| Age | Commit message (Collapse) | Author |
|---|
|
The phandles used inside a template are not copied to the node inserting
the template, leading to a missing phandle error.
The following example can be used to reproduce the issue:
&binman {
some_template: template-0 {
ti-secure-rom {
content = <&some_data>;
keyfile = "some_key";
};
some_data: blob-ext {
optional;
};
};
output-bin {
insert-template = <&some_template>;
};
};
With the error 'binman: Node '/binman/output-bin/ti-secure-rom': Cannot
find node for phandle 103' observed.
The test_copy_subnodes_from_phandles was also updated to verify the new
behavior of phandles being copied.
Reviewed-by: Moteen Shah <[email protected]>
Signed-off-by: Anshul Dalal <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Target-side configuration verification builds the signed-region list from
every image-reference property in the selected configuration. Host-side
signing still uses either the signature node sign-images property or the
legacy kernel/fdt/script default list.
This lets mkimage generate configuration signatures which U-Boot cannot
verify when the configuration references other image types, such as
firmware, loadables or ramdisk entries. It also lets the host and target
disagree when sign-images names only a subset of the configuration images.
Build the host-side signing list from the configuration properties in the
same way as target-side verification. Use one shared property classifier so
the host and target cannot drift apart again. This makes signed
configurations cover the root node, the configuration node, every
referenced image node, and its hash, cipher and dm-verity subnodes,
regardless of image type.
Warn when a legacy sign-images property is present, since it no longer
limits the signed image list. Require every referenced image to have at
least one hash subnode. Add sandbox coverage proving that a firmware
reference omitted from sign-images is still recorded in hashed-nodes and
verified.
Update the signed-configuration documentation to describe the same rule and
the hash-subnode requirement.
Fixes: 2092322b31cc ("boot: Add fit_config_get_hash_list() to build signed node list")
Signed-off-by: James Hilliard <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Similar to RISC-V and ARM, 32-bit and 64-bit LoongArch cannot be
distinguished solely by CONFIG_SYS_ARCH, but require different
toolchains if multilib is disabled in compiler, which is the case of
toolchain provided by kernel.org.
Override the parsed arch parameter for LoongArch configs based on
CONFIG_ARCH_LA64 Kconfig symbol.
Signed-off-by: Yao Zi <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Aristo Chen <[email protected]>m says:
This series brings back the FIT load address overlap detection that
was applied to next in September 2025 and reverted a day later in
commit e482fdbbca93 ("Revert "Merge patch series "mkimage: Detect FIT
image load address overlaps and fix related test/DTS issues""").
The v2 revert had two causes. On TI AM62x family boards the tispl FIT
image references the mutually exclusive tifsstub variants at a single
shared load address, and v2 tried to satisfy the checker by moving the
variants 64 KiB apart. Neha had warned in the v1 review that this
address is fixed by the platform and that moving the images would
break tifsstub selection, and that feedback was regrettably still
unaddressed when the series was applied. Nishanth then hit exactly
this class of failure in the K3 upstream boot build with real firmware
binaries, where am62px_evm, a board v2 had not even touched, failed
the new check on tifsstub-hs and tifsstub-fs sharing 0x9ca00000.
Separately, E Shattow reported an overlap on the StarFive VisionFive
2, which we later narrowed down to OpenSBI fw_payload.bin having been
passed to the build instead of the documented fw_dynamic.bin. With
fw_dynamic.bin the board has no overlap, as confirmed on the list in
January 2026.
Since then the structural fix for the tifsstub case has landed. The
series merged as commit 4e7a9bb0885e ("Merge patch series "arm: k3:
replace tifsstub runtime filter with per-state FIT configurations"")
gives each K3 security state its own FIT configuration referencing
only the matching tifsstub variant, so a per configuration overlap
check sees no conflict while the variants keep their required common
load address. That series was written precisely to unblock this one.
