- Various patches from Andrew to address issues found by Smatch
- Reinitialize job ring in crypto fsl rng
- Set scaler values for fsl dspi CS-SCK and SCK-CS
u-boot internals were being corrupted following an EFI callback to
get_rng(). One of the many footprints was a corruption of the EFI
protocols linked list.
A request for >16 bytes of random data is broken into smaller requests.
Those requests are fed in a loop to the CAAM RNG, which uses a job
queue ring for interaction.
However, the job queue descriptor is created only at probe time. That
descriptor may end up needing an endian swap (LS1046A) before being fed
to the CAAM RNG. This corrupts the descriptor for the next iteration,
since it will be blindly endian swapped yet again.
Two issues arise. The number of words to endian swap is taken from the
input descriptor itself. So on the second iteration, the length has been
corrupted. This results in a corruption past the end of the descriptor:
whatever is after in memory is endian swapped too. Second, some of the
entries in the descriptor are DMA addresses. If the descriptor is still
somehow considered valid after swapping, the data at the corrupted DMA
address is now trampled.
Linux properly initializes the descriptor for each iteration. This is
what is now done with this commit.
Signed-off-by: Anthony Pighin <anthony.pighin@nokia.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
fsl_dspi: set scaler values for CS-SCK and SCK-CS delays
These values were calculated but not set.
They are required for the calculation of the delays, as stated in the
"QorIQ LS1043A Reference Manual, Rev. 6, 07/2020" page 2172.
The delays are calculated as (1/freq)*PCSSCK*CSSCK and
(1/freq)*PASC*ASC.
Signed-off-by: Tomas Alvarez Vanoli <tomas.alvarez-vanoli@hitachienergy.com> Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
Andrew Goodbody [Mon, 11 Aug 2025 16:25:17 +0000 (17:25 +0100)]
serial: lpuart: Return value from correct variable
In get_lpuart_clk_rate if the call to clk_get_rate returns an error then
the call to return should pass the value of the error which is in rate
rather than ret which will be 0 as its value is not affected by this
error.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Signed-off-by: Peng Fan <peng.fan@nxp.com>
Andrew Goodbody [Fri, 8 Aug 2025 10:29:33 +0000 (11:29 +0100)]
drivers: qe: avoid double free()
Avoid calling free(addr) twice if the device for ucode is not found.
This patch repeats a similar fix but that only applied to code without
CONFIG_TFABOOT enabled. This patch applies to the code with
CONFIG_TFABOOT enabled.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Signed-off-by: Peng Fan <peng.fan@nxp.com>
Andrew Goodbody [Mon, 4 Aug 2025 16:56:59 +0000 (17:56 +0100)]
net: fsl-mc: Incorrect variable used in error path
In mc_fixup_dpc_mac_addr noff is assigned the return value from
fdt_add_subnode so that is the variable that should be passed to
fdt_strerror and returned when negative.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Signed-off-by: Peng Fan <peng.fan@nxp.com>
Andrew Goodbody [Mon, 4 Aug 2025 16:56:58 +0000 (17:56 +0100)]
net: fsl-mc: NULL check dflt_dpni before dereference
In dpni_exit there is a NULL check for dflt_dpni after it is
dereferenced a number of times. Instead move the NULL check to early in
the function. Also assign NULL to dflt_dpni after free in both dpni_init
and dpni_exit.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Signed-off-by: Peng Fan <peng.fan@nxp.com>
Andrew Goodbody [Mon, 4 Aug 2025 16:56:57 +0000 (17:56 +0100)]
net: fsl-mc: NULL check dflt_dpbp before dereference
In dpbp_exit there is a NULL check for dflt_dpbp after it is
dereferenced a number of times. Instead move the NULL check to early in
the function. Also assign NULL to dflt_dpbp after free in both dpbp_init
and dpbp_exit.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Signed-off-by: Peng Fan <peng.fan@nxp.com>
Andrew Goodbody [Mon, 4 Aug 2025 16:56:56 +0000 (17:56 +0100)]
net: fsl-mc: NULL check dflt_dpio before dereference
In dpio_exit there is a NULL check for dflt_dpio but it happens after
dpio_dflt has been dereferenced a number of times already. Instead move
the NULL check to first thing in the function. Also assign NULL to
dflt_dpio after free in both dpio_init and dpio_exit.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Signed-off-by: Peng Fan <peng.fan@nxp.com>
Andrew Goodbody [Mon, 4 Aug 2025 16:56:55 +0000 (17:56 +0100)]
net: fsl_enetc: Fix copy/paste error
In netc_blk_ctrl_probe the test for failure of the function
clk_prepare_enable should not return PTR_ERR(ipg_clk) as it does not
check IS_ERR(ipg_clk) instead it should return err as that is what is
holding the error code in this case.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Signed-off-by: Peng Fan <peng.fan@nxp.com>
Andrew Goodbody [Mon, 4 Aug 2025 16:03:59 +0000 (17:03 +0100)]
net: fm: Correct test for timeout
In memac_wait_until_free and memac_wait_until_done the use of
post-decrement on the test in the while loop for a timeout means that
timeout will be equal to -1 on exit in that case. Adjust the test for
this expected value.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Signed-off-by: Peng Fan <peng.fan@nxp.com>
Andrew Goodbody [Mon, 4 Aug 2025 16:03:58 +0000 (17:03 +0100)]
net: fm: NULL check dev before dereference
In fm_eth_bind there is a dereference of dev before it is NULL checked.
