Commit Graph
106670 Commits
Author SHA1 Message Date
Max MerchelandFabio Estevam c644dec64a ARM: dts: tqma6: add boot phase properties
Add boot phase properties from U-Boot device tree.
This commit can be reverted if changes are integrated in upstreem
device trees and synced with U-Boot.

Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com>
2026-07-27 13:05:07 -03:00
Markus NiebelandFabio Estevam 2484741fec board: tqma6: change U-Boot device tree fragments
We will need GPIO to distinguish between SOM variants with / without
workaround for ENET errata. This is necessary to implement the
appropriate solution and remove code intended for the non-DM use case.
To support reuse, split them in SOM and baseboard specific parts.

Prepare fragments for use with SPL.

Signed-off-by: Markus Niebel <Markus.Niebel@ew.tq-group.com>
Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com>
2026-07-27 13:05:07 -03:00
Alexander KochandFabio Estevam 5c2fc4acc4 rtc: snvs: Add i.MX SNVS RTC driver
Add simple driver for i.MX SNVS RTC IP present in NXP i.MX SoCs.

Signed-off-by: Alexander Koch <akoch@initse.com>
Signed-off-by: Marek Vasut <marex@nabladev.com>
2026-07-27 13:05:07 -03:00
Marek VasutandFabio Estevam 771dca9677 arm64: imx: Handle both MMC2 and SD2 boot devices on Data Modul i.MX8M Mini eDM SBC
Handle both MMC2 and SD2 boot devices as SDMMC device 1 on
Data Modul i.MX8M Mini eDM SBC. In case the system boots from
a microSD card, the BootROM reports boot device as SD2_BOOT
instead of MMC2_BOOT. Continue booting from that SDMMC device
instead of falling back to SDP. Note that SDMMC device 1 is
the microSD slot on this device, SDMMC device 2 is the eMMC,
but BootROM reports the numbers the other way around, hence
the potential confusion in this commit message.

Fixes: 0b97a394f6 ("ARM: imx: Replace YModem with SDP on Data Modul i.MX8M Mini eDM SBC SPL")
Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
2026-07-27 13:05:07 -03:00
Vitor SoaresandFabio Estevam 2e49ea72ff toradex: tdx-cfg-block: Add verdin am62 0242 pid4
Add the new 0242 PID4 to config block handling:

- 0242 Verdin AM62 Dual 1GB WB ET

Update the board-specific variant selection to use the Wi-Fi variant
for the new WB SKU.

Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
2026-07-27 13:05:07 -03:00
Vitor SoaresandFabio Estevam 815de58370 toradex: tdx-cfg-block: Add smarc imx8mp 0240 pid4
Add the new 0240 PID4 to config block handling:

- 0240 SMARC iMX8M Plus Quad 4GB WB IT

Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
2026-07-27 13:05:07 -03:00
Vitor SoaresandFabio Estevam 96a52d11ae toradex: tdx-cfg-block: Add verdin imx8mm 0239 pid4
Add the new 0239 PID4 to config block handling:

- 0239 Verdin iMX8M Mini Quad 2GB WB IT

Update the board-specific variant selection to use the Wi-Fi variant
for the new WB SKU.

Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
2026-07-27 13:05:07 -03:00
Vitor SoaresandFabio Estevam 30586348b8 toradex: tdx-cfg-block: Add verdin imx8mp 64gb emmc pid4s
Add the new Verdin iMX8M Plus 64GB eMMC PID4s to config block handling:

- 0236 Verdin iMX8M Plus Quad 4GB WB IT
- 0237 Verdin iMX8M Plus Quad 4GB IT
- 0238 Verdin iMX8M Plus Quad 8GB WB IT

Update the board-specific variant selection to use the Wi-Fi variant for
the new WB SKUs.

Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
2026-07-27 13:05:07 -03:00
Vitor SoaresandFabio Estevam 6c00fdf583 toradex: tdx-cfg-block: Add apalis imx8qm 64gb emmc pid4s
Add the new Apalis iMX8QM 64GB eMMC PID4s to config block handling:

- 0233 Apalis iMX8QM 4GB WB IT
- 0234 Apalis iMX8QM 4GB IT
- 0235 Apalis iMX8QM 8GB WB IT

Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
2026-07-27 13:05:07 -03:00
Vitor SoaresandFabio Estevam 9d42978d91 toradex: tdx-cfg-block: Add aquila tda4 0230 pid4
Add the new 0230 PID4 to config block handling:

- 0230 Aquila TDA4 Octa 8GB IT

Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
2026-07-27 13:05:07 -03:00
Vitor SoaresandFabio Estevam f7d1cb673d toradex: tdx-cfg-block: Add smarc imx95 0229 pid4
Add the new 0229 PID4 to config block handling:

- 0229 SMARC iMX95 Hexa 4GB IT

Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
2026-07-27 13:05:07 -03:00
Emanuele GhidoliandFabio Estevam 3685450a81 board: toradex: aquila-imx95: detect RAM sizes
Use alias-based RAM probing to detect different memory configurations
on Toradex Aquila iMX95. The address wrap-around is not linear: address
bits above the module capacity alias back with some low address bits
XORed (bit 32 -> XOR 0xc000), as measured on 4GB and 8GB modules.

During probing, skip the first 256MB, since that region is reserved.

Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
2026-07-27 13:05:07 -03:00
Emanuele GhidoliandFabio Estevam 1f829fcc2a board: toradex: smarc-imx95: detect RAM sizes
Use alias-based RAM probing to detect different memory configurations
on Toradex SMARC iMX95. The address wrap-around is not linear: address
bits above the module capacity alias back with some low address bits
XORed (bit 32 -> XOR 0xc000), as measured on 4GB and 8GB modules.

During probing, skip the first 256MB, since that region is reserved.

Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
2026-07-27 13:05:07 -03:00
Ye LiandFabio Estevam bb4b0925d4 imx9: scmi: Update get mac from fuse for iMX952
Since iMX952 only has 2 pf and 2 vf, update the imx_get_mac_from_fuse
to adapt this layout.

Signed-off-by: Ye Li <ye.li@nxp.com>
2026-07-27 13:05:07 -03:00
Mathieu Dubois-BriandandFabio Estevam 099fc6eda5 imx93_frdm: Add OP-TEE device tree node
Add missing firmware/optee node, so is can be both used and copied into
Linux device tree by optee_copy_firmware_node(). This is consistent with
other i.MX93 boards.

Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
2026-07-27 11:30:51 -03:00
Marek VasutandFabio Estevam ba1a95aef3 arm64: dts: imx8mn: Drop nxp,fspi-header-filename
The FSPI header is now generated purely using binman, drop no longer
supported nxp,fspi-header-filename property.

Acked-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Marek Vasut <marex@nabladev.com>
2026-07-27 11:30:25 -03:00
Marek VasutandFabio Estevam 3f7a074d83 arm64: dts: imx8mm: Drop nxp,fspi-header-filename
The FSPI header is now generated purely using binman, drop no longer
supported nxp,fspi-header-filename property.

Acked-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Marek Vasut <marex@nabladev.com>
2026-07-27 11:30:25 -03:00
Marek VasutandFabio Estevam c62cdff89c binman: imx8mimage: Generate FSPI header in binman instead of mkimage
Stop depending on the current mkimage method of generating the FSPI
header, instead generate the FSPI header within binman itself. This
is more flexible, as the FSPI header properties can be configured
from within the board-specific DT instead of being hard-coded in
mkimage at build time.

Acked-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-07-27 11:30:25 -03:00
Md Shofiqul IslamandFabio Estevam d2d005a32b ge: common: vpd_reader: fix errloc array size in verify_bch()
errloc stores bit positions of errors returned by decode_bch().
The maximum number of correctable errors is ecc_bits, so errloc
must have ecc_bits entries.  The array was allocated with data_length
entries instead, which is the number of EEPROM data bytes -- orders
of magnitude larger than needed and incorrect.

Fixes: b418dfe16e ("board: ge: make VPD code common")
Signed-off-by: Md Shofiqul Islam <shofiqtest@gmail.com>
2026-07-27 11:29:56 -03:00
Max MerchelandFabio Estevam 141b9cab27 boards: tqma6ul: select TQ_COMMON_SYSINFO
Select TQ_COMMON_SYSINFO to use the tq_eeprom sysinfo driver
to read and print module EEPROM data.

Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com>
2026-07-27 11:29:29 -03:00
Max MerchelandFabio Estevam e643d211f5 arm: dts: tqma6ul: integrate tq,eeprom sysinfo driver
Add sysinfo node for tq,eeprom sysinfo driver.

Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com>
2026-07-27 11:29:29 -03:00
Max MerchelandFabio Estevam 1786f0e16e arm: dts: tqma6ul: add eeprom nvmem-layout
TQMa6UL has board-information located in EEPROM at offset 0x20.
Add necessary nodes and properties for nvmem-cells.

Revert this commit once the upstream linux device trees are
accepted and synchronized.

Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com>
2026-07-27 11:29:29 -03:00
Max MerchelandFabio Estevam beae2cdf2f sysinfo: tq_eeprom: select NVMEM
The SYSINFO_TQ_EEPROM driver requires NVMEM to access the SoM EEPROM.

Signed-off-by: Max Merchel <Max.Merchel@ew.tq-group.com>
2026-07-27 11:29:29 -03:00
Marek VasutandFabio Estevam 3dcbac87a2 arm64: dts: imx8m: Reinstate TEE ifdeffery
Since b57ed14793 ("dts: imx8m{m,n,p,q}: Make optee packaging optional")
the TEE node is always present in U-Boot proper fitImage, even if the
CONFIG_OPTEE is disabled because the u-boot.itb should not contain any
tee.bin. This is wasteful, and produces the following warning which is
also confusing to users:

"
Image 'image' is missing optional external blobs but is still functional: tee-os

/binman/section/fit/images/tee/tee-os (tee.bin):
   See the documentation for your board. You may need to build Open Portable
   Trusted Execution Environment (OP-TEE) and build with TEE=/path/to/tee.bin
"

Reinstate the CONFIG_OPTEE ifdeffery to mitigate the problem, but retain the
binman "optional" keyword at tee.bin .

Before:
"
$ mkimage -l u-boot.itb
FIT description: Configuration to load ATF before U-Boot
Created:         Tue Jun 30 17:23:54 2026
 Image 0 (uboot)
...
 Image 2 (tee) <------------------------------ bogus empty image entry
  Description:  OP-TEE                                 |
  Created:      Tue Jun 30 17:23:54 2026               |
  Type:         Trusted Execution Environment Image    |
  Compression:  uncompressed                           |
  Data Size:    0 Bytes = 0.00 KiB = 0.00 MiB <--------'
 Image 3 (fdt-1)
...
"

After:
"
$ mkimage -l u-boot.itb
FIT description: Configuration to load ATF before U-Boot
Created:         Tue Jun 30 17:58:15 2026
 Image 0 (uboot)
...
 Image 1 (atf)
...
 Image 2 (fdt-1)
...
"

Fixes: b57ed14793 ("dts: imx8m{m,n,p,q}: Make optee packaging optional")
Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
2026-07-27 11:28:57 -03:00
Marek VasutandFabio Estevam cec2f200b4 mx6: ddr: Subtract half a cycle instead of three quarters of a cycle after DQS gating calibration
The current DRAM calibration sequence is implemented based on NXP
AN4467 Rev.2 03/2015, which in chapter "12.3.2 Calibration Sequence
Setup with Predefined Data Content" states:

"
9. For each of the DQSx:
- Read the HW_DG_UPx value from the MMDC0/1_MPDGHWSTx, subtract the
  value of 0xc0 (3/4 cycle).
"

However, the i.MX 6Solo/6DualLite Applications Processor Reference
Manual, Rev. 5, 05/2020, chapter "45.11.3.1.2 Hardware DQS Calibration
with pre-defined value" states:

"
35. Set (MPDGHWSTn[HW_DG_UPn][10:7] - 1) to MPDGCTRLn[DG_HC_DELn].
    (We set the DQS gating value to be the upper limit value minus
     1 half cycle)
"

The i.MX 6Dual/6Quad Applications Processor Reference Manual, Rev. 6,
05/2020, chapter 44.11.3.1.2 Hardware DQS Calibration with pre-defined
value lists the same information. So do the following manuals:

