u-boot-fslc: Update to 2026.10

The U-Boot fork has been updated to include the tagged v2026.10 from
upstream. The following commits were ported from 2025.01+fslc:

----
322904a1db ("imx: iMX6: Define disconnect_from_pc function")
ebf892284f ("MLK-21854-2 imx: uuu: Update autoboot to run uuu or fastboot")
32b6811094 ("pico-imx6ul, pico-imx7d: Explain how to use eMMC user partition")
eec398606f ("mx6sabre_common: Dynamically change the video output")
8852a5a1c7 ("mx6sabresd: Enable video interfaces in bootargs")
----

The mkimage signing code still uses the OpenSSL ENGINE API, removed in
OpenSSL 4.0, so building the host tools fails. Carry the OpenSSL
Provider API patch that OE-Core uses for its own u-boot recipe; it
applies cleanly to this tree. It goes in the common include, since
u-boot-fslc-mxsboot builds the same tools.

Two changes in 2026.10 affect the i.MX 8M boot container that binman
builds for the mainline BSP:

- fd1072d0d59 ("imx8m: dts: Update ddr firmware name") packs the
  versioned lpddr4_pmu_train_*_202006.bin files on i.MX 8M Mini, Nano
  and Quad, and binman fails with missing external blobs otherwise.
  Select them for the mainline BSP on imx8mq-evk and imx8mm-lpddr4-evk,
  the LPDDR4 machines that use u-boot-fslc there. The NXP BSP and its
  imx-boot keep the unversioned files.

- 5b6dba2924b ("imx8mq: Correct signed_hdmi firmware position") puts
  the signed HDMI firmware, with its 1KB head padding, at the start of
  flash.bin, which must now be written at 32KB. At 33KB the boot ROM
  does not find the IVT and the board stays silent. Set IMX_BOOT_SEEK
  to 32 for the mainline BSP on imx8mq-evk.

The pylibfdt SWIG 4.5 fix and the binman pkg_resources fix needed by
2025.01 are already part of 2026.10.

Tested with 'bitbake core-image-weston u-boot-fslc-mxsboot-native' for
imx8mq-evk with the mainline BSP. On an imx8mq-evk board the image
boots through U-Boot 2026.10 and Linux to Weston, which runs on the
DSI panel with the GC7000 GPU. That boot needed imx-atf built with
LOG_LEVEL=40: the release BL31 from imx-atf hangs after its banner on
this board, independent of the U-Boot version. imx8mm-lpddr4-evk was
not built.

Signed-off-by: Rodrigo M. Duarte <rodrigo.duarte@ossystems.com.br>

6 files changed, 363 insertions, 4 deletions

diff --git a/conf/machine/imx8mm-lpddr4-evk.conf b/conf/machine/imx8mm-lpddr4-evk.conf
index ae81a92d4..024515095 100644
--- a/conf/machine/imx8mm-lpddr4-evk.conf
+++ b/conf/machine/imx8mm-lpddr4-evk.conf
@@ -37,5 +37,12 @@ DDR_FIRMWARE_NAME = " \
     lpddr4_pmu_train_2d_imem.bin \
     lpddr4_pmu_train_2d_dmem.bin \
 "
+# Mainline U-Boot packs the versioned 202006 DDR firmware since v2026.10
+DDR_FIRMWARE_NAME:use-mainline-bsp = " \
+    lpddr4_pmu_train_1d_imem_202006.bin \
+    lpddr4_pmu_train_1d_dmem_202006.bin \
+    lpddr4_pmu_train_2d_imem_202006.bin \
+    lpddr4_pmu_train_2d_dmem_202006.bin \
+"
 
 IMXBOOT_TARGETS_BASENAME = "flash_evk"
diff --git a/conf/machine/imx8mq-evk.conf b/conf/machine/imx8mq-evk.conf
index 9974928db..40ff665e9 100644
--- a/conf/machine/imx8mq-evk.conf
+++ b/conf/machine/imx8mq-evk.conf
@@ -62,6 +62,13 @@ DDR_FIRMWARE_NAME = " \
     lpddr4_pmu_train_2d_imem.bin \
     lpddr4_pmu_train_2d_dmem.bin \
 "
+# Mainline U-Boot packs the versioned 202006 DDR firmware since v2026.10
+DDR_FIRMWARE_NAME:use-mainline-bsp = " \
+    lpddr4_pmu_train_1d_imem_202006.bin \
+    lpddr4_pmu_train_1d_dmem_202006.bin \
+    lpddr4_pmu_train_2d_imem_202006.bin \
+    lpddr4_pmu_train_2d_dmem_202006.bin \
+"
 
