Pull request efi-2026-07-rc5
CI: https://source.denx.de/u-boot/custodians/u-boot-efi/-/pipelines/30365
Documentation:
* Update urllib3 version for building
* usb: typos 'requird', 'current'
UEFI
* Improve PE-COFF relocation data validation
Devicetree-to-C generator:
* dtoc: test: add missing escape in help text
Neha Malcom Francis <n-francis@ti.com> says:
Update all DDR configuration DTSIs to the latest auto-generated output of
the Sysconfig Tool (DDR Configuration for TDA4x, DRA8x, AM67x, AM68x,
AM69x (0.12.00.0000)) [0]
The auto-generated files must not be modified, but effort will be taken to
change the tool output to adhere to the latest checkpatch.pl rules. J722S
and J721E will also be updated in a subsequent series.
All the changes have been kernel boot tested and memtester has passed (same
as v1, as no functional changes made).
[0] https://dev.ti.com/sysconfig/#/start
Link: https://lore.kernel.org/r/20251103071035.674604-1-n-francis@ti.com
Add a concise section for DDR configuration pointing to the public tool
that can be used to generate the configuration DTSI.
Signed-off-by: Neha Malcom Francis <n-francis@ti.com>
Reviewed-by: Romain Naour <romain.naour@smile.fr>
Jamie Gibbons <jamie.gibbons@microchip.com> says:
This series updates the Microchip PolarFire SoC (MPFS) mailbox driver in
U-Boot.
The first three patches contain a set of bug fixes and cleanups to the
existing driver, fixing MMIO size calculations, and removing invalid
mailbox channel and private-data handling. These changes are independent
of any devicetree updates and fix issues present in the legacy driver.
The final patch adds support for the corrected, syscon-based devicetree
bindings for the MPFS mailbox. Linux has moved to this binding to more
accurately model the hardware, and U-Boot already supports the same
approach for the MPFS clock controller. This patch updates the mailbox
driver accordingly, while retaining support for the legacy binding for
backwards compatibility.
The final patch is required ASAP as boot is currently broken on master
for MPFS generic boards.
Tested on a PolarFire SoC Icicle Kit ES.
Link: https://lore.kernel.org/r/20260518141712.3597880-1-jamie.gibbons@microchip.com
The original PolarFire SoC mailbox devicetree bindings described the
control/status and interrupt registers as standalone reg regions of the
mailbox device. This was incorrect, as these registers are shared system
control blocks and should instead be modeled as syscon devices.
Linux has since corrected this by introducing syscon-based bindings for
the MPFS mailbox and updating the mailbox driver to access the control
and interrupt registers via syscon/regmap. U-Boot, however, continued to
expect the legacy binding, causing mailbox access to fail when using
Linux-aligned devicetrees.
Update the U-Boot MPFS mailbox driver to support the new syscon-based
bindings by resolving the control and sysreg syscon nodes and accessing
the registers through regmap. Support for the legacy mailbox binding is
retained for backwards compatibility with existing firmware-provided
devicetrees.
This brings the U-Boot mailbox driver in line with the corrected hardware
description and matches the behavior of the Linux mailbox driver.
Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Remove an unused and invalid struct mbox_chan pointer from the private
data and fix incorrect memory handling in the probe path, where the
private data structure was allocated.
This change corrects a functional bugs and cleans up the driver without
altering its behavior.
Fixes: 111e9bf6a5 ("mailbox: add PolarFire SoC mailbox driver")
Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
The MPFS mailbox driver declares priv_auto but also allocates a second
private data structure in the legacy probe path and overwrites the
device’s private pointer using dev_set_priv().
This results in leaking the auto-allocated private data and replacing
the driver’s private state mid-probe, which is incorrect usage of the
U-Boot Driver Model and can lead to undefined behavior.
Remove the redundant allocation and dev_set_priv() call so that the
driver consistently uses the auto-allocated private data provided by
U-Boot.
Fixes: 111e9bf6a5 ("mailbox: add PolarFire SoC mailbox driver")
Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Correct the MMIO mapping size calculation, which
previously relied on an invalid start/end subtraction.
