u-boot: upgrade 2025.04 -> 2025.07

Upgrade to U-Boot 2025.07.

Add patches for build race conditions.
Remove the QEMU KVM USB workaround since the issue is fixed upstream.

(From OE-Core rev: bb287fade558d0138f7254876c9029da63e3087f)

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

9 files changed, 656 insertions, 6 deletions

diff --git a/meta/recipes-bsp/u-boot/files/0001-nxp-Prepare-macros-for-KVM-changes.patch b/meta/recipes-bsp/u-boot/files/0001-nxp-Prepare-macros-for-KVM-changes.patch
new file mode 100644
index 0000000000..fa34c8033e
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/0001-nxp-Prepare-macros-for-KVM-changes.patch
@@ -0,0 +1,100 @@
+From 9be804cbfde1df715d79247b27de4b388c714cde Mon Sep 17 00:00:00 2001
+From: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Date: Wed, 18 Jun 2025 09:58:12 +0300
+Subject: [PATCH 1/3] nxp: Prepare macros for KVM changes
+
+A following patch is replacing our IO accessors with
+do { ... } while(0) ones in order to make them usable with KVM.
+
+That leads to an error eventually looking like this:
+arch/arm/include/asm/io.h:62:9: error: expected expression before 'do'
+   62 |         do {                                            \
+      |         ^~
+arch/arm/include/asm/io.h:211:41: note: in expansion of macro '__raw_writel'
+  211 | #define out_arch(type,endian,a,v)       __raw_write##type(cpu_to_##endian(v),a)
+      |                                         ^~~~~~~~~~~
+arch/arm/include/asm/io.h:223:25: note: in expansion of macro 'out_arch'
+  223 | #define out_be32(a,v)   out_arch(l,be32,a,v)
+      |                         ^~~~~~~~
+drivers/spi/fsl_dspi.c:127:17: note: in expansion of macro 'out_be32'
+  127 |                 out_be32(addr, val) : out_le32(addr, val);
+      |                 ^~~~~~~~
+
+So adjust the current macros and code to be compatible with the upcoming
+change.
+
+Upstream-Status: Backport [https://github.com/u-boot/u-boot/commit/b56c0632ad62]
+Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Reviewed-by: Tom Rini <trini@konsulko.com>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+---
+ drivers/spi/fsl_dspi.c |  6 ++++--
+ include/fsl_ifc.h      | 24 ++++++++++++------------
+ 2 files changed, 16 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/spi/fsl_dspi.c b/drivers/spi/fsl_dspi.c
+index f2393c041f44..545561ad1169 100644
+--- a/drivers/spi/fsl_dspi.c
++++ b/drivers/spi/fsl_dspi.c
+@@ -123,8 +123,10 @@ static uint dspi_read32(uint flags, uint *addr)
+ 
+ static void dspi_write32(uint flags, uint *addr, uint val)
+ {
+-       flags & DSPI_FLAG_REGMAP_ENDIAN_BIG ?
+-               out_be32(addr, val) : out_le32(addr, val);
++       if (flags & DSPI_FLAG_REGMAP_ENDIAN_BIG)
++               out_be32(addr, val);
++       else
++               out_le32(addr, val);
+ }
+ 
+ static void dspi_halt(struct fsl_dspi_priv *priv, u8 halt)
+diff --git a/include/fsl_ifc.h b/include/fsl_ifc.h
+index 3ac226879303..1c363115beb2 100644
+--- a/include/fsl_ifc.h
++++ b/include/fsl_ifc.h
+@@ -803,29 +803,29 @@ void init_final_memctl_regs(void);
+        ((struct fsl_ifc_fcm *)CFG_SYS_IFC_ADDR)
+ 
+ #define get_ifc_cspr_ext(i)    \
+-               (ifc_in32(&(IFC_FCM_BASE_ADDR)->cspr_cs[i].cspr_ext))
++               ifc_in32(&(IFC_FCM_BASE_ADDR)->cspr_cs[i].cspr_ext)
+ #define get_ifc_cspr(i)                \
+-               (ifc_in32(&(IFC_FCM_BASE_ADDR)->cspr_cs[i].cspr))
++               ifc_in32(&(IFC_FCM_BASE_ADDR)->cspr_cs[i].cspr)
+ #define get_ifc_csor_ext(i)    \
+-               (ifc_in32(&(IFC_FCM_BASE_ADDR)->csor_cs[i].csor_ext))
++               ifc_in32(&(IFC_FCM_BASE_ADDR)->csor_cs[i].csor_ext)
+ #define get_ifc_csor(i)                \
+-               (ifc_in32(&(IFC_FCM_BASE_ADDR)->csor_cs[i].csor))
++               ifc_in32(&(IFC_FCM_BASE_ADDR)->csor_cs[i].csor)
+ #define get_ifc_amask(i)       \
+-               (ifc_in32(&(IFC_FCM_BASE_ADDR)->amask_cs[i].amask))
++               ifc_in32(&(IFC_FCM_BASE_ADDR)->amask_cs[i].amask)
+ #define get_ifc_ftim(i, j)     \
