u-boot.git/common/spl, branch next

spl: fit: Fill in the image descriptor when skipping a zero-size image

2026-08-13T21:02:57Z

load_simple_fit() is expected to fill in the image_info structure it receives upon successful return, but the path which skips a zero-sized image returns success without touching it. The result is that spl_fit_record_loadable() then publishes whatever else the descriptor happened to hold in /fit-images under the skipped image's name: the size and entry point of the previous loadable, or - for the first one, since image_info is declared without an initialiser - uninitialised stack. This is reachable whenever a FIT carries an image node with no content, which binman produces for an optional blob that was not supplied, such as an OP-TEE which the build did not provide. Ensure that the image_info structure is filled in with a size and entry point before returning, same way as other successful paths do (but skipping the actual load). Fixes: 6d99f866952b ("spl: fit: Skip attempting to load 0 length image") Signed-off-by: Alexey Charkov Reviewed-by: Simon Glass

of_live: support in SPL

2026-08-07T12:47:07Z

Add CONFIG_SPL_OF_LIVE and if set, initialize of_live in spl.c Signed-off-by: Michael Srba Reviewed-by: Simon Glass Reviewed-by: Casey Connolly Link: https://patch.msgid.link/20260521-qcom_spl-v9-2-c108ebe8ff4e@seznam.cz Signed-off-by: Casey Connolly

Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

2026-08-07T12:47:06Z

Some platforms (e.g. at least Qualcomm) use the ELF format in creative ways, including in the bootrom. Make SPL_REMAKE_ELF use a linker script specified in SPL_REMAKE_ELF_LDSCRIPT (with the previously hardcoded path as the default). Signed-off-by: Michael Srba Reviewed-by: Simon Glass Reviewed-by: Casey Connolly Link: https://patch.msgid.link/20260521-qcom_spl-v9-1-c108ebe8ff4e@seznam.cz Signed-off-by: Casey Connolly

spl: atf: fix BL32 entry point for multi-segment TEE images

2026-07-29T20:52:23Z

binman's split-elf operation records one FIT image node per ELF segment, all with os = "tee", and only the segment containing the ELF entry point carries an entry property. Since fdt_add_subnode() inserts new subnodes in front of existing ones, the /fit-images nodes end up in reverse recording order, so spl_fit_images_find() would return the *last* TEE segment and its load address was passed to BL31 as the BL32 entry point. On RK3588 with an OP-TEE tee.elf consisting of two PT_LOAD segments this made BL31 (SPD=opteed) ERET into OP-TEE's data segment at 0x30200000 instead of the entry point at 0x30000000, hanging the boot right after 'BL31: Initializing BL32'. Prefer the FIT image node which provides an entry property and only fall back to the first matching node when none of them has one. Signed-off-by: Daniel Golle

spl: fit: bound the external data size before reading it

2026-07-21T19:50:54Z

load_simple_fit() loads an image stored as external data by reading it from the boot device with a transfer sized from the FIT data-size property. That property is listed in exc_prop[] in image-fit-sig.c, so it is excluded from the configuration signature and stays under the control of anyone able to modify the boot medium even when CONFIG_SPL_FIT_SIGNATURE is enabled. The read happens before fit_image_verify_with_data() checks the image hash, so an inflated data-size overruns the destination before the corruption can be detected. The device-tree overlay path is the sharpest case, because there the destination is a fixed CONFIG_SPL_LOAD_FIT_APPLY_OVERLAY_BUF_SZ heap buffer. Pass the size of the destination into load_simple_fit() and reject an image whose data does not fit before the read is issued. The check is done in two places: an early bail on len > max_size, then a bail on the block-aligned size > max_size. The size check is the mathematically binding one because size is len rounded up to the device block length. The early bail exists so that get_aligned_image_size() never runs on a hostile len, where its int arithmetic would invoke signed-integer overflow. For the overlay path the bound is exact: the caller passes the size of its temporary buffer. For the firmware, loadables, FDT and FPGA call sites the destination is wherever the load_addr field points, with no defined upper limit at the call site. Those callers pass CONFIG_SYS_BOOTM_LEN as a conservative ceiling, matching the same limit spl_parse_legacy_validate() already applies to legacy images. It is not a tight bound on the actual capacity at the destination, just a cap that rejects implausibly-sized data. Signed-off-by: Aristo Chen Reviewed-by: Simon Glass

Kconfig: common: restyle

2026-06-25T20:13:36Z

Restyle all Kconfigs for "common": Menu entries : no space left Menu attributes: 1 TAB Help text : 1 TAB + 2 spaces Replace '---help---' by 'help' Signed-off-by: Johan Jonker

Merge patch series "Fixes, cleanup and a test for the SPL FIT "full" loader"

2026-06-17T20:25:13Z

Francesco Valla says: This patch set contains a collection of small fixes and cleanups for the "full" FIT loader that can be used for the SPL. The main beneficiary is the falcon boot flow, but the same loader can be used also for U-Boot proper. Patch 1 was part of another set, but I decided to put it here for a better separation between plumbing (here) and new features (there). I kept the Reviewed-by tag collected from Simon in that occasion. Patch 6 introduces a new unit test covering most of the code that is being cleaned up. The set was tested on a i.MX93 FRDM, both with and without signature and to boot both U-Boot proper and the Linux kernel directly (i.e., falcon boot). Link: https://lore.kernel.org/r/20260604-spl_fit_full_cleanup-v1-0-ec036b5872e2@valla.it

spl: fit: use CONFIG_IS_ENABLED whenever possible

2026-06-17T20:16:41Z

Replace #ifdef directives with the CONFIG_IS_ENABLED() for better coverage and cleaner code. In the mean time, convert the last IS_ENABLED() to CONFIG_IS_ENABLED(). Signed-off-by: Francesco Valla

spl: fit: drop the 'standalone' load attempt

2026-06-17T20:16:41Z

The 'standalone =' config property has been deprecated for ~5 years [1], with the loud warn about the deprecation lasting much more than the foreseen couple of releases. Remove the attempt to load the primary image through this property to save some boot time and code complexity. [1] https://lore.kernel.org/u-boot/20210401182531.2147653-5-mr.nuke.me@gmail.com/ Signed-off-by: Francesco Valla

spl: fit: rework the FDT load hack

2026-06-17T20:16:41Z

U-Boot proper expects its FDT to be right after its binary image; the "full" FIT image loader thus adopts an hack to relocate it, ignoring the specified load address. Rework the current form of the hack to: - support the 'sandbox' environment with a sysmem-aware memcpy; - use the ALIGN() macro instead of raw alignment logic; - align the FDT to 8-byte boundary as per FDT specifications; - fix the debug print (which was reporting the source address for the relocation instead of the destination one). Signed-off-by: Francesco Valla