reboot-into-UBOOT-on-Watchdog-Failures.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0022-Reboot-into-UBOOT-on-Watchdog-Failures.patch
new file mode 100644
index 000000000..d5ccddf27
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/0022-Reboot-into-UBOOT-on-Watchdog-Failures.patch
@@ -0,0 +1,87 @@
+From b81b62f2ca4d4e434f2fec090725e99f198f64ef Mon Sep 17 00:00:00 2001
+From: James Feist <james.feist@linux.intel.com>
+Date: Wed, 31 Jul 2019 16:01:49 -0700
+Subject: [PATCH] Reboot into UBOOT on Watchdog Failures
+
+We use watchdog1 to reboot when there is a watchdog
+error. Reboot into u-boot as we are using that as
+safe mode.
+
+Tested: watchdog -T 0 -F /dev/watchdog1 reboots into
+uboot after 3 times
+
+Signed-off-by: James Feist <james.feist@linux.intel.com>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+---
+ board/aspeed/ast2600_intel/intel.c | 34 ++++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+diff --git a/board/aspeed/ast2600_intel/intel.c b/board/aspeed/ast2600_intel/intel.c
+index 565893777ffc..2fb84e880e5c 100644
+--- a/board/aspeed/ast2600_intel/intel.c
++++ b/board/aspeed/ast2600_intel/intel.c
+@@ -7,6 +7,28 @@
+ #include <asm/io.h>
+ #include <malloc.h>
+ 
++#define WATCHDOG_RESET_BIT	BIT(20)
++#define BOOT_FAILURE_LIMIT	3
++
++static int get_boot_failures(void)
++{
++	return env_get_ulong("bootfailures", 10, 0);
++}
++
++static void set_boot_failures(u32 count)
++{
++	if (count > BOOT_FAILURE_LIMIT)
++		return;
++
++	env_set_ulong("bootfailures", count);
++	env_save();
++}
++
++int intel_failed_boot(void)
++{
++	return get_boot_failures() >= BOOT_FAILURE_LIMIT;
++}
++
+ /* use GPIOC0 on intel boards */
+ #define FFUJ_GPIO "gpio@1e78000016"
+ 
+@@ -33,6 +55,10 @@ int read_ffuj(void)
+ int gpio_abort(void)
+ {
+ 	int value;
++
++	if (intel_failed_boot())
++		return 1;
++
+ 	/* check ffuj to abort the autoboot */
+ 	value = read_ffuj();
+ 	printf("FFUJ: %d\n", value);
+@@ -407,6 +433,7 @@ int board_late_init(void)
+ #define REV_ID_AST2600A0	0x05000303	/* AST2600 A0 */
+ #define ONE_MSEC_IN_USEC	1000
+ 	char value[11];
++	u32 boot_failures;
+ 
+ 	if (readl(SCU_BASE | SCU_014) == REV_ID_AST2600A0)
+ 		timer_enable(0, ONE_MSEC_IN_USEC, timer_callback, (void *)0);
+@@ -417,6 +444,13 @@ int board_late_init(void)
+ 	snprintf(value, sizeof(value), "0x%x", gd->reset_reason);
+ 	update_bootargs_cmd("resetreason", value);
+ 
++	boot_failures = get_boot_failures();
++
++	if (gd->reset_reason & WATCHDOG_RESET_BIT)
++		set_boot_failures(boot_failures + 1);
++	else
++		set_boot_failures(0);
++
+ 	/* Update the special mode in bootargs */
+ 	if (is_mfg_mode_phy_req())
+ 		update_bootargs_cmd("special", "mfg");
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0001-image-Correct-comment-for-fit_conf_get_node.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0001-image-Correct-comment-for-fit_conf_get_node.patch
new file mode 100644
index 000000000..8c922f5e8
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0001-image-Correct-comment-for-fit_conf_get_node.patch
@@ -0,0 +1,77 @@
+From 211549e16fa6601f9783e6e3802db9aaa3f4922e Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] image: Correct comment for fit_conf_get_node()
+
+This should mention that conf_uname can be NULL and should be in the
+header file. Fix this.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ common/image-fit.c | 18 ------------------
+ include/image.h    | 19 +++++++++++++++++++
+ 2 files changed, 19 insertions(+), 18 deletions(-)
+
+diff --git a/common/image-fit.c b/common/image-fit.c
+index ac901e131ca1..06f3358c931c 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -1612,24 +1612,6 @@ int fit_conf_find_compat(const void *fit, const void *fdt)
+ 	return best_match_offset;
+ }
+ 
+-/**
+- * fit_conf_get_node - get node offset for configuration of a given unit name
+- * @fit: pointer to the FIT format image header
+- * @conf_uname: configuration node unit name
+- *
+- * fit_conf_get_node() finds a configuration (within the '/configurations'
+- * parent node) of a provided unit name. If configuration is found its node
+- * offset is returned to the caller.
+- *
+- * When NULL is provided in second argument fit_conf_get_node() will search
+- * for a default configuration node instead. Default configuration node unit
+- * name is retrieved from FIT_DEFAULT_PROP property of the '/configurations'
+- * node.
+- *
+- * returns:
+- *     configuration node offset when found (>=0)
+- *     negative number on failure (FDT_ERR_* code)
+- */
+ int fit_conf_get_node(const void *fit, const char *conf_uname)
+ {
+ 	int noffset, confs_noffset;
+diff --git a/include/image.h b/include/image.h
+index 765ffecee0a7..4b764d11c70d 100644
+--- a/include/image.h
++++ b/include/image.h
+@@ -1045,6 +1045,25 @@ int fit_image_check_comp(const void *fit, int noffset, uint8_t comp);
+ int fit_check_format(const void *fit);
+ 
+ int fit_conf_find_compat(const void *fit, const void *fdt);
++
++/**
++ * fit_conf_get_node - get node offset for configuration of a given unit name
++ * @fit: pointer to the FIT format image header
++ * @conf_uname: configuration node unit name (NULL to use default)
++ *
++ * fit_conf_get_node() finds a configuration (within the '/configurations'
++ * parent node) of a provided unit name. If configuration is found its node
++ * offset is returned to the caller.
++ *
++ * When NULL is provided in second argument fit_conf_get_node() will search
++ * for a default configuration node instead. Default configuration node unit
++ * name is retrieved from FIT_DEFAULT_PROP property of the '/configurations'
++ * node.
++ *
++ * returns:
++ *     configuration node offset when found (>=0)
++ *     negative number on failure (FDT_ERR_* code)
++ */
+ int fit_conf_get_node(const void *fit, const char *conf_uname);
+ 
+ /**
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0002-image-Be-a-little-more-verbose-when-checking-signatu.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0002-image-Be-a-little-more-verbose-when-checking-signatu.patch
new file mode 100644
index 000000000..230a7bb0a
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0002-image-Be-a-little-more-verbose-when-checking-signatu.patch
@@ -0,0 +1,45 @@
+From 63c22eddb8fba1b6ffb845765e91587e998e470e Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] image: Be a little more verbose when checking signatures
+
+It is useful to be a little more specific about what is being checked.
+Update a few messages to help with this.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ common/image-fit.c | 2 +-
+ tools/image-host.c | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/common/image-fit.c b/common/image-fit.c
+index 06f3358c931c..58923cbc9371 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -1850,7 +1850,7 @@ int fit_image_load(bootm_headers_t *images, ulong addr,
+ 		fit_uname = fit_get_name(fit, noffset, NULL);
+ 	}
+ 	if (noffset < 0) {
+-		puts("Could not find subimage node\n");
++		printf("Could not find subimage node type '%s'\n", prop_name);
+ 		bootstage_error(bootstage_id + BOOTSTAGE_SUB_SUBNODE);
+ 		return -ENOENT;
+ 	}
+diff --git a/tools/image-host.c b/tools/image-host.c
+index 88b329502ca3..8e94ee8f3e31 100644
+--- a/tools/image-host.c
++++ b/tools/image-host.c
+@@ -743,7 +743,8 @@ int fit_check_sign(const void *fit, const void *key)
+ 	if (!cfg_noffset)
+ 		return -1;
+ 
+-	printf("Verifying Hash Integrity ... ");
++	printf("Verifying Hash Integrity for node '%s'... ",
++	       fdt_get_name(fit, cfg_noffset, NULL));
+ 	ret = fit_config_verify(fit, cfg_noffset);
+ 	if (ret)
+ 		return ret;
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0003-image-Return-an-error-message-from-fit_config_verify.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0003-image-Return-an-error-message-from-fit_config_verify.patch
new file mode 100644
index 000000000..5f82abeda
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0003-image-Return-an-error-message-from-fit_config_verify.patch
@@ -0,0 +1,39 @@
+From 2fa27334977ba688f17edb6b66c8eb355d4a53a5 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] image: Return an error message from fit_config_verify_sig()
+
+This function only returns an error message sometimes. Update it to always
+return an error message if one is available. This makes it easier to see
+what went wrong.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ common/image-sig.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/common/image-sig.c b/common/image-sig.c
+index 4f6b4ec412c3..48c89f930276 100644
+--- a/common/image-sig.c
++++ b/common/image-sig.c
+@@ -470,13 +470,14 @@ static int fit_config_verify_sig(const void *fit, int conf_noffset,
+ 		goto error;
+ 	}
+ 
+-	return verified ? 0 : -EPERM;
++	if (verified)
++		return 0;
+ 
+ error:
+ 	printf(" error!\n%s for '%s' hash node in '%s' config node\n",
+ 	       err_msg, fit_get_name(fit, noffset, NULL),
+ 	       fit_get_name(fit, conf_noffset, NULL));
+-	return -1;
++	return -EPERM;
+ }
+ 
+ int fit_config_verify_required_sigs(const void *fit, int conf_noffset,
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0007-image-Check-hash-nodes-when-checking-configurations.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0007-image-Check-hash-nodes-when-checking-configurations.patch
new file mode 100644
index 000000000..9dd5e6668
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0007-image-Check-hash-nodes-when-checking-configurations.patch
@@ -0,0 +1,97 @@
+From c7c1af4f9996986f05ced17694b68a575eda328e Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] image: Check hash-nodes when checking configurations
+
+It is currently possible to use a different configuration's signature and
+thus bypass the configuration check. Make sure that the configuration node
+that was hashed matches the one being checked, to catch this problem.
+
+Also add a proper function comment to fit_config_check_sig() and make it
+static.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ common/image-sig.c | 36 +++++++++++++++++++++++++++++++++---
+ 1 file changed, 33 insertions(+), 3 deletions(-)
+
+diff --git a/common/image-sig.c b/common/image-sig.c
+index 48c89f930276..4526c82acf75 100644
+--- a/common/image-sig.c
++++ b/common/image-sig.c
+@@ -330,20 +330,39 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
+ 	return 0;
+ }
+ 
+-int fit_config_check_sig(const void *fit, int noffset, int required_keynode,
+-			 char **err_msgp)
++/**
++ * fit_config_check_sig() - Check the signature of a config
++ *
++ * @fit: FIT to check
++ * @noffset: Offset of configuration node (e.g. /configurations/conf-1)
++ * @required_keynode:	Offset in the control FDT of the required key node,
++ *			if any. If this is given, then the configuration wil not
++ *			pass verification unless that key is used. If this is
++ *			-1 then any signature will do.
++ * @conf_noffset: Offset of the configuration subnode being checked (e.g.
++ *	 /configurations/conf-1/kernel)
++ * @err_msgp:		In the event of an error, this will be pointed to a
++ *			help error string to display to the user.
++ * @return 0 if all verified ok, <0 on error
++ */
++static int fit_config_check_sig(const void *fit, int noffset,
++				int required_keynode, int conf_noffset,
++				char **err_msgp)
+ {
+ 	char * const exc_prop[] = {"data"};
+ 	const char *prop, *end, *name;
+ 	struct image_sign_info info;
+ 	const uint32_t *strings;
++	const char *config_name;
+ 	uint8_t *fit_value;
+ 	int fit_value_len;
++	bool found_config;
+ 	int max_regions;
+ 	int i, prop_len;
+ 	char path[200];
+ 	int count;
+ 
++	config_name = fit_get_name(fit, conf_noffset, NULL);
+ 	debug("%s: fdt=%p, conf='%s', sig='%s'\n", __func__, gd_fdt_blob(),
+ 	      fit_get_name(fit, noffset, NULL),
+ 	      fit_get_name(gd_fdt_blob(), required_keynode, NULL));
+@@ -384,9 +403,20 @@ int fit_config_check_sig(const void *fit, int noffset, int required_keynode,
+ 	char *node_inc[count];
+ 
+ 	debug("Hash nodes (%d):\n", count);
++	found_config = false;
+ 	for (name = prop, i = 0; name < end; name += strlen(name) + 1, i++) {
+ 		debug("   '%s'\n", name);
+ 		node_inc[i] = (char *)name;
++		if (!strncmp(FIT_CONFS_PATH, name, strlen(FIT_CONFS_PATH)) &&
++		    name[sizeof(FIT_CONFS_PATH) - 1] == '/' &&
++		    !strcmp(name + sizeof(FIT_CONFS_PATH), config_name)) {
++			debug("      (found config node %s)", config_name);
++			found_config = true;
++		}
++	}
++	if (!found_config) {
++		*err_msgp = "Selected config not in hashed nodes";
++		return -1;
+ 	}
+ 
+ 	/*
+@@ -454,7 +484,7 @@ static int fit_config_verify_sig(const void *fit, int conf_noffset,
+ 		if (!strncmp(name, FIT_SIG_NODENAME,
+ 			     strlen(FIT_SIG_NODENAME))) {
+ 			ret = fit_config_check_sig(fit, noffset, sig_offset,
+-						   &err_msg);
++						   conf_noffset, &err_msg);
+ 			if (ret) {
+ 				puts("- ");
+ 			} else {
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0008-image-Load-the-correct-configuration-in-fit_check_si.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0008-image-Load-the-correct-configuration-in-fit_check_si.patch
new file mode 100644
index 000000000..9a6b64b06
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0008-image-Load-the-correct-configuration-in-fit_check_si.patch
@@ -0,0 +1,51 @@
+From 0b274994cc0fe1631c27837a4e4c546b37d7dc77 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] image: Load the correct configuration in fit_check_sign
+
+At present bootm_host_load_images() is passed the configuration that has
+been verified, but ignores it and just uses the default configuration.
+This may not be the same.
+
+Update this function to use the selected configuration.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ common/bootm.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/common/bootm.c b/common/bootm.c
+index 3adbceaa38e3..29091be0a1c8 100644
+--- a/common/bootm.c
++++ b/common/bootm.c
+@@ -929,7 +929,8 @@ void memmove_wd(void *to, void *from, size_t len, ulong chunksz)
+ 	memmove(to, from, len);
+ }
+ 
+-static int bootm_host_load_image(const void *fit, int req_image_type)
++static int bootm_host_load_image(const void *fit, int req_image_type,
++				 int cfg_noffset)
+ {
+ 	const char *fit_uname_config = NULL;
+ 	ulong data, len;
+@@ -941,6 +942,7 @@ static int bootm_host_load_image(const void *fit, int req_image_type)
+ 	void *load_buf;
+ 	int ret;
+ 
++	fit_uname_config = fdt_get_name(fit, cfg_noffset, NULL);
+ 	memset(&images, '\0', sizeof(images));
+ 	images.verify = 1;
+ 	noffset = fit_image_load(&images, (ulong)fit,
+@@ -985,7 +987,7 @@ int bootm_host_load_images(const void *fit, int cfg_noffset)
+ 	for (i = 0; i < ARRAY_SIZE(image_types); i++) {
+ 		int ret;
+ 
+-		ret = bootm_host_load_image(fit, image_types[i]);
++		ret = bootm_host_load_image(fit, image_types[i], cfg_noffset);
+ 		if (!err && ret && ret != -ENOENT)
+ 			err = ret;
+ 	}
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0009-fit_check_sign-Allow-selecting-the-configuration-to-.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0009-fit_check_sign-Allow-selecting-the-configuration-to-.patch
new file mode 100644
index 000000000..3094e7ecc
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0009-fit_check_sign-Allow-selecting-the-configuration-to-.patch
@@ -0,0 +1,101 @@
+From 77b652268cacc0f114ba9e92b79e7ff372ec62ee Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] fit_check_sign: Allow selecting the configuration to verify
+
+This tool always verifies the default configuration. It is useful to be
+able to verify a specific one. Add a command-line flag for this and plumb
+the logic through.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ tools/fdt_host.h       | 3 ++-
+ tools/fit_check_sign.c | 8 ++++++--
+ tools/image-host.c     | 6 ++++--
+ 3 files changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/tools/fdt_host.h b/tools/fdt_host.h
+index 99b009b22109..15c07c7a96ed 100644
+--- a/tools/fdt_host.h
++++ b/tools/fdt_host.h
+@@ -27,6 +27,7 @@
+  */
+ int fdt_remove_unused_strings(const void *old, void *new);
+ 
+-int fit_check_sign(const void *working_fdt, const void *key);
++int fit_check_sign(const void *fit, const void *key,
++		   const char *fit_uname_config);
+ 
+ #endif /* __FDT_HOST_H__ */
+diff --git a/tools/fit_check_sign.c b/tools/fit_check_sign.c
+index 62adc751cbce..303e878ddb4d 100644
+--- a/tools/fit_check_sign.c
++++ b/tools/fit_check_sign.c
+@@ -41,6 +41,7 @@ int main(int argc, char **argv)
+ 	void *fit_blob;
+ 	char *fdtfile = NULL;
+ 	char *keyfile = NULL;
++	char *config_name = NULL;
+ 	char cmdname[256];
+ 	int ret;
+ 	void *key_blob;
+@@ -48,7 +49,7 @@ int main(int argc, char **argv)
+ 
+ 	strncpy(cmdname, *argv, sizeof(cmdname) - 1);
+ 	cmdname[sizeof(cmdname) - 1] = '\0';
+-	while ((c = getopt(argc, argv, "f:k:")) != -1)
++	while ((c = getopt(argc, argv, "f:k:c:")) != -1)
+ 		switch (c) {
+ 		case 'f':
+ 			fdtfile = optarg;
+@@ -56,6 +57,9 @@ int main(int argc, char **argv)
+ 		case 'k':
+ 			keyfile = optarg;
+ 			break;
++		case 'c':
++			config_name = optarg;
++			break;
+ 		default:
+ 			usage(cmdname);
+ 			break;
+@@ -78,7 +82,7 @@ int main(int argc, char **argv)
+ 		return EXIT_FAILURE;
+ 
+ 	image_set_host_blob(key_blob);
+-	ret = fit_check_sign(fit_blob, key_blob);
++	ret = fit_check_sign(fit_blob, key_blob, config_name);
+ 	if (!ret) {
+ 		ret = EXIT_SUCCESS;
+ 		fprintf(stderr, "Signature check OK\n");
+diff --git a/tools/image-host.c b/tools/image-host.c
+index 8e94ee8f3e31..28474bc7fc8b 100644
+--- a/tools/image-host.c
++++ b/tools/image-host.c
+@@ -734,12 +734,13 @@ int fit_add_verification_data(const char *keydir, void *keydest, void *fit,
+ }
+ 
+ #ifdef CONFIG_FIT_SIGNATURE
+-int fit_check_sign(const void *fit, const void *key)
++int fit_check_sign(const void *fit, const void *key,
++		   const char *fit_uname_config)
+ {
+ 	int cfg_noffset;
+ 	int ret;
+ 
+-	cfg_noffset = fit_conf_get_node(fit, NULL);
++	cfg_noffset = fit_conf_get_node(fit, fit_uname_config);
+ 	if (!cfg_noffset)
+ 		return -1;
+ 
+@@ -748,6 +749,7 @@ int fit_check_sign(const void *fit, const void *key)
+ 	ret = fit_config_verify(fit, cfg_noffset);
+ 	if (ret)
+ 		return ret;
++	printf("Verified OK, loading images\n");
+ 	ret = bootm_host_load_images(fit, cfg_noffset);
+ 
+ 	return ret;
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0012-image-Use-constants-for-required-and-key-name-hint.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0012-image-Use-constants-for-required-and-key-name-hint.patch
new file mode 100644
index 000000000..6cdaaa656
--- /dev/null
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0012-image-Use-constants-for-required-and-key-name-hint.patch
@@ -0,0 +1,152 @@
+From b7249b8a036200cd461d0676a330b865f7309231 Mon Sep 17 00:00:00 2001
+From: Simon Glass <sjg@chromium.org>
+Date: Tue, 31 Mar 2020 18:43:55 +0200
+Subject: [PATCH] image: Use constants for 'required' and 'key-name-hint'
+
+These are used in multiple places so update them to use a shared #define.
+
+Signed-off-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+---
+ common/image-fit.c | 6 +++---
+ common/image-sig.c | 8 +++++---
+ include/image.h    | 4 +++-
+ lib/rsa/rsa-sign.c | 6 +++---
+ tools/image-host.c | 6 +++---
+ 5 files changed, 17 insertions(+), 13 deletions(-)
+
+diff --git a/common/image-fit.c b/common/image-fit.c
+index 58923cbc9371..b2f41ba408be 100644
+--- a/common/image-fit.c
++++ b/common/image-fit.c
+@@ -166,7 +166,7 @@ static void fit_image_print_data(const void *fit, int noffset, const char *p,
+ 	int value_len;
+ 	char *algo;
+ 	const char *padding;
+-	int required;
++	bool required;
+ 	int ret, i;
+ 
+ 	debug("%s  %s node:    '%s'\n", p, type,
+@@ -177,8 +177,8 @@ static void fit_image_print_data(const void *fit, int noffset, const char *p,
+ 		return;
+ 	}
+ 	printf("%s", algo);
+-	keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
+-	required = fdt_getprop(fit, noffset, "required", NULL) != NULL;
++	keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
++	required = fdt_getprop(fit, noffset, FIT_KEY_REQUIRED, NULL) != NULL;
+ 	if (keyname)
+ 		printf(":%s", keyname);
+ 	if (required)
+diff --git a/common/image-sig.c b/common/image-sig.c
+index 4526c82acf75..e0987af4f5e8 100644
+--- a/common/image-sig.c
++++ b/common/image-sig.c
+@@ -200,7 +200,7 @@ static int fit_image_setup_verify(struct image_sign_info *info,
+ 		padding_name = RSA_DEFAULT_PADDING_NAME;
+ 
+ 	memset(info, '\0', sizeof(*info));
+-	info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
++	info->keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
+ 	info->fit = (void *)fit;
+ 	info->node_offset = noffset;
+ 	info->name = algo_name;
+@@ -311,7 +311,8 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
+ 		const char *required;
+ 		int ret;
+ 
+-		required = fdt_getprop(sig_blob, noffset, "required", NULL);
++		required = fdt_getprop(sig_blob, noffset, FIT_KEY_REQUIRED,
++				       NULL);
+ 		if (!required || strcmp(required, "image"))
+ 			continue;
+ 		ret = fit_image_verify_sig(fit, image_noffset, data, size,
+@@ -528,7 +529,8 @@ int fit_config_verify_required_sigs(const void *fit, int conf_noffset,
+ 		const char *required;
+ 		int ret;
+ 
+-		required = fdt_getprop(sig_blob, noffset, "required", NULL);
++		required = fdt_getprop(sig_blob, noffset, FIT_KEY_REQUIRED,
++				       NULL);
+ 		if (!required || strcmp(required, "conf"))
+ 			continue;
+ 		ret = fit_config_verify_sig(fit, conf_noffset, sig_blob,
+diff --git a/include/image.h b/include/image.h
+index 4b764d11c70d..afb9bea17c34 100644
+--- a/include/image.h
++++ b/include/image.h
+@@ -903,12 +903,14 @@ int booti_setup(ulong image, ulong *relocated_addr, ulong *size,
+ #define FIT_IMAGES_PATH		"/images"
+ #define FIT_CONFS_PATH		"/configurations"
+ 
+-/* hash/signature node */
++/* hash/signature/key node */
+ #define FIT_HASH_NODENAME	"hash"
+ #define FIT_ALGO_PROP		"algo"
+ #define FIT_VALUE_PROP		"value"
+ #define FIT_IGNORE_PROP		"uboot-ignore"
+ #define FIT_SIG_NODENAME	"signature"
++#define FIT_KEY_REQUIRED	"required"
++#define FIT_KEY_HINT		"key-name-hint"
+ 
+ /* image node */
+ #define FIT_DATA_PROP		"data"
+diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
+index fb5e07b56d8a..5f0f27d2f6f9 100644
+--- a/lib/rsa/rsa-sign.c
++++ b/lib/rsa/rsa-sign.c
+@@ -773,8 +773,8 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
+ 	}
+ 
+ 	if (!ret) {
+-		ret = fdt_setprop_string(keydest, node, "key-name-hint",
+-				 info->keyname);
++		ret = fdt_setprop_string(keydest, node, FIT_KEY_HINT,
++					 info->keyname);
+ 	}
+ 	if (!ret)
+ 		ret = fdt_setprop_u32(keydest, node, "rsa,num-bits", bits);
+@@ -796,7 +796,7 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
+ 					 info->name);
+ 	}
+ 	if (!ret && info->require_keys) {
+-		ret = fdt_setprop_string(keydest, node, "required",
++		ret = fdt_setprop_string(keydest, node, FIT_KEY_REQUIRED,
+ 					 info->require_keys);
+ 	}
+ done:
+diff --git a/tools/image-host.c b/tools/image-host.c
+index 28474bc7fc8b..3396d8234e52 100644
+--- a/tools/image-host.c
++++ b/tools/image-host.c
+@@ -170,7 +170,7 @@ static int fit_image_setup_sig(struct image_sign_info *info,
+ 
+ 	memset(info, '\0', sizeof(*info));
+ 	info->keydir = keydir;
+-	info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
++	info->keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
+ 	info->fit = fit;
+ 	info->node_offset = noffset;
+ 	info->name = strdup(algo_name);
+@@ -249,7 +249,7 @@ static int fit_image_process_sig(const char *keydir, void *keydest,
+ 	free(value);
+ 
+ 	/* Get keyname again, as FDT has changed and invalidated our pointer */
+-	info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
++	info.keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
+ 
+ 	/*
+ 	 * Write the public key into the supplied FDT file; this might fail
+@@ -630,7 +630,7 @@ static int fit_config_process_sig(const char *keydir, void *keydest,
+ 	free(region_prop);
+ 
+ 	/* Get keyname again, as FDT has changed and invalidated our pointer */
+-	info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
++	info.keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
+ 
+ 	/* Write the public key into the supplied FDT file */
+ 	if (keydest) {
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/intel.cfg b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/intel.cfg
index ceaf62800..d16227937 100644
--- a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/intel.cfg
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/intel.cfg
@@ -24,4 +24,6 @@ CONFIG_EFI_PARTITION=n
 CONFIG_USB=n
 CONFIG_DM_USB=n
 CONFIG_USB_EHCI_HCD=n
-CONFIG_USB_STORAGE=n
\ No newline at end of file
+CONFIG_USB_STORAGE=n
+CONFIG_NETCONSOLE=n
+CONFIG_CMD_NFS=n
\ No newline at end of file
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/u-boot-aspeed-sdk_%.bbappend b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/u-boot-aspeed-sdk_%.bbappend
index 01f904a13..ce22b2057 100644
--- a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/u-boot-aspeed-sdk_%.bbappend
+++ b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/u-boot-aspeed-sdk_%.bbappend
@@ -1,5 +1,6 @@
 COMPATIBLE_MACHINE = "intel-ast2600"
 FILESEXTRAPATHS_append_intel-ast2600:= "${THISDIR}/files:"
+FILESEXTRAPATHS_append_intel-ast2600:= "${THISDIR}/files/CVE-2020-10648:"
 