- i.MX 6DualPlus/6QuadPlus Applications Processor Reference Manual, Rev. 3, 05/2020
  chapter 46.11.3.1.2 Hardware DQS Calibration with pre-defined value
- i.MX 6SoloX Applications Processor Reference Manual, Rev. 4, 05/2020
  chapter 40.11.3.1.2 Hardware DQS Calibration with pre-defined value
- i.MX 6UltraLite Applications Processor Reference Manual, Rev. 2, 03/2017
  chapter 33.11.3.1.2 Hardware DQS Calibration with pre-defined value
- i.MX 6ULL Applications Processor Reference Manual, Rev. 1, 11/2017
  chapter 35.11.3.1.2 Hardware DQS Calibration with pre-defined value
- i.MX 6ULZ Applications Processor Reference Manual, Rev. 0, 10/2018
  chapter 29.11.3.1.2 Hardware DQS Calibration with pre-defined value

The NXP MMDC DDR Stress Test (3.0.0) tool seems to be have the same
way as the later document rather than the AN4467 application note,
and produces values similar to the values with subtracted 1/2 cycle.

Adjust the behavior to match the more recent Reference Manual and
the MMDC calibration tool.

Winbond W634GU6RB does show sporadic signs of instability without
this correction.

Signed-off-by: Marek Vasut <marex@nabladev.com>
Tested-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
2026-07-27 11:27:19 -03:00
Ye LiandFabio Estevam 573b03317a arm: dts: imx943-evk: Add label for gpio expander devices
Because the i2c address of some gpio expander devices are same, so
in dts they have same node name which lead to same gpio device name.
Users can't get the GPIO through GPIO API or GPIO command.
Add the label to each gpio expander node, hence give unique name.

Signed-off-by: Ye Li <ye.li@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
2026-07-27 11:27:02 -03:00
Peng FanandFabio Estevam ae31cc745b imx9: scmi: reset GPIO2 according its node status
Check the GPIO2 dts node status to determine reset it or not.
On iMX952 single SPL/U-Boot image is shared for both mx952evk
and mx952evkrpmsg SM configs. GPIO2 is assigned to M7 domain
in mx952evkrpmsg, and there is no active user of GPIO2 for
mx952evk and mx952evkrpmsg in SPL/U-Boot, so it is disabled in
DTS. Otherwise, reset GPIO2 will meet hang when working with
mx952evkrpmsg SM.

Signed-off-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
2026-07-27 11:25:30 -03:00
Ye LiandFabio Estevam 047ed96784 imx9{4, 5, 52}_evk: power on mcore according to SM config
When working with SM config mx9{4,5,52}evkrpmsg, mcores are not booted
by ROM. Hence, power on the mcore and initialize TCM ECC in u-boot for
subsequent mcore booting.

Signed-off-by: Ye Li <ye.li@nxp.com>
[fabio: Adapted to mainline context]
Signed-off-by: Fabio Estevam <festevam@gmail.com>
2026-07-27 11:25:27 -03:00
Alice GuoandFabio Estevam bc92fd3aec imx9: bootaux: Support booting CM70, CM71 and CM33 sync cores
Support booting CM70, CM71 and CM33 sync core image by bootaux command
on iMX95, iMX94 and iMX952. (iMX95 and iMX952 only supports CM70).

Each core uses different core id which is defined by SM and passed in
SIP call.
 - CM33:  0
 - CM70:  1
 - CM71:  7
 - CM33S: 8

Prior to run bootaux to start core, prepaux is needed before loading
image. Below is example for booting CM70 TCM image on iMX95.

    =>fatload mmc 1:1 0x90000000 rpmsg.bin
    =>prepaux 1
    =>cp.b 0x90000000 0x203c0000 ${filesize}
    =>bootaux 0 1

Signed-off-by: Alice Guo <alice.guo@nxp.com>
Signed-off-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Jacky Bai <ping.bai@nxp.com>
2026-07-27 11:25:22 -03:00
Ye LiandFabio Estevam 0d61a1fda6 imx9: bootaux: Support authenticate signed Mcore container image
Add new command bootaux_cntr to replace bootaux in secure boot
(CONFIG_AHAB_BOOT=y) to authenticate signed M33 core image.
The M33 image must be packed in container format and signed.
bootaux_cntr supports Mcore image loaded to TCM or run as
FlexSPI NOR XIP.

