| Age | Commit message (Collapse) | Author |
|---|
|
Add myself to help review patches for RISC-V port.
Signed-off-by: Yao Zi <[email protected]>
Reviewed-by: Leo Yu-Chi Liang <[email protected]>
|
|
dev_read_addr returns FDT_ADDR_T_NONE (-1), not NULL,
in case of errors.
Replace dev_read_addr by dev_read_addr_ptr.
Replace error to EINVAL.
Signed-off-by: Francois Berder <[email protected]>
Reviewed-by: Hal Feng <[email protected]>
|
|
The Xilinx MicroBlaze V platform does not have an ACLINT (Advanced
Core Local Interruptor) hardware block. The timer functionality is
provided through a different mechanism.
Exclude both RISCV_ACLINT and SPL_RISCV_ACLINT from being implied
for TARGET_XILINX_MBV while keeping the default behavior for other
generic RISC-V targets that do have ACLINT hardware.
spl/u-boot-spl: all -1382 data -360 rodata -200 text -822
Signed-off-by: Michal Simek <[email protected]>
Reviewed-by: Leo Yu-Chi Liang <[email protected]>
|
|
A platform (like Xilinx Microblaze V) does not have an ACLINT (Advanced
Core Local Interruptor) hardware block.
Make RISCV_ACLINT and SPL_RISCV_ACLINT Kconfig symbols visible with
prompts.
Signed-off-by: Michal Simek <[email protected]>
Reviewed-by: Yao Zi <[email protected]>
|
|
Building on commit c64fc632a86a ("riscv: cpu: Use CONFIG_IS_ENABLED(CPU)
instead of plain ifdef"), add an early return in riscv_cpu_setup() when
CONFIG_CPU is not enabled. This allows platforms to save code space in
SPL by disabling CONFIG_SPL_CPU.
Without this patch, building U-Boot with CONFIG_CPU=n and CONFIG_EVENT=y
is broken: riscv_cpu_setup() is registered as an EVT_DM_POST_INIT_F event
spy, and when the CPU uclass is unavailable uclass_find_first_device()
returns no device, so the function returns -ENODEV. That in turn makes
event_notify_null() in dm_init_and_scan() fail and triggers a boot hang
("initcall initf_dm() failed"). Returning 0 early avoids that failure.
The compiler's dead-code elimination combined with --gc-sections
removes the unreachable code and all associated static data,
achieving significant size reduction without preprocessor guards:
spl/u-boot-spl:all -4332 spl/u-boot-spl:rodata -2872
spl/u-boot-spl:text -1460
Signed-off-by: Michal Simek <[email protected]>
Reviewed-by: Yao Zi <[email protected]>
|
|
Add emmc detection to VisionFive 2 Lite DT selection and
fdtfile environment variable setting.
Reviewed-by: E Shattow <[email protected]>
Signed-off-by: Hal Feng <[email protected]>
|
|
So the VisionFive 2 Lite eMMC DT will be built and merged into FIT.
Reviewed-by: E Shattow <[email protected]>
Signed-off-by: Hal Feng <[email protected]>
|
|
Fix warning:
arch/riscv/dts/cv18xx.dtsi:208.26-216.5: Warning (spi_bus_bridge):
/soc/spi-nor@10000000: node name for SPI buses should be 'spi'
Signed-off-by: Hiago De Franco <[email protected]>
|
|
Steps 2 and 3 are incorrectly numbered. Fix them.
Signed-off-by: Hiago De Franco <[email protected]>
|
|
The Allwinner A527 SoC features two Ethernet controllers utilizing
different IP blocks. While gmac0 uses the older sun8i-emac IP, gmac1 is
based on the Synopsys DesignWare Ethernet QOS IP.
This enables the DWC_ETH_QOS_SUNXI driver and the required PHY interface
configurations in the defconfig for the Radxa Cubie A5E board,
activating the gmac1 port.
Signed-off-by: Junhui Liu <[email protected]>
[Andre: drop unneeded options]
Reviewed-by: Andre Przywara <[email protected]>
Tested-by: Andre Przywara <[email protected]>
|
|
The Allwinner sun55i (A523/A527/T527) platform features the Synopsys
DesignWare Ethernet QOS IP. To enable this GMAC controller in U-Boot,
this introduces the glue layer responsible for configuring the
corresponding clocks, resets, and syscon registers.
