u-boot.git/common, branch v2025.07

Merge patch series "spl: fix error handling in spl_fit_get_image_name()"

2025-06-26T17:58:21+00:00

Heinrich Schuchardt  says:

spl_fit_get_image_name() used to lack a detection of malformed image name
properties in FIT images. The change in commit 3704b888a4ca ("common/spl:
fix potential out of buffer access in spl_fit_get_image_name function")
tried to fix this  but led to function spl_fit_get_image_name() no longer
detecting if a property at index > 1 does not exist.

This patch is reverted.

An explicit check for malformed image name properties is introduced.

Link: https://lore.kernel.org/u-boot/38f5d078-3328-4bdb-9c95-4fb5fe89ddc2@gmx.de/T/#u
Link: https://lore.kernel.org/r/20250624153431.46986-1-heinrich.schuchardt@canonical.com

common/spl: guard against buffer overflow in spl_fit_get_image_name()

2025-06-26T17:58:17+00:00

A malformed FIT image could have an image name property that is not NUL
terminated. Reject such images.

Reported-by: Mikhail Kshevetskiy 
Signed-off-by: Heinrich Schuchardt 
Tested-by: E Shattow

common/spl: Revert fix potential out of buffer access in spl_fit_get_image_name function

2025-06-26T17:58:17+00:00

The change in commit 3704b888a4ca ("common/spl: fix potential out of buffer
access in spl_fit_get_image_name function") led to function
spl_fit_get_image_name() no longer detecting if a property does not exist
at a non-zero buffer.

Link: https://lore.kernel.org/u-boot/38f5d078-3328-4bdb-9c95-4fb5fe89ddc2@gmx.de/T/#m59f3a23e675daa992c28d12236de71cae2ca2bb9
Fixes: 3704b888a4ca ("common/spl: fix potential out of buffer access in spl_fit_get_image_name function")
Signed-off-by: Heinrich Schuchardt 
Tested-by: E Shattow

arm: kirkwood: fix freeze on boot

2025-06-23T20:04:40+00:00

Commit 6fe50e395080 ("arm: asm/system.h: mrc and mcr need .arm if
__thumb2__ is not set") is not a proper fix for the LTO link error
mentioned in its description. It causes 32-bit arm instructions to be
mixed with thumb instructions, which the Kirkwood SoCs do not support.
For example, board_init_r() is mostly generated in Thumb-1 mode as
expected since the build flags contain -mthumb -mthumb-interwork. The
MCR instruction corresponding to writefr_extra_feature_reg() is also
correcly emitted as a 32-bit ARM instruction (it cannot be encoded in
Thumb-1 anyways). The problem is, the compiler inlines the MCR without
generating the BX or BLX instruction which are needed to transition
between the ARM and the Thumb-1 states. From the objdump output:

006186a0 :
board_init_r():
/home/jerome/work/u-boot/common/board_r.c:799
  6186a0:       b5f0            push    {r4, r5, r6, r7, lr}
  6186a2:       b0ab            sub     sp, #172        @ 0xac
get_gd():
/home/jerome/work/u-boot/./arch/arm/include/asm/global_data.h:127
  6186a4:       464a            mov     r2, r9
...
/home/jerome/work/u-boot/arch/arm/mach-kirkwood/cpu.c:242
  619aae:       9b15            ldr     r3, [sp, #84]   @ 0x54
writefr_extra_feature_reg():
/home/jerome/work/u-boot/./arch/arm/include/asm/arch/cpu.h:100
  619ab0:       ee2f3f11        mcr     15, 1, r3, cr15, cr1, {0}
                ^^^^^^^^
                32-bit ARM instruction

Further investigation is needed to understand how to fix the issue so
that the code size is minimal for all boards. In the mean time, this
fix disables LTO for the two problematic files (common/board_f.c and
common/board_r.c). This makes the Kirkwood-based boards bootable again.
The binary size is increased by 1048 bytes which is perfectly
acceptable.

