summaryrefslogtreecommitdiff
path: root/arch
AgeCommit message (Collapse)Author
22 hoursMerge tag 'u-boot-rockchip-2027.01-20260828' of ↵nextTom Rini
https://git.u-boot-project.org/u-boot/custodians/u-boot-rockchip into next - Fixed possible SPI hangs when only PICO is routed (TX-only), - Added support for ROC-RK3399-PC-PLUS (via roc-pc-rk3399_defconfig)
48 hoursMerge patch series "Refactor binman nodes for boot binaries for TI AM625 ↵Tom Rini
into templates" Anshul Dalal <[email protected]> says: This patch series seeks to help in reuse by moving currently duplicated entries for tiboot3.bin and tispl.bin into a generic SoC wide DTSI (k3-am625-binman.dtsi). This dtsi in-turn gets included by all AM625 based boards which can insert the templates from k3-am625-binman.dtsi. The newly added templates are as follows: tiboot3_am625_hs tiboot3_am625_hs_fs tiboot3_am625_gp ti_falcon_am625 ti_spl_unsigned_am625 ti_spl_am625 The series has been boot tested on beagleplay and AM62x EVM but the following affected boards have only been build tested: - phycore_am62x - verdin-am62 To verify no regressions, I compared the final 'u-boot.dtb.out' for both the R5 and A53 build using dtx_diff script from linux source. Link: https://lore.kernel.org/r/[email protected]
48 hoursarm: dts: k3-am625: add template for tispl.binAnshul Dalal
This patch addresses the duplication of the binman nodes responsible for generating tispl.bin and tispl.bin_unsigned for TI's AM625 SoC based boards. The common nodes are factored out into a template in the SoC level k3-am625-binman.dtsi that each board in-turn includes. No functional change is intended from the patch asides from the addition of tifsstub-hs and tifsstub-fs nodes in beagleplay's tispl.bin which should have no consequence asides from growing the binary size by few kilo bytes. Signed-off-by: Anshul Dalal <[email protected]> Tested-by: Wadim Egorov <[email protected]>
48 hoursarm: dts: k3-am625: add template for tiboot3.binAnshul Dalal
Currently we are duplicating binman nodes responsible for building tiboot3.bin binaries across boards that use TI's AM625 SoC. This patch adds a SoC level k3-am625-binman.dtsi with templates for the commonly used tiboot3 variants (i.e. hs, hs-fs and gp) which can be inserted by the corresponding board's dtsi to promote reuse. Note that for some boards the hardcoded load address for SPL firmware has been changed to use CONFIG_SPL_TEXT_BASE but it should cause no functional change. Reviewed-by: Simon Glass <[email protected]> Signed-off-by: Anshul Dalal <[email protected]> Tested-by: Wadim Egorov <[email protected]>
5 daysMerge tag 'mediatek-for-next-2026-08-24' of ↵Tom Rini
https://git.u-boot-project.org/u-boot/custodians/u-boot-mediatek into next * New HDMI PHY and I2C DDC drivers, default EDID_ADDR macro * MT8189 clock qualifier fix * Phase-aware PSCI reset (MT8195/MT8365) * dwc_eth_qos MT8366 support * MediaTek TPHY v3 hardware support * mtk_snor mt8188/mt8189 compatible-string cleanup * MT6358/MT6366 PMIC regulator + pwrap support * MediaTek pinctrl Kconfig cleanup (per-SoC symbols → single driver + TARGET_*) * New MT8366 pinctrl driver + dt-bindings header * MediaTek serial driver clock-handling fixes
5 daysarm64: dts: renesas: Drop bootph-all from PRR node on R-Car Gen5 R8A78000 X5HMarek Vasut
The PRR node is going to be folded into MFIS node in Linux 7.2.y DTs. The PRR node is currently unused and does not require the bootph-all DT property. Drop the property from the PRR node, and drop the entire prr {} node phandle, thus unblocking Linux 7.2.y upstream DT update. Signed-off-by: Marek Vasut <[email protected]>
6 daysMerge tag 'v2026.10-rc3' into nextTom Rini
6 daysarm: dts: add mt6366 PMIC includeDavid Lechner
Add a mt6366.dtsi file for the MediaTek MT6366 PMIC. For now, this just includes the regulators since that is all that U-Boot uses. This should eventually be replaced by an upstream devicetree file. Link: https://patch.msgid.link/[email protected] Signed-off-by: David Lechner <[email protected]>
10 daysarm64: dts: renesas: r8a779g3: Drop set VDDQ18_25_AVB voltage on Retronix ↵Marek Vasut