The underlying semantics, that overlap is a property of a single
configuration and that images referenced by different configurations
never coexist in memory, were discussed with the FIT spec folks in
flat-image-tree issue #32 [1].
The check itself is unchanged in spirit: for every configuration,
collect the load regions of all referenced images that have both a
load address and data, and fail the build if any two regions within
that configuration intersect. Images referenced only by different
configurations may freely share addresses.
Verification done for this version:
Running the new mkimage in reprocess mode over every FIT produced by
current master builds of am62x_evm, verdin-am62 and phycore_am62x
(A53 and R5 each) flags exactly one problem: the phycore u-boot FIT,
where the four SPL devicetree overlays are loaded simultaneously from
one configuration but are spaced only 4 KiB apart while each packaged
image measures 5.9 to 6.1 KiB including its ti-secure certificate.
That is a real overlap shipping today and patch 4 widens the spacing.
All tispl FITs with the per-state tifsstub configurations pass.
buildman with binman missing blob handling, matching CI, builds all of
phycore_am62x, phycore_am62ax, phycore_am64x, am62x_evm, am62ax_evm,
am62px_evm, am64x_evm, verdin-am62, verdin-am62p and am62x_beagleplay
(A53 and R5 each) plus starfive_visionfive2 with the check active,
since binman invokes the freshly built mkimage during these builds.
starfive_visionfive2 was additionally built with a real OpenSBI 1.7
fw_dynamic.bin passed via OPENSBI and completes cleanly.
The binman functional test suite shows no new failures compared to
master in the same environment. The nine tests whose fixtures are
touched by patches 1 to 3, including the OpenSSL engine and PKCS11
signing tests that only run when softhsm2 and opensc are available,
all pass. The mkimage validation pytests, including the two new
ones, pass against a sandbox build.
[1] https://github.com/open-source-firmware/flat-image-tree/issues/32
Link: https://lore.kernel.org/r/[email protected]
|
|
The fit,load property confuses users because the load address is
taken from the ELF file rather than being specified in the binman
node. Document how to inspect an ELF file to find out where its
segments will be loaded, using readelf, the linker script or objdump,
and point at the elf_sections and elf_sections_tee test linker
scripts as examples of two components placed to avoid overlapping
memory. Also note that the mkimage load address overlap check works
on packaged data sizes and therefore assumes uncompressed images.
Compared to the previously applied version of this change, the text
now lives in the fit etype docstring. The entry documentation is
produced from docstrings by the binman_docs Sphinx extension at
documentation build time, so no pre-generated file needs updating.
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Add a validation step to mkimage that checks, for every configuration
of a FIT image, whether the images referenced by that configuration
declare overlapping load regions. Images that are loaded together must
not share memory, and such conflicts currently go unnoticed until the
resulting image corrupts memory at runtime.
The check is strictly per configuration. Images that share a load
address while being referenced by different configurations are not
reported, because only one configuration is selected at boot. This
matches the layout used by the TI K3 tispl images since commit
c85bf61b14f9 ("arm: k3: select tifsstub via board_fit_config_name_match"),
where the mutually exclusive tifsstub variants moved into per security
state configurations precisely so that static tooling can reason about
each configuration on its own.
Images without a load address or without data are skipped, since
nothing is copied anywhere for them. Compared to the previously
reverted version of this check, the missing load address case no
longer prints a warning, as FDT images routinely have no load address
and the warning only added noise to every build. An image referenced
through several properties of the same configuration, for example
listed in both firmware and loadables, is only counted once.
When an overlap is found mkimage prints the configuration name
together with both image names and their regions, then fails with
FDT_ERR_BADSTRUCTURE. Teach main() to exit cleanly for that value the
same way it already does for FDT_ERR_NOTFOUND, since the error
message has already been printed.
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
testFitSplitElf builds both the ATF and TEE test images from the same
elf_sections binary, so the split-elf nodes generated for the two
images end up with identical load addresses and overlap in memory. An
upcoming commit teaches mkimage to validate whether the memory
regions referenced by a configuration overlap, which makes this test
fail.