This implementation is directly ported from upstream Linux kernel commit
f603808a98af ("net: stmmac: Add support for Allwinner A523 GMAC200").
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Junhui Liu <[email protected]>
|
|
The upstream Linux kernel relies on the sunxi_sram driver to bind the
system-control nodes as syscon devices. Since U-Boot lacks this SRAM
driver, peripheral drivers may fail to resolve the syscon node unless an
explicit "syscon" compatible is added into the device tree.
To address this, add a bare UCLASS_SYSCON driver that matches all
Allwinner system-control and SRAM controller compatibles listed in the
Linux kernel to provide the necessary regmap access to the system
controller.
Signed-off-by: Junhui Liu <[email protected]>
|
|
The Allwinner sun55i (A523/A527/T527) platform requires the MBUS clock
gate enabled for the gmac1 controller to function. Add the clock gate
definition for CLK_MBUS_EMAC1.
Signed-off-by: Junhui Liu <[email protected]>
Reviewed-by: Andre Przywara <[email protected]>
|
|
The Allwinner sun55i (A523/A527/T527) platform provide a Synopsys
DesignWare Ethernet QOS IP block as the gmac1 controller, which uses
pins PJ0 to PJ16. Add the gmac1 function to the pinctrl driver to
support it.
Signed-off-by: Junhui Liu <[email protected]>
Reviewed-by: Andre Przywara <[email protected]>
|
|
The OrangePi 4A board ships with SPI NOR flash, so enable the SPI and
flash drivers, also the SPL version, for SPI booting.
Signed-off-by: Andre Przywara <[email protected]>
Acked-by: Jernej Skrabec <[email protected]>
|
|
The Radxa Cubie A5E ships with SPI NOR flash, so enable the SPI and
flash drivers, also the SPL version, for SPI booting.
Sync the defconfig file with the version from savedefconfig on the way.
Signed-off-by: Andre Przywara <[email protected]>
Acked-by: Jernej Skrabec <[email protected]>
|
|
The SPI IP in the Allwinner A523 is mostly compatible to the later
generation used in other Allwinner SoCs, at least as far as the SPL
driver is concerned.
Just add the pinmux configuration for SPI0 on PortC, as used by the
BROM. This enables SPI (NOR) boot on A523/A527/T527 boards.
Signed-off-by: Andre Przywara <[email protected]>
Reviewed-by: Jernej Skrabec <[email protected]>
|
|
The function to set the pinmux for the Port C SPI0 pins was looking more
like a logic puzzle from a magazine than something that readers could
understand and extend.
Replace the convoluted pinmux setup, grouped by pin, with a simple array
of the four pins involved, and just initialise this array at build time,
based on the selected SoC.
This makes it easy to see which pins are needed, and even easier to extend.
Signed-off-by: Andre Przywara <[email protected]>
|
|
The SPI controllers in the Allwinner A523/A527/T527 SoCs is very close
to the one used in the R329 and D1 generation, definitely as far as our
driver is concerned.
Add the new compatible string, but use the existing config section from
the previous SoC generation.
Signed-off-by: Andre Przywara <[email protected]>
Acked-by: Jernej Skrabec <[email protected]>
|
|
The get_mclk_offset() function used the non-existent Kconfig symbol
CONFIG_MACH_SUN9I_A80 instead of CONFIG_MACH_SUN9I, causing the
MMC2 clock register to be written at 0x06000090 instead of
0x06000418. This corrupted the CMD2 response and made eMMC
completely unresponsive.
Also the legacy (SPL) sunxi_mmc_init() did not include CONFIG_MACH_SUN9I
in the 8-bit bus width condition, so MMC2 (eMMC) would only use
4-bit mode in the SPL, which is insufficient for reliable boot.
Tested on a Cubieboard4 A80: with both fixes, SPL loads U-Boot proper
and boots Debian 12 from eMMC with no SD card present.
