For AST2600 SPL with CONFIG_SPL_SEPARATE_BSS=y and
CONFIG_OF_SEPARATE=y, fdt_find_separate() expects the appended control
DTB at _image_binary_end.
The AST2600 SPL linker script aligned _image_binary_end via the
.binman_sym_table section. In builds where that section has no emitted
contents, objcopy -O binary does not include the alignment bytes in
spl/u-boot-spl-nodtb.bin. This causes the nodtb binary to end before
_image_binary_end, so the appended DTB is placed too early.
On evb-ast2600 this produced:
sizeof(spl/u-boot-spl-nodtb.bin) = 0xc92c
_image_binary_end = 0xc930
SPL then looked four bytes past the FDT header and failed with:
Missing DTB
No serial driver found
Move the 8-byte alignment into the preceding emitted __u_boot_list
section so the objcopy output and _image_binary_end agree.
Signed-off-by: Quentin Strydom <qstrydom0@gmail.com>
Pull request net-20260623.
net:
- airoha_eth: fix mt7531 mdio related initialization bug
net-legacy:
- cdp: reject CDP TLVs with a length below the 4-byte header
- Clear IP defragmentation state after returning a complete packet
net-lwip:
- Halt ethernet after network commands
cdp_receive() reads a 16-bit TLV length (tlen) from the packet and only
checks that it does not exceed the remaining buffer (tlen > len). It then
unconditionally does "tlen -= 4" to skip the TLV header. As tlen is a
u16, a crafted TLV with a length of 0..3 underflows tlen to ~65532-65535.
For a CDP_APPLIANCE_VLAN_TLV the underflowed length then drives the inner
"while (tlen > 0)" loop, which walks ~64KB past the receive buffer reading
*ss each step -> out-of-bounds read (crash / info-influence). A length of
0 additionally fails to advance pkt/len, hanging the parse loop.
Reject any TLV whose declared length is smaller than its own 4-byte
header. This is the same class of bug as the recent bootp/dhcpv6/sntp/nfs
fixes (unchecked length field), in a sibling LAN parser that was missed.
Verified with a standalone AddressSanitizer harness using the verbatim
cdp_receive()/cdp_compute_csum() routines: a 16-byte CDP frame with an
appliance-VLAN TLV of length 3 triggers a heap-buffer-overflow READ that
the check eliminates.
Fixes: f575ae1f7d ("net: Move CDP out of net.c")
Cc: stable@vger.kernel.org
Signed-off-by: Piyush Paliwal <piyushthepal@gmail.com>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Add a introduce net_lwip_eth_stop() function and use that to stop the
network interface after each command that uses the network.
This makes the behavior the same as the legacy net code and avoids
potential issues with the network interface being left in an active
state after a command finishes.
The start/stop is reference-counted since there is at least one command
(dhcp) that calls another command (tftp) to avoid starting and stopping
the network interface multiple times in a single command.
Signed-off-by: David Lechner <dlechner@baylibre.com>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Change the return values of the lwip implementation of wget_do_request()
to be errno codes instead of command return codes.
wget_do_request() is not a command, so it does not make sense to return
command return codes from it. Also, the legacy network implementation of
wget_do_request() already returns errno codes so it is logical for the
lwip implementation to do the same.
This fixes a bug in try_load_from_uri_path() in efi_manager.c where it
checks that the return value of wget_do_request() is < 0. Before this
change, CMD_RET_FAILURE would not be considered an error since it has a
value of 1.
The value of ENODEV is used in places where there could actually be a
number of different causes of failure and it isn't possible to
discriminate (i.e. failing function returns NULL for all errors). Since
all callers of wget_do_request() don't propagate the error code, it
doesn't matter so much that this is not ideal, at least at this point in
time.
Fixes: 3c656c928b ("net: lwip: add wget command")
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Signed-off-by: David Lechner <dlechner@baylibre.com>
Split wget_do_request() into two functions to make error handling less
error-prone.
After a successful call to net_lwip_new_netif(), net_lwip_remove_netif()
must always be called to prevent leaks. This was missed in the CACERT
section of the code where we returned on error without cleaning up.
