[PATCH 0/5] Enhance the SPL FIT "full" loading logic

[PATCH 0/5] Enhance the SPL FIT "full" loading logic

[Francesco Valla]

Hello,

this patch set tries to align the behavior of the SPL FIT "full" boot
flow (i.e., the one obtained enabling SPL_LOAD_FIT_FULL) to the one
happening in U-Boot proper through the bootm command.

The final goal is to simplify the implementation of FIT-based Falcon
boot on new platforms, reducing the need of custom per-arch or (even 
worse) per-board logic. The reduced FIT loading logic is in fact not
enough in some of the modern platforms, where additional firmware
components (e.g.: TF-A, OP-TEE, auxilliary processors) need to be
loaded alongside the Linux kernel and its devicetree.
 
Note: patch 1 fixes a bug in the signature checking logic when called
from the SPL and should probably be applied even in case the other
patches are not deemed suitable for inclusion.

Thank you!

Regards,
Francesco Valla

Signed-off-by: Francesco Valla <francesco@valla.it>
---
Francesco Valla (5):
      boot: fit: fix FIT verification in SPL
      boot: fit: decompress kernel when in SPL
      boot: fit: enable FIT image post-processing in SPL
      spl: call ft_board_setup() and ft_system_setup() if enabled
      spl: fit: add ramdisk load

 boot/image-fit.c     | 11 ++++++-----
 common/spl/spl.c     | 33 ++++++++++++++++++++++++++++++---
 common/spl/spl_fit.c | 18 ++++++++++++++++--
 include/spl.h        | 20 ++++++++++++++++++++
 4 files changed, 72 insertions(+), 10 deletions(-)
---
base-commit: 4433253ecf2041f9362a763bb6cb79960921ac7e
change-id: 20260428-spl_fit_full-19a0b8b1aada

Best regards,
--  
Francesco Valla <francesco@valla.it>

[PATCH 1/5] boot: fit: fix FIT verification in SPL

[Francesco Valla]

Align the behavior of fit_image_verify() called in SPL to the one in
full U-Boot. In particular, this function is called when both
CONFIG_SPL_LOAD_FIT_FULL and CONFIG_SPL_FIT_SIGNATURE are set (which can
happen e.g. in case of secure falcon boot).

Signed-off-by: Francesco Valla <francesco@valla.it>
---
 boot/image-fit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/boot/image-fit.c b/boot/image-fit.c
index 2d2709aa5b16..9aa165a38cd9 100644
--- a/boot/image-fit.c
+++ b/boot/image-fit.c
@@ -1439,7 +1439,7 @@ int fit_image_verify(const void *fit, int image_noffset)
 	size_t		size;
 	char		*err_msg = "";
 
-	if (IS_ENABLED(CONFIG_FIT_SIGNATURE) && strchr(name, '@')) {
+	if (CONFIG_IS_ENABLED(FIT_SIGNATURE) && strchr(name, '@')) {
 		/*
 		 * We don't support this since libfdt considers names with the
 		 * name root but different @ suffix to be equal

-- 
2.54.0

Re: [PATCH 1/5] boot: fit: fix FIT verification in SPL

[Simon Glass]

On 2026-04-28T20:24:41, Francesco Valla <francesco@valla.it> wrote:
> boot: fit: fix FIT verification in SPL
>
> Align the behavior of fit_image_verify() called in SPL to the one in
> full U-Boot. In particular, this function is called when both
> CONFIG_SPL_LOAD_FIT_FULL and CONFIG_SPL_FIT_SIGNATURE are set (which can
> happen e.g. in case of secure falcon boot).
>
> Signed-off-by: Francesco Valla <francesco@valla.it>
>
> boot/image-fit.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Simon Glass <sjg@chromium.org>

[PATCH 2/5] boot: fit: decompress kernel when in SPL

[Francesco Valla]

During the esecution of fit_image_load() in full U-Boot, the kernel is
not decompressed as this step is typically performed by the bootm
command logic afterward. This is not however true when doing a falcon
boot from SPL; enable the decompression in this case (i.e., if
CONFIG_SPL_OS_BOOT is set).