R-Car V4H Sparrow Hawk EVTB1 This partly reverts commit 1df2880e9512f4760f615668e5d06aa5f44b778a. This change is part of Linux 6.18.y DTs as commit 7d1e3aa2826a ("arm64: dts: renesas: sparrow-hawk: Set VDDQ18_25_AVB voltage on EVTB1") Drop the duplicate change from U-Boot DT. Signed-off-by: Marek Vasut <[email protected]>
10 daysarm64: dts: renesas: r8a779g3: Drop invert microSD voltage selector on ↵Marek Vasut
Retronix R-Car V4H Sparrow Hawk EVTB1 This reverts commit 74bc80190c48dce43a59cbae1975ccf10f671bc2. This change is part of Linux 6.18.y DTs as commit ae95807b00e1 ("arm64: dts: renesas: sparrow-hawk: Invert microSD voltage selector on EVTB1") Drop the duplicate change from U-Boot DT. Signed-off-by: Marek Vasut <[email protected]>
10 daysarm64: dts: renesas: r8a779g3: Drop generic SPI NOR support on Retronix ↵Marek Vasut
R-Car V4H Sparrow Hawk board This reverts commit 797255d897d635799fbb878262b7491e07ceac9e. This change is part of Linux 6.18.y DTs as commit 95319aaa3ffc ("arm64: dts: renesas: sparrow-hawk: Describe generic SPI NOR support") Drop the duplicate change from U-Boot DT. Signed-off-by: Marek Vasut <[email protected]>
11 daysarm: socfpga: cyclone5: select WDT with DESIGNWARE_WATCHDOGTien Fong Chee
ARCH_SOCFPGA_CYCLONE5 selects DESIGNWARE_WATCHDOG, which depends on WDT. Arria 10 already selects both. Cyclone V did not, so boards such as socfpga_de10_nano warn: unmet direct dependencies detected for DESIGNWARE_WATCHDOG Select WDT with the same board filter as DESIGNWARE_WATCHDOG. Fixes: b4fd1e122682 ("arm: socfpga: Gen5/A10: Enable Designware watchdog") Signed-off-by: Tien Fong Chee <[email protected]>
11 daysarm: socfpga: Improve handoff prepare on SoCFPGABrian Sune
Ensure qts folder header files are properly updated by isolating the Python execution environment. This prevents partial or failed script runs from corrupting the target directory. Signed-off-by: Brian Sune <[email protected]> Reviewed-by: Simon Glass <[email protected]> Reviewed-by: Tien Fong Chee <[email protected]>
11 daysarm: socfpga: n5x: Enable system manager driver for N5XAlif Zakuan Yuslaimi
The base address of system manager can be retrieved using the DT framework through the system manager driver. Enable system manager support for N5X by probing the system manager driver during SPL and U-Boot proper board_early_init_f, matching the Agilex and Stratix10 DM path. Drop the of_flat_tree altr,sys-mgr lookup for N5X so the base comes only from DM. Signed-off-by: Alif Zakuan Yuslaimi <[email protected]> Signed-off-by: Tien Fong Chee <[email protected]>
11 daysconfigs: socfpga: arria10: Disable CONFIG_SPL_USE_TINY_PRINTFDinesh Maniyam
From: Dinesh Maniyam <[email protected]> CONFIG_SPL_USE_TINY_PRINTF is enabled by default, disable it. Arria 10 has 256KB of onchip ram and it is enough to support full printf. Full printf allows us to have more complex format printing, example %ll. Signed-off-by: Dinesh Maniyam <[email protected]>
11 daysarm: socfpga: Remove confusing timer related words from watchdog resetDinesh Maniyam
From: Dinesh Maniyam <[email protected]> It's confusing to have timer related words along with watchdog reset dessert function, because the function is only release watchdog from reset, so it has not related to any timer setting. Signed-off-by: Tien Fong Chee <[email protected]> Signed-off-by: Dinesh Maniyam <[email protected]>
11 daysarm: dts: soc64: Remove kernel node from binman for non-VAB flowAlif Zakuan Yuslaimi
Binman will attempt to package kernel.itb during U-Boot build, expecting Image and linux.dtb files that are not available in standard U-Boot-only builds. This would cause build warnings with missing blob errors. Add conditional deletion of the kernel node from binman when FIT is enabled and CONFIG_SOCFPGA_SECURE_VAB_AUTH is not defined. Clean up binman node setting in Agilex device tree as this will apply to all SoC64 devices via the common the dts. Signed-off-by: Alif Zakuan Yuslaimi <[email protected]>
11 daysarm: dts: socfpga: Enable 8-bit embedded device support in Agilex5 eMMC ↵tzeyeeng
device tree Set SDHCI Capabilities bit18 to enable 8-bit embedded device support. Signed-off-by: tzeyeeng <[email protected]>
11 daysarch: arm: dts: agilex: Disable gmac2 node for Agilex7MAlif Zakuan Yuslaimi