This change corrects a functional bug and cleans up the driver without
altering its behavior.
Fixes: 111e9bf6a5 ("mailbox: add PolarFire SoC mailbox driver")
Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
smbios_write_type3() uses SYSID_SM_BASEBOARD_ASSET_TAG (Type 2) instead
of SYSID_SM_ENCLOSURE_ASSET_TAG (Type 3) for the enclosure asset tag.
This causes the enclosure's asset tag to be read from the baseboard
sysinfo field rather than the enclosure-specific one.
Fixes: bcf456dd ("smbios: add detailed smbios information")
Signed-off-by: Frank Böwingloh <f.boewingloh@beckhoff.com>
Cc: Raymond Mao <raymondmaoca@gmail.com>
Cc: Tom Rini <trini@konsulko.com>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Raymond Mao <raymondmaoca@gmail.com>
When applying base relocations from a PE-COFF binary all data must
be treated as untrusted. Add the following checks to
efi_loader_relocate():
* Reject relocation blocks that don't start on a 32-bit aligned
address.
* Reject relocation blocks whose SizeOfBlock is smaller than the
block header, which would cause an unsigned underflow when computing
the entry count.
* A block with SizeOfBlock == 0 is invalid and does not mark the end of
the relocation table.
* Reject relocation blocks that extend beyond the end of the
relocation section.
* Reject individual relocation entries whose target offset, together
with the access width, exceeds the mapped image size, preventing
out-of-bounds writes.
Pass virt_size to efi_loader_relocate() from efi_load_pe() to enable
the per-entry bounds check.
Reported-by: Anas Cherni <anas@calif.io>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
A single percent sign might be interpreted as a string format directive
and shall thus be escaped - doubling it - to actually indicate a
percentage.
Without the escape, pytest fails to run test_fdt.py with the following
error:
ValueError: Test coverage failure
fdt code coverage: Traceback (most recent call last):
File "/usr/lib64/python3.14/argparse.py", line 1748, in _check_help
formatter._expand_help(action)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib64/python3.14/argparse.py", line 676, in _expand_help
return help_string % params
~~~~~~~~~~~~^~~~~~~~
TypeError: %c requires an int or a unicode character, not dict
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/home/user/u-boot/./tools/dtoc/test_fdt", line 1002, in <module>
sys.exit(main())
~~~~^^
File "/home/user/u-boot/./tools/dtoc/test_fdt", line 987, in main
parser.add_argument('-T', '--test-coverage', action='store_true',
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
default=False,
^^^^^^^^^^^^^^
help='run tests and check for 100% coverage')
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.14/argparse.py", line 1562, in add_argument
self._check_help(action)
~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib64/python3.14/argparse.py", line 1750, in _check_help
raise ValueError('badly formed help string') from exc
ValueError: badly formed help string
Fixes: 7640b16660 ("test_fdt: Convert to use argparse")
Signed-off-by: Francesco Valla <francesco@valla.it>
The GitHub dependabot tool has reported two "high" priority bug,
CVE-2026-44431 and CVE-2026-44432, with this package. Update to the
patched version.
Reported-by: GitHub dependabot
Signed-off-by: Tom Rini <trini@konsulko.com>
The SPI NOR minimum subsector size is 4 kiB, update the alignment.
THis is particularly important in case of embedded DUMMY_DDR, which
must be at at least 4 kiB aligned offset.
Fixes: a2b96ece5b ("tools: add i.MX8/8X image support")
Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
The binman imx8mimage now correctly handles generated fspi_header.bin
in its imx8mimage etype. Make use of this, remove fspi_conf_block in
favor of generated fspi_header.bin, and configure imx8mimage accordingly.
Signed-off-by: Marek Vasut <marex@nabladev.com>
The binman imx8mimage now correctly handles generated fspi_header.bin
in its imx8mimage etype. Make use of this, remove fspi_conf_block in
favor of generated fspi_header.bin, and configure imx8mimage accordingly.
Signed-off-by: Marek Vasut <marex@nabladev.com>
Boot from FSPI requires additional 448 Byte long header, with U-Boot SPL
starting at offset 0x1000. Currently, both i.MX8MM and i.MX8MN attempt
to generate this header using fspi_conf_block with filename pointing at
CONFIG_FSPI_CONF_FILE file. This does not work, for two reasons.
