Commit graph

83049 commits

Author SHA1 Message Date
Paul Barker
07744f2ac0 bus: Optionally include TI sysc driver in SPL/TPL
The TI sysc bus driver is required to allow access to the SPI bus on
am335x platforms. To support SPI boot this driver needs to be enabled in
the SPL/TPL as appropriate.

Signed-off-by: Paul Barker <paul.barker@sancloud.com>
2022-12-02 08:39:00 -05:00
Paul Barker
e92f47c06a bus: TI sysc driver requires DM
This driver does not build if CONFIG_DM is disabled as it uses the
function `dev_get_priv`.

Signed-off-by: Paul Barker <paul.barker@sancloud.com>
2022-12-02 08:39:00 -05:00
Paul Barker
dec64d55af dm: core: Fix iteration over driver_info records
We should only perform additional iteration steps when needed to
initialize the parent of a device. Other binding errors (such as a
missing driver) should not lead to additional iteration steps.

Unnecessary iteration steps can cause issues when memory is tightly
constrained (such as in the TPL/SPL) since device_bind_by_name()
unconditionally allocates memory for a struct udevice. On the SanCloud
BBE this led to boot failure caused by memory exhaustion in the SPL
when booting from SPI flash.

Signed-off-by: Paul Barker <paul.barker@sancloud.com>
2022-12-02 08:39:00 -05:00
Marek Vasut
9f52e765dc MAINTAINERS: Move usb_storage from DFU to USB
The usb_storage.c is the host-side USB mass storage device support,
it is not the DFU/UMS gadget-side implementation. Fix the entry.

Signed-off-by: Marek Vasut <marex@denx.de>
2022-12-02 08:39:00 -05:00
Peter Robinson
1cfba53ca4 config: tools only: add VIDEO to build bmp_logo
Pre 2023.01 the bmp_logo was built as part of the tools-only_defconfig
build, something changed and the VIDEO dep needed to build it
is no longer pulled in so fix that by explicitly defining it.

Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-02 08:39:00 -05:00
Matthias Brugger
58880b5208 MAINTAINERS: add RaspberryPi co-maintainer
Peter accpeted to step up as a co-maintainer for the RPis.
Reflect that in the corresponding MAINTAINERS files.

Signed-off-by: Matthias Brugger <mbrugger@suse.com>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
2022-12-02 08:39:00 -05:00
Mihai Sain
94256dc610 ARM: dts: at91: sama7g5: fix signal name of pin PD8
The signal name of pin PD8 with function D is A22_NANDCLE
as it is defined in the datasheet.

Fixes: 558378a4cd ("ARM: mach-at91: add support for new SoC sama7g5")
Signed-off-by: Mihai Sain <mihai.sain@microchip.com>
2022-12-02 09:48:49 +02:00
Tom Rini
39b81955d3 Merge branch '2022-11-28-networking-updates-and-improvements'
- LiteX Ethernet support, dwc_eth_qos fixes, re-work fixing
  CVE-2022-{30790,30552}, macb race fix, Intel XWAY PHY support
  and add wget command and TCP support.
2022-11-28 13:12:40 -05:00
Tim Harvey
5e6c069b2c phy: add driver for Intel XWAY PHY
Add a driver for the Intel XWAY GbE PHY:
 - configure RGMII using dt phy-mode and standard delay properties
 - use genphy_config

Signed-off-by: Tim Harvey <tharvey@gateworks.com>
2022-11-28 13:06:40 -05:00
Yaron Micher
d1559435d7 net: macb: Fix race caused by flushing unwanted descriptors
The rx descriptor list is in cached memory, and there may be multiple
descriptors per cache-line. After reclaim_rx_buffers marks a descriptor
as unused it does a cache flush, which causes the entire cache-line to
be written to memory, which may override other descriptors in the same
cache-line that the controller may have written to.

