When sqfs_read_nest() encounters a symlink it resolves it by calling
itself recursively. In the unfixed code this looks like:
// dirsp is open: inode_table + dir_table still on heap
resolved = sqfs_resolve_symlink(symlink, filename);
ret = sqfs_read_nest(resolved, ...); // recursive: allocates a new
// inode_table + dir_table pair
free(resolved);
goto out;
// out: sqfs_closedir(dirsp) <- parent tables freed HERE, too late
There is no permanent leak: the parent's tables are freed at the
out: label once the recursive call returns. However, for the entire
duration of the recursive call both the parent's inode_table +
dir_table and the child's inode_table + dir_table are live on the
heap simultaneously. On large squashfs images these tables can be
significant in size, and this temporary double allocation may exhaust
the heap budget.
A superficial workaround would be to increase CONFIG_SYS_MALLOC_LEN,
but that wastes memory on all boards and does not address the
structural problem. The correct fix is to change the freeing order:
release the parent directory's resources before recursing. This way
only one set of inode and directory tables is live at any given time,
halving the peak heap usage during symlink resolution.
When heap exhaustion does occur and malloc returns NULL for dir_table
or pos_list inside sqfs_read_directory_table(), the failure is
currently silent and cascading:
- metablks_count is not reset to -1 before the goto out, so the
function returns a positive block count alongside a NULL pointer.
- sqfs_opendir_nest() does not detect the failure (it only checks
metablks_count < 1) and calls sqfs_search_dir() with m_list=NULL.
- sqfs_dir_offset() iterates over m_list[0..n], reading from
addresses 0x0, 0x4, 0x8, ... None of those values match the
inode's start_block, so the function returns -EINVAL.
- The error propagates up as a load failure with no indication
that the root cause was heap exhaustion:
Error: invalid inode reference to directory table.
Failed to load '<symlink path>'
Two fixes:
1. In sqfs_read_directory_table(), set metablks_count = -1 whenever
malloc fails after sqfs_count_metablks() returns a positive value,
so that the caller's "metablks_count < 1" check correctly detects
the failure and avoids calling sqfs_search_dir() with a NULL
pos_list.
2. In sqfs_read_nest() and sqfs_size_nest(), call sqfs_closedir() on
the parent dirsp before the recursive call so that the parent's
inode and directory tables are freed before the child allocates
its own. Only one set of tables is then live at any given time,
halving peak heap usage during symlink resolution.
Link: https://lists.denx.de/pipermail/u-boot/2026-May/618533.html
Reviewed-by: Richard Genoud <richard.genoud@bootlin.com>
Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Allan ELKAIM <allan.elkaim@gmail.com>
Add a contributors file to provide a high level overview
for people who wish to contribute to the project outlining
basic details and setting some project expectations.
This isn't intended to replace any of the existing documentation
but rather provide a succinct top level document that's easy
to find to enable users to understand the project and get
started as quickly as possible.
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
[trini: Correct merge window length, release day and typo in the main
index]
Signed-off-by: Tom Rini <trini@konsulko.com>
Two trivial fixes for 2026.04 , one fix for possible NULL pointer
dereference which was not triggered thus far but got detected on Gen5
RSIP, and one basic disablement of SCIF1 in DT to which a driver was
never bound. But it would be nice to have them corrected.
Disable incorrectly enabled SCIF1 in Renesas R-Car X5H R8A78000 SoC DT.
The SCIF1 should be enabled on board DT level in case it is needed, but
should be disabled in SoC DT by default. This had no adverse effect on
the currently upstream platforms, because those managed to probe only
the HSCIF0 device and SCIF1 was ignored.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
At the very early stage when PHY ID is being auto-detected, the
PHY device is not yet instantiated and rswitch_etha .phydev is
still NULL. Add missing check for this condition and perform C22
fallback access in this PHY ID auto-detection case.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
While USB DFU boot works with this patch, but the non USB boot modes like
SD Boot and flash boot fails for J784S4 EVM device.
