Rasmus Villemoes [Thu, 11 Jun 2026 14:08:57 +0000 (16:08 +0200)]
Makefile: let 'make clean' remove files created by DEVICE_TREE_DEBUG
Originally, 'make DEVICE_TREE_DEBUG=1' only generated extra output on
the console. But since 6cdd7597a2f ("kbuild: Produce diff between base
DT and U-Boot augmented DT if DEVICE_TREE_DEBUG=1"), that has also
left behind lots of files that clutter the repo and are hard to get
rid of manually.
Make sure that a 'make clean' will remove those files, and add them to
.gitignore.
Signed-off-by: Rasmus Villemoes <rv@rasmusvillemoes.dk> Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Heiko Stuebner [Sat, 13 Jun 2026 17:24:44 +0000 (19:24 +0200)]
lmb: Add the Rockchip architecture as requiring DMA below 4G
Loading EFI parts like a Debian-Installer on Rockchip SoCs creates
interesting results, in that on some boards the Grub bootloader can't
find any partitions on a USB-Stick, or loading a kernel from Grub spews
EHCI fail timeout STS_IAA set
messages before failing and on others the loading something like efivars
from an eMMC creates read errors and making the MMC vanish from U-Boot.
This only affected boards with at least 4GB of RAM.
These boards have at least 256MB of memory placed above the actual 4GB
address space (due to the iomem being in between) and while kernel,
initramfs, dt are generally loaded to predefined addresses, additional
EFI parts (efivars, etc) are likely just loaded "somewhere" and it seems
this always landed in that higher up memory part.
Also in the Linux-kernel peripherals like EMMC, USB, etc already run
with a 32bit dma-mask set.
So far, I've seen this on RK3568 and RK3588, but as the same peripherals
are used on most Rockchip SoCs, it makes sense to limit this on all.
So add ARCH_ROCKCHIP to the default-y list of LMB_LIMIT_DMA_BELOW_RAM_TOP.
Signed-off-by: Heiko Stuebner <heiko@sntech.de> Reviewed-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Tom Rini [Mon, 15 Jun 2026 18:50:04 +0000 (12:50 -0600)]
Merge patch series "Repair boards broken by the 6.1 kbuild bump"
Simon Glass <sjg@chromium.org> says:
Commit bd3f9ee679b4 added FORCE to several if_changed rules whose
recipes expand $^, so FORCE leaks in as a stray argument and the
command fails. Use $< to restore the Edison and i.MX23/28 images.
Simon Glass [Sat, 13 Jun 2026 13:05:13 +0000 (07:05 -0600)]
arm: mxs: Avoid passing FORCE to commands
Commit bd3f9ee679b4 ("kbuild: Bump the build system to 6.1") adds FORCE
as a prerequisite to the if_changed rules here, but the commands use $^
so FORCE leaks in as a stray operand. The dd in cmd_mkalign_mxs fails
(silently, since its stderr is discarded) and the binary is never
aligned, stat in cmd_mkivt_mxs emits an error and cst receives a bogus
argument.
Use $< and $(real-prereqs) instead, which exclude FORCE.
Fixes: bd3f9ee679b4 ("kbuild: Bump the build system to 6.1") Signed-off-by: Simon Glass <sjg@chromium.org>
Simon Glass [Sat, 13 Jun 2026 13:05:12 +0000 (07:05 -0600)]
x86: edison: Avoid passing FORCE to the align command
Commit bd3f9ee679b4 ("kbuild: Bump the build system to 6.1") adds FORCE
as a prerequisite to the u-boot-align.bin rule, but cmd_mkalign_eds
expands $^, so FORCE leaks in as a stray operand. The dd then fails
(silently, since its stderr is discarded) and the following mv never
runs, so u-boot.bin never gains its 4096-byte zero prefix. The mask ROM
enters U-Boot 0x1000 (4KB) into the image and the board never starts,
sitting in BootROM download mode (DnX).
Use $< instead of $^, which excludes FORCE and restores the prefix.
Fixes: bd3f9ee679b4 ("kbuild: Bump the build system to 6.1") Signed-off-by: Simon Glass <sjg@chromium.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Marek Vasut [Sun, 14 Jun 2026 01:52:21 +0000 (03:52 +0200)]
arm64: renesas: Initialize GIC600 fully on R-Car S4/V4H/V4M
ARM GIC-600 IP complies with ARM GICv3 architecture, but among others,
implements a power control register in the Redistributor frame. This
register must be programmed to mark the frame as powered on, before
accessing other registers in the frame.