+-               (ifc_in32(&(IFC_FCM_BASE_ADDR)->ftim_cs[i].ftim[j]))
++               ifc_in32(&(IFC_FCM_BASE_ADDR)->ftim_cs[i].ftim[j])
+ #define set_ifc_cspr_ext(i, v) \
+-               (ifc_out32(&(IFC_FCM_BASE_ADDR)->cspr_cs[i].cspr_ext, v))
++               ifc_out32(&(IFC_FCM_BASE_ADDR)->cspr_cs[i].cspr_ext, v)
+ #define set_ifc_cspr(i, v)     \
+-               (ifc_out32(&(IFC_FCM_BASE_ADDR)->cspr_cs[i].cspr, v))
++               ifc_out32(&(IFC_FCM_BASE_ADDR)->cspr_cs[i].cspr, v)
+ #define set_ifc_csor_ext(i, v) \
+-               (ifc_out32(&(IFC_FCM_BASE_ADDR)->csor_cs[i].csor_ext, v))
++               ifc_out32(&(IFC_FCM_BASE_ADDR)->csor_cs[i].csor_ext, v)
+ #define set_ifc_csor(i, v)     \
+-               (ifc_out32(&(IFC_FCM_BASE_ADDR)->csor_cs[i].csor, v))
++               ifc_out32(&(IFC_FCM_BASE_ADDR)->csor_cs[i].csor, v)
+ #define set_ifc_amask(i, v)    \
+-               (ifc_out32(&(IFC_FCM_BASE_ADDR)->amask_cs[i].amask, v))
++               ifc_out32(&(IFC_FCM_BASE_ADDR)->amask_cs[i].amask, v)
+ #define set_ifc_ftim(i, j, v)  \
+-               (ifc_out32(&(IFC_FCM_BASE_ADDR)->ftim_cs[i].ftim[j], v))
++               ifc_out32(&(IFC_FCM_BASE_ADDR)->ftim_cs[i].ftim[j], v)
+ 
+ enum ifc_chip_sel {
+        IFC_CS0,
+-- 
+2.34.1
+
diff --git a/meta/recipes-bsp/u-boot/files/0002-arm-io.h-Fix-io-accessors-for-KVM.patch b/meta/recipes-bsp/u-boot/files/0002-arm-io.h-Fix-io-accessors-for-KVM.patch
new file mode 100644
index 0000000000..558d753d4a
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/0002-arm-io.h-Fix-io-accessors-for-KVM.patch
@@ -0,0 +1,310 @@
+From 2fc16d8de5bbe2a40ab25445936150c3250a9077 Mon Sep 17 00:00:00 2001
+From: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Date: Wed, 18 Jun 2025 09:58:13 +0300
+Subject: [PATCH 2/3] arm: io.h: Fix io accessors for KVM
+
+commit 2e2c2a5e72a8 ("arm: qemu: override flash accessors to use virtualizable instructions")
+explains why we can't have instructions with multiple output registers
+when running under QEMU + KVM and the instruction leads to an exception
+to the hypervisor.
+
+USB XHCI is such a case (MMIO) where a ldr w1, [x0], #4 is emitted for
+xhci_start() which works fine with QEMU but crashes for QEMU + KVM.
+
+These instructions cannot be emulated by KVM as they do not produce
+syndrome information data that KVM can use to infer the destination
+register, the faulting address, whether it was a load or store, or
+if it's a 32 or 64 bit general-purpose register.
+As a result an external abort is injected from QEMU, via ext_dabt_pending
+to KVM and we end up throwing an exception that looks like
+
+ U-Boot 2025.07-rc4 (Jun 10 2025 - 12:00:15 +0000)
+ [...]
+ Register 8001040 NbrPorts 8
+ Starting the controller
+ "Synchronous Abort" handler, esr 0x96000010, far 0x10100040
+ elr: 000000000005b1c8 lr : 000000000005b1ac (reloc)
+ elr: 00000000476fc1c8 lr : 00000000476fc1ac
+ x0 : 0000000010100040 x1 : 0000000000000001
+ x2 : 0000000000000000 x3 : 0000000000003e80
+ x4 : 0000000000000000 x5 : 00000000477a5694
+ x6 : 0000000000000038 x7 : 000000004666f360
+ x8 : 0000000000000000 x9 : 00000000ffffffd8
+ x10: 000000000000000d x11: 0000000000000006
+ x12: 0000000046560a78 x13: 0000000046560dd0
+ x14: 00000000ffffffff x15: 000000004666eed2
+ x16: 00000000476ee2f0 x17: 0000000000000000
+ x18: 0000000046660dd0 x19: 000000004666f480
+ x20: 0000000000000000 x21: 0000000010100040
+ x22: 0000000010100000 x23: 0000000000000000
+ x24: 0000000000000000 x25: 0000000000000000
+ x26: 0000000000000000 x27: 0000000000000000
+ x28: 0000000000000000 x29: 000000004666f360
+
+ Code: d5033fbf aa1503e0 5287d003 52800002 (b8004401)
+ Resetting CPU ...
+
+There are two problems making this the default.
+- It will emit ldr + add or str + add instead of ldr/str(post increment)
+  in somne cases
+- Some platforms that depend on TPL/SPL grow in size enough so that the
+  binary doesn't fit anymore.
+
+So let's add proper I/O accessors add a Kconfig option
+to turn it off by default apart from our QEMU builds.
