| Age | Commit message (Collapse) | Author |
|---|
|
Signed-off-by: Tom Rini <[email protected]>
|
|
sqfs_frag_lookup() reads a 16-bit metadata block header whose lower
15 bits encode the data size. Unlike sqfs_read_metablock() in
sqfs_inode.c, this function does not validate that the decoded size is
within SQFS_METADATA_BLOCK_SIZE (8192). A malformed SquashFS image can
set the size field to any value up to 32767, causing memcpy to write
past the 8192-byte 'entries' heap buffer.
Add the same bounds check used by sqfs_read_metablock(): reject any
metadata block header with SQFS_METADATA_SIZE(header) exceeding
SQFS_METADATA_BLOCK_SIZE.
Found by fuzzing with libFuzzer + AddressSanitizer.
Signed-off-by: Eric Kilmer <[email protected]>
Reviewed-by: Miquel Raynal <[email protected]>
|
|
We currently provide default board names for each board in their
respective evm.c file. However for custom boards, this behaviour
overwrites the default DT as set in the defconfig
(CONFIG_DEFAULT_FDT_FILE or CONFIG_DEFAULT_DEVICE_TREE).
This patch changes the default name to be NULL which prevents this
overwrite and allows ti_set_fdt_env to instead fallback to the correct
DT as set in Kconfig.
Signed-off-by: Anshul Dalal <[email protected]>
Reviewed-by: Bryan Brattlof <[email protected]>
|
|
Update dev-data and clk-data to include wake-up I2C device for J722s.
Signed-off-by: Chintan Vankar <[email protected]>
Tested-by: Richard Genoud <[email protected]>
|
|
Marek Vasut <[email protected]> says:
Enable zip command in sandbox so it is always build tested.
Add simple test for zip/unzip/gzwrite commands so they are
unit tested.
Link: https://lore.kernel.org/r/[email protected]
|
|
Add simple test for zip/unzip/gzwrite commands. The test works as
follows. First, create three buffers with a bit of space between
each of them, fill them with random data, then compress data in
buffer 1 into buffer 2, decompress data in buffer 2 either directly
into buffer 3 or into MMC 1 and then read them back into buffer 3,
and finally compare buffer 1 and buffer 3, they have to be identical.
The buffers are filled with random data to detect out of bounds writes.
Test for various sizes, both small and large and unaligned.
The test uses ut_assert_skip_to_line() to skip over gzwrite progress
bar. Since the progress bar updates fill up the console record buffer,
increase the size of it to compensate.
Reviewed-by: Mattijs Korpershoek <[email protected]>
Tested-by: Mattijs Korpershoek <[email protected]>
Signed-off-by: Marek Vasut <[email protected]>
|
|
What is not being built and tested in CI, breaks. Enable the 'zip'
command in sandbox to get it build tested in preparation for an
actual unit test.
Reviewed-by: Mattijs Korpershoek <[email protected]>
Signed-off-by: Marek Vasut <[email protected]>
|
|
Update DDR timings to increase stability in higher temperature ranges.
Update DDR settings:
- SysConfig DDR tool v0.09.05
- Package: ALV
- Extended temperature range -40C to 105C
- Lower tREFI (ns) to 3900
Signed-off-by: Wadim Egorov <[email protected]>
Tested-by: Daniel Schultz <[email protected]>
|
|
This commit updates the RAM region filtering logic in
board_get_usable_ram_top() to skip any memory regions whose start address
is above 4GB. Previously, only the end address was capped at 4GB, but
regions entirely above this threshold were still considered.
