Commit Graph
106131 Commits
Author SHA1 Message Date
Naveen Kumar ChaudharyandTom Rini d73aed0b05 serial: goldfish: return error when device address is invalid
goldfish_serial_of_to_plat() returns success even when dev_read_addr()
fails to find a valid address. This leaves plat->reg unset and defers
the failure to probe().

Return -EINVAL immediately when the address is FDT_ADDR_T_NONE so the
failure is reported at the of_to_plat stage where it belongs.

Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
Acked-by: Kuan-Wei Chiu <visitorckw@gmail.com>
2026-06-23 12:37:21 -06:00
Naveen Kumar ChaudharyandTom Rini 0bef438428 serial: cortina: check RX FIFO status before reading data
ca_serial_getc() reads from the URX_DATA register unconditionally
without first checking whether the RX FIFO contains valid data. When
the FIFO is empty, this returns whatever stale value is in the
register, which the DM serial framework interprets as a valid
character.

The DM serial framework expects getc() to return -EAGAIN when no data
is available, so it can handle retries and call schedule() to service
the watchdog between attempts.

Add a check of the UINFO register's UINFO_RX_FIFO_EMPTY bit before
reading URX_DATA, returning -EAGAIN when no data is pending. This
is consistent with how ca_serial_putc() already checks
UINFO_TX_FIFO_FULL before writing.

Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
2026-06-23 12:37:02 -06:00
Alexander SteinandTom Rini 157186fbfc global_data: fix type for gd_malloc_ptr()
With commit 92aa3ec321 ("global_data: Reduce size of early-malloc vars")
the type changes from (unsigned) long to int. But the type for default
if SYS_MALLOC_F_LEN is unset was not changed. Remove the suffix.
Fixes the warning:
 common/spl/spl.c:800:23: warning: format '%x' expects argument of type
 'unsigned int', but argument 2 has type 'long int' [-Wformat=]

Fixes: 92aa3ec321 ("global_data: Reduce size of early-malloc vars")
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-06-23 12:36:26 -06:00
Tom Rini 9f16b258e5 Merge tag 'v2026.07-rc5' into next
Prepare v2026.07-rc5
2026-06-22 16:42:41 -06:00
Tom Rini f072620dc9 Prepare v2026.07-rc5
Signed-off-by: Tom Rini <trini@konsulko.com>
2026-06-22 16:22:08 -06:00
Tom Rini cfaf135460 Merge branch 'master' of https://source.denx.de/u-boot/custodians/u-boot-sh
- serial: sh: Fix dev_read_addr error check
2026-06-22 08:19:12 -06:00
Francois BerderandMarek Vasut 6614139042 serial: sh: Fix dev_read_addr error check
dev_read_addr returns FDT_ADDR_T_NONE (-1) in case of error
and not 0.

Signed-off-by: Francois Berder <fberder@outlook.fr>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Tested-by: Marek Vasut <marek.vasut+renesas@mailbox.org> # R-Car H3/M3-W/M3-N Salvator-X(S), H3/M3-W ULCB, V4H Sparrow Hawk, X5H Ironhide RSIP and CA720AE
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> # Update subject tags
2026-06-22 06:34:09 +02:00
Tom Rini d57ea0d9ed Merge tag 'efi-2026-07-rc6' of https://source.denx.de/u-boot/custodians/u-boot-efi
Pull request efi-2026-07-rc6

CI: https://source.denx.de/u-boot/custodians/u-boot-efi/-/pipelines/30505

Documentation:

* bootdev: fix typos
* board: renesas: Document Renesas RZ/N1D and RZ/N1S as arm
* board: renesas: Document Renesas Geist board support
* board: renesas: Document Renesas Gray Hawk board support
* board: renesas: Document Renesas Ironhide board support
* android: fastboot: Document halt behaviour

UEFI:

* fix memory leak in efi_var_collect()
* set revision field in block IO protocol
* fix guid comparison in efi_selftest_loaded_image.c
* fix use-after-free in efi_selftest_memory.c
2026-06-21 09:27:12 -06:00
Mattijs KorpershoekandHeinrich Schuchardt ad90d1ec8b doc: android: fastboot: Document halt behaviour
It's possible to interrupt the fastboot command from the U-Boot shell
using the Ctrl-c keybinding.