+
+Upstream-Status: Backport [https://github.com/u-boot/u-boot/commit/dc512700ad46]
+Reported-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+Tested-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+---
+ arch/arm/Kconfig          |  12 +++
+ arch/arm/include/asm/io.h | 152 ++++++++++++++++++++++++++++----------
+ 2 files changed, 124 insertions(+), 40 deletions(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 6ff3f2750ea8..f6430a5aaf07 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -108,6 +108,18 @@ config LNX_KRNL_IMG_TEXT_OFFSET_BASE
+          The value subtracted from CONFIG_TEXT_BASE to calculate the
+          TEXT_OFFSET value written to the Linux kernel image header.
+ 
++config KVM_VIRT_INS
++       bool "Emit virtualizable instructions"
++       help
++         Instructions in the ARM ISA that have multiple output registers,
++         can't be used if the instruction leads to an exception to the hypervisor.
++         These instructions cannot be emulated by KVM because they do not produce
++         syndrome information data that KVM can use to infer the destination
++         register, the faulting address, whether it was a load or store,
++         if it's a 32 or 64 bit general-purpose register amongst other things.
++         Use this to produce virtualizable instructions if you plan to run U-Boot
++         with KVM.
++
+ config NVIC
+        bool
+ 
+diff --git a/arch/arm/include/asm/io.h b/arch/arm/include/asm/io.h
+index 89b1015bc4d3..85ec0e6937e8 100644
+--- a/arch/arm/include/asm/io.h
++++ b/arch/arm/include/asm/io.h
+@@ -20,23 +20,108 @@ static inline void sync(void)
+ {
+ }
+ 
+-/* Generic virtual read/write. */
+-#define __arch_getb(a)                 (*(volatile unsigned char *)(a))
+-#define __arch_getw(a)                 (*(volatile unsigned short *)(a))
+-#define __arch_getl(a)                 (*(volatile unsigned int *)(a))
+-#define __arch_getq(a)                 (*(volatile unsigned long long *)(a))
++#ifdef CONFIG_ARM64
++#define __W    "w"
++#else
++#define __W
++#endif
++
++#if CONFIG_IS_ENABLED(SYS_THUMB_BUILD)
++#define __R "l"
++#define __RM "=l"
++#else
++#define __R "r"
++#define __RM "=r"
++#endif
+ 
+-#define __arch_putb(v,a)               (*(volatile unsigned char *)(a) = (v))
+-#define __arch_putw(v,a)               (*(volatile unsigned short *)(a) = (v))
+-#define __arch_putl(v,a)               (*(volatile unsigned int *)(a) = (v))
+-#define __arch_putq(v,a)               (*(volatile unsigned long long *)(a) = (v))
++#ifdef CONFIG_KVM_VIRT_INS
++/*
++ * The __raw_writeX/__raw_readX below should be converted to static inline
++ * functions. However doing so produces a lot of compilation warnings when
++ * called with a raw address. Convert these once the callers have been fixed.
++ */
++#define __raw_writeb(val, addr)                        \
++       do {                                    \
++               asm volatile("strb %" __W "0, [%1]"     \
++               :                               \
++               : __R ((u8)(val)), __R (addr)); \
++       } while (0)
++
++#define __raw_readb(addr)                              \
++       ({                                              \
++               u32 __val;                              \
++               asm volatile("ldrb %" __W "0, [%1]"             \
++               : __RM (__val)                          \
++               : __R (addr));                          \
++               __val;                                  \
++       })
++
++#define __raw_writew(val, addr)                        \
++       do {                                    \
++               asm volatile("strh %" __W "0, [%1]"     \
++               :                                       \
++               : __R ((u16)(val)), __R (addr));        \
++       } while (0)
++
++#define __raw_readw(addr)                              \
++       ({                                              \
++               u32 __val;                              \
++               asm volatile("ldrh %" __W "0, [%1]"             \
++               : __RM (__val)                          \
++               : __R (addr));                          \
++       __val;                                          \
++    })
++
++#define __raw_writel(val, addr)                                \
++       do {                                            \
++               asm volatile("str %" __W "0, [%1]"              \
++               :                                       \
++               : __R ((u32)(val)), __R (addr));        \
++       } while (0)
++
++#define __raw_readl(addr)                              \
++       ({                                              \