Signed-off-by: Omar Ivan Fardjoume <[email protected]>
[Andre: fix mangled patch, trim commit message]
Signed-off-by: Andre Przywara <[email protected]>
|
|
Allan ELKAIM <[email protected]> says:
sqfsload fails to load a file through a symlink when the squashfs
image contains a large number of inodes (e.g. a rootfs that includes
the tzdata timezone database).
Root cause: sqfs_read_nest() resolves the symlink by calling itself
recursively without first freeing the parent directory's inode and
directory table buffers. This causes a temporary double allocation
that can exhaust the U-Boot heap. When malloc() subsequently fails
inside sqfs_read_directory_table(), the error goes undetected and
sqfs_search_dir() is called with a NULL pos_list pointer, leading to:
Error: invalid inode reference to directory table.
Failed to load '/boot/Image'
Patch 1 fixes the structural problem (temporary double allocation)
and plugs the silent NULL pointer path in sqfs_read_directory_table().
Patch 2 adds the missing return-value checks on sqfs_dir_offset() that
turn any residual lookup failure into a clean error propagation.
Patch 3 (reworked in v3 following Richard Genoud's review) fixes
pre-existing leaks of dirs->entry on the error paths of
sqfs_search_dir(), by centralizing the cleanup at the 'out' label.
All patches are independent and can be reviewed separately.
The bug was first observed on U-Boot v2024.01 and is still present
on v2026.04. The patches have been tested on a Raspberry Pi CM4
running U-Boot v2026.04 (Yocto Scarthgap 5.0.17) with a 325 MB
squashfs rootfs containing 22 517 inodes. The symlink
/boot/Image -> Image-6.6.63-v8 now resolves successfully.
This series addresses the bug reported at:
https://lists.u-boot-project.org/pipermail/u-boot/2026-May/618533.html
Link: https://lore.kernel.org/r/[email protected]
|
|
Several error paths in sqfs_search_dir() return through 'goto out'
while a directory entry obtained from sqfs_readdir_nest() is still
held, leaking dirs->entry: the inode lookup failure, the symlink
nesting limit check, every allocation/tokenization failure during
symlink resolution, and the case where readdir aborts after an
entry was already read.
Instead of freeing dirs->entry at each error site, centralize the
cleanup at the 'out' label: on error, no valid entry may be handed
back to the caller, so it can be freed unconditionally there. On
success, dirs->entry is already NULL: it is freed at the end of
each token iteration and before recursing into a symlink target,
and the root directory path never allocates it.
Explicit frees remain only where a success path needs them:
between reads in the readdir loop, at the end of each token
iteration, and before the recursive call. The now-redundant frees
on individual error paths are removed.
Suggested-by: Richard Genoud <[email protected]>
Signed-off-by: Allan ELKAIM <[email protected]>
|
|
sqfs_dir_offset() returns a negative errno on failure, but three
call sites in sqfs_search_dir() use the return value as an array
index without checking for errors first. If the lookup fails,
dirs->table is set to an invalid address, leading to undefined
behavior.
Add negative-value guards after each sqfs_dir_offset() call so
that any lookup failure propagates cleanly as an error rather
than producing incorrect results.
Note: the corresponding sqfs_find_inode() NULL checks and the
heap exhaustion fix during symlink resolution are applied in
separate patches.
Acked-by: Miquel Raynal <[email protected]>
Reviewed-by: Richard Genoud <[email protected]>
Signed-off-by: Allan ELKAIM <[email protected]>
|
|
When sqfs_read_nest() encounters a symlink it resolves it by calling
itself recursively. In the unfixed code this looks like:
// dirsp is open: inode_table + dir_table still on heap
resolved = sqfs_resolve_symlink(symlink, filename);
ret = sqfs_read_nest(resolved, ...); // recursive: allocates a new
// inode_table + dir_table pair
free(resolved);
goto out;
// out: sqfs_closedir(dirsp) <- parent tables freed HERE, too late
There is no permanent leak: the parent's tables are freed at the
out: label once the recursive call returns. However, for the entire
duration of the recursive call both the parent's inode_table +
dir_table and the child's inode_table + dir_table are live on the
heap simultaneously. On large squashfs images these tables can be
significant in size, and this temporary double allocation may exhaust
the heap budget.