Document this.

Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Reviewed-by: Sam Day <me@samcday.com>
2026-06-21 10:56:37 +02:00
Vincent StehléandHeinrich Schuchardt 60ff3d9509 efi_selftest: fix use-after-free
When the `memory' efi selftest verifies the Devicetree memory reservation,
it accesses the memory_map buffer after it has been freed with free_pool().
Move the verification earlier to fix this.

Fixes: 34c96659ed ("efi_selftest: check fdt is marked as runtime data")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2026-06-21 10:53:01 +02:00
Vincent StehléandHeinrich Schuchardt 41c6b83c77 lib/efi_loader: fix block io revision
The Revision field of the EFI_BLOCK_IO_PROTOCOL structure must be set to
one of the two valid values [1], but this is not initialized in the
efi_loader; fix it.

Link: https://uefi.org/specs/UEFI/2.11/13_Protocols_Media_Access.html#efi-block-io-protocol [1]
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2026-06-21 10:51:48 +02:00
Ilias ApalodimasandHeinrich Schuchardt 1f5c8eac2f efi_loader: fix memory leak in efi_var_collect
Barebox has now ported some of the UEFI code. In the process
they found some bugs.

In this case when the variable buffer is too small, efi_var_collect()
returns EFI_BUFFER_TOO_SMALL but doesn't free the allocated 'buf'.

Fixes: 5f7dcf079d ("efi_loader: UEFI variable persistence")
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2026-06-21 10:25:08 +02:00
Denis MukhinandHeinrich Schuchardt eb6f420836 bootdev: fix typos
Signed-off-by: Denis Mukhin <dmukhin@ford.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
2026-06-21 09:43:33 +02:00
Vincent StehléandHeinrich Schuchardt 5150a86187 efi_selftest: fix guid comparison
The `loaded image' efi selftest is comparing protocol GUIDs with the wrong
polarity.
This can be verified on the sandbox, where two protocols GUIDs are
retrieved by the test from the image handle in the following order:

1. Loaded Image Device Path Protocol GUID
2. Loaded Image Protocol GUID

The test matches on the first GUID, while it is in fact looking for the
second one; fix the comparison polarity.

Fixes: efe79a7c0d ("efi_selftest: test for loaded image protocol")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
Cc: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2026-06-21 09:41:59 +02:00
Marek VasutandHeinrich Schuchardt 861be585cc doc: board: renesas: Document Renesas Ironhide board support
Document support for Renesas Ironhide development board
based on Renesas R-Car X5H (R8A78000) SoC.

Fixes: cf71963778 ("arm64: dts: renesas: Add Renesas R-Car X5H R8A78000 Ironhide board code")
Fixes: 9d47a5a4d5 ("arm: renesas: Add Renesas R-Car R8A78000 X5H Cortex-M33 RSIP port")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
2026-06-21 09:20:49 +02:00
Marek VasutandHeinrich Schuchardt 89b45e46ca doc: board: renesas: Document Renesas Gray Hawk board support
Document support for Renesas Gray Hawk Single development board
based on Renesas R-Car V4M (R8A779H0) SoC.

Fixes: 53066deccb ("ARM: renesas: Add Renesas R8A779H0 V4M Gray Hawk board code")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
2026-06-21 09:20:49 +02:00
Marek VasutandHeinrich Schuchardt 3b2190935b doc: board: renesas: Document Renesas Geist board support
Document support for Renesas Geist development board
based on Renesas R-Car M3Le (R8A779MD) SoC.

Fixes: c8523795d7 ("arm64: dts: renesas: r8a779md: Add support for R-Car M3Le R8A779MD Geist")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
2026-06-21 09:20:49 +02:00
Marek VasutandHeinrich Schuchardt a1d74f409f doc: board: renesas: Document Renesas RZ/N1D and RZ/N1S as arm
The RZ/N1D and RZ/N1S contain Cortex-A7 core, which is 32bit ARM core.
Document the SoC as 32bit ARM instead of aarch64.

