summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-21riscv: binman: Always set default configuration in FIT imageRaymond Mao
When CONFIG_MULTI_DTB_FIT is enabled, the FIT image contains multiple device tree configurations for different boards. The default configuration must be explicitly set to ensure the FIT framework traverses all available configurations instead of falling back to CONFIG_DEFAULT_DEVICE_TREE. Without this default property, fit_find_config_node() will use CONFIG_DEFAULT_DEVICE_TREE as the configuration name to match. This prevents the SPL from correctly selecting the appropriate DTB based on runtime board detection (e.g., from EEPROM). Remove the conditional guard so that "default = conf-1" is always present in the FIT image, regardless of CONFIG_MULTI_DTB_FIT. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]>
2026-07-21spl: k1: enable SPI NOR flash detection and bootGuodong Xu
Add nor_early_init() to probe the QSPI controller and SPI NOR flash in SPL. Switch spl_boot_device() to BOOT_DEVICE_SPI so the board boots from SPI flash. Change the default device tree to k1-musepi-pro, whose u-boot overlay already defines the QSPI controller and flash node with bootph-pre-ram markers. Enable the required SPI driver model and flash config options. Signed-off-by: Guodong Xu <[email protected]>
2026-07-21spi: fsl: add support for Spacemit K1 SoCRaymond Mao
Make FSL QSPI driver supporting Spacemit K1 SoC. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]>
2026-07-21mtd: spi: enable spi_nor_remove() in soft reset configRaymond Mao
spi_nor_remove() is only implemented in spi-nor-core.o, not spi-nor-tiny.o. So make spi_nor_remove() only valid for CONFIG_SPI_FLASH_SOFT_RESET. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]>
2026-07-21mtd: spi: select SPL_SPI_FLASH_TINY in SPL stageRaymond Mao
Fix to select CONFIG_SPL_SPI_FLASH_TINY in SPL_BUILD stage. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Acked-by: Tanmay Kathpalia <[email protected]>
2026-07-21doc: spacemit: add K1 SPL build and test guideGuodong Xu
The K1 SPL patchset requires DDR firmware integration and FSBL signing steps that are not covered by existing documentation. Add a SoC-level guide so reviewers and developers can build and test on hardware. Signed-off-by: Guodong Xu <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21board: k1: enable pmic in splRaymond Mao
Add Spacemit P1 SoC support in SPL. And set the default voltage for BUCKs and LDOs. Also update MAINTAINERS: add Guodong Xu as co-maintainer, list the u-boot-spacemit mailing list, register the new K1 driver files (i2c, PMIC, regulator), and fix a pre-existing '@@' typo in Huan Zhou's email. Fixes: 1cd239f44438 ("riscv: spacemit: bananapi_f3: initial support added") Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21power: regulator: add support for Spacemit P1 SoCRaymond Mao
Support voltage regulator for Spacemit P1 SoC. It contains 6 BUCKs and 11 LDOs. Signed-off-by: Raymond Mao <[email protected]> Acked-by: Peng Fan <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21power: pmic: add support for Spacemit P1 PMICRaymond Mao
Spacemit's PMIC is used by Spacemit K1 SoC. It contains voltage regulators, GPIOs and Watchdog. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Acked-by: Peng Fan <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21spacemit: k1: Add DDR firmware support to SPLRaymond Mao
Include DDR initialization firmware in the SPL image. The firmware path can be specified via the DDR_FW_FILE environment variable. If the firmware is not found, an empty placeholder file is created to allow the build to proceed without DDR initialization support. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21spacemit: k1: add TLV EEPROM support in SPLRaymond Mao
And support for required components including clock, I2C controller, and I2C EEPROM. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21i2c: k1: add I2C driver supportRaymond Mao
