6 files changed, 363 insertions, 4 deletions

diff --git a/conf/machine/imx8mm-lpddr4-evk.conf b/conf/machine/imx8mm-lpddr4-evk.conf
index ae81a92d4..024515095 100644
--- a/conf/machine/imx8mm-lpddr4-evk.conf
+++ b/conf/machine/imx8mm-lpddr4-evk.conf
@@ -37,5 +37,12 @@ DDR_FIRMWARE_NAME = " \
     lpddr4_pmu_train_2d_imem.bin \
     lpddr4_pmu_train_2d_dmem.bin \
 "
+# Mainline U-Boot packs the versioned 202006 DDR firmware since v2026.10
+DDR_FIRMWARE_NAME:use-mainline-bsp = " \
+    lpddr4_pmu_train_1d_imem_202006.bin \
+    lpddr4_pmu_train_1d_dmem_202006.bin \
+    lpddr4_pmu_train_2d_imem_202006.bin \
+    lpddr4_pmu_train_2d_dmem_202006.bin \
+"
 
 IMXBOOT_TARGETS_BASENAME = "flash_evk"
diff --git a/conf/machine/imx8mq-evk.conf b/conf/machine/imx8mq-evk.conf
index 9974928db..40ff665e9 100644
--- a/conf/machine/imx8mq-evk.conf
+++ b/conf/machine/imx8mq-evk.conf
@@ -62,6 +62,13 @@ DDR_FIRMWARE_NAME = " \
     lpddr4_pmu_train_2d_imem.bin \
     lpddr4_pmu_train_2d_dmem.bin \
 "
+# Mainline U-Boot packs the versioned 202006 DDR firmware since v2026.10
+DDR_FIRMWARE_NAME:use-mainline-bsp = " \
+    lpddr4_pmu_train_1d_imem_202006.bin \
+    lpddr4_pmu_train_1d_dmem_202006.bin \
+    lpddr4_pmu_train_2d_imem_202006.bin \
+    lpddr4_pmu_train_2d_dmem_202006.bin \
+"
 
 # Set u-boot DTB
 UBOOT_DTB_NAME = "imx8mq-evk.dtb"
@@ -95,6 +102,9 @@ IMAGE_BOOT_FILES:append:use-mainline-bsp = " extlinux.conf;extlinux/extlinux.con
 LOADADDR = ""
 UBOOT_MAKE_TARGET = ""
 IMX_BOOT_SEEK = "33"
+# Mainline U-Boot puts the signed HDMI firmware, with its 1KB head
+# padding, at the start of flash.bin since v2026.10, so it goes at 32KB
+IMX_BOOT_SEEK:use-mainline-bsp = "32"
 
 OPTEE_BIN_EXT = "8mq"
 
