| Age | Commit message (Collapse) | Author |
|---|
|
Signed-off-by: Tom Rini <[email protected]>
|
|
layout
Document the SPI NOR layout, placement of U-Boot bootloader,
U-Boot environment and optional PCIe controller firmware.
Signed-off-by: Marek Vasut <[email protected]>
|
|
https://git.u-boot-project.org/u-boot/custodians/u-boot-net
Pull request net-20260813.
net:
- phy: dp83867: enable extended read / write for driver
- phy: fix duplicate eth_phy binding
- Drop unnecessary device_set_name
- dwc_eth_xgmac: Return -ENODEV when phy_connect() fails
- nfs: clean up bounds checks in nfs_readlink_reply()
- rtl8169: add support for RTL8126A and RTL8127A
- srand_mac(): fix -ENODEV crash with CONFIG_DM_RNG
net-legacy:
- Fix out-of-bounds write in IP fragment reassembly
- test: net: add regression test for IP reassembly overflow
net-lwip:
- Add tftpsrv command
- Handle chained pbufs in transmit path
- sntp: fix netif leak when ntpserverip is unset
- wget: free mbedtls x509 cert context to avoid memory leak
- Fix DHCP fine timer interval
|
|
Signed-off-by: Tom Rini <[email protected]>
|
|
Daniel Golle <[email protected]> says:
A signed FIT configuration can delegate the integrity of a (potentially
large) root filesystem image to the kernel's dm-verity instead of having
U-Boot hash the whole payload at boot: the FIT carries a "dm-verity"
subnode with the roothash, salt and block parameters, U-Boot passes the
roothash to Linux through the dm-mod.create bootargs, and dm-verity then
validates the filesystem block by block against it.
For that to be safe the roothash has to be trusted, and in a signed
configuration the only thing that establishes trust is the configuration
signature. The roothash was not covered by it. fit_config_add_hash()
collected the image node, its hash subnodes and its cipher subnode into
the signed region, but not the dm-verity subnode, so the roothash, the
sole integrity anchor for the filesystem, was left unsigned.
The result is a verified-boot bypass for the root filesystem: an
attacker who can rewrite the boot medium can replace the filesystem,
recompute a matching dm-verity tree, write the new roothash into the
unsigned dm-verity subnode, and the configuration signature still
verifies. dm-verity then faithfully validates the malicious filesystem
against the attacker's roothash.
This series closes the gap.
Link: https://lore.kernel.org/r/[email protected]
|
|
A dm-verity protected filesystem image is not hashed by U-Boot; its
integrity is delegated to the kernel, which trusts the roothash taken
from the FIT dm-verity subnode. For that chain of trust to hold, the
roothash (and salt) must be part of the region covered by the
configuration signature, otherwise an attacker can replace both the
filesystem and the roothash while keeping the signature valid.
Add two independent checks of this property:
- test/py/tests/test_fit_verity_sign.py signs a configuration that
references a filesystem image carrying a dm-verity subnode, then
confirms that tampering the roothash or the salt is rejected by
fit_check_sign. A control that tampers a byte known to be signed
proves the check can fail. A matching page is added under
doc/develop/pytest/ so the module documentation is rendered with
the rest of the generated docs.
- test/boot/fit_verity.c gains a runtime unit test that builds the
exact node list the configuration signature is computed over,
turns it into hashed regions and checks both that the roothash
bytes fall inside a signed region and that tampering them changes
the hash. It needs no private key, so it also runs on real devices
and uses the same hash path a device would.
To let the unit test build the signed-region node list, rename the
config node-list helper to fit_config_get_signed_nodes(), make it
non-static and declare it in image.h.
Signed-off-by: Daniel Golle <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
A dm-verity protected filesystem image is not hashed by U-Boot when it
is loaded; its integrity is delegated to the kernel, which validates the
filesystem on the fly against the roothash taken from the FIT dm-verity
subnode. The roothash is therefore the sole integrity anchor for the
filesystem, yet fit_config_add_hash() only adds the image node, its
hash subnodes and its cipher subnode to the signed region, leaving the
dm-verity subnode (roothash, salt and block parameters) unsigned.
