u-boot.git/common, branch main

board_f: Call initf_malloc() before fdtdec_setup()

2026-08-10T20:48:11Z

In case MULTI_DTB_FIT_GZIP is enabled, fdtdec_setup() does uncompress the compressed DTs in uncompress_blob() using gunzip(), which invokes malloc() internally. The early simple malloc is initialized in board_f initf_malloc() call, which sets up the early simple malloc limit and offset pointer in global data. Currently, the initf_malloc() is called after fdtdec_setup(), which leads to malloc failure in fdtdec_setup() during the gzip decompression, because the early simple malloc is not initialized yet. Call initf_malloc() before fdtdec_setup() to assure fdtdec_setup() can use malloc() during gzip decompression of the DTs. The impact of this change on boot time is negligible, because the initf_malloc() only assigns two fields in global data. Signed-off-by: Marek Vasut Fixes: 95f4bbd581cf ("lib: fdt: Allow LZO and GZIP DT compression in U-Boot") Reviewed-by: Simon Glass [trini: Update test/py/tests/test_trace.py] Signed-off-by: Tom Rini

cyclic: return early from cyclic_run() if the list is empty

2026-08-03T13:00:33Z

It is possible that schedule(), and hence cyclic_run(), gets called very early, perhaps even from assembly code. With commit 9c1b13b3fd27 ("cyclic: reduce get_timer_us() calls inside hlist_for_each_entry_safe()"), there is now an unconditional get_timer_us(0) done outside the loop, and depending on the platform, the timer infrastructure may not be set up yet. In at least one case, that has caused a divide-by-0 and hence a failure to boot. Platforms should really ensure their timers are ready ASAP, and in the concrete case reported, that was indeed possible to fix that way. However, it doesn't hurt to also insert an early return here, and that could prevent other such hard-to-debug boot failures. Reported-by: Emanuele Ghidoli Link: https://marc.info/?l=u-boot&m=178481834846283&w=2 Fixes: 9c1b13b3fd27 ("cyclic: reduce get_timer_us() calls inside hlist_for_each_entry_safe()") Signed-off-by: Rasmus Villemoes Reviewed-by: Emanuele Ghidoli Reviewed-by: Stefan Roese [sr: fix Fixes: tag SHA length and return statement indentation]

cyclic: get rid of cyclic_get_list() helper

2026-08-03T12:46:51Z

As the comment indicates, this was used to silence a warning without having to add casts everywhere gd->cyclic_list was referenced. But nowadays gd is not volatile qualified, so this helper is not needed and only obfuscates the code somewhat, because the head of the list being operated on with the hlist_ or list_ macros is usually not obtained via a function call. Remove the helper and refer to the list head using the idiomatic &gd->cyclic_list. Signed-off-by: Rasmus Villemoes Reviewed-by: Stefan Roese

crypto: hash: use DM providers from hash command

2026-07-29T20:53:46Z

The hash command currently always uses the software implementation for the selected algorithm, even when driver-model hash providers are available. Add a hash_digest_wd_lookup() helper which probes UCLASS_HASH devices in order and uses the first provider supporting the requested algorithm. Continue past unavailable providers and unsupported operations, but propagate a hard digest failure once a provider accepts the operation. Remember probe failures so they are not silently hidden by software fallback when no later provider succeeds. Use the helper from the hash command and retain its software fallback when no usable provider is present. Add sandbox tests covering provider fallback and hard-error propagation. Signed-off-by: James Hilliard

spl: atf: fix BL32 entry point for multi-segment TEE images

2026-07-29T20:52:23Z

binman's split-elf operation records one FIT image node per ELF segment, all with os = "tee", and only the segment containing the ELF entry point carries an entry property. Since fdt_add_subnode() inserts new subnodes in front of existing ones, the /fit-images nodes end up in reverse recording order, so spl_fit_images_find() would return the *last* TEE segment and its load address was passed to BL31 as the BL32 entry point. On RK3588 with an OP-TEE tee.elf consisting of two PT_LOAD segments this made BL31 (SPD=opteed) ERET into OP-TEE's data segment at 0x30200000 instead of the entry point at 0x30000000, hanging the boot right after 'BL31: Initializing BL32'. Prefer the FIT image node which provides an entry property and only fall back to the first matching node when none of them has one. Signed-off-by: Daniel Golle

avb: free mmc_part allocated by get_partition()

