Marek Vasut [Sat, 18 Jul 2026 23:45:48 +0000 (01:45 +0200)]
doc: Switch from setenv to env set
The "env" command is the recommended environment management command,
its "set" subcommand is the equivalent replacement for legacy "setenv"
command. Update the documentation to use the contemporary "env set"
command instead of legacy "setenv" command.
Note that the "setenv" command is unlikely to be removed from U-Boot
in the near future due to it being integral part of the command line
ABI.
If we use video copy, bit image transfers need to write to the in memory
copy of the physical frame buffer. Damage control will sync the changes
to the physical frame buffer.
Cyclic video copy will catch all changes done by EFI applications directly
accessing the frame buffer copy.
gopobj->mode.fb_base must be a valid pointer to memory and not a virtual
sandbox address.
With this change the block image transfer test works again on the sandbox.
setenv efi_selftest block image transfer
bootefi selftest
Fixes: a75cf70d23ac ("efi: Correct handling of frame buffer") Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Tom Rini [Sat, 25 Jul 2026 13:55:35 +0000 (07:55 -0600)]
Merge patch series "fs/squashfs: fix symlink load failure on large images"
Allan ELKAIM <allan.elkaim@gmail.com> says:
sqfsload fails to load a file through a symlink when the squashfs
image contains a large number of inodes (e.g. a rootfs that includes
the tzdata timezone database).
Root cause: sqfs_read_nest() resolves the symlink by calling itself
recursively without first freeing the parent directory's inode and
directory table buffers. This causes a temporary double allocation
that can exhaust the U-Boot heap. When malloc() subsequently fails
inside sqfs_read_directory_table(), the error goes undetected and
sqfs_search_dir() is called with a NULL pos_list pointer, leading to:
Error: invalid inode reference to directory table.
Failed to load '/boot/Image'
Patch 1 fixes the structural problem (temporary double allocation)
and plugs the silent NULL pointer path in sqfs_read_directory_table().
Patch 2 adds the missing return-value checks on sqfs_dir_offset() that
turn any residual lookup failure into a clean error propagation.
Patch 3 (reworked in v3 following Richard Genoud's review) fixes
pre-existing leaks of dirs->entry on the error paths of
sqfs_search_dir(), by centralizing the cleanup at the 'out' label.
All patches are independent and can be reviewed separately.
The bug was first observed on U-Boot v2024.01 and is still present
on v2026.04. The patches have been tested on a Raspberry Pi CM4
running U-Boot v2026.04 (Yocto Scarthgap 5.0.17) with a 325 MB
squashfs rootfs containing 22 517 inodes. The symlink
/boot/Image -> Image-6.6.63-v8 now resolves successfully.
This series addresses the bug reported at:
https://lists.u-boot-project.org/pipermail/u-boot/2026-May/618533.html
Allan ELKAIM [Mon, 13 Jul 2026 14:22:47 +0000 (16:22 +0200)]
fs/squashfs: fix dirs->entry leaks on sqfs_search_dir() error paths
Several error paths in sqfs_search_dir() return through 'goto out'
while a directory entry obtained from sqfs_readdir_nest() is still
held, leaking dirs->entry: the inode lookup failure, the symlink
nesting limit check, every allocation/tokenization failure during
symlink resolution, and the case where readdir aborts after an
entry was already read.
Instead of freeing dirs->entry at each error site, centralize the
cleanup at the 'out' label: on error, no valid entry may be handed
back to the caller, so it can be freed unconditionally there. On
success, dirs->entry is already NULL: it is freed at the end of
each token iteration and before recursing into a symlink target,
and the root directory path never allocates it.
Explicit frees remain only where a success path needs them:
between reads in the readdir loop, at the end of each token
iteration, and before the recursive call. The now-redundant frees
on individual error paths are removed.
Suggested-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Allan ELKAIM <allan.elkaim@gmail.com>
Allan ELKAIM [Mon, 13 Jul 2026 14:22:45 +0000 (16:22 +0200)]
fs/squashfs: add sqfs_dir_offset() error checks
sqfs_dir_offset() returns a negative errno on failure, but three
call sites in sqfs_search_dir() use the return value as an array
index without checking for errors first. If the lookup fails,
dirs->table is set to an invalid address, leading to undefined
behavior.
Add negative-value guards after each sqfs_dir_offset() call so
that any lookup failure propagates cleanly as an error rather
than producing incorrect results.
Note: the corresponding sqfs_find_inode() NULL checks and the
heap exhaustion fix during symlink resolution are applied in
separate patches.
Acked-by: Miquel Raynal <miquel.raynal@bootlin.com> Reviewed-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Allan ELKAIM <allan.elkaim@gmail.com>
Allan ELKAIM [Mon, 13 Jul 2026 14:22:43 +0000 (16:22 +0200)]
fs/squashfs: fix heap exhaustion during symlink resolution
When sqfs_read_nest() encounters a symlink it resolves it by calling
itself recursively. In the unfixed code this looks like:
// dirsp is open: inode_table + dir_table still on heap
resolved = sqfs_resolve_symlink(symlink, filename);
ret = sqfs_read_nest(resolved, ...); // recursive: allocates a new
// inode_table + dir_table pair
free(resolved);
goto out;
// out: sqfs_closedir(dirsp) <- parent tables freed HERE, too late
There is no permanent leak: the parent's tables are freed at the
out: label once the recursive call returns. However, for the entire
duration of the recursive call both the parent's inode_table +
dir_table and the child's inode_table + dir_table are live on the
heap simultaneously. On large squashfs images these tables can be
significant in size, and this temporary double allocation may exhaust
the heap budget.