First, the CONFIG_FSPI_CONF_FILE is generated by mkimage -T imx8mimage
and may not be available yet when the fspi_conf_block is evaluated. That
leads to a race condition where highly parallel builds fail to find the
CONFIG_FSPI_CONF_FILE, which is usually called fspi_header.bin, on first
build attempt.
Second, binman gets confused and patches incorrect offset of DDR PHY
firmware blobs into U-Boot SPL, the offset is incremented by exactly
0x1000 which is the size of fspi_conf_block.
Fix both problems at once, make imx8mimage handle the generated FSPI
header and prepend it in front of the imx8mimage processed data. This
way, the race condition is solved, because the data generated by the
imx8mimage are surely combined only after mkimage -T imx8mimage ran.
The binman offset calculation is also solved, because there is no
fspi_conf_block node in the DT anymore.
Signed-off-by: Marek Vasut <marex@nabladev.com>
Should not use CONFIG_IMX_TMU to determine the print of CPU market
segment information. Only iMX8 platforms don't have segment fuse.
And there is no extended commercial part on iMX9 (91/93/94/95),
fix it to extended industrial.
Signed-off-by: Ye Li <ye.li@nxp.com>
The following failure occurs right before switching to the kernel:
data abort
pc : [<9ff60162>] lr : [<9ff79d13>]
reloc pc : [<8781c162>] lr : [<87835d13>]
sp : 9bf30f78 ip : 9bf4b140 fp : 007963a0
r10: fffffdfb r9 : 9bf3bed0 r8 : 00004600
r7 : 00000000 r6 : 9ffe5a0c r5 : 00004600 r4 : 9bf4acf0
r3 : f5f5f5f5 r2 : f5f5f5f5 r1 : 9ffe0c5c r0 : 9bf7c130
Flags: NzCv IRQs off FIQs off Mode SVC_32 (T)
Code: 9ffe b158 e9d0 2300 (6053) 601a
Resetting CPU ...
This is due to the fact that the board uses a shared MDIO bus for
both ethernet controllers, but FEC_MXC_SHARE_MDIO is not enabled.
This results in a double free in fecmxc_remove(). To fix this
enable CONFIG_DM_MDIO so the shared MDIO is correctly detected
from the devicetree.
Fixes: 048fdda977 ("imx: kontron-sl-mx6ul: Enable second ethernet interface")
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
The ram_alias_checks addresses are 32 bit values. When summed as 64 bit
values the calculation is done correctly, otherwise, if they are summed
as 32 bit values, the sum wraps around.
Fix by adding uintptr_t recast to the base address.
Fixes: 60d8255d8d ("board: toradex: add Toradex Verdin iMX95")
Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
Acked-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Since 5c71f8110, the u-boot.elf produced by dragonboard410c_defconfig no
longer fits in the 1MiB aboot partition it is intended for.
To be precise, this issue occurs on toolchains that have a linker with a
COMMONPAGESIZE > 4K. Since u-boot is hardcoded for 4K granules, we
ensure that the linker doesn't try to align to anything larger than
that, otherwise we're just filling our ELFs with a bunch of useless
zeros.
Suggested-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Signed-off-by: Sam Day <me@samcday.com>
Tested-by: Peter Robinson <pbrobinson@gmail.com>
Fix-ups for the BCM root complex when it is located behind an AXI
bridge and clocked with 54MHz. Some are from kernel commit
377bced88c326, some where picked by Oleksii off a now-stale older
branch. All reworked for the simpler setup code in U-Boot.
Signed-off-by: Torsten Duwe <duwe@suse.de>
Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com>
Tested-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Rework the setup of inbound PCIe windows: use the convenience functions
from Linux kernel commit ae6476c6de187 to calculate the BAR offsets and
factor out the setup code into a separate function.
The Linux kernel first allocates and populates an array of inbound_win[]
and sets the BARs from it later, while U-Boot does it all on the fly,
in one go, so the code is not 1:1 comparable.
