Prepare v2025.04-rc5

-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAmfiDmUACgkQFHw5/5Y0
 tyx+qAv/X6EO1LJlIB55461gdvzua2SJni8inDjQBjrpmyyGiB1J5bZhQW1rrPqO
 5F6heLaErn5aSo1Vlyiwh/rajzMVP+fsVlt2uWNWfSzYxl4Dgv/3VpaDsAXgB0L7
 3RZVhiMihCXFb74E1NtxDeqtzYWH6JklG6Z6sqBk9turQnodysdafVX85KwmLrlH
 L+U5L1FY80bizAGAeQU0hnMtMC/5lcJmmIBHyRdit86Qe+OyZQnjw5EZeTOtybHk
 8Xd3MkX8jyE9ZM1jDtlp6RYctHnRiFSAU5DPYv65sd4ag8WkpwbWwPd0/s7Pbyx8
 QbAKNCIPJm2FrZTytklOIhU9YimLZTyPkmlLA9DG+GasfuB5KK7NF5RbtCSLj30i
 PNq+62o2P2k30ZHn4UneDmxVCKVzP+o4qGX+FbRvdjAg0VYHyCO9HNWf5kxetUAW
 LwudDidu2XUOjZZmbIhNBMIIuVpmbVDcFm2HVEN/ULK98rPAiy/4g2ZLuVXZCmky
 /Nc4ma4w
 =fu10
 -----END PGP SIGNATURE-----

Merge tag 'v2025.04-rc5' into next

Prepare v2025.04-rc5

Makefile

@@ -3,7 +3,7 @@
 VERSION = 2025
 PATCHLEVEL = 04
 SUBLEVEL =
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME =
 
 # *DOCUMENTATION*

arch/arm/dts/r8a779g0-u-boot.dtsi

@@ -147,6 +147,10 @@
 	bootph-all;
 };
 
+&otp {
+	bootph-all;
+};
+
 &pfc {
 	bootph-all;
 };

arch/arm/lib/crt0_aarch64_efi.S

@@ -144,6 +144,7 @@ section_table:
 		 IMAGE_SCN_CNT_INITIALIZED_DATA)
 
 	.align		12
+	.globl		_start
 _start:
 	stp		x29, x30, [sp, #-32]!
 	mov		x29, sp

arch/arm/lib/crt0_arm_efi.S

@@ -143,6 +143,7 @@ section_table:
 		 IMAGE_SCN_CNT_INITIALIZED_DATA)
 
 	.align		12
+	.globl		_start
 _start:
 	stmfd		sp!, {r0-r2, lr}
 

arch/riscv/lib/crt0_riscv_efi.S

@@ -179,6 +179,7 @@ section_table:
 		 IMAGE_SCN_CNT_INITIALIZED_DATA)
 
 	.align		12
+	.globl		_start
 _start:
 	addi		sp, sp, -(SIZE_LONG * 3)
 	SAVE_LONG(a0, 0)

board/renesas/common/Makefile

@@ -1,6 +1,4 @@
 #
-# board/renesas/whitehawk/Makefile
-#
 # Copyright (C) 2024 Marek Vasut <marek.vasut+renesas@mailbox.org>
 #
 # SPDX-License-Identifier: GPL-2.0+

board/renesas/common/gen4-common.c

@@ -7,11 +7,13 @@
 
 #include <asm/arch/renesas.h>
 #include <asm/arch/sys_proto.h>
+#include <asm/armv8/mmu.h>
 #include <asm/global_data.h>
 #include <asm/io.h>
 #include <asm/mach-types.h>
 #include <asm/processor.h>
 #include <asm/system.h>
+#include <image.h>
 #include <linux/errno.h>
 
 #define RST_BASE	0xE6160000 /* Domain0 */
@@ -88,3 +90,127 @@ int ft_board_setup(void *blob, struct bd_info *bd)
 {
 	return 0;
 }
+
+/* R-Car Gen4 TFA BL31 handoff structure and handling. */
+struct param_header {
+	u8			type;
+	u8			version;
+	u16			size;
+	u32			attr;
+};
+
+struct tfa_image_info {
+	struct param_header	h;
+	uintptr_t		image_base;
+	u32			image_size;
+	u32			image_max_size;
+};
+
+struct aapcs64_params {
+	u64			arg0;
+	u64			arg1;
+	u64			arg2;
+	u64			arg3;
+	u64			arg4;
+	u64			arg5;
+	u64			arg6;
+	u64			arg7;
+};
+
+struct entry_point_info {
+	struct param_header	h;
+	uintptr_t		pc;
+	u32			spsr;
+	struct aapcs64_params	args;
+};
+
+struct bl2_to_bl31_params_mem {
+	struct tfa_image_info	bl32_image_info;
+	struct tfa_image_info	bl33_image_info;
+	struct entry_point_info	bl33_ep_info;
+	struct entry_point_info	bl32_ep_info;
+};
+
+/* Default jump address, return to U-Boot */
+#define BL33_BASE	0x44100000
+/* Custom parameters address passed to TFA by ICUMXA loader */
+#define PARAMS_BASE	0x46422200
+
+/* Usually such a structure is produced by ICUMXA and passed in at 0x46422200 */
+static const struct bl2_to_bl31_params_mem blinfo_template = {
+	.bl33_ep_info.h.type = 1,	/* PARAM_EP */
+	.bl33_ep_info.h.version = 2,	/* Version 2 */
+	.bl33_ep_info.h.size = sizeof(struct entry_point_info),
+	.bl33_ep_info.h.attr = 0x81,	/* Executable | Non-Secure */
+	.bl33_ep_info.spsr = 0x2c9,	/* Mode=EL2, SP=ELX, Exceptions=OFF */
+	.bl33_ep_info.pc = BL33_BASE,
+
+	.bl33_image_info.h.type = 1,	/* PARAM_EP */
+	.bl33_image_info.h.version = 2,	/* Version 2 */
+	.bl33_image_info.h.size = sizeof(struct image_info),
+	.bl33_image_info.h.attr = 0,
+	.bl33_image_info.image_base = BL33_BASE,
+};
+
+static bool tfa_bl31_image_loaded;
+static ulong tfa_bl31_image_addr;
+
+static void tfa_bl31_image_process(ulong image, size_t size)
+{
+	/* Custom parameters address passed to TFA by ICUMXA loader */
+	struct bl2_to_bl31_params_mem *blinfo = (struct bl2_to_bl31_params_mem *)PARAMS_BASE;
+
+	/* Not in EL3, do nothing. */
+	if (current_el() != 3)
+		return;
+
+	/* Clear a page and copy template */
+	memset((void *)PARAMS_BASE, 0, PAGE_SIZE);
+	memcpy(blinfo, &blinfo_template, sizeof(*blinfo));
+	tfa_bl31_image_addr = image;
+	tfa_bl31_image_loaded = true;
+}
+
+U_BOOT_FIT_LOADABLE_HANDLER(IH_TYPE_TFA_BL31, tfa_bl31_image_process);
+
+void armv8_switch_to_el2_prep(u64 args, u64 mach_nr, u64 fdt_addr,
+			      u64 arg4, u64 entry_point, u64 es_flag)
+{
+	typedef void __noreturn (*image_entry_noargs_t)(void);
+	image_entry_noargs_t image_entry =
+		(image_entry_noargs_t)(void *)tfa_bl31_image_addr;
+	struct bl2_to_bl31_params_mem *blinfo =
+		(struct bl2_to_bl31_params_mem *)PARAMS_BASE;
+
+	/* Not in EL3, do nothing. */
+	if (current_el() != 3)
+		return;
+
+	/*
+	 * Destination address in arch/arm/cpu/armv8/transition.S
+	 * right past the first bl in armv8_switch_to_el2() to let
+	 * the rest of U-Boot pre-Linux code run. The code does run
+	 * without stack pointer!
+	 */
+	const u64 ep = ((u64)(uintptr_t)&armv8_switch_to_el2) + 4;
+
+	/* If TFA BL31 was not part of the fitImage, do regular boot. */
+	if (!tfa_bl31_image_loaded)
+		return;
+
+	/*
+	 * Set up kernel entry point and parameters:
+	 * x0 is FDT address, x1..x3 must be 0
+	 */
+	blinfo->bl33_ep_info.pc = ep;
+	blinfo->bl33_ep_info.args.arg0 = args;
+	blinfo->bl33_ep_info.args.arg1 = mach_nr;
+	blinfo->bl33_ep_info.args.arg2 = fdt_addr;
+	blinfo->bl33_ep_info.args.arg3 = arg4;
+	blinfo->bl33_ep_info.args.arg4 = entry_point;
+	blinfo->bl33_ep_info.args.arg5 = es_flag;
+	blinfo->bl33_image_info.image_base = ep;
+
+	/* Jump to TFA BL31 */
+	image_entry();
+}

