Commit Graph
105661 Commits
Author SHA1 Message Date
Tom Rini 77a48fa272 Merge tag 'mediatek-for-master-2026-06-24' of https://source.denx.de/u-boot/custodians/u-boot-mediatek
- Cherry-pick upstream devicetree fix for duplicate regulator names.
- Fix regressions due to recent mach-wide cleanups accidentally changing
  gd->bd->bi_dram[0].size.
2026-06-24 10:02:34 -06:00
David Lechner b4fa246a15 arm: mediatek: mt8512: fix gd->bd->bi_dram[0].size
Use board_get_usable_ram_top() instead of get_effective_memsize() to
limit gd->ram_top.

Both board_get_usable_ram_top() and get_effective_memsize() are used to
set gd->ram_top in setup_dest_addr(). However, get_effective_memsize()
also sets gd->bd->bi_dram[0].size in dram_init_banksize(), which is
undesirable.

Prior to commit b9e6281632 ("arm: mediatek: mt8512:
drop dram_init_banksize()"), gd->bd->bi_dram[0].size was overridden in
a board-specific dram_init_banksize() implementation.

We can just use board_get_usable_ram_top() now to set gd->ram_top to the
correct value instead. Overriding gd->bd->bi_dram[0].size was a bit
confusing since it isn't easily apparent which order the functions that
set it are called.

Fixes: b9e6281632 ("arm: mediatek: mt8512: drop dram_init_banksize()")
Link: https://patch.msgid.link/20260615-mtk-fix-ram-size-v2-8-f72cfc52ce58@baylibre.com
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-06-24 10:06:16 -05:00
David Lechner ec457f7cfd arm: mediatek: mt8195: fix gd->bd->bi_dram[0].size
Use board_get_usable_ram_top() instead of get_effective_memsize() to
set gd->ram_top to something <= 4GiB.

Both board_get_usable_ram_top() and get_effective_memsize() are used to
set gd->ram_top in setup_dest_addr(). However, get_effective_memsize()
also sets gd->bd->bi_dram[0].size in dram_init_banksize(), which is
undesirable.

Prior to commit d83bd9729d ("arm: mediatek: mt8195:
drop dram_init_banksize()"), gd->bd->bi_dram[0].size was overridden in
a board-specific dram_init_banksize() implementation. When that was
removed get_effective_memsize() set gd->bd->bi_dram[0].size to the wrong
value because of get_effective_memsize() being overridden in commit
af4cba9a05 ("arm: mediatek: mt8195: fix gd->ram_top limit")

We can just use board_get_usable_ram_top() now to set gd->ram_top to the
correct value instead. This is possible now, thanks to
LMB_LIMIT_DMA_BELOW_RAM_TOP being set by default for 64-bit Mediatek
ARM SoCs.

Fixes: d83bd9729d ("arm: mediatek: mt8195: drop dram_init_banksize()")
Link: https://patch.msgid.link/20260615-mtk-fix-ram-size-v2-7-f72cfc52ce58@baylibre.com
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-06-24 10:06:16 -05:00
David Lechner 58c7145d68 arm: mediatek: mt8189: fix gd->bd->bi_dram[0].size
Use board_get_usable_ram_top() instead of get_effective_memsize() to
set gd->ram_top to something <= 4GiB.

Both board_get_usable_ram_top() and get_effective_memsize() are used to
set gd->ram_top in setup_dest_addr(). However, get_effective_memsize()
also sets gd->bd->bi_dram[0].size in dram_init_banksize(), which is
undesirable.

We can just use board_get_usable_ram_top() now to set gd->ram_top to the
correct value instead. This is possible now, thanks to
LMB_LIMIT_DMA_BELOW_RAM_TOP being set by default for 64-bit Mediatek
ARM SoCs.

Fixes: a7c682565b ("arm: mediatek: add support of MT8189 SoC family")
Link: https://patch.msgid.link/20260615-mtk-fix-ram-size-v2-6-f72cfc52ce58@baylibre.com
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-06-24 10:06:16 -05:00
David Lechner 6f274732f7 arm: mediatek: mt8188: fix gd->bd->bi_dram[0].size
Use board_get_usable_ram_top() instead of get_effective_memsize() to
set gd->ram_top to something <= 4GiB.

Both board_get_usable_ram_top() and get_effective_memsize() are used to
set gd->ram_top in setup_dest_addr(). However, get_effective_memsize()
also sets gd->bd->bi_dram[0].size in dram_init_banksize(), which is
undesirable.

