Commit Graph
106670 Commits
Author SHA1 Message Date
Tom Rini 6fd5e4b7e7 Merge tag 'u-boot-rockchip-2026.10-20260724' of https://git.u-boot-project.org/u-boot/custodians/u-boot-rockchip
- Switched to use upstream pinctrl header include,
- Dropped SDHCI DT properties in U-Boot-specific DT for NanoPi R5 as
  most are present upstream and those which aren't are breaking devices,
- Fixed ECC strength mismatch between reading and writing on non-0
  NAND chips configured as boot medium (nand-is-boot-medium),
- Moved Simon to reviewer for ARM ROCKCHIP,
- Fixed build issue related to GPT capsule support accessing a struct
  member only present when CONFIG_PARTITION_TYPE_GUID is set,
- Added support for new devices:
  - Anbernic RG-DS
  - ROC-RK3588S-PC
2026-07-27 11:05:58 -06:00
Tom Rini 7ffa20af30 Merge patch series "fs: regression-safe load <iface> for null_dev_desc_ok fstypes"
Vincent Jardin <vjardin@free.fr> says:

3 commits providing documentation of impacts and testing the dispatch
for null_dev_desc_ok fstypes (semihosting, ubifs, sandbox) in the
generic `load <iface> ...` command.

The test does not cover ubifs, I could not make it work with
qemu. Since the code logic is there and testing with semihost
is done, it should cover the needed cases.

Link: https://lore.kernel.org/r/20260715165735.3207801-1-vjardin@free.fr
2026-07-27 10:52:25 -06:00
Vincent JardinandTom Rini 0ccf0193a5 test: py: load: check null_dev_desc_ok dispatch
Some pytest modules exercising the dispatch added by
  fs: dispatch null_dev_desc_ok filesystems before lookup

test_load_semihosting.py:
  "load semihosting - <addr> <file>" and the optional
  [bytes] [pos] variant. Runs on qemu_arm64 with
  CONFIG_SEMIHOSTING=y; reuses test_hostfs.py's host-staged
  fixture.

test_load_sandbox.py:
  "load sandbox - <addr> <file>" and the optional [bytes] [pos]
  variant. Runs on sandbox (boardspec('sandbox')); the sandbox
  fstype is registered with name="sandbox" and
    null_dev_desc_ok=true,
  so the same fs_lookup_null_dev_info() helper that
  routes semihosting also routes the "sandbox".

A "load ubifs - <addr> <file>" test is intentionally not provided.
UBIFS is built on UBI on MTD, which requires some additional works
that are not available with qemu/sandbox-ing.

Signed-off-by: Vincent Jardin <vjardin@free.fr>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-07-27 09:07:39 -06:00
Vincent JardinandTom Rini c23eeeadfc doc: usage: cmd: load: null-block-device
Document the dispatch path added by the former commit

    fs: dispatch null_dev_desc_ok filesystems before lookup

Add a null-block-device interfaces section that:

  * lists the three fstypes that can benefit of it (semihosting, ubifs,
    sandbox) and the CONFIG option that builds each
  * explains the '-' convention for the unused <dev[:part]> field

Suggested-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Vincent Jardin <vjardin@free.fr>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-07-27 09:07:39 -06:00
Vincent JardinandTom Rini 5b1dac9ee2 fs: dispatch null_dev_desc_ok filesystems before lookup
Filesystems that are null_dev_desc_ok (semihosting, ubifs) have
no UCLASS_BLK device under their ifname, so on real hardware
fs_set_blk_dev() always fails at the partition lookup.
The workaround was to add a per-filesystem
command (example cmd/ubifs.c), which duplicates the plumbing of
fstype_info.

Probe such entries with block_desc=NULL up front, so
  load semihosting - <addr> <file>
works without a new command.

Sandbox boards that exercise the existing fallback through "host
bind" stay unchanged.

Signed-off-by: Vincent Jardin <vjardin@free.fr>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-07-27 09:07:39 -06:00
Tom Rini 5c5f1e1de1 Merge https://git.u-boot-project.org/u-boot/custodians/u-boot-riscv
CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-riscv/-/pipelines/740

- some fixes
- Add Yao Zi as a reviewer
2026-07-27 08:24:21 -06:00
Naveen Kumar ChaudharyandLeo Yu-Chi Liang c201051a9c serial: sifive: remove busy-loops from getc and putc ops
The DM serial framework in __serial_getc() and __serial_putc() already
retries when driver ops return -EAGAIN, calling schedule() between
attempts to service the watchdog.

sifive_serial_getc() and sifive_serial_putc() spin internally on
-EAGAIN, which prevents the framework from calling schedule(). This can
lead to watchdog timeouts when waiting for RX data or TX FIFO space.

Remove the busy-loops and return -EAGAIN directly from the underlying
helpers, letting the framework handle retries with proper watchdog
servicing. This is consistent with how other DM serial drivers (pl01x,
meson, cortina, etc.) implement their ops.

Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
Reviewed-by: Leo Yu-Chi Liang <leo.liang@sifive.com>
2026-07-26 21:04:42 -07:00
Charles PerryandLeo Yu-Chi Liang b3b5b305e2 riscv: remove log_debug() in enable_caches()
log_debug() cannot be used before log_init() has been called. Remove the
log_debug() statement in enable_caches() since it is called before
log_init() in initcall_run_r().

This fixes a bug where a RISC-V system which does not have the "zicbom"
extension (such as PIC64-HPSC/HX) would get lost in an infinite loop in
log_dispatch().

Fixes: 9e859849e2 ("riscv: cache: Add CBO instructions")
Signed-off-by: Charles Perry <charles.perry@microchip.com>
Reviewed-by: Leo Yu-Chi Liang <leo.liang@sifive.com>
2026-07-26 19:39:22 -07:00
Yao ZiandLeo Yu-Chi Liang e1b16d3c0f MAINTAINERS: riscv: Add myself as a reviewer
Add myself to help review patches for RISC-V port.

Signed-off-by: Yao Zi <me@ziyao.cc>
Reviewed-by: Leo Yu-Chi Liang <leo.liang@sifive.com>
2026-07-26 19:39:22 -07:00
Francois BerderandLeo Yu-Chi Liang c7c969d7e2 rng: jh7110: Fix invalid usage of dev_read_addr
dev_read_addr returns FDT_ADDR_T_NONE (-1), not NULL,
in case of errors.
Replace dev_read_addr by dev_read_addr_ptr.
Replace error to EINVAL.

Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Hal Feng <hal.feng@starfivetech.com>
2026-07-26 19:39:22 -07:00
Michal SimekandLeo Yu-Chi Liang 84b48a9181 riscv: Exclude ACLINT for TARGET_XILINX_MBV
The Xilinx MicroBlaze V platform does not have an ACLINT (Advanced
Core Local Interruptor) hardware block. The timer functionality is
provided through a different mechanism.

Exclude both RISCV_ACLINT and SPL_RISCV_ACLINT from being implied
for TARGET_XILINX_MBV while keeping the default behavior for other
generic RISC-V targets that do have ACLINT hardware.

   spl/u-boot-spl: all -1382 data -360 rodata -200 text -822

Signed-off-by: Michal Simek <michal.simek@amd.com>
Reviewed-by: Leo Yu-Chi Liang <leo.liang@sifive.com>
2026-07-26 19:39:22 -07:00
Michal SimekandLeo Yu-Chi Liang 0798f12031 riscv: Make RISCV_ACLINT visible
A platform (like Xilinx Microblaze V) does not have an ACLINT (Advanced
Core Local Interruptor) hardware block.

Make RISCV_ACLINT and SPL_RISCV_ACLINT Kconfig symbols visible with
prompts.

Signed-off-by: Michal Simek <michal.simek@amd.com>
Reviewed-by: Yao Zi <me@ziyao.cc>
2026-07-26 19:39:22 -07:00
Michal SimekandLeo Yu-Chi Liang d8810e1d4f riscv: Skip riscv_cpu_setup() when CPU driver is disabled
Building on commit c64fc632a8 ("riscv: cpu: Use CONFIG_IS_ENABLED(CPU)
instead of plain ifdef"), add an early return in riscv_cpu_setup() when
CONFIG_CPU is not enabled. This allows platforms to save code space in
SPL by disabling CONFIG_SPL_CPU.

Without this patch, building U-Boot with CONFIG_CPU=n and CONFIG_EVENT=y
is broken: riscv_cpu_setup() is registered as an EVT_DM_POST_INIT_F event
spy, and when the CPU uclass is unavailable uclass_find_first_device()
returns no device, so the function returns -ENODEV. That in turn makes
event_notify_null() in dm_init_and_scan() fail and triggers a boot hang
("initcall initf_dm() failed"). Returning 0 early avoids that failure.

The compiler's dead-code elimination combined with --gc-sections
removes the unreachable code and all associated static data,
achieving significant size reduction without preprocessor guards:

  spl/u-boot-spl:all -4332 spl/u-boot-spl:rodata -2872
  spl/u-boot-spl:text -1460

Signed-off-by: Michal Simek <michal.simek@amd.com>
Reviewed-by: Yao Zi <me@ziyao.cc>
2026-07-26 19:39:21 -07:00
Hal FengandLeo Yu-Chi Liang be256bd560 board: starfive: visionfive2: Support VisionFive 2 Lite eMMC
Add emmc detection to VisionFive 2 Lite DT selection and
fdtfile environment variable setting.

Reviewed-by: E Shattow <e@freeshell.de>
Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
2026-07-26 19:39:21 -07:00
Hal FengandLeo Yu-Chi Liang 13b990d05f configs: visionfive2: Add VisionFive 2 Lite eMMC DT to OF_LIST
So the VisionFive 2 Lite eMMC DT will be built and merged into FIT.