A superficial workaround would be to increase CONFIG_SYS_MALLOC_LEN,
but that wastes memory on all boards and does not address the
structural problem. The correct fix is to change the freeing order:
release the parent directory's resources before recursing. This way
only one set of inode and directory tables is live at any given time,
halving the peak heap usage during symlink resolution.
When heap exhaustion does occur and malloc returns NULL for dir_table
or pos_list inside sqfs_read_directory_table(), the failure is
currently silent and cascading:
- metablks_count is not reset to -1 before the goto out, so the
function returns a positive block count alongside a NULL pointer.
- sqfs_opendir_nest() does not detect the failure (it only checks
metablks_count < 1) and calls sqfs_search_dir() with m_list=NULL.
- sqfs_dir_offset() iterates over m_list[0..n], reading from
addresses 0x0, 0x4, 0x8, ... None of those values match the
inode's start_block, so the function returns -EINVAL.
- The error propagates up as a load failure with no indication
that the root cause was heap exhaustion:
Error: invalid inode reference to directory table.
Failed to load '<symlink path>'
Two fixes:
1. In sqfs_read_directory_table(), set metablks_count = -1 whenever
malloc fails after sqfs_count_metablks() returns a positive value,
so that the caller's "metablks_count < 1" check correctly detects
the failure and avoids calling sqfs_search_dir() with a NULL
pos_list.
2. In sqfs_read_nest() and sqfs_size_nest(), call sqfs_closedir() on
the parent dirsp before the recursive call so that the parent's
inode and directory tables are freed before the child allocates
its own. Only one set of tables is then live at any given time,
halving peak heap usage during symlink resolution.
Tom Rini [Fri, 15 May 2026 14:59:40 +0000 (08:59 -0600)]
Azure CI: Drop Windows host tools builds
In preparation for being able to support more recent OpenSSL versions,
we need to add support for the OpenSSL Provider API. This in turn isn't
something that MSYS has all of the required packages to support. Given a
lack of user feedback that these tools are still used in this manner,
remove Windows host tool builds from CI.
Carlo Caione [Thu, 9 Jul 2026 10:48:31 +0000 (12:48 +0200)]
fit: prefer the default configuration on best-match ties
With CONFIG_FIT_BEST_MATCH, fit_conf_find_compat() selects the
configuration matching the most specific U-Boot compatible string; on
equal matches the first listed configuration wins and the configurations
node 'default' property is never consulted.
A FIT whose configurations all share the same base devicetree compatible
(e.g. one manifest carrying a base tree plus overlay combinations for a
single board) therefore always boots the first configuration, silently
ignoring the default chosen by the manifest author.
Break score ties in favour of the default configuration. A strictly
better compatible match still wins over it, and FITs without a default
keep the current first-listed behaviour.
Reviewed-by: Simon Glass <sjg@chromium.org> Reviewed-by: Tom Rini <trini@konsulko.com> Signed-off-by: Carlo Caione <ccaione@baylibre.com>
.mailmap: map the old U-Boot mailing list address to the new one
We have a new mailing list but the old one still forwards to the new
one, although some people (including me) have issues with the forward
and their mails to the old mailing list being dropped due to SPF policy.
Add an entry in .mailmap so that Cc: u-boot@lists.denx.de in "old"
cover letters and patches use the new mailing list address.
Tested with b4 ty --dry-run on a series from the old mailing list.
Tested with a Cc: u-boot@lists.denx.de in a commit log with b4 (b4
send), git-format-patch and git-send-email somehow don't seem to be
respecting this mapping. At least one tool (the one we now recommend)
does the right thing, so it's progress :)
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
arm: armv8: mmu: fix DCACHE_OFF incorrectly unmapping region
DCACHE_OFF is defined as (0 << 2) = 0, and PTE_TYPE_FAULT is defined
as (0 << 0) = 0. In mmu_set_region_dcache_behaviour(), the cache
attribute passed to set_regions() is computed as:
attrs = PMD_ATTRINDX(option >> 2)
For DCACHE_OFF=0 this evaluates to PMD_ATTRINDX(0) = 0, which equals
PTE_TYPE_FAULT.
Commit 6468ca13ffd6f ("armv8: mmu: fix and optimise explicitly unmapping
regions") added an unmap path to set_one_region() that
triggers when attrs == PTE_TYPE_FAULT. Because DCACHE_OFF and
PTE_TYPE_FAULT share the same numerical value (0), any call to
mmu_set_region_dcache_behaviour() with DCACHE_OFF silently unmaps the
target region instead of changing its cache attributes to non-cached.
The subsequent flush_dcache_range() call at the end of
mmu_set_region_dcache_behaviour() then crashes with a Level 3
translation fault because the region it tries to flush has just been
unmapped.
The existing flag parameter already distinguishes the two callers:
- mmu_set_region_dcache_behaviour() always passes flag=false
- mmu_change_region_attr_nobreak() always passes flag=true, and is the
only legitimate caller that passes PTE_TYPE_FAULT to unmap a region
Guard the unmap path with flag so that DCACHE_OFF attribute changes
take the correct else branch, which ORs in the ATTRINDX bits only,
leaving the PTE valid.
