Merge tag 'efi-2026-07-rc6' of https://source.denx.de/u-boot/custodians/u-boot-efiHEADmaster

Pull request efi-2026-07-rc6

CI: https://source.denx.de/u-boot/custodians/u-boot-efi/-/pipelines/30505

Documentation:

* bootdev: fix typos
* board: renesas: Document Renesas RZ/N1D and RZ/N1S as arm
* board: renesas: Document Renesas Geist board support
* board: renesas: Document Renesas Gray Hawk board support
* board: renesas: Document Renesas Ironhide board support
* android: fastboot: Document halt behaviour

UEFI:

* fix memory leak in efi_var_collect()
* set revision field in block IO protocol
* fix guid comparison in efi_selftest_loaded_image.c
* fix use-after-free in efi_selftest_memory.c

7 files changed, 50 insertions, 17 deletions

diff --git a/doc/android/fastboot.rst b/doc/android/fastboot.rst
index 19e2ee9d407..818b8815ebd 100644
--- a/doc/android/fastboot.rst
+++ b/doc/android/fastboot.rst
@@ -212,6 +212,11 @@ or initiate a reboot::
 
 and once the client comes back, the board should reset.
 
+It's possible to interrupt the fastboot command using Ctrl-c::
+
+   => fastboot usb 0
+   Operation aborted.
+
 You can also specify a kernel image to boot. You have to either specify
 the an image in Android format *or* pass a binary kernel and let the
 fastboot client wrap the Android suite around it. On OMAP for instance you
diff --git a/doc/board/renesas/renesas.rst b/doc/board/renesas/renesas.rst
index fedfeed42e3..fcfd51aa19c 100644
--- a/doc/board/renesas/renesas.rst
+++ b/doc/board/renesas/renesas.rst
@@ -121,6 +121,12 @@ Renesas is a SoC solutions provider for automotive and industrial applications.
      - rcar3_ulcb_defconfig
 
    * -
+     - Geist
+     - R8A779MD (M3Le)
+     - arm64
+     - r8a779md_geist_defconfig
+
+   * -
      - Eagle
      - R8A77970 (V3M)
      - arm64
@@ -186,6 +192,24 @@ Renesas is a SoC solutions provider for automotive and industrial applications.
      - arm64
      - r8a779g3_sparrowhawk_defconfig
 
+   * -
+     - Gray Hawk
+     - R8A779H0 (V4M)
+     - arm64
+     - r8a779h0_grayhawk_defconfig
+
+   * - R-Car Gen5
+     - Ironhide (Cortex-A720AE application core)
+     - R8A78000 (X5H)
+     - arm64
+     - r8a78000_ironhide_defconfig
+
+   * -
+     - Ironhide (Cortex-M33 RSIP boot core)
+     - R8A78000 (X5H)
+     - arm64
+     - r8a78000_ironhide_cm33_defconfig
+
    * - RZ/G2 Family
      - Beacon EmbeddedWorks RZ/G2M SoM
      - R8A774A1 (RZ/G2M)
@@ -231,13 +255,13 @@ Renesas is a SoC solutions provider for automotive and industrial applications.
    * - :doc:`RZ/N1 Family <rzn1>`
      - Schneider RZ/N1D board
      - R9A06G032 (RZ/N1D)
-     - arm64
+     - arm
      - rzn1_snarc_defconfig
 
    * -
      - Schneider RZ/N1S board
      - R9A06G033 (RZ/N1S)
-     - arm64
+     - arm
      - rzn1_snarc_defconfig
 
 Build
diff --git a/include/bootdev.h b/include/bootdev.h
index 12c90c4ec1b..14f8a98633b 100644
--- a/include/bootdev.h
+++ b/include/bootdev.h
@@ -30,10 +30,10 @@ struct udevice;
  * generally very quick to access, e.g. less than 100ms
  * @BOOTDEVP_3_INTERNAL_SLOW: Internal devices which don't need scanning but
  * take a significant fraction of a second to access
- * @BOOTDEVP_4_SCAN_FAST: Extenal devices which need scanning or bus
+ * @BOOTDEVP_4_SCAN_FAST: External devices which need scanning or bus
  * enumeration to find, but this enumeration happens quickly, typically under
  * 100ms
- * @BOOTDEVP_5_SCAN_SLOW: Extenal devices which need scanning or bus
+ * @BOOTDEVP_5_SCAN_SLOW: External devices which need scanning or bus
  * enumeration to find. The enumeration takes significant fraction of a second
  * to complete
  * @BOOTDEVP_6_NET_BASE: Basic network devices which are quickly and easily
@@ -327,7 +327,7 @@ int bootdev_hunt_and_find_by_label(const char *label, struct udevice **devp,
  * Bootdev scanners are used as needed. For example a label "mmc1" results in
  * running the "mmc" bootdrv.
  *
- * @iter: Interation info, containing iter->cur_label
+ * @iter: Iteration info, containing iter->cur_label
  * @devp: New bootdev found, if any was found
  * @method_flagsp: If non-NULL, returns any flags implied by the label
  * (enum bootflow_meth_flags_t), 0 if none
@@ -342,7 +342,7 @@ int bootdev_next_label(struct bootflow_iter *iter, struct udevice **devp,
  * This moves @devp to the next bootdev with the current priority. If there is
  * none, then it moves to the next priority and scans for new bootdevs there.
  *
- * @iter: Interation info, containing iter->cur_prio
+ * @iter: Iteration info, containing iter->cur_prio
  * @devp: On entry this is the previous bootdev that was considered. On exit
  *	this is the new bootdev, if any was found
  * Returns 0 on success (*devp is updated), -ENODEV if there are no more
diff --git a/lib/efi_loader/efi_disk.c b/lib/efi_loader/efi_disk.c
index f8a57539ec6..4a3ace3a304 100644
--- a/lib/efi_loader/efi_disk.c
+++ b/lib/efi_loader/efi_disk.c
@@ -305,6 +305,7 @@ static efi_status_t EFIAPI efi_disk_flush_blocks(struct efi_block_io *this)
 }
 