board/renesas/common/gen4-spl.c

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * R-Car Gen4 Cortex-R52 SPL
+ * R-Car Gen4 SPL
  *
  * Copyright (C) 2024 Marek Vasut <marek.vasut+renesas@mailbox.org>
  */

board/toradex/verdin-am62/verdin-am62.c

@@ -112,13 +112,6 @@ int board_late_init(void)
 #define CORE_VOLTAGE			0x80000000
 #define MCU_CTRL_LFXOSC_32K_BYPASS_VAL	BIT(4)
 
-#if IS_ENABLED(CONFIG_XPL_BUILD)
-void spl_perform_fixups(struct spl_image_info *spl_image)
-{
-	fixup_memory_node(spl_image);
-}
-#endif
-
 #ifdef CONFIG_SPL_BOARD_INIT
 void spl_board_init(void)
 {

cmd/version.c

@@ -6,6 +6,7 @@
 
 #include <command.h>
 #include <display_options.h>
+#include <version.h>
 #include <version_string.h>
 #include <linux/compiler.h>
 #ifdef CONFIG_SYS_COREBOOT

configs/r8a779g0_whitehawk_defconfig

@@ -3,6 +3,8 @@
 CONFIG_ARM=y
 CONFIG_ARCH_RENESAS=y
 CONFIG_RCAR_GEN4=y
+CONFIG_ARM_SMCCC=y
+CONFIG_ARMV8_PSCI=y
 CONFIG_ENV_SIZE=0x20000
 CONFIG_ENV_OFFSET=0xFFFE0000
 CONFIG_DEFAULT_DEVICE_TREE="renesas/r8a779g0-white-hawk"

doc/README.bitbangMII

@@ -1,39 +0,0 @@
-This patch rewrites the miiphybb ( Bit-banged MII bus driver ) in order to
-support an arbitrary number of mii buses. This feature is useful when your
-board uses different mii buses for different phys and all (or a part) of these
-buses are implemented via bit-banging mode.
-
-The driver requires that the following macros should be defined into the board
-configuration file:
-
-CONFIG_BITBANGMII	- Enable the miiphybb driver
-
-The board code needs to fill the bb_miiphy_buses[] array with a record for
-each required bus and declare the bb_miiphy_buses_num variable with the
-number of mii buses. The record (struct bb_miiphy_bus) has the following
-fields/callbacks (see miiphy.h for details):
-
-char name[]	       - The symbolic name that must be equal to the MII bus
-			 registered name
-int (*init)()	       - Initialization function called at startup time (just
-			 before the Ethernet initialization)
-int (*mdio_active)()   - Activate the MDIO pin as output
-int (*mdio_tristate)() - Activate the MDIO pin as input/tristate pin
-int (*set_mdio)()      - Write the MDIO pin
-int (*get_mdio)()      - Read the MDIO pin
-int (*set_mdc)()       - Write the MDC pin
-int (*delay)()	       - Delay function
-void *priv	       - Private data used by board specific code
-
-The board code will look like:
-
-struct bb_miiphy_bus bb_miiphy_buses[] = {
- { .name = "miibus#1", .init = b1_init, .mdio_active = b1_mdio_active, ... },
- { .name = "miibus#2", .init = b2_init, .mdio_active = b2_mdio_active, ... },
- ...
-};
-int bb_miiphy_buses_num = sizeof(bb_miiphy_buses) /
-			  sizeof(bb_miiphy_buses[0]);
-
-2009 Industrie Dial Face S.p.A.
-     Luigi 'Comio' Mantellini <luigi.mantellini@idf-hit.com>