This was observed as a boot crash on Versal, Versal Net, and ZynqMP
platforms during network initialisation. The zynq_gem driver calls
mmu_set_region_dcache_behaviour() with DCACHE_OFF to make its BD
descriptor ring non-cached. With the bug the BD memory is unmapped,
and the subsequent dcache flush inside
mmu_set_region_dcache_behaviour() faults.
Honbo He [Wed, 8 Jul 2026 12:54:06 +0000 (20:54 +0800)]
serial: esp32: add driver for esp32 series chips
Add a driver model serial driver for Espressif ESP32 UART
controllers. The driver supports ESP32, ESP32-S3 and ESP32-S31 UART
register variants, including baud-rate setup, FIFO access and basic
port initialization.
Signed-off-by: Honbo He <hehongbo918@gmail.com>
Changes in v3:
- Add debug UART for early print output
bootm: teach handle_decomp_error() about the noload decompression buffer
For a compressed kernel_noload image, bootm_load_os() allocates a
per-image decompression buffer of ALIGN(image_len * 8, SZ_1M) rather
than the global CONFIG_SYS_BOOTM_LEN. When decompression fails on that
path, handle_decomp_error() still prints
Image too large: increase CONFIG_SYS_BOOTM_LEN
which is misleading: increasing CONFIG_SYS_BOOTM_LEN does not help
because the smaller per-image buffer is the actual bound. Commit 2ff26c1e378d ("bootm: fix overflow of the noload kernel decompression
buffer") worked around this by printing a follow-up note right after
handle_decomp_error() returned, but the boot log then reads as two
contradictory sentences.
Introduce enum bootm_decomp_limit and pass it into
handle_decomp_error() so the helper picks the right message in one
place. For the per-image path it now prints
Image too large for the per-image decompression buffer (0x100000 bytes)
quoting the actual buffer size; the global path is unchanged. Drop the
trailing note in bootm_load_os() so only one line is printed.
Suggested-by: Simon Glass <sjg@chromium.org> Signed-off-by: Aristo Chen <aristo.chen@canonical.com> Reviewed-by: Tom Rini <trini@konsulko.com> Reviewed-by: Simon Glass <sjg@chromium.org>
cmd: mbr: return false instead of NULL from bool found_key()
found_key() is declared to return bool but returns NULL when strdup()
fails. NULL is a pointer constant; while it happens to convert to
zero (i.e. false) it is a type mismatch that trips stricter
compilers/static analysers.
cmd: pstore: bound path formatting with snprintf to avoid stack overflow
pstore_save() writes four different filenames into a fixed 256-byte
stack buffer 'path' using sprintf() with "%s" fed from argv[3] (the
user-supplied mount directory). The U-Boot command line buffer
(CONFIG_SYS_CBSIZE) is typically 1024 or 2048 bytes, so a directory
path in argv[3] can easily exceed 240 characters and overflow 'path',
corrupting the surrounding stack frame including the return address.
Replace the four sprintf(path, ...) call sites with snprintf() using
sizeof(path) as the bound. The neighbouring sprintf() calls into the
'addr' and 'length' buffers are left as-is; they write fixed-width
numeric conversions whose maximum length is bounded by the size of
ulong/u32 in hex and cannot overflow those buffers.
cmd: strings: interpret second argument as a byte count
The help text advertises "<addr> [byte count]" but do_strings()
stores argv[2] directly into last_addr and the loop condition tests
"addr < last_addr", i.e. it treats the value as an absolute end
address. When invoked as documented (e.g. "strings 0x40000000
0x100") the loop condition fails immediately because the supplied
count is far below start_addr, and the command prints nothing.
Compute last_addr as start_addr + hextoul(argv[2], NULL) so the
argument is used as a length in bytes, matching the help. The
existing repeat-mode fixup (last_addr = addr + (last_addr -
start_addr)) continues to preserve the same byte-count window
across CMD_FLAG_REPEAT.
Marek Vasut [Sat, 11 Jul 2026 13:38:37 +0000 (15:38 +0200)]
cmd: date: Handle -ENOSYS return from dm_rtc_reset()
In case dm_rtc_reset() returns -ENOSYS, it means the .reset callback
in RTC driver is not implemented, likely because the callback is not
needed. Handle the -ENOSYS return code as success and proceed, else
the 'date reset' invocation incorrectly prints a bogus warning:
"## Failed to set date after RTC reset".
Signed-off-by: Marek Vasut <marex@nabladev.com> Reviewed-by: Simon Glass <sjg@chromium.org>
Tom Rini [Thu, 23 Jul 2026 19:43:27 +0000 (13:43 -0600)]
Merge patch series "tools: mkimage: fix stale data pointer in fit_import_data()"
Aristo Chen <aristo.chen@canonical.com> says:
fit_import_data() in tools/fit_image.c declares the data pointer and
the name of the external data property outside its loop over the
/images subnodes, so both values leak from one image into the next. An
image node that carries data-size but neither data-offset nor
data-position then reuses the pointer left behind by the previously
imported image: the previous image's data is written into the node,
after which the import aborts trying to delete an external data
property the node never had. Since that abort path only prints a
debug() message, a regular mkimage build fails with nothing but the
generic usage text. The failure mode also depends on the order of the
image nodes: when no externally stored image precedes the malformed
node, the pointer is still NULL, the node is skipped, and the hashing
stage reports a proper error instead.
