Add handoff headers for the Google Chameleonv3 variants: 480-2 and
270-3. Both files were generated using qts-filter-a10.sh.
Signed-off-by: Paweł Anikiel <pan@semihalf.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
mxs_nand_command() implementation assume that it's working with a
LP NAND, which is a common case nowadays and thus uses two bytes
for column address.
However this is wrong for NAND_CMD_READID and NAND_CMD_PARAM, which
expects only one byte of column address, even for LP NANDs.
This leads to ONFI detection problem with some NAND manufacturer (like
Winbond) but not with others (like Samsung and Spansion)
We fix this with a simple workaround to avoid the 2nd byte column address
for those two commands.
Also align the code with nand_base to support 16 bit devices.
Tested on an iMX6SX device with:
* Winbond W29N04GVSIAA
* Spansion S34ML04G100TF100
* Samsung K9F4G08U00
Tested on imx8mn device with:
* Windbond W29N04GV
Signed-off-by: Andrea Scian <andrea.scian@dave.eu>
CC: Stefano Babic <sbabic@denx.de>
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Reviewed-by: Fabio Estevam <festevam@denx.de>
Passing the mtdparts environment variable to the Linux kernel is
required to properly mount the UBI rootfs.
Co-developed-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
The Linux kernel device tree already specifies the device to be used for
boot console output with a stdout-path property under /chosen.
Co-developed-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
imx8mn_bsh_smm_s2 uses ubifs rootfs, UBI commands are required to flash
it.
Co-developed-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
It allows to boot from NAND.
Co-developed-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
A crafted squashfs image could embed a huge number of empty metadata
blocks in order to make the amount of malloc()'d memory overflow and be
much smaller than expected. Because of this flaw, any random code
positioned at the right location in the squashfs image could be memcpy'd
from the squashfs structures into U-Boot code location while trying to
access the rearmost blocks, before being executed.
In order to prevent this vulnerability from being exploited in eg. a
secure boot environment, let's add a check over the amount of data
that is going to be allocated. Such a check could look like:
if (!elem_size || n > SIZE_MAX / elem_size)
return NULL;
The right way to do it would be to enhance the calloc() implementation
but this is quite an impacting change for such a small fix. Another
solution would be to add the check before the malloc call in the
squashfs implementation, but this does not look right. So for now, let's
use the kcalloc() compatibility function from Linux, which has this
check.
Fixes: c510061303 ("fs/squashfs: new filesystem")
Reported-by: Tatsuhiko Yasumatsu <Tatsuhiko.Yasumatsu@sony.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Tested-by: Tatsuhiko Yasumatsu <Tatsuhiko.Yasumatsu@sony.com>
When running "i2c md 0 0 80000100", the function do_i2c_md parses the
length into an unsigned int variable named length. The value is then
moved to a signed variable:
int nbytes = length;
#define DISP_LINE_LEN 16
int linebytes = (nbytes > DISP_LINE_LEN) ? DISP_LINE_LEN : nbytes;
ret = dm_i2c_read(dev, addr, linebuf, linebytes);
On systems where integers are 32 bits wide, 0x80000100 is a negative
value to "nbytes > DISP_LINE_LEN" is false and linebytes gets assigned
0x80000100 instead of 16.
The consequence is that the function which reads from the i2c device
(dm_i2c_read or i2c_read) is called with a 16-byte stack buffer to fill
but with a size parameter which is too large. In some cases, this could
trigger a crash. But with some i2c drivers, such as drivers/i2c/nx_i2c.c
(used with "nexell,s5pxx18-i2c" bus), the size is actually truncated to
a 16-bit integer. This is because function i2c_transfer expects an
unsigned short length. In such a case, an attacker who can control the
response of an i2c device can overwrite the return address of a function
and execute arbitrary code through Return-Oriented Programming.
Fix this issue by using unsigned integers types in do_i2c_md. While at
it, make also alen unsigned, as signed sizes can cause vulnerabilities
when people forgot to check that they can be negative.
Signed-off-by: Nicolas Iooss <nicolas.iooss+uboot@ledger.fr>
Reviewed-by: Heiko Schocher <hs@denx.de>
Add CAAM support, which is required when enabling HAB secure boot.