Typically, the following memory map entries would cause
board_get_usable_ram_top() to return 0x100000000, which is incorrect.
start=00000000, end=00001000, type=16
start=00001000, end=000a0000, type=1
start=000a0000, end=000f6000, type=2
start=000f6000, end=000f7000, type=16
start=000f7000, end=00100000, type=2
start=00100000, end=6f170000, type=1
start=6f170000, end=70000000, type=16
start=70000000, end=80800000, type=2
start=e0000000, end=f8000000, type=2
start=fa000000, end=fc000000, type=2
start=fc800000, end=fc880000, type=2
start=fd800000, end=fe800000, type=2
start=feb00000, end=feb80000, type=2
start=fec00000, end=fed00000, type=2
start=fed20000, end=fed80000, type=2
start=feda1000, end=feda2000, type=2
start=fedc0000, end=fede0000, type=2
start=100000000, end=102400000, type=2
start=102400000, end=47f800000, type=1
start=4000000000, end=4020000000, type=2
By adding a check to continue the loop if the region's start address
exceeds 0xffffffffULL, the function now properly ignores regions that are
not usable in 32-bit address space.
Signed-off-by: Jeremy Compostella <[email protected]>
|
|
Since commit 27cc5951c862 ("include: env: ti: add default for
do_main_cpsw0_qsgmii_phyinit"), the value of the environment variable
do_main_cpsw0_qsgmii_phyinit happened to remain '0' and couldn't be
changed without user intervention. This behavior is due to the following
cyclic dependency:
A) ti_common.env sets do_main_cpsw0_qsgmii_phyinit to '0' and its value
can only be updated automatically by main_cpsw0_qsgmii_phyinit.
B) main_cpsw0_qsgmii_phyinit is defined in j721e.env and it can run only
if 'do_main_cpsw0_qsgmii_phyinit' is already '1' which isn't possible
unless the user manually assigns the value.
Fix the aforementioned cyclic dependency by using board_late_init() to
detect the QSGMII Daughtercard and set do_main_cpsw0_qsgmii_phyinit.
Additionally, to address the issue of do_main_cpsw0_qsgmii_phyinit being
'undefined' for other platforms, replace:
if test ${do_main_cpsw0_qsgmii_phyinit} -eq 1;
with:
if env exists do_main_cpsw0_qsgmii_phyinit;
in ti_common.env.
Fixes: 27cc5951c862 ("include: env: ti: add default for do_main_cpsw0_qsgmii_phyinit")
Signed-off-by: Siddharth Vadapalli <[email protected]>
Reviewed-by: Anshul Dalal <[email protected]>
|
|
Fix a segmentation fault caused by a null pointer access during root
partition checking. The function part_get_info() was falsely given null
for the disk_partition struct, which later resulted in accessing a null
pointer and thus undefined behavior.
Fixes: 5d7c080ae5dc ("bootstd: rauc: Don't check root part filesystem")
Signed-off-by: Martin Schwan <[email protected]>
|
|
Add missing "to" so that the sentence makes sense.
Signed-off-by: Hugo Villeneuve <[email protected]>
|
|
libfdt expects FDT/DTO blobs to be 8-byte aligned. When loading the
base FDT or overlays from a FIT, the mapped buffer may be unaligned,
which can break fdt_open_into() on strict-alignment architectures.
boot_get_fdt_fit() relocates the base FDT with boot_relocate_fdt()
before applying overlays. That uses the bootm memory map and can
overlap with the FIT buffer when the FIT is loaded into RAM,
corrupting data needed to load the kernel and ramdisk.
Allocate writable, 8-byte aligned copies of the base FDT and overlays
with memalign() and fdt_open_into(). Grow the base buffer as needed,
apply overlays to it and pack the final tree. Free each temporary
overlay copy after application and check fdt_pack() errors.
Fixes: 8fbcc0e0e839 ("boot: Assure FDT is always 8-byte aligned")
Fixes: 881f0b77dc8c ("image: apply FDTOs on FDT image node")
Signed-off-by: James Hilliard <[email protected]>
Cc: Jamie Gibbons <[email protected]>
Reviewed-by: Marek Vasut <[email protected]>
|
|
It has been a long while since Jagan Teki, Joe Hershberger or Ramon
Fried have been active in the community. We thank them for their time
over the years. Remove them from the active maintainer list and mark a
few things as Orphaned for now.
Signed-off-by: Tom Rini <[email protected]>
|
|
Fix a typo in the docstring for run_build() where source_dir was
misspelled.