Signed-off-by: Francesco Valla <francesco@valla.it>
---
 boot/image-fit.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/boot/image-fit.c b/boot/image-fit.c
index 9aa165a38cd9..f3ddee940dbd 100644
--- a/boot/image-fit.c
+++ b/boot/image-fit.c
@@ -2291,9 +2291,10 @@ int fit_image_load(struct bootm_headers *images, ulong addr,
 	if (!fit_image_get_comp(fit, noffset, &comp) &&
 	    comp != IH_COMP_NONE &&
 	    load_op != FIT_LOAD_IGNORED &&
-	    !(image_type == IH_TYPE_KERNEL ||
-	      image_type == IH_TYPE_KERNEL_NOLOAD ||
-	      image_type == IH_TYPE_RAMDISK)) {
+	    image_type != IH_TYPE_RAMDISK &&
+	    (CONFIG_IS_ENABLED(OS_BOOT) ||
+	     image_type != IH_TYPE_KERNEL ||
+	     image_type != IH_TYPE_KERNEL_NOLOAD)) {
 		ulong max_decomp_len = len * 20;
 
 		log_debug("decompressing image\n");

-- 
2.54.0

Re: [PATCH 2/5] boot: fit: decompress kernel when in SPL

[Simon Glass]

Hi Francesco,

On 2026-04-28T20:24:41, Francesco Valla <francesco@valla.it> wrote:
> boot: fit: decompress kernel when in SPL
>
> During the esecution of fit_image_load() in full U-Boot, the kernel is
> not decompressed as this step is typically performed by the bootm
> command logic afterward. This is not however true when doing a falcon
> boot from SPL; enable the decompression in this case (i.e., if
> CONFIG_SPL_OS_BOOT is set).
>
> Signed-off-by: Francesco Valla <francesco@valla.it>
>
> boot/image-fit.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)

> diff --git a/boot/image-fit.c b/boot/image-fit.c
> @@ -2291,9 +2291,10 @@ int fit_image_load(struct bootm_headers *images, ulong addr,
> +         image_type != IH_TYPE_RAMDISK &&
> +         (CONFIG_IS_ENABLED(OS_BOOT) ||
> +          image_type != IH_TYPE_KERNEL ||
> +          image_type != IH_TYPE_KERNEL_NOLOAD)) {

Since image_type can never be both IH_TYPE_KERNEL and
IH_TYPE_KERNEL_NOLOAD at the same time, (image_type != IH_TYPE_KERNEL
|| image_type != IH_TYPE_KERNEL_NOLOAD) is always true, the kernel is
decompressed unconditionally, including in U-Boot proper, which is
what the original code was trying to avoid.

I think you want:

    (CONFIG_IS_ENABLED(OS_BOOT) ||
     (image_type != IH_TYPE_KERNEL &&
      image_type != IH_TYPE_KERNEL_NOLOAD))

Can you see a way to add a test that exercises this path so the
regression would be caught?

> During the esecution of fit_image_load() in full U-Boot, the kernel is

execution

It is worth mentioning mention in the commit message that you rely on
CONFIG_IS_ENABLED(OS_BOOT) being false in U-Boot proper (since only
CONFIG_SPL_OS_BOOT exists), so existing behaviour is preserved there.

Regards,
Simon

Re: [PATCH 2/5] boot: fit: decompress kernel when in SPL

[Francesco Valla]

Hi Simon,

On Mon, May 04, 2026 at 06:08:40AM -0600, Simon Glass wrote:
> Hi Francesco,
> 
> On 2026-04-28T20:24:41, Francesco Valla <francesco@valla.it> wrote:
> > boot: fit: decompress kernel when in SPL
> >
> > During the esecution of fit_image_load() in full U-Boot, the kernel is
> > not decompressed as this step is typically performed by the bootm
> > command logic afterward. This is not however true when doing a falcon
> > boot from SPL; enable the decompression in this case (i.e., if
> > CONFIG_SPL_OS_BOOT is set).
> >
> > Signed-off-by: Francesco Valla <francesco@valla.it>
> >
> > boot/image-fit.c | 7 ++++---
> >  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> > diff --git a/boot/image-fit.c b/boot/image-fit.c
> > @@ -2291,9 +2291,10 @@ int fit_image_load(struct bootm_headers *images, ulong addr,
> > +         image_type != IH_TYPE_RAMDISK &&
> > +         (CONFIG_IS_ENABLED(OS_BOOT) ||
> > +          image_type != IH_TYPE_KERNEL ||
> > +          image_type != IH_TYPE_KERNEL_NOLOAD)) {
> 
> Since image_type can never be both IH_TYPE_KERNEL and
> IH_TYPE_KERNEL_NOLOAD at the same time, (image_type != IH_TYPE_KERNEL
> || image_type != IH_TYPE_KERNEL_NOLOAD) is always true, the kernel is
> decompressed unconditionally, including in U-Boot proper, which is
> what the original code was trying to avoid.
> 
> I think you want:
> 
>     (CONFIG_IS_ENABLED(OS_BOOT) ||
>      (image_type != IH_TYPE_KERNEL &&
>       image_type != IH_TYPE_KERNEL_NOLOAD))
>

This was exactly the first version, then I tried to simplify the logic
and quite obviously failed. I'll fix it for v2.