Add a NULL check before the first dereference and remove a later NULL
check that is now redundant.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Signed-off-by: Peng Fan <peng.fan@nxp.com>
Andrew Goodbody [Mon, 4 Aug 2025 16:03:57 +0000 (17:03 +0100)]
net: fm: Correct test for timeout
In bmi_rx_port_disable and bmi_tx_port_disable the use of post-decrement
on the test in the while loop for a timeout means that timeout will be
equal to -1 on exit in that case. Adjust the test for this expected
value.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Signed-off-by: Peng Fan <peng.fan@nxp.com>
Lucien.Jheng [Sun, 17 Aug 2025 15:02:03 +0000 (23:02 +0800)]
misc: fs_loader: Add request_firmware_into_buf_via_script() for flexible firmware loading via U-Boot script
This commit introduces a new API,
request_firmware_into_buf_via_script(), to the fs_loader framework.
This function allows firmware to be loaded into memory using
a user-defined U-Boot script, providing greater flexibility for
firmware loading scenarios that cannot be handled by static file
paths or device/partition selection alone.
Key features:
- The API runs a specified U-Boot script (by name), which is responsible
for loading the firmware into memory by any means (e.g., load from MMC, USB, network, etc.).
- The script must set two environment variables: 'fw_addr'
(the memory address where the firmware is loaded) and
'fw_size' (the size of the firmware in bytes).
- The function validates these variables, copies the firmware into a newly
allocated buffer (using memdup), and returns the pointer
via the provided double pointer argument.
- The maximum allowed firmware size is checked to prevent buffer overflows.
- The environment variables are cleared after use to avoid stale data.
- Detailed error messages are provided for all failure conditions to aid debugging.
Usage example:
1. Define a U-Boot script in the environment that loads the firmware
and sets the required variables:
=> env set my_fw_script 'load mmc 0:1 ${loadaddr} firmware.bin &&
env set fw_addr ${loadaddr} && env set fw_size ${filesize}'
2. In your code, call the new API:
void *fw_buf = NULL;
int ret = request_firmware_into_buf_via_script(&fw_buf, 0x46000000, "my_fw_script");
if (ret < 0)
return ret;
This approach allows board integrators and users to customize the firmware
loading process without modifying the source code,
simply by changing the script in the U-Boot environment.
Signed-off-by: Lucien.Jheng <lucienzx159@gmail.com> Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
[trini: Fix printf of size_t needing to use %zx] Signed-off-by: Tom Rini <trini@konsulko.com>
Tom Rini [Tue, 26 Aug 2025 18:49:35 +0000 (12:49 -0600)]
Merge patch series "Update SoM detection related code and configs"
Wadim Egorov <w.egorov@phytec.de> says:
Update Kconfig options for phyCORE-AM62Ax to align with other boards and
prepare common board code for the upcoming phyCORE-AM62L which has the
SoM EEPROM connected on a different bus.