Signed-off-by: David Lechner <[email protected]>
|
|
- A fix for CDNS3 in correctly determining dr_mode for OTG.
|
|
The cdns3_bind() function is responsible for identifying the appropriate
driver to bind to the USB Controller's device-tree node. If the device-tree
node has the 'dr_mode' property set to 'otg', the existing approach fails
to bind a driver, leading to loss of functionality.
To address this, use the VBUS Valid field of the OTG Status register to
determine the role as follows:
- If VBUS Valid field is set, it indicates that a USB Host is supplying
power and the Controller should assume the Peripheral role.
- If VBUS Valid field is clear, it indicates the absence of a USB Host and
the Controller should assume the Host role.
Additionally, when 'dr_mode' happens to be 'otg' and the STRAP settings
are not specified, use VBUS Valid to determine the role in cdns3_drd_init()
and assign it to cdns->dr_mode.
Signed-off-by: Siddharth Vadapalli <[email protected]>
Reviewed-by: Marek Vasut <[email protected]>
|
|
https://source.denx.de/u-boot/custodians/u-boot-efi
Pull request efi-2026-04-rc3
CI: https://source.denx.de/u-boot/custodians/u-boot-efi/-/pipelines/29293
UEFI:
* add missing EFI_CALL around tcg2 read_blocks calls
* fix ECPT table size computation
|
|
The size of the memory allocated for the EFI Conformance Profiles Table is
computed with `num_entries' always equal to zero, which is incorrect when
CONFIG_EFI_EBBR_2_1_CONFORMANCE is enabled.
This can be verified by allocating the ECPT memory with malloc() instead of
efi_allocate_pool(), building u-boot with sandbox_defconfig and
CONFIG_VALGRIND=y, and by finally running the following command:
valgrind --suppressions=scripts/u-boot.supp \
./u-boot -T -c 'efidebug tables'
Fix this by using an array of the supported profiles GUIDs instead, which
should also be easier to extend in the future as U-Boot should publish the
GUIDs for all supported EBBR revisions.
Fixes: 6b92c1735205 ("efi: Create ECPT table")
Suggested-by: Heinrich Schuchardt <[email protected]>
Signed-off-by: Vincent Stehlé <[email protected]>
Cc: Ilias Apalodimas <[email protected]>
Cc: Tom Rini <[email protected]>
Cc: Jose Marinho <[email protected]>
Reviewed-by: Heinrich Schuchardt <[email protected]>
|
|
The read_blocks() function from the Block IO protocol is a UEFI function;
make sure to call it from within U-Boot using the EFI_CALL() macro.
To demonstrate the issue on an AArch64 machine, define the DEBUG macro in
include/efi_loader.h and build u-boot with sandbox_defconfig, then download
and uncompress the ACS-DT image [1], and finally execute the following
command:
$ ./u-boot -T -c " \
host bind 0 systemready-dt_acs_live_image.wic; \
setenv loadaddr 0x10000; \
load host 0 \${loadaddr} EFI/BOOT/Shell.efi; \
bootefi \${loadaddr} \${fdtcontroladdr}"
The following assertion should fail:
lib/efi_loader/efi_net.c:858: efi_network_timer_notify: Assertion `__efi_entry_check()' failed.
This happens due to the following EFIAPI functions call chain:
efi_start_image()
efi_disk_read_blocks()
(due to the missing EFI_CALL, entry_count == 2)
efi_network_timer_notify()
Link: https://github.com/ARM-software/arm-systemready/releases/download/v25.12_DT_3.1.1/systemready-dt_acs_live_image.wic.xz [1]
Fixes: ce3dbc5d080d ("efi_loader: add UEFI GPT measurement")
Signed-off-by: Vincent Stehlé <[email protected]>
Cc: Heinrich Schuchardt <[email protected]>
Cc: Ilias Apalodimas <[email protected]>
Cc: Tom Rini <[email protected]>
Cc: Masahisa Kojima <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
Acked-by: Masahisa Kojima <[email protected]>
Reviewed-by: Heinrich Schuchardt <[email protected]>
|
|
`dram_init()` is called by R5 SPL and U-Boot, both. It starts by
computing the size of the RAM. In verdin-am62(p), it does so by calling
`get_ram_size()`. This function computes the size of the RAM by writing
over the RAM.