doc/develop/bitbangmii.rst

@@ -0,0 +1,75 @@
+.. SPDX-License-Identifier: GPL-2.0-or-later
+.. Luigi 'Comio' Mantellini <luigi.mantellini@idf-hit.com>, Industrie Dial Face S.p.A., 2009
+
+Bit-banged MII bus support
+==========================
+
+The miiphybb ( Bit-banged MII bus driver ) supports an arbitrary number of
+MII buses. This feature is useful when a driver uses different MII buses for
+different PHYs and all (or a part) of these buses are implemented via
+bit-banging mode.
+
+The driver requires that the following macro is defined in the board
+configuration file:
+
+* CONFIG_BITBANGMII - Enable the miiphybb driver
+
+The driver code needs to allocate a regular MDIO device using mdio_alloc()
+and assign .read and .write accessors which wrap bb_miiphy_read() and
+bb_miiphy_write() functions respectively. The bb_miiphy_read() and
+bb_miiphy_write() functions take a pointer to a callback structure,
+struct bb_miiphy_bus_ops. The struct bb_miiphy_bus_ops has the following
+fields/callbacks (see miiphy.h for details):
+
+.. code-block:: c
+
+    int (*mdio_active)()   // Activate the MDIO pin as output
+    int (*mdio_tristate)() // Activate the MDIO pin as input/tristate pin
+    int (*set_mdio)()      // Write the MDIO pin
+    int (*get_mdio)()      // Read the MDIO pin
+    int (*set_mdc)()       // Write the MDC pin
+    int (*delay)()         // Delay function
+
+The driver code will look like:
+
+.. code-block:: c
+
+    static const struct bb_miiphy_bus_ops ravb_bb_miiphy_bus_ops = {
+        .mdio_active      = ravb_bb_mdio_active,
+        .mdio_tristate    = ravb_bb_mdio_tristate,
+        .set_mdio         = ravb_bb_set_mdio,
+        .get_mdio         = ravb_bb_get_mdio,
+        .set_mdc          = ravb_bb_set_mdc,
+        .delay            = ravb_bb_delay,
+    };
+
+    static int ravb_bb_miiphy_read(struct mii_dev *miidev, int addr,
+                                   int devad, int reg)
+    {
+        return bb_miiphy_read(miidev, &ravb_bb_miiphy_bus_ops,
+                              addr, devad, reg);
+    }
+
+    static int ravb_bb_miiphy_write(struct mii_dev *miidev, int addr,
+                                    int devad, int reg, u16 value)
+    {
+        return bb_miiphy_write(miidev, &ravb_bb_miiphy_bus_ops,
+                               addr, devad, reg, value);
+    }
+
+    static int ravb_probe(struct udevice *dev)
+    {
+        struct mii_dev *mdiodev;
+    ...
+        mdiodev = mdio_alloc();
+        if (!mdiodev)
+            return -ENOMEM;
+
+        mdiodev->read = ravb_bb_miiphy_read;
+        mdiodev->write = ravb_bb_miiphy_write;
+        mdiodev->priv = eth;
+        snprintf(mdiodev->name, sizeof(mdiodev->name), dev->name);
+
+        ret = mdio_register(mdiodev);
+    ...
+    }

doc/develop/index.rst

@@ -9,6 +9,7 @@ General
 .. toctree::
    :maxdepth: 1
 
+   bitbangmii
    board_best_practices
    codingstyle
    designprinciples

doc/develop/release_cycle.rst

@@ -76,7 +76,7 @@ For the next scheduled release, release candidates were made on::
 
 * U-Boot v2025.04-rc4 was released on Mon 10 March 2025.
 
-.. * U-Boot v2025.04-rc5 was released on Mon 24 March 2025.
+* U-Boot v2025.04-rc5 was released on Mon 24 March 2025.
 
 Please note that the following dates are planned only and may be deviated from
 as needed.

drivers/ram/renesas/dbsc5/dbsc5.c

@@ -59,7 +59,8 @@ int renesas_dbsc5_bind(struct udevice *dev)
 
 struct renesas_dbsc5_data r8a779g0_dbsc5_data = {
 	.clock_node = "renesas,r8a779g0-cpg-mssr",
-	.reset_node = "renesas,r8a779g0-rst"
+	.reset_node = "renesas,r8a779g0-rst",
+	.otp_node = "renesas,r8a779g0-otp",
 };
 
 static const struct udevice_id renesas_dbsc5_ids[] = {

drivers/ram/renesas/dbsc5/dbsc5.h

@@ -23,6 +23,7 @@
 struct renesas_dbsc5_data {
 	const char		*clock_node;
 	const char		*reset_node;
+	const char		*otp_node;
 };
 
 #endif /* __DRIVERS_RAM_RENESAS_DBSC5_DBSC5_H__ */

drivers/ram/renesas/dbsc5/dram.c

@@ -4,6 +4,7 @@
  */
 
 #include <asm/io.h>
+#include <dbsc5.h>
 #include <dm.h>
 #include <errno.h>
 #include <hang.h>
@@ -12,13 +13,6 @@
 #include <linux/sizes.h>
 #include "dbsc5.h"
 
-/* The number of channels V4H has */
-#define DRAM_CH_CNT			4
-/* The number of slices V4H has */
-#define SLICE_CNT			2
-/* The number of chip select V4H has */
-#define CS_CNT				2
-
 /* Number of array elements in Data Slice */
 #define DDR_PHY_SLICE_REGSET_SIZE_V4H	0x100
 /* Number of array elements in Data Slice */
@@ -220,6 +214,7 @@ static const u16 jedec_spec2_tRFC_ab[] = {
 #define PHY_RDLVL_RDDQS_DQ_TE_DLY_OBS		DDR_REGDEF(0x00, 0x09, 0x103F)
 #define PHY_WDQLVL_STATUS_OBS			DDR_REGDEF(0x00, 0x20, 0x1043)
 #define PHY_DATA_DC_CAL_START			DDR_REGDEF(0x18, 0x01, 0x104D)
+#define PHY_SLV_DLY_CTRL_GATE_DISABLE		DDR_REGDEF(0x10, 0x01, 0x104E)
 #define PHY_REGULATOR_EN_CNT			DDR_REGDEF(0x18, 0x06, 0x1050)
 #define PHY_VREF_INITIAL_START_POINT		DDR_REGDEF(0x00, 0x09, 0x1055)
 #define PHY_VREF_INITIAL_STOP_POINT		DDR_REGDEF(0x10, 0x09, 0x1055)
@@ -469,7 +464,7 @@ static const u32 DDR_PHY_SLICE_REGSET_V4H[DDR_PHY_SLICE_REGSET_NUM_V4H] = {
 	0x00000000, 0x00500050, 0x00500050, 0x00500050,
 	0x00500050, 0x0D000050, 0x10100004, 0x06102010,
 	0x61619041, 0x07097000, 0x00644180, 0x00803280,
-	0x00808001, 0x13010100, 0x02000016, 0x10001003,
+	0x00808001, 0x13010101, 0x02000016, 0x10001003,
 	0x06093E42, 0x0F063D01, 0x011700C8, 0x04100140,
 	0x00000100, 0x000001D1, 0x05000068, 0x00030402,
 	0x01400000, 0x80800300, 0x00160010, 0x76543210,
@@ -512,8 +507,8 @@ static const u32 DDR_PHY_ADR_G_REGSET_V4H[DDR_PHY_ADR_G_REGSET_NUM_V4H] = {
 	0x00040101, 0x00000000, 0x00000000, 0x00000064,
 	0x00000000, 0x00000000, 0x39421B42, 0x00010124,
 	0x00520052, 0x00000052, 0x00000000, 0x00000000,
-	0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00010001, 0x00000000, 0x00000000, 0x00010001,
-	0x00000000, 0x00000000, 0x00000000, 0x07030102,
+	0x00000000, 0x00000000, 0x00010001, 0x07030102,
 	0x01030307, 0x00000054, 0x00004096, 0x08200820,
 	0x08200820, 0x08200820, 0x08200820, 0x00000820,
 	0x004103B8, 0x0000003F, 0x000C0006, 0x00000000,
@@ -1294,7 +1289,7 @@ static const struct dbsc5_table_patch dbsc5_table_patch_slice_mbpsdiv_572 = {
 };
 
