Boot from FSPI requires additional 448 Byte long header, with U-Boot SPL
starting at offset 0x1000. Currently, both i.MX8MM and i.MX8MN attempt
to generate this header using fspi_conf_block with filename pointing at
CONFIG_FSPI_CONF_FILE file. This does not work, for two reasons.
First, the CONFIG_FSPI_CONF_FILE is generated by mkimage -T imx8mimage
and may not be available yet when the fspi_conf_block is evaluated. That
leads to a race condition where highly parallel builds fail to find the
CONFIG_FSPI_CONF_FILE, which is usually called fspi_header.bin, on first
build attempt.
Second, binman gets confused and patches incorrect offset of DDR PHY
firmware blobs into U-Boot SPL, the offset is incremented by exactly
0x1000 which is the size of fspi_conf_block.
Fix both problems at once, make imx8mimage handle the generated FSPI
header and prepend it in front of the imx8mimage processed data. This
way, the race condition is solved, because the data generated by the
imx8mimage are surely combined only after mkimage -T imx8mimage ran.
The binman offset calculation is also solved, because there is no
fspi_conf_block node in the DT anymore.
Signed-off-by: Marek Vasut <marex@nabladev.com>
Should not use CONFIG_IMX_TMU to determine the print of CPU market
segment information. Only iMX8 platforms don't have segment fuse.
And there is no extended commercial part on iMX9 (91/93/94/95),
fix it to extended industrial.
Signed-off-by: Ye Li <ye.li@nxp.com>
The following failure occurs right before switching to the kernel:
data abort
pc : [<9ff60162>] lr : [<9ff79d13>]
reloc pc : [<8781c162>] lr : [<87835d13>]
sp : 9bf30f78 ip : 9bf4b140 fp : 007963a0
r10: fffffdfb r9 : 9bf3bed0 r8 : 00004600
r7 : 00000000 r6 : 9ffe5a0c r5 : 00004600 r4 : 9bf4acf0
r3 : f5f5f5f5 r2 : f5f5f5f5 r1 : 9ffe0c5c r0 : 9bf7c130
Flags: NzCv IRQs off FIQs off Mode SVC_32 (T)
Code: 9ffe b158 e9d0 2300 (6053) 601a
Resetting CPU ...
This is due to the fact that the board uses a shared MDIO bus for
both ethernet controllers, but FEC_MXC_SHARE_MDIO is not enabled.
This results in a double free in fecmxc_remove(). To fix this
enable CONFIG_DM_MDIO so the shared MDIO is correctly detected
from the devicetree.
Fixes: 048fdda977 ("imx: kontron-sl-mx6ul: Enable second ethernet interface")
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
The ram_alias_checks addresses are 32 bit values. When summed as 64 bit
values the calculation is done correctly, otherwise, if they are summed
as 32 bit values, the sum wraps around.
Fix by adding uintptr_t recast to the base address.
Fixes: 60d8255d8d ("board: toradex: add Toradex Verdin iMX95")
Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
Acked-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Since 5c71f8110, the u-boot.elf produced by dragonboard410c_defconfig no
longer fits in the 1MiB aboot partition it is intended for.
To be precise, this issue occurs on toolchains that have a linker with a
COMMONPAGESIZE > 4K. Since u-boot is hardcoded for 4K granules, we
ensure that the linker doesn't try to align to anything larger than
that, otherwise we're just filling our ELFs with a bunch of useless
zeros.
Suggested-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Signed-off-by: Sam Day <me@samcday.com>
Tested-by: Peter Robinson <pbrobinson@gmail.com>
Fix-ups for the BCM root complex when it is located behind an AXI
bridge and clocked with 54MHz. Some are from kernel commit
377bced88c326, some where picked by Oleksii off a now-stale older
branch. All reworked for the simpler setup code in U-Boot.
Signed-off-by: Torsten Duwe <duwe@suse.de>
Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com>
Tested-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Rework the setup of inbound PCIe windows: use the convenience functions
from Linux kernel commit ae6476c6de187 to calculate the BAR offsets and
factor out the setup code into a separate function.
The Linux kernel first allocates and populates an array of inbound_win[]
and sets the BARs from it later, while U-Boot does it all on the fly,
in one go, so the code is not 1:1 comparable.
Signed-off-by: Torsten Duwe <duwe@suse.de>
Tested-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
A driver for Broadcom rescal reset controllers ported from
linux/drivers/reset/reset-brcmstb-rescal.c to U-Boot.
Signed-off-by: Torsten Duwe <duwe@suse.de>
Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com>
Tested-by: Pedro Falcato <pfalcato@suse.de>
A driver for Broadcom reset controllers ported from
linux/drivers/reset/reset-brcmstb.c to U-Boot.
