Commit Graph

1093 Commits

Author SHA1 Message Date
Julien Olivain
9868f67d38 boot/edk2: add a new Kconfig option to pass arbitrary build options
EDK2 build may include extra options. Those are usually in the form
of "-D SOMEFLAG_ENABLE" and might be specific for a processor
architecture or a platform. For example:
"-D NETWORK_HTTP_BOOT_ENABLE", "-D NETWORK_TLS_ENABLE", ...

Those options are generally documented in their respective packages.
See for example:
https://github.com/tianocore/edk2/blob/master/OvmfPkg/README

This commit adds a new Kconfig string option to let the use define
arbitrary build flags.

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-01-16 21:25:30 +01:00
Dario Binacchi
98e71e54ba boot/uboot: bump to version 2026.01
Release announcement:
https://lists.denx.de/pipermail/u-boot/2026-January/606771.html

Changelog:
https://github.com/u-boot/u-boot/compare/v2025.10...v2026.01

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-01-07 15:06:09 +01:00
Quentin Schulz
088bec09fb boot/uboot: fix externally provided env file not used on 2025.10
fb5235239aad ("env: Rename DEFAULT_ENV_FILE to
ENV_DEFAULT_ENV_TEXT_FILE") renamed the Kconfig symbols and thus we need
to adapt the U-Boot package in Buildroot to support it.

Fixes: 128c26f287 ("boot/uboot: bump to version 2025.10")
Reported-by: Ozan Durgut <ozandurgut.2001@hotmail.com>
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-01-02 23:39:33 +01:00
Philip Molloy
2ef9fd947e boot/uboot: add ADSP LDR binary format
Signed-off-by: Philip Molloy <philip.molloy@analog.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-01-02 18:51:42 +01:00
Neal Frager
6019df8f99 boot/arm-trusted-firmware: override BL31 environment variable error
When building the arm-trusted-firmware, if the host environment has a value
configured in the BL31 variable such as the following:

export BL31=/tmp/bl31.elf

This will cause the build of the bl31.elf to be skipped leading to the
following build error:

make[1]: Nothing to be done for 'bl31'.
And then:
readelf: Error: './output/build/arm-trusted-firmware-custom/build/versal/release/bl31/bl31.elf': No such file

To fix this, clear the BL31 variable in the MAKE_OPTS, so that building the
arm-trusted-firmware will build regardless of the host environment.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-01-02 18:26:47 +01:00
Thomas Perale
2a2184f317 boot/grub2: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

The IGNORE_CVES entries introduced in [2][3][4] are then no longer
matched to the grub2 package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching
[2] 2495630383 boot/grub2: ignore CVE-2024-1048
[3] e2f46ed03d boot/grub2: ignore CVE-2023-4001
[4] a490687571 boot/grub2: ignore the last 3 remaining CVEs

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-12-30 11:54:12 +01:00
Peter Korsgaard
ff0bd00468 boot/s500-bootloader: drop package
With the removal of the roseapplepi defconfig in commit 56091a5818
("configs/roseapplepi: remove defconfig, broken") there are no (in-tree)
users of the s500-bootloader binary blob package, so drop it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-12-29 17:52:30 +01:00
Thomas Perale
d464e5e856 boot/grub2: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-12-28 22:00:03 +01:00
Peter Korsgaard
148cd0c3c1 Merge branch 'next' 2025-12-12 08:23:49 +01:00
Neal Frager
df4a87e6e6 boot/xilinx-prebuilt: add local versal xsa support
Most of the time, users will be running Vivado on their local host machine,
and will generate a XSA (Xilinx Shell Archive) locally.

Instead of requiring users to create a URL location for their XSA file,
this patch improves ease of use by allowing users to work directly with
just a path on the local host machine.

BR2_TARGET_XILINX_PREBUILT_VERSAL_XSA_LOCATION can thus be defined as either
a simple local location or a URL location for the XSA file.

In either case, a hash for the XSA file needs to be added to the
boot/xilinx-prebuilt/xilinx-prebuilt.hash when using this option.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-12-05 21:56:55 +01:00
Neal Frager
1609e85322 boot/xilinx-prebuilt: add versal2 support
Add support for Xilinx versal2 devices to download the boot.pdi, pld.pdi and
plm.elf files from the Xilinx/soc-prebuilt-firmware repo.