Disable gmac2 node with the incorrect settings to only enable gmac0 as default for the standard reference Agilex7M devkit. The gmac2 node can be enabled and configured with the correct board-specific settings for other Agilex7M board variants in the Linux device tree. Signed-off-by: Alif Zakuan Yuslaimi <[email protected]>
11 daysarm: dts: socfpga: agilex: Add eMMC device tree source fileAlif Zakuan Yuslaimi
The Agilex devkit supports a separate NAND/eMMC daughter card. The NAND/eMMC daughter card replaces the SDMMC slot that is on the default daughter card and thus requires a separate board dts file. New eMMC dts which is based on the existing NAND dts is needed to comply with spec in which eMMC board ID is designated as 2. Signed-off-by: Alif Zakuan Yuslaimi <[email protected]>
11 daysarm: socfpga: soc64: separate reset manager into common and platform-family ↵Chen Huei Lok
parts The SoCFPGA SoC64 reset manager code is currently built as reset_manager_s10.o even though it is shared across multiple SoC64 families. Split the implementation into: - reset_manager_soc64.o for common SoC64 logic - reset_manager_soc64_families.o for platform-family-specific code This improves code organization and prepares the reset manager for additional SoC64 platform families. No functional change intended. Signed-off-by: Chen Huei Lok <[email protected]>
11 daysarm: socfpga: Setting the image magic value to romcode initswstate registerDinesh Maniyam
The romcode_initswstate register need to be set with FSBL_IMAGE_IS_VALID value if the current FSBL image is found valid, otherwise BootROM will look for next subsequent valid FSBL image when warm reset is triggered. Signed-off-by: Tien Fong Chee <[email protected]> Signed-off-by: Dinesh Maniyam <[email protected]>
11 daysarm: dts: socfpga: n5x: Drop kernel node from binmanDinesh Maniyam
Recent binman changes expect a kernel image to be present when processing the binman description. N5X builds U-Boot without a kernel image, so drop the kernel node from n5x.dtsi to avoid the build dependency. Signed-off-by: Dinesh Maniyam <[email protected]>
11 daysarm: arria10: Add correct mask bits for RTRIM and PU_DRV_STRGDinesh Maniyam
The current mask bits of RTRIM and PU_DRV_STRG are mismatched with the configuration register of arria10. The correct register for RTRIM and PU_DRV_STRG should be 0x7 and 0x1f respectively. Signed-off-by: Dinesh Maniyam <[email protected]>
11 daysarm: dts: agilex5: Set DTB filename and kernel node removal for non-secure bootAlif Zakuan Yuslaimi
Set the DTB filename in fdt_0_blob node and remove kernel node from binman node for non-secure boot scenarios. Signed-off-by: Alif Zakuan Yuslaimi <[email protected]> Signed-off-by: Boon Khai Ng <[email protected]>
11 daysarm: socfpga: Add NAND register address and data registerDinesh Maniyam
These are required by denali_spl.c for Arria10. Pre-set nand base and data address will be used for spl nand read and write. Signed-off-by: Tien Fong Chee <[email protected]> Signed-off-by: Dinesh Maniyam <[email protected]>
11 daysarm: socfpga: Gen5/A10: Enable Designware watchdogTien Fong Chee
Some bootROMs enable the watchdog before jumping to SPL, so calling WATCHDOG_RESET() is required to reset watchdog timely especially in long looping. Enable Designware watchdog driver is required to support WATCHDOG_RESET(). Gen5 uses non device model watchdog HW_WATCHDOG due to OCRAM size limitation. Signed-off-by: Tien Fong Chee <[email protected]> Signed-off-by: Boon Khai Ng <[email protected]>
11 daysarch: arm: socfpga: Fix data cache flush issueNaresh Kumar Ravulapalli
During flushing of data cache operation, the stop address was modified incorrectly. This led to Linux certificate authentication failure during VAB flow. So, addressing this cache issue with this patch. Signed-off-by: Naresh Kumar Ravulapalli <[email protected]> Signed-off-by: Boon Khai Ng <[email protected]>
11 daysarch: arm: mach-socfpga: Change U-Boot mailbox client IDDinesh Maniyam
Changed MBOX_CLIENT_ID_UBOOT to be the same with ATF's mailbox client ID so that SDM can treat them as same client for related request. Otherwise, under some specific cases, like QSPI_OPEN in SPL stage used different client ID with ATF's client ID for QSPI exclusive access, then following QSPI access like QSPI_CLOSE via SMC call to ATF will fail. Signed-off-by: Dinesh Maniyam <[email protected]>
