u-boot.git/tools/binman/etype, branch master

binman: Add optee binary to i.MX9 platform types

2026-06-26T20:08:59Z

OP-TEE tee.bin is generated externally and might be missing during the build. Signed-off-by: Mathieu Dubois-Briand

binman: imx8mimage: Handle nxp,boot-from = "fspi"

2026-06-04T20:26:40Z

Boot from FSPI requires additional 448 Byte long header, with U-Boot SPL starting at offset 0x1000. Currently, both i.MX8MM and i.MX8MN attempt to generate this header using fspi_conf_block with filename pointing at CONFIG_FSPI_CONF_FILE file. This does not work, for two reasons. First, the CONFIG_FSPI_CONF_FILE is generated by mkimage -T imx8mimage and may not be available yet when the fspi_conf_block is evaluated. That leads to a race condition where highly parallel builds fail to find the CONFIG_FSPI_CONF_FILE, which is usually called fspi_header.bin, on first build attempt. Second, binman gets confused and patches incorrect offset of DDR PHY firmware blobs into U-Boot SPL, the offset is incremented by exactly 0x1000 which is the size of fspi_conf_block. Fix both problems at once, make imx8mimage handle the generated FSPI header and prepend it in front of the imx8mimage processed data. This way, the race condition is solved, because the data generated by the imx8mimage are surely combined only after mkimage -T imx8mimage ran. The binman offset calculation is also solved, because there is no fspi_conf_block node in the DT anymore. Signed-off-by: Marek Vasut

global: Update URL for U-Boot project

2026-05-25T15:30:47Z

Our official domain is now u-boot-project.org, so update all in-tree references to use the correct domain. Reviewed-by: Tony Dinh Reviewed-by: Peter Robinson Signed-off-by: Tom Rini

binman: collection: Set build_done on referenced entries

2026-05-05T16:37:09Z

The collection etype uses phandles in the 'content' property to reference other entries. Mark each referenced entry with build_done to avoid rebuilding the same entry data multiple times. This is important for cases where rebuilding may change the data content, e.g. due to timestamps or random IVs in encryption. Refactor GetContentsByPhandle() to return both the entry object and its data. Signed-off-by: yan wang Reviewed-by: Simon Glass

binman: Generate preload header and sign data only once

2026-05-05T16:37:09Z

To optimize preload generation, generate the header and signatures only after all data has been collected in ProcessContentsUpdate(). This avoids signing the data multiple times. Since header_size is known upfront (from __init__), create a placeholder in `ObtainContents()` to avoid an extra packing pass when ProcessContentsUpdate() detects a size change. This reduces unnecessary repacking and signing operations. Signed-off-by: Paul HENRYS Reviewed-by: Simon Glass

binman: DTS: Add dump-signature option for capsules

2026-03-18T12:14:17Z

Mkeficapsule can dump signature for signed capsules. It can be used in test to validate signature i.e. with openssl. Add an entry for device tree node. Signed-off-by: Wojciech Dubowik Reviewed-by: Simon Glass

binman: Accept pkcs11 URI tokens for capsule updates

2026-03-18T12:14:17Z

With pkcs11 support in mkeficapsule we can now accept URI tokens and not only files. Signed-off-by: Wojciech Dubowik Reviewed-by: Simon Glass

binman: blob_dtb: improve error message when SPL is not found

2025-12-10T19:45:29Z

When using binman with the '-a spl-dtb=y' flag, if the SPL blob is not found, binman throws a cryptic error message: binman: 'NoneType' object has no attribute 'startswith' Let's improve the error message to explicitly state which SPL blob is missing. This is particularly useful when binman is used as a standalone tool outside the U-Boot source tree. Signed-off-by: Jérémie Dautheribes [trini: Add '# pragma: no cover' because coverage doesn't seem to like the documentation about this error] Signed-off-by: Tom Rini

tools: binman: fit: add support for OpenSSL engines

2025-12-06T17:43:08Z

This adds support for using an OpenSSL engine for signing a FIT image. To use it, one should set the fit,engine property at the FIT node level with the engine to use. This will in turn call mkimage with the -N option. The -k argument to mkimage can be specified via fit,engine-keydir. If not specified, -k is not passed to mkimage. This property is especially useful for pkcs11 engine to specify slots, token label, etc... As far as I could tell, mkimage encrypts and signs a FIT in one go, thus the -k argument applies to both signing and encrypting. Considering we reuse the -k argument for two different meanings (info to pass to the engine when using an engine otherwise the directory where keys are stored), we cannot reasonably encrypt using local keys and signing with an engine, hence the enforced check. I believe it should be possible to support encrypting and signing with the same engine (using different key pairs of course, via different key-name-hint likely), but this is left for the next person to implement. This is why the property is named fit,engine and not fit,sign-engine. Ditto for fit,engine-keydir. The public key (with .crt extension) is still required if it needs to be embedded in the SPL DTB for example. We could probably support retrieving the public key from an engine, but this is a change to make to fdt_add_pubkey.c. Signed-off-by: Quentin Schulz

binman: add a new entry type to support .bin file generation for the i.MX95 platform

2025-09-17T11:16:04Z

To support passing specific commands defined in enum imx8image_cmd to the imx8image_copy_image() function, this patch introduces a new entry type nxp-imx9image. This entry generates a plain text data file containing the relevant commands, enabling flexible configuration during image creation. Signed-off-by: Alice Guo