A superficial workaround would be to increase CONFIG_SYS_MALLOC_LEN,
but that wastes memory on all boards and does not address the
structural problem. The correct fix is to change the freeing order:
release the parent directory's resources before recursing. This way
only one set of inode and directory tables is live at any given time,
halving the peak heap usage during symlink resolution.
When heap exhaustion does occur and malloc returns NULL for dir_table
or pos_list inside sqfs_read_directory_table(), the failure is
currently silent and cascading:
- metablks_count is not reset to -1 before the goto out, so the
function returns a positive block count alongside a NULL pointer.
- sqfs_opendir_nest() does not detect the failure (it only checks
metablks_count < 1) and calls sqfs_search_dir() with m_list=NULL.
- sqfs_dir_offset() iterates over m_list[0..n], reading from
addresses 0x0, 0x4, 0x8, ... None of those values match the
inode's start_block, so the function returns -EINVAL.
- The error propagates up as a load failure with no indication
that the root cause was heap exhaustion:
Error: invalid inode reference to directory table.
Failed to load '<symlink path>'
Two fixes:
1. In sqfs_read_directory_table(), set metablks_count = -1 whenever
malloc fails after sqfs_count_metablks() returns a positive value,
so that the caller's "metablks_count < 1" check correctly detects
the failure and avoids calling sqfs_search_dir() with a NULL
pos_list.
2. In sqfs_read_nest() and sqfs_size_nest(), call sqfs_closedir() on
the parent dirsp before the recursive call so that the parent's
inode and directory tables are freed before the child allocates
its own. Only one set of tables is then live at any given time,
halving peak heap usage during symlink resolution.
Link: https://lists.denx.de/pipermail/u-boot/2026-May/618533.html
Reviewed-by: Richard Genoud <[email protected]>
Acked-by: Miquel Raynal <[email protected]>
Signed-off-by: Allan ELKAIM <[email protected]>
|
|
In preparation for being able to support more recent OpenSSL versions,
we need to add support for the OpenSSL Provider API. This in turn isn't
something that MSYS has all of the required packages to support. Given a
lack of user feedback that these tools are still used in this manner,
remove Windows host tool builds from CI.
Link: https://lore.kernel.org/u-boot/[email protected]/
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Tom Rini <[email protected]>
|
|
With CONFIG_FIT_BEST_MATCH, fit_conf_find_compat() selects the
configuration matching the most specific U-Boot compatible string; on
equal matches the first listed configuration wins and the configurations
node 'default' property is never consulted.
A FIT whose configurations all share the same base devicetree compatible
(e.g. one manifest carrying a base tree plus overlay combinations for a
single board) therefore always boots the first configuration, silently
ignoring the default chosen by the manifest author.
Break score ties in favour of the default configuration. A strictly
better compatible match still wins over it, and FITs without a default
keep the current first-listed behaviour.
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
Signed-off-by: Carlo Caione <[email protected]>
|
|
Use N: to match on all atmel/at91 files, drop the large list of
entries which represent the same set of relevant files and miss a
few in the process.
Signed-off-by: Marek Vasut <[email protected]>
|
|
We have a new mailing list but the old one still forwards to the new
one, although some people (including me) have issues with the forward
and their mails to the old mailing list being dropped due to SPF policy.
Add an entry in .mailmap so that Cc: [email protected] in "old"
cover letters and patches use the new mailing list address.
Tested with b4 ty --dry-run on a series from the old mailing list.
Tested with a Cc: [email protected] in a commit log with b4 (b4
send), git-format-patch and git-send-email somehow don't seem to be
respecting this mapping. At least one tool (the one we now recommend)
does the right thing, so it's progress :)
Signed-off-by: Quentin Schulz <[email protected]>
Reviewed-by: Peter Robinson <[email protected]>
|
|
get_partition() returns a malloc()'d struct mmc_part and only frees it on
its own internal error path. None of its callers - mmc_byte_io(),
get_unique_guid_for_partition() and get_size_of_partition() - free the
returned pointer, so every partition access leaks one struct mmc_part.