 # the meta-phosphor layer adds this patch, which conflicts
 # with the intel layout for environment
@@ -21,6 +22,23 @@ SRC_URI_append_intel-ast2600 = " \
     file://0013-Add-a-workaround-to-cover-UART-interrupt-bug-in-AST2.patch \
     file://0014-Add-a-workaround-to-cover-eSPI-OOB-free-bug-in-AST26.patch \
     file://0015-net-phy-realtek-Change-LED-configuration.patch \
+    file://0016-Add-system-reset-status-support.patch \
+    file://0017-Manufacturing-mode-physical-presence-detection.patch \
+    file://0018-Add-a-workaround-to-cover-VGA-memory-size-bug-in-A0.patch \
+    file://0019-Apply-WDT-reset-mask-to-reset-needed-controller.patch \
+    file://0020-Add-BMC-running-indicator-LED-control.patch \
+    file://0022-Reboot-into-UBOOT-on-Watchdog-Failures.patch \
+    "
+
+# CVE-2020-10648 vulnerability fix
+SRC_URI_append_intel-ast2600 = " \
+    file://0001-image-Correct-comment-for-fit_conf_get_node.patch \
+    file://0002-image-Be-a-little-more-verbose-when-checking-signatu.patch \
+    file://0003-image-Return-an-error-message-from-fit_config_verify.patch \
+    file://0007-image-Check-hash-nodes-when-checking-configurations.patch \
+    file://0008-image-Load-the-correct-configuration-in-fit_check_si.patch \
+    file://0009-fit_check_sign-Allow-selecting-the-configuration-to-.patch \
+    file://0012-image-Use-constants-for-required-and-key-name-hint.patch \
     "
 
 PFR_SRC_URI = " \
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-phosphor/configuration/entity-manager/AC-Baseboard.json b/meta-openbmc-mods/meta-ast2600/recipes-phosphor/configuration/entity-manager/AC-Baseboard.json
index 6e1b3a22b..add4ca372 100644
--- a/meta-openbmc-mods/meta-ast2600/recipes-phosphor/configuration/entity-manager/AC-Baseboard.json
+++ b/meta-openbmc-mods/meta-ast2600/recipes-phosphor/configuration/entity-manager/AC-Baseboard.json
@@ -226,15 +226,15 @@
             "Type": "ADC"
         },
         {
-            "Index": 7,
-            "BridgeGPIO": [
+            "BridgeGpio": [
                 {
                     "Name": "A_P3V_BAT_SCALED_EN",
                     "Polarity": "High"
                 }
             ],
+            "Index": 7,
             "Name": "P3VBAT",
-            "ScaleFactor": 0.3333,
+            "ScaleFactor": 0.1111,
             "Thresholds": [
                 {
                     "Direction": "greater than",
@@ -266,7 +266,7 @@
         {
             "CPURequired": 1,
             "Index": 8,
-            "Name": "PVCCIN_CPU0",
+            "Name": "PVCCIN_CPU1",
             "PowerState": "On",
             "ScaleFactor": 0.7505,
             "Thresholds": [
@@ -300,7 +300,7 @@
         {
             "CPURequired": 2,
             "Index": 9,
-            "Name": "PVCCIN_CPU1",
+            "Name": "PVCCIN_CPU2",
             "PowerState": "On",
             "ScaleFactor": 0.7505,
             "Thresholds": [
@@ -334,7 +334,7 @@
         {
             "CPURequired": 1,
             "Index": 10,
-            "Name": "PVCCINFAON_CPU0",
+            "Name": "PVCCINFAON_CPU1",
             "PowerState": "On",
             "Thresholds": [
                 {
@@ -367,7 +367,7 @@
         {
             "CPURequired": 2,
             "Index": 11,
-            "Name": "PVCCINFAON_CPU1",
+            "Name": "PVCCINFAON_CPU2",
             "PowerState": "On",
             "Thresholds": [
                 {
@@ -400,7 +400,7 @@
         {
             "CPURequired": 1,
             "Index": 12,
-            "Name": "PVCCFA_EHV_FIVRA_CPU0",
+            "Name": "PVCCFA_EHV_FIVRA_CPU1",
             "PowerState": "On",
             "Thresholds": [
                 {
@@ -433,7 +433,7 @@
         {
             "CPURequired": 2,
             "Index": 13,
-            "Name": "PVCCFA_EHV_FIVRA_CPU1",
+            "Name": "PVCCFA_EHV_FIVRA_CPU2",
             "PowerState": "On",
             "Thresholds": [
                 {
@@ -466,7 +466,7 @@
         {
             "CPURequired": 1,
             "Index": 14,
-            "Name": "PVCCD_HV_CPU0",
+            "Name": "PVCCD_HV_CPU1",
             "PowerState": "On",
             "Thresholds": [
                 {
@@ -499,7 +499,7 @@
         {
             "CPURequired": 2,
             "Index": 15,
-            "Name": "PVCCD_HV_CPU1",
+            "Name": "PVCCD_HV_CPU2",
             "PowerState": "On",
             "Thresholds": [
                 {
@@ -745,7 +745,7 @@
         {
             "Address": "0xC4",
             "Class": "MpsBridgeTemp",
-            "Name": "CPU0 VCCIN VR Temp",
+            "Name": "CPU1 VCCIN VR Temp",
             "Thresholds": [
                 {
                     "Direction": "greater than",
@@ -777,7 +777,7 @@
         {
             "Address": "0xE0",
             "Class": "PxeBridgeTemp",
-            "Name": "CPU0 PVCCFA_EHV_FIVRA VR Temp",
+            "Name": "CPU1 PVCCFA_EHV_FIVRA VR Temp",
             "Thresholds": [
                 {
                     "Direction": "greater than",
@@ -809,7 +809,7 @@
         {
             "Address": "0xF0",
             "Class": "PxeBridgeTemp",
-            "Name": "CPU0 PVCCD VR Temp",
+            "Name": "CPU1 PVCCD VR Temp",
             "Thresholds": [
                 {
                     "Direction": "greater than",
@@ -841,7 +841,7 @@
         {
             "Address": "0xC0",
             "Class": "MpsBridgeTemp",
-            "Name": "CPU1 PVCCIN VR Temp",
+            "Name": "CPU2 PVCCIN VR Temp",
             "Thresholds": [
                 {
                     "Direction": "greater than",
@@ -873,7 +873,7 @@
         {
             "Address": "0xE8",
             "Class": "PxeBridgeTemp",
-            "Name": "CPU1 PVCCFA_EHV_FIVRA VR Temp",
+            "Name": "CPU2 PVCCFA_EHV_FIVRA VR Temp",
             "Thresholds": [
                 {
                     "Direction": "greater than",
@@ -903,9 +903,9 @@
             "Type": "IpmbSensor"
         },
         {
-            "Address": "0F4",
+            "Address": "0xF4",
             "Class": "PxeBridgeTemp",
-            "Name": "CPU1 PVCCD VR Temp",
+            "Name": "CPU2 PVCCD VR Temp",
             "Thresholds": [
                 {
                     "Direction": "greater than",
@@ -993,7 +993,7 @@
             "Name": "Fan 1",
             "NegativeHysteresis": 0.0,
             "OutLimitMax": 100.0,
-            "OutLimitMin": 30.0,
+            "OutLimitMin": 70.0,
             "Outputs": [
                 "Pwm 1"
             ],
@@ -1019,7 +1019,7 @@
             "Name": "Fan 2",
             "NegativeHysteresis": 0.0,
             "OutLimitMax": 100.0,
-            "OutLimitMin": 30.0,
+            "OutLimitMin": 70.0,
             "Outputs": [
                 "Pwm 2"
             ],
@@ -1045,7 +1045,7 @@
             "Name": "Fan 3",
             "NegativeHysteresis": 0.0,
             "OutLimitMax": 100.0,
-            "OutLimitMin": 30.0,
+            "OutLimitMin": 70.0,
             "Outputs": [
                 "Pwm 3"
             ],
@@ -1071,7 +1071,7 @@
             "Name": "Fan 4",
             "NegativeHysteresis": 0.0,
             "OutLimitMax": 100.0,
-            "OutLimitMin": 30.0,
+            "OutLimitMin": 70.0,
             "Outputs": [
                 "Pwm 4"
             ],
@@ -1097,7 +1097,7 @@
             "Name": "Fan 5",
             "NegativeHysteresis": 0.0,
             "OutLimitMax": 100.0,
-            "OutLimitMin": 30.0,
+            "OutLimitMin": 70.0,
             "Outputs": [
                 "Pwm 5"
             ],
@@ -1123,7 +1123,7 @@
             "Name": "Fan 6",
             "NegativeHysteresis": 0.0,
             "OutLimitMax": 100.0,
-            "OutLimitMin": 30.0,
+            "OutLimitMin": 70.0,
             "Outputs": [
                 "Pwm 6"
             ],
@@ -1149,7 +1149,7 @@
             "Name": "Fan 7",
             "NegativeHysteresis": 0.0,
             "OutLimitMax": 100.0,
-            "OutLimitMin": 30.0,
+            "OutLimitMin": 70.0,
             "Outputs": [
                 "Pwm 13"
             ],
@@ -1175,7 +1175,7 @@
             "Name": "Fan 8",
             "NegativeHysteresis": 0.0,
             "OutLimitMax": 100.0,
-            "OutLimitMin": 30.0,
+            "OutLimitMin": 70.0,
             "Outputs": [
                 "Pwm 14"
             ],
@@ -1201,7 +1201,7 @@
             "Name": "Fan 9",
             "NegativeHysteresis": 0.0,
             "OutLimitMax": 100.0,
-            "OutLimitMin": 30.0,
+            "OutLimitMin": 70.0,
             "Outputs": [
                 "Pwm 15"
             ],
@@ -1227,7 +1227,7 @@
             "Name": "Fan 10",
             "NegativeHysteresis": 0.0,
             "OutLimitMax": 100.0,
-            "OutLimitMin": 30.0,
+            "OutLimitMin": 70.0,
             "Outputs": [
                 "Pwm 16"
             ],
@@ -1273,9 +1273,9 @@
             "ILimitMax": 100,
             "ILimitMin": 30,
             "Inputs": [
-                "CPU0 North VR Temp"
+                "CPU1 North VR Temp"
             ],
-            "Name": "CPU0 North VR Temp",
+            "Name": "CPU1 North VR Temp",
             "NegativeHysteresis": 5.0,
             "OutLimitMax": 100,
             "OutLimitMin": 30,
@@ -1298,9 +1298,9 @@
             "ILimitMax": 100,
             "ILimitMin": 30,
             "Inputs": [
-                "CPU0 South VR Temp"
+                "CPU1 South VR Temp"
             ],
-            "Name": "CPU0 South VR Temp",
+            "Name": "CPU1 South VR Temp",
             "NegativeHysteresis": 5.0,
             "OutLimitMax": 100,
             "OutLimitMin": 30,
@@ -1323,9 +1323,9 @@
             "ILimitMax": 100,
             "ILimitMin": 30,
             "Inputs": [
-                "CPU1 North VR Temp"
+                "CPU2 North VR Temp"
             ],
-            "Name": "CPU1 North VR Temp",
+            "Name": "CPU2 North VR Temp",
             "NegativeHysteresis": 5.0,
             "OutLimitMax": 100,
             "OutLimitMin": 30,
@@ -1348,9 +1348,9 @@
             "ILimitMax": 100,
             "ILimitMin": 30,
             "Inputs": [
-                "CPU1 South VR Temp"
+                "CPU2 South VR Temp"
             ],
-            "Name": "CPU1 South VR Temp",
+            "Name": "CPU2 South VR Temp",
             "NegativeHysteresis": 5.0,
             "OutLimitMax": 100,
             "OutLimitMin": 30,
@@ -1751,7 +1751,7 @@
         {
             "Address": "0x4C",
             "Bus": 6,
-            "Name": "CPU0 North VR Temp",
+            "Name": "CPU1 North VR Temp",
             "Thresholds": [
                 {
                     "Direction": "greater than",
@@ -1783,7 +1783,7 @@
         {
             "Address": "0x4D",
             "Bus": 6,
-            "Name": "CPU0 South VR Temp",
+            "Name": "CPU1 South VR Temp",
             "Thresholds": [
                 {
                     "Direction": "greater than",
@@ -1815,7 +1815,7 @@
         {
             "Address": "0x4E",
             "Bus": 6,
-            "Name": "CPU1 North VR Temp",
+            "Name": "CPU2 North VR Temp",
             "Thresholds": [
                 {
                     "Direction": "greater than",
@@ -1847,7 +1847,7 @@
         {
             "Address": "0x4F",
             "Bus": 6,
-            "Name": "CPU1 South VR Temp",
+            "Name": "CPU2 South VR Temp",
             "Thresholds": [
                 {
                     "Direction": "greater than",
@@ -2050,6 +2050,12 @@
                 "PinName": "DBP_PRESENT_IN_R2_N"
             },
             "Type": "ASD"
+        },
+        {
+            "Address": "0x38",
+            "Bus": 4,
+            "Name": "PFR",
+            "Type": "PFR"
         }
     ],
     "Name": "AC Baseboard",
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-phosphor/console/obmc-console/obmc-console.conf b/meta-openbmc-mods/meta-ast2600/recipes-phosphor/console/obmc-console/obmc-console.conf
deleted file mode 100644
index 8491f5365..000000000
--- a/meta-openbmc-mods/meta-ast2600/recipes-phosphor/console/obmc-console/obmc-console.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-baud = 115200
-local-tty = ttyS3
-local-tty-baud = 115200
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-phosphor/console/obmc-console/sol-option-check.sh b/meta-openbmc-mods/meta-ast2600/recipes-phosphor/console/obmc-console/sol-option-check.sh
deleted file mode 100755
index ef32fcb9a..000000000
--- a/meta-openbmc-mods/meta-ast2600/recipes-phosphor/console/obmc-console/sol-option-check.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/bin/sh
-
-# Copyright 2017 Intel Corporation
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-#
-
-if [ $(grep 192000000 /sys/class/tty/ttyS0/uartclk | wc -l) != 0 ]; then
-  echo "hs-uart"
-  sed -i -e 's/115200/921600/g' /etc/obmc-console.conf
-else
-  echo "normal uart"
-  sed -i -e 's/921600/115200/g' /etc/obmc-console.conf
-fi
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-phosphor/console/obmc-console_%.bbappend b/meta-openbmc-mods/meta-ast2600/recipes-phosphor/console/obmc-console_%.bbappend
deleted file mode 100644
index 7b6a47dac..000000000
--- a/meta-openbmc-mods/meta-ast2600/recipes-phosphor/console/obmc-console_%.bbappend
+++ /dev/null
@@ -1,16 +0,0 @@
-FILESEXTRAPATHS_prepend_intel-ast2600 := "${THISDIR}/${PN}:"
-OBMC_CONSOLE_HOST_TTY = "ttyS2"
-SRC_URI += "file://sol-option-check.sh \
-            file://obmc-console@.service \
-           "
-inherit obmc-phosphor-systemd
-
-SYSTEMD_SERVICE_${PN} += " \
-        ${PN}@${OBMC_CONSOLE_HOST_TTY}.service \
-        "
-do_install_append() {
-        rm -rf ${D}${base_libdir}/udev/rules.d/80-obmc-console-uart.rules
-        install -m 0644 ${WORKDIR}/${PN}@.service ${D}${systemd_system_unitdir}
-        install -d ${D}${bindir}
-        install -m 0755 ${WORKDIR}/sol-option-check.sh ${D}${bindir}
-}
diff --git a/meta-openbmc-mods/meta-common/classes/image_types_intel_pfr.bbclass b/meta-openbmc-mods/meta-common/classes/image_types_intel_pfr.bbclass
index 344dddd3d..e961ae463 100644
--- a/meta-openbmc-mods/meta-common/classes/image_types_intel_pfr.bbclass
+++ b/meta-openbmc-mods/meta-common/classes/image_types_intel_pfr.bbclass
@@ -38,6 +38,7 @@ do_image_pfr () {
     bbplain "Build Version = ${build_version}"
     bbplain "Build Number = ${build_number}"
     bbplain "Build Hash = ${build_hash}"
+    bbplain "Build SHA = ${SHA_NAME}"
 
     mkdir -p "${PFR_IMAGES_DIR}"
     cd "${PFR_IMAGES_DIR}"
@@ -77,7 +78,9 @@ do_image_pfr () {
     # artifacts and that makes fully qualified pathes break. Relative links
     # work because of the 'cd "${PFR_IMAGES_DIR}"' at the start of this section.
     ln -sf image-mtd-pfr-${DATETIME}.bin ${PFR_IMAGES_DIR}/image-mtd-pfr.bin
+    ln -sf image-mtd-pfr-${DATETIME}.bin ${PFR_IMAGES_DIR}/OBMC-${@ do_get_version(d)}-pfr-full.ROM
     ln -sf bmc_signed_cap-${DATETIME}.bin ${PFR_IMAGES_DIR}/bmc_signed_cap.bin
+    ln -sf bmc_signed_cap-${DATETIME}.bin ${PFR_IMAGES_DIR}/OBMC-${@ do_get_version(d)}-pfr-oob.bin
 }
 
 do_image_pfr[vardepsexclude] += "DATE DATETIME"
@@ -91,6 +94,7 @@ python() {
     product_gen = d.getVar('PRODUCT_GENERATION', True)
     if product_gen == "wht":
         d.setVar('SHA', "1")# 1- SHA256
+        d.setVar('SHA_NAME', "SHA256")
 
     types = d.getVar('IMAGE_FSTYPES', True).split()
 
diff --git a/meta-openbmc-mods/meta-common/classes/image_types_phosphor_auto.bbclass b/meta-openbmc-mods/meta-common/classes/image_types_phosphor_auto.bbclass
index f90a19c4b..0c32e0e53 100644
--- a/meta-openbmc-mods/meta-common/classes/image_types_phosphor_auto.bbclass
+++ b/meta-openbmc-mods/meta-common/classes/image_types_phosphor_auto.bbclass
@@ -60,6 +60,7 @@ do_generate_auto() {
     ln ${IMGDEPLOYDIR}/${IMAGE_NAME}.auto.mtd \
         ${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.auto.mtd
     ln -sf ${IMAGE_NAME}.auto.mtd ${DEPLOY_DIR_IMAGE}/image-mtd
+    ln -sf ${IMAGE_NAME}.auto.mtd ${DEPLOY_DIR_IMAGE}/OBMC-${@ do_get_version(d)}.ROM
 }
 do_generate_auto[dirs] = "${S}/auto"
 do_generate_auto[depends] += " \
diff --git a/meta-openbmc-mods/meta-common/classes/systemd-watchdog.bbclass b/meta-openbmc-mods/meta-common/classes/systemd-watchdog.bbclass
index c088fec34..ad49eed82 100644
--- a/meta-openbmc-mods/meta-common/classes/systemd-watchdog.bbclass
+++ b/meta-openbmc-mods/meta-common/classes/systemd-watchdog.bbclass
@@ -28,6 +28,12 @@ add_watchdog_confs() {
         echo "[Service]" >> "${fname}"
         echo "StartLimitInterval=${interval}min" >> "${fname}"
         echo "StartLimitBurst=${count}" >> "${fname}"
+        echo "RestartSec=60" >> "${fname}"
+
+        if cat $D/lib/systemd/system/${service} | grep Restart > /dev/null; then
+             continue
+        fi
+        echo "Restart=on-failure" >> "${fname}"
      done
 
 }
diff --git a/meta-openbmc-mods/meta-common/recipes-core/ac-boot-check/ac-boot-check/ac-boot-check.sh b/meta-openbmc-mods/meta-common/recipes-core/ac-boot-check/ac-boot-check/ac-boot-check.sh
index 38728b512..b9ea1127c 100644
--- a/meta-openbmc-mods/meta-common/recipes-core/ac-boot-check/ac-boot-check/ac-boot-check.sh
+++ b/meta-openbmc-mods/meta-common/recipes-core/ac-boot-check/ac-boot-check/ac-boot-check.sh
@@ -1,8 +1,23 @@
 #!/bin/sh
 
-if [[ `cat /proc/cmdline` =~ "resetreason=0x11" ]]
-then
-    busctl set-property xyz.openbmc_project.Settings /xyz/openbmc_project/control/host0/ac_boot xyz.openbmc_project.Common.ACBoot ACBoot s "True"
-else
-    busctl set-property xyz.openbmc_project.Settings /xyz/openbmc_project/control/host0/ac_boot xyz.openbmc_project.Common.ACBoot ACBoot s "False"
-fi
+bitWiseAnd() {
+    local IFS='&'
+    printf "%s\n" "$(( $* ))"
+}
+
+ACBOOT="False"
+
+while IFS=' ' read -ra OPTIONS; do
+  for i in "${OPTIONS[@]}"; do
+    while IFS='=' read option param; do
+      if [ "resetreason" == "$option" ]; then
+        if [ $(bitWiseAnd "$param" "0x1") -ne 0 ]; then
+          ACBOOT="True"
+        fi
+      fi
+    done <<< $i
+  done
+done < /proc/cmdline
+
+busctl set-property xyz.openbmc_project.Settings /xyz/openbmc_project/control/host0/ac_boot xyz.openbmc_project.Common.ACBoot ACBoot s "$ACBOOT"
+
diff --git a/meta-openbmc-mods/meta-common/recipes-core/busybox/busybox/enable.cfg b/meta-openbmc-mods/meta-common/recipes-core/busybox/busybox/enable.cfg
new file mode 100644
index 000000000..7e1b90da6
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-core/busybox/busybox/enable.cfg
@@ -0,0 +1 @@
+CONFIG_TRUNCATE=y
diff --git a/meta-openbmc-mods/meta-common/recipes-core/busybox/busybox_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/busybox/busybox_%.bbappend
index deb9ccbf8..c72975ccc 100644
--- a/meta-openbmc-mods/meta-common/recipes-core/busybox/busybox_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-core/busybox/busybox_%.bbappend
@@ -1,4 +1,7 @@
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
-SRC_URI += "file://disable.cfg"
+SRC_URI += " \
+           file://disable.cfg \
+           file://enable.cfg \
+		"
 
 SRC_URI += "${@bb.utils.contains('EXTRA_IMAGE_FEATURES', 'debug-tweaks','file://dev-only.cfg','',d)}"
diff --git a/meta-openbmc-mods/meta-common/recipes-core/crashdump/crashdump_git.bb b/meta-openbmc-mods/meta-common/recipes-core/crashdump/crashdump_git.bb
index b4875c332..184f6c0f1 100644
--- a/meta-openbmc-mods/meta-common/recipes-core/crashdump/crashdump_git.bb
+++ b/meta-openbmc-mods/meta-common/recipes-core/crashdump/crashdump_git.bb
@@ -7,7 +7,7 @@ DESCRIPTION = "CPU utilities for dumping CPU Crashdump and registers over PECI"
 DEPENDS = "boost cjson sdbusplus safec gtest libpeci"
 inherit cmake
 
-EXTRA_OECMAKE = "-DCRASHDUMP_BUILD_UT=ON"
+EXTRA_OECMAKE = "-DYOCTO_DEPENDENCIES=ON -DCRASHDUMP_BUILD_UT=OFF"
 
 LICENSE = "Proprietary"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=43c09494f6b77f344027eea0a1c22830"
diff --git a/meta-openbmc-mods/meta-common/recipes-core/fw-update/files/fwupd.sh b/meta-openbmc-mods/meta-common/recipes-core/fw-update/files/fwupd.sh
index 917e7ab09..96ec876cc 100644
--- a/meta-openbmc-mods/meta-common/recipes-core/fw-update/files/fwupd.sh
+++ b/meta-openbmc-mods/meta-common/recipes-core/fw-update/files/fwupd.sh
@@ -82,7 +82,7 @@ pfr_active_update() {
         systemctl start nv-sync.service || log "failed to start nv-sync"
         wait_for_log_sync
     fi
-    reboot
+    reboot -f
 }
 
 pfr_staging_update() {
@@ -268,7 +268,7 @@ ping_pong_update() {
     redfish_log_fw_evt success
     wait_for_log_sync
     # reboot
-    reboot
+    reboot -f
 }
 
 fetch_fw() {
diff --git a/meta-openbmc-mods/meta-common/recipes-core/host-error-monitor/host-error-monitor_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/host-error-monitor/host-error-monitor_%.bbappend
index cd42c9933..869cf5f2f 100644
--- a/meta-openbmc-mods/meta-common/recipes-core/host-error-monitor/host-error-monitor_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-core/host-error-monitor/host-error-monitor_%.bbappend
@@ -1,5 +1,5 @@
 # Enable downstream autobump
-SRC_URI = "git://github.com/openbmc/host-error-monitor"
-SRCREV = "5287c02c5f96b40f0941c9c72ab29d2c7ac44a96"
+#SRC_URI = "git://github.com/openbmc/host-error-monitor"
+SRCREV = "2fbb9eadeda2ae8a77ac53346b53f2d0a72f3e74"
 
 EXTRA_OECMAKE = "-DYOCTO=1"
diff --git a/meta-openbmc-mods/meta-common/recipes-core/interfaces/libmctp/0001-Smbus-changes-for-libmctp.patch b/meta-openbmc-mods/meta-common/recipes-core/interfaces/libmctp/0001-Smbus-changes-for-libmctp.patch
index 05bd4c055..d537b5db7 100644
--- a/meta-openbmc-mods/meta-common/recipes-core/interfaces/libmctp/0001-Smbus-changes-for-libmctp.patch
+++ b/meta-openbmc-mods/meta-common/recipes-core/interfaces/libmctp/0001-Smbus-changes-for-libmctp.patch
@@ -1,19 +1,20 @@
-From 1f14ea50ece39c59d23690690dc7c8b1059a35f6 Mon Sep 17 00:00:00 2001
+From 8e3ae96546010c5d4f3fce6df9c32aece1093458 Mon Sep 17 00:00:00 2001
 From: Nikhil Potade <nikhil.potade@linux.intel.com>
 Date: Tue, 19 Feb 2019 14:16:20 +0800
 Subject: [PATCH 1/1] Smbus changes for libmctp
 
 Signed-off-by: James Feist <james.feist@linux.intel.com>
+
 ---
  core.c    |  2 ++
  libmctp.h | 40 ++++++++++++++++++++++++++++++++++++++++
  2 files changed, 42 insertions(+)
 
 diff --git a/core.c b/core.c
-index e7f5689..3732e8a 100644
+index 6e59993..3b11672 100644
 --- a/core.c
 +++ b/core.c
-@@ -17,6 +17,7 @@
+@@ -19,6 +19,7 @@
  
  /* Internal data structures */
  
@@ -21,7 +22,7 @@ index e7f5689..3732e8a 100644
  struct mctp_bus {
  	mctp_eid_t		eid;
  	struct mctp_binding	*binding;
-@@ -56,6 +57,7 @@ struct mctp {
+@@ -58,6 +59,7 @@ struct mctp {
  		ROUTE_BRIDGE,
  	}			route_policy;
  };
@@ -30,18 +31,18 @@ index e7f5689..3732e8a 100644
  #ifndef BUILD_ASSERT
  #define BUILD_ASSERT(x) \
 diff --git a/libmctp.h b/libmctp.h
-index 69ec46a..b7212be 100644
+index 40e5371..766473b 100644
 --- a/libmctp.h
 +++ b/libmctp.h
-@@ -15,6 +15,7 @@ extern "C" {
- typedef uint8_t mctp_eid_t;
+@@ -19,6 +19,7 @@ typedef uint8_t mctp_eid_t;
+ #define MCTP_EID_BROADCAST 0xff
  
  /* MCTP packet definitions */
 +/* clang-format off */
  struct mctp_hdr {
  	uint8_t	ver;
  	uint8_t	dest;
-@@ -30,19 +31,56 @@ struct mctp_hdr {
+@@ -34,20 +35,57 @@ struct mctp_hdr {
  #define MCTP_HDR_SEQ_MASK	(0x3)
  #define MCTP_HDR_TAG_SHIFT	(0)
  #define MCTP_HDR_TAG_MASK	(0x7)
@@ -50,6 +51,7 @@ index 69ec46a..b7212be 100644
  /* Baseline Transmission Unit and packet size */
  #define MCTP_BTU		64
  #define MCTP_PACKET_SIZE(unit)	((unit) + sizeof(struct mctp_hdr))
+ #define MCTP_BODY_SIZE(unit)	((unit) - sizeof(struct mctp_hdr))
  
 +#define MCTP_CONTROL_MESSAGE_TYPE	0x00
 +
@@ -98,17 +100,17 @@ index 69ec46a..b7212be 100644
  
  struct mctp_binding;
  
