u-boot.git/tools/fit_image.c, branch main

Merge patch series "tools: mkimage: fix get_basename crash on paths with dotted directories"

2026-06-11T18:00:55Z

Aristo Chen says: The get_basename() helper in tools/fit_image.c searches the entire input path independently for the last '/' and the last '.'. When the last '.' falls at an offset earlier than the last '/', for example "./mydt", "a.b/c" or "sub.d/leaf", 'end' points before 'start' and the computed length is negative. The size check uses signed comparison so the negative value flows unchanged into memcpy() (cast to size_t there) and mkimage segfaults during -f auto FIT generation. The helper is reached on every auto-FIT build via the -b, --fit-tee and --fit-tfa-bl31 file arguments. The first patch restricts the dot search to the substring that follows the last slash, which is the minimal fix and preserves the existing behaviour for typical inputs such as "arch/arm/dts/foo.dtb". The second patch adds a parametrized sandbox test under test/py/tests/test_fit_mkimage_validate.py that drives mkimage -f auto with each of the crashing inputs ("./mydt", "./sub.d/leaf", "./a.b/c") plus one control input ("./mydt.dtb"). The test reads the resulting /images/fdt-1 description back from the produced FIT via fdtget to verify get_basename()'s output matches the expected stripped basename. Reproducer that previously segfaulted and now produces a valid image: echo dummy > kernel.bin echo dummy > ./mydt ./tools/mkimage -f auto -A arm -O linux -T kernel -C none \ -a 0x80000000 -e 0x80000000 -n test \ -d kernel.bin -b ./mydt out.itb Verified by rebuilding tools/mkimage on master and running the command above with each of the four parametrized inputs. The three crash triggers all segfault before the fix and now produce the expected fdt-1 descriptions ("mydt", "leaf", "c"); the control input "./mydt.dtb" continues to produce "mydt" as before. Link: https://lore.kernel.org/r/20260526070336.23199-1-aristo.chen@canonical.com

tools: mkimage: fix get_basename crash on paths with dotted directories

2026-06-11T18:00:46Z

The get_basename() helper in tools/fit_image.c searches the entire input path for the last '/' and the last '.' independently. When the last '.' falls at an offset earlier than the last '/' (for example "./mydt", "a.b/c", or "sub.d/leaf"), 'end' points before 'start' and the computed length is negative. The subsequent size check uses signed comparison so the negative value passes through unchanged, and memcpy() is then called with that length implicitly cast to size_t, which segfaults. Restrict the dot search to the substring that follows the last slash so that only an extension in the filename component can become the end of the basename. This matches the function's stated intent of stripping an extension from the leaf, and keeps the existing behaviour for typical inputs such as "arch/arm/dts/foo.dtb". Reproducer that previously segfaulted and now produces a valid image: echo dummy > kernel.bin echo dummy > ./mydt ./tools/mkimage -f auto -A arm -O linux -T kernel -C none \ -a 0x80000000 -e 0x80000000 -n test \ -d kernel.bin -b ./mydt out.itb Signed-off-by: Aristo Chen Reviewed-by: Quentin Schulz

tools: mkimage: add dm-verity Merkle-tree generation

2026-05-27T19:41:33Z

When mkimage encounters a dm-verity subnode inside a component image node it now automatically invokes veritysetup(8) with --no-superblock to generate the Merkle hash tree, screen-scrapes the Root hash and Salt from the tool output, and writes the computed properties back into the FIT blob. The user only needs to specify algorithm, data-block-size, and hash-block-size in the ITS; mkimage fills in digest, salt, num-data-blocks, and hash-start-block. Because --no-superblock is used, hash-start-block equals num-data-blocks with no off-by-one. The image data property is replaced with the expanded content (original data followed directly by the hash tree) so that subsequent hash and signature subnodes operate on the complete image. fit_image_add_verification_data() is restructured into two passes: dm-verity first (may grow data), then hashes and signatures. Signed-off-by: Daniel Golle Reviewed-by: Simon Glass

mkimage: fit: align DTs in external data to 8 Bytes by default

2026-02-02T15:15:52Z

Unless specified otherwise using the mkimage -B n option, align DTs in fitImage external data to 8 Bytes, and retain alignment of everything else to 4 Bytes. This should fulfill the DTspec requirement, that DTs must be placed at 8 Byte aligned addresses, even for DTs that are part of fitImage with external data. For fitImage with embedded data, there is nothing we can do, as the embedded data are aligned to 4 Bytes, just like any other DT property. Replace fdtdec_get_child_count() counting of images with counting of padding using fdt_for_each_subnode(). This is much more useful, as the added up padding can be passed directly to calloc() when allocating the buffer which holds the external data. The image count is no longer needed. Adjust the image layouting such, that buf_ptr is incremented to place the next image at align_size aligned offset. This is done at the beginning of the loop, once the align_size for current image can be determined from the current image type. Update binman test to validate the new 8 Byte alignment. Signed-off-by: Marek Vasut