A single "avb verify" issues many such accesses (footer, vbmeta and the
hashed image chunks), so the leak accumulates quickly.
Free the descriptor in all three callers. mmc_byte_io() is reworked to
use a single exit path so the partition is released on every return.
Fixes: 3af30e4443aa ("avb2.0: implement AVB ops")
Signed-off-by: Igor Opaniuk <[email protected]>
Reviewed-by: Mattijs Korpershoek <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mattijs Korpershoek <[email protected]>
|
|
run_avb_verification() allocates an AvbOps via avb_ops_alloc() but never
frees it on any return path. Every Android boot attempt therefore leaks
the AvbOpsData structure and, when CONFIG_OPTEE_TA_AVB is enabled, leaves
the OP-TEE session open (it is only closed inside avb_ops_free()).
In addition, the AvbSlotVerifyData returned by avb_slot_verify() is only
released on the failure branches. The successful "return 0" paths (both
the locked GREEN/OK case and the unlocked ORANGE/ERROR_VERIFICATION case)
return without freeing it, leaking the whole out_data (cmdline and loaded
partition metadata) on every good boot.
Route all exit paths through a single cleanup label that frees both
out_data and avb_ops.
Fixes: 125d9f3306ea ("bootstd: Add a bootmeth for Android")
Signed-off-by: Igor Opaniuk <[email protected]>
Reviewed-by: Mattijs Korpershoek <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mattijs Korpershoek <[email protected]>
|
|
DCACHE_OFF is defined as (0 << 2) = 0, and PTE_TYPE_FAULT is defined
as (0 << 0) = 0. In mmu_set_region_dcache_behaviour(), the cache
attribute passed to set_regions() is computed as:
attrs = PMD_ATTRINDX(option >> 2)
For DCACHE_OFF=0 this evaluates to PMD_ATTRINDX(0) = 0, which equals
PTE_TYPE_FAULT.
Commit 6468ca13ffd6f ("armv8: mmu: fix and optimise explicitly unmapping
regions") added an unmap path to set_one_region() that
triggers when attrs == PTE_TYPE_FAULT. Because DCACHE_OFF and
PTE_TYPE_FAULT share the same numerical value (0), any call to
mmu_set_region_dcache_behaviour() with DCACHE_OFF silently unmaps the
target region instead of changing its cache attributes to non-cached.
The subsequent flush_dcache_range() call at the end of
mmu_set_region_dcache_behaviour() then crashes with a Level 3
translation fault because the region it tries to flush has just been
unmapped.
The existing flag parameter already distinguishes the two callers:
- mmu_set_region_dcache_behaviour() always passes flag=false
- mmu_change_region_attr_nobreak() always passes flag=true, and is the
only legitimate caller that passes PTE_TYPE_FAULT to unmap a region
Guard the unmap path with flag so that DCACHE_OFF attribute changes
take the correct else branch, which ORs in the ATTRINDX bits only,
leaving the PTE valid.
This was observed as a boot crash on Versal, Versal Net, and ZynqMP
platforms during network initialisation. The zynq_gem driver calls
mmu_set_region_dcache_behaviour() with DCACHE_OFF to make its BD
descriptor ring non-cached. With the bug the BD memory is unmapped,
and the subsequent dcache flush inside
mmu_set_region_dcache_behaviour() faults.
Fixes: 6468ca13ffd6f ("armv8: mmu: fix and optimise explicitly unmapping regions")
Signed-off-by: Akshay Belsare <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
|
|
Add a driver model serial driver for Espressif ESP32 UART
controllers. The driver supports ESP32, ESP32-S3 and ESP32-S31 UART
register variants, including baud-rate setup, FIFO access and basic
port initialization.
Signed-off-by: Honbo He <[email protected]>
Changes in v3:
- Add debug UART for early print output
|
|
For a compressed kernel_noload image, bootm_load_os() allocates a
per-image decompression buffer of ALIGN(image_len * 8, SZ_1M) rather
than the global CONFIG_SYS_BOOTM_LEN. When decompression fails on that
path, handle_decomp_error() still prints
Image too large: increase CONFIG_SYS_BOOTM_LEN
which is misleading: increasing CONFIG_SYS_BOOTM_LEN does not help
because the smaller per-image buffer is the actual bound. Commit
2ff26c1e378d ("bootm: fix overflow of the noload kernel decompression
buffer") worked around this by printing a follow-up note right after
handle_decomp_error() returned, but the boot log then reads as two
contradictory sentences.
