u-boot.git, branch next

Merge patch series "Refactor binman nodes for boot binaries for TI AM625 into templates"

2026-08-28T14:52:48Z

Anshul Dalal says: This patch series seeks to help in reuse by moving currently duplicated entries for tiboot3.bin and tispl.bin into a generic SoC wide DTSI (k3-am625-binman.dtsi). This dtsi in-turn gets included by all AM625 based boards which can insert the templates from k3-am625-binman.dtsi. The newly added templates are as follows: tiboot3_am625_hs tiboot3_am625_hs_fs tiboot3_am625_gp ti_falcon_am625 ti_spl_unsigned_am625 ti_spl_am625 The series has been boot tested on beagleplay and AM62x EVM but the following affected boards have only been build tested: - phycore_am62x - verdin-am62 To verify no regressions, I compared the final 'u-boot.dtb.out' for both the R5 and A53 build using dtx_diff script from linux source. Link: https://lore.kernel.org/r/20260729-k3_binman_refactor-v2-0-9a66fd170040@ti.com

arm: dts: k3-am625: add template for tispl.bin

2026-08-28T14:51:33Z

This patch addresses the duplication of the binman nodes responsible for generating tispl.bin and tispl.bin_unsigned for TI's AM625 SoC based boards. The common nodes are factored out into a template in the SoC level k3-am625-binman.dtsi that each board in-turn includes. No functional change is intended from the patch asides from the addition of tifsstub-hs and tifsstub-fs nodes in beagleplay's tispl.bin which should have no consequence asides from growing the binary size by few kilo bytes. Signed-off-by: Anshul Dalal Tested-by: Wadim Egorov

arm: dts: k3-am625: add template for tiboot3.bin

2026-08-28T14:51:33Z

Currently we are duplicating binman nodes responsible for building tiboot3.bin binaries across boards that use TI's AM625 SoC. This patch adds a SoC level k3-am625-binman.dtsi with templates for the commonly used tiboot3 variants (i.e. hs, hs-fs and gp) which can be inserted by the corresponding board's dtsi to promote reuse. Note that for some boards the hardcoded load address for SPL firmware has been changed to use CONFIG_SPL_TEXT_BASE but it should cause no functional change. Reviewed-by: Simon Glass Signed-off-by: Anshul Dalal Tested-by: Wadim Egorov

fdt: Fix phandles not copying when using templates

2026-08-28T14:49:30Z

The phandles used inside a template are not copied to the node inserting the template, leading to a missing phandle error. The following example can be used to reproduce the issue: &binman { some_template: template-0 { ti-secure-rom { content = <&some_data>; keyfile = "some_key"; }; some_data: blob-ext { optional; }; }; output-bin { insert-template = <&some_template>; }; }; With the error 'binman: Node '/binman/output-bin/ti-secure-rom': Cannot find node for phandle 103' observed. The test_copy_subnodes_from_phandles was also updated to verify the new behavior of phandles being copied. Reviewed-by: Moteen Shah Signed-off-by: Anshul Dalal Reviewed-by: Simon Glass

Merge patch series "video: bmp: fix out-of-bounds write in the RLE8 decoder"

2026-08-26T22:33:27Z

Shahriyar Jalayeri says: This fixes an out-of-bounds write in the RLE8 BMP decoder and adds a regression test. video_display_rle8_bitmap() lets the framebuffer cursor drift below the start of the framebuffer via repeated End-Of-Line escapes, so a crafted image displayed from the splash-screen or PXE-menu path (loaded from removable media or over TFTP) writes before the framebuffer. Patch 1 bounds each run and rejects such an image with -EINVAL; patch 2 adds a DM test for it. Link: https://lore.kernel.org/r/20260729-video-oob-fix-v3-0-21d3412212cf@byteray.co.uk

test: video: add regression test for RLE8 bmp overflow

2026-08-26T22:33:21Z

Add a DM test that displays a crafted RLE8 bitmap whose decode cursor is driven below the framebuffer. Without the preceding fix video_bmp_display() writes out of bounds and returns success; with it the image is rejected with -EINVAL. Signed-off-by: Shahriyar Jalayeri Reviewed-by: Simon Glass

video: bmp: bound RLE8 decode writes to the framebuffer

2026-08-26T22:33:21Z

video_display_rle8_bitmap() moves the framebuffer cursor fb up by a full row plus a scanline on each End-Of-Line escape, with no lower-bound check. Repeated EOL escapes desynchronise fb from the scanline index y: after height - 1 escapes y is back in range while fb has drifted about one framebuffer below priv->fb, and the decoder writes pixel data before the start of the framebuffer. The DELTA escape recomputes fb from an unchecked y as well. A crafted RLE8 image displayed from the splash-screen or PXE-menu path can therefore write out of bounds. Check the cursor against [priv->fb, priv->fb + fb_size) before each run and reject the image with -EINVAL if a write would fall outside it. Signed-off-by: Shahriyar Jalayeri Reviewed-by: Simon Glass

blkcache: include the hardware partition in the cache key

2026-08-26T20:51:31Z

The block cache keys its entries on (iftype, devnum, start, blkcnt, blksz) but not on the block descriptor's hardware partition. Devices that expose several independent address spaces through blk_desc->hwpart therefore alias each other in the cache: once a block has been cached for one hwpart, reads of the same LBA on another hwpart return the data cached for the first one. For MMC this is masked because switching hwpart invalidates the cache, but a UBI block device selects the target volume purely through hwpart and does not invalidate on switch, so scanning several UBI volumes returns the first volume's blocks for all of them. Add hwpart to the cache key so entries for different hardware partitions (or UBI volumes) are kept distinct. Fixes: e40cf34a29f1 ("drivers: block: add block device cache") Signed-off-by: Daniel Golle

tools: fit: sign all config image references

2026-08-25T23:12:40Z

Target-side configuration verification builds the signed-region list from every image-reference property in the selected configuration. Host-side signing still uses either the signature node sign-images property or the legacy kernel/fdt/script default list. This lets mkimage generate configuration signatures which U-Boot cannot verify when the configuration references other image types, such as firmware, loadables or ramdisk entries. It also lets the host and target disagree when sign-images names only a subset of the configuration images. Build the host-side signing list from the configuration properties in the same way as target-side verification. Use one shared property classifier so the host and target cannot drift apart again. This makes signed configurations cover the root node, the configuration node, every referenced image node, and its hash, cipher and dm-verity subnodes, regardless of image type. Warn when a legacy sign-images property is present, since it no longer limits the signed image list. Require every referenced image to have at least one hash subnode. Add sandbox coverage proving that a firmware reference omitted from sign-images is still recorded in hashed-nodes and verified. Update the signed-configuration documentation to describe the same rule and the hash-subnode requirement. Fixes: 2092322b31cc ("boot: Add fit_config_get_hash_list() to build signed node list") Signed-off-by: James Hilliard Reviewed-by: Simon Glass

Merge tag 'i2c-updates-for-2026.10-next' of https://git.u-boot-project.org/u-boot/custodians/hs/u-boot-i2c into next

2026-08-25T17:37:49Z

i2c updates for 2026.10-next - i2c/clk: spacemit: k1: fix I2C bus configuration and clock handling from Junhui Reviewed by Yao Zi and myself.