 static const struct dbsc5_table_patch dbsc5_table_patch_adr_g_mbpsdiv_572 = {
-	PHY_PAD_ACS_RX_PCLK_CLK_SEL, 0x03
+	PHY_PAD_ACS_RX_PCLK_CLK_SEL, 0x02
 };
 
 static const struct dbsc5_table_patch dbsc5_table_patch_adr_g_mbpsdiv_400[] = {
@@ -1374,46 +1369,6 @@ static const u32 PI_DARRAY3_1_CSx_Fx[CS_CNT][3] = {
 
 #define CLK_DIV(a, diva, b, divb)	(((a) * (divb)) / ((b) * (diva)))
 
-struct renesas_dbsc5_board_config {
-	/* Channels in use */
-	u8 bdcfg_phyvalid;
-	/* Read vref (SoC) training range */
-	u32 bdcfg_vref_r;
-	/* Write vref (MR14, MR15) training range */
-	u16 bdcfg_vref_w;
-	/* CA vref (MR12) training range */
-	u16 bdcfg_vref_ca;
-	/* RFM required check */
-	bool bdcfg_rfm_chk;
-
-	/* Board parameter about channels */
-	struct {
-		/*
-		 * 0x00:  4Gb dual channel die /  2Gb single channel die
-		 * 0x01:  6Gb dual channel die /  3Gb single channel die
-		 * 0x02:  8Gb dual channel die /  4Gb single channel die
-		 * 0x03: 12Gb dual channel die /  6Gb single channel die
-		 * 0x04: 16Gb dual channel die /  8Gb single channel die
-		 * 0x05: 24Gb dual channel die / 12Gb single channel die
-		 * 0x06: 32Gb dual channel die / 16Gb single channel die
-		 * 0x07: 24Gb single channel die
-		 * 0x08: 32Gb single channel die
-		 * 0xFF: NO_MEMORY
-		 */
-		u8 bdcfg_ddr_density[CS_CNT];
-		/* SoC caX([6][5][4][3][2][1][0]) -> MEM caY: */
-		u32 bdcfg_ca_swap;
-		/* SoC dqsX([1][0]) -> MEM dqsY: */
-		u8 bdcfg_dqs_swap;
-		/* SoC dq([7][6][5][4][3][2][1][0]) -> MEM dqY/dm:  (8 means DM) */
-		u32 bdcfg_dq_swap[SLICE_CNT];
-		/* SoC dm -> MEM dqY/dm:  (8 means DM) */
-		u8 bdcfg_dm_swap[SLICE_CNT];
-		/* SoC ckeX([1][0]) -> MEM csY */
-		u8 bdcfg_cs_swap;
-	} ch[4];
-};
-
 struct renesas_dbsc5_dram_priv {
 	void __iomem	*regs;
 	void __iomem	*cpg_regs;
@@ -1713,14 +1668,17 @@ static void dbsc5_clk_wait_dbpdstat1(struct udevice *dev, u32 status)
 {
 	struct renesas_dbsc5_dram_priv *priv = dev_get_priv(dev);
 	void __iomem *regs_dbsc_d = priv->regs + DBSC5_DBSC_D_OFFSET;
-	u32 i, ch, reg;
+	u32 i, ch, chk, reg;
 
 	for (i = 0; i < 2; i++) {
 		do {
 			reg = status;
-			r_foreach_vch(dev, ch)
+			chk = 0;
+			r_foreach_vch(dev, ch) {
 				reg &= readl(regs_dbsc_d + DBSC_DBPDSTAT1(ch));
-		} while (reg != status);
+				chk |= readl(regs_dbsc_d + DBSC_DBPDSTAT0(ch));
+			}
+		} while (reg != status && !(chk & BIT(0)));
 	}
 }
 
@@ -2192,7 +2150,7 @@ static void dbsc5_ddrtbl_calc(struct renesas_dbsc5_dram_priv *priv)
 		if (js1[i].fx3 * 2 * priv->ddr_mbpsdiv >= priv->ddr_mbps * 3)
 			break;
 
-	priv->js1_ind = max(i, JS1_USABLEC_SPEC_HI);
+	priv->js1_ind = clamp(i, 0, JS1_USABLEC_SPEC_HI);
 
 	priv->RL = js1[priv->js1_ind].RLset1;
 	priv->WL = js1[priv->js1_ind].WLsetA;
@@ -2635,7 +2593,7 @@ static void dbsc5_dbsc_regset(struct udevice *dev)
 	 */
 	dbsc5_reg_write(regs_dbsc_d + DBSC_DBTR(11),
 			priv->RL + 4 + priv->js2[JS2_tWCK2DQO_HF] -
-			js1[priv->js1_ind].ODTLon - priv->js2[JS2_tODTon_min]);
+			js1[priv->js1_ind].ODTLon - priv->js2[JS2_tODTon_min] + 2);
 