Since the psmfw.elf does not exist for versal2 devices, the installation of
this image has been split out for original versal devices only, whereas the
other images are all common between versal and versal2 device families.

For more information about the Xilinx Versal Gen2 series:
https://www.amd.com/en/products/adaptive-socs-and-fpgas/versal/gen2/ai-edge-series.html
https://www.amd.com/en/products/adaptive-socs-and-fpgas/versal/gen2/prime-series.html

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-12-03 19:27:56 +01:00
Neal Frager
c7d703b202 boot/xilinx-embeddedsw: add versal2 support
Add support for Xilinx versal2 devices which include two new applications
for the xilinx-embeddedsw package.

BR2_TARGET_XILINX_EMBEDDEDSW_VERSAL2_PLM
There is a new PLM (platform loader and manager) application for versal2
devices. The purpose of the PLM is to act as the bootloader for loading the
boot.pdi to configure the DDR memory and then loading arm-trusted-firmware and
u-boot on the Cortex-A78 core 0.

BR2_TARGET_XILINX_EMBEDDEDSW_VERSAL2_ASUFW
Included with versal2 devices is a risc-v based security accelerator called
the ASU (application security unit). The ASUFW is the open-source application
which runs on the ASU.

Versal2 devices simplified the boot process by getting rid of the second
microblaze core called the PSM (processor system manager). There is thus no
longer a need for a separate psmfw application like with the original versal
devices, as this functionality is now fully included in the new PLM for
versal2.

For more information about the Xilinx Versal Gen2 series:
https://www.amd.com/en/products/adaptive-socs-and-fpgas/versal/gen2/ai-edge-series.html
https://www.amd.com/en/products/adaptive-socs-and-fpgas/versal/gen2/prime-series.html

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-12-03 19:27:56 +01:00
Neal Frager
7f09843acb boot/xilinx-prebuilt: bump default to xilinx_v2025.2
Now that all Xilinx board configs have been bumped to xilinx_v2025.2, bump the
default version of xilinx-prebuilt to xilinx_v2025.2.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-27 08:31:04 +01:00
Neal Frager
b922c47134 boot/xilinx-embeddedsw: bump default to xilinx_v2025.2
Now that all Xilinx board configs have been bumped to xilinx_v2025.2, bump the
default version of xilinx-embeddedsw to xilinx_v2025.2.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-26 22:52:03 +01:00
Neal Frager
8d278b8f30 boot/xilinx-prebuilt: add xilinx_v2025.2 hash
Add hash for xilinx_v2025.2 version, so that example defconfigs can be
bumped to the latest version individually.

Since the license.txt changes with each release, move the hashes to version
specific directories instead of having a generic hash file.

xilinx_v2025.1 hash is moved to boot/xilinx-prebuilt/xilinx_v2025.1_update1
xilinx_v2025.2 hash is added to boot/xilinx-prebuilt/xilinx_v2025.2

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-26 11:43:47 +01:00
Neal Frager
9c1dfb6199 boot/xilinx-embeddedsw: add xilinx_v2025.2 hash
Add hash for xilinx_v2025.2 version, so that example defconfigs can be
bumped to the latest version individually.

Since the license.txt changes with each release, move the hashes to version
specific directories instead of having a generic hash file.

xilinx_v2025.1 hash is moved to boot/xilinx-embeddedsw/xilinx_v2025.1
xilinx_v2025.2 hash is added to boot/xilinx-embeddedsw/xilinx_v2025.2

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-26 11:37:47 +01:00
Bernd Kuhls
531a39d21e boot/syslinux: add -std=gnu17 only for gcc >= 8
Buildroot commit f5101638b9 unconditionally
added -std=gnu17 breaking the build with older gcc versions:
https://lore.kernel.org/buildroot/20250815121815.436050ec@windsurf/

Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: update message url to use lore]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-11-24 21:31:14 +01:00
Julien Olivain
a675057bda boot/edk2: bump to version edk2-stable202508
For release notes since edk2-stable202505, see:
https://github.com/tianocore/edk2/releases/tag/edk2-stable202508

This commit also updates the edk2-platforms packages with the last
commit merged at the edk2 release date (2025-08-12), which corresponds
to commit [1].
The edk2-non-osi package is not updated because it did not received
any commit since the last edk2 bump.

