Marek Vasut [Thu, 29 Jan 2026 00:44:28 +0000 (01:44 +0100)]
arm: renesas: Enable wget command and TCP on all R-Car systems
Enable the 'wget' command and TCP protocol support on all Renesas R-Car
systems. This allows users to download content from local HTTP server,
which may sometimes be more accessible than TFTP server. Enable TCP SACK
support to improve download performance.
The usage is similar to the TFTP command. To download file from server
http://192.ser.ver.ip/file/path/on/local/server , invoke wget as follows:
"
=> wget $loadaddr 192.ser.ver.ip:/file/path/on/local/server
"
In case the HTTP server listens on port other than default port 80,
set the 'httpdstp' environment variable to download file from server
http://192.ser.ver.ip:8088/file/path/on/local/server
"
=> env set httpdstp 8088
=> wget $loadaddr 192.ser.ver.ip:/file/path/on/local/server
"
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
* Remove pip from requirements.txt
* develop/process: Clarify name usage in the Signed-off-by line
UEFI:
* Improve EFI variable load message
* Fix use after free in efi_exit() with tcg2
* Fix efi_debug_image_info_normal allocation
* Add missing EFI_CALL in efi_net
net: airoha_eth: use proper switch node for en7523 case
Commit d2145a89bcf6 ("net: airoha: bind MDIO controller on Ethernet load")
uses "airoha,en7581-switch" dts node for finding MDIO childs. This is wrong
for EN7523 SoC. The correct node name should be used instead.
net: airoha_eth: fix mdio binding to switch device
Commit d2145a89bcf6 ("net: airoha: bind MDIO controller on Ethernet load")
refers to non-present CONFIG_MDIO_MT7531 and non-present "mt7531-mdio"
driver. It should use CONFIG_MDIO_MT7531_MMIO and "mt7531-mdio-mmio"
instead.
Jonas Karlman [Thu, 29 Jan 2026 21:01:51 +0000 (21:01 +0000)]
net: dwc_eth_qos: Start DMA and MAC after tail pointers are initialized
The DesignWare Cores Ethernet Quality-of-Service databook state that
receive and transmit descriptor list address and also transmit and
receive tail pointer registers should be initialized before the receive
and transmit DMAs are started.
It also state to enable the MAC receiver only after the DMA is active.
Otherwise, received frames can fill the Rx FIFO and overflow.
Move the activation of receive and transmit DMA and MAC receiver until
after tail pointer registers have been initialized.
Jonas Karlman [Thu, 29 Jan 2026 21:01:50 +0000 (21:01 +0000)]
net: dwc_eth_qos: Initialize the transmit tail pointer in eqos_start()
The DesignWare Cores Ethernet Quality-of-Service databook state that
descriptors up to one location less than the one indicated by the
descriptor tail pointer are owned by the DMA. The DMA continues to
process the descriptors until the following condition occurs:
Current Descriptor Pointer == Descriptor Tail Pointer
The DMA goes into suspend mode when this condition occurs, and updating
the tail pointer resume the DMA processing.
Configure the transmit tail pointer to the first (current) descriptor
pointer so that the tail pointer is a valid address instead of being
initialized to NULL when transmit DMA is started.
Also update the receive tail pointer comment to state that by pointing
to the last descriptor we are actually implying that all receive
descriptors are owned by and can be processed by the DMA.
Jonas Karlman [Thu, 29 Jan 2026 21:01:49 +0000 (21:01 +0000)]
net: dwc_eth_qos: Use lower_32_bits() for tail pointers
The DesignWare Cores Ethernet Quality-of-Service databook state that the
descriptor address from the start to the end of the ring must not cross
the 4GB boundary.
Use lower_32_bits() to write the lower 32 bits of descriptor addresses,
including the 32-bit tail pointers, consistently. No functional change
is intended.
Marek Vasut [Thu, 29 Jan 2026 00:23:29 +0000 (01:23 +0100)]
net: lwip: wget: rework the '#' printing
Currently, the LWIP wget command prints excessive amount of progress
indicator '#' for very long file downloads, limit this to one line
that scales according to transfer size.