Signed-off-by: Torsten Duwe <duwe@suse.de>
Tested-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
A driver for Broadcom rescal reset controllers ported from
linux/drivers/reset/reset-brcmstb-rescal.c to U-Boot.
Signed-off-by: Torsten Duwe <duwe@suse.de>
Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com>
Tested-by: Pedro Falcato <pfalcato@suse.de>
A driver for Broadcom reset controllers ported from
linux/drivers/reset/reset-brcmstb.c to U-Boot.
Signed-off-by: Torsten Duwe <duwe@suse.de>
Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com>
Tested-by: Pedro Falcato <pfalcato@suse.de>
The Linux kernel driver already had support for multiple hardware
variants when the bcm2712 was added (see e.g. linux commit
10dbedad3c818 which is the last in a longer set of changes). This
patch brings in this required infrastructure and adds a
differentiation between 2711 and 2712 register layouts on top.
Signed-off-by: Torsten Duwe <duwe@suse.de>
Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com>
Tested-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
The linux kernel assigns a new domain for every Root Complex where bus
numbering starts from 0 for each domain. U-Boot does not have domains
and uses a flattened bus numbering scheme instead. This means that any
device or bridge on the second enumerated RC will receive a bus number
equal to the last assigned one +1. This bus number contributes to the
address written into the index register, which will select the
configuration space to be read. Compensate for this contribution by
subtracting the base bus number.
Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
Signed-off-by: Torsten Duwe <duwe@suse.de>
Tested-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Add a mapping region for the PCIe bus address spaces to the BCM2712
memory controller setup. Generously merging the PCIe address spaces
works sufficiently well for a boot loader.
Signed-off-by: Torsten Duwe <duwe@suse.de>
Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com>
Tested-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
ulong is 64 bits on 64-bit platforms. Hence, simple_xtoa can
produce up to 16 hex characters + NULL byte. The initrd_filesize
buffer is only 10 bytes which can cause a buffer overflow on
every PXE boot that loads an initrd on an address greater than
4GB.
Increase buffer size to 17 bytes to hold the maximum hex
representation of a 64-bit address.
Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
dhcp_message_type() scans DHCP options looking for a 0xff
end-of-options marker with no check that the scan pointer stays
within the received packet. A server can send a crafted OFFER with
no 0xff terminator and large option length fields, advancing the
pointer past bp_vend[312] into adjacent heap memory.
This is the same class of bug as CVE-2024-42040, which fixed the
related bootp_process_vendor() call site. Fix it by adding an end
parameter to dhcp_message_type() and checking that popt is lower
than end.
Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
dhcp6_parse_options() verifies that an option's declared data fits
within the packet, but does not check that option_len is large
enough for the fixed-size read each case performs. A malicious
DHCP server can send an ADVERTISE with a zero-length IA_NA,
STATUS_CODE, SOL_MAX_RT, or BOOTFILE_PARAM option, causing the
parser to read 2-4 bytes past the option's declared data.
Check option_len value before each dereference of option_ptr.
Signed-off-by: Francois Berder <fberder@outlook.fr>
The net_boot_file_name is a 1024 byte buffer.
However, based on DHCPv6 RFC, bootfile-url length is
specified by option_len, a 16-bit unsigned integer
(valid range: 0-65535).
Hence, one needs to make sure that option_len is less
than the size of net_boot_file_name array before copying
bootfile-url to net_boot_file_name.
Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Currently, the sntp_handler uses data in the UDP packet
regardless of the actual packet size. A OOB read can occur
if the packet is too small.
Fix it by checking the packet length before extracting
seconds from a SNTP packet.
Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
portname consists of dev->parent->name ("icssg0-eth",
"icssg1-eth", or "ethernet") and dev->name is the port node
name ("port@0" or "port@1"). Every board DTS in the repository
produces a string that overflows the buffer:
"icssg1-eth-port@0" 17 chars + NUL = 18 bytes (AM642 EVM, IoT2050)
"ethernet-port@0" 15 chars + NUL = 16 bytes (SR-SOM, phyboard)
This commits increases portname to 64 bytes and replaces sprintf
by snprintf so that any future DT node name cannot overflow it
regardless of length.
Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
