u-boot.git/tools/binman, branch next

fdt: Fix phandles not copying when using templates

2026-08-28T14:49:30Z

The phandles used inside a template are not copied to the node inserting the template, leading to a missing phandle error. The following example can be used to reproduce the issue: &binman { some_template: template-0 { ti-secure-rom { content = <&some_data>; keyfile = "some_key"; }; some_data: blob-ext { optional; }; }; output-bin { insert-template = <&some_template>; }; }; With the error 'binman: Node '/binman/output-bin/ti-secure-rom': Cannot find node for phandle 103' observed. The test_copy_subnodes_from_phandles was also updated to verify the new behavior of phandles being copied. Reviewed-by: Moteen Shah Signed-off-by: Anshul Dalal Reviewed-by: Simon Glass

Merge patch series "mkimage: detect FIT image load address overlaps"

2026-08-14T16:33:22Z

Aristo Chen m says: This series brings back the FIT load address overlap detection that was applied to next in September 2025 and reverted a day later in commit e482fdbbca93 ("Revert "Merge patch series "mkimage: Detect FIT image load address overlaps and fix related test/DTS issues"""). The v2 revert had two causes. On TI AM62x family boards the tispl FIT image references the mutually exclusive tifsstub variants at a single shared load address, and v2 tried to satisfy the checker by moving the variants 64 KiB apart. Neha had warned in the v1 review that this address is fixed by the platform and that moving the images would break tifsstub selection, and that feedback was regrettably still unaddressed when the series was applied. Nishanth then hit exactly this class of failure in the K3 upstream boot build with real firmware binaries, where am62px_evm, a board v2 had not even touched, failed the new check on tifsstub-hs and tifsstub-fs sharing 0x9ca00000. Separately, E Shattow reported an overlap on the StarFive VisionFive 2, which we later narrowed down to OpenSBI fw_payload.bin having been passed to the build instead of the documented fw_dynamic.bin. With fw_dynamic.bin the board has no overlap, as confirmed on the list in January 2026. Since then the structural fix for the tifsstub case has landed. The series merged as commit 4e7a9bb0885e ("Merge patch series "arm: k3: replace tifsstub runtime filter with per-state FIT configurations"") gives each K3 security state its own FIT configuration referencing only the matching tifsstub variant, so a per configuration overlap check sees no conflict while the variants keep their required common load address. That series was written precisely to unblock this one. The underlying semantics, that overlap is a property of a single configuration and that images referenced by different configurations never coexist in memory, were discussed with the FIT spec folks in flat-image-tree issue #32 [1]. The check itself is unchanged in spirit: for every configuration, collect the load regions of all referenced images that have both a load address and data, and fail the build if any two regions within that configuration intersect. Images referenced only by different configurations may freely share addresses. Verification done for this version: Running the new mkimage in reprocess mode over every FIT produced by current master builds of am62x_evm, verdin-am62 and phycore_am62x (A53 and R5 each) flags exactly one problem: the phycore u-boot FIT, where the four SPL devicetree overlays are loaded simultaneously from one configuration but are spaced only 4 KiB apart while each packaged image measures 5.9 to 6.1 KiB including its ti-secure certificate. That is a real overlap shipping today and patch 4 widens the spacing. All tispl FITs with the per-state tifsstub configurations pass. buildman with binman missing blob handling, matching CI, builds all of phycore_am62x, phycore_am62ax, phycore_am64x, am62x_evm, am62ax_evm, am62px_evm, am64x_evm, verdin-am62, verdin-am62p and am62x_beagleplay (A53 and R5 each) plus starfive_visionfive2 with the check active, since binman invokes the freshly built mkimage during these builds. starfive_visionfive2 was additionally built with a real OpenSBI 1.7 fw_dynamic.bin passed via OPENSBI and completes cleanly. The binman functional test suite shows no new failures compared to master in the same environment. The nine tests whose fixtures are touched by patches 1 to 3, including the OpenSSL engine and PKCS11 signing tests that only run when softhsm2 and opensc are available, all pass. The mkimage validation pytests, including the two new ones, pass against a sandbox build. [1] https://github.com/open-source-firmware/flat-image-tree/issues/32 Link: https://lore.kernel.org/r/20260731001347.35624-1-aristo.chen@canonical.com

binman: fit: document how ELF load addresses are determined

2026-08-14T16:33:22Z

The fit,load property confuses users because the load address is taken from the ELF file rather than being specified in the binman node. Document how to inspect an ELF file to find out where its segments will be loaded, using readelf, the linker script or objdump, and point at the elf_sections and elf_sections_tee test linker scripts as examples of two components placed to avoid overlapping memory. Also note that the mkimage load address overlap check works on packaged data sizes and therefore assumes uncompressed images. Compared to the previously applied version of this change, the text now lives in the fit etype docstring. The entry documentation is produced from docstrings by the binman_docs Sphinx extension at documentation build time, so no pre-generated file needs updating. Signed-off-by: Aristo Chen Reviewed-by: Simon Glass