The HTTP server does report the size of the entire file in protocol
headers, which are received before the actual data transfer. Cache
this information and use it to adaptively print progress indicator
'#' until it fills one entire line worth of '#', which indicates the
transfer has completed. This way, long transfers don't print pages of
'#', but every transfer will print exactly one line worth of '#'. The
algorithm for '#' printing is the same as TFTP tsize one.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Acked-by: Jerome Forissier <jerome.forissier@rm.com>
Marek Vasut [Wed, 28 Jan 2026 23:43:45 +0000 (00:43 +0100)]
net: lwip: tftp: add support of tsize option to client
The TFTP server can report the size of the entire file that is about to
be received in the Transfer Size Option, this is described in RFC 2349.
This functionality is optional and the server may not report tsize in
case it is not supported.
Always send tsize request to the server to query the transfer size,
and in case the server does respond, cache that information locally
in tftp_state.tsize, otherwise cache size 0. Introduce new function
tftp_client_get_tsize() which returns the cached tftp_state.tsize so
clients can determine the transfer size and use it.
Update net/lwip/tftp.c to make use of tftp_client_get_tsize() and
avoid excessive printing of '#' during TFTP transfers in case the
transfer size is reported by the server.
Yuya Hamamachi [Thu, 29 Jan 2026 22:30:19 +0000 (23:30 +0100)]
net: tftp: Fix TFTP Transfer Size data type
The TFTP transfer size is unsigned integer, update the data type
and print formating string accordingly to prevent an overflow in
case the file size is longer than 2 GiB.
TFTP transfer of a 3 GiB file, before (wrong) and after (right):
Loading: ################################################# 16 EiB
Loading: ################################################## 3 GiB
Signed-off-by: Yuya Hamamachi <yuya.hamamachi.sx@renesas.com> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Yuya Hamamachi [Thu, 29 Jan 2026 22:30:18 +0000 (23:30 +0100)]
net: Stop conflating return value with file size in net_loop()
The net_loop() currently conflates return value with file size
at the end of successful transfer, in NETLOOP_SUCCESS state.
The return type of net_loop() is int, which makes this practice
workable for file sizes below 2 GiB, but anything above that will
lead to overflow and bogus negative return value from net_loop().
The return file size is only used by a few sites in the code base,
which can be easily fixed. Change the net_loop() return value to
always be only a return code, in case of error the returned value
is the error code, in case of successful transfer the value is 0
or 1 instead of 0 or net_boot_file_size . This surely always fits
into a signed integer.
By keeping the return code 0 or 1 in case of successful transfer,
no conditionals which depended on the old behavior are broken, but
all the sites had to be inspected and updated accordingly.
Fix the few sites which depend on the file size by making them
directly use the net_boot_file_size variable value. This variable
is accessible to all of those sites already, because they all
include net-common.h .
Signed-off-by: Yuya Hamamachi <yuya.hamamachi.sx@renesas.com> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Tom Rini [Fri, 30 Jan 2026 21:57:22 +0000 (15:57 -0600)]
CI: Update to using grub-2.14 for our tests
When building grub-2.12 with a newer GCC, we run in to warings (treated
as errors). The simple fix here is to move to the latest release tag. In
order to build a newer grub from source we need the autoconf-archive
package to be installed.
Marek Vasut [Wed, 28 Jan 2026 19:40:40 +0000 (20:40 +0100)]
gunzip: Fix len parameter in function signature
The only call site of gzwrite() is cmd/unzip.c do_gzwrite(), where
the 'len' parameter passed to gzwrite(..., len, ...) function is of
type unsigned long. This usage is correct, the 'len' parameter is
an unsigned integer, and the gzwrite() function currently supports
input data 'len' of up to 4 GiB - 1 .
The function signature of gzwrite() function in both include/gzip.h
and lib/gunzip.c does however list 'len' as signed integer, which
is not correct, and ultimatelly limits the implementation to only
2 GiB input data 'len' .
Fix this, update gzwrite() function parameter 'len' data type to
size_t consistently in include/gzip.h and lib/gunzip.c .
Furthermore, update gzwrite() function 'szwritebuf' parameter in
lib/gunzip.c from 'unsigned long' to 'size_t' to be synchronized
with include/gzip.h . Rewrite the other parameters to size_t and
off_t and propagate the change too.