Update the test to use a non-overlapping memory layout so the two
images no longer collide:
1. Add elf_sections_tee.lds, which mirrors elf_sections.lds with the
section addresses shifted up by 0x100000 for the TEE image.
2. Build an elf_sections_tee binary from it in the test Makefile.
3. Update ftest.py to use the separate ELF file for the TEE component
in split-elf operations.
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Several binman test fixtures describe FIT images whose configuration
references both a u-boot firmware image loaded at address 0x0 with a
size of 0x2e bytes and a split-elf atf image whose first segment is
loaded at 0x10, so the two images overlap in memory. The upcoming
mkimage load address overlap check refuses to build such images,
which makes the tests that run these fixtures through mkimage fail.
Move the u-boot load and entry addresses to 0x2000, clear of the atf
segments taken from elf_sections.lds, in the fixtures used by
testFitFirmwareLoadables, testFitSignSimple,
testFitSignNoSignatureNodes, testFitSignEngineSimple,
testFitSignEncryptEngine, testFitSignPKCS11Simple,
testFitSignPKCS11Object, testFitSignMultipleKeyPaths and
testKeyNameHintIsPathSimpleFit.
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Fix typo from `Singature` to `Signature`
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Dhruva Gole <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
WriteDocs() and write_bintool_docs() strip four characters from the start
of every docstring line but the first, to undo the indentation the source
file gives them. Since Python 3.13 the compiler already removes the common
indentation from docstrings [1], so this removes four characters of actual
text from every line of every entry and bintool description:
$ binman entry-docs | head
...
that an image node whose only content is an optional entry which was
is an example showing ATF, TEE and a device tree all combined::
Use inspect.cleandoc() instead, which produces the same result on both
older and newer interpreters.
The existing tests only checked that some output was produced, so they
missed this entirely; make them also confirm that a known line of a known
description survives intact.
Link: https://github.com/python/cpython/issues/81283 [1]
Signed-off-by: Alexey Charkov <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Yao Zi <[email protected]> says:
This originates the series "New CI image and fixes" sent by Jiaxun Yang
back to Jul. 2024, though only one PATCH remains since the Ubuntu image
used as CI's base has been bumped to noble-20251013.
I also found the upstream added new dependencies to swtpm, breaking
docker image build as we build the latest branch HEAD instead of a
specified version, so in this series swtpm is locked to v0.10.1, the
latest version without newly introduced dependencies.
Link: https://lore.kernel.org/r/[email protected]
|
|
Install LoongArch64 toolchains, build LoongArch64 QEMU,
build LoongArch64 GRUB.
Signed-off-by: Jiaxun Yang <[email protected]>
Signed-off-by: Yao Zi <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
|
|
Instead of pulling the latest code, specify the exact version to improve
reproducibility.
Fixes: 8a87d1ae9585 ("Dockerfile: build swtpm")
Signed-off-by: Yao Zi <[email protected]>
|
|
https://git.u-boot-project.org/u-boot/custodians/u-boot-snapdragon into next
* Support for building mbn files during the build with the new mkmbn
tool.
* Remove UCLASS_SMEM and the old smem driver (Qualcomm was the only
user of both), replace it with a port of the Linux SMEM driver.
* Refactor memory map parsing and support reading the memory layout from
the SMEM database.
* Set the serial# from SMEM.
* Introduce initial support for SPL in mach-snapdragon.
* Add a defconfig for sm8650 with U-Boot as the primary bootloader.
* Workaround an MMC issue by limiting the transfer size.
* Add support for SM7125/SC7180 (clock/pinctrl drivers and UFS phy).