Add I2C driver support on Spacemit K1 SoC using driver model. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Reviewed-by: Heiko Schocher <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21board: k1: initialize clock and serial devices in SPLRaymond Mao
Initialize clock and serial devices in SPL. Otherwise, the device driver won't be loaded in SPL. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21dts: k1: enable clocks in SPLRaymond Mao
Make the K1 clock controllers visible to SPL by tagging the four root fixed clocks (osc_32k, vctcxo_{1,3,24}m) and the four syscon nodes (mpmu, pll, apmu, apbc) with bootph-pre-ram in the BPI-F3 U-Boot overlay. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21configs: k1: add default option for clock driver in SPLRaymond Mao
Add default option for enabling clock driver in SPL. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21clk: spacemit: k1: prune SPL clock treeGuodong Xu
K1 SPL runs from on-chip SRAM with a small pre-relocation malloc heap. Registering the full K1 clock tree would not fit, so split the tree on CONFIG_SPL_BUILD: the SPL build registers only the subset SPL needs (currently UART, SDHCI, I2C (TWSI), and their PLL/MPMU/APMU/APBC ancestors); the non-SPL build keeps the full tree. Where surviving SPL CCU definitions reference parent clocks outside that subset, use "clock-dummy", so framework parent lookups still resolve. Signed-off-by: Guodong Xu <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21configs: k1: enable early timer supportRaymond Mao
Enable CONFIG_TIMER_EARLY to allow udelay() calls during early initialization phases. This is required for proper timing operations before the full timer driver is available. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21spacemit: k1: enable SPL with debug UARTRaymond Mao
Add SPL support featuring debug UART output for early boot diagnostics on K1 SoC. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Tested-by: Songsong Zhang <[email protected]>
2026-07-21spacemit: k1: support multi-board infrastructureRaymond Mao
Restructure K1 SoC support to handle multiple boards through a single configuration: 1. Rename bananapi-f3_defconfig to spacemit_k1_defconfig. 2. Move all K1 board files to board/spacemit/k1/. 3. Replace TARGET_BANANAPI_F3 with TARGET_SPACEMIT_K1 and rename the board's <board>.h header to k1.h. Eliminates the need for board-specific defconfigs while maintaining hardware compatibility. Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]> Link: https://patch.msgid.link/[email protected] Tested-by: Songsong Zhang <[email protected]>
2026-07-21dt-bindings: reset: drop spacemit-k1-reset.hGuodong Xu
After the K1 build switched to dts/upstream/, all reset IDs come from the kernel's per-syscon namespace in <dt-bindings/clock/spacemit,k1-syscon.h>. Remove the legacy U-Boot-only reset binding header. Signed-off-by: Guodong Xu <[email protected]>
2026-07-21reset: spacemit: k1: drop legacy spacemit,k1-reset driverGuodong Xu
After the K1 build switched to dts/upstream/src/riscv/spacemit/ and the local arch/riscv/dts/k1.dtsi was deleted, the legacy reset-controller@d4050000 DT node no longer exists. The of_match driver in drivers/reset/reset-spacemit-k1.c (compatible "spacemit,k1-reset") matches nothing and only sits in the binary as dead code. Remove the legacy driver file, its Makefile entry, the RESET_SPACEMIT_K1 Kconfig symbol, and its bananapi-f3_defconfig selection. The new syscon-bound reset driver under drivers/reset/spacemit/ has no DT of_match of its own and is spawned by the K1 clock drivers, so gate the subdirectory on CONFIG_CLK_SPACEMIT_K1 instead. Signed-off-by: Guodong Xu <[email protected]>
2026-07-21dts: k1: drop legacy local DT filesGuodong Xu
The K1 build now consumes the kernel device tree via OF_UPSTREAM. The local copies under arch/riscv/dts/ (k1.dtsi, k1-pinctrl.dtsi, k1-bananapi-f3.dts) are unreachable; remove them. Signed-off-by: Guodong Xu <[email protected]>
2026-07-21dts: k1: switch BPI-F3 build to upstream DTGuodong Xu