So, Reverting this patch.
This reverts commit bfb530e06c.
Signed-off-by: Prasanth Babu Mantena <p-mantena@ti.com>
When patman is used email address is composed together with both email
address from .mailmal file. Having two commit emails is not proper format.
Error:
error: unable to extract a valid address from: Jerome Forissier
<jerome.forissier@arm.comjerome@forissier.org>
Fixes: f2566c3a71 ("MAINTAINERS: update my email address")
Signed-off-by: Michal Simek <michal.simek@amd.com>
Acked-by: Jerome Forissier <jerome.forissier@arm.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
u-boot-dtb.bin is built by concatenating u-boot-nodtb.bin and u-boot.dtb.
u-boot-nodtb.bin, in turn, is generated by objcopy'ing the contents of
u-boot (U-Boot in ELF format) into a raw file.
In order to find the bundled FDT (u-boot.dtb), the code in lib/fdtdec.c
uses the _end symbol. Platform-specific linker scripts ensure that _end is
8-byte aligned, which is required by libfdt.
For the PowerPC MPC83xx platform, the ALIGN(8) directive was outside a
section, with the unfortunate effect that the potentially generated padding
bytes would not be copied by objcopy. This resulted in a discrepancy
between the _end symbol on the one hand, and the size of u-boot-nodtb.bin
and thus the starting location of the actual FDT on the other side. Under
these conditions, the FDT could not be found and boot would fail early.
This commit fixes it by moving the ALIGN(8) into the __u_boot_list section,
which is non-empty and thus copied into u-boot-nodtb.bin.
Signed-off-by: J. Neuschäfer <j.ne@posteo.net>
Reviewed-by: Tom Rini <trini@konsulko.com>
Pull request doc-2026-04-rc6
CI: https://source.denx.de/u-boot/custodians/u-boot-efi/-/pipelines/29687
Documentation:
* TI boards
- fix OP-TEE args
- fix incorrect labels for boot switches
* Fix typo in pstore documentation.
* Fix document references pointing to replaced uImage.FIT.
* buildman: Add missing :: for examples.
* overlay-fdt-boot: .dtbos do not need load addresses.
* When building the documentation use sys.path.append for pytests.
The requirement that .dtbos have load addresses in the FIT image
vanished five years ago with
4c531d9f58 ("fit: Load DTO into temporary buffer and ignore load address")
Fix the documentation accordingly.
Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
Rather than having our "docs" build tagets modify PTYHONPATH, have
doc/conf.py append the required paths at runtime instead. This will
ensure that our builds from readthedocs will also find all of the
required files.
Signed-off-by: Tom Rini <trini@konsulko.com>
Fix 4 instances in buildman.rst where examples were missing :: for
proper formatting. Three cases just had a single : and in one case,
: didn't make grammatical sense, so it gets a stand-alone :: along
with fixing the indent.
Signed-off-by: David Lechner <dlechner@baylibre.com>
Commit 488445cefa ("doc: Move FIT into its own directory") moved the
documentation in doc/uImage.FIT to doc/usage/fit, subsequently all
documents and example sources have been converted to reStructuredText.
Fix (almost) all of the remaining occurrences of the old path and
filenames across the tree.
The exception is doc/uImage.FIT/command_syntax_extensions.txt which
apparently has been removed entirely, or at least I was unable to
locate where that document is now.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The downstream Raspberry Pi uses two namings for the revD
SoC device trees, both bcm2712d0-rpi-5-b and bcm2712-d-rpi-5-b
but it seems upstream has settled on just the later, so lets
use that as it's the name that maps both upstream and downstream.