 	/* DBTR12.TWRRD_S : WL + BL/2 + tWTR_S, TWRRD_L : WL + BL + tWTR_L */
 	dbsc5_reg_write(regs_dbsc_d + DBSC_DBTR(12),
@@ -3491,13 +3449,10 @@ static void dbsc5_manual_write_dca(struct udevice *dev)
 {
 	struct renesas_dbsc5_dram_priv *priv = dev_get_priv(dev);
 	const u32 rank = priv->ch_have_this_cs[1] ? 0x2 : 0x1;
-	u32 slv_dly_center[DRAM_CH_CNT][CS_CNT][SLICE_CNT];
+	u32 phy_slv_dly[DRAM_CH_CNT][CS_CNT][SLICE_CNT];
-	u32 slv_dly_center_cyc;
+	u32 phy_slv_dly_avg[DRAM_CH_CNT][SLICE_CNT];
-	u32 slv_dly_center_dly;
 	u32 slv_dly_min[DRAM_CH_CNT][SLICE_CNT];
 	u32 slv_dly_max[DRAM_CH_CNT][SLICE_CNT];
-	u32 slv_dly_min_tmp[DRAM_CH_CNT][CS_CNT][SLICE_CNT];
-	u32 slv_dly_max_tmp[DRAM_CH_CNT][CS_CNT][SLICE_CNT];
 	u32 phy_dcc_code_min[DRAM_CH_CNT][SLICE_CNT];
 	u32 phy_dcc_code_max[DRAM_CH_CNT][SLICE_CNT];
 	u32 phy_dcc_code_mid;
@@ -3521,18 +3476,9 @@ static void dbsc5_manual_write_dca(struct udevice *dev)
 		dbsc5_ddr_setval_all_ch_all_slice(dev, PHY_PER_CS_TRAINING_INDEX, cs);
 		r_foreach_vch(dev, ch) {
 			for (slice = 0; slice < SLICE_CNT; slice++) {
-				slv_dly_center[ch][cs][slice] =
+				phy_slv_dly[ch][cs][slice] =
-					dbsc5_ddr_getval_slice(dev, ch, slice, PHY_CLK_WRDQS_SLAVE_DELAY);
+					dbsc5_ddr_getval_slice(dev, ch, slice,
-				slv_dly_center_cyc = slv_dly_center[ch][cs][slice] & 0x180;
+							       PHY_CLK_WRDQS_SLAVE_DELAY);
-				slv_dly_center_dly = slv_dly_center[ch][cs][slice] & 0x7F;
-				slv_dly_min_tmp[ch][cs][slice] =
-					slv_dly_center_cyc |
-					(slv_dly_center_dly * ratio_min / ratio_min_div);
-				slv_dly_max_tmp[ch][cs][slice] = slv_dly_center_cyc;
-				if ((slv_dly_center_dly * ratio_max) > (0x7F * ratio_max_div))
-					slv_dly_max_tmp[ch][cs][slice] |= 0x7F;
-				else
-					slv_dly_max_tmp[ch][cs][slice] |= slv_dly_center_dly * ratio_max / ratio_max_div;
 			}
 		}
 	}
@@ -3540,22 +3486,22 @@ static void dbsc5_manual_write_dca(struct udevice *dev)
 	r_foreach_vch(dev, ch) {
 		for (slice = 0; slice < SLICE_CNT; slice++) {
 			if (rank == 0x2) {
-				if (slv_dly_max_tmp[ch][0][slice] < slv_dly_max_tmp[ch][1][slice])
+				/* Calculate average between ranks */
-					slv_dly_max[ch][slice] = slv_dly_max_tmp[ch][1][slice];
+				phy_slv_dly_avg[ch][slice] = (phy_slv_dly[ch][0][slice] +
-				else
+							      phy_slv_dly[ch][1][slice]) / 2;
-					slv_dly_max[ch][slice] = slv_dly_max_tmp[ch][0][slice];
-
-				if (slv_dly_min_tmp[ch][0][slice] < slv_dly_min_tmp[ch][1][slice])
-					slv_dly_min[ch][slice] = slv_dly_min_tmp[ch][0][slice];
-				else
-					slv_dly_min[ch][slice] = slv_dly_min_tmp[ch][1][slice];
 			} else {
-				slv_dly_max[ch][slice] = slv_dly_max_tmp[ch][0][slice];
+				phy_slv_dly_avg[ch][slice] = phy_slv_dly[ch][0][slice];
-				slv_dly_min[ch][slice] = slv_dly_min_tmp[ch][0][slice];
 			}
+			/* Determine the search range */
+			slv_dly_min[ch][slice] = (phy_slv_dly_avg[ch][slice] & 0x07F) * ratio_min / ratio_min_div;
+			slv_dly_max[ch][slice] = (phy_slv_dly_avg[ch][slice] & 0x07F) * ratio_max / ratio_max_div;
+			if (slv_dly_max[ch][slice] > 0x7F)
+				slv_dly_max[ch][slice] = 0x7F;
 		}
 	}
 
+	dbsc5_ddr_setval_all_ch_all_slice(dev, PHY_SLV_DLY_CTRL_GATE_DISABLE, 0x1);
+
 	for (i = 0; i <= 0x7F; i++) {
 		r_foreach_vch(dev, ch) {
 			for (slice = 0; slice < SLICE_CNT; slice++) {
@@ -3621,13 +3567,16 @@ static void dbsc5_manual_write_dca(struct udevice *dev)
 			for (slice = 0; slice < SLICE_CNT; slice++) {
 				dbsc5_ddr_setval_slice(dev, ch, slice,
 						       PHY_CLK_WRDQS_SLAVE_DELAY,
-						       slv_dly_center[ch][cs][slice]);
+						       phy_slv_dly[ch][cs][slice]);
 				dbsc5_ddr_setval_slice(dev, ch, slice,
 						       SC_PHY_WCK_CALC, 0x1);
 				dbsc5_ddr_setval(dev, ch, SC_PHY_MANUAL_UPDATE, 0x1);
 			}
 		}
 	}
+
+	dbsc5_ddr_setval_all_ch_all_slice(dev, PHY_SLV_DLY_CTRL_GATE_DISABLE, 0x0);
+
 	dbsc5_ddr_setval_all_ch_all_slice(dev, PHY_PER_CS_TRAINING_MULTICAST_EN, 0x1);
 
 	r_foreach_vch(dev, ch) {
@@ -4369,16 +4318,20 @@ static int renesas_dbsc5_dram_probe(struct udevice *dev)
 {
 #define RST_MODEMR0			0x0
 #define RST_MODEMR1			0x4
+#define OTP_MONITOR17			0x1144
 	struct renesas_dbsc5_data *data = (struct renesas_dbsc5_data *)dev_get_driver_data(dev);
 	ofnode cnode = ofnode_by_compatible(ofnode_null(), data->clock_node);
 	ofnode rnode = ofnode_by_compatible(ofnode_null(), data->reset_node);
+	ofnode onode = ofnode_by_compatible(ofnode_null(), data->otp_node);
 	struct renesas_dbsc5_dram_priv *priv = dev_get_priv(dev);
 	void __iomem *regs_dbsc_a = priv->regs + DBSC5_DBSC_A_OFFSET;
 	void __iomem *regs_dbsc_d = priv->regs + DBSC5_DBSC_D_OFFSET;
 	phys_addr_t rregs = ofnode_get_addr(rnode);
 	const u32 modemr0 = readl(rregs + RST_MODEMR0);
 	const u32 modemr1 = readl(rregs + RST_MODEMR1);
-	u32 breg, reg, md, sscg;
+	phys_addr_t oregs = ofnode_get_addr(onode);
+	const u32 otpmon17 = readl(oregs + OTP_MONITOR17);
+	u32 breg, reg, md, sscg, product;
 	u32 ch, cs;
 
 	/* Get board data */
@@ -4433,29 +4386,41 @@ static int renesas_dbsc5_dram_probe(struct udevice *dev)
 