Before the switch to generic lowlevel_init function, this did not pose
a problem as the previous custom lowlevel_init did not access the GICR
registers. The generic function does and that does lead to a hang early
in SPL. Enable the GIC600 initialization variant to mitigate the hang.
Fixes: 37997a214ed1 ("arm: renesas: Use stock lowlevel_init function and remove s_init") Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Marek Vasut [Sun, 14 Jun 2026 01:52:08 +0000 (03:52 +0200)]
arm64: renesas: Fold mach_cpu_init into board_init_f on R-Car S4/V4H/V4M SPL
The mach_cpu_init() function is not invoked in SPL. Instead of
having two functions, fold mach_cpu_init() into board_init_f(),
which is called very early in the boot process and assures that
the CPG and APMU setup will be invoked before DM is brought up.
Fixes: 37997a214ed1 ("arm: renesas: Use stock lowlevel_init function and remove s_init") Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Marek Vasut [Thu, 11 Jun 2026 18:05:58 +0000 (20:05 +0200)]
arm: renesas: Make R-Car Gen5 u-boot-elf.shdr compatible with SDK flash_writer
The SDK 4.32 flash_writer tool, built from the SDK IPL source, requires
SREC S7 "Start address (termination)" record [1] at the end of the SREC
file that is sent to it during installation of content into storage,
otherwise the tool waits for the S7 record indefinitelly and the payload
does not get installed into storage.
Specifically, the tool considers SREC S3 and S7 records as mandatory,
S0, S5, S6 as ignored, and any other records as unsupported.
Configure srec_cat such that it explicitly generates the trailing S7
record, and also that it never generates the ignored S5 Count record.
This fixes installation of u-boot-elf.shdr using the flash_writer tool,
which can not finish successfully without the trailing S7 record.
Marek Vasut [Thu, 11 Jun 2026 18:04:26 +0000 (20:04 +0200)]
arm: renesas: Build u-boot-elf.shdr for R-Car X5H Cortex-M33 RSIP port
Currently, the default build target for all R-Car Gen3/4/5 is the
u-boot-elf.srec, which depends on u-boot.bin and other vital build
artifacts, which get built as prerequisites. The R-Car Gen5 RSIP
port benefits from u-boot-elf.shdr being built as well, because the
u-boot-elf.shdr contains header used by the BootROM to load and
start U-Boot on the RSIP core. Because u-boot-elf.shdr depends on
u-boot-elf.srec, switch the default build target for R-Car Gen5
RSIP port to u-boot-elf.shdr. This way, both u-boot-elf.shdr and
u-boot-elf.srec are built for R-Car Gen5 RSIP port.
Tom Rini [Fri, 12 Jun 2026 14:45:32 +0000 (08:45 -0600)]
Merge patch series "configs: imx95: enable PCI_INIT_R for Toradex modules"
Franz Schnyder <fra.schnyder@gmail.com> says:
Currently, on the Toradex SMARC iMX95 and the Verdin iMX95 the ENETC
device is not enumerated before network initialization because
pci_init() is not called. As a result, no Ethernet device is registered.
Enable CONFIG_PCI_INIT_R so the PCI buses are enumerated early enough
for the Ethernet Controller to be detected and used.
Franz Schnyder [Fri, 12 Jun 2026 08:59:01 +0000 (10:59 +0200)]
configs: verdin-imx95: enable PCI_INIT_R
Currently, the ENETC device on iMX95 is not enumerated before network
initialization because pci_init() is not called. As a result, no
Ethernet device is registered.
Enable CONFIG_PCI_INIT_R so the PCI buses are enumerated early enough
for the Ethernet Controller to be detected and used.
Fixes: 60d8255d8dc0 ("board: toradex: add Toradex Verdin iMX95") Signed-off-by: Franz Schnyder <franz.schnyder@toradex.com> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Franz Schnyder [Fri, 12 Jun 2026 08:59:00 +0000 (10:59 +0200)]
configs: toradex-smarc-imx95: enable PCI_INIT_R
Currently, the ENETC device on iMX95 is not enumerated before network
initialization because pci_init() is not called. As a result, no
Ethernet device is registered.
Enable CONFIG_PCI_INIT_R so the PCI buses are enumerated early enough
for the Ethernet Controller to be detected and used.
