Signed-off-by: Tom Rini <trini@konsulko.com>
sqfs_frag_lookup() reads a 16-bit metadata block header whose lower 15 bits encode the data size. Unlike sqfs_read_metablock() in sqfs_inode.c, this function does not validate that the decoded size is within SQFS_METADATA_BLOCK_SIZE (8192). A malformed SquashFS image can set the size field to any value up to 32767, causing memcpy to write past the 8192-byte 'entries' heap buffer. Add the same bounds check used by sqfs_read_metablock(): reject any metadata block header with SQFS_METADATA_SIZE(header) exceeding SQFS_METADATA_BLOCK_SIZE. Found by fuzzing with libFuzzer + AddressSanitizer. Signed-off-by: Eric Kilmer <eric.kilmer@trailofbits.com> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
We currently provide default board names for each board in their respective evm.c file. However for custom boards, this behaviour overwrites the default DT as set in the defconfig (CONFIG_DEFAULT_FDT_FILE or CONFIG_DEFAULT_DEVICE_TREE). This patch changes the default name to be NULL which prevents this overwrite and allows ti_set_fdt_env to instead fallback to the correct DT as set in Kconfig. Signed-off-by: Anshul Dalal <anshuld@ti.com> Reviewed-by: Bryan Brattlof <bb@ti.com>
Update dev-data and clk-data to include wake-up I2C device for J722s. Signed-off-by: Chintan Vankar <c-vankar@ti.com> Tested-by: Richard Genoud <richard.genoud@bootlin.com>
Marek Vasut <marek.vasut+renesas@mailbox.org> says: Enable zip command in sandbox so it is always build tested. Add simple test for zip/unzip/gzwrite commands so they are unit tested. Link: https://lore.kernel.org/r/20260205014153.218621-1-marek.vasut+renesas@mailbox.org
Add simple test for zip/unzip/gzwrite commands. The test works as follows. First, create three buffers with a bit of space between each of them, fill them with random data, then compress data in buffer 1 into buffer 2, decompress data in buffer 2 either directly into buffer 3 or into MMC 1 and then read them back into buffer 3, and finally compare buffer 1 and buffer 3, they have to be identical. The buffers are filled with random data to detect out of bounds writes. Test for various sizes, both small and large and unaligned. The test uses ut_assert_skip_to_line() to skip over gzwrite progress bar. Since the progress bar updates fill up the console record buffer, increase the size of it to compensate. Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org> Tested-by: Mattijs Korpershoek <mkorpershoek@kernel.org> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
What is not being built and tested in CI, breaks. Enable the 'zip' command in sandbox to get it build tested in preparation for an actual unit test. Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Update DDR timings to increase stability in higher temperature ranges. Update DDR settings: - SysConfig DDR tool v0.09.05 - Package: ALV - Extended temperature range -40C to 105C - Lower tREFI (ns) to 3900 Signed-off-by: Wadim Egorov <w.egorov@phytec.de> Tested-by: Daniel Schultz <d.schultz@phytec.de>
This commit updates the RAM region filtering logic in
board_get_usable_ram_top() to skip any memory regions whose start address
is above 4GB. Previously, only the end address was capped at 4GB, but
regions entirely above this threshold were still considered.
Typically, the following memory map entries would cause
board_get_usable_ram_top() to return 0x100000000, which is incorrect.
start=00000000, end=00001000, type=16
start=00001000, end=000a0000, type=1
start=000a0000, end=000f6000, type=2
start=000f6000, end=000f7000, type=16
start=000f7000, end=00100000, type=2
start=00100000, end=6f170000, type=1
start=6f170000, end=70000000, type=16
start=70000000, end=80800000, type=2
start=e0000000, end=f8000000, type=2
start=fa000000, end=fc000000, type=2
start=fc800000, end=fc880000, type=2
start=fd800000, end=fe800000, type=2
start=feb00000, end=feb80000, type=2
start=fec00000, end=fed00000, type=2
start=fed20000, end=fed80000, type=2
start=feda1000, end=feda2000, type=2
start=fedc0000, end=fede0000, type=2
start=100000000, end=102400000, type=2
start=102400000, end=47f800000, type=1
start=4000000000, end=4020000000, type=2
By adding a check to continue the loop if the region's start address
exceeds 0xffffffffULL, the function now properly ignores regions that are
not usable in 32-bit address space.
Signed-off-by: Jeremy Compostella <jeremy.compostella@intel.com>
Since commit 27cc5951c862 ("include: env: ti: add default for
do_main_cpsw0_qsgmii_phyinit"), the value of the environment variable
do_main_cpsw0_qsgmii_phyinit happened to remain '0' and couldn't be
changed without user intervention. This behavior is due to the following
cyclic dependency:
A) ti_common.env sets do_main_cpsw0_qsgmii_phyinit to '0' and its value
can only be updated automatically by main_cpsw0_qsgmii_phyinit.
B) main_cpsw0_qsgmii_phyinit is defined in j721e.env and it can run only
if 'do_main_cpsw0_qsgmii_phyinit' is already '1' which isn't possible
unless the user manually assigns the value.
Fix the aforementioned cyclic dependency by using board_late_init() to
detect the QSGMII Daughtercard and set do_main_cpsw0_qsgmii_phyinit.
Additionally, to address the issue of do_main_cpsw0_qsgmii_phyinit being
'undefined' for other platforms, replace:
if test ${do_main_cpsw0_qsgmii_phyinit} -eq 1;
with:
if env exists do_main_cpsw0_qsgmii_phyinit;
in ti_common.env.
Fixes: 27cc5951c862 ("include: env: ti: add default for do_main_cpsw0_qsgmii_phyinit")
Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Reviewed-by: Anshul Dalal <anshuld@ti.com>