load_simple_fit() loads an image stored as external data by reading
it from the boot device with a transfer sized from the FIT data-size
property. That property is listed in exc_prop[] in image-fit-sig.c,
so it is excluded from the configuration signature and stays under
the control of anyone able to modify the boot medium even when
CONFIG_SPL_FIT_SIGNATURE is enabled. The read happens before
fit_image_verify_with_data() checks the image hash, so an inflated
data-size overruns the destination before the corruption can be
detected. The device-tree overlay path is the sharpest case, because
there the destination is a fixed CONFIG_SPL_LOAD_FIT_APPLY_OVERLAY_BUF_SZ
heap buffer.
Pass the size of the destination into load_simple_fit() and reject
an image whose data does not fit before the read is issued. The
check is done in two places: an early bail on len > max_size, then a
bail on the block-aligned size > max_size. The size check is the
mathematically binding one because size is len rounded up to the
device block length. The early bail exists so that
get_aligned_image_size() never runs on a hostile len, where its int
arithmetic would invoke signed-integer overflow.
For the overlay path the bound is exact: the caller passes the size
of its temporary buffer. For the firmware, loadables, FDT and FPGA
call sites the destination is wherever the load_addr field points,
with no defined upper limit at the call site. Those callers pass
CONFIG_SYS_BOOTM_LEN as a conservative ceiling, matching the same
limit spl_parse_legacy_validate() already applies to legacy images.
It is not a tight bound on the actual capacity at the destination,
just a cap that rejects implausibly-sized data.
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Rick and Leo are no longer with Andes. Remove Rick from the RISC-V
maintainer list. Leo will continue maintaining RISC-V, but update his
email address. Add myself to the maintainer list as Rick's replacement.
Signed-off-by: Leo Yu-Chi Liang <leo.liang@sifive.com>
Signed-off-by: Tim Ouyang <tim609@andestech.com>
Enable multiple DTB support in the FIT image for the Spacemit K1 SoC,
allowing a single U-Boot binary to support different board variants.
The SPL reads the board type from EEPROM and selects the corresponding
device tree at runtime via board_fit_config_name_match(), ensuring the
correct hardware description is passed to U-Boot proper.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
When CONFIG_MULTI_DTB_FIT is enabled, the FIT image contains multiple
device tree configurations for different boards. The default
configuration must be explicitly set to ensure the FIT framework
traverses all available configurations instead of falling back to
CONFIG_DEFAULT_DEVICE_TREE.
Without this default property, fit_find_config_node() will use
CONFIG_DEFAULT_DEVICE_TREE as the configuration name to match.
This prevents the SPL from correctly selecting the appropriate
DTB based on runtime board detection (e.g., from EEPROM).
Remove the conditional guard so that "default = conf-1" is always
present in the FIT image, regardless of CONFIG_MULTI_DTB_FIT.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Add nor_early_init() to probe the QSPI controller and SPI NOR flash
in SPL. Switch spl_boot_device() to BOOT_DEVICE_SPI so the board
boots from SPI flash.
Change the default device tree to k1-musepi-pro, whose u-boot
overlay already defines the QSPI controller and flash node with
bootph-pre-ram markers. Enable the required SPI driver model and
flash config options.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
spi_nor_remove() is only implemented in spi-nor-core.o, not spi-nor-tiny.o.
So make spi_nor_remove() only valid for CONFIG_SPI_FLASH_SOFT_RESET.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
The K1 SPL patchset requires DDR firmware integration and FSBL signing
steps that are not covered by existing documentation. Add a SoC-level
guide so reviewers and developers can build and test on hardware.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
Add Spacemit P1 SoC support in SPL. And set the default voltage
for BUCKs and LDOs.
Also update MAINTAINERS: add Guodong Xu as co-maintainer, list the
u-boot-spacemit mailing list, register the new K1 driver files (i2c,
PMIC, regulator), and fix a pre-existing '@@' typo in Huan Zhou's
email.
Fixes: 1cd239f444 ("riscv: spacemit: bananapi_f3: initial support added")
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
Include DDR initialization firmware in the SPL image. The firmware
path can be specified via the DDR_FW_FILE environment variable. If
the firmware is not found, an empty placeholder file is created to
allow the build to proceed without DDR initialization support.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
Initialize clock and serial devices in SPL. Otherwise, the device
driver won't be loaded in SPL.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
Make the K1 clock controllers visible to SPL by tagging the four root
fixed clocks (osc_32k, vctcxo_{1,3,24}m) and the four syscon nodes
(mpmu, pll, apmu, apbc) with bootph-pre-ram in the BPI-F3 U-Boot
overlay.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
K1 SPL runs from on-chip SRAM with a small pre-relocation malloc heap.