Signed-off-by: Torsten Duwe <duwe@suse.de>
Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com>
Tested-by: Pedro Falcato <pfalcato@suse.de>
The Linux kernel driver already had support for multiple hardware
variants when the bcm2712 was added (see e.g. linux commit
10dbedad3c818 which is the last in a longer set of changes). This
patch brings in this required infrastructure and adds a
differentiation between 2711 and 2712 register layouts on top.
Signed-off-by: Torsten Duwe <duwe@suse.de>
Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com>
Tested-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
The linux kernel assigns a new domain for every Root Complex where bus
numbering starts from 0 for each domain. U-Boot does not have domains
and uses a flattened bus numbering scheme instead. This means that any
device or bridge on the second enumerated RC will receive a bus number
equal to the last assigned one +1. This bus number contributes to the
address written into the index register, which will select the
configuration space to be read. Compensate for this contribution by
subtracting the base bus number.
Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
Signed-off-by: Torsten Duwe <duwe@suse.de>
Tested-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Add a mapping region for the PCIe bus address spaces to the BCM2712
memory controller setup. Generously merging the PCIe address spaces
works sufficiently well for a boot loader.
Signed-off-by: Torsten Duwe <duwe@suse.de>
Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com>
Tested-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
ulong is 64 bits on 64-bit platforms. Hence, simple_xtoa can
produce up to 16 hex characters + NULL byte. The initrd_filesize
buffer is only 10 bytes which can cause a buffer overflow on
every PXE boot that loads an initrd on an address greater than
4GB.
Increase buffer size to 17 bytes to hold the maximum hex
representation of a 64-bit address.
Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
dhcp_message_type() scans DHCP options looking for a 0xff
end-of-options marker with no check that the scan pointer stays
within the received packet. A server can send a crafted OFFER with
no 0xff terminator and large option length fields, advancing the
pointer past bp_vend[312] into adjacent heap memory.
This is the same class of bug as CVE-2024-42040, which fixed the
related bootp_process_vendor() call site. Fix it by adding an end
parameter to dhcp_message_type() and checking that popt is lower
than end.
Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
dhcp6_parse_options() verifies that an option's declared data fits
within the packet, but does not check that option_len is large
enough for the fixed-size read each case performs. A malicious
DHCP server can send an ADVERTISE with a zero-length IA_NA,
STATUS_CODE, SOL_MAX_RT, or BOOTFILE_PARAM option, causing the
parser to read 2-4 bytes past the option's declared data.
Check option_len value before each dereference of option_ptr.
Signed-off-by: Francois Berder <fberder@outlook.fr>
The net_boot_file_name is a 1024 byte buffer.
However, based on DHCPv6 RFC, bootfile-url length is
specified by option_len, a 16-bit unsigned integer
(valid range: 0-65535).
Hence, one needs to make sure that option_len is less
than the size of net_boot_file_name array before copying
bootfile-url to net_boot_file_name.
Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Currently, the sntp_handler uses data in the UDP packet
regardless of the actual packet size. A OOB read can occur
if the packet is too small.
Fix it by checking the packet length before extracting
seconds from a SNTP packet.
Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
portname consists of dev->parent->name ("icssg0-eth",
"icssg1-eth", or "ethernet") and dev->name is the port node
name ("port@0" or "port@1"). Every board DTS in the repository
produces a string that overflows the buffer:
"icssg1-eth-port@0" 17 chars + NUL = 18 bytes (AM642 EVM, IoT2050)
"ethernet-port@0" 15 chars + NUL = 16 bytes (SR-SOM, phyboard)
This commits increases portname to 64 bytes and replaces sprintf
by snprintf so that any future DT node name cannot overflow it
regardless of length.
Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Correct the rule in .gitignore to skip u_boot_logo.bmp.S artifact which
is generated for any board with CONFIG_VIDEO_LOGO enabled.
Also, correct the stale u_boot_logo name in CLEAN_FILES in top-level
Makefile.
Signed-off-by: Denis Mukhin <dmukhin@ford.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Remove an extra leading dash from the KBUILD_CFLAGS assignment
under the CONFIG_CC_OPTIMIZE_FOR_DEBUG conditional block. The
extra dash breaks the build when CONFIG_CC_OPTIMIZE_FOR_DEBUG
is enabled.