-@@ -90,6 +128,7 @@ int mctp_message_tx(struct mctp *mctp, mctp_eid_t eid,
+@@ -96,6 +134,7 @@ int mctp_message_tx(struct mctp *mctp, mctp_eid_t eid,
  		void *msg, size_t msg_len);
  
  /* hardware bindings */
 +/* clang-format off */
  struct mctp_binding {
- 	const char	*name;
- 	uint8_t		version;
-@@ -101,6 +140,7 @@ struct mctp_binding {
- 	int		(*tx)(struct mctp_binding *binding,
- 				struct mctp_pktbuf *pkt);
+ 	const char *name;
+ 	uint8_t version;
+@@ -108,6 +147,7 @@ struct mctp_binding {
+ 	mctp_rx_fn control_rx;
+ 	void *control_rx_data;
  };
 +/* clang-format on */
  
diff --git a/meta-openbmc-mods/meta-common/recipes-core/interfaces/libmctp/0002-Fix-Memory-Leak.patch b/meta-openbmc-mods/meta-common/recipes-core/interfaces/libmctp/0002-Fix-Memory-Leak.patch
new file mode 100644
index 000000000..52acac1ab
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-core/interfaces/libmctp/0002-Fix-Memory-Leak.patch
@@ -0,0 +1,36 @@
+From bda505bc62f95ee927b75f87c52e04584dab4d79 Mon Sep 17 00:00:00 2001
+From: James Feist <james.feist@linux.intel.com>
+Date: Fri, 26 Jun 2020 13:50:08 -0700
+Subject: [PATCH 1/1] Fix Memory Leak
+
+In mctp_send_tx_queue if rc is of an error,
+the packet does not get freed, causing a leak.
+
+Change-Id: Ic39b0920b454608841e6e879cc028e455520e67d
+Signed-off-by: James Feist <james.feist@linux.intel.com>
+---
+ core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/core.c b/core.c
+index 6e59993..c251b72 100644
+--- a/core.c
++++ b/core.c
+@@ -543,11 +543,11 @@ static void mctp_send_tx_queue(struct mctp_bus *bus)
+ 		int rc;
+ 
+ 		rc = mctp_packet_tx(bus, pkt);
+-		if (rc)
+-			break;
+-
+ 		bus->tx_queue_head = pkt->next;
+ 		mctp_pktbuf_free(pkt);
++
++		if (rc)
++			break;
+ 	}
+ 
+ 	if (!bus->tx_queue_head)
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-common/recipes-core/interfaces/libmctp_git.bb b/meta-openbmc-mods/meta-common/recipes-core/interfaces/libmctp_git.bb
index aa5a8e8b7..170fbdff9 100644
--- a/meta-openbmc-mods/meta-common/recipes-core/interfaces/libmctp_git.bb
+++ b/meta-openbmc-mods/meta-common/recipes-core/interfaces/libmctp_git.bb
@@ -2,7 +2,7 @@ SUMMARY = "libmctp"
 DESCRIPTION = "Implementation of MCTP (DTMF DSP0236)"
 
 SRC_URI = "git://github.com/openbmc/libmctp.git"
-SRCREV = "8d53b1c368b5d498c4f241b2b492210780010bb9"
+SRCREV = "3ac70d62571953be172a0d16976e383490d25059"
 
 PV = "0.1+git${SRCPV}"
 
@@ -21,6 +21,7 @@ CFLAGS_append = " -I ${STAGING_KERNEL_DIR}/include"
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
 
 SRC_URI += "file://0001-Smbus-changes-for-libmctp.patch \
+            file://0002-Fix-Memory-Leak.patch \
             file://CMakeLists.txt \
             file://crc32c.c \
             file://crc32c.h  \
diff --git a/meta-openbmc-mods/meta-common/recipes-core/ipmi/intel-ipmi-oem_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/ipmi/intel-ipmi-oem_%.bbappend
index f49f33873..13171277b 100644
--- a/meta-openbmc-mods/meta-common/recipes-core/ipmi/intel-ipmi-oem_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-core/ipmi/intel-ipmi-oem_%.bbappend
@@ -2,4 +2,4 @@ EXTRA_OECMAKE += "${@bb.utils.contains('IMAGE_FSTYPES', 'intel-pfr', '-DINTEL_PF
 EXTRA_OECMAKE += "${@bb.utils.contains('EXTRA_IMAGE_FEATURES', 'validation-unsecure', '-DBMC_VALIDATION_UNSECURE_FEATURE=ON', '', d)}"
 EXTRA_OECMAKE += "-DUSING_ENTITY_MANAGER_DECORATORS=OFF"
 SRC_URI = "git://github.com/openbmc/intel-ipmi-oem.git"
-SRCREV = "fcd2d3a943c4fb518d399d8a0addd1cc661e5628"
+SRCREV = "2030d7c8ebb6ccdbc300bf4967647a3b496c9726"
diff --git a/meta-openbmc-mods/meta-common/recipes-core/libpeci/libpeci_%.bbappend b/meta-openbmc-mods/meta-common/recipes-core/libpeci/libpeci_%.bbappend
index ba549b324..2bb0dcd30 100644
--- a/meta-openbmc-mods/meta-common/recipes-core/libpeci/libpeci_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-core/libpeci/libpeci_%.bbappend
@@ -1,3 +1,3 @@
 # Enable downstream autobump
 SRC_URI = "git://github.com/openbmc/libpeci"
-SRCREV = "a2ceec2aa139277cebb62e1eda449ef60fa4c962"
+SRCREV = "c965e72c6765e054531c1ab91e7fa13f04651f21"
diff --git a/meta-openbmc-mods/meta-common/recipes-extended/pam/libpam_%.bbappend b/meta-openbmc-mods/meta-common/recipes-extended/pam/libpam_%.bbappend
new file mode 100644
index 000000000..3c1c501ee
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-extended/pam/libpam_%.bbappend
@@ -0,0 +1 @@
+RDEPENDS_${PN}-runtime += "${MLPREFIX}pam-plugin-localuser-${libpam_suffix}"
diff --git a/meta-openbmc-mods/meta-common/recipes-graphics/libvncserver/libvncserver_%.bbappend b/meta-openbmc-mods/meta-common/recipes-graphics/libvncserver/libvncserver_%.bbappend
index 2f877ed53..d25bb7753 100644
--- a/meta-openbmc-mods/meta-common/recipes-graphics/libvncserver/libvncserver_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-graphics/libvncserver/libvncserver_%.bbappend
@@ -1,5 +1,5 @@
 FILESEXTRAPATHS_append := ":${THISDIR}/${PN}"
 
 # Use the latest to support obmc-ikvm properly
-SRC_URI = "git://github.com/LibVNC/libvncserver;nobranch=1"
-SRCREV = "ce9ae99b370d76521add190a8ca593aa6e3114dd"
+SRC_URI = "git://github.com/LibVNC/libvncserver"
+SRCREV = "38fd347afb6e2b720fdc0dc43bb3e5f179d0ce4e"
diff --git a/meta-openbmc-mods/meta-common/recipes-intel/hsbp/hsbp-manager_git.bb b/meta-openbmc-mods/meta-common/recipes-intel/hsbp/hsbp-manager_git.bb
index a83a2c5f9..3a25900d5 100644
--- a/meta-openbmc-mods/meta-common/recipes-intel/hsbp/hsbp-manager_git.bb
+++ b/meta-openbmc-mods/meta-common/recipes-intel/hsbp/hsbp-manager_git.bb
@@ -2,7 +2,7 @@ SUMMARY = "HSBP Manager"
 DESCRIPTION = "HSBP Manager monitors HSBPs through SMBUS"
 
 SRC_URI = "git://github.com/openbmc/s2600wf-misc.git"
-SRCREV = "b688f3f460b78643b95dd80de3100f2373793200"
+SRCREV = "7045b4b283cf1405e832641fb79fcfb2b07c1acb"
 PV = "0.1+git${SRCPV}"
 
 LICENSE = "Apache-2.0"
diff --git a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/pfr_image.py b/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/pfr_image.py
index 438a3b91f..b69639f32 100755
--- a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/pfr_image.py
+++ b/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/pfr_image.py
@@ -44,12 +44,9 @@ EXCLUDE_PAGES =[[0x80, 0x9f],[0x2a00,0x7fff]]
 PFM_OFFSET = 0x80000
 PFM_SPI = 0x1
 PFM_I2C = 0x2
-SHA = 0x1
 PFM_DEF_SIZE = 32 # 32 bytes of PFM header
 PFM_SPI_SIZE_DEF = 16 # 16 bytes of SPI PFM
-PFM_SPI_SIZE_HASH = 32 # 32 bytes of SPI region HASH
 PFM_I2C_SIZE = 40 # 40 bytes of i2c rules region in PFM
-
 PAGE_SIZE = 0x1000 # 4KB size of page
 
 def load_manifest(fname):
@@ -64,6 +61,10 @@ class pfm_spi(object):
         self.spi_pfm = PFM_SPI
         self.spi_prot_mask = prot_mask
         self.spi_hash_pres = hash_pres
+        print("hash_pres={}".format(self.spi_hash_pres))
+        print("spi_hash={}".format(hash))
+        print("spi_start_addr={}".format(start_addr))
+        print("spi_end_addr={}".format(end_addr))
         if hash_pres != 0:
             self.spi_hash = hash
         self.spi_pfm_rsvd = 0xffffffff        # b'\xff'*4
@@ -92,11 +93,11 @@ class pfr_bmc_image(object):
         self.build_hash = build_hash
         self.sha = sha
         if self.sha == "2":
-            SHA = 0x2
-            PFM_SPI_SIZE_HASH = 48
+            self.sha_version = 0x2
+            self.pfm_spi_size_hash = 48
         if self.sha == "1":
-            PFM_SPI_SIZE_HASH = 32
-            SHA = 0x1
+            self.pfm_spi_size_hash = 32
+            self.sha_version = 0x1
         self.pfr_rom_file = 'image-mtd-pfr'
         open(self.pfr_rom_file, 'a').close()
 
@@ -211,15 +212,14 @@ class pfr_bmc_image(object):
         if pfm_flag == 1:
            self.pfm_bytes += PFM_SPI_SIZE_DEF
 
-           hash = bytearray(PFM_SPI_SIZE_HASH)
+           hash = bytearray(self.pfm_spi_size_hash)
            hash_pres = 0
 
            if hash_flag == 1:
                # region's hash
                hash = hash_dgst.hexdigest()
-               hash_pres = SHA
-               self.pfm_bytes += PFM_SPI_SIZE_HASH
-
+               hash_pres = self.sha_version
+               self.pfm_bytes += self.pfm_spi_size_hash
            # append to SPI regions in PFM
            self.pfm_spi_regions.append(pfm_spi(pfm_prot_mask, start_addr, (start_addr+size), hash, hash_pres))
 
diff --git a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/obmc-intel-pfr-image-native.bb b/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/obmc-intel-pfr-image-native.bb
index bb8684ac2..bb0f9ba7e 100644
--- a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/obmc-intel-pfr-image-native.bb
+++ b/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/obmc-intel-pfr-image-native.bb
@@ -11,13 +11,6 @@ DEPENDS += " intel-blocksign-native"
 
 SRC_URI = " \
            file://pfr_image.py \
-           file://${PRODUCT_GENERATION}/pfr_manifest.json \
-           file://${PRODUCT_GENERATION}/pfm_config.xml \
-           file://${PRODUCT_GENERATION}/bmc_config.xml \
-           file://${PRODUCT_GENERATION}/csk_prv.pem \
-           file://${PRODUCT_GENERATION}/csk_pub.pem \
-           file://${PRODUCT_GENERATION}/rk_pub.pem \
-           file://${PRODUCT_GENERATION}/rk_prv.pem \
           "
 
 do_install () {
@@ -26,12 +19,5 @@ do_install () {
         install -d ${D}${bindir}
         install -d ${D}/${datadir}/pfrconfig
         install -m 775 ${WORKDIR}/pfr_image.py ${D}${bindir}/pfr_image.py
-        install -m 400 ${WORKDIR}/${PRODUCT_GENERATION}/pfr_manifest.json ${D}/${datadir}/pfrconfig
-        install -m 400 ${WORKDIR}/${PRODUCT_GENERATION}/pfm_config.xml ${D}/${datadir}/pfrconfig/pfm_config.xml
-        install -m 400 ${WORKDIR}/${PRODUCT_GENERATION}/bmc_config.xml ${D}/${datadir}/pfrconfig/bmc_config.xml
-        install -m 400 ${WORKDIR}/${PRODUCT_GENERATION}/csk_prv.pem ${D}/${datadir}/pfrconfig/csk_prv.pem
-        install -m 400 ${WORKDIR}/${PRODUCT_GENERATION}/csk_pub.pem ${D}/${datadir}/pfrconfig/csk_pub.pem
-        install -m 400 ${WORKDIR}/${PRODUCT_GENERATION}/rk_pub.pem ${D}/${datadir}/pfrconfig/rk_pub.pem
-        install -m 400 ${WORKDIR}/${PRODUCT_GENERATION}/rk_prv.pem ${D}/${datadir}/pfrconfig/rk_prv.pem
 }
 
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0001-arm-dts-add-DTS-for-Intel-ast2500-platforms.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0001-arm-dts-add-DTS-for-Intel-ast2500-platforms.patch
index 5c4fb8a25..088e1a02b 100644
--- a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0001-arm-dts-add-DTS-for-Intel-ast2500-platforms.patch
+++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0001-arm-dts-add-DTS-for-Intel-ast2500-platforms.patch
@@ -1,4 +1,4 @@
-From 2399c5d353e4b8dc55bd7c56bb3f1d01918bccd9 Mon Sep 17 00:00:00 2001
+From 7ad89fd032d56cc20622d34cf9d0d09adacb2796 Mon Sep 17 00:00:00 2001
 From: Yuan Li <yuan.li@linux.intel.com>
 Date: Tue, 19 Sep 2017 15:55:39 +0800
 Subject: [PATCH] arm: dts: add DTS for Intel ast2500 platforms
@@ -24,7 +24,7 @@ Signed-off-by: Arun P. Mohanan <arun.p.m@linux.intel.com>
 
 diff --git a/arch/arm/boot/dts/aspeed-bmc-intel-ast2500.dts b/arch/arm/boot/dts/aspeed-bmc-intel-ast2500.dts
 new file mode 100644
-index 000000000000..980e2b55a09a
+index 000000000000..7a09ca54f161
 --- /dev/null
 +++ b/arch/arm/boot/dts/aspeed-bmc-intel-ast2500.dts
 @@ -0,0 +1,477 @@
@@ -239,8 +239,8 @@ index 000000000000..980e2b55a09a
 +	/*IC0-IC7*/	"","","CPU2_MISMATCH","CPU2_MEM_THERM_EVENT","","","","",
 +	/*ID0-ID7*/	"","","","","","","","",
 +	/*IE0-IE7*/	"","","","","","","","",
-+	/*IF0-IF7*/	"","","","","","","","",
-+	/*IG0-IG7*/	"","","","","","","","",
++	/*IF0-IF7*/	"SGPIO_PLD_MINOR_REV_BIT0","SGPIO_PLD_MINOR_REV_BIT1","SGPIO_PLD_MINOR_REV_BIT2","SGPIO_PLD_MINOR_REV_BIT3","SGPIO_PLD_MAJOR_REV_BIT0","SGPIO_PLD_MAJOR_REV_BIT1","SGPIO_PLD_MAJOR_REV_BIT2","SGPIO_PLD_MAJOR_REV_BIT3",
++	/*IG0-IG7*/	"MAIN_PLD_MINOR_REV_BIT0","MAIN_PLD_MINOR_REV_BIT1","MAIN_PLD_MINOR_REV_BIT2","MAIN_PLD_MINOR_REV_BIT3","MAIN_PLD_MAJOR_REV_BIT0","MAIN_PLD_MAJOR_REV_BIT1","MAIN_PLD_MAJOR_REV_BIT2","MAIN_PLD_MAJOR_REV_BIT3",
 +	/*IH0-IH7*/	"","","","","","","","",
 +	/*II0-II7*/	"","","","","","","","",
 +	/*IJ0-IJ7*/	"","","","","","","","";
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0001-arm-dts-add-DTS-for-Intel-ast2600-platforms.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0001-arm-dts-add-DTS-for-Intel-ast2600-platforms.patch
index a077e7cdb..6e58657ec 100644
--- a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0001-arm-dts-add-DTS-for-Intel-ast2600-platforms.patch
+++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0001-arm-dts-add-DTS-for-Intel-ast2600-platforms.patch
@@ -1,4 +1,4 @@
-From 20c08d8ba976f43ebb98fbbe8f27dff352d41c40 Mon Sep 17 00:00:00 2001
+From eeecdb993d9e5dbf8cb45eb11ad367e9eb67018d Mon Sep 17 00:00:00 2001
 From: Vernon Mauery <vernon.mauery@linux.intel.com>
 Date: Tue, 19 Sep 2017 15:55:39 +0800
 Subject: [PATCH] arm: dts: add DTS for Intel ast2600 platforms
@@ -14,16 +14,16 @@ Signed-off-by: Ayushi Smriti <smriti.ayushi@intel.com>
 Signed-off-by: Arun P. Mohanan <arun.p.m@linux.intel.com>
 Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
 ---
- arch/arm/boot/dts/aspeed-bmc-intel-ast2600.dts | 530 +++++++++++++++++++++++++
- 1 file changed, 530 insertions(+)
+ .../arm/boot/dts/aspeed-bmc-intel-ast2600.dts | 534 ++++++++++++++++++
+ 1 file changed, 534 insertions(+)
  create mode 100644 arch/arm/boot/dts/aspeed-bmc-intel-ast2600.dts
 
 diff --git a/arch/arm/boot/dts/aspeed-bmc-intel-ast2600.dts b/arch/arm/boot/dts/aspeed-bmc-intel-ast2600.dts
 new file mode 100644
-index 000000000000..b7f47623c021
+index 000000000000..e9cea7b63836
 --- /dev/null
 +++ b/arch/arm/boot/dts/aspeed-bmc-intel-ast2600.dts
-@@ -0,0 +1,530 @@
+@@ -0,0 +1,534 @@
 +// SPDX-License-Identifier: GPL-2.0+
 +/dts-v1/;
 +
@@ -37,7 +37,7 @@ index 000000000000..b7f47623c021
 +
 +	chosen {
 +		stdout-path = &uart5;
-+		bootargs = "console=tty0 console=ttyS4,115200n8 root=/dev/ram rw init=/linuxrc";
++		bootargs = "console=ttyS4,115200n8 root=/dev/ram rw init=/linuxrc earlyprintk";
 +	};
 +
 +	memory@80000000 {
@@ -266,9 +266,9 @@ index 000000000000..b7f47623c021
 +	/*IB0-IB7*/	"CPU1_MISMATCH","IRQ_PSYS_CRIT_N","CPU2_PRESENCE","CPU2_THERMTRIP","CPU2_VRHOT","CPU2_FIVR_FAULT","CPU1_MEM_VRHOT","CPU2_MEM_THERM_EVENT",
 +	/*IC0-IC7*/	"FM_CPU1_PROC_ID0","FM_CPU1_PROC_ID1","CPU2_MISMATCH","","","","","",
 +	/*ID0-ID7*/	"","","","","","","","",
-+	/*IE0-IE7*/	"","","","","","","","",
-+	/*IF0-IF7*/	"FPGA_REV_TEST_0","FPGA_REV_TEST_1","FPGA_REV_TEST_2","FPGA_REV_TEST_3","FPGA_REV_TEST_4","FPGA_REV_TEST_5","FPGA_REV_TEST_6","FPGA_REV_TEST_7",
-+	/*IG0-IG7*/	"FPGA_REV_0","FPGA_REV_1","FPGA_REV_2","FPGA_REV_3","FPGA_REV_4","FPGA_REV_5","FPGA_REV_6","FPGA_REV_7",
++	/*IE0-IE7*/	"","","","","","","","CPU1_CPLD_CRC_ERROR",
++	/*IF0-IF7*/	"CPU2_CPLD_CRC_ERROR","","","","","","","",
++	/*IG0-IG7*/	"MAIN_PLD_MINOR_REV_BIT0","MAIN_PLD_MINOR_REV_BIT1","MAIN_PLD_MINOR_REV_BIT2","MAIN_PLD_MINOR_REV_BIT3","MAIN_PLD_MAJOR_REV_BIT0","MAIN_PLD_MAJOR_REV_BIT1","MAIN_PLD_MAJOR_REV_BIT2","MAIN_PLD_MAJOR_REV_BIT3",
 +	/*IH0-IH7*/	"","WMEMX_PWR_FLT","WCPUX_MEM_PWR_FLT","PWRGD_P3V3_FF","WPSU_PWR_FLT","","","WPCH_PWR_FLT",
 +	/*II0-II7*/	"FM_CPU0_PKGID0","FM_CPU0_PKGID1","FM_CPU0_PKGID2","H_CPU0_MEMTRIP_LVC1_N","FM_CPU1_PKGID0","FM_CPU1_PKGID1","FM_CPU1_PKGID2","H_CPU1_MEMTRIP_LVC1_N",
 +	/*IJ0-IJ7*/	"","","","","","","","";
@@ -554,6 +554,10 @@ index 000000000000..b7f47623c021
 +&jtag1 {
 +	status = "okay";
 +};
++
++&wdt2 {
++	status = "okay";
++};
 -- 
-2.7.4
+2.17.1
 
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0053-Add-Aspeed-SoC-24xx-and-25xx-families-JTAG.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0053-Add-Aspeed-SoC-24xx-and-25xx-families-JTAG.patch
index b70629f18..d29098459 100644
--- a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0053-Add-Aspeed-SoC-24xx-and-25xx-families-JTAG.patch
+++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0053-Add-Aspeed-SoC-24xx-and-25xx-families-JTAG.patch
@@ -1,6 +1,6 @@
 From e01c562db28797e3b6be9030f1f52507115c6765 Mon Sep 17 00:00:00 2001
 From: "Corona, Ernesto" <ernesto.corona@intel.com>
-Date: Mon, 6 Apr 2020 09:48:32 -0700
+Date: Thu, 9 Jul 2020 12:03:34 -0700
 Subject: [PATCH] Add Aspeed SoC 24xx and 25xx families JTAG
 
 Driver adds support of Aspeed 2400-2600 series SOC JTAG master controller.
@@ -38,6 +38,10 @@ Cc: Bryan Hunt <bryan.hunt@intel.com>
 v29->v30
 Comments pointed by Steven Filary <steven.a.filary@intel.com>
 - Add Suport for 26xx series
+  Software mode
+  Hardware mode 1 (disabled by default)
+  Hardware mode 2 (enabled by default) up to 160 bit lenght transfers
+- clang jtag-aspeed.c
 
 v28->v29
 Comments pointed by Steven Filary <steven.a.filary@intel.com>
@@ -205,8 +209,8 @@ Comments pointed by kbuild test robot <lkp@intel.com>
 ---
  drivers/jtag/Kconfig       |   14 +
  drivers/jtag/Makefile      |    1 +
- drivers/jtag/jtag-aspeed.c | 1217 ++++++++++++++++++++++++++++++++++++++++++++
- 3 files changed, 1232 insertions(+)
+ drivers/jtag/jtag-aspeed.c | 1524 ++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 1539 insertions(+)
  create mode 100644 drivers/jtag/jtag-aspeed.c
 