++               u32 __val;                              \
++               asm volatile("ldr %" __W "0, [%1]"              \
++               : __RM (__val)                          \
++               : __R (addr));                          \
++               __val;                                  \
++       })
++
++#define __raw_writeq(val, addr)                                \
++       do {                                            \
++               asm volatile("str %0, [%1]"             \
++               :                                       \
++               : __R ((u64)(val)), __R (addr));        \
++       } while (0)
++
++#define __raw_readq(addr)                              \
++       ({                                              \
++               u64 __val;                              \
++               asm volatile("ldr %0, [%1]"             \
++               : __RM (__val)                          \
++               : __R (addr));                          \
++               __val;                                  \
++           })
++#else
++/* Generic virtual read/write. */
++#define __raw_readb(a)                 (*(volatile unsigned char *)(a))
++#define __raw_readw(a)                 (*(volatile unsigned short *)(a))
++#define __raw_readl(a)                 (*(volatile unsigned int *)(a))
++#define __raw_readq(a)                 (*(volatile unsigned long long *)(a))
++
++#define __raw_writeb(v, a)             (*(volatile unsigned char *)(a) = (v))
++#define __raw_writew(v, a)             (*(volatile unsigned short *)(a) = (v))
++#define __raw_writel(v, a)             (*(volatile unsigned int *)(a) = (v))
++#define __raw_writeq(v, a)             (*(volatile unsigned long long *)(a) = (v))
++#endif
+ 
+ static inline void __raw_writesb(unsigned long addr, const void *data,
+                                 int bytelen)
+ {
+        uint8_t *buf = (uint8_t *)data;
+        while(bytelen--)
+-               __arch_putb(*buf++, addr);
++               __raw_writeb(*buf++, addr);
+ }
+ 
+ static inline void __raw_writesw(unsigned long addr, const void *data,
+@@ -44,7 +129,7 @@ static inline void __raw_writesw(unsigned long addr, const void *data,
+ {
+        uint16_t *buf = (uint16_t *)data;
+        while(wordlen--)
+-               __arch_putw(*buf++, addr);
++               __raw_writew(*buf++, addr);
+ }
+ 
+ static inline void __raw_writesl(unsigned long addr, const void *data,
+@@ -52,40 +137,30 @@ static inline void __raw_writesl(unsigned long addr, const void *data,
+ {
+        uint32_t *buf = (uint32_t *)data;
+        while(longlen--)
+-               __arch_putl(*buf++, addr);
++               __raw_writel(*buf++, addr);
+ }
+ 
+ static inline void __raw_readsb(unsigned long addr, void *data, int bytelen)
+ {
+        uint8_t *buf = (uint8_t *)data;
+        while(bytelen--)
+-               *buf++ = __arch_getb(addr);
++               *buf++ = __raw_readb(addr);
+ }
+ 
+ static inline void __raw_readsw(unsigned long addr, void *data, int wordlen)
+ {
+        uint16_t *buf = (uint16_t *)data;
+        while(wordlen--)
+-               *buf++ = __arch_getw(addr);
++               *buf++ = __raw_readw(addr);
+ }
+ 
+ static inline void __raw_readsl(unsigned long addr, void *data, int longlen)
+ {
+        uint32_t *buf = (uint32_t *)data;
+        while(longlen--)
+-               *buf++ = __arch_getl(addr);
++               *buf++ = __raw_readl(addr);
+ }
+ 
+-#define __raw_writeb(v,a)      __arch_putb(v,a)
+-#define __raw_writew(v,a)      __arch_putw(v,a)
+-#define __raw_writel(v,a)      __arch_putl(v,a)
+-#define __raw_writeq(v,a)      __arch_putq(v,a)
+-
+-#define __raw_readb(a)         __arch_getb(a)
+-#define __raw_readw(a)         __arch_getw(a)
+-#define __raw_readl(a)         __arch_getl(a)
+-#define __raw_readq(a)         __arch_getq(a)
+-
+ /*
+  * TODO: The kernel offers some more advanced versions of barriers, it might
+  * have some advantages to use them instead of the simple one here.
+@@ -98,15 +173,15 @@ static inline void __raw_readsl(unsigned long addr, void *data, int longlen)
+ 
+ #define smp_processor_id()     0
+ 
+-#define writeb(v,c)    ({ u8  __v = v; __iowmb(); __arch_putb(__v,c); __v; })
+-#define writew(v,c)    ({ u16 __v = v; __iowmb(); __arch_putw(__v,c); __v; })
+-#define writel(v,c)    ({ u32 __v = v; __iowmb(); __arch_putl(__v,c); __v; })
+-#define writeq(v,c)    ({ u64 __v = v; __iowmb(); __arch_putq(__v,c); __v; })
++#define writeb(v, c)   ({ u8  __v = v; __iowmb(); writeb_relaxed(__v, c); __v; })
++#define writew(v, c)   ({ u16 __v = v; __iowmb(); writew_relaxed(__v, c); __v; })
++#define writel(v, c)   ({ u32 __v = v; __iowmb(); writel_relaxed(__v, c); __v; })