Reviewed-by: E Shattow <e@freeshell.de>
Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
2026-07-26 19:39:21 -07:00
Hiago De FrancoandLeo Yu-Chi Liang 40ea5423f9 riscv: dts: cv18xx: fix spi node name
Fix warning:
arch/riscv/dts/cv18xx.dtsi:208.26-216.5: Warning (spi_bus_bridge):
/soc/spi-nor@10000000: node name for SPI buses should be 'spi'

Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
2026-07-26 19:39:21 -07:00
Hiago De FrancoandLeo Yu-Chi Liang 33e6383108 doc: sophgo: licheerv_nano: fix incorrect step numbering
Steps 2 and 3 are incorrectly numbered. Fix them.

Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
2026-07-26 19:39:21 -07:00
Tom Rini b635d43bca Merge patch series "fs/squashfs: fix symlink load failure on large images"
Allan ELKAIM <allan.elkaim@gmail.com> says:

sqfsload fails to load a file through a symlink when the squashfs
image contains a large number of inodes (e.g. a rootfs that includes
the tzdata timezone database).

Root cause: sqfs_read_nest() resolves the symlink by calling itself
recursively without first freeing the parent directory's inode and
directory table buffers. This causes a temporary double allocation
that can exhaust the U-Boot heap. When malloc() subsequently fails
inside sqfs_read_directory_table(), the error goes undetected and
sqfs_search_dir() is called with a NULL pos_list pointer, leading to:

  Error: invalid inode reference to directory table.
  Failed to load '/boot/Image'

Patch 1 fixes the structural problem (temporary double allocation)
and plugs the silent NULL pointer path in sqfs_read_directory_table().
Patch 2 adds the missing return-value checks on sqfs_dir_offset() that
turn any residual lookup failure into a clean error propagation.

Patch 3 (reworked in v3 following Richard Genoud's review) fixes
pre-existing leaks of dirs->entry on the error paths of
sqfs_search_dir(), by centralizing the cleanup at the 'out' label.

All patches are independent and can be reviewed separately.

The bug was first observed on U-Boot v2024.01 and is still present
on v2026.04. The patches have been tested on a Raspberry Pi CM4
running U-Boot v2026.04 (Yocto Scarthgap 5.0.17) with a 325 MB
squashfs rootfs containing 22 517 inodes. The symlink
/boot/Image -> Image-6.6.63-v8 now resolves successfully.

This series addresses the bug reported at:
https://lists.u-boot-project.org/pipermail/u-boot/2026-May/618533.html

Link: https://lore.kernel.org/r/20260713142420.2618339-1-allan.elkaim@gmail.com
2026-07-25 07:55:35 -06:00
Allan ELKAIMandTom Rini 171b604888 fs/squashfs: fix dirs->entry leaks on sqfs_search_dir() error paths
Several error paths in sqfs_search_dir() return through 'goto out'
while a directory entry obtained from sqfs_readdir_nest() is still
held, leaking dirs->entry: the inode lookup failure, the symlink
nesting limit check, every allocation/tokenization failure during
symlink resolution, and the case where readdir aborts after an
entry was already read.

Instead of freeing dirs->entry at each error site, centralize the
cleanup at the 'out' label: on error, no valid entry may be handed
back to the caller, so it can be freed unconditionally there. On
success, dirs->entry is already NULL: it is freed at the end of
each token iteration and before recursing into a symlink target,
and the root directory path never allocates it.

Explicit frees remain only where a success path needs them:
between reads in the readdir loop, at the end of each token
iteration, and before the recursive call. The now-redundant frees
on individual error paths are removed.

Suggested-by: Richard Genoud <richard.genoud@bootlin.com>
Signed-off-by: Allan ELKAIM <allan.elkaim@gmail.com>
2026-07-24 18:39:29 -06:00
Allan ELKAIMandTom Rini 57e0bb7bf0 fs/squashfs: add sqfs_dir_offset() error checks
sqfs_dir_offset() returns a negative errno on failure, but three
call sites in sqfs_search_dir() use the return value as an array
index without checking for errors first. If the lookup fails,
dirs->table is set to an invalid address, leading to undefined
behavior.

Add negative-value guards after each sqfs_dir_offset() call so
that any lookup failure propagates cleanly as an error rather
than producing incorrect results.

Note: the corresponding sqfs_find_inode() NULL checks and the
heap exhaustion fix during symlink resolution are applied in
separate patches.

Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Richard Genoud <richard.genoud@bootlin.com>
Signed-off-by: Allan ELKAIM <allan.elkaim@gmail.com>
2026-07-24 18:39:29 -06:00
Allan ELKAIMandTom Rini 9a9d46cb5e fs/squashfs: fix heap exhaustion during symlink resolution
When sqfs_read_nest() encounters a symlink it resolves it by calling
itself recursively. In the unfixed code this looks like:

  // dirsp is open: inode_table + dir_table still on heap
  resolved = sqfs_resolve_symlink(symlink, filename);
  ret = sqfs_read_nest(resolved, ...); // recursive: allocates a new
                                       // inode_table + dir_table pair
  free(resolved);
  goto out;
  // out: sqfs_closedir(dirsp) <- parent tables freed HERE, too late

There is no permanent leak: the parent's tables are freed at the
out: label once the recursive call returns. However, for the entire
duration of the recursive call both the parent's inode_table +
dir_table and the child's inode_table + dir_table are live on the
heap simultaneously. On large squashfs images these tables can be
significant in size, and this temporary double allocation may exhaust
the heap budget.