An attacker able to rewrite the boot medium could then replace both the
filesystem and the roothash, recompute a matching dm-verity tree and
keep the configuration signature valid, defeating verified boot for the
root filesystem.
Add the dm-verity subnode to the list of nodes covered by the
configuration signature, both when signing (tools/image-host.c) and when
verifying (boot/image-fit-sig.c), so the roothash and salt are
authenticated together with the rest of the configuration.
Signed-off-by: Daniel Golle <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
The MediaTek MTU3 and xHCI text bindings describe legacy U-Boot layouts
which have been superseded by the canonical Linux schemas. Those schemas
are already synchronized into `dts/upstream/Bindings/usb`.
Remove the duplicate text bindings so new devicetrees and driver changes
use the maintained YAML definitions.
Reviewed-by: Marek Vasut <[email protected]>
Signed-off-by: Carlo Caione <[email protected]>
|
|
https://git.u-boot-project.org/u-boot/custodians/u-boot-imx
CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-imx/-/pipelines/906
- Fix a boot regression on i.MX7 related to the system counter.
- Add Aquila iMX95 0243 PID4.
- Update phycore_imx8mm DDR timings.
- Add FRDM-IMX95 initial support.
- Handle FCFB header during SPI NOR boot and CST backend selection.
|
|
Add boot support and peripherals like eMMC/SD, UART, I2C, GPIO, ENETC0/1
and PCIE0/1 for iMX95 15x15 FRDM.
Updated doc for build instructions.
Signed-off-by: Lei Xu <[email protected]>
Signed-off-by: Joseph Guo <[email protected]>
|
|
Add U-Boot support for Milk-V Duo 256M.
This board has a different SoC compared to the Milk-V Duo 64M, it uses
the Sophgo SG2002 instead of the Sophgo CV1800B. Both SoCs share many
common IP blocks, so this board reuses the existing cv1800b CPU support.
The board shares the same 'board.c' with Milk-V Duo 64MB (CV1800B), so
use the same file for now.
Link: https://milkv.io/docs/duo/getting-started/duo256m
Signed-off-by: Hiago De Franco <[email protected]>
Acked-by: Leo Yu-Chi Liang <[email protected]>
|
|
Add support for setting the CST backend, both via DT property and
CST_BACKEND environment variable. The CST currently supports two
backends, 'ssl' and 'pkcs11', with 'ssl' being the default when
CST tool is invoked without any -b parameter. Keep 'ssl' backend
as the default, but explicitly pass it via the '-b' parameter,
unless the user selects 'pkcs11' via either method.
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
https://git.u-boot-project.org/u-boot/custodians/u-boot-efi
Pull request efi-2026-10-rc2-2
CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-efi/-/pipelines/839
Documentation:
* README: Slightly rephrase env set and env print paragraph
* cmd: gpt: Reinstate gpt setenv
* CONTRIBUTE: replace "as" with "like"
UEFI:
* Unify the memory map output of 'efi mem' and 'efidebug memmap'
* Print ISA-specific and unknown memory attributes
* Rix memory leak in efi_sigstore_parse_siglist
* Fix use of uninitialized guid in variable enumeration loops
|
|
Commit dc3765ede5a4 ("doc: Switch from setenv to env set") was
too eager to switch "setenv" to "env set" and also incorrectly
rewrote "gpt setenv" to "gpt env set". Undo this error.
Fixes: dc3765ede5a4 ("doc: Switch from setenv to env set")
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
It's either "as with" or "like" but not "as", as reported by Simon.
Let's fix this oversight.
Fixes: 06f014394594 ("doc: CONTRIBUTE: tell people reviewing *is* contributing")
Reported-by: Simon Glass <[email protected]>
Suggested-by: Simon Glass <[email protected]>
Signed-off-by: Quentin Schulz <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
The attribute mnemonic table did not cover EFI_MEMORY_ISA_VALID and the
EFI_MEMORY_ISA_MASK field, and attribute bits without a mnemonic were
silently dropped, so a memory map carrying ISA-specific, invalid or not
yet known attributes displayed incomplete information without any hint
that something was missing.