The fix skips freeing descriptors that are not the last in a cache-line,
and if the freed descriptor is the last one in a cache-line, it marks
all the descriptors in the cache-line as unused.
This is similarly to what is done in drivers/net/fec_mxc.c

In my case this bug caused tftpboot to fail some times when other
packets are sent to u-boot in addition to the ongoing tftp (e.g. ping).
The driver would stop receiving new packets because it is waiting
on a descriptor that is marked unused, when in reality the descriptor
contains a new unprocessed packet but while freeing the previous buffer
descriptor & flushing the cache, the driver accidentally marked the
descriptor as unused.

Signed-off-by: Yaron Micher <yaronm@hailo.ai>
2022-11-28 13:06:40 -05:00
Ying-Chun Liu (PaulLiu)
d6abc7e2e0 test: cmd: add test for wget command.
Simulate a TCP HTTP server's response for testing wget command.

Signed-off-by: Ying-Chun Liu (PaulLiu) <paul.liu@linaro.org>
Cc: Christian Gmeiner <christian.gmeiner@gmail.com>
Cc: Joe Hershberger <joe.hershberger@ni.com>
Cc: Michal Simek <michal.simek@xilinx.com>
Cc: Ramon Fried <rfried.dev@gmail.com>
Cc: Simon Glass <sjg@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 13:06:40 -05:00
Ying-Chun Liu (PaulLiu)
bfce0ca9d4 doc: cmd: wget: add documentation
Add documentation for the wget command.

Signed-off-by: Ying-Chun Liu (PaulLiu) <paul.liu@linaro.org>
Cc: Christian Gmeiner <christian.gmeiner@gmail.com>
Cc: Joe Hershberger <joe.hershberger@ni.com>
Cc: Michal Simek <michal.simek@xilinx.com>
Cc: Ramon Fried <rfried.dev@gmail.com>
Cc: Simon Glass <sjg@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 13:06:39 -05:00
Ying-Chun Liu (PaulLiu)
cfbae48219 net: Add wget application
This commit adds a simple wget command that can download files
from http server.

The command syntax is
wget ${loadaddr} <path of the file from server>

Signed-off-by: Duncan Hare <DuncanCHare@yahoo.com>
Signed-off-by: Ying-Chun Liu (PaulLiu) <paul.liu@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Cc: Christian Gmeiner <christian.gmeiner@gmail.com>
Cc: Joe Hershberger <joe.hershberger@ni.com>
Cc: Michal Simek <michal.simek@xilinx.com>
Cc: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 13:06:39 -05:00
Ying-Chun Liu (PaulLiu)
a3bf193bf4 net: Add TCP protocol
Currently file transfers are done using tftp or NFS both
over udp. This requires a request to be sent from client
(u-boot) to the boot server.

The current standard is TCP with selective acknowledgment.

Signed-off-by: Duncan Hare <DH@Synoia.com>
Signed-off-by: Duncan Hare <DuncanCHare@yahoo.com>
Signed-off-by: Ying-Chun Liu (PaulLiu) <paul.liu@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Cc: Christian Gmeiner <christian.gmeiner@gmail.com>
Cc: Joe Hershberger <joe.hershberger@ni.com>
Cc: Michal Simek <michal.simek@xilinx.com>
Cc: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 13:06:39 -05:00
Tim Harvey
3cdbbe52f7 drivers: net: aquantia: fix typos
Fix a couple of typos:
- s/Acquantia/Aquantia/
- s/firmare/firmware/

Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 13:06:39 -05:00
Rasmus Villemoes
0686968639 net: deal with fragment-overlapping-two-holes case
With a suitable sequence of malicious packets, it's currently possible
to get a hole descriptor to contain arbitrary attacker-controlled
contents, and then with one more packet to use that as an arbitrary
write vector.

While one could possibly change the algorithm so we instead loop over
all holes, and in each hole puts as much of the current fragment as
belongs there (taking care to carefully update the hole list as
appropriate), it's not worth the complexity: In real, non-malicious
scenarios, one never gets overlapping fragments, and certainly not
fragments that would be supersets of one another.