diff --git a/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch b/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch
new file mode 100644
index 000000000..346d0584d
--- /dev/null
+++ b/recipes-bsp/u-boot/files/0001-Add-support-for-OpenSSL-Provider-API.patch
@@ -0,0 +1,340 @@
+From a81cb0932dce109af44d7245d47489fe54ae390f Mon Sep 17 00:00:00 2001
+From: Eddie Kovsky <ewk@edkovsky.org>
+Date: Mon, 23 Feb 2026 09:43:22 -0700
+Subject: [PATCH] Add support for OpenSSL Provider API
+
+The Engine API has been deprecated since the release of OpenSSL 3.0. End
+users have been advised to migrate to the new Provider interface.
+Several distributions have already removed support for engines, which is
+preventing U-Boot from being compiled in those environments.
+
+Add support for the Provider API while continuing to support the existing
+Engine API on distros shipping older releases of OpenSSL.
+
+This is based on similar work contributed by Jan Stancek updating Linux
+to use the Provider interface.
+
+    commit 558bdc45dfb2669e1741384a0c80be9c82fa052c
+    Author: Jan Stancek <jstancek@redhat.com>
+    Date:   Fri Sep 20 19:52:48 2024 +0300
+
+        sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3
+
+The changes have been tested with the FIT signature verification vboot
+tests on Fedora 42 and Debian 13. All 30 tests pass with both the legacy
+Engine library installed and with the Provider API.
+
+Signed-off-by: Eddie Kovsky <ewk@edkovsky.org>
+
+Upstream-Status: Submitted [https://lore.kernel.org/u-boot/20260429180247.83091-1-ekovsky@redhat.com/]
+
+Note: Modified to make pkcs11 provider loading optional. The upstream
+patch unconditionally requires the pkcs11 provider, which is not
+available in the OE build environment. File-based key signing only needs
+the default provider; pkcs11 is only required for pkcs11: URI keys.
+Changes from upstream:
+ - Load default provider first (was pkcs11 first)
+ - Make pkcs11 provider load failure non-fatal (ERR_clear_error instead
+   of ERR(1, ...) which calls errx/abort)
+
+Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
+---
+ doc/build/gcc.rst      |   4 +-
+ lib/aes/aes-encrypt.c |   4 +-
+ lib/rsa/rsa-sign.c    | 102 +++++++++++++++++++++++++++++++++++++++---
+ tools/docker/Dockerfile |  1 +
+ 4 files changed, 103 insertions(+), 8 deletions(-)
+
+diff --git a/doc/build/gcc.rst b/doc/build/gcc.rst
+index 1fef718ceecb..29a6a632e7e3 100644
+--- a/doc/build/gcc.rst
++++ b/doc/build/gcc.rst
+@@ -25,8 +25,8 @@ Depending on the build targets further packages maybe needed
+ 
+     sudo apt-get install bc bison build-essential coccinelle \
+       device-tree-compiler dfu-util efitools flex gdisk graphviz imagemagick \
+-      libgnutls28-dev libguestfs-tools libncurses-dev \
+-      libpython3-dev libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl \
++      libgnutls28-dev libguestfs-tools libncurses-dev libpython3-dev \
++      libsdl2-dev libssl-dev lz4 lzma lzma-alone openssl pkcs11-provider \
+       pkg-config python3 python3-asteval python3-coverage python3-filelock \
+       python3-pkg-resources python3-pycryptodome python3-pyelftools \
+       python3-pytest python3-pytest-xdist python3-sphinxcontrib.apidoc \
+diff --git a/lib/aes/aes-encrypt.c b/lib/aes/aes-encrypt.c
+index 90e1407b4f09..4fc4ce232478 100644
+--- a/lib/aes/aes-encrypt.c
++++ b/lib/aes/aes-encrypt.c
+@@ -16,7 +16,9 @@
+ #include <openssl/err.h>
+ #include <openssl/ssl.h>
+ #include <openssl/evp.h>
+-#include <openssl/engine.h>
++#if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
++# include <openssl/engine.h>
++#endif
+ #include <uboot_aes.h>
+ 
+ #if OPENSSL_VERSION_NUMBER >= 0x10000000L
+diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
+index 0e38c9e802fd..f456f3c58e65 100644
+--- a/lib/rsa/rsa-sign.c
++++ b/lib/rsa/rsa-sign.c
+@@ -19,7 +19,47 @@
+ #include <openssl/err.h>
+ #include <openssl/ssl.h>
+ #include <openssl/evp.h>
+-#include <openssl/engine.h>
++#if OPENSSL_VERSION_MAJOR >= 3
++# define USE_PKCS11_PROVIDER
++# include <err.h>
++# include <openssl/provider.h>
++# include <openssl/store.h>
++#else
++# if !defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
++#  define USE_PKCS11_ENGINE
++#  include <openssl/engine.h>
++# endif
++#endif
++
++#ifdef USE_PKCS11_PROVIDER
++#define ERR(cond, fmt, ...)                            \
++       do {                                            \
++               bool __cond = (cond);                   \
++               drain_openssl_errors(__LINE__, 0);      \
++               if (__cond) {                           \
++                       errx(1, fmt, ## __VA_ARGS__);   \
++               }                                       \
++       } while (0)
++
++static void drain_openssl_errors(int l, int silent)
++{
++       const char *file;
++       char buf[120];
++       int e, line;
++
++       if (ERR_peek_error() == 0)
++               return;
++       if (!silent)
++               fprintf(stderr, "At main.c:%d:\n", l);
++
++       while ((e = ERR_peek_error_line(&file, &line))) {
++               ERR_error_string(e, buf);
++               if (!silent)
++                       fprintf(stderr, "- SSL %s: %s:%d\n", buf, file, line);
++               ERR_get_error();
++       }
++}
++#endif
+ 
+ static int rsa_err(const char *msg)
+ {
+@@ -94,10 +134,11 @@ static int rsa_pem_get_pub_key(const char *keydir, const char *name, EVP_PKEY **
+  *
+  * @keydir:    Key prefix
+  * @name       Name of key
+- * @engine     Engine to use
++ * @engine     Engine to use or NULL when using pkcs11 provider
+  * @evpp       Returns EVP_PKEY object, or NULL on failure
+  * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+  */
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
+                                  ENGINE *engine, EVP_PKEY **evpp)
+ {
+@@ -157,21 +198,24 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
+ 
+        return 0;
+ }
++#endif
+ 
+ /**
+  * rsa_get_pub_key() - read a public key
+  *
+  * @keydir:    Directory containing the key (PEM file) or key prefix (engine)
+  * @name       Name of key file (will have a .crt extension)
+- * @engine     Engine to use
++ * @engine     Engine to use or NULL when using pkcs11 provider