binman: Fix FIT image overlap issues for testFitSplitElf

2026-08-14T16:33:22Z

testFitSplitElf builds both the ATF and TEE test images from the same elf_sections binary, so the split-elf nodes generated for the two images end up with identical load addresses and overlap in memory. An upcoming commit teaches mkimage to validate whether the memory regions referenced by a configuration overlap, which makes this test fail. Update the test to use a non-overlapping memory layout so the two images no longer collide: 1. Add elf_sections_tee.lds, which mirrors elf_sections.lds with the section addresses shifted up by 0x100000 for the TEE image. 2. Build an elf_sections_tee binary from it in the test Makefile. 3. Update ftest.py to use the separate ELF file for the TEE component in split-elf operations. Signed-off-by: Aristo Chen Reviewed-by: Simon Glass

binman: Fix FIT image overlap issues

2026-08-14T16:33:21Z

Several binman test fixtures describe FIT images whose configuration references both a u-boot firmware image loaded at address 0x0 with a size of 0x2e bytes and a split-elf atf image whose first segment is loaded at 0x10, so the two images overlap in memory. The upcoming mkimage load address overlap check refuses to build such images, which makes the tests that run these fixtures through mkimage fail. Move the u-boot load and entry addresses to 0x2000, clear of the atf segments taken from elf_sections.lds, in the fixtures used by testFitFirmwareLoadables, testFitSignSimple, testFitSignNoSignatureNodes, testFitSignEngineSimple, testFitSignEncryptEngine, testFitSignPKCS11Simple, testFitSignPKCS11Object, testFitSignMultipleKeyPaths and testKeyNameHintIsPathSimpleFit. Signed-off-by: Aristo Chen Reviewed-by: Simon Glass

binman: Fix typo for the test case name

2026-08-14T16:33:21Z

Fix typo from `Singature` to `Signature` Signed-off-by: Aristo Chen Reviewed-by: Dhruva Gole Reviewed-by: Simon Glass

binman: Do not dedent docstrings twice on Python 3.13+

2026-08-13T21:02:15Z

WriteDocs() and write_bintool_docs() strip four characters from the start of every docstring line but the first, to undo the indentation the source file gives them. Since Python 3.13 the compiler already removes the common indentation from docstrings [1], so this removes four characters of actual text from every line of every entry and bintool description: $ binman entry-docs | head ... that an image node whose only content is an optional entry which was is an example showing ATF, TEE and a device tree all combined:: Use inspect.cleandoc() instead, which produces the same result on both older and newer interpreters. The existing tests only checked that some output was produced, so they missed this entirely; make them also confirm that a known line of a known description survives intact. Link: https://github.com/python/cpython/issues/81283 [1] Signed-off-by: Alexey Charkov Reviewed-by: Simon Glass

binman: nxp_imx8mcst: Handle FCFB header during SPI NOR boot

2026-08-07T01:05:45Z

In case the image that is wrapped in the nxp_imx8mcst already contains an FCFB header which is mandatory for SPI NOR boot, then the IVT is at offset 0x1000 instead of offset 0x0, but the whole image including the FCFB header must be signed to prevent attacker from tampering with any of the headers. Add the FCFB handling. Signed-off-by: Marek Vasut Reviewed-by: Simon Glass

binman: add CST backend selection for i.MX8M signing

2026-08-03T12:31:24Z

Add support for setting the CST backend, both via DT property and CST_BACKEND environment variable. The CST currently supports two backends, 'ssl' and 'pkcs11', with 'ssl' being the default when CST tool is invoked without any -b parameter. Keep 'ssl' backend as the default, but explicitly pass it via the '-b' parameter, unless the user selects 'pkcs11' via either method. Signed-off-by: Marek Vasut Reviewed-by: Simon Glass

tools: binman: pass KEYDIR to FIT entries

2026-07-28T18:30:55Z

U-Boot's Makefile passes KEYDIR to direct mkimage invocations, but internal binman FIT builds only receive the generic BINMAN_INDIRS search path. Adding KEYDIR to BINMAN_INDIRS treats it as one more input-file search path: FIT entries still auto-detect a key directory from all include directories, so an explicit KEYDIR may not be the directory that gets passed to mkimage. It also makes a key-only directory part of the generic blob lookup path. Forward KEYDIR as a binman entry argument named keydir, matching the existing entry-argument mechanism used for BL31, TEE, of-list and other U-Boot build inputs. FIT entries use that directory directly for mkimage -k when fit,sign or fit,encrypt is enabled, falling back to the include-directory autodetection when keydir is not provided. Signed-off-by: James Hilliard