Adopt the kernel device tree directly from dts/upstream/src/riscv/spacemit/k1-bananapi-f3.dts instead of carrying a forked copy under arch/riscv/dts/. The U-Boot-only overlay k1-bananapi-f3-u-boot.dtsi carries the binman description and a memory@0 node, since the upstream kernel DT has no memory node (RAM is filled in by the bootloader). Signed-off-by: Guodong Xu <[email protected]>
2026-07-21configs: bananapi-f3: enable Spacemit K1 clock driverGuodong Xu
Enable CLK_SPACEMIT and CLK_SPACEMIT_K1 to compile in the K1 per-syscon clock drivers. Signed-off-by: Guodong Xu <[email protected]>
2026-07-21clk: spacemit: k1: spawn reset device from per-syscon clock driversGuodong Xu
The K1 reset driver in drivers/reset/spacemit/ binds by name (no DT of_match), so the per-syscon clock drivers must spawn it. Add a .bind hook to k1_mpmu_clk, k1_apbc_clk and k1_apmu_clk that calls spacemit_k1_reset_bind() to instantiate a UCLASS_RESET sibling on the same ofnode. Also introduce k1_apbc2_clk here. Its kernel DT node has #reset-cells but no #clock-cells, so the driver exists only as the binding hook for the apbc2 reset spawn. With this in place, references such as resets = <&syscon_apbc RESET_TWSI0>; in the kernel-mainline DT resolve correctly. Signed-off-by: Guodong Xu <[email protected]>
2026-07-21reset: spacemit: k1: introduce syscon-bound reset driverGuodong Xu
The existing K1 reset driver (drivers/reset/reset-spacemit-k1.c) binds via DT of_match against a top-level reset-controller node, but kernel mainline DT for K1 has no such node: the mpmu, apbc, apmu and apbc2 syscons each spawn their own reset device as an auxiliary of the clock controller. The legacy driver therefore cannot consume it. Add a new reset driver at drivers/reset/spacemit/reset-spacemit-k1.c bound by name from each per-syscon clock driver via device_bind_driver_to_node(), without DT of_match, mirroring the kernel's auxiliary-device pattern. To keep the series bisectable, this driver coexists link-cleanly with the legacy spacemit,k1-reset driver during the transition. A follow-up patch that switches the K1 build to dts/upstream/src/riscv/spacemit/ will drop the legacy driver. Signed-off-by: Guodong Xu <[email protected]>
2026-07-21clk: spacemit: Add support for K1 SoCJunhui Liu
The K1 SoC exposes four clock providers in the kernel mainline DT: one PLL controller ("spacemit,k1-pll") and three syscon clock nodes ("spacemit,k1-syscon-{mpmu,apbc,apmu}"). Register a separate U_BOOT_DRIVER for each. The controllers register clocks into a single CCF namespace, and a clock in one controller may parent off a clock owned by another, so a controller must register only after the controllers that own its parents have probed. Each probe forces its parent controllers up by driver: MPMU <- PLL APMU <- PLL, MPMU APBC <- PLL, MPMU, APMU Signed-off-by: Junhui Liu <[email protected]> Signed-off-by: Raymond Mao <[email protected]> Signed-off-by: Guodong Xu <[email protected]>
2026-07-21ufs: invalidate the whole descriptor data segment after a query readJorge Ramirez-Ortiz
ufshcd_get_req_rsp() invalidates only sizeof(struct utp_upiu_rsp) of the DMA'd response, but a READ DESCRIPTOR response's data segment follows the UPIU header at GENERAL_UPIU_REQUEST_SIZE and can extend past that window. The tail of a longer descriptor was therefore read from stale cache (the pre-transfer memset had zeroed it), so its last bytes came back as 0. This corrupted the last UTF-16 code unit of longer string descriptors: e.g. a 34-byte product-name descriptor "THGJFGT0T25BAZZA" was read as "THGJFGT0T25BAZZ\0", dropping the final 'A'. Shorter descriptors that fit within the invalidated cache line (serial numbers, etc.) were unaffected. Invalidate the descriptor region before copying it out. Tested on the Qualcomm IQ-9075-EVK. Fixes: 7feafb0ae4f7 ("ufs: Add Initial Support for UFS subsystem") Signed-off-by: Jorge Ramirez-Ortiz <[email protected]> Reviewed-by: Neha Malcom Francis <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Neil Armstrong <[email protected]>
2026-07-21usb: xhci-dwc3: Call xhci_deregister() before asserting resetBoon Khai Ng