 diff --git a/drivers/jtag/Kconfig b/drivers/jtag/Kconfig
@@ -243,7 +247,7 @@ new file mode 100644
 index 0000000..1e6ace6
 --- /dev/null
 +++ b/drivers/jtag/jtag-aspeed.c
-@@ -0,0 +1,1217 @@
+@@ -0,0 +1,1524 @@
 +// SPDX-License-Identifier: GPL-2.0
 +// Copyright (c) 2018 Mellanox Technologies. All rights reserved.
 +// Copyright (c) 2018 Oleksandr Shamray <oleksandrs@mellanox.com>
@@ -268,13 +272,14 @@ index 0000000..1e6ace6
 +#define ASPEED_JTAG_DATA		0x00
 +#define ASPEED_JTAG_INST		0x04
 +#define ASPEED_JTAG_CTRL		0x08
-+#define ASPEED_JTAG_ISR			0x0C
++#define ASPEED_JTAG_ISR		0x0C
 +#define ASPEED_JTAG_SW			0x10
-+#define ASPEED_JTAG_TCK			0x14
++#define ASPEED_JTAG_TCK		0x14
 +#define ASPEED_JTAG_EC			0x18
 +
-+#define ASPEED_JTAG_DATA_MSB		0x01
-+#define ASPEED_JTAG_DATA_CHUNK_SIZE	0x20
++#define ASPEED_JTAG_DATA_MSB			0x01
++#define ASPEED_JTAG_DATA_CHUNK_SIZE		0x20
++#define ASPEED_JTAG_HW2_DATA_CHUNK_SIZE	160
 +
 +/* ASPEED_JTAG_CTRL: Engine Control 24xx and 25xx series*/
 +#define ASPEED_JTAG_CTL_ENG_EN		BIT(31)
@@ -283,38 +288,39 @@ index 0000000..1e6ace6
 +#define ASPEED_JTAG_CTL_IR_UPDATE	BIT(26)
 +#define ASPEED_JTAG_CTL_INST_LEN(x)	((x) << 20)
 +#define ASPEED_JTAG_CTL_LASPEED_INST	BIT(17)
-+#define ASPEED_JTAG_CTL_INST_EN		BIT(16)
++#define ASPEED_JTAG_CTL_INST_EN	BIT(16)
 +#define ASPEED_JTAG_CTL_DR_UPDATE	BIT(10)
 +#define ASPEED_JTAG_CTL_DATA_LEN(x)	((x) << 4)
 +#define ASPEED_JTAG_CTL_LASPEED_DATA	BIT(1)
-+#define ASPEED_JTAG_CTL_DATA_EN		BIT(0)
++#define ASPEED_JTAG_CTL_DATA_EN	BIT(0)
 +
 +/* ASPEED_JTAG_CTRL: Engine Control 26xx series*/
 +#define ASPEED_JTAG_CTL_26XX_RESET_FIFO	BIT(21)
-+#define ASPEED_JTAG_CTL_26XX_FIFO_MODE_CTRL BIT(20)
-+#define ASPEED_JTAG_CTL_26XX_TRANS_LEN(x) ((x) << 8)
-+#define ASPEED_JTAG_CTL_26XX_MSB_FIRST	BIT(6)
++#define ASPEED_JTAG_CTL_26XX_FIFO_MODE_CTRL	BIT(20)
++#define ASPEED_JTAG_CTL_26XX_TRANS_LEN(x)	((x) << 8)
++#define ASPEED_JTAG_CTL_26XX_TRANS_MASK	GENMASK(17, 8)
++#define ASPEED_JTAG_CTL_26XX_MSB_FIRST		BIT(6)
 +#define ASPEED_JTAG_CTL_26XX_TERM_TRANS	BIT(5)
-+#define ASPEED_JTAG_CTL_26XX_LASPEED_TRANS BIT(4)
-+#define ASPEED_JTAG_CTL_26XX_INST_EN	BIT(1)
++#define ASPEED_JTAG_CTL_26XX_LASPEED_TRANS	BIT(4)
++#define ASPEED_JTAG_CTL_26XX_INST_EN		BIT(1)
 +
 +/* ASPEED_JTAG_ISR : Interrupt status and enable */
-+#define ASPEED_JTAG_ISR_INST_PAUSE	BIT(19)
-+#define ASPEED_JTAG_ISR_INST_COMPLETE	BIT(18)
-+#define ASPEED_JTAG_ISR_DATA_PAUSE	BIT(17)
-+#define ASPEED_JTAG_ISR_DATA_COMPLETE	BIT(16)
-+#define ASPEED_JTAG_ISR_INST_PAUSE_EN	BIT(3)
-+#define ASPEED_JTAG_ISR_INST_COMPLETE_EN BIT(2)
-+#define ASPEED_JTAG_ISR_DATA_PAUSE_EN	BIT(1)
-+#define ASPEED_JTAG_ISR_DATA_COMPLETE_EN BIT(0)
-+#define ASPEED_JTAG_ISR_INT_EN_MASK	GENMASK(3, 0)
-+#define ASPEED_JTAG_ISR_INT_MASK	GENMASK(19, 16)
++#define ASPEED_JTAG_ISR_INST_PAUSE		BIT(19)
++#define ASPEED_JTAG_ISR_INST_COMPLETE		BIT(18)
++#define ASPEED_JTAG_ISR_DATA_PAUSE		BIT(17)
++#define ASPEED_JTAG_ISR_DATA_COMPLETE		BIT(16)
++#define ASPEED_JTAG_ISR_INST_PAUSE_EN		BIT(3)
++#define ASPEED_JTAG_ISR_INST_COMPLETE_EN	BIT(2)
++#define ASPEED_JTAG_ISR_DATA_PAUSE_EN		BIT(1)
++#define ASPEED_JTAG_ISR_DATA_COMPLETE_EN	BIT(0)
++#define ASPEED_JTAG_ISR_INT_EN_MASK		GENMASK(3, 0)
++#define ASPEED_JTAG_ISR_INT_MASK		GENMASK(19, 16)
 +
 +/* ASPEED_JTAG_SW : Software Mode and Status */
-+#define ASPEED_JTAG_SW_MODE_EN		BIT(19)
++#define ASPEED_JTAG_SW_MODE_EN			BIT(19)
 +#define ASPEED_JTAG_SW_MODE_TCK		BIT(18)
 +#define ASPEED_JTAG_SW_MODE_TMS		BIT(17)
-+#define ASPEED_JTAG_SW_MODE_TDIO	BIT(16)
++#define ASPEED_JTAG_SW_MODE_TDIO		BIT(16)
 +
 +/* ASPEED_JTAG_TCK : TCK Control */
 +#define ASPEED_JTAG_TCK_DIVISOR_MASK	GENMASK(10, 0)
@@ -347,9 +353,12 @@ index 0000000..1e6ace6
 +#define ASPEED_JTAG_RESET_CNTR		10
 +#define WAIT_ITERATIONS		75
 +
++/* Use this macro to switch between HW mode 1(comment out) and 2(defined)  */
++#define ASPEED_JTAG_HW_MODE_2_ENABLE	1
++
 +/* ASPEED JTAG HW MODE 2 (Only supported in AST26xx series) */
-+#define ASPEED_JTAG_SHDATA0		0x20
-+#define ASPEED_JTAG_SHDATA1		0x24
++#define ASPEED_JTAG_SHDATA		0x20
++#define ASPEED_JTAG_SHINST		0x24
 +#define ASPEED_JTAG_PADCTRL0		0x28
 +#define ASPEED_JTAG_PADCTRL1		0x2C
 +#define ASPEED_JTAG_SHCTRL		0x30
@@ -374,14 +383,16 @@ index 0000000..1e6ace6
 +#define ASPEED_JTAG_SHCTRL_START_SHIFT	BIT(7)
 +#define ASPEED_JTAG_SHCTRL_LWRDT_SHIFT(x) ((x) & GENMASK(6, 0))
 +
++#define ASPEED_JTAG_END_SHIFT_DISABLED	0
++
 +/* ASPEED_JTAG_GBLCTRL : Global Control */
 +#define ASPEED_JTAG_GBLCTRL_ENG_MODE_EN	BIT(31)
 +#define ASPEED_JTAG_GBLCTRL_ENG_OUT_EN	BIT(30)
 +#define ASPEED_JTAG_GBLCTRL_FORCE_TMS	BIT(29)
 +#define ASPEED_JTAG_GBLCTRL_SHIFT_COMPLETE  BIT(28)
 +#define ASPEED_JTAG_GBLCTRL_RESET_FIFO	BIT(25)
-+#define ASPEED_JTAG_GBLCTRL_FIFO_MODE	BIT(24)
-+#define ASPEED_JTAG_GBLCTRL_UPDT_SHIFT(x)	(((x) & GENMASK(3, 0)) << 20)
++#define ASPEED_JTAG_GBLCTRL_FIFO_CTRL_MODE	BIT(24)
++#define ASPEED_JTAG_GBLCTRL_UPDT_SHIFT(x)	(((x) & GENMASK(9, 7)) << 13)
 +#define ASPEED_JTAG_GBLCTRL_STSHIFT(x)	(((x) & GENMASK(0, 0)) << 16)
 +#define ASPEED_JTAG_GBLCTRL_TRST	BIT(15)
 +#define ASPEED_JTAG_CLK_DIVISOR_MASK	GENMASK(11, 0)
@@ -405,8 +416,8 @@ index 0000000..1e6ace6
 +	[ASPEED_JTAG_SW]   = "ASPEED_JTAG_SW",
 +	[ASPEED_JTAG_TCK]  = "ASPEED_JTAG_TCK",
 +	[ASPEED_JTAG_EC]   = "ASPEED_JTAG_EC",
-+	[ASPEED_JTAG_SHDATA0]  = "ASPEED_JTAG_SHDATA0",
-+	[ASPEED_JTAG_SHDATA1]  = "ASPEED_JTAG_SHDATA1",
++	[ASPEED_JTAG_SHDATA]  = "ASPEED_JTAG_SHDATA",
++	[ASPEED_JTAG_SHINST]  = "ASPEED_JTAG_SHINST",
 +	[ASPEED_JTAG_PADCTRL0] = "ASPEED_JTAG_PADCTRL0",
 +	[ASPEED_JTAG_PADCTRL1] = "ASPEED_JTAG_PADCTRL1",
 +	[ASPEED_JTAG_SHCTRL]   = "ASPEED_JTAG_SHCTRL",
@@ -427,7 +438,7 @@ index 0000000..1e6ace6
 +	u32				flag;
 +	wait_queue_head_t		jtag_wq;
 +	u32				mode;
-+	struct jtag_low_level_functions *llops;
++	const struct jtag_low_level_functions *llops;
 +};
 +
 +/* Multi generation support is enabled by fops and low level assped function
@@ -436,15 +447,20 @@ index 0000000..1e6ace6
 +
 +struct jtag_low_level_functions {
 +	void (*output_disable)(struct aspeed_jtag *aspeed_jtag);
++	void (*master_enable)(struct aspeed_jtag *aspeed_jtag);
 +	int (*xfer_push_data)(struct aspeed_jtag *aspeed_jtag,
 +			      enum jtag_xfer_type type, u32 bits_len);
 +	int (*xfer_push_data_last)(struct aspeed_jtag *aspeed_jtag,
 +				   enum jtag_xfer_type type, u32 bits_len);
++	void (*xfer_sw)(struct aspeed_jtag *aspeed_jtag, struct jtag_xfer *xfer,
++			u32 *data);
++	int (*xfer_hw)(struct aspeed_jtag *aspeed_jtag, struct jtag_xfer *xfer,
++		       u32 *data);
 +};
 +
 +struct aspeed_jtag_functions {
-+	struct jtag_ops *aspeed_jtag_ops;
-+	struct jtag_low_level_functions *aspeed_jtag_llops;
++	const struct jtag_ops *aspeed_jtag_ops;
++	const struct jtag_low_level_functions *aspeed_jtag_llops;
 +};
 +
 +/*
@@ -453,8 +469,8 @@ index 0000000..1e6ace6
 + * more than 1 byte of TMS cycles)
 + */
 +struct tms_cycle {
-+	unsigned char		tmsbits;
-+	unsigned char		count;
++	unsigned char tmsbits;
++	unsigned char count;
 +};
 +
 +/*
@@ -576,10 +592,10 @@ index 0000000..1e6ace6
 +};
 +
 +#ifdef DEBUG_JTAG
-+static char *end_status_str[] = {
-+	"tlr", "idle", "selDR", "capDR", "sDR", "ex1DR", "pDR", "ex2DR",
-+	 "updDR", "selIR", "capIR", "sIR", "ex1IR", "pIR", "ex2IR", "updIR"
-+};
++static char *end_status_str[] = { "tlr",   "idle",  "selDR", "capDR",
++				  "sDR",   "ex1DR", "pDR",   "ex2DR",
++				  "updDR", "selIR", "capIR", "sIR",
++				  "ex1IR", "pIR",   "ex2IR", "updIR" };
 +#endif
 +
 +static u32 aspeed_jtag_read(struct aspeed_jtag *aspeed_jtag, u32 reg)
@@ -592,12 +608,11 @@ index 0000000..1e6ace6
 +	return val;
 +}
 +
-+static void
-+aspeed_jtag_write(struct aspeed_jtag *aspeed_jtag, u32 val, u32 reg)
++static void aspeed_jtag_write(struct aspeed_jtag *aspeed_jtag, u32 val, u32 reg)
 +{
 +#ifdef DEBUG_JTAG
-+	dev_dbg(aspeed_jtag->dev, "write:%s val = 0x%08x\n",
-+		regnames[reg], val);
++	dev_dbg(aspeed_jtag->dev, "write:%s val = 0x%08x\n", regnames[reg],
++		val);
 +#endif
 +	writel(val, aspeed_jtag->reg_base + reg);
 +}
@@ -609,6 +624,9 @@ index 0000000..1e6ace6
 +	u32 tck_val;
 +	u16 div;
 +
++	if (!freq)
++		return -EINVAL;
++
 +	apb_frq = clk_get_rate(aspeed_jtag->pclk);
 +	if (!apb_frq)
 +		return -ENOTSUPP;
@@ -621,6 +639,28 @@ index 0000000..1e6ace6
 +	return 0;
 +}
 +
++static int aspeed_jtag_freq_set_26xx(struct jtag *jtag, u32 freq)
++{
++	struct aspeed_jtag *aspeed_jtag = jtag_priv(jtag);
++	unsigned long apb_frq;
++	u32 tck_val;
++	u16 div;
++
++	if (!freq)
++		return -EINVAL;
++
++	apb_frq = clk_get_rate(aspeed_jtag->pclk);
++	if (!apb_frq)
++		return -ENOTSUPP;
++
++	div = (apb_frq - 1) / freq;
++	tck_val = aspeed_jtag_read(aspeed_jtag, ASPEED_JTAG_GBLCTRL);
++	aspeed_jtag_write(aspeed_jtag,
++			  (tck_val & ~ASPEED_JTAG_CLK_DIVISOR_MASK) | div,
++			  ASPEED_JTAG_GBLCTRL);
++	return 0;
++}
++
 +static int aspeed_jtag_freq_get(struct jtag *jtag, u32 *frq)
 +{
 +	struct aspeed_jtag *aspeed_jtag = jtag_priv(jtag);
@@ -634,29 +674,87 @@ index 0000000..1e6ace6
 +	return 0;
 +}
 +
++static int aspeed_jtag_freq_get_26xx(struct jtag *jtag, u32 *frq)
++{
++	struct aspeed_jtag *aspeed_jtag = jtag_priv(jtag);
++	u32 pclk;
++	u32 tck;
++
++	pclk = clk_get_rate(aspeed_jtag->pclk);
++	tck = aspeed_jtag_read(aspeed_jtag, ASPEED_JTAG_GBLCTRL);
++	*frq = pclk / (ASPEED_JTAG_CLK_GET_DIV(tck) + 1);
++
++	return 0;
++}
++
 +static inline void aspeed_jtag_output_disable(struct aspeed_jtag *aspeed_jtag)
 +{
 +	aspeed_jtag_write(aspeed_jtag, 0, ASPEED_JTAG_CTRL);
 +}
 +
++static inline void
++aspeed_jtag_output_disable_26xx(struct aspeed_jtag *aspeed_jtag)
++{
++	aspeed_jtag_write(aspeed_jtag, 0, ASPEED_JTAG_GBLCTRL);
++}
++
 +static inline void aspeed_jtag_master(struct aspeed_jtag *aspeed_jtag)
 +{
-+	aspeed_jtag_write(aspeed_jtag, (ASPEED_JTAG_CTL_ENG_EN |
-+					ASPEED_JTAG_CTL_ENG_OUT_EN),
-+					ASPEED_JTAG_CTRL);
-+
-+	aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_SW_MODE_EN |
-+			ASPEED_JTAG_SW_MODE_TDIO,
-+			ASPEED_JTAG_SW);
-+	aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_ISR_INST_PAUSE |
-+			ASPEED_JTAG_ISR_INST_COMPLETE |
-+			ASPEED_JTAG_ISR_DATA_PAUSE |
-+			ASPEED_JTAG_ISR_DATA_COMPLETE |
-+			ASPEED_JTAG_ISR_INST_PAUSE_EN |
-+			ASPEED_JTAG_ISR_INST_COMPLETE_EN |
-+			ASPEED_JTAG_ISR_DATA_PAUSE_EN |
-+			ASPEED_JTAG_ISR_DATA_COMPLETE_EN,
-+			ASPEED_JTAG_ISR);  /* Enable Interrupt */
++	aspeed_jtag_write(aspeed_jtag,
++			  (ASPEED_JTAG_CTL_ENG_EN | ASPEED_JTAG_CTL_ENG_OUT_EN),
++			  ASPEED_JTAG_CTRL);
++
++	aspeed_jtag_write(aspeed_jtag,
++			  ASPEED_JTAG_SW_MODE_EN | ASPEED_JTAG_SW_MODE_TDIO,
++			  ASPEED_JTAG_SW);
++	aspeed_jtag_write(aspeed_jtag,
++			  ASPEED_JTAG_ISR_INST_PAUSE |
++				  ASPEED_JTAG_ISR_INST_COMPLETE |
++				  ASPEED_JTAG_ISR_DATA_PAUSE |
++				  ASPEED_JTAG_ISR_DATA_COMPLETE |
++				  ASPEED_JTAG_ISR_INST_PAUSE_EN |
++				  ASPEED_JTAG_ISR_INST_COMPLETE_EN |
++				  ASPEED_JTAG_ISR_DATA_PAUSE_EN |
++				  ASPEED_JTAG_ISR_DATA_COMPLETE_EN,
++			  ASPEED_JTAG_ISR); /* Enable Interrupt */
++}
++
++static inline void aspeed_jtag_master_26xx(struct aspeed_jtag *aspeed_jtag)
++{
++	if (aspeed_jtag->mode & JTAG_XFER_HW_MODE) {
++		aspeed_jtag_write(aspeed_jtag, 0, ASPEED_JTAG_CTRL);
++		aspeed_jtag_write(aspeed_jtag, 0, ASPEED_JTAG_SW);
++		aspeed_jtag_write(aspeed_jtag,
++				  ASPEED_JTAG_GBLCTRL_ENG_MODE_EN |
++					  ASPEED_JTAG_GBLCTRL_ENG_OUT_EN,
++				  ASPEED_JTAG_GBLCTRL);
++
++		aspeed_jtag_write(aspeed_jtag,
++				  ASPEED_JTAG_INTCTRL_SHCPL_IRQ_EN |
++					  ASPEED_JTAG_INTCTRL_SHCPL_IRQ_STAT,
++				  ASPEED_JTAG_INTCTRL); /* Enable Interrupt */
++	} else {
++		aspeed_jtag_write(aspeed_jtag, 0, ASPEED_JTAG_GBLCTRL);
++		aspeed_jtag_write(aspeed_jtag,
++				  ASPEED_JTAG_CTL_ENG_EN |
++					  ASPEED_JTAG_CTL_ENG_OUT_EN,
++				  ASPEED_JTAG_CTRL);
++
++		aspeed_jtag_write(aspeed_jtag,
++				  ASPEED_JTAG_SW_MODE_EN |
++					  ASPEED_JTAG_SW_MODE_TDIO,
++				  ASPEED_JTAG_SW);
++		aspeed_jtag_write(aspeed_jtag,
++				  ASPEED_JTAG_ISR_INST_PAUSE |
++					  ASPEED_JTAG_ISR_INST_COMPLETE |
++					  ASPEED_JTAG_ISR_DATA_PAUSE |
++					  ASPEED_JTAG_ISR_DATA_COMPLETE |
++					  ASPEED_JTAG_ISR_INST_PAUSE_EN |
++					  ASPEED_JTAG_ISR_INST_COMPLETE_EN |
++					  ASPEED_JTAG_ISR_DATA_PAUSE_EN |
++					  ASPEED_JTAG_ISR_DATA_COMPLETE_EN,
++				  ASPEED_JTAG_ISR); /* Enable Interrupt */
++	}
 +}
 +
 +static int aspeed_jtag_mode_set(struct jtag *jtag, struct jtag_mode *jtag_mode)
@@ -666,12 +764,13 @@ index 0000000..1e6ace6
 +	switch (jtag_mode->feature) {
 +	case JTAG_XFER_MODE:
 +		aspeed_jtag->mode = jtag_mode->mode;
++		aspeed_jtag->llops->master_enable(aspeed_jtag);
 +		break;
 +	case JTAG_CONTROL_MODE:
 +		if (jtag_mode->mode == JTAG_MASTER_OUTPUT_DISABLE)
-+			aspeed_jtag_output_disable(aspeed_jtag);
++			aspeed_jtag->llops->output_disable(aspeed_jtag);
 +		else if (jtag_mode->mode == JTAG_MASTER_MODE)
-+			aspeed_jtag_master(aspeed_jtag);
++			aspeed_jtag->llops->master_enable(aspeed_jtag);
 +		break;
 +	default:
 +		return -EINVAL;
@@ -679,23 +778,26 @@ index 0000000..1e6ace6
 +	return 0;
 +}
 +
-+static char aspeed_jtag_tck_cycle(struct aspeed_jtag *aspeed_jtag,
-+				  u8 tms, u8 tdi)
++static char aspeed_jtag_tck_cycle(struct aspeed_jtag *aspeed_jtag, u8 tms,
++				  u8 tdi)
 +{
 +	char tdo = 0;
 +
 +	/* TCK = 0 */
-+	aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_SW_MODE_EN |
-+			  (tms * ASPEED_JTAG_SW_MODE_TMS) |
-+			  (tdi * ASPEED_JTAG_SW_MODE_TDIO), ASPEED_JTAG_SW);
++	aspeed_jtag_write(aspeed_jtag,
++			  ASPEED_JTAG_SW_MODE_EN |
++				  (tms * ASPEED_JTAG_SW_MODE_TMS) |
++				  (tdi * ASPEED_JTAG_SW_MODE_TDIO),
++			  ASPEED_JTAG_SW);
 +
 +	aspeed_jtag_read(aspeed_jtag, ASPEED_JTAG_SW);
 +
 +	/* TCK = 1 */
-+	aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_SW_MODE_EN |
-+			  ASPEED_JTAG_SW_MODE_TCK |
-+			  (tms * ASPEED_JTAG_SW_MODE_TMS) |
-+			  (tdi * ASPEED_JTAG_SW_MODE_TDIO), ASPEED_JTAG_SW);
++	aspeed_jtag_write(aspeed_jtag,
++			  ASPEED_JTAG_SW_MODE_EN | ASPEED_JTAG_SW_MODE_TCK |
++				  (tms * ASPEED_JTAG_SW_MODE_TMS) |
++				  (tdi * ASPEED_JTAG_SW_MODE_TDIO),
++			  ASPEED_JTAG_SW);
 +
 +	if (aspeed_jtag_read(aspeed_jtag, ASPEED_JTAG_SW) &
 +	    ASPEED_JTAG_SW_MODE_TDIO)
@@ -713,33 +815,33 @@ index 0000000..1e6ace6
 +
 +	for (i = 0; i < bitbang->length; i++) {
 +		bitbang_data[i].tdo =
-+		aspeed_jtag_tck_cycle(aspeed_jtag, bitbang_data[i].tms,
-+				      bitbang_data[i].tdi);
++			aspeed_jtag_tck_cycle(aspeed_jtag, bitbang_data[i].tms,
++					      bitbang_data[i].tdi);
 +	}
 +	return 0;
 +}
 +
-+static int aspeed_jtag_wait_instruction_pause(struct aspeed_jtag *aspeed_jtag)
++static int aspeed_jtag_isr_wait(struct aspeed_jtag *aspeed_jtag, u32 bit)
 +{
 +	int res = 0;
 +#ifdef USE_INTERRUPTS
 +	res = wait_event_interruptible(aspeed_jtag->jtag_wq,
-+				       aspeed_jtag->flag &
-+				       ASPEED_JTAG_ISR_INST_PAUSE);
-+	aspeed_jtag->flag &= ~ASPEED_JTAG_ISR_INST_PAUSE;
++				       aspeed_jtag->flag & bit);
++	aspeed_jtag->flag &= ~bit;
 +#else
 +	u32 status = 0;
 +	u32 iterations = 0;
 +
-+	while ((status & ASPEED_JTAG_ISR_INST_PAUSE) == 0) {
++	while ((status & bit) == 0) {
 +		status = aspeed_jtag_read(aspeed_jtag, ASPEED_JTAG_ISR);
 +#ifdef DEBUG_JTAG
 +		dev_dbg(aspeed_jtag->dev, "%s  = 0x%08x\n", __func__, status);
 +#endif
 +		iterations++;
 +		if (iterations > WAIT_ITERATIONS) {
-+			dev_err(aspeed_jtag->dev,
-+				"aspeed_jtag driver timed out waiting for instruction pause complete\n");
++			dev_err(aspeed_jtag->dev, "%s %d in ASPEED_JTAG_ISR\n",
++				"aspeed_jtag driver timed out waiting for bit",
++				bit);
 +			res = -EFAULT;
 +			break;
 +		}
@@ -750,124 +852,44 @@ index 0000000..1e6ace6
 +				udelay(1);
 +		}
 +	}
-+	aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_ISR_INST_PAUSE |
-+			  (status & 0xf),
-+			  ASPEED_JTAG_ISR);
++	aspeed_jtag_write(aspeed_jtag, bit | (status & 0xf), ASPEED_JTAG_ISR);
 +#endif
 +	return res;
 +}
 +
-+static int
-+aspeed_jtag_wait_instruction_complete(struct aspeed_jtag *aspeed_jtag)
++static int aspeed_jtag_wait_shift_complete(struct aspeed_jtag *aspeed_jtag)
 +{
 +	int res = 0;
 +#ifdef USE_INTERRUPTS
 +	res = wait_event_interruptible(aspeed_jtag->jtag_wq,
 +				       aspeed_jtag->flag &
-+				       ASPEED_JTAG_ISR_INST_COMPLETE);
-+	aspeed_jtag->flag &= ~ASPEED_JTAG_ISR_INST_COMPLETE;
++				       ASPEED_JTAG_INTCTRL_SHCPL_IRQ_STAT);
++	aspeed_jtag->flag &= ~ASPEED_JTAG_INTCTRL_SHCPL_IRQ_STAT;
 +#else
 +	u32 status = 0;
 +	u32 iterations = 0;
 +
-+	while ((status & ASPEED_JTAG_ISR_INST_COMPLETE) == 0) {
-+		status = aspeed_jtag_read(aspeed_jtag, ASPEED_JTAG_ISR);
++	while ((status & ASPEED_JTAG_INTCTRL_SHCPL_IRQ_STAT) == 0) {
++		status = aspeed_jtag_read(aspeed_jtag, ASPEED_JTAG_INTCTRL);
 +#ifdef DEBUG_JTAG
 +		dev_dbg(aspeed_jtag->dev, "%s  = 0x%08x\n", __func__, status);
 +#endif
 +		iterations++;
 +		if (iterations > WAIT_ITERATIONS) {
 +			dev_err(aspeed_jtag->dev,
-+				"aspeed_jtag driver timed out waiting for instruction complete\n");
++				"aspeed_jtag driver timed out waiting for shift completed\n");
 +			res = -EFAULT;
 +			break;
 +		}
-+		if ((status & ASPEED_JTAG_ISR_DATA_COMPLETE) == 0) {
-+			if (iterations % 25 == 0)
-+				usleep_range(1, 5);
-+			else
-+				udelay(1);
-+		}
-+	}
-+	aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_ISR_INST_COMPLETE |
-+			  (status & 0xf),
-+			  ASPEED_JTAG_ISR);
-+#endif
-+	return res;
-+}
-+
-+static int
-+aspeed_jtag_wait_data_pause_complete(struct aspeed_jtag *aspeed_jtag)
-+{
-+	int res = 0;
-+#ifdef USE_INTERRUPTS
-+	res = wait_event_interruptible(aspeed_jtag->jtag_wq,
-+				       aspeed_jtag->flag &
-+				       ASPEED_JTAG_ISR_DATA_PAUSE);
-+	aspeed_jtag->flag &= ~ASPEED_JTAG_ISR_DATA_PAUSE;
-+#else
-+	u32 status = 0;
-+	u32 iterations = 0;
-+
-+	while ((status & ASPEED_JTAG_ISR_DATA_PAUSE) == 0) {
-+		status = aspeed_jtag_read(aspeed_jtag, ASPEED_JTAG_ISR);
-+#ifdef DEBUG_JTAG
-+		dev_dbg(aspeed_jtag->dev, "%s  = 0x%08x\n", __func__, status);
-+#endif
-+		iterations++;
-+		if (iterations > WAIT_ITERATIONS) {
-+			dev_err(aspeed_jtag->dev,
-+				"aspeed_jtag driver timed out waiting for data pause complete\n");
-+			res = -EFAULT;
-+			break;
-+		}
-+		if ((status & ASPEED_JTAG_ISR_DATA_COMPLETE) == 0) {
-+			if (iterations % 25 == 0)
-+				usleep_range(1, 5);
-+			else
-+				udelay(1);
-+		}
-+	}
-+	aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_ISR_DATA_PAUSE |
-+			  (status & 0xf), ASPEED_JTAG_ISR);
-+#endif
-+	return res;
-+}
-+
-+static int aspeed_jtag_wait_data_complete(struct aspeed_jtag *aspeed_jtag)
-+{
-+	int res = 0;
-+#ifdef USE_INTERRUPTS
-+	res = wait_event_interruptible(aspeed_jtag->jtag_wq,
-+				       aspeed_jtag->flag &
-+				       ASPEED_JTAG_ISR_DATA_COMPLETE);
-+	aspeed_jtag->flag &= ~ASPEED_JTAG_ISR_DATA_COMPLETE;
-+#else
-+	u32 status = 0;
-+	u32 iterations = 0;
-+
-+	while ((status & ASPEED_JTAG_ISR_DATA_COMPLETE) == 0) {
-+		status = aspeed_jtag_read(aspeed_jtag, ASPEED_JTAG_ISR);
-+#ifdef DEBUG_JTAG
-+		dev_dbg(aspeed_jtag->dev, "%s  = 0x%08x\n", __func__, status);
-+#endif
-+		iterations++;
-+		if (iterations > WAIT_ITERATIONS) {
-+			dev_err(aspeed_jtag->dev,
-+				"ast_jtag driver timed out waiting for data complete\n");
-+			res = -EFAULT;
-+			break;
-+		}
-+		if ((status & ASPEED_JTAG_ISR_DATA_COMPLETE) == 0) {
-+			if (iterations % 25 == 0)
-+				usleep_range(1, 5);
-+			else
-+				udelay(1);
-+		}
++		if (iterations % 25 == 0)
++			usleep_range(1, 5);
++		else
++			udelay(1);
 +	}
 +	aspeed_jtag_write(aspeed_jtag,
-+			  ASPEED_JTAG_ISR_DATA_COMPLETE | (status & 0xf),
-+			  ASPEED_JTAG_ISR);
++			  ASPEED_JTAG_INTCTRL_SHCPL_IRQ_STAT |
++				  ASPEED_JTAG_INTCTRL_SHCPL_IRQ_EN,
++			  ASPEED_JTAG_INTCTRL);
 +#endif
 +	return res;
 +}
@@ -887,7 +909,8 @@ index 0000000..1e6ace6
 +
 +	for (i = 0; i < _tms_cycle_lookup[from][to].count; i++)
 +		aspeed_jtag_tck_cycle(aspeed_jtag,
-+			((_tms_cycle_lookup[from][to].tmsbits >> i) & 0x1), 0);
++				      ((_tms_cycle_lookup[from][to].tmsbits
++				      >> i) & 0x1), 0);
 +	aspeed_jtag->status = end_state;
 +}
 +
@@ -927,15 +950,99 @@ index 0000000..1e6ace6
 +		/* Disable sw mode */
 +		aspeed_jtag_write(aspeed_jtag, 0, ASPEED_JTAG_SW);
 +		mdelay(1);
-+		aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_CTL_ENG_EN |
-+				  ASPEED_JTAG_CTL_ENG_OUT_EN |
-+				  ASPEED_JTAG_CTL_FORCE_TMS, ASPEED_JTAG_CTRL);
++		aspeed_jtag_write(aspeed_jtag,
++				  ASPEED_JTAG_CTL_ENG_EN |
++					  ASPEED_JTAG_CTL_ENG_OUT_EN |
++					  ASPEED_JTAG_CTL_FORCE_TMS,
++				  ASPEED_JTAG_CTRL);
++		mdelay(1);
++		aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_SW_TDIO,
++				  ASPEED_JTAG_SW);
++		aspeed_jtag->status = JTAG_STATE_TLRESET;
++	}
++
++	return 0;
++}
++
++static void aspeed_jtag_shctrl_tms_mask(enum jtag_tapstate from,
++					enum jtag_tapstate to,
++					enum jtag_tapstate there,
++					enum jtag_tapstate endstate,
++					u32 start_shift, u32 end_shift,
++					u32 *tms_mask)
++{
++	u32 pre_tms = start_shift ? _tms_cycle_lookup[from][to].count : 0;
++	u32 post_tms = end_shift ? _tms_cycle_lookup[there][endstate].count : 0;
++	u32 tms_value = start_shift ? _tms_cycle_lookup[from][to].tmsbits : 0;
++
++	tms_value |= end_shift ? _tms_cycle_lookup[there][endstate].tmsbits
++					 << pre_tms :
++				 0;
++	*tms_mask = start_shift | ASPEED_JTAG_SHCTRL_PRE_TMS(pre_tms) |
++		    end_shift | ASPEED_JTAG_SHCTRL_POST_TMS(post_tms) |
++		    ASPEED_JTAG_SHCTRL_TMS(tms_value);
++}
++
++static void aspeed_jtag_set_tap_state_hw2(struct aspeed_jtag *aspeed_jtag,
++					  struct jtag_tap_state *tapstate)
++{
++	u32 reg_val;
++	u32 start_shift = ASPEED_JTAG_SHCTRL_START_SHIFT;
++	u32 tms_mask = 0;
++
++	/* x TMS high + 1 TMS low */
++	if (tapstate->reset) {
++		/* Disable sw mode */
++		aspeed_jtag_write(aspeed_jtag, 0, ASPEED_JTAG_SW);
 +		mdelay(1);
++		reg_val = aspeed_jtag_read(aspeed_jtag, ASPEED_JTAG_GBLCTRL);
 +		aspeed_jtag_write(aspeed_jtag,
-+				  ASPEED_JTAG_SW_TDIO, ASPEED_JTAG_SW);
++				  reg_val | ASPEED_JTAG_GBLCTRL_ENG_MODE_EN |
++					  ASPEED_JTAG_GBLCTRL_ENG_OUT_EN |
++					  ASPEED_JTAG_GBLCTRL_RESET_FIFO |
++					  ASPEED_JTAG_GBLCTRL_FORCE_TMS,
++				  ASPEED_JTAG_GBLCTRL);
++		mdelay(1);
 +		aspeed_jtag->status = JTAG_STATE_TLRESET;
++		return;
++	}
++
++	if (tapstate->from != tapstate->endstate) {
++		aspeed_jtag_shctrl_tms_mask(tapstate->from, tapstate->endstate,
++					    JTAG_STATE_TLRESET,
++					    JTAG_STATE_TLRESET, start_shift,
++					    ASPEED_JTAG_END_SHIFT_DISABLED,
++					    &tms_mask);
++
++		/* Trigger a 0 bit transfer to execute pre tms flow*/
++		aspeed_jtag_write(aspeed_jtag,
++				  tms_mask | ASPEED_JTAG_SHCTRL_LWRDT_SHIFT(0),
++				  ASPEED_JTAG_SHCTRL);
++		aspeed_jtag_wait_shift_complete(aspeed_jtag);
++		reg_val = aspeed_jtag_read(aspeed_jtag, ASPEED_JTAG_GBLCTRL);
++		aspeed_jtag_write(aspeed_jtag,
++				  reg_val | ASPEED_JTAG_GBLCTRL_RESET_FIFO,
++				  ASPEED_JTAG_GBLCTRL);
 +	}
++	aspeed_jtag->status = tapstate->endstate;
++}
++
++static int aspeed_jtag_status_set_26xx(struct jtag *jtag,
++				       struct jtag_tap_state *tapstate)
++{
++	struct aspeed_jtag *aspeed_jtag = jtag_priv(jtag);
 +
++#ifdef DEBUG_JTAG
++	dev_dbg(aspeed_jtag->dev, "Set TAP state: %s\n",
++		end_status_str[tapstate->endstate]);
++#endif
++
++	if (!(aspeed_jtag->mode & JTAG_XFER_HW_MODE)) {
++		aspeed_jtag_set_tap_state_sw(aspeed_jtag, tapstate);
++		return 0;
++	}
++
++	aspeed_jtag_set_tap_state_hw2(aspeed_jtag, tapstate);
 +	return 0;
 +}
 +
@@ -965,8 +1072,8 @@ index 0000000..1e6ace6
 +	while (remain_xfer > 1) {
 +		tdo = aspeed_jtag_tck_cycle(aspeed_jtag, 0,