A FIT authored from a .its cannot hit this, because dtc-authored
images carry inline data. It takes re-processing an external-data FIT
in which an image has lost its data-offset, for example one edited
with fdtput -d or produced by another tool:
There is no silent-success path, because the failing property delete
always aborts the run before the file is written back, but the user is
left without any indication of what is wrong.
Patch 1 moves the declarations into the loop so that each image starts
from a clean state. A node without an external data reference is now
skipped consistently regardless of node order, and the later
processing stages report the malformed node with a proper error
message (Can't get image data/size).
Patch 2 adds a regression test that builds an external-data FIT,
deletes the data-offset property of the second image and re-processes
the result with mkimage -F. It asserts that mkimage fails and that the
diagnostic is present on stderr; the unfixed tool fails the second
assertion since it prints nothing beyond the usage text.
test: py: add regression test for fit_import_data() stale state
Build an external-data FIT, remove the data-offset property from the
second image so that only its data-size remains, and re-process the
result with mkimage -F. mkimage must reject the malformed FIT with a
clear diagnostic from the hashing stage. Previously the stale per-image
state in fit_import_data() made the import copy the first image's data
into the second image and abort without printing anything.
Signed-off-by: Aristo Chen <aristo.chen@canonical.com> Reviewed-by: Simon Glass <sjg@chromium.org>
tools: mkimage: fix stale data pointer in fit_import_data()
The data pointer and the name of the external data property are
declared outside the loop over the image nodes, so their values leak
from one image into the next. An image node that carries data-size but
neither data-offset nor data-position then reuses the pointer of the
previously imported image: the previous image's data is written into
the node before the import aborts when it tries to delete an external
data property the node does not have. Since that abort path only prints
a debug message, mkimage fails without any indication of what is wrong.
The failure mode also depends on the order of the image nodes: when no
externally stored image precedes the malformed node, the stale pointer
is still NULL, so the import skips the node and the hashing stage
reports a proper error instead.
Move the declarations into the loop so that each image starts from a
clean state. A node without an external data reference is now skipped
consistently regardless of node order, and a malformed node is always
reported by the later processing stages with a proper error message.
Signed-off-by: Aristo Chen <aristo.chen@canonical.com> Reviewed-by: Simon Glass <sjg@chromium.org>
Tom Rini [Thu, 23 Jul 2026 16:55:18 +0000 (10:55 -0600)]
Merge tag 'mediatek-for-main-2026-07-22' of https://git.u-boot-project.org/u-boot/custodians/u-boot-mediatek
Fixes:
* Fixed some wrong parents of VLP clocks on mt8189.
* Added a missing perficfg_ao clock in mt8188.
* Disabled watchdog by default on Genio 510/700.
* Fixed U-Boot DT overrides not included on Genio 510/700.
Cleanups/refactoring:
* Changed how clock parent providers are registered and looked
up for all MediaTek targets.
* Removed duplicate devicetree node in mt7623.
* Removed unused/non-standard DT properties in mt798{1,6,8}.
* Simplified MAINTAINERS by using N: instead of F: when possible.
* Replaced duplicate driver names in all MediaTek clock drivers.
* Cleaned up MediaTek power domain driver and split into separate
driver per compatible target.
* Removed unused power domain enablement from mt798{1,6,6a,7,8}.
Tom Rini [Wed, 22 Jul 2026 16:21:37 +0000 (10:21 -0600)]
Merge patch series "i3c: dw: fix slave device setup and probe issues"
Pranav Tilak <pranav.vinaytilak@amd.com> says:
This series fixes several issues in the DW I3C master driver and
related infrastructure that prevented I3C read/write operations,
and enables I3C support for Versal Gen 2.
i3c_master_add_i3c_dev_locked() incorrectly set master->this to the
newly discovered slave device, causing i3c_master_attach_i3c_dev()
to skip the attach_i3c_dev() callback. As a result the slave device
never got its master_priv (DAT slot index) allocated, free_pos was
never updated, and the DAT entry was never written.
Fix by removing the incorrect master->this assignment. Store the
slave descriptor directly in master->i3cdev[pos] inside
dw_i3c_master_attach_i3c_dev() where the DAT slot index is already
known. Also check the return value of i3c_master_add_i3c_dev_locked()
and skip num_i3cdevs increment on failure, fixing dummy devices shown
when no slaves are present on the bus.
cmd: i3c: fix list and current needing pre-selected controller
The !currdev guard in do_i3c() was placed before the list and current
handlers, causing both to fail when no controller is pre-selected.
Move the guard to only protect device_list, write and read which
actually need a controller.
Treat -ENOENT and -ENOTSUPP from reset_get_bulk() as non-fatal to
support platforms where no resets are defined in the DTS. The resets
property is not yet documented in the DT binding.
Julien Stephan [Thu, 9 Jul 2026 12:58:19 +0000 (14:58 +0200)]
power: domain: mediatek: add MT8188 power domain driver
Add the power domain driver for the MediaTek MT8188 SoC. It describes
the SoC's power domains (MFG, display, camera, codec, ADSP, PCIe, ...)
as a table of mtk_scp_domain_data entries and reuses the shared scpsys
core through the power-controller probe, including the per-domain power
status offsets and the ordered infracfg bus-protection steps.