A superficial workaround would be to increase CONFIG_SYS_MALLOC_LEN,
but that wastes memory on all boards and does not address the
structural problem. The correct fix is to change the freeing order:
release the parent directory's resources before recursing. This way
only one set of inode and directory tables is live at any given time,
halving the peak heap usage during symlink resolution.

When heap exhaustion does occur and malloc returns NULL for dir_table
or pos_list inside sqfs_read_directory_table(), the failure is
currently silent and cascading:

  - metablks_count is not reset to -1 before the goto out, so the
    function returns a positive block count alongside a NULL pointer.
  - sqfs_opendir_nest() does not detect the failure (it only checks
    metablks_count < 1) and calls sqfs_search_dir() with m_list=NULL.
  - sqfs_dir_offset() iterates over m_list[0..n], reading from
    addresses 0x0, 0x4, 0x8, ... None of those values match the
    inode's start_block, so the function returns -EINVAL.
  - The error propagates up as a load failure with no indication
    that the root cause was heap exhaustion:

      Error: invalid inode reference to directory table.
      Failed to load '<symlink path>'

Two fixes:
1. In sqfs_read_directory_table(), set metablks_count = -1 whenever
   malloc fails after sqfs_count_metablks() returns a positive value,
   so that the caller's "metablks_count < 1" check correctly detects
   the failure and avoids calling sqfs_search_dir() with a NULL
   pos_list.
2. In sqfs_read_nest() and sqfs_size_nest(), call sqfs_closedir() on
   the parent dirsp before the recursive call so that the parent's
   inode and directory tables are freed before the child allocates
   its own. Only one set of tables is then live at any given time,
   halving peak heap usage during symlink resolution.

Link: https://lists.denx.de/pipermail/u-boot/2026-May/618533.html

Reviewed-by: Richard Genoud <richard.genoud@bootlin.com>
Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Allan ELKAIM <allan.elkaim@gmail.com>
2026-07-24 18:39:29 -06:00
Tom Rini d99ad80750 Azure CI: Drop Windows host tools builds
In preparation for being able to support more recent OpenSSL versions,
we need to add support for the OpenSSL Provider API. This in turn isn't
something that MSYS has all of the required packages to support. Given a
lack of user feedback that these tools are still used in this manner,
remove Windows host tool builds from CI.

Link: https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Tom Rini <trini@konsulko.com>
2026-07-24 18:17:49 -06:00
Carlo CaioneandTom Rini 574b1adad7 fit: prefer the default configuration on best-match ties
With CONFIG_FIT_BEST_MATCH, fit_conf_find_compat() selects the
configuration matching the most specific U-Boot compatible string; on
equal matches the first listed configuration wins and the configurations
node 'default' property is never consulted.

A FIT whose configurations all share the same base devicetree compatible
(e.g. one manifest carrying a base tree plus overlay combinations for a
single board) therefore always boots the first configuration, silently
ignoring the default chosen by the manifest author.

Break score ties in favour of the default configuration. A strictly
better compatible match still wins over it, and FITs without a default
keep the current first-listed behaviour.

Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
2026-07-24 10:46:16 -06:00
Quentin SchulzandTom Rini 6380cb867e .mailmap: map the old U-Boot mailing list address to the new one
We have a new mailing list but the old one still forwards to the new
one, although some people (including me) have issues with the forward
and their mails to the old mailing list being dropped due to SPF policy.

Add an entry in .mailmap so that Cc: u-boot@lists.denx.de in "old"
cover letters and patches use the new mailing list address.

Tested with b4 ty --dry-run on a series from the old mailing list.

Tested with a Cc: u-boot@lists.denx.de in a commit log with b4 (b4
send), git-format-patch and git-send-email somehow don't seem to be
respecting this mapping. At least one tool (the one we now recommend)
does the right thing, so it's progress :)

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
2026-07-24 09:46:58 -06:00
Akshay BelsareandTom Rini d7ef23c07b arm: armv8: mmu: fix DCACHE_OFF incorrectly unmapping region
DCACHE_OFF is defined as (0 << 2) = 0, and PTE_TYPE_FAULT is defined
as (0 << 0) = 0. In mmu_set_region_dcache_behaviour(), the cache
attribute passed to set_regions() is computed as:
  attrs = PMD_ATTRINDX(option >> 2)
For DCACHE_OFF=0 this evaluates to PMD_ATTRINDX(0) = 0, which equals
PTE_TYPE_FAULT.