2026-07-24T12:43:24Z

get_partition() returns a malloc()'d struct mmc_part and only frees it on its own internal error path. None of its callers - mmc_byte_io(), get_unique_guid_for_partition() and get_size_of_partition() - free the returned pointer, so every partition access leaks one struct mmc_part. A single "avb verify" issues many such accesses (footer, vbmeta and the hashed image chunks), so the leak accumulates quickly. Free the descriptor in all three callers. mmc_byte_io() is reworked to use a single exit path so the partition is released on every return. Fixes: 3af30e4443aa ("avb2.0: implement AVB ops") Signed-off-by: Igor Opaniuk Reviewed-by: Mattijs Korpershoek Link: https://patch.msgid.link/20260712-avb-fix-memory-leaks-v1-2-51d6d5a42631@gmail.com Signed-off-by: Mattijs Korpershoek

spl: fit: bound the external data size before reading it

2026-07-21T19:50:54Z

load_simple_fit() loads an image stored as external data by reading it from the boot device with a transfer sized from the FIT data-size property. That property is listed in exc_prop[] in image-fit-sig.c, so it is excluded from the configuration signature and stays under the control of anyone able to modify the boot medium even when CONFIG_SPL_FIT_SIGNATURE is enabled. The read happens before fit_image_verify_with_data() checks the image hash, so an inflated data-size overruns the destination before the corruption can be detected. The device-tree overlay path is the sharpest case, because there the destination is a fixed CONFIG_SPL_LOAD_FIT_APPLY_OVERLAY_BUF_SZ heap buffer. Pass the size of the destination into load_simple_fit() and reject an image whose data does not fit before the read is issued. The check is done in two places: an early bail on len > max_size, then a bail on the block-aligned size > max_size. The size check is the mathematically binding one because size is len rounded up to the device block length. The early bail exists so that get_aligned_image_size() never runs on a hostile len, where its int arithmetic would invoke signed-integer overflow. For the overlay path the bound is exact: the caller passes the size of its temporary buffer. For the firmware, loadables, FDT and FPGA call sites the destination is wherever the load_addr field points, with no defined upper limit at the call site. Those callers pass CONFIG_SYS_BOOTM_LEN as a conservative ceiling, matching the same limit spl_parse_legacy_validate() already applies to legacy images. It is not a tight bound on the actual capacity at the destination, just a cap that rejects implausibly-sized data. Signed-off-by: Aristo Chen Reviewed-by: Simon Glass

bloblist: Rename GD_FLG_BLOBLIST_READY to GD_FLG_BLOBLIST_HANDOFF

2026-07-17T20:50:28Z

Now that we have made bloblist have distinct "find" and "create" functions, the global data tag "GD_FLG_BLOBLIST_READY" doesn't quite make sense anymore. Rename it to GD_FLG_BLOBLIST_HANDOFF. Suggested-by: Raymond Mao Reviewed-by: Raymond Mao Signed-off-by: Tom Rini

Merge patch series "cyclic: update and optimization"

2026-07-16T22:11:24Z

Patrice Chotard says: First patch is replacing uint64_t by u64 as suggested by b4 Second patch optimizes cyclic_run() to parse cyclic list only if a cyclic function's timestamp is elapsed. Link: https://lore.kernel.org/r/20260706-optimize_cyclic_run-v3-0-06ecbd74ef7c@foss.st.com

cyclic: reduce get_timer_us() calls inside hlist_for_each_entry_safe()

2026-07-16T22:11:19Z

On STM32MP157C-DK2, when using the "ums" command, in sleep_thread(), ctrlc() is called every ~640ms which doesn't allows high reactivity when user press CTRL+C in U-Boot console. In sleep_thread() loop, ctrlc() is called every 200000 iterations. But schedule is called on each loop iteration. Optimize cyclic_run() in order to not call get_timer_us() on each entry. This allow to save computation time : _ before : ctrlc() is called every ~640ms _ after : ctrlc() is called every ~230ms Signed-off-by: Rasmus Villemoes Signed-off-by: Patrice Chotard Cc: Marek Vasut