Merge patch series "test/py: fit: Deduplicate the test"

2025-12-06T17:46:15Z

This series from Marek Vasut cleans up some of the FIT pytests we have and then extends mkimage to support including the TEE in FIT images when using "-f auto" to create the resulting FIT. Link: https://lore.kernel.org/r/20251125154324.51940-1-marek.vasut@mailbox.org

mkimage: Add support for bundling TEE in mkimage -f auto

2025-12-06T17:46:09Z

Introduce two new parameters to be used with mkimage -f auto to bundle TEE image into fitImage, using auto-generated fitImage. Add -z to specify TEE file name and -Z to specify TEE load and entry point address. This is meant to be used with systems which boot all of TEE, Linux and its DT from a single fitImage, all booted by U-Boot. Example invocation: " $ mkimage -E -A arm -C none -e 0xc0008000 -a 0xc0008000 -f auto \ -d arch/arm/boot/zImage \ -b arch/arm/boot/dts/st/stm32mp135f-dhcor-dhsbc.dtb \ -z ../optee_os/out/arm-plat-stm32mp1/core/tee-raw.bin \ -Z 0xde000000 \ /path/to/output/fitImage " Documentation update and test are also included, the test validates both positive and negative test cases, where fitImage does not include TEE and does include TEE blobs. Acked-by: Quentin Schulz Signed-off-by: Marek Vasut

fit: support signing with only an engine_id

2025-12-06T17:43:08Z

Currently, when one wants to use an OpenSSL engine to sign a FIT image, one needs to pass a keydir (via -k) to mkimage which will then be prepended to the value of the key-name-hint before being passed as key_id argument to the OpenSSL Engine API, or pass a keyfile (via -G) to mkimage. My OpenSSL engine only has "slots" which are not mapped like directories, so using keydir is not proper, though I could simply have -k '' I guess but this won't work currently with binman anyway. Additionally, passing a keyfile (-G) when using an engine doesn't make sense as the key is stored in the engine. Let simply allow FIT images be signed if both keydir and keyfile are missing but an engine is to be used. The keyname member is already filled by looking at key-name-hint property in the FIT and passed to the engine, which is exactly what is needed here. Reviewed-by: Wolfgang Wallner Reviewed-by: Simon Glass Signed-off-by: Quentin Schulz

mkimage: fit: erase data-size property when importing data

2025-10-10T19:28:36Z

When importing data, the data-offset property is removed and the data content is imported inside the data property of the node. When mkimage is run twice on the same FIT, data-size property is already set in the second run, from the first run (via the fit_export_data function). If we don't remove the data-size property, nothing guarantees it matches the actual size of data within the data property. To avoid possible mistakes when handling the data property, let's simply remove the data-size property as well. This also fixes an ordering issue of the data-size and data-offset properties in FIT when comparing the FIT after one run of mkimage and a second run. This is due to fit_export_data setting data-offset property first (it doesn't exist so it's added) and then data-size (it doesn't exist so it's added) for the first run, while it sets data-offset property first (removed in fit_import_data, so it doesn't exist so it's added) and then data-size (it exists already from the first run, so it's simply modified) for the second run. Signed-off-by: Quentin Schulz

mkimage: fit: do not ignore fdt_setprop return code

2025-10-10T19:28:36Z

All explicit calls to fdt_setprop* in tools/ are checked except those three. Let's add a check for the return code of fdt_setprop_u32() calls. Signed-off-by: Quentin Schulz

mkimage: fit: do not overwrite fdt_setprop return value

2025-10-10T19:28:36Z

The return code of fdt_setprop is overwritten by the one from fdt_delprop meaning we could very well have an issue when setting the property that would be ignored if the deletion of the property that comes right after passes. Let's add a separate check for each. Fixes: 4860ee9b09e0 ("mkimage: allow internalization of data-position") Signed-off-by: Quentin Schulz