So instead opt for this simple protection: Simply don't allow the
eventual memcpy() to write beyond the last_byte of the current hole.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-11-28 13:06:39 -05:00
Rasmus Villemoes
087648b5df net: tftp: sanitize tftp block size, especially for TX
U-Boot does not support IP fragmentation on TX (and unless
CONFIG_IP_DEFRAG is set, neither on RX). So the blocks we send must
fit in a single ethernet packet.

Currently, if tftpblocksize is set to something like 5000 and I
tftpput a large enough file, U-Boot crashes because we overflow
net_tx_packet (which only has room for 1500 bytes plus change).

Similarly, if tftpblocksize is set to something larger than what we
can actually receive (e.g. 50000, with NET_MAXDEFRAG being 16384), any
tftp get just hangs because we never receive any packets.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 13:06:39 -05:00
Rasmus Villemoes
4b8c44e39c net: tftp: use IS_ENABLED(CONFIG_NET_TFTP_VARS) instead of #if
Nothing inside this block depends on NET_TFTP_VARS to be set to parse
correctly. Switch to C if() in preparation for adding code before
this (to avoid a declaration-after-statement warning).

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
[trini: Update to cover CONFIG_TFTP_PORT case as well]
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-11-28 13:06:14 -05:00
Rasmus Villemoes
06653c7010 net: fix ip_len in reassembled IP datagram
For some reason, the ip_len field in a reassembled IP datagram is set
to just the size of the payload, but it should be set to the value it
would have had if the datagram had never been fragmented in the first
place, i.e. size of payload plus size of IP header.

That latter value is currently returned correctly via the "len"
variable. And before entering net_defragment(), len does have the
value ntohs(ip->ip_len), so if we're not dealing with a
fragment (so net_defragment leaves *len alone), that relationship of
course also holds after the net_defragment() call.

The only use I can find of ip->ip_len after the net_defragment call is
the ntohs(ip->udp_len) > ntohs(ip->ip_len) sanity check - none of the
functions that are passed the "ip" pointer themselves inspect ->ip_len
but instead use the passed len.

But that sanity check is a bit odd, since the RHS really should be
"ntohs(ip->ip_len) - 20", i.e. the IP payload size.

Now that we've fixed things so that len == ntohs(ip->ip_len) in all
cases, change that sanity check to use len-20 as the RHS.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-11-28 10:25:18 -05:00
Rasmus Villemoes
1817c3824a net: (actually/better) deal with CVE-2022-{30790,30552}
I hit a strange problem with v2022.10: Sometimes my tftp transfer
would seemingly just hang. It only happened for some files. Moreover,
changing tftpblocksize from 65464 to 65460 or 65000 made it work again
for all the files I tried. So I started suspecting it had something to
do with the file sizes and in particular the way the tftp blocks get
fragmented and reassembled.

v2022.01 showed no problems with any of the files or any value of
tftpblocksize.

Looking at what had changed in net.c or tftp.c since January showed
only one remotely interesting thing, b85d130ea0.

So I fired up wireshark on my host to see if somehow one of the
packets would be too small. But no, with both v2022.01 and v2022.10,
the exact same sequence of packets were sent, all but the last of size
1500, and the last being 1280 bytes.

But then it struck me that 1280 is 5*256, so one of the two bytes
on-the-wire is 0 and the other is 5, and when then looking at the code
again the lack of endianness conversion becomes obvious. [ntohs is
both applied to ip->ip_off just above, as well as to ip->ip_len just a
little further down when the "len" is actually computed].

IOWs the current code would falsely reject any packet which happens to
be a multiple of 256 bytes in size, breaking tftp transfers somewhat
randomly, and if it did get one of those "malicious" packets with
ip_len set to, say, 27, it would be seen by this check as being 6912
and hence not rejected.

====

Now, just adding the missing ntohs() would make my initial problem go
away, in that I can now download the file where the last fragment ends
up being 1280 bytes. But there's another bug in the code and/or
analysis: The right-hand side is too strict, in that it is ok for the
last fragment not to have a multiple of 8 bytes as payload - it really
must be ok, because nothing in the IP spec says that IP datagrams must
have a multiple of 8 bytes as payload. And comments in the code also
mention this.

