In rpmb_route_frames(), the RPMB_REQ_READ_DATA case checks
"req_cnt != 1 || !req_cnt" which is tautological -- !req_cnt (req_cnt
== 0) is always a subset of req_cnt != 1. The second operand is dead
code.
Based on the pattern of all other cases in the switch (RPMB_REQ_KEY,
RPMB_REQ_WRITE_DATA, RPMB_REQ_WCOUNTER) which validate rsp_cnt, this
was meant to be "req_cnt != 1 || !rsp_cnt". Without this fix, a caller
could pass rsp_cnt=0 for a read request without validation.
Signed-off-by: Peng Fan <peng.fan@nxp.com>
mmc_poll_for_busy() returns a false -ETIMEDOUT if the card becomes
ready on the exact iteration where timeout_ms reaches 0. The card-ready
check breaks out of the loop, but then the post-loop check
"if (timeout_ms <= 0)" fires and returns -ETIMEDOUT despite the card
being ready.
Fix by returning 0 directly when the card is ready instead of breaking
out of the loop. The only exit from the loop is now the timeout path,
so the post-loop code unconditionally returns -ETIMEDOUT.
Reviewed-by: Tanmay Kathpalia <tanmay.kathpalia@altera.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
The original checking is wrong, it basically compares memory address
end = r->start + r->range;
with memory size:
if (end > (ddr_ram_size - ecc_res))
so the if() condition would be always true. This causes the ECC config
never take input from the devicetree.
Fixes: f43f710122 ("ram: k3-ddrss: Add support for a partial inline ECC region")
Signed-off-by: Bin Liu <b-liu@ti.com>
Reviewed-by: Neha Malcom Francis <n-francis@ti.com>
Commit f43f710122 ("ram: k3-ddrss: Add support for a partial inline
ECC region") uses ofnode_get_addr_size() to read memory address and
size from devicetree using type fdt_addr_t and fdt_size_t. However
these data types are 32bit if CONFIG_FDT_64BIT is not defined on ARMv7
build.
So enable CONFIG_FDT_64BIT to retrieve correct 64bit memory address and
size from devicetree.
Signed-off-by: Bin Liu <b-liu@ti.com>
Reviewed-by: Udit Kumar <u-kumar1@ti.com>
Reviewed-by: Neha Malcom Francis <n-francis@ti.com>
Starting with pmic firmware version 5 the watchdog is enabled with a
timeout window of 13 minutes by default.
The TI EVMs use a dip switch to control a gpio on the pmic which gets
configured as DISABLE_WDOG by the firmware.
On the phycore_am68x there is no such dip switch so pull resistors would be
necessary. Using mcu_i2c0 to turn off the pmic watchdog works with all
hardware and pmic firmware combinations.
Signed-off-by: Dominik Haller <d.haller@phytec.de>
When DEBUG_UART and SKIP_EARLY_DM are enabled, the serial console
is still probed before relocation even though DEBUG_UART already
configures the UART and provides early console output. The debug
UART configuration is sufficient until relocation, making full
serial driver initialization at this stage unnecessary.
Furthermore, the initialization is slow since it runs with dcache
disabled and is repeated again after relocation.
Skip pre-relocation serial probing in this configuration and
defer full UART initialization until after relocation. Update the
GENI UART probe logic accordingly.
This removes redundant UART initialization and improves boot
performance.
Signed-off-by: Aswin Murugan <aswin.murugan@oss.qualcomm.com>
The eMMC and SD card on the sc598 share pins, so they cannot be
used at the same time. Previously, this was managed with a patch applied
by the relevant build system, but patches are brittle and have to be
maintained. Instead, they have been replaced with two separate device trees
, one for eMMC and one for SD card, which inherit a shared base dtsi.
The build system can then select between the default device tree which
enabled eMMC or the other device tree which enables SD card support.