Reorder the remove path to deregister the controller first (and return early on failure), then shut down PHY/clocks and finally assert reset. This prevents register reads/writes after reset and avoids undefined behavior. Signed-off-by: Boon Khai Ng <[email protected]> Reviewed-by: Marek Vasut <[email protected]>
2026-07-20spi: dw: Allow bits_per_word to be configured by device driversBoon Khai Ng
The DesignWare SPI controller supports configurable bits_per_word (typically 4-32 bits), but this was previously hardcoded to 8 bits in the driver initialization. This patch enables bits_per_word to be set dynamically by upper-level device drivers, matching the approach used in Linux. The controller reads the bits_per_word value from the spi_slave structure during each transfer, allowing different SPI devices on the same bus to use different word sizes. Implementation details: - Read slave->bits_per_word in dw_spi_xfer() before each transfer - Validate requested value against controller capabilities (4 to max_xfer) - Default to 8 bits if not set (maintains backward compatibility) This follows the Linux model where spi_device drivers set bits_per_word, and the controller driver reads it in the transfer function. Device drivers can now set slave->bits_per_word before calling spi_xfer(). Example usage in device driver: slave->bits_per_word = 16; spi_xfer(slave, ...); Backward compatible: Existing drivers that don't set bits_per_word will continue to work with the default 8-bit transfers. Signed-off-by: Boon Khai Ng <[email protected]>
2026-07-20global: Switch from source.denx.de to git.u-boot-project.orgTom Rini
As part of moving our git forge to a new location, update all references in tree to point to git.u-boot-project.org now. Signed-off-by: Tom Rini <[email protected]>
2026-07-20Merge patch series "treewide: migrate to the new mailing-list domain"Tom Rini
Neil Armstrong <[email protected]> says: We are migrating to the new U-Boot mailing-list server hosted by OSU-OSL on the new lists.u-boot-project.org domain. This changes all references of lists.denx.de in code, comments, documentation and MAINTAINERS/README files. Please review closely to ensure the transition goes smoothly. The exact migration date is expected to be on July 20 2026, see [1]. [1] https://lore.kernel.org/all/20260715173119.GL749385@bill-the-cat/ Link: https://lore.kernel.org/r/[email protected]
2026-07-20MAINTAINERS/README: Migrate mailing-list to lists.u-boot-project.orgNeil Armstrong
The U-Boot Mailing-list is moving to the lists.u-boot-project.org domain, so update all references of list.denx.de to the new domain in the main README and MAINTAINERS files. Signed-off-by: Neil Armstrong <[email protected]> Reviewed-by: Peter Robinson <[email protected]>
2026-07-20doc: Migrate mailing-list to lists.u-boot-project.orgNeil Armstrong
The U-Boot Mailing-list is moving to the lists.u-boot-project.org domain, so update all references of list.denx.de to the new domain in the documentation. Reviewed-by: Simon Glass <[email protected]> Signed-off-by: Neil Armstrong <[email protected]> Reviewed-by: Peter Robinson <[email protected]>
2026-07-20tools/patman: Migrate mailing-list to lists.u-boot-project.orgNeil Armstrong
The U-Boot Mailing-list is moving to the lists.u-boot-project.org domain, so update all references of the list.denx.de to the new domain in the patman code. Reviewed-by: Simon Glass <[email protected]> Signed-off-by: Neil Armstrong <[email protected]> Reviewed-by: Peter Robinson <[email protected]>
2026-07-20board: rockchip: add Anbernic RG-DSChris Morgan
Add support for the Anbernic RG-DS dual-screen handheld gaming device. Link: https://anbernic.com/products/rgds Signed-off-by: Chris Morgan <[email protected]> Reviewed-by: Quentin Schulz <[email protected]> Reviewed-by: Kever Yang <[email protected]> Link: https://patch.msgid.link/[email protected] [conflict resolution in doc/board/rockchip/rockchip.rst due to commit b5deaa71fbe5 ("board: rockchip: Add support for 9Tripod X3568 v4")] Signed-off-by: Quentin Schulz <[email protected]>