11 daysarch: arm: dts: agilex5: Enable autostart on watchdog0 onlyAlif Zakuan Yuslaimi
Exclude watchdog1, watchdog2, watchdog3 and watchdog4 from automatically starting when probed with watchdog autostart enabled in the defconfig Signed-off-by: Alif Zakuan Yuslaimi <[email protected]> Signed-off-by: Boon Khai Ng <[email protected]>
11 daysarm: socfpga: n5x: update SPL data save and restore implementationChen Huei Lok
Enable backup for data section to support warm reset as no SPL image would be reloaded in warm reset. Signed-off-by: Chen Huei Lok <[email protected]>
11 daysarch: arm: dts: n5x: switch to using upstream Linux DT configChen Huei Lok
Migrate the legacy n5x platform to use the upstream Linux device tree configuration. This helps reduce maintenance overhead and aligns U-Boot with the Linux kernel's DTS hierarchy and naming conventions. This change improves consistency between U-Boot and Linux by removing custom/legacy DTS handling and instead relying on the standardized definitions provided by the upstream Linux DTS. Signed-off-by: Chen Huei Lok <[email protected]>
11 daysarm: socfpga: n5x: switch firewall setup to driver modelChen Huei Lok
Move the system manager and L3 interconnect firewall configuration from a dedicated firewall_setup() function to the driver model, using uclass_get_device_by_name(). This removes hardcoded firewall setup in SPL and relies on the driver model, making the code more maintainable and aligned with upstream practices. With spl_n5x.c migrated, no in-tree SoC64 SPL file calls firewall_setup() directly any longer. Remove the function and its private helpers from firewall.c, drop firewall.c from the Makefile, remove the now-unused declaration from firewall.h, and drop the stale firewall.h include from spl_n5x.c. Signed-off-by: Tien Fong Chee <[email protected]> Signed-off-by: Chen Huei Lok <[email protected]>
11 daysarm: dts: socfpga: n5x: update GMAC nodes and DT register settingsChen Huei Lok
Enable register settings in the N5X U-Boot device tree by adding firewall configuration nodes under the L3 interconnect firewall. These settings disable OCRAM security at the CCU and relax MPFE firewall restrictions required during early boot. Update the GMAC nodes to include proper compatible, reset-names, and clock-names properties, explicitly setting their status. Remove the clocks property from the QSPI node in socfpga_n5x_socdk-u-boot.dtsi. The QSPI controller clock is obtained via cm_get_qspi_controller_clk_hz(), so the device tree clock reference is unnecessary. Additionally, include socfpga_soc64_u-boot.dtsi and rename the soc node to soc@0 in socfpga_n5x-u-boot.dtsi to align with the common SoCFPGA DT layout. Signed-off-by: Tien Fong Chee <[email protected]> Signed-off-by: Alif Zakuan Yuslaimi <[email protected]> Signed-off-by: Chen Huei Lok <[email protected]>
11 daysddr: socfpga: Implement ECC DRAM scrubbing support for both Gen5/Arria10Alif Zakuan Yuslaimi
Enable ECC scrubbing support for Gen5 by moving sdram_init_ecc_bits() from sdram_arria10.c to a new common file, sdram_soc32.c which is shared by both Arria10 and Gen5 devices. This makes ECC scrubbing support no longer exclusive only to Arria10. Remove legacy HW watchdog check in favor of current WDT DM for Gen5/Arria10. New Kconfig is introduced to enable this implementation only on the default Arria10 and CycloneV boards as this will increase the SPL size which will exceed some Gen5 devices' SPL size limit. Signed-off-by: Tien Fong Chee <[email protected]> Signed-off-by: Alif Zakuan Yuslaimi <[email protected]>
11 daysddr: altera: gen5: Add DRAM size checkingAlif Zakuan Yuslaimi
Add DRAM size checking compare between size from device tree and actual hardware. Trigger hang if DRAM size from device tree is greater than actual hardware. Display warning message if DRAM size mismatch between device tree and actual hardware. get_ram_size() uses size from device tree. So, it has consistency with other device families. New Kconfig is introduced to enable this implementation only on the default CycloneV board as this will increase the SPL size which will exceed some Gen5 devices' SPL size limit. Signed-off-by: Alif Zakuan Yuslaimi <[email protected]>