Registering the full K1 clock tree would not fit, so split the tree on
CONFIG_SPL_BUILD: the SPL build registers only the subset SPL needs
(currently UART, SDHCI, I2C (TWSI), and their PLL/MPMU/APMU/APBC
ancestors); the non-SPL build keeps the full tree.
Where surviving SPL CCU definitions reference parent clocks outside
that subset, use "clock-dummy", so framework parent lookups still resolve.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
Enable CONFIG_TIMER_EARLY to allow udelay() calls during
early initialization phases. This is required for proper
timing operations before the full timer driver is available.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Tested-by: Songsong Zhang <sszhang@vsit.ai>
Restructure K1 SoC support to handle multiple boards through a single
configuration:
1. Rename bananapi-f3_defconfig to spacemit_k1_defconfig.
2. Move all K1 board files to board/spacemit/k1/.
3. Replace TARGET_BANANAPI_F3 with TARGET_SPACEMIT_K1 and rename the
board's <board>.h header to k1.h.
Eliminates the need for board-specific defconfigs while maintaining
hardware compatibility.
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Link: https://patch.msgid.link/20260519-b4-k1-spl-bring-up-v4-0-3915a2a904c1@riscstar.com
Tested-by: Songsong Zhang <sszhang@vsit.ai>
After the K1 build switched to dts/upstream/, all reset IDs come from
the kernel's per-syscon namespace in
<dt-bindings/clock/spacemit,k1-syscon.h>. Remove the legacy U-Boot-only
reset binding header.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
After the K1 build switched to dts/upstream/src/riscv/spacemit/ and the
local arch/riscv/dts/k1.dtsi was deleted, the legacy
reset-controller@d4050000 DT node no longer exists. The of_match driver
in drivers/reset/reset-spacemit-k1.c (compatible "spacemit,k1-reset")
matches nothing and only sits in the binary as dead code.
Remove the legacy driver file, its Makefile entry, the RESET_SPACEMIT_K1
Kconfig symbol, and its bananapi-f3_defconfig selection. The new
syscon-bound reset driver under drivers/reset/spacemit/ has no
DT of_match of its own and is spawned by the K1 clock drivers, so gate
the subdirectory on CONFIG_CLK_SPACEMIT_K1 instead.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
The K1 build now consumes the kernel device tree via OF_UPSTREAM. The
local copies under arch/riscv/dts/ (k1.dtsi, k1-pinctrl.dtsi,
k1-bananapi-f3.dts) are unreachable; remove them.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Adopt the kernel device tree directly from
dts/upstream/src/riscv/spacemit/k1-bananapi-f3.dts instead of carrying
a forked copy under arch/riscv/dts/.
The U-Boot-only overlay k1-bananapi-f3-u-boot.dtsi carries the binman
description and a memory@0 node, since the upstream kernel DT has no
memory node (RAM is filled in by the bootloader).
Signed-off-by: Guodong Xu <guodong@riscstar.com>
The K1 reset driver in drivers/reset/spacemit/ binds by name (no DT
of_match), so the per-syscon clock drivers must spawn it.
Add a .bind hook to k1_mpmu_clk, k1_apbc_clk and k1_apmu_clk that
calls spacemit_k1_reset_bind() to instantiate a UCLASS_RESET sibling
on the same ofnode.
Also introduce k1_apbc2_clk here. Its kernel DT node has #reset-cells
but no #clock-cells, so the driver exists only as the binding hook
for the apbc2 reset spawn.
With this in place, references such as
resets = <&syscon_apbc RESET_TWSI0>;
in the kernel-mainline DT resolve correctly.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
The existing K1 reset driver (drivers/reset/reset-spacemit-k1.c) binds
via DT of_match against a top-level reset-controller node, but kernel
mainline DT for K1 has no such node: the mpmu, apbc, apmu and apbc2
syscons each spawn their own reset device as an auxiliary of the
clock controller. The legacy driver therefore cannot consume it.
Add a new reset driver at drivers/reset/spacemit/reset-spacemit-k1.c
bound by name from each per-syscon clock driver via
device_bind_driver_to_node(), without DT of_match, mirroring the
kernel's auxiliary-device pattern.
To keep the series bisectable, this driver coexists link-cleanly with
the legacy spacemit,k1-reset driver during the transition. A
follow-up patch that switches the K1 build to
dts/upstream/src/riscv/spacemit/ will drop the legacy driver.
Signed-off-by: Guodong Xu <guodong@riscstar.com>
The K1 SoC exposes four clock providers in the kernel mainline DT: one
PLL controller ("spacemit,k1-pll") and three syscon clock nodes
("spacemit,k1-syscon-{mpmu,apbc,apmu}"). Register a separate
U_BOOT_DRIVER for each.