Prior to commit b3467e51e9 ("arm: mediatek: mt8188:
drop dram_init_banksize()"), gd->bd->bi_dram[0].size was overridden in
a board-specific dram_init_banksize() implementation. When that was
removed get_effective_memsize() set gd->bd->bi_dram[0].size to the wrong
value because of get_effective_memsize() being overridden in commit
7518e10cd2 ("arm: mediatek: mt8188: fix gd->ram_top limit").

We can just use board_get_usable_ram_top() now to set gd->ram_top to the
correct value instead. This is possible now, thanks to
LMB_LIMIT_DMA_BELOW_RAM_TOP being set by default for 64-bit Mediatek
ARM SoCs.

Fixes: b3467e51e9 ("arm: mediatek: mt8188: drop dram_init_banksize()")
Link: https://patch.msgid.link/20260615-mtk-fix-ram-size-v2-5-f72cfc52ce58@baylibre.com
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-06-24 10:06:16 -05:00
David Lechner 3b7adad0b5 arm: mediatek: mt7988: fix gd->bd->bi_dram[0].size
Use board_get_usable_ram_top() instead of get_effective_memsize() to
set gd->ram_top to something <= 4GiB.

Both board_get_usable_ram_top() and get_effective_memsize() are used to
set gd->ram_top in setup_dest_addr(). However, get_effective_memsize()
also sets gd->bd->bi_dram[0].size in dram_init_banksize(), which is
undesirable.

Prior to commit bddd6bbef3 ("arm: mediatek: mt7988:
drop dram_init_banksize()"), gd->bd->bi_dram[0].size was overridden in
a board-specific dram_init_banksize() implementation. When that was
removed get_effective_memsize() set gd->bd->bi_dram[0].size to the wrong
value because of CFG_MAX_MEM_MAPPED.

Rather than continue to use an old-style CFG_ option and the potentially
confusing overriding of gd->bd->bi_dram[0].size (it is difficult to see
which order the functions that set it are called), we can just use
board_get_usable_ram_top() to set gd->ram_top to the correct value
instead. This is possible now, thanks to LMB_LIMIT_DMA_BELOW_RAM_TOP
being set by default for 64-bit Mediatek ARM SoCs.

The CFG_MAX_MEM_MAPPED option is removed since it is no longer needed.
The config header and Kconfig option are also removed since that was
the last CFG_ option.

Reported-by: Rudy Andram <rmandrad@gmail.com>
Closes: https://lore.kernel.org/u-boot/20260602162233.2418471-1-rmandrad@gmail.com/
Fixes: bddd6bbef3 ("arm: mediatek: mt7988: drop dram_init_banksize()")
Link: https://patch.msgid.link/20260615-mtk-fix-ram-size-v2-4-f72cfc52ce58@baylibre.com
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-06-24 10:06:16 -05:00
David Lechner c074950b48 arm: mediatek: mt7987: fix gd->bd->bi_dram[0].size
Use board_get_usable_ram_top() instead of get_effective_memsize() to
set gd->ram_top to something <= 4GiB.

Both board_get_usable_ram_top() and get_effective_memsize() are used to
set gd->ram_top in setup_dest_addr(). However, get_effective_memsize()
also sets gd->bd->bi_dram[0].size in dram_init_banksize(), which is
undesirable.

Prior to commit 56183fb025 ("arm: mediatek: mt7987: drop
dram_init_banksize()"), gd->bd->bi_dram[0].size was overridden in
a board-specific dram_init_banksize() implementation. When that was
removed get_effective_memsize() set gd->bd->bi_dram[0].size to the wrong
value because of CFG_MAX_MEM_MAPPED.

Rather than continue to use an old-style CFG_ option and the potentially
confusing overriding of gd->bd->bi_dram[0].size (it is difficult to see
which order the functions that set it are called), we can just use
board_get_usable_ram_top() to set gd->ram_top to the correct value
instead. This is possible now, thanks to LMB_LIMIT_DMA_BELOW_RAM_TOP
being set by default for 64-bit Mediatek ARM SoCs.

On mt7987, there is already an implementation of
board_get_usable_ram_top() for other reasons, so it is modified to
also limit ram_top to 4GiB (mt7987 is currently the only thing that
sets CONFIG_MTK_TZ_MOVABLE=y so it is safe to change this here without
unintentional side-effects).

The CFG_MAX_MEM_MAPPED option is removed since it is no longer needed.
The config header and Kconfig option are also removed since that was
the last CFG_ option.

Fixes: 56183fb025 ("arm: mediatek: mt7987: drop dram_init_banksize()")
Link: https://patch.msgid.link/20260615-mtk-fix-ram-size-v2-3-f72cfc52ce58@baylibre.com
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-06-24 10:06:16 -05:00
David Lechner 2d9a9f1cad net: mtk_eth: select LMB_LIMIT_DMA_BELOW_RAM_TOP
Default to CONFIG_LMB_LIMIT_DMA_BELOW_RAM_TOP=y when MEDIATEK_ETH is
enabled. The MediaTek Ethernet controller can only access the first 4GB
of RAM when DMA is used.