The domain tables and ordered bus-protection sequences mirror the
Linux mt8188-pm-domains.h data.
Julien Stephan [Thu, 9 Jul 2026 12:58:18 +0000 (14:58 +0200)]
power: domain: mediatek: add support for the power-controller model
The current driver handles a flat scpsys node with a single, fixed set
of power status registers and one infracfg bus-protection mask. Newer
MediaTek SoCs describe their domains as child nodes of a power
controller and need a richer model:
- per-domain power status register offsets (pwr_sta_offs /
pwr_sta2nd_offs), falling back to the legacy SPM_PWR_STATUS
registers when not set;
- an ordered list of bus-protection steps (scpsys_bus_prot_data /
BUS_PROT_WR), each with its own set/clear/status register, applied
on power-off and released in reverse on power-on;
- per-domain clocks and an optional parent power domain.
Add mtk_power_controller_probe(), which walks the controller's subnodes,
resolves each domain's id, clocks and infracfg, and builds the domain
tree. The existing flat probe (mtk_scpsys_probe) is left unchanged.
No functional change for the existing MT7623/MT7629 drivers.
Julien Stephan [Thu, 9 Jul 2026 12:58:17 +0000 (14:58 +0200)]
power: domain: mediatek: rename struct mtk_scp_domain to mtk_scpsys
Prepare for support of future MediaTek SoCs by renaming struct
mtk_scp_domain to struct mtk_scpsys.
Upcoming SoCs require additional per-domain runtime data obtained from
Device Tree. To keep the domain_data description in soc_data static
const, a new wrapper structure will be introduced to combine the
immutable domain_data description with the runtime data. The natural
name for that wrapper is struct mtk_scp_domain, so free that name by
renaming the existing runtime state structure to struct mtk_scpsys.
Julien Stephan [Thu, 9 Jul 2026 12:58:16 +0000 (14:58 +0200)]
power: domain: mediatek: rename mtk_power_domain_probe to mtk_scpsys_probe
Rename the flat, single-node probe to mtk_scpsys_probe so that the name
mtk_power_domain_probe can be reused for an upcoming nested
(power-controller) probe. Update the MT7623 and MT7629 drivers
accordingly.
Julien Stephan [Thu, 9 Jul 2026 12:58:15 +0000 (14:58 +0200)]
power: domain: mediatek: wrap domain tables in struct scp_soc_data
The per-SoC match data currently points directly at the array of
mtk_scp_domain_data. Wrap it in a new struct mtk_scp_soc_data that
carries the table pointer together with its size, and add a
MTK_SCP_SOC_DATA() helper that fills both from a single table definition
via ARRAY_SIZE().
The num_domains field is not used yet; it is added here so that upcoming
SoC support can validate the domain index coming from the device tree
against the size of the table.
Julien Stephan [Thu, 9 Jul 2026 12:58:14 +0000 (14:58 +0200)]
power: domain: mediatek: split into per-SoC drivers
In order to prepare addition of future SoC, split the current driver
into common shared code and SoC specific drivers:
- mtk-power-domain.c now only holds the common register access and
power on/off/request/probe logic plus the shared power_domain_ops.
- mtk-power-domain.h exposes the register definitions, the mtk_scp_domain
data structures and the core helpers to the per-SoC drivers.
- mt7623-power-domain.c and mt7629-power-domain.c each hold their own
domain table and U_BOOT_DRIVER registration. The mt7629 driver also
matches the mt7622 compatible, preserving the previous behaviour.
Update the mt7622, mt7623 and mt7629 defconfigs to select the matching
per-SoC driver.
Make all scp_domain_data instances static const by removing the mutable
scpd member from struct scp_domain_data.
Refactor mtk_scpsys_domain_is_on() to take struct power_domain as
parameter instead of struct mtk_scp_domain_data and remove
mtk_scpsys_power_request(), which only existed to associate a struct
scp_domain with struct scp_domain_data.
The driver mapped each compatible to an enum scp_domain_type via the
match data, then used mtk_power_domain_hook() to switch on that enum
and select the per-SoC domain table. This forces every new SoC to add
an enum value and a switch case in shared code.
Store a pointer to the per-SoC table directly in the match data and
drop the enum, the type field, and mtk_power_domain_hook(). This keeps
per-SoC information in the match data where it belongs, making it
possible to later split the SoC-specific tables into standalone drivers.
Julien Stephan [Thu, 9 Jul 2026 12:58:10 +0000 (14:58 +0200)]
power: domain: mediatek: use MT2701 naming instead of MT7623
Upstream DT bindings define "mediatek,mt7623-scpsys" to fall back to
"mediatek,mt2701-scpsys". Align the driver with this convention by
using MT2701 naming throughout.
This also allows the driver to use the upstream
dts/upstream/include/dt-bindings/power/mt2701-power.h header instead of
the local include/dt-bindings/power/mt7623-power.h, since both expose
equivalent power domain definitions.
Rename scp_domain_mt7623 to scp_domain_mt2701, replace SCPSYS_MT7623
enum by SCPSYS_MT2701, and switch all MT7623 power domain defines to
their MT2701 equivalents.
Note:
we intentionally keep the explicit "mediatek,mt7623-scpsys"
compatible entry to avoid breaking legacy boards
(mt7623a_unielec_u7623_02 and mt7623n_bpir2_defconfig) that didn't
switched yet to OF_UPSTREAM. Same for
include/dt-bindings/power/mt7623-power.h that is only used in these
boards.
