diff --git a/0001-Revert-spi-spi-uclass-Add-support-to-manually-reloca.patch b/0001-Revert-spi-spi-uclass-Add-support-to-manually-reloca.patch deleted file mode 100644 index 5dd7695..0000000 --- a/0001-Revert-spi-spi-uclass-Add-support-to-manually-reloca.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 1c56fc2835e10cdc039a4c1d049c1a6978e036f3 Mon Sep 17 00:00:00 2001 -From: Peter Robinson -Date: Thu, 22 Jul 2021 16:22:48 +0100 -Subject: [PATCH] Revert "spi: spi-uclass: Add support to manually relocate spi - memory ops" - -This reverts commit 346df7d4fa62afc578d820b3a18815eec765074f. - -This patch broke booting Rockchip systems from U-Boot residing on SPI -flash, for at least the Pinebook Pro and Rockpro64, and also confirmed -with the not yet upstream Helios64. - -Signed-off-by: Peter Robinson -Cc: T Karthik Reddy -Cc: Ashok Reddy Soma -Cc: Michal Simek -Cc: Pratyush Yadav ---- - drivers/spi/spi-uclass.c | 11 ----------- - 1 file changed, 11 deletions(-) - -diff --git a/drivers/spi/spi-uclass.c b/drivers/spi/spi-uclass.c -index d867b27806..ec7f4652b3 100644 ---- a/drivers/spi/spi-uclass.c -+++ b/drivers/spi/spi-uclass.c -@@ -11,7 +11,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -200,16 +199,6 @@ static int spi_post_probe(struct udevice *bus) - ops->set_mode += gd->reloc_off; - if (ops->cs_info) - ops->cs_info += gd->reloc_off; -- if (ops->mem_ops) { -- struct spi_controller_mem_ops *mem_ops = -- (struct spi_controller_mem_ops *)ops->mem_ops; -- if (mem_ops->adjust_op_size) -- mem_ops->adjust_op_size += gd->reloc_off; -- if (mem_ops->supports_op) -- mem_ops->supports_op += gd->reloc_off; -- if (mem_ops->exec_op) -- mem_ops->exec_op += gd->reloc_off; -- } - reloc_done++; - } - #endif --- -2.31.1 - diff --git a/CVE-2022-30767.patch b/CVE-2022-30767.patch new file mode 100644 index 0000000..1c85214 --- /dev/null +++ b/CVE-2022-30767.patch @@ -0,0 +1,43 @@ +From bdbf7a05e26f3c5fd437c99e2755ffde186ddc80 Mon Sep 17 00:00:00 2001 +From: Andrea zi0Black Cappa +Date: Wed, 18 May 2022 16:30:08 +0000 +Subject: [PATCH] net: nfs: Fix CVE-2022-30767 (old CVE-2019-14196) + +This patch mitigates the vulnerability identified via CVE-2019-14196. + +The previous patch was bypassed/ineffective, and now the vulnerability +is identified via CVE-2022-30767. The patch removes the sanity check +introduced to mitigate CVE-2019-14196 since it's ineffective. +filefh3_length is changed to unsigned type integer, preventing negative +numbers from being used during comparison with positive values during +size sanity checks. + +Signed-off-by: Andrea zi0Black Cappa +--- + net/nfs.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/net/nfs.c b/net/nfs.c +index 3c01cebd96..9152ab742e 100644 +--- a/net/nfs.c ++++ b/net/nfs.c +@@ -52,7 +52,7 @@ static const ulong nfs_timeout = CONFIG_NFS_TIMEOUT; + + static char dirfh[NFS_FHSIZE]; /* NFSv2 / NFSv3 file handle of directory */ + static char filefh[NFS3_FHSIZE]; /* NFSv2 / NFSv3 file handle */ +-static int filefh3_length; /* (variable) length of filefh when NFSv3 */ ++static unsigned int filefh3_length; /* (variable) length of filefh when NFSv3 */ + + static enum net_loop_state nfs_download_state; + static struct in_addr nfs_server_ip; +@@ -573,8 +573,6 @@ static int nfs_lookup_reply(uchar *pkt, unsigned len) + filefh3_length = ntohl(rpc_pkt.u.reply.data[1]); + if (filefh3_length > NFS3_FHSIZE) + filefh3_length = NFS3_FHSIZE; +- if (((uchar *)&(rpc_pkt.u.reply.data[0]) - (uchar *)(&rpc_pkt) + filefh3_length) > len) +- return -NFS_RPC_DROP; + memcpy(filefh, rpc_pkt.u.reply.data + 2, filefh3_length); + } + +-- +GitLab diff --git a/rockchip-Add-initial-support-for-the-PinePhone-Pro.patch b/rockchip-Add-initial-support-for-the-PinePhone-Pro.patch deleted file mode 100644 index 3dc7614..0000000 --- a/rockchip-Add-initial-support-for-the-PinePhone-Pro.patch +++ /dev/null @@ -1,886 +0,0 @@ -From: Martijn Braam -Subject: [PATCH] rockchip: Add initial support for the PinePhone Pro -Date: Thu, 21 Oct 2021 19:18:43 +0200 - -This is a new device by PINE64 that's very similar to the Pinebook Pro -that's already supported. - -Specification: -- Rockchip RK3399 -- 4GB Dual-Channel LPDDR4 -- 128GB eMMC -- mSD card slot -- AP6255 for 802.11ac WiFi and Bluetooth -- 6 inch 720*1440 DSI display -- Quectel EG25g usb modem -- Type-C port with alt-mode display (DP 1.2) and PD charging. - -Signed-off-by: Martijn Braam ---- - - arch/arm/dts/Makefile | 1 + - arch/arm/dts/rk3399-pinephone-pro-u-boot.dtsi | 44 ++ - arch/arm/dts/rk3399-pinephone-pro.dts | 520 ++++++++++++++++++ - arch/arm/mach-rockchip/rk3399/Kconfig | 8 + - board/pine64/pinephone-pro-rk3399/Kconfig | 15 + - board/pine64/pinephone-pro-rk3399/MAINTAINERS | 8 + - board/pine64/pinephone-pro-rk3399/Makefile | 1 + - .../pinephone-pro-rk3399.c | 57 ++ - configs/pinephone-pro-rk3399_defconfig | 92 ++++ - include/configs/pinephone-pro-rk3399.h | 23 + - 10 files changed, 769 insertions(+) - create mode 100644 arch/arm/dts/rk3399-pinephone-pro-u-boot.dtsi - create mode 100644 arch/arm/dts/rk3399-pinephone-pro.dts - create mode 100644 board/pine64/pinephone-pro-rk3399/Kconfig - create mode 100644 board/pine64/pinephone-pro-rk3399/MAINTAINERS - create mode 100644 board/pine64/pinephone-pro-rk3399/Makefile - create mode 100644 board/pine64/pinephone-pro-rk3399/pinephone-pro-rk3399.c - create mode 100644 configs/pinephone-pro-rk3399_defconfig - create mode 100644 include/configs/pinephone-pro-rk3399.h - -diff --git a/arch/arm/dts/Makefile b/arch/arm/dts/Makefile -index ed3d360bb1..3206370226 100644 ---- a/arch/arm/dts/Makefile -+++ b/arch/arm/dts/Makefile -@@ -137,6 +137,7 @@ dtb-$(CONFIG_ROCKCHIP_RK3399) += \ - rk3399-nanopi-r4s.dtb \ - rk3399-orangepi.dtb \ - rk3399-pinebook-pro.dtb \ -+ rk3399-pinephone-pro.dtb \ - rk3399-puma-haikou.dtb \ - rk3399-roc-pc.dtb \ - rk3399-roc-pc-mezzanine.dtb \ -diff --git a/arch/arm/dts/rk3399-pinephone-pro-u-boot.dtsi b/arch/arm/dts/rk3399-pinephone-pro-u-boot.dtsi -new file mode 100644 -index 0000000000..9d44db5978 ---- /dev/null -+++ b/arch/arm/dts/rk3399-pinephone-pro-u-boot.dtsi -@@ -0,0 +1,44 @@ -+// SPDX-License-Identifier: GPL-2.0+ -+/* -+ * Copyright (C) 2019 Peter Robinson -+ * Copyright (C) 2021 Martijn Braam -+ */ -+ -+#include "rk3399-u-boot.dtsi" -+#include "rk3399-sdram-lpddr4-100.dtsi" -+ -+/ { -+ aliases { -+ spi0 = &spi1; -+ }; -+ -+ chosen { -+ u-boot,spl-boot-order = "same-as-spl", &sdhci, &sdmmc; -+ }; -+ -+ config { -+ u-boot,spl-payload-offset = <0x60000>; /* @ 384KB */ -+ }; -+}; -+ -+&i2c0 { -+ u-boot,dm-pre-reloc; -+}; -+ -+&rk818 { -+ u-boot,dm-pre-reloc; -+}; -+ -+&rng { -+ status = "okay"; -+}; -+ -+&sdhci { -+ max-frequency = <25000000>; -+ u-boot,dm-pre-reloc; -+}; -+ -+&sdmmc { -+ max-frequency = <20000000>; -+ u-boot,dm-pre-reloc; -+}; -diff --git a/arch/arm/dts/rk3399-pinephone-pro.dts b/arch/arm/dts/rk3399-pinephone-pro.dts -new file mode 100644 -index 0000000000..3fe1845ced ---- /dev/null -+++ b/arch/arm/dts/rk3399-pinephone-pro.dts -@@ -0,0 +1,520 @@ -+// SPDX-License-Identifier: (GPL-2.0+ OR MIT) -+/* -+ * Copyright (c) 2021 Martijn Braam -+ */ -+ -+/dts-v1/; -+#include "rk3399.dtsi" -+#include "rk3399-opp.dtsi" -+ -+/ { -+ model = "Pine64 PinePhone Pro"; -+ compatible = "pine64,pinephone-pro", "rockchip,rk3399"; -+ -+ chosen { -+ stdout-path = "serial2:1500000n8"; -+ }; -+ -+ sdio_pwrseq: sdio-pwrseq { -+ compatible = "mmc-pwrseq-simple"; -+ pinctrl-names = "default"; -+ }; -+ -+ /* Power tree */ -+ /* Root power source */ -+ vcc_sysin: vcc-sysin { -+ compatible = "regulator-fixed"; -+ regulator-name = "vcc_sysin"; -+ regulator-always-on; -+ regulator-boot-on; -+ }; -+ -+ /* Main 3.3v supply */ -+ vcc3v3_sys: vcc3v3-sys { -+ compatible = "regulator-fixed"; -+ regulator-name = "vcc3v3_sys"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ vin-supply = <&vcc_sysin>; -+ -+ regulator-state-mem { -+ regulator-on-in-suspend; -+ }; -+ }; -+}; -+ -+&cpu_l0 { -+ cpu-supply = <&vdd_cpu_l>; -+}; -+ -+&cpu_l1 { -+ cpu-supply = <&vdd_cpu_l>; -+}; -+ -+&cpu_l2 { -+ cpu-supply = <&vdd_cpu_l>; -+}; -+ -+&cpu_l3 { -+ cpu-supply = <&vdd_cpu_l>; -+}; -+ -+&cpu_b0 { -+ cpu-supply = <&vdd_cpu_b>; -+}; -+ -+&cpu_b1 { -+ cpu-supply = <&vdd_cpu_b>; -+}; -+ -+&emmc_phy { -+ status = "okay"; -+}; -+ -+&gpu { -+ mali-supply = <&vdd_gpu>; -+ status = "okay"; -+}; -+ -+&i2c0 { -+ clock-frequency = <400000>; -+ i2c-scl-rising-time-ns = <168>; -+ i2c-scl-falling-time-ns = <4>; -+ status = "okay"; -+ -+ rk818: pmic@1c { -+ compatible = "rockchip,rk818"; -+ reg = <0x1c>; -+ interrupt-parent = <&gpio1>; -+ interrupts = ; -+ #clock-cells = <1>; -+ clock-output-names = "xin32k", "rk808-clkout2"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&pmic_int_l>; -+ rockchip,system-power-controller; -+ wakeup-source; -+ -+ vcc1-supply = <&vcc_sysin>; -+ vcc2-supply = <&vcc_sysin>; -+ vcc3-supply = <&vcc_sysin>; -+ vcc4-supply = <&vcc_sysin>; -+ vcc6-supply = <&vcc_sysin>; -+ vcc7-supply = <&vcc3v3_sys>; -+ vcc8-supply = <&vcc_sysin>; -+ vcc9-supply = <&vcc3v3_sys>; -+ -+ regulators { -+ vdd_cpu_l: DCDC_REG1 { -+ regulator-name = "vdd_cpu_1"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <750000>; -+ regulator-max-microvolt = <1350000>; -+ regulator-ramp-delay = <6001>; -+ regulator-state-mem { -+ regulator-off-in-suspend; -+ }; -+ }; -+ -+ vdd_center: DCDC_REG2 { -+ regulator-name = "vdd_center"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <800000>; -+ regulator-max-microvolt = <1350000>; -+ regulator-ramp-delay = <6001>; -+ regulator-state-mem { -+ regulator-off-in-suspend; -+ }; -+ }; -+ -+ vcc_ddr: DCDC_REG3 { -+ regulator-name = "vcc_ddr"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-state-mem { -+ regulator-on-in-suspend; -+ }; -+ }; -+ -+ vcc_1v8: DCDC_REG4 { -+ regulator-name = "vcc_1v8"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ regulator-state-mem { -+ regulator-on-in-suspend; -+ regulator-suspend-microvolt = <1800000>; -+ }; -+ }; -+ -+ vcca3v0_codec: LDO_REG1 { -+ regulator-name = "vcca3v0_codec"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <3000000>; -+ regulator-max-microvolt = <3000000>; -+ regulator-state-mem { -+ regulator-off-in-suspend; -+ }; -+ }; -+ -+ vcc3v0_touch: LDO_REG2 { -+ regulator-name = "vcc3v0_touch"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <3000000>; -+ regulator-max-microvolt = <3000000>; -+ regulator-state-mem { -+ regulator-off-in-suspend; -+ }; -+ }; -+ -+ vcca1v8_codec: LDO_REG3 { -+ regulator-name = "vcca1v8_codec"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ regulator-state-mem { -+ regulator-off-in-suspend; -+ }; -+ }; -+ -+ vcc_power_on: LDO_REG4 { -+ regulator-name = "vcc_power_on"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ regulator-state-mem { -+ regulator-on-in-suspend; -+ regulator-suspend-microvolt = <3300000>; -+ }; -+ }; -+ -+ vcc_3v0: LDO_REG5 { -+ regulator-name = "vcc_3v0"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <3000000>; -+ regulator-max-microvolt = <3000000>; -+ regulator-state-mem { -+ regulator-on-in-suspend; -+ regulator-suspend-microvolt = <3000000>; -+ }; -+ }; -+ -+ vcc_1v5: LDO_REG6 { -+ regulator-name = "vcc_1v5"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <1500000>; -+ regulator-max-microvolt = <1500000>; -+ regulator-state-mem { -+ regulator-on-in-suspend; -+ regulator-suspend-microvolt = <1500000>; -+ }; -+ }; -+ -+ vcc1v8_dvp: LDO_REG7 { -+ regulator-name = "vcc1v8_dvp"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <1800000>; -+ regulator-state-mem { -+ regulator-off-in-suspend; -+ }; -+ }; -+ -+ vcc3v3_s3: LDO_REG8 { -+ regulator-name = "vcc3v3_s3"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <3300000>; -+ regulator-max-microvolt = <3300000>; -+ regulator-state-mem { -+ regulator-off-in-suspend; -+ }; -+ }; -+ -+ vcc_sd: LDO_REG9 { -+ regulator-name = "vcc_sd"; -+ regulator-min-microvolt = <1800000>; -+ regulator-max-microvolt = <3300000>; -+ regulator-state-mem { -+ regulator-on-in-suspend; -+ regulator-suspend-microvolt = <3300000>; -+ }; -+ }; -+ -+ vcc3v3_s0: SWITCH_REG { -+ regulator-name = "vcc3v3_s0"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-state-mem { -+ regulator-on-in-suspend; -+ }; -+ }; -+ -+ boost_otg: DCDC_BOOST { -+ regulator-name = "boost_otg"; -+ regulator-always-on; -+ regulator-boot-on; -+ regulator-min-microvolt = <5000000>; -+ regulator-max-microvolt = <5000000>; -+ regulator-state-mem { -+ regulator-on-in-suspend; -+ regulator-suspend-microvolt = <5000000>; -+ }; -+ }; -+ -+ otg_switch: OTG_SWITCH { -+ regulator-name = "otg_switch"; -+ }; -+ }; -+ }; -+ -+ vdd_cpu_b: regulator@40 { -+ compatible = "silergy,syr827"; -+ reg = <0x40>; -+ fcs,suspend-voltage-selector = <1>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&vsel1_pin>; -+ regulator-name = "vdd_cpu_b"; -+ regulator-min-microvolt = <712500>; -+ regulator-max-microvolt = <1500000>; -+ regulator-ramp-delay = <1000>; -+ regulator-always-on; -+ regulator-boot-on; -+ -+ regulator-state-mem { -+ regulator-off-in-suspend; -+ }; -+ }; -+ -+ vdd_gpu: regulator@41 { -+ compatible = "silergy,syr828"; -+ reg = <0x41>; -+ fcs,suspend-voltage-selector = <1>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&vsel2_pin>; -+ regulator-name = "vdd_gpu"; -+ regulator-min-microvolt = <712500>; -+ regulator-max-microvolt = <1500000>; -+ regulator-ramp-delay = <1000>; -+ regulator-always-on; -+ regulator-boot-on; -+ -+ regulator-state-mem { -+ regulator-off-in-suspend; -+ }; -+ }; -+}; -+ -+&i2c1 { -+ i2c-scl-rising-time-ns = <300>; -+ i2c-scl-falling-time-ns = <15>; -+ status = "okay"; -+}; -+ -+&i2c3 { -+ i2c-scl-rising-time-ns = <450>; -+ i2c-scl-falling-time-ns = <15>; -+ status = "okay"; -+}; -+ -+&i2c4 { -+ i2c-scl-rising-time-ns = <600>; -+ i2c-scl-falling-time-ns = <20>; -+ status = "okay"; -+ -+ fusb0: typec-portc@22 { -+ compatible = "fcs,fusb302"; -+ reg = <0x22>; -+ interrupt-parent = <&gpio1>; -+ interrupts = ; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&fusb0_int>; -+ status = "okay"; -+ }; -+}; -+ -+&io_domains { -+ status = "okay"; -+ -+ bt656-supply = <&vcc1v8_dvp>; -+ audio-supply = <&vcca1v8_codec>; -+ sdmmc-supply = <&vcc_sd>; -+ gpio1830-supply = <&vcc_3v0>; -+}; -+ -+&pmu_io_domains { -+ pmu1830-supply = <&vcc_3v0>; -+ status = "okay"; -+}; -+ -+&pinctrl { -+ bt { -+ bt_enable_h: bt-enable-h { -+ rockchip,pins = <0 RK_PB1 RK_FUNC_GPIO &pcfg_pull_none>; -+ }; -+ -+ bt_host_wake_l: bt-host-wake-l { -+ rockchip,pins = <0 RK_PA4 RK_FUNC_GPIO &pcfg_pull_down>; -+ }; -+ -+ bt_wake_l: bt-wake-l { -+ rockchip,pins = <2 RK_PD3 RK_FUNC_GPIO &pcfg_pull_none>; -+ }; -+ }; -+ -+ buttons { -+ pwrbtn: pwrbtn { -+ rockchip,pins = <0 RK_PA5 RK_FUNC_GPIO &pcfg_pull_up>; -+ }; -+ }; -+ -+ fusb302x { -+ fusb0_int: fusb0-int { -+ rockchip,pins = <1 RK_PA2 RK_FUNC_GPIO &pcfg_pull_up>; -+ }; -+ }; -+ -+ leds { -+ work_led_pin: work-led-pin { -+ rockchip,pins = <0 RK_PB3 RK_FUNC_GPIO &pcfg_pull_none>; -+ }; -+ -+ diy_led_pin: diy-led-pin { -+ rockchip,pins = <0 RK_PA2 RK_FUNC_GPIO &pcfg_pull_none>; -+ }; -+ }; -+ -+ pcie { -+ pcie_perst: pcie-perst { -+ rockchip,pins = <2 RK_PD4 RK_FUNC_GPIO &pcfg_pull_none>; -+ }; -+ -+ pcie_pwr_en: pcie-pwr-en { -+ rockchip,pins = <1 RK_PD0 RK_FUNC_GPIO &pcfg_pull_none>; -+ }; -+ }; -+ -+ pmic { -+ pmic_int_l: pmic-int-l { -+ rockchip,pins = <1 RK_PC5 RK_FUNC_GPIO &pcfg_pull_up>; -+ }; -+ -+ vsel1_pin: vsel1-pin { -+ rockchip,pins = <1 RK_PC1 RK_FUNC_GPIO &pcfg_pull_down>; -+ }; -+ -+ vsel2_pin: vsel2-pin { -+ rockchip,pins = <1 RK_PB6 RK_FUNC_GPIO &pcfg_pull_down>; -+ }; -+ }; -+ -+ sdcard { -+ sdmmc0_pwr_h: sdmmc0-pwr-h { -+ rockchip,pins = <0 RK_PA1 RK_FUNC_GPIO &pcfg_pull_none>; -+ }; -+ -+ }; -+ -+ sdio-pwrseq { -+ wifi_enable_h: wifi-enable-h { -+ rockchip,pins = <0 RK_PB2 RK_FUNC_GPIO &pcfg_pull_none>; -+ }; -+ }; -+ -+ usb-typec { -+ vcc5v0_typec_en: vcc5v0_typec_en { -+ rockchip,pins = <1 RK_PA3 RK_FUNC_GPIO &pcfg_pull_up>; -+ }; -+ }; -+ -+ usb2 { -+ vcc5v0_host_en: vcc5v0-host-en { -+ rockchip,pins = <4 RK_PD2 RK_FUNC_GPIO &pcfg_pull_none>; -+ }; -+ }; -+}; -+ -+&pwm0 { -+ status = "okay"; -+}; -+ -+&pwm1 { -+ status = "okay"; -+}; -+ -+&pwm2 { -+ status = "okay"; -+}; -+ -+&sdio0 { -+ bus-width = <4>; -+ cap-sd-highspeed; -+ cap-sdio-irq; -+ disable-wp; -+ keep-power-in-suspend; -+ mmc-pwrseq = <&sdio_pwrseq>; -+ non-removable; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&sdio0_bus4 &sdio0_cmd &sdio0_clk>; -+ sd-uhs-sdr104; -+ status = "okay"; -+}; -+ -+&sdmmc { -+ bus-width = <4>; -+ cap-sd-highspeed; -+ cd-gpios = <&gpio0 7 GPIO_ACTIVE_LOW>; -+ disable-wp; -+ max-frequency = <150000000>; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_bus4>; -+ vmmc-supply = <&vcc3v3_s3>; -+ vqmmc-supply = <&vcc_1v8>; -+ status = "okay"; -+}; -+ -+&sdhci { -+ bus-width = <8>; -+ mmc-hs200-1_8v; -+ non-removable; -+ status = "okay"; -+}; -+ -+&tsadc { -+ /* tshut mode 0:CRU 1:GPIO */ -+ rockchip,hw-tshut-mode = <1>; -+ /* tshut polarity 0:LOW 1:HIGH */ -+ rockchip,hw-tshut-polarity = <1>; -+ status = "okay"; -+}; -+ -+&uart2 { -+ status = "okay"; -+}; -+ -+&vopb { -+ status = "okay"; -+}; -+ -+&vopb_mmu { -+ status = "okay"; -+}; -+ -+&vopl { -+ status = "okay"; -+}; -+ -+&vopl_mmu { -+ status = "okay"; -+}; -diff --git a/arch/arm/mach-rockchip/rk3399/Kconfig b/arch/arm/mach-rockchip/rk3399/Kconfig -index 17628f9171..3ba603ca80 100644 ---- a/arch/arm/mach-rockchip/rk3399/Kconfig -+++ b/arch/arm/mach-rockchip/rk3399/Kconfig -@@ -28,6 +28,13 @@ config TARGET_PINEBOOK_PRO_RK3399 - with 4Gb RAM, onboard eMMC, USB-C, a USB3 and USB2 port, - 1920*1080 screen and all the usual laptop features. - -+config TARGET_PINEPHONE_PRO_RK3399 -+ bool "PinePhone Pro" -+ help -+ PinePhone Pro is a phone based on the Rockchip rk3399 SoC -+ with 4Gb RAM, onboard eMMC, USB-C, a headphone jack, -+ 720x1440 screen and an external Quectel USB modem. -+ - config TARGET_PUMA_RK3399 - bool "Theobroma Systems RK3399-Q7 (Puma)" - help -@@ -154,6 +161,7 @@ endif # BOOTCOUNT_LIMIT - source "board/firefly/roc-pc-rk3399/Kconfig" - source "board/google/gru/Kconfig" - source "board/pine64/pinebook-pro-rk3399/Kconfig" -+source "board/pine64/pinephone-pro-rk3399/Kconfig" - source "board/pine64/rockpro64_rk3399/Kconfig" - source "board/rockchip/evb_rk3399/Kconfig" - source "board/theobroma-systems/puma_rk3399/Kconfig" -diff --git a/board/pine64/pinephone-pro-rk3399/Kconfig b/board/pine64/pinephone-pro-rk3399/Kconfig -new file mode 100644 -index 0000000000..13d6465ae6 ---- /dev/null -+++ b/board/pine64/pinephone-pro-rk3399/Kconfig -@@ -0,0 +1,15 @@ -+if TARGET_PINEPHONE_PRO_RK3399 -+ -+config SYS_BOARD -+ default "pinephone-pro-rk3399" -+ -+config SYS_VENDOR -+ default "pine64" -+ -+config SYS_CONFIG_NAME -+ default "pinephone-pro-rk3399" -+ -+config BOARD_SPECIFIC_OPTIONS -+ def_bool y -+ -+endif -diff --git a/board/pine64/pinephone-pro-rk3399/MAINTAINERS b/board/pine64/pinephone-pro-rk3399/MAINTAINERS -new file mode 100644 -index 0000000000..9ca4fc4cbe ---- /dev/null -+++ b/board/pine64/pinephone-pro-rk3399/MAINTAINERS -@@ -0,0 +1,8 @@ -+PINEPHONE_PRO -+M: Martijn Braam -+S: Maintained -+F: board/pine64/rk3399-pinephone-pro/ -+F: include/configs/rk3399-pinephone-pro.h -+F: arch/arm/dts/rk3399-pinephone-pro.dts -+F: arch/arm/dts/rk3399-pinephone-pro-u-boot.dtsi -+F: configs/pinephone-pro-rk3399_defconfig -diff --git a/board/pine64/pinephone-pro-rk3399/Makefile b/board/pine64/pinephone-pro-rk3399/Makefile -new file mode 100644 -index 0000000000..8d9203053e ---- /dev/null -+++ b/board/pine64/pinephone-pro-rk3399/Makefile -@@ -0,0 +1 @@ -+obj-y += pinephone-pro-rk3399.o -diff --git a/board/pine64/pinephone-pro-rk3399/pinephone-pro-rk3399.c b/board/pine64/pinephone-pro-rk3399/pinephone-pro-rk3399.c -new file mode 100644 -index 0000000000..8efeb6ea3d ---- /dev/null -+++ b/board/pine64/pinephone-pro-rk3399/pinephone-pro-rk3399.c -@@ -0,0 +1,57 @@ -+// SPDX-License-Identifier: GPL-2.0+ -+/* -+ * (C) Copyright 2019 Vasily Khoruzhick -+ * (C) Copyright 2021 Martijn Braam -+ */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#define GRF_IO_VSEL_BT565_SHIFT 0 -+#define PMUGRF_CON0_VSEL_SHIFT 8 -+ -+#ifdef CONFIG_MISC_INIT_R -+static void setup_iodomain(void) -+{ -+ struct rk3399_grf_regs *grf = -+ syscon_get_first_range(ROCKCHIP_SYSCON_GRF); -+ struct rk3399_pmugrf_regs *pmugrf = -+ syscon_get_first_range(ROCKCHIP_SYSCON_PMUGRF); -+ -+ /* BT565 is in 1.8v domain */ -+ rk_setreg(&grf->io_vsel, 1 << GRF_IO_VSEL_BT565_SHIFT); -+ -+ /* Set GPIO1 1.8v/3.0v source select to PMU1830_VOL */ -+ rk_setreg(&pmugrf->soc_con0, 1 << PMUGRF_CON0_VSEL_SHIFT); -+} -+ -+int misc_init_r(void) -+{ -+ const u32 cpuid_offset = 0x7; -+ const u32 cpuid_length = 0x10; -+ u8 cpuid[cpuid_length]; -+ int ret; -+ -+ setup_iodomain(); -+ -+ ret = rockchip_cpuid_from_efuse(cpuid_offset, cpuid_length, cpuid); -+ if (ret) -+ return ret; -+ -+ ret = rockchip_cpuid_set(cpuid, cpuid_length); -+ if (ret) -+ return ret; -+ -+ ret = rockchip_setup_macaddr(); -+ -+ return ret; -+} -+ -+#endif -diff --git a/configs/pinephone-pro-rk3399_defconfig b/configs/pinephone-pro-rk3399_defconfig -new file mode 100644 -index 0000000000..2cf80f7d35 ---- /dev/null -+++ b/configs/pinephone-pro-rk3399_defconfig -@@ -0,0 +1,92 @@ -+CONFIG_ARM=y -+CONFIG_SKIP_LOWLEVEL_INIT=y -+CONFIG_ARCH_ROCKCHIP=y -+CONFIG_SYS_TEXT_BASE=0x00200000 -+CONFIG_NR_DRAM_BANKS=1 -+CONFIG_ENV_SIZE=0x8000 -+CONFIG_ROCKCHIP_RK3399=y -+CONFIG_TARGET_PINEPHONE_PRO_RK3399=y -+CONFIG_DEBUG_UART_BASE=0xFF1A0000 -+CONFIG_DEBUG_UART_CLOCK=24000000 -+CONFIG_SPL_SPI_FLASH_SUPPORT=y -+CONFIG_SPL_SPI_SUPPORT=y -+CONFIG_DEFAULT_DEVICE_TREE="rk3399-pinephone-pro" -+CONFIG_DEBUG_UART=y -+CONFIG_SYS_LOAD_ADDR=0x800800 -+CONFIG_BOOTDELAY=3 -+CONFIG_USE_PREBOOT=y -+CONFIG_DEFAULT_FDT_FILE="rockchip/rk3399-pinephone-pro.dtb" -+CONFIG_DISPLAY_BOARDINFO_LATE=y -+CONFIG_MISC_INIT_R=y -+# CONFIG_SPL_RAW_IMAGE_SUPPORT is not set -+CONFIG_SPL_STACK_R=y -+CONFIG_SPL_STACK_R_MALLOC_SIMPLE_LEN=0x10000 -+CONFIG_SPL_MTD_SUPPORT=y -+CONFIG_SPL_SPI_LOAD=y -+CONFIG_TPL=y -+CONFIG_CMD_BOOTZ=y -+CONFIG_CMD_GPIO=y -+CONFIG_CMD_GPT=y -+CONFIG_CMD_I2C=y -+CONFIG_CMD_MMC=y -+CONFIG_CMD_PCI=y -+CONFIG_CMD_USB=y -+# CONFIG_CMD_SETEXPR is not set -+CONFIG_CMD_TIME=y -+CONFIG_CMD_PMIC=y -+CONFIG_CMD_REGULATOR=y -+CONFIG_SPL_OF_CONTROL=y -+CONFIG_OF_SPL_REMOVE_PROPS="pinctrl-0 pinctrl-names clock-names interrupt-parent assigned-clocks assigned-clock-rates assigned-clock-parents" -+CONFIG_ENV_IS_IN_SPI_FLASH=y -+CONFIG_SYS_RELOC_GD_ENV_ADDR=y -+CONFIG_ROCKCHIP_GPIO=y -+CONFIG_SYS_I2C_ROCKCHIP=y -+CONFIG_DM_KEYBOARD=y -+CONFIG_LED=y -+CONFIG_LED_GPIO=y -+CONFIG_MISC=y -+CONFIG_ROCKCHIP_EFUSE=y -+CONFIG_MMC_DW=y -+CONFIG_MMC_DW_ROCKCHIP=y -+CONFIG_MMC_SDHCI=y -+CONFIG_MMC_SDHCI_SDMA=y -+CONFIG_MMC_SDHCI_ROCKCHIP=y -+CONFIG_SF_DEFAULT_SPEED=20000000 -+CONFIG_SPI_FLASH_GIGADEVICE=y -+CONFIG_SPI_FLASH_WINBOND=y -+CONFIG_DM_ETH=y -+CONFIG_PHY_ROCKCHIP_INNO_USB2=y -+CONFIG_PHY_ROCKCHIP_TYPEC=y -+CONFIG_DM_PMIC_FAN53555=y -+CONFIG_PMIC_RK8XX=y -+CONFIG_REGULATOR_PWM=y -+CONFIG_REGULATOR_RK8XX=y -+CONFIG_PWM_ROCKCHIP=y -+CONFIG_RAM_RK3399_LPDDR4=y -+CONFIG_DM_RESET=y -+CONFIG_DM_RNG=y -+CONFIG_RNG_ROCKCHIP=y -+CONFIG_BAUDRATE=1500000 -+CONFIG_DEBUG_UART_SHIFT=2 -+CONFIG_ROCKCHIP_SPI=y -+CONFIG_SYSRESET=y -+CONFIG_USB=y -+CONFIG_USB_XHCI_HCD=y -+CONFIG_USB_XHCI_DWC3=y -+CONFIG_USB_EHCI_HCD=y -+CONFIG_USB_EHCI_GENERIC=y -+CONFIG_USB_OHCI_HCD=y -+CONFIG_USB_OHCI_GENERIC=y -+CONFIG_USB_DWC3=y -+CONFIG_USB_DWC3_GENERIC=y -+CONFIG_USB_KEYBOARD=y -+CONFIG_SYS_USB_EVENT_POLL_VIA_INT_QUEUE=y -+CONFIG_USB_HOST_ETHER=y -+CONFIG_USB_ETHER_ASIX=y -+CONFIG_USB_ETHER_RTL8152=y -+CONFIG_DM_VIDEO=y -+CONFIG_DISPLAY=y -+CONFIG_VIDEO_ROCKCHIP=y -+CONFIG_DISPLAY_ROCKCHIP_EDP=y -+CONFIG_SPL_TINY_MEMSET=y -+CONFIG_ERRNO_STR=y -diff --git a/include/configs/pinephone-pro-rk3399.h b/include/configs/pinephone-pro-rk3399.h -new file mode 100644 -index 0000000000..fefa793fdd ---- /dev/null -+++ b/include/configs/pinephone-pro-rk3399.h -@@ -0,0 +1,23 @@ -+/* SPDX-License-Identifier: GPL-2.0+ */ -+/* -+ * Copyright (C) 2016 Rockchip Electronics Co., Ltd -+ * Copyright (C) 2020 Peter Robinson -+ * Copyright (C) 2021 Martijn Braam -+ */ -+ -+#ifndef __PINEPHONE_PRO_RK3399_H -+#define __PINEPHONE_PRO_RK3399_H -+ -+#define ROCKCHIP_DEVICE_SETTINGS \ -+ "stdin=serial,usbkbd\0" \ -+ "stdout=serial,vidconsole\0" \ -+ "stderr=serial,vidconsole\0" -+ -+#include -+ -+#define SDRAM_BANK_SIZE (2UL << 30) -+ -+#define CONFIG_USB_OHCI_NEW -+#define CONFIG_SYS_USB_OHCI_MAX_ROOT_PORTS 2 -+ -+#endif diff --git a/rpi-Enable-using-the-DT-provided-by-the-Raspberry-Pi.patch b/rpi-Enable-using-the-DT-provided-by-the-Raspberry-Pi.patch deleted file mode 100644 index c156e4d..0000000 --- a/rpi-Enable-using-the-DT-provided-by-the-Raspberry-Pi.patch +++ /dev/null @@ -1,96 +0,0 @@ -From f10f94831450671a77f61fe413b4a57459963860 Mon Sep 17 00:00:00 2001 -From: Peter Robinson -Date: Mon, 10 Aug 2020 22:20:29 +0100 -Subject: [PATCH] rpi: Use firmware provided device tree - -Signed-off-by: Peter Robinson ---- - configs/rpi_0_w_defconfig | 2 +- - configs/rpi_2_defconfig | 2 +- - configs/rpi_3_32b_defconfig | 2 +- - configs/rpi_3_b_plus_defconfig | 2 +- - configs/rpi_3_defconfig | 2 +- - configs/rpi_defconfig | 2 +- - 6 files changed, 6 insertions(+), 6 deletions(-) - -diff --git a/configs/rpi_0_w_defconfig b/configs/rpi_0_w_defconfig -index bba5e12b12..0241f4c6d3 100644 ---- a/configs/rpi_0_w_defconfig -+++ b/configs/rpi_0_w_defconfig -@@ -17,7 +17,7 @@ CONFIG_CMD_GPIO=y - CONFIG_CMD_MMC=y - CONFIG_CMD_USB=y - CONFIG_CMD_FS_UUID=y --CONFIG_OF_EMBED=y -+CONFIG_OF_BOARD=y - CONFIG_ENV_FAT_DEVICE_AND_PART="0:1" - CONFIG_SYS_RELOC_GD_ENV_ADDR=y - CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y -diff --git a/configs/rpi_2_defconfig b/configs/rpi_2_defconfig -index 1c2bbb29ce..9573e475f4 100644 ---- a/configs/rpi_2_defconfig -+++ b/configs/rpi_2_defconfig -@@ -17,7 +17,7 @@ CONFIG_CMD_GPIO=y - CONFIG_CMD_MMC=y - CONFIG_CMD_USB=y - CONFIG_CMD_FS_UUID=y --CONFIG_OF_EMBED=y -+CONFIG_OF_BOARD=y - CONFIG_ENV_FAT_DEVICE_AND_PART="0:1" - CONFIG_SYS_RELOC_GD_ENV_ADDR=y - CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y -diff --git a/configs/rpi_3_32b_defconfig b/configs/rpi_3_32b_defconfig -index b8a3d17f43..252df994e6 100644 ---- a/configs/rpi_3_32b_defconfig -+++ b/configs/rpi_3_32b_defconfig -@@ -18,7 +18,7 @@ CONFIG_CMD_GPIO=y - CONFIG_CMD_MMC=y - CONFIG_CMD_USB=y - CONFIG_CMD_FS_UUID=y --CONFIG_OF_EMBED=y -+CONFIG_OF_BOARD=y - CONFIG_ENV_FAT_DEVICE_AND_PART="0:1" - CONFIG_SYS_RELOC_GD_ENV_ADDR=y - CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y -diff --git a/configs/rpi_3_b_plus_defconfig b/configs/rpi_3_b_plus_defconfig -index 4c361438fa..3b2996a2f9 100644 ---- a/configs/rpi_3_b_plus_defconfig -+++ b/configs/rpi_3_b_plus_defconfig -@@ -18,7 +18,7 @@ CONFIG_CMD_GPIO=y - CONFIG_CMD_MMC=y - CONFIG_CMD_USB=y - CONFIG_CMD_FS_UUID=y --CONFIG_OF_EMBED=y -+CONFIG_OF_BOARD=y - CONFIG_ENV_FAT_DEVICE_AND_PART="0:1" - CONFIG_SYS_RELOC_GD_ENV_ADDR=y - CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y -diff --git a/configs/rpi_3_defconfig b/configs/rpi_3_defconfig -index 9b281a4f15..1e9ee6122e 100644 ---- a/configs/rpi_3_defconfig -+++ b/configs/rpi_3_defconfig -@@ -18,7 +18,7 @@ CONFIG_CMD_GPIO=y - CONFIG_CMD_MMC=y - CONFIG_CMD_USB=y - CONFIG_CMD_FS_UUID=y --CONFIG_OF_EMBED=y -+CONFIG_OF_BOARD=y - CONFIG_ENV_FAT_DEVICE_AND_PART="0:1" - CONFIG_SYS_RELOC_GD_ENV_ADDR=y - CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y -diff --git a/configs/rpi_defconfig b/configs/rpi_defconfig -index b5ad53c37b..223fc03275 100644 ---- a/configs/rpi_defconfig -+++ b/configs/rpi_defconfig -@@ -17,7 +17,7 @@ CONFIG_CMD_GPIO=y - CONFIG_CMD_MMC=y - CONFIG_CMD_USB=y - CONFIG_CMD_FS_UUID=y --CONFIG_OF_EMBED=y -+CONFIG_OF_BOARD=y - CONFIG_ENV_FAT_DEVICE_AND_PART="0:1" - CONFIG_SYS_RELOC_GD_ENV_ADDR=y - CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y --- -2.26.2 - diff --git a/rpi-bcm2835_sdhost-firmware-managed-clock.patch b/rpi-bcm2835_sdhost-firmware-managed-clock.patch deleted file mode 100644 index d1c60e8..0000000 --- a/rpi-bcm2835_sdhost-firmware-managed-clock.patch +++ /dev/null @@ -1,228 +0,0 @@ -From f3a870bfa075fb880f5e018a0a5ae6f27ca8be49 Mon Sep 17 00:00:00 2001 -From: Vincent Fazio -Date: Mon, 13 Sep 2021 13:34:45 -0500 -Subject: [PATCH] mmc: bcm2835-host: let firmware manage the clock - -Newer firmware supports managing the sdhost clock divisor, so leverage -this feature if it is available. - -SET_SDHOST_CLOCK is largely undocumented except for its usage within the -Linux kernel, which this change is based on. - -https://github.com/raspberrypi/linux/commit/3cd16c39c718e2dda7885c4ed7a20118aed12524 - -Signed-off-by: Vincent Fazio ---- - arch/arm/mach-bcm283x/include/mach/mbox.h | 18 ++++++++ - arch/arm/mach-bcm283x/include/mach/msg.h | 10 +++++ - arch/arm/mach-bcm283x/msg.c | 30 +++++++++++++ - drivers/mmc/bcm2835_sdhost.c | 53 ++++++++++++++--------- - 4 files changed, 90 insertions(+), 21 deletions(-) - -diff --git a/arch/arm/mach-bcm283x/include/mach/mbox.h b/arch/arm/mach-bcm283x/include/mach/mbox.h -index 7dcac583cc4..9b1943fcfc4 100644 ---- a/arch/arm/mach-bcm283x/include/mach/mbox.h -+++ b/arch/arm/mach-bcm283x/include/mach/mbox.h -@@ -252,6 +252,24 @@ struct bcm2835_mbox_tag_get_clock_rate { - } body; - }; - -+#define BCM2835_MBOX_TAG_SET_SDHOST_CLOCK 0x00038042 -+ -+struct bcm2835_mbox_tag_set_sdhost_clock { -+ struct bcm2835_mbox_tag_hdr tag_hdr; -+ union { -+ struct { -+ u32 rate_hz; -+ u32 rate_1; -+ u32 rate_2; -+ } req; -+ struct { -+ u32 rate_hz; -+ u32 rate_1; -+ u32 rate_2; -+ } resp; -+ } body; -+}; -+ - #define BCM2835_MBOX_TAG_ALLOCATE_BUFFER 0x00040001 - - struct