Link: https://patch.msgid.link/20260615-mtk-fix-ram-size-v2-2-f72cfc52ce58@baylibre.com
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-06-24 10:06:16 -05:00
David Lechner ae73cc6df7 mmc: mtk-sd: select LMB_LIMIT_DMA_BELOW_RAM_TOP
Default to CONFIG_LMB_LIMIT_DMA_BELOW_RAM_TOP=y when CONFIG_MTK_SD is
enabled. The MediaTek SD controller can only access the first 4GB of RAM
when DMA is used. "imply" is used rather than "select" in case someone
want's to turn off the option when DMA is not used.

Link: https://patch.msgid.link/20260615-mtk-fix-ram-size-v2-1-f72cfc52ce58@baylibre.com
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-06-24 10:06:16 -05:00
David Lechner 7aedd1f7fb arm64: dts: mediatek: mt6359: give regulators unique names
Change the regulator-name properties to be unique for all regulators.
U-Boot cannot handle duplicate names.

Signed-off-by: David Lechner <dlechner@baylibre.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>

[ upstream commit: d91639d0ab3223b61c00442021dc639c9ddc2b76 ]

(cherry picked from commit 22ce1d7d45a696128b8ad2cb9fbc4f2073bcb4f6)

Reviewed-by: Julien Stephan <jstephan@baylibre.com>
Link: https://patch.msgid.link/20260611-mtk-pick-dt-mt6359-unique-names-v1-1-601546be1210@baylibre.com
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-06-24 09:51:00 -05:00
Quentin StrydomandTom Rini fcda974e36 arm: aspeed: Fix AST2600 SPL external DTB alignment
For AST2600 SPL with CONFIG_SPL_SEPARATE_BSS=y and
CONFIG_OF_SEPARATE=y, fdt_find_separate() expects the appended control
DTB at _image_binary_end.

The AST2600 SPL linker script aligned _image_binary_end via the
.binman_sym_table section. In builds where that section has no emitted
contents, objcopy -O binary does not include the alignment bytes in
spl/u-boot-spl-nodtb.bin. This causes the nodtb binary to end before
_image_binary_end, so the appended DTB is placed too early.

On evb-ast2600 this produced:

  sizeof(spl/u-boot-spl-nodtb.bin) = 0xc92c
  _image_binary_end                = 0xc930

SPL then looked four bytes past the FDT header and failed with:

  Missing DTB
  No serial driver found

Move the 8-byte alignment into the preceding emitted __u_boot_list
section so the objcopy output and _image_binary_end agree.

Signed-off-by: Quentin Strydom <qstrydom0@gmail.com>
2026-06-23 10:41:25 -06:00
Tom Rini 4edbb6fb60 Merge tag 'net-20260623' of https://source.denx.de/u-boot/custodians/u-boot-net
Pull request net-20260623.

net:
- airoha_eth: fix mt7531 mdio related initialization bug

net-legacy:
- cdp: reject CDP TLVs with a length below the 4-byte header
- Clear IP defragmentation state after returning a complete packet

net-lwip:
- Halt ethernet after network commands
2026-06-23 10:36:58 -06:00
Piyush PaliwalandJerome Forissier 91d5e0ee3e net: cdp: reject CDP TLVs with a length below the 4-byte header
cdp_receive() reads a 16-bit TLV length (tlen) from the packet and only
checks that it does not exceed the remaining buffer (tlen > len). It then
unconditionally does "tlen -= 4" to skip the TLV header. As tlen is a
u16, a crafted TLV with a length of 0..3 underflows tlen to ~65532-65535.

For a CDP_APPLIANCE_VLAN_TLV the underflowed length then drives the inner
"while (tlen > 0)" loop, which walks ~64KB past the receive buffer reading
*ss each step -> out-of-bounds read (crash / info-influence). A length of
0 additionally fails to advance pkt/len, hanging the parse loop.

Reject any TLV whose declared length is smaller than its own 4-byte
header. This is the same class of bug as the recent bootp/dhcpv6/sntp/nfs
fixes (unchecked length field), in a sibling LAN parser that was missed.

Verified with a standalone AddressSanitizer harness using the verbatim
cdp_receive()/cdp_compute_csum() routines: a 16-byte CDP frame with an
appliance-VLAN TLV of length 3 triggers a heap-buffer-overflow READ that
the check eliminates.

