u-boot.git/tools, branch main

binman: gbb: update link

2026-08-29T04:41:36Z

The current link results in a 404. Looking at the Wayback Machine[1], I found a similar page currently being served. It's probably very outdated by now but at least it's not a 404 anymore. [1] https://web.archive.org/web/20230520044331/https://www.chromium.org/chromium-os/firmware-porting-guide/ Signed-off-by: Quentin Schulz

binman: btool: bootgen: update link to user guide

2026-08-29T04:41:36Z

The link doesn't serve the document anymore. It's available both in HTML and PDF form at another address but let's point at the HTML version in hope it stays online longer. Signed-off-by: Quentin Schulz

MAINTAINERS: Use proper Orphan status marking

2026-08-28T18:21:02Z

Orphaned is not correct status based on description. s/Orphaned/Orphan/g Signed-off-by: Michal Simek Reviewed-by: Quentin Schulz

Merge patch series "boot: fit: authenticate the dm-verity roothash"

2026-08-10T18:37:16Z

Daniel Golle says: A signed FIT configuration can delegate the integrity of a (potentially large) root filesystem image to the kernel's dm-verity instead of having U-Boot hash the whole payload at boot: the FIT carries a "dm-verity" subnode with the roothash, salt and block parameters, U-Boot passes the roothash to Linux through the dm-mod.create bootargs, and dm-verity then validates the filesystem block by block against it. For that to be safe the roothash has to be trusted, and in a signed configuration the only thing that establishes trust is the configuration signature. The roothash was not covered by it. fit_config_add_hash() collected the image node, its hash subnodes and its cipher subnode into the signed region, but not the dm-verity subnode, so the roothash, the sole integrity anchor for the filesystem, was left unsigned. The result is a verified-boot bypass for the root filesystem: an attacker who can rewrite the boot medium can replace the filesystem, recompute a matching dm-verity tree, write the new roothash into the unsigned dm-verity subnode, and the configuration signature still verifies. dm-verity then faithfully validates the malicious filesystem against the attacker's roothash. This series closes the gap. Link: https://lore.kernel.org/r/cover.1785276461.git.daniel@makrotopia.org

boot: fit: cover the dm-verity roothash with the config signature

2026-08-10T18:32:41Z

A dm-verity protected filesystem image is not hashed by U-Boot when it is loaded; its integrity is delegated to the kernel, which validates the filesystem on the fly against the roothash taken from the FIT dm-verity subnode. The roothash is therefore the sole integrity anchor for the filesystem, yet fit_config_add_hash() only adds the image node, its hash subnodes and its cipher subnode to the signed region, leaving the dm-verity subnode (roothash, salt and block parameters) unsigned. An attacker able to rewrite the boot medium could then replace both the filesystem and the roothash, recompute a matching dm-verity tree and keep the configuration signature valid, defeating verified boot for the root filesystem. Add the dm-verity subnode to the list of nodes covered by the configuration signature, both when signing (tools/image-host.c) and when verifying (boot/image-fit-sig.c), so the roothash and salt are authenticated together with the rest of the configuration. Signed-off-by: Daniel Golle Reviewed-by: Tom Rini Reviewed-by: Simon Glass

boot: fit: factor out node-path collection in fit_config_add_hash()

2026-08-10T18:32:41Z

Both the boot-side and host-side fit_config_add_hash() repeat the same sequence to append a node's path to the hashed-node list three times: for the image node, for each hash subnode and for the cipher subnode. Extract it into a helper, fit_config_add_node(), in each file, with no functional change. Signed-off-by: Daniel Golle Reviewed-by: Tom Rini Reviewed-by: Simon Glass

binman: nxp_imx8mcst: Handle FCFB header during SPI NOR boot

2026-08-07T01:05:45Z

In case the image that is wrapped in the nxp_imx8mcst already contains an FCFB header which is mandatory for SPI NOR boot, then the IVT is at offset 0x1000 instead of offset 0x0, but the whole image including the FCFB header must be signed to prevent attacker from tampering with any of the headers. Add the FCFB handling. Signed-off-by: Marek Vasut Reviewed-by: Simon Glass

binman: add CST backend selection for i.MX8M signing

2026-08-03T12:31:24Z

Add support for setting the CST backend, both via DT property and CST_BACKEND environment variable. The CST currently supports two backends, 'ssl' and 'pkcs11', with 'ssl' being the default when CST tool is invoked without any -b parameter. Keep 'ssl' backend as the default, but explicitly pass it via the '-b' parameter, unless the user selects 'pkcs11' via either method. Signed-off-by: Marek Vasut Reviewed-by: Simon Glass

tools: binman: pass KEYDIR to FIT entries

2026-07-28T18:30:55Z

U-Boot's Makefile passes KEYDIR to direct mkimage invocations, but internal binman FIT builds only receive the generic BINMAN_INDIRS search path. Adding KEYDIR to BINMAN_INDIRS treats it as one more input-file search path: FIT entries still auto-detect a key directory from all include directories, so an explicit KEYDIR may not be the directory that gets passed to mkimage. It also makes a key-only directory part of the generic blob lookup path. Forward KEYDIR as a binman entry argument named keydir, matching the existing entry-argument mechanism used for BL31, TEE, of-list and other U-Boot build inputs. FIT entries use that directory directly for mkimage -k when fit,sign or fit,encrypt is enabled, falling back to the include-directory autodetection when keydir is not provided. Signed-off-by: James Hilliard

binman: imx8mimage: Generate FSPI header in binman instead of mkimage

2026-07-27T14:30:25Z

Stop depending on the current mkimage method of generating the FSPI header, instead generate the FSPI header within binman itself. This is more flexible, as the FSPI header properties can be configured from within the board-specific DT instead of being hard-coded in mkimage at build time. Acked-by: Peng Fan Signed-off-by: Marek Vasut Reviewed-by: Simon Glass