[PATCH v2 0/4] firmware: raspberrypi: Add support for the tryboot mode

[PATCH v2 0/4] firmware: raspberrypi: Add support for the tryboot mode

[Gregor Herburger]

This adds support for the tryboot mode on Raspberry Pis. As there is no
documentation other than the downstream implementation [0] the
implementation is based on this.

I tested this on Raspberry Pi 5 and therefore I only added the
properties to this devicetree. But afaik this should work on all
Raspberry Pis. I will add it to the correspondings dts if I get some
hardware to test it.

[0] https://github.com/raspberrypi/linux/commit/eb56da0c1925c07e8929ce4c9fe8aeafa7cb8c7b

---
Changes in v2:
- Remove unnecessary reboot_mode_unregister().
- dt-binding: restrict to mode-{normal,tryboot} and only allow 32bit value.
- Link to v1: https://patch.msgid.link/20260626-rpi-tryboot-v1-0-490b1c4c4970@linutronix.de

---
Gregor Herburger (4):
      firmware: raspberrypi: reorder rpi_firmware_property_tag enum
      dt-bindings: raspberrypi,bcm2835-firmware: Include 'reboot-mode.yaml'
      firmware: raspberrypi: Add reboot mode support
      arm64: dts: broadcom: bcm2712: Add reboot modes to firmware node

 .../arm/bcm/raspberrypi,bcm2835-firmware.yaml      |  9 +++++++++
 .../boot/dts/broadcom/bcm2712-rpi-5-b-base.dtsi    |  2 ++
 drivers/firmware/Kconfig                           |  1 +
 drivers/firmware/raspberrypi.c                     | 23 ++++++++++++++++++++++
 include/soc/bcm2835/raspberrypi-firmware.h         | 22 +++++++++++----------
 5 files changed, 47 insertions(+), 10 deletions(-)
---
base-commit: 8cd9520d35a6c38db6567e97dd93b1f11f185dc6
change-id: 20260623-rpi-tryboot-4292c92b0727

Best regards,
--  
Gregor Herburger <gregor.herburger@linutronix.de>

[PATCH v2 1/4] firmware: raspberrypi: reorder rpi_firmware_property_tag enum

[Gregor Herburger]

The enum was once ordered by tags. The later added tags where added in
a different order. Reorder the tags again.

No functional change intended.

Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
---
 include/soc/bcm2835/raspberrypi-firmware.h | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index e1f87fbfe5542..66cc5a426c3c5 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -72,26 +72,26 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_GET_EDID_BLOCK =                         0x00030020,
 	RPI_FIRMWARE_GET_CUSTOMER_OTP =                       0x00030021,
 	RPI_FIRMWARE_GET_DOMAIN_STATE =                       0x00030030,
+	RPI_FIRMWARE_GET_GPIO_STATE =                         0x00030041,
+	RPI_FIRMWARE_GET_GPIO_CONFIG =                        0x00030043,
+	RPI_FIRMWARE_GET_PERIPH_REG =                         0x00030045,
 	RPI_FIRMWARE_GET_THROTTLED =                          0x00030046,
 	RPI_FIRMWARE_GET_CLOCK_MEASURED =                     0x00030047,
 	RPI_FIRMWARE_NOTIFY_REBOOT =                          0x00030048,
+	RPI_FIRMWARE_GET_POE_HAT_VAL =                        0x00030049,
+	RPI_FIRMWARE_SET_POE_HAT_VAL =                        0x00030050,
+	RPI_FIRMWARE_NOTIFY_XHCI_RESET =                      0x00030058,
+	RPI_FIRMWARE_NOTIFY_DISPLAY_DONE =                    0x00030066,
 	RPI_FIRMWARE_SET_CLOCK_STATE =                        0x00038001,
 	RPI_FIRMWARE_SET_CLOCK_RATE =                         0x00038002,
 	RPI_FIRMWARE_SET_VOLTAGE =                            0x00038003,
 	RPI_FIRMWARE_SET_TURBO =                              0x00038009,
 	RPI_FIRMWARE_SET_CUSTOMER_OTP =                       0x00038021,
 	RPI_FIRMWARE_SET_DOMAIN_STATE =                       0x00038030,
-	RPI_FIRMWARE_GET_GPIO_STATE =                         0x00030041,
 	RPI_FIRMWARE_SET_GPIO_STATE =                         0x00038041,
 	RPI_FIRMWARE_SET_SDHOST_CLOCK =                       0x00038042,
-	RPI_FIRMWARE_GET_GPIO_CONFIG =                        0x00030043,
 	RPI_FIRMWARE_SET_GPIO_CONFIG =                        0x00038043,
-	RPI_FIRMWARE_GET_PERIPH_REG =                         0x00030045,
 	RPI_FIRMWARE_SET_PERIPH_REG =                         0x00038045,
-	RPI_FIRMWARE_GET_POE_HAT_VAL =                        0x00030049,
-	RPI_FIRMWARE_SET_POE_HAT_VAL =                        0x00030050,
-	RPI_FIRMWARE_NOTIFY_XHCI_RESET =                      0x00030058,
-	RPI_FIRMWARE_NOTIFY_DISPLAY_DONE =                    0x00030066,
 