++#define writeq(v, c)   ({ u64 __v = v; __iowmb(); writeq_relaxed(__v, c); __v; })
+ 
+-#define readb(c)       ({ u8  __v = __arch_getb(c); __iormb(); __v; })
+-#define readw(c)       ({ u16 __v = __arch_getw(c); __iormb(); __v; })
+-#define readl(c)       ({ u32 __v = __arch_getl(c); __iormb(); __v; })
+-#define readq(c)       ({ u64 __v = __arch_getq(c); __iormb(); __v; })
++#define readb(c)       ({ u8  __v = readb_relaxed(c); __iormb(); __v; })
++#define readw(c)       ({ u16 __v = readw_relaxed(c); __iormb(); __v; })
++#define readl(c)       ({ u32 __v = readl_relaxed(c); __iormb(); __v; })
++#define readq(c)       ({ u64 __v = readq_relaxed(c); __iormb(); __v; })
+ 
+ /*
+  * Relaxed I/O memory access primitives. These follow the Device memory
+@@ -121,13 +196,10 @@ static inline void __raw_readsl(unsigned long addr, void *data, int longlen)
+ #define readq_relaxed(c)       ({ u64 __r = le64_to_cpu((__force __le64) \
+                                                __raw_readq(c)); __r; })
+ 
+-#define writeb_relaxed(v, c)   ((void)__raw_writeb((v), (c)))
+-#define writew_relaxed(v, c)   ((void)__raw_writew((__force u16) \
+-                                                   cpu_to_le16(v), (c)))
+-#define writel_relaxed(v, c)   ((void)__raw_writel((__force u32) \
+-                                                   cpu_to_le32(v), (c)))
+-#define writeq_relaxed(v, c)   ((void)__raw_writeq((__force u64) \
+-                                                   cpu_to_le64(v), (c)))
++#define writeb_relaxed(v, c)   __raw_writeb((v), (c))
++#define writew_relaxed(v, c)   __raw_writew((__force u16)cpu_to_le16(v), (c))
++#define writel_relaxed(v, c)   __raw_writel((__force u32)cpu_to_le32(v), (c))
++#define writeq_relaxed(v, c)   __raw_writeq((__force u64)cpu_to_le64(v), (c))
+ 
+ /*
+  * The compiler seems to be incapable of optimising constants
+-- 
+2.34.1
+
diff --git a/meta/recipes-bsp/u-boot/files/0003-qemu-arm-Enable-virtualizable-IO-accessors.patch b/meta/recipes-bsp/u-boot/files/0003-qemu-arm-Enable-virtualizable-IO-accessors.patch
new file mode 100644
index 0000000000..520c9226b4
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/0003-qemu-arm-Enable-virtualizable-IO-accessors.patch
@@ -0,0 +1,41 @@
+From cb6120b4bfd8b24dde7e0d1eda882e203a849d3f Mon Sep 17 00:00:00 2001
+From: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Date: Wed, 18 Jun 2025 09:58:14 +0300
+Subject: [PATCH 3/3] qemu: arm: Enable virtualizable IO accessors
+
+We recently added IO accessors that will work with KVM for any MMIO
+access that casues an exception to the hypervisor. Enable them by
+default for QEMU.
+
+Upstream-Status: Backport [https://github.com/u-boot/u-boot/commit/fcc60481ae75]
+Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Tested-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+---
+ configs/qemu_arm64_defconfig | 1 +
+ configs/qemu_arm_defconfig   | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/configs/qemu_arm64_defconfig b/configs/qemu_arm64_defconfig
+index 72bd255eafa3..39afb837e411 100644
+--- a/configs/qemu_arm64_defconfig
++++ b/configs/qemu_arm64_defconfig
+@@ -1,4 +1,5 @@
+ CONFIG_ARM=y
++CONFIG_KVM_VIRT_INS=y
+ CONFIG_ARCH_QEMU=y
+ CONFIG_SYS_MALLOC_LEN=0x1000000
+ CONFIG_BLOBLIST_SIZE_RELOC=0x2000
+diff --git a/configs/qemu_arm_defconfig b/configs/qemu_arm_defconfig
+index f13001390d4d..92ba48f6af97 100644
+--- a/configs/qemu_arm_defconfig
++++ b/configs/qemu_arm_defconfig
+@@ -1,4 +1,5 @@
+ CONFIG_ARM=y
++CONFIG_KVM_VIRT_INS=y
+ CONFIG_ARM_SMCCC=y
+ CONFIG_ARCH_QEMU=y
+ CONFIG_SYS_MALLOC_LEN=0x1000000
+-- 
+2.34.1
+
diff --git a/meta/recipes-bsp/u-boot/files/disable_CONFIG_USB.cfg b/meta/recipes-bsp/u-boot/files/disable_CONFIG_USB.cfg
deleted file mode 100644
index 1d2509982b..0000000000
--- a/meta/recipes-bsp/u-boot/files/disable_CONFIG_USB.cfg
+++ /dev/null
@@ -1 +0,0 @@
-# CONFIG_USB is not set
diff --git a/meta/recipes-bsp/u-boot/files/v3-0001-Makefile-scripts-Makefile.lib-fix-_efi.so-depende.patch b/meta/recipes-bsp/u-boot/files/v3-0001-Makefile-scripts-Makefile.lib-fix-_efi.so-depende.patch
new file mode 100644
index 0000000000..e8253a67b2
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/v3-0001-Makefile-scripts-Makefile.lib-fix-_efi.so-depende.patch
@@ -0,0 +1,136 @@
+From 2e7c1321bb44cc6af4ee4b1026a52e1a0aa7e336 Mon Sep 17 00:00:00 2001
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+Date: Thu, 10 Jul 2025 14:24:07 +0000
+Subject: [PATCH v3 1/2] Makefile scripts/Makefile.lib: fix *_efi.so dependency
+ to PLATFORM_LIBGCC
+
+When PLATFORM_LIBGCC was added to linker command it was not
+added to the dependency of the .so and other rules. Thus a build can
+try to link *_efi.so files before lib.a from PLATFORM_LIBGCC is available.