> Can you see a way to add a test that exercises this path so the
> regression would be caught?
> 
> > During the esecution of fit_image_load() in full U-Boot, the kernel is
> 
> execution
> 
> It is worth mentioning mention in the commit message that you rely on
> CONFIG_IS_ENABLED(OS_BOOT) being false in U-Boot proper (since only
> CONFIG_SPL_OS_BOOT exists), so existing behaviour is preserved there.
> 

Ok

> Regards,
> Simon

Thank you

Regards,
Francesco

[PATCH 3/5] boot: fit: enable FIT image post-processing in SPL

[Francesco Valla]

Since CONFIG_SPL_FIT_IMAGE_POST_PROCESS is a valid configuration, allow
it to be used when using the "full" FIT loading logic in SPL.

Signed-off-by: Francesco Valla <francesco@valla.it>
---
 boot/image-fit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/boot/image-fit.c b/boot/image-fit.c
index f3ddee940dbd..347304956a99 100644
--- a/boot/image-fit.c
+++ b/boot/image-fit.c
@@ -2243,7 +2243,7 @@ int fit_image_load(struct bootm_headers *images, ulong addr,
 	}
 
 	/* perform any post-processing on the image data */
-	if (!tools_build() && IS_ENABLED(CONFIG_FIT_IMAGE_POST_PROCESS))
+	if (!tools_build() && CONFIG_IS_ENABLED(FIT_IMAGE_POST_PROCESS))
 		board_fit_image_post_process(fit, noffset, &buf, &size);
 
 	len = (ulong)size;

-- 
2.54.0

Re: [PATCH 3/5] boot: fit: enable FIT image post-processing in SPL

[Simon Glass]

On 2026-04-28T20:24:41, Francesco Valla <francesco@valla.it> wrote:
> boot: fit: enable FIT image post-processing in SPL
>
> Since CONFIG_SPL_FIT_IMAGE_POST_PROCESS is a valid configuration, allow
> it to be used when using the 'full' FIT loading logic in SPL.
>
> Signed-off-by: Francesco Valla <francesco@valla.it>
>
> boot/image-fit.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Simon Glass <sjg@chromium.org>

Re: [PATCH 3/5] boot: fit: enable FIT image post-processing in SPL

[Quentin Schulz]

Hi Francesco,

On 4/28/26 10:24 PM, Francesco Valla wrote:
> Since CONFIG_SPL_FIT_IMAGE_POST_PROCESS is a valid configuration, allow
> it to be used when using the "full" FIT loading logic in SPL.
> 
> Signed-off-by: Francesco Valla <francesco@valla.it>
> ---
>   boot/image-fit.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/boot/image-fit.c b/boot/image-fit.c
> index f3ddee940dbd..347304956a99 100644
> --- a/boot/image-fit.c
> +++ b/boot/image-fit.c
> @@ -2243,7 +2243,7 @@ int fit_image_load(struct bootm_headers *images, ulong addr,
>   	}
>   
>   	/* perform any post-processing on the image data */
> -	if (!tools_build() && IS_ENABLED(CONFIG_FIT_IMAGE_POST_PROCESS))
> +	if (!tools_build() && CONFIG_IS_ENABLED(FIT_IMAGE_POST_PROCESS))

I think this can be reduced to

if (CONFIG_IS_ENABLED(FIT_IMAGE_POST_PROCESS))

as tools_build() is true when building for the host (tools), and 
CONFIG_IS_ENABLED prepends CONFIG_TOOLS_ when building for the host 
(tools) and we don't have a TOOLS_FIT_IMAGE_POST_PROCESS.

Cheers,
Quentin

Re: [PATCH 3/5] boot: fit: enable FIT image post-processing in SPL

[Francesco Valla]

Hi Quentin

On Thu, May 07, 2026 at 06:17:34PM +0200, Quentin Schulz wrote:
> Hi Francesco,
> 
> On 4/28/26 10:24 PM, Francesco Valla wrote:
> > Since CONFIG_SPL_FIT_IMAGE_POST_PROCESS is a valid configuration, allow
> > it to be used when using the "full" FIT loading logic in SPL.
> > 
> > Signed-off-by: Francesco Valla <francesco@valla.it>
> > ---
> >   boot/image-fit.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/boot/image-fit.c b/boot/image-fit.c
> > index f3ddee940dbd..347304956a99 100644
> > --- a/boot/image-fit.c
> > +++ b/boot/image-fit.c
> > @@ -2243,7 +2243,7 @@ int fit_image_load(struct bootm_headers *images, ulong addr,
> >   	}
> >   	/* perform any post-processing on the image data */
> > -	if (!tools_build() && IS_ENABLED(CONFIG_FIT_IMAGE_POST_PROCESS))
> > +	if (!tools_build() && CONFIG_IS_ENABLED(FIT_IMAGE_POST_PROCESS))
> 
> I think this can be reduced to
> 
> if (CONFIG_IS_ENABLED(FIT_IMAGE_POST_PROCESS))
> 
> as tools_build() is true when building for the host (tools), and
> CONFIG_IS_ENABLED prepends CONFIG_TOOLS_ when building for the host (tools)
> and we don't have a TOOLS_FIT_IMAGE_POST_PROCESS.
> 