When R5 computes the size of the RAM, it does not update the DT with
this size. As a result, when A53 invokes `dram_init()` again, it has to
compute the size through `get_ram_size()` again.
Commit 13c54cf588d82 and 0c3a6f748c9 add firewall over ATF's and OPTEE's
regions. This firewall is added during the R5 SPL stage of boot. So when
A53 attempts to write over RAM in `get_ram_size()`, it writes over the
protected region. Since A53 is a non-secure core, this is blocked by the
firewall.
To fix this, do the following:
* Implement `spl_perform_board_fixups()` function for verdin-am62
and verdin-am62p. Make this function call `fixup_memory_node()`,
which updates the DT.
* Add an if-block in `dram_init()`, to ensure that only R5 is able
to call `get_ram_size()`, and that A53 reads this size from the
DT.
Signed-off-by: Suhaas Joshi <[email protected]>
Reviewed-by: Francesco Dolcini <[email protected]>
|
|
https://source.denx.de/u-boot/custodians/u-boot-microblaze
AMD/Xilinx/FPGA changes for v2026.04-rc3
clk:
- zynqmp clk fixes
phy:
- sync vsc8541 config
versal2:
- fix GIC configuration
|
|
https://source.denx.de/u-boot/custodians/u-boot-dfu
u-boot-dfu-20260211
USB Gadget:
* dwc3: Support ip and version type
* dwc3: Increase controller halt timeout
* dwc3: Don't send unintended link state change
* dwc3: Improve reset sequence
* dwc2: Move dr_mode check to bind to support RK3288/RK3506 with
2 DWC2 controllers
|
|
https://source.denx.de/u-boot/custodians/u-boot-tpm
A coverity fix and documentation update from Heiko on SM3 support
|
|
add documentation for sm3sum command.
Signed-off-by: Heiko Schocher <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
Coverity scan reported:
CID 449815: Memory - illegal accesses (OVERRUN)
Overrunning array of 64 bytes at byte offset 64 by dereferencing pointer
"sctx->buffer + partial". [Note: The source code implementation of the
function has been overridden by a builtin model.]
In line: 252
memset(sctx->buffer + partial, 0, SM3_BLOCK_SIZE - partial);
The respective line should be:
memset(sctx->buffer + partial, 0, SM3_BLOCK_SIZE - partial - 1);
as partial gets incremented by one before.
Signed-off-by: Heiko Schocher <[email protected]>
Acked-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Ilias Apalodimas <[email protected]>
|
|
Set RMII reference clock output to enabled (1) by default for VSC8541
PHY in RMII mode. The RMII specification requires a 50MHz reference
clock, and many board designs expect the PHY to provide this clock to
the MAC controller.
Previously, the driver defaulted rmii_clk_out to 0 (disabled) for all
interface modes, which caused the PHY to not output the required 50MHz
clock. This resulted in MAC-PHY communication failures and prevented
network operations like DHCP from working on RMII-configured boards.
This change alligns with the hardware power-up default behavior and
aligns with both the generic PHY driver and Linux MSCC PHY driver
implementations.
Signed-off-by: Pranav Tilak <[email protected]>
Signed-off-by: Michal Simek <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Versal2 was using wrong GIC base mappings, causing GICR_TYPER reads to
not match EL1 MPIDR. This led U-Boot to walk beyond the per-CPU GICR
frames, access out-of-range addresses, and hit a synchronous exception
during early gic init percpu while booting up on alternate core
i.e., non cpu0.
Update Versal Gen 2 headers to the correct Versal Gen 2 bases.