To fix that, replace the comparison with <= IP_HDR_SIZE and add
another check that len is actually a multiple of 8 when the "more
fragments" bit is set - which it necessarily is for the case where
offset8 ends up being 0, since we're only called when

  (ip_off & (IP_OFFS | IP_FLAGS_MFRAG)).

====

So, does this fix CVE-2022-30790 for real? It certainly correctly
rejects the POC code which relies on sending a packet of size 27 with
the MFRAG flag set. Can the attack be carried out with a size 27
packet that doesn't set MFRAG (hence must set a non-zero fragment
offset)? I dunno. If we get a packet without MFRAG, we update
h->last_byte in the hole we've found to be start+len, hence we'd enter
one of

	if ((h >= thisfrag) && (h->last_byte <= start + len)) {

or

	} else if (h->last_byte <= start + len) {

and thus won't reach any of the

		/* overlaps with initial part of the hole: move this hole */
		newh = thisfrag + (len / 8);

		/* fragment sits in the middle: split the hole */
		newh = thisfrag + (len / 8);

IOW these division are now guaranteed to be exact, and thus I think
the scenario in CVE-2022-30790 cannot happen anymore.

====

However, there's a big elephant in the room, which has always been
spelled out in the comments, and which makes me believe that one can
still cause mayhem even with packets whose payloads are all 8-byte
aligned:

    This code doesn't deal with a fragment that overlaps with two
    different holes (thus being a superset of a previously-received
    fragment).

Suppose each character below represents 8 bytes, with D being already
received data, H being a hole descriptor (struct hole), h being
non-populated chunks, and P representing where the payload of a just
received packet should go:

  DDDHhhhhDDDDHhhhDDDD
        PPPPPPPPP

I'm pretty sure in this case we'd end up with h being the first hole,
enter the simple

	} else if (h->last_byte <= start + len) {
		/* overlaps with final part of the hole: shorten this hole */
		h->last_byte = start;

case, and thus in the memcpy happily overwrite the second H with our
chosen payload. This is probably worth fixing...

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-11-28 10:25:18 -05:00
Rasmus Villemoes
ad359d89ec net: compare received length to sizeof(ip_hdr), not sizeof(ip_udp_hdr)
While the code mostly/only handles UDP packets, it's possible for the
last fragment of a fragmented UDP packet to be smaller than 28 bytes;
it can be as small as 21 bytes (an IP header plus one byte of
payload). So until we've performed the defragmentation step and thus
know whether we're now holding a full packet, we should only check for
the existence of the fields in the ip header, i.e. that there are at
least 20 bytes present.

In practice, we always seem to be handed a "len" of minimum 60 from the
device layer, i.e. minimal ethernet frame length minus FCS, so this is
mostly theoretical.

After we've fetched the header's claimed length and used that to
update the len variable, check that the header itself claims to be the
minimal possible length.

This is probably how CVE-2022-30552 should have been dealt with in the
first place, because net_defragment() is not the only place that wants
to know the size of the IP datagram payload: If we receive a
non-fragmented ICMP packet, we pass "len" to receive_icmp() which in
turn may pass it to ping_receive() which does

  compute_ip_checksum(icmph, len - IP_HDR_SIZE)

and due to the signature of compute_ip_checksum(), that would then
lead to accessing ~4G of address space, very likely leading to a
crash.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-11-28 10:25:18 -05:00
Rasmus Villemoes
b0fcc48cb3 net: improve check for no IP options
There's no reason we should accept an IP packet with a malformed IHL
field. So ensure that it is exactly 5, not just <= 5.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 10:25:18 -05:00
Marek Vasut
e9d3fc7e46 net: dwc_eth_qos: Add support for bulk RX descriptor cleaning
Add new desc_per_cacheline property which lets a platform run RX descriptor
cleanup after every power-of-2 - 1 received packets instead of every packet.
This is useful on platforms where (axi_bus_width EQOS_AXI_WIDTH_n * DMA DSL
inter-descriptor word skip count + DMA descriptor size) is less than cache
line size, which necessitates packing multiple DMA descriptors into single
cache line.