Instead of adding more calls to net_lwip_remove_netif(), refactor the
code into two functions. The outer function handles managing the netif
lifecycle. The inner function no longer has to worry about cleaning up
before returning on error.
To keep things simple, the `path` local variable is removed during the
refactoring. Instead, ctx.path is used directly everywhere.
Fixes: 3c656c928b ("net: lwip: add wget command")
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: David Lechner <dlechner@baylibre.com>
Add a unit test for the IP datagram reassembler (CONFIG_IP_DEFRAG) that
covers the duplicate-last-fragment scenario.
Without the fix the last fragment will re-trigger datagram delivery,
increasing udp_rx_count to 2 and effectively failing the test; with it
applied the test passes with udp_rx_count == 1.
Signed-off-by: Mateusz Furdyna <mateusz.furdyna@nokia.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
During the IP defragmentation process, after the reassembly is finished
with the last packet arriving with MF=0, the reassembly state wrt.
static counters is not cleared. In case this last arriving packet with
MF=0 gets duplicated, payload bytes are mistakenly treated as hole data.
A malicious actor who can deliver fragmented IP traffic to a U-Boot
instance with CONFIG_IP_DEFRAG=y can corrupt memory via out-of-bound
writes and redirect control flow into attacker-supplied payload bytes
that already sit in `pkt_buff[]`.
Publicly available AI models are able to generate a reproducer based
on the provided information.
Fix: once the assembled packet has been handed back to the caller, mark
the reassembly state empty so that any further fragment (duplicate,
replay, or a brand-new datagram that happens to reuse the `ip_id`) goes
through the normal re-init path and rebuilds a clean hole list instead
of dereferencing payload bytes as struct hole.
Fixes: 5cfaa4e54d ("net: defragment IP packets")
Reported-by: Mariusz Madej <mariusz.madej@nokia.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Acked-by: Alessandro Rubini <rubini@gnudd.com>
Signed-off-by: Mateusz Furdyna <mateusz.furdyna@nokia.com>
Private data isn't ready during bind time. The call of dev_get_priv()
function will return NULL. Thus we can't save mdio device pointer and
use it later during probe.
To solve an issue, we will move mt7531 mdio device binding to the probing
function of 'airoha-eth' driver.
All GDM ports (except of GDM1) are connected directly to their PHYs, so
corresponding mdio bus will be automatically probed during PHY setup.
GDM1 ports differ from other GDM ports. It connected to the airoha switch
device. The mt7531 mdio bus is used to manage link state of airoha switch
device ports (LAN ports 1-4 corresponds to PHYs 0x09-0x0C). Therefore,
manual probing of mt7531 mdio bus is required to be able set/query states
of corresponding LAN ports.
Fixes: 96d9e7c464 ("net: airoha: use mt7531 mdio for GDM1")
Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
It's possible to interrupt the fastboot command from the U-Boot shell
using the Ctrl-c keybinding.
Document this.
Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Reviewed-by: Sam Day <me@samcday.com>
When the `memory' efi selftest verifies the Devicetree memory reservation,
it accesses the memory_map buffer after it has been freed with free_pool().
Move the verification earlier to fix this.
Fixes: 34c96659ed ("efi_selftest: check fdt is marked as runtime data")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Barebox has now ported some of the UEFI code. In the process
they found some bugs.
In this case when the variable buffer is too small, efi_var_collect()
returns EFI_BUFFER_TOO_SMALL but doesn't free the allocated 'buf'.
Fixes: 5f7dcf079d ("efi_loader: UEFI variable persistence")
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
The `loaded image' efi selftest is comparing protocol GUIDs with the wrong
polarity.
This can be verified on the sandbox, where two protocols GUIDs are
retrieved by the test from the image handle in the following order:
1. Loaded Image Device Path Protocol GUID
2. Loaded Image Protocol GUID
The test matches on the first GUID, while it is in fact looking for the
second one; fix the comparison polarity.
Fixes: efe79a7c0d ("efi_selftest: test for loaded image protocol")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
Cc: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Document support for Renesas Gray Hawk Single development board
based on Renesas R-Car V4M (R8A779H0) SoC.