 +					    tdi & ASPEED_JTAG_DATA_MSB);
-+		data[index] |= tdo << (shift_bits %
-+					    ASPEED_JTAG_DATA_CHUNK_SIZE);
++		data[index] |= tdo
++			       << (shift_bits % ASPEED_JTAG_DATA_CHUNK_SIZE);
 +		tdi >>= 1;
 +		shift_bits++;
 +		remain_xfer--;
@@ -980,41 +1087,49 @@ index 0000000..1e6ace6
 +	}
 +
 +	if ((xfer->endstate == (xfer->type == JTAG_SIR_XFER ?
-+				JTAG_STATE_SHIFTIR : JTAG_STATE_SHIFTDR))) {
++					JTAG_STATE_SHIFTIR :
++					JTAG_STATE_SHIFTDR))) {
 +		/* Stay in Shift IR/DR*/
 +		tdo = aspeed_jtag_tck_cycle(aspeed_jtag, 0,
 +					    tdi & ASPEED_JTAG_DATA_MSB);
-+		data[index] |= tdo << (shift_bits %
-+					ASPEED_JTAG_DATA_CHUNK_SIZE);
-+	} else  {
++		data[index] |= tdo
++			       << (shift_bits % ASPEED_JTAG_DATA_CHUNK_SIZE);
++	} else {
 +		/* Goto end state */
 +		tdo = aspeed_jtag_tck_cycle(aspeed_jtag, 1,
 +					    tdi & ASPEED_JTAG_DATA_MSB);
-+		data[index] |= tdo << (shift_bits %
-+				       ASPEED_JTAG_DATA_CHUNK_SIZE);
++		data[index] |= tdo
++			       << (shift_bits % ASPEED_JTAG_DATA_CHUNK_SIZE);
 +		aspeed_jtag->status = (xfer->type == JTAG_SIR_XFER) ?
-+				       JTAG_STATE_EXIT1IR : JTAG_STATE_EXIT1DR;
++					      JTAG_STATE_EXIT1IR :
++					      JTAG_STATE_EXIT1DR;
 +		aspeed_jtag_set_tap_state(aspeed_jtag, aspeed_jtag->status,
 +					  xfer->endstate);
 +	}
 +}
 +
 +static int aspeed_jtag_xfer_push_data_26xx(struct aspeed_jtag *aspeed_jtag,
-+				      enum jtag_xfer_type type, u32 bits_len)
++					   enum jtag_xfer_type type,
++					   u32 bits_len)
 +{
 +	int res = 0;
 +
 +	aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_TRANS_LEN(bits_len),
 +			  ASPEED_JTAG_CTRL);
 +	if (type == JTAG_SIR_XFER) {
-+		aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_TRANS_LEN(bits_len) |
-+				  ASPEED_JTAG_CTL_26XX_INST_EN,
++		aspeed_jtag_write(aspeed_jtag,
++				  ASPEED_JTAG_TRANS_LEN(bits_len) |
++					  ASPEED_JTAG_CTL_26XX_INST_EN,
 +				  ASPEED_JTAG_CTRL);
-+		res = aspeed_jtag_wait_instruction_pause(aspeed_jtag);
++		res = aspeed_jtag_isr_wait(aspeed_jtag,
++					   ASPEED_JTAG_ISR_INST_PAUSE);
 +	} else {
-+		aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_TRANS_LEN(bits_len) |
-+				  ASPEED_JTAG_CTL_DATA_EN, ASPEED_JTAG_CTRL);
-+		res = aspeed_jtag_wait_data_pause_complete(aspeed_jtag);
++		aspeed_jtag_write(aspeed_jtag,
++				  ASPEED_JTAG_TRANS_LEN(bits_len) |
++					  ASPEED_JTAG_CTL_DATA_EN,
++				  ASPEED_JTAG_CTRL);
++		res = aspeed_jtag_isr_wait(aspeed_jtag,
++					   ASPEED_JTAG_ISR_DATA_PAUSE);
 +	}
 +	return res;
 +}
@@ -1027,41 +1142,51 @@ index 0000000..1e6ace6
 +	if (type == JTAG_SIR_XFER) {
 +		aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_IOUT_LEN(bits_len),
 +				  ASPEED_JTAG_CTRL);
-+		aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_IOUT_LEN(bits_len) |
-+				  ASPEED_JTAG_CTL_INST_EN, ASPEED_JTAG_CTRL);
-+		res = aspeed_jtag_wait_instruction_pause(aspeed_jtag);
++		aspeed_jtag_write(aspeed_jtag,
++				  ASPEED_JTAG_IOUT_LEN(bits_len) |
++					  ASPEED_JTAG_CTL_INST_EN,
++				  ASPEED_JTAG_CTRL);
++		res = aspeed_jtag_isr_wait(aspeed_jtag,
++					   ASPEED_JTAG_ISR_INST_PAUSE);
 +	} else {
 +		aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_DOUT_LEN(bits_len),
 +				  ASPEED_JTAG_CTRL);
-+		aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_DOUT_LEN(bits_len) |
-+				  ASPEED_JTAG_CTL_DATA_EN, ASPEED_JTAG_CTRL);
-+		res = aspeed_jtag_wait_data_pause_complete(aspeed_jtag);
++		aspeed_jtag_write(aspeed_jtag,
++				  ASPEED_JTAG_DOUT_LEN(bits_len) |
++					  ASPEED_JTAG_CTL_DATA_EN,
++				  ASPEED_JTAG_CTRL);
++		res = aspeed_jtag_isr_wait(aspeed_jtag,
++					   ASPEED_JTAG_ISR_DATA_PAUSE);
 +	}
 +	return res;
 +}
 +
 +static int aspeed_jtag_xfer_push_data_last_26xx(struct aspeed_jtag *aspeed_jtag,
-+					   enum jtag_xfer_type type,
-+					   u32 shift_bits)
++						enum jtag_xfer_type type,
++						u32 shift_bits)
 +{
 +	int res = 0;
 +
-+	aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_TRANS_LEN(shift_bits) |
-+			  ASPEED_JTAG_CTL_26XX_LASPEED_TRANS, ASPEED_JTAG_CTRL);
++	aspeed_jtag_write(aspeed_jtag,
++			  ASPEED_JTAG_TRANS_LEN(shift_bits) |
++				  ASPEED_JTAG_CTL_26XX_LASPEED_TRANS,
++			  ASPEED_JTAG_CTRL);
 +	if (type == JTAG_SIR_XFER) {
 +		aspeed_jtag_write(aspeed_jtag,
 +				  ASPEED_JTAG_TRANS_LEN(shift_bits) |
-+				  ASPEED_JTAG_CTL_26XX_LASPEED_TRANS |
-+				  ASPEED_JTAG_CTL_26XX_INST_EN,
++					  ASPEED_JTAG_CTL_26XX_LASPEED_TRANS |
++					  ASPEED_JTAG_CTL_26XX_INST_EN,
 +				  ASPEED_JTAG_CTRL);
-+		res = aspeed_jtag_wait_instruction_complete(aspeed_jtag);
++		res = aspeed_jtag_isr_wait(aspeed_jtag,
++					   ASPEED_JTAG_ISR_INST_COMPLETE);
 +	} else {
 +		aspeed_jtag_write(aspeed_jtag,
 +				  ASPEED_JTAG_TRANS_LEN(shift_bits) |
-+				  ASPEED_JTAG_CTL_26XX_LASPEED_TRANS |
-+				  ASPEED_JTAG_CTL_DATA_EN,
++					  ASPEED_JTAG_CTL_26XX_LASPEED_TRANS |
++					  ASPEED_JTAG_CTL_DATA_EN,
 +				  ASPEED_JTAG_CTRL);
-+		res = aspeed_jtag_wait_data_complete(aspeed_jtag);
++		res = aspeed_jtag_isr_wait(aspeed_jtag,
++					   ASPEED_JTAG_ISR_DATA_COMPLETE);
 +	}
 +	return res;
 +}
@@ -1075,25 +1200,27 @@ index 0000000..1e6ace6
 +	if (type == JTAG_SIR_XFER) {
 +		aspeed_jtag_write(aspeed_jtag,
 +				  ASPEED_JTAG_IOUT_LEN(shift_bits) |
-+				  ASPEED_JTAG_CTL_LASPEED_INST,
++					  ASPEED_JTAG_CTL_LASPEED_INST,
 +				  ASPEED_JTAG_CTRL);
 +		aspeed_jtag_write(aspeed_jtag,
 +				  ASPEED_JTAG_IOUT_LEN(shift_bits) |
-+				  ASPEED_JTAG_CTL_LASPEED_INST |
-+				  ASPEED_JTAG_CTL_INST_EN,
++					  ASPEED_JTAG_CTL_LASPEED_INST |
++					  ASPEED_JTAG_CTL_INST_EN,
 +				  ASPEED_JTAG_CTRL);
-+		res = aspeed_jtag_wait_instruction_complete(aspeed_jtag);
++		res = aspeed_jtag_isr_wait(aspeed_jtag,
++					   ASPEED_JTAG_ISR_INST_COMPLETE);
 +	} else {
 +		aspeed_jtag_write(aspeed_jtag,
 +				  ASPEED_JTAG_DOUT_LEN(shift_bits) |
-+				  ASPEED_JTAG_CTL_LASPEED_DATA,
++					  ASPEED_JTAG_CTL_LASPEED_DATA,
 +				  ASPEED_JTAG_CTRL);
 +		aspeed_jtag_write(aspeed_jtag,
 +				  ASPEED_JTAG_DOUT_LEN(shift_bits) |
-+				  ASPEED_JTAG_CTL_LASPEED_DATA |
-+				  ASPEED_JTAG_CTL_DATA_EN,
++					  ASPEED_JTAG_CTL_LASPEED_DATA |
++					  ASPEED_JTAG_CTL_DATA_EN,
 +				  ASPEED_JTAG_CTRL);
-+		res = aspeed_jtag_wait_data_complete(aspeed_jtag);
++		res = aspeed_jtag_isr_wait(aspeed_jtag,
++					   ASPEED_JTAG_ISR_DATA_COMPLETE);
 +	}
 +	return res;
 +}
@@ -1111,8 +1238,8 @@ index 0000000..1e6ace6
 +	dev_dbg(aspeed_jtag->dev, "HW JTAG SHIFT %s, length = %d\n",
 +		(xfer->type == JTAG_SIR_XFER) ? "IR" : "DR", xfer->length);
 +#endif
-+	data_reg = xfer->type == JTAG_SIR_XFER ?
-+		   ASPEED_JTAG_INST : ASPEED_JTAG_DATA;
++	data_reg = xfer->type == JTAG_SIR_XFER ? ASPEED_JTAG_INST :
++						 ASPEED_JTAG_DATA;
 +	if (xfer->endstate == JTAG_STATE_SHIFTIR ||
 +	    xfer->endstate == JTAG_STATE_SHIFTDR ||
 +	    xfer->endstate == JTAG_STATE_PAUSEIR ||
@@ -1142,7 +1269,9 @@ index 0000000..1e6ace6
 +			 * and after the transfer go to Pause IR/DR.
 +			 */
 +			if (aspeed_jtag->llops->xfer_push_data(aspeed_jtag,
-+						xfer->type, shift_bits) != 0) {
++							       xfer->type,
++							       shift_bits)
++							       != 0) {
 +				return -EFAULT;
 +			}
 +		} else {
@@ -1157,15 +1286,14 @@ index 0000000..1e6ace6
 +				 */
 +#ifdef DEBUG_JTAG
 +				dev_dbg(aspeed_jtag->dev,
-+				"Last len=%d chunk_size=%d remain_xfer=%lu\n",
++					"Last len=%d chunk_size=%d remain_xfer=%lu\n",
 +					xfer->length,
 +					ASPEED_JTAG_DATA_CHUNK_SIZE,
 +					remain_xfer);
 +#endif
 +				if (aspeed_jtag->llops->xfer_push_data_last(
-+							aspeed_jtag,
-+							xfer->type,
-+							shift_bits) != 0) {
++					    aspeed_jtag, xfer->type,
++					    shift_bits) != 0) {
 +					return -EFAULT;
 +				}
 +			} else {
@@ -1176,16 +1304,14 @@ index 0000000..1e6ace6
 +				 */
 +#ifdef DEBUG_JTAG
 +				dev_dbg(aspeed_jtag->dev,
-+				"Tail len=%d chunk_size=%d remain_xfer=%lu\n",
++					"Tail len=%d chunk_size=%d remain_xfer=%lu\n",
 +					xfer->length,
 +					ASPEED_JTAG_DATA_CHUNK_SIZE,
 +					remain_xfer);
 +#endif
 +				if (aspeed_jtag->llops->xfer_push_data(
-+							       aspeed_jtag,
-+							       xfer->type,
-+							       shift_bits)
-+							       != 0) {
++					    aspeed_jtag, xfer->type,
++					    shift_bits) != 0) {
 +					return -EFAULT;
 +				}
 +			}
@@ -1193,14 +1319,14 @@ index 0000000..1e6ace6
 +
 +		if (xfer->direction & JTAG_READ_XFER) {
 +			if (shift_bits < ASPEED_JTAG_DATA_CHUNK_SIZE) {
-+				data[index] = aspeed_jtag_read(aspeed_jtag,
-+							       data_reg);
++				data[index] =
++					aspeed_jtag_read(aspeed_jtag, data_reg);
 +
 +				data[index] >>= ASPEED_JTAG_DATA_CHUNK_SIZE -
-+								shift_bits;
++						shift_bits;
 +			} else {
-+				data[index] = aspeed_jtag_read(aspeed_jtag,
-+							       data_reg);
++				data[index] =
++					aspeed_jtag_read(aspeed_jtag, data_reg);
 +			}
 +		}
 +
@@ -1220,12 +1346,13 @@ index 0000000..1e6ace6
 +		aspeed_jtag_write(aspeed_jtag, ASPEED_JTAG_SW_TDIO,
 +				  ASPEED_JTAG_SW);
 +
-+		aspeed_jtag_xfer_sw(aspeed_jtag, xfer, (u32 *)xfer_data);
++		aspeed_jtag->llops->xfer_sw(aspeed_jtag, xfer,
++					    (u32 *)xfer_data);
 +	} else {
 +		/* HW mode */
 +		aspeed_jtag_write(aspeed_jtag, 0, ASPEED_JTAG_SW);
-+		if (aspeed_jtag_xfer_hw(aspeed_jtag, xfer,
-+					(u32 *)xfer_data) != 0)
++		if (aspeed_jtag->llops->xfer_hw(aspeed_jtag, xfer,
++						(u32 *)xfer_data) != 0)
 +			return -EFAULT;
 +	}
 +
@@ -1233,6 +1360,160 @@ index 0000000..1e6ace6
 +	return 0;
 +}
 +
++static int aspeed_jtag_xfer_hw2(struct aspeed_jtag *aspeed_jtag,
++				struct jtag_xfer *xfer, u32 *data)
++{
++	unsigned long remain_xfer = xfer->length;
++	unsigned long partial_xfer_size = 0;
++	unsigned long index = 0;
++	u32 shift_bits;
++	u32 data_reg;
++	u32 reg_val;
++	enum jtag_tapstate shift;
++	enum jtag_tapstate exit;
++	u32 start_shift;
++	u32 end_shift;
++	u32 tms_mask;
++
++	if (xfer->type == JTAG_SIR_XFER) {
++		data_reg = ASPEED_JTAG_SHDATA;
++		shift = JTAG_STATE_SHIFTIR;
++		exit = JTAG_STATE_EXIT1IR;
++	} else {
++		data_reg = ASPEED_JTAG_SHDATA;
++		shift = JTAG_STATE_SHIFTDR;
++		exit = JTAG_STATE_EXIT1DR;
++	}
++#ifdef DEBUG_JTAG
++	dev_dbg(aspeed_jtag->dev,
++		"HW2 JTAG SHIFT %s, length %d from %s to %s then %s stat %s\n",
++		(xfer->type == JTAG_SIR_XFER) ? "IR" : "DR", xfer->length,
++		end_status_str[xfer->from], end_status_str[shift],
++		end_status_str[xfer->endstate],
++		end_status_str[aspeed_jtag->status]);
++#endif
++
++	if (xfer->from == shift) {
++		start_shift = 0;
++	} else {
++		reg_val = aspeed_jtag_read(aspeed_jtag, ASPEED_JTAG_GBLCTRL);
++		aspeed_jtag_write(aspeed_jtag,
++				  reg_val | ASPEED_JTAG_GBLCTRL_RESET_FIFO,
++				  ASPEED_JTAG_GBLCTRL);
++		start_shift = ASPEED_JTAG_SHCTRL_START_SHIFT;
++	}
++
++	if (xfer->endstate == shift)
++		end_shift = 0;
++	else
++		end_shift = ASPEED_JTAG_SHCTRL_END_SHIFT;
++
++	while (remain_xfer) {
++		unsigned long partial_xfer;
++		unsigned long partial_index;
++
++		if (remain_xfer > ASPEED_JTAG_HW2_DATA_CHUNK_SIZE)
++			partial_xfer_size = ASPEED_JTAG_HW2_DATA_CHUNK_SIZE;
++		else
++			partial_xfer_size = remain_xfer;
++
++		partial_index = index;
++		partial_xfer = partial_xfer_size;
++		while (partial_xfer) {
++			if (partial_xfer > ASPEED_JTAG_DATA_CHUNK_SIZE)
++				shift_bits = ASPEED_JTAG_DATA_CHUNK_SIZE;
++			else
++				shift_bits = partial_xfer;
++
++			if (xfer->direction & JTAG_WRITE_XFER)
++				aspeed_jtag_write(aspeed_jtag,
++						  data[partial_index++],
++						  data_reg);
++			else
++				aspeed_jtag_write(aspeed_jtag, 0, data_reg);
++			partial_xfer = partial_xfer - shift_bits;
++		}
++		if (remain_xfer > ASPEED_JTAG_HW2_DATA_CHUNK_SIZE) {
++			shift_bits = ASPEED_JTAG_HW2_DATA_CHUNK_SIZE;
++
++			/*
++			 * Transmit bytes that were not equals to column length
++			 * and after the transfer go to Pause IR/DR.
++			 */
++
++			aspeed_jtag_shctrl_tms_mask(xfer->from, shift, exit,
++						    xfer->endstate, start_shift,
++						    0, &tms_mask);
++
++			reg_val = aspeed_jtag_read(aspeed_jtag,
++						   ASPEED_JTAG_GBLCTRL);
++			reg_val = reg_val & ~(GENMASK(22, 20));
++			aspeed_jtag_write(aspeed_jtag, reg_val |
++					  ASPEED_JTAG_GBLCTRL_FIFO_CTRL_MODE |
++					  ASPEED_JTAG_GBLCTRL_UPDT_SHIFT(
++						shift_bits),
++					  ASPEED_JTAG_GBLCTRL);
++
++			aspeed_jtag_write(aspeed_jtag, tms_mask |
++				ASPEED_JTAG_SHCTRL_LWRDT_SHIFT(shift_bits),
++				ASPEED_JTAG_SHCTRL);
++			aspeed_jtag_wait_shift_complete(aspeed_jtag);
++		} else {
++			/*
++			 * Read bytes equals to column length
++			 */
++			shift_bits = remain_xfer;
++			aspeed_jtag_shctrl_tms_mask(xfer->from, shift, exit,
++						    xfer->endstate, start_shift,
++						    end_shift, &tms_mask);
++
++			reg_val = aspeed_jtag_read(aspeed_jtag,
++						   ASPEED_JTAG_GBLCTRL);
++			reg_val = reg_val & ~(GENMASK(22, 20));
++			aspeed_jtag_write(aspeed_jtag, reg_val |
++					  ASPEED_JTAG_GBLCTRL_FIFO_CTRL_MODE |
++					  ASPEED_JTAG_GBLCTRL_UPDT_SHIFT(
++						shift_bits),
++					  ASPEED_JTAG_GBLCTRL);
++
++			aspeed_jtag_write(aspeed_jtag, tms_mask |
++					  ASPEED_JTAG_SHCTRL_LWRDT_SHIFT(
++						  shift_bits),
++					  ASPEED_JTAG_SHCTRL);
++
++			aspeed_jtag_wait_shift_complete(aspeed_jtag);
++		}
++
++		if (xfer->direction & JTAG_READ_XFER) {
++			partial_index = index;
++			partial_xfer = partial_xfer_size;
++			while (partial_xfer) {
++				if (partial_xfer >
++				    ASPEED_JTAG_DATA_CHUNK_SIZE) {
++					shift_bits =
++						ASPEED_JTAG_DATA_CHUNK_SIZE;
++					data[partial_index++] =
++						aspeed_jtag_read(aspeed_jtag,
++								 data_reg);
++
++				} else {
++					shift_bits = partial_xfer;
++					data[partial_index++] =
++						aspeed_jtag_read(aspeed_jtag,
++								 data_reg);
++				}
++				partial_xfer = partial_xfer - shift_bits;
++			}
++		}
++
++		remain_xfer = remain_xfer - partial_xfer_size;
++		index = partial_index;
++		start_shift = 0;
++	}
++	aspeed_jtag->status = xfer->endstate;
++	return 0;
++}
++
 +static int aspeed_jtag_status_get(struct jtag *jtag, u32 *status)
 +{
 +	struct aspeed_jtag *aspeed_jtag = jtag_priv(jtag);
@@ -1252,8 +1533,9 @@ index 0000000..1e6ace6
 +
 +	if (status & ASPEED_JTAG_ISR_INT_MASK) {
 +		aspeed_jtag_write(aspeed_jtag,
-+				  (status & ASPEED_JTAG_ISR_INT_MASK)
-+				  | (status & ASPEED_JTAG_ISR_INT_EN_MASK),
++				  (status & ASPEED_JTAG_ISR_INT_MASK) |
++					  (status &
++					   ASPEED_JTAG_ISR_INT_EN_MASK),
 +				  ASPEED_JTAG_ISR);
 +		aspeed_jtag->flag |= status & ASPEED_JTAG_ISR_INT_MASK;
 +	}
@@ -1262,8 +1544,7 @@ index 0000000..1e6ace6
 +		wake_up_interruptible(&aspeed_jtag->jtag_wq);
 +		ret = IRQ_HANDLED;
 +	} else {
-+		dev_err(aspeed_jtag->dev, "irq status:%x\n",
-+			status);
++		dev_err(aspeed_jtag->dev, "irq status:%x\n", status);
 +		ret = IRQ_NONE;
 +	}
 +	return ret;
@@ -1274,7 +1555,7 @@ index 0000000..1e6ace6
 +{
 +	struct aspeed_jtag *aspeed_jtag = jtag_priv(jtag);
 +
-+	aspeed_jtag_master(aspeed_jtag);
++	aspeed_jtag->llops->master_enable(aspeed_jtag);
 +	return 0;
 +}
 +
@@ -1282,7 +1563,7 @@ index 0000000..1e6ace6
 +{
 +	struct aspeed_jtag *aspeed_jtag = jtag_priv(jtag);
 +
-+	aspeed_jtag_output_disable(aspeed_jtag);
++	aspeed_jtag->llops->output_disable(aspeed_jtag);
 +	return 0;
 +}
 +
@@ -1328,8 +1609,8 @@ index 0000000..1e6ace6
 +
 +#ifdef USE_INTERRUPTS
 +	err = devm_request_irq(aspeed_jtag->dev, aspeed_jtag->irq,
-+			       aspeed_jtag_interrupt, 0,
-+			       "aspeed-jtag", aspeed_jtag);
++			       aspeed_jtag_interrupt, 0, "aspeed-jtag",
++			       aspeed_jtag);
 +	if (err) {
 +		dev_err(aspeed_jtag->dev, "unable to get IRQ");
 +		clk_disable_unprepare(aspeed_jtag->pclk);
@@ -1337,7 +1618,7 @@ index 0000000..1e6ace6
 +	}
 +#endif
 +
-+	aspeed_jtag_output_disable(aspeed_jtag);
++	aspeed_jtag->llops->output_disable(aspeed_jtag);
 +
 +	aspeed_jtag->flag = 0;
 +	aspeed_jtag->mode = 0;
@@ -1368,25 +1649,59 @@ index 0000000..1e6ace6
 +	.disable = aspeed_jtag_disable
 +};
 +
++static const struct jtag_ops aspeed_jtag_ops_26xx = {
++#ifdef ASPEED_JTAG_HW_MODE_2_ENABLE
++	.freq_get = aspeed_jtag_freq_get_26xx,
++	.freq_set = aspeed_jtag_freq_set_26xx,
++	.status_get = aspeed_jtag_status_get,
++	.status_set = aspeed_jtag_status_set_26xx,
++#else
++	.freq_get = aspeed_jtag_freq_get,
++	.freq_set = aspeed_jtag_freq_set,
++	.status_get = aspeed_jtag_status_get,
++	.status_set = aspeed_jtag_status_set,
++#endif
++	.xfer = aspeed_jtag_xfer,
++	.mode_set = aspeed_jtag_mode_set,
++	.bitbang = aspeed_jtag_bitbang,
++	.enable = aspeed_jtag_enable,
++	.disable = aspeed_jtag_disable
++};
++
 +static const struct jtag_low_level_functions ast25xx_llops = {
++	.master_enable = aspeed_jtag_master,
 +	.output_disable = aspeed_jtag_output_disable,
 +	.xfer_push_data = aspeed_jtag_xfer_push_data,
-+	.xfer_push_data_last = aspeed_jtag_xfer_push_data_last
++	.xfer_push_data_last = aspeed_jtag_xfer_push_data_last,
++	.xfer_sw = aspeed_jtag_xfer_sw,
++	.xfer_hw = aspeed_jtag_xfer_hw
 +};
 +
-+static struct aspeed_jtag_functions ast25xx_functions = {
++static const struct aspeed_jtag_functions ast25xx_functions = {
 +	.aspeed_jtag_ops = &aspeed_jtag_ops,
 +	.aspeed_jtag_llops = &ast25xx_llops
 +};
 +
 +static const struct jtag_low_level_functions ast26xx_llops = {
++#ifdef ASPEED_JTAG_HW_MODE_2_ENABLE
++	.master_enable = aspeed_jtag_master_26xx,
++	.output_disable = aspeed_jtag_output_disable_26xx,
++	.xfer_push_data = aspeed_jtag_xfer_push_data_26xx,
++	.xfer_push_data_last = aspeed_jtag_xfer_push_data_last_26xx,
++	.xfer_sw = aspeed_jtag_xfer_sw,
++	.xfer_hw = aspeed_jtag_xfer_hw2
++#else
++	.master_enable = aspeed_jtag_master,
 +	.output_disable = aspeed_jtag_output_disable,
 +	.xfer_push_data = aspeed_jtag_xfer_push_data_26xx,
-+	.xfer_push_data_last = aspeed_jtag_xfer_push_data_last_26xx
++	.xfer_push_data_last = aspeed_jtag_xfer_push_data_last_26xx,
++	.xfer_sw = aspeed_jtag_xfer_sw,
++	.xfer_hw = aspeed_jtag_xfer_hw
++#endif
 +};
 +
-+static struct aspeed_jtag_functions ast26xx_functions = {
-+	.aspeed_jtag_ops = &aspeed_jtag_ops,
++static const struct aspeed_jtag_functions ast26xx_functions = {
++	.aspeed_jtag_ops = &aspeed_jtag_ops_26xx,
 +	.aspeed_jtag_llops = &ast26xx_llops
 +};
 +
@@ -1402,7 +1717,7 @@ index 0000000..1e6ace6
 +	struct aspeed_jtag *aspeed_jtag;
 +	struct jtag *jtag;
 +	const struct of_device_id *match;
-+	struct aspeed_jtag_functions *jtag_functions;
++	const struct aspeed_jtag_functions *jtag_functions;
 +	int err;
 +
 +	match = of_match_node(aspeed_jtag_of_match, pdev->dev.of_node);
@@ -1462,5 +1777,4 @@ index 0000000..1e6ace6
 +MODULE_DESCRIPTION("ASPEED JTAG driver");
 +MODULE_LICENSE("GPL v2");
 -- 
-2.7.4
-
+2.7.4
\ No newline at end of file
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0116-watchdog-aspeed-fix-AST2600-support.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0116-watchdog-aspeed-fix-AST2600-support.patch
new file mode 100644
index 000000000..3f71219de
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0116-watchdog-aspeed-fix-AST2600-support.patch
@@ -0,0 +1,49 @@
+From f911c7c994bf57685254f3b92e03e999d9cf058a Mon Sep 17 00:00:00 2001
+From: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+Date: Thu, 25 Jun 2020 23:56:15 -0700
+Subject: [PATCH] watchdog: aspeed: fix AST2600 support
+
+AST2600 provides different function of WDT0C[4] and it doesn't
+provides WDT10[1] so this commit fixes driver to make it don't
+use these register bits in case of AST2600.
+
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+---
+ drivers/watchdog/aspeed_wdt.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c
+index 7e00960651fa..5a74b439e3b1 100644
+--- a/drivers/watchdog/aspeed_wdt.c
++++ b/drivers/watchdog/aspeed_wdt.c
+@@ -279,6 +279,8 @@ static int aspeed_wdt_probe(struct platform_device *pdev)
+ 	 *  - ast2500 only runs at 1MHz, hard coding bit 4 to 1
+ 	 *  - ast2600 always runs at 1MHz
+ 	 *
++	 * Note: ast2600 uses WDT0C[4] as 'Enable WDT to be reset by SOC reset'
++	 *
+ 	 * Set the ast2400 to run at 1MHz as it simplifies the driver.
+ 	 */
+ 	if (of_device_is_compatible(np, "aspeed,ast2400-wdt"))
+@@ -367,13 +369,12 @@ static int aspeed_wdt_probe(struct platform_device *pdev)
+ 		writel(duration - 1, wdt->base + WDT_RESET_WIDTH);
+ 	}
+ 
+-	status = readl(wdt->base + WDT_TIMEOUT_STATUS);
+-	if (status & WDT_TIMEOUT_STATUS_BOOT_SECONDARY) {
+-		wdt->wdd.bootstatus = WDIOF_CARDRESET;
+-
+-		if (of_device_is_compatible(np, "aspeed,ast2400-wdt") ||
+-		    of_device_is_compatible(np, "aspeed,ast2500-wdt"))
++	if (!of_device_is_compatible(np, "aspeed,ast2600-wdt")) {
++		status = readl(wdt->base + WDT_TIMEOUT_STATUS);
++		if (status & WDT_TIMEOUT_STATUS_BOOT_SECONDARY) {
++			wdt->wdd.bootstatus = WDIOF_CARDRESET;
+ 			wdt->wdd.groups = bswitch_groups;
++		}
+ 	}
+ 
+ 	dev_set_drvdata(dev, wdt);
+-- 
+2.7.4
+
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0117-Copy-raw-PECI-response-to-user-space-on-timeout.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0117-Copy-raw-PECI-response-to-user-space-on-timeout.patch
new file mode 100644
index 000000000..f019b43ab
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/0117-Copy-raw-PECI-response-to-user-space-on-timeout.patch
@@ -0,0 +1,54 @@
+From c63c2466e3e8f61dd61fd98f4265af2e13ac9bac Mon Sep 17 00:00:00 2001
+From: "Jason M. Bills" <jason.m.bills@linux.intel.com>
+Date: Mon, 6 Jul 2020 13:59:52 -0700
+Subject: [PATCH] Copy raw PECI response to user-space on timeout
+
+When a raw PECI command times out, the response is not copied
+to user-space, so the timeout completion code is lost.
+
+This follows the default flow and also copies the response to
+user-space on timeout to give the user a valid completion code.
+
+Tested:
+Forced PECI timeout and confirmed that the raw PECI command
+returns a valid completion code to the user.
+
+Signed-off-by: Jason M. Bills <jason.m.bills@linux.intel.com>
+---
+ drivers/peci/peci-dev.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/peci/peci-dev.c b/drivers/peci/peci-dev.c
+index e0fe09467a80..c574d13213af 100644
+--- a/drivers/peci/peci-dev.c
++++ b/drivers/peci/peci-dev.c
+@@ -138,8 +138,13 @@ static long peci_dev_ioctl(struct file *file, uint iocmd, ulong arg)
+ 		xmsg->tx_len = uxmsg.tx_len;
+ 		xmsg->rx_len = uxmsg.rx_len;
+ 
++		/*
++		 * Send the command and copy the results back to user space on
++		 * either success or timeout to provide the completion code to
++		 * the caller.
++		 */
+ 		ret = peci_command(peci_dev->adapter, cmd, xmsg);
+-		if (!ret && xmsg->rx_len &&
++		if ((!ret || ret == -ETIMEDOUT) && xmsg->rx_len &&
+ 		    copy_to_user((__u8 __user *)uxmsg.rx_buf, xmsg->rx_buf,
+ 				 xmsg->rx_len))
+ 			ret = -EFAULT;
+@@ -153,6 +158,11 @@ static long peci_dev_ioctl(struct file *file, uint iocmd, ulong arg)
+ 			break;
+ 		}
+ 
++		/*
++		 * Send the command and copy the results back to user space on
++		 * either success or timeout to provide the completion code to
++		 * the caller.
++		 */
+ 		ret = peci_command(peci_dev->adapter, cmd, msg);
+ 		if ((!ret || ret == -ETIMEDOUT) &&
+ 		    copy_to_user(umsg, msg, msg_len))
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend
index 1c6a307ff..b176446c3 100644
--- a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed_%.bbappend
@@ -82,6 +82,8 @@ SRC_URI += " \
         file://0110-USB-gadget-fix-illegal-array-access-in-binding-with-.patch \
         file://0111-Unconditionally-calculate-the-PECI-AW-FCS.patch \
         file://0112-AST2600-enable-UART-routing.patch \
+        file://0116-watchdog-aspeed-fix-AST2600-support.patch \
+        file://0117-Copy-raw-PECI-response-to-user-space-on-timeout.patch \
         "
 