Fixes: a5b9f95943 ("doc: renesas: add Renesas board docs")
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2026-06-21 09:19:35 +02:00
Tom Rini 922cf29dd8 Merge branch 'master' of git://source.denx.de/u-boot-usb
- usb: tcpm: fix inverted poll condition in tcpm_pd_transmit()
2026-06-18 11:41:22 -06:00
Peng FanandMarek Vasut 78d5f8cb50 usb: tcpm: fix inverted poll condition in tcpm_pd_transmit()
The read_poll_timeout() macro breaks out of its loop when the condition
evaluates to true. The current code uses "!tx_complete" as the
condition, which means it exits immediately when tx_complete is false
(i.e., transmission has NOT completed yet), rather than waiting for
completion.

Fix the condition to "tx_complete" so that the poll loop waits until
the TCPC signals transmission success/failure/discard before
proceeding.

Without this fix, tcpm_pd_transmit() returns before the TCPC has
finished transmitting, causing the PD state machine to proceed with
stale tx_status values.

Fixes: 1db4c0ac77 ("usb: tcpm: add core framework")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
2026-06-18 16:48:16 +02:00
Tom Rini 298d44464d Merge patch series "Fixes, cleanup and a test for the SPL FIT "full" loader"
Francesco Valla <francesco@valla.it> says:

This patch set contains a collection of small fixes and cleanups for the
"full" FIT loader that can be used for the SPL. The main beneficiary is
the falcon boot flow, but the same loader can be used also for U-Boot
proper.

Patch 1 was part of another set, but I decided to put it here for a
better separation between plumbing (here) and new features (there).  I
kept the Reviewed-by tag collected from Simon in that occasion.

Patch 6 introduces a new unit test covering most of the code that is
being cleaned up.

The set was tested on a i.MX93 FRDM, both with and without signature and
to boot both U-Boot proper and the Linux kernel directly (i.e., falcon
boot).

Link: https://lore.kernel.org/r/20260604-spl_fit_full_cleanup-v1-0-ec036b5872e2@valla.it
2026-06-17 14:25:13 -06:00
Francesco VallaandTom Rini e41a770f38 test: spl: add unit test for the "full" FIT loader
Following what is already done for the "simple" FIT loader, add a unit
test for the "full" loader.

Signed-off-by: Francesco Valla <francesco@valla.it>
2026-06-17 14:16:41 -06:00
Francesco VallaandTom Rini 99b9223948 spl: fit: use CONFIG_IS_ENABLED whenever possible
Replace #ifdef directives with the CONFIG_IS_ENABLED() for better
coverage and cleaner code. In the mean time, convert the last
IS_ENABLED() to CONFIG_IS_ENABLED().

Signed-off-by: Francesco Valla <francesco@valla.it>
2026-06-17 14:16:41 -06:00
Francesco VallaandTom Rini cd9c7bc3b4 spl: fit: drop the 'standalone' load attempt
The 'standalone =' config property has been deprecated for ~5 years [1],
with the loud warn about the deprecation lasting much more than the
foreseen couple of releases.

Remove the attempt to load the primary image through this property to
save some boot time and code complexity.

[1] https://lore.kernel.org/u-boot/20210401182531.2147653-5-mr.nuke.me@gmail.com/

Signed-off-by: Francesco Valla <francesco@valla.it>
2026-06-17 14:16:41 -06:00
Francesco VallaandTom Rini fffbb6f428 spl: fit: rework the FDT load hack
U-Boot proper expects its FDT to be right after its binary image; the
"full" FIT image loader thus adopts an hack to relocate it, ignoring
the specified load address.

Rework the current form of the hack to:

- support the 'sandbox' environment with a sysmem-aware memcpy;
- use the ALIGN() macro instead of raw alignment logic;
- align the FDT to 8-byte boundary as per FDT specifications;
- fix the debug print (which was reporting the source address for the
  relocation instead of the destination one).

Signed-off-by: Francesco Valla <francesco@valla.it>
2026-06-17 14:16:41 -06:00
Francesco VallaandTom Rini 2a70a7e225 spl: fit: fix loadables load under sandbox
Align the fit_image_load() call done for the loadables to the ones for
other artifatcs (firmware, kernel, fdt), calling virt_to_phys() on the
pointer that contains the FIT location.