Signed-off-by: Caleb Ethridge <caleb.ethridge@analog.com>
U-Boot's Makefile passes KEYDIR to direct mkimage invocations, but
internal binman FIT builds only receive the generic BINMAN_INDIRS search
path. Adding KEYDIR to BINMAN_INDIRS treats it as one more input-file
search path: FIT entries still auto-detect a key directory from all
include directories, so an explicit KEYDIR may not be the directory that
gets passed to mkimage. It also makes a key-only directory part of the
generic blob lookup path.
Forward KEYDIR as a binman entry argument named keydir, matching the
existing entry-argument mechanism used for BL31, TEE, of-list and other
U-Boot build inputs. FIT entries use that directory directly for
mkimage -k when fit,sign or fit,encrypt is enabled, falling back to the
include-directory autodetection when keydir is not provided.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
single_add_gpio_func() calls ofnode_parse_phandle_with_args() once per
gpio-range entry. With a flat device tree, every call re-iterates the
property from index 0 and, because cellname is set, performs an
fdt_node_offset_by_phandle() (a full-FDT scan) at every step. The total
cost is therefore quadratic in the number of entries and proportional to
the size of the device tree.
The impact depends on when the pinctrl is probed. On the J722S EVM
defconfig, pinctrl@f4000 (main_pmx0, the SoC's stock 7-entry gpio-range)
is probed after relocation (caches on): single_add_gpio_func() takes
~18 ms there and ~1 ms with this change. When the node is probed before
relocation (caches off) the same parse takes hundreds of ms; on a board
that probes it pre-relocation and runs LPDDR4 clocked down it reached
723 ms, cut to 22 ms here. Any pinctrl-single user with a populated
gpio-range property pays this cost.
The phandle target is never dereferenced by this function (only the
argument cells are stored), so resolve it only for the first entry to
learn the per-entry cell count, then read the argument cells directly
with ofnode_read_u32_index() and allocate the ranges in one block. A
zero phandle still terminates the list, as in the original loop. This
follows the existing pinctrl-single,gpio-range usage observed in current
DTs, where entries use the same provider and therefore a uniform
per-entry cell count.
Signed-off-by: Jordi Trepat Mur <yordy1902@gmail.com>
Reviewed-by: Anshul Dalal <anshuld@ti.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
The R5 SPL SRAM size is limited and cannot accommodate both MMC boot and
Ethernet boot config options simultaneously. Add a dedicated defconfig
that enables the Ethernet boot on SK-AM62A-LP for R5 SPL stage.
Reviewed-by: Anshul Dalal <anshuld@ti.com>
Tested-by: Anshul Dalal <anshuld@ti.com>
Signed-off-by: Chintan Vankar <c-vankar@ti.com>
u-boot-dfu-20260728
CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu/-/pipelines/769
Android:
* avb: Update libavb to AOSP 1.3.0
* avb: Fix memory leak on mmc_part
* bootmeth_android: Fix memory leaks for AvbOps and verify-data
* bootmeth_android: Fix out-of-bounds access in bootconfig parsing
USB Gadget:
* cmd: ums: Set serial# on iSerial device descriptor
* dwc2: Set maxpacket_limit and endpoint capabilities to prepare for
udc core migration
* ci_udc: Fix ep type in ep_enable()
* ci_udc: Set usb request status to handle complete callback
* ci_udc: Ensure dtds are inactive before completing request
CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-imx/-/pipelines/749
- Support authenticating signed Mcore container image on i.MX9.
- Support booting CM70, CM71 and CM33 sync cores on i.MX9.
- Add i.MX SNVS RTC driver.
- Detect RAM sizes on Toradex smarc and aquila i.MX95 boards.
- Add support for the Librem5 devkit.
- Subtract half a cycle instead of three quarters of a cycle after DQS
gating calibration on i.MX6.
- Several tqma6 improvements.
- Add product ID support for new Toradex boards.
