u-boot.git/common/spl, branch main

spl: atf: fix BL32 entry point for multi-segment TEE images

2026-07-29T20:52:23Z

binman's split-elf operation records one FIT image node per ELF segment, all with os = "tee", and only the segment containing the ELF entry point carries an entry property. Since fdt_add_subnode() inserts new subnodes in front of existing ones, the /fit-images nodes end up in reverse recording order, so spl_fit_images_find() would return the *last* TEE segment and its load address was passed to BL31 as the BL32 entry point. On RK3588 with an OP-TEE tee.elf consisting of two PT_LOAD segments this made BL31 (SPD=opteed) ERET into OP-TEE's data segment at 0x30200000 instead of the entry point at 0x30000000, hanging the boot right after 'BL31: Initializing BL32'. Prefer the FIT image node which provides an entry property and only fall back to the first matching node when none of them has one. Signed-off-by: Daniel Golle

spl: fit: bound the external data size before reading it

2026-07-21T19:50:54Z

load_simple_fit() loads an image stored as external data by reading it from the boot device with a transfer sized from the FIT data-size property. That property is listed in exc_prop[] in image-fit-sig.c, so it is excluded from the configuration signature and stays under the control of anyone able to modify the boot medium even when CONFIG_SPL_FIT_SIGNATURE is enabled. The read happens before fit_image_verify_with_data() checks the image hash, so an inflated data-size overruns the destination before the corruption can be detected. The device-tree overlay path is the sharpest case, because there the destination is a fixed CONFIG_SPL_LOAD_FIT_APPLY_OVERLAY_BUF_SZ heap buffer. Pass the size of the destination into load_simple_fit() and reject an image whose data does not fit before the read is issued. The check is done in two places: an early bail on len > max_size, then a bail on the block-aligned size > max_size. The size check is the mathematically binding one because size is len rounded up to the device block length. The early bail exists so that get_aligned_image_size() never runs on a hostile len, where its int arithmetic would invoke signed-integer overflow. For the overlay path the bound is exact: the caller passes the size of its temporary buffer. For the firmware, loadables, FDT and FPGA call sites the destination is wherever the load_addr field points, with no defined upper limit at the call site. Those callers pass CONFIG_SYS_BOOTM_LEN as a conservative ceiling, matching the same limit spl_parse_legacy_validate() already applies to legacy images. It is not a tight bound on the actual capacity at the destination, just a cap that rejects implausibly-sized data. Signed-off-by: Aristo Chen Reviewed-by: Simon Glass

Kconfig: common: restyle

2026-06-25T20:13:36Z

Restyle all Kconfigs for "common": Menu entries : no space left Menu attributes: 1 TAB Help text : 1 TAB + 2 spaces Replace '---help---' by 'help' Signed-off-by: Johan Jonker

Merge patch series "Fixes, cleanup and a test for the SPL FIT "full" loader"

2026-06-17T20:25:13Z

Francesco Valla says: This patch set contains a collection of small fixes and cleanups for the "full" FIT loader that can be used for the SPL. The main beneficiary is the falcon boot flow, but the same loader can be used also for U-Boot proper. Patch 1 was part of another set, but I decided to put it here for a better separation between plumbing (here) and new features (there). I kept the Reviewed-by tag collected from Simon in that occasion. Patch 6 introduces a new unit test covering most of the code that is being cleaned up. The set was tested on a i.MX93 FRDM, both with and without signature and to boot both U-Boot proper and the Linux kernel directly (i.e., falcon boot). Link: https://lore.kernel.org/r/20260604-spl_fit_full_cleanup-v1-0-ec036b5872e2@valla.it

spl: fit: use CONFIG_IS_ENABLED whenever possible

2026-06-17T20:16:41Z

Replace #ifdef directives with the CONFIG_IS_ENABLED() for better coverage and cleaner code. In the mean time, convert the last IS_ENABLED() to CONFIG_IS_ENABLED(). Signed-off-by: Francesco Valla