Thanks, I'll check and add this to the v2.

> Cheers,
> Quentin

Regards,
Francesco

[PATCH 4/5] spl: call ft_board_setup() and ft_system_setup() if enabled

[Francesco Valla]

If board and system FDT setups are enabled by the corresponding
configuration options, perform them also in SPL. This aligns the
behavior of FIT loading from SPL and U-Boot proper in this aspect,
reducing the need for custom code in falcon boot setups.

Signed-off-by: Francesco Valla <francesco@valla.it>
---
 common/spl/spl.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/common/spl/spl.c b/common/spl/spl.c
index 722b18c98edc..a09ebac62c2a 100644
--- a/common/spl/spl.c
+++ b/common/spl/spl.c
@@ -156,6 +156,22 @@ void spl_fixup_fdt(void *fdt_blob)
 		printf(PHASE_PROMPT "arch_fixup_fdt err - %d\n", err);
 		return;
 	}
+
+	if (IS_ENABLED(CONFIG_OF_BOARD_SETUP)) {
+		err = ft_board_setup(fdt_blob, gd->bd);
+		if (err) {
+			printf(PHASE_PROMPT "ft_board_setup err - %d\n", err);
+			return;
+		}
+	}
+
+	if (IS_ENABLED(CONFIG_OF_SYSTEM_SETUP)) {
+		err = ft_system_setup(fdt_blob, gd->bd);
+		if (err) {
+			printf(PHASE_PROMPT "ft_system_setup err - %d\n", err);
+			return;
+		}
+	}
 #endif
 }
 

-- 
2.54.0

Re: [PATCH 4/5] spl: call ft_board_setup() and ft_system_setup() if enabled

[Simon Glass]

Hi Francesco,

On 2026-04-28T20:24:41, Francesco Valla <francesco@valla.it> wrote:
> spl: call ft_board_setup() and ft_system_setup() if enabled
>
> If board and system FDT setups are enabled by the corresponding
> configuration options, perform them also in SPL. This aligns the
> behavior of FIT loading from SPL and U-Boot proper in this aspect,
> reducing the need for custom code in falcon boot setups.
>
> Signed-off-by: Francesco Valla <francesco@valla.it>
>
> common/spl/spl.c | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)

> diff --git a/common/spl/spl.c b/common/spl/spl.c
> @@ -156,6 +156,22 @@ void spl_fixup_fdt(void *fdt_blob)
> +     if (IS_ENABLED(CONFIG_OF_BOARD_SETUP)) {
> +             err = ft_board_setup(fdt_blob, gd->bd);
> +             if (err) {
> +                     printf(PHASE_PROMPT "ft_board_setup err - %d\n", err);
> +                     return;
> +             }
> +     }
> +
> +     if (IS_ENABLED(CONFIG_OF_SYSTEM_SETUP)) {
> +             err = ft_system_setup(fdt_blob, gd->bd);
> +             if (err) {
> +                     printf(PHASE_PROMPT "ft_system_setup err - %d\n", err);
> +                     return;
> +             }
> +     }

CONFIG_OF_BOARD_SETUP / CONFIG_OF_SYSTEM_SETUP are not SPL-aware, so
any board that has them set today will start call ft_board_setup() /
ft_system_setup() in SPL with this patch. Can you use
CONFIG_IS_ENABLED() and add new SPL_... options for your board to
enable?

If we're aligning with image_setup_libfdt(),
CONFIG_OF_BOARD_SETUP_EXTENDED / ft_board_setup_ex() is also part of
that flow. Is leaving it out deliberate, or should it be handled here
too? A note in the commit message would help.