 	/* Dispmanx TAGS */
 	RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE =                   0x00040001,
@@ -107,7 +107,6 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_GET_PALETTE =                0x0004000b,
 	RPI_FIRMWARE_FRAMEBUFFER_GET_TOUCHBUF =               0x0004000f,
 	RPI_FIRMWARE_FRAMEBUFFER_GET_GPIOVIRTBUF =            0x00040010,
-	RPI_FIRMWARE_FRAMEBUFFER_RELEASE =                    0x00048001,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_PHYSICAL_WIDTH_HEIGHT = 0x00044003,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VIRTUAL_WIDTH_HEIGHT =  0x00044004,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_DEPTH =                 0x00044005,
@@ -117,6 +116,7 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_OVERSCAN =              0x0004400a,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_PALETTE =               0x0004400b,
 	RPI_FIRMWARE_FRAMEBUFFER_TEST_VSYNC =                 0x0004400e,
+	RPI_FIRMWARE_FRAMEBUFFER_RELEASE =                    0x00048001,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT =  0x00048003,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT =   0x00048004,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_DEPTH =                  0x00048005,
@@ -125,10 +125,10 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_FRAMEBUFFER_SET_VIRTUAL_OFFSET =         0x00048009,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_OVERSCAN =               0x0004800a,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_PALETTE =                0x0004800b,
-	RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF =               0x0004801f,
-	RPI_FIRMWARE_FRAMEBUFFER_SET_GPIOVIRTBUF =            0x00048020,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_VSYNC =                  0x0004800e,
 	RPI_FIRMWARE_FRAMEBUFFER_SET_BACKLIGHT =              0x0004800f,
+	RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF =               0x0004801f,
+	RPI_FIRMWARE_FRAMEBUFFER_SET_GPIOVIRTBUF =            0x00048020,
 
 	RPI_FIRMWARE_VCHIQ_INIT =                             0x00048010,
 

-- 
2.47.3

[PATCH v2 2/4] dt-bindings: raspberrypi,bcm2835-firmware: Include 'reboot-mode.yaml'

[Gregor Herburger]

The Raspberry Pi firmware allows to set a reboot mode called tryboot
that allows to try booting from a different partition to allow updating
of the boot partition. Allow reboot mode properties by referencing the
reboot-mode schema. The firmware allows a 32bit value to be sent as
reboot flag so restrict the maxItems to 1.

Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
---
 .../bindings/arm/bcm/raspberrypi,bcm2835-firmware.yaml           | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/Documentation/devicetree/bindings/arm/bcm/raspberrypi,bcm2835-firmware.yaml b/Documentation/devicetree/bindings/arm/bcm/raspberrypi,bcm2835-firmware.yaml
index 983ea80eaec97..28c5713860468 100644
--- a/Documentation/devicetree/bindings/arm/bcm/raspberrypi,bcm2835-firmware.yaml
+++ b/Documentation/devicetree/bindings/arm/bcm/raspberrypi,bcm2835-firmware.yaml
@@ -133,6 +133,15 @@ properties:
     required:
       - compatible
 
+  mode-normal:
+    maxItems: 1
+
+  mode-tryboot:
+    maxItems: 1
+
+allOf:
+  - $ref: /schemas/power/reset/reboot-mode.yaml#
+
 required:
   - compatible
   - mboxes

-- 
2.47.3

[PATCH v2 3/4] firmware: raspberrypi: Add reboot mode support

[Gregor Herburger]

The Raspberry Pi firmware has a tryboot mode where it tries to boot from
another partition. This can be used to create a A/B update schema.

To enable this on the next boot the RPI_FIRMWARE_SET_REBOOT_FLAGS
message must be send to the firmware.

Add support for this by registering a reboot mode driver.

Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
---
 drivers/firmware/Kconfig                   |  1 +
 drivers/firmware/raspberrypi.c             | 23 +++++++++++++++++++++++
 include/soc/bcm2835/raspberrypi-firmware.h |  2 ++
 3 files changed, 26 insertions(+)

diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index bbd2155d84838..04bc8263e0017 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -115,6 +115,7 @@ config ISCSI_IBFT
 config RASPBERRYPI_FIRMWARE
 	tristate "Raspberry Pi Firmware Driver"
 	depends on BCM2835_MBOX
+	select REBOOT_MODE
 	help
 	  This option enables support for communicating with the firmware on the
 	  Raspberry Pi.
diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index 0aa322e9a2e73..bba8d14604002 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -14,6 +14,7 @@
 #include <linux/of.h>
 #include <linux/of_platform.h>
 #include <linux/platform_device.h>
+#include <linux/reboot-mode.h>
 #include <linux/slab.h>
 #include <soc/bcm2835/raspberrypi-firmware.h>
 
@@ -29,6 +30,7 @@ struct rpi_firmware {
 	struct mbox_client cl;
 	struct mbox_chan *chan; /* The property channel. */
 	struct completion c;
+	struct reboot_mode_driver reboot_mode;
 	u32 enabled;
 
 	struct kref consumers;
@@ -273,10 +275,25 @@ static void devm_rpi_firmware_put(void *data)
 	rpi_firmware_put(fw);
 }
 
+static int rpi_firmware_reboot_mode_write(struct reboot_mode_driver *reboot,
+					  unsigned int magic)
+{
+	struct rpi_firmware *fw = container_of(reboot, struct rpi_firmware,
+					       reboot_mode);
+	int ret = 0;
+
+	if (magic)
+		ret = rpi_firmware_property(fw, RPI_FIRMWARE_SET_REBOOT_FLAGS,
+					    &magic, sizeof(magic));
+
+	return ret;
+}
+
 static int rpi_firmware_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct rpi_firmware *fw;
+	int ret;
 
 	/*
 	 * Memory will be freed by rpi_firmware_delete() once all users have
@@ -306,6 +323,12 @@ static int rpi_firmware_probe(struct platform_device *pdev)
 	rpi_register_hwmon_driver(dev, fw);
 	rpi_register_clk_driver(dev);
 
+	fw->reboot_mode.dev = dev;
+	fw->reboot_mode.write = rpi_firmware_reboot_mode_write;
+	ret = devm_reboot_mode_register(dev, &fw->reboot_mode);
+	if (ret)
+		dev_err(dev, "Failed to register reboot mode: %d\n", ret);
+
 	return 0;
 }
 
diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
index 66cc5a426c3c5..f905bff0fb3ea 100644
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
@@ -81,6 +81,7 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_GET_POE_HAT_VAL =                        0x00030049,
 	RPI_FIRMWARE_SET_POE_HAT_VAL =                        0x00030050,
 	RPI_FIRMWARE_NOTIFY_XHCI_RESET =                      0x00030058,
+	RPI_FIRMWARE_GET_REBOOT_FLAGS =                       0x00030064,
 	RPI_FIRMWARE_NOTIFY_DISPLAY_DONE =                    0x00030066,
 	RPI_FIRMWARE_SET_CLOCK_STATE =                        0x00038001,
 	RPI_FIRMWARE_SET_CLOCK_RATE =                         0x00038002,
@@ -92,6 +93,7 @@ enum rpi_firmware_property_tag {
 	RPI_FIRMWARE_SET_SDHOST_CLOCK =                       0x00038042,
 	RPI_FIRMWARE_SET_GPIO_CONFIG =                        0x00038043,
 	RPI_FIRMWARE_SET_PERIPH_REG =                         0x00038045,
+	RPI_FIRMWARE_SET_REBOOT_FLAGS =                       0x00038064,
 
 	/* Dispmanx TAGS */
 	RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE =                   0x00040001,

-- 
2.47.3

[PATCH v2 4/4] arm64: dts: broadcom: bcm2712: Add reboot modes to firmware node

[Gregor Herburger]

The raspberry pi firmware driver allows the tryboot reboot mode. Add
this mode and normal boot mode to the node.

Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
---
 arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b-base.dtsi | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b-base.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b-base.dtsi
index b7a6bc34ae1ab..67095c7ff770d 100644
--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b-base.dtsi
+++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b-base.dtsi
@@ -49,6 +49,8 @@ firmware: rpi-firmware {
 			compatible = "raspberrypi,bcm2835-firmware", "simple-mfd";
 
 			mboxes = <&mailbox>;
+			mode-normal = <0>;
+			mode-tryboot = <1>;
 
 			firmware_clocks: clocks {
 				compatible = "raspberrypi,firmware-clocks";

-- 
2.47.3

Re: [PATCH v2 4/4] arm64: dts: broadcom: bcm2712: Add reboot modes to firmware node

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free in devm_reboot_mode_unregister during driver unbind
- [High] Endianness bug in reboot mode magic value parsing
--

commit 29798275c02dc4226f698253632e8ea76033c96b
Author: Gregor Herburger <gregor.herburger@linutronix.de>

arm64: dts: broadcom: bcm2712: Add reboot modes to firmware node

The raspberry pi firmware driver allows the tryboot reboot mode. Add
this mode and normal boot mode to the node.

> diff --git a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b-base.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b-base.dtsi
> index b7a6bc34ae1ab..67095c7ff770d 100644
> --- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b-base.dtsi
> +++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b-base.dtsi
> @@ -49,6 +49,8 @@ firmware: rpi-firmware {
>  			compatible = "raspberrypi,bcm2835-firmware", "simple-mfd";
>  
>  			mboxes = <&mailbox>;
> +			mode-normal = <0>;
> +			mode-tryboot = <1>;

[Severity: High]
This is a pre-existing issue, but enabling the reboot mode in the device
tree exposes a use-after-free during driver unbind.

The reboot mode is registered using devres, but is embedded in a manually
refcounted struct:

drivers/firmware/raspberrypi.c:rpi_firmware_probe() {
    ...
    fw->reboot_mode.dev = dev;
    fw->reboot_mode.write = rpi_firmware_reboot_mode_write;
    ret = devm_reboot_mode_register(dev, &fw->reboot_mode);
    ...
}

When the driver is unbound, rpi_firmware_remove() drops the final reference
to fw, freeing it before devres cleanup runs:

drivers/firmware/raspberrypi.c:rpi_firmware_remove() {
    ...
    rpi_firmware_put(fw);
    ...
}

Will this cause memory corruption when the driver core later invokes
devm_reboot_mode_release() and accesses &fw->reboot_mode?


[Severity: High]
This is a pre-existing issue, but does this feature work correctly on
big-endian kernels?