Fixes: 56ae3c2a44 ("Makefile: repair CONFIG_CC_OPTIMIZE_FOR_DEBUG support")
Signed-off-by: Giovanni Santini <santigio2003@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
If the filesystem creation attempted by the FsHelper class fails, the
invocation of the cleanup function will cause a TypeError exception,
because the path of the filesystem itself, fed to os.remove(), will be
None. This will lead to a test failure even in case a skip is instead
wanted.
Such an exception will lead to a backtrace like this:
test/py/tests/test_fs/conftest.py:269: in fs_obj_basic
fsh.mk_fs()
test/py/tests/fs_helper.py:70: in mk_fs
self.fs_img = mk_fs(self.config, self.fs_type, self.size_mb << 20,
test/py/tests/fs_helper.py:246: in mk_fs
check_call(f'mkfs.{fs_lnxtype} {mkfs_opt} {fs_img}', shell=True,
/usr/lib64/python3.14/subprocess.py:420: in check_call
raise CalledProcessError(retcode, cmd)
E subprocess.CalledProcessError: Command '<...>' returned non-zero exit status 1.
During handling of the above exception, another exception occurred:
test/py/tests/test_fs/conftest.py:272: in fs_obj_basic
pytest.skip('Setup failed for filesystem: ' + fs_type + '. {}'.format(err))
E Skipped: Setup failed for filesystem: ext4. Command '<...>' returned non-zero exit status 1.
During handling of the above exception, another exception occurred:
test/py/tests/test_fs/conftest.py:277: in fs_obj_basic
fsh.cleanup()
test/py/tests/fs_helper.py:91: in cleanup
os.remove(self.fs_img)
E TypeError: remove: path should be string, bytes or os.PathLike, not NoneType
Fix this by checking if the variable containing the filesystem path is
valid before attempting to call os.remove() on it.
Fixes: 3691b1e4ce ("test: Convert fs_helper to use a class")
Signed-off-by: Francesco Valla <francesco@valla.it>
Add armada-375-xhci to the compatible list in XHCI MVEBU driver.
Tested with WD MyCloud Gen2 NAS.
Signed-off-by: Tony Dinh <mibodhi@gmail.com>
Reviewed-by: Marek Vasut <marek.vasut+usb@mailbox.org>
Add support for the Geist board based on the Renesas R8A779MD (M3Le) SoC, a
register-compatible variant of the R8A77965 (M3N) with reduced peripherals.
The Geist board design references the Renesas Salvator-X/XS boards, adapting
their configuration for the R8A779MD SoC.
The board will be switched to OF_UPSTREAM once the DTs land in upstream.
Signed-off-by: Huy Bui <huy.bui.pz@bp.renesas.com>
Signed-off-by: Nguyen Tran <nguyen.tran.pz@bp.renesas.com>
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
With commit 17ceb774a1 ("rpi_arm64: Enable MBEDTLS/LWIP/WGET and
WGET_HTTPS"), we can drop the tests for switching from the legacy stack
to lwIP.
Signed-off-by: Tom Rini <trini@konsulko.com>
sdhci_brcmstb_init_2712() reads host->mmc->host_caps to decide whether
to force card-detect for a non-removable eMMC, or to route the CD signal
for a removable SD card. At the time this function runs from
sdhci_bcmstb_probe(), however, host->mmc->host_caps is still zero, that
field is only populated later by the MMC uclass, after the driver's
probe returns. mmc_of_parse() has already filled plat->cfg.host_caps
from the device tree by this point, so check that field instead.
Without the fix, every BCM2712 SDHCI instance takes the else branch and
writes SDIO_CFG_SD_PIN_SEL = SDIO_CFG_SD_PIN_SEL_CARD (0x02), including
the non-removable eMMC on boards such as CM5 on Home Assistant Yellow.
The SDIO_CFG block lies outside the SDHCI core's reset scope, so this
value persists across SDHCI_RESET_ALL into the next stage. On the
BCM2712, having SD_PIN_SEL set to "SD" when the Linux kernel performs
its first set_power(MMC_POWER_UP) write racily prevents the SDHCI
POWER_ON bit from latching (see [1] for the whole backstory) - the
voltage bits stick but POWER_ON drops - which wedges the first CMD0 the
full 10 s software timeout. On Home Assistant Yellow this manifested as
a ~20 s eMMC probe delay on roughly one in two Linux boots when U-Boot
was the previous stage. Booting directly from the Pi firmware (no U-Boot
in between) left SD_PIN_SEL at its default and did not exhibit the race.
Reading plat->cfg.host_caps lets init_2712 see the "non-removable"
property and take the correct branch, leaving SD_PIN_SEL untouched for
the eMMC.