This commit has been runtime tested with tests using EDK2 package,
with commands:

    support/testing/run-tests \
        -d dl -o output_folder \
            tests.boot.test_edk2 \
            tests.boot.test_grub.TestGrubAArch64EFI \
            tests.boot.test_grub.TestGrubi386EFI \
            tests.boot.test_grub.TestGrubRiscV64EFI \
            tests.boot.test_grub.TestGrubX8664EFI \
            tests.fs.test_iso9660.TestIso9660Grub2EFI \
            tests.fs.test_iso9660.TestIso9660Grub2Hybrid \
            tests.package.test_fwts

It has also been runtime tested (by booting in qemu) with defconfigs
using EDK2 package:
qemu_aarch64_sbsa_defconfig
qemu_loongarch64_virt_efi_defconfig
qemu_riscv64_virt_efi_defconfig

[1] d1b297b2aa

Cc: Dick Olsson <hi@senzilla.io>
Cc: Romain Naour <romain.naour@smile.fr>
Cc: Vincent Stehlé <vincent.stehle@arm.com>
Tested-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-11-12 08:55:55 +01:00
Dario Binacchi
128c26f287 boot/uboot: bump to version 2025.10
Release announcement:
https://lists.denx.de/pipermail/u-boot/2025-October/599798.html

Changelog:
https://github.com/u-boot/u-boot/compare/v2025.07...v2025.10

With upstream commit a239b0b0b6db ("Add symlink from gpl-2.0.txt to
a COPYING file"), COPYING is now a symlink to Licenses/gpl-2.0.txt,
causing the install command in UBOOT_COPY_OLD_LICENSE_FILE to fail
because the source and destination refer to the same file. To avoid
this, copy the license file only if Licenses/gpl-2.0.txt does not
already exist.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-10-10 13:43:39 +02:00
Peter Korsgaard
6e06a69fd2 boot/shim: bump to version 16.1
For various bugfixes. For details, see:

https://github.com/rhboot/shim/releases/tag/16.1

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-10-07 21:46:13 +02:00
Neal Frager
97ecafec89 boot/xilinx-prebuilt: simplify family logic
Currently, the xilinx-prebuilt package uses an if-then-else statement for
deciding which files need to be installed from the xilinx-prebuilt repo. This
works fine for now because there are really only two options, either versal or
zynqmp/kria.

Starting with the xilinx_v2025.2 release, the versal2 family along with the
vek385 board will be added to Buildroot and thus the xilinx-prebuilt package
as well. In the future, additional families will also probably be added to
this package.

To avoid creating a long if-then-else-then-else statement which will only grow
in complexity over time, simplify the logic of the xilinx-prebuilt package by
giving each xilinx family its own if statement. In the long term, this will
make the xilinx-prebuilt package easier to understand and maintain.

For this reason, this patch moves the zynqmp/kria families from the "else"
statement to having an if statement separate from the versal family.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-30 21:20:55 +02:00
Neal Frager
93977c592d boot/xilinx-prebuilt: bump default version to xilinx_v2025.1_update1
Bump the xilinx-prebuilt default version to xilinx_v2025.1_update1, so that
all versal defconfigs use this new release tag.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 19:20:08 +02:00
Neal Frager
4ff963bffd boot/xilinx-prebuilt: add hash for xilinx_v2025.1_update1 tag
Add the xilinx_v2025.1_update1 release tag hash to the xilinx-prebuilt
package, so that Xilinx boards can use this new release tag.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 19:20:08 +02:00
Neal Frager
6f435187c6 boot/xilinx-prebuilt: add support for plmfw.elf filename
AMD / Xilinx has made the decision to change the name of plm.elf to plmfw.elf
in the prebuilt binaries repo starting with the next update.