 	/* Decode DDR operating frequency from MD[37:36,19,17] pins */
 	md = ((modemr0 & BIT(19)) >> 18) | ((modemr0 & BIT(17)) >> 17);
+	product = otpmon17 & 0xff;
 	sscg = (modemr1 >> 4) & 0x03;
 	if (sscg == 2) {
 		printf("MD[37:36] setting 0x%x not supported!", sscg);
 		hang();
 	}
 
-	if (md == 0) {
+	if (product == 0x2) {			/* V4H-3 */
-		if (sscg == 0) {
-			priv->ddr_mbps = 6400;
-			priv->ddr_mbpsdiv = 1;
-		} else {
-			priv->ddr_mbps = 19000;
-			priv->ddr_mbpsdiv = 3;
-		}
-	} else if (md == 1) {
-		priv->ddr_mbps = 6000;
-		priv->ddr_mbpsdiv = 1;
-	} else if (md == 1) {
-		priv->ddr_mbps = 5500;
-		priv->ddr_mbpsdiv = 1;
-	} else if (md == 1) {
 		priv->ddr_mbps = 4800;
 		priv->ddr_mbpsdiv = 1;
+	} else if (product == 0x1) {		/* V4H-5 */
+		if (md == 3)
+			priv->ddr_mbps = 4800;
+		else
+			priv->ddr_mbps = 5000;
+		priv->ddr_mbpsdiv = 1;
+	} else {				/* V4H-7 */
+		if (md == 0) {
+			if (sscg == 0) {
+				priv->ddr_mbps = 6400;
+				priv->ddr_mbpsdiv = 1;
+			} else {
+				priv->ddr_mbps = 19000;
+				priv->ddr_mbpsdiv = 3;
+			}
+		} else if (md == 1) {
+			priv->ddr_mbps = 6000;
+			priv->ddr_mbpsdiv = 1;
+		} else if (md == 2) {
+			priv->ddr_mbps = 5500;
+			priv->ddr_mbpsdiv = 1;
+		} else if (md == 3) {
+			priv->ddr_mbps = 4800;
+			priv->ddr_mbpsdiv = 1;
+		}
 	}
 
 	priv->ddr_mul = CLK_DIV(priv->ddr_mbps, priv->ddr_mbpsdiv * 2,

drivers/usb/dwc3/gadget.c

@@ -1631,8 +1631,25 @@ usb_ep *dwc3_gadget_match_ep(struct usb_gadget *gadget,
 		return dwc3_find_ep(gadget, "ep1in");
 	if (usb_endpoint_is_bulk_out(desc))
 		return dwc3_find_ep(gadget, "ep2out");
-	if (usb_endpoint_is_int_in(desc))
+	if (usb_endpoint_is_int_in(desc)) {
+		/*
+		 * Special workaround for NXP UUU tool in SPL.
+		 *
+		 * The tool excepts the interrupt-in endpoint to be ep1in,
+		 * otherwise it crashes. This is a result of the previous
+		 * hard-coded EP setup in drivers/usb/gadget/epautoconf.c
+		 * which did special-case EP allocation for SPL builds,
+		 * and which was since converted to this callback, but
+		 * without the special-case EP allocation in SPL part.
+		 *
+		 * This reinstates the SPL part in an isolated manner,
+		 * only for NXP iMX SoCs, only for SPL builds, and only
+		 * for the ep1in interrupt-in endpoint.
+		 */
+		if (IS_ENABLED(CONFIG_MACH_IMX) && IS_ENABLED(CONFIG_XPL_BUILD))
+			return dwc3_find_ep(gadget, "ep1in");
 		return dwc3_find_ep(gadget, "ep3in");
+	}
 
 	return NULL;
 }

fs/fs.c

@@ -574,7 +574,7 @@ static int fs_read_lmb_check(const char *filename, ulong addr, loff_t offset,
 
 	lmb_dump_all();
 
-	if (lmb_alloc_addr(addr, read_len, LMB_NONE) == addr)
+	if (!lmb_alloc_addr(addr, read_len, LMB_NONE))
 		return 0;
 
 	log_err("** Reading file would overwrite reserved memory **\n");

include/dbsc5.h

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Copyright (C) 2024-2025 Renesas Electronics Corp.
+ */
+
+#ifndef __INCLUDE_DBSC5_H__
+#define __INCLUDE_DBSC5_H__
+
+/* The number of channels V4H has */
+#define DRAM_CH_CNT			4
+/* The number of slices V4H has */
+#define SLICE_CNT			2
+/* The number of chip select V4H has */
+#define CS_CNT				2
+
+struct renesas_dbsc5_board_config {
+	/* Channels in use */
+	u8 bdcfg_phyvalid;
+	/* Read vref (SoC) training range */
+	u32 bdcfg_vref_r;
+	/* Write vref (MR14, MR15) training range */
+	u16 bdcfg_vref_w;
+	/* CA vref (MR12) training range */
+	u16 bdcfg_vref_ca;
+	/* RFM required check */
+	bool bdcfg_rfm_chk;
+
+	/* Board parameter about channels */
+	struct {
+		/*
+		 * 0x00:  4Gb dual channel die /  2Gb single channel die
+		 * 0x01:  6Gb dual channel die /  3Gb single channel die
+		 * 0x02:  8Gb dual channel die /  4Gb single channel die
+		 * 0x03: 12Gb dual channel die /  6Gb single channel die
+		 * 0x04: 16Gb dual channel die /  8Gb single channel die
+		 * 0x05: 24Gb dual channel die / 12Gb single channel die
+		 * 0x06: 32Gb dual channel die / 16Gb single channel die
+		 * 0x07: 24Gb single channel die
+		 * 0x08: 32Gb single channel die
+		 * 0xFF: NO_MEMORY
+		 */
+		u8 bdcfg_ddr_density[CS_CNT];
+		/* SoC caX([6][5][4][3][2][1][0]) -> MEM caY: */
+		u32 bdcfg_ca_swap;
+		/* SoC dqsX([1][0]) -> MEM dqsY: */
+		u8 bdcfg_dqs_swap;
+		/* SoC dq([7][6][5][4][3][2][1][0]) -> MEM dqY/dm:  (8 means DM) */
+		u32 bdcfg_dq_swap[SLICE_CNT];
+		/* SoC dm -> MEM dqY/dm:  (8 means DM) */
+		u8 bdcfg_dm_swap[SLICE_CNT];
+		/* SoC ckeX([1][0]) -> MEM csY */
+		u8 bdcfg_cs_swap;
+	} ch[4];
+};
+
+#endif	/* __INCLUDE_DBSC5_H__ */

include/lmb.h

@@ -135,9 +135,9 @@ phys_addr_t lmb_alloc_base(phys_size_t size, ulong align, phys_addr_t max_addr,
  * parameter. The base parameter is used to specify the base address
  * of the requested region.
  *
- * Return: Base address on success, 0 on error.
+ * Return: 0 on success -1 on error
  */
-phys_addr_t lmb_alloc_addr(phys_addr_t base, phys_size_t size, u32 flags);
+int lmb_alloc_addr(phys_addr_t base, phys_size_t size, u32 flags);
 