In case of TX descriptors, this is not a problem, since the driver always
does synchronous TX, i.e. the TX descriptor is always written, flushed and
polled for completion in eqos_send().

In case of RX descriptors, it is necessary to update their status in bulk,
i.e. after the entire cache line worth of RX descriptors has been used up
to receive data.

Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 10:25:17 -05:00
Marek Vasut
f94d008a9d net: dwc_eth_qos: Split TX and RX DMA rings
Separate TX and RX DMA rings to make their handling slightly clearer.
This is a preparatory patch for bulk RX descriptor flushing.

Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 10:25:17 -05:00
Joel Stanley
3167b4d722 liteeth: LiteX Ethernet device
LiteX is a soft system-on-chip that targets FPGAs. LiteETH is a basic
network device that is commonly used in LiteX designs.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 10:25:17 -05:00
Tom Rini
597e7b784d Merge https://source.denx.de/u-boot/custodians/u-boot-usb
- DWC3 fixes / improvements
2022-11-28 09:35:02 -05:00
Marek Vasut
db5bace4f6 usb: dwc3: Drop support for "snps, ref-clock-period-ns" DT property
Drop support for quickly deprecated DT property "snps,ref-clock-period-ns"
to prevent its proliferation.

Reviewed-by: Sean Anderson <seanga2@gmail.com>
Signed-off-by: Marek Vasut <marex@denx.de>
2022-11-27 15:34:56 +01:00
Sean Anderson
c55ac51a55 usb: dwc3: Program GFLADJ
GUCTL.REFCLKPER can only account for clock frequencies with integer
periods. To address this, program REFCLK_FLADJ with the relative error
caused by period truncation. The formula given in the register reference
has been rearranged to allow calculation based on rate (instead of
period), and to allow for fixed-point arithmetic.

Additionally, calculate a value for 240MHZDECR. This configures a
simulated 240Mhz clock using a counter with one fractional bit (PLS1).

This register is programmed only for versions >= 2.50a, since this is
the check also used by commit db2be4e9e30c ("usb: dwc3: Add frame length
adjustment quirk").

[ marek: Ported from Linux kernel commit
         596c87856e08d ("usb: dwc3: Program GFLADJ") ]

Reviewed-by: Sean Anderson <seanga2@gmail.com>
Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Signed-off-by: Marek Vasut <marex@denx.de> # Port from Linux
2022-11-27 15:34:56 +01:00
Sean Anderson
6bae0eb5b8 usb: dwc3: Calculate REFCLKPER based on reference clock
Instead of using a special property to determine the reference clock
period, use the rate of the reference clock. When we have a legacy
snps,ref-clock-period-ns property and no reference clock, use it
instead. Fractional clocks are not currently supported, and will be
dealt with in the next commit.

[ marek: Ported from Linux kernel commit
         5114c3ee24875 ("usb: dwc3: Calculate REFCLKPER based on reference clock") ]

Reviewed-by: Sean Anderson <seanga2@gmail.com>
Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Signed-off-by: Marek Vasut <marex@denx.de> # Port from Linux
2022-11-27 15:34:56 +01:00
Balaji Prakash J
57548e8bc7 usb: dwc3: reference clock period configuration
Set reference clock period when it differs from dwc3 default hardware
set.

We could calculate clock period based on reference clock frequency. But
this information is not always available. This is the case of PCI bus
attached USB host. For that reason we use a custom property.

Tested (USB2 only) on IPQ6010 SoC based board with 24 MHz reference
clock while hardware default is 19.2 MHz.

