u-boot/u-boot.git, branch main

Prepare v2026.10-rc4

2026-09-07T20:08:25+00:00

Signed-off-by: Tom Rini

arm: mvebu: armada8k: do not offer the ATF/TEE region as free memory

2026-09-07T16:33:19+00:00

mvebu_mem_map[] deliberately leaves the ATF and TEE region unmapped: { /* RAM 0-64MB */ .phys = 0x0UL, .size = ATF_REGION_START, ... }, /* ATF and TEE region 0x4000000-0x5400000 not mapped */ { /* RAM 66MB-2GB */ .phys = ATF_REGION_END, ... }, Nothing tells LMB about the hole, so the whole of DRAM bank 0 is added as available memory (sizes elided from the dumps below for width): lmb_dump_all: memory.count = 0x2 memory[0] [0x0-0xbfffffff], flags: none memory[1] [0x100000000-0x43fffffff], flags: none reserved.count = 0x4 reserved[0] [0x4000000-0x41fffff], flags: no-map reserved[1] [0x7eb1d000-0x7eb1ffff], flags: no-notify, no-overwrite reserved[2] [0x7eb20f40-0xbfffffff], flags: no-overwrite reserved[3] [0x100000000-0x43fffffff], flags: no-overwrite The only part of the hole that is reserved is the 2 MiB psci-area from armada-ap80x.dtsi. The remaining 18 MiB is allocatable, and since lmb_add() notifies the EFI allocator, it is also published to EFI payloads as EFI_CONVENTIONAL_MEMORY. Any access to it faults: => md 0x4200000 4 "Synchronous Abort" handler, esr 0x96000006, far 0x4200000 Resetting CPU ... ESR 0x96000006 is a data abort at the current exception level with DFSC 0x06, a level 2 translation fault - there is no mapping, which is exactly what mvebu_mem_map[] intends. The same abort with WnR set (esr 0x96000046) is what MemTest86 v11 for ARM64 hits on its first write, because the EFI memory map it is handed says: 0x000004000000 - 0x0000041FFFFF (2MB) {Reserved Memory} 0x000004200000 - 0x000006FFFFFF (46MB) {Free Memory} Add an lmb_arch_add_memory() for Armada 8k that adds each DRAM bank around the ATF and TEE region instead of over it, and select LMB_ARCH_MEM_MAP for ARMADA_8K. The hook replaces the generic lmb_add_memory() rather than extending it, so it also has to reproduce the LMB_LIMIT_DMA_BELOW_RAM_TOP reservation above gd->ram_top; both are needed on this SoC, which maps only the first 2 GiB of DRAM. After the change: lmb_dump_all: memory.count = 0x3 memory[0] [0x0-0x3ffffff], flags: none memory[1] [0x5400000-0xbfffffff], flags: none memory[2] [0x100000000-0x43fffffff], flags: none reserved.count = 0x3 reserved[0] [0x7eb1d000-0x7eb1ffff], flags: no-notify, no-overwrite reserved[1] [0x7eb20f40-0xbfffffff], flags: no-overwrite reserved[2] [0x100000000-0x43fffffff], flags: no-overwrite => md 0x4200000 4 "Synchronous Abort" handler, esr 0x96000006, far 0x4200000 => md 0x5400000 4 05400000: 00000000 ffffffff 00000000 ffdfffff ................ and MemTest86 completes passes instead of aborting. Note the psci-area reservation disappears from the dump: the region is no longer part of the LMB memory map, so boot_fdt_reserve_region() gets -EINVAL back from lmb_alloc_mem() and skips it. That is harmless - the memory is not allocatable either way - but it is a visible change in "bdinfo" output. board_get_usable_ram_top() already clamps gd->ram_top to the 2 GiB that mvebu_mem_map[] maps, for the same underlying reason. A ram_top limit cannot express a hole in the middle of a bank, hence this patch. Tested on a SolidRun MACCHIATObin (Armada 8040) with 16 GiB of DRAM. Signed-off-by: Bruno Banelli

Merge tag 'efi-2026-10-rc4-2' of https://git.u-boot-project.org/u-boot/custodians/u-boot-efi

2026-09-07T16:33:19+00:00

Pull request efi-2026-10-rc4-2 CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-efi/-/pipelines/1198 Documentation: * board: ti: am64x: add missing debugging section * board: ti: correct path to tcl scripts * regenerate u-boot-stats-v2026.07: Regenerate UEFI * Consider type of platform_get_rng_device() return value * Remove duplicate function declarations