Julien Stephan [Thu, 9 Jul 2026 12:58:09 +0000 (14:58 +0200)]
power: domain: mediatek: use MT7622 naming instead of MT7629
Upstream DT bindings define "mediatek,mt7629-scpsys" to fall back to
"mediatek,mt7622-scpsys". Align the driver with this convention by
using MT7622 naming throughout.
This also allows the driver to use the upstream
dts/upstream/include/dt-bindings/power/mt7622-power.h header instead of
the local include/dt-bindings/power/mt7629-power.h, since both expose
equivalent power domain definitions.
Rename scp_domain_mt7629 to scp_domain_mt7622, remove the
SCPSYS_MT7629 enum, and switch all MT7629 power domain defines to their
MT7622 equivalents.
Also drop the explicit "mediatek,mt7629-scpsys" compatible entry and
rely on the DT fallback instead.
Julien Stephan [Thu, 9 Jul 2026 12:58:08 +0000 (14:58 +0200)]
configs: mediatek: drop unused CONFIG_MTK_POWER_DOMAIN
The MT7981, MT7986, MT7987 and MT7988 SoCs do not have a scpsys power
domain block: none of their device trees carry a "mediatek,*-scpsys"
compatible, so the driver never binds and enabling CONFIG_MTK_POWER_DOMAIN
only builds dead code.
Note: the MT7987 and MT7988 device trees do carry a
"mediatek,mt79xx-power-controller" compatible on their topmisc syscon,
but no U-Boot driver binds it and no node consumes power-domains, so
the symbols are unused there as well.
Remove the unused symbols (CONFIG_MTK_POWER_DOMAIN and
CONFIG_POWER_DOMAIN) from these defconfigs.
David Lechner [Tue, 7 Jul 2026 19:10:17 +0000 (14:10 -0500)]
clk: mediatek: mt8518: unique driver names
Change driver names for MediaTek mt8518 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:16 +0000 (14:10 -0500)]
clk: mediatek: mt8516: unique driver names
Change driver names for MediaTek mt8516 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:15 +0000 (14:10 -0500)]
clk: mediatek: mt8512: unique driver names
Change driver names for MediaTek mt8512 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:14 +0000 (14:10 -0500)]
clk: mediatek: mt8365: unique driver names
Change driver names for MediaTek mt8365 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:13 +0000 (14:10 -0500)]
clk: mediatek: mt8195: unique driver names
Change driver names for MediaTek mt8195 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:12 +0000 (14:10 -0500)]
clk: mediatek: mt8189: unique driver names
Change driver names for MediaTek mt8189 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:11 +0000 (14:10 -0500)]
clk: mediatek: mt8188: unique driver names
Change driver names for MediaTek mt8188 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:10 +0000 (14:10 -0500)]
clk: mediatek: mt8183: unique driver names
Change driver names for MediaTek mt8183 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:09 +0000 (14:10 -0500)]
clk: mediatek: mt7988: unique driver names
Change driver names for MediaTek mt7988 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:08 +0000 (14:10 -0500)]
clk: mediatek: mt7987: unique driver names
Change driver names for MediaTek mt7987 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:07 +0000 (14:10 -0500)]
clk: mediatek: mt7986: unique driver names
Change driver names for MediaTek mt7986 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:06 +0000 (14:10 -0500)]
clk: mediatek: mt7981: unique driver names
Change driver names for MediaTek mt7981 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:05 +0000 (14:10 -0500)]
clk: mediatek: mt7629: unique driver names
Change driver names for MediaTek mt7629 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:04 +0000 (14:10 -0500)]
clk: mediatek: mt7623: unique driver names
Change driver names for MediaTek mt7623 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Tue, 7 Jul 2026 19:10:03 +0000 (14:10 -0500)]
clk: mediatek: mt7622: unique driver names
Change driver names for MediaTek mt7622 clocks to be globally unique.
This will allow better build bot testing by allowing all clocks to be
compiled at the same time.
David Lechner [Fri, 10 Jul 2026 18:56:39 +0000 (13:56 -0500)]
arm: dts: mt7988: remove clock-parent properties
Remove all clock-parent properties from mt7988.dtsi. The clock driver
for this no longer uses this property. And this property would not be
acceptable upstream anyway.
David Lechner [Fri, 10 Jul 2026 18:56:38 +0000 (13:56 -0500)]
arm: dts: mt7986: remove clock-parent properties
Remove all clock-parent properties from mt7986.dtsi. The clock driver
for this no longer uses this property. And this property would not be
acceptable upstream anyway.
David Lechner [Fri, 10 Jul 2026 18:56:37 +0000 (13:56 -0500)]
arm: dts: mt7981: remove clock-parent properties
Remove all clock-parent properties from mt7981.dtsi. The clock driver
for this no longer uses this property. And this property would not be
acceptable upstream anyway.
David Lechner [Fri, 10 Jul 2026 18:56:35 +0000 (13:56 -0500)]
clk: mediatek: drop parent udevice field
Remove the parent field from the mediatek clock private data structures.
This was no longer used other than debug prints.
The uclass_get_device_* functions had the effect of ensuring that
parents were probed. This is done now by having parent providers
probe on bind, so re-probing here is no longer necessary. Clock trees
could have more than one parent anyway, so the existing code was not
completely correct anyway.