Select CONFIG_SPL_DRIVERS_MISC so that CONFIG_IMX_HAB could
build successfully, if selected.
Signed-off-by: Fabio Estevam <festevam@denx.de>
Acked-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Tested-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Do DDR initialization using the procedural mx6_dram_cfg() instead of
programming the MMDC using a raw list of register/value pairs, this
solves some rare boot failures on specific "bad" modules.
Calibration values, DDR geometry are unchanged, memory timings are
updated according to the relevant memory datasheet, no changes on
the power consumption.
For IT temperature range SKUs CL is decreased from 8 to 7 and tFAW
value is increased, for commercial temperature range SKUs some
changes on ODT parameters.
This change was validated over a range of different apalis-imx6 SoM, on
the whole working temperature range with weeks of continuous testing.
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Fabio Estevam <festevam@denx.de>
Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
Currently accessing the SD card on USDHC2 fails with:
=> mmc dev 1
Card did not respond to voltage select! : -110
This is due to the fact that UHS modes are enabled in the defconfig
and the devicetree, but the referenced LDO5 regulator (reg_nvcc_sd)
is not available to switch the data lines from 3.3V to 1.8V mode.
By enabling the regulator driver the vqmmc-supply is now available
and the SD card works also in high speed modes:
=> mmc dev 1
switch to partitions #0, OK
mmc1 is current device
Please note that the board has a GPIO connected to the SD_VSEL signal
of the PMIC. As the driver uses the LDO5CTRL_H register to set the
voltage, we need to make sure that this GPIO (GPIO01_IO4) is set to
a high level.
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Reviewed-by: Fabio Estevam <festevam@denx.de>
Tested-by: Fabio Estevam <festevam@denx.de>
LDO5 has two separate control registers. LDO5CTRL_L is used if the
input signal SD_VSEL is low and LDO5CTRL_H if it is high.
The current driver implementation only uses LDO5CTRL_H. To make this
work on boards that have SD_VSEL connected to a GPIO, we add support
for specifying an optional GPIO and setting it to high at probe time.
In the future we might also want to add support for boards that have
SD_VSEL set to a fixed low level. In this case we need to change the
driver to be able to use the LDO5CTRL_L register.
This is a port of the same change in the Linux kernel:
8c67a11bae88 ("regulator: pca9450: Add SD_VSEL GPIO for LDO5")
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Reviewed-by: Fabio Estevam <festevam@denx.de>
Tested-by: Fabio Estevam <festevam@denx.de>
In case rtt_nom is set to 0 keep ODT disabled (MMDC MPODTCTRL = 0).
No changes required for DDR MR1 Rtt_Nom impedance register, 0 value is
already handled correctly.
No board is currently affected by this change (rtt_nom != 0 on all i.MX6
ddr3 boards), this will be used by a follow-up change.
Fixes: fe0f7f7842 ("mx6: add mmdc configuration for MX6Q/MX6DL")
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Fabio Estevam <festevam@denx.de>
Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
Set CLK01 and CLK02 to 24MHz and enable it in CCM_CCOSR register.
This clock is used by both the audio codec (CLKO1) and by the CSI camera
(CLKO2) and is expected to be 24MHz.
Despite the wrong 16.5MHz there was no real issue because of the wrong
frequency since Linux reconfigures the clocks afterward, however this
was triggering an issue with noise coming from the SGTL5000 audio codec.
The problem is that the SGTL5000 does not have a reset pin and after it
is configured if the input MCLK clock is disabled it produces a constant
noise on its output, this was happening on software reboot.
Forcing the clock to be enabled in U-Boot prevent the problem by making
sure that the clock is always available, without this change as soon as
Linux was changing the clock tree (setting clk_out_sel=1 without setting
clko2_en=1) the noise would start till the actual clock was enabled
(clko2_en=1) during the SGTL5000 driver probe.
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Fabio Estevam <festevam@denx.de>
Fixup thermal trips in Linux device tree according to SoC thermal
grade.
Signed-off-by: Andrejs Cainikovs <andrejs.cainikovs@toradex.com>
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Tested-by: Adam Ford <aford173@gmail.com>
The main attraction are two regressions, plus a fix
for a long standing bug:
- Fix USB support on boards with a switched VBUS regulator.