 static const struct efi_block_io block_io_disk_template = {
+	.revision = EFI_BLOCK_IO_PROTOCOL_REVISION3,
 	.reset = &efi_disk_reset,
 	.read_blocks = &efi_disk_read_blocks,
 	.write_blocks = &efi_disk_write_blocks,
diff --git a/lib/efi_loader/efi_var_common.c b/lib/efi_loader/efi_var_common.c
index d63c2d1b1cd..e51b21fe0b0 100644
--- a/lib/efi_loader/efi_var_common.c
+++ b/lib/efi_loader/efi_var_common.c
@@ -446,8 +446,10 @@ efi_status_t __maybe_unused efi_var_collect(struct efi_var_file **bufp, loff_t *
 		efi_status_t ret;
 
 		if ((uintptr_t)buf + len <=
-		    (uintptr_t)var->name + old_var_name_length)
+		    (uintptr_t)var->name + old_var_name_length) {
+			free(buf);
 			return EFI_BUFFER_TOO_SMALL;
+		}
 
 		var_name_length = (uintptr_t)buf + len - (uintptr_t)var->name;
 		memcpy(var->name, old_var->name, old_var_name_length);
diff --git a/lib/efi_selftest/efi_selftest_loaded_image.c b/lib/efi_selftest/efi_selftest_loaded_image.c
index 5889ab12617..e0668f60ebd 100644
--- a/lib/efi_selftest/efi_selftest_loaded_image.c
+++ b/lib/efi_selftest/efi_selftest_loaded_image.c
@@ -60,8 +60,8 @@ static int execute(void)
 	efi_st_printf("%u protocols installed on image handle\n",
 		      (unsigned int)protocol_buffer_count);
 	for (i = 0; i < protocol_buffer_count; ++i) {
-		if (memcmp(protocol_buffer[i], &loaded_image_protocol_guid,
-			   sizeof(efi_guid_t)))
+		if (!memcmp(protocol_buffer[i], &loaded_image_protocol_guid,
+			    sizeof(efi_guid_t)))
 			found = true;
 	}
 	if (!found) {
diff --git a/lib/efi_selftest/efi_selftest_memory.c b/lib/efi_selftest/efi_selftest_memory.c
index 7320964c129..450470ceedd 100644
--- a/lib/efi_selftest/efi_selftest_memory.c
+++ b/lib/efi_selftest/efi_selftest_memory.c
@@ -155,6 +155,15 @@ static int execute(void)
 			       EFI_RUNTIME_SERVICES_DATA) != EFI_ST_SUCCESS)
 		return EFI_ST_FAILURE;
 
+	/* Check memory reservation for the device tree */
+	if (fdt_addr &&
+	    find_in_memory_map(map_size, memory_map, desc_size, fdt_addr,
+			       EFI_ACPI_RECLAIM_MEMORY) != EFI_ST_SUCCESS) {
+		efi_st_error
+			("Device tree not marked as ACPI reclaim memory\n");
+		return EFI_ST_FAILURE;
+	}
+
 	/* Free memory */
 	ret = boottime->free_pages(p1, EFI_ST_NUM_PAGES);
 	if (ret != EFI_SUCCESS) {
@@ -172,14 +181,6 @@ static int execute(void)
 		return EFI_ST_FAILURE;
 	}
 
-	/* Check memory reservation for the device tree */
-	if (fdt_addr &&
-	    find_in_memory_map(map_size, memory_map, desc_size, fdt_addr,
-			       EFI_ACPI_RECLAIM_MEMORY) != EFI_ST_SUCCESS) {
-		efi_st_error
-			("Device tree not marked as ACPI reclaim memory\n");
-		return EFI_ST_FAILURE;
-	}
 	return EFI_ST_SUCCESS;
 }