This patch updates the xilinx-prebuilt package to support either the old
plm.elf filename or the new plmfw.elf filename.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 19:20:08 +02:00
Neal Frager
5986c51219 boot/uboot: use BR2_TARGET_XILINX_FIRMWARE_ARCH_SUPPORTS
Migrate the BR2_TARGET_UBOOT_ZYNQMP dependency to the new
BR2_TARGET_XILINX_FIRMWARE_ARCH_SUPPORTS symbol. Also, add a cpu dependency
on BR2_cortex_a53 since the zynqmp platform is based on the ARM Cortex-A53
and the BR2_TARGET_UBOOT_ZYNQMP should not be available for other CPUs with
aarch64 architecture.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 19:10:31 +02:00
Neal Frager
92f76f6c35 boot/xilinx-prebuilt: only allow binaries for device family
Add an architecture cpu dependency to each family to make sure that users can
only install prebuilt firmware which is applicable to their target device
family.

The versal family is based on BR2_cortex_a72.

The kria and zynqmp families are based on BR2_cortex_a53.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 19:10:31 +02:00
Neal Frager
9e25bcfdab boot/xilinx-embeddedsw: only allow apps for device family
Add an architecture cpu dependency to each application to make sure that users
can only build applications which are applicable to their target device
family.

The versal_plm and versal_psmfw applications are specific to versal devices
which are based on BR2_cortex_a72.

The zynqmp_pmufw application is specific to zynqmp devices which are based on
BR2_cortex_a53.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 19:10:31 +02:00
Neal Frager
5b1a52aea0 boot: add BR2_TARGET_XILINX_FIRMWARE_ARCH_SUPPORTS
Currently, the xilinx-embeddedsw and xilinx-prebuilt packages are appearing
for any aarch64 processor. As all Xilinx processors that need these packages
are ARM Cortex-A53 or ARM Cortex-A72, this means that these packages are
often appearing as options for non-Xilinx platforms.

To reduce this occurrence, this patch creates a new symbol
BR2_TARGET_XILINX_FIRMWARE_ARCH_SUPPORTS to limit the appearance of the
xilinx-embeddedsw and xilinx-prebuilt boot packages to only platforms based
on the BR2_cortex_a53 or BR2_cortex_a72 CPU and aarch64 architecture.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-26 19:10:31 +02:00
Neal Frager
e0ed51ca8b boot/uboot: add cpu dependency to BR2_TARGET_UBOOT_ZYNQ
Since the Xilinx Zynq SoC family is always based on ARM Cortex-A9 CPUs, the
BR2_TARGET_UBOOT_ZYNQ option should only be available when the BR2_cortex_a9
option is selected.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-24 23:04:02 +02:00
Neal Frager
98b57fafdf boot/uboot: add support for custom zynq ps7_init_gpl.c
On Zynq, the booloader is responsible for some basic initializations, such as
enabling peripherals, DDR and configuring pinmuxes. The ps7_init_gpl.c file
(and optionally, ps7_init_gpl.h) contains the code for such initializations.

Although U-Boot contains ps7_init_gpl.c files for some boards, each of them
describes only one specific configuration. Users of a different board, or
needing a different configuration, can generate custom files using the Xilinx
Vivado development tools.

This patch adds Buildroot support for custom zynq ps7_init_gpl.c files in the
same way that is already done for zynqmp when working with custom hardware
that is not already supported by u-boot.

To test this feature, the following configs can be added to any zynq_defconfig:

BR2_TARGET_UBOOT_ZYNQ=y
BR2_TARGET_UBOOT_ZYNQ_PS7_INIT_FILE=<path to custom board ps7_init_gpl.c>

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Brandon Maier <brandon.maier@collins.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-09-24 23:02:41 +02:00
Julien Olivain
51fd6aaa8a boot/boot-wrapper-aarch64: bump to git commit b621b157b4 (2025-06-10)
Changelog:
git log --oneline ac6742520d..b621b157b4

b621b15 aarch64: Enable access into FEAT_SPE_FDS register from EL2 and below
785302c aarch64: Enable use of ZT0
7f5a545 aarch64: Enable use of FPMR
0f3a153 aarch64: shuffle ID_AA64PFR{0,1}_EL1 definitions
0e78492 Makefile: Ensure initrd parameters in /chosen are up-to-date
1571345 aarch64: Enable access into FEAT_PMUv3p9 registers from EL2 and below
e1b9137 aarch64: Enable access into FEAT_FGT2 registers from EL2 and below

Cc: Vincent Stehlé <vincent.stehle@laposte.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-09-16 22:02:43 +02:00
Julien Olivain
4b14018a38 boot/boot-wrapper-aarch64: add hash file
Since boot-wrapper-aarch64 introduction in commit [1]
"boot-wrapper-aarch64: new package", the package never received a hash
file. This commit adds it, including the source archive and license
hashes.