Signed-off-by: Maheedhar Bollapalli <[email protected]>
Signed-off-by: Michal Simek <[email protected]>
Link: https://lore.kernel.org/r/d0bc3fe1af8409fcfe505e55fb7042a33b845a4e.1770721325.git.michal.simek@amd.com
|
|
Santhosh Kumar K <[email protected]> says:
This series updates the DDR Configurations according to the SysConfig DDR
Configuration tool v0.10.32 for the following devices [1]
- AM64x EVM
- AM62x SK
- AM62x LP SK
- AM62Ax SK
- AM62Px SK
Testing:
memtester - 50% of memory for 10 loops - PASSED
[1] https://dev.ti.com/tirex/content/Processor_DDR_Config_0.10.32.0000/docs/REVISION_HISTORY.html
Link: https://lore.kernel.org/r/[email protected]
|
|
Update the DDR Configurations for AM62Px SK according to the SysConfig
DDR Configuration tool v0.10.32. [1]
[1] https://dev.ti.com/tirex/content/Processor_DDR_Config_0.10.32.0000/docs/REVISION_HISTORY.html
Signed-off-by: Santhosh Kumar K <[email protected]>
Reviewed-by: Bryan Brattlof <[email protected]>
|
|
Update the DDR Configurations for AM62Ax SK according to the SysConfig
DDR Configuration tool v0.10.32. [1]
[1] https://dev.ti.com/tirex/content/Processor_DDR_Config_0.10.32.0000/docs/REVISION_HISTORY.html
Signed-off-by: Santhosh Kumar K <[email protected]>
Reviewed-by: Bryan Brattlof <[email protected]>
|
|
Update the DDR Configurations for AM62x LP SK according to the SysConfig
DDR Configuration tool v0.10.32. [1]
[1] https://dev.ti.com/tirex/content/Processor_DDR_Config_0.10.32.0000/docs/REVISION_HISTORY.html
Signed-off-by: Santhosh Kumar K <[email protected]>
Reviewed-by: Bryan Brattlof <[email protected]>
|
|
Update the DDR Configurations for AM62x SK according to the SysConfig
DDR Configuration tool v0.10.32. [1]
[1] https://dev.ti.com/tirex/content/Processor_DDR_Config_0.10.32.0000/docs/REVISION_HISTORY.html
Signed-off-by: Santhosh Kumar K <[email protected]>
Reviewed-by: Bryan Brattlof <[email protected]>
|
|
Update the DDR Configurations for AM64x EVM according to the SysConfig
DDR Configuration tool v0.10.32. [1]
[1] https://dev.ti.com/tirex/content/Processor_DDR_Config_0.10.32.0000/docs/REVISION_HISTORY.html
Signed-off-by: Santhosh Kumar K <[email protected]>
Reviewed-by: Bryan Brattlof <[email protected]>
|
|
When built without CONFIG_CMD_CLK, we get a warning about the unused
clk_names variable:
../drivers/clk/clk_zynqmp.c:153:27: warning: ‘clk_names’ defined but not used [-Wunused-const-variable=]
153 | static const char * const clk_names[clk_max] = {
So also guard it with CONFIG_CMD_CLK to get rid of that.
Signed-off-by: Peter Korsgaard <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
Signed-off-by: Michal Simek <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
It looks like the original zynqmp typo was copied to versal as well. Fix
both.
Signed-off-by: Peter Korsgaard <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
Signed-off-by: Michal Simek <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
Signed-off-by: Tom Rini <[email protected]>
|
|
Historically, when we have an appended device tree and also our
resulting binary will contain the BSS section, we have ensured that
everything will be where it's expected to be by declaring that the BSS
is overlayed with a symbol matches the end of the port of the ELF binary
that is objcopy'd to the binary we concatenate with. This in turn means
that the logic to generate a "pad" file, which is the size found in the
__bss_size symbol, will be correct and then we can concatenate the
device tree and it will begin at __bss_size at run time.
With commit 5ffc1dcc26d3 ("arm: Remove rel.dyn from SPL linker scripts")
we removed this overlay as part of trying to ensure that we met both the
requirements of the device tree to be 8 byte aligned as well as that our
logic to generate the -pad file would match what ended up in the
resulting binary. While it was correct to remove an unused section it
did not solve ultimately solve the problem for all cases.
To really fix the problem, we need to do two things. First, our final
section prior to _image_binary_end must be 8 byte aligned (for the case
of having a separate BSS and so our appended DTB exists at this
location). This cannot be '.binman_sym_table' as it may be empty, and in
turn the ELF type would be NOBITS and so not copied with objcopy. The
__u_boot_list section will never be empty, so it is our final section,
and ends with a '. = ALIGN(8)' statement. Second, as this is the end of
our copied data it is safe to declare that the BSS starts here, so use
the OVERLAY keyword to place the BSS here.
