On Thu, 25 Jun 2026 18:18:21 -0600, James Hilliard wrote:
> The fdt checksign command accepts an optional address for an FDT
> containing public keys. It currently installs that blob as gd->fdt_blob
> before verifying the FIT configuration.
>
> This breaks verification with DM-backed crypto drivers which have not
> probed yet, since the later probe path expects gd->fdt_blob to remain
> U-Boot's control FDT. For example, an ECDSA verifier can be bound from
> the control FDT but fail to probe after fdt checksign points
> gd->fdt_blob at the key-only DTB.
>
> [...]
Applied to u-boot/master, thanks!
[1/1] cmd: fdt: keep control FDT during checksign
commit: 58c2284a1a90d138f60364caf3513dda5693f8ff
--
Tom