Signed-off-by: Ye Li <ye.li@nxp.com>
[fabio: Adapted to use gd->dram[i]]
Signed-off-by: Fabio Estevam <festevam@gmail.com>
2026-07-27 11:25:19 -03:00
Guido GüntherandFabio Estevam 765ec2edd9 board: purism: Add support for the Librem5 devkit
Although it has similar naming the Librem 5 Devkit is a completely
different design from the Librem 5 phone. It uses an imx8mq SOM from
Emcraft, a separate HDMI port instead of DisplayPort, different USB-C
chip, panel, etc.

This is based on a Emcraft's SOM documentation, Purism's downstream fork
and the available schematics of the devkit.

Link: https://developer.puri.sm/Librem5/Development_Environment/Boards/imx8.html
Link: https://source.puri.sm/Librem5/dvk-mx8m-bsb
Co-authored-by: Angus Ainslie <angus@akkea.ca>
Co-authored-by: Manuel Traut <manut@mecka.net>
Signed-off-by: Manuel Traut <manut@mecka.net>
Tested-by: Manuel Traut <manut@mecka.net>
Signed-off-by: Guido Günther <agx@sigxcpu.org>
[fabio: Removed the  arch/arm/dts/Makefile  entry that does not apply and
it is not needed as the board uses OF_UPSTREAM]
Signed-off-by: Fabio Estevam <festevam@gmail.com>
2026-07-27 11:15:42 -03:00
Carlo CaioneandTom Rini 574b1adad7 fit: prefer the default configuration on best-match ties
With CONFIG_FIT_BEST_MATCH, fit_conf_find_compat() selects the
configuration matching the most specific U-Boot compatible string; on
equal matches the first listed configuration wins and the configurations
node 'default' property is never consulted.

A FIT whose configurations all share the same base devicetree compatible
(e.g. one manifest carrying a base tree plus overlay combinations for a
single board) therefore always boots the first configuration, silently
ignoring the default chosen by the manifest author.

Break score ties in favour of the default configuration. A strictly
better compatible match still wins over it, and FITs without a default
keep the current first-listed behaviour.

Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
2026-07-24 10:46:16 -06:00
Quentin SchulzandTom Rini 6380cb867e .mailmap: map the old U-Boot mailing list address to the new one
We have a new mailing list but the old one still forwards to the new
one, although some people (including me) have issues with the forward
and their mails to the old mailing list being dropped due to SPF policy.

Add an entry in .mailmap so that Cc: u-boot@lists.denx.de in "old"
cover letters and patches use the new mailing list address.

Tested with b4 ty --dry-run on a series from the old mailing list.

Tested with a Cc: u-boot@lists.denx.de in a commit log with b4 (b4
send), git-format-patch and git-send-email somehow don't seem to be
respecting this mapping. At least one tool (the one we now recommend)
does the right thing, so it's progress :)

Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
2026-07-24 09:46:58 -06:00
Akshay BelsareandTom Rini d7ef23c07b arm: armv8: mmu: fix DCACHE_OFF incorrectly unmapping region
DCACHE_OFF is defined as (0 << 2) = 0, and PTE_TYPE_FAULT is defined
as (0 << 0) = 0. In mmu_set_region_dcache_behaviour(), the cache
attribute passed to set_regions() is computed as:
  attrs = PMD_ATTRINDX(option >> 2)
For DCACHE_OFF=0 this evaluates to PMD_ATTRINDX(0) = 0, which equals
PTE_TYPE_FAULT.

Commit 6468ca13ff ("armv8: mmu: fix and optimise explicitly unmapping
regions") added an unmap path to set_one_region() that
triggers when attrs == PTE_TYPE_FAULT. Because DCACHE_OFF and
PTE_TYPE_FAULT share the same numerical value (0), any call to
mmu_set_region_dcache_behaviour() with DCACHE_OFF silently unmaps the
target region instead of changing its cache attributes to non-cached.

The subsequent flush_dcache_range() call at the end of
mmu_set_region_dcache_behaviour() then crashes with a Level 3
translation fault because the region it tries to flush has just been
unmapped.