Introduce enum bootm_decomp_limit and pass it into
handle_decomp_error() so the helper picks the right message in one
place. For the per-image path it now prints
Image too large for the per-image decompression buffer (0x100000 bytes)
quoting the actual buffer size; the global path is unchanged. Drop the
trailing note in bootm_load_os() so only one line is printed.
Suggested-by: Simon Glass <[email protected]>
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
found_key() is declared to return bool but returns NULL when strdup()
fails. NULL is a pointer constant; while it happens to convert to
zero (i.e. false) it is a type mismatch that trips stricter
compilers/static analysers.
Return false to match the declared return type.
Signed-off-by: Naveen Kumar Chaudhary <[email protected]>
|
|
pstore_save() writes four different filenames into a fixed 256-byte
stack buffer 'path' using sprintf() with "%s" fed from argv[3] (the
user-supplied mount directory). The U-Boot command line buffer
(CONFIG_SYS_CBSIZE) is typically 1024 or 2048 bytes, so a directory
path in argv[3] can easily exceed 240 characters and overflow 'path',
corrupting the surrounding stack frame including the return address.
Replace the four sprintf(path, ...) call sites with snprintf() using
sizeof(path) as the bound. The neighbouring sprintf() calls into the
'addr' and 'length' buffers are left as-is; they write fixed-width
numeric conversions whose maximum length is bounded by the size of
ulong/u32 in hex and cannot overflow those buffers.
Signed-off-by: Naveen Kumar Chaudhary <[email protected]>
|
|
The help text advertises "<addr> [byte count]" but do_strings()
stores argv[2] directly into last_addr and the loop condition tests
"addr < last_addr", i.e. it treats the value as an absolute end
address. When invoked as documented (e.g. "strings 0x40000000
0x100") the loop condition fails immediately because the supplied
count is far below start_addr, and the command prints nothing.
Compute last_addr as start_addr + hextoul(argv[2], NULL) so the
argument is used as a length in bytes, matching the help. The
existing repeat-mode fixup (last_addr = addr + (last_addr -
start_addr)) continues to preserve the same byte-count window
across CMD_FLAG_REPEAT.
Signed-off-by: Naveen Kumar Chaudhary <[email protected]>
|
|
In case dm_rtc_reset() returns -ENOSYS, it means the .reset callback
in RTC driver is not implemented, likely because the callback is not
needed. Handle the -ENOSYS return code as success and proceed, else
the 'date reset' invocation incorrectly prints a bogus warning:
"## Failed to set date after RTC reset".
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Aristo Chen <[email protected]> says:
fit_import_data() in tools/fit_image.c declares the data pointer and
the name of the external data property outside its loop over the
/images subnodes, so both values leak from one image into the next. An
image node that carries data-size but neither data-offset nor
data-position then reuses the pointer left behind by the previously
imported image: the previous image's data is written into the node,
after which the import aborts trying to delete an external data
property the node never had. Since that abort path only prints a
debug() message, a regular mkimage build fails with nothing but the
generic usage text. The failure mode also depends on the order of the
image nodes: when no externally stored image precedes the malformed
node, the pointer is still NULL, the node is skipped, and the hashing
stage reports a proper error instead.
A FIT authored from a .its cannot hit this, because dtc-authored
images carry inline data. It takes re-processing an external-data FIT
in which an image has lost its data-offset, for example one edited
with fdtput -d or produced by another tool:
mkimage -E -f demo.its demo.itb
fdtput -d demo.itb /images/kernel-2 data-offset
mkimage -F demo.itb
There is no silent-success path, because the failing property delete
always aborts the run before the file is written back, but the user is
left without any indication of what is wrong.
Patch 1 moves the declarations into the loop so that each image starts
from a clean state. A node without an external data reference is now
skipped consistently regardless of node order, and the later
processing stages report the malformed node with a proper error
message (Can't get image data/size).