2026-07-20rockchip: rk3568-nanopi-r5: Drop duplicated/extra sdhciPeter Robinson
The pinctrl settings are now upstream, with the upstream voltage supplies, and the HS200 mode is confirmed to work fine but the HS400 mode had reported issues so let's just consume what the upstream DT has now as it's all known good. Reported-by: Dusty Mabe <[email protected]> Tested-by: Dusty Mabe <[email protected]> Signed-off-by: Peter Robinson <[email protected]> Reviewed-by: Quentin Schulz <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Quentin Schulz <[email protected]>
2026-07-17clk: airoha: fix off-by-one in clock ID boundary checkWayen Yan
The boundary checks in airoha_clk_enable(), airoha_clk_get_rate(), and airoha_clk_set_rate() use "id > data->num_clocks" which allows id equal to num_clocks to pass. Since data->descs[] has exactly num_clocks entries (indices 0 to num_clocks-1), id=num_clocks results in an out-of-bounds array access. This is currently not triggered because the device tree clock IDs are within bounds, but the check should be defensive. Fix by changing the comparison from ">" to ">=". Fixes: d0b81afb5ec9 ("clk: airoha: Add support for Airoha AN7581 SoC clock") Signed-off-by: Wayen Yan <[email protected]>
2026-07-17bloblist: Rename GD_FLG_BLOBLIST_READY to GD_FLG_BLOBLIST_HANDOFFTom Rini
Now that we have made bloblist have distinct "find" and "create" functions, the global data tag "GD_FLG_BLOBLIST_READY" doesn't quite make sense anymore. Rename it to GD_FLG_BLOBLIST_HANDOFF. Suggested-by: Raymond Mao <[email protected]> Reviewed-by: Raymond Mao <[email protected]> Signed-off-by: Tom Rini <[email protected]>
2026-07-17Revert "Merge patch series "Add DM firmware reserved memory support""Tom Rini
I had missed that this series was no longer ready to merge as there are other issues to resolve. This reverts commit a5ef1849394de475ee3bb9ebfc7629b4dd3b746a, reversing changes made to 4e7a9bb0885e75853687956002e69875e0ef64e6. Signed-off-by: Tom Rini <[email protected]>
2026-07-16Merge patch series "cyclic: update and optimization"Tom Rini
Patrice Chotard <[email protected]> says: First patch is replacing uint64_t by u64 as suggested by b4 Second patch optimizes cyclic_run() to parse cyclic list only if a cyclic function's timestamp is elapsed. Link: https://lore.kernel.org/r/[email protected]
2026-07-16cyclic: reduce get_timer_us() calls inside hlist_for_each_entry_safe()Patrice Chotard
On STM32MP157C-DK2, when using the "ums" command, in sleep_thread(), ctrlc() is called every ~640ms which doesn't allows high reactivity when user press CTRL+C in U-Boot console. In sleep_thread() loop, ctrlc() is called every 200000 iterations. But schedule is called on each loop iteration. Optimize cyclic_run() in order to not call get_timer_us() on each entry. This allow to save computation time : _ before : ctrlc() is called every ~640ms _ after : ctrlc() is called every ~230ms Signed-off-by: Rasmus Villemoes <[email protected]> Signed-off-by: Patrice Chotard <[email protected]> Cc: Marek Vasut <[email protected]>
2026-07-16cyclic: replace uint64_t by u64 suggested by b4Patrice Chotard
For new patch, b4 is suggested to replace type 'uint64_t' by 'u64' : CHECK: Prefer kernel type 'u64' over 'uint64_t' Update cyclic.c accordingly in order to be coherent with following commit. Signed-off-by: Patrice Chotard <[email protected]> Reviewed-by: Marek Vasut <[email protected]>
2026-07-16Merge patch series "vbe: bound FIT external-data reads against the firmware ↵Tom Rini