+This was seen in yocto autobuilder builds with u-boot 2025.07
+update, see https://lists.openembedded.org/g/openembedded-core/message/220004
+
+https://autobuilder.yoctoproject.org/valkyrie/api/v2/logs/2914600/raw_inline
+
+|    rm -f lib/efi_loader/built-in.o; arm-poky-linux-gnueabi-ar cDPrsT lib/efi_loader/built-in.o lib/efi_loader/efi_bootmgr.o lib/efi_loader/efi_bootbin.o lib/efi_loader/efi_boottime.o lib/efi_loader/efi_helper.o lib/efi_loader/efi_console.o lib/efi_loader/efi_device_path.o lib/efi_loader/efi_device_path_to_text.o lib/efi_loader/efi_device_path_utilities.o lib/efi_loader/efi_dt_fixup.o lib/efi_loader/efi_fdt.o lib/efi_loader/efi_file.o lib/efi_loader/efi_hii.o lib/efi_loader/efi_hii_config.o lib/efi_loader/efi_image_loader.o lib/efi_loader/efi_load_options.o lib/efi_loader/efi_memory.o lib/efi_loader/efi_root_node.o lib/efi_loader/efi_runtime.o lib/efi_loader/efi_setup.o lib/efi_loader/efi_string.o lib/efi_loader/efi_unicode_collation.o lib/efi_loader/efi_var_common.o lib/efi_loader/efi_var_mem.o lib/efi_loader/efi_variable.o lib/efi_loader/efi_var_file.o lib/efi_loader/efi_watchdog.o lib/efi_loader/efi_disk.o lib/efi_loader/efi_net.o lib/efi_loader/efi_smbios.o lib/efi_loader/efi_load_initrd.o lib/efi_loader/efi_conformance.o
+|   arm-poky-linux-gnueabi-ld.bfd -nostdlib -zexecstack -znocombreloc -znorelro --no-warn-rwx-segments -L /srv/pokybuild/yocto-worker/oe-selftest-armhost/build/build-st-3119200/tmp/work/beaglebone_yocto-poky-linux-gnueabi/u-boot/2025.07/sources/u-boot-2025.07 -T arch/arm/lib/elf_arm_efi.lds -shared -Bsymbolic -s lib/efi_loader/helloworld.o lib/efi_loader/efi_crt0.o lib/efi_loader/efi_reloc.o lib/efi_loader/efi_freestanding.o arch/arm/lib/lib.a -o lib/efi_loader/helloworld_efi.so
+| arm-poky-linux-gnueabi-ld.bfd: cannot find arch/arm/lib/lib.a: No such file or directory
+| make[3]: *** [scripts/Makefile.lib:512: lib/efi_loader/helloworld_efi.so] Error 1
+
+The issue is hard to reproduce but this change can artificially trigger it:
+
+  a/scripts/Makefile.build
+  b/scripts/Makefile.build
+@@ -353,7 +353,7 @@ $(modorder-target): $(subdir-ym) FORCE
+ #
+ ifdef lib-target
+ quiet_cmd_link_l_target = AR      $@
+-cmd_link_l_target = rm -f $@; $(AR) cDPrsT$(KBUILD_ARFLAGS) $@ $(lib-y)
++cmd_link_l_target = rm -f $@ && echo "HACK, delaying build!" && sleep 60 && $(AR) cDPrsT$(KBUILD_ARFLAGS) $@ $(lib-y)
+
+ $(lib-target): $(lib-y) FORCE
+        $(call if_changed,link_l_target)
+
+Then run a rebuild with:
+
+$  rm -f $( find build/ -name lib.a -or -name helloworld_efi.so ) && \
+   make
+...
+  arm-poky-linux-gnueabi-ld.bfd -nostdlib -zexecstack -znocombreloc -znorelro --no-warn-rwx-segments -L /home/mcfrisk/src/base/repo/poky/build_bea
+glebone/tmp/work/beaglebone_yocto-poky-linux-gnueabi/u-boot/2025.07/sources/u-boot-2025.07 -T arch/arm/lib/elf_arm_efi.lds -shared -Bsymbolic -s lib/efi_loader/helloworld.o lib/efi_loader/efi_crt0.o lib/efi_loader/efi_reloc.o lib/efi_loader/efi_freestanding.o arch/arm/lib/lib.a -o lib/efi_loader/helloworld_efi.so
+arm-poky-linux-gnueabi-ld.bfd: cannot find arch/arm/lib/lib.a: No such file or directory
+make[3]: *** [scripts/Makefile.lib:512: lib/efi_loader/helloworld_efi.so] Error 1
+
+Fix by introducing PLATFORM_LIBGCC_LIBA variable with only lib.a
+filename which is then used to add the dependency in rules which use
+PLATFORM_LIBGCC. This should not impact builds which don't set
+PLATFORM_LIBGCC_LIBA and PLATFORM_LIBGCC usage stays as is.