Commit 6468ca13ff ("armv8: mmu: fix and optimise explicitly unmapping
regions") added an unmap path to set_one_region() that
triggers when attrs == PTE_TYPE_FAULT. Because DCACHE_OFF and
PTE_TYPE_FAULT share the same numerical value (0), any call to
mmu_set_region_dcache_behaviour() with DCACHE_OFF silently unmaps the
target region instead of changing its cache attributes to non-cached.

The subsequent flush_dcache_range() call at the end of
mmu_set_region_dcache_behaviour() then crashes with a Level 3
translation fault because the region it tries to flush has just been
unmapped.

The existing flag parameter already distinguishes the two callers:
 - mmu_set_region_dcache_behaviour() always passes flag=false
 - mmu_change_region_attr_nobreak() always passes flag=true, and is the
   only legitimate caller that passes PTE_TYPE_FAULT to unmap a region

Guard the unmap path with flag so that DCACHE_OFF attribute changes
take the correct else branch, which ORs in the ATTRINDX bits only,
leaving the PTE valid.

This was observed as a boot crash on Versal, Versal Net, and ZynqMP
platforms during network initialisation. The zynq_gem driver calls
mmu_set_region_dcache_behaviour() with DCACHE_OFF to make its BD
descriptor ring non-cached. With the bug the BD memory is unmapped,
and the subsequent dcache flush inside
mmu_set_region_dcache_behaviour() faults.

Fixes: 6468ca13ff ("armv8: mmu: fix and optimise explicitly unmapping regions")
Signed-off-by: Akshay Belsare <akshay.belsare@amd.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2026-07-23 15:16:29 -06:00
Honbo HeandTom Rini 64ce0f86ab serial: esp32: add driver for esp32 series chips
Add a driver model serial driver for Espressif ESP32 UART
controllers. The driver supports ESP32, ESP32-S3 and ESP32-S31 UART
register variants, including baud-rate setup, FIFO access and basic
port initialization.

Signed-off-by: Honbo He <hehongbo918@gmail.com>

Changes in v3:
- Add debug UART for early print output
2026-07-23 15:16:22 -06:00
Aristo ChenandTom Rini 79b6ee1a4b bootm: teach handle_decomp_error() about the noload decompression buffer
For a compressed kernel_noload image, bootm_load_os() allocates a
per-image decompression buffer of ALIGN(image_len * 8, SZ_1M) rather
than the global CONFIG_SYS_BOOTM_LEN. When decompression fails on that
path, handle_decomp_error() still prints

    Image too large: increase CONFIG_SYS_BOOTM_LEN

which is misleading: increasing CONFIG_SYS_BOOTM_LEN does not help
because the smaller per-image buffer is the actual bound. Commit
2ff26c1e378d ("bootm: fix overflow of the noload kernel decompression
buffer") worked around this by printing a follow-up note right after
handle_decomp_error() returned, but the boot log then reads as two
contradictory sentences.

Introduce enum bootm_decomp_limit and pass it into
handle_decomp_error() so the helper picks the right message in one
place. For the per-image path it now prints

    Image too large for the per-image decompression buffer (0x100000 bytes)

quoting the actual buffer size; the global path is unchanged. Drop the
trailing note in bootm_load_os() so only one line is printed.

Suggested-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-07-23 15:16:15 -06:00
Naveen Kumar ChaudharyandTom Rini f7b525a8bc cmd: mbr: return false instead of NULL from bool found_key()
found_key() is declared to return bool but returns NULL when strdup()
fails. NULL is a pointer constant; while it happens to convert to
zero (i.e. false) it is a type mismatch that trips stricter
compilers/static analysers.

Return false to match the declared return type.

Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
2026-07-23 15:16:09 -06:00
Naveen Kumar ChaudharyandTom Rini 0ccd0a939d cmd: pstore: bound path formatting with snprintf to avoid stack overflow
pstore_save() writes four different filenames into a fixed 256-byte
stack buffer 'path' using sprintf() with "%s" fed from argv[3] (the
user-supplied mount directory). The U-Boot command line buffer
(CONFIG_SYS_CBSIZE) is typically 1024 or 2048 bytes, so a directory
path in argv[3] can easily exceed 240 characters and overflow 'path',
corrupting the surrounding stack frame including the return address.

Replace the four sprintf(path, ...) call sites with snprintf() using
sizeof(path) as the bound. The neighbouring sprintf() calls into the
'addr' and 'length' buffers are left as-is; they write fixed-width
numeric conversions whose maximum length is bounded by the size of
ulong/u32 in hex and cannot overflow those buffers.

Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
2026-07-23 15:15:59 -06:00
Naveen Kumar ChaudharyandTom Rini 3c82b041f7 cmd: strings: interpret second argument as a byte count
The help text advertises "<addr> [byte count]" but do_strings()
stores argv[2] directly into last_addr and the loop condition tests
"addr < last_addr", i.e. it treats the value as an absolute end
address. When invoked as documented (e.g. "strings 0x40000000
0x100") the loop condition fails immediately because the supplied
count is far below start_addr, and the command prints nothing.