The controllers register clocks into a single CCF namespace, and a clock
in one controller may parent off a clock owned by another, so a
controller must register only after the controllers that own its parents
have probed. Each probe forces its parent controllers up by driver:
MPMU <- PLL
APMU <- PLL, MPMU
APBC <- PLL, MPMU, APMU
Signed-off-by: Junhui Liu <junhui.liu@pigmoral.tech>
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Signed-off-by: Guodong Xu <guodong@riscstar.com>
The DesignWare SPI controller supports configurable bits_per_word
(typically 4-32 bits), but this was previously hardcoded to 8 bits
in the driver initialization.
This patch enables bits_per_word to be set dynamically by upper-level
device drivers, matching the approach used in Linux. The controller
reads the bits_per_word value from the spi_slave structure during
each transfer, allowing different SPI devices on the same bus to use
different word sizes.
Implementation details:
- Read slave->bits_per_word in dw_spi_xfer() before each transfer
- Validate requested value against controller capabilities (4 to max_xfer)
- Default to 8 bits if not set (maintains backward compatibility)
This follows the Linux model where spi_device drivers set bits_per_word,
and the controller driver reads it in the transfer function. Device
drivers can now set slave->bits_per_word before calling spi_xfer().
Example usage in device driver:
slave->bits_per_word = 16;
spi_xfer(slave, ...);
Backward compatible: Existing drivers that don't set bits_per_word
will continue to work with the default 8-bit transfers.
Signed-off-by: Boon Khai Ng <boon.khai.ng@altera.com>
As part of moving our git forge to a new location, update all references
in tree to point to git.u-boot-project.org now.
Signed-off-by: Tom Rini <trini@konsulko.com>
The U-Boot Mailing-list is moving to the lists.u-boot-project.org
domain, so update all references of list.denx.de to the new
domain in the main README and MAINTAINERS files.
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
The U-Boot Mailing-list is moving to the lists.u-boot-project.org
domain, so update all references of list.denx.de to the new
domain in the documentation.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
The U-Boot Mailing-list is moving to the lists.u-boot-project.org
domain, so update all references of the list.denx.de to the new
domain in the patman code.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
The boundary checks in airoha_clk_enable(), airoha_clk_get_rate(), and
airoha_clk_set_rate() use "id > data->num_clocks" which allows id equal
to num_clocks to pass. Since data->descs[] has exactly num_clocks entries
(indices 0 to num_clocks-1), id=num_clocks results in an out-of-bounds
array access.
This is currently not triggered because the device tree clock IDs are
within bounds, but the check should be defensive. Fix by changing the
comparison from ">" to ">=".
Fixes: d0b81afb5e ("clk: airoha: Add support for Airoha AN7581 SoC clock")
Signed-off-by: Wayen Yan <win847@gmail.com>
Now that we have made bloblist have distinct "find" and "create"
functions, the global data tag "GD_FLG_BLOBLIST_READY" doesn't quite
make sense anymore. Rename it to GD_FLG_BLOBLIST_HANDOFF.
Suggested-by: Raymond Mao <raymondmaoca@gmail.com>
Reviewed-by: Raymond Mao <raymondmaoca@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
I had missed that this series was no longer ready to merge as there are
other issues to resolve.
This reverts commit a5ef184939, reversing
changes made to 4e7a9bb088.
Signed-off-by: Tom Rini <trini@konsulko.com>
On STM32MP157C-DK2, when using the "ums" command, in sleep_thread(),
ctrlc() is called every ~640ms which doesn't allows high reactivity when
user press CTRL+C in U-Boot console.
In sleep_thread() loop, ctrlc() is called every 200000 iterations.
But schedule is called on each loop iteration.
Optimize cyclic_run() in order to not call get_timer_us() on each entry.
This allow to save computation time :
_ before : ctrlc() is called every ~640ms
_ after : ctrlc() is called every ~230ms
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com>
Cc: Marek Vasut <marek.vasut@mailbox.org>
For new patch, b4 is suggested to replace type 'uint64_t' by 'u64' :
CHECK: Prefer kernel type 'u64' over 'uint64_t'
Update cyclic.c accordingly in order to be coherent with following commit.
Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com>
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
Aristo Chen <aristo.chen@canonical.com> says:
vbe_read_fit() loads a firmware-phase FIT from a fixed firmware area on
a block device and then issues a follow-up blk_read() to pull in the
image, and optionally an FDT, referenced by the FIT's image node. The
source offset on the device and the read length both come from the FIT
itself, via data-position or data-offset and data-size. Those properties
live on mutable boot media and can be controlled by an attacker with
write access to the firmware area. On the TPL or VPL path, and on the
bootmeth bootflow path reached via abrec_read_bootflow_fw() and
vbe_simple_read_bootflow_fw(), the follow-up blk_read() runs before any
signature or hash check on the loaded phase.