[1] 7689b72e00

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-09-16 22:00:30 +02:00
Julien Olivain
afff65c340 boot/boot-wrapper-aarch64/Config.in: switch homepage URL to https
Buildroot commit [1] ("package: replace git:// URLs with https://
URLs where possible") switched _SITE URL from git to https, but did
not updated the package homepage in Config.in.

This commit updates it to match the package _SITE URL.

[1] 6626bf7c5f

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-09-16 21:59:40 +02:00
Bryan Brattlof
b401a61f35 boot/ti-k3-boot-firmware: bump to 11.01.12
Bump to the latest tagged version of ti-linux-firmware to pull in
updates for TI's DM and TIFS firmware for TI's K3 processors

Signed-off-by: Bryan Brattlof <bb@ti.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
2025-09-10 13:21:09 +02:00
Bryan Brattlof
ebf0131e3e boot/ti-k3-boot-firmware: switch to github mirror
The git.ti.com cgit server continues to be plagued with reliability
issues which are reportedly from heavy bot traffic. To combat this the
system administrators have removed the archived downloads feature from
this server.

Switch to TI's Github mirror so new downloads continue to be possible.

Signed-off-by: Bryan Brattlof <bb@ti.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
2025-09-10 13:21:05 +02:00
Peter Korsgaard
0af159ae2b Merge branch 'next'
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-09-08 15:36:35 +02:00
Thomas Petazzoni
ded3e0045a boot/grub2: add patches to fix numerous CVEs
This patch brings the entire stack of Debian patches on grub2 titled
"cve-2025-jan" and available at:

  https://salsa.debian.org/grub-team/grub/-/tree/debian/2.12-9/debian/patches/cve-2025-jan?ref_type=tags

As of this exact Debian grub2 version 2.12-9. Some minor conflicts had
to be fixed. All patches are in upstream Grub master, but mixed with
hundreds of other changes, which is why Debian's effort to backport
them has been leveraged here.

In addition to those patches, 2 extra patches are added:

 0073-net-drivers-ieee1275-ofnet-Add-missing-grub_malloc.patch
 0074-Constant-time-grub_crypto_memcmp.patch

The first one fixes an issue in one of the earlier patches. The fix is
not in Debian, but is in upstream Grub.

The second one fixes another CVE, not fixed in Debian, but fixed in
OpenSUSE. This fix is not upstream as upstream has decided to move to
libgcrypt instead to avoid the problem, but that's a fairly large
change.

Overall, this patch fixes all CVEs currently reported by pkg-stats
against our grub2 package, namely:

CVE-2024-45777
CVE-2024-45778
CVE-2024-45779
CVE-2024-45780
CVE-2024-45782
CVE-2024-56737
CVE-2024-56738
CVE-2025-0678
CVE-2025-0684
CVE-2025-0685
CVE-2025-0686
CVE-2025-0689
CVE-2025-1125

With the previous fixes on runtime tests added (to use glibc
toolchains to build grub2 tests), this commit successfully passes all
tests:

- The ISO9660 tests that use grub2:
  https://gitlab.com/tpetazzoni/buildroot/-/pipelines/1985234563

- The grub2 tests:
  https://gitlab.com/tpetazzoni/buildroot/-/pipelines/1985234685

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien: also tested by building and booting
 - qemu_aarch64_sbsa_defconfig
 - qemu_arm_ebbr_defconfig
 - qemu_loongarch64_virt_efi_defconfig
 - qemu_riscv64_virt_efi_defconfig
 - pc_x86_64_bios_defconfig
 - pc_x86_64_efi_defconfig
]
Tested-by: Julien Olivain <ju.o@free.fr>
[Julien:
 - fix patch #72 upstream link to point to the initial patch
   sumbission rather than a reply
 - merge two _IGNORE_CVES blocks for patch #50 into a single one
 - order _IGNORE_CVES blocks by numerical patch order
 - order numerically the CVE list in commit log
 - add a "Fixes:" tag in patch #74 since its commit log does not
   mention the CVE.
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-08-19 02:50:55 +02:00
Breno Lima
c45735988e configs/freescale_imx93evk: Add OP-TEE OS support
Add OP-TEE OS Support. NXP BSP lf-6.12.3-1.0.0 version.