This is needed to support the 'sandbox' environment.

Signed-off-by: Francesco Valla <francesco@valla.it>
2026-06-17 14:16:41 -06:00
Francesco VallaandTom Rini e50ee1acd4 boot: fit: fix FIT verification in SPL
Align the behavior of fit_image_verify() called in SPL to the one in
full U-Boot. In particular, this function is called when both
CONFIG_SPL_LOAD_FIT_FULL and CONFIG_SPL_FIT_SIGNATURE are set (which can
happen e.g. in case of secure falcon boot).

Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Francesco Valla <francesco@valla.it>
2026-06-17 14:16:41 -06:00
Tom Rini 3838059689 Merge patch series "dtc: Resync fdt_check_full function"
Tom Rini <trini@konsulko.com> says:

As part of the resync to dtc version v1.7.2-35-g52f07dcca47c from the
Linux Kernel, we missed updating the fdt_check_full function because it
exists in its own file in upstream dtc and the kernel doesn't import it,
as reported by Anton Ivanov. This short series brings in the upstream
fdt_check.c file and then implements our size-saving option, but in the
modern way.

The size-saving portion has been upstreamed.

Link: https://lore.kernel.org/r/20260526202218.4004070-1-trini@konsulko.com
2026-06-17 14:13:00 -06:00
Tom Rini 487994d65c dtc: libfdt: Introduce a can_assume check in fdt_check_full
The current upstream method of having a function omit various tests is
to use the can_assume macro. Take the logic we had previously been using
and instead make it a can_assume(PERFECT) check within fdt_check_full
itself.

Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Tom Rini <trini@konsulko.com>
2026-06-17 14:06:48 -06:00
Tom Rini 37fef5ab88 dtc: Resync fdt_check_full() with upstream version v1.7.2-35-g52f07dcca47c
In the upstream project, the function fdt_check_full has been moved from
fdt_ro.c to its own file, fdt_check.c. This file is not included in the
Linux kernel copy and so has not been synced over. As we do need and use
the fdt_check_full function, bring that file over as of the current
upstream we are synced to. Remove our copy of this function from
fdt_ro.c and add fdt_check.o and 1-liner fdt_check.c where needed. Note
that for now, this will increase size in some cases as upstream does not
have a size reduction method here.

Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Tom Rini <trini@konsulko.com>
2026-06-17 14:06:48 -06:00
Wadim EgorovandTom Rini fae363f2cf configs: phycore_am62x_a53_defconfig: Enable fastboot
Enable USB fastboot support for downloading and flashing images via
the fastboot protocol.

Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
2026-06-17 13:55:15 -06:00
Tom Rini 7636a15a54 Merge patch series "armv8: mmu: fix region unmapping and optimise set_one_region()"
Casey Connolly <casey.connolly@linaro.org> says:

Currently trying to unmap a region results in slow and largely broken
behaviour as we unnecessarily split blocks and manually set thousands of
individual 4k pages instead of higher level blocks.

This series fixes the behaviour of set_one_region() so that it works
properly when called to unmap regions. See patch 4 for details.

Patches 1 & 2 improve the existing debug functionality, the pagetable
dumper will now print most explicitly unmapped regions (since they still
have their PA intact), as well as adding a new function which does a
very basic software TLB lookup to help with debugging.

Patch 3 de-duplicates some code by moving the loop that always surrounds
set_one_region() calls into its own function, this also helps with
readability in the calling functions.

Link: https://lore.kernel.org/r/20260608-b4-mmu-unmap-fixes-v6-0-ac0764cccf40@linaro.org
2026-06-17 09:55:31 -06:00
Casey ConnollyandTom Rini 6468ca13ff armv8: mmu: fix and optimise explicitly unmapping regions
As more platforms start ensuring they explicitly unmap reserved-memory
regions a few issues have appeared with how the existing dynamic mapping
code works. Fix these and get a small optimisation as well.