Since the gzwrite() function currently surely only supports input
data size of 4 GiB - 1, add input data size check. The limitation
comes from the current use of zlib z_stream .avail_in parameter,
to which the gzwrite() function sets the entire input data size,
and which is of unsigned int type, which cannot accept any number
beyond 4 GiB - 1. This limitation will be removed in future commit.
Reported-by: Yuya Hamamachi <yuya.hamamachi.sx@renesas.com> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Jamie Gibbons [Tue, 20 Jan 2026 15:33:13 +0000 (15:33 +0000)]
configs: microchip_mpfs_generic: fix boot failure
Recent changes to device resource management (DEVRES) increased early
memory requirements during boot. The previous value was insufficient,
resulting in boot failures. Increase CONFIG_SYS_MALLOC_F_LEN to provide
enough early malloc pool for successful boot and device initialisation.
To reproduce the issue, define LOG_DEBUG in lib/efi_loader/efi_boottime.c
and build u-boot for your platform. Then, boot the U-Boot helloworld.efi
application over the network. Example commands (adjust the URL and boot
entry number):
=> efidebug boot add -u 0 net http://10.0.2.2:8000/helloworld.efi
=> efidebug boot order 0
=> bootefi bootmgr
Fixes: dd5d82a59995 ("efi_loader: efi_net: Add device path cache") Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de> Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org> Cc: Tom Rini <trini@konsulko.com> Cc: Adriano Cordova <adrianox@gmail.com> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Tom Rini [Tue, 3 Feb 2026 19:16:20 +0000 (13:16 -0600)]
doc: develop/process: Clarify name usage in the Signed-off-by line
Long ago we took the Linux Kernel documentation about adding a
Signed-off-by line and adjusted it slightly for how we organized things.
In 2003 Linus clarified the intent and then re-worded what the name
portion of the Signed-off-by line can be. Mirror that change here.
When adding a new EFI Debug Image Info entry, we allocate memory for a new
EFI Debug Image Info Normal structure and we add a new entry into the EFI
Debug Image Info Table, which is in fact just a pointer to the allocated
structure.
However, when allocating memory for the new structure we allocate memory
for the wrong type, leading to allocating memory for just a pointer instead
of the desired structure.
Fix the type used during allocation.
Fixes: 146546138af5 ("efi: add EFI_DEBUG_IMAGE_INFO for debug") Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de> Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org> Cc: Tom Rini <trini@konsulko.com> Cc: Ying-Chun Liu (PaulLiu) <paul.liu@linaro.org> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Pranav Tilak [Mon, 2 Feb 2026 11:37:17 +0000 (17:07 +0530)]
efi_loader: Improve EFI variable load message
Change the EFI variable load message from log_err() to log_info() with
neutral wording. The previous "Failed to load" message caused customer
confusion as it appeared to indicate an error condition.
The efi_var_from_file() function deliberately returns EFI_SUCCESS in
this case to allow the boot process to continue normally. This is
documented in the function's comment block but was not reflected in
the log message level or content.
The message now uses informational wording to reflect that this is
normal behavior when the ubootefi.var file does not yet exist.
Signed-off-by: Pranav Tilak <pranav.vinaytilak@amd.com> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Vincent Stehlé [Tue, 27 Jan 2026 16:18:43 +0000 (17:18 +0100)]
efi_loader: fix use after free in efi_exit() with tcg2
The efi_exit() function frees the loaded image memory by calling
efi_delete_image(). However, when CONFIG_EFI_TCG2_PROTOCOL is enabled, the
image_obj->image_type structure member is accessed after the memory has
been freed.
Fix this by performing the tcg2 measurement before the image deletion.
Fixes: 8fc4e0b4273a ("efi_loader: add boot variable measurement") Suggested-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com> Cc: Heinrich Schuchardt <xypron.glpk@gmx.de> Cc: Tom Rini <trini@konsulko.com> Cc: Masahisa Kojima <kojima.masahisa@socionext.com> Acked-by: Masahisa Kojima <kojima.masahisa@socionext.com> Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
video: menu "TrueType Fonts" depends on TrueType enabled
The Kconfig menu "TrueType Fonts" should only be shown if TrueType is
enabled.
Put all TrueType dependent customization within one if statement.