 /**
  * lmb_is_reserved_flags() - Test if address is in reserved region with flag
@@ -175,7 +175,7 @@ void lmb_pop(struct lmb *store);
 
 static inline int lmb_read_check(phys_addr_t addr, phys_size_t len)
 {
-	return lmb_alloc_addr(addr, len, LMB_NONE) == addr ? 0 : -1;
+	return lmb_alloc_addr(addr, len, LMB_NONE);
 }
 
 /**

lib/efi_loader/efi_memory.c

@@ -491,8 +491,7 @@ efi_status_t efi_allocate_pages(enum efi_allocate_type type,
 			return EFI_NOT_FOUND;
 
 		addr = map_to_sysmem((void *)(uintptr_t)*memory);
-		addr = (u64)lmb_alloc_addr(addr, len, flags);
+		if (lmb_alloc_addr(addr, len, flags))
-		if (!addr)
 			return EFI_NOT_FOUND;
 		break;
 	default:

lib/efi_loader/elf_efi.ldsi

@@ -21,10 +21,10 @@ SECTIONS
 		*(.gnu.linkonce.t.*)
 		*(.srodata)
 		*(.rodata*)
-		. = ALIGN(16);
-		*(.dynamic);
-		. = ALIGN(512);
 	}
+	. = ALIGN(16);
+	.dynamic : { *(.dynamic) }
+	. = ALIGN(512);
 	.rela.dyn : { *(.rela.dyn) }
 	.rela.plt : { *(.rela.plt) }
 	.rela.got : { *(.rela.got) }

lib/lmb.c

@@ -742,7 +742,7 @@ phys_addr_t lmb_alloc_base(phys_size_t size, ulong align, phys_addr_t max_addr,
 	return _lmb_alloc_base(size, align, max_addr, flags);
 }
 
-phys_addr_t lmb_alloc_addr(phys_addr_t base, phys_size_t size, u32 flags)
+int lmb_alloc_addr(phys_addr_t base, phys_size_t size, u32 flags)
 {
 	long rgn;
 	struct lmb_region *lmb_memory = lmb.available_mem.data;
@@ -759,11 +759,11 @@ phys_addr_t lmb_alloc_addr(phys_addr_t base, phys_size_t size, u32 flags)
 				      base + size - 1, 1)) {
 			/* ok, reserve the memory */
 			if (!lmb_reserve(base, size, flags))
-				return base;
+				return 0;
 		}
 	}
 
-	return 0;
+	return -1;
 }
 
 /* Return number of bytes from a given address that are free */

scripts/Makefile.lib

@@ -513,8 +513,8 @@ $(obj)/%_efi.S: $(obj)/%.efi
 	$(call cmd,S_efi)
 
 quiet_cmd_efi_objcopy = OBJCOPY $@
-cmd_efi_objcopy = $(OBJCOPY) -j .header -j .text -j .sdata -j .data -j \
+cmd_efi_objcopy = $(OBJCOPY) -j .header -j .text -j .sdata -j .data \
-		.dynamic -j .dynsym  -j .rel* -j .rela* -j .reloc \
+		-j .dynamic -j .dynstr  -j .dynsym -j .rel* -j .reloc \
 		$(if $(EFI_TARGET),$(EFI_TARGET),-O binary) $^ $@
 
 $(obj)/%.efi: $(obj)/%_efi.so

scripts/checkpatch.pl

@@ -2692,6 +2692,12 @@ sub u_boot_line {
 		ERROR("PRE_SCHEMA",
 		      "Driver model schema uses 'bootph-...' tags now\n" . $herecurr);
 	}
+
+	# Do not allow CONFIG_xPL_BUILD in device trees
+	if ($realfile =~ /\.dtsi?$/ && $line =~ /^\+.*CONFIG_(X|S|T|V)PL_BUILD.*/) {
+		ERROR("CONFIG_xPL_BUILD",
+		      "Do not use CONFIG_xPL_BUILD in device trees\n" . $herecurr);
+	}
 }
 
 sub exclude_global_initialisers {

scripts/event_dump.py

@@ -107,7 +107,7 @@ def main(argv):
     Args:
         argv (list of str): List of program arguments, excluding arvg[0]
     """
-    epilog = 'Show a list of even spies in a U-Boot EFL file'
+    epilog = 'Show a list of event spies in a U-Boot ELF file'
     parser = ArgumentParser(epilog=epilog)
     parser.add_argument('elf', type=str, help='ELF file to decode')
     parser.add_argument('-e', '--endian', type=str, default='auto',

test/lib/lmb.c

@@ -566,21 +566,21 @@ static int test_alloc_addr(struct unit_test_state *uts, const phys_addr_t ram)
 
 	/* Try to allocate a page twice */
 	b = lmb_alloc_addr(alloc_addr_a, 0x1000, LMB_NONE);
-	ut_asserteq(b, alloc_addr_a);
-	b = lmb_alloc_addr(alloc_addr_a, 0x1000, LMB_NOOVERWRITE);
 	ut_asserteq(b, 0);
+	b = lmb_alloc_addr(alloc_addr_a, 0x1000, LMB_NOOVERWRITE);
+	ut_asserteq(b, -1);
 	b = lmb_alloc_addr(alloc_addr_a, 0x1000, LMB_NONE);
-	ut_asserteq(b, alloc_addr_a);
+	ut_asserteq(b, 0);
 	b = lmb_alloc_addr(alloc_addr_a, 0x2000, LMB_NONE);
-	ut_asserteq(b, alloc_addr_a);
+	ut_asserteq(b, 0);
 	ret = lmb_free(alloc_addr_a, 0x2000);
 	ut_asserteq(ret, 0);
 	b = lmb_alloc_addr(alloc_addr_a, 0x1000, LMB_NOOVERWRITE);
-	ut_asserteq(b, alloc_addr_a);
+	ut_asserteq(b, 0);
 	b = lmb_alloc_addr(alloc_addr_a, 0x1000, LMB_NONE);
-	ut_asserteq(b, 0);
+	ut_asserteq(b, -1);
 	b = lmb_alloc_addr(alloc_addr_a, 0x1000, LMB_NOOVERWRITE);
-	ut_asserteq(b, 0);
+	ut_asserteq(b, -1);
 	ret = lmb_free(alloc_addr_a, 0x1000);
 	ut_asserteq(ret, 0);
 