Fixes: 53066deccb ("ARM: renesas: Add Renesas R8A779H0 V4M Gray Hawk board code")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Document support for Renesas Geist development board
based on Renesas R-Car M3Le (R8A779MD) SoC.
Fixes: c8523795d7 ("arm64: dts: renesas: r8a779md: Add support for R-Car M3Le R8A779MD Geist")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
The RZ/N1D and RZ/N1S contain Cortex-A7 core, which is 32bit ARM core.
Document the SoC as 32bit ARM instead of aarch64.
Fixes: a5b9f95943 ("doc: renesas: add Renesas board docs")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
The read_poll_timeout() macro breaks out of its loop when the condition
evaluates to true. The current code uses "!tx_complete" as the
condition, which means it exits immediately when tx_complete is false
(i.e., transmission has NOT completed yet), rather than waiting for
completion.
Fix the condition to "tx_complete" so that the poll loop waits until
the TCPC signals transmission success/failure/discard before
proceeding.
Without this fix, tcpm_pd_transmit() returns before the TCPC has
finished transmitting, causing the PD state machine to proceed with
stale tx_status values.
Fixes: 1db4c0ac77 ("usb: tcpm: add core framework")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
This is a DRAM controller driver for the R-Car X5H and its enablement.
This makes the U-Boot on RSIP usable beyond U-Boot shell running on
Cortex-M33, as the U-Boot on RSIP can now load not only SCP firmware
into the SCP core STCM, but also TFA BL31, OPTEE-OS and U-Boot into DRAM
and start them on the Cortex-A720AE core. This is self-contained and
affects only the R-Car X5H and a bit of R-Car V4H, besides it went
through rounds of testing until now, therefore it is safe to include it
this late in the release cycle. I know this will make rc5 massive, sorry
about that.
u-boot-dfu-20260616
CI: https://source.denx.de/u-boot/custodians/u-boot-dfu/-/pipelines/30480
Android:
* Fix A/B slot selection when marked successful and tries = 0
Fastboot:
* Handle partial blk_dwrite() as errors instead of success
Usb Gadget:
* Atmel: Use calloc() to initialize endpoint list
Originally, 'make DEVICE_TREE_DEBUG=1' only generated extra output on
the console. But since 6cdd7597a2 ("kbuild: Produce diff between base
DT and U-Boot augmented DT if DEVICE_TREE_DEBUG=1"), that has also
left behind lots of files that clutter the repo and are hard to get
rid of manually.
Make sure that a 'make clean' will remove those files, and add them to
.gitignore.
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Bind the DBSC5 DRAM controller driver on boot in board_early_init_r(),
which brings up the DBSC5 DRAM controller and its PHY and which enables
access to DRAM present on this system.
Add default boot command which loads additional bootloader components
from HF and UFS storage into SRAM and DRAM, and starts those components
on SCP and AP core 0. The system is then capable of reaching U-Boot on
the AP core 0. Specifically, the following components are loaded:
- SCP firmware, 384 kiB from HF offset 0x4c0000 to SCP STCM
- TFA BL31, 256 kiB from UFS0 offset 0x5000 * 4 kiB sectors to DRAM 0x8c200000
- TEE, 2 MiB from UFS0 offset 0x5200 * 4 kiB sectors to DRAM 0x8c400000
- U-Boot, 1 MiB from UFS0 offset 0x7200 * 4 kiB sectors to DRAM 0x8c300000
- IPL parameters table is generated at DRAM address 0x8c100000
Enable pstore command support to allow dumping kernel console from
pstore/ramoops, which is convenient for debugging. Use as follows:
=> pstore set 0x80000000 0x10000 0x400 0x8000 0 0 0
=> pstore display console
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Add Renesas R-Car Gen5 DBSC5 DRAM controller driver. This driver is currently
capable of bringing LPDDR5X DRAM on Renesas R-Car X5H Ironhide board. Further
boards can be supported by supplying board specific DRAM configuration data
via dbsc5_get_board_data().
The driver reuses parts of previous DBSC5 driver, but due to hardware changes,
can not be fully integrated into existing DBSC and DRAM driver, therefore the
currentl DBSC and DRAM drivers are moved into R8A779G0 V4H specific files, and
the R8A78000 X5H files are added in parallel.
