u-boot.git/common, branch next

Merge tag 'u-boot-dfu-next-20260819' of https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu into next

2026-08-20T19:37:09Z

CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu/-/pipelines/1016 u-boot-dfu-next-20260819 Android: * avb: Make the AVB root key source pluggable * avb: Add OP-TEE root key digest provider * avb: Add board-specific root key provider * avb: Update docs for root key source

spl: fit: Fill in the image descriptor when skipping a zero-size image

2026-08-13T21:02:57Z

load_simple_fit() is expected to fill in the image_info structure it receives upon successful return, but the path which skips a zero-sized image returns success without touching it. The result is that spl_fit_record_loadable() then publishes whatever else the descriptor happened to hold in /fit-images under the skipped image's name: the size and entry point of the previous loadable, or - for the first one, since image_info is declared without an initialiser - uninitialised stack. This is reachable whenever a FIT carries an image node with no content, which binman produces for an optional blob that was not supplied, such as an OP-TEE which the build did not provide. Ensure that the image_info structure is filled in with a size and entry point before returning, same way as other successful paths do (but skipping the actual load). Fixes: 6d99f866952b ("spl: fit: Skip attempting to load 0 length image") Signed-off-by: Alexey Charkov Reviewed-by: Simon Glass

board_f: Make printing reset information optional

2026-08-13T21:02:01Z

Current code tries to print information about the reset method whenever sysreset support is enabled. This causes the core to try to bind the sysreset device in board_init_f, even if the driver doesn't support reset status reporting, causing pure waste on some platforms (e.g. on Rockchip RK3576 it increases the boot time by ~0.4s even though the driver doesn't support reset status reporting). Make the printing of reset information optional, so that it can be enabled only on platforms where it is supported and useful. Only four sysreset drivers actually implement the get_status() op, so default the new symbol to y wherever one of them can be in use to avoid regressing those platforms: - sysreset_sandbox - sysreset_mpc83xx - sysreset_psci, whose weak stub get_status() is only overridden by i.MX9; - the pca9450 PMIC sysreset child driver. Signed-off-by: Alexey Charkov

avb: add board-specific root key provider

2026-08-12T07:44:24Z

The strongest anchor for the root of trust is a key hash burned into hardware (OTP/eFuse), which is inherently SoC-specific and cannot live in common code. Give boards a hook to supply it from wherever their hardware keeps it. The default is deliberately fail-closed: a board that has not wired up a provider refuses verification rather than silently trusting whatever key it is handed. A misconfiguration should stop the boot, not quietly weaken it. Signed-off-by: Igor Opaniuk Reviewed-by: Mattijs Korpershoek Link: https://patch.msgid.link/20260727-avb-root-key-pluggable-v1-3-7e27b2b92cc0@gmail.com Signed-off-by: Mattijs Korpershoek

avb: add OP-TEE root key digest provider

2026-08-12T07:44:24Z

When a device already runs OP-TEE, its root-of-trust key should live in the same secure, RPMB-backed storage that already holds the AVB rollback indexes and lock state, so it is provisioned per device and protected by the secure world -- not shipped inside the bootloader image. Let AVB fetch the trusted digest from the OP-TEE AVB TA. It reuses the existing persistent-value interface, so no change to the TA is required, and a missing value fails closed. Signed-off-by: Igor Opaniuk Reviewed-by: Mattijs Korpershoek Link: https://patch.msgid.link/20260727-avb-root-key-pluggable-v1-2-7e27b2b92cc0@gmail.com Signed-off-by: Mattijs Korpershoek

avb: make the AVB root key source pluggable

2026-08-12T07:44:24Z

AVB's whole chain of trust reduces to a single public key, and that key is currently hard-coded in U-Boot as the AVB reference/test key, whose private half is public. That is fine for bring-up but unusable for a locked product, which must anchor its root of trust in something an attacker cannot swap out -- a hash fused into the SoC, a secure element -- rather than a blob compiled into the bootloader. Make the source of the trusted key digest selectable so a board can decide where its root of trust lives, without touching the verification logic and with any lookup failure treated as untrusted. The built-in key remains the default, so existing users are unaffected; the sources a production device actually needs are added in the following patches. Signed-off-by: Igor Opaniuk Reviewed-by: Mattijs Korpershoek Link: https://patch.msgid.link/20260727-avb-root-key-pluggable-v1-1-7e27b2b92cc0@gmail.com Signed-off-by: Mattijs Korpershoek

Merge patch "Fix negation on modern hush shell"

2026-08-11T18:36:22Z

Anshul Dalal says: This patch series fixes the negation on modern hush shell and adds a sandbox test for the same. Link: https://lore.kernel.org/r/20260728-negation_fix-v1-0-c8021b2b74c0@ti.com

cli: hush_modern: fix negation during run_pipe

2026-08-11T18:35:43Z

The negation rule was not being applied when run_pipe was executed leading to '! command' not actually negating the return code when using modern shell. => cli set modern => ! false => echo $? Reported-by: Rasmus Villemoes Closes: https://lore.kernel.org/u-boot/878qbyr2wg.fsf@prevas.dk/ Signed-off-by: Anshul Dalal

Merge branch 'qcom-next' of https://git.u-boot-project.org/u-boot/custodians/u-boot-snapdragon into next

2026-08-11T16:34:48Z

* Support for building mbn files during the build with the new mkmbn tool. * Remove UCLASS_SMEM and the old smem driver (Qualcomm was the only user of both), replace it with a port of the Linux SMEM driver. * Refactor memory map parsing and support reading the memory layout from the SMEM database. * Set the serial# from SMEM. * Introduce initial support for SPL in mach-snapdragon. * Add a defconfig for sm8650 with U-Boot as the primary bootloader. * Workaround an MMC issue by limiting the transfer size. * Add support for SM7125/SC7180 (clock/pinctrl drivers and UFS phy). * Add support for the QCS6490 powered Rubik Pi 3 board and document it.

board_f: Call initf_malloc() before fdtdec_setup()

2026-08-10T20:48:11Z

In case MULTI_DTB_FIT_GZIP is enabled, fdtdec_setup() does uncompress the compressed DTs in uncompress_blob() using gunzip(), which invokes malloc() internally. The early simple malloc is initialized in board_f initf_malloc() call, which sets up the early simple malloc limit and offset pointer in global data. Currently, the initf_malloc() is called after fdtdec_setup(), which leads to malloc failure in fdtdec_setup() during the gzip decompression, because the early simple malloc is not initialized yet. Call initf_malloc() before fdtdec_setup() to assure fdtdec_setup() can use malloc() during gzip decompression of the DTs. The impact of this change on boot time is negligible, because the initf_malloc() only assigns two fields in global data. Signed-off-by: Marek Vasut Fixes: 95f4bbd581cf ("lib: fdt: Allow LZO and GZIP DT compression in U-Boot") Reviewed-by: Simon Glass [trini: Update test/py/tests/test_trace.py] Signed-off-by: Tom Rini