* Add support for the QCS6490 powered Rubik Pi 3 board and document it.
|
|
Daniel Golle <[email protected]> says:
A signed FIT configuration can delegate the integrity of a (potentially
large) root filesystem image to the kernel's dm-verity instead of having
U-Boot hash the whole payload at boot: the FIT carries a "dm-verity"
subnode with the roothash, salt and block parameters, U-Boot passes the
roothash to Linux through the dm-mod.create bootargs, and dm-verity then
validates the filesystem block by block against it.
For that to be safe the roothash has to be trusted, and in a signed
configuration the only thing that establishes trust is the configuration
signature. The roothash was not covered by it. fit_config_add_hash()
collected the image node, its hash subnodes and its cipher subnode into
the signed region, but not the dm-verity subnode, so the roothash, the
sole integrity anchor for the filesystem, was left unsigned.
The result is a verified-boot bypass for the root filesystem: an
attacker who can rewrite the boot medium can replace the filesystem,
recompute a matching dm-verity tree, write the new roothash into the
unsigned dm-verity subnode, and the configuration signature still
verifies. dm-verity then faithfully validates the malicious filesystem
against the attacker's roothash.
This series closes the gap.
Link: https://lore.kernel.org/r/[email protected]
|
|
A dm-verity protected filesystem image is not hashed by U-Boot when it
is loaded; its integrity is delegated to the kernel, which validates the
filesystem on the fly against the roothash taken from the FIT dm-verity
subnode. The roothash is therefore the sole integrity anchor for the
filesystem, yet fit_config_add_hash() only adds the image node, its
hash subnodes and its cipher subnode to the signed region, leaving the
dm-verity subnode (roothash, salt and block parameters) unsigned.
An attacker able to rewrite the boot medium could then replace both the
filesystem and the roothash, recompute a matching dm-verity tree and
keep the configuration signature valid, defeating verified boot for the
root filesystem.
Add the dm-verity subnode to the list of nodes covered by the
configuration signature, both when signing (tools/image-host.c) and when
verifying (boot/image-fit-sig.c), so the roothash and salt are
authenticated together with the rest of the configuration.
Signed-off-by: Daniel Golle <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Both the boot-side and host-side fit_config_add_hash() repeat the same
sequence to append a node's path to the hashed-node list three times:
for the image node, for each hash subnode and for the cipher subnode.
Extract it into a helper, fit_config_add_node(), in each file, with no
functional change.
Signed-off-by: Daniel Golle <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Adjust the elf class to support creating ELF files from scratch so that
mkmbn can build an MBN file from the U-Boot binary image and fix some
imports to work correctly in the U-Boot build system.
The new tool inspects the DTB embedded in u-boot.bin and uses a lookup
table to determine the appropriate configuration based on the root
compatible property, effectively encoding the info that was previously
kept in documentation.
Link: https://patch.msgid.link/20260511-b4-qcom-tooling-improvements-v7-3-0c06346e79a9@linaro.org
Signed-off-by: Casey Connolly <[email protected]>
|
|
This is a fork of qtestsign[1] with modifications to integrate with the
U-Boot build system. It is pulled from
f3df53a5f0e3 ("Rename "fw" to "mbn"")
New Qualcomm dev boards flash U-Boot to the "uefi" partition, the format
is a standard ELF file with custom program headers containing Qualcomm
signatures, hashes and other metadata. Currently this is accomplished
with qtestsign manually, let's instead import it so we can integrate it
into the build process.
This library will be used by a new mkmbn.py tool to create MBN files
which can be directly flashed to the board.
[1]: https://github.com/msm8916-mainline/qtestsign
Link: https://patch.msgid.link/20260511-b4-qcom-tooling-improvements-v7-2-0c06346e79a9@linaro.org
Signed-off-by: Casey Connolly <[email protected]>
|
|
In case the image that is wrapped in the nxp_imx8mcst already contains
an FCFB header which is mandatory for SPI NOR boot, then the IVT is at
offset 0x1000 instead of offset 0x0, but the whole image including the
FCFB header must be signed to prevent attacker from tampering with any
of the headers. Add the FCFB handling.