Merge tag 'fsl-qoriq-for-2026.10-rc4' of https://git.u-boot-project.org/u-boot/custodians/u-boot-fsl-qoriq

2026-09-07T16:33:19+00:00

CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-fsl-qoriq/-/jobs/84506 - Various config fixes for Layerscape/QorIQ boards - Fix fsl_dspi by adding missed Layerscape compatible - Fix ldpaa_eth inverted error logic - Extend mpq8785 for MPQ8646

configs: ls104{3,6}aqds_tfa: enable PCIe Ethernet

2026-09-07T16:33:19+00:00

These boards are typically fitted with an Intel PCIe network card. Since commit cd9b71c3f629 ("layerscape: Disable CONFIG_FMAN_ENET on *aqds* platforms") which disabled on-chip DPAA networking, we can now set CONFIG_DM_ETH for the Intel driver. We also need to enable PCI bus enumeration during init, to actually make use of the DM_ETH driver. Signed-off-by: Vladimir Oltean Reviewed-by: Vincent Jardin Signed-off-by: Peng Fan

common: kconfig: raise SYS_CBSIZE default to 1024 for FSL_LSCH2/LSCH3

2026-09-07T16:33:19+00:00

The 512-byte console input buffer limit for Layerscape SoCs originates from copy-pasted boilerplate in the original LS2085A board support added in commit f749db3a75ec ("ARMv8/ls2085a_emu: Add LS2085A emulator and simulator board support"). No rationale was given for the 512-byte choice; every subsequent FSL_LSCH2 and FSL_LSCH3 common header (ls1043a, ls1046a, ls1088a, lx2160a, ...) inherited it by convention. When CONFIG_SYS_CBSIZE was moved to Kconfig in commit d31466b382dd ("Convert CONFIG_SYS_CBSIZE to Kconfig"), the existing 512-byte values were transcribed mechanically into Kconfig defaults, cementing the limit without re-examining its validity. The practical consequence is that environment variables holding multi-step boot scripts are silently truncated at 510 usable characters on all Layerscape boards, making it impossible to store commands such as combined TFTP+flash sequences in a single variable. The same problem was already identified and fixed for i.MX6 and i.MX7 in commit f7b237b81e5a ("MLK-24380 imx6: Enlarge the console I/O buffer to 1024"), whose commit message states: "we have some env variables with long script string and exceed the 512". FSL_LSCH2 and FSL_LSCH3 were not included in that fix. Remove FSL_LSCH2 and FSL_LSCH3 from the 512-byte special case, letting them fall through to the generic default of 1024. This is consistent with the i.MX6/MX7 precedent and with the majority of other architectures. Boards that need a larger buffer can still override CONFIG_SYS_CBSIZE in their defconfig. The Layerscape defconfigs carrying the now-stale CONFIG_SYS_PBSIZE=532 override were already cleaned up in commit 82d725c31cbd ("configs: layerscape: drop CONFIG_SYS_PBSIZE=532 override"). Signed-off-by: Vladimir Oltean Reviewed-by: Vincent Jardin Signed-off-by: Peng Fan

configs: layerscape: drop CONFIG_SYS_PBSIZE=532 override

2026-09-07T16:33:19+00:00

All Layerscape defconfigs (FSL_LSCH2 and FSL_LSCH3) carry an explicit CONFIG_SYS_PBSIZE=532, which was set to match the 512-byte SYS_CBSIZE default that applies to those SoCs (512 + 20 bytes of prompt headroom = 532). The Kconfig default for SYS_PBSIZE is 1044, which corresponds to the generic 1024-byte SYS_CBSIZE default. The per-board override of 532 was only necessary because the FSL_LSCH2/LSCH3 CBSIZE default was lower than the generic one. Drop the explicit CONFIG_SYS_PBSIZE=532 from all 40 affected Layerscape defconfigs in preparation for removing FSL_LSCH2 and FSL_LSCH3 from the 512-byte SYS_CBSIZE special case. After this commit SYS_PBSIZE will be 1044 (the Kconfig default), which matches the upcoming 1024-byte CBSIZE. Signed-off-by: Vladimir Oltean Reviewed-by: Vincent Jardin Signed-off-by: Peng Fan

configs: layerscape qds: enable OF_LIBFDT_OVERLAY

2026-09-07T16:33:19+00:00

The QorIQ Development System (QDS) boards are highly reconfigurable, and it is desirable to be able to run 'fdt apply' from environment scripts to apply various DTB overlays. Signed-off-by: Vladimir Oltean Reviewed-by: Vincent Jardin Signed-off-by: Peng Fan