Fixes: ff0540fcfe49 ("board: toradex: add Toradex SMARC iMX95") Signed-off-by: Franz Schnyder <franz.schnyder@toradex.com> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Please pull the updates for rockchip platform:
- New Board support: rk3588 FriendlyElec NanoPi R76S
- UFS boot from SPL for rk3576 (NanoPi M5, ROCK 4D)
- Clock support for RK3576 GMAC 25MHz output and RK3528/RK3576 USB3 OTG
- Switch rk3128/rk3229 boards to upstream devicetree
- MAINTAINERS update for upstream devicetree references
- rk3588-rock-5b: Remove USB-C controller from u-boot.dtsi
- Define memory map for lemans-evk (pending SMEM)
- Fix CONFIG_SYS_INIT_SP_BSS_OFFSET in db410c chainloaded fragment
- Fix the "dump bootargs" command in the qcom-phone boot menu
- Fix a bug in the rpmh-regulator driver where the regulator mode may
not be set during enable.
- Enable watchdog autostart for Dragonwing boards
- Fix serial console init on ipq5424-rdp466
arm: dts: ipq5424-rdp466: add chosen node for serial console
Add a /chosen node with stdout-path pointing to serial0 (uart1) to
enable the DT-driven console discovery path in
serial_find_console_or_panic().
Without this node, the live DT path in serial_find_console_or_panic()
is skipped and the fallback path is used. Adding the /chosen node makes
the console selection explicit and deterministic, ensuring the correct
serial device is always selected as the console.
Petr Hodina [Fri, 5 Jun 2026 15:09:07 +0000 (17:09 +0200)]
gpio: qcom_spmi_gpio: move PM8998 GPIO from legacy pmic driver
Move the "qcom,pm8998-gpio" compatible from the legacy driver
qcom_pmic_gpio.c to qcom_spmi_gpio.c. Enables on PM8998-based boards
(sdm845: SHIFT 6mq, Pixel 3, OnePlus 6, Poco F1, Sony Xperia Akatsuki)
the Volume UP gpio-key.
Tom Rini [Tue, 9 Jun 2026 16:26:36 +0000 (10:26 -0600)]
Merge patch series "ti: j7: Update to v0.12.0 of DDR config tool"
Neha Malcom Francis <n-francis@ti.com> says:
Update all DDR configuration DTSIs to the latest auto-generated output of
the Sysconfig Tool (DDR Configuration for TDA4x, DRA8x, AM67x, AM68x,
AM69x (0.12.00.0000)) [0]
The auto-generated files must not be modified, but effort will be taken to
change the tool output to adhere to the latest checkpatch.pl rules. J722S
and J721E will also be updated in a subsequent series.
All the changes have been kernel boot tested and memtester has passed (same
as v1, as no functional changes made).
Johan Jonker [Sun, 17 May 2026 23:24:13 +0000 (01:24 +0200)]
rockchip: MAINTAINERS: upstream devicetree update
Most Rockchip boards are now using the upstream device tree.
Some MAINTAINERS files still contain a reference to
no longer available files. Update and where possible
streamline with '*' ending.
Signed-off-by: Johan Jonker <jbx6244@gmail.com> Reviewed-by: Peter Robinson <pbrobinson@gmail.com> Acked-by: Matwey V. Kornilov <matwey.kornilov@gmail.com> Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
Alexey Charkov [Mon, 4 May 2026 13:45:08 +0000 (17:45 +0400)]
rockchip: clk: clk_rk3576: Add support for RK3576 GMAC 25MHz clock output
Rockchip RK3576 SoC has two built-in GMACs which connect to external PHYs
via RGMII interface. The RGMII link can be clocked by either the PHY or
the SoC. When the SoC is the master, as is the case on the RK3576 EVB1,
the output clock needs to be configured in the CRU.
Add the respective logic for getting and setting the RGMII reference clock
output for both GMAC0 and GMAC1.
Tom Rini [Mon, 8 Jun 2026 21:37:38 +0000 (15:37 -0600)]
Merge patch series "mailbox: mpfs-mbox: fixes and syscon support"
Jamie Gibbons <jamie.gibbons@microchip.com> says:
This series updates the Microchip PolarFire SoC (MPFS) mailbox driver in
U-Boot.
The first three patches contain a set of bug fixes and cleanups to the
existing driver, fixing MMIO size calculations, and removing invalid
mailbox channel and private-data handling. These changes are independent
of any devicetree updates and fix issues present in the legacy driver.
The final patch adds support for the corrected, syscon-based devicetree
bindings for the MPFS mailbox. Linux has moved to this binding to more
accurately model the hardware, and U-Boot already supports the same
approach for the MPFS clock controller. This patch updates the mailbox
driver accordingly, while retaining support for the legacy binding for
backwards compatibility.