Wadim Egorov [Fri, 15 Aug 2025 11:10:50 +0000 (13:10 +0200)]
board: phytec: phycore-am62a: Update SoM detection Kconfig options
Drop SUPPORT_EXTENSION_SCAN and enable PHYTEC_SOM_DETECTION_BLOCKS
to align with other PHYTEC platforms. These options were missed when
phyCORE-AM62Ax support was added.
Tom removed an unused TPM driver and fixed a few prints to include
the 'z' prefix for size_t declaratiuons. Andrew fixed an unsigned int
comparision against < 0 in the tpm infineon driver.
Anshul Dalal [Thu, 14 Aug 2025 15:21:43 +0000 (20:51 +0530)]
remoteproc: k3: update compatible for am654 syscon
The existing compatible name for U-Boot's k3 system controller driver
i.e "ti,am625-system-controller" has been added to linux[1] device-tree.
This compatible in kernel is meant for configuring the Control Module
registers (CTRL_MMR0).
However in U-Boot, the matching driver was being used to load the system
firmware on the secure M-cores by the R5 SPL and therefore must be
updated to a different compatible to avoid conflicts.
Therefore, this patch renames all references of the compatible to
"ti,am654-tisci-rproc-r5". The "-r5" is appended so as to avoid any
future conflicts since r5 specific compatibles should only be useful for
U-Boot.
configs: versal2: Add usb_pgood_delay for versal2 boards
Add usb_pgood_delay to ensure proper detection of USB devices.
Increase the USB power good delay for versal2 specific boards,
as certain USB sticks may not be detected without it.
Andrew Goodbody [Mon, 18 Aug 2025 09:24:36 +0000 (10:24 +0100)]
net: axi_emac: Fix timeout test
The timeout test in axi_dma_init is not correct due to the
post-decrement used on the timeout variable which will mean timeout is
not 0 if the timeout occurs. Make the timeout variable an int instead of
a u32 and then test for timeout being -1.
Michal Simek [Tue, 29 Jul 2025 13:55:20 +0000 (15:55 +0200)]
arm64: zynqmp: Add missing ethernet alias for kr260-revB
Ethernet aliases are used in fdt_fixup_ethernet() to inject
local-mac-address in every boot for OS. Similar change has been done for
other carrier cards by commit c4a711253613 ("arm64: zynqmp: Describe
ethernet controllers via aliases on SOM").
Michal Simek [Mon, 28 Jul 2025 07:07:54 +0000 (09:07 +0200)]
fpga: lattice: Remove unused support
There is no single platform which is using this driver that's why remove it
completely. Some issues regarding this code are also reported by Coverity
(CID 583143, 583144, 583145, 583146).
Currently u-boot displayed a zu1cg soc as "Chip: zu1eg".
A value of 0468_8093h in the IDCODE (CSU) Register defines a ZU1 soc
not only for the EG family but also for the CG family as described
in the Xilinx Zynq UltraScale+ UG1085 documentation in Table 1-2.
Andrew Goodbody [Thu, 7 Aug 2025 10:04:05 +0000 (11:04 +0100)]
pinctrl: zynqmp: Avoid using uninitialised variable
In zynqmp_pinconf_set if param is PIN_CFG_IOSTANDARD or
PIN_CONFIG_POWER_SOURCE and zynqmp_pm_pinctrl_get_config returns an
error then value will not be assigned to when its value is tested to be
not equal to arg. Add code to only test value not equal to arg if ret is
false.
Andrew Goodbody [Thu, 7 Aug 2025 10:04:04 +0000 (11:04 +0100)]
pinctrl: zynqmp: Ensure ret is initialised
In zynqmp_pinctrl_prepare_func_groups if called with func->ngroups == 0
then ret will not be assigned to before its value is returned on exit.
Initialise ret to ensure it is always valid.
Andrew Goodbody [Wed, 13 Aug 2025 10:40:05 +0000 (11:40 +0100)]
tpm: tis_infineon: Cannot test unsigned for being negative
tpm_tis_i2c_get_burstcount returns a size_t but also returns -EBUSY if
the TPM is surrently busy. As size_t is an unsigned type simply testing
for < 0 will not work so change the test for being equal to -EBUSY which
will work. Also remove the trivial comments.