 # Set u-boot DTB
 UBOOT_DTB_NAME = "imx8mq-evk.dtb"
@@ -95,6 +102,9 @@ IMAGE_BOOT_FILES:append:use-mainline-bsp = " extlinux.conf;extlinux/extlinux.con
 LOADADDR = ""
 UBOOT_MAKE_TARGET = ""
 IMX_BOOT_SEEK = "33"
+# Mainline U-Boot puts the signed HDMI firmware, with its 1KB head
+# padding, at the start of flash.bin since v2026.10, so it goes at 32KB
+IMX_BOOT_SEEK:use-mainline-bsp = "32"
 
 OPTEE_BIN_EXT = "8mq"
 
diff --git a/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch b/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch
new file mode 100644
index 000000000..346d0584d
--- /dev/null
+++ b/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch
@@ -0,0 +1,340 @@
+From a81cb0932dce109af44d7245d47489fe54ae390f Mon Sep 17 00:00:00 2001
+From: Eddie Kovsky <ewk@edkovsky.org>
+Date: Mon, 23 Feb 2026 09:43:22 -0700
+Subject: [PATCH] Add support for OpenSSL Provider API
+
+The Engine API has been deprecated since the release of OpenSSL 3.0. End
+users have been advised to migrate to the new Provider interface.
+Several distributions have already removed support for engines, which is
+preventing U-Boot from being compiled in those environments.
+
+Add support for the Provider API while continuing to support the existing
+Engine API on distros shipping older releases of OpenSSL.
+
+This is based on similar work contributed by Jan Stancek updating Linux
+to use the Provider interface.
+
+    commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
+    Author: Jan Stancek <jstancek@redhat.com>
+    Date:   Fri Sep 20 19:52:48 2024 +0300
+
+        sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
+
+The changes have been tested with the FIT signature verification vboot
+tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
+Engine library installed and with the Provider API.
+
+Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
+
+Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
+
+Note: Modified to make pkcs11 provider loading optional. The upstream
+patch unconditionally requires the pkcs11 provider, which is not
+available in the OE build environment. File-based key signing only needs
+the default provider; pkcs11 is only required for pkcs11: URI keys.
+Changes from upstream:
+ - Load default provider first (was pkcs11 first)
+ - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
+   of ERR(1, ...) which calls errx/abort)
+
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ doc/build/gcc.rst      |   4 +-
+ lib/aes/aes-encrypt.c |   4 +-
+ lib/rsa/rsa-sign.c    | 102 +++++++++++++++++++++++++++++++++++++++---
+ tools/docker/Dockerfile |  1 +
+ 4 files changed, 103 insertions(+), 8 deletions(-)
+
+diff --git a/doc/build/gcc.rst b/doc/build/gcc.rst
+index 1fef718ceecb..29a6a632e7e3 100644
+--- a/doc/build/gcc.rst
++++ b/doc/build/gcc.rst
+@@ -25,8 +25,8 @@ Depending on the build targets further packages maybe needed
+ 
+     sudo apt-get install bc bison build-essential coccinelle \
+       device-tree-compiler dfu-util efitools flex gdisk graphviz imagemagick \
+-      libgnutls28-dev libguestfs-tools libncurses-dev \
+-      libpython3-dev libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl \
++      libgnutls28-dev libguestfs-tools libncurses-dev libpython3-dev \
++      libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl pkcs11-provider \
+       pkg-config python3 python3-asteval python3-coverage python3-filelock \
+       python3-pkg-resources python3-pycryptodome python3-pyelftools \
+       python3-pytest python3-pytest-xdist python3-sphinxcontrib.apidoc \
+diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
+index 90e1407b4f09..4fc4ce232478 100644
+--- a/lib/aes/aes-encrypt.c
++++ b/lib/aes/aes-encrypt.c
+@@ -16,7 +16,9 @@
+ #include <openssl/err.h>
+ #include <openssl/ssl.h>
+ #include <openssl/evp.h>
+-#include <openssl/engine.h>
++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
++# include <openssl/engine.h>
++#endif
+ #include <uboot_aes.h>
+ 
+ #if OPENSSL_VERSION_NUMBER >= 0x10000000L
+diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
+index 0e38c9e802fd..f456f3c58e65 100644
+--- a/lib/rsa/rsa-sign.c
++++ b/lib/rsa/rsa-sign.c
+@@ -19,7 +19,47 @@
+ #include <openssl/err.h>
+ #include <openssl/ssl.h>
+ #include <openssl/evp.h>
+-#include <openssl/engine.h>
++#if OPENSSL_VERSION_MAJOR >= 3
++# define USE_PKCS11_PROVIDER
++# include <err.h>
++# include <openssl/provider.h>
++# include <openssl/store.h>
++#else
++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
++#  define USE_PKCS11_ENGINE
++#  include <openssl/engine.h>
++# endif
++#endif
++
++#ifdef USE_PKCS11_PROVIDER
++#define ERR(cond, fmt, ...)                            \
++       do {                                            \
++               bool __cond = (cond);                   \
++               drain_openssl_errors(__LINE__, 0);      \
++               if (__cond) {                           \
++                       errx(1, fmt, ## __VA_ARGS__);   \
++               }                                       \
++       } while (0)
++
++static void drain_openssl_errors(int l, int silent)
++{
++       const char *file;
++       char buf[120];
++       int e, line;
++
++       if (ERR_peek_error() == 0)
++               return;
++       if (!silent)
++               fprintf(stderr, "At main.c:%d:\n", l);
++
++       while ((e = ERR_peek_error_line(&file, &line))) {
++               ERR_error_string(e, buf);
++               if (!silent)
++                       fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
++               ERR_get_error();
++       }
++}
++#endif
+ 
+ static int rsa_err(const char *msg)
+ {
+@@ -94,10 +134,11 @@ static int rsa_pem_get_pub_key(const char *keydir, const char *name, EVP_PKEY **
+  *
+  * @keydir:    Key prefix
+  * @name       Name of key
+- * @engine     Engine to use
++ * @engine     Engine to use or NULL when using pkcs11 provider
+  * @evpp       Returns EVP_PKEY object, or NULL on failure
+  * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+  */
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
+                                  ENGINE *engine, EVP_PKEY **evpp)
+ {
+@@ -157,21 +198,24 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
+ 
+        return 0;
+ }
++#endif
+ 
+ /**
+  * rsa_get_pub_key() - read a public key
+  *
+  * @keydir:    Directory containing the key (PEM file) or key prefix (engine)