[1] https://github.com/home-assistant/operating-system/pull/3700#issuecomment-4430229511
Fixes: 10127cdbab ("mmc: bcmstb: Add support for bcm2712 SD controller")
Signed-off-by: Jan Čermák <sairon@sairon.cz>
Reviewed-by: Ivan T. Ivanov <iivanov@suse.de>
When the identify buffer crosses a page boundary, PRP2 is used
and dma_addr is advanced to the second page:
dma_addr += (page_size - offset);
The subsequent invalidate_dcache_range() calls then use the
modified dma_addr instead of the original buffer start address.
As a result, the beginning of the identify buffer is not
invalidated and the invalidation range extends past the end of
the buffer.
Fix this by preserving the original DMA buffer address for cache
invalidation.
Suggested-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Prashant Kamble <prashant.kamble223@gmail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260524100625.11135-1-prashant.kamble223@gmail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
CI: https://source.denx.de/u-boot/custodians/u-boot-stm/-/pipelines/30256
- Add support dynamic A/B bank bootup for STM32MP15
- Increase SYS_MALLOC_F_LEN for stm32mp15_defconfig to fix boot with optee-4.10.0
- Enable Arm SMC watchdog for STM32MP1
- Update part number for TM32MP251/3 SoC's family
For this configuration, the watchdog (iwdg1) is secured and managed by
OP-TEE. Add an watchdog node with arm,smc-wdt compatible, and disable
iwdg2 node which is then no more used.
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
No watchdog was enabled for STM32MP13 platform. Add the required flags to
support it. As done for STM32MP15 (in SCMI config) and STM32MP2x, we use
the Arm SMC watchdog. The required nodes were already present in Linux
imported DT files (stm32mp13.dtsi & stm32mp135f-dk.dts).
To enable this SMC watchdog on other platforms based on STM32MP13, check
that both the following flags are enabled in the dedicated config file:
CONFIG_WDT=y
CONFIG_WDT_ARM_SMC=y
And that there is a node in Linux board DT that enables the feature, as
it is done in stm32mp135f-dk.dts:
&arm_wdt {
timeout-sec = <32>;
status = "okay";
};
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Enable the arm watchdog over SMC driver. This allows using a secure
watchdog, based on IWDG1 peripheral and managed by OP-TEE.
The driver will be probed if a watchdog node with "arm,smc-wdt"
compatible is enabled.
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Factorize FWU multi-bank support code common to STM32MP1 and
STM32MP2 platforms into a dedicated shared source file.
No functional change intended.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Following commit 4300f9f4c5 ("board: st: stm32mp25: support dynamic
A/B bank bootup"), this patch enables automatic detection of the active
A/B bank on STM32MP15 platforms by retrieving partition GUIDs from FWU
metadata.
This ensures the system correctly identifies the bootable partitions
even in multi-bank scenarios, falling back to a standard bootable flag
scan if the UUIDs are missing.
To enable A/B bank bootup on STM32MP15 boards, add the following Kconfig
options to the stm32mp15[_basic]_defconfig:
CONFIG_FWU_MULTI_BANK_UPDATE=y
CONFIG_FWU_MDATA=y
CONFIG_FWU_NUM_BANKS=2
CONFIG_FWU_NUM_IMAGES_PER_BANK=3
CONFIG_CMD_FWU_METADATA=y
CONFIG_FWU_MDATA_V2=y
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
The bcm2835 SDHCI driver sets up the MMC host configuration via
sdhci_setup_cfg(), but does not parse generic MMC device tree
properties.
As a result, properties such as bus-width are ignored. On Raspberry Pi
Compute Module 4, the eMMC node describes an 8-bit bus, but U-Boot
initialized the device as 4-bit.
Call mmc_of_parse() before sdhci_setup_cfg() so that generic MMC
properties are folded into the host configuration before the MMC core
selects the bus width.
Before this change, mmc info reported:
Bus Speed: 52000000
Bus Width: 4-bit
After this change, mmc info reports:
Bus Speed: 52000000
Bus Width: 8-bit
Tested on Raspberry Pi Compute Module 4 with onboard eMMC.
Signed-off-by: Liel Harel <liel.harel@gmail.com>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Tested-by: Peter Robinson <pbrobinson@gmail.com> # on the CM4 as well
Enable LWIP and HTTPS on the Raspberry Pi arm64 platform to be able to
use it in the boot process.
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Reviewed-by: Matthias Brugger <mbrugger@suse.com>
The 'brcm,bcm2712-hdmi0' compatible string is used on RPi5.
There appears to be no change that impacts early boot output
on the display controller so add the RPi5 compatible string.
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Reviewed-by: Matthias Brugger <mbrugger@suse.com>