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Add support for setting the CST backend, both via DT property and
CST_BACKEND environment variable. The CST currently supports two
backends, 'ssl' and 'pkcs11', with 'ssl' being the default when
CST tool is invoked without any -b parameter. Keep 'ssl' backend
as the default, but explicitly pass it via the '-b' parameter,
unless the user selects 'pkcs11' via either method.
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
U-Boot's Makefile passes KEYDIR to direct mkimage invocations, but
internal binman FIT builds only receive the generic BINMAN_INDIRS search
path. Adding KEYDIR to BINMAN_INDIRS treats it as one more input-file
search path: FIT entries still auto-detect a key directory from all
include directories, so an explicit KEYDIR may not be the directory that
gets passed to mkimage. It also makes a key-only directory part of the
generic blob lookup path.
Forward KEYDIR as a binman entry argument named keydir, matching the
existing entry-argument mechanism used for BL31, TEE, of-list and other
U-Boot build inputs. FIT entries use that directory directly for
mkimage -k when fit,sign or fit,encrypt is enabled, falling back to the
include-directory autodetection when keydir is not provided.
Signed-off-by: James Hilliard <[email protected]>
|
|
Stop depending on the current mkimage method of generating the FSPI
header, instead generate the FSPI header within binman itself. This
is more flexible, as the FSPI header properties can be configured
from within the board-specific DT instead of being hard-coded in
mkimage at build time.
Acked-by: Peng Fan <[email protected]>
Signed-off-by: Marek Vasut <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Aristo Chen <[email protected]> says:
fit_import_data() in tools/fit_image.c declares the data pointer and
the name of the external data property outside its loop over the
/images subnodes, so both values leak from one image into the next. An
image node that carries data-size but neither data-offset nor
data-position then reuses the pointer left behind by the previously
imported image: the previous image's data is written into the node,
after which the import aborts trying to delete an external data
property the node never had. Since that abort path only prints a
debug() message, a regular mkimage build fails with nothing but the
generic usage text. The failure mode also depends on the order of the
image nodes: when no externally stored image precedes the malformed
node, the pointer is still NULL, the node is skipped, and the hashing
stage reports a proper error instead.
A FIT authored from a .its cannot hit this, because dtc-authored
images carry inline data. It takes re-processing an external-data FIT
in which an image has lost its data-offset, for example one edited
with fdtput -d or produced by another tool:
mkimage -E -f demo.its demo.itb
fdtput -d demo.itb /images/kernel-2 data-offset
mkimage -F demo.itb
There is no silent-success path, because the failing property delete
always aborts the run before the file is written back, but the user is
left without any indication of what is wrong.
Patch 1 moves the declarations into the loop so that each image starts
from a clean state. A node without an external data reference is now
skipped consistently regardless of node order, and the later
processing stages report the malformed node with a proper error
message (Can't get image data/size).
Patch 2 adds a regression test that builds an external-data FIT,
deletes the data-offset property of the second image and re-processes
the result with mkimage -F. It asserts that mkimage fails and that the
diagnostic is present on stderr; the unfixed tool fails the second
assertion since it prints nothing beyond the usage text.
Link: https://lore.kernel.org/r/[email protected]
|
|
The data pointer and the name of the external data property are
declared outside the loop over the image nodes, so their values leak
from one image into the next. An image node that carries data-size but
neither data-offset nor data-position then reuses the pointer of the
previously imported image: the previous image's data is written into
the node before the import aborts when it tries to delete an external
data property the node does not have. Since that abort path only prints
a debug message, mkimage fails without any indication of what is wrong.
The failure mode also depends on the order of the image nodes: when no
externally stored image precedes the malformed node, the stale pointer
is still NULL, so the import skips the node and the hashing stage
reports a proper error instead.
Move the declarations into the loop so that each image starts from a
clean state. A node without an external data reference is now skipped
consistently regardless of node order, and a malformed node is always
reported by the later processing stages with a proper error message.