The i.MX93 Boot Container requires a raw TEE binary without a TEE header.
Update the imx9-bootloader-prepare.sh script and Config.in accordingly
to ensure compatibility with this requirement.

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Breno Lima <breno.lima@nxp.com>
Reviewed-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
[Julien: remove empty line in hash file to fix check-package error]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-08-14 23:56:22 +02:00
Bernd Kuhls
f5101638b9 boot/syslinux: fix build with gcc-15.x
Fixes build error with gcc-15.x:

drivers/net/3c509-eisa.c:39:26: error:  initialization of 'void (*)(void)'
 from incompatible pointer type 'void (*)(struct nic *, struct eisa_device *)'
 [-Wincompatible-pointer-types]

For a similar fix see https://bugzilla.suse.com/show_bug.cgi?id=1243225

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-07-31 16:04:45 +02:00
Jesse Taube
38c5b1e29e boot/opensbi: bump version to 1.7
Release notes at:
https://github.com/riscv-software-src/opensbi/releases/tag/v1.7

Signed-off-by: Jesse Taube <jesse@rivosinc.com>
[Julien: add missing BR2_TARGET_OPENSBI_VERSION default value]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-07-23 22:12:42 +02:00
Dario Binacchi
0802f39a78 boot/uboot: bump to version 2025.07
Release announcement:
https://lists.denx.de/pipermail/u-boot/2025-July/593789.html

Changelog:
https://github.com/u-boot/u-boot/compare/v2025.04...v2025.07

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-07-08 23:04:14 +02:00
Edgar Bonet
500678593f boot/at91bootstrap3: fix build with host GCC 15
Building at91bootstrap3 with GCC 15 fails with:

    include/types.h:23:23: error: ‘bool’ cannot be defined via ‘typedef’
       23 | typedef unsigned char bool;
          |                       ^~~~
    include/types.h:23:23: note: ‘bool’ is a keyword with ‘-std=c23’ onwards

This is due to GCC 15 defaulting to the C23 language dialect.

Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
2025-07-06 18:55:00 +02:00
Julien Olivain
7c0da58313 boot/shim: bump to version 16.0
For release note, see:
https://github.com/rhboot/shim/releases/tag/16.0

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-07-06 11:28:27 +02:00
Jiaxun Yang
269bb5d8bf boot/edk2: Add LoongArch64 OVMF support
LoongArch64 OVMF target is introduced to EDK2 in edk2-202408.

Enable architecture support here.

Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-07-05 19:45:38 +02:00
Jiaxun Yang
c4a4b8552f boot/grub2: Introduce loongarch64-efi target
loongarch64-efi target presents in GRUB can be utilised
by any EFI compatible LoongArch64 machine to boot kernel.

Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Reviewed-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-07-05 19:45:38 +02:00
Yann E. MORIN
48639f074c boot/syslinux: add option to install lpxelinux
lpxelinux is like pxelinux, except it allows retrieving the files for
the kernel (with the KERNEL directive) and initrd (the path to initrd=
in the APPEND directive) from FTP or HTTP, rather than just from TFTP.
Using HTTP or FTP is musch faster than TFTP, so the boot time for big
kernels or big initrds is much shorter than with TFTP.

Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
[Julien: fix typo in commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-06-29 11:52:43 +02:00
Yann E. MORIN
90e76818a1 boot/syslinux: fix install with top-level parallel build
syslinux is... special. It is a target package, but it is installed in
HOST_DIR *in the target install commands*: in addition to the boot files
that run on the target, syslinux installs a set of host tools that are
to be used at build time (e.g. extlinux, to prepare bootable media, like
an iso96660 image). Then, from HOST_DIR, the actual boot files are
copied into BINARIES_DIR (i.e. images/); we do it that way because the
boot files are scattered about everywhere in the build tree, while they
are all packed together in a single directory once installed.