The existing flag parameter already distinguishes the two callers:
 - mmu_set_region_dcache_behaviour() always passes flag=false
 - mmu_change_region_attr_nobreak() always passes flag=true, and is the
   only legitimate caller that passes PTE_TYPE_FAULT to unmap a region

Guard the unmap path with flag so that DCACHE_OFF attribute changes
take the correct else branch, which ORs in the ATTRINDX bits only,
leaving the PTE valid.

This was observed as a boot crash on Versal, Versal Net, and ZynqMP
platforms during network initialisation. The zynq_gem driver calls
mmu_set_region_dcache_behaviour() with DCACHE_OFF to make its BD
descriptor ring non-cached. With the bug the BD memory is unmapped,
and the subsequent dcache flush inside
mmu_set_region_dcache_behaviour() faults.

Fixes: 6468ca13ff ("armv8: mmu: fix and optimise explicitly unmapping regions")
Signed-off-by: Akshay Belsare <akshay.belsare@amd.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2026-07-23 15:16:29 -06:00
Honbo HeandTom Rini 64ce0f86ab serial: esp32: add driver for esp32 series chips
Add a driver model serial driver for Espressif ESP32 UART
controllers. The driver supports ESP32, ESP32-S3 and ESP32-S31 UART
register variants, including baud-rate setup, FIFO access and basic
port initialization.

Signed-off-by: Honbo He <hehongbo918@gmail.com>

Changes in v3:
- Add debug UART for early print output
2026-07-23 15:16:22 -06:00
Aristo ChenandTom Rini 79b6ee1a4b bootm: teach handle_decomp_error() about the noload decompression buffer
For a compressed kernel_noload image, bootm_load_os() allocates a
per-image decompression buffer of ALIGN(image_len * 8, SZ_1M) rather
than the global CONFIG_SYS_BOOTM_LEN. When decompression fails on that
path, handle_decomp_error() still prints

    Image too large: increase CONFIG_SYS_BOOTM_LEN

which is misleading: increasing CONFIG_SYS_BOOTM_LEN does not help
because the smaller per-image buffer is the actual bound. Commit
2ff26c1e378d ("bootm: fix overflow of the noload kernel decompression
buffer") worked around this by printing a follow-up note right after
handle_decomp_error() returned, but the boot log then reads as two
contradictory sentences.

Introduce enum bootm_decomp_limit and pass it into
handle_decomp_error() so the helper picks the right message in one
place. For the per-image path it now prints

    Image too large for the per-image decompression buffer (0x100000 bytes)

quoting the actual buffer size; the global path is unchanged. Drop the
trailing note in bootm_load_os() so only one line is printed.

Suggested-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-07-23 15:16:15 -06:00
Naveen Kumar ChaudharyandTom Rini f7b525a8bc cmd: mbr: return false instead of NULL from bool found_key()
found_key() is declared to return bool but returns NULL when strdup()
fails. NULL is a pointer constant; while it happens to convert to
zero (i.e. false) it is a type mismatch that trips stricter
compilers/static analysers.

Return false to match the declared return type.

Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
2026-07-23 15:16:09 -06:00
Naveen Kumar ChaudharyandTom Rini 0ccd0a939d cmd: pstore: bound path formatting with snprintf to avoid stack overflow
pstore_save() writes four different filenames into a fixed 256-byte
stack buffer 'path' using sprintf() with "%s" fed from argv[3] (the
user-supplied mount directory). The U-Boot command line buffer
(CONFIG_SYS_CBSIZE) is typically 1024 or 2048 bytes, so a directory
path in argv[3] can easily exceed 240 characters and overflow 'path',
corrupting the surrounding stack frame including the return address.

Replace the four sprintf(path, ...) call sites with snprintf() using
sizeof(path) as the bound. The neighbouring sprintf() calls into the
'addr' and 'length' buffers are left as-is; they write fixed-width
numeric conversions whose maximum length is bounded by the size of
ulong/u32 in hex and cannot overflow those buffers.

Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
2026-07-23 15:15:59 -06:00
Naveen Kumar ChaudharyandTom Rini 3c82b041f7 cmd: strings: interpret second argument as a byte count
The help text advertises "<addr> [byte count]" but do_strings()
stores argv[2] directly into last_addr and the loop condition tests
"addr < last_addr", i.e. it treats the value as an absolute end
address. When invoked as documented (e.g. "strings 0x40000000
0x100") the loop condition fails immediately because the supplied
count is far below start_addr, and the command prints nothing.