Remove `depends TRUETYPE` clauses.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Reviewed-by: Tom Rini <trini@konsulko.com> Reviewed-by: Simon Glass <simon.glass@canonical.com>
Tom Rini [Wed, 4 Feb 2026 16:40:37 +0000 (10:40 -0600)]
Merge patch series "arm: k3: j722s: add PCIe support"
George McCollister <george.mccollister@konsulko.com> says:
This patch series brings over several changes from Linux that are required
to get PCIe working on the j722s and also enables PCIe in
j722s_evm_a53_defconfig. This allows Linux to be booted from an NVMe drive.
The J722S SoC provides pcie0 (using pcie_cdns_ti) thru serdes1
(using phy-cadence-torrent) thru serdes_wiz1 (using phy-j721e-wiz). Changes
to the three drivers needed to be ported from Linux to enable the REFCLK
output which is used with this SoC. These changes should be tested on other
platforms using these drivers by those with the hardware available to make
sure no problems were introduced.
The PCIe controller in this SoC relies on the code performing the PCI scan
not scanning devices which cannot exist. In Linux this is implemented as
only_one_child() in probe.c. If this mechanism is not used, PCI config reads
for subsequent functions will return information for device 0 resulting in
U-Boot detecting 32 devices when only 1 is present. This change should be
tested on other platforms with PCI to ensure the same PCI devices are
enumerated before and after the patch is applied.
I would like to thank Opto 22 for sponsoring the initial development and
anyone that is able to contribute to testing of patches.
TI's J722S SoC has one instance of PCIe namely PCIe0 which is a Gen3
single lane PCIe controller. Add support for the "ti,j722s-pcie-host"
compatible specific to J722S SoC.
Based on:
https://lore.kernel.org/all/20240524092349.158443-1-s-vadapalli@ti.com/
Signed-off-by: George McCollister <george.mccollister@konsulko.com> Tested-by: Bryan Brattlof <bb@ti.com>
phy: cadence-torrent: Add support to drive refclk out
cmn_refclk_<p/m> lines in Torrent SERDES are used for connecting an
external reference clock. cmn_refclk_<p/m> can also be configured to
output the reference clock. Model this derived reference clock as a
"clock" so that platforms like AM642 EVM can enable it.
This is used by PCIe to use the same refclk both in local SERDES
and remote device. Add support here to drive refclk out.
Based on: https://lore.kernel.org/all/20210310120840.16447-7-kishon@ti.com/
Signed-off-by: George McCollister <george.mccollister@konsulko.com> Tested-by: Bryan Brattlof <bb@ti.com>
phy: ti: j721e-wiz: Enable reference clock output in cmn_refclk_<p/m>
cmn_refclk_<p/m> lines in Torrent SERDES are used for an connecting
external reference clock. cmn_refclk_<p/m> can also be configured to
output the reference clock. In order to drive the refclk out from the
SERDES (Cadence Torrent), PHY_EN_REFCLK should be set in SERDES_RST of
WIZ. Model PHY_EN_REFCLK as a clock, so that platforms like AM642 EVM
can enable it.
Based on: https://lore.kernel.org/r/20210310120840.16447-6-kishon@ti.com
Signed-off-by: George McCollister <george.mccollister@konsulko.com> Tested-by: Bryan Brattlof <bb@ti.com>
Use the same mechanism as the Linux kernel to skip unnecessary (and in
the case of the J722S, errant) scanning of direct children of root
ports, downstream ports or bridges.
Based on Linux PCI code in the following files as of b927546677c8:
drivers/pci/probe.c
drivers/pci/pci.h
include/linux/pci.h
Signed-off-by: George McCollister <george.mccollister@konsulko.com> Tested-by: Bryan Brattlof <bb@ti.com>
It was noted that a GPT partition with the maximum available partition
number (ex: /dev/mmcblk128) can't be read/write from U-Boot using
read/write commands. Futher investigation shows that the problem is
deeper.
mtdpart internally enumerate partitions starting from zero, but partition
driver API enumerate partitions starting from 1, so wrong partition will
be queried. This is wrong.
Unnecessary debug message also was removed.
Fixes: c29a6daec184 ("disk: support MTD partitions") Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
=> read mmc 0#fip ${loadaddr} 0 4
Could not find "fip" partition
** Bad device specification mmc 0#fip **
** Bad device specification mmc 0#fip **
Couldn't find partition mmc 0#fip
The error is caused by invalid boundary checks. This patch fixes an
issue.