configs: ls2088aqds_tfa: fix NOR flash write failure

2026-09-07T16:33:19+00:00

saveenv fails on the LS2088A-QDS board with: Flash buffer write timeout at address 580500000 data fffffffffec6fec6 The NOR flash (Spansion S29GL01GT) is connected to the IFC as a 16-bit device, as reflected by the CSPR_PORT_SIZE_16 setting in the board configuration. However, CONFIG_SYS_FLASH_CFI_WIDTH is not set, so the CFI probe loop starts at portwidth=1 (8-bit) and stops as soon as it finds a valid CFI QRY signature, which it does at portwidth=1 because the S29GL01GT supports x8 mode and the IFC byte-lane routing makes the 8-bit probe succeed first. As a result, flinfo reports "(8 x 8)" instead of the correct "(16 x 16)". With the wrong port width, all flash commands - unlock sequences, buffer write, write confirm - are issued to incorrect byte addresses. The AMD/Spansion chip rejects the malformed write command sequence by toggling DQ6 indefinitely, which the cfi_flash driver reports as a buffer write timeout. Commit 53879b17382f ("cfi_flash: Fix detection of 8-bit bus flash devices via address shift") introduced the address-shift probing logic that causes the 8-bit probe to match before the correct 16-bit one. An identical fix to this one was applied to the ls2088ardb platform in commit ed56fda586fc ("config: ls2088ardb: Add config CONFIG_SYS_FLASH_CFI_WIDTH"), but it was not realized that it should apply to ls2088aqds as well. Set CONFIG_SYS_FLASH_CFI_WIDTH_16BIT to force the CFI probe to start at the correct 16-bit port width. Fixes: 53879b17382f ("cfi_flash: Fix detection of 8-bit bus flash devices via address shift") Signed-off-by: Vladimir Oltean Reviewed-by: Vincent Jardin Signed-off-by: Peng Fan

configs: layerscape qds: disable ENV_RELOC_GD_ENV_ADDR for NOR boot

2026-09-07T16:32:52+00:00

CONFIG_ENV_RELOC_GD_ENV_ADDR causes gd->env_addr to be adjusted by the relocation offset at the start of board_r init: gd->env_addr += gd->reloc_off; On QDS boards with CONFIG_ENV_IS_IN_FLASH=y the environment driver (env/flash.c) sets env_addr to CONFIG_ENV_ADDR, a fixed memory-mapped NOR flash address (0x580500000 on LS2088A-QDS). That address is a hardware constant and must not be adjusted. Applying the relocation offset corrupts it to an unmapped address (e.g. 0x5fa1fb004). The first call to env_get() after relocation passes this corrupted address to env_get_from_linear(), which then issues an AXI read from the bogus address. The bus returns a SLVERR, which the CPU core buffers as an asynchronous SError and delivers on the next function epilogue, producing: "Error" handler, esr 0xbf000000 elr: 00000000fbd68068 lr : 00000000fbd68040 ... Resetting CPU ... ESR 0xbf000000 decodes as EC=0x2F (SError), IDS=1 (implementation- defined syndrome), consistent with a Cortex-A72 external abort. Disable the option for the four QDS TFA defconfigs that combine CONFIG_ENV_RELOC_GD_ENV_ADDR=y with CONFIG_ENV_IS_IN_FLASH=y: ls1043aqds_tfa, ls1046aqds_tfa, ls1088aqds_tfa, and ls2088aqds_tfa. The remaining Layerscape defconfigs that carry RELOC_GD_ENV_ADDR use SPI_FLASH, MMC, or NAND storage, none of which use a memory-mapped CONFIG_ENV_ADDR, so they are unaffected. Since commit 123682c7651d ("env: Rename SYS_RELOC_GD_ENV_ADDR to ENV_RELOC_GD_ENV_ADDR"), the Kconfig option has been renamed, so splitting the change for each board is slightly pointless (it can't be backported as one to individual configs). Fixes: c43a4f827691 ("configs: nxp: Enable CONFIG_SYS_RELOC_GD_ENV_ADDR") Fixes: effcb1ebe44a ("configs: ls1088a: Enable CONFIG_SYS_RELOC_ENV_ADDR") Fixes: 5e736c9397e5 ("configs: ls1046aqds: Configure environment related configs") Fixes: b42f71732320 ("configs: ls1043aqds: Configure environment related configs") Signed-off-by: Vladimir Oltean Reviewed-by: Vincent Jardin Signed-off-by: Peng Fan