Fixes: f575ae1f7d ("net: Move CDP out of net.c")
Cc: stable@vger.kernel.org
Signed-off-by: Piyush Paliwal <piyushthepal@gmail.com>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
2026-06-23 13:13:16 +02:00
David LechnerandJerome Forissier 9f7906a58c net: lwip: introduce net_lwip_eth_stop() function
Add a introduce net_lwip_eth_stop() function and use that to stop the
network interface after each command that uses the network.

This makes the behavior the same as the legacy net code and avoids
potential issues with the network interface being left in an active
state after a command finishes.

The start/stop is reference-counted since there is at least one command
(dhcp) that calls another command (tftp) to avoid starting and stopping
the network interface multiple times in a single command.

Signed-off-by: David Lechner <dlechner@baylibre.com>
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
2026-06-23 13:13:16 +02:00
David LechnerandJerome Forissier 91911aa0c7 net: lwip: wget: return errno codes from wget_do_request()
Change the return values of the lwip implementation of wget_do_request()
to be errno codes instead of command return codes.

wget_do_request() is not a command, so it does not make sense to return
command return codes from it. Also, the legacy network implementation of
wget_do_request() already returns errno codes so it is logical for the
lwip implementation to do the same.

This fixes a bug in try_load_from_uri_path() in efi_manager.c where it
checks that the return value of wget_do_request() is < 0. Before this
change, CMD_RET_FAILURE would not be considered an error since it has a
value of 1.

The value of ENODEV is used in places where there could actually be a
number of different causes of failure and it isn't possible to
discriminate (i.e. failing function returns NULL for all errors). Since
all callers of wget_do_request() don't propagate the error code, it
doesn't matter so much that this is not ideal, at least at this point in
time.

Fixes: 3c656c928b ("net: lwip: add wget command")
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-06-23 13:13:16 +02:00
David LechnerandJerome Forissier 747720eb73 net: lwip: wget: fix error handling in wget_do_request()
Split wget_do_request() into two functions to make error handling less
error-prone.

After a successful call to net_lwip_new_netif(), net_lwip_remove_netif()
must always be called to prevent leaks. This was missed in the CACERT
section of the code where we returned on error without cleaning up.

Instead of adding more calls to net_lwip_remove_netif(), refactor the
code into two functions. The outer function handles managing the netif
lifecycle. The inner function no longer has to worry about cleaning up
before returning on error.

To keep things simple, the `path` local variable is removed during the
refactoring. Instead, ctx.path is used directly everywhere.

Fixes: 3c656c928b ("net: lwip: add wget command")
Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: David Lechner <dlechner@baylibre.com>
2026-06-23 13:13:16 +02:00
Mateusz FurdynaandJerome Forissier 8382c2ad52 test: net: add IP defragmentation duplicate-fragment regression test
Add a unit test for the IP datagram reassembler (CONFIG_IP_DEFRAG) that
covers the duplicate-last-fragment scenario.

Without the fix the last fragment will re-trigger datagram delivery,
increasing udp_rx_count to 2 and effectively failing the test; with it
applied the test passes with udp_rx_count == 1.

Signed-off-by: Mateusz Furdyna <mateusz.furdyna@nokia.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-06-23 13:13:16 +02:00
Mateusz FurdynaandJerome Forissier b1aec609bb net: clear IP defragmentation state after returning a complete packet
During the IP defragmentation process, after the reassembly is finished
with the last packet arriving with MF=0, the reassembly state wrt.
static counters is not cleared. In case this last arriving packet with
MF=0 gets duplicated, payload bytes are mistakenly treated as hole data.

A malicious actor who can deliver fragmented IP traffic to a U-Boot
instance with CONFIG_IP_DEFRAG=y can corrupt memory via out-of-bound
writes and redirect control flow into attacker-supplied payload bytes
that already sit in `pkt_buff[]`.

Publicly available AI models are able to generate a reproducer based
on the provided information.

Fix: once the assembled packet has been handed back to the caller, mark
the reassembly state empty so that any further fragment (duplicate,
replay, or a brand-new datagram that happens to reuse the `ip_id`) goes
through the normal re-init path and rebuilds a clean hole list instead
of dereferencing payload bytes as struct hole.

Fixes: 5cfaa4e54d ("net: defragment IP packets")
Reported-by: Mariusz Madej <mariusz.madej@nokia.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Acked-by: Alessandro Rubini <rubini@gnudd.com>
Signed-off-by: Mateusz Furdyna <mateusz.furdyna@nokia.com>
2026-06-23 13:13:16 +02:00
Mikhail KshevetskiyandJerome Forissier 5aa2066aca net: airoha_eth: fix mt7531 mdio related initialization bug
Private data isn't ready during bind time. The call of dev_get_priv()
function will return NULL. Thus we can't save mdio device pointer and
use it later during probe.