Fixes: 43fd4bcefd4e ("disk: part: implement generic function part_get_info_by_uuid()") Fixes: 56670d6fb83f ("disk: part: use common api to lookup part driver") Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu> Acked-by: Quentin Schulz <quentin.schulz@cherry.de> Reviewed-By: Michael Trimarchi <michael@amarulasolutions.com>
Robert Marko [Mon, 12 Jan 2026 13:12:41 +0000 (14:12 +0100)]
serial: atmel-usart: include arch specific headers only for AT91
Microchip LAN969x will not include any arch specific clk.h nor hardware.h,
so in order to support it only include <asm/arch/clk.h> and
<asm/arch/hardware.h> when AT91 is selected.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Robert Marko [Mon, 12 Jan 2026 13:12:40 +0000 (14:12 +0100)]
dm: platform_data: atmel_serial: fix build warning on 64-bit platforms
Pointer size cannot be assumed to be 32-bit, so use uintptr_t instead of
uint32_t.
Fixes the below build warning on 64-bit builds:
drivers/serial/atmel_usart.c: In function ‘atmel_serial_probe’:
drivers/serial/atmel_usart.c:275:23: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
275 | priv->usart = (atmel_usart3_t *)plat->base_addr;
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Jonas Karlman [Sat, 17 Jan 2026 00:24:42 +0000 (00:24 +0000)]
net: lwip: nfs: Prefer nfsserverip over serverip when set
Prefer use of a 'nfsserverip' env var before falling back to 'serverip'
when using the nfs command. Similar to how the 'tftpserverip' env var
is preferred over 'serverip' by the tftp command.
This also updates the error message to closer match the error message
used by the lwIP tftp command when a server ip is not set.
Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Jonas Karlman [Sat, 17 Jan 2026 00:24:41 +0000 (00:24 +0000)]
net: lwip: dhcp: Save DHCP siaddr field to tftpserverip env var
The DHCP siaddr field contains the IP address of next server to use in
bootstrap. Typically this will be the IP address of a TFTP server or the
IP address of the DHCP server itself.
RFC 2131, 2. Protocol Summary, Page 10:
DHCP clarifies the interpretation of the 'siaddr' field as the
address of the server to use in the next step of the client's
bootstrap process. A DHCP server may return its own address in the
'siaddr' field, if the server is prepared to supply the next
bootstrap service (e.g., delivery of an operating system executable
image). A DHCP server always returns its own address in the 'server
identifier' option.
Set the 'tftpserverip' env variable when the siaddr field contains an
IP address that is different compared to the DHCP server IP address.
Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Jonas Karlman [Sat, 17 Jan 2026 00:24:40 +0000 (00:24 +0000)]
net: lwip: Use ipaddr helpers
The ip_addr_t of lwIP has support for both IPv6 and IPv4 addresses.
Some lwIP commans is directly accessing the internal addr field of the
ip_addr_t instead of using ipaddr helper functions.
Change to use ipaddr helper functions where appropriate to remove direct
access of the internal addr field. Also change a few instances from ip4
to the version less ipaddr helpers.
There is no intended functional change, besides the change from using
ip4 addr helper to using version less ipaddr helper.
Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Jonas Karlman [Sat, 17 Jan 2026 00:24:39 +0000 (00:24 +0000)]
net: lwip: dns: Call env_set() from dns loop instead of found callback
The lwIP dns command handle env_set() calls from the found callback and
printf() to console in the dns loop. Making it more complex than it
needs to be.
Simplify and ensure any environment variable that is being set is the
same value that would have been printed on console.
There should not be any intended change in behavior, besides the change
from using ip4addr helper to using version less ipaddr helper.
Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Jonas Karlman [Sat, 17 Jan 2026 00:24:38 +0000 (00:24 +0000)]
net: lwip: nfs: Print device name based on current udevice
Use udevice name, similar to other lwip commands, instead of using the
legacy eth_get_name() when printing out the device being used.
Fixes: 230cf3bc2776 ("net: lwip: nfs: Port the NFS code to work with lwIP") Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Jonas Karlman [Sat, 17 Jan 2026 00:24:37 +0000 (00:24 +0000)]
net: lwip: dns: Fix print of resolved IP address
The lwIP dns command only prints out cached resolved IP addresses.