+  * @name       Name of key file (will have a .crt extension)
+- * @engine     Engine to use
++ * @engine     Engine to use or NULL when using pkcs11 provider
+  * @evpp       Returns EVP_PKEY object, or NULL on failure
+  * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+  */
+ static int rsa_get_pub_key(const char *keydir, const char *name,
+                           ENGINE *engine, EVP_PKEY **evpp)
+ {
++#ifdef USE_PKCS11_ENGINE
+        if (engine)
+                return rsa_engine_get_pub_key(keydir, name, engine, evpp);
++#endif
+        return rsa_pem_get_pub_key(keydir, name, evpp);
+ }
+ 
+@@ -207,13 +251,45 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
+                return -ENOENT;
+        }
+ 
++#ifdef USE_PKCS11_PROVIDER
++       EVP_PKEY *private_key = NULL;
++       OSSL_STORE_CTX *store;
++
++       if (!OSSL_PROVIDER_try_load(NULL, "default", true))
++               ERR(1, "OSSL_PROVIDER_try_load(default)");
++       /* pkcs11 provider is optional; only needed for pkcs11: URIs */
++       if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
++               ERR_clear_error();
++
++       store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
++       ERR(!store, "OSSL_STORE_open");
++
++       while (!OSSL_STORE_eof(store)) {
++               OSSL_STORE_INFO *info = OSSL_STORE_load(store);
++
++               if (!info) {
++                       drain_openssl_errors(__LINE__, 0);
++                       continue;
++               }
++               if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
++                       private_key = OSSL_STORE_INFO_get1_PKEY(info);
++                       ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
++               }
++               OSSL_STORE_INFO_free(info);
++               if (private_key)
++                       break;
++       }
++       OSSL_STORE_close(store);
++
++       *evpp = private_key;
++#else
+        if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
+                rsa_err("Failure reading private key");
+                fclose(f);
+                return -EPROTO;
+        }
+        fclose(f);
+-
++#endif
+        return 0;
+ }
+ 
+@@ -226,6 +301,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
+  * @evpp       Returns EVP_PKEY object, or NULL on failure
+  * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+  */
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
+                                   const char *keyfile,
+                                   ENGINE *engine, EVP_PKEY **evpp)
+@@ -293,22 +369,25 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
+ 
+        return 0;
+ }
++#endif
+ 
+ /**
+  * rsa_get_priv_key() - read a private key
+  *
+  * @keydir:    Directory containing the key (PEM file) or key prefix (engine)
+  * @name       Name of key
+- * @engine     Engine to use for signing
++ * @engine     Engine to use or NULL when using pkcs11 provider
+  * @evpp       Returns EVP_PKEY object, or NULL on failure
+  * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+  */
+ static int rsa_get_priv_key(const char *keydir, const char *name,
+                            const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
+ {
++#ifdef USE_PKCS11_ENGINE
+        if (engine)
+                return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
+                                               evpp);
++#endif
+        return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
+ }
+ 
+@@ -325,6 +404,7 @@ static int rsa_init(void)
+        return 0;
+ }
+ 
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_init(const char *engine_id, ENGINE **pe)
+ {
+        const char *key_pass;
+@@ -380,6 +460,7 @@ static void rsa_engine_remove(ENGINE *e)
+                ENGINE_free(e);
+        }
+ }
++#endif
+ 
+ static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo,
+                             struct checksum_algo *checksum_algo,
+@@ -480,11 +561,13 @@ int rsa_sign(struct image_sign_info *info,
+        if (ret)
+                return ret;
+ 
++#ifdef USE_PKCS11_ENGINE
+        if (info->engine_id) {
+                ret = rsa_engine_init(info->engine_id, &e);
+                if (ret)
+                        return ret;
+        }
++#endif
+ 
+        ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
+                               e, &pkey);
+@@ -496,16 +579,21 @@ int rsa_sign(struct image_sign_info *info,
+                goto err_sign;
+ 
+        EVP_PKEY_free(pkey);
++
++#ifdef USE_PKCS11_ENGINE
+        if (info->engine_id)
+                rsa_engine_remove(e);
++#endif
+ 
+        return ret;
+ 
+ err_sign:
+        EVP_PKEY_free(pkey);
+ err_priv:
++#ifdef USE_PKCS11_ENGINE
+        if (info->engine_id)
+                rsa_engine_remove(e);
++#endif
+        return ret;
+ }
+ 
+@@ -645,11 +733,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
+        ENGINE *e = NULL;
+ 
+        debug("%s: Getting verification data\n", __func__);
++#ifdef USE_PKCS11_ENGINE
+        if (info->engine_id) {
+                ret = rsa_engine_init(info->engine_id, &e);
+                if (ret)
+                        return ret;
+        }
++#endif
+        ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
+        if (ret)
+                goto err_get_pub_key;
+@@ -726,8 +816,10 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
+ err_get_params:
+        EVP_PKEY_free(pkey);
+ err_get_pub_key:
++#ifdef USE_PKCS11_ENGINE
+        if (info->engine_id)
+                rsa_engine_remove(e);
++#endif
+ 
+        if (ret)
+                return ret;
+diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
+index 73bf6cdd2c52..50e98e83dc20 100644
+--- a/tools/docker/Dockerfile
++++ b/tools/docker/Dockerfile
+@@ -122,6 +122,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+        openssl \
+        picocom \
+        parted \
++       pkcs11-provider \
+        pkg-config \
+        python-is-python3 \
+        python3 \
diff --git a/recipes-bsp/u-boot/u-boot-fslc-common_2025.01.inc b/recipes-bsp/u-boot/u-boot-fslc-common_2026.10.inc
index a7be37572..e401c110d 100644
--- a/recipes-bsp/u-boot/u-boot-fslc-common_2025.01.inc
+++ b/recipes-bsp/u-boot/u-boot-fslc-common_2026.10.inc
@@ -9,12 +9,14 @@ LIC_FILES_CHKSUM = "file://Licenses/README;md5=2ca5f2c35c8cc335f0a19756634782f1"
 