Compute last_addr as start_addr + hextoul(argv[2], NULL) so the
argument is used as a length in bytes, matching the help. The
existing repeat-mode fixup (last_addr = addr + (last_addr -
start_addr)) continues to preserve the same byte-count window
across CMD_FLAG_REPEAT.

Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
2026-07-23 15:15:48 -06:00
Marek VasutandTom Rini bc61758cbc cmd: date: Handle -ENOSYS return from dm_rtc_reset()
In case dm_rtc_reset() returns -ENOSYS, it means the .reset callback
in RTC driver is not implemented, likely because the callback is not
needed. Handle the -ENOSYS return code as success and proceed, else
the 'date reset' invocation incorrectly prints a bogus warning:
"## Failed to set date after RTC reset".

Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-07-23 15:15:34 -06:00
Tom Rini aa4ca3e1bc Merge patch series "tools: mkimage: fix stale data pointer in fit_import_data()"
Aristo Chen <aristo.chen@canonical.com> says:

fit_import_data() in tools/fit_image.c declares the data pointer and
the name of the external data property outside its loop over the
/images subnodes, so both values leak from one image into the next. An
image node that carries data-size but neither data-offset nor
data-position then reuses the pointer left behind by the previously
imported image: the previous image's data is written into the node,
after which the import aborts trying to delete an external data
property the node never had. Since that abort path only prints a
debug() message, a regular mkimage build fails with nothing but the
generic usage text. The failure mode also depends on the order of the
image nodes: when no externally stored image precedes the malformed
node, the pointer is still NULL, the node is skipped, and the hashing
stage reports a proper error instead.

A FIT authored from a .its cannot hit this, because dtc-authored
images carry inline data. It takes re-processing an external-data FIT
in which an image has lost its data-offset, for example one edited
with fdtput -d or produced by another tool:

  mkimage -E -f demo.its demo.itb
  fdtput -d demo.itb /images/kernel-2 data-offset
  mkimage -F demo.itb

There is no silent-success path, because the failing property delete
always aborts the run before the file is written back, but the user is
left without any indication of what is wrong.

Patch 1 moves the declarations into the loop so that each image starts
from a clean state. A node without an external data reference is now
skipped consistently regardless of node order, and the later
processing stages report the malformed node with a proper error
message (Can't get image data/size).

Patch 2 adds a regression test that builds an external-data FIT,
deletes the data-offset property of the second image and re-processes
the result with mkimage -F. It asserts that mkimage fails and that the
diagnostic is present on stderr; the unfixed tool fails the second
assertion since it prints nothing beyond the usage text.

Link: https://lore.kernel.org/r/20260710153343.1839357-1-aristo.chen@canonical.com
2026-07-23 13:43:27 -06:00
Aristo ChenandTom Rini 7551ce0977 test: py: add regression test for fit_import_data() stale state
Build an external-data FIT, remove the data-offset property from the
second image so that only its data-size remains, and re-process the
result with mkimage -F. mkimage must reject the malformed FIT with a
clear diagnostic from the hashing stage. Previously the stale per-image
state in fit_import_data() made the import copy the first image's data
into the second image and abort without printing anything.

Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-07-23 13:42:49 -06:00
Aristo ChenandTom Rini eecc4148fe tools: mkimage: fix stale data pointer in fit_import_data()
The data pointer and the name of the external data property are
declared outside the loop over the image nodes, so their values leak
from one image into the next. An image node that carries data-size but
neither data-offset nor data-position then reuses the pointer of the
previously imported image: the previous image's data is written into
the node before the import aborts when it tries to delete an external
data property the node does not have. Since that abort path only prints
a debug message, mkimage fails without any indication of what is wrong.
The failure mode also depends on the order of the image nodes: when no
externally stored image precedes the malformed node, the stale pointer
is still NULL, so the import skips the node and the hashing stage
reports a proper error instead.

Move the declarations into the loop so that each image starts from a
clean state. A node without an external data reference is now skipped
consistently regardless of node order, and a malformed node is always
reported by the later processing stages with a proper error message.

Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-07-23 13:42:49 -06:00
Tom Rini 88226db737 Merge tag 'mediatek-for-main-2026-07-22' of https://git.u-boot-project.org/u-boot/custodians/u-boot-mediatek
Fixes:
* Fixed some wrong parents of VLP clocks on mt8189.
* Added a missing perficfg_ao clock in mt8188.
* Disabled watchdog by default on Genio 510/700.
* Fixed U-Boot DT overrides not included on Genio 510/700.

Cleanups/refactoring:
* Changed how clock parent providers are registered and looked
  up for all MediaTek targets.
* Removed duplicate devicetree node in mt7623.
* Removed unused/non-standard DT properties in mt798{1,6,8}.
* Simplified MAINTAINERS by using N: instead of F: when possible.
* Replaced duplicate driver names in all MediaTek clock drivers.
* Cleaned up MediaTek power domain driver and split into separate
  driver per compatible target.
* Removed unused power domain enablement from mt798{1,6,6a,7,8}.