Beside a fix for a long standing bug in the A80 eMMC code, this adds
SPI booting support for the Allwinner A523/A527/T527 class of boards.
The second major feature is support for the secondary Ethernet controller
on that same SoC. This might not be as important as for the kernel (I
doubt that U-Boot acts as a router), but for once some boards only connect
the secondary EMAC, and on others people might have the boot server only
reachable via this port.
There are some smaller fixes and improvements still queued up, but they
need some more testing and are minor, so can land a bit later.
The world build timed out, but the rest passed, and I booted that briefly
on an A523 board with two Ethernet ports.
- Switched to use upstream pinctrl header include,
- Dropped SDHCI DT properties in U-Boot-specific DT for NanoPi R5 as
most are present upstream and those which aren't are breaking devices,
- Fixed ECC strength mismatch between reading and writing on non-0
NAND chips configured as boot medium (nand-is-boot-medium),
- Moved Simon to reviewer for ARM ROCKCHIP,
- Fixed build issue related to GPT capsule support accessing a struct
member only present when CONFIG_PARTITION_TYPE_GUID is set,
- Added support for new devices:
- Anbernic RG-DS
- ROC-RK3588S-PC
Vincent Jardin <vjardin@free.fr> says:
3 commits providing documentation of impacts and testing the dispatch
for null_dev_desc_ok fstypes (semihosting, ubifs, sandbox) in the
generic `load <iface> ...` command.
The test does not cover ubifs, I could not make it work with
qemu. Since the code logic is there and testing with semihost
is done, it should cover the needed cases.
Link: https://lore.kernel.org/r/20260715165735.3207801-1-vjardin@free.fr
get_dp_device() reads a Boot#### variable and passes its contents to
efi_deserialize_load_option() but ignores the return value. On failure
efi_deserialize_load_option() may return without having initialised the
caller's struct efi_load_option, and even on a malformed device path it
sets lo.file_path before validating it with efi_dp_check_length().
As a result get_dp_device() can proceed to walk lo.file_path with
efi_dp_split_file_path() (via efi_dp_dup()/efi_dp_size()) on a device
path that was never validated, or on an uninitialised pointer when the
variable is too short to be parsed. A device-path node with a length of
zero makes the walk loop forever, and a length below the 4-byte node
header leads to an out-of-bounds read. The Boot#### variable is
attacker-controlled in threat models where writing EFI variables does
not imply the ability to execute firmware code, so this is reachable
during capsule-on-disk processing at boot.
Check the return value and bail out, as every other caller of
efi_deserialize_load_option() already does.
Suggested-by: Hem Parekh <hemparekh1596@gmail.com>
Cc: Hem Parekh <hemparekh1596@gmail.com>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
The name to GUID mapping that "env set -e" applies when no -guid
option is given was not covered by any test, which is how the wrong
default GUID for "dbr" went unnoticed until the previous commit.
Add a test case that enrolls each of db, dbx, dbt and dbr in setup
mode without an explicit -guid option and checks that every variable
is created under the image security database GUID and not under the
global variable GUID. Then enroll PK and KEK, also without -guid, and
check that both are created under the global variable GUID and not
under the image security database GUID. This is also the first
coverage of dbt and dbr anywhere under test/.
The signature database enrollment happens in setup mode because once
secure boot is enabled, efi_variable_authenticate() only accepts
writes to PK, KEK, db and dbx; PK and KEK are enrolled last because
installing PK leaves setup mode.
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
do_env_set_efi() hand rolls the mapping from well known variable names
to their default vendor GUID and has already drifted from the canonical
name_type[] table in efi_var_common.c: it does not know "dbr", so
"env set -e dbr" operates on the variable under EFI_GLOBAL_VARIABLE_GUID
instead of the image security database GUID, silently creating a
variable that nothing will ever consume.
