__net_defragment() reassembles IP fragments into the static buffer
pkt_buff[CONFIG_NET_MAXDEFRAG]. The bounds check
if (start + len > IP_MAXUDP)
return NULL;
only covers the fragment data copy. The split-hole and move-hole
branches additionally write an 8-byte struct hole via "*newh = *h" at
newh = thisfrag + len / 8, which can land up to sizeof(struct hole)
bytes past the end of pkt_buff. A single fragment with a non-zero
fragment offset and the More-Fragments flag set reaches this path, so
a crafted fragment received during netboot overflows the buffer.
Reject any fragment whose trailing hole descriptor would fall outside
pkt_buff.
Signed-off-by: Shahriyar Jalayeri <shahriyar@byteray.co.uk>
Acked-by: Jerome Forissier <jerome.forissier@arm.com>
Commit d6694018ea ("net: nfs: fix buffer overflow in
nfs_readlink_reply()") added bounds checks against sizeof(nfs_path_buff)
before both memcpy() calls. This is a cosmetic cleanup of that fix:
- introduce a local new_len for the relative-path branch so the sum
pathlen + rlen is computed once and reused for both the bounds check
and the NUL terminator, rather than being open-coded twice;
- emit a diagnostic when a symlink target is rejected for exceeding the
buffer, matching the style of other NFS error paths.
No functional change to the accept/reject decision.
This same overflow was independently discovered and privately reported
to the U-Boot maintainers on 2026-04-03, together with a working proof
of concept, ahead of the change that became the fix cited above. This
cleanup restores the local-variable form from that original report.
Signed-off-by: Murtaza Munaim <murtaza@saramena.us>
When multiple Ethernet controllers are enabled in the device tree,
but only one controller is actually present in hardware, the
non-existent controller still attempts to connect to a PHY.
In this case, phy_connect() may return NULL without setting an
error code. The current driver only logs the failure but does not
propagate an error, causing the initialization flow to continue
with an invalid PHY handle.
This leads to failures later in the initialization sequence.
Fix this by explicitly setting ret = -ENODEV when phy_connect()
returns NULL, ensuring the driver exits cleanly on failure.
Signed-off-by: Boon Khai Ng <boon.khai.ng@altera.com>
_set_cacert() calls mbedtls_x509_crt_init(&crt) followed by
mbedtls_x509_crt_parse(), which allocates internal storage (parsed
cert fields, chain links, raw buffers) inside the crt object. The
function then returns on both the error and success paths without
calling mbedtls_x509_crt_free(&crt), so all of that internal state
is leaked when the stack-allocated crt goes out of scope. Every
invocation of "wget cacert ..." leaks memory.
Free the cert object on both return paths.
Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
sntp_loop() allocates a netif via net_lwip_new_netif() and normally
releases it with net_lwip_remove_netif() before returning. The error
path taken when no explicit server IP is passed and ntp_server_known()
is false returns -1 directly without freeing the netif, leaking the
lwIP netif structure (and its associated state) on every failed
invocation of the sntp command.
Call net_lwip_remove_netif(netif) before returning on this path so it
matches the other exits.
Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
LwIP may pass a packet to the netif linkoutput callback as a chain
of pbufs. In this case, p->len only describes the length of the
first pbuf, while p->tot_len describes the length of the whole
packet.
The current transmit path only sends the first pbuf. This can
truncate packets whose headers have already been generated for the
full packet length, resulting in malformed frames on the wire.
For example, the IP header may record a larger total length than the
actual Ethernet frame length.
Assemble chained pbufs into one aligned contiguous buffer before
passing the packet to the Ethernet driver.
Fixes: 98ad145db6 (net: lwip: add DHCP support and dhcp commmand)
Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
The legacy network stack supports tftpsrv, which listens for an
incoming TFTP write request and receives the first file into memory.
Despite the old command help wording, the command returns after
receiving the file and does not boot it automatically.
The lwIP stack already builds the lwIP TFTP application, but only wires
it up for client-side tftpboot. Add a lwIP tftpsrv command and
implement the server path with tftp_init_server(). Reuse the existing
lwIP TFTP write callback and memory copy path so LMB checks, progress
output, filesize/fileaddr updates and EFI bootdev handling stay
consistent with tftpboot.
Track receive timeout and write-failure state around the lwIP callbacks
so a stalled or rejected receive is not reported as a successful close.
Move CMD_TFTPSRV out of the legacy-only Kconfig block so it can be
enabled with either network stack. Update the command help text and add
usage documentation for the receive-only behavior.