 SRC_URI += "${@bb.utils.contains('IMAGE_FSTYPES', 'intel-pfr', 'file://0005-128MB-flashmap-for-PFR.patch', '', d)}"
diff --git a/meta-openbmc-mods/meta-common/recipes-network/network/phosphor-network/0003-Adding-channel-specific-privilege-to-network.patch b/meta-openbmc-mods/meta-common/recipes-network/network/phosphor-network/0003-Adding-channel-specific-privilege-to-network.patch
index 05e26bedb..f361c3d07 100644
--- a/meta-openbmc-mods/meta-common/recipes-network/network/phosphor-network/0003-Adding-channel-specific-privilege-to-network.patch
+++ b/meta-openbmc-mods/meta-common/recipes-network/network/phosphor-network/0003-Adding-channel-specific-privilege-to-network.patch
@@ -200,7 +200,7 @@ index 68668d6..058d328 100644
  
  using IP = sdbusplus::xyz::openbmc_project::Network::server::IP;
  
-@@ -31,10 +35,15 @@ using EthernetInterfaceIntf =
+@@ -31,10 +35,14 @@ using EthernetInterfaceIntf =
      sdbusplus::xyz::openbmc_project::Network::server::EthernetInterface;
  using MacAddressIntf =
      sdbusplus::xyz::openbmc_project::Network::server::MACAddress;
@@ -210,8 +210,7 @@ index 68668d6..058d328 100644
  using ServerList = std::vector<std::string>;
  using ObjectPath = sdbusplus::message::object_path;
  
-+using DbusVariant =
-+    sdbusplus::message::variant<std::string, std::vector<std::string>>;
++using DbusVariant = std::variant<std::string, std::vector<std::string>>;
 +
  namespace fs = std::experimental::filesystem;
  
@@ -276,7 +275,7 @@ index 043d7a2..75f4e5f 100644
  Manager::Manager(sdbusplus::bus::bus& bus, const char* objPath,
                   const std::string& path) :
      details::VLANCreateIface(bus, objPath, true),
-@@ -41,6 +48,103 @@ Manager::Manager(sdbusplus::bus::bus& bus, const char* objPath,
+@@ -41,6 +48,101 @@ Manager::Manager(sdbusplus::bus::bus& bus, const char* objPath,
  {
      fs::path confDir(path);
      setConfDir(confDir);
@@ -345,12 +344,10 @@ index 043d7a2..75f4e5f 100644
 +            return;
 +        }
 +
-+        sdbusplus::message::variant<std::vector<std::string>> result;
++        std::variant<std::vector<std::string>> result;
 +        reply.read(result);
 +
-+        supportedPrivList =
-+            sdbusplus::message::variant_ns::get<std::vector<std::string>>(
-+                result);
++        supportedPrivList = std::get<std::vector<std::string>>(result);
 +    }
 +
 +    // Resgister the signal
@@ -370,8 +367,8 @@ index 043d7a2..75f4e5f 100644
 +                {
 +                    if (t.first == propNameAllPrivileges)
 +                    {
-+                        supportedPrivList = sdbusplus::message::variant_ns::get<
-+                            std::vector<std::string>>(t.second);
++                        supportedPrivList =
++                             std::get<std::vector<std::string>>(t.second);
 +                    }
 +                }
 +            });
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/configuration/entity-manager_%.bbappend b/meta-openbmc-mods/meta-common/recipes-phosphor/configuration/entity-manager_%.bbappend
index 813561384..e76c23fa6 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/configuration/entity-manager_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/configuration/entity-manager_%.bbappend
@@ -1,6 +1,6 @@
 # this is here just to bump faster than upstream
 SRC_URI = "git://github.com/openbmc/entity-manager.git"
-SRCREV = "8c505da0ffd8709f3c799a855ff921cfbd446201"
+SRCREV = "ac09fe44dba113aacee1d2fd995e137c0d5ea18e"
 
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
 
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/console/obmc-console/obmc-console.conf b/meta-openbmc-mods/meta-common/recipes-phosphor/console/obmc-console/obmc-console.conf
index 1d332e2a2..1d332e2a2 100644
--- a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/console/obmc-console/obmc-console.conf
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/console/obmc-console/obmc-console.conf
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/console/obmc-console/obmc-console@.service b/meta-openbmc-mods/meta-common/recipes-phosphor/console/obmc-console/obmc-console@.service
index 7fb8f79d3..7fb8f79d3 100644
--- a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/console/obmc-console/obmc-console@.service
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/console/obmc-console/obmc-console@.service
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/console/obmc-console/sol-option-check.sh b/meta-openbmc-mods/meta-common/recipes-phosphor/console/obmc-console/sol-option-check.sh
index ef32fcb9a..19179c497 100755
--- a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/console/obmc-console/sol-option-check.sh
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/console/obmc-console/sol-option-check.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-# Copyright 2017 Intel Corporation
+# Copyright 2017-2020 Intel Corporation
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -16,7 +16,14 @@
 #
 #
 
-if [ $(grep 192000000 /sys/class/tty/ttyS0/uartclk | wc -l) != 0 ]; then
+CPUPART="CPU part"
+AST2500_ID="0xb76"
+AST2600_ID="0xc07"
+
+if ([ $(grep "$CPUPART" /proc/cpuinfo | grep "$AST2500_ID" | wc -l) != 0 ] && \
+    [ $(grep 192000000 /sys/class/tty/ttyS0/uartclk | wc -l) != 0 ]) || \
+   ([ $(grep "$CPUPART" /proc/cpuinfo | grep "$AST2600_ID" | wc -l) != 0 ] && \
+    [ $(grep 14769216 /sys/class/tty/ttyS0/uartclk | wc -l) != 0 ]); then
   echo "hs-uart"
   sed -i -e 's/115200/921600/g' /etc/obmc-console.conf
 else
diff --git a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/console/obmc-console_%.bbappend b/meta-openbmc-mods/meta-common/recipes-phosphor/console/obmc-console_%.bbappend
index 7baf1cabc..09510fec8 100644
--- a/meta-openbmc-mods/meta-ast2500/recipes-phosphor/console/obmc-console_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/console/obmc-console_%.bbappend
@@ -1,4 +1,4 @@
-FILESEXTRAPATHS_prepend_intel-ast2500 := "${THISDIR}/${PN}:"
+FILESEXTRAPATHS_append := ":${THISDIR}/${PN}"
 OBMC_CONSOLE_HOST_TTY = "ttyS2"
 SRC_URI += "file://sol-option-check.sh \
             file://obmc-console@.service \
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/fans/phosphor-pid-control_%.bbappend b/meta-openbmc-mods/meta-common/recipes-phosphor/fans/phosphor-pid-control_%.bbappend
index e6c993658..5efc383f0 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/fans/phosphor-pid-control_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/fans/phosphor-pid-control_%.bbappend
@@ -5,6 +5,6 @@ SYSTEMD_SERVICE_${PN} = "phosphor-pid-control.service"
 EXTRA_OECONF = "--enable-configure-dbus=yes"
 
 SRC_URI = "git://github.com/openbmc/phosphor-pid-control.git"
-SRCREV = "e30916c9ef6d363328b95c9947ac95d94a2b6a24"
+SRCREV = "4b36f265a10048127d93e4b70916c181827c9af2"
 
 FILES_${PN} = "${bindir}/swampd ${bindir}/setsensor"
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0001-Add-more-error-types.patch b/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0001-Add-more-error-types.patch
new file mode 100644
index 000000000..d43256bf4
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0001-Add-more-error-types.patch
@@ -0,0 +1,459 @@
+From e710df3123c382fc735c451a048f7c51250c1a92 Mon Sep 17 00:00:00 2001
+From: James Feist <james.feist@linux.intel.com>
+Date: Thu, 11 Jun 2020 13:14:11 -0700
+Subject: [PATCH 1/2] Add more error types
+
+This adds ImageFailure and Busy error types
+to updates status in bmcweb.
+
+elog-errors.hpp is a generated file.
+
+Tested: Could create errors
+
+Signed-off-by: James Feist <james.feist@linux.intel.com>
+---
+ elog-errors.hpp                               | 269 ++++++++++++------
+ .../Software/Image.errors.yaml                |   5 +
+ .../Software/Image.metadata.yaml              |  11 +
+ 3 files changed, 204 insertions(+), 81 deletions(-)
+
+diff --git a/elog-errors.hpp b/elog-errors.hpp
+index 2888f0d..38016e1 100644
+--- a/elog-errors.hpp
++++ b/elog-errors.hpp
+@@ -2,12 +2,12 @@
+ // See elog-gen.py for more details
+ #pragma once
+ 
+-#include <phosphor-logging/elog.hpp>
+-#include <phosphor-logging/log.hpp>
+-#include <sdbusplus/exception.hpp>
+ #include <string>
+ #include <tuple>
+ #include <type_traits>
++#include <sdbusplus/exception.hpp>
++#include <phosphor-logging/log.hpp>
++#include <phosphor-logging/elog.hpp>
+ 
+ namespace sdbusplus
+ {
+@@ -21,7 +21,7 @@ namespace Image
+ {
+ namespace Error
+ {
+-struct UnTarFailure;
++    struct InternalFailure;
+ } // namespace Error
+ } // namespace Image
+ } // namespace Software
+@@ -41,7 +41,7 @@ namespace Image
+ {
+ namespace Error
+ {
+-struct InternalFailure;
++    struct UnTarFailure;
+ } // namespace Error
+ } // namespace Image
+ } // namespace Software
+@@ -61,7 +61,7 @@ namespace Image
+ {
+ namespace Error
+ {
+-struct ManifestFileFailure;
++    struct BusyFailure;
+ } // namespace Error
+ } // namespace Image
+ } // namespace Software
+@@ -69,6 +69,47 @@ struct ManifestFileFailure;
+ } // namespace xyz
+ } // namespace sdbusplus
+ 
++namespace sdbusplus
++{
++namespace xyz
++{
++namespace openbmc_project
++{
++namespace Software
++{
++namespace Image
++{
++namespace Error
++{
++    struct ImageFailure;
++} // namespace Error
++} // namespace Image
++} // namespace Software
++} // namespace openbmc_project
++} // namespace xyz
++} // namespace sdbusplus
++
++namespace sdbusplus
++{
++namespace xyz
++{
++namespace openbmc_project
++{
++namespace Software
++{
++namespace Image
++{
++namespace Error
++{
++    struct ManifestFileFailure;
++} // namespace Error
++} // namespace Image
++} // namespace Software
++} // namespace openbmc_project
++} // namespace xyz
++} // namespace sdbusplus
++
++
+ namespace phosphor
+ {
+ 
+@@ -88,38 +129,25 @@ namespace _UnTarFailure
+ 
+ struct PATH
+ {
+-    static constexpr auto str = "PATH=%s";
++    /*
++     * We can't use -fsanitize=undefined if we declare a
++     * 'static constexpr auto str' member, so don't. Instead, open-code the
++     * mako template lookups.
++     */
+     static constexpr auto str_short = "PATH";
+-    using type = std::tuple<std::decay_t<decltype(str)>, const char*>;
+-    explicit constexpr PATH(const char* a) : _entry(entry(str, a)){};
++    using type = std::tuple<std::decay_t<decltype("PATH=%s")>,const char*>;
++    explicit constexpr PATH(const char* a) : _entry(entry("PATH=%s", a)) {};
+     type _entry;
+ };
+ 
+-} // namespace _UnTarFailure
++}  // namespace _UnTarFailure
+ 
+-struct UnTarFailure : public sdbusplus::exception_t
++struct UnTarFailure
+ {
+-    static constexpr auto errName =
+-        "xyz.openbmc_project.Software.Image.UnTarFailure";
+-    static constexpr auto errDesc = "An error occurred during untar.";
+     static constexpr auto L = level::ERR;
+     using PATH = _UnTarFailure::PATH;
+     using metadata_types = std::tuple<PATH>;
+ 
+-    const char* name() const noexcept
+-    {
+-        return errName;
+-    }
+-
+-    const char* description() const noexcept
+-    {
+-        return errDesc;
+-    }
+-
+-    const char* what() const noexcept
+-    {
+-        return errName;
+-    }
+ };
+ 
+ } // namespace Image
+@@ -127,16 +155,17 @@ struct UnTarFailure : public sdbusplus::exception_t
+ } // namespace openbmc_project
+ } // namespace xyz
+ 
++
+ namespace details
+ {
+ 
+ template <>
+-struct map_exception_type<
+-    sdbusplus::xyz::openbmc_project::Software::Image::Error::UnTarFailure>
++struct map_exception_type<sdbusplus::xyz::openbmc_project::Software::Image::Error::UnTarFailure>
+ {
+     using type = xyz::openbmc_project::Software::Image::UnTarFailure;
+ };
+-} // namespace details
++
++}
+ 
+ namespace xyz
+ {
+@@ -151,38 +180,25 @@ namespace _ManifestFileFailure
+ 
+ struct PATH
+ {
+-    static constexpr auto str = "PATH=%s";
++    /*
++     * We can't use -fsanitize=undefined if we declare a
++     * 'static constexpr auto str' member, so don't. Instead, open-code the
++     * mako template lookups.
++     */
+     static constexpr auto str_short = "PATH";
+-    using type = std::tuple<std::decay_t<decltype(str)>, const char*>;
+-    explicit constexpr PATH(const char* a) : _entry(entry(str, a)){};
++    using type = std::tuple<std::decay_t<decltype("PATH=%s")>,const char*>;
++    explicit constexpr PATH(const char* a) : _entry(entry("PATH=%s", a)) {};
+     type _entry;
+ };
+ 
+-} // namespace _ManifestFileFailure
++}  // namespace _ManifestFileFailure
+ 
+-struct ManifestFileFailure : public sdbusplus::exception_t
++struct ManifestFileFailure
+ {
+-    static constexpr auto errName =
+-        "xyz.openbmc_project.Software.Image.ManifestFileFailure";
+-    static constexpr auto errDesc = "An error when reading the Manifest file.";
+     static constexpr auto L = level::ERR;
+     using PATH = _ManifestFileFailure::PATH;
+     using metadata_types = std::tuple<PATH>;
+ 
+-    const char* name() const noexcept
+-    {
+-        return errName;
+-    }
+-
+-    const char* description() const noexcept
+-    {
+-        return errDesc;
+-    }
+-
+-    const char* what() const noexcept
+-    {
+-        return errName;
+-    }
+ };
+ 
+ } // namespace Image
+@@ -190,16 +206,17 @@ struct ManifestFileFailure : public sdbusplus::exception_t
+ } // namespace openbmc_project
+ } // namespace xyz
+ 
++
+ namespace details
+ {
+ 
+ template <>
+-struct map_exception_type<sdbusplus::xyz::openbmc_project::Software::Image::
+-                              Error::ManifestFileFailure>
++struct map_exception_type<sdbusplus::xyz::openbmc_project::Software::Image::Error::ManifestFileFailure>
+ {
+     using type = xyz::openbmc_project::Software::Image::ManifestFileFailure;
+ };
+-} // namespace details
++
++}
+ 
+ namespace xyz
+ {
+@@ -214,39 +231,76 @@ namespace _InternalFailure
+ 
+ struct FAIL
+ {
+-    static constexpr auto str = "FAIL=%s";
++    /*
++     * We can't use -fsanitize=undefined if we declare a
++     * 'static constexpr auto str' member, so don't. Instead, open-code the
++     * mako template lookups.
++     */
+     static constexpr auto str_short = "FAIL";
+-    using type = std::tuple<std::decay_t<decltype(str)>, const char*>;
+-    explicit constexpr FAIL(const char* a) : _entry(entry(str, a)){};
++    using type = std::tuple<std::decay_t<decltype("FAIL=%s")>,const char*>;
++    explicit constexpr FAIL(const char* a) : _entry(entry("FAIL=%s", a)) {};
+     type _entry;
+ };
+ 
+-} // namespace _InternalFailure
++}  // namespace _InternalFailure
+ 
+-struct InternalFailure : public sdbusplus::exception_t
++struct InternalFailure
+ {
+-    static constexpr auto errName =
+-        "xyz.openbmc_project.Software.Image.InternalFailure";
+-    static constexpr auto errDesc =
+-        "The operation failed internally during processing the image.";
+     static constexpr auto L = level::ERR;
+     using FAIL = _InternalFailure::FAIL;
+     using metadata_types = std::tuple<FAIL>;
+ 
+-    const char* name() const noexcept
+-    {
+-        return errName;
+-    }
++};
++
++} // namespace Image
++} // namespace Software
++} // namespace openbmc_project
++} // namespace xyz
++
++
++namespace details
++{
++
++template <>
++struct map_exception_type<sdbusplus::xyz::openbmc_project::Software::Image::Error::InternalFailure>
++{
++    using type = xyz::openbmc_project::Software::Image::InternalFailure;
++};
++
++}
+ 
+-    const char* description() const noexcept
+-    {
+-        return errDesc;
+-    }
++namespace xyz
++{
++namespace openbmc_project
++{
++namespace Software
++{
++namespace Image
++{
++namespace _ImageFailure
++{
++
++struct PATH
++{
++    /*
++     * We can't use -fsanitize=undefined if we declare a
++     * 'static constexpr auto str' member, so don't. Instead, open-code the
++     * mako template lookups.
++     */
++    static constexpr auto str_short = "PATH";
++    using type = std::tuple<std::decay_t<decltype("PATH=%s")>,const char*>;
++    explicit constexpr PATH(const char* a) : _entry(entry("PATH=%s", a)) {};
++    type _entry;
++};
++
++}  // namespace _ImageFailure
++
++struct ImageFailure
++{
++    static constexpr auto L = level::ERR;
++    using PATH = _ImageFailure::PATH;
++    using metadata_types = std::tuple<PATH>;
+ 
+-    const char* what() const noexcept
+-    {
+-        return errName;
+-    }
+ };
+ 
+ } // namespace Image
+@@ -254,16 +308,69 @@ struct InternalFailure : public sdbusplus::exception_t
+ } // namespace openbmc_project
+ } // namespace xyz
+ 
++
+ namespace details
+ {
+ 
+ template <>
+-struct map_exception_type<
+-    sdbusplus::xyz::openbmc_project::Software::Image::Error::InternalFailure>
++struct map_exception_type<sdbusplus::xyz::openbmc_project::Software::Image::Error::ImageFailure>
+ {
+-    using type = xyz::openbmc_project::Software::Image::InternalFailure;
++    using type = xyz::openbmc_project::Software::Image::ImageFailure;
+ };
+-} // namespace details
++
++}
++
++namespace xyz
++{
++namespace openbmc_project
++{
++namespace Software
++{
++namespace Image
++{
++namespace _BusyFailure
++{
++
++struct PATH
++{
++    /*
++     * We can't use -fsanitize=undefined if we declare a
++     * 'static constexpr auto str' member, so don't. Instead, open-code the
++     * mako template lookups.
++     */
++    static constexpr auto str_short = "PATH";
++    using type = std::tuple<std::decay_t<decltype("PATH=%s")>,const char*>;
++    explicit constexpr PATH(const char* a) : _entry(entry("PATH=%s", a)) {};
++    type _entry;
++};
++
++}  // namespace _BusyFailure
++
++struct BusyFailure
++{
++    static constexpr auto L = level::ERR;
++    using PATH = _BusyFailure::PATH;
++    using metadata_types = std::tuple<PATH>;
++
++};
++
++} // namespace Image
++} // namespace Software
++} // namespace openbmc_project
++} // namespace xyz
++
++
++namespace details
++{
++
++template <>
++struct map_exception_type<sdbusplus::xyz::openbmc_project::Software::Image::Error::BusyFailure>
++{
++    using type = xyz::openbmc_project::Software::Image::BusyFailure;
++};
++
++}
++
+ 
+ } // namespace logging
+ 
+diff --git a/xyz/openbmc_project/Software/Image.errors.yaml b/xyz/openbmc_project/Software/Image.errors.yaml
+index 67d6c20..2b8f7ee 100644
+--- a/xyz/openbmc_project/Software/Image.errors.yaml
++++ b/xyz/openbmc_project/Software/Image.errors.yaml
+@@ -4,3 +4,8 @@
+   description: An error when reading the Manifest file.
+ - name: InternalFailure
+   description: The operation failed internally during processing the image.
++- name: ImageFailure
++  description: An error occured processing the image.
++- name: BusyFailure
++  description: The device is busy during the update.
++
+diff --git a/xyz/openbmc_project/Software/Image.metadata.yaml b/xyz/openbmc_project/Software/Image.metadata.yaml
+index 5e749c9..65d4e1c 100644
+--- a/xyz/openbmc_project/Software/Image.metadata.yaml
++++ b/xyz/openbmc_project/Software/Image.metadata.yaml
+@@ -13,3 +13,14 @@
+   meta:
+     - str: "FAIL=%s"
+       type: string
++- name: ImageFailure
++  level: ERR
++  meta:
++    - str: "PATH=%s"
++      type: string
++- name: BusyFailure
++  level: ERR
++  meta:
++    - str: "PATH=%s"
++      type: string
++
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0008-PFR-image-HASH-verification.patch b/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0008-PFR-image-HASH-verification.patch
index 31373104f..c65f8318c 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0008-PFR-image-HASH-verification.patch
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0008-PFR-image-HASH-verification.patch
@@ -8,11 +8,43 @@ firmware updates
 
 Tested: tested firmware update with good and bad HASH images.
 