1. Teach pte_type() to actually respect the PTE_TYPE_VALID bit
2. Don't walk the TLB a second time if we call mmu_change_region_attr()
   with PTE_TYPE_FAULT (since it would just be a slow nop)
3. Fix how set_one_region() decides to split blocks.

Today set_one_region() will always split blocks until it reaches the
smallest granule size (4k) and then update all of these pages. This
appears to be due to a big in how is_aligned() is implemented, since
it only evaluates to true if addr and size are both multiples of the
current granule size, so a mapping aligned to 2M which is 4M in size
will cleanly result in 2 blocks being set, but a mapping aligned to
2M which is 4M + 8k in size will result in blocks being split and 1026
individual pages being set.

While for the address it is correct to enforce that it is aligned to
the current granule size, we only need to check if the region size is
greater than the current granule size. This allows us to simplify our
second example above to only 4 entries being updated (assuming no blocks
have to be split) since we only need to update 2 blocks to map the first
4M, drastically improving the best-case performance.

In the case where the address is 4k aligned rather than 2M aligned we
will still be restricted to mapping 4k pages until we reach 2M alignment
where we could then map a larger 2M granule which previously would never
happen.

Signed-off-by: Casey Connolly <casey.connolly@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2026-06-17 09:55:00 -06:00
Casey ConnollyandTom Rini 76c9092608 armv8: mmu: commonize the set_one_region() loop
This loop is duplicated 3 times, put it into its own function and call
it instead. This simplifies the logic in a few functions.

Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Casey Connolly <casey.connolly@linaro.org>
2026-06-17 09:55:00 -06:00
Casey ConnollyandTom Rini 41b6b904b5 armv8: mmu: teach the pagetable dumper to show explicit FAULT maps
When a region is explicitly unmapped (like with
mmu_change_region_attr(.... PTE_TYPE_FAULT)) the address translation
still remains but won't be used since the region is marked invalid.
Print these regions when we dump the pagetable to help with debugging.

Signed-off-by: Casey Connolly <casey.connolly@linaro.org>
2026-06-17 09:55:00 -06:00
Casey ConnollyandTom Rini 647990c528 armv8: mmu: add a function to help debug TLB lookups
Implement a super basic software TLB walk which can look up a single
address in the TLB and print each stage of the translation. This is
helpful for debugging TLB issues and will be compiled out if unused.

Example output on QEMU aarch64:

Performing software TLB lookup of address 0x50100000 va_bits: 40
  PTE: 0x47fe0000. addr[47:39]: 0x000 (offset 0x00000)
  L0: 0x47fe0000 -> TABLE (0x47fe1000)
    PTE: 0x47fe1000. addr[38:30]: 0x001 (offset 0x00008)
    L1: 0x47fe1008 -> BLOCK (0x40000000)
      [0x40000000 - 0x80000000]

Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Casey Connolly <casey.connolly@linaro.org>
2026-06-17 09:55:00 -06:00
Tom Rini a57f2a31a7 Merge patch series "bootm: bound noload kernel decompression to the allocated buffer"
Aristo Chen <aristo.chen@canonical.com> says:

For a compressed kernel_noload image, bootm_load_os() allocates a
decompression buffer of ALIGN(image_len * 4, SZ_1M) and then passes
CONFIG_SYS_BOOTM_LEN (typically 128 MiB on arm64) to image_decomp() as
the output limit. The decompressors honour whatever limit they are
given, so a kernel that decompresses to more than four times its
compressed size runs past the end of the allocated buffer and silently
corrupts adjacent memory.

A 4x compression ratio is at the edge of what modern compressors
(zstd, xz) achieve on real kernels, and is trivially exceeded by
crafted, highly compressible payloads, so this is reachable both
accidentally and intentionally. The overflow can land on already-loaded
boot artefacts (FDT, ramdisk, loadables), U-Boot's own data, or
memory-mapped device registers; the existing post-decompression overlap
check in bootm_load_os() only catches overlap with the FIT itself.