+  * @evpp       Returns EVP_PKEY object, or NULL on failure
+  * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+  */
+ static int rsa_get_pub_key(const char *keydir, const char *name,
+                           ENGINE *engine, EVP_PKEY **evpp)
+ {
++#ifdef USE_PKCS11_ENGINE
+        if (engine)
+                return rsa_engine_get_pub_key(keydir, name, engine, evpp);
++#endif
+        return rsa_pem_get_pub_key(keydir, name, evpp);
+ }
+ 
+@@ -207,13 +251,45 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
+                return -ENOENT;
+        }
+ 
++#ifdef USE_PKCS11_PROVIDER
++       EVP_PKEY *private_key = NULL;
++       OSSL_STORE_CTX *store;
++
++       if (!OSSL_PROVIDER_try_load(NULL, "default", true))
++               ERR(1, "OSSL_PROVIDER_try_load(default)");
++       /* pkcs11 provider is optional; only needed for pkcs11: URIs */
++       if (!OSSL_PROVIDER_try_load(NULL, "pkcs11", true))
++               ERR_clear_error();
++
++       store = OSSL_STORE_open(path, NULL, NULL, NULL, NULL);
++       ERR(!store, "OSSL_STORE_open");
++
++       while (!OSSL_STORE_eof(store)) {
++               OSSL_STORE_INFO *info = OSSL_STORE_load(store);
++
++               if (!info) {
++                       drain_openssl_errors(__LINE__, 0);
++                       continue;
++               }
++               if (OSSL_STORE_INFO_get_type(info) == OSSL_STORE_INFO_PKEY) {
++                       private_key = OSSL_STORE_INFO_get1_PKEY(info);
++                       ERR(!private_key, "OSSL_STORE_INFO_get1_PKEY");
++               }
++               OSSL_STORE_INFO_free(info);
++               if (private_key)
++                       break;
++       }
++       OSSL_STORE_close(store);
++
++       *evpp = private_key;
++#else
+        if (!PEM_read_PrivateKey(f, evpp, NULL, path)) {
+                rsa_err("Failure reading private key");
+                fclose(f);
+                return -EPROTO;
+        }
+        fclose(f);
+-
++#endif
+        return 0;
+ }
+ 
+@@ -226,6 +301,7 @@ static int rsa_pem_get_priv_key(const char *keydir, const char *name,
+  * @evpp       Returns EVP_PKEY object, or NULL on failure
+  * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+  */
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
+                                   const char *keyfile,
+                                   ENGINE *engine, EVP_PKEY **evpp)
+@@ -293,22 +369,25 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
+ 
+        return 0;
+ }
++#endif
+ 
+ /**
+  * rsa_get_priv_key() - read a private key
+  *
+  * @keydir:    Directory containing the key (PEM file) or key prefix (engine)
+  * @name       Name of key
+- * @engine     Engine to use for signing
++ * @engine     Engine to use or NULL when using pkcs11 provider
+  * @evpp       Returns EVP_PKEY object, or NULL on failure
+  * Return: 0 if ok, -ve on error (in which case *evpp will be set to NULL)
+  */
+ static int rsa_get_priv_key(const char *keydir, const char *name,
+                            const char *keyfile, ENGINE *engine, EVP_PKEY **evpp)
+ {
++#ifdef USE_PKCS11_ENGINE
+        if (engine)
+                return rsa_engine_get_priv_key(keydir, name, keyfile, engine,
+                                               evpp);
++#endif
+        return rsa_pem_get_priv_key(keydir, name, keyfile, evpp);
+ }
+ 
+@@ -325,6 +404,7 @@ static int rsa_init(void)
+        return 0;
+ }
+ 
++#ifdef USE_PKCS11_ENGINE
+ static int rsa_engine_init(const char *engine_id, ENGINE **pe)
+ {
+        const char *key_pass;
+@@ -380,6 +460,7 @@ static void rsa_engine_remove(ENGINE *e)
+                ENGINE_free(e);
+        }
+ }
++#endif
+ 
+ static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo,
+                             struct checksum_algo *checksum_algo,
+@@ -480,11 +561,13 @@ int rsa_sign(struct image_sign_info *info,
+        if (ret)
+                return ret;
+ 
++#ifdef USE_PKCS11_ENGINE
+        if (info->engine_id) {
+                ret = rsa_engine_init(info->engine_id, &e);
+                if (ret)
+                        return ret;
+        }
++#endif
+ 
+        ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile,
+                               e, &pkey);
+@@ -496,16 +579,21 @@ int rsa_sign(struct image_sign_info *info,
+                goto err_sign;
+ 
+        EVP_PKEY_free(pkey);
++
++#ifdef USE_PKCS11_ENGINE
+        if (info->engine_id)
+                rsa_engine_remove(e);
++#endif
+ 
+        return ret;
+ 
+ err_sign:
+        EVP_PKEY_free(pkey);
+ err_priv:
++#ifdef USE_PKCS11_ENGINE
+        if (info->engine_id)
+                rsa_engine_remove(e);
++#endif
+        return ret;
+ }
+ 
+@@ -645,11 +733,13 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
+        ENGINE *e = NULL;
+ 
+        debug("%s: Getting verification data\n", __func__);
++#ifdef USE_PKCS11_ENGINE
+        if (info->engine_id) {
+                ret = rsa_engine_init(info->engine_id, &e);
+                if (ret)
+                        return ret;
+        }
++#endif
+        ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey);
+        if (ret)
+                goto err_get_pub_key;
+@@ -726,8 +816,10 @@ int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
+ err_get_params:
+        EVP_PKEY_free(pkey);
+ err_get_pub_key:
++#ifdef USE_PKCS11_ENGINE
+        if (info->engine_id)
+                rsa_engine_remove(e);
++#endif
+ 
+        if (ret)
+                return ret;
+diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
+index 73bf6cdd2c52..50e98e83dc20 100644
+--- a/tools/docker/Dockerfile
++++ b/tools/docker/Dockerfile
+@@ -122,6 +122,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+        openssl \
+        picocom \
+        parted \
++       pkcs11-provider \
+        pkg-config \
+        python-is-python3 \
+        python3 \
diff --git a/recipes-bsp/u-boot/u-boot-fslc-common_2025.01.inc b/recipes-bsp/u-boot/u-boot-fslc-common_2026.10.inc
index a7be37572..e401c110d 100644
--- a/recipes-bsp/u-boot/u-boot-fslc-common_2025.01.inc
+++ b/recipes-bsp/u-boot/u-boot-fslc-common_2026.10.inc
@@ -9,12 +9,14 @@ LIC_FILES_CHKSUM = "file://Licenses/README;md5=2ca5f2c35c8cc335f0a19756634782f1"
 