When a hostname is first resolved and ERR_INPROGRESS is returned the
dns command prints out 0.0.0.0 instead of the resolved IP address.
Fix this by printing out host_ipaddr instead of the temporary ipaddr
that only is valid when ERR_OK is returned.
Fixes: 1361d9f4f00a ("lwip: dns: do not print IP address when a variable is specified") Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Jonas Karlman [Tue, 6 Jan 2026 20:34:30 +0000 (20:34 +0000)]
net: lwip: add TFTPSERVERIP Kconfig option
With the legacy networking stack, it is possible to use USE_SERVERIP,
SERVERIP and BOOTP_PREFER_SERVERIP Kconfg options to force use of a
specific TFTP server ip.
Using the lwIP networking stack use of the 'tftpserverip' environment
variable provide the closest equivalent functionality.
Add USE_TFTPSERVERIP and TFTPSERVERIP Kconfig options that can be used
to add the 'tftpserverip' environment variable to force use of a
specific TFTP server ip.
Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Acked-by: Jerome Forissier <jerome.forissier@arm.com>
Andrew Goodbody [Wed, 14 Jan 2026 15:12:10 +0000 (15:12 +0000)]
net: lwip: dhcp: Do not write past end of buffer
sprintf will write a trailing \0 at the end of the string so when
writing into a buffer, that buffer must be sized to allow for that
trailing zero. In the DHCP code when the index is a number needing two
digits to express the index would use up the two \0 bytes in the buffer
and the trailing \0 from sprintf would be beyond the end of the
allocation. Fix this by adding a third \0 in the buffer.
This was found by code inspection when looking for an issue reported by
Michal Simek, but I do not have the hardware to reproduce, so cannot
confirm if this addresses that issue or not.
Fixes: 98ad145db61a ("net: lwip: add DHCP support and dhcp commmand") Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
Andrew Goodbody [Wed, 14 Jan 2026 15:12:09 +0000 (15:12 +0000)]
net: lwip: tftp: Do not write past buffer end
sprintf will add a trailing \0 so manually adding a trailing \0 will
result in an extra unaccounted for character being written. This
overwrote the first byte of the following allocation block resulting in
unexpected behavior.
This was found by Running 'pxe get' with no available file resulting in
multiple attempts, using the default algorithm, to attempt to find a file.
Eventually there would be a failed assert when free() was called.
Failing the assert would result in a system reset.
Fixes: 27d7ccda94fa ("net: lwip: tftp: add support of blksize option to client") Reported-by: Michal Simek <michal.simek@amd.com> Tested-by: Michal Simek <michal.simek@amd.com> Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Tested-by: Tom Rini <trini@konsulko.com> # Pine64+ Reviewed-by: Jerome Forissier <jerome.forissier@arm.com> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
This series provides a comprehensive cleanup of the Allwinner (sunxi)
NAND controller drivers and introduces full support for the H6 and H616
SoCs in both the main U-Boot driver and the SPL.
The series successfully deduplicates register maps between sunxi_nand.c
and sunxi_nand_spl.c while migrating to a capability-based architecture.
This approach allows the driver to handle the H616's specific
requirements—such as shifted register offsets for ECC/OOB, the removal
of 512B ECC block support, and mandatory MBUS clock gating—without
breaking compatibility for legacy A10/A23 devices.
Tom Rini [Tue, 3 Feb 2026 21:46:21 +0000 (15:46 -0600)]
Merge patch series "arm: dts: sc5xx: device tree updates and fixes"
Ozan Durgut <ozan.durgut@analog.com> says:
This series introduces updates for Analog Devices SC5xx boards.
It cleans up device trees by renaming GPIO expanders and removing
incorrect SPI flash definitions from the common include file.
For the SC598, this series updates the EZLITE board to the latest
Revision E hardware. It also adds missing GPIO hogs and enables
additional commands for the EZKIT configuration.
Ozan Durgut [Mon, 26 Jan 2026 16:15:04 +0000 (17:15 +0100)]
arm: dts: adi: rename GPIO expanders
The current naming convention for GPIO expanders across ADI SC5xx
device trees is inconsistent. This patch updates the node names to
correct indexing and clarify hardware location.
For SC573, SC584, and SC589 evaluation SBCs, switch to zero-based
indexing to align with standard conventions.