- Fix failing boot due to env loading on boards without MMC (CHIP).
- Fix PSCI CPU_OFF operation on R40 boards.
The rest are smaller fixes, and the forgotten DT sync for sun4i boards.
linux system will die if we offline one of the cpu on R40 based board:
eg: echo 0 > /sys/devices/system/cpu/cpu3/online
The reason is that the R40 version of sunxi_cpu_set_power always passes
0 for the CPU number, so we turn off CPU0, regardless of what CPU the
CPU_OFF request came for.
Fix this by passing the proper CPU number, as there are proper power
clamp registers for every of the four cores.
Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Commit e42dad4168 ("sunxi: use boot source for determining environment
location") changed our implementation of env_get_location() and enabled
it for every board, even those without MMC support (like the C.H.I.P.
boards). However the default fallback location of ENVL_FAT requires MMC
support compiled in, so the board hangs when trying to initially load
the environment.
Change the algorithm to only return configured environment locations,
and improve the fallback algorithm on the way.
The env_init() routine calling this function here does not behave well
if the return value is ENVL_UNKNOWN on the very first call: it will make
U-Boot proper silently hang very early.
Work around this issue by making sure we return some configured (dummy)
environment location when prio is 0. This for instance happens when
booting via FEL.
This fixes U-Boot loading on the C.H.I.P. boards.
Fixes: e42dad4168 ("sunxi: use boot source for determining environment location")
Reported-by: Chris Morgan <macroalpha82@gmail.com>
Signed-off-by: Samuel Holland <samuel@sholland.org>
[Andre: fix FEL boot case by not returning ENVL_UNKNOWN when prio==0]
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Compatible strings for some new RTC hardware variants were added to
the binding. Add them to the driver in preparation for supporting
those new SoCs.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Reviewed-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
This driver uses simple_strtol(), so it needs SPL_STRTO. Before commit
88ca8e2695 ("disk: Add an option for partitions in SPL"), SPL_STRTO
was always selected indirectly. Now it is not, so select it here.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Reviewed-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Copy the devicetree source for the A10 SoC and all existing boards
verbatim from the Linux v5.18-rc1 tag.
The previous version of this change was only partially applied.
Fixes: 4746694cba ("ARM: dts: sun4i: Sync from Linux v5.18-rc1")
Signed-off-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
The Allwinner USB PHY driver is still using the legacy GPIO interface,
which is now implemented by the DM_GPIO compat functions.
Those seem to have some design flaws, as setting the direction, then
later setting the value will not work, if the DM_GPIO driver is
implementing set_flags.
Fix this by using the dm_ version of the direct GPIO interface, which
uses struct gpio_desc structs to handle requested GPIOs, and actually
keeps the flags we set earlier.
This fixes USB operation on boards which need to toggle the VBUS supply
via a GPIO, like the Teres-I laptop or the BananaPi M2 Berry board.
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reported-by: Milan P. Stanić <mps@arvanta.net>
Reviewed-by: Samuel Holland <samuel@sholland.org>
- fix stb TrueType to check return value of STBTT_malloc()
- remove not required DM_REGULATOR test in stm32 dsi driver
-----BEGIN PGP SIGNATURE-----
iGwEABECACwWIQSC4hxrSoIUVfFO0kRM6ATMmsalXAUCYra5EQ4cYWd1c3RAZGVu
eC5kZQAKCRBM6ATMmsalXB1XAJ9YS0T24BTOYW+5NDE+1xXx8cv1xgCggNpqT5W7
JNtpQwJWDaN341p1ocI=
=QzEZ
-----END PGP SIGNATURE-----
Merge tag 'video-20220625' of https://source.denx.de/u-boot/custodians/u-boot-video
- fix building sandbox with NO_SDL=1
- fix stb TrueType to check return value of STBTT_malloc()
- remove not required DM_REGULATOR test in stm32 dsi driver
The tests on CONFIG_DM_REGULATOR, added to avoid compilation issues, can
now be removed, they are no more needed since the commit 16cc5ad0b4
("power: regulator: add dummy helper").
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
The codes that call STBTT_malloc() / stbtt__new_active() do not check
the return value at present which may cause segfault.