The CPU-endian magic variable is passed by reference to the hardware
communication layer without cpu_to_le32() conversion:

drivers/firmware/raspberrypi.c:rpi_firmware_reboot_mode_write() {
    ...
    if (magic)
        ret = rpi_firmware_property(fw, RPI_FIRMWARE_SET_REBOOT_FLAGS,
                                    &magic, sizeof(magic));
    ...
}

Since the reboot-mode framework parses the device tree property into a
CPU-endian unsigned int, passing it directly to rpi_firmware_property() will
send the wrong value to the little-endian VideoCore firmware.

Should magic be converted to little-endian before it is sent to the firmware?

>  
>  			firmware_clocks: clocks {
>  				compatible = "raspberrypi,firmware-clocks";

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630-rpi-tryboot-v2-0-f68d2dc6aa27@linutronix.de?part=4

Re: [PATCH v2 2/4] dt-bindings: raspberrypi,bcm2835-firmware: Include 'reboot-mode.yaml'

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The DT schema inadvertently rejects generic reboot mode properties due to the retention of `additionalProperties: false` alongside a `$ref` in `allOf`, contradicting the stated intent.
--

commit f839a4f18593a7083b268a49226464a9e0f0e8b5
Author: Gregor Herburger <gregor.herburger@linutronix.de>

dt-bindings: raspberrypi,bcm2835-firmware: Include 'reboot-mode.yaml'

This commit allows reboot mode properties by referencing the
reboot-mode.yaml schema for the Raspberry Pi firmware. It restricts the
maxItems to 1 for specific modes because the firmware accepts a 32-bit
reboot flag.

> diff --git a/Documentation/devicetree/bindings/arm/bcm/raspberrypi,bcm2835-firmware.yaml b/Documentation/devicetree/bindings/arm/bcm/raspberrypi,bcm2835-firmware.yaml
> index 983ea80eaec97..28c5713860468 100644
> --- a/Documentation/devicetree/bindings/arm/bcm/raspberrypi,bcm2835-firmware.yaml
> +++ b/Documentation/devicetree/bindings/arm/bcm/raspberrypi,bcm2835-firmware.yaml
[ ... ]
> @@ -133,6 +133,15 @@ properties:
>      required:
>        - compatible
>  
> +  mode-normal:
> +    maxItems: 1
> +
> +  mode-tryboot:
> +    maxItems: 1
> +
> +allOf:
> +  - $ref: /schemas/power/reset/reboot-mode.yaml#
> +

[Severity: Medium]
Will this schema inadvertently reject generic reboot mode properties due to
the retention of additionalProperties: false later in the file?

Because additionalProperties: false is used instead of
unevaluatedProperties: false, properties defined in the referenced
reboot-mode.yaml schema but omitted here are rejected. This prevents device
trees from using other standard reboot modes like mode-recovery or
mode-bootloader.

Could the mode-normal and mode-tryboot properties be replaced with a single
patternProperties rule for ^mode-.*$ to enforce the 32-bit cell restriction
across all reboot modes, while changing the schema to use
unevaluatedProperties: false?

>  required:
>    - compatible
>    - mboxes

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630-rpi-tryboot-v2-0-f68d2dc6aa27@linutronix.de?part=2

Re: [PATCH v2 3/4] firmware: raspberrypi: Add reboot mode support

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Critical] Use-After-Free in devm_reboot_mode_release due to incorrect devres registration.
- [Medium] The reboot mode magic value is sent to the firmware in CPU byte order, which breaks on big-endian kernels.
- [Low] RASPBERRYPI_FIRMWARE selects REBOOT_MODE without depending on POWER_RESET, causing a linker error.
--

commit c3a66741771139fdb5972557da035f4b4fb75ce1
Author: Gregor Herburger <gregor.herburger@linutronix.de>

firmware: raspberrypi: Add reboot mode support

The Raspberry Pi firmware has a tryboot mode where it tries to boot from
another partition. This can be used to create a A/B update schema. Add
support for this by registering a reboot mode driver.

> diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
> --- a/drivers/firmware/Kconfig
> +++ b/drivers/firmware/Kconfig
> @@ -115,6 +115,7 @@ config ISCSI_IBFT
>  config RASPBERRYPI_FIRMWARE
>  	tristate "Raspberry Pi Firmware Driver"
>  	depends on BCM2835_MBOX
> +	select REBOOT_MODE

[Severity: Low]
Since REBOOT_MODE implicitly depends on POWER_RESET, does selecting it here
without also adding `depends on POWER_RESET` cause unmet direct dependency
warnings and subsequent linker errors when POWER_RESET is disabled?

>  	help
>  	  This option enables support for communicating with the firmware on the
>  	  Raspberry Pi.

[ ... ]

> diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
> --- a/drivers/firmware/raspberrypi.c
> +++ b/drivers/firmware/raspberrypi.c

[ ... ]

> @@ -273,10 +275,25 @@ static void devm_rpi_firmware_put(void *data)
>  	rpi_firmware_put(fw);
>  }
>  
> +static int rpi_firmware_reboot_mode_write(struct reboot_mode_driver *reboot,
> +					  unsigned int magic)
> +{
> +	struct rpi_firmware *fw = container_of(reboot, struct rpi_firmware,
> +					       reboot_mode);
> +	int ret = 0;
> +
> +	if (magic)
> +		ret = rpi_firmware_property(fw, RPI_FIRMWARE_SET_REBOOT_FLAGS,
> +					    &magic, sizeof(magic));

[Severity: Medium]
The `magic` parameter is passed by reference directly to the firmware here.

Since the firmware expects a little-endian 32-bit value, does this cause
the reboot mode flag to be misinterpreted on big-endian kernels?

Should this value be converted with `cpu_to_le32()` before sending it?

> +
> +	return ret;
> +}

[ ... ]

> @@ -306,6 +323,12 @@ static int rpi_firmware_probe(struct platform_device *pdev)
>  	rpi_register_hwmon_driver(dev, fw);
>  	rpi_register_clk_driver(dev);
>  
> +	fw->reboot_mode.dev = dev;
> +	fw->reboot_mode.write = rpi_firmware_reboot_mode_write;
> +	ret = devm_reboot_mode_register(dev, &fw->reboot_mode);

[Severity: Critical]
Does unbinding the driver lead to a use-after-free in the devres cleanup
phase?

The `fw` structure is allocated and managed by a kref, which gets dropped in
`rpi_firmware_remove()` when the driver unbinds, freeing the `fw` memory.

However, `devm_reboot_mode_register()` ties the cleanup of the reboot mode
driver to the device's devres lifecycle. Since devres cleanup happens after
the remove function returns, `devm_reboot_mode_release()` will attempt to
access `&fw->reboot_mode` after the memory has already been freed.

> +	if (ret)
> +		dev_err(dev, "Failed to register reboot mode: %d\n", ret);
> +
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630-rpi-tryboot-v2-0-f68d2dc6aa27@linutronix.de?part=3

Re: [PATCH v2 3/4] firmware: raspberrypi: Add reboot mode support

[Stefan Wahren]