To solve an issue, we will move mt7531 mdio device binding to the probing
function of 'airoha-eth' driver.

All GDM ports (except of GDM1) are connected directly to their PHYs, so
corresponding mdio bus will be automatically probed during PHY setup.

GDM1 ports differ from other GDM ports. It connected to the airoha switch
device. The mt7531 mdio bus is used to manage link state of airoha switch
device ports (LAN ports 1-4 corresponds to PHYs 0x09-0x0C). Therefore,
manual probing of mt7531 mdio bus is required to be able set/query states
of corresponding LAN ports.

Fixes: 96d9e7c464 ("net: airoha: use mt7531 mdio for GDM1")
Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
2026-06-23 13:13:16 +02:00
Tom Rini f072620dc9 Prepare v2026.07-rc5
Signed-off-by: Tom Rini <trini@konsulko.com>
2026-06-22 16:22:08 -06:00
Tom Rini cfaf135460 Merge branch 'master' of https://source.denx.de/u-boot/custodians/u-boot-sh
- serial: sh: Fix dev_read_addr error check
2026-06-22 08:19:12 -06:00
Francois BerderandMarek Vasut 6614139042 serial: sh: Fix dev_read_addr error check
dev_read_addr returns FDT_ADDR_T_NONE (-1) in case of error
and not 0.

Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org> # R-Car H3/M3-W/M3-N Salvator-X(S), H3/M3-W ULCB, V4H Sparrow Hawk, X5H Ironhide RSIP and CA720AE
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> # Update subject tags
2026-06-22 06:34:09 +02:00
Tom Rini d57ea0d9ed Merge tag 'efi-2026-07-rc6' of https://source.denx.de/u-boot/custodians/u-boot-efi
Pull request efi-2026-07-rc6

CI: https://source.denx.de/u-boot/custodians/u-boot-efi/-/pipelines/30505

Documentation:

* bootdev: fix typos
* board: renesas: Document Renesas RZ/N1D and RZ/N1S as arm
* board: renesas: Document Renesas Geist board support
* board: renesas: Document Renesas Gray Hawk board support
* board: renesas: Document Renesas Ironhide board support
* android: fastboot: Document halt behaviour

UEFI:

* fix memory leak in efi_var_collect()
* set revision field in block IO protocol
* fix guid comparison in efi_selftest_loaded_image.c
* fix use-after-free in efi_selftest_memory.c
2026-06-21 09:27:12 -06:00
Mattijs KorpershoekandHeinrich Schuchardt ad90d1ec8b doc: android: fastboot: Document halt behaviour
It's possible to interrupt the fastboot command from the U-Boot shell
using the Ctrl-c keybinding.

Document this.

Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Reviewed-by: Sam Day <me@samcday.com>
2026-06-21 10:56:37 +02:00
Vincent StehléandHeinrich Schuchardt 60ff3d9509 efi_selftest: fix use-after-free
When the `memory' efi selftest verifies the Devicetree memory reservation,
it accesses the memory_map buffer after it has been freed with free_pool().
Move the verification earlier to fix this.

Fixes: 34c96659ed ("efi_selftest: check fdt is marked as runtime data")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2026-06-21 10:53:01 +02:00
Vincent StehléandHeinrich Schuchardt 41c6b83c77 lib/efi_loader: fix block io revision
The Revision field of the EFI_BLOCK_IO_PROTOCOL structure must be set to
one of the two valid values [1], but this is not initialized in the
efi_loader; fix it.

Link: https://uefi.org/specs/UEFI/2.11/13_Protocols_Media_Access.html#efi-block-io-protocol [1]
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2026-06-21 10:51:48 +02:00
Ilias ApalodimasandHeinrich Schuchardt 1f5c8eac2f efi_loader: fix memory leak in efi_var_collect
Barebox has now ported some of the UEFI code. In the process
they found some bugs.

In this case when the variable buffer is too small, efi_var_collect()
returns EFI_BUFFER_TOO_SMALL but doesn't free the allocated 'buf'.

Fixes: 5f7dcf079d ("efi_loader: UEFI variable persistence")
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2026-06-21 10:25:08 +02:00
Denis MukhinandHeinrich Schuchardt eb6f420836 bootdev: fix typos
Signed-off-by: Denis Mukhin <dmukhin@ford.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-06-21 09:43:33 +02:00
Vincent StehléandHeinrich Schuchardt 5150a86187 efi_selftest: fix guid comparison
The `loaded image' efi selftest is comparing protocol GUIDs with the wrong
polarity.
This can be verified on the sandbox, where two protocols GUIDs are
retrieved by the test from the image handle in the following order:

1. Loaded Image Device Path Protocol GUID
2. Loaded Image Protocol GUID

The test matches on the first GUID, while it is in fact looking for the
second one; fix the comparison polarity.