Features:
* Added power domain driver for mt8188.
2026-07-23 10:55:18 -06:00
Tom Rini a814edb52d Merge branch 'main' of https://git.u-boot-project.org/u-boot/custodians/u-boot-usb
- XHCI DWC3 bugfix
2026-07-23 10:54:48 -06:00
Johan JonkerandQuentin Schulz d97d3df79e mtd: nand: raw: rockchip_nfc: fix ecc setup
A Rockchip NAND Flash Controller (NFC) supports multiple
flash devices. The SoC boot ROM only checks for NAND chip 0
and with reduced ECC strength. Currently only the read page
functions have this condition check added in the U-Boot
driver.

In single- and multi-chip nodes with rockchip,boot-blks and
rockchip,boot-ecc-strength set, the chips that aren't chip 0
will thus have an ECC mismatch when writing and reading.

Fix by adding the same condition to all read and write page
functions by dropping the existing 'selected_bank == 0' check
and use the NAND_IS_BOOT_MEDIUM option that was introduced to
U-Boot more recently than this driver to behave
identically to the Linux driver.

NAND_IS_BOOT_MEDIUM is automatically set when nand-is-boot-medium
property is set in the Device Tree, which is a requirement for
rockchip,boot-blks and rockchip,boot-ecc-strength and will thus
apply to all chips in single- and multi-chips nodes, regardless
of the CS.

Fixes: b12dc5d6fa ("mtd: nand: NFC drivers for RK3308, RK2928 and others")
Signed-off-by: Johan Jonker <jbx6244@gmail.com>
Tested-by: Hüseyin BIYIK <boogiepop@gmx.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/5690db1e-4de5-44bc-a9c0-58ad23662753@gmail.com
Signed-off-by: Quentin Schulz <u-boot@0leil.net>
2026-07-23 17:43:33 +02:00
Fabio EstevamandQuentin Schulz 15387d5a90 rockchip: rk3588s: Add support for ROC-RK3588S-PC
The ROC-RK3588S-PC board is an SBC made by Firefly, based on the RK3588S
SoC.

Add support for it.

Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/20260722184024.1210447-1-festevam@gmail.com
[s/ROC-PC-RK3588S/ROC-RK3588S-PC/ in commit log and diff]
Signed-off-by: Quentin Schulz <u-boot@0leil.net>
2026-07-23 15:13:12 +02:00
Johan JonkerandQuentin Schulz 51947d4017 rockchip: pinctrl: use include from dts/upstream
Use Rockchip pinctrl include from dts/upstream and remove what
is now redundant.

Signed-off-by: Johan Jonker <jbx6244@gmail.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/5c0bc31f-047b-4b51-999f-7f6cebd8378b@gmail.com
Signed-off-by: Quentin Schulz <u-boot@0leil.net>
2026-07-23 15:00:08 +02:00
Johan JonkerandQuentin Schulz 2f783e5375 rockchip: pinctrl: replace RK_GPIOn defines
The use of RK_GPIOn defines is deprecated in the upstream
rockchip.h file. Replace all them by the gpio number.

Signed-off-by: Johan Jonker <jbx6244@gmail.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/6bcf3192-82dc-464e-92f6-b9758f6c8422@gmail.com
Signed-off-by: Quentin Schulz <u-boot@0leil.net>
2026-07-23 15:00:08 +02:00
Johan JonkerandQuentin Schulz e504d9cffb rockchip: pinctrl: replace RK_FUNC_n defines
The use of RK_FUNC_n defines is deprecated in the upstream
rockchip.h file. Replace all them by the function number.

Signed-off-by: Johan Jonker <jbx6244@gmail.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/51cb65e5-1702-467f-b961-c9cdd029056f@gmail.com
Signed-off-by: Quentin Schulz <u-boot@0leil.net>
2026-07-23 15:00:08 +02:00
Quentin SchulzandQuentin Schulz 3067562284 MAINTAINERS: update ARM ROCKCHIP entry to list Simon as reviewer
From his own recollection[1], Simon hasn't done PRs since Kever took
over, 7 years ago. Moreover, he doesn't have rights to push to the
Rockchip custodian tree on the old source.denx.de or the new
git.u-boot-project.org.

Therefore, let's reflect the reality and make Simon a reviewer as
requested on the mailing list[1].

We thank him for the many years of being a custodian and reviewer for
anything-Rockchip.