Fixes: c15a791972 ("board/raspberrypi: add bcm2712d0-rpi-5-b for Raspberry Pi 5")
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Reviewed-by: Matthias Brugger <mbrugger@suse.com>
The msg.c file uses EIO macro defined in errno.h , include errno.h
to avoid build failure:
"
arch/arm/mach-bcm283x/msg.c: In function 'bcm2835_power_on_module':
arch/arm/mach-bcm283x/msg.c:73:25: error: 'EIO' undeclared (first use in this function)
73 | return -EIO;
| ^~~
"
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
With the migration to DM_SERIAL in commit 191b10ac70 ("PowerPC /
Layerscape: Finish migration to DM_SERIAL") a number of platforms were
incorrectly migrated and did not enable SYS_NS16550 despite previously
having enabled the non-DM NS16650 serial driver. Enable these now.
Fixes: 191b10ac70 ("PowerPC / Layerscape: Finish migration to DM_SERIAL")
Reported-by: Michael Walle <mwalle@kernel.org>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Commit bb6f3c0f76 ("armv7: ls102xa: Update SCFG_QSPI_CLKSEL value")
broke the SPI boot on the LS1021ATSN board (ls1021atsn_qspi_defconfig)
at least.
The commit message reads
Update SCFG_QSPI_CLKSEL value : 0xC -> 0x5
which means ClusterPLL/16
The original submitted patch had the following description:
Value 0xC is reserved. Replace it with correct value 0x5 which
is ClusterPLL/16
Unfortunatly, the little information which was there, was stripped even
further. Why is 0x5 the "correct" value? In fact, it seems that the
upper bit is just ignored and thus the value 0xC translates to 0x4 which
is ClusterPLL/20. This, will result in a SPI clock of 60MHz (if the PLL
is clocked at 1.2GHz). But even that is too much for the (default) 03h
read opcode (max 50MHz). Set the value to ClusterPLL/24 which is 50MHz.
Link: https://lore.kernel.org/r/1568804284-25162-1-git-send-email-kuldeep.singh@nxp.com/
Fixes: bb6f3c0f76 ("armv7: ls102xa: Update SCFG_QSPI_CLKSEL value")
Signed-off-by: Michael Walle <mwalle@kernel.org>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Switching to DM_SERIAL disabled any serial driver. Re-enable it again.
Fixes: 191b10ac70 ("PowerPC / Layerscape: Finish migration to DM_SERIAL")
Signed-off-by: Michael Walle <mwalle@kernel.org>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Since switching to DM_SERIAL 'stdout-path' seems to be necessary.
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Related to the problem resolved with commit 2092322b31 ("boot: Add
fit_config_get_hash_list() to build signed node list"), add a testcase
for the problem as well.
Reported-by: Apple Security Engineering and Architecture (SEAR)
Signed-off-by: Tom Rini <trini@konsulko.com>
The functions use 'ulong', however, the comments said 'uint32_t'.
Update the comments to match the prototype.
Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
The MT7622 infracfg and pericfg drivers both use
mtk_common_clk_infrasys_init() for probe, which populates struct
mtk_clk_priv and stores gate definitions in the clk_tree. However,
both drivers were incorrectly wired to mtk_clk_gate_ops which expects
struct mtk_cg_priv with separately populated gates/num_gates/gates_offs
fields from mtk_common_clk_gate_init().
Since those fields were never set, any attempt to enable an infracfg or
pericfg gate clock (e.g. CLK_INFRA_TRNG) would fail with -EINVAL.
Switch both to mtk_clk_infrasys_ops and struct mtk_clk_priv to match
the init function.
Fixes: 72ab603b20 ("clk: mediatek: add driver for MT7622")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: David Lechner <dlechner@baylibre.com>
Updates for RPi for 2026.04-rc4:
- board/raspberrypi: add bcm2712d0-rpi-5-b for Raspberry Pi 5
- board/raspberrypi: add multi-FDT support
- rpi: pass the Video Core logs DT parameter through
- pinctrl: bcm283x: Fix GPIO pull state register values for BCM2711
This commit adds an FDT entry for the d0 stepping of the BCM2712 SoC.