 DEPENDS += "bison-native flex-native"
 
-PV = "2025.01+fslc+git${SRCPV}"
+PV = "2026.10+fslc+git${SRCPV}"
 
-SRC_URI = "git://github.com/Freescale/u-boot-fslc.git;branch=${SRCBRANCH};protocol=https"
+SRC_URI = "git://github.com/Freescale/u-boot-fslc.git;branch=${SRCBRANCH};protocol=https \
+           file://0001-Add-support-for-OpenSSL-Provider-API.patch \
+"
 
-SRCREV = "aa4bc52d08c342df83e3c576e2c108d7c8816e0e"
-SRCBRANCH = "2025.01+fslc"
+SRCREV = "322904a1db22d45b9a7f4627e1093fe4f6befaba"
+SRCBRANCH = "2026.10+fslc"
 
 CVE_PRODUCT = "denx:u-boot"
 
diff --git a/recipes-bsp/u-boot/u-boot-fslc-mxsboot_2025.01.bb b/recipes-bsp/u-boot/u-boot-fslc-mxsboot_2026.10.bb
index a5c4011aa..a5c4011aa 100644
--- a/recipes-bsp/u-boot/u-boot-fslc-mxsboot_2025.01.bb
+++ b/recipes-bsp/u-boot/u-boot-fslc-mxsboot_2026.10.bb
diff --git a/recipes-bsp/u-boot/u-boot-fslc_2025.01.bb b/recipes-bsp/u-boot/u-boot-fslc_2026.10.bb
index 92076aa72..92076aa72 100644
--- a/recipes-bsp/u-boot/u-boot-fslc_2025.01.bb
+++ b/recipes-bsp/u-boot/u-boot-fslc_2026.10.bb