Add pytest coverage for tftpsrv using a generated host file and curl's
TFTP upload support. Enable the command in qemu_arm64_lwip_defconfig so
the test can be run with the existing lwIP QEMU build when the boardenv
provides env__net_tftpsrv_file.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Jerome Forissier: remove trailing ':' after SPDX tag]
Signed-off-by: Jerome Forissier <jerome.forissier@arm.com>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
When device was created, it already has a name assigned. There is
no need to alloc space for name and set it with same device name.
Cleanup the code to avoid unnecessary device_set_name.
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
When both CONFIG_PHY_ETHERNET_ID and CONFIG_DM_ETH_PHY are enabled,
eth_phy_binds_nodes() called from eth_post_bind() already binds the
ethernet PHY node to eth_phy_generic_drv. However, phy_connect_phy_id()
called via phy_connect() also binds the same PHY node, resulting in
duplicate entries in the DM tree.
Fix this by introducing phy_connect_dm_bound() which checks if the PHY
is already bound via uclass_find_device_by_phandle(). If so, it gets
the phy_device via phy_find_by_mask() since the udevice does not store
a phy_device pointer and the phy_device can only be obtained by
scanning the MDIO bus. The phydev->node is then set from the
already-bound DM device. This skips the generic binding methods
in phy_connect() when the PHY is already DM-bound.
Fixes: 68a4d15061 ("net: phy: Bind ETH_PHY uclass driver to each new PHY")
Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Add a wrapper to implement ext_read / write using phy_[read,write]_mmd.
Check if devad is the only supported extended MMD address on this PHY.
Signed-off-by: Markus Niebel <Markus.Niebel@tq-group.com>
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
i3c_master_add_i3c_dev_locked() incorrectly set master->this to the
newly discovered slave device, causing i3c_master_attach_i3c_dev()
to skip the attach_i3c_dev() callback. As a result the slave device
never got its master_priv (DAT slot index) allocated, free_pos was
never updated, and the DAT entry was never written.
Fix by removing the incorrect master->this assignment. Store the
slave descriptor directly in master->i3cdev[pos] inside
dw_i3c_master_attach_i3c_dev() where the DAT slot index is already
known. Also check the return value of i3c_master_add_i3c_dev_locked()
and skip num_i3cdevs increment on failure, fixing dummy devices shown
when no slaves are present on the bus.
Fixes: 1009c96f15 ("drivers: i3c: Add driver for MIPI DWI3C")
Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Reviewed-by: Dinesh Maniyam <dinesh.maniyam@altera.com>
Enable I3C controller driver and command support for Versal Gen 2 by
adding CONFIG_CMD_I3C, CONFIG_I3C and CONFIG_DW_I3C_MASTER.
Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Acked-by: Michal Simek <michal.simek@amd.com>
The !currdev guard in do_i3c() was placed before the list and current
handlers, causing both to fail when no controller is pre-selected.
Move the guard to only protect device_list, write and read which
actually need a controller.
Fixes: b875409da7 ("cmd: Add i3c command support.")
Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Reviewed-by: Dinesh Maniyam <dinesh.maniyam@altera.com>
Treat -ENOENT and -ENOTSUPP from reset_get_bulk() as non-fatal to
support platforms where no resets are defined in the DTS. The resets
property is not yet documented in the DT binding.
Fixes: 1009c96f15 ("drivers: i3c: Add driver for MIPI DWI3C")
Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Reviewed-by: Dinesh Maniyam <dinesh.maniyam@altera.com>
The bounds check in do_rw() was written as:
if (cnt + blk > limit)
with cnt and blk declared as uint (unsigned int) and limit as ulong.
C's usual arithmetic conversions are applied per binary operator, so
"cnt + blk" is evaluated entirely in unsigned int and wraps modulo
2^32 before the result is widened for the comparison against limit.
With cnt = 0xFFFFFFFF and blk = 1 the sum wraps to 0 and the guard
passes, allowing blk_dread()/blk_dwrite() to be issued with a 4 GiB
transfer count that runs past the partition (or, when no partition
is selected, the entire device).
Rewrite the check as two comparisons that do not overflow:
if (blk > limit || cnt > limit - blk)
The subtraction is performed in ulong (limit's type), so no truncation
occurs, and the two sub-conditions cover both "start block past end"
and "count would push us past end" failure modes.
Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Rasmus Villemoes <rv@rasmusvillemoes.dk> says:
This started by me wanting something like what patch 8 does. That
wasn't too hard, except we had no strcasestr(), and also our regex
engine (which I didn't really want to pull into the mix anyway)
doesn't have a flag that requests case-insensitive matching. So I
wanted to add strcasestr(), but then I stumbled on a bunch of stuff
that should be cleaned up in str-land.
Link: https://lore.kernel.org/r/20260708203711.849489-1-rv@rasmusvillemoes.dk
Add some test cases for the 'config' command, including the ability to
filter the output.
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Reviewed-by: Simon Glass <sjg@chromium.org>
Add a little documentation for the config command and its new ability
to filter the output.
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Reviewed-by: Simon Glass <sjg@chromium.org>
When doing development, it can be quite useful to enable
CONFIG_CMD_CONFIG, so that one can always check whether a config knob
one has just enabled has actually made it to target.
Because sometimes, one doesn't flash the right binary, or maybe one
has just done CONFIG_FOO=y in some config fragment, but that had no
effect because one would also have to do CONFIG_BAR=y.
However, 2400+ lines of text are rather hard to read through. One
probably uses a terminal emulator with capturing enabled, but
searching back through the capture file is a little tedious, and one
easily ends up finding something that doesn't pertain to the most
recent 'config' command invocation.
So make it possible to limit the output to those lines containing a
given string. Like the search functionality in menuconfig, make it
case insensitive, because it is much more convenient to type "config
pinctrl" than "config PINCTRL".
Since enabling CONFIG_CMD_CONFIG by itself adds over 10K of data, and
that increases with every U-Boot release even if one doesn't add any
new features to one's own defconfig (because the .config grows lots of
"is not set"), I don't see any point in guarding this by some
CONFIG_CMD_CONFIG_GREP.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Change the existing strstr() test a little so that the substring not
found is "bits", i.e. one that is actually found when doing case
insensitive search.
Then copy all of lib_strstr(), adapt the expectation for the
strcasestr(s1, s3) result, and add another "not found" case.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
While this is not likely needed by any "real" driver code, a later
convenience addition to the "config" command will need this. As usual,
the linker will throw it away if nothing actually uses it, so it
should have no size impact when not used.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
None of these six macros are defined by any architecture. Moreover,
the ifndef guard only exists in either string.h or string.c, making them
completely pointless.
I'm not sure whether we have an explicit coding style discouraging the
"extern" qualifier on function declarations, and string.h has a random
mix of everything, but I can't leave it on strncasecmp() now that it
will be immediately after strcasecmp() which doesn't have it.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
The last use of this function with rather peculiar semantics[*] vanished
in 2021 with 0a527fda78 ("Fix IDE commands issued, fix endian issues,
fix non MMIO"). It has no tests, and should a need for something
similar ever appear, it is better done with some proper
utf16le/utf16be/utf16 abstractions rather than cluttering code with
'#ifdef __LITTLE_ENDIAN'.
[*] The byte-swapping itself is weird enough. But why is an input string
of odd length ok, while the empty string is not allowed?
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
The len parameter for strnstr() concerns the maximum size of the
haystack to consider, not the length of the needle being searched for.
strstr() obviously has no len parameter, so remove the copy-pasta.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Both glibc's (where this originated as a GNU extension) and the
kernel's versions of strchrnul() return "char *", not "const
char *". That also makes it consistent with the standard strchr()
function.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
First, remove the !__KERNEL__ block, since U-Boot is always compiled
with -D__KERNEL__.
Second, remove the mention of the non-existing file
arch/sh/lib/strcasecmp.c and the redundant declaration of strcasecmp()
If sh did have a strcasecmp.c file, presumably the header would have
had to #define __HAVE_ARCH_STRCASECMP.
Third, remove the explicit #undefs of various __HAVE_ARCH_* and
redundant declarations of standard functions, which are anyway
declared in linux/string.h. In the linux source tree, those are all
#defines, and indeed linux does have asm implementations of those functions.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Add a regression test that builds a FIT with external data, inflates
the data-size property far beyond the image and any plausible load
region, and confirms that spl_load_simple_fit() returns -EFBIG instead
of reading the declared size off the device. Without the bounds check
in load_simple_fit() this test overruns memory and crashes; with it the
load is rejected cleanly.