spl: fit: drop the 'standalone' load attempt

2026-06-17T20:16:41Z

The 'standalone =' config property has been deprecated for ~5 years [1], with the loud warn about the deprecation lasting much more than the foreseen couple of releases. Remove the attempt to load the primary image through this property to save some boot time and code complexity. [1] https://lore.kernel.org/u-boot/20210401182531.2147653-5-mr.nuke.me@gmail.com/ Signed-off-by: Francesco Valla

spl: fit: rework the FDT load hack

2026-06-17T20:16:41Z

U-Boot proper expects its FDT to be right after its binary image; the "full" FIT image loader thus adopts an hack to relocate it, ignoring the specified load address. Rework the current form of the hack to: - support the 'sandbox' environment with a sysmem-aware memcpy; - use the ALIGN() macro instead of raw alignment logic; - align the FDT to 8-byte boundary as per FDT specifications; - fix the debug print (which was reporting the source address for the relocation instead of the destination one). Signed-off-by: Francesco Valla

spl: fit: fix loadables load under sandbox

2026-06-17T20:16:41Z

Align the fit_image_load() call done for the loadables to the ones for other artifatcs (firmware, kernel, fdt), calling virt_to_phys() on the pointer that contains the FIT location. This is needed to support the 'sandbox' environment. Signed-off-by: Francesco Valla

Merge patch series "arm: omap: Add back omap4 support"

2026-06-17T15:52:33Z

Bastien Curutchet says: This series aims to add back the omap4 support. This support was removed by commit b0ee3fe642c ("arm: ti: Remove omap4 platform support") because at that moment, none of the OMAP4-based boards had done the migration to DM_I2C. My use case is an old product based on the Variscite's omap4 system on module. I needed to upgrade U-Boot on it for security reasons. I think that this work could benefit to other people who may have same kind of product to maintain. Patch 1 to 3 remove the omap's clock driver dependency to the AM33xx as it is also present in omap4 platforms. I tested these changes on the beaglebone black to ensure I didn't break the AM33xx case. Patch 4 & 5 revert the deletion of the omap4 support. The revert makes checkpatch.pl angry. I fixed quite a lots of warnings already but it remains two kinds of warnings: - CamelCase on timings structure, I left the CamelCase because IMHO it's more readable this way. - #ifdef CONFIG_XYZ shouldn't be used anymore. I left one of this because I didn't find a clean way to get rid of it. Patch 6 adds support for the Variscite's system on module. This system on module is supported by the Linux project through ti/omap/omap4-var-som-om44.dtsi Link: https://lore.kernel.org/r/20260608-omap4-support-v3-0-8595ccd203f0@bootlin.com

arm: ti: Introduce back omap4 support

2026-06-17T15:50:36Z

omap4 support was dropped by b0ee3fe642c ("arm: ti: Remove omap4 platform support") because the supported boards hadn't done the conversion to CONFIG_DM_I2C in time. It still exists some omap4-based products and they could benefit from the latest U-Boot support for obvious security reasons. Revert part of b0ee3fe642c to introduce back a minimal support for the omap4 platform. Fix the checkpatch's warning/errors induced by this revert. Following warnings are still present: | arch/arm/include/asm/arch-omap4/clock.h:445: WARNING: added, moved or deleted file(s), does MAINTAINERS need updating? | arch/arm/mach-omap2/omap4/hwinit.c:24: WARNING: Use 'if (IS_ENABLED(CONFIG...))' instead of '#if or #ifdef' where possible | arch/arm/mach-omap2/omap4/sdram_elpida.c:142: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:143: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:144: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:145: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:146: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:147: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:148: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:149: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:150: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:151: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:152: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:153: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:154: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:155: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:156: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:157: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:158: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:159: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:209: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:210: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:213: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:215: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:216: CHECK: Avoid CamelCase: | arch/arm/mach-omap2/omap4/sdram_elpida.c:217: CHECK: Avoid CamelCase: I didn't find an clean way to fix the "don't use #ifdef" warning as we need to define the gpio_bank for the SPL build only. For the CamelCase warnings, the incriminated attributes represent timings, so IMHO, it is more readable with CamelCase. Set myself as OMAP4 maintainer. Signed-off-by: Bastien Curutchet