[ baruch: rewrite commit message; drop GFLADJ code; remove 'quirk-' from
  property name; mention tested hardware ]

[ marek: Ported from Linux kernel commit
         7bee318838890 ("usb: dwc3: reference clock period configuration") ]

Reviewed-by: Sean Anderson <seanga2@gmail.com>
Signed-off-by: Balaji Prakash J <bjagadee@codeaurora.org>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Marek Vasut <marex@denx.de> # Port from Linux
2022-11-27 15:34:56 +01:00
Marek Vasut
8ae84e6453 usb: dwc3: Cache ref_clk pointer in struct dwc3
Cache ref_clk clock pointer in struct dwc3 . This is a preparatory
patch for subsequent backports from Linux kernel which configure
GFLADJ register content based on the ref_clk rate and therefore need
access to the ref_clk pointer.

It is possible to extract the clock pointer from existing clk_bulk
list of already claimed clock, no need to call clk_get*() again.

Reviewed-by: Sean Anderson <seanga2@gmail.com>
Signed-off-by: Marek Vasut <marex@denx.de>
2022-11-27 15:34:56 +01:00
Marek Vasut
55a95f8f58 usb: Expand buffer size in usb_find_and_bind_driver()
The "generic_bus_%x_dev_%x" string which is printed into this buffer
can be up to 34 characters long ("generic_bus_12345678_dev_12345678").
The buffer would be clipped by snprintf() if both %x were at maximum
range. Make sure the buffer is long enough to cover such possibility.

Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-11-27 12:04:36 +01:00
Tom Rini
27c415ae8b Merge branch '2022-11-23-assorted-fixes'
- Small ubifs updates, mkenvimage fix, ast2600 ram updates, update CI to
  make git happier, spelling fix in K3 code and fix dependencies in
  CMD_CLS
2022-11-24 16:31:02 -05:00
John Keeping
2fdc4c0c49 cmd: fix dependency for CMD_CLS
It seems this symbol was missed when renaming DM_VIDEO -> VIDEO.  Update
it.

Fixes: b86986c7b3 ("video: Rename CONFIG_DM_VIDEO to CONFIG_VIDEO")
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: John Keeping <john@metanate.com>
2022-11-24 16:26:03 -05:00
Bryan Brattlof
4c710fa828 arm: mach-k3: fix spelling mistake "entended" -> "extended"
the macro for the boot data location from rom is misspelled. fix it

Signed-off-by: Bryan Brattlof <bb@ti.com>
2022-11-24 16:26:03 -05:00
Tom Rini
bd181a24c4 CI: Make more use of git safe.directory
We have a number of jobs that will have git complain about needing to
set safe.directory and this being untrue as a fatal error, but then
complete. Set this flag correctly now as it should be used, and may
prevent a future failure.

Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-11-24 16:26:03 -05:00
Dylan Hung
8c7b55724c ram: ast2600: Align the RL and WL setting
Use macro to represent the RL and WL setting to ensure the PHY and
controller setting are aligned.

Review-by: Ryan Chen <ryan_chen@aspeedtech.com>
Signed-off-by: Dylan Hung <dylan_hung@aspeedtech.com>
2022-11-24 16:26:01 -05:00
Dylan Hung
bd1e195421 ram: ast2600: Improve ddr4 timing and signal quality
Adjust the following settings to get better timing and signal quality.

1. write DQS/DQ delay
- 1e6e2304[0]
- 1e6e2304[15:8]

2. read DQS/DQ delay
- 0x1e6e0298[0]
- 0x1e6e0298[15:8]

3. CLK/CA timing
- 0x1e6e01a8[31]

4. Read and write termination
- change RTT_ROM from 40 ohm to 48 ohm (MR1[10:8])
- change RTT_PARK from disable to 48 ohm (MR5[8:6])
- change RTT_WR from 120 ohm to disable (MR2[11:9])
- change PHY ODT from 40 ohm to 80 ohm (0x1e6e0130[10:8])

Note1: Both DDR-PHY and DDR controller have their own registers for DDR4
Mode Registers (MR0~MR6).  This patch introduces macros to synchronize
the MR value on both sides.

Note2: the waveform meansurement can be found in item #21 of Aspeed
AST26x0 Application note (AP note).