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
load_simple_fit() loads an image stored as external data by reading
it from the boot device with a transfer sized from the FIT data-size
property. That property is listed in exc_prop[] in image-fit-sig.c,
so it is excluded from the configuration signature and stays under
the control of anyone able to modify the boot medium even when
CONFIG_SPL_FIT_SIGNATURE is enabled. The read happens before
fit_image_verify_with_data() checks the image hash, so an inflated
data-size overruns the destination before the corruption can be
detected. The device-tree overlay path is the sharpest case, because
there the destination is a fixed CONFIG_SPL_LOAD_FIT_APPLY_OVERLAY_BUF_SZ
heap buffer.
Pass the size of the destination into load_simple_fit() and reject
an image whose data does not fit before the read is issued. The
check is done in two places: an early bail on len > max_size, then a
bail on the block-aligned size > max_size. The size check is the
mathematically binding one because size is len rounded up to the
device block length. The early bail exists so that
get_aligned_image_size() never runs on a hostile len, where its int
arithmetic would invoke signed-integer overflow.
For the overlay path the bound is exact: the caller passes the size
of its temporary buffer. For the firmware, loadables, FDT and FPGA
call sites the destination is wherever the load_addr field points,
with no defined upper limit at the call site. Those callers pass
CONFIG_SYS_BOOTM_LEN as a conservative ceiling, matching the same
limit spl_parse_legacy_validate() already applies to legacy images.
It is not a tight bound on the actual capacity at the destination,
just a cap that rejects implausibly-sized data.
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Rick and Leo are no longer with Andes. Remove Rick from the RISC-V
maintainer list. Leo will continue maintaining RISC-V, but update his
email address. Add myself to the maintainer list as Rick's replacement.
Signed-off-by: Leo Yu-Chi Liang <leo.liang@sifive.com>
Signed-off-by: Tim Ouyang <tim609@andestech.com>
Enable multiple DTB support in the FIT image for the Spacemit K1 SoC,
allowing a single U-Boot binary to support different board variants.
The SPL reads the board type from EEPROM and selects the corresponding
device tree at runtime via board_fit_config_name_match(), ensuring the
correct hardware description is passed to U-Boot proper.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
When CONFIG_MULTI_DTB_FIT is enabled, the FIT image contains multiple
device tree configurations for different boards. The default
configuration must be explicitly set to ensure the FIT framework
traverses all available configurations instead of falling back to
CONFIG_DEFAULT_DEVICE_TREE.
Without this default property, fit_find_config_node() will use
CONFIG_DEFAULT_DEVICE_TREE as the configuration name to match.
This prevents the SPL from correctly selecting the appropriate
DTB based on runtime board detection (e.g., from EEPROM).
Remove the conditional guard so that "default = conf-1" is always
present in the FIT image, regardless of CONFIG_MULTI_DTB_FIT.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Add nor_early_init() to probe the QSPI controller and SPI NOR flash
in SPL. Switch spl_boot_device() to BOOT_DEVICE_SPI so the board
boots from SPI flash.
Change the default device tree to k1-musepi-pro, whose u-boot
overlay already defines the QSPI controller and flash node with
bootph-pre-ram markers. Enable the required SPI driver model and
flash config options.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
spi_nor_remove() is only implemented in spi-nor-core.o, not spi-nor-tiny.o.
So make spi_nor_remove() only valid for CONFIG_SPI_FLASH_SOFT_RESET.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
The K1 SPL patchset requires DDR firmware integration and FSBL signing
steps that are not covered by existing documentation. Add a SoC-level
guide so reviewers and developers can build and test on hardware.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
Add Spacemit P1 SoC support in SPL. And set the default voltage
for BUCKs and LDOs.
Also update MAINTAINERS: add Guodong Xu as co-maintainer, list the
u-boot-spacemit mailing list, register the new K1 driver files (i2c,
PMIC, regulator), and fix a pre-existing '@@' typo in Huan Zhou's
email.
Fixes: 1cd239f444 ("riscv: spacemit: bananapi_f3: initial support added")
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
Include DDR initialization firmware in the SPL image. The firmware
path can be specified via the DDR_FW_FILE environment variable. If
the firmware is not found, an empty placeholder file is created to
allow the build to proceed without DDR initialization support.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
Initialize clock and serial devices in SPL. Otherwise, the device
driver won't be loaded in SPL.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
Make the K1 clock controllers visible to SPL by tagging the four root
fixed clocks (osc_32k, vctcxo_{1,3,24}m) and the four syscon nodes
(mpmu, pll, apmu, apbc) with bootph-pre-ram in the BPI-F3 U-Boot
overlay.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