Regards,
Simon

Re: [PATCH 4/5] spl: call ft_board_setup() and ft_system_setup() if enabled

[Francesco Valla]

Hi Simon,

On Mon, May 04, 2026 at 06:09:01AM -0600, Simon Glass wrote:
> Hi Francesco,
> 
> On 2026-04-28T20:24:41, Francesco Valla <francesco@valla.it> wrote:
> > spl: call ft_board_setup() and ft_system_setup() if enabled
> >
> > If board and system FDT setups are enabled by the corresponding
> > configuration options, perform them also in SPL. This aligns the
> > behavior of FIT loading from SPL and U-Boot proper in this aspect,
> > reducing the need for custom code in falcon boot setups.
> >
> > Signed-off-by: Francesco Valla <francesco@valla.it>
> >
> > common/spl/spl.c | 16 ++++++++++++++++
> >  1 file changed, 16 insertions(+)
> 
> > diff --git a/common/spl/spl.c b/common/spl/spl.c
> > @@ -156,6 +156,22 @@ void spl_fixup_fdt(void *fdt_blob)
> > +     if (IS_ENABLED(CONFIG_OF_BOARD_SETUP)) {
> > +             err = ft_board_setup(fdt_blob, gd->bd);
> > +             if (err) {
> > +                     printf(PHASE_PROMPT "ft_board_setup err - %d\n", err);
> > +                     return;
> > +             }
> > +     }
> > +
> > +     if (IS_ENABLED(CONFIG_OF_SYSTEM_SETUP)) {
> > +             err = ft_system_setup(fdt_blob, gd->bd);
> > +             if (err) {
> > +                     printf(PHASE_PROMPT "ft_system_setup err - %d\n", err);
> > +                     return;
> > +             }
> > +     }
> 
> CONFIG_OF_BOARD_SETUP / CONFIG_OF_SYSTEM_SETUP are not SPL-aware, so
> any board that has them set today will start call ft_board_setup() /
> ft_system_setup() in SPL with this patch. Can you use
> CONFIG_IS_ENABLED() and add new SPL_... options for your board to
> enable?
>

Ok, I was not sure new config options would have been accepted here.
I'll do this on the V2.

> If we're aligning with image_setup_libfdt(),
> CONFIG_OF_BOARD_SETUP_EXTENDED / ft_board_setup_ex() is also part of
> that flow. Is leaving it out deliberate, or should it be handled here
> too? A note in the commit message would help.
> 

I missed ft_board_setup_ex() TBH. I'll take a look and do the
evaluation.

> Regards,
> Simon

Regards,
Francesco

[PATCH 5/5] spl: fit: add ramdisk load

[Francesco Valla]

Add ramdisk loading logic to the "full" SPL FIT loader, as well as the
corresponding FDT fixup. This is required for proper support of falcon
boot using FIT images, but is useless for a U-Boot launch, so make it
depend on SPL_OS_BOOT.

Signed-off-by: Francesco Valla <francesco@valla.it>
---
 common/spl/spl.c     | 17 ++++++++++++++---
 common/spl/spl_fit.c | 18 ++++++++++++++++--
 include/spl.h        | 20 ++++++++++++++++++++
 3 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/common/spl/spl.c b/common/spl/spl.c
index a09ebac62c2a..b4890ba9ae83 100644
--- a/common/spl/spl.c
+++ b/common/spl/spl.c
@@ -130,7 +130,7 @@ void __weak spl_perform_board_fixups(struct spl_image_info *spl_image)
 {
 }
 
-void spl_fixup_fdt(void *fdt_blob)
+void spl_fixup_fdt(void *fdt_blob, ulong initrd_start, ulong initrd_end)
 {
 #if defined(CONFIG_SPL_OF_LIBFDT)
 	int err;
@@ -172,6 +172,14 @@ void spl_fixup_fdt(void *fdt_blob)
 			return;
 		}
 	}
+
+#if IS_ENABLED(CONFIG_SPL_OS_BOOT)
+	err = fdt_initrd(fdt_blob, initrd_start, initrd_end);
+	if (err) {
+		printf(PHASE_PROMPT "fdt_initrd err - %d\n", err);
+		return;
+	}
+#endif
 #endif
 }
 