Fixes: 5ffc1dcc26d3 ("arm: Remove rel.dyn from SPL linker scripts")
Reported-by: Brian Sune <[email protected]>
Reported-by: Phil Phil Sutter <[email protected]>
Tested-by: Brian Sune <[email protected]>
Tested-by: Phil Sutter <[email protected]>
Tested-by: Greg Malysa <[email protected]>
Signed-off-by: Tom Rini <[email protected]>
|
|
Resync all defconfig files using qconfig.py
Signed-off-by: Tom Rini <[email protected]>
|
|
Pull request net-20260209.
net:
- airoha: mdio support for the switch
- phy: mscc: allow RGMII with internal delay for the VSC8541
- dwc_eth_qos: Update tail pointer handling
net-legacy:
- Stop conflating return value with file size in net_loop()
net-lwip:
- wget: rework the '#' printing
- tftp: add support of tsize option to client
|
|
https://source.denx.de/u-boot/custodians/u-boot-at91
First set of u-boot-at91 features for the 2026.04 cycle:
This small fixes set includes fixing 64 bit builds and some warnings for
the at91 serial driver, and some cleanup on the nand driver.
|
|
Fix ti-secure content reference from spl_am62a7_sk_dtb to
spl_am62d2_evm_dtb or AM62d dtb. Also remove redundant k3-binman.dtsi
include.
Fixes: 14dfa6b86187 ("Add initial support for AM62D2-EVM")
Signed-off-by: Paresh Bhagat <[email protected]>
Reviewed-by: Andrew Davis <[email protected]>
|
|
Moving forward, DM firmware will no longer mess with the MAIN_PLL3.
This means MAIN_PLL3 will need to be manually set to 2GHz in order for
the CPSW9G HSDIV to have the correct 250MHz output for RGMII.
Signed-off-by: Bryan Brattlof <[email protected]>
Signed-off-by: Siddharth Vadapalli <[email protected]>
|
|
Add entry for SMBIOS in MAINTAINERS and assign myself as maintainer.
Signed-off-by: Raymond Mao <[email protected]>
|
|
Frank Wunderlich <[email protected]> says:
Add command for getting ramsize in scripts
Link: https://lore.kernel.org/r/[email protected]
|
|
Add documentation for memsize command.
Signed-off-by: Frank Wunderlich <[email protected]>
|
|
Add a test for memsize command in same way as meminfo.
Signed-off-by: Frank Wunderlich <[email protected]>
|
|
Add a command for getting detected ram size with possibility to
assign it to an environment variable.
example usage:
BPI-R4> memsize
4096 MiB
BPI-R4> memsize memsz
BPI-R4> printenv memsz
memsz=4096
BPI-R4>
board with 8GB ram:
BPI-R4> memsize
8192 MiB
BPI-R4> memsize memsz
BPI-R4> printenv memsz
memsz=8192
BPI-R4>
Signed-off-by: Frank Wunderlich <[email protected]>
|
|
Suhaas Joshi <[email protected]> says:
This series starts by replacing hard-coded addresses in firewall
templates that are defined in k3-binman.dtsi, by Kconfigs. Using
Kconfigs makes it easier for someone to move ATF and OP-TEE to another
location, since they wouldn't have to fiddle with the firewall
configurations in dtsi files.
The rest of the commits in this series add firewall configs to each
device's dtsi files.
I have only tested this patch series with TI boards. For non-TI Sitara
boards, respective board maintainers are requested to test the relevant
patch and confirm whether it works.
To test this, I used `k3conf <read|write> <address> [<value>]`. Both of
these operations were disallowed, as expected.
Link: https://lore.kernel.org/r/[email protected]
|
|
Add firewall configurations to protect ATF and OP-TEE memory regions
from non-secure read's and write's in Phycore AM64 SOM.
Signed-off-by: Suhaas Joshi <[email protected]>
|