Add a mnemonic for EFI_MEMORY_ISA_VALID and print the ISA-specific
field as ISA=<value> when it is valid, instead of decoding bits whose
meaning U-Boot cannot know. Any remaining bits that match neither the
mnemonic table nor the ISA field are printed as a hexadecimal value.
Suggested-by: Heinrich Schuchardt <[email protected]>
Signed-off-by: Aristo Chen <[email protected]>
|
|
The efi and efidebug commands each carried their own code for printing
the EFI memory map, with separate tables of memory type and attribute
names. The copies had drifted: efidebug knew EFI_PERSISTENT_MEMORY_TYPE
while 'efi mem' printed it as '<invalid>', neither table knew
EFI_UNACCEPTED_MEMORY_TYPE, and the 'efi mem' printer had misaligned
column headers, a broken '<gap>' line and a superfluous Virtual column:
the map is identity mapped before SetVirtualAddressMap() is called, so
the field carries no information at the time the command can run.
Move the printing loop of 'efidebug memmap' into efi_common.c as
efi_show_memmap(), which is linked into both commands, and use it from
both. The second copy in 'efi mem' is deleted together with
efi_print_mem_table() and the private sorting and merging code,
including the 'all' argument.
The memory type names follow the UEFI specification with the leading
'Efi' and the trailing 'Type' stripped, for example ConventionalMemory
for EfiConventionalMemory, and the missing name for unaccepted memory
is added. The type column is widened to fit the longest name,
MemoryMappedIOPortSpace.
The shared function iterates the map with the descriptor size reported
by the firmware instead of assuming sizeof(struct efi_mem_desc). This
matters for 'efi mem' under EDK II based firmware, which reports a
descriptor size of 0x30. The memory map key, which was printed
uninitialized on the payload path, is now initialized. The command
documentation is updated with output captured from the app running
under OVMF, and documents why virtual addresses are not shown.
Suggested-by: Heinrich Schuchardt <[email protected]>
Signed-off-by: Aristo Chen <[email protected]>
|
|
The current documentation doesn't work as-is for extracting the DDR
training binary from the vendor bootloader. There are some seemingly
undocumented alignment requirements that we need to meet by padding the
binary file. Add some instructions on how to do this with objcopy. Also
fix a minor spelling mistake while we're here.
Signed-off-by: Chris Packham <[email protected]>
Reviewed-by: Stefan Roese <[email protected]>
[sr: fix title underline length]
|
|
Chintan Vankar <[email protected]> says:
This series enables Ethernet boot on SK-AM62A-LP. The series is based on
commit 'a18265f1ccb7' of origin/next branch of U-Boot repo.
Link: https://lore.kernel.org/r/[email protected]
|
|
Document the procedure to enable Ethernet Boot on SK-AM62A-LP.
Tested-by: Anshul Dalal <[email protected]>
Signed-off-by: Chintan Vankar <[email protected]>
|
|
https://git.u-boot-project.org/u-boot/custodians/u-boot-efi
Pull request efi-2026-01-rc2
CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-efi/-/pipelines/753
Documentation:
* sandbox: fix enum host_platform_flags description
* switch from setenv to env set and from printenv to env print
* document Renesas R-Car Gen5 RSIP Cortex-R52 start
* thead: lpi4a: detail how to enable fastboot
UEFI:
* unify and correct GUID selection for security database variables
* test: check default GUID selection of security database variables
* set correct frame buffer address
* check efi_deserialize_load_option() in get_dp_device()
|
|
https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu
u-boot-dfu-20260728
CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu/-/pipelines/769
Android:
* avb: Update libavb to AOSP 1.3.0
* avb: Fix memory leak on mmc_part
* bootmeth_android: Fix memory leaks for AvbOps and verify-data
* bootmeth_android: Fix out-of-bounds access in bootconfig parsing
USB Gadget:
* cmd: ums: Set serial# on iSerial device descriptor
* dwc2: Set maxpacket_limit and endpoint capabilities to prepare for
udc core migration
* ci_udc: Fix ep type in ep_enable()
* ci_udc: Set usb request status to handle complete callback
* ci_udc: Ensure dtds are inactive before completing request
|
|
https://git.u-boot-project.org/u-boot/custodians/u-boot-imx
CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-imx/-/pipelines/749
- Support authenticating signed Mcore container image on i.MX9.