David Lechner [Fri, 10 Jul 2026 18:56:34 +0000 (13:56 -0500)]
clk: mediatek: use registered provider for parent lookup
Replace complex and fragile parent/grandparent lookup logic with a
simple lookup that matches CLK_PARENT_* flags to registered clock
providers.
Previously, we were walking priv->parent path to find a the matching
provider by either looking at driver name or driver ops. This was
fragile because more than one udevice could match the criteria and the
search depth had different rules depending on the clock type and the
parent type.
This will also enable more simplification in the future since we no
longer have to keep track of the udevice parents.
David Lechner [Fri, 10 Jul 2026 18:56:18 +0000 (13:56 -0500)]
clk: mediatek: add registration function for clock tree types
Add a new enum, field and function for registering clock tree types.
These types will be later used when looking up parent clocks. This
will replace fragile code that depends on lookup up devices by driver
names or ops.
We also need a way to ensure that any parent clock trees are probed
before trying to use a clock tree that depends on them. Since the
devicetree does not provide these relationships and there are only
a small number of clock parent providers (2 or 3 per SoC) vs. a large
number of clock trees that depend on them, it will simpler to just
always probe the parent clock trees on bind rather than trying to
add device info to all of the clocks to describe their parent
relations. For this, a mtk_common_clk_parent_bind() is added that the
drivers will use to set DM_FLAG_PROBE_AFTER_BIND.
Carlo Caione [Mon, 6 Jul 2026 13:24:59 +0000 (15:24 +0200)]
configs: mediatek: do not autostart the watchdog on the Genio EVKs
U-Boot autostarts the SoC watchdog (CONFIG_WATCHDOG_AUTOSTART default
y) and services it from its main loop, but nothing services it after
ExitBootServices()/bootm: an EFI-booted OS that does not take over the
watchdog in time is reset mid-boot at a wall-clock-dependent point.
The MediaTek toprgu can count at most ~16 seconds, once firmware stops
servicing it at the handoff, the OS has whatever is left of those 16
seconds.
On the Genio 700 EVK the generic Ubuntu 26.04 arm64 image is hard-reset
before its first boot reaches the login prompt: the mtk-wdt driver is
a module loaded from the rootfs and cannot win that race. Nothing tells
a generic OS that the watchdog is armed, so the failure is silent and,
from the user's side, indistinguishable from broken firmware.
Disable WATCHDOG_AUTOSTART for the Genio EVK boards (mt8365_evk
directly, mt8188.config for the Genio 510/700).
For Genio 510 and Genio 700, the common mt8188-u-boot.dtsi override is
never applied because none of the lookup paths resolve to it
(CONFIG_SYS_SOC="mediatek", CONFIG_SYS_CPU="armv8",
CONFIG_SYS_VENDOR="mediatek").
Add board-specific overrides for mt8370-genio-510-evk and
mt8390-genio-700-evk that include mt8188-u-boot.dtsi.
While at it, also add mt8188-u-boot.dtsi into
board/mediatek/MAINTAINERS.
Marek Vasut [Wed, 17 Jun 2026 02:40:53 +0000 (04:40 +0200)]
MAINTAINERS: Replace Mediatek with N:
Use N: to match on all mediatek/mtk files, drop the large list of
entries which represent the same set of relevant files and miss a
few in the process.
cmd: read: fix unsigned overflow bypassing range check
The bounds check in do_rw() was written as:
if (cnt + blk > limit)
with cnt and blk declared as uint (unsigned int) and limit as ulong.
C's usual arithmetic conversions are applied per binary operator, so
"cnt + blk" is evaluated entirely in unsigned int and wraps modulo
2^32 before the result is widened for the comparison against limit.
With cnt = 0xFFFFFFFF and blk = 1 the sum wraps to 0 and the guard
passes, allowing blk_dread()/blk_dwrite() to be issued with a 4 GiB
transfer count that runs past the partition (or, when no partition
is selected, the entire device).
Rewrite the check as two comparisons that do not overflow:
if (blk > limit || cnt > limit - blk)
The subtraction is performed in ulong (limit's type), so no truncation
occurs, and the two sub-conditions cover both "start block past end"
and "count would push us past end" failure modes.
Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com> Reviewed-by: Simon Glass <sjg@chromium.org>
Tom Rini [Tue, 21 Jul 2026 19:52:00 +0000 (13:52 -0600)]
Merge patch series "some string cleanup, and a tweak of the "config" command"
Rasmus Villemoes <rv@rasmusvillemoes.dk> says:
This started by me wanting something like what patch 8 does. That
wasn't too hard, except we had no strcasestr(), and also our regex
engine (which I didn't really want to pull into the mix anyway)
doesn't have a flag that requests case-insensitive matching. So I
wanted to add strcasestr(), but then I stumbled on a bunch of stuff
that should be cleaned up in str-land.
When doing development, it can be quite useful to enable
CONFIG_CMD_CONFIG, so that one can always check whether a config knob
one has just enabled has actually made it to target.
Because sometimes, one doesn't flash the right binary, or maybe one
has just done CONFIG_FOO=y in some config fragment, but that had no
effect because one would also have to do CONFIG_BAR=y.
However, 2400+ lines of text are rather hard to read through. One
probably uses a terminal emulator with capturing enabled, but
searching back through the capture file is a little tedious, and one
easily ends up finding something that doesn't pertain to the most
recent 'config' command invocation.