Patch 1 is a sandbox test-tree preparation. The firmware1 node in
arch/sandbox/dts/test.dts declared area-size = 0xe00000 (14 MiB), but
the binman fw-update section in sandbox_vpl.dtsi is 32 MiB and the FIT
inside it carries ~16 MiB of external data, so the FIT already extended
past the declared area. The mismatch was tolerated because no caller
bounded the external-data load against area_size. Patch 1 raises
area-size to match the binman section size so test_vbe_vpl keeps passing
once the bound is enforced. The patches are ordered so the test is never
broken in the middle of the series.
Patch 2 adds the missing range check, confining the FIT-supplied
[load_addr, load_addr + len) window to [addr, addr + area_size] before
block numbers and lengths are computed, and applying the same constraint
to fdt_load_addr and fdt_size. The check is written in subtraction-only
form against the trusted area_size so the comparison cannot itself
overflow.
Patch 3 adds two sandbox unit tests under test/boot/ that construct
synthetic FITs with out-of-range data-position and oversized data-size,
write them to mmc1, and confirm vbe_read_fit() returns -E2BIG for each
before issuing the follow-up blk_read().
Deferring the external-data blk_read() until after the phase has been
signature-verified would be a stronger structural fix and was discussed
on the v1 thread. Simon confirmed the bounded read is the right first
step and that the verify-then-load change should be a separate series,
so this v3 stays scoped to the bound.
Link: https://lore.kernel.org/r/20260705034414.2247-1-aristo.chen@canonical.com
vbe_read_fit() rejects FITs whose external-data window extends past the
trusted firmware area on disk by returning -E2BIG. Add two sandbox unit
tests that construct synthetic FITs with attacker-controlled
data-position and data-size values, write them to mmc1, and assert
vbe_read_fit() catches each one before issuing the follow-up
blk_read().
vbe_read_fit_oob_position uses a data-position past area_size, which
trips the load_addr - addr > area_size clause. vbe_read_fit_oversize_data
keeps data-position inside the area but picks a data-size that overruns
area_size - (load_addr - addr), tripping the third clause.
The two remaining bound clauses stay unreachable from a sandbox test.
The load_addr < addr guard trivially holds when addr comes from
CONFIG_VAL(TEXT_BASE), which is 0 on sandbox, and the FDT-region bound
sits behind a !CONFIG_SANDBOX guard in vbe_read_fit(), so fdt_size stays
0 and that block is skipped in this test environment.
The new file follows the existing bootstd VBE test layout and writes
the FIT at block 16, past the version and nvdata blocks already used by
bootstd_setup_for_tests().
Suggested-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
vbe_read_fit() loads a firmware-phase FIT from the trusted firmware area
and then issues a blk_read() to pull in the image, and optionally an
FDT, referenced by the FIT image node. The source offset on the device
and the read length both come from the FIT's data-position or data-offset
property and its data-size property, which live on mutable boot media
and can be controlled by an attacker with prior write access to the
firmware area.
Without a range check the resulting blk_read() can read past the
firmware area on the device and, on the non-SPL path, write an
attacker-chosen number of blocks past the malloc(aligned_size) FIT
buffer into adjacent memory. Only the SPL branch routes through
spl_load_simple_fit(), which hashes the data. The external-data block
reached from TPL or VPL, and from the bootflow path via
abrec_read_bootflow_fw() and vbe_simple_read_bootflow_fw(), runs before
any signature or hash check on the loaded phase.
Confine the FIT-supplied [load_addr, load_addr + len) window to
[addr, addr + area_size] before computing block numbers and lengths,
and apply the same constraint to fdt_load_addr and fdt_size. The checks
are written in subtraction-only form against the trusted area_size so
the comparison itself cannot overflow.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
The firmware1 node in test.dts declares area-size = 0xe00000 (14 MiB)
but the binman fw-update section in sandbox_vpl.dtsi is 0x2000000
(32 MiB) and the FIT inside it carries ~16 MiB of external data
(spl + u-boot subimages). The FIT therefore extends past the
declared firmware area, contradicting the documented contract of
vbe_read_fit() that the FIT must fit within @area_size.
The mismatch was tolerated because no caller actually bounded the
external-data load against area_size. Bring the devicetree in line
with the binman section size so the FIT extent stays within the
trusted firmware area, in preparation for vbe_read_fit() enforcing
that bound.
state-offset and version-offset are left as-is; they were already
inside the FIT data region and are not exercised by test_vbe_vpl.
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Aristo ChenandTom Rini
Tim Ouyang
Guodong XuandTim Ouyang
Raymond MaoandTim Ouyang
Junhui LiuandTim Ouyang
Boon Khai NgandTom Rini
Neil ArmstrongandTom Rini
Wayen YanandTom Rini
Patrice ChotardandTom Rini