- Support booting CM70, CM71 and CM33 sync cores on i.MX9.
- Add i.MX SNVS RTC driver.
- Detect RAM sizes on Toradex smarc and aquila i.MX95 boards.
- Add support for the Librem5 devkit.
- Subtract half a cycle instead of three quarters of a cycle after DQS
gating calibration on i.MX6.
- Several tqma6 improvements.
- Add product ID support for new Toradex boards.
|
|
Signed-off-by: Tom Rini <[email protected]>
|
|
https://git.u-boot-project.org/u-boot/custodians/u-boot-rockchip
- Switched to use upstream pinctrl header include,
- Dropped SDHCI DT properties in U-Boot-specific DT for NanoPi R5 as
most are present upstream and those which aren't are breaking devices,
- Fixed ECC strength mismatch between reading and writing on non-0
NAND chips configured as boot medium (nand-is-boot-medium),
- Moved Simon to reviewer for ARM ROCKCHIP,
- Fixed build issue related to GPT capsule support accessing a struct
member only present when CONFIG_PARTITION_TYPE_GUID is set,
- Added support for new devices:
- Anbernic RG-DS
- ROC-RK3588S-PC
|
|
fstypes"
Vincent Jardin <[email protected]> says:
3 commits providing documentation of impacts and testing the dispatch
for null_dev_desc_ok fstypes (semihosting, ubifs, sandbox) in the
generic `load <iface> ...` command.
The test does not cover ubifs, I could not make it work with
qemu. Since the code logic is there and testing with semihost
is done, it should cover the needed cases.
Link: https://lore.kernel.org/r/[email protected]
|
|
Document the usage of remoteproc on R-Car Gen5 RSIP U-Boot port
and clarify how to start Cortex-R52 cores from U-Boot on RSIP.
Signed-off-by: Marek Vasut <[email protected]>
|
|
The "env" command is the recommended environment management command,
its "print" subcommand is the equivalent replacement for legacy "printenv"
command. Update the documentation to use the contemporary "env print"
command instead of legacy "printenv" command.
Note that the "printenv" command is unlikely to be removed from U-Boot
in the near future due to it being integral part of the command line
ABI.
Implemented using:
$ sed -i 's@\<printenv\>@env print@g' $(git grep -li '\<printenv\>' doc/) README
Signed-off-by: Marek Vasut <[email protected]>
|
|
The "env" command is the recommended environment management command,
its "set" subcommand is the equivalent replacement for legacy "setenv"
command. Update the documentation to use the contemporary "env set"
command instead of legacy "setenv" command.
Note that the "setenv" command is unlikely to be removed from U-Boot
in the near future due to it being integral part of the command line
ABI.
Implemented using:
$ sed -i 's@\<setenv\>@env set@g' $(git grep -li '\<setenv\>' doc/) README
Signed-off-by: Marek Vasut <[email protected]>
|
|
Add that the "BOOT" button must be used
to switch the board to fastboot mode.
Signed-off-by: Michael Opdenacker <[email protected]>
Reviewed-by: Yao Zi <[email protected]>
|
|
Document the dispatch path added by the former commit
fs: dispatch null_dev_desc_ok filesystems before lookup
Add a null-block-device interfaces section that:
* lists the three fstypes that can benefit of it (semihosting, ubifs,
sandbox) and the CONFIG option that builds each
* explains the '-' convention for the unused <dev[:part]> field
Suggested-by: Simon Glass <[email protected]>
Signed-off-by: Vincent Jardin <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Although it has similar naming the Librem 5 Devkit is a completely
different design from the Librem 5 phone. It uses an imx8mq SOM from
Emcraft, a separate HDMI port instead of DisplayPort, different USB-C
chip, panel, etc.