[1] https://lore.kernel.org/u-boot/CAFLszTjXkx0Jw0yjNXXwdXrQYre7Lcs59m_Bc27QW0n0c+WaJw@mail.gmail.com/

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/20260720-sjg-no-rk-cust-v1-1-38eebe54c349@cherry.de
Signed-off-by: Quentin Schulz <u-boot@0leil.net>
2026-07-23 14:52:36 +02:00
Daniel GolleandQuentin Schulz 3bc0f81273 rockchip: only build GPT capsule update helpers with PARTITION_TYPE_GUID
The GPT-based capsule update helpers match updatable images by
partition type GUID and fail to build if PARTITION_TYPE_GUID is not
enabled:

  arch/arm/mach-rockchip/board.c:50:29: error: 'struct disk_partition'
  has no member named 'type_guid'

Boards which keep their firmware on SPI-NOR use a static dfu_string
instead of scanning GPT partitions and have no use for this code, so
guard it accordingly.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Fixes: bea9267d7e ("rockchip: capsule: Add functions for supporting capsule updates")
Link: https://patch.msgid.link/af0ac32e2bf603c39f490f15fe62319fd73c5282.1784423864.git.daniel@makrotopia.org
Signed-off-by: Quentin Schulz <u-boot@0leil.net>
2026-07-23 14:51:25 +02:00
Tom Rini de02bc0ecc Merge patch series "i3c: dw: fix slave device setup and probe issues"
Pranav Tilak <pranav.vinaytilak@amd.com> says:

This series fixes several issues in the DW I3C master driver and
related infrastructure that prevented I3C read/write operations,
and enables I3C support for Versal Gen 2.

Link: https://lore.kernel.org/r/20260709091357.1860417-1-pranav.vinaytilak@amd.com
2026-07-22 13:10:22 -06:00
Pranav TilakandTom Rini 57b60ccd79 i3c: dw: fix slave device setup after DAA
i3c_master_add_i3c_dev_locked() incorrectly set master->this to the
newly discovered slave device, causing i3c_master_attach_i3c_dev()
to skip the attach_i3c_dev() callback. As a result the slave device
never got its master_priv (DAT slot index) allocated, free_pos was
never updated, and the DAT entry was never written.

Fix by removing the incorrect master->this assignment. Store the
slave descriptor directly in master->i3cdev[pos] inside
dw_i3c_master_attach_i3c_dev() where the DAT slot index is already
known. Also check the return value of i3c_master_add_i3c_dev_locked()
and skip num_i3cdevs increment on failure, fixing dummy devices shown
when no slaves are present on the bus.

Fixes: 1009c96f15 ("drivers: i3c: Add driver for MIPI DWI3C")
Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Reviewed-by: Dinesh Maniyam <dinesh.maniyam@altera.com>
2026-07-22 13:10:21 -06:00
Pranav TilakandTom Rini 331d9b8cf6 configs: versal2: enable I3C support
Enable I3C controller driver and command support for Versal Gen 2 by
adding CONFIG_CMD_I3C, CONFIG_I3C and CONFIG_DW_I3C_MASTER.

Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Acked-by: Michal Simek <michal.simek@amd.com>
2026-07-22 13:10:20 -06:00
Pranav TilakandTom Rini b2062131b4 cmd: i3c: fix list and current needing pre-selected controller
The !currdev guard in do_i3c() was placed before the list and current
handlers, causing both to fail when no controller is pre-selected.
Move the guard to only protect device_list, write and read which
actually need a controller.

Fixes: b875409da7 ("cmd: Add i3c command support.")
Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Reviewed-by: Dinesh Maniyam <dinesh.maniyam@altera.com>
2026-07-22 13:10:17 -06:00
Pranav TilakandTom Rini f077a6b07b i3c: dw: make resets optional in probe
Treat -ENOENT and -ENOTSUPP from reset_get_bulk() as non-fatal to
support platforms where no resets are defined in the DTS. The resets
property is not yet documented in the DT binding.

Fixes: 1009c96f15 ("drivers: i3c: Add driver for MIPI DWI3C")
Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Reviewed-by: Dinesh Maniyam <dinesh.maniyam@altera.com>
2026-07-22 13:09:54 -06:00
Julien StephanandDavid Lechner d0c49353a6 configs: mediatek: enable MT8188 power domain
Enable the MT8188 power domain driver.

CONFIG_POWER_DOMAIN is required as CONFIG_MT8188_POWER_DOMAIN depends
on it.

Signed-off-by: Julien Stephan <jstephan@baylibre.com>
Link: https://patch.msgid.link/20260709-mt8188-add-power-domain-v2-14-589ace7d30e2@baylibre.com
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-07-22 13:54:55 -05:00
Julien StephanandDavid Lechner 6c04714f55 power: domain: mediatek: add MT8188 power domain driver
Add the power domain driver for the MediaTek MT8188 SoC. It describes
the SoC's power domains (MFG, display, camera, codec, ADSP, PCIe, ...)
as a table of mtk_scp_domain_data entries and reuses the shared scpsys
core through the power-controller probe, including the per-domain power
status offsets and the ordered infracfg bus-protection steps.

The domain tables and ordered bus-protection sequences mirror the
Linux mt8188-pm-domains.h data.

Signed-off-by: Chris-QJ Chen <chris-qj.chen@mediatek.com>
Signed-off-by: Julien Stephan <jstephan@baylibre.com>
Link: https://patch.msgid.link/20260709-mt8188-add-power-domain-v2-13-589ace7d30e2@baylibre.com
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-07-22 13:54:55 -05:00