bcm2835_mbox_tag_allocate_buffer { -diff --git a/arch/arm/mach-bcm283x/include/mach/msg.h b/arch/arm/mach-bcm283x/include/mach/msg.h -index e45c1bf010f..ab37abdb6c6 100644 ---- a/arch/arm/mach-bcm283x/include/mach/msg.h -+++ b/arch/arm/mach-bcm283x/include/mach/msg.h -@@ -22,6 +22,16 @@ int bcm2835_power_on_module(u32 module); - */ - int bcm2835_get_mmc_clock(u32 clock_id); - -+/** -+ * bcm2835_set_sdhost_clock() - determine if firmware controls sdhost cdiv -+ * -+ * @rate_hz: Input clock frequency -+ * @rate_1: Returns a clock frequency -+ * @rate_2: Returns a clock frequency -+ * @return 0 of OK, -EIO on error -+ */ -+int bcm2835_set_sdhost_clock(u32 rate_hz, u32 *rate_1, u32 *rate_2); -+ - /** - * bcm2835_get_video_size() - get the current display size - * -diff --git a/arch/arm/mach-bcm283x/msg.c b/arch/arm/mach-bcm283x/msg.c -index e2badfecb09..8c1c36a5f15 100644 ---- a/arch/arm/mach-bcm283x/msg.c -+++ b/arch/arm/mach-bcm283x/msg.c -@@ -21,6 +21,12 @@ struct msg_get_clock_rate { - u32 end_tag; - }; - -+struct msg_set_sdhost_clock { -+ struct bcm2835_mbox_hdr hdr; -+ struct bcm2835_mbox_tag_set_sdhost_clock set_sdhost_clock; -+ u32 end_tag; -+}; -+ - struct msg_query { - struct bcm2835_mbox_hdr hdr; - struct bcm2835_mbox_tag_physical_w_h physical_w_h; -@@ -111,6 +117,30 @@ int bcm2835_get_mmc_clock(u32 clock_id) - return clock_rate; - } - -+int bcm2835_set_sdhost_clock(u32 rate_hz, u32 *rate_1, u32 *rate_2) -+{ -+ ALLOC_CACHE_ALIGN_BUFFER(struct msg_set_sdhost_clock, msg_sdhost_clk, 1); -+ int ret; -+ -+ BCM2835_MBOX_INIT_HDR(msg_sdhost_clk); -+ BCM2835_MBOX_INIT_TAG(&msg_sdhost_clk->set_sdhost_clock, SET_SDHOST_CLOCK); -+ -+ msg_sdhost_clk->set_sdhost_clock.body.req.rate_hz = rate_hz; -+ msg_sdhost_clk->set_sdhost_clock.body.req.rate_1 = *rate_1; -+ msg_sdhost_clk->set_sdhost_clock.body.req.rate_2 = *rate_2; -+ -+ ret = bcm2835_mbox_call_prop(BCM2835_MBOX_PROP_CHAN, &msg_sdhost_clk->hdr); -+ if (ret) { -+ printf("bcm2835: Could not query sdhost clock rate\n"); -+ return -EIO; -+ } -+ -+ *rate_1 = msg_sdhost_clk->set_sdhost_clock.body.resp.rate_1; -+ *rate_2 = msg_sdhost_clk->set_sdhost_clock.body.resp.rate_2; -+ -+ return 0; -+} -+ - int bcm2835_get_video_size(int *widthp, int *heightp) - { - ALLOC_CACHE_ALIGN_BUFFER(struct msg_query, msg_query, 1); -diff --git a/drivers/mmc/bcm2835_sdhost.c b/drivers/mmc/bcm2835_sdhost.c -index 894dbdd6861..3a9cd6f1eb2 100644 ---- a/drivers/mmc/bcm2835_sdhost.c -+++ b/drivers/mmc/bcm2835_sdhost.c -@@ -181,6 +181,7 @@ struct bcm2835_host { - struct udevice *dev; - struct mmc *mmc; - struct bcm2835_plat *plat; -+ unsigned int firmware_sets_cdiv:1; - }; - - static void bcm2835_dumpregs(struct bcm2835_host *host) -@@ -233,7 +234,7 @@ static void bcm2835_reset_internal(struct bcm2835_host *host) - msleep(20); - host->clock = 0; - writel(host->hcfg, host->ioaddr + SDHCFG); -- writel(host->cdiv, host->ioaddr + SDCDIV); -+ writel(SDCDIV_MAX_CDIV, host->ioaddr + SDCDIV); - } - - static int bcm2835_wait_transfer_complete(struct bcm2835_host *host) -@@ -598,6 +599,7 @@ static int bcm2835_transmit(struct bcm2835_host *host) - static void bcm2835_set_clock(struct bcm2835_host *host, unsigned int clock) - { - int div; -+ u32 clock_rate[2] = { 0 }; - - /* The SDCDIV register has 11 bits, and holds (div - 2). But - * in data mode the max is 50MHz wihout a minimum, and only -@@ -620,26 +622,34 @@ static void bcm2835_set_clock(struct bcm2835_host *host, unsigned int clock) - * clock divisor at all times. - */ - -- if (clock < 100000) { -- /* Can't stop the clock, but make it as slow as possible -- * to show willing -- */ -- host->cdiv = SDCDIV_MAX_CDIV; -- writel(host->cdiv, host->ioaddr + SDCDIV); -- return; -- } -+ if (host->firmware_sets_cdiv) { -+ bcm2835_set_sdhost_clock(clock, &clock_rate[0], &clock_rate[1]); -+ clock = max(clock_rate[0], clock_rate[1]); -+ } else { -+ if (clock < 100000) { -+ /* Can't stop the clock, but make it as slow as possible -+ * to show willing -+ */ -+ host->cdiv = SDCDIV_MAX_CDIV; -+ writel(host->cdiv, host->ioaddr + SDCDIV); -+ return; -+ } - -- div = host->max_clk / clock; -- if (div < 2) -- div = 2; -- if ((host->max_clk / div) > clock) -- div++; -- div -= 2; -+ div = host->max_clk / clock; -+ if (div < 2) -+ div = 2; -+ if ((host->max_clk / div) > clock) -+ div++; -+ div -= 2; - -- if (div > SDCDIV_MAX_CDIV) -- div = SDCDIV_MAX_CDIV; -+ if (div > SDCDIV_MAX_CDIV) -+ div = SDCDIV_MAX_CDIV; -+ -+ clock = host->max_clk / (div + 2); -+ host->cdiv = div; -+ writel(host->cdiv, host->ioaddr + SDCDIV); -+ } - -- clock = host->max_clk / (div + 2); - host->mmc->clock = clock; - - /* Calibrate some delays */ -@@ -647,9 +657,6 @@ static void bcm2835_set_clock(struct bcm2835_host *host, unsigned int clock) - host->ns_per_fifo_word = (1000000000 / clock) * - ((host->mmc->card_caps & MMC_MODE_4BIT) ? 8 : 32); - -- host->cdiv = div; -- writel(host->cdiv, host->ioaddr + SDCDIV); -- - /* Set the timeout to 500ms */ - writel(host->mmc->clock / 2, host->ioaddr + SDTOUT); - } -@@ -759,6 +766,7 @@ static int bcm2835_probe(struct udevice *dev) - struct bcm2835_host *host = dev_get_priv(dev); - struct mmc *mmc = mmc_get_mmc_dev(dev); - struct mmc_uclass_priv *upriv = dev_get_uclass_priv(dev); -+ u32 clock_rate[2] = { ~0 }; - - host->dev = dev; - host->mmc = mmc; -@@ -776,6 +784,9 @@ static int bcm2835_probe(struct udevice *dev) - - host->max_clk = bcm2835_get_mmc_clock(BCM2835_MBOX_CLOCK_ID_CORE); - -+ bcm2835_set_sdhost_clock(0, &clock_rate[0], &clock_rate[1]); -+ host->firmware_sets_cdiv = (clock_rate[0] != ~0); -+ - bcm2835_add_host(host); - - dev_dbg(dev, "%s -> OK\n", __func__); diff --git a/rpi-fallback-to-max-clock-for-mmc.patch b/rpi-fallback-to-max-clock-for-mmc.patch deleted file mode 100644 index 81ee372..0000000 --- a/rpi-fallback-to-max-clock-for-mmc.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 71ba043e5c5575f3d86536acade70dab6599489b Mon Sep 17 00:00:00 2001 -From: Vincent Fazio -Date: Mon, 13 Sep 2021 11:22:30 -0500 -Subject: [PATCH] arm: rpi: fallback to max clock rate for MMC clock - -In rpi-firmware 25e2b597ebfb2495eab4816a276758dcc6ea21f1 and later, -the GET_CLOCK_RATE mailbox property was changed to return the last -value set by SET_CLOCK_RATE. - -https://github.com/raspberrypi/firmware/issues/1619#issuecomment-917025502 - -U-Boot does not call SET_CLOCK_RATE so bcm2835_get_mmc_clock will -return zero and can cause degraded MMC performance. - -Calling SET_CLOCK_RATE fixes the frequency of the clock to a specific -value and disables the firmware's clock scaling so is not an option. - -Instead, fallback to GET_MAX_CLOCK_RATE in bcm2835_get_mmc_clock if -GET_CLOCK_RATE returns zero. - -Signed-off-by: Vincent Fazio ---- - arch/arm/mach-bcm283x/include/mach/mbox.h | 2 ++ - arch/arm/mach-bcm283x/msg.c | 20 +++++++++++++++++++- - 2 files changed, 21 insertions(+), 1 deletion(-) - -diff --git a/arch/arm/mach-bcm283x/include/mach/mbox.h b/arch/arm/mach-bcm283x/include/mach/mbox.h -index 2ae2d3d97c3..7dcac583cc4 100644 ---- a/arch/arm/mach-bcm283x/include/mach/mbox.h -+++ b/arch/arm/mach-bcm283x/include/mach/mbox.h -@@ -224,6 +224,8 @@ struct bcm2835_mbox_tag_set_power_state { - }; - - #define BCM2835_MBOX_TAG_GET_CLOCK_RATE 0x00030002 -+#define BCM2835_MBOX_TAG_GET_MAX_CLOCK_RATE 0x00030004 -+#define BCM2835_MBOX_TAG_GET_MIN_CLOCK_RATE 0x00030007 - - #define BCM2835_MBOX_CLOCK_ID_EMMC 1 - #define BCM2835_MBOX_CLOCK_ID_UART 2 -diff --git