+
+Fixes: 43d43241d1c9 ("scripts/Makefile.lib: add PLATFORM_LIBGCC to efi linking")
+
+Cc: Adriano Cordova <adrianox@gmail.com>
+Cc: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+---
+ Makefile                     | 4 +++-
+ examples/standalone/Makefile | 2 +-
+ scripts/Makefile.lib         | 2 +-
+ scripts/Makefile.xpl         | 3 ++-
+ 4 files changed, 7 insertions(+), 4 deletions(-)
+
+Upstream-Status: Submitted [https://lists.denx.de/pipermail/u-boot/2025-July/594581.html]
+
+v3: added "export PLATFORM_LIBGCC_LIBA" like PLATFORM_LIBGCC, not sure
+    how testing worked without this before
+
+v2: introduced PLATFORM_LIBGCC_LIBA variable with just lib.a filename,
+    PLATFORM_LIBGCC can have other flags too
+    https://lists.denx.de/pipermail/u-boot/2025-July/594034.html
+
+v1: https://lists.denx.de/pipermail/u-boot/2025-July/593982.html
+
+diff --git a/Makefile b/Makefile
+index 1a5c77d7caf0..a0797f36f7f6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -911,7 +911,8 @@ u-boot-main := $(libs-y)
+ 
+ # Add GCC lib
+ ifeq ($(CONFIG_USE_PRIVATE_LIBGCC),y)
+-PLATFORM_LIBGCC = arch/$(ARCH)/lib/lib.a
++PLATFORM_LIBGCC_LIBA = arch/$(ARCH)/lib/lib.a
++PLATFORM_LIBGCC = $(PLATFORM_LIBGCC_LIBA)
+ else
+ ifndef CONFIG_CC_IS_CLANG
+ PLATFORM_LIBGCC := -L $(shell dirname `$(CC) $(c_flags) -print-libgcc-file-name`) -lgcc
+@@ -926,6 +927,7 @@ endif
+ 
+ export PLATFORM_LIBS
+ export PLATFORM_LIBGCC
++export PLATFORM_LIBGCC_LIBA
+ 
+ # Special flags for CPP when processing the linker script.
+ # Pass the version down so we can handle backwards compatibility
+diff --git a/examples/standalone/Makefile b/examples/standalone/Makefile
+index 9b57f1c0c66c..aa9e3121cf9a 100644
+--- a/examples/standalone/Makefile
++++ b/examples/standalone/Makefile
+@@ -64,7 +64,7 @@ quiet_cmd_link_elf = LD      $@
+       cmd_link_elf = $(LD) $(KBUILD_LDFLAGS) $(LDFLAGS_STANDALONE) -g  \
+                     -o $@ -e $(SYM_PREFIX)$(@F) $< $(LIB) $(PLATFORM_LIBGCC)
+ 
+-$(ELF): $(obj)/%: $(obj)/%.o $(LIB) FORCE
++$(ELF): $(obj)/%: $(obj)/%.o $(LIB) $(PLATFORM_LIBGCC_LIBA) FORCE
+        $(call if_changed,link_elf)
+ 
+ $(obj)/%.srec: OBJCOPYFLAGS += -O srec
+diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
+index e89a4a51b74d..cef3863dfdc4 100644
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -508,7 +508,7 @@ $(obj)/efi_reloc.o: $(srctree)/arch/$(ARCH)/lib/$(EFI_RELOC:.o=.c) $(recordmcoun
+        $(call cmd,force_checksrc)
+        $(call if_changed_rule,cc_o_c)
+ 
+-$(obj)/%_efi.so: $(obj)/%.o $(obj)/efi_crt0.o $(obj)/efi_reloc.o $(obj)/efi_freestanding.o
++$(obj)/%_efi.so: $(PLATFORM_LIBGCC_LIBA) $(obj)/%.o $(obj)/efi_crt0.o $(obj)/efi_reloc.o $(obj)/efi_freestanding.o
+        $(call cmd,efi_ld)
+ 
+ targets += $(obj)/efi_crt0.o $(obj)/efi_reloc.o $(obj)/efi_freestanding.o
+diff --git a/scripts/Makefile.xpl b/scripts/Makefile.xpl
+index 43f27874f9fe..68c88293f0d9 100644
+--- a/scripts/Makefile.xpl
++++ b/scripts/Makefile.xpl
+@@ -139,7 +139,8 @@ libs-y := $(patsubst %/, %/built-in.o, $(libs-y))
+ 
+ # Add GCC lib
+ ifeq ($(CONFIG_USE_PRIVATE_LIBGCC),y)
+-PLATFORM_LIBGCC = arch/$(ARCH)/lib/lib.a
++PLATFORM_LIBGCC_LIBA = arch/$(ARCH)/lib/lib.a
++PLATFORM_LIBGCC = $(PLATFORM_LIBGCC_LIBA)
+ PLATFORM_LIBS := $(filter-out %/lib.a, $(filter-out -lgcc, $(PLATFORM_LIBS))) $(PLATFORM_LIBGCC)
+ endif
+ 
+-- 
+2.43.0
+
diff --git a/meta/recipes-bsp/u-boot/files/v3-0002-efi_loader-Makefile-change-apps-from-always-to-ta.patch b/meta/recipes-bsp/u-boot/files/v3-0002-efi_loader-Makefile-change-apps-from-always-to-ta.patch
new file mode 100644
index 0000000000..6b68f74724
--- /dev/null
+++ b/meta/recipes-bsp/u-boot/files/v3-0002-efi_loader-Makefile-change-apps-from-always-to-ta.patch
@@ -0,0 +1,57 @@
+From d207ec22429adc94f9e173971e30c675d2ab3de4 Mon Sep 17 00:00:00 2001
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+Date: Fri, 18 Jul 2025 08:15:25 +0000
+Subject: [PATCH v3 2/2] efi_loader Makefile: change apps from "always" to
+ "targets"
+
+Adding delay to link commands in scripts/Makefile.build
+
+@@ -353,7 +353,7 @@ $(modorder-target): $(subdir-ym) FORCE
+ #
+ ifdef lib-target
+ quiet_cmd_link_l_target = AR      $@
+-cmd_link_l_target = rm -f $@; $(AR) cDPrsT$(KBUILD_ARFLAGS) $@ $(lib-y)
++cmd_link_l_target = rm -f $@; echo "HACK delaying lib-target"; sleep 10; $(AR) cDPrsT$(KBUILD_ARFLAGS) $@ $(lib-y)
+
+ $(lib-target): $(lib-y) FORCE
+        $(call if_changed,link_l_target)
+(1/2) Stage this hunk [y,n,q,a,d,j,J,g,/,e,?]? n
+@@ -362,7 +362,7 @@ targets += $(lib-target)
+ endif
+
+ quiet_cmd_link_multi-y = AR      $@
+-cmd_link_multi-y = rm -f $@; $(AR) cDPrsT$(KBUILD_ARFLAGS) $@ $(filter %.o,$^)
++cmd_link_multi-y = rm -f $@; echo "HACK delaying cmd_link_multi-y"; sleep 10; $(AR) cDPrsT$(KBUILD_ARFLAGS) $@ $(filter %.o,$^)
+
+ quiet_cmd_link_multi-m = AR [M]  $@
+ cmd_link_multi-m = $(cmd_link_multi-y)
+
+exposes a build failure:
+
+make[3]: *** No rule to make target 'lib/efi_loader/helloworld.efi', needed by '__build'.  Stop.