Patch 1 plumbs the actual allocation size through to image_decomp() and
handle_decomp_error() via a single decomp_len variable, so
decompression stops at the buffer boundary and fails cleanly when the
image is too large. The non-noload code path is unchanged and continues
to use CONFIG_SYS_BOOTM_LEN. A clarifying note is printed when the
failure is gated by the per-image buffer, so the generic
"increase CONFIG_SYS_BOOTM_LEN" advice does not mislead.

Patch 2 raises the noload-decompression headroom from 4x to 8x. The 4x
factor is at the edge of what zstd and xz achieve on real kernels, so
well-compressed vendor kernels can fail to boot at runtime once the
bound is enforced. 8x covers them comfortably while remaining bounded.

Patch 3 adds two sandbox py-tests against the per-image buffer at the
final 8x value: one that exceeds the buffer and must be rejected, and
one that matches the buffer exactly and must succeed (guarding the
boundary).

Tested on sandbox: both new tests pass; the existing
test_fit_compressed_images_load (which covers the load-address path)
and the other tests in test/py/tests/test_fit.py continue to pass.

Link: https://lore.kernel.org/r/20260605154255.833334-1-aristo.chen@canonical.com
2026-06-17 09:54:27 -06:00
Aristo ChenandTom Rini a7ea33e3a3 test/py: test kernel_noload decompression buffer overflow
Add sandbox tests that exercise the per-image decompression buffer that
bootm_load_os() allocates for a compressed kernel_noload image
(ALIGN(image_len * 8, SZ_1M)).

The overflow test builds a FIT whose decompressed size far exceeds the
per-image buffer and asserts that 'bootm loados' rejects it with a
decompression error rather than overflowing.

The boundary test builds a FIT whose decompressed size equals the
per-image buffer exactly and asserts that 'bootm loados' succeeds,
guarding against an off-by-one rejection at the buffer limit.

Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
2026-06-17 09:53:20 -06:00
Aristo ChenandTom Rini 4956f10853 bootm: increase kernel_noload decompression headroom from 4x to 8x
For a compressed kernel_noload image, bootm_load_os() allocates a buffer
of ALIGN(image_len * 4, SZ_1M). The 4x factor is at the edge of what
modern compressors (zstd, xz) achieve on real kernels, so a
well-compressed vendor kernel can fail to boot at runtime with no
intervening warning.

Bump the headroom to 8x. The buffer is still bounded by the compressed
image size, and the SZ_1M alignment keeps the overhead below 1 MiB on
small kernels.

Suggested-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
2026-06-17 09:53:20 -06:00
Aristo ChenandTom Rini 2ff26c1e37 bootm: fix overflow of the noload kernel decompression buffer
For a compressed kernel_noload image, bootm_load_os() allocates a
decompression buffer sized to ALIGN(image_len * 4, SZ_1M), assuming the
kernel compresses by no more than a factor of four. It then passes
CONFIG_SYS_BOOTM_LEN, rather than the size of that buffer, to
image_decomp() as the output limit. The decompressors honour the limit
they are given, so a kernel that decompresses to more than four times
its compressed size is written past the end of the allocated buffer and
corrupts adjacent memory.

Pass the allocation size to image_decomp() and handle_decomp_error() so
decompression stops at the buffer boundary and fails cleanly when the
image is too large, instead of overflowing. The regular non-noload
paths are unchanged and continue to use CONFIG_SYS_BOOTM_LEN. When the
failure is triggered by the smaller per-image buffer, print a note so
that handle_decomp_error()'s generic advice to increase
CONFIG_SYS_BOOTM_LEN does not mislead the reader.

Fixes: 69544c4fd8 ("bootm: Support kernel_noload with compression")
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Aristo Chen <aristo.chen@canonical.com>
2026-06-17 09:53:20 -06:00
Tom Rini e79de74103 Merge patch series "arm: omap: Add back omap4 support"
Bastien Curutchet <bastien.curutchet@bootlin.com> says:

This series aims to add back the omap4 support. This support was removed
by commit b0ee3fe642 ("arm: ti: Remove omap4 platform support") because
at that moment, none of the OMAP4-based boards had done the migration to
DM_I2C.
My use case is an old product based on the Variscite's omap4 system on
module. I needed to upgrade U-Boot on it for security reasons. I think
that this work could benefit to other people who may have same kind of
product to maintain.