Review-by: Ryan Chen <ryan_chen@aspeedtech.com>
Signed-off-by: Dylan Hung <dylan_hung@aspeedtech.com>
2022-11-24 16:25:58 -05:00
Dylan Hung
581df347db ram: ast2600: Fix incorrect statement of the register polling
The condition "~data" in the if-statement is a typo.  The original
intention is to poll if SDRAM_PHYCTRL0_INIT bit equals to 0. So use
"data == 0" for instead.

Besides, the bit[1] of "phy_status" register is hardwired to
SDRAM_PHYCTRL0_INIT (with inverse logic). Since SDRAM_PHYCTRL0_INIT has
already done, remove the unnecessary checking of phy_status[1].

Fixes: fde9314346 ("ram: aspeed: Add AST2600 DRAM control support")
Review-by: Ryan Chen <ryan_chen@aspeedtech.com>
Signed-off-by: Dylan Hung <dylan_hung@aspeedtech.com>
2022-11-24 16:25:54 -05:00
Marek Vasut
c246d69f31 tools: mkenvimage: Drop duplicate crc header include
This header was already included just above version.h,
do not include it twice.

Fixes: 3db7110857 ("crc32: Use the crc.h header for crc functions")
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-11-23 13:06:12 -05:00
Pali Rohár
1853811287 cmd: ubifs: Do not show usage when command fails
Return value -1 cause U-Boot to print usage message. Return value
1 (CMD_RET_FAILURE) indicates failure. So fix return value when ubifs
command starts it execution and fails.

Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Dhruva Gole <d-gole@ti.com>
2022-11-23 13:06:12 -05:00
Pali Rohár
6b752c729e ubifs: Allow to silence debug dumps
Debug dump logs are not always required. Add a new config option
UBIFS_SILENCE_DEBUG_DUMP to silence all debug dumps. On powerpc/mpc85xx
when enabled this will decrease size of U-Boot binary by 11 kB.

Signed-off-by: Pali Rohár <pali@kernel.org>
Tested-by: Tony Dinh <mibodhi@gmail.com>
2022-11-23 13:06:12 -05:00
Tom Rini
d5d9f32579 - Implement setbrg op to meson serial device
- Re-add the old PHY reset binding for nanopi-k2
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPVPGJshWBf4d9CyLd9zb2sjISdEFAmN9DUIACgkQd9zb2sjI
 SdE1zBAAhTdTj1XXUhYRTG78UmcGEvm0Xz8om/Ej9dnIOZiZ1BvhU9XkLF1/qE4T
 0Z0rmhHtFETB7G+TiToHncUqtH5F6R8hSB2+RaChQtTjLmAeYquUFJva5ysFlnhp
 SkwS4fHx7WwEK2/ZD/FlXCWJE98Q1NdsJmIGDvPc6OwIMLlo2IA9C+Ct0ZLHQf7p
 ipgppxVZrqD0qxosPGRraUE2O2MvZRQu3pKdn4BAbZv4X+HrwI7+rv0zyAPRZBUA
 qJjOfpgzqDUqSGgSdGvqHIDbpm3PfzttDjr3W3PnVl3tYFjOXDekdGpQTV+Uvhy2
 1LCpLNYGShInmVrl5X3UGpGzPLodNTfCrz7kqc689nohoyR+/og4jpvctkH5jpek
 Vwi2uTjTHXDqgl6J7S1mExY0x17IR2cfpH5HBSZEmpmuKX53KZHFe1Qbd6QOyBK2
 SUUJO3mQ6zEoMGMTv+XrnBo9hwNNJTh02O1IqQypYxWnSodmAYZ9VYhK3iCx5pXp
 hBfnRzwA63DKvzS5r3IjzubKjDCyWnL4S9Gd5VczcAwwJlgddSgv6+aZd2qJpiVK
 YafUxeR0sCYVs9ccD7WY7Wkb0NivND0BevdEjNEri3KDAlsZuzkbYACHDE3HYzp+
 8pHUrbpxsuxd7MDUiHUTCALwbv5mFDtCfq9S/nCTlmS0OB3aEjY=
 =yEaP
 -----END PGP SIGNATURE-----