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
As part of moving our git forge to a new location, update all references
in tree to point to git.u-boot-project.org now.
Signed-off-by: Tom Rini <[email protected]>
|
|
The U-Boot Mailing-list is moving to the lists.u-boot-project.org
domain, so update all references of list.denx.de to the new
domain in the main README and MAINTAINERS files.
Signed-off-by: Neil Armstrong <[email protected]>
Reviewed-by: Peter Robinson <[email protected]>
|
|
The U-Boot Mailing-list is moving to the lists.u-boot-project.org
domain, so update all references of the list.denx.de to the new
domain in the patman code.
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Neil Armstrong <[email protected]>
Reviewed-by: Peter Robinson <[email protected]>
|
|
missing"
Julien Stephan <[email protected]> says:
When I first ran ./tools/qconfig.py, it immediately crashed with a
Python traceback because the configuration database had not yet been
generated.
This series adds a simple pre-check that detects this condition and
prints a clear error message instructing the user to generate the
database first using the -b option, instead of failing with an unhandled
exception.
While looking at the script, I also noticed that the help text still
references the obsolete moveconfig.rst document. This series updates
that reference as well.
Link: https://lore.kernel.org/r/[email protected]
|
|
This was missed during the renaming of the tool. Fix it.
Signed-off-by: Julien Stephan <[email protected]>
Fixes: ea4d6dead372 ("moveconfig: Rename the tool to qconfig")
Reviewed-by: Tom Rini <[email protected]>
|
|
When CONFIG_DATABASE does not exist, read_database() would fail with a
Python traceback. Add a pre-check to print a clear message asking the
user to generate the database first with the -b option.
Signed-off-by: Julien Stephan <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
|
|
The software revision field in the combined board config binary header
was hardcoded to 1, preventing independent control from SBL SWREV
configured via ti-secure-rom's sw-rev property.
Add support for the optional 'sw-rev' DTS property in ti_board_config
nodes, which sets the SWREV byte in the header. Defaults to 1 for
backward compatibility.
Signed-off-by: Shiva Tripathi <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
The ZynqMP Boot Image Format allows specifying the register
initialization file with the "[init]" attribute. Since this
feature is already supported by the "zynqmpimage" backend, this
commit leverages that existing capability to add support for the
"[init]" attribute in the zynqmpbif backend:
https://docs.amd.com/r/en-US/ug1283-bootgen-user-guide/init
This currently uses the same register initialization file format as
zynqmpimage (ASCII text hex values with each line composed of a pair
of register address and value), for example:
===
0xff003248 0x12345678
===
It is not, yet, compatible with the format used by bootgen:
https://docs.amd.com/r/en-US/ug1283-bootgen-user-guide/Initialization-Pairs-and-INT-File-Attribute
Use this feature, with other zynqmpbif options, like so:
===
image : {
[init] reginit.int
[bootloader] fsbl.elf
[pmufw_image] pmufw.elf
[destination_cpu=a53-0, exception_level=el-3] bl31.elf
[destination_cpu=a53-0, exception_level=el-2, load=0x08000000,
startup=0x08000000] u-boot.bin
}
===
Signed-off-by: Erich E. Hoover <[email protected]>
Signed-off-by: Michal Simek <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
|
|
|
|
Delete the command-line tool and its supporting modules, now that this
functionality lives in the standalone patch-manager package.
Keep the modules that buildman still imports (commit and patchstream,
plus their dependencies series, get_maintainer and settings), along with
the stub command. Trim __init__.py to match.
Signed-off-by: Simon Glass <[email protected]>
|
|
These tests cover the patch-management functionality, which is being
removed from the tree in favour of the standalone patch-manager package.
Drop the tests and their data files.
Signed-off-by: Simon Glass <[email protected]>
|
|
patman is now maintained as a standalone 'patch-manager' package, rather
than in the U-Boot tree. Replace the command with a small stub which
tells people how to install it.
buildman still uses the shared modules commit and patchstream (and their
dependencies), so leave those in place; the patches that follow remove
the patch-management code itself.