Fixes: efe79a7c0d ("efi_selftest: test for loaded image protocol")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
Cc: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2026-06-21 09:41:59 +02:00
Marek VasutandHeinrich Schuchardt 861be585cc doc: board: renesas: Document Renesas Ironhide board support
Document support for Renesas Ironhide development board
based on Renesas R-Car X5H (R8A78000) SoC.

Fixes: cf71963778 ("arm64: dts: renesas: Add Renesas R-Car X5H R8A78000 Ironhide board code")
Fixes: 9d47a5a4d5 ("arm: renesas: Add Renesas R-Car R8A78000 X5H Cortex-M33 RSIP port")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
2026-06-21 09:20:49 +02:00
Marek VasutandHeinrich Schuchardt 89b45e46ca doc: board: renesas: Document Renesas Gray Hawk board support
Document support for Renesas Gray Hawk Single development board
based on Renesas R-Car V4M (R8A779H0) SoC.

Fixes: 53066deccb ("ARM: renesas: Add Renesas R8A779H0 V4M Gray Hawk board code")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
2026-06-21 09:20:49 +02:00
Marek VasutandHeinrich Schuchardt 3b2190935b doc: board: renesas: Document Renesas Geist board support
Document support for Renesas Geist development board
based on Renesas R-Car M3Le (R8A779MD) SoC.

Fixes: c8523795d7 ("arm64: dts: renesas: r8a779md: Add support for R-Car M3Le R8A779MD Geist")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
2026-06-21 09:20:49 +02:00
Marek VasutandHeinrich Schuchardt a1d74f409f doc: board: renesas: Document Renesas RZ/N1D and RZ/N1S as arm
The RZ/N1D and RZ/N1S contain Cortex-A7 core, which is 32bit ARM core.
Document the SoC as 32bit ARM instead of aarch64.

Fixes: a5b9f95943 ("doc: renesas: add Renesas board docs")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2026-06-21 09:19:35 +02:00
Tom Rini 922cf29dd8 Merge branch 'master' of git://source.denx.de/u-boot-usb
- usb: tcpm: fix inverted poll condition in tcpm_pd_transmit()
2026-06-18 11:41:22 -06:00
Peng FanandMarek Vasut 78d5f8cb50 usb: tcpm: fix inverted poll condition in tcpm_pd_transmit()
The read_poll_timeout() macro breaks out of its loop when the condition
evaluates to true. The current code uses "!tx_complete" as the
condition, which means it exits immediately when tx_complete is false
(i.e., transmission has NOT completed yet), rather than waiting for
completion.

Fix the condition to "tx_complete" so that the poll loop waits until
the TCPC signals transmission success/failure/discard before
proceeding.

Without this fix, tcpm_pd_transmit() returns before the TCPC has
finished transmitting, causing the PD state machine to proceed with
stale tx_status values.

Fixes: 1db4c0ac77 ("usb: tcpm: add core framework")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
2026-06-18 16:48:16 +02:00
Wadim EgorovandTom Rini fae363f2cf configs: phycore_am62x_a53_defconfig: Enable fastboot
Enable USB fastboot support for downloading and flashing images via
the fastboot protocol.

Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
2026-06-17 13:55:15 -06:00
Tom Rini a7830e8755 Merge branch 'master' of https://source.denx.de/u-boot/custodians/u-boot-sh
This is a DRAM controller driver for the R-Car X5H and its enablement.
This makes the U-Boot on RSIP usable beyond U-Boot shell running on
Cortex-M33, as the U-Boot on RSIP can now load not only SCP firmware
into the SCP core STCM, but also TFA BL31, OPTEE-OS and U-Boot into DRAM
and start them on the Cortex-A720AE core. This is self-contained and
affects only the R-Car X5H and a bit of R-Car V4H, besides it went
through rounds of testing until now, therefore it is safe to include it
this late in the release cycle. I know this will make rc5 massive, sorry
about that.
2026-06-16 17:39:13 -06:00
Tom Rini 932e3f6c6a Merge tag 'u-boot-dfu-20260616' of https://source.denx.de/u-boot/custodians/u-boot-dfu
u-boot-dfu-20260616

CI: https://source.denx.de/u-boot/custodians/u-boot-dfu/-/pipelines/30480

Android:
* Fix A/B slot selection when marked successful and tries = 0

Fastboot:
* Handle partial blk_dwrite() as errors instead of success

Usb Gadget:
* Atmel: Use calloc() to initialize endpoint list
2026-06-16 08:57:04 -06:00
Rasmus VillemoesandTom Rini 79f3e2f8be Makefile: let 'make clean' remove files created by DEVICE_TREE_DEBUG
Originally, 'make DEVICE_TREE_DEBUG=1' only generated extra output on
the console. But since 6cdd7597a2 ("kbuild: Produce diff between base
DT and U-Boot augmented DT if DEVICE_TREE_DEBUG=1"), that has also
left behind lots of files that clutter the repo and are hard to get
rid of manually.