However, there is no dependency between the target and image install
steps. So, when using top-level parallel builds, there is no guarantee
that the target install commands are finished before the image install
commands are started.

We fix that by first installing into a temporary location, as part of
the build step, and by then copying from there as part of the install
step. This ensures that the boot files are easily available, without
needing a dependency on the target install step, that we can't express.

Note that we do not change the actual installation into HOST_DIR: it can
be set up differently that our temporary location, and we do not want
to duplicate that setup here (it's going to diverge over time).

Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-06-29 11:45:42 +02:00
Julien Olivain
5ddba9702a boot/edk2: bump to version edk2-stable202505
For release notes since edk2-stable202411, see:
https://github.com/tianocore/edk2/releases/tag/edk2-stable202502
https://github.com/tianocore/edk2/releases/tag/edk2-stable202505

Note: the edk2-stable202505 release note mention a security fix.
This fix was already backported in Buildroot in a previous commit.
For that reason, this bump is not marked as securiy, and also
removes the backported patch and its associated _IGNORE_CVES entry.

Those versions include fixes when using gcc 15 (host and target).

This commit also updates the edk2-platforms and edk2-non-osi packages
with the last commit merged at the edk2 release date (2025-05-23).
In the case of edk2-platforms, the commit id used in this update
is few days later, to include a fix for the Arm Sgi575 platform.
Exact commit should have been [1] (to be exactly aligned to the edk2
tag date), but commit [2] is used instead. The package edk2-non-osi is
updated to commit [3].

Also, the SocioNext SynQuacer platforms (including the DeveloperBox)
were removed upstream in edk2-platforms commit [4]. This commit
reflect that change by removing those platforms choices and associated
runtime tests.

This commit has been runtime tested with tests using EDK2 package,
with commands:

    support/testing/run-tests \
        -d dl -o output_folder \
            tests.boot.test_edk2 \
            tests.boot.test_grub.TestGrubAArch64EFI \
            tests.boot.test_grub.TestGrubi386EFI \
            tests.boot.test_grub.TestGrubRiscV64EFI \
            tests.boot.test_grub.TestGrubX8664EFI \
            tests.fs.test_iso9660.TestIso9660Grub2EFI \
            tests.fs.test_iso9660.TestIso9660Grub2Hybrid \
            tests.package.test_fwts

It has also been runtime tested (by booting in qemu) with defconfigs
using EDK2 package:
qemu_aarch64_sbsa_defconfig
qemu_riscv64_virt_efi_defconfig

[1] 2bfe3fa99e
[2] 92f7d69e8a
[3] ea2040c2d4
[4] aaba5807f1

Cc: Dick Olsson <hi@senzilla.io>
Cc: Romain Naour <romain.naour@smile.fr>
Cc: Vincent Stehlé <vincent.stehle@arm.com>
Tested-by: Vincent Stehlé <vincent.stehle@arm.com>
Reviewed-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-06-25 19:30:18 +02:00
Julien Olivain
14d07d1914 boot/edk2: add security fix for CVE-2024-38805
This commit adds a security fix from the upstream commit:
b3a2f7ff24

It fixes CVE-2024-38805:
https://www.cve.org/CVERecord?id=CVE-2024-38805
Note: at the time of this commit, this CVE is "reserved" by a CNA.
Details will come later.

See also the associated pull request:
https://github.com/tianocore/edk2/pull/11042

This commit also adds the corresponding _IGNORE_CVES entry.

Reviewed-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-06-25 19:29:49 +02:00
Neal Frager
8ebb1c3edc boot/xilinx-embeddedsw: add comment dependencies
Since the comment about the xilinx-embeddedsw package needing a bare-metal
toolchain was moved to the start of the Config.in file, it is now printing
in make menuconfig for virtually all defconfigs.

By adding the same dependencies as the xilinx-embeddedsw package, the
comment will appear only when the xilinx-embeddedsw package is actually
selectable.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-06-15 11:55:50 +02:00