Hi Gregor,

Am 30.06.26 um 22:59 schrieb Gregor Herburger:
> The Raspberry Pi firmware has a tryboot mode where it tries to boot from
> another partition. This can be used to create a A/B update schema.
>
> To enable this on the next boot the RPI_FIRMWARE_SET_REBOOT_FLAGS
> message must be send to the firmware.
>
> Add support for this by registering a reboot mode driver.
>
> Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
> ---
>   drivers/firmware/Kconfig                   |  1 +
>   drivers/firmware/raspberrypi.c             | 23 +++++++++++++++++++++++
>   include/soc/bcm2835/raspberrypi-firmware.h |  2 ++
>   3 files changed, 26 insertions(+)
>
> diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
> index bbd2155d84838..04bc8263e0017 100644
> --- a/drivers/firmware/Kconfig
> +++ b/drivers/firmware/Kconfig
> @@ -115,6 +115,7 @@ config ISCSI_IBFT
>   config RASPBERRYPI_FIRMWARE
>   	tristate "Raspberry Pi Firmware Driver"
>   	depends on BCM2835_MBOX
> +	select REBOOT_MODE
>   	help
>   	  This option enables support for communicating with the firmware on the
>   	  Raspberry Pi.
> diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
> index 0aa322e9a2e73..bba8d14604002 100644
> --- a/drivers/firmware/raspberrypi.c
> +++ b/drivers/firmware/raspberrypi.c
> @@ -14,6 +14,7 @@
>   #include <linux/of.h>
>   #include <linux/of_platform.h>
>   #include <linux/platform_device.h>
> +#include <linux/reboot-mode.h>
>   #include <linux/slab.h>
>   #include <soc/bcm2835/raspberrypi-firmware.h>
>   
> @@ -29,6 +30,7 @@ struct rpi_firmware {
>   	struct mbox_client cl;
>   	struct mbox_chan *chan; /* The property channel. */
>   	struct completion c;
> +	struct reboot_mode_driver reboot_mode;
>   	u32 enabled;
>   
>   	struct kref consumers;
> @@ -273,10 +275,25 @@ static void devm_rpi_firmware_put(void *data)
>   	rpi_firmware_put(fw);
>   }
>   
> +static int rpi_firmware_reboot_mode_write(struct reboot_mode_driver *reboot,
> +					  unsigned int magic)
> +{
> +	struct rpi_firmware *fw = container_of(reboot, struct rpi_firmware,
> +					       reboot_mode);
> +	int ret = 0;
> +
> +	if (magic)
> +		ret = rpi_firmware_property(fw, RPI_FIRMWARE_SET_REBOOT_FLAGS,
> +					    &magic, sizeof(magic));
I think it's more elegant to check for !magic and return 0 directly. So 
we can drop "ret".
> +
> +	return ret;
> +}
> +
>   static int rpi_firmware_probe(struct platform_device *pdev)
>   {
>   	struct device *dev = &pdev->dev;
>   	struct rpi_firmware *fw;
> +	int ret;
>   
>   	/*
>   	 * Memory will be freed by rpi_firmware_delete() once all users have
> @@ -306,6 +323,12 @@ static int rpi_firmware_probe(struct platform_device *pdev)
>   	rpi_register_hwmon_driver(dev, fw);
>   	rpi_register_clk_driver(dev);
>   
> +	fw->reboot_mode.dev = dev;
> +	fw->reboot_mode.write = rpi_firmware_reboot_mode_write;
> +	ret = devm_reboot_mode_register(dev, &fw->reboot_mode);
> +	if (ret)
> +		dev_err(dev, "Failed to register reboot mode: %d\n", ret);
I suggest to move all of this code into a function called 
rpi_register_reboot_mode() ?

Best regards
> +
>   	return 0;
>   }
>   
> diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
> index 66cc5a426c3c5..f905bff0fb3ea 100644
> --- a/include/soc/bcm2835/raspberrypi-firmware.h
> +++ b/include/soc/bcm2835/raspberrypi-firmware.h
> @@ -81,6 +81,7 @@ enum rpi_firmware_property_tag {
>   	RPI_FIRMWARE_GET_POE_HAT_VAL =                        0x00030049,
>   	RPI_FIRMWARE_SET_POE_HAT_VAL =                        0x00030050,
>   	RPI_FIRMWARE_NOTIFY_XHCI_RESET =                      0x00030058,
> +	RPI_FIRMWARE_GET_REBOOT_FLAGS =                       0x00030064,
>   	RPI_FIRMWARE_NOTIFY_DISPLAY_DONE =                    0x00030066,
>   	RPI_FIRMWARE_SET_CLOCK_STATE =                        0x00038001,
>   	RPI_FIRMWARE_SET_CLOCK_RATE =                         0x00038002,
> @@ -92,6 +93,7 @@ enum rpi_firmware_property_tag {
>   	RPI_FIRMWARE_SET_SDHOST_CLOCK =                       0x00038042,
>   	RPI_FIRMWARE_SET_GPIO_CONFIG =                        0x00038043,
>   	RPI_FIRMWARE_SET_PERIPH_REG =                         0x00038045,
> +	RPI_FIRMWARE_SET_REBOOT_FLAGS =                       0x00038064,
>   
>   	/* Dispmanx TAGS */
>   	RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE =                   0x00040001,
>