The final patch is required ASAP as boot is currently broken on master
for MPFS generic boards.
Jamie Gibbons [Mon, 18 May 2026 14:17:12 +0000 (15:17 +0100)]
mailbox: mpfs-mbox: support new syscon based devicetree configuration
The original PolarFire SoC mailbox devicetree bindings described the
control/status and interrupt registers as standalone reg regions of the
mailbox device. This was incorrect, as these registers are shared system
control blocks and should instead be modeled as syscon devices.
Linux has since corrected this by introducing syscon-based bindings for
the MPFS mailbox and updating the mailbox driver to access the control
and interrupt registers via syscon/regmap. U-Boot, however, continued to
expect the legacy binding, causing mailbox access to fail when using
Linux-aligned devicetrees.
Update the U-Boot MPFS mailbox driver to support the new syscon-based
bindings by resolving the control and sysreg syscon nodes and accessing
the registers through regmap. Support for the legacy mailbox binding is
retained for backwards compatibility with existing firmware-provided
devicetrees.
This brings the U-Boot mailbox driver in line with the corrected hardware
description and matches the behavior of the Linux mailbox driver.
Jamie Gibbons [Mon, 18 May 2026 14:17:11 +0000 (15:17 +0100)]
mailbox: mpfs-mbox: fix driver bug and cleanup
Remove an unused and invalid struct mbox_chan pointer from the private
data and fix incorrect memory handling in the probe path, where the
private data structure was allocated.
This change corrects a functional bugs and cleans up the driver without
altering its behavior.
Jamie Gibbons [Mon, 18 May 2026 14:17:10 +0000 (15:17 +0100)]
mailbox: mpfs-mbox: fix Driver Model private data handling
The MPFS mailbox driver declares priv_auto but also allocates a second
private data structure in the legacy probe path and overwrites the
device’s private pointer using dev_set_priv().
This results in leaking the auto-allocated private data and replacing
the driver’s private state mid-probe, which is incorrect usage of the
U-Boot Driver Model and can lead to undefined behavior.
Remove the redundant allocation and dev_set_priv() call so that the
driver consistently uses the auto-allocated private data provided by
U-Boot.
Frank Böwingloh [Fri, 5 Jun 2026 07:33:31 +0000 (09:33 +0200)]
smbios: Fix wrong sysinfo ID for Type 3 enclosure asset tag
smbios_write_type3() uses SYSID_SM_BASEBOARD_ASSET_TAG (Type 2) instead
of SYSID_SM_ENCLOSURE_ASSET_TAG (Type 3) for the enclosure asset tag.
This causes the enclosure's asset tag to be read from the baseboard
sysinfo field rather than the enclosure-specific one.
Fixes: bcf456dd ("smbios: add detailed smbios information") Signed-off-by: Frank Böwingloh <f.boewingloh@beckhoff.com> Cc: Raymond Mao <raymondmaoca@gmail.com> Cc: Tom Rini <trini@konsulko.com> Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org> Reviewed-by: Raymond Mao <raymondmaoca@gmail.com>
Alexey Charkov [Wed, 11 Mar 2026 13:30:59 +0000 (17:30 +0400)]
rockchip: spl: Add support for booting from UFS
Add the required architecture-specific lookups to enable U-boot SPL to
load images from UFS storage devices on Rockchip RK3576, which has a
boot ROM capable of loading the SPL image from UFS.
Reviewed-by: Jonas Karlman <jonas@kwiboo.se> Signed-off-by: Alexey Charkov <alchark@flipper.net>
Jonas Karlman [Mon, 9 Mar 2026 21:37:06 +0000 (21:37 +0000)]
rockchip: rk3588-rock-5b: Remove USB-C controller from u-boot.dtsi
The commit 12049db76437 ("rockchip: rk3588-rock-5b: Add USB-C controller
to u-boot.dtsi") added the USB-C controller node to the ROCK 5B board
u-boot.dtsi, this and related usb nodes are now part of upstream DT.
Remove the upstream USB-C controller related DT nodes from u-boot.dtsi,
including the temporary used dr_mode and maximum-speed props of the
usb_host0_xhci node. Only usbc0 status = "okay" is kept ensuring USB-C
power delivery continues to work as intended.
Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> Reviewed-by: Kever Yang <kever.yang@rock-chips.com>
Reviewed-by: Marek Vasut <marek.vasut@mailbox.org> Reviewed-by: Bin Meng <bmeng.cn@gmail.com> Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
When applying base relocations from a PE-COFF binary all data must
be treated as untrusted. Add the following checks to
efi_loader_relocate():
* Reject relocation blocks that don't start on a 32-bit aligned
address.