Tom Rini [Wed, 6 Aug 2025 14:55:19 +0000 (08:55 -0600)]
tpm: tpm_tis_infineon: Make use of 'z' for printing size_t
When printing the contents of an size_t variable we need to use z prefix
to the format character in order to get the correct format type
depending on 32 or 64bit-ness.
Tom Rini [Wed, 6 Aug 2025 14:55:18 +0000 (08:55 -0600)]
tpm: cr50_i2c: Make use of 'z' for printing size_t
When printing the contents of an size_t variable we need to use z prefix
to the format character in order to get the correct format type
depending on 32 or 64bit-ness.
- Fix the environment location when booting from USB on i.MX93.
- Fix env location when booting from USB on phycore-imx93.
- Fix conflict early SPL malloc address on imx93 boards.
Patrick Delaunay [Wed, 23 Jul 2025 15:09:16 +0000 (17:09 +0200)]
usb: dwc2: fix reset logic in dwc2_core_reset
Use GUSBCFG_FORCEHOSTMODE to detected the HOST forced mode as it is done
in the Linux driver drivers/usb/dwc2/core.c:dwc2_core_reset().
The host polling must be executed only if the current mode is host,
either due to the force HOST mode (which persists after core reset)
or the connector id pin.
The GUSBCFG_FORCEDEVMODE bits is used to force the device mode (for
example used on STM32MP1x platform) and when it is activated the DWC2 reset
failed with the trace:
"dwc2_core_reset: Waiting for GINTSTS_CURMODE_HOST timeout"
Fixes: c5d685b8993c ("usb: dwc2: Unify flush and reset logic with v4.20a support") Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com> Reviewed-by: Junhui Liu <junhui.liu@pigmoral.tech> Tested-by: Patrice Chotard <patrice.chotard@foss.st.com> Reviewed-by: Marek Vasut <marek.vasut@mailbox.org>
Tim Harvey [Mon, 21 Jul 2025 18:02:05 +0000 (11:02 -0700)]
usb: ehci-mx6: Add i.MX95 OTG support
When the usb node is defined dr_mode="otg" ehci_usb_phy_mode() is called
to determine the mode from status registers.
The IMX95RM does not currently define the USBNC STATUS register but it is
assumed to be an omission as the first three registers are defined.
It has been expirimentally verified that the USBNC_PHY_STATUS register
at offset 0x23C bit4 (USBNC_PHYSTATUS_ID_DIG) reads 0 when USB_ID is GND
and 1 when floating.
Use is_imx9() as this driver works for i.MX91, i.MX93 and i.MX95 and all
of these determine the role based on the USBNC_PHY_STATUS register.
Fixes: 801b5fafd35d "(usb: ehci-mx6: Add i.MX95 support") Signed-off-by: Tim Harvey <tharvey@gateworks.com> Reviewed-by: Alice Guo <alice.guo@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Fabio Estevam <festevam@gmail.com>
Tim Harvey [Wed, 9 Jul 2025 15:24:08 +0000 (08:24 -0700)]
phy: phy-imx8mq-usb: Add support for i.MX95 USB3 PHY
Add initial support for i.MX95 USB.30 PHY, which is similar to
the i.MX8MQ and i.MX8MP USB PHY.
The i.MX95 USB3 PHY has a Type-C Assist block (TCA) consisting of two
functional blocks (XBar assist and VBus assist) and is documented
in the i.MX95 RM Chapter 163.3.8 Type-C assist (TCA) block.
Instead of relying on an external MUX for Type-C plug orientation the
XBar can handle the flip internally.
Add initial support for i.MX95 by:
- allowing the driver to be enabled i.MX95
- resetting the XBar
- configuring the TCA in System Configuration mode (which was determined
to be necessary to enable the PHY in device-mode)
Follow-on support will need to be added to steer the XBar based on
either board design (if only one pair is brought out) or if used with a
Type-C controller.