+A)
+1. Upload the corrupted image for fw update.
+2. Image present in /tmp/images/
+-rw-r--r--    1 root     root      22969344 Jun  3 09:27
+5dea710b-8b85-4065-8af7-3149ada81edf
+
+3. Journalctl logs during image verification
+Jun 03 09:27:20 intel-obmc phosphor-version-software-manager[4755]:
+Firmware image HASH verification failed
+Jun 03 09:27:20 intel-obmc phosphor-version-software-manager[4755]:
+Error verifying uploaded image
+Jun 03 09:27:20 intel-obmc phosphor-version-software-manager[4755]:
+Error processing image
+
+4. image deleted from /tmp/images/
+
+B)
+1. Upload the correct image.
+POST: https://<BMC_IP>/redfish/v1/UpdateService/
+      with <BMC_signed_cap> binary file
+2. Image verification is success and proceeds with update.
+{
+  "@odata.id": "/redfish/v1/TaskService/Tasks/0",
+  "@odata.type": "#Task.v1_4_3.Task",
+  "Id": "0",
+  "TaskState": "Running",
+  "TaskStatus": "OK"
+}
+
+Change-Id: I9336980bfb74c8136690024782bfef45f6b08d56
+Signed-off-by: Chalapathi Venkataramashetty <chalapathix.venkataramashetty@intel.com>
+
 Signed-off-by: Vikram Bodireddy <vikram.bodireddy@linux.intel.com>
 ---
- pfr_image_manager.cpp | 149 ++++++++++++++++++++++++++++++++----------
+ pfr_image_manager.cpp | 150 +++++++++++++++++++++++++++++++++----------
  pfr_image_manager.hpp | 112 +++++++++++++++++++++++++++++--
- 2 files changed, 221 insertions(+), 40 deletions(-)
+ 2 files changed, 222 insertions(+), 40 deletions(-)
 
 diff --git a/pfr_image_manager.cpp b/pfr_image_manager.cpp
 index 242a6ca..1a41cbe 100644
@@ -168,7 +200,7 @@ index 242a6ca..1a41cbe 100644
          }
          catch (std::exception& e)
          {
-@@ -79,20 +174,20 @@ static int getPFRImgInfo(const std::filesystem::path imgPath, uint8_t& imgType,
+@@ -79,20 +174,21 @@ static int getPFRImgInfo(const std::filesystem::path imgPath, uint8_t& imgType,
  
  int Manager::processImage(const std::string& imgFilePath)
  {
@@ -189,6 +221,7 @@ index 242a6ca..1a41cbe 100644
          phosphor::logging::log<phosphor::logging::level::ERR>(
 -            "Error reading uploaded image type and version");
 +            "Error verifying uploaded image");
++        std::filesystem::remove_all(imgFilePath);
          return -1;
      }
  
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0010-Add-error-reporting-to-pfr_image_manager.patch b/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0010-Add-error-reporting-to-pfr_image_manager.patch
new file mode 100644
index 000000000..9c3ab4dd2
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0010-Add-error-reporting-to-pfr_image_manager.patch
@@ -0,0 +1,187 @@
+From ffa3642e436b559d8062f777f00458cc7b5ecb01 Mon Sep 17 00:00:00 2001
+From: James Feist <james.feist@linux.intel.com>
+Date: Thu, 11 Jun 2020 13:30:02 -0700
+Subject: [PATCH 1/1] Add error reporting to pfr_image_manager
+
+This uses report functionality to update error
+return status for redfish updates.
+
+Tested: Got 400 error with different messages based
+on failure type
+
+{
+    "error": {
+        "@Message.ExtendedInfo": [
+            {
+                "@odata.type": "/redfish/v1/$metadata#Message.v1_0_0.Message",
+                "Message": "Invalid file uploaded to /redfish/v1/UpdateService: invalid archive.",
+                "MessageArgs": [
+                    "/redfish/v1/UpdateService",
+                    "invalid archive"
+                ],
+                "MessageId": "OpenBMC.0.1.0.InvalidFile",
+                "Resolution": "None.",
+                "Severity": "Warning"
+            }
+        ],
+        "code": "OpenBMC.0.1.0.InvalidFile",
+        "message": "Invalid file uploaded to /redfish/v1/UpdateService: invalid archive."
+    }
+}
+
+{
+    "error": {
+        "@Message.ExtendedInfo": [
+            {
+                "@odata.type": "/redfish/v1/$metadata#Message.v1_0_0.Message",
+                "Message": "Invalid file uploaded to /redfish/v1/UpdateService: invalid image format.",
+                "MessageArgs": [
+                    "/redfish/v1/UpdateService",
+                    "invalid image format"
+                ],
+                "MessageId": "OpenBMC.0.1.0.InvalidFile",
+                "Resolution": "None.",
+                "Severity": "Warning"
+            }
+        ],
+        "code": "OpenBMC.0.1.0.InvalidFile",
+        "message": "Invalid file uploaded to /redfish/v1/UpdateService: invalid image format."
+    }
+}
+
+{
+    "error": {
+        "@Message.ExtendedInfo": [
+            {
+                "@odata.type": "#Message.v1_0_0.Message",
+                "Message": "The resource /redfish/v1/UpdateService was unable to satisfy the request due to unavailability of resources.",
+                "MessageArgs": [
+                    "/redfish/v1/UpdateService"
+                ],
+                "MessageId": "Base.1.4.0.ResourceExhaustion",
+                "Resolution": "Ensure that the resources are available and resubmit the request.",
+                "Severity": "Critical"
+            }
+        ],
+        "code": "Base.1.4.0.ResourceExhaustion",
+        "message": "The resource /redfish/v1/UpdateService was unable to satisfy the request due to unavailability of resources."
+    }
+}
+
+Signed-off-by: James Feist <james.feist@linux.intel.com>
+---
+ dbus_helpers.hpp      | 30 ++++++++++++++++++++++++++++++
+ pfr_image_manager.cpp | 18 ++++++++++++++++++
+ 2 files changed, 48 insertions(+)
+ create mode 100644 dbus_helpers.hpp
+
+diff --git a/dbus_helpers.hpp b/dbus_helpers.hpp
+new file mode 100644
+index 0000000..b9ffa36
+--- /dev/null
++++ b/dbus_helpers.hpp
+@@ -0,0 +1,30 @@
++#pragma once
++
++#include "config.h"
++
++#include <sdbusplus/bus.hpp>
++inline bool isFwupdScriptRunning(sdbusplus::bus::bus& bus)
++{
++    using ObjectPath = sdbusplus::message::object_path;
++    // type is ssssssouso
++    using ListUnitsType =
++        std::tuple<std::string, std::string, std::string, std::string,
++                   std::string, std::string, ObjectPath, uint32_t, std::string,
++                   ObjectPath>;
++    auto method = bus.new_method_call(SYSTEMD_BUSNAME, SYSTEMD_PATH,
++                                      SYSTEMD_INTERFACE, "ListUnits");
++
++    auto reply = bus.call(method);
++    std::vector<ListUnitsType> resp;
++    reply.read(resp);
++
++    for (const auto& unit : resp)
++    {
++        if (std::get<0>(unit).find("fwupd@") != std::string::npos &&
++            std::get<3>(unit) != "failed")
++        {
++            return true;
++        }
++    }
++    return false;
++}
+diff --git a/pfr_image_manager.cpp b/pfr_image_manager.cpp
+index 1a41cbe..fe1e6f9 100644
+--- a/pfr_image_manager.cpp
++++ b/pfr_image_manager.cpp
+@@ -2,6 +2,7 @@
+ 
+ #include "pfr_image_manager.hpp"
+ 
++#include "dbus_helpers.hpp"
+ #include "version.hpp"
+ #include "watch.hpp"
+ 
+@@ -33,6 +34,9 @@ namespace manager
+ 
+ using namespace sdbusplus::xyz::openbmc_project::Software::Image::Error;
+ namespace Software = phosphor::logging::xyz::openbmc_project::Software;
++using UnTarFail = Software::Image::UnTarFailure;
++using ImageFail = Software::Image::ImageFailure;
++using BusyFail = Software::Image::BusyFailure;
+ 
+ static constexpr const uint32_t pfmPos = 2054;
+ static constexpr const uint32_t block0Magic = 0xB6EAFD19;
+@@ -74,6 +78,8 @@ int Manager::verifyPFRImage(const std::filesystem::path imgPath,
+                 phosphor::logging::log<phosphor::logging::level::ERR>(
+                     "Image magic number match failed",
+                     phosphor::logging::entry("IMAGEMAGIC=0x%x", imgMagic));
++                phosphor::logging::report<UnTarFailure>(
++                    UnTarFail::PATH(imgPath.c_str()));
+                 return -1;
+             }
+ 
+@@ -108,6 +114,8 @@ int Manager::verifyPFRImage(const std::filesystem::path imgPath,
+ 
+                 phosphor::logging::log<phosphor::logging::level::ERR>(
+                     "Unknown image type");
++                phosphor::logging::report<ImageFailure>(
++                    ImageFail::PATH(imgPath.c_str()));
+                 return -1;
+             }
+ 
+@@ -151,6 +159,8 @@ int Manager::verifyPFRImage(const std::filesystem::path imgPath,
+                                 "PRIORITY=%i", LOG_ERR, "REDFISH_MESSAGE_ID=%s",
+                                 redfishMsgID.c_str(), "REDFISH_MESSAGE_ARGS=%s",
+                                 "Image HASH check fail", NULL);
++                phosphor::logging::report<ImageFailure>(
++                    ImageFail::PATH(imgPath.c_str()));
+                 return -1;
+             }
+ 
+@@ -165,6 +175,8 @@ int Manager::verifyPFRImage(const std::filesystem::path imgPath,
+         catch (std::exception& e)
+         {
+             phosphor::logging::log<phosphor::logging::level::ERR>(e.what());
++            phosphor::logging::report<ImageFailure>(
++                ImageFail::PATH(imgPath.c_str()));
+             return -1;
+         }
+     }
+@@ -180,6 +192,12 @@ int Manager::processImage(const std::string& imgFilePath)
+     if (!std::filesystem::exists(imgPath))
+         return -1;
+ 
++    if (isFwupdScriptRunning(bus))
++    {
++        phosphor::logging::report<BusyFailure>(BusyFail::PATH(imgPath.c_str()));
++        return -1;
++    }
++
+     int retry = 3;
+     std::string ver;
+     std::string purposeString;
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0011-Fix-for-RedudancyPriority-in-item_updater.patch b/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0011-Fix-for-RedudancyPriority-in-item_updater.patch
new file mode 100644
index 000000000..4c8f82aa3
--- /dev/null
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager/0011-Fix-for-RedudancyPriority-in-item_updater.patch
@@ -0,0 +1,38 @@
+From 0babf82f51561ac92a9b0dd56991d8de01930129 Mon Sep 17 00:00:00 2001
+From: Vikram Bodireddy <vikram.bodireddy@intel.com>
+Date: Sun, 5 Jul 2020 00:54:57 +0530
+Subject: [PATCH] Fix for RedudancyPriority in item_updater
+
+This fixes accessing RedudancyPriority property for the
+activated image in item_updater. The downloaded image object
+is not actually associated with RedudancyPriority before and
+after activation. There exists no RedundancyPriority property
+for downloaded image, accessing it causing a crash in
+item_updater.
+
+Tested: Tested for coredumps during Seamless firmware update.
+
+Signed-off-by: Vikram Bodireddy <vikram.bodireddy@intel.com>
+---
+ item_updater.cpp | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/item_updater.cpp b/item_updater.cpp
+index af01e39..8d7bb82 100644
+--- a/item_updater.cpp
++++ b/item_updater.cpp
+@@ -655,8 +655,9 @@ void ItemUpdater::freeSpace(Activation& caller)
+             // Failed activations don't have priority, assign them a large value
+             // for sorting purposes.
+             auto priority = 999;
+-            if (iter.second.get()->activation() ==
+-                server::Activation::Activations::Active)
++             if ((iter.second.get()->activation() ==
++                server::Activation::Activations::Active)&&
++                iter.second->redundancyPriority.get())
+             {
+                 priority = iter.second->redundancyPriority.get()->priority();
+             }
+-- 
+2.17.1
+
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager_%.bbappend b/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager_%.bbappend
index f72c18cd0..ae108bf70 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/flash/phosphor-software-manager_%.bbappend
@@ -5,17 +5,20 @@ SYSTEMD_SERVICE_${PN}-updater += "fwupd@.service"
 
 EXTRA_OECONF += "${@bb.utils.contains('IMAGE_FSTYPES', 'intel-pfr', '--enable-pfr_update', '', d)}"
 
-SRC_URI += "file://0002-Redfish-firmware-activation.patch \
+SRC_URI += "file://0001-Add-more-error-types.patch \
+            file://0002-Redfish-firmware-activation.patch \
             file://0004-Changed-the-condition-of-software-version-service-wa.patch \
             file://0005-Modified-firmware-activation-to-launch-fwupd.sh-thro.patch \
             file://0006-Modify-the-ID-of-software-image-updater-object-on-DB.patch \
             file://0007-Adding-StandBySpare-for-firmware-activation.patch \
             file://0008-item_updater-update-the-bmc_active-objectPath.patch \
+            file://0011-Fix-for-RedudancyPriority-in-item_updater.patch \
            "
 
 SRC_URI_PFR = "file://0007-PFR-images-support.patch \
                file://0008-PFR-image-HASH-verification.patch \
                file://0009-Add-ApplyOptions-D-bus-property-under-Software.patch \
+               file://0010-Add-error-reporting-to-pfr_image_manager.patch \
               "
 
 SRC_URI += "${@bb.utils.contains('IMAGE_FSTYPES', 'intel-pfr', SRC_URI_PFR, '', d)}"
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0001-Firmware-update-support-for-StandBySpare.patch b/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0001-Firmware-update-support-for-StandBySpare.patch
index 46e94e339..3895424ac 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0001-Firmware-update-support-for-StandBySpare.patch
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0001-Firmware-update-support-for-StandBySpare.patch
@@ -1,6 +1,6 @@
-From 461da7ec950704a1f5bcc7f6527ed8ca119cfaf9 Mon Sep 17 00:00:00 2001
+From 98c57392535227f1906fdc2d6f65980267b5d97c Mon Sep 17 00:00:00 2001
 From: Vikram Bodireddy <vikram.bodireddy@intel.com>
-Date: Tue, 24 Mar 2020 16:05:32 +0530
+Date: Tue, 30 Jun 2020 21:47:55 +0530
 Subject: [PATCH] Firmware update support for StandBySpare
 
 Firmware update support for StandBySpare. This will
@@ -28,38 +28,38 @@ Tested:
 
 Signed-off-by: Vikram Bodireddy <vikram.bodireddy@intel.com>
 ---
- redfish-core/lib/update_service.hpp | 274 +++++++++++++++++++++++++++++++-----
- 1 file changed, 241 insertions(+), 33 deletions(-)
+ redfish-core/lib/update_service.hpp | 276 ++++++++++++++++++++++++----
+ 1 file changed, 243 insertions(+), 33 deletions(-)
 
 diff --git a/redfish-core/lib/update_service.hpp b/redfish-core/lib/update_service.hpp
-index e9793eb..a913bac 100644
+index 8dae2fb..86ddd8a 100644
 --- a/redfish-core/lib/update_service.hpp
 +++ b/redfish-core/lib/update_service.hpp
-@@ -30,6 +30,17 @@ static std::unique_ptr<sdbusplus::bus::match::match> fwUpdateMatcher;
+@@ -32,6 +32,17 @@ static std::unique_ptr<sdbusplus::bus::match::match> fwUpdateErrorMatcher;
  static bool fwUpdateInProgress = false;
  // Timer for software available
  static std::unique_ptr<boost::asio::steady_timer> fwAvailableTimer;
-+static constexpr const char *versionIntf =
++static constexpr const char* versionIntf =
 +    "xyz.openbmc_project.Software.Version";
-+static constexpr const char *activationIntf =
++static constexpr const char* activationIntf =
 +    "xyz.openbmc_project.Software.Activation";
-+static constexpr const char *reqActivationPropName = "RequestedActivation";
-+static constexpr const char *reqActivationsActive =
++static constexpr const char* reqActivationPropName = "RequestedActivation";
++static constexpr const char* reqActivationsActive =
 +    "xyz.openbmc_project.Software.Activation.RequestedActivations.Active";
-+static constexpr const char *reqActivationsStandBySpare =
++static constexpr const char* reqActivationsStandBySpare =
 +    "xyz.openbmc_project.Software.Activation.RequestedActivations.StandbySpare";
-+static constexpr const char *activationsStandBySpare =
++static constexpr const char* activationsStandBySpare =
 +    "xyz.openbmc_project.Software.Activation.Activations.StandbySpare";
  
  static void cleanUp()
  {
-@@ -37,27 +48,119 @@ static void cleanUp()
-     fwUpdateMatcher = nullptr;
+@@ -40,27 +51,119 @@ static void cleanUp()
+     fwUpdateErrorMatcher = nullptr;
  }
- static void activateImage(const std::string &objPath,
--                          const std::string &service)
-+                          const std::string &service,
-+                          const std::vector<std::string> &imgUriTargets)
+ static void activateImage(const std::string& objPath,
+-                          const std::string& service)
++                          const std::string& service,
++                          const std::vector<std::string>& imgUriTargets)
  {
      BMCWEB_LOG_DEBUG << "Activate image for " << objPath << " " << service;
 +    // If targets is empty, it will apply to the active.
@@ -90,7 +90,7 @@ index e9793eb..a913bac 100644
 -            if (error_code)
 +        [objPath, service, imgTarget{imgUriTargets[0]}](
 +            const boost::system::error_code ec,
-+            const crow::openbmc_mapper::GetSubTreeType &subtree) {
++            const crow::openbmc_mapper::GetSubTreeType& subtree) {
 +            if (ec || !subtree.size())
              {
 -                BMCWEB_LOG_DEBUG << "error_code = " << error_code;
@@ -98,7 +98,7 @@ index e9793eb..a913bac 100644
 +                return;
 +            }
 +
-+            for (const auto &[invObjPath, invDict] : subtree)
++            for (const auto& [invObjPath, invDict] : subtree)
 +            {
 +                std::size_t idPos = invObjPath.rfind("/");
 +                if ((idPos == std::string::npos) ||
@@ -173,23 +173,23 @@ index e9793eb..a913bac 100644
 +        "xyz.openbmc_project.ObjectMapper",
 +        "/xyz/openbmc_project/object_mapper",
 +        "xyz.openbmc_project.ObjectMapper", "GetSubTree", "/",
-+        static_cast<int32_t>(0), std::array<const char *, 1>{versionIntf});
++        static_cast<int32_t>(0), std::array<const char*, 1>{versionIntf});
  }
  
  // Note that asyncResp can be either a valid pointer or nullptr. If nullptr
  // then no asyncResp updates will occur
  static void softwareInterfaceAdded(std::shared_ptr<AsyncResp> asyncResp,
 +                                   const std::vector<std::string> imgUriTargets,
-                                    sdbusplus::message::message &m,
-                                    const crow::Request &req)
+                                    sdbusplus::message::message& m,
+                                    const crow::Request& req)
  {
-@@ -70,25 +173,27 @@ static void softwareInterfaceAdded(std::shared_ptr<AsyncResp> asyncResp,
+@@ -73,25 +176,27 @@ static void softwareInterfaceAdded(std::shared_ptr<AsyncResp> asyncResp,
  
      m.read(objPath, interfacesProperties);
  
 -    BMCWEB_LOG_DEBUG << "obj path = " << objPath.str;
 +    BMCWEB_LOG_DEBUG << "Software Interface Added. obj path = " << objPath.str;
-     for (auto &interface : interfacesProperties)
+     for (auto& interface : interfacesProperties)
      {
          BMCWEB_LOG_DEBUG << "interface = " << interface.first;
  
@@ -205,7 +205,7 @@ index e9793eb..a913bac 100644
 +                [objPath, asyncResp, imgTargets{imgUriTargets},
                   req](const boost::system::error_code error_code,
                        const std::vector<std::pair<
-                           std::string, std::vector<std::string>>> &objInfo) {
+                           std::string, std::vector<std::string>>>& objInfo) {
                      if (error_code)
                      {
 -                        BMCWEB_LOG_DEBUG << "error_code = " << error_code;
@@ -215,7 +215,7 @@ index e9793eb..a913bac 100644
                          BMCWEB_LOG_DEBUG << "error msg = "
                                           << error_code.message();
                          if (asyncResp)
-@@ -115,7 +220,7 @@ static void softwareInterfaceAdded(std::shared_ptr<AsyncResp> asyncResp,
+@@ -118,7 +223,7 @@ static void softwareInterfaceAdded(std::shared_ptr<AsyncResp> asyncResp,
                      // is added
                      fwAvailableTimer = nullptr;
  
@@ -224,13 +224,13 @@ index e9793eb..a913bac 100644
                      if (asyncResp)
                      {
                          std::shared_ptr<task::TaskData> task =
-@@ -196,17 +301,16 @@ static void softwareInterfaceAdded(std::shared_ptr<AsyncResp> asyncResp,
+@@ -248,18 +353,17 @@ static void softwareInterfaceAdded(std::shared_ptr<AsyncResp> asyncResp,
                  "xyz.openbmc_project.ObjectMapper",
                  "/xyz/openbmc_project/object_mapper",
                  "xyz.openbmc_project.ObjectMapper", "GetObject", objPath.str,
--                std::array<const char *, 1>{
+-                std::array<const char*, 1>{
 -                    "xyz.openbmc_project.Software.Activation"});
-+                std::array<const char *, 1>{activationIntf});
++                std::array<const char*, 1>{activationIntf});
          }
      }
  }
@@ -238,28 +238,30 @@ index e9793eb..a913bac 100644
  // Note that asyncResp can be either a valid pointer or nullptr. If nullptr
  // then no asyncResp updates will occur
 -static void monitorForSoftwareAvailable(std::shared_ptr<AsyncResp> asyncResp,
--                                        const crow::Request &req,
+-                                        const crow::Request& req,
+-                                        const std::string& url,
 -                                        int timeoutTimeSeconds = 5)
 +static void monitorForSoftwareAvailable(
-+    std::shared_ptr<AsyncResp> asyncResp, const crow::Request &req,
-+    const std::vector<std::string> &imgUriTargets, int timeoutTimeSeconds = 5)
++    std::shared_ptr<AsyncResp> asyncResp, const crow::Request& req,
++    const std::string& url, const std::vector<std::string>& imgUriTargets,
++    int timeoutTimeSeconds = 5)
  {
      // Only allow one FW update at a time
      if (fwUpdateInProgress != false)
-@@ -246,9 +350,10 @@ static void monitorForSoftwareAvailable(std::shared_ptr<AsyncResp> asyncResp,
+@@ -299,9 +403,10 @@ static void monitorForSoftwareAvailable(std::shared_ptr<AsyncResp> asyncResp,
              }
          });
  
--    auto callback = [asyncResp, req](sdbusplus::message::message &m) {
+-    auto callback = [asyncResp, req](sdbusplus::message::message& m) {
 +    auto callback = [asyncResp, imgTargets{imgUriTargets},
-+                     req](sdbusplus::message::message &m) {
++                     req](sdbusplus::message::message& m) {
          BMCWEB_LOG_DEBUG << "Match fired";
 -        softwareInterfaceAdded(asyncResp, m, req);
 +        softwareInterfaceAdded(asyncResp, imgTargets, m, req);
      };
  
      fwUpdateInProgress = true;
-@@ -358,9 +463,12 @@ class UpdateServiceActionsSimpleUpdate : public Node
+@@ -467,12 +572,15 @@ class UpdateServiceActionsSimpleUpdate : public Node
          std::string fwFile = imageURI.substr(separator + 1);
          BMCWEB_LOG_DEBUG << "Server: " << tftpServer + " File: " << fwFile;
  