* Reject relocation blocks whose SizeOfBlock is smaller than the
block header, which would cause an unsigned underflow when computing
the entry count.
* A block with SizeOfBlock == 0 is invalid and does not mark the end of
the relocation table.
* Reject relocation blocks that extend beyond the end of the
relocation section.
* Reject individual relocation entries whose target offset, together
with the access width, exceeds the mapped image size, preventing
out-of-bounds writes.
Pass virt_size to efi_loader_relocate() from efi_load_pe() to enable
the per-entry bounds check.
Reported-by: Anas Cherni <anas@calif.io> Reviewed-by: Simon Glass <sjg@chromium.org> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Francesco Valla [Sun, 31 May 2026 15:24:23 +0000 (17:24 +0200)]
dtoc: test: add missing escape in help text
A single percent sign might be interpreted as a string format directive
and shall thus be escaped - doubling it - to actually indicate a
percentage.
Without the escape, pytest fails to run test_fdt.py with the following
error:
ValueError: Test coverage failure
fdt code coverage: Traceback (most recent call last):
File "/usr/lib64/python3.14/argparse.py", line 1748, in _check_help
formatter._expand_help(action)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib64/python3.14/argparse.py", line 676, in _expand_help
return help_string % params
~~~~~~~~~~~~^~~~~~~~
TypeError: %c requires an int or a unicode character, not dict
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/home/user/u-boot/./tools/dtoc/test_fdt", line 1002, in <module>
sys.exit(main())
~~~~^^
File "/home/user/u-boot/./tools/dtoc/test_fdt", line 987, in main
parser.add_argument('-T', '--test-coverage', action='store_true',
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
default=False,
^^^^^^^^^^^^^^
help='run tests and check for 100% coverage')
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.14/argparse.py", line 1562, in add_argument
self._check_help(action)
~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib64/python3.14/argparse.py", line 1750, in _check_help
raise ValueError('badly formed help string') from exc
ValueError: badly formed help string
Fixes: 7640b166604e ("test_fdt: Convert to use argparse") Signed-off-by: Francesco Valla <francesco@valla.it>
- Fix RAM size calculation on verdin-imx95.
- Fix boot from SPI on i.MX8MM.
- Fix boot abort on kontron-sl-mx6ul.
- Fix the imx8 CPU market segment report.
Marek Vasut [Wed, 3 Jun 2026 22:32:12 +0000 (00:32 +0200)]
tools: imx8image: Fix FSPI alignment to 4 kiB
The SPI NOR minimum subsector size is 4 kiB, update the alignment.
THis is particularly important in case of embedded DUMMY_DDR, which
must be at at least 4 kiB aligned offset.
Fixes: a2b96ece5be1 ("tools: add i.MX8/8X image support") Signed-off-by: Marek Vasut <marex@nabladev.com> Reviewed-by: Peng Fan <peng.fan@nxp.com>
Marek Vasut [Sat, 30 May 2026 17:08:26 +0000 (19:08 +0200)]
arm64: dts: imx8mn: Generate FSPI header using binman imx8mimage
The binman imx8mimage now correctly handles generated fspi_header.bin
in its imx8mimage etype. Make use of this, remove fspi_conf_block in
favor of generated fspi_header.bin, and configure imx8mimage accordingly.
Marek Vasut [Sat, 30 May 2026 17:08:25 +0000 (19:08 +0200)]
arm64: dts: imx8mm: Generate FSPI header using binman imx8mimage
The binman imx8mimage now correctly handles generated fspi_header.bin
in its imx8mimage etype. Make use of this, remove fspi_conf_block in
favor of generated fspi_header.bin, and configure imx8mimage accordingly.
Marek Vasut [Sat, 30 May 2026 17:08:24 +0000 (19:08 +0200)]
binman: imx8mimage: Handle nxp,boot-from = "fspi"
Boot from FSPI requires additional 448 Byte long header, with U-Boot SPL
starting at offset 0x1000. Currently, both i.MX8MM and i.MX8MN attempt
to generate this header using fspi_conf_block with filename pointing at
CONFIG_FSPI_CONF_FILE file. This does not work, for two reasons.
First, the CONFIG_FSPI_CONF_FILE is generated by mkimage -T imx8mimage
and may not be available yet when the fspi_conf_block is evaluated. That
leads to a race condition where highly parallel builds fail to find the
CONFIG_FSPI_CONF_FILE, which is usually called fspi_header.bin, on first
build attempt.