Signed-off-by: Tim Harvey <tharvey@gateworks.com> Tested-by: Alice Guo <alice.guo@nxp.com>
Andrew Goodbody [Thu, 31 Jul 2025 16:21:32 +0000 (17:21 +0100)]
mtd: nand: Do not dereference before NULL check
In nanddev_init mtd and memorg are assigned values that dereference nand
but this happens before a NULL check for nand. Move the assignments
after the NULL check.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Miquel Raynal [Mon, 4 Aug 2025 09:21:37 +0000 (11:21 +0200)]
cmd: mtd: Enable speed benchmarking
Linux features a flash_speed speed test from the mtd-utils suite, U-Boot
does not. Benchmarks are useful for speed improvement developments as
well as troubleshooting or regression testing sometimes.
david regan [Thu, 14 Aug 2025 18:04:55 +0000 (11:04 -0700)]
cmd: nand: bug fix MTD_OOB_AUTO to MTD_OPS_AUTO_OOB
bug fix MTD_OOB_AUTO to MTD_OPS_AUTO_OOB since MTD_OOB_AUTO does not exist
Fixes: dfe64e2c8973 ("mtd: resync with Linux-3.7.1") Signed-off-by: david regan <dregan@broadcom.com> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
The driver currently does:
mtd->dev->parent = cadence->dev;
This works in Linux because `struct mtd_info` embeds a `struct device`,
so `mtd->dev` is always valid and its `.parent` can be set.
In U-Boot, however, `mtd->dev` is only a pointer to a `struct udevice`.
Dereferencing it before assignment is invalid, which breaks the device
hierarchy. As a result, consumers relying on `mtd->dev` (e.g. partition
parser, reset and re-init paths) operate on a dangling pointer. This
leads to failures during warm reset when the NAND device is accessed
again.
Fix by assigning the device pointer directly:
mtd->dev = cadence->dev;
This matches U-Boot’s device model, preserves a valid hierarchy, and
resolves the warm reset issue on Cadence NAND.
Fixes: ebc41cad ("drivers: mtd: nand: Add driver for Cadence Nand") Signed-off-by: Dinesh Maniyam <dinesh.maniyam@altera.com> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Ye Li [Wed, 20 Aug 2025 13:08:51 +0000 (15:08 +0200)]
imx: imx93_{evk, frdm, qsb}: Fix conflict SPL early malloc address
Because the early malloc pool size is set to 0x18000, so using this
start address may cause conflict with ATF, then corrupt the heap data.
So we delete the definition to use the default early malloc pool from
CONFIG_SPL_STACK to avoid any conflict
Primoz Fiser [Tue, 19 Aug 2025 05:39:41 +0000 (07:39 +0200)]
board: phytec: phycore-imx93: Fix EEPROM bus mismatch in SPL
Fix PHYTEC EEPROM bus mismatch between SPL and U-Boot proper by enabling
CONFIG_SPL_DM_SEQ_ALIAS=y on phyCORE-i.MX93 boards. This way, both the
SPL and U-Boot proper will respect the device-tree aliases for I2C devs
and use the same I2C bus number for phytec_eeprom_data_setup() function
calls. This makes code less confusing and more robust.
Fixes an issue apparent since commit 79f3e77133bd ("Subtree merge tag
'v6.16-dts' of dts repo [1] into dts/upstream") where SPL would spew the
following error:
phytec_eeprom_read: i2c EEPROM not found: -110.
phytec_eeprom_data_setup: EEPROM data init failed
While later in U-Boot proper, EEPROM would be successfully read out.
This happens because Linux device-tree for phyBOARD-Segin-i.MX93 since
aforementioned commit enables I2C bus 2 (lpi2c2 is used for audio codec
and RTC) which breaks SPL I2C bus number ordering and I2C EEPROM bus is
shifted by +1. Now, lets prevent this from happening again by utilizing
device-tree aliases also in the SPL.
arm: imx: imx9: soc: Fix env location when booting from USB
On i.MX9 platforms, when booting from USB, the U-Boot environment is
always assumed to be in RAM. However, this causes the boot to hang when
`CONFIG_ENV_IS_NOWHERE` is not enabled. The boot also hangs even if the
environment is present in another storage media (for example, eMMC). Fix
the issue by correctly handling the U-Boot environment's location when
booting from USB. Also for i.MX95, set the environment location based on
the ENV config and not solely based on the boot device type.
Suggested-by: Frieder Schrempf <frieder.schrempf@kontron.de> Signed-off-by: João Paulo Gonçalves <joao.goncalves@toradex.com>
Tom Rini [Thu, 21 Aug 2025 21:05:15 +0000 (15:05 -0600)]
Merge patch series "bootstd: rauc: Fix segfault when scanning device with unsupported layout"
Martin Schwan <m.schwan@phytec.de> says:
This series fixes a segfault, that would occur at the end of scanning a
device, which does not contain the required partition layout scheme for
a RAUC system.