+make[3]: *** Waiting for unfinished jobs....
+
+This if fixed by using normal targets for .efi apps. The rules
+in scripts/Makefile.lib handle the dependencies correctly.
+
+Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+---
+ lib/efi_loader/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Upstream-Status: Submitted [https://lists.denx.de/pipermail/u-boot/2025-July/594583.html]
+
+diff --git a/lib/efi_loader/Makefile b/lib/efi_loader/Makefile
+index cf050e5385dd..e929c23b1cb1 100644
+--- a/lib/efi_loader/Makefile
++++ b/lib/efi_loader/Makefile
+@@ -96,5 +96,5 @@ $(foreach f,$(apps-y),\
+        $(eval CFLAGS_$(f).o := $(CFLAGS_EFI) -Os -ffreestanding)\
+        $(eval CFLAGS_REMOVE_$(f).o := $(CFLAGS_NON_EFI)))
+ 
+-always += $(foreach f,$(apps-y),$(f).efi)
++targets += $(foreach f,$(apps-y),$(f).efi)
+ targets += $(foreach f,$(apps-y),$(f).o)
+-- 
+2.43.0
+
diff --git a/meta/recipes-bsp/u-boot/u-boot-common.inc b/meta/recipes-bsp/u-boot/u-boot-common.inc
index 8600d4bab6..053e686354 100644
--- a/meta/recipes-bsp/u-boot/u-boot-common.inc
+++ b/meta/recipes-bsp/u-boot/u-boot-common.inc
@@ -12,9 +12,16 @@ PE = "1"
 
 # We use the revision in order to avoid having to fetch it from the
 # repo during parse
-SRCREV = "34820924edbc4ec7803eb89d9852f4b870fa760a"
-
-SRC_URI = "git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master;tag=v${PV}"
+SRCREV = "e37de002fac3895e8d0b60ae2015e17bb33e2b5b"
+
+SRC_URI = "\
+    git://source.denx.de/u-boot/u-boot.git;protocol=https;branch=master;tag=v${PV} \
+    file://v3-0001-Makefile-scripts-Makefile.lib-fix-_efi.so-depende.patch \
+    file://v3-0002-efi_loader-Makefile-change-apps-from-always-to-ta.patch \
+    file://0001-nxp-Prepare-macros-for-KVM-changes.patch \
+    file://0002-arm-io.h-Fix-io-accessors-for-KVM.patch \
+    file://0003-qemu-arm-Enable-virtualizable-IO-accessors.patch \
+"
 
 SRC_URI_RISCV = "\
     file://u-boot-riscv-isa_clear.cfg \
diff --git a/meta/recipes-bsp/u-boot/u-boot-tools_2025.04.bb b/meta/recipes-bsp/u-boot/u-boot-tools_2025.07.bb
index 7eaf721ca8..7eaf721ca8 100644
--- a/meta/recipes-bsp/u-boot/u-boot-tools_2025.04.bb
+++ b/meta/recipes-bsp/u-boot/u-boot-tools_2025.07.bb
diff --git a/meta/recipes-bsp/u-boot/u-boot_2025.04.bb b/meta/recipes-bsp/u-boot/u-boot_2025.07.bb
index 89e964f627..25f264c961 100644
--- a/meta/recipes-bsp/u-boot/u-boot_2025.04.bb
+++ b/meta/recipes-bsp/u-boot/u-boot_2025.07.bb
@@ -4,5 +4,5 @@ require u-boot.inc
 DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native"
 
 # workarounds for aarch64 kvm qemu boot regressions
-SRC_URI:append:qemuarm64 = " file://disable-CONFIG_BLOBLIST.cfg file://disable_CONFIG_USB.cfg"
-SRC_URI:append:genericarm64 = " file://disable-CONFIG_BLOBLIST.cfg file://disable_CONFIG_USB.cfg"
+SRC_URI:append:qemuarm64 = " file://disable-CONFIG_BLOBLIST.cfg"
+SRC_URI:append:genericarm64 = " file://disable-CONFIG_BLOBLIST.cfg"