Second, binman gets confused and patches incorrect offset of DDR PHY
firmware blobs into U-Boot SPL, the offset is incremented by exactly
0x1000 which is the size of fspi_conf_block.
Fix both problems at once, make imx8mimage handle the generated FSPI
header and prepend it in front of the imx8mimage processed data. This
way, the race condition is solved, because the data generated by the
imx8mimage are surely combined only after mkimage -T imx8mimage ran.
The binman offset calculation is also solved, because there is no
fspi_conf_block node in the DT anymore.
Ye Li [Fri, 22 May 2026 13:51:42 +0000 (21:51 +0800)]
cpu: imx8_cpu: Fix CPU segment information print
Should not use CONFIG_IMX_TMU to determine the print of CPU market
segment information. Only iMX8 platforms don't have segment fuse.
And there is no extended commercial part on iMX9 (91/93/94/95),
fix it to extended industrial.
The ram_alias_checks addresses are 32 bit values. When summed as 64 bit
values the calculation is done correctly, otherwise, if they are summed
as 32 bit values, the sum wraps around.
Fix by adding uintptr_t recast to the base address.
Sam Day [Thu, 28 May 2026 05:21:06 +0000 (05:21 +0000)]
arch: arm: force 4K page alignment in linker
Since 5c71f8110, the u-boot.elf produced by dragonboard410c_defconfig no
longer fits in the 1MiB aboot partition it is intended for.
To be precise, this issue occurs on toolchains that have a linker with a
COMMONPAGESIZE > 4K. Since u-boot is hardcoded for 4K granules, we
ensure that the linker doesn't try to align to anything larger than
that, otherwise we're just filling our ELFs with a bunch of useless
zeros.
Suggested-by: Stephan Gerhold <stephan.gerhold@linaro.org> Signed-off-by: Sam Day <me@samcday.com> Tested-by: Peter Robinson <pbrobinson@gmail.com>
Torsten Duwe [Mon, 1 Jun 2026 10:39:40 +0000 (12:39 +0200)]
pci: brcmstb: Adapt to AXI bridge
Fix-ups for the BCM root complex when it is located behind an AXI
bridge and clocked with 54MHz. Some are from kernel commit 377bced88c326, some where picked by Oleksii off a now-stale older
branch. All reworked for the simpler setup code in U-Boot.
Signed-off-by: Torsten Duwe <duwe@suse.de> Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com> Tested-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Torsten Duwe [Mon, 1 Jun 2026 10:39:36 +0000 (12:39 +0200)]
pci: brcmstb: rework iBAR handling
Rework the setup of inbound PCIe windows: use the convenience functions
from Linux kernel commit ae6476c6de187 to calculate the BAR offsets and
factor out the setup code into a separate function.
The Linux kernel first allocates and populates an array of inbound_win[]
and sets the BARs from it later, while U-Boot does it all on the fly,
in one go, so the code is not 1:1 comparable.
Signed-off-by: Torsten Duwe <duwe@suse.de> Tested-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Torsten Duwe [Mon, 1 Jun 2026 10:39:25 +0000 (12:39 +0200)]
pci: brcmstb: Support different variants using a cfg struct
The Linux kernel driver already had support for multiple hardware
variants when the bcm2712 was added (see e.g. linux commit 10dbedad3c818 which is the last in a longer set of changes). This
patch brings in this required infrastructure and adds a
differentiation between 2711 and 2712 register layouts on top.
Signed-off-by: Torsten Duwe <duwe@suse.de> Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com> Tested-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
The linux kernel assigns a new domain for every Root Complex where bus
numbering starts from 0 for each domain. U-Boot does not have domains
and uses a flattened bus numbering scheme instead. This means that any
device or bridge on the second enumerated RC will receive a bus number
equal to the last assigned one +1. This bus number contributes to the
address written into the index register, which will select the
configuration space to be read. Compensate for this contribution by
subtracting the base bus number.
Signed-off-by: Andrea della Porta <andrea.porta@suse.com> Signed-off-by: Torsten Duwe <duwe@suse.de> Tested-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Torsten Duwe [Mon, 1 Jun 2026 10:39:20 +0000 (12:39 +0200)]
ARM: bcm283x: Add bcm2712 PCIe memory window
Add a mapping region for the PCIe bus address spaces to the BCM2712
memory controller setup. Generously merging the PCIe address spaces
works sufficiently well for a boot loader.