Make sure that a 'make clean' will remove those files, and add them to
.gitignore.

Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
2026-06-16 08:53:12 -06:00
Marek Vasut 28f675023d arm: dts: renesas: Enable DBSC5 on R-Car R8A78000 X5H Cortex-M33 RSIP port
Bind the DBSC5 DRAM controller driver on boot in board_early_init_r(),
which brings up the DBSC5 DRAM controller and its PHY and which enables
access to DRAM present on this system.

Add default boot command which loads additional bootloader components
from HF and UFS storage into SRAM and DRAM, and starts those components
on SCP and AP core 0. The system is then capable of reaching U-Boot on
the AP core 0. Specifically, the following components are loaded:
- SCP firmware, 384 kiB from HF offset 0x4c0000 to SCP STCM
- TFA BL31, 256 kiB from UFS0 offset 0x5000 * 4 kiB sectors to DRAM 0x8c200000
- TEE, 2 MiB from UFS0 offset 0x5200 * 4 kiB sectors to DRAM 0x8c400000
- U-Boot, 1 MiB from UFS0 offset 0x7200 * 4 kiB sectors to DRAM 0x8c300000
- IPL parameters table is generated at DRAM address 0x8c100000

Enable pstore command support to allow dumping kernel console from
pstore/ramoops, which is convenient for debugging. Use as follows:
=> pstore set 0x80000000 0x10000 0x400 0x8000 0 0 0
=> pstore display console

Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
2026-06-16 05:38:25 +02:00
Marek Vasut a06d8334e5 ram: renesas: dbsc5: Add Renesas R-Car Gen5 DBSC5 driver
Add Renesas R-Car Gen5 DBSC5 DRAM controller driver. This driver is currently
capable of bringing LPDDR5X DRAM on Renesas R-Car X5H Ironhide board. Further
boards can be supported by supplying board specific DRAM configuration data
via dbsc5_get_board_data().

The driver reuses parts of previous DBSC5 driver, but due to hardware changes,
can not be fully integrated into existing DBSC and DRAM driver, therefore the
currentl DBSC and DRAM drivers are moved into R8A779G0 V4H specific files, and
the R8A78000 X5H files are added in parallel.

The Gen5 DBSC driver is meant to be used in RSIP context, while the Gen4 DBSC
driver is meant to be used in SPL, therefore the Kconfig conditionals have been
adjusted to match.

Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
2026-06-16 05:38:25 +02:00
Marek Vasut 93e5ca9261 ram: renesas: rtvram: Add support for Renesas R-Car Gen5
Add support for Renesas R-Car Gen5 R8A78000 SoC into RT-VRAM
initialization driver. The changes are only a slight adjustment
to the register programming, therefore reuse the existing RT-VRAM
driver and parametrize those changes using driver data.

Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
2026-06-16 05:38:25 +02:00
Heiko StuebnerandTom Rini 8b154abd31 lmb: Add the Rockchip architecture as requiring DMA below 4G
Loading EFI parts like a Debian-Installer on Rockchip SoCs creates
interesting results, in that on some boards the Grub bootloader can't
find any partitions on a USB-Stick, or loading a kernel from Grub spews
    EHCI fail timeout STS_IAA set
messages before failing and on others the loading something like efivars
from an eMMC creates read errors and making the MMC vanish from U-Boot.

This only affected boards with at least 4GB of RAM.

These boards have at least 256MB of memory placed above the actual 4GB
address space (due to the iomem being in between) and while kernel,
initramfs, dt are generally loaded to predefined addresses, additional
EFI parts (efivars, etc) are likely just loaded "somewhere" and it seems
this always landed in that higher up memory part.

Also in the Linux-kernel peripherals like EMMC, USB, etc already run
with a 32bit dma-mask set.

So far, I've seen this on RK3568 and RK3588, but as the same peripherals
are used on most Rockchip SoCs, it makes sense to limit this on all.

So add ARCH_ROCKCHIP to the default-y list of LMB_LIMIT_DMA_BELOW_RAM_TOP.

Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Jonas Karlman <jonas@kwiboo.se>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
2026-06-15 13:32:29 -06:00
Tom Rini badd97fe24 Merge patch series "Repair boards broken by the 6.1 kbuild bump"
Simon Glass <sjg@chromium.org> says:

Commit bd3f9ee679 added FORCE to several if_changed rules whose
recipes expand $^, so FORCE leaks in as a stray argument and the
command fails. Use $< to restore the Edison and i.MX23/28 images.

Link: https://lore.kernel.org/r/20260613130519.1516808-1-sjg@chromium.org
2026-06-15 12:50:04 -06:00
Simon GlassandTom Rini 3ac35afdd2 arm: mxs: Avoid passing FORCE to commands
Commit bd3f9ee679 ("kbuild: Bump the build system to 6.1") adds FORCE
as a prerequisite to the if_changed rules here, but the commands use $^
so FORCE leaks in as a stray operand. The dd in cmd_mkalign_mxs fails
(silently, since its stderr is discarded) and the binary is never
aligned, stat in cmd_mkivt_mxs emits an error and cst receives a bogus
argument.

Use $< and $(real-prereqs) instead, which exclude FORCE.

Fixes: bd3f9ee679 ("kbuild: Bump the build system to 6.1")
Signed-off-by: Simon Glass <sjg@chromium.org>
2026-06-15 12:49:56 -06:00
Simon GlassandTom Rini 895d3c67cd x86: edison: Avoid passing FORCE to the align command
Commit bd3f9ee679 ("kbuild: Bump the build system to 6.1") adds FORCE
as a prerequisite to the u-boot-align.bin rule, but cmd_mkalign_eds
expands $^, so FORCE leaks in as a stray operand. The dd then fails
(silently, since its stderr is discarded) and the following mv never
runs, so u-boot.bin never gains its 4096-byte zero prefix. The mask ROM
enters U-Boot 0x1000 (4KB) into the image and the board never starts,
sitting in BootROM download mode (DnX).

Use $< instead of $^, which excludes FORCE and restores the prefix.

Fixes: bd3f9ee679 ("kbuild: Bump the build system to 6.1")
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2026-06-15 12:49:56 -06:00
Zixun LIandMattijs Korpershoek 033eb908d0 usb: gadget: atmel: use calloc() to allocate endpoint list
malloc() doesn't zero out memory, leaving ep->ep.enabled uninitiated,
which could make this flag falsely true.

In next usb_ep_enable() call since this flag is true, ep->ops->enable()
will be skipped. Then usb_ep_queue() will fail on uninitialized endpoint.

Fixes: 59310d1ecb ("usb: gadget: introduce 'enabled' flag in struct usb_ep")
Signed-off-by: Zixun LI <admin@hifiphile.com>
Reviewed-by: Marek Vasut <marek.vasut+usb@mailbox.org>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Link: https://patch.msgid.link/20260606-udc_malloc-v2-1-1155326b182b@hifiphile.com
Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
2026-06-15 09:15:25 +02:00
Colin Pinnell McAllisterandMattijs Korpershoek e41e97e6e6 android_ab: fix slot selection
The boot selection rules state that a slot is bootable if it is not
corrupted and either has tries remaining or has already booted
successfully. However, slots that have tries_remaining == 0 and
successful_boot == 1 will be disregarded when picking the slot to
attempt.

Updates the selection logic so slots marked successful remain eligible
even when their tries counter is zero. Debug message now also includes
the successful_boot value.

Signed-off-by: Colin Pinnell McAllister <colinmca242@gmail.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Link: https://patch.msgid.link/20260525003158.11319-1-colinmca242@gmail.com
Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
2026-06-15 09:15:05 +02:00
Francois BerderandMattijs Korpershoek 1bd1d03337 fastboot: Fix blk_dwrite error checking
blk_dwrite() returns the number of blocks written.
The code was only checking if the return value was different
than 0. Hence, partial writes were considered successful.
Fix blk_dwrite error handling by checking that all blocks
are written.

Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Link: https://patch.msgid.link/BESP194MB2805BBD03E7C92727F116585DA0D2@BESP194MB2805.EURP194.PROD.OUTLOOK.COM
Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
2026-06-15 09:14:53 +02:00
Tom Rini 1e80ee4144 Merge branch 'master' of https://source.denx.de/u-boot/custodians/u-boot-sh
Two fixes for R-Car Gen5 RSIP, one to surely build u-boot-elf.shdr and
one to make u-boot-elf.shdr compatible with tooling.

Two fixes for R-Car Gen4, which could hang in SPL without them.
2026-06-14 15:35:00 -06:00