 DEPENDS += "bison-native flex-native"
 
-PV = "2025.01+fslc+git${SRCPV}"
+PV = "2026.10+fslc+git${SRCPV}"
 
-SRC_URI = "git://github.com/Freescale/u-boot-fslc.git;branch=${SRCBRANCH};protocol=https"
+SRC_URI = "git://github.com/Freescale/u-boot-fslc.git;branch=${SRCBRANCH};protocol=https \
+           file://0001-Add-support-for-OpenSSL-Provider-API.patch \
+"
 
-SRCREV = "aa4bc52d08c342df83e3c576e2c108d7c8816e0e"
-SRCBRANCH = "2025.01+fslc"
+SRCREV = "322904a1db22d45b9a7f4627e1093fe4f6befaba"
+SRCBRANCH = "2026.10+fslc"
 
 CVE_PRODUCT = "denx:u-boot"
 
diff --git a/recipes-bsp/u-boot/u-boot-fslc-mxsboot_2025.01.bb b/recipes-bsp/u-boot/u-boot-fslc-mxsboot_2026.10.bb
index a5c4011aa..a5c4011aa 100644
--- a/recipes-bsp/u-boot/u-boot-fslc-mxsboot_2025.01.bb
+++ b/recipes-bsp/u-boot/u-boot-fslc-mxsboot_2026.10.bb
diff --git a/recipes-bsp/u-boot/u-boot-fslc_2025.01.bb b/recipes-bsp/u-boot/u-boot-fslc_2026.10.bb
index 92076aa72..92076aa72 100644
--- a/recipes-bsp/u-boot/u-boot-fslc_2025.01.bb
+++ b/recipes-bsp/u-boot/u-boot-fslc_2026.10.bb