@@ -789,7 +797,9 @@ void board_init_r(gd_t *dummy1, ulong dummy2)
 		debug("Jumping to %s...\n", xpl_name(xpl_next_phase()));
 	} else if (CONFIG_IS_ENABLED(ATF) && os == IH_OS_ARM_TRUSTED_FIRMWARE) {
 		debug("Jumping to U-Boot via ARM Trusted Firmware\n");
-		spl_fixup_fdt(spl_image_fdt_addr(&spl_image));
+		spl_fixup_fdt(spl_image_fdt_addr(&spl_image),
+			      spl_image_ramdisk_start(&spl_image),
+			      spl_image_ramdisk_end(&spl_image));
 		jumper = &spl_invoke_atf;
 	} else if (CONFIG_IS_ENABLED(OPTEE_IMAGE) && os == IH_OS_TEE) {
 		debug("Jumping to U-Boot via OP-TEE\n");
@@ -804,7 +814,8 @@ void board_init_r(gd_t *dummy1, ulong dummy2)
 			fdt = (void *)SPL_PAYLOAD_ARGS_ADDR;
 		else
 			fdt = spl_image_fdt_addr(&spl_image);
-		spl_fixup_fdt(fdt);
+		spl_fixup_fdt(fdt, spl_image_ramdisk_start(&spl_image),
+			      spl_image_ramdisk_end(&spl_image));
 		spl_board_prepare_for_linux();
 		spl_image.arg = fdt;
 		jumper = &jump_to_image_linux;
diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c
index 46ebcabe56a1..51933ba7bebf 100644
--- a/common/spl/spl_fit.c
+++ b/common/spl/spl_fit.c
@@ -950,8 +950,8 @@ int spl_load_fit_image(struct spl_image_info *spl_image,
 	const char *fit_uname_config = NULL;
 	ulong fdt_hack;
 	const char *uname;
-	ulong fw_data = 0, dt_data = 0, img_data = 0;
-	ulong fw_len = 0, dt_len = 0, img_len = 0;
+	ulong fw_data = 0, dt_data = 0, img_data = 0, rd_data = 0;
+	ulong fw_len = 0, dt_len = 0, img_len = 0, rd_len = 0;
 	int idx, conf_noffset;
 	int ret;
 
@@ -1011,6 +1011,20 @@ int spl_load_fit_image(struct spl_image_info *spl_image,
 		}
 	}
 
+	if (spl_image->os != IH_OS_U_BOOT) {
+#ifdef CONFIG_SPL_FIT_SIGNATURE
+		images.verify = 1;
+#endif
+		ret = fit_image_load(&images, virt_to_phys((void *)header), NULL,
+				     &fit_uname_config, IH_ARCH_DEFAULT,
+				     IH_TYPE_RAMDISK, -1, FIT_LOAD_OPTIONAL,
+				     &rd_data, &rd_len);
+		if (ret >= 0) {
+			spl_image->ramdisk_addr = rd_data;
+			spl_image->ramdisk_size = rd_len;
+		}
+	}
+
 	conf_noffset = fit_conf_get_node((const void *)header,
 					 fit_uname_config);
 	if (conf_noffset < 0)
diff --git a/include/spl.h b/include/spl.h
index 5078d7525abb..a390cdd841b9 100644
--- a/include/spl.h
+++ b/include/spl.h
@@ -288,6 +288,8 @@ struct spl_image_info {
 	ulong entry_point;
 #if CONFIG_IS_ENABLED(LOAD_FIT) || CONFIG_IS_ENABLED(LOAD_FIT_FULL)
 	void *fdt_addr;
+	ulong ramdisk_addr;
+	ulong ramdisk_size;
 #endif
 #if defined(CONFIG_BOOTM_OPTEE) && defined(CONFIG_ARM) && !defined(CONFIG_ARM64)
 	ulong optee_addr;
@@ -325,6 +327,24 @@ static inline void *spl_image_fdt_addr(struct spl_image_info *info)
 #endif
 }
 
+static inline ulong spl_image_ramdisk_start(struct spl_image_info *info)
+{
+#if CONFIG_IS_ENABLED(LOAD_FIT) || CONFIG_IS_ENABLED(LOAD_FIT_FULL)
+	return info->ramdisk_addr;
+#else
+	return 0;
+#endif
+}
+
+static inline ulong spl_image_ramdisk_end(struct spl_image_info *info)
+{
+#if CONFIG_IS_ENABLED(LOAD_FIT) || CONFIG_IS_ENABLED(LOAD_FIT_FULL)
+	return info->ramdisk_addr + info->ramdisk_size;
+#else
+	return 0;
+#endif
+}
+
 struct spl_load_info;
 
 /**

-- 
2.54.0

Re: [PATCH 5/5] spl: fit: add ramdisk load

[Simon Glass]

Hi Francesco,

On 2026-04-28T20:24:41, Francesco Valla <francesco@valla.it> wrote:
> spl: fit: add ramdisk load
>
> Add ramdisk loading logic to the 'full' SPL FIT loader, as well as the
> corresponding FDT fixup. This is required for proper support of falcon
> boot using FIT images, but is useless for a U-Boot launch, so make it
> depend on SPL_OS_BOOT.
>
> Signed-off-by: Francesco Valla <francesco@valla.it>
>
> common/spl/spl.c     | 17 ++++++++++++++---
>  common/spl/spl_fit.c | 18 ++++++++++++++++--
>  include/spl.h        | 20 ++++++++++++++++++++
>  3 files changed, 50 insertions(+), 5 deletions(-)