So make it possible to limit the output to those lines containing a
given string. Like the search functionality in menuconfig, make it
case insensitive, because it is much more convenient to type "config
pinctrl" than "config PINCTRL".
Since enabling CONFIG_CMD_CONFIG by itself adds over 10K of data, and
that increases with every U-Boot release even if one doesn't add any
new features to one's own defconfig (because the .config grows lots of
"is not set"), I don't see any point in guarding this by some
CONFIG_CMD_CONFIG_GREP.
Reviewed-by: Simon Glass <sjg@chromium.org> Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
test: string: add test of new strcasestr() function
Change the existing strstr() test a little so that the substring not
found is "bits", i.e. one that is actually found when doing case
insensitive search.
Then copy all of lib_strstr(), adapt the expectation for the
strcasestr(s1, s3) result, and add another "not found" case.
Reviewed-by: Simon Glass <sjg@chromium.org> Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
While this is not likely needed by any "real" driver code, a later
convenience addition to the "config" command will need this. As usual,
the linker will throw it away if nothing actually uses it, so it
should have no size impact when not used.
Reviewed-by: Simon Glass <sjg@chromium.org> Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
None of these six macros are defined by any architecture. Moreover,
the ifndef guard only exists in either string.h or string.c, making them
completely pointless.
I'm not sure whether we have an explicit coding style discouraging the
"extern" qualifier on function declarations, and string.h has a random
mix of everything, but I can't leave it on strncasecmp() now that it
will be immediately after strcasecmp() which doesn't have it.
Reviewed-by: Simon Glass <sjg@chromium.org> Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
The last use of this function with rather peculiar semantics[*] vanished
in 2021 with 0a527fda782 ("Fix IDE commands issued, fix endian issues,
fix non MMIO"). It has no tests, and should a need for something
similar ever appear, it is better done with some proper
utf16le/utf16be/utf16 abstractions rather than cluttering code with
'#ifdef __LITTLE_ENDIAN'.
[*] The byte-swapping itself is weird enough. But why is an input string
of odd length ok, while the empty string is not allowed?
Reviewed-by: Simon Glass <sjg@chromium.org> Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
Both glibc's (where this originated as a GNU extension) and the
kernel's versions of strchrnul() return "char *", not "const
char *". That also makes it consistent with the standard strchr()
function.
Reviewed-by: Simon Glass <sjg@chromium.org> Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
First, remove the !__KERNEL__ block, since U-Boot is always compiled
with -D__KERNEL__.
Second, remove the mention of the non-existing file
arch/sh/lib/strcasecmp.c and the redundant declaration of strcasecmp()
If sh did have a strcasecmp.c file, presumably the header would have
had to #define __HAVE_ARCH_STRCASECMP.
Third, remove the explicit #undefs of various __HAVE_ARCH_* and
redundant declarations of standard functions, which are anyway
declared in linux/string.h. In the linux source tree, those are all
#defines, and indeed linux does have asm implementations of those functions.
Reviewed-by: Simon Glass <sjg@chromium.org> Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk>
test: spl: check load_simple_fit() rejects an oversized data-size
Add a regression test that builds a FIT with external data, inflates
the data-size property far beyond the image and any plausible load
region, and confirms that spl_load_simple_fit() returns -EFBIG instead
of reading the declared size off the device. Without the bounds check
in load_simple_fit() this test overruns memory and crashes; with it the
load is rejected cleanly.
Signed-off-by: Aristo Chen <aristo.chen@canonical.com> Reviewed-by: Simon Glass <sjg@chromium.org>
spl: fit: bound the external data size before reading it
load_simple_fit() loads an image stored as external data by reading
it from the boot device with a transfer sized from the FIT data-size
property. That property is listed in exc_prop[] in image-fit-sig.c,
so it is excluded from the configuration signature and stays under
the control of anyone able to modify the boot medium even when
CONFIG_SPL_FIT_SIGNATURE is enabled. The read happens before
fit_image_verify_with_data() checks the image hash, so an inflated
data-size overruns the destination before the corruption can be
detected. The device-tree overlay path is the sharpest case, because
there the destination is a fixed CONFIG_SPL_LOAD_FIT_APPLY_OVERLAY_BUF_SZ
heap buffer.
Pass the size of the destination into load_simple_fit() and reject
an image whose data does not fit before the read is issued. The
check is done in two places: an early bail on len > max_size, then a
bail on the block-aligned size > max_size. The size check is the
mathematically binding one because size is len rounded up to the
device block length. The early bail exists so that
get_aligned_image_size() never runs on a hostile len, where its int
arithmetic would invoke signed-integer overflow.
For the overlay path the bound is exact: the caller passes the size
of its temporary buffer. For the firmware, loadables, FDT and FPGA
call sites the destination is wherever the load_addr field points,
with no defined upper limit at the call site. Those callers pass
CONFIG_SYS_BOOTM_LEN as a conservative ceiling, matching the same
limit spl_parse_legacy_validate() already applies to legacy images.
It is not a tight bound on the actual capacity at the destination,
just a cap that rejects implausibly-sized data.
Signed-off-by: Aristo Chen <aristo.chen@canonical.com> Reviewed-by: Simon Glass <sjg@chromium.org>
projects / thirdparty / u-boot.git / log