Patch 1 to 3 remove the omap's clock driver dependency to the AM33xx
as it is also present in omap4 platforms. I tested these changes on the
beaglebone black to ensure I didn't break the AM33xx case.

Patch 4 & 5 revert the deletion of the omap4 support. The revert makes
checkpatch.pl angry. I fixed quite a lots of warnings already but it
remains two kinds of warnings:
- CamelCase on timings structure, I left the CamelCase because IMHO it's
  more readable this way.
- #ifdef CONFIG_XYZ shouldn't be used anymore. I left one of this because
  I didn't find a clean way to get rid of it.

Patch 6 adds support for the Variscite's system on module. This system on
module is supported by the Linux project through
ti/omap/omap4-var-som-om44.dtsi

Link: https://lore.kernel.org/r/20260608-omap4-support-v3-0-8595ccd203f0@bootlin.com
2026-06-17 09:52:33 -06:00
Bastien CurutchetandTom Rini 8974dd64e6 board: variscite: add support for the omap4_var_som
OMAP4 support is present but there isn't any board using it.

Add minimal support for the Variscite OMAP4-SoM (debug console + boot
from SD card).
Use the ti/omap/omap4-var-stk-om44 device-tree from the Linux kernel. The
real representation of the SoM's hardware is located in
ti/omap/omap4-var-som-om44.dtsi included in it.

Set myself as maintainer for it.

Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
2026-06-17 09:50:36 -06:00
Bastien CurutchetandTom Rini 93d204f717 arm: ti: Introduce back omap4 support
omap4 support was dropped by b0ee3fe642 ("arm: ti: Remove omap4 platform
support") because the supported boards hadn't done the conversion to
CONFIG_DM_I2C in time. It still exists some omap4-based products and
they could benefit from the latest U-Boot support for obvious security
reasons.

Revert part of b0ee3fe642 to introduce back a minimal support for the
omap4 platform.
Fix the checkpatch's warning/errors induced by this revert. Following
warnings are still present:
| arch/arm/include/asm/arch-omap4/clock.h:445: WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
| arch/arm/mach-omap2/omap4/hwinit.c:24: WARNING: Use 'if (IS_ENABLED(CONFIG...))' instead of '#if or #ifdef' where possible
| arch/arm/mach-omap2/omap4/sdram_elpida.c:142: CHECK: Avoid CamelCase: <tRPab>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:143: CHECK: Avoid CamelCase: <tRCD>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:144: CHECK: Avoid CamelCase: <tWR>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:145: CHECK: Avoid CamelCase: <tRASmin>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:146: CHECK: Avoid CamelCase: <tRRD>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:147: CHECK: Avoid CamelCase: <tWTRx2>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:148: CHECK: Avoid CamelCase: <tXSR>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:149: CHECK: Avoid CamelCase: <tXPx2>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:150: CHECK: Avoid CamelCase: <tRFCab>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:151: CHECK: Avoid CamelCase: <tRTPx2>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:152: CHECK: Avoid CamelCase: <tCKE>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:153: CHECK: Avoid CamelCase: <tCKESR>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:154: CHECK: Avoid CamelCase: <tZQCS>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:155: CHECK: Avoid CamelCase: <tZQCL>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:156: CHECK: Avoid CamelCase: <tZQINIT>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:157: CHECK: Avoid CamelCase: <tDQSCKMAXx2>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:158: CHECK: Avoid CamelCase: <tRASmax>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:159: CHECK: Avoid CamelCase: <tFAW>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:209: CHECK: Avoid CamelCase: <tRL>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:210: CHECK: Avoid CamelCase: <tRP_AB>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:213: CHECK: Avoid CamelCase: <tRAS_MIN>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:215: CHECK: Avoid CamelCase: <tWTR>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:216: CHECK: Avoid CamelCase: <tXP>
| arch/arm/mach-omap2/omap4/sdram_elpida.c:217: CHECK: Avoid CamelCase: <tRTP>
I didn't find an clean way to fix the "don't use #ifdef" warning as we
need to define the gpio_bank for the SPL build only.
For the CamelCase warnings, the incriminated attributes represent
timings, so IMHO, it is more readable with CamelCase.