This is based on a Emcraft's SOM documentation, Purism's downstream fork
and the available schematics of the devkit.
Link: https://developer.puri.sm/Librem5/Development_Environment/Boards/imx8.html
Link: https://source.puri.sm/Librem5/dvk-mx8m-bsb
Co-authored-by: Angus Ainslie <[email protected]>
Co-authored-by: Manuel Traut <[email protected]>
Signed-off-by: Manuel Traut <[email protected]>
Tested-by: Manuel Traut <[email protected]>
Signed-off-by: Guido Günther <[email protected]>
[fabio: Removed the arch/arm/dts/Makefile entry that does not apply and
it is not needed as the board uses OF_UPSTREAM]
Signed-off-by: Fabio Estevam <[email protected]>
|
|
Note that verification is performed by the libavb copy vendored under
lib/libavb/ (AVB version 1.3.0) and which parts are U-Boot-specific, and
pin the README reference to the exact upstream commit the vendored copy
corresponds to instead of a moving master branch.
Signed-off-by: Igor Opaniuk <[email protected]>
|
|
Steps 2 and 3 are incorrectly numbered. Fix them.
Signed-off-by: Hiago De Franco <[email protected]>
|
|
With CONFIG_FIT_BEST_MATCH, fit_conf_find_compat() selects the
configuration matching the most specific U-Boot compatible string; on
equal matches the first listed configuration wins and the configurations
node 'default' property is never consulted.
A FIT whose configurations all share the same base devicetree compatible
(e.g. one manifest carrying a base tree plus overlay combinations for a
single board) therefore always boots the first configuration, silently
ignoring the default chosen by the manifest author.
Break score ties in favour of the default configuration. A strictly
better compatible match still wins over it, and FITs without a default
keep the current first-listed behaviour.
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
Signed-off-by: Carlo Caione <[email protected]>
|
|
The legacy network stack supports tftpsrv, which listens for an
incoming TFTP write request and receives the first file into memory.
Despite the old command help wording, the command returns after
receiving the file and does not boot it automatically.
The lwIP stack already builds the lwIP TFTP application, but only wires
it up for client-side tftpboot. Add a lwIP tftpsrv command and
implement the server path with tftp_init_server(). Reuse the existing
lwIP TFTP write callback and memory copy path so LMB checks, progress
output, filesize/fileaddr updates and EFI bootdev handling stay
consistent with tftpboot.
Track receive timeout and write-failure state around the lwIP callbacks
so a stalled or rejected receive is not reported as a successful close.
Move CMD_TFTPSRV out of the legacy-only Kconfig block so it can be
enabled with either network stack. Update the command help text and add
usage documentation for the receive-only behavior.
Add pytest coverage for tftpsrv using a generated host file and curl's
TFTP upload support. Enable the command in qemu_arm64_lwip_defconfig so
the test can be run with the existing lwIP QEMU build when the boardenv
provides env__net_tftpsrv_file.
Signed-off-by: James Hilliard <[email protected]>
[Jerome Forissier: remove trailing ':' after SPDX tag]
Signed-off-by: Jerome Forissier <[email protected]>
Reviewed-by: Jerome Forissier <[email protected]>
|
|
The ROC-RK3588S-PC board is an SBC made by Firefly, based on the RK3588S
SoC.
Add support for it.
Signed-off-by: Fabio Estevam <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
Link: https://patch.msgid.link/[email protected]
[s/ROC-PC-RK3588S/ROC-RK3588S-PC/ in commit log and diff]
Signed-off-by: Quentin Schulz <[email protected]>
|
|
The use of RK_FUNC_n defines is deprecated in the upstream
rockchip.h file. Replace all them by the function number.