For SC594 and SC598 SoM + carrier evaluation kits, rename the nodes to
crr_gpio_expander. This prefix indicates which board the expander is on.
Philip Molloy [Mon, 26 Jan 2026 16:15:03 +0000 (17:15 +0100)]
arm: dts: sc5xx: drop SPI flash from common dtsi
SPI flash devices are not common across all SC5xx boards. They
already defined in the SoM-specific dtsi files. Keeping the
definition in the common dtsi is therefore incorrect.
Fixes: c9e893d ("board: adi: Add support for SC598") Signed-off-by: Philip Molloy <philip.molloy@analog.com> Signed-off-by: Ozan Durgut <ozan.durgut@analog.com> Reviewed-by: Greg Malysa <malysagreg@gmail.com>
Tom Rini [Tue, 3 Feb 2026 21:45:09 +0000 (15:45 -0600)]
Merge patch series "toradex: aquila-am69: fix SPL USB DFU, drop obsolete clock"
Ernest Van Hoecke <ernest.vanhoecke@toradex.com> says:
This is a small, board-specific series for Aquila AM69.
Patch 1 fixes intermittent SPL USB DFU gadget enumeration.
Patch 2 drops a stale MCU_CLKOUT0 enable for ETH_1. V1.1 hardware uses
an external 25 MHz crystal, and support for earlier revisions was
already removed from the DT before upstreaming.
On the Toradex Aquila AM69 V1.1, the on-module ETH_1 relies on an
external 25 MHz crystal oscillator. On the V1.0, we needed to enable
MCU_CLKOUT0, but support for this was already dropped from the device
tree before being sent to U-Boot.
Remove this obsolete enabling of MCU_CLKOUT0.
Fixes: 3f0528882c0d ("board: toradex: add aquila am69 support") Signed-off-by: Ernest Van Hoecke <ernest.vanhoecke@toradex.com> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
arm: dts: k3-am69-aquila: Fix SPL USB DFU gadget failures
Around 1 in 20 times, the current R5 SPL fails to pull up the D+ line to
signal that a new USB device (the USB gadget used for downloading the
next stage) joined the bus.
With these strapping options, this is greatly reduced to 1 in thousands.
Richard Genoud [Fri, 23 Jan 2026 11:45:01 +0000 (12:45 +0100)]
tools: sunxi-spl-image-builder: support H6/H616 NAND boot
The H6/H616 boot ROM doesn't expect a SPL scrambled the same way as
older SoCs.
It doesn't use a specific seeds table, it expects a maximized ECC
(BCH-80), a specific BBM (FF000301) and doesn't work if empty pages are
skipped (it needs its specific BBM, even in the padding).
So, add a --soc=h6 option to support H6/616 with:
- more ECC strengths
- specific BBM
- default_scrambler_seeds[] with all values
- no empty pages skip
In Kconfig, select BCH-80 by default for SUNXI_SPL_ECC_STRENGTH to make
BROM happy.
And in scripts/Makefile.xpl, use --soc=h6 option when building for a
SUN50I_GEN_H6 SoC.
Tested on Whatsminer H616 board, booting from NAND.
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> Co-developed-by: James Hilliard <james.hilliard1@gmail.com> Signed-off-by: James Hilliard <james.hilliard1@gmail.com> Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Richard Genoud [Fri, 23 Jan 2026 11:44:59 +0000 (12:44 +0100)]
mtd: rawnand: sunxi_spl: Fix cast to pointer from integer warnings
Fix a cast to pointer from integer warning on ARM64
On 64bits platform, the casts done in {read,write}l() give that kind of
warnings:
drivers/mtd/nand/raw/sunxi_nand_spl.c: In function ‘check_value_inner’:
./arch/arm/include/asm/io.h:110:43: warning: cast to pointer from \
integer of different size [-Wint-to-pointer-cast]
110 | #define __raw_readl(a) (*(volatile unsigned int *)(a))
| ^
[...]
drivers/mtd/nand/raw/sunxi_nand_spl.c:81:27: note: in expansion of \
macro ‘readl’
81 | int val = readl(offset) & expected_bits;
Introduce {read,write}l_nfc inline function to do the right cast and
push the base address (SUNXI_NFC_BASE) into those functions, making the
code more readable.
Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Richard Genoud [Fri, 23 Jan 2026 11:44:58 +0000 (12:44 +0100)]
mtd: rawnand: sunxi_spl: add support for H6/H616 nand controller
Introduce H6/H616 NAND controller support for SPL
The H616 NAND controller has the same base as A10/A23, with some
differences:
- MDMA is based on chained buffers
- its ECC supports up to 80bit per 1024bytes
- some registers layouts are a bit different, mainly due do the stronger
ECC.
- it uses USER_DATA_LEN registers along USER_DATA registers.
- it needs a specific clock for ECC and MBUS.
For SPL, most of the work was setting the clocks, adding the new
capability structure for H616 and supporting the new USER_DATA_LEN
registers.
Tested on Whatsminer H616 board (with and without scrambling, ECC)
Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Richard Genoud [Fri, 23 Jan 2026 11:44:57 +0000 (12:44 +0100)]
mtd: rawnand: sunxi: add support for H6/H616 nand controller
Introduce H6/H616 NAND controller support for U-Boot
The H616 NAND controller has the same base as A10/A23, with some
differences:
- MDMA is based on chained buffers
- its ECC supports up to 80bit per 1024bytes
- some registers layouts are a bit different, mainly due do the stronger
ECC.
- it uses USER_DATA_LEN registers along USER_DATA registers.
- it needs a specific clock for ECC and MBUS.
Introduce the basic support, with ECC and scrambling, but without
DMA/MDMA.
Tested on Whatsminer H616 board (with and without scrambling, ECC)
Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
The NAND controller on H6/H616 uses one clock for its internal logic
(NAND0_CLK) and one clock for ECC engine (NAND1_CLK) in addition to AHB
and MBUS clocks.
As NAND{0,1}_CLKs and MBUS_GATE are missing, add them.
The bit locations are from H616/H6 User Manual.
Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Richard Genoud [Fri, 23 Jan 2026 11:44:53 +0000 (12:44 +0100)]
mtd: rawnand: sunxi_spl: increase max_oobsize for 2KiB pages
Increase max_oobsize to take into account bigger OOB on 2KiB pages
Some NAND chip (e.g. Kioxia TC58NVG1S3HTA00) have a 2KiB page size +
128 bytes OOB.
In order to detect them, the max_oobsize has to be increased from 64 to
128 bytes.
Tested on Kioxia TC58NVG1S3HTA00 NAND chip on Whatsminer H616 board.
Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Richard Genoud [Fri, 23 Jan 2026 11:44:52 +0000 (12:44 +0100)]
mtd: rawnand: sunxi_spl: use NFC_ECC_ERR_MSK and NFC_ECC_PAT_FOUND
Use defines instead of hardcoded values for NFC_ECC_{ERR_MSK,PAT_FOUND}
SPL is using hard coded values for ECC error detection and empty chunk
detection.
The H6/H616 registers for that have changed, the pattern found is no
more in the NFC_REG_ECC_ST register.
So, don't presume anymore that pattern_found is in NFC_REG_ECC_ST, and
read the pattern_found register to get this information.
Apart from an additional register reading, no functional change.
Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
The H616 controller can't handle 512 bytes ECC block size. The
NFC_ECC_BLOCK_512 bit disappeared in H6, and NDFC_RANDOM_EN took its
place.
So, add has_ecc_block_512 capability to only set this bit on SoC having
it.
On the way, let's drop NFC_ECC_BLOCK_SIZE_MSK which was just a mask for
the very same bit.
No functional change.
Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Richard Genoud [Fri, 23 Jan 2026 11:44:45 +0000 (12:44 +0100)]
mtd: rawnand: sunxi: move ECC_PAT_FOUND register in SoC caps
Move ECC_PAT_FOUND register in SoC capabilities structure
This register offset moved in H616, it's now its own register (@0x3c,
bits 0-31), not shared with NFC_ECC_ST any more (was @0x38 bits 16-31).
Push that specificity in caps structure.
Reviewed-by: Andre Przywara <andre.przywara@arm.com> Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Richard Genoud [Fri, 23 Jan 2026 11:44:44 +0000 (12:44 +0100)]
mtd: rawnand: sunxi: move USER_DATA register offset in SoC caps
USER_DATA register offset moved in H616, so let's make it a SoC cap
Reviewed-by: Andre Przywara <andre.przywara@arm.com> Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
projects / thirdparty / u-boot.git / log