Signed-off-by: Torsten Duwe <duwe@suse.de> Co-authored-by: Oleksii Moisieiev <oleksii_moisieiev@epam.com> Tested-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Peter Robinson <pbrobinson@gmail.com>
Denis Mukhin [Fri, 29 May 2026 03:44:36 +0000 (20:44 -0700)]
drivers: nvme: Log I/O timeouts
Current code silently swallows any timed-out commands scheduled
to NVMe. Log those to be able to debug any potential problems with
the NVMe hardware/firmware.
Signed-off-by: Denis Mukhin <dmukhin@ford.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Reviewed-by: Simon Glass <sjg@chromium.org> Link: https://patch.msgid.link/20260529034441.2075305-2-dmukhin@ford.com Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
ulong is 64 bits on 64-bit platforms. Hence, simple_xtoa can
produce up to 16 hex characters + NULL byte. The initrd_filesize
buffer is only 10 bytes which can cause a buffer overflow on
every PXE boot that loads an initrd on an address greater than
4GB.
Increase buffer size to 17 bytes to hold the maximum hex
representation of a 64-bit address.
Francois Berder [Fri, 15 May 2026 16:56:51 +0000 (18:56 +0200)]
net: bootp: Prevent out-of-bounds read in dhcp_message_type
dhcp_message_type() scans DHCP options looking for a 0xff
end-of-options marker with no check that the scan pointer stays
within the received packet. A server can send a crafted OFFER with
no 0xff terminator and large option length fields, advancing the
pointer past bp_vend[312] into adjacent heap memory.
This is the same class of bug as CVE-2024-42040, which fixed the
related bootp_process_vendor() call site. Fix it by adding an end
parameter to dhcp_message_type() and checking that popt is lower
than end.
Francois Berder [Fri, 15 May 2026 16:53:32 +0000 (18:53 +0200)]
net: dhcpv6: Prevent out-of-bounds reads while parsing options
dhcp6_parse_options() verifies that an option's declared data fits
within the packet, but does not check that option_len is large
enough for the fixed-size read each case performs. A malicious
DHCP server can send an ADVERTISE with a zero-length IA_NA,
STATUS_CODE, SOL_MAX_RT, or BOOTFILE_PARAM option, causing the
parser to read 2-4 bytes past the option's declared data.
Check option_len value before each dereference of option_ptr.
Francois Berder [Mon, 11 May 2026 19:55:31 +0000 (21:55 +0200)]
net: dhcpv6: Prevent buffer overflow during BOOTFILE_URL parsing
The net_boot_file_name is a 1024 byte buffer.
However, based on DHCPv6 RFC, bootfile-url length is
specified by option_len, a 16-bit unsigned integer
(valid range: 0-65535).
Hence, one needs to make sure that option_len is less
than the size of net_boot_file_name array before copying
bootfile-url to net_boot_file_name.
Francois Berder [Mon, 11 May 2026 13:37:58 +0000 (15:37 +0200)]
net: sntp: Check packet length in sntp_handler
Currently, the sntp_handler uses data in the UDP packet
regardless of the actual packet size. A OOB read can occur
if the packet is too small.
Fix it by checking the packet length before extracting
seconds from a SNTP packet.
Francois Berder [Sat, 9 May 2026 20:01:42 +0000 (22:01 +0200)]
net: ti: icssg: Fix portname buffer overflow
portname consists of dev->parent->name ("icssg0-eth",
"icssg1-eth", or "ethernet") and dev->name is the port node
name ("port@0" or "port@1"). Every board DTS in the repository
produces a string that overflows the buffer:
Giovanni Santini [Mon, 18 May 2026 20:46:05 +0000 (22:46 +0200)]
Makefile: fix extra dash in KBUILD_CFLAGS
Remove an extra leading dash from the KBUILD_CFLAGS assignment
under the CONFIG_CC_OPTIMIZE_FOR_DEBUG conditional block. The
extra dash breaks the build when CONFIG_CC_OPTIMIZE_FOR_DEBUG
is enabled.
Fixes: 56ae3c2a44fc ("Makefile: repair CONFIG_CC_OPTIMIZE_FOR_DEBUG support") Signed-off-by: Giovanni Santini <santigio2003@gmail.com> Reviewed-by: Simon Glass <sjg@chromium.org>
Francesco Valla [Sun, 31 May 2026 21:15:09 +0000 (23:15 +0200)]
tests: fs_helper: check path validity during cleanup
If the filesystem creation attempted by the FsHelper class fails, the
invocation of the cleanup function will cause a TypeError exception,
because the path of the filesystem itself, fed to os.remove(), will be
None. This will lead to a test failure even in case a skip is instead
wanted.