11 daysarm: socfpga: Consolidate dram_bank_mmu_setup()Alif Zakuan Yuslaimi
Share dram_bank_mmu_setup() between Gen5 and Arria10 in misc.c. Before relocation, map OCRAM and DRAM write-through so SPL can run sdram_init_ecc_bits() with dcache; after relocation, use default DRAM cache attributes. See also commit e26ecebc684b ("socfpga: arria10: Allow dcache_enable before relocation") Fixes: 503eea451903 ("arm: cp15: update DACR value to activate access control") Signed-off-by: Alif Zakuan Yuslaimi <[email protected]>
11 daysspl: s10: Enhance watchdog support in SPL for Stratix 10Alif Zakuan Yuslaimi
Watchdog should be primed before longer, failure-prone steps such as firewall, SDRAM or QSPI initialization so that if a hang occurs in one of those steps, it is able to trigger a reset. Switch from the legacy hw_watchdog_init() path to the driver-model WDT (initr_watchdog()). This requires clocks and reset to be valid for the L4 watchdog block, and so it must run after the clock manager (uclass_get_device(UCLASS_CLK)) succeeds. Enabling watchdog immediately after clock init keeps watchdog coverage as early as possible. Signed-off-by: Alif Zakuan Yuslaimi <[email protected]>
11 daysclk: s10: Refactor S10 clock driverAlif Zakuan Yuslaimi
Refactor Stratix10 clock manager driver to support driver model, following Agilex clock driver. Create a new clock driver, clk-s10.c, for Stratix10 which supports the driver model. This allows several APIs such as enable/disable clock, and get clock rate to be supported. This driver will be initialized during SPL to bring up the clock as early as possible. The clock initialization process are refactored into this new driver from clock_manager_s10.c during clock driver probe. Excluding Stratix10 from legacy method of obtaining clkmgr base address in mach-socfpga/misc.c as the base address is already obtained during clock driver probe during SPL initialization. Signed-off-by: Alif Zakuan Yuslaimi <[email protected]>
11 daysarm: socfpga: s10: Enable system manager driver for Stratix10Alif Zakuan Yuslaimi
The base address of system manager can be retrieved using DT framework through the system manager driver. Enable system manager support for Stratix10 by probing the system manager driver to initialize during SPL boot up. Signed-off-by: Alif Zakuan Yuslaimi <[email protected]>
11 daysarm: socfpga: Update Stratix10 SPL data save and restore implementationAlif Zakuan Yuslaimi
Enable backup for data section to support warm reset in Stratix10 SPL as no SPL image would be reloaded in warm reset. Signed-off-by: Alif Zakuan Yuslaimi <[email protected]>
11 daysarm: socfpga: Move firmware register settings from source code to device treeAlif Zakuan Yuslaimi
Migrate the CCU, firewall, and high privilege register configurations from hardcoded values in the source code to the device tree. L4 per/sys firewall setup which was previously done by firewall_setup() in spl_s10.c is now replaced by DTreg node in socfpga_soc64_u-boot.dtsi as Stratix10 is sharing the same tables that Agilex uses. This helps to centralize hardware configuration, improves maintainability, and allows easier customization for different platforms. Signed-off-by: Alif Zakuan Yuslaimi <[email protected]>
11 daysarch: arm: dts: stratix10: Switch to using upstream Linux DT configAlif Zakuan Yuslaimi
Migrate the legacy Stratix10 platform to use the upstream Linux device tree configuration. This helps reduce maintenance overhead and aligns U-Boot with the Linux kernel's DTS hierarchy and naming conventions. This change improves consistency between U-Boot and Linux by removing custom/legacy DTS handling and instead relying on the standardized definitions provided by the upstream Linux DTS. Signed-off-by: Alif Zakuan Yuslaimi <[email protected]>
11 daystest: sandbox: enable GPIO_DELAYPranav Sanwal
Enable CONFIG_GPIO_DELAY on sandbox and sandbox64 so the gpio-delay driver gets sandbox coverage, and add a gpio-delay-test node wrapping two real GPIO lines (gpio_a 9 and 18), along with test6-gpios and test7-gpios consumer properties for use by an upcoming test. Verified the existing sandbox test suite (ut dm, pytest) still passes unchanged with the driver enabled and the new node present. Signed-off-by: Pranav Sanwal <[email protected]> Reviewed-by: Simon Glass <[email protected]>