The Gen5 DBSC driver is meant to be used in RSIP context, while the Gen4 DBSC
driver is meant to be used in SPL, therefore the Kconfig conditionals have been
adjusted to match.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Add support for Renesas R-Car Gen5 R8A78000 SoC into RT-VRAM
initialization driver. The changes are only a slight adjustment
to the register programming, therefore reuse the existing RT-VRAM
driver and parametrize those changes using driver data.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Loading EFI parts like a Debian-Installer on Rockchip SoCs creates
interesting results, in that on some boards the Grub bootloader can't
find any partitions on a USB-Stick, or loading a kernel from Grub spews
EHCI fail timeout STS_IAA set
messages before failing and on others the loading something like efivars
from an eMMC creates read errors and making the MMC vanish from U-Boot.
This only affected boards with at least 4GB of RAM.
These boards have at least 256MB of memory placed above the actual 4GB
address space (due to the iomem being in between) and while kernel,
initramfs, dt are generally loaded to predefined addresses, additional
EFI parts (efivars, etc) are likely just loaded "somewhere" and it seems
this always landed in that higher up memory part.
Also in the Linux-kernel peripherals like EMMC, USB, etc already run
with a 32bit dma-mask set.
So far, I've seen this on RK3568 and RK3588, but as the same peripherals
are used on most Rockchip SoCs, it makes sense to limit this on all.
So add ARCH_ROCKCHIP to the default-y list of LMB_LIMIT_DMA_BELOW_RAM_TOP.
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Jonas Karlman <jonas@kwiboo.se>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Commit bd3f9ee679 ("kbuild: Bump the build system to 6.1") adds FORCE
as a prerequisite to the if_changed rules here, but the commands use $^
so FORCE leaks in as a stray operand. The dd in cmd_mkalign_mxs fails
(silently, since its stderr is discarded) and the binary is never
aligned, stat in cmd_mkivt_mxs emits an error and cst receives a bogus
argument.
Use $< and $(real-prereqs) instead, which exclude FORCE.
Fixes: bd3f9ee679 ("kbuild: Bump the build system to 6.1")
Signed-off-by: Simon Glass <sjg@chromium.org>
Commit bd3f9ee679 ("kbuild: Bump the build system to 6.1") adds FORCE
as a prerequisite to the u-boot-align.bin rule, but cmd_mkalign_eds
expands $^, so FORCE leaks in as a stray operand. The dd then fails
(silently, since its stderr is discarded) and the following mv never
runs, so u-boot.bin never gains its 4096-byte zero prefix. The mask ROM
enters U-Boot 0x1000 (4KB) into the image and the board never starts,
sitting in BootROM download mode (DnX).
Use $< instead of $^, which excludes FORCE and restores the prefix.
Fixes: bd3f9ee679 ("kbuild: Bump the build system to 6.1")
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
The boot selection rules state that a slot is bootable if it is not
corrupted and either has tries remaining or has already booted
successfully. However, slots that have tries_remaining == 0 and
successful_boot == 1 will be disregarded when picking the slot to
attempt.
Updates the selection logic so slots marked successful remain eligible
even when their tries counter is zero. Debug message now also includes
the successful_boot value.
Signed-off-by: Colin Pinnell McAllister <colinmca242@gmail.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Link: https://patch.msgid.link/20260525003158.11319-1-colinmca242@gmail.com
Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Two fixes for R-Car Gen5 RSIP, one to surely build u-boot-elf.shdr and
one to make u-boot-elf.shdr compatible with tooling.
Two fixes for R-Car Gen4, which could hang in SPL without them.
ARM GIC-600 IP complies with ARM GICv3 architecture, but among others,
implements a power control register in the Redistributor frame. This
register must be programmed to mark the frame as powered on, before
accessing other registers in the frame.
Before the switch to generic lowlevel_init function, this did not pose
a problem as the previous custom lowlevel_init did not access the GICR
registers. The generic function does and that does lead to a hang early
in SPL. Enable the GIC600 initialization variant to mitigate the hang.