> diff --git a/common/spl/spl.c b/common/spl/spl.c
> @@ -172,6 +172,14 @@ void spl_fixup_fdt(void *fdt_blob)
>                       return;
>               }
>       }
> +
> +#if IS_ENABLED(CONFIG_SPL_OS_BOOT)
> +     err = fdt_initrd(fdt_blob, initrd_start, initrd_end);
> +     if (err) {
> +             printf(PHASE_PROMPT "fdt_initrd err - %d\n", err);
> +             return;
> +     }
> +#endif
>  #endif
>  }

Please us 'if (IS_ENABLED(CONFIG_SPL_OS_BOOT))' - we try to avoid #if
in C files for better build-coverage.

> diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c
> @@ -1011,6 +1011,20 @@ int spl_load_fit_image(struct spl_image_info *spl_image,
>               }
>       }
>
> +     if (spl_image->os != IH_OS_U_BOOT) {
> +#ifdef CONFIG_SPL_FIT_SIGNATURE
> +             images.verify = 1;
> +#endif
> +             ret = fit_image_load(&images, virt_to_phys((void *)header), NULL,
> +                                  &fit_uname_config, IH_ARCH_DEFAULT,
> +                                  IH_TYPE_RAMDISK, -1, FIT_LOAD_OPTIONAL,
> +                                  &rd_data, &rd_len);
> +             if (ret >= 0) {
> +                     spl_image->ramdisk_addr = rd_data;
> +                     spl_image->ramdisk_size = rd_len;
> +             }
> +     }
> +

There is no SPL_OS_BOOT guard here, so the ramdisk lookup is attempted
for any non-U-Boot OS (ATF, OP-TEE, OpenSBI, Linux). Is that
intentional? With FIT_LOAD_OPTIONAL it is harmless when no ramdisk
node exists, but gating on CONFIG_IS_ENABLED(OS_BOOT) would match the
consumer side in spl_fixup_fdt()

> diff --git a/include/spl.h b/include/spl.h
> @@ -288,6 +288,8 @@ struct spl_image_info {
>       ulong entry_point;
>  #if CONFIG_IS_ENABLED(LOAD_FIT) || CONFIG_IS_ENABLED(LOAD_FIT_FULL)
>       void *fdt_addr;
> +     ulong ramdisk_addr;
> +     ulong ramdisk_size;
>  #endif

Only the LOAD_FIT_FULL path populates these (spl_load_simple_fit()
does not load a ramdisk), so they could be gated on LOAD_FIT_FULL
only. Please also add a kernel-doc comment to the new
spl_image_ramdisk_start()/spl_image_ramdisk_end() helpers describing
the units and what they return when the FIT loader is not enabled -
'end' in particular is ambiguous (inclusive vs exclusive), so please
state that it is the exclusive end address expected by fdt_initrd().

Regards,
Simon

Re: [PATCH 5/5] spl: fit: add ramdisk load

[Francesco Valla]

Hi Simon,

On Mon, May 04, 2026 at 06:09:31AM -0600, Simon Glass wrote:
> Hi Francesco,
> 
> On 2026-04-28T20:24:41, Francesco Valla <francesco@valla.it> wrote:
> > spl: fit: add ramdisk load
> >
> > Add ramdisk loading logic to the 'full' SPL FIT loader, as well as the
> > corresponding FDT fixup. This is required for proper support of falcon
> > boot using FIT images, but is useless for a U-Boot launch, so make it
> > depend on SPL_OS_BOOT.
> >
> > Signed-off-by: Francesco Valla <francesco@valla.it>
> >
> > common/spl/spl.c     | 17 ++++++++++++++---
> >  common/spl/spl_fit.c | 18 ++++++++++++++++--
> >  include/spl.h        | 20 ++++++++++++++++++++
> >  3 files changed, 50 insertions(+), 5 deletions(-)
> 
> > diff --git a/common/spl/spl.c b/common/spl/spl.c
> > @@ -172,6 +172,14 @@ void spl_fixup_fdt(void *fdt_blob)
> >                       return;
> >               }
> >       }
> > +
> > +#if IS_ENABLED(CONFIG_SPL_OS_BOOT)
> > +     err = fdt_initrd(fdt_blob, initrd_start, initrd_end);
> > +     if (err) {
> > +             printf(PHASE_PROMPT "fdt_initrd err - %d\n", err);
> > +             return;
> > +     }
> > +#endif
> >  #endif
> >  }
> 
> Please us 'if (IS_ENABLED(CONFIG_SPL_OS_BOOT))' - we try to avoid #if
> in C files for better build-coverage.
> 

Ok.

> > diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c
> > @@ -1011,6 +1011,20 @@ int spl_load_fit_image(struct spl_image_info *spl_image,
> >               }
> >       }
> >
> > +     if (spl_image->os != IH_OS_U_BOOT) {
> > +#ifdef CONFIG_SPL_FIT_SIGNATURE
> > +             images.verify = 1;
> > +#endif
> > +             ret = fit_image_load(&images, virt_to_phys((void *)header), NULL,
> > +                                  &fit_uname_config, IH_ARCH_DEFAULT,
> > +                                  IH_TYPE_RAMDISK, -1, FIT_LOAD_OPTIONAL,
> > +                                  &rd_data, &rd_len);
> > +             if (ret >= 0) {
> > +                     spl_image->ramdisk_addr = rd_data;
> > +                     spl_image->ramdisk_size = rd_len;
> > +             }
> > +     }
> > +
> 
> There is no SPL_OS_BOOT guard here, so the ramdisk lookup is attempted
> for any non-U-Boot OS (ATF, OP-TEE, OpenSBI, Linux). Is that
> intentional? With FIT_LOAD_OPTIONAL it is harmless when no ramdisk
> node exists, but gating on CONFIG_IS_ENABLED(OS_BOOT) would match the
> consumer side in spl_fixup_fdt()
> 

It _was_ intentional, since when I wrote initially this patch I was
experimenting with different options for the FIT image format (including
e.g. having TF-A instead of Linux marked as the OS).

But in the end a guard is probably a better option, I agree. 

> > diff --git a/include/spl.h b/include/spl.h
> > @@ -288,6 +288,8 @@ struct spl_image_info {
> >       ulong entry_point;
> >  #if CONFIG_IS_ENABLED(LOAD_FIT) || CONFIG_IS_ENABLED(LOAD_FIT_FULL)
> >       void *fdt_addr;
> > +     ulong ramdisk_addr;
> > +     ulong ramdisk_size;
> >  #endif
> 
> Only the LOAD_FIT_FULL path populates these (spl_load_simple_fit()
> does not load a ramdisk), so they could be gated on LOAD_FIT_FULL
> only. Please also add a kernel-doc comment to the new
> spl_image_ramdisk_start()/spl_image_ramdisk_end() helpers describing
> the units and what they return when the FIT loader is not enabled -
> 'end' in particular is ambiguous (inclusive vs exclusive), so please
> state that it is the exclusive end address expected by fdt_initrd().
> 

Ok.

> Regards,
> Simon

Thank you!

Regards,
Francesco

Re: [0/5] Enhance the SPL FIT "full" loading logic

[Simon Glass]

Hi Francesco,

On 2026-04-28T20:24:41, Francesco Valla <francesco@valla.it> wrote:

> this patch set tries to align the behavior of the SPL FIT 'full' boot
> flow (i.e., the one obtained enabling SPL_LOAD_FIT_FULL) to the one
> happening in U-Boot proper through the bootm command.

Please update doc/usage/spl.rst (and the falcon-boot section) to
mention the newly-supported pieces, i.e. kernel decompression,
post-processing, ft_board_setup()/ft_system_setup() and the ramdisk.

Please also extend the existing FIT/SPL tests (test/image, or the
pytests under test/py) to cover the new code paths. At minimum a
sandbox_spl test for the ramdisk fixup and ft_*_setup() invocation
would give us some coverage. Let me know if I can help with that.

Regards,
Simon

Re: [0/5] Enhance the SPL FIT "full" loading logic

[Francesco Valla]

Hi Simon,

thank you very much for the review!

On Mon, May 04, 2026 at 06:07:59AM -0600, Simon Glass wrote:
> Hi Francesco,
> 
> On 2026-04-28T20:24:41, Francesco Valla <francesco@valla.it> wrote:
> 
> > this patch set tries to align the behavior of the SPL FIT 'full' boot
> > flow (i.e., the one obtained enabling SPL_LOAD_FIT_FULL) to the one
> > happening in U-Boot proper through the bootm command.
> 
> Please update doc/usage/spl.rst (and the falcon-boot section) to
> mention the newly-supported pieces, i.e. kernel decompression,
> post-processing, ft_board_setup()/ft_system_setup() and the ramdisk.
> 

Ok, will do.

> Please also extend the existing FIT/SPL tests (test/image, or the
> pytests under test/py) to cover the new code paths. At minimum a
> sandbox_spl test for the ramdisk fixup and ft_*_setup() invocation
> would give us some coverage. Let me know if I can help with that.
> 

I'll try to add full tests, and chime in if something is not clear.

> Regards,
> Simon

Regards,
Francesco