11 daysrockchip: rk3399: Add ROC-PC-PLUS board detectionFabio Estevam
The ROC-RK3399-PC has an MP8859 regulator on I2C7 at address 0x66, while the ROC-RK3399-PC-PLUS does not. Probe for the regulator in SPL and use the result to select the matching devicetree from the U-Boot FIT. Fall back to the original board if the I2C bus cannot be probed. Build both devicetrees from the existing roc-pc-rk3399_defconfig and enable the XMC SPI NOR driver used by the Plus variant. Set fdtfile from the selected U-Boot devicetree so the matching Linux devicetree is used as well. Signed-off-by: Fabio Estevam <[email protected]> Reviewed-by: Quentin Schulz <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Quentin Schulz <[email protected]>
11 daysrockchip: rk3399: Remove ROC-PC regulator overridesFabio Estevam
The upstream devicetree already describes dc_12v as the output of the MP8859 regulator and drives the USB hub reset through the vcc5v0_host regulator pinctrl state. Remove the legacy fixed-regulator overrides and rely on the upstream regulator descriptions. Signed-off-by: Fabio Estevam <[email protected]> Reviewed-by: Quentin Schulz <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Quentin Schulz <[email protected]>
2026-08-15remoteproc: renesas: rsip: Extract SCP initialization from board fileMarek Vasut
Move the SCP initialization from board file into remoteproc driver where this is supposed to be. Add SCP MDLC DT node and describe the SCP reset controlled by the SCP MDLC in remoteproc DT node. Adjust the driver to control the SCP reset via reset framework instead of the current board-specific register poking. Signed-off-by: Marek Vasut <[email protected]>
2026-08-14Merge tag 'u-boot-imx-next-20260814' of ↵Tom Rini
https://git.u-boot-project.org/u-boot/custodians/u-boot-imx into next CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-imx/-/pipelines/990 - Several fixes for long-standing Vybrid issues. - Improvements for imx6dl-sielaff. - ADD SPL Quick Boot support for several Toradex boards.
2026-08-14ARM: imx: Support detection of ECSPI recovery mode on i.MX6Frieder Schrempf
The i.MX6 allows to boot from a SPI NOR as a fallback if the primary boot fails. Parse the ROM log in order to detect this and return the proper boot device in spl_boot_device(). Otherwise the primary boot device is returned even if it was not used. To make imx6_is_ecspi_recovery_boot() usable in U-Boot proper, add them in arch/arm/mach-imx/init.c. This was tested on i.MX6S and the implementation covers other i.MX6 variants based on the documentation from NXP (AN12853). Assisted-by: Claude:claude-opus-5 Signed-off-by: Frieder Schrempf <[email protected]>
2026-08-14arm: imx: hab: validate HAB M4 event length before memcpy()Ngo Luong Thanh Tra
get_hab_status_m4() copies each HAB_TAG_EVT record from the HAB M4 persistent memory region into a fixed 128-byte stack buffer using a length taken straight from the record header: record_len = get_record_len(rec); if (rec->tag == HAB_TAG_EVT) memcpy(&event_data, rec, record_len); get_record_len() builds a 16-bit big-endian value from rec->len[], so record_len can be up to 65535, while event_data is 128 bytes. A record advertising a length above 128 therefore overflows the stack buffer. The A7 path in get_hab_status() does not have this problem because it passes sizeof(event_data) to hab_rvt_report_event() as an in/out bound. A zero-length record is also mishandled: offset += record_len leaves offset unchanged and the parse loop never terminates. Reject records whose length is zero or which extend past the end of the persistent memory region, and reject events larger than the destination buffer, before the copy is made. An invalid record means the region is corrupt, so abort the listing rather than continue, matching the existing handling of an invalid HAB_TAG_EVT_DEF header. Fixes: 58f75efeaf30 ("mx7ulp: hab: Add hab_status command for HABv4 M4 boot") Signed-off-by: Ngo Luong Thanh Tra <[email protected]> Cc: Stefano Babic <[email protected]> Cc: Fabio Estevam <[email protected]> Cc: NXP i.MX U-Boot Team <[email protected]> Cc: Tom Rini <[email protected]>