Patch 2 adds a regression test that builds an external-data FIT,
deletes the data-offset property of the second image and re-processes
the result with mkimage -F. It asserts that mkimage fails and that the
diagnostic is present on stderr; the unfixed tool fails the second
assertion since it prints nothing beyond the usage text.
Link: https://lore.kernel.org/r/[email protected]
|
|
Build an external-data FIT, remove the data-offset property from the
second image so that only its data-size remains, and re-process the
result with mkimage -F. mkimage must reject the malformed FIT with a
clear diagnostic from the hashing stage. Previously the stale per-image
state in fit_import_data() made the import copy the first image's data
into the second image and abort without printing anything.
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
The data pointer and the name of the external data property are
declared outside the loop over the image nodes, so their values leak
from one image into the next. An image node that carries data-size but
neither data-offset nor data-position then reuses the pointer of the
previously imported image: the previous image's data is written into
the node before the import aborts when it tries to delete an external
data property the node does not have. Since that abort path only prints
a debug message, mkimage fails without any indication of what is wrong.
The failure mode also depends on the order of the image nodes: when no
externally stored image precedes the malformed node, the stale pointer
is still NULL, so the import skips the node and the hashing stage
reports a proper error instead.
Move the declarations into the loop so that each image starts from a
clean state. A node without an external data reference is now skipped
consistently regardless of node order, and a malformed node is always
reported by the later processing stages with a proper error message.
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
https://git.u-boot-project.org/u-boot/custodians/u-boot-mediatek
Fixes:
* Fixed some wrong parents of VLP clocks on mt8189.
* Added a missing perficfg_ao clock in mt8188.
* Disabled watchdog by default on Genio 510/700.
* Fixed U-Boot DT overrides not included on Genio 510/700.
Cleanups/refactoring:
* Changed how clock parent providers are registered and looked
up for all MediaTek targets.
* Removed duplicate devicetree node in mt7623.
* Removed unused/non-standard DT properties in mt798{1,6,8}.
* Simplified MAINTAINERS by using N: instead of F: when possible.
* Replaced duplicate driver names in all MediaTek clock drivers.
* Cleaned up MediaTek power domain driver and split into separate
driver per compatible target.
* Removed unused power domain enablement from mt798{1,6,6a,7,8}.
Features:
* Added power domain driver for mt8188.
|
|
https://git.u-boot-project.org/u-boot/custodians/u-boot-usb
- XHCI DWC3 bugfix
|
|
A Rockchip NAND Flash Controller (NFC) supports multiple
flash devices. The SoC boot ROM only checks for NAND chip 0
and with reduced ECC strength. Currently only the read page
functions have this condition check added in the U-Boot
driver.
In single- and multi-chip nodes with rockchip,boot-blks and
rockchip,boot-ecc-strength set, the chips that aren't chip 0
will thus have an ECC mismatch when writing and reading.
Fix by adding the same condition to all read and write page
functions by dropping the existing 'selected_bank == 0' check
and use the NAND_IS_BOOT_MEDIUM option that was introduced to
U-Boot more recently than this driver to behave
identically to the Linux driver.
NAND_IS_BOOT_MEDIUM is automatically set when nand-is-boot-medium
property is set in the Device Tree, which is a requirement for
rockchip,boot-blks and rockchip,boot-ecc-strength and will thus
apply to all chips in single- and multi-chips nodes, regardless
of the CS.
Fixes: b12dc5d6fa76 ("mtd: nand: NFC drivers for RK3308, RK2928 and others")
Signed-off-by: Johan Jonker <[email protected]>
Tested-by: Hüseyin BIYIK <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Quentin Schulz <[email protected]>
|
|
Commit d6694018eadd ("net: nfs: fix buffer overflow in
nfs_readlink_reply()") added bounds checks against sizeof(nfs_path_buff)
before both memcpy() calls. This is a cosmetic cleanup of that fix:
- introduce a local new_len for the relative-path branch so the sum
pathlen + rlen is computed once and reused for both the bounds check
and the NUL terminator, rather than being open-coded twice;
- emit a diagnostic when a symlink target is rejected for exceeding the
buffer, matching the style of other NFS error paths.