Fixes: 6fe50e395080 ("arm: asm/system.h: mrc and mcr need .arm if __thumb2__ is not set")
Reported-by: Tony Dinh 
Tested-by: Tony Dinh 
Signed-off-by: Jerome Forissier 
Signed-off-by: Tom Rini

common/spl: improve error handling in spl_fit

2025-06-19T17:01:51+00:00

This fix a possible NULL pointer dereference.

There is also a risk of memory leaking within the same portion of code.
The leak will happen if loaded image is bad or damaged. In this case
u-boot-spl will try booting from the other available media. Unfortunately
resources allocated for previous boot media will NOT be freed.

We can't fix that issue as the memory allocation mechanism used here
is unknown. It can be different kinds of malloc() or something else.

To somewhat reduce memory consumption, one can try to reuse previously
allocated memory as it's done in board_spl_fit_buffer_addr() from
test/image/spl_load.c.

The corresponding comment was put to the code as well.

Signed-off-by: Mikhail Kshevetskiy 
Reviewed-by: Anshul Dalal

common/spl: handle properly images with bad checksum

2025-06-19T17:01:51+00:00

load_simple_fit() returns -EPERM for the images with broken signatures.
Unfortunately this may conflict with image loaging selection on the base
of boot phase. See commit 873112db9ce68c38984ff25808dde726f8dd5573
("spl: Support selecting images based on phase in simple FIT").

Thus loading of

	configurations {
		uboot {
			description = "u-boot";
			firmware = "atf";
			loadables = "atf", "tee", "uboot";
		};
	};

with damaged "tee" image may finish without errors. This may results in
board bricking.

This patch fixes commit 873112db9ce68c38984ff25808dde726f8dd5573
("spl: Support selecting images based on phase in simple FIT")
by replacing EPERM with EBADSLT places where it should be done.

Signed-off-by: Mikhail Kshevetskiy

common/spl: fix potential out of buffer access in spl_fit_get_image_name function

2025-06-19T17:01:51+00:00

The current code have two issues:
1) ineffective NULL pointer check

	str = strchr(str, '\0') + 1
	if (!str || ...

   The str here will never be NULL (because we add 1 to result of strchr())

2) strchr() may go out of the buffer for the special forms of name variable.
   It's better use memchr() function here.

   According to the code the property is a sequence of C-string like
   shown below:

     'h', 'e', 'l', 'l', 'o', '\0', 'w', 'o', 'r', 'l', 'd', '\0', '!', '\0'

   index is the string number we are interested, so

     index = 0   =>  "hello",
     index = 1   =>  "world",
     index = 2   =>  "!"

   The issue will arrise if last string for some reason have no terminating
   '\0' character. This can happen for damaged or specially crafted dtb.

Signed-off-by: Mikhail Kshevetskiy 
Reviewed-by: Tom Rini

Merge tag 'xilinx-for-v2025.07-rc4' of https://source.denx.de/u-boot/custodians/u-boot-microblaze

2025-06-05T14:40:42+00:00

AMD/Xilinx/FPGA changes for v2025.07-rc4

usb:
- Fix regulator handling

net:
- Fix MII clock handling

phy:
- Fix GTR line logic for sgmii

pci:
- Fix pcireg_base logic

fpga:
- Fix change handling in intel_sdm_mb driver

x86: Correct condition for init_cache_f_r()

2025-06-04T14:15:12+00:00

The condition here is reversed, which makes link and coral very slow,
leading to lab failures.

Fixes 6c171f7a184 ("common: board: make initcalls static")

Signed-off-by: Simon Glass 
Reviewed-by: Jerome Forissier

usb: onboard-hub: Fix return type for regulator APIs

2025-06-04T08:24:16+00:00

Apart from ENOENT observing return value as ENOSYS when
!DM_REGULATOR that's why cover both configurations.
Changed code is not working as operation should be "&&"
not "||" (ret != -ENOENT && ret != -ENOSYS).

Also fix the remove function where the regulator_set_enable_if_allowed()
function is returning an error.

Signed-off-by: Padmarao Begari 
Reviewed-by: Marek Vasut 
Signed-off-by: Michal Simek 
Link: https://lore.kernel.org/r/a2d520f14efc30fc28ec59881205e156dabbfcd9.1744350937.git.michal.simek@amd.com