Fixes: 37997a214e ("arm: renesas: Use stock lowlevel_init function and remove s_init")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
The mach_cpu_init() function is not invoked in SPL. Instead of
having two functions, fold mach_cpu_init() into board_init_f(),
which is called very early in the boot process and assures that
the CPG and APMU setup will be invoked before DM is brought up.
Fixes: 37997a214e ("arm: renesas: Use stock lowlevel_init function and remove s_init")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
The SDK 4.32 flash_writer tool, built from the SDK IPL source, requires
SREC S7 "Start address (termination)" record [1] at the end of the SREC
file that is sent to it during installation of content into storage,
otherwise the tool waits for the S7 record indefinitelly and the payload
does not get installed into storage.
Specifically, the tool considers SREC S3 and S7 records as mandatory,
S0, S5, S6 as ignored, and any other records as unsupported.
Configure srec_cat such that it explicitly generates the trailing S7
record, and also that it never generates the ignored S5 Count record.
This fixes installation of u-boot-elf.shdr using the flash_writer tool,
which can not finish successfully without the trailing S7 record.
[1] https://en.wikipedia.org/wiki/Motorola_S-record#Record_types
Fixes: 3b2ce3743c ("arm: renesas: Generate u-boot-elf.shdr for R-Car Gen5 RSIP")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Currently, the default build target for all R-Car Gen3/4/5 is the
u-boot-elf.srec, which depends on u-boot.bin and other vital build
artifacts, which get built as prerequisites. The R-Car Gen5 RSIP
port benefits from u-boot-elf.shdr being built as well, because the
u-boot-elf.shdr contains header used by the BootROM to load and
start U-Boot on the RSIP core. Because u-boot-elf.shdr depends on
u-boot-elf.srec, switch the default build target for R-Car Gen5
RSIP port to u-boot-elf.shdr. This way, both u-boot-elf.shdr and
u-boot-elf.srec are built for R-Car Gen5 RSIP port.
Fixes: 9d47a5a4d5 ("arm: renesas: Add Renesas R-Car R8A78000 X5H Cortex-M33 RSIP port")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Franz Schnyder <fra.schnyder@gmail.com> says:
Currently, on the Toradex SMARC iMX95 and the Verdin iMX95 the ENETC
device is not enumerated before network initialization because
pci_init() is not called. As a result, no Ethernet device is registered.
Enable CONFIG_PCI_INIT_R so the PCI buses are enumerated early enough
for the Ethernet Controller to be detected and used.
Link: https://lore.kernel.org/r/20260612-fix-smarc-verdin-imx95-eth-v1-0-851197b36dcc@toradex.com
Currently, the ENETC device on iMX95 is not enumerated before network
initialization because pci_init() is not called. As a result, no
Ethernet device is registered.
Enable CONFIG_PCI_INIT_R so the PCI buses are enumerated early enough
for the Ethernet Controller to be detected and used.
Fixes: 60d8255d8d ("board: toradex: add Toradex Verdin iMX95")
Signed-off-by: Franz Schnyder <franz.schnyder@toradex.com>
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Currently, the ENETC device on iMX95 is not enumerated before network
initialization because pci_init() is not called. As a result, no
Ethernet device is registered.
Enable CONFIG_PCI_INIT_R so the PCI buses are enumerated early enough
for the Ethernet Controller to be detected and used.
Fixes: ff0540fcfe ("board: toradex: add Toradex SMARC iMX95")
Signed-off-by: Franz Schnyder <franz.schnyder@toradex.com>
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
David Lechner
Quentin StrydomandTom Rini
Piyush PaliwalandJerome Forissier
Mateusz FurdynaandJerome Forissier
Mikhail KshevetskiyandJerome Forissier
Francois BerderandMarek Vasut
Mattijs KorpershoekandHeinrich Schuchardt
Vincent StehléandHeinrich Schuchardt
Ilias ApalodimasandHeinrich Schuchardt
Denis MukhinandHeinrich Schuchardt
Peng FanandMarek Vasut
Wadim EgorovandTom Rini
Rasmus VillemoesandTom Rini
Heiko StuebnerandTom Rini
Simon GlassandTom Rini
Zixun LIandMattijs Korpershoek
Colin Pinnell McAllisterandMattijs Korpershoek
Franz SchnyderandTom Rini