This entry is used by the v1.1 revision of the board
(revision & 0x0f == 1).
Signed-off-by: Filip Kokosiński <filip.kokosinski@gmail.com>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Tested-by: Peter Robinson <pbrobinson@gmail.com>
This patch adds support for multiple FDT files per board model. This is
done by adding the FDTFILES macro, which initializes two rpi_model
struct members: fdtfiles and fdtcount.
The new-style revision codes designate LSB bits as board revision; this
value is used to choose between provided FDTs. The first element of the
fdtfiles list is used should no revision match.
Signed-off-by: Filip Kokosiński <filip.kokosinski@gmail.com>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Tested-by: Peter Robinson <pbrobinson@gmail.com>
Pass the VC logs DT parameter through to the kernel
device tree. This is used by the vclog tool and is
a useful debugging tool.
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Acked-by: Matthias Brugger <mbrugger@suse.com>
BCM2711 has different pull-up/down register values compared to BCM2835
- BCM2835: NONE=0, DOWN=1, UP=2
- BCM2711: NONE=0, UP=1, DOWN=2
This patch fixes the pull state register values for BCM2711.
Fixes: 2c39d975f8 ("pinctrl: bcm283x: Add GPIO pull-up/down control for BCM2835 and BCM2711")
Signed-off-by: Cibil Pankiras <cibil.pankiras@egym.com>
Reviewed-by: Matthias Brugger <mbrugger@suse.com>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Tested-by: Peter Robinson <pbrobinson@gmail.com>
Frieder reports that after the kbuild sync running
make tools-only_defconfig
make cross_tools
fails with
UPD include/generated/timestamp_autogenerated.h
PYMOD rebuild
tools/Makefile:359: *** insufficient number of arguments (1) to function
'filter'. Stop.
make: *** [Makefile:2191: tools] Error 2
After the sync 'hostprogs-always-y' contains the complete list of
the tools we need to strip, so the $(filter) command is not needed.
Fixes: bd3f9ee679 ("kbuild: Bump the build system to 6.1")
Reported-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Tested-by: Frieder Schrempf <frieder.schrempf@kontron.de>
The hashed-nodes property in a FIT signature node lists which FDT paths
are included in the signature hash. It is intended as a hint so should
not be used for verification.
Add a function to build the node list from scratch by iterating the
configuration's image references. Skip properties known not to be image
references. For each image, collect the path plus all hash and cipher
subnodes.
Use the new function in fit_config_check_sig() instead of reading
'hashed-nodes'.
Update the test_vboot kernel@ test case: fit_check_sign now catches the
attack at signature-verification time (the @-suffixed node is hashed
instead of the real one, causing a mismatch) rather than at
fit_check_format() time.
Update the docs to cover this. The FIT spec can be updated separately.
Signed-off-by: Simon Glass <simon.glass@canonical.com>
Closes: https://lore.kernel.org/u-boot/20260302220937.3682128-1-trini@konsulko.com/
Reported-by: Apple Security Engineering and Architecture (SEAR)
Tested-by: Tom Rini <trini@konsulko.com>
Allan ELKAIMandTom Rini
Peter RobinsonandTom Rini
Marek Vasut
Prasanth Babu MantenaandTom Rini
Michal SimekandTom Rini
J. NeuschäferandTom Rini
Rasmus VillemoesandHeinrich Schuchardt
Anshul DalalandHeinrich Schuchardt
David LechnerandHeinrich Schuchardt
Aristo ChenandHeinrich Schuchardt
Daniel GolleandHeinrich Schuchardt
Casey Connolly
Balaji SelvanathanandCasey Connolly
Michael WalleandPeng Fan
Quentin SchulzandTom Rini
Kunihiko HayashiandTom Rini
Filip KokosińskiandPeter Robinson
Cibil PankirasandPeter Robinson
Ilias ApalodimasandTom Rini
Simon GlassandTom Rini