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Building the sandbox with NO_SDL=1 resulted in an undefined reference to
'sandbox_sdl_remove_display'. Resolve this by adding a stub
implementation to match the stubs of the other similar functions.
Signed-off-by: Andrew Scull <ascull@google.com>
Cc: Simon Glass <sjg@chromium.org>
Cc: Anatolij Gustschin <agust@denx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
This was previously needed, but U-Boot is now capable of parsing
the new "phy-connection-type" property that is already used in
the main devicetree.
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Reviewed-by: Fabio Estevam <festevam@denx.de>
This syncs the devicetree files with the latest Linux kernel (5.19-rc2).
This also fixes the currently broken ethernet support:
Before:
Net: Could not get PHY for FEC0: addr 0
After:
Net: eth0: ethernet@30be0000
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Reviewed-by: Fabio Estevam <festevam@denx.de>
Timeouts are not expected to happen and are handled as fatal errors.
Increase all timeouts to 1 second as defensive measure to avoid relying
on the timing behaviour of certain firmware versions or configurations.
Signed-off-by: Janne Grunau <j@jannau.net>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
Tested-by: Mark Kettenis <kettenis@openbsd.org>
The NVMe firmware in the macOS 13 beta blocks or crashes with u-boot's
current minimal RTKit implementation. It does not provide buffers for
the firmware's buffer requests. The ANS2 firmware included in macOS 11
and 12 tolerates this. The firmware included in the first macOS 13 beta
requires buffers for the crashlog and ioreport endpoints to function.
In the case of the NVMe the buffers are physical memory. Access to
physical memory is guarded by what Apple calls SART.
Import m1n1's SART driver (exclusively used for the NVMe controller).
Implement buffer management helpers for RTKit. These are generic since
other devices (none in u-boot so far) require different handling.
Signed-off-by: Janne Grunau <j@jannau.net>
Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
Tested-by: Mark Kettenis <kettenis@openbsd.org>
If CONFIG_VIDEO_DM=n we query the display size from the serial console.
Especially when using a remote console the response can be so late that
it interferes with autoboot.
Only query the console size when running an EFI binary.
Add debug output showing the determined console size.
Reported-by: Fabio Estevam <festevam@gmail.com>
Fixes: a57ad20d07 ("efi_loader: split efi_init_obj_list() into two stages")
Fixes: a9bf024b29 ("efi_loader: disk: a helper function to create efi_disk objects from udevice")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Tested-by: Fabio Estevam <festevam@denx.de>
Tested-by: Heiko Thiery <heiko.thiery@gmail.com>
When the UEFI sub-system is initialized it sends an escape sequence to the
serial console to determine the terminal size. This stops the
run_command_list() function of the console emulation from recognizing the
U-Boot command line prompt.
Add a 'print -e' command as first command in the command list to work
around this issue.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
If printenv -e is executed and the specified variable is not found, the
return value $? of the command should be 1 (false).
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Convert the constant integer to 'phys_size_t' to avoid overflow
when calculating the SDRAM size.
Signed-off-by: Dinesh Maniyam <dinesh.maniyam@intel.com>
Reviewed-by: Tien Fong Chee <tien.fong.chee@intel.com>
There is hardware bug in NCORE CCU IP and it is causing an issue in the
coherent directory tracking of outstanding cache lines.
The workaround is disabling snoop filter.
Signed-off-by: Dinesh Maniyam <dinesh.maniyam@intel.com>
Reviewed-by: Tien Fong Chee <tien.fong.chee@intel.com>
The freeze controller is required for FPGA partial reconfig.
This node is disable on default.
Enable this node via u-boot fdt command when needed.
Signed-off-by: Yau Wai Gan <yau.wai.gan@intel.com>
Signed-off-by: Dinesh Maniyam <dinesh.maniyam@intel.com>
Reviewed-by: Tien Fong Chee <tien.fong.chee@intel.com>
The freeze controller is required for FPGA partial reconfig.
This node is disable on default.
Enable this node via u-boot fdt command when needed.
Signed-off-by: Yau Wai Gan <yau.wai.gan@intel.com>
Signed-off-by: Dinesh Maniyam <dinesh.maniyam@intel.com>
Reviewed-by: Tien Fong Chee <tien.fong.chee@intel.com>