Merge tag 'u-boot-amlogic-20221122' of https://source.denx.de/u-boot/custodians/u-boot-amlogic

- Implement setbrg op to meson serial device
- Re-add the old PHY reset binding for nanopi-k2
2022-11-23 10:05:26 -05:00
Tom Rini
19fb8d7945 buildman /binman improvements for handling missing blobs
fix for long-standing image.h warning
 minor fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQFFBAABCgAvFiEEslwAIq+Gp8wWVbYnfxc6PpAIreYFAmN9XKIRHHNqZ0BjaHJv
 bWl1bS5vcmcACgkQfxc6PpAIreapMgf8Ch58wHIG/vxEeYqvcNQAjLOUSKI84Uzp
 XmZju35pIH8ec9Rv9Fq7KPHbCheaBdTTODhemGdYggdEEn9jv4XheQjBnPmUQ044
 kpbv17WPFfV81UERxibSP+/JZlcEFgG4j7eIVVPZuiwHminabTirbB1sXWiar+u9
 03S36MRDKPernJg4xYUFK0vlhvH0oq28cBVfKlm/bhqSmLHHsP5QnVOHB819i6Qs
 cGiyl7oCyec9fjEBy/A48D3NVrhVqtdjLdBvBMz2V0IwhCGh885P3rK7Mt6eCnyD
 L5PcqEo2Ppl5fEoVnRv675x8hmwr3JR7zl3/iAxZCxLI3xmHE565MA==
 =ImUn
 -----END PGP SIGNATURE-----

Merge tag 'dm-pull-22nov22' of https://source.denx.de/u-boot/custodians/u-boot-dm

buildman /binman improvements for handling missing blobs
fix for long-standing image.h warning
minor fixes
2022-11-22 22:14:06 -05:00
Simon Glass
b4574c0e75 test: Disable part of the setexpr test for now
This fails in CI for unknown reasons. Disable the last assert for now.

Signed-off-by: Simon Glass <sjg@chromium.org>
2022-11-22 15:14:25 -07:00
Marek Vasut
d83615bc34 test: cmd: fdt: Add fdt get value test case
Add test case for 'fdt get value' sub command.

The test case can be triggered using:
"
./u-boot -d u-boot.dtb -c 'ut fdt'
"

Acked-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Signed-off-by: Marek Vasut <marex@denx.de>
2022-11-22 15:13:35 -07:00
Marek Vasut
7dfcf2a57f cmd: fdt: Fix iteration over elements above index 1 in fdt get
Always increment both the iterator and pointer into the string
property value by length of the current element + 1 (to cater
for the string delimiter), otherwise the element extracted from
the string property value would be extracted from an offset that
is multiple of the length of the first element, instead of sum
of element lengths until select index.

This fixes 'fdt get value' operation for index above 1 (counting
from index 0).

Acked-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Fixes: 13982ced2c ("cmd: fdt: Add support for reading stringlist property values")
Signed-off-by: Marek Vasut <marex@denx.de>
2022-11-22 15:13:35 -07:00
Sughosh Ganu
0524bfc297 sandbox: Move the capsule GUID declarations to board file
The sandbox config file is to be removed. Move the GUID declarations
needed for capsule update functionality to the board file where they
are used.

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-11-22 15:13:35 -07:00
Heinrich Schuchardt
b3a680a47a sandbox: check lseek return value in handle_ufi_command
Invoking lseek() may result in an error. Handle it.

Addresses-Coverity-ID: 376212 ("Error handling issues  (CHECKED_RETURN)")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-11-22 15:13:35 -07:00
Simon Glass
8dd0059f77 binman: Add documentation for the command line args
Add command-line documentation for binman.

Signed-off-by: Simon Glass <sjg@chromium.org>
2022-11-22 15:13:35 -07:00