Signed-off-by: Simon Glass <[email protected]>
|
|
patman is no longer shipped from the U-Boot tree, so drop it from the
'make pip' target and from make_pip.sh, and remove its packaging files
(setup.py, pyproject.toml, requirements.txt). Nothing else refers to
them by this point in the series, so they can go.
Also fix binman's pyproject.toml, which declares package-data for a
'patman' package (a copy-paste leftover); use 'binman' instead.
Signed-off-by: Simon Glass <[email protected]>
|
|
The CI runner image pre-caches pip packages by downloading each tool's
requirements.txt from master. A later patch removes patman's
requirements.txt from the tree, so stop fetching and installing it.
The same step already installs setuptools explicitly (patman's
requirements list it too), so this needs nothing further.
This takes effect the next time someone rebuilds the image; the existing
image keeps working in the meantime.
Signed-off-by: Simon Glass <[email protected]>
|
|
The full patman manual now lives with the standalone patch-manager
package, making the 1000-line copy in the tree redundant.
Remove the in-tree manual, its README and the doc/develop/patman.rst
toctree page.
The sending-patches guide already introduces patman, so point it at the
patch-manager package instead of the now-dead ':doc:' cross-reference
and, with the manual gone, add a couple of lines on how the tool works.
Point the SPI howto at that guide too, rather than repeating the install
details.
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
Reviewed-by: Mattijs Korpershoek <[email protected]>
|
|
In preparation of the migration of the mailman mailing-list currently
hosted on the denx.de infrastructure, migrate the links in the code,
comments and documentation to https://patch.msgid.link to be future proof
and always link to the expected content data and uses the message-id in
the URL which will help find the appropriate e-mail in the future.
Signed-off-by: Neil Armstrong <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
|
|
OP-TEE tee.bin is generated externally and might be missing during the
build.
Signed-off-by: Mathieu Dubois-Briand <[email protected]>
|
|
Prepare v2026.07-rc5
|
|
Tom Rini <[email protected]> says:
As part of the resync to dtc version v1.7.2-35-g52f07dcca47c from the
Linux Kernel, we missed updating the fdt_check_full function because it
exists in its own file in upstream dtc and the kernel doesn't import it,
as reported by Anton Ivanov. This short series brings in the upstream
fdt_check.c file and then implements our size-saving option, but in the
modern way.
The size-saving portion has been upstreamed.
Link: https://lore.kernel.org/r/[email protected]
|
|
In the upstream project, the function fdt_check_full has been moved from
fdt_ro.c to its own file, fdt_check.c. This file is not included in the
Linux kernel copy and so has not been synced over. As we do need and use
the fdt_check_full function, bring that file over as of the current
upstream we are synced to. Remove our copy of this function from
fdt_ro.c and add fdt_check.o and 1-liner fdt_check.c where needed. Note
that for now, this will increase size in some cases as upstream does not
have a size reduction method here.
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Tom Rini <[email protected]>
|
|
fdt_get_name() can return NULL and set len to a negative error code.
fdt_find_regions() does not check for this, leading to a potential NULL
pointer dereference and a buffer out-of-bounds write during signature
verification of an untrusted FIT. fdt_next_region(), fdt_check_full(),
and display_fdt_by_regions() also lack validation.
Add NULL checks and propagate the error code from fdt_get_name()
to the caller.
Signed-off-by: Anton Ivanov <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
dotted directories"
Aristo Chen <[email protected]> says:
The get_basename() helper in tools/fit_image.c searches the entire input
path independently for the last '/' and the last '.'. When the last '.'
falls at an offset earlier than the last '/', for example "./mydt",
"a.b/c" or "sub.d/leaf", 'end' points before 'start' and the computed
length is negative. The size check uses signed comparison so the negative
value flows unchanged into memcpy() (cast to size_t there) and mkimage
segfaults during -f auto FIT generation. The helper is reached on every
auto-FIT build via the -b, --fit-tee and --fit-tfa-bl31 file arguments.