Such an exception will lead to a backtrace like this:
test/py/tests/test_fs/conftest.py:269: in fs_obj_basic
fsh.mk_fs()
test/py/tests/fs_helper.py:70: in mk_fs
self.fs_img = mk_fs(self.config, self.fs_type, self.size_mb << 20,
test/py/tests/fs_helper.py:246: in mk_fs
check_call(f'mkfs.{fs_lnxtype} {mkfs_opt} {fs_img}', shell=True,
/usr/lib64/python3.14/subprocess.py:420: in check_call
raise CalledProcessError(retcode, cmd)
E subprocess.CalledProcessError: Command '<...>' returned non-zero exit status 1.
During handling of the above exception, another exception occurred:
test/py/tests/test_fs/conftest.py:272: in fs_obj_basic
pytest.skip('Setup failed for filesystem: ' + fs_type + '. {}'.format(err))
E Skipped: Setup failed for filesystem: ext4. Command '<...>' returned non-zero exit status 1.
During handling of the above exception, another exception occurred:
test/py/tests/test_fs/conftest.py:277: in fs_obj_basic
fsh.cleanup()
test/py/tests/fs_helper.py:91: in cleanup
os.remove(self.fs_img)
E TypeError: remove: path should be string, bytes or os.PathLike, not NoneType
Fix this by checking if the variable containing the filesystem path is
valid before attempting to call os.remove() on it.
Fixes: 3691b1e4ce074 ("test: Convert fs_helper to use a class") Signed-off-by: Francesco Valla <francesco@valla.it>
Nguyen Tran [Sun, 24 May 2026 22:06:19 +0000 (00:06 +0200)]
arm64: dts: renesas: r8a779md: Add support for R-Car M3Le R8A779MD Geist
Add support for the Geist board based on the Renesas R8A779MD (M3Le) SoC, a
register-compatible variant of the R8A77965 (M3N) with reduced peripherals.
The Geist board design references the Renesas Salvator-X/XS boards, adapting
their configuration for the R8A779MD SoC.
The board will be switched to OF_UPSTREAM once the DTs land in upstream.
Jan Čermák [Tue, 12 May 2026 12:24:35 +0000 (14:24 +0200)]
mmc: bcmstb: Fix non-removable check in bcm2712 init
sdhci_brcmstb_init_2712() reads host->mmc->host_caps to decide whether
to force card-detect for a non-removable eMMC, or to route the CD signal
for a removable SD card. At the time this function runs from
sdhci_bcmstb_probe(), however, host->mmc->host_caps is still zero, that
field is only populated later by the MMC uclass, after the driver's
probe returns. mmc_of_parse() has already filled plat->cfg.host_caps
from the device tree by this point, so check that field instead.
Without the fix, every BCM2712 SDHCI instance takes the else branch and
writes SDIO_CFG_SD_PIN_SEL = SDIO_CFG_SD_PIN_SEL_CARD (0x02), including
the non-removable eMMC on boards such as CM5 on Home Assistant Yellow.
The SDIO_CFG block lies outside the SDHCI core's reset scope, so this
value persists across SDHCI_RESET_ALL into the next stage. On the
BCM2712, having SD_PIN_SEL set to "SD" when the Linux kernel performs
its first set_power(MMC_POWER_UP) write racily prevents the SDHCI
POWER_ON bit from latching (see [1] for the whole backstory) - the
voltage bits stick but POWER_ON drops - which wedges the first CMD0 the
full 10 s software timeout. On Home Assistant Yellow this manifested as
a ~20 s eMMC probe delay on roughly one in two Linux boots when U-Boot
was the previous stage. Booting directly from the Pi firmware (no U-Boot
in between) left SD_PIN_SEL at its default and did not exhibit the race.
Reading plat->cfg.host_caps lets init_2712 see the "non-removable"
property and take the correct branch, leaving SD_PIN_SEL untouched for
the eMMC.
Fixes: 10127cdbab64 ("mmc: bcmstb: Add support for bcm2712 SD controller") Signed-off-by: Jan Čermák <sairon@sairon.cz> Reviewed-by: Ivan T. Ivanov <iivanov@suse.de>
- Add support dynamic A/B bank bootup for STM32MP15
- Increase SYS_MALLOC_F_LEN for stm32mp15_defconfig to fix boot with optee-4.10.0
- Enable Arm SMC watchdog for STM32MP1
- Update part number for TM32MP251/3 SoC's family
projects / thirdparty / u-boot.git / log