a/arch/arm/mach-bcm283x/msg.c b/arch/arm/mach-bcm283x/msg.c -index 347aece3cd8..e2badfecb09 100644 ---- a/arch/arm/mach-bcm283x/msg.c -+++ b/arch/arm/mach-bcm283x/msg.c -@@ -75,6 +75,7 @@ int bcm2835_get_mmc_clock(u32 clock_id) - { - ALLOC_CACHE_ALIGN_BUFFER(struct msg_get_clock_rate, msg_clk, 1); - int ret; -+ u32 clock_rate = 0; - - ret = bcm2835_power_on_module(BCM2835_MBOX_POWER_DEVID_SDHCI); - if (ret) -@@ -90,7 +91,24 @@ int bcm2835_get_mmc_clock(u32 clock_id) - return -EIO; - } - -- return msg_clk->get_clock_rate.body.resp.rate_hz; -+ clock_rate = msg_clk->get_clock_rate.body.resp.rate_hz; -+ -+ if (clock_rate == 0) -+ { -+ BCM2835_MBOX_INIT_HDR(msg_clk); -+ BCM2835_MBOX_INIT_TAG(&msg_clk->get_clock_rate, GET_MAX_CLOCK_RATE); -+ msg_clk->get_clock_rate.body.req.clock_id = clock_id; -+ -+ ret = bcm2835_mbox_call_prop(BCM2835_MBOX_PROP_CHAN, &msg_clk->hdr); -+ if (ret) { -+ printf("bcm2835: Could not query max eMMC clock rate\n"); -+ return -EIO; -+ } -+ -+ clock_rate = msg_clk->get_clock_rate.body.resp.rate_hz; -+ } -+ -+ return clock_rate; - } - - int bcm2835_get_video_size(int *widthp, int *heightp) diff --git a/uboot-tools.spec b/uboot-tools.spec index e147faf..025824a 100644 --- a/uboot-tools.spec +++ b/uboot-tools.spec @@ -1,9 +1,13 @@ #global candidate rc0 +%if 0%{?rhel} +%bcond_with toolsonly +%else %bcond_without toolsonly +%endif Name: uboot-tools Version: 2022.04 -Release: 1%{?candidate:.%{candidate}}%{?dist} +Release: 2%{?candidate:.%{candidate}}%{?dist} Summary: U-Boot utilities License: GPLv2+ BSD LGPL-2.1+ LGPL-2.0+ URL: http://www.denx.de/wiki/U-Boot @@ -13,18 +17,8 @@ Source0: https://ftp.denx.de/pub/u-boot/u-boot-%{version}%{?candidate:-%{candid Source1: arm-boards Source2: aarch64-boards -# Fedoraisms patches -# Needed to find DT on boot partition that's not the first partition -Patch1: uefi-distro-load-FDT-from-any-partition-on-boot-device.patch - -# Board fixes and enablement -# RPi - uses RPI firmware device tree for HAT support -Patch3: rpi-Enable-using-the-DT-provided-by-the-Raspberry-Pi.patch -Patch4: rpi-fallback-to-max-clock-for-mmc.patch -Patch5: rpi-bcm2835_sdhost-firmware-managed-clock.patch -# Rockchips improvements -Patch8: 0001-Revert-spi-spi-uclass-Add-support-to-manually-reloca.patch -Patch9: rockchip-Add-initial-support-for-the-PinePhone-Pro.patch +Patch0: CVE-2022-30767.patch +Patch1: zlib-Port-fix-for-CVE-2018-25032-to-U-Boot.patch BuildRequires: bc BuildRequires: bison @@ -42,9 +36,11 @@ BuildRequires: python3-setuptools BuildRequires: python3-libfdt BuildRequires: SDL-devel BuildRequires: swig +%if %{with toolsonly} %ifarch aarch64 BuildRequires: arm-trusted-firmware-armv8 %endif +%endif Requires: dtc %description @@ -247,6 +243,11 @@ cp -p board/warp7/README builds/docs/README.warp7 %endif %changelog +* Sun Jun 12 2022 Peter Robinson - 2022.04-2 +- Fixes for Pine64 Pinebook Pro +- Fix for CVE-2022-30767 (NFSv2) +- Fix for CVE-2018-25032 (zlib) + * Mon Apr 04 2022 Peter Robinson - 2022.04-1 - Update to 2022.04 GA diff --git a/uefi-distro-load-FDT-from-any-partition-on-boot-device.patch b/uefi-distro-load-FDT-from-any-partition-on-boot-device.patch deleted file mode 100644 index c28fdb0..0000000 --- a/uefi-distro-load-FDT-from-any-partition-on-boot-device.patch +++ /dev/null @@ -1,84 +0,0 @@ -From fd3434c754b3b8dddb345352a2434b6b8445343a Mon Sep 17 00:00:00 2001 -From: Peter Robinson -Date: Sun, 18 Apr 2021 14:05:45 +0100 -Subject: [PATCH] distro: load FDT from any partition on boot device - -In the EFI_LOADER boot path, we were only checking the FAT partition -containing the EFI payload for dtb files. But this is somewhat of a -fiction. In reality there will be one small (V)FAT partition containing -grub (or whatever the payload may be), and a second boot partition -containing kernel/initrd/fdt (typically ext4). It is this second -partition where we should be looking for a FDT to load. - -So instead scan all the partitions of the disk containing the EFI -payload. This matches where grub looks for kernel/initrd (barring -custom grub.cfg, in which case the user can use grub's 'devicetree' -command to load the correct FDT). - -The other option is somehow passing the ${fdtfile} to grub so that it -can load the FDT based on selected kernel version location (which grub -knows) and SoC/board specific ${fdtfile} (which grub does not know). - -Signed-off-by: Rob Clark -Signed-off-by: Peter Robinson ---- - include/config_distro_bootcmd.h | 35 ++++++++++++++++++++++----------- - 1 file changed, 23 insertions(+), 12 deletions(-) - -diff --git a/include/config_distro_bootcmd.h b/include/config_distro_bootcmd.h -index 2627c2a6a5..eadd1080b3 100644 ---- a/include/config_distro_bootcmd.h -+++ b/include/config_distro_bootcmd.h -@@ -148,26 +148,37 @@ - "fi\0" \ - \ - "load_efi_dtb=" \ -- "load ${devtype} ${devnum}:${distro_bootpart} " \ -- "${fdt_addr_r} ${prefix}${efi_fdtfile}\0" \ -+ "load ${devtype} ${devnum}:${dtb_devp} " \ -+ "${fdt_addr_r} ${prefix}${efi_fdtfile} && " \ -+ "run boot_efi_binary\0" \ - \ - "efi_dtb_prefixes=/ /dtb/ /dtb/current/\0" \ -- "scan_dev_for_efi=" \ -+ "scan_dev_for_dtb=" \ - "setenv efi_fdtfile ${fdtfile}; " \ - BOOTENV_EFI_SET_FDTFILE_FALLBACK \ -- "for prefix in ${efi_dtb_prefixes}; do " \ -- "if test -e ${devtype} " \ -- "${devnum}:${distro_bootpart} " \ -- "${prefix}${efi_fdtfile}; then " \ -- "run load_efi_dtb; " \ -- "fi;" \ -- "done;" \ -- "run boot_efi_bootmgr;" \ -+ "part list ${devtype} ${devnum} dtb_devplist; " \ -+ "env exists dtb_devplist || setenv dtb_devplist " \ -+ "${distro_bootpart}; " \ -+ "for dtb_devp in ${dtb_devplist}; do " \ -+ "for prefix in ${efi_dtb_prefixes}; do " \ -+ "if test -e ${devtype} " \ -+ "${devnum}:${dtb_devp} " \ -+ "${prefix}${efi_fdtfile};"\ -+ " then " \ -+ "echo Found DTB ${devtype} " \ -+ "${devnum}:${dtb_devp} " \ -+ "${prefix}${efi_fdtfile};"\ -+ "run load_efi_dtb; " \ -+ "fi;" \ -+ "done; " \ -+ "done; " \ -+ "run boot_efi_binary\0" \ -+ "scan_dev_for_efi=" \ - "if test -e ${devtype} ${devnum}:${distro_bootpart} " \ - "efi/boot/"BOOTEFI_NAME"; then " \ - "echo Found EFI removable media binary " \ - "efi/boot/"BOOTEFI_NAME"; " \ -- "run boot_efi_binary; " \ -+ "run scan_dev_for_dtb; " \ - "echo EFI LOAD FAILED: continuing...; " \ - "fi; " \ - "setenv efi_fdtfile\0" --- -2.31.1 - diff --git a/zlib-Port-fix-for-CVE-2018-25032-to-U-Boot.patch b/zlib-Port-fix-for-CVE-2018-25032-to-U-Boot.patch new file mode 100644 index 0000000..0c7d3f1 --- /dev/null +++ b/zlib-Port-fix-for-CVE-2018-25032-to-U-Boot.patch @@ -0,0 +1,382 @@ +From patchwork Tue May 10 18:36:59 2022 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +X-Patchwork-Submitter: Tom Rini +X-Patchwork-Id: 1629327 +X-Patchwork-Delegate: trini@ti.com +Return-Path: +X-Original-To: incoming@patchwork.ozlabs.org +Delivered-To: patchwork-incoming@bilbo.ozlabs.org +Authentication-Results: ozlabs.org; + spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de + (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; + envelope-from=u-boot-bounces@lists.denx.de; receiver=) +Received: from phobos.denx.de (phobos.denx.de + [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) + (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) + key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest + SHA256) + (No client certificate requested) + by bilbo.ozlabs.org (Postfix) with ESMTPS id 4KyRbn5BX1z9sGD + for ; Wed, 11 May 2022 04:37:23 +1000 (AEST) +Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) + by phobos.denx.de (Postfix) with ESMTP id A92288427E; + Tue, 10 May 2022 20:37:11 +0200 (CEST) +Authentication-Results: phobos.denx.de; + dmarc=fail (p=none dis=none) header.from=konsulko.com +Authentication-Results: phobos.denx.de; + spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de +Received: by phobos.denx.de (Postfix, from userid 109) + id 5EE118428F; Tue, 10 May 2022 20:37:09 +0200 (CEST) +X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de +X-Spam-Level: +X-Spam-Status: No, score=-1.4 required=5.0 tests=BAYES_00, + FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS, + RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_PASS, + T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.2 +Received: from mail-qt1-f170.google.com (mail-qt1-f170.google.com + [209.85.160.170]) + (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) + (No client certificate requested) + by phobos.denx.de (Postfix) with ESMTPS id BC6F78425F + for ; Tue, 10 May 2022 20:37:04 +0200 (CEST) +Authentication-Results: phobos.denx.de; + dmarc=fail (p=none dis=none) header.from=konsulko.com +Authentication-Results: phobos.denx.de; + spf=pass smtp.mailfrom=tom.rini@gmail.com +Received: by mail-qt1-f170.google.com with SMTP id t11so14204577qto.11 + for ; Tue, 10 May 2022 11:37:04 -0700 (PDT) +X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; + d=1e100.net; s=20210112; + h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version + :content-transfer-encoding; + bh=GgFA2F9spTDeRgG1dsLXhCI+5ME44EB+UP3kk83/r+w=; + b=zXRRyKVcPVLTBD71EFJ8uajlzRqX7d1i0mFi4MLdw5LEfjtJtJZQd2KHjhXseHEt6+ + XxaSQG1Ari1f3adpf7Hsb9AeDE/8GhnOcICHTI+0E3I5Q8OHjkp0EaLnIdRL4Z97HnQf + eCGtIivU6CIxghbp6568d/w6D0mnyUSer35LbNvFlwW85yU1RcYkDauFIzgeBm/1Fdtd + yMZCjr5qDnCiJwYexp6nXQl8o2BoAAfiq+n0g7N3ICV7e5WJtF/eqlmBq1Ms2efxOO3R + d2rbTNK7RYrre27RBiCUN4e9GZVHysh02bfEEXMU1rWycFyb/hJLxvJYjrMGgqnu4nz1 + FNHQ== +X-Gm-Message-State: AOAM5309WCz7CJBM2JlQOX65gbWpmgAdZizCBB/LDQr1lGxbGBzhzSrA + CezrRFVNnNFZF/xP4PS2NQYxp/Y9eg== +X-Google-Smtp-Source: + ABdhPJxl7/5tGPSU+8kNV89P2lLdCce/fnYp8Eu6BTaaU6Tpe4ZLkfgOMXgKFOfElwDGofc1XUpPug== +X-Received: by 2002:a05:622a:1aa5:b0:2f3:b433:5dc1 with SMTP id + s37-20020a05622a1aa500b002f3b4335dc1mr20827993qtc.53.1652207823150; + Tue, 10 May 2022 11:37:03 -0700 (PDT) +Received: from bill-the-cat.lan + (2603-6081-7b01-4500-b057-3c7b-12c2-aabf.res6.spectrum.com. + [2603:6081:7b01:4500:b057:3c7b:12c2:aabf]) + by smtp.gmail.com with ESMTPSA id + bi5-20020a05620a318500b0069fd12a957bsm4199878qkb.17.2022.05.10.11.37.02 + (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); + Tue, 10 May 2022 11:37:02 -0700 (PDT) +From: Tom Rini +To: u-boot@lists.denx.de +Cc: "Gan, Yau Wai" +Subject: [PATCH] zlib: Port fix for CVE-2018-25032 to U-Boot +Date: Tue, 10 May 2022 14:36:59 -0400 +Message-Id: <20220510183659.1749717-1-trini@konsulko.com> +X-Mailer: git-send-email 2.25.1 +MIME-Version: 1.0 +X-BeenThere: u-boot@lists.denx.de +X-Mailman-Version: 2.1.39 +Precedence: list +List-Id: U-Boot discussion +List-Unsubscribe: , + +List-Archive: +List-Post: +List-Help: +List-Subscribe: , + +Errors-To: u-boot-bounces@lists.denx.de +Sender: "U-Boot" +X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de +X-Virus-Status: Clean + +While our copy of zlib is missing upstream commit 263b1a05b04e ("Allow +deflatePrime() to insert bits in the middle of a stream.") we do have +Z_FIXED support, and so the majority of the code changes in 5c44459c3b28 +("Fix a bug that can crash deflate on some input when using Z_FIXED.") +apply here directly and cleanly. As this has been assigned a CVE, lets +go and apply these changes. + +Link: https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531 +Reported-by: "Gan, Yau Wai" +Signed-off-by: Tom Rini +--- + lib/zlib/deflate.c | 64 +++++++++++++++++++++++++++++++++++----------- + lib/zlib/deflate.h | 25 ++++++++---------- + lib/zlib/trees.c | 50 ++++++++++-------------------------- + 3 files changed, 74 insertions(+), 65 deletions(-) + +diff --git a/lib/zlib/deflate.c b/lib/zlib/deflate.c +index 63473359e456..4549f4dc12a0 100644 +--- a/lib/zlib/deflate.c ++++ b/lib/zlib/deflate.c +@@ -223,11 +223,6 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, + int wrap = 1; + static const char my_version[] = ZLIB_VERSION; + +- ushf *overlay; +- /* We overlay pending_buf and d_buf+l_buf. This works since the average +- * output size for (length,distance) codes is <= 24 bits. +- */ +- + if (version == Z_NULL || version[0] != my_version[0] || + stream_size != sizeof(z_stream)) { + return Z_VERSION_ERROR; +@@ -287,9 +282,47 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, + + s->lit_bufsize = 1 << (memLevel + 6); /* 16K elements by default */ + +- overlay = (ushf *) ZALLOC(strm, s->lit_bufsize, sizeof(ush)+2); +- s->pending_buf = (uchf *) overlay; +- s->pending_buf_size = (ulg)s->lit_bufsize * (sizeof(ush)+2L); ++ /* We overlay pending_buf and sym_buf. This works since the average size ++ * for length/distance pairs over any compressed block is assured to be 31 ++ * bits or less. ++ * ++ * Analysis: The longest fixed codes are a length code of 8 bits plus 5 ++ * extra bits, for lengths 131 to 257. The longest fixed distance codes are ++ * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest ++ * possible fixed-codes length/distance pair is then 31 bits total. ++ * ++ * sym_buf starts one-fourth of the way into pending_buf. So there are ++ * three bytes in sym_buf for every four bytes in pending_buf. Each symbol ++ * in sym_buf is three bytes -- two for the distance and one for the ++ * literal/length. As each symbol is consumed, the pointer to the next ++ * sym_buf value to read moves forward three bytes. From that symbol, up to ++ * 31 bits are written to pending_buf. The closest the written pending_buf ++ * bits gets to the next sym_buf symbol to read is just before the last ++ * code is written. At that time, 31*(n-2) bits have been written, just ++ * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at ++ * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1 ++ * symbols are written.) The closest the writing gets to what is unread is ++ * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and ++ * can range from 128 to 32768. ++ * ++ * Therefore, at a minimum, there are 142 bits of space between what is ++ * written and what is read in the overlain buffers, so the symbols cannot ++ * be overwritten by the compressed data. That space is actually 139 bits, ++ * due to the three-bit fixed-code block header. ++ * ++ * That covers the case where either Z_FIXED is specified, forcing fixed ++ * codes, or when the use of fixed codes is chosen, because that choice ++ * results in a smaller compressed block than dynamic codes. That latter ++ * condition then assures that the above analysis also covers all dynamic ++ * blocks. A dynamic-code block will only be chosen to be emitted if it has ++ * fewer bits than a fixed-code block would for the same set of symbols. ++ * Therefore its average symbol length is assured to be less than 31. So ++ * the compressed data for a dynamic block also cannot overwrite the ++ * symbols from which it is being constructed. ++ */ ++ ++ s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4); ++ s->pending_buf_size = (ulg)s->lit_bufsize * 4; + + if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL || + s->pending_buf == Z_NULL) { +@@ -298,8 +331,12 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, + deflateEnd (strm); + return Z_MEM_ERROR; + } +- s->d_buf = overlay + s->lit_bufsize/sizeof(ush); +- s->l_buf = s->pending_buf + (1+sizeof(ush))*s->lit_bufsize; ++ s->sym_buf = s->pending_buf + s->lit_bufsize; ++ s->sym_end = (s->lit_bufsize - 1) * 3; ++ /* We avoid equality with lit_bufsize*3 because of wraparound at 64K ++ * on 16 bit machines and because stored blocks are restricted to ++ * 64K-1 bytes. ++ */ + + s->level = level; + s->strategy = strategy; +@@ -935,7 +972,6 @@ int ZEXPORT deflateCopy (dest, source) + #else + deflate_state *ds; + deflate_state *ss; +- ushf *overlay; + + + if (source == Z_NULL || dest == Z_NULL || source->state == Z_NULL) { +@@ -955,8 +991,7 @@ int ZEXPORT deflateCopy (dest, source) + ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte)); + ds->prev = (Posf *) ZALLOC(dest, ds->w_size, sizeof(Pos)); + ds->head = (Posf *) ZALLOC(dest, ds->hash_size, sizeof(Pos)); +- overlay = (ushf *) ZALLOC(dest, ds->lit_bufsize, sizeof(ush)+2); +- ds->pending_buf = (uchf *) overlay; ++ ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4); + + if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL || + ds->pending_buf == Z_NULL) { +@@ -970,8 +1005,7 @@ int ZEXPORT deflateCopy (dest, source) + zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size); + + ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf); +- ds->d_buf = overlay + ds->lit_bufsize/sizeof(ush); +- ds->l_buf = ds->pending_buf + (1+sizeof(ush))*ds->lit_bufsize; ++ ds->sym_buf = ds->pending_buf + ds->lit_bufsize; + + ds->l_desc.dyn_tree = ds->dyn_ltree; + ds->d_desc.dyn_tree = ds->dyn_dtree; +diff --git a/lib/zlib/deflate.h b/lib/zlib/deflate.h +index cbf0d1ea5d96..4c53b94af0b0 100644 +--- a/lib/zlib/deflate.h ++++ b/lib/zlib/deflate.h +@@ -211,7 +211,7 @@ typedef struct internal_state { + /* Depth of each subtree used as tie breaker for trees of equal frequency + */ + +- uchf *l_buf; /* buffer for literals or lengths */ ++ uchf *sym_buf; /* buffer for distances and literals/lengths */ + + uInt lit_bufsize; + /* Size of match buffer for literals/lengths. There are 4 reasons for +@@ -233,13 +233,8 @@ typedef struct internal_state { + * - I can't count above 4 + */ + +- uInt last_lit; /* running index in l_buf */ +- +- ushf *d_buf; +- /* Buffer for distances. To simplify the code, d_buf and l_buf have +- * the same number of elements. To use different lengths, an extra flag +- * array would be necessary. +- */ ++ uInt sym_next; /* running index in sym_buf */ ++ uInt sym_end; /* symbol table full when sym_next reaches this */ + + ulg opt_len; /* bit length of current block with optimal trees */ + ulg static_len; /* bit length of current block with static trees */ +@@ -318,20 +313,22 @@ void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf, + + # define _tr_tally_lit(s, c, flush) \ + { uch cc = (c); \ +- s->d_buf[s->last_lit] = 0; \ +- s->l_buf[s->last_lit++] = cc; \ ++ s->sym_buf[s->sym_next++] = 0; \ ++ s->sym_buf[s->sym_next++] = 0; \ ++ s->sym_buf[s->sym_next++] = cc; \ + s->dyn_ltree[cc].Freq++; \ +- flush = (s->last_lit == s->lit_bufsize-1); \ ++ flush = (s->sym_next == s->sym_end); \ + } + # define _tr_tally_dist(s, distance, length, flush) \ + { uch len = (length); \ + ush dist = (distance); \ +- s->d_buf[s->last_lit] = dist; \ +- s->l_buf[s->last_lit++] = len; \ ++ s->sym_buf[s->sym_next++] = dist; \ ++ s->sym_buf[s->sym_next++] = dist >> 8; \ ++ s->sym_buf[s->sym_next++] = len; \ + dist--; \ + s->dyn_ltree[_length_code[len]+LITERALS+1].Freq++; \ + s->dyn_dtree[d_code(dist)].Freq++; \ +- flush = (s->last_lit == s->lit_bufsize-1); \ ++ flush = (s->sym_next == s->sym_end); \ + } + #else + # define _tr_tally_lit(s, c, flush) flush = _tr_tally(s, 0, c) +diff --git a/lib/zlib/trees.c b/lib/zlib/trees.c +index 700c62f6d7b9..970bc5dbc64e 100644 +--- a/lib/zlib/trees.c ++++ b/lib/zlib/trees.c +@@ -425,7 +425,7 @@ local void init_block(s) + + s->dyn_ltree[END_BLOCK].Freq = 1; + s->opt_len = s->static_len = 0L; +- s->last_lit = s->matches = 0; ++ s->sym_next = s->matches = 0; + } + + #define SMALLEST 1 +@@ -962,7 +962,7 @@ void ZLIB_INTERNAL _tr_flush_block(s, buf, stored_len, last) + + Tracev((stderr, "\nopt %lu(%lu) stat %lu(%lu) stored %lu lit %u ", + opt_lenb, s->opt_len, static_lenb, s->static_len, stored_len, +- s->last_lit)); ++ s->sym_next / 3)); + + if (static_lenb <= opt_lenb) opt_lenb = static_lenb; + +@@ -1029,8 +1029,9 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc) + unsigned dist; /* distance of matched string */ + unsigned lc; /* match length-MIN_MATCH or unmatched char (if dist==0) */ + { +- s->d_buf[s->last_lit] = (ush)dist; +- s->l_buf[s->last_lit++] = (uch)lc; ++ s->sym_buf[s->sym_next++] = dist; ++ s->sym_buf[s->sym_next++] = dist >> 8; ++ s->sym_buf[s->sym_next++] = lc; + if (dist == 0) { + /* lc is the unmatched char */ + s->dyn_ltree[lc].Freq++; +@@ -1045,30 +1046,7 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc) + s->dyn_ltree[_length_code[lc]+LITERALS+1].Freq++; + s->dyn_dtree[d_code(dist)].Freq++; + } +- +-#ifdef TRUNCATE_BLOCK +- /* Try to guess if it is profitable to stop the current block here */ +- if ((s->last_lit & 0x1fff) == 0 && s->level > 2) { +- /* Compute an upper bound for the compressed length */ +- ulg out_length = (ulg)s->last_lit*8L; +- ulg in_length = (ulg)((long)s->strstart - s->block_start); +- int dcode; +- for (dcode = 0; dcode < D_CODES; dcode++) { +- out_length += (ulg)s->dyn_dtree[dcode].Freq * +- (5L+extra_dbits[dcode]); +- } +- out_length >>= 3; +- Tracev((stderr,"\nlast_lit %u, in %ld, out ~%ld(%ld%%) ", +- s->last_lit, in_length, out_length, +- 100L - out_length*100L/in_length)); +- if (s->matches < s->last_lit/2 && out_length < in_length/2) return 1; +- } +-#endif +- return (s->last_lit == s->lit_bufsize-1); +- /* We avoid equality with lit_bufsize because of wraparound at 64K +- * on 16 bit machines and because stored blocks are restricted to +- * 64K-1 bytes. +- */ ++ return (s->sym_next == s->sym_end); + } + + /* =========================================================================== +@@ -1081,13 +1059,14 @@ local void compress_block(s, ltree, dtree) + { + unsigned dist; /* distance of matched string */ + int lc; /* match length or unmatched char (if dist == 0) */ +- unsigned lx = 0; /* running index in l_buf */ ++ unsigned sx = 0; /* running index in sym_buf */ + unsigned code; /* the code to send */ + int extra; /* number of extra bits to send */ + +- if (s->last_lit != 0) do { +- dist = s->d_buf[lx]; +- lc = s->l_buf[lx++]; ++ if (s->sym_next != 0) do { ++ dist = s->sym_buf[sx++] & 0xff; ++ dist += (unsigned)(s->sym_buf[sx++] & 0xff) << 8; ++ lc = s->sym_buf[sx++]; + if (dist == 0) { + send_code(s, lc, ltree); /* send a literal byte */ + Tracecv(isgraph(lc), (stderr," '%c' ", lc)); +@@ -1112,11 +1091,10 @@ local void compress_block(s, ltree, dtree) + } + } /* literal or match pair ? */ + +- /* Check that the overlay between pending_buf and d_buf+l_buf is ok: */ +- Assert((uInt)(s->pending) < s->lit_bufsize + 2*lx, +- "pendingBuf overflow"); ++ /* Check that the overlay between pending_buf and sym_buf is ok: */ ++ Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow"); + +- } while (lx < s->last_lit); ++ } while (sx < s->sym_next); + + send_code(s, END_BLOCK, ltree); + s->last_eob_len = ltree[END_BLOCK].Len;