Re: [PATCH v2 2/4] dt-bindings: raspberrypi,bcm2835-firmware: Include 'reboot-mode.yaml'

[Krzysztof Kozlowski]

On Tue, Jun 30, 2026 at 10:59:28PM +0200, Gregor Herburger wrote:
> The Raspberry Pi firmware allows to set a reboot mode called tryboot
> that allows to try booting from a different partition to allow updating
> of the boot partition. Allow reboot mode properties by referencing the
> reboot-mode schema. The firmware allows a 32bit value to be sent as
> reboot flag so restrict the maxItems to 1.
> 
> Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
> ---
>  .../bindings/arm/bcm/raspberrypi,bcm2835-firmware.yaml           | 9 +++++++++
>  1 file changed, 9 insertions(+)

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>

Best regards,
Krzysztof

Re: [PATCH v2 3/4] firmware: raspberrypi: Add reboot mode support

[Gregor Herburger]

Hi Stefan,

On Tue, Jun 30, 2026 at 11:57:49PM +0200, Stefan Wahren wrote:
> Hi Gregor,
> 
> Am 30.06.26 um 22:59 schrieb Gregor Herburger:
> > +static int rpi_firmware_reboot_mode_write(struct reboot_mode_driver *reboot,
> > +					  unsigned int magic)
> > +{
> > +	struct rpi_firmware *fw = container_of(reboot, struct rpi_firmware,
> > +					       reboot_mode);
> > +	int ret = 0;
> > +
> > +	if (magic)
> > +		ret = rpi_firmware_property(fw, RPI_FIRMWARE_SET_REBOOT_FLAGS,
> > +					    &magic, sizeof(magic));
> I think it's more elegant to check for !magic and return 0 directly. So we
> can drop "ret".
> > +
> > +	return ret;
> > +}
> > +
> >   static int rpi_firmware_probe(struct platform_device *pdev)
> >   {
> >   	struct device *dev = &pdev->dev;
> >   	struct rpi_firmware *fw;
> > +	int ret;
> >   	/*
> >   	 * Memory will be freed by rpi_firmware_delete() once all users have
> > @@ -306,6 +323,12 @@ static int rpi_firmware_probe(struct platform_device *pdev)
> >   	rpi_register_hwmon_driver(dev, fw);
> >   	rpi_register_clk_driver(dev);
> > +	fw->reboot_mode.dev = dev;
> > +	fw->reboot_mode.write = rpi_firmware_reboot_mode_write;
> > +	ret = devm_reboot_mode_register(dev, &fw->reboot_mode);
> > +	if (ret)
> > +		dev_err(dev, "Failed to register reboot mode: %d\n", ret);
> I suggest to move all of this code into a function called
> rpi_register_reboot_mode() ?
> 

Ok, will do. Will wait a bit for more feedback and add this to the next version.

-- 
Gregor Herburger
Linutronix GmbH | Bahnhofstrasse 3 | D-88690 Uhldingen-Mühlhofen
Phone: +49 7556 25 999 35; Fax.: +49 7556 25 999 99

Hinweise zum Datenschutz finden Sie hier (Informations on data privacy 
can be found here): https://linutronix.de/legal/data-protection.php

Linutronix GmbH | Firmensitz (Registered Office): Uhldingen-Mühlhofen | 
Registergericht (Registration Court): Amtsgericht Freiburg i.Br., HRB700 
806 | Geschäftsführer (Managing Directors): Dr. Wilfried Wessner, 
Katharina Kopp, Alexander Gieringer