Convert the variable name to UTF-16 before selecting the GUID and let
efi_auth_var_get_guid() do the lookup. That function knows all
authenticated variables including "dbr" and falls back to
EFI_GLOBAL_VARIABLE_GUID for any other name, so behaviour is unchanged
for "db", "dbx", "dbt" and non-authenticated variables. Future
additions to the table now apply to the shell command automatically.
Since the conversion now happens before the value parsing loop, free
the UTF-16 name at the common exit label so the error path there does
not leak it.
Also drop the unmap_sysmem() call right after efi_set_variable_int():
the common exit path already unmaps the value for the -i case and frees
it otherwise, so the value was unmapped twice. On sandbox the second
call triggers a spurious "Address not mapped" warning for addresses
that get a tagged mapping.
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Document the usage of remoteproc on R-Car Gen5 RSIP U-Boot port
and clarify how to start Cortex-R52 cores from U-Boot on RSIP.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
The "env" command is the recommended environment management command,
its "print" subcommand is the equivalent replacement for legacy "printenv"
command. Update the documentation to use the contemporary "env print"
command instead of legacy "printenv" command.
Note that the "printenv" command is unlikely to be removed from U-Boot
in the near future due to it being integral part of the command line
ABI.
Implemented using:
$ sed -i 's@\<printenv\>@env print@g' $(git grep -li '\<printenv\>' doc/) README
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
The "env" command is the recommended environment management command,
its "set" subcommand is the equivalent replacement for legacy "setenv"
command. Update the documentation to use the contemporary "env set"
command instead of legacy "setenv" command.
Note that the "setenv" command is unlikely to be removed from U-Boot
in the near future due to it being integral part of the command line
ABI.
Implemented using:
$ sed -i 's@\<setenv\>@env set@g' $(git grep -li '\<setenv\>' doc/) README
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Add that the "BOOT" button must be used
to switch the board to fastboot mode.
Signed-off-by: Michael Opdenacker <michael.opdenacker@rootcommit.com>
Reviewed-by: Yao Zi <me@ziyao.cc>
If we use video copy, bit image transfers need to write to the in memory
copy of the physical frame buffer. Damage control will sync the changes
to the physical frame buffer.
Cyclic video copy will catch all changes done by EFI applications directly
accessing the frame buffer copy.
gopobj->mode.fb_base must be a valid pointer to memory and not a virtual
sandbox address.
With this change the block image transfer test works again on the sandbox.
setenv efi_selftest block image transfer
bootefi selftest
Fixes: a75cf70d23 ("efi: Correct handling of frame buffer")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
fsa_user_info.gpios[] is a fixed 20-element array, but the number of
descriptors iterated and indexed comes from the FSA add-on board EEPROM:
board_info.sockgpios and board_info.ioexpgpios are u8 fields (up to 255
each) read via dm_i2c_read() with no upper bound.
fsa_config_gpios(), invoked automatically at boot from fsa_init(), loops
over info->gpios[i] for i < sockgpios + ioexpgpios, reading past the
20-element array (an out-of-bounds stack read whose contents are then
used to configure GPIOs and build names). do_fsa_gpio() validates the
console-supplied index only against the same EEPROM counts, so
"fsa gpio <i> ..." can memcpy() a descriptor to user_info.gpios[i] for i
up to 254 -- an out-of-bounds stack write that is then written back to
the EEPROM.
A malicious or swapped FSA add-on board EEPROM (only a valid checksum is
required, which the attacker can compute) thus yields OOB accesses on the
boot path and via the console command.
Clamp the descriptor count to ARRAY_SIZE(info->gpios) before iterating,
and reject any console index outside the array.
Fixes: da9e2218af ("board: venice: add FSA support")
Signed-off-by: Christopher Kleiner <chris@kleiner.pro>
Set the environment variable 'fdtfile' depending on ENET workaround
detection.
The function tqma6_get_fdt_configuration is implemented to be reusable
for configuration detection in multi-DTB FIT image and therefore returns
the devicetree name without the '.dtb' ending.