Set myself as OMAP4 maintainer.

Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
2026-06-17 09:50:36 -06:00
Bastien CurutchetandTom Rini 196b1fe9bf configs: omap4: remove unused boot target devices
This include file isn't used since the omap4 support has been dropped.
Since this support is about to be reintroduced, this file is going to be
used again. The upcoming support is minimal and doesn't include network,
therefore leaving PXE and DHCP in the BOOT_TARGET_DEVICES list would lead
to build errors.

Remove PXE and DHCP from the list of BOOT_TARGET_DEVICES.
Remove the LEGACY_MMC macros and the findfdt script that looks for
no-longer supported boards.
Remove the empty #ifdef XPL_BUILD

Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
2026-06-17 09:50:35 -06:00
Bastien CurutchetandTom Rini de2e3f00f2 clk: ti: Remove AM33xx dependency
The clock controller driven by this driver exists on other OMAP platforms
than the AM33xx. Yet, it uses functions provided by
arch/arm/mach-omap2/am33xx/clock.c making it unusable by other OMAPs.

Replace am33xx-specific do_{enable/disable}_clocks() with new static
functions implemented locally.
Replace the am33xx-specific clock header with the one shared by all OMAP
platforms.

Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
2026-06-17 09:50:35 -06:00
Bastien CurutchetandTom Rini 9a4f679096 arm: ti: omap: Extract common clock definitions
Lots of clock definitions are common to OMAP3, OMAP4 and OMAP5. So the
same macros are defined both in arch-am33xx/clock.h and in
arch-omap5/clock.h. Upcoming support for OMAP4 will again need the same
macros.

Group these common macro definitions into a common omap_clock header
shared across the OMAP2+ families.

Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
2026-06-17 09:50:35 -06:00
Bastien CurutchetandTom Rini bc93b4bcb3 arm: omap: Move PRM I2C channel frequency to vc.c
PRM_VC_I2C_CHANNEL_FREQ_KHZ is defined in omap5/clock.h but isn't really
related to clocks.

Since it's only used by mach-omap2/vc.c, move its definition there.

Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
2026-06-17 09:50:35 -06:00
Tom Rini a7830e8755 Merge branch 'master' of https://source.denx.de/u-boot/custodians/u-boot-sh
This is a DRAM controller driver for the R-Car X5H and its enablement.
This makes the U-Boot on RSIP usable beyond U-Boot shell running on
Cortex-M33, as the U-Boot on RSIP can now load not only SCP firmware
into the SCP core STCM, but also TFA BL31, OPTEE-OS and U-Boot into DRAM
and start them on the Cortex-A720AE core. This is self-contained and
affects only the R-Car X5H and a bit of R-Car V4H, besides it went
through rounds of testing until now, therefore it is safe to include it
this late in the release cycle. I know this will make rc5 massive, sorry
about that.
2026-06-16 17:39:13 -06:00
Tom Rini 932e3f6c6a Merge tag 'u-boot-dfu-20260616' of https://source.denx.de/u-boot/custodians/u-boot-dfu
u-boot-dfu-20260616

CI: https://source.denx.de/u-boot/custodians/u-boot-dfu/-/pipelines/30480

Android:
* Fix A/B slot selection when marked successful and tries = 0

Fastboot:
* Handle partial blk_dwrite() as errors instead of success

Usb Gadget:
* Atmel: Use calloc() to initialize endpoint list
2026-06-16 08:57:04 -06:00
Rasmus VillemoesandTom Rini 79f3e2f8be Makefile: let 'make clean' remove files created by DEVICE_TREE_DEBUG
Originally, 'make DEVICE_TREE_DEBUG=1' only generated extra output on
the console. But since 6cdd7597a2 ("kbuild: Produce diff between base
DT and U-Boot augmented DT if DEVICE_TREE_DEBUG=1"), that has also
left behind lots of files that clutter the repo and are hard to get
rid of manually.

Make sure that a 'make clean' will remove those files, and add them to
.gitignore.

Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
2026-06-16 08:53:12 -06:00