u-boot.git/test, branch next

Merge tag 'u-boot-rockchip-2027.01-20260828' of https://git.u-boot-project.org/u-boot/custodians/u-boot-rockchip into next

2026-08-29T15:56:00Z

- Fixed possible SPI hangs when only PICO is routed (TX-only), - Added support for ROC-RK3399-PC-PLUS (via roc-pc-rk3399_defconfig)

test/py: nand: Add tests for NAND flash device

2026-08-28T20:57:37Z

Add tests for nand commands to test various NAND flash operations such as erase, write and read. Use the current test/py APIs (ubman fixture and utils helpers) and refactor the pre-command helper to return a dictionary. Also add the test_nand.py test to the generated documentation. See commit 8f8f0f0ed9d0 ("doc: pytest: Document the test_net_boot test") for the kinds of changes required for the docstring to be rendered correctly. Signed-off-by: Love Kumar

Merge patch series "video: bmp: fix out-of-bounds write in the RLE8 decoder"

2026-08-26T22:33:27Z

Shahriyar Jalayeri says: This fixes an out-of-bounds write in the RLE8 BMP decoder and adds a regression test. video_display_rle8_bitmap() lets the framebuffer cursor drift below the start of the framebuffer via repeated End-Of-Line escapes, so a crafted image displayed from the splash-screen or PXE-menu path (loaded from removable media or over TFTP) writes before the framebuffer. Patch 1 bounds each run and rejects such an image with -EINVAL; patch 2 adds a DM test for it. Link: https://lore.kernel.org/r/20260729-video-oob-fix-v3-0-21d3412212cf@byteray.co.uk

test: video: add regression test for RLE8 bmp overflow

2026-08-26T22:33:21Z

Add a DM test that displays a crafted RLE8 bitmap whose decode cursor is driven below the framebuffer. Without the preceding fix video_bmp_display() writes out of bounds and returns success; with it the image is rejected with -EINVAL. Signed-off-by: Shahriyar Jalayeri Reviewed-by: Simon Glass

tools: fit: sign all config image references

2026-08-25T23:12:40Z

Target-side configuration verification builds the signed-region list from every image-reference property in the selected configuration. Host-side signing still uses either the signature node sign-images property or the legacy kernel/fdt/script default list. This lets mkimage generate configuration signatures which U-Boot cannot verify when the configuration references other image types, such as firmware, loadables or ramdisk entries. It also lets the host and target disagree when sign-images names only a subset of the configuration images. Build the host-side signing list from the configuration properties in the same way as target-side verification. Use one shared property classifier so the host and target cannot drift apart again. This makes signed configurations cover the root node, the configuration node, every referenced image node, and its hash, cipher and dm-verity subnodes, regardless of image type. Warn when a legacy sign-images property is present, since it no longer limits the signed image list. Require every referenced image to have at least one hash subnode. Add sandbox coverage proving that a firmware reference omitted from sign-images is still recorded in hashed-nodes and verified. Update the signed-configuration documentation to describe the same rule and the hash-subnode requirement. Fixes: 2092322b31cc ("boot: Add fit_config_get_hash_list() to build signed node list") Signed-off-by: James Hilliard Reviewed-by: Simon Glass

Merge tag 'v2026.10-rc3' into next

2026-08-25T01:31:25Z

lmb: Return -EFAULT when freeing unallocated memory regions

2026-08-24T19:58:00Z

Make lmb_free() return -EFAULT when the requested memory region is not allocated, instead of the generic -1 error value. Document the updated error code in the public API comment and change the LMB unit test to check for the new -EFAULT errno value. Signed-off-by: Jonas Karlman Reviewed-by: Randolph Sapp

lmb: Return -EFAULT when requested region is not part of memory map

2026-08-24T19:58:00Z

lmb_alloc_addr() is documented to return -EINVAL when the requested memory region is not part of the LMB memory map. However, -EINVAL is also used to e.g. indicate that a NULL pointer is passed as the addr parameter or when the requested memory region partially overlaps an existing region. Change lmb_alloc_addr() to return -EFAULT when the requested memory region is not part of the LMB memory map to make the type of error known to callers. Also extend unit tests to validate that the return code has stay the same when the requested memory region partially overlaps. No caller of lmb_alloc_addr() is checking what type of error code is returned, so this change has no intended behavior change. Signed-off-by: Jonas Karlman Reviewed-by: Randolph Sapp

spi: Handle spi-{tx, rx}-bus-width 0 as SPI_NO_TX/SPI_NO_RX

2026-08-24T08:53:00Z

The spi-peripheral-props binding shipped in dts/upstream allows a bus width of 0, meaning no RX or TX is possible on this device. The switches in spi_slave_of_to_plat() only handle 1/2/4/8, so a width of 0 falls through to the default case and warns "spi-rx-bus-width 0 not supported" on every boot, even though the devicetree is valid per the binding. The fact that the wire is missing is then dropped from plat->mode. Map 0 to new SPI_NO_TX/SPI_NO_RX mode bits, as Linux has done since v5.12 ("spi: Add SPI_NO_TX/RX support", mainline d962608ce218). Bits 16 and 17 are the first free mode bits. Mapping the bits is not enough on its own, as Quentin pointed out: nothing would stop a caller from asking for a transfer in a direction that has no wire, and every controller driver would need its own guard. Validate centrally in dm_spi_xfer() instead, matching Linux's __spi_validate(): a din on a SPI_NO_RX device or a dout on a SPI_NO_TX device fails with -EINVAL before it reaches the driver. A new sandbox test covers both rejections. This comes up on devices with no MISO line at all, such as a write-only SPI display described with spi-rx-bus-width = <0>. Signed-off-by: Cole Munz Acked-by: Quentin Schulz Link: https://patch.msgid.link/ae6a85d6f985b63c8f5a3fe8deeab89d79757b14.1787309754.git.Munzzyy1@proton.me Signed-off-by: Quentin Schulz

test: cmd: add a test for bootd

2026-08-22T00:01:02Z

There is no test for the bootd command. Add one to the cmd suite that covers the documented behaviour: bootd and its "boot" alias run the command held in the bootcmd environment variable, and the return value of bootd is the one of that command. Also assert the recursion guard in cmd_process(), which is part of the code bootd carries. Reviewed-by: Simon Glass Signed-off-by: Mehmet Fide