u-boot.git/doc/develop, branch next

test/py: nand: Add tests for NAND flash device

2026-08-28T20:57:37Z

Add tests for nand commands to test various NAND flash operations such as erase, write and read. Use the current test/py APIs (ubman fixture and utils helpers) and refactor the pre-command helper to return a dictionary. Also add the test_nand.py test to the generated documentation. See commit 8f8f0f0ed9d0 ("doc: pytest: Document the test_net_boot test") for the kinds of changes required for the docstring to be rendered correctly. Signed-off-by: Love Kumar

Prepare v2026.10-rc3

2026-08-25T00:46:24Z

Signed-off-by: Tom Rini

Prepare v2026.10-rc2

2026-08-10T22:43:34Z

Signed-off-by: Tom Rini

Merge patch series "boot: fit: authenticate the dm-verity roothash"

2026-08-10T18:37:16Z

Daniel Golle says: A signed FIT configuration can delegate the integrity of a (potentially large) root filesystem image to the kernel's dm-verity instead of having U-Boot hash the whole payload at boot: the FIT carries a "dm-verity" subnode with the roothash, salt and block parameters, U-Boot passes the roothash to Linux through the dm-mod.create bootargs, and dm-verity then validates the filesystem block by block against it. For that to be safe the roothash has to be trusted, and in a signed configuration the only thing that establishes trust is the configuration signature. The roothash was not covered by it. fit_config_add_hash() collected the image node, its hash subnodes and its cipher subnode into the signed region, but not the dm-verity subnode, so the roothash, the sole integrity anchor for the filesystem, was left unsigned. The result is a verified-boot bypass for the root filesystem: an attacker who can rewrite the boot medium can replace the filesystem, recompute a matching dm-verity tree, write the new roothash into the unsigned dm-verity subnode, and the configuration signature still verifies. dm-verity then faithfully validates the malicious filesystem against the attacker's roothash. This series closes the gap. Link: https://lore.kernel.org/r/cover.1785276461.git.daniel@makrotopia.org

test: fit: verify dm-verity roothash is covered by the config signature

2026-08-10T18:32:41Z

A dm-verity protected filesystem image is not hashed by U-Boot; its integrity is delegated to the kernel, which trusts the roothash taken from the FIT dm-verity subnode. For that chain of trust to hold, the roothash (and salt) must be part of the region covered by the configuration signature, otherwise an attacker can replace both the filesystem and the roothash while keeping the signature valid. Add two independent checks of this property: - test/py/tests/test_fit_verity_sign.py signs a configuration that references a filesystem image carrying a dm-verity subnode, then confirms that tampering the roothash or the salt is rejected by fit_check_sign. A control that tampers a byte known to be signed proves the check can fail. A matching page is added under doc/develop/pytest/ so the module documentation is rendered with the rest of the generated docs. - test/boot/fit_verity.c gains a runtime unit test that builds the exact node list the configuration signature is computed over, turns it into hashed regions and checks both that the roothash bytes fall inside a signed region and that tampering them changes the hash. It needs no private key, so it also runs on real devices and uses the same hash path a device would. To let the unit test build the signed-region node list, rename the config node-list helper to fit_config_get_signed_nodes(), make it non-static and declare it in image.h. Signed-off-by: Daniel Golle Reviewed-by: Simon Glass

Merge tag 'efi-2026-01-rc2' of https://git.u-boot-project.org/u-boot/custodians/u-boot-efi

2026-07-28T13:52:13Z

Pull request efi-2026-01-rc2 CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-efi/-/pipelines/753 Documentation: * sandbox: fix enum host_platform_flags description * switch from setenv to env set and from printenv to env print * document Renesas R-Car Gen5 RSIP Cortex-R52 start * thead: lpi4a: detail how to enable fastboot UEFI: * unify and correct GUID selection for security database variables * test: check default GUID selection of security database variables * set correct frame buffer address * check efi_deserialize_load_option() in get_dp_device()

Prepare v2026.10-rc1

2026-07-27T22:47:10Z

Signed-off-by: Tom Rini

Merge tag 'u-boot-rockchip-2026.10-20260724' of https://git.u-boot-project.org/u-boot/custodians/u-boot-rockchip

2026-07-27T17:05:58Z

- Switched to use upstream pinctrl header include, - Dropped SDHCI DT properties in U-Boot-specific DT for NanoPi R5 as most are present upstream and those which aren't are breaking devices, - Fixed ECC strength mismatch between reading and writing on non-0 NAND chips configured as boot medium (nand-is-boot-medium), - Moved Simon to reviewer for ARM ROCKCHIP, - Fixed build issue related to GPT capsule support accessing a struct member only present when CONFIG_PARTITION_TYPE_GUID is set, - Added support for new devices: - Anbernic RG-DS - ROC-RK3588S-PC

doc: Switch from setenv to env set

2026-07-27T16:50:27Z

The "env" command is the recommended environment management command, its "set" subcommand is the equivalent replacement for legacy "setenv" command. Update the documentation to use the contemporary "env set" command instead of legacy "setenv" command. Note that the "setenv" command is unlikely to be removed from U-Boot in the near future due to it being integral part of the command line ABI. Implemented using: $ sed -i 's@\@env set@g' $(git grep -li '\' doc/) README Signed-off-by: Marek Vasut

rockchip: pinctrl: replace RK_FUNC_n defines

2026-07-23T13:00:08Z

The use of RK_FUNC_n defines is deprecated in the upstream rockchip.h file. Replace all them by the function number. Signed-off-by: Johan Jonker Reviewed-by: Quentin Schulz Link: https://patch.msgid.link/51cb65e5-1702-467f-b961-c9cdd029056f@gmail.com Signed-off-by: Quentin Schulz