Set fdtfile only if CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG is enabled and it
is currently unset.
The model string is loaded from the device tree variant. Therefore, the
overriding of the model string is being removed.
Signed-off-by: Paul Gerber <Paul.Gerber@tq-group.com>
Signed-off-by: Markus Niebel <Markus.Niebel@ew.tq-group.com>
Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com>
TQMa6 SOM beginning with hardware rev. 0200 comes in two flavours:
With and without a hardware workaround for ENET errata err006687.
Therefore we need two flavours of device tree. To be able to detect
the presence of the workaround we need to check GPIO1_6 is connected
to I2C bus or not. If the I2C bus is detected, the workaround is not
used and separate I2C buses are used for the SoM and the baseboard.
Later on this detection will be used to select the correct devicetree
at runtime.
Signed-off-by: Markus Niebel <Markus.Niebel@ew.tq-group.com>
Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com>
Add boot phase properties from U-Boot device tree.
This commit can be reverted if changes are integrated in upstreem
device trees and synced with U-Boot.
Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com>
We will need GPIO to distinguish between SOM variants with / without
workaround for ENET errata. This is necessary to implement the
appropriate solution and remove code intended for the non-DM use case.
To support reuse, split them in SOM and baseboard specific parts.
Prepare fragments for use with SPL.
Signed-off-by: Markus Niebel <Markus.Niebel@ew.tq-group.com>
Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com>
Add simple driver for i.MX SNVS RTC IP present in NXP i.MX SoCs.
Signed-off-by: Alexander Koch <akoch@initse.com>
Signed-off-by: Marek Vasut <marex@nabladev.com>
Handle both MMC2 and SD2 boot devices as SDMMC device 1 on
Data Modul i.MX8M Mini eDM SBC. In case the system boots from
a microSD card, the BootROM reports boot device as SD2_BOOT
instead of MMC2_BOOT. Continue booting from that SDMMC device
instead of falling back to SDP. Note that SDMMC device 1 is
the microSD slot on this device, SDMMC device 2 is the eMMC,
but BootROM reports the numbers the other way around, hence
the potential confusion in this commit message.
Fixes: 0b97a394f6 ("ARM: imx: Replace YModem with SDP on Data Modul i.MX8M Mini eDM SBC SPL")
Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Add the new 0242 PID4 to config block handling:
- 0242 Verdin AM62 Dual 1GB WB ET
Update the board-specific variant selection to use the Wi-Fi variant
for the new WB SKU.
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Add the new 0239 PID4 to config block handling:
- 0239 Verdin iMX8M Mini Quad 2GB WB IT
Update the board-specific variant selection to use the Wi-Fi variant
for the new WB SKU.
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Add the new Verdin iMX8M Plus 64GB eMMC PID4s to config block handling:
- 0236 Verdin iMX8M Plus Quad 4GB WB IT
- 0237 Verdin iMX8M Plus Quad 4GB IT
- 0238 Verdin iMX8M Plus Quad 8GB WB IT
Update the board-specific variant selection to use the Wi-Fi variant for
the new WB SKUs.
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Peng Fan
Bin LiuandTom Rini
Romain CariteyandTom Rini
Dominik HallerandTom Rini
Aswin MuruganandTom Rini
Caleb EthridgeandTom Rini
James HilliardandTom Rini
Jordi Trepat MurandTom Rini
Chintan VankarandTom Rini
Heinrich Schuchardt
Hem ParekhandHeinrich Schuchardt
Aristo ChenandHeinrich Schuchardt
Marek VasutandHeinrich Schuchardt
Michael OpdenackerandHeinrich Schuchardt
Christopher KleinerandFabio Estevam
Alexander FeilkeandFabio Estevam
Paul GerberandFabio Estevam
Markus NiebelandFabio Estevam
Max MerchelandFabio Estevam
Alexander KochandFabio Estevam
Marek VasutandFabio Estevam
Vitor SoaresandFabio Estevam