The first patch restricts the dot search to the substring that follows
the last slash, which is the minimal fix and preserves the existing
behaviour for typical inputs such as "arch/arm/dts/foo.dtb".
The second patch adds a parametrized sandbox test under
test/py/tests/test_fit_mkimage_validate.py that drives mkimage -f auto
with each of the crashing inputs ("./mydt", "./sub.d/leaf", "./a.b/c")
plus one control input ("./mydt.dtb"). The test reads the resulting
/images/fdt-1 description back from the produced FIT via fdtget to verify
get_basename()'s output matches the expected stripped basename.
Reproducer that previously segfaulted and now produces a valid image:
echo dummy > kernel.bin
echo dummy > ./mydt
./tools/mkimage -f auto -A arm -O linux -T kernel -C none \
-a 0x80000000 -e 0x80000000 -n test \
-d kernel.bin -b ./mydt out.itb
Verified by rebuilding tools/mkimage on master and running the command
above with each of the four parametrized inputs. The three crash triggers
all segfault before the fix and now produce the expected fdt-1
descriptions ("mydt", "leaf", "c"); the control input "./mydt.dtb"
continues to produce "mydt" as before.
Link: https://lore.kernel.org/r/[email protected]
|
|
The get_basename() helper in tools/fit_image.c searches the entire input
path for the last '/' and the last '.' independently. When the last '.'
falls at an offset earlier than the last '/' (for example "./mydt",
"a.b/c", or "sub.d/leaf"), 'end' points before 'start' and the computed
length is negative. The subsequent size check uses signed comparison so
the negative value passes through unchanged, and memcpy() is then called
with that length implicitly cast to size_t, which segfaults.
Restrict the dot search to the substring that follows the last slash so
that only an extension in the filename component can become the end of
the basename. This matches the function's stated intent of stripping an
extension from the leaf, and keeps the existing behaviour for typical
inputs such as "arch/arm/dts/foo.dtb".
Reproducer that previously segfaulted and now produces a valid image:
echo dummy > kernel.bin
echo dummy > ./mydt
./tools/mkimage -f auto -A arm -O linux -T kernel -C none \
-a 0x80000000 -e 0x80000000 -n test \
-d kernel.bin -b ./mydt out.itb
Signed-off-by: Aristo Chen <[email protected]>
Reviewed-by: Quentin Schulz <[email protected]>
|
|
Prepare v2026.07-rc4
|
|
A single percent sign might be interpreted as a string format directive
and shall thus be escaped - doubling it - to actually indicate a
percentage.
Without the escape, pytest fails to run test_fdt.py with the following
error:
ValueError: Test coverage failure
fdt code coverage: Traceback (most recent call last):
File "/usr/lib64/python3.14/argparse.py", line 1748, in _check_help
formatter._expand_help(action)
~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib64/python3.14/argparse.py", line 676, in _expand_help
return help_string % params
~~~~~~~~~~~~^~~~~~~~
TypeError: %c requires an int or a unicode character, not dict
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/home/user/u-boot/./tools/dtoc/test_fdt", line 1002, in <module>
sys.exit(main())
~~~~^^
File "/home/user/u-boot/./tools/dtoc/test_fdt", line 987, in main
parser.add_argument('-T', '--test-coverage', action='store_true',
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
default=False,
^^^^^^^^^^^^^^
help='run tests and check for 100% coverage')
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.14/argparse.py", line 1562, in add_argument
self._check_help(action)
~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib64/python3.14/argparse.py", line 1750, in _check_help
raise ValueError('badly formed help string') from exc
ValueError: badly formed help string
Fixes: 7640b166604e ("test_fdt: Convert to use argparse")
Signed-off-by: Francesco Valla <[email protected]>
|
