u-boot.git/test/dm, branch next

Merge tag 'u-boot-rockchip-2027.01-20260828' of https://git.u-boot-project.org/u-boot/custodians/u-boot-rockchip into next

2026-08-29T15:56:00Z

- Fixed possible SPI hangs when only PICO is routed (TX-only), - Added support for ROC-RK3399-PC-PLUS (via roc-pc-rk3399_defconfig)

Merge patch series "video: bmp: fix out-of-bounds write in the RLE8 decoder"

2026-08-26T22:33:27Z

Shahriyar Jalayeri says: This fixes an out-of-bounds write in the RLE8 BMP decoder and adds a regression test. video_display_rle8_bitmap() lets the framebuffer cursor drift below the start of the framebuffer via repeated End-Of-Line escapes, so a crafted image displayed from the splash-screen or PXE-menu path (loaded from removable media or over TFTP) writes before the framebuffer. Patch 1 bounds each run and rejects such an image with -EINVAL; patch 2 adds a DM test for it. Link: https://lore.kernel.org/r/20260729-video-oob-fix-v3-0-21d3412212cf@byteray.co.uk

test: video: add regression test for RLE8 bmp overflow

2026-08-26T22:33:21Z

Add a DM test that displays a crafted RLE8 bitmap whose decode cursor is driven below the framebuffer. Without the preceding fix video_bmp_display() writes out of bounds and returns success; with it the image is rejected with -EINVAL. Signed-off-by: Shahriyar Jalayeri Reviewed-by: Simon Glass

Merge tag 'v2026.10-rc3' into next

2026-08-25T01:31:25Z

spi: Handle spi-{tx, rx}-bus-width 0 as SPI_NO_TX/SPI_NO_RX

2026-08-24T08:53:00Z

The spi-peripheral-props binding shipped in dts/upstream allows a bus width of 0, meaning no RX or TX is possible on this device. The switches in spi_slave_of_to_plat() only handle 1/2/4/8, so a width of 0 falls through to the default case and warns "spi-rx-bus-width 0 not supported" on every boot, even though the devicetree is valid per the binding. The fact that the wire is missing is then dropped from plat->mode. Map 0 to new SPI_NO_TX/SPI_NO_RX mode bits, as Linux has done since v5.12 ("spi: Add SPI_NO_TX/RX support", mainline d962608ce218). Bits 16 and 17 are the first free mode bits. Mapping the bits is not enough on its own, as Quentin pointed out: nothing would stop a caller from asking for a transfer in a direction that has no wire, and every controller driver would need its own guard. Validate centrally in dm_spi_xfer() instead, matching Linux's __spi_validate(): a din on a SPI_NO_RX device or a dout on a SPI_NO_TX device fails with -EINVAL before it reaches the driver. A new sandbox test covers both rejections. This comes up on devices with no MISO line at all, such as a write-only SPI display described with spi-rx-bus-width = <0>. Signed-off-by: Cole Munz Acked-by: Quentin Schulz Link: https://patch.msgid.link/ae6a85d6f985b63c8f5a3fe8deeab89d79757b14.1787309754.git.Munzzyy1@proton.me Signed-off-by: Quentin Schulz

test: dm: hash: check digest size before memset

2026-08-20T18:15:24Z

hash_algo_digest_size() returns -EINVAL for an invalid algorithm. The test success provider passes that result directly to memset(), where it is converted to a large size_t. Return the error before touching the output buffer, and exercise the invalid-algorithm path in the provider-selection test. This addresses Coverity CIDs 652907 and 652908. Fixes: 94b349bd902d ("crypto: hash: use DM providers from hash command") Signed-off-by: James Hilliard

test: dm: add sandbox coverage for gpio-delay

2026-08-19T14:48:18Z

gpio-delay had no sandbox coverage, which is how two bugs in it went unnoticed: gpio_delay_xlate() never propagated the requested index into the descriptor offset, so every consumer past the first silently collided with the first consumer's already-claimed offset 0; and the claimed/name tracking arrays were sized and bounds-checked against a hardcoded 32 instead of the driver's actual GPIO count. Both are fixed by a companion series that is a dependency of this patch: applied without it, this test fails outright, since it directly exercises both fixes. Add a test requesting both consumers wired up by gpio-delay-test in test.dts (gpio_a 9 and 18): a third consumer colliding with an already-claimed offset must fail with -EBUSY, each consumer's write must land on its own wrapped GPIO line, and a request past the wrapped GPIO count must fail with -EINVAL rather than succeed against a hardcoded bound of 32. Gated on CONFIG_GPIO_DELAY, since not every sandbox variant that builds test/dm/gpio.c enables it (sandbox_vpl, sandbox_spl, sandbox_noinst, sandbox_flattree). Signed-off-by: Pranav Sanwal Reviewed-by: Simon Glass

test: dm: free gpio in dm_test_gpio_requestf()

2026-08-19T14:48:18Z

dm_test_gpio_requestf() requests a GPIO via gpio_requestf() but never frees it, unlike every other test in this file. Free it before returning. Signed-off-by: Pranav Sanwal Reviewed-by: Simon Glass

Merge tag 'net-20260813' of https://git.u-boot-project.org/u-boot/custodians/u-boot-net

2026-08-13T14:58:29Z

Pull request net-20260813. net: - phy: dp83867: enable extended read / write for driver - phy: fix duplicate eth_phy binding - Drop unnecessary device_set_name - dwc_eth_xgmac: Return -ENODEV when phy_connect() fails - nfs: clean up bounds checks in nfs_readlink_reply() - rtl8169: add support for RTL8126A and RTL8127A - srand_mac(): fix -ENODEV crash with CONFIG_DM_RNG net-legacy: - Fix out-of-bounds write in IP fragment reassembly - test: net: add regression test for IP reassembly overflow net-lwip: - Add tftpsrv command - Handle chained pbufs in transmit path - sntp: fix netif leak when ntpserverip is unset - wget: free mbedtls x509 cert context to avoid memory leak - Fix DHCP fine timer interval

Revert "test: smem: add basic smem test"

2026-08-07T12:32:14Z

This reverts commit 20e7705764c4e5ea924f1ea54bb36ebbbeffffe7. Reviewed-by: Sumit Garg Reviewed-by: Neil Armstrong Reviewed-by: Simon Glass Tested-by: Sumit Garg Link: https://patch.msgid.link/20260504-b4-modernise-smem-v2-3-c01ec2ff3886@linaro.org Signed-off-by: Casey Connolly