@@ -667,22 +667,22 @@ static int test_alloc_addr(struct unit_test_state *uts, const phys_addr_t ram)
 
 	/* allocate blocks */
 	a = lmb_alloc_addr(ram, alloc_addr_a - ram, LMB_NONE);
-	ut_asserteq(a, ram);
+	ut_asserteq(a, 0);
 	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 3, ram, 0x8010000,
 		   alloc_addr_b, 0x10000, alloc_addr_c, 0x10000);
 	b = lmb_alloc_addr(alloc_addr_a + 0x10000,
 			   alloc_addr_b - alloc_addr_a - 0x10000, LMB_NONE);
-	ut_asserteq(b, alloc_addr_a + 0x10000);
+	ut_asserteq(b, 0);
 	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 2, ram, 0x10010000,
 		   alloc_addr_c, 0x10000, 0, 0);
 	c = lmb_alloc_addr(alloc_addr_b + 0x10000,
 			   alloc_addr_c - alloc_addr_b - 0x10000, LMB_NONE);
-	ut_asserteq(c, alloc_addr_b + 0x10000);
+	ut_asserteq(c, 0);
 	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 1, ram, 0x18010000,
 		   0, 0, 0, 0);
 	d = lmb_alloc_addr(alloc_addr_c + 0x10000,
 			   ram_end - alloc_addr_c - 0x10000, LMB_NONE);
-	ut_asserteq(d, alloc_addr_c + 0x10000);
+	ut_asserteq(d, 0);
 	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 1, ram, ram_size,
 		   0, 0, 0, 0);
 
@@ -692,57 +692,58 @@ static int test_alloc_addr(struct unit_test_state *uts, const phys_addr_t ram)
 	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 1, ram, ram_size,
 		   0, 0, 0, 0);
 
-	ret = lmb_free(d, ram_end - alloc_addr_c - 0x10000);
+	/* free thge allocation from d */
+	ret = lmb_free(alloc_addr_c + 0x10000, ram_end - alloc_addr_c - 0x10000);
 	ut_asserteq(ret, 0);
 
 	/* allocate at 3 points in free range */
 
 	d = lmb_alloc_addr(ram_end - 4, 4, LMB_NONE);
-	ut_asserteq(d, ram_end - 4);
+	ut_asserteq(d, 0);
 	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 2, ram, 0x18010000,
-		   d, 4, 0, 0);
+		   ram_end - 4, 4, 0, 0);
-	ret = lmb_free(d, 4);
+	ret = lmb_free(ram_end - 4, 4);
 	ut_asserteq(ret, 0);
 	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 1, ram, 0x18010000,
 		   0, 0, 0, 0);
 
 	d = lmb_alloc_addr(ram_end - 128, 4, LMB_NONE);
-	ut_asserteq(d, ram_end - 128);
+	ut_asserteq(d, 0);
 	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 2, ram, 0x18010000,
-		   d, 4, 0, 0);
+		   ram_end - 128, 4, 0, 0);
-	ret = lmb_free(d, 4);
+	ret = lmb_free(ram_end - 128, 4);
 	ut_asserteq(ret, 0);
 	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 1, ram, 0x18010000,
 		   0, 0, 0, 0);
 
 	d = lmb_alloc_addr(alloc_addr_c + 0x10000, 4, LMB_NONE);
-	ut_asserteq(d, alloc_addr_c + 0x10000);
+	ut_asserteq(d, 0);
 	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 1, ram, 0x18010004,
 		   0, 0, 0, 0);
-	ret = lmb_free(d, 4);
+	ret = lmb_free(alloc_addr_c + 0x10000, 4);
 	ut_asserteq(ret, 0);
 	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 1, ram, 0x18010000,
 		   0, 0, 0, 0);
 
-	/* allocate at the bottom */
+	/* allocate at the bottom a was assigned to ram at the top */
-	ret = lmb_free(a, alloc_addr_a - ram);
+	ret = lmb_free(ram, alloc_addr_a - ram);
 	ut_asserteq(ret, 0);
 	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 1, ram + 0x8000000,
 		   0x10010000, 0, 0, 0, 0);
 
 	d = lmb_alloc_addr(ram, 4, LMB_NONE);
-	ut_asserteq(d, ram);
+	ut_asserteq(d, 0);
-	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 2, d, 4,
+	ASSERT_LMB(mem_lst, used_lst, ram, ram_size, 2, ram, 4,
 		   ram + 0x8000000, 0x10010000, 0, 0);
 
 	/* check that allocating outside memory fails */
 	if (ram_end != 0) {
 		ret = lmb_alloc_addr(ram_end, 1, LMB_NONE);
-		ut_asserteq(ret, 0);
+		ut_asserteq(ret, -1);
 	}
 	if (ram != 0) {
 		ret = lmb_alloc_addr(ram - 1, 1, LMB_NONE);
-		ut_asserteq(ret, 0);
+		ut_asserteq(ret, -1);
 	}
 
 	lmb_pop(&store);

tools/qconfig.py

@@ -1453,7 +1453,7 @@ def do_scan_source(path, do_update):
     print('\nCONFIG options used as Proper in Makefiles but without a non-xPL_ variant:')
     not_found = check_not_found(all_uses, MODE_PROPER)
     show_uses(not_found)
-    proper_not_found |= {not_found.keys()}
+    proper_not_found |= not_found.keys()
 
     # Scan the source code
     all_uses, _ = scan_src_files(src_list)
@@ -1471,7 +1471,7 @@ def do_scan_source(path, do_update):
     print('\nCONFIG options used as Proper in source but without a non-xPL_ variant:')
     not_found = check_not_found(all_uses, MODE_PROPER)
     show_uses(not_found)
-    proper_not_found |= {not_found.keys()}
+    proper_not_found |= not_found.keys()
 
     print('\nCONFIG options used as SPL but without an xPL_ variant:')
     for item in sorted(spl_not_found):

tools/sfspl.c

@@ -70,11 +70,14 @@ static int sfspl_verify_header(unsigned char *buf, int size,
 		printf("Truncated file\n");
 		return EXIT_FAILURE;
 	}
+	if ((size_t)size > hdr_size + file_size)
+		printf("File too long, expected %u bytes\n",
+		       hdr_size + file_size);
 	if (hdr->version != DEFAULT_VERSION) {
 		printf("Unknown file format version\n");
 		return EXIT_FAILURE;
 	}
-	crc_check = crc32(0, &buf[hdr_size], size - hdr_size);
+	crc_check = crc32(0, &buf[hdr_size], file_size);
 	if (crc_check != crc) {
 		printf("Incorrect CRC32\n");
 		return EXIT_FAILURE;