@@ -268,32 +270,35 @@ index e9793eb..a913bac 100644
 +
          // Setup callback for when new software detected
          // Give TFTP 2 minutes to complete
--        monitorForSoftwareAvailable(nullptr, req, 120);
-+        monitorForSoftwareAvailable(nullptr, req, httpUriTargets, 120);
+         monitorForSoftwareAvailable(
+             nullptr, req,
+             "/redfish/v1/UpdateService/Actions/UpdateService.SimpleUpdate",
+-            120);
++            httpUriTargets, 120);
  
          // TFTP can take up to 2 minutes depending on image size and
          // connection speed. Return to caller as soon as the TFTP operation
-@@ -394,7 +502,8 @@ class UpdateServiceActionsSimpleUpdate : public Node
+@@ -506,7 +614,8 @@ class UpdateServiceActionsSimpleUpdate : public Node
  class UpdateService : public Node
  {
    public:
--    UpdateService(CrowApp &app) : Node(app, "/redfish/v1/UpdateService/")
-+    UpdateService(CrowApp &app) :
+-    UpdateService(CrowApp& app) : Node(app, "/redfish/v1/UpdateService/")
++    UpdateService(CrowApp& app) :
 +        Node(app, "/redfish/v1/UpdateService/"), httpPushUriTargetBusy(false)
      {
          entityPrivileges = {
              {boost::beast::http::verb::get, {{"Login"}}},
-@@ -406,6 +515,9 @@ class UpdateService : public Node
+@@ -518,6 +627,9 @@ class UpdateService : public Node
      }
  
    private:
 +    std::vector<std::string> httpPushUriTargets;
 +    bool httpPushUriTargetBusy;
 +
-     void doGet(crow::Response &res, const crow::Request &req,
-                const std::vector<std::string> &params) override
+     void doGet(crow::Response& res, const crow::Request& req,
+                const std::vector<std::string>& params) override
      {
-@@ -416,6 +528,8 @@ class UpdateService : public Node
+@@ -528,6 +640,8 @@ class UpdateService : public Node
          res.jsonValue["Description"] = "Service for Software Update";
          res.jsonValue["Name"] = "Update Service";
          res.jsonValue["HttpPushUri"] = "/redfish/v1/UpdateService";
@@ -302,7 +307,7 @@ index e9793eb..a913bac 100644
          // UpdateService cannot be disabled
          res.jsonValue["ServiceEnabled"] = true;
          res.jsonValue["FirmwareInventory"] = {
-@@ -475,9 +589,14 @@ class UpdateService : public Node
+@@ -587,9 +701,14 @@ class UpdateService : public Node
          std::shared_ptr<AsyncResp> asyncResp = std::make_shared<AsyncResp>(res);
  
          std::optional<nlohmann::json> pushUriOptions;
@@ -319,7 +324,7 @@ index e9793eb..a913bac 100644
              return;
          }
  
-@@ -545,6 +664,98 @@ class UpdateService : public Node
+@@ -657,6 +776,98 @@ class UpdateService : public Node
                  }
              }
          }
@@ -370,7 +375,7 @@ index e9793eb..a913bac 100644
 +                            }
 +
 +                            bool swInvObjFound = false;
-+                            for (const std::string &path : swInvPaths)
++                            for (const std::string& path : swInvPaths)
 +                            {
 +                                std::size_t idPos = path.rfind("/");
 +                                if ((idPos == std::string::npos) ||
@@ -402,7 +407,7 @@ index e9793eb..a913bac 100644
 +                        "/xyz/openbmc_project/object_mapper",
 +                        "xyz.openbmc_project.ObjectMapper", "GetSubTreePaths",
 +                        "/", static_cast<int32_t>(0),
-+                        std::array<const char *, 1>{versionIntf});
++                        std::array<const char*, 1>{versionIntf});
 +                }
 +                else
 +                {
@@ -417,27 +422,28 @@ index e9793eb..a913bac 100644
 +        }
      }
  
-     void doPost(crow::Response &res, const crow::Request &req,
-@@ -555,7 +766,7 @@ class UpdateService : public Node
+     void doPost(crow::Response& res, const crow::Request& req,
+@@ -667,8 +878,8 @@ class UpdateService : public Node
          std::shared_ptr<AsyncResp> asyncResp = std::make_shared<AsyncResp>(res);
  
          // Setup callback for when new software detected
--        monitorForSoftwareAvailable(asyncResp, req);
-+        monitorForSoftwareAvailable(asyncResp, req, httpPushUriTargets);
+-        monitorForSoftwareAvailable(asyncResp, req,
+-                                    "/redfish/v1/UpdateService");
++        monitorForSoftwareAvailable(asyncResp, req, "/redfish/v1/UpdateService",
++                                    httpPushUriTargets);
  
          std::string filepath(
              "/tmp/images/" +
-@@ -641,8 +852,7 @@ class SoftwareInventoryCollection : public Node
+@@ -754,7 +965,7 @@ class SoftwareInventoryCollection : public Node
              "/xyz/openbmc_project/object_mapper",
              "xyz.openbmc_project.ObjectMapper", "GetSubTree",
              "/xyz/openbmc_project/software", static_cast<int32_t>(0),
--            std::array<const char *, 1>{
--                "xyz.openbmc_project.Software.Version"});
-+            std::array<const char *, 1>{versionIntf});
+-            std::array<const char*, 1>{"xyz.openbmc_project.Software.Version"});
++            std::array<const char*, 1>{versionIntf});
      }
  };
  
-@@ -825,7 +1035,7 @@ class SoftwareInventory : public Node
+@@ -937,7 +1148,7 @@ class SoftwareInventory : public Node
                          },
                          obj.second[0].first, obj.first,
                          "org.freedesktop.DBus.Properties", "GetAll",
@@ -446,17 +452,16 @@ index e9793eb..a913bac 100644
                  }
                  if (!found)
                  {
-@@ -846,9 +1056,7 @@ class SoftwareInventory : public Node
+@@ -958,8 +1169,7 @@ class SoftwareInventory : public Node
              "xyz.openbmc_project.ObjectMapper",
              "/xyz/openbmc_project/object_mapper",
              "xyz.openbmc_project.ObjectMapper", "GetSubTree", "/",
 -            static_cast<int32_t>(0),
--            std::array<const char *, 1>{
--                "xyz.openbmc_project.Software.Version"});
-+            static_cast<int32_t>(0), std::array<const char *, 1>{versionIntf});
+-            std::array<const char*, 1>{"xyz.openbmc_project.Software.Version"});
++            static_cast<int32_t>(0), std::array<const char*, 1>{versionIntf});
      }
  };
  
 -- 
-2.7.4
+2.17.1
 
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0002-Use-chip-id-based-UUID-for-Service-Root.patch b/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0002-Use-chip-id-based-UUID-for-Service-Root.patch
index 03c27fb43..e963b1423 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0002-Use-chip-id-based-UUID-for-Service-Root.patch
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0002-Use-chip-id-based-UUID-for-Service-Root.patch
@@ -1,7 +1,10 @@
-From d629bf86a9ac970d8c0505c0aa2488373c9df102 Mon Sep 17 00:00:00 2001
+From b68d62ddf0a9d77a287a7e9a99762915e31d02b9 Mon Sep 17 00:00:00 2001
 From: Wiktor Golgowski <wiktor.golgowski@linux.intel.com>
 Date: Thu, 30 Apr 2020 11:09:35 +0200
 Subject: [PATCH] Use chip id-based UUID for Service Root.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
 
 If the sysfs-provided chip id is available, it will be used as
 payload to generate Service Root UUID from hardcoded namespace.
@@ -12,15 +15,16 @@ If the sysfs node is not available, code falls back to randomly
 generated UUID.
 
 Signed-off-by: Wiktor Gołgowski <wiktor.golgowski@linux.intel.com>
+
 ---
- include/persistent_data_middleware.hpp | 32 +++++++++++++++++++++++---
+ include/persistent_data_middleware.hpp | 32 +++++++++++++++++++++++++++++---
  1 file changed, 29 insertions(+), 3 deletions(-)
 
 diff --git a/include/persistent_data_middleware.hpp b/include/persistent_data_middleware.hpp
-index 348079b..925e7b6 100644
+index de3a6ba..a20b213 100644
 --- a/include/persistent_data_middleware.hpp
 +++ b/include/persistent_data_middleware.hpp
-@@ -30,6 +30,10 @@ class Middleware
+@@ -31,6 +31,10 @@ class Middleware
    public:
      // todo(ed) should read this from a fixed location somewhere, not CWD
      static constexpr const char* filename = "bmcweb_persistent_data.json";
@@ -30,8 +34,8 @@ index 348079b..925e7b6 100644
 +    "944847ed76f5}";
  
      struct Context
-     {
-@@ -143,9 +147,31 @@ class Middleware
+     {};
+@@ -141,9 +145,31 @@ class Middleware
  
          if (systemUuid.empty())
          {
@@ -66,6 +70,3 @@ index 348079b..925e7b6 100644
          }
          if (fileRevision < jsonRevision)
          {
--- 
-2.20.1
-
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0003-Temporarily-disable-EventService-log-support.patch b/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0003-Temporarily-disable-EventService-log-support.patch
deleted file mode 100644
index bfa843e73..000000000
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0003-Temporarily-disable-EventService-log-support.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From cd173b21c42456bde9765e7f6164e495b6c6a303 Mon Sep 17 00:00:00 2001
-From: James Feist <james.feist@linux.intel.com>
-Date: Wed, 3 Jun 2020 10:08:05 -0700
-Subject: [PATCH 1/1] Temporarily disable EventService log support
-
-This is causing bmcweb to crash when there is no
-redfish log.
-
-Change-Id: Id53e57f1ca140ee44f69fec46fd63bec18490c99
-Signed-off-by: James Feist <james.feist@linux.intel.com>
----
- src/webserver_main.cpp | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/webserver_main.cpp b/src/webserver_main.cpp
-index ea32122..421cd1d 100644
---- a/src/webserver_main.cpp
-+++ b/src/webserver_main.cpp
-@@ -116,7 +116,7 @@ int main(int argc, char** argv)
- 
-     redfish::RedfishService redfish(app);
- 
--#ifndef BMCWEB_ENABLE_REDFISH_DBUS_LOG_ENTRIES
-+#if 0
-     int rc = redfish::EventServiceManager::startEventLogMonitor(*io);
-     if (rc)
-     {
--- 
-2.17.1
-
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0003-bmcweb-changes-for-setting-ApplyOptions-ClearCfg.patch b/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0003-bmcweb-changes-for-setting-ApplyOptions-ClearCfg.patch
index 844a65ec9..704031fe1 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0003-bmcweb-changes-for-setting-ApplyOptions-ClearCfg.patch
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb/0003-bmcweb-changes-for-setting-ApplyOptions-ClearCfg.patch
@@ -1,6 +1,6 @@
-From 4d88fcada1d95f485ea5a1dd418b31c508652712 Mon Sep 17 00:00:00 2001
+From e883ea9d43a84998641428448d7220c0f5be72c0 Mon Sep 17 00:00:00 2001
 From: Vikram Bodireddy <vikram.bodireddy@intel.com>
-Date: Fri, 15 May 2020 21:12:44 +0530
+Date: Tue, 30 Jun 2020 22:09:10 +0530
 Subject: [PATCH] bmcweb changes for setting ApplyOptions-ClearCfg
 
 ApplyOptions are used to specify firmware update specific options
@@ -25,10 +25,10 @@ Signed-off-by: Vikram Bodireddy <vikram.bodireddy@intel.com>
  create mode 100644 static/redfish/v1/schema/OemUpdateService_v1.xml
 
 diff --git a/redfish-core/lib/update_service.hpp b/redfish-core/lib/update_service.hpp
-index a913bac..3a64e63 100644
+index 86ddd8a..291acec 100644
 --- a/redfish-core/lib/update_service.hpp
 +++ b/redfish-core/lib/update_service.hpp
-@@ -579,6 +579,29 @@ class UpdateService : public Node
+@@ -691,6 +691,29 @@ class UpdateService : public Node
              "/xyz/openbmc_project/software/apply_time",
              "org.freedesktop.DBus.Properties", "Get",
              "xyz.openbmc_project.Software.ApplyTime", "RequestedApplyTime");
@@ -44,7 +44,7 @@ index a913bac..3a64e63 100644
 +                    return;
 +                }
 +
-+                const bool *b = std::get_if<bool>(&applyOption);
++                const bool* b = std::get_if<bool>(&applyOption);
 +
 +                if (b)
 +                {
@@ -57,8 +57,8 @@ index a913bac..3a64e63 100644
 +            "Get", "xyz.openbmc_project.Software.ApplyOptions", "ClearConfig");
      }
  
-     void doPatch(crow::Response &res, const crow::Request &req,
-@@ -591,15 +614,59 @@ class UpdateService : public Node
+     void doPatch(crow::Response& res, const crow::Request& req,
+@@ -703,15 +726,59 @@ class UpdateService : public Node
          std::optional<nlohmann::json> pushUriOptions;
          std::optional<std::vector<std::string>> imgTargets;
          std::optional<bool> imgTargetBusy;
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb_%.bbappend b/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb_%.bbappend
index a1ce5f99b..5c70f25d7 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/interfaces/bmcweb_%.bbappend
@@ -1,6 +1,6 @@
 # todo(james) remove nobranch
 SRC_URI = "git://github.com/openbmc/bmcweb.git"
-SRCREV = "dc3fbbd0b0021ae888a97bf48a62f30129fc3f4d"
+SRCREV = "a502de3d661acf95613d4e4d27c9611f2c8148ea"
 
 FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
 
@@ -12,7 +12,6 @@ GROUPADD_PARAM_${PN} = "web; redfish "
 
 SRC_URI += "file://0001-Firmware-update-support-for-StandBySpare.patch \
             file://0002-Use-chip-id-based-UUID-for-Service-Root.patch \
-            file://0003-Temporarily-disable-EventService-log-support.patch \
             file://0003-bmcweb-changes-for-setting-ApplyOptions-ClearCfg.patch \
 "
 
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-config/channel_config.json b/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-config/channel_config.json
index b02595e81..656207de6 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-config/channel_config.json
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-config/channel_config.json
@@ -45,7 +45,7 @@
   },
   "4" : {
     "name" : "RESERVED",
-    "is_valid" : true,
+    "is_valid" : false,
     "active_sessions" : 0,
     "channel_info" : {
       "medium_type" : "reserved",
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-kcs_%.bbappend b/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-kcs_%.bbappend
index 97d329498..a3dceb01e 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-kcs_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-kcs_%.bbappend
@@ -11,7 +11,7 @@ SMM_DEVICE = "ipmi_kcs4"
 SYSTEMD_SERVICE_${PN}_append = " ${PN}@${SMM_DEVICE}.service "
 
 SRC_URI = "git://github.com/openbmc/kcsbridge.git"
-SRCREV = "58d596ad9625790b5e06804360aa161579364425"
+SRCREV = "d8594e9a62feb8b2fac789159966b4782b4aa31e"
 
 SRC_URI += "file://99-ipmi-kcs.rules"
 
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend b/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend
index 0a9a6ba57..10d0d8c94 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/ipmi/phosphor-ipmi-net_%.bbappend
@@ -3,7 +3,7 @@ inherit useradd
 # TODO: This should be removed, once up-stream bump up
 # issue is resolved
 SRC_URI += "git://github.com/openbmc/phosphor-net-ipmid"
-SRCREV = "9d9b7638cb1e95989329680730ec272da786615f"
+SRCREV = "ecb32fbc699aaacee4d6a42bb986575c4c5780dc"
 
 USERADD_PACKAGES = "${PN}"
 # add a group called ipmi
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/pmci/libmctp-intel_git.bb b/meta-openbmc-mods/meta-common/recipes-phosphor/pmci/libmctp-intel_git.bb
index 5607ab823..055e9710e 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/pmci/libmctp-intel_git.bb
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/pmci/libmctp-intel_git.bb
@@ -2,7 +2,7 @@ SUMMARY = "libmctp_intel"
 DESCRIPTION = "Implementation of MCTP(DMTF DSP0236)"
 
 SRC_URI = "git://github.com/Intel-BMC/libmctp.git;protocol=ssh"
-SRCREV = "8cf0d4e76516511ec77bda9e3a1ad1e75f801cdd"
+SRCREV = "58581630af62fce296206e9d09da38cf1d6d1a0f"
 
 S = "${WORKDIR}/git/"
 
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/pmci/mctp-emulator.bb b/meta-openbmc-mods/meta-common/recipes-phosphor/pmci/mctp-emulator.bb
index ae11b299a..829bc1636 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/pmci/mctp-emulator.bb
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/pmci/mctp-emulator.bb
@@ -5,7 +5,7 @@ LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=bcd9ada3a943f58551867d72893cc9ab"
 
 SRC_URI = "git://github.com/Intel-BMC/pmci.git;protocol=ssh"
-SRCREV = "31c8b7aa2bf24060fee2954ae1891c3418a3ae46"
+SRCREV = "cd15b3175e2dd8315d1e01634f2c8a24174c9b21"
 
 S = "${WORKDIR}/git/mctp_emulator/"
 
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/pmci/mctpd.bb b/meta-openbmc-mods/meta-common/recipes-phosphor/pmci/mctpd.bb
index 764b65c36..f20426ba1 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/pmci/mctpd.bb
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/pmci/mctpd.bb
@@ -5,7 +5,7 @@ LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=e3fc50a88d0a364313df4b21ef20c29e"
 
 SRC_URI = "git://github.com/Intel-BMC/pmci.git;protocol=ssh"
-SRCREV = "31c8b7aa2bf24060fee2954ae1891c3418a3ae46"
+SRCREV = "cd15b3175e2dd8315d1e01634f2c8a24174c9b21"
 
 S = "${WORKDIR}/git/mctpd/"
 
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/sensors/dbus-sensors_%.bbappend b/meta-openbmc-mods/meta-common/recipes-phosphor/sensors/dbus-sensors_%.bbappend
index ab36babb3..882547ea7 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/sensors/dbus-sensors_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/sensors/dbus-sensors_%.bbappend
@@ -1,9 +1,11 @@
-SRCREV = "54ffb271b995db4f0b00f0661baab23763fae5bd"
+SRCREV = "5591cf0860895607bda0b8ae713e6b05ac0623b1"
 #SRC_URI = "git://github.com/openbmc/dbus-sensors.git"
 
 DEPENDS_append = " libgpiod libmctp"
 
 FILESEXTRAPATHS_append := ":${THISDIR}/${PN}"
 
-EXTRA_OECMAKE += "-DDISABLE_NVME=OFF"
-SYSTEMD_SERVICE_${PN} += " xyz.openbmc_project.nvmesensor.service"
+PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'disable-nvme-sensors', d)}"
+PACKAGECONFIG[disable-nvme-sensors] = "-DDISABLE_NVME=ON, -DDISABLE_NVME=OFF"
+
+SYSTEMD_SERVICE_${PN} += "${@bb.utils.contains('DISTRO_FEATURES', 'disable-nvme-sensors', '', 'xyz.openbmc_project.nvmesensor.service', d)}"
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/service-config-manager/service-config-manager_%.bbappend b/meta-openbmc-mods/meta-common/recipes-phosphor/service-config-manager/service-config-manager_%.bbappend
index 3b4b25021..6d26a95a9 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/service-config-manager/service-config-manager_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/service-config-manager/service-config-manager_%.bbappend
@@ -1,3 +1,5 @@
-# Enable downstream autobump
+inherit meson pkgconfig systemd
 SRC_URI = "git://github.com/openbmc/service-config-manager"
-SRCREV = "ee853eb2d865c7da9eec99cdcac04f8aee750e49"
+SRCREV = "1a885d98eea964bd9a3d57152dcaae7d4808211f"
+
+
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/settings/settings_git.bb b/meta-openbmc-mods/meta-common/recipes-phosphor/settings/settings_git.bb
index e49a410cb..e15525bba 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/settings/settings_git.bb
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/settings/settings_git.bb
@@ -1,7 +1,7 @@
 SUMMARY = "Settings"
 
-SRC_URI = "git://github.com/Intel-BMC/provingground.git;protocol=ssh"
-SRCREV = "bee56d62b209088454d166d1efae4825a2b175df"
+SRC_URI = "git://github.com/Intel-BMC/settings.git;protocol=ssh"
+SRCREV = "cf55f85c9cd676736356f06fc47a7e98abd297f3"
 PV = "0.1+git${SRCPV}"
 
 LICENSE = "Apache-2.0"
@@ -13,7 +13,7 @@ DEPENDS = "boost \
            nlohmann-json \
            sdbusplus"
 
-S = "${WORKDIR}/git/settings"
+S = "${WORKDIR}/git"
 inherit cmake systemd
 
 EXTRA_OECMAKE = "-DYOCTO=1"
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/special-mode-mgr/special-mode-mgr_git.bb b/meta-openbmc-mods/meta-common/recipes-phosphor/special-mode-mgr/special-mode-mgr_git.bb
index 6f6bb860d..ea8971eb4 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/special-mode-mgr/special-mode-mgr_git.bb
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/special-mode-mgr/special-mode-mgr_git.bb
@@ -9,7 +9,7 @@ LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=e3fc50a88d0a364313df4b21ef20c29e"
 
 SRC_URI = "git://github.com/Intel-BMC/special-mode-manager.git;protocol=ssh"
-SRCREV = "cf2ba04cf68d76047211f66d9bb4ae1be1907323"
+SRCREV = "658d313be17b971aedae69e9edbba5f26667dd03"
 
 EXTRA_OECMAKE += "${@bb.utils.contains('EXTRA_IMAGE_FEATURES', 'validation-unsecure', '-DBMC_VALIDATION_UNSECURE_FEATURE=ON', '', d)}"
 
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/watchdog/frb2-watchdog/frb2-watchdog.cpp b/meta-openbmc-mods/meta-common/recipes-phosphor/watchdog/frb2-watchdog/frb2-watchdog.cpp
index 5356e95db..792e564d9 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/watchdog/frb2-watchdog/frb2-watchdog.cpp
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/watchdog/frb2-watchdog/frb2-watchdog.cpp
@@ -127,8 +127,7 @@ template <typename T> void setProperty(const std::string &key, const T &val)
                             boost::system::system_error(err).what()));
                 }
             },
-            wdBus, wdPath, propIntf, "Set", wdIntf, key,
-            sdbusplus::message::variant_ns::variant<T>(val));
+            wdBus, wdPath, propIntf, "Set", wdIntf, key, std::variant<T>(val));
     }
     catch (sdbusplus::exception::SdBusError &e)
     {
diff --git a/meta-openbmc-mods/meta-common/recipes-phosphor/webui/phosphor-webui_%.bbappend b/meta-openbmc-mods/meta-common/recipes-phosphor/webui/phosphor-webui_%.bbappend
index 217eb9ef9..ce46ec5cd 100644
--- a/meta-openbmc-mods/meta-common/recipes-phosphor/webui/phosphor-webui_%.bbappend
+++ b/meta-openbmc-mods/meta-common/recipes-phosphor/webui/phosphor-webui_%.bbappend
@@ -1,4 +1,4 @@
 SRC_URI = "git://github.com/Intel-BMC/phosphor-webui;protocol=ssh;branch=intel2"
 FILESEXTRAPATHS_prepend_intel := "${THISDIR}/${PN}:"
 
-SRCREV = "190f423c191f1f292d24b55f1310eadd565e5ee9"
+SRCREV = "7d6650577d28a52e7be47dd2106d9e0f3b6e1c59"
diff --git a/meta-openbmc-mods/meta-common/recipes-support/boost/boost/0001-Fix-Issue-62.patch b/meta-openbmc-mods/meta-common/recipes-support/boost/boost/0001-Fix-Issue-62.patch
deleted file mode 100644
index 80dfc2725..000000000
--- a/meta-openbmc-mods/meta-common/recipes-support/boost/boost/0001-Fix-Issue-62.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 318439af2e77731ae2c3df5e198c1d3e8392d556 Mon Sep 17 00:00:00 2001
-From: Simon Ebner <Simon.Ebner@advertima.com>
-Date: Fri, 22 Mar 2019 15:27:35 +0100
-Subject: [PATCH 1/2] Fix Issue 62
-
-Fixes a leaking pipe. See https://github.com/boostorg/process/issues/62
----
- boost/process/detail/posix/executor.hpp | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/boost/process/detail/posix/executor.hpp b/boost/process/detail/posix/executor.hpp
-index 1390a58..8b86ed1 100644
---- a/boost/process/detail/posix/executor.hpp
-+++ b/boost/process/detail/posix/executor.hpp
-@@ -282,7 +282,10 @@ class executor
-                 set_error(std::error_code(err, std::system_category()), "Error read pipe");
-         }
-         if (count == 0)
-+        {
-+            ::close(source);
-             return  ;
-+        }
- 
-         std::error_code ec(data[0], std::system_category());
-         std::string msg(data[1], ' ');
--- 
-2.7.4
-
diff --git a/meta-openbmc-mods/meta-common/recipes-support/boost/boost_%.bbappend b/meta-openbmc-mods/meta-common/recipes-support/boost/boost_%.bbappend
deleted file mode 100644
index f85e30b1f..000000000
--- a/meta-openbmc-mods/meta-common/recipes-support/boost/boost_%.bbappend
+++ /dev/null
@@ -1,3 +0,0 @@
-FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
-
-SRC_URI += "file://0001-Fix-Issue-62.patch"
diff --git a/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native.bbappend b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native.bbappend
new file mode 100644
index 000000000..55cc619ce
--- /dev/null
+++ b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native.bbappend
@@ -0,0 +1,22 @@
+FILESEXTRAPATHS_append := ":${THISDIR}/${PN}"
+
+SRC_URI_append = " \
+           file://pfr_manifest.json \
+           file://pfm_config.xml \
+           file://bmc_config.xml \
+           file://csk_prv.pem \
+           file://csk_pub.pem \
+           file://rk_pub.pem \
+           file://rk_prv.pem \
+          "
+
+do_install_append () {
+        install -m 400 ${WORKDIR}/pfr_manifest.json ${D}/${datadir}/pfrconfig
+        install -m 400 ${WORKDIR}/pfm_config.xml ${D}/${datadir}/pfrconfig/pfm_config.xml
+        install -m 400 ${WORKDIR}/bmc_config.xml ${D}/${datadir}/pfrconfig/bmc_config.xml
+        install -m 400 ${WORKDIR}/csk_prv.pem ${D}/${datadir}/pfrconfig/csk_prv.pem
+        install -m 400 ${WORKDIR}/csk_pub.pem ${D}/${datadir}/pfrconfig/csk_pub.pem
+        install -m 400 ${WORKDIR}/rk_pub.pem ${D}/${datadir}/pfrconfig/rk_pub.pem
+        install -m 400 ${WORKDIR}/rk_prv.pem ${D}/${datadir}/pfrconfig/rk_prv.pem
+}
+
diff --git a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/bmc_config.xml b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/bmc_config.xml
index 9e7d3f82d..9e7d3f82d 100644
--- a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/bmc_config.xml
+++ b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/bmc_config.xml
diff --git a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/csk_prv.pem b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/csk_prv.pem
index a46fa2a2b..a46fa2a2b 100644
--- a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/csk_prv.pem
+++ b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/csk_prv.pem
diff --git a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/csk_pub.pem b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/csk_pub.pem
index cc70d6e28..cc70d6e28 100644
--- a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/csk_pub.pem
+++ b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/csk_pub.pem
diff --git a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/pfm_config.xml b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/pfm_config.xml
index 19378d1b9..19378d1b9 100644
--- a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/pfm_config.xml
+++ b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/pfm_config.xml
diff --git a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/pfr_manifest.json b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/pfr_manifest.json
index c79b7f343..c79b7f343 100644
--- a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/pfr_manifest.json
+++ b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/pfr_manifest.json
diff --git a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/rk_prv.pem b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/rk_prv.pem
index 9e8616795..9e8616795 100644
--- a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/rk_prv.pem
+++ b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/rk_prv.pem
diff --git a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/rk_pub.pem b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/rk_pub.pem
index 117e08bae..117e08bae 100644
--- a/meta-openbmc-mods/meta-common/recipes-intel/intel-pfr/files/wht/rk_pub.pem
+++ b/meta-openbmc-mods/meta-wht/recipes-intel/intel-pfr/obmc-intel-pfr-image-native/rk_pub.pem