u-boot.git/drivers/ufs/ufs-uclass.c, branch main

ufs: core: Fix heap corruption due to out of bounds write

2026-04-22T08:06:01Z

The ufshcd_read_string_desc() can perform out of bounds write and corrupt heap in case the input utf-16 string contains code points which convert to anything more than plain 7-bit ASCII string. This occurs because utf16_to_utf8(dst, src, size) in U-Boot behaves differently than Linux utf16s_to_utf8s(..., maxlen), but the porting process did not take that into consideration. The U-Boot variant of the function converts up to $size utf-16 fixed-length 16-bit input characters into as many 1..4 Byte long variable-length utf-8 output characters. That means for 16 Byte input, the output can be up to 64 Bytes long. The Linux variant converts up utf-16 input into up to $maxlen Bytes worth of utf-8 output, but stops at the $maxlen limit. That means for 16 Byte input with maxlen=32, the processing will stop after writing 32 output Bytes. In case of U-Boot, use of utf16_to_utf8() leads to potential corruption of data past the $size Bytes and therefore corruption of surrounding content on the heap. The fix is as simple, allocate buffer that is sufficient to fit the utf-8 string. The rest of the code in ufshcd_read_string_desc() does correctly limit the buffer to fit into the DMA descriptor afterward. Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20260329231151.332108-1-marek.vasut+renesas@mailbox.org Signed-off-by: Neil Armstrong

ufs: Remap CPU to bus addresses using dev_phys_to_bus()

2026-04-08T17:53:44Z

Use dev_phys_to_bus() to convert CPU addresses of DMA descriptors into bus addresses of DMA descriptors. This is necessary on hardware which does not have 1:1 mapping between CPU and memory addressed by the DMA. This has no impact on other hardware which does not need this conversion. Signed-off-by: Marek Vasut

Merge tag 'u-boot-ufs-20260313' of https://source.denx.de/u-boot/custodians/u-boot-ufs into next

2026-03-13T16:52:03Z

- ufs_hba_ops callbacks cleanup - Rockchip UFS reset support - UFS support in SPL

drivers: ufs: handle return values of ufs_hba_ops callbacks

2026-03-05T15:51:51Z

The return values of ufshcd_ops_link_startup_notify(), ufshcd_ops_hce_enable_notify(), ufshcd_ops_init(), and ufshcd_device_reset() are currently ignored. Check and propagate these return values properly and emit appropriate error messages on error. While at it, remove the ufshcd_device_reset() wrapper, which just call ufshcd_device_reset(). Signed-off-by: Julien Stephan Reviewed-by: Macpaul Lin Link: https://patch.msgid.link/20260305-ufs-ufs_hba_ops-cleanup-v3-1-e153ffab98f5@baylibre.com Signed-off-by: Neil Armstrong

ufs: Disable UTP command timeout in slow mode

2026-03-02T14:19:17Z

When the UFS controller is operating in slow (PWM) mode, the driver is disabled the timeout for UTP send commands. In high-speed mode, the timeout remains enabled to detect stalled or failed transfers. This change ensures reliable operation in slow mode, where command completion may take longer and timeouts are not required. Signed-off-by: Padmarao Begari Signed-off-by: Michal Simek Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/e6deb9086afab9d2bdd53db8ecbc7db93af5204d.1764169598.git.michal.simek@amd.com Signed-off-by: Neil Armstrong

ufs: Call ufs_scsi_bind() from uclass .post_bind

2025-10-28T16:35:19Z

Instead of duplicating the ufs_scsi_bind() call in every driver, call it from UFS uclass .post_bind callback for every driver in one place. While doing so, inline ufs_scsi_bind() directly into ufs_post_bind() as trivial device_bind_driver() call. Reviewed-by: Neil Armstrong Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20251028142335.18125-5-marek.vasut+renesas@mailbox.org [narmstrong: also updated the rockchip and mediatek drivers] Signed-off-by: Neil Armstrong

ufs: core: Fold ufs-uclass into ufs

2025-10-28T16:32:29Z

Move the few lines of ufs-uclass.c into ufs.c and remove the ufs-uclass.c . No functional change. Reviewed-by: Neil Armstrong Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20251028142335.18125-2-marek.vasut+renesas@mailbox.org Signed-off-by: Neil Armstrong

Restore patch series "arm: dts: am62-beagleplay: Fix Beagleplay Ethernet"

2024-05-20T19:35:03Z

As part of bringing the master branch back in to next, we need to allow for all of these changes to exist here. Reported-by: Jonas Karlman Signed-off-by: Tom Rini

Revert "Merge patch series "arm: dts: am62-beagleplay: Fix Beagleplay Ethernet""

2024-05-19T14:16:36Z

When bringing in the series 'arm: dts: am62-beagleplay: Fix Beagleplay Ethernet"' I failed to notice that b4 noticed it was based on next and so took that as the base commit and merged that part of next to master. This reverts commit c8ffd1356d42223cbb8c86280a083cc3c93e6426, reversing changes made to 2ee6f3a5f7550de3599faef9704e166e5dcace35. Reported-by: Jonas Karlman Signed-off-by: Tom Rini

ufs: Remove and add needed includes

2024-05-07T14:00:56Z

Remove from this driver directory and when needed add missing include files directly. Signed-off-by: Tom Rini