u-boot.git/common/spl, branch v2025.07-rc5

common/spl: improve error handling in spl_fit

2025-06-19T17:01:51Z

This fix a possible NULL pointer dereference. There is also a risk of memory leaking within the same portion of code. The leak will happen if loaded image is bad or damaged. In this case u-boot-spl will try booting from the other available media. Unfortunately resources allocated for previous boot media will NOT be freed. We can't fix that issue as the memory allocation mechanism used here is unknown. It can be different kinds of malloc() or something else. To somewhat reduce memory consumption, one can try to reuse previously allocated memory as it's done in board_spl_fit_buffer_addr() from test/image/spl_load.c. The corresponding comment was put to the code as well. Signed-off-by: Mikhail Kshevetskiy Reviewed-by: Anshul Dalal

common/spl: handle properly images with bad checksum

2025-06-19T17:01:51Z

load_simple_fit() returns -EPERM for the images with broken signatures. Unfortunately this may conflict with image loaging selection on the base of boot phase. See commit 873112db9ce68c38984ff25808dde726f8dd5573 ("spl: Support selecting images based on phase in simple FIT"). Thus loading of configurations { uboot { description = "u-boot"; firmware = "atf"; loadables = "atf", "tee", "uboot"; }; }; with damaged "tee" image may finish without errors. This may results in board bricking. This patch fixes commit 873112db9ce68c38984ff25808dde726f8dd5573 ("spl: Support selecting images based on phase in simple FIT") by replacing EPERM with EBADSLT places where it should be done. Signed-off-by: Mikhail Kshevetskiy

common/spl: fix potential out of buffer access in spl_fit_get_image_name function

2025-06-19T17:01:51Z

The current code have two issues: 1) ineffective NULL pointer check str = strchr(str, '\0') + 1 if (!str || ... The str here will never be NULL (because we add 1 to result of strchr()) 2) strchr() may go out of the buffer for the special forms of name variable. It's better use memchr() function here. According to the code the property is a sequence of C-string like shown below: 'h', 'e', 'l', 'l', 'o', '\0', 'w', 'o', 'r', 'l', 'd', '\0', '!', '\0' index is the string number we are interested, so index = 0 => "hello", index = 1 => "world", index = 2 => "!" The issue will arrise if last string for some reason have no terminating '\0' character. This can happen for damaged or specially crafted dtb. Signed-off-by: Mikhail Kshevetskiy Reviewed-by: Tom Rini

spl: Kconfig: support U-Boot load from raw NAND

2025-05-21T10:52:29Z

Commit 2a00d73d081a ("spl: mmc: Try to clean up raw-mode options") breaks the boot of the BSH SMM S2 board. As stated in the commit itself, "Some boards use this value even though MMC is not enabled in SPL, for example imx8mn_bsh_smm_s2". Support load of the U-Boot image from raw NAND sector. This is equivalent to load from MMC raw sector. Fixes: 2a00d73d081a ("spl: mmc: Try to clean up raw-mode options") Signed-off-by: Dario Binacchi

rockchip: Add SPL_PAD_TO Kconfig default value

2025-05-06T07:58:25Z

Almost all Rockchip boards use the same Kconfig value for SPL_PAD_TO, 0x7f8000. u-boot-rockchip.bin is typically written to offset 64S (32KiB) of MMC media. u-boot.itb (or u-boot.img) is typically expected at offset 16384S (8MiB) of MMC media (SYS_MMCSD_RAW_MODE_U_BOOT_SECTOR=0x4000). SPL_PAD_TO is used as the offset for u-boot.itb (or u-boot.img) in the generated simple-bin binman image, and can be calculated as: SPL_PAD_TO = (16384S - 64S) * 512 = 0x7f8000 Add this value as a default value for ARCH_ROCKCHIP. Signed-off-by: Jonas Karlman Reviewed-by: Kever Yang Reviewed-by: Quentin Schulz

spl: imx: use trampoline buffer to load images to secure region

2025-05-03T19:55:32Z

When SPL loading image to secure region, for example, ATF and tee to DDR secure region. Because the USDHC controller is non-secure master, it can't access this region and will cause loading issue. So use a trampoline buffer in non-secure region, then use CPU to copy the image from trampoline buffer to destination secure region. Signed-off-by: Ye Li Signed-off-by: Alice Guo Reviewed-by: Peng Fan

configs: set SPL_TEXT_BASE by default for k3 platforms

2025-04-24T14:23:07Z

SPL_TEXT_BASE is used as the load address for the main domain SPL on k3 platforms. Since the config value is the same for every board, this patch sets the value 0x80080000 as default for all 64-bit ARCH_K3, 0x43c00000 as default for the R5 cores and deletes the instances of SPL_TEXT_BASE in individual defconfigs. Signed-off-by: Anshul Dalal Reviewed-by: Tom Rini

ARM: mvebu: Correct SYS_MMCSD_RAW_MODE_U_BOOT_USE_SECTOR usage

2025-04-16T06:05:15Z

As the code is today, we get a warning about "select" statements on "choice" options not doing anything. However, it also works as intended because SYS_MMCSD_RAW_MODE_U_BOOT_USE_SECTOR is the default option within that choice statement. To guard against future regressions, make the choice statement in common/spl/Kconfig have an explicit default if MVEBU_SPL_BOOT_DEVICE_MMC. Signed-off-by: Tom Rini Reviewed-by: Stefan Roese

Merge patch series "Annotate switch/case fallthrough cases"

2025-04-08T22:24:12Z

Andre Przywara says: C's implicit fallthrough behaviour in switch/case statements can lead to subtle bugs. Quite some while ago many compilers introduced warnings in those cases, requiring intentional fallthrough's to be annotated. So far we were not enabling that compiler option, so many ambiguities and some bugs in the code went unnoticed. This series adds the required annotations in code paths that the first stage of the U-Boot CI covers. There is a large number of cases left in the libbz2 code. The usage of switch/case is borderline insane there, labels are hidden in macros, and there are no breaks, but just goto's. Upstream still uses very similar code, without any annotations. I still am not 100% sure those are meant to fall through or not, and plan to do further investigations, but didn't want to hold the rest of the patches back. You can see for yourself by applying patch 18/18 and building for sandbox64, for instance. Because of this we cannot quite enable the warning in the Makefile yet, but those fixes are worth regardless, and be it to increase readability. Please note that those patches do not fix anything, really, they just add those fallthrough annotations, so the series is not really critical. Link: https://lore.kernel.org/r/20250327153313.2105227-1-andre.przywara@arm.com

spl: mmc: properly annotate fallthrough

2025-04-08T22:23:51Z

Depending on the various MMC boot configurations, we might end up with trying filesystem mode when a raw image boot failed. This fall-through in the switch/case statement is explained in a comment, but this is not visible to the compiler, which still will complain. Add the proper compiler-visible annotation, to allow enabling the compiler check in the future. Signed-off-by: Andre Przywara Reviewed-by: Tom Rini