u-boot.git/drivers, branch next

Merge tag 'u-boot-rockchip-2027.01-20260828' of https://git.u-boot-project.org/u-boot/custodians/u-boot-rockchip into next

2026-08-29T15:56:00Z

- Fixed possible SPI hangs when only PICO is routed (TX-only), - Added support for ROC-RK3399-PC-PLUS (via roc-pc-rk3399_defconfig)

Merge patch series "video: bmp: fix out-of-bounds write in the RLE8 decoder"

2026-08-26T22:33:27Z

Shahriyar Jalayeri says: This fixes an out-of-bounds write in the RLE8 BMP decoder and adds a regression test. video_display_rle8_bitmap() lets the framebuffer cursor drift below the start of the framebuffer via repeated End-Of-Line escapes, so a crafted image displayed from the splash-screen or PXE-menu path (loaded from removable media or over TFTP) writes before the framebuffer. Patch 1 bounds each run and rejects such an image with -EINVAL; patch 2 adds a DM test for it. Link: https://lore.kernel.org/r/20260729-video-oob-fix-v3-0-21d3412212cf@byteray.co.uk

video: bmp: bound RLE8 decode writes to the framebuffer

2026-08-26T22:33:21Z

video_display_rle8_bitmap() moves the framebuffer cursor fb up by a full row plus a scanline on each End-Of-Line escape, with no lower-bound check. Repeated EOL escapes desynchronise fb from the scanline index y: after height - 1 escapes y is back in range while fb has drifted about one framebuffer below priv->fb, and the decoder writes pixel data before the start of the framebuffer. The DELTA escape recomputes fb from an unchecked y as well. A crafted RLE8 image displayed from the splash-screen or PXE-menu path can therefore write out of bounds. Check the cursor against [priv->fb, priv->fb + fb_size) before each run and reject the image with -EINVAL if a write would fall outside it. Signed-off-by: Shahriyar Jalayeri Reviewed-by: Simon Glass

blkcache: include the hardware partition in the cache key

2026-08-26T20:51:31Z

The block cache keys its entries on (iftype, devnum, start, blkcnt, blksz) but not on the block descriptor's hardware partition. Devices that expose several independent address spaces through blk_desc->hwpart therefore alias each other in the cache: once a block has been cached for one hwpart, reads of the same LBA on another hwpart return the data cached for the first one. For MMC this is masked because switching hwpart invalidates the cache, but a UBI block device selects the target volume purely through hwpart and does not invalidate on switch, so scanning several UBI volumes returns the first volume's blocks for all of them. Add hwpart to the cache key so entries for different hardware partitions (or UBI volumes) are kept distinct. Fixes: e40cf34a29f1 ("drivers: block: add block device cache") Signed-off-by: Daniel Golle

Merge tag 'i2c-updates-for-2026.10-next' of https://git.u-boot-project.org/u-boot/custodians/hs/u-boot-i2c into next

2026-08-25T17:37:49Z

i2c updates for 2026.10-next - i2c/clk: spacemit: k1: fix I2C bus configuration and clock handling from Junhui Reviewed by Yao Zi and myself.

Merge tag 'mediatek-for-next-2026-08-24' of https://git.u-boot-project.org/u-boot/custodians/u-boot-mediatek into next

2026-08-25T17:36:46Z

* New HDMI PHY and I2C DDC drivers, default EDID_ADDR macro * MT8189 clock qualifier fix * Phase-aware PSCI reset (MT8195/MT8365) * dwc_eth_qos MT8366 support * MediaTek TPHY v3 hardware support * mtk_snor mt8188/mt8189 compatible-string cleanup * MT6358/MT6366 PMIC regulator + pwrap support * MediaTek pinctrl Kconfig cleanup (per-SoC symbols → single driver + TARGET_*) * New MT8366 pinctrl driver + dt-bindings header * MediaTek serial driver clock-handling fixes

clk: spacemit: k1: remove bus gate from TWSI functional clocks

2026-08-25T06:22:24Z

The TWSI functional clocks incorrectly include both the functional clock enable bit and the bus clock enable bit in their gate masks. The device tree and the full clock tree model the bus clocks separately. Remove the bus clock enable bit from the functional clock gate masks so that the functional and bus clocks are controlled independently. Keep the combined gate for TWSI8 because its clock control register is write-only and therefore cannot be safely shared by two clock instances. Fixes: 3aa2882a3e1a ("clk: spacemit: Add support for K1 SoC") Reviewed-by: Yao Zi Signed-off-by: Junhui Liu

i2c: k1: enable both functional and bus clocks

2026-08-25T06:22:24Z

The K1 I2C controller requires both its functional clock and APB bus clock to operate. The device tree provides them as "func" and "bus", but the driver currently acquires and enables only the first clock. Acquire both clocks by name and enable them during probe. Use explicit named lookups instead of the bulk clock API to align with the K1 Linux driver and keep the roles of the two clocks clear if functional clock rate configuration is needed later. Fixes: 271546fb8e54 ("i2c: k1: add I2C driver support") Reviewed-by: Heiko Schocher Reviewed-by: Yao Zi Signed-off-by: Junhui Liu

clk: spacemit: k1: add TWSI bus clocks to SPL

2026-08-25T06:22:24Z

The K1 device tree describes separate functional and bus clocks for TWSI controllers, but the SPL clock tree currently only provides their functional clocks. Add the bus clocks for TWSI2 and TWSI8, which are the TWSI controllers currently used in SPL, along with their required parent clock chain. TWSI8 uses a fixed-factor bus clock because its write-only clock control register requires the functional and bus gate bits to remain combined in a single clock instance. Reviewed-by: Yao Zi Signed-off-by: Junhui Liu

i2c: k1: fix wrong bus speed setting

2026-08-25T06:22:24Z

The controller bus mode should be selected according to the requested I2C bus speed. However, the driver currently passes the functional clock rate to k1_i2c_set_bus_speed(), so the selected mode does not reflect the requested bus speed. Fix this by reading the clock-frequency property from the Device Tree, defaulting to standard speed, and drop the unused clk_rate field. Fixes: 271546fb8e54 ("i2c: k1: add I2C driver support") Reviewed-by: Heiko Schocher Reviewed-by: Yao Zi Signed-off-by: Junhui Liu