area" Aristo Chen <[email protected]> says: vbe_read_fit() loads a firmware-phase FIT from a fixed firmware area on a block device and then issues a follow-up blk_read() to pull in the image, and optionally an FDT, referenced by the FIT's image node. The source offset on the device and the read length both come from the FIT itself, via data-position or data-offset and data-size. Those properties live on mutable boot media and can be controlled by an attacker with write access to the firmware area. On the TPL or VPL path, and on the bootmeth bootflow path reached via abrec_read_bootflow_fw() and vbe_simple_read_bootflow_fw(), the follow-up blk_read() runs before any signature or hash check on the loaded phase. Patch 1 is a sandbox test-tree preparation. The firmware1 node in arch/sandbox/dts/test.dts declared area-size = 0xe00000 (14 MiB), but the binman fw-update section in sandbox_vpl.dtsi is 32 MiB and the FIT inside it carries ~16 MiB of external data, so the FIT already extended past the declared area. The mismatch was tolerated because no caller bounded the external-data load against area_size. Patch 1 raises area-size to match the binman section size so test_vbe_vpl keeps passing once the bound is enforced. The patches are ordered so the test is never broken in the middle of the series. Patch 2 adds the missing range check, confining the FIT-supplied [load_addr, load_addr + len) window to [addr, addr + area_size] before block numbers and lengths are computed, and applying the same constraint to fdt_load_addr and fdt_size. The check is written in subtraction-only form against the trusted area_size so the comparison cannot itself overflow. Patch 3 adds two sandbox unit tests under test/boot/ that construct synthetic FITs with out-of-range data-position and oversized data-size, write them to mmc1, and confirm vbe_read_fit() returns -E2BIG for each before issuing the follow-up blk_read(). Deferring the external-data blk_read() until after the phase has been signature-verified would be a stronger structural fix and was discussed on the v1 thread. Simon confirmed the bounded read is the right first step and that the verify-then-load change should be a separate series, so this v3 stays scoped to the bound. Link: https://lore.kernel.org/r/[email protected]
2026-07-16test: vbe: cover vbe_read_fit() external-data bounds checksAristo Chen
vbe_read_fit() rejects FITs whose external-data window extends past the trusted firmware area on disk by returning -E2BIG. Add two sandbox unit tests that construct synthetic FITs with attacker-controlled data-position and data-size values, write them to mmc1, and assert vbe_read_fit() catches each one before issuing the follow-up blk_read(). vbe_read_fit_oob_position uses a data-position past area_size, which trips the load_addr - addr > area_size clause. vbe_read_fit_oversize_data keeps data-position inside the area but picks a data-size that overruns area_size - (load_addr - addr), tripping the third clause. The two remaining bound clauses stay unreachable from a sandbox test. The load_addr < addr guard trivially holds when addr comes from CONFIG_VAL(TEXT_BASE), which is 0 on sandbox, and the FDT-region bound sits behind a !CONFIG_SANDBOX guard in vbe_read_fit(), so fdt_size stays 0 and that block is skipped in this test environment. The new file follows the existing bootstd VBE test layout and writes the FIT at block 16, past the version and nvdata blocks already used by bootstd_setup_for_tests(). Suggested-by: Simon Glass <[email protected]> Reviewed-by: Simon Glass <[email protected]> Signed-off-by: Aristo Chen <[email protected]>
2026-07-16vbe: bound FIT external-data offset and size before blk_readAristo Chen
vbe_read_fit() loads a firmware-phase FIT from the trusted firmware area and then issues a blk_read() to pull in the image, and optionally an FDT, referenced by the FIT image node. The source offset on the device and the read length both come from the FIT's data-position or data-offset property and its data-size property, which live on mutable boot media and can be controlled by an attacker with prior write access to the firmware area. Without a range check the resulting blk_read() can read past the firmware area on the device and, on the non-SPL path, write an attacker-chosen number of blocks past the malloc(aligned_size) FIT buffer into adjacent memory. Only the SPL branch routes through spl_load_simple_fit(), which hashes the data. The external-data block reached from TPL or VPL, and from the bootflow path via abrec_read_bootflow_fw() and vbe_simple_read_bootflow_fw(), runs before any signature or hash check on the loaded phase. Confine the FIT-supplied [load_addr, load_addr + len) window to [addr, addr + area_size] before computing block numbers and lengths, and apply the same constraint to fdt_load_addr and fdt_size. The checks are written in subtraction-only form against the trusted area_size so the comparison itself cannot overflow. Reviewed-by: Simon Glass <[email protected]> Signed-off-by: Aristo Chen <[email protected]>