Compute last_addr as start_addr + hextoul(argv[2], NULL) so the
argument is used as a length in bytes, matching the help. The
existing repeat-mode fixup (last_addr = addr + (last_addr -
start_addr)) continues to preserve the same byte-count window
across CMD_FLAG_REPEAT.

Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
2026-07-23 15:15:48 -06:00
Marek VasutandTom Rini bc61758cbc cmd: date: Handle -ENOSYS return from dm_rtc_reset()
In case dm_rtc_reset() returns -ENOSYS, it means the .reset callback
in RTC driver is not implemented, likely because the callback is not
needed. Handle the -ENOSYS return code as success and proceed, else
the 'date reset' invocation incorrectly prints a bogus warning:
"## Failed to set date after RTC reset".

Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-07-23 15:15:34 -06:00
Tom Rini aa4ca3e1bc Merge patch series "tools: mkimage: fix stale data pointer in fit_import_data()"
Aristo Chen <aristo.chen@canonical.com> says:

fit_import_data() in tools/fit_image.c declares the data pointer and
the name of the external data property outside its loop over the
/images subnodes, so both values leak from one image into the next. An
image node that carries data-size but neither data-offset nor
data-position then reuses the pointer left behind by the previously
imported image: the previous image's data is written into the node,
after which the import aborts trying to delete an external data
property the node never had. Since that abort path only prints a
debug() message, a regular mkimage build fails with nothing but the
generic usage text. The failure mode also depends on the order of the
image nodes: when no externally stored image precedes the malformed
node, the pointer is still NULL, the node is skipped, and the hashing
stage reports a proper error instead.

A FIT authored from a .its cannot hit this, because dtc-authored
images carry inline data. It takes re-processing an external-data FIT
in which an image has lost its data-offset, for example one edited
with fdtput -d or produced by another tool:

  mkimage -E -f demo.its demo.itb
  fdtput -d demo.itb /images/kernel-2 data-offset
  mkimage -F demo.itb

There is no silent-success path, because the failing property delete
always aborts the run before the file is written back, but the user is
left without any indication of what is wrong.

Patch 1 moves the declarations into the loop so that each image starts
from a clean state. A node without an external data reference is now
skipped consistently regardless of node order, and the later
processing stages report the malformed node with a proper error
message (Can't get image data/size).

Patch 2 adds a regression test that builds an external-data FIT,
deletes the data-offset property of the second image and re-processes
the result with mkimage -F. It asserts that mkimage fails and that the
diagnostic is present on stderr; the unfixed tool fails the second
assertion since it prints nothing beyond the usage text.

Link: https://lore.kernel.org/r/20260710153343.1839357-1-aristo.chen@canonical.com
2026-07-23 13:43:27 -06:00
Aristo ChenandTom Rini 7551ce0977 test: py: add regression test for fit_import_data() stale state
Build an external-data FIT, remove the data-offset property from the
second image so that only its data-size remains, and re-process the
result with mkimage -F. mkimage must reject the malformed FIT with a
clear diagnostic from the hashing stage. Previously the stale per-image
state in fit_import_data() made the import copy the first image's data
into the second image and abort without printing anything.

Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-07-23 13:42:49 -06:00
Aristo ChenandTom Rini eecc4148fe tools: mkimage: fix stale data pointer in fit_import_data()
The data pointer and the name of the external data property are
declared outside the loop over the image nodes, so their values leak
from one image into the next. An image node that carries data-size but
neither data-offset nor data-position then reuses the pointer of the
previously imported image: the previous image's data is written into
the node before the import aborts when it tries to delete an external
data property the node does not have. Since that abort path only prints
a debug message, mkimage fails without any indication of what is wrong.
The failure mode also depends on the order of the image nodes: when no
externally stored image precedes the malformed node, the stale pointer
is still NULL, so the import skips the node and the hashing stage
reports a proper error instead.

Move the declarations into the loop so that each image starts from a
clean state. A node without an external data reference is now skipped
consistently regardless of node order, and a malformed node is always
reported by the later processing stages with a proper error message.

Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-07-23 13:42:49 -06:00
Tom Rini 88226db737 Merge tag 'mediatek-for-main-2026-07-22' of https://git.u-boot-project.org/u-boot/custodians/u-boot-mediatek
Fixes:
* Fixed some wrong parents of VLP clocks on mt8189.
* Added a missing perficfg_ao clock in mt8188.
* Disabled watchdog by default on Genio 510/700.
* Fixed U-Boot DT overrides not included on Genio 510/700.

Cleanups/refactoring:
* Changed how clock parent providers are registered and looked
  up for all MediaTek targets.
* Removed duplicate devicetree node in mt7623.
* Removed unused/non-standard DT properties in mt798{1,6,8}.
* Simplified MAINTAINERS by using N: instead of F: when possible.
* Replaced duplicate driver names in all MediaTek clock drivers.
* Cleaned up MediaTek power domain driver and split into separate
  driver per compatible target.
* Removed unused power domain enablement from mt798{1,6,6a,7,8}.

Features:
* Added power domain driver for mt8188.
2026-07-23 10:55:18 -06:00
Tom Rini a814edb52d Merge branch 'main' of https://git.u-boot-project.org/u-boot/custodians/u-boot-usb
- XHCI DWC3 bugfix
2026-07-23 10:54:48 -06:00
Tom Rini de02bc0ecc Merge patch series "i3c: dw: fix slave device setup and probe issues"
Pranav Tilak <pranav.vinaytilak@amd.com> says:

This series fixes several issues in the DW I3C master driver and
related infrastructure that prevented I3C read/write operations,
and enables I3C support for Versal Gen 2.

Link: https://lore.kernel.org/r/20260709091357.1860417-1-pranav.vinaytilak@amd.com
2026-07-22 13:10:22 -06:00
Pranav TilakandTom Rini 57b60ccd79 i3c: dw: fix slave device setup after DAA
i3c_master_add_i3c_dev_locked() incorrectly set master->this to the
newly discovered slave device, causing i3c_master_attach_i3c_dev()
to skip the attach_i3c_dev() callback. As a result the slave device
never got its master_priv (DAT slot index) allocated, free_pos was
never updated, and the DAT entry was never written.

Fix by removing the incorrect master->this assignment. Store the
slave descriptor directly in master->i3cdev[pos] inside
dw_i3c_master_attach_i3c_dev() where the DAT slot index is already
known. Also check the return value of i3c_master_add_i3c_dev_locked()
and skip num_i3cdevs increment on failure, fixing dummy devices shown
when no slaves are present on the bus.

Fixes: 1009c96f15 ("drivers: i3c: Add driver for MIPI DWI3C")
Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Reviewed-by: Dinesh Maniyam <dinesh.maniyam@altera.com>
2026-07-22 13:10:21 -06:00
Pranav TilakandTom Rini 331d9b8cf6 configs: versal2: enable I3C support
Enable I3C controller driver and command support for Versal Gen 2 by
adding CONFIG_CMD_I3C, CONFIG_I3C and CONFIG_DW_I3C_MASTER.

Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Acked-by: Michal Simek <michal.simek@amd.com>
2026-07-22 13:10:20 -06:00
Pranav TilakandTom Rini b2062131b4 cmd: i3c: fix list and current needing pre-selected controller
The !currdev guard in do_i3c() was placed before the list and current
handlers, causing both to fail when no controller is pre-selected.
Move the guard to only protect device_list, write and read which
actually need a controller.

Fixes: b875409da7 ("cmd: Add i3c command support.")
Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Reviewed-by: Dinesh Maniyam <dinesh.maniyam@altera.com>
2026-07-22 13:10:17 -06:00
Pranav TilakandTom Rini f077a6b07b i3c: dw: make resets optional in probe
Treat -ENOENT and -ENOTSUPP from reset_get_bulk() as non-fatal to
support platforms where no resets are defined in the DTS. The resets
property is not yet documented in the DT binding.

Fixes: 1009c96f15 ("drivers: i3c: Add driver for MIPI DWI3C")
Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com>
Reviewed-by: Dinesh Maniyam <dinesh.maniyam@altera.com>
2026-07-22 13:09:54 -06:00