With this series, a "bootflow scan" should now correctly scan the
specified devices with boot method "rauc" without crashing on invalid
partition schemes.
Anshul Dalal [Thu, 14 Aug 2025 15:21:43 +0000 (20:51 +0530)]
remoteproc: k3: update compatible for am654 syscon
The existing compatible name for U-Boot's k3 system controller driver
i.e "ti,am625-system-controller" has been added to linux[1] device-tree.
This compatible in kernel is meant for configuring the Control Module
registers (CTRL_MMR0).
However in U-Boot, the matching driver was being used to load the system
firmware on the secure M-cores by the R5 SPL and therefore must be
updated to a different compatible to avoid conflicts.
Therefore, this patch renames all references of the compatible to
"ti,am654-tisci-rproc-r5". The "-r5" is appended so as to avoid any
future conflicts since r5 specific compatibles should only be useful for
U-Boot.
Philip Molloy [Thu, 14 Aug 2025 13:28:13 +0000 (13:28 +0000)]
mach-sc5xx: generate U-Boot proper in ADI ldr format
Generating an ldr boot stream containing U-Boot Proper was never added
to U-Boot because it is done by the ADI Yocto layer. Add it to U-Boot to
support projects that do not use that layer.
Signed-off-by: Philip Molloy <philip.molloy@analog.com>
Maxim Kochetkov [Wed, 13 Aug 2025 05:54:32 +0000 (08:54 +0300)]
serial-uclass: set GD_FLG_SERIAL_READY only when cur_serial_dev is assigned
serial_find_console_or_panic() may left cur_serial_dev unassigned if
REQUIRE_SERIAL_CONSOLE is not set. Setting GD_FLG_SERIAL_READY in
this situation confuses serial console code. It tries to use
unassigned driver instead of debug port and stops printing.
So check cur_serial_dev before setting GD_FLG_SERIAL_READY to allow
console to keep printing via debug port.
Andrew Goodbody [Tue, 12 Aug 2025 10:26:06 +0000 (11:26 +0100)]
sound: maxim_codec: Fix coding mistake
In maxim_i2c_read the code mistakenly just returned the return value
from dm_i2c_read leaving the following code unreachable. Instead assign
ret to be the return value from dm_i2c_read so that the following code
can operate as expected.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Andrew Goodbody [Fri, 8 Aug 2025 11:32:36 +0000 (12:32 +0100)]
ram: renesas: dbsc5: Fix off by 1 errors
In dbsc5_read_vref_training the arrays dvw_min_byte0_table and
dvw_min_byte1_table have 128 elements per channel. The variable
vref_stop_index is limited to be a maximum of 128. This means that the
index used to access the arrays must use a test of '< vref_stop_index'
rather than '<= vref_stop_index' in order to prevent out of bounds
accesses to the arrays.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Tom Rini [Wed, 20 Aug 2025 17:07:22 +0000 (11:07 -0600)]
Merge patch series "Add support for Ethernet boot"
Chintan Vankar <c-vankar@ti.com> says:
This series adds bind method for CPSW to avoid explicit probing, removes
explicit probing of CPSW, adds support for Ethernet boot on SK-AM68,
SK-AM62P-LP, J722S, SK-AM69.
net: ti: Kconfig: Enable SPL_SYSCON config for CPSW
TI's Ethernet switch needs system controllers enabled in R5SPL stage while
booting via Ethernet. Enable SPL_SYSCON config for
CONFIG_TI_AM65_CPSW_NUSS.
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@siemens.com> Signed-off-by: Chintan Vankar <c-vankar@ti.com>
Bind method of "am65_cpsw_nuss" driver will ensure binding of it's child
driver "am65_cpsw_nuss_ports", and there is no need to probe CPSW driver
explicitly.
Bind method of "am65_cpsw_nuss" driver will ensure binding of it's child
driver "am65_cpsw_nuss_ports", and there is no need to probe CPSW driver
explicitly.
projects / thirdparty / u-boot.git / log