2026-07-16sandbox: vbe: size firmware1 area to fit the binman fw-update sectionAristo Chen
The firmware1 node in test.dts declares area-size = 0xe00000 (14 MiB) but the binman fw-update section in sandbox_vpl.dtsi is 0x2000000 (32 MiB) and the FIT inside it carries ~16 MiB of external data (spl + u-boot subimages). The FIT therefore extends past the declared firmware area, contradicting the documented contract of vbe_read_fit() that the FIT must fit within @area_size. The mismatch was tolerated because no caller actually bounded the external-data load against area_size. Bring the devicetree in line with the binman section size so the FIT extent stays within the trusted firmware area, in preparation for vbe_read_fit() enforcing that bound. state-offset and version-offset are left as-is; they were already inside the FIT data region and are not exercised by test_vbe_vpl. Reviewed-by: Simon Glass <[email protected]> Signed-off-by: Aristo Chen <[email protected]>
2026-07-16Merge patch series "Add DM firmware reserved memory support"Tom Rini
Paresh Bhagat <[email protected]> says: This series adds support for DM firmware reserved memory fixup in device tree for K3 SoCs that use separate DM firmware (K3_DM_FW enabled). The series includes: 1. Fix for phandle corruption in FDT reserved memory fixup 2. Enable OF_SYSTEM_SETUP for AM62D2 to allow device tree fixups 3. Add Kconfig options for DM firmware reserved memory for other K3 SoCs 4. Add DM reserved memory fixup implementation The main issue being addressed is that the current reserved DDR carveout for DM firmware in device tree is insufficient to accommodate the DM firmware binary on AM62A7, and potentially other K3 SoCs in the future. Currently, the size is only modified for AM62A7 SoC. For rest of SocS existing values from device tree is taken. For vendor boards, please verify boot and check for errors if any. This series depends on dts update for effected devices. If "dm" node is not found then the existing mechanism creates a new node with same address, which cause memory overlap issue. Link: https://lore.kernel.org/r/[email protected]
2026-07-16arm: mach-k3: Add DM reserved memory fixupParesh Bhagat
Add support for fixing up DM firmware reserved memory in the kernel device tree for K3 SoCs that use separate DM firmware. The fixup uses the CONFIG_K3_DM_FW_RESERVED_ADDR and CONFIG_K3_DM_FW_RESERVED_SIZE Kconfig options to update the reserved-memory node with the correct DM firmware carveout. Note that the fixup needs DM reserved memory node is to be renamed in dts. Example memory@9c900000 → dm@9c900000 Signed-off-by: Paresh Bhagat <[email protected]> Reviewed-by: Neha Malcom Francis <[email protected]>
2026-07-16arm: mack-k3: Kconfig: Add DM firmware reserved memory configsParesh Bhagat
Add Kconfig options for DM firmware reserved memory for K3 SOCs that support DM firmware (K3_DM_FW enabled) - K3_DM_FW_RESERVED_ADDR: DM firmware address - K3_DM_FW_RESERVED_SIZE: DM firmware reserved size These configs will be used to fixup the kernel device tree's reserved memory node for DM. Currently the fixup is only done for AM62A7 SoC, as K3_DM_FW_RESERVED_SIZE is being used to update DM reserved memory from 0xf0000 to 0x1f0000 as the current reserved carveout is insufficient to accommodate the binary. For other platforms, the addresses and sizes are based on the existing device tree reserved memory. If needed for other SoCs, address and size could be modified in Kconfig. Signed-off-by: Paresh Bhagat <[email protected]>