No functional change to the accept/reject decision.
This same overflow was independently discovered and privately reported
to the U-Boot maintainers on 2026-04-03, together with a working proof
of concept, ahead of the change that became the fix cited above. This
cleanup restores the local-variable form from that original report.
Signed-off-by: Murtaza Munaim <[email protected]>
|
|
When multiple Ethernet controllers are enabled in the device tree,
but only one controller is actually present in hardware, the
non-existent controller still attempts to connect to a PHY.
In this case, phy_connect() may return NULL without setting an
error code. The current driver only logs the failure but does not
propagate an error, causing the initialization flow to continue
with an invalid PHY handle.
This leads to failures later in the initialization sequence.
Fix this by explicitly setting ret = -ENODEV when phy_connect()
returns NULL, ensuring the driver exits cleanly on failure.
Signed-off-by: Boon Khai Ng <[email protected]>
|
|
_set_cacert() calls mbedtls_x509_crt_init(&crt) followed by
mbedtls_x509_crt_parse(), which allocates internal storage (parsed
cert fields, chain links, raw buffers) inside the crt object. The
function then returns on both the error and success paths without
calling mbedtls_x509_crt_free(&crt), so all of that internal state
is leaked when the stack-allocated crt goes out of scope. Every
invocation of "wget cacert ..." leaks memory.
Free the cert object on both return paths.
Signed-off-by: Naveen Kumar Chaudhary <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
|
|
sntp_loop() allocates a netif via net_lwip_new_netif() and normally
releases it with net_lwip_remove_netif() before returning. The error
path taken when no explicit server IP is passed and ntp_server_known()
is false returns -1 directly without freeing the netif, leaking the
lwIP netif structure (and its associated state) on every failed
invocation of the sntp command.
Call net_lwip_remove_netif(netif) before returning on this path so it
matches the other exits.
Signed-off-by: Naveen Kumar Chaudhary <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
|
|
LwIP may pass a packet to the netif linkoutput callback as a chain
of pbufs. In this case, p->len only describes the length of the
first pbuf, while p->tot_len describes the length of the whole
packet.
The current transmit path only sends the first pbuf. This can
truncate packets whose headers have already been generated for the
full packet length, resulting in malformed frames on the wire.
For example, the IP header may record a larger total length than the
actual Ethernet frame length.
Assemble chained pbufs into one aligned contiguous buffer before
passing the packet to the Ethernet driver.
Fixes: 98ad145db61a (net: lwip: add DHCP support and dhcp commmand)
Signed-off-by: Weijie Gao <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
|
|
The legacy network stack supports tftpsrv, which listens for an
incoming TFTP write request and receives the first file into memory.
Despite the old command help wording, the command returns after
receiving the file and does not boot it automatically.
The lwIP stack already builds the lwIP TFTP application, but only wires
it up for client-side tftpboot. Add a lwIP tftpsrv command and
implement the server path with tftp_init_server(). Reuse the existing
lwIP TFTP write callback and memory copy path so LMB checks, progress
output, filesize/fileaddr updates and EFI bootdev handling stay
consistent with tftpboot.
Track receive timeout and write-failure state around the lwIP callbacks
so a stalled or rejected receive is not reported as a successful close.
Move CMD_TFTPSRV out of the legacy-only Kconfig block so it can be
enabled with either network stack. Update the command help text and add
usage documentation for the receive-only behavior.
Add pytest coverage for tftpsrv using a generated host file and curl's
TFTP upload support. Enable the command in qemu_arm64_lwip_defconfig so
the test can be run with the existing lwIP QEMU build when the boardenv
provides env__net_tftpsrv_file.
Signed-off-by: James Hilliard <[email protected]>
[Jerome Forissier: remove trailing ':' after SPDX tag]
Signed-off-by: Jerome Forissier <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
|
|
When device was created, it already has a name assigned. There is
no need to alloc space for name and set it with same device name.
Cleanup the code to avoid unnecessary device_set_name.
Signed-off-by: Peng Fan <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
|