Signed-off-by: Johan Jonker <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Quentin Schulz <[email protected]>
|
|
Rasmus Villemoes <[email protected]> says:
This started by me wanting something like what patch 8 does. That
wasn't too hard, except we had no strcasestr(), and also our regex
engine (which I didn't really want to pull into the mix anyway)
doesn't have a flag that requests case-insensitive matching. So I
wanted to add strcasestr(), but then I stumbled on a bunch of stuff
that should be cleaned up in str-land.
Link: https://lore.kernel.org/r/[email protected]
|
|
Add a little documentation for the config command and its new ability
to filter the output.
Signed-off-by: Rasmus Villemoes <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
The K1 SPL patchset requires DDR firmware integration and FSBL signing
steps that are not covered by existing documentation. Add a SoC-level
guide so reviewers and developers can build and test on hardware.
Signed-off-by: Guodong Xu <[email protected]>
Tested-by: Songsong Zhang <[email protected]>
|
|
Restructure K1 SoC support to handle multiple boards through a single
configuration:
1. Rename bananapi-f3_defconfig to spacemit_k1_defconfig.
2. Move all K1 board files to board/spacemit/k1/.
3. Replace TARGET_BANANAPI_F3 with TARGET_SPACEMIT_K1 and rename the
board's <board>.h header to k1.h.
Eliminates the need for board-specific defconfigs while maintaining
hardware compatibility.
Signed-off-by: Raymond Mao <[email protected]>
Signed-off-by: Guodong Xu <[email protected]>
Link: https://patch.msgid.link/[email protected]
Tested-by: Songsong Zhang <[email protected]>
|
|
As part of moving our git forge to a new location, update all references
in tree to point to git.u-boot-project.org now.
Signed-off-by: Tom Rini <[email protected]>
|
|
The U-Boot Mailing-list is moving to the lists.u-boot-project.org
domain, so update all references of list.denx.de to the new
domain in the documentation.
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Neil Armstrong <[email protected]>
Reviewed-by: Peter Robinson <[email protected]>
|
|
Add support for the Anbernic RG-DS dual-screen handheld gaming device.
Link: https://anbernic.com/products/rgds
Signed-off-by: Chris Morgan <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
Reviewed-by: Kever Yang <[email protected]>
Link: https://patch.msgid.link/[email protected]
[conflict resolution in doc/board/rockchip/rockchip.rst due to commit
b5deaa71fbe5 ("board: rockchip: Add support for 9Tripod X3568 v4")]
Signed-off-by: Quentin Schulz <[email protected]>
|
|
contributions
We don't have too many people looking at those at the moment, so having
people getting into the project by adding tests or documentation is I
believe a good thing so let's encourage those specific contributions.
Signed-off-by: Quentin Schulz <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
|
|
We are "a bit" struggling with reviewing things and it's most of the
time maintainers or long time contributors reviewing patches on the
mailing list.
Hint that reviewing is also contributing to the project and that even if
you don't feel you're an expert, your review is still welcome and can
help us catch bugs before they are merged.
Signed-off-by: Quentin Schulz <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
|
|
This way we don't need to make sure this link still points to something
that exists, as Sphinx will enforce it at build time. It also has the
added benefit that if someone builds the docs they will point at their
docs (though that is debatable whether that's useful, but at least you
stay on the same website).
Signed-off-by: Quentin Schulz <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
|
|
The list-table layout does not allow grouping columns together,
convert the table into grid-table layout instead and rework it
such that SoC families, generations, architectures and SoCs are
grouped together. Include SoC column to group SoCs together, and
Core column which is useful on SoC like the R-Car X5H where U-Boot
can run on multiple cores in the SoC.
Signed-off-by: Marek Vasut <[email protected]>
|
|
Update the Build section and note that it is only applicable
in case the table above does not contain any board specific
instructions. Include information that the Architecture column
now contains toolchain setup instruction links.
Signed-off-by: Marek Vasut <[email protected]>
|
