Re: [OE-core] [PATCH v2] kernel-fit-image: support arbitrary loadables

Francesco Valla
2026-03-03T20:41:24Z

Hi Trevor,

On 3/2/26 19:00, Trevor Gamblin wrote:
>
> On 2026-03-01 16:17, Francesco Valla via lists.openembedded.org wrote:
>> Allow a user to insert additional, arbitrary loadables in a FIT image.
>> The loadables can be specified through the FIT_LOADABLES variable as
>> a list, with parameters defined by flags on dedicated FIT_LOADABLE_*
>> variables; they will be included in all configurations.
>>
>> Sensible defaults will be used for some parameters (type, compression,
>> description, arch, os) if the corresponding flag is not set, while
>> others (load address and entry point) will be omitted in the final FIT
>> image.
>>
>> As an example, the following configuration can be specified to add as
>> loadables a TF-A BL31 firmware and a (compressed) TEE firmware, to be
>> loaded respectively at 0x204E0000 and 0x96000000:
>>
>>    FIT_LOADABLES = "atf tee"
>>
>>    FIT_LOADABLE_FILENAME[atf] = "bl31.bin"
>>    FIT_LOADABLE_TYPE[atf] = "tfa-bl31"
>>    FIT_LOADABLE_ARCH[atf] = "arm64"
>>    FIT_LOADABLE_OS[atf] = "arm-trusted-firmware"
>>    FIT_LOADABLE_LOADADDRESS[atf] = "0x204E0000"
>>
>>    FIT_LOADABLE_FILENAME[tee] = "tee.bin.gz"
>>    FIT_LOADABLE_COMPRESSSION[tee] = "gzip"
>>    FIT_LOADABLE_TYPE[tee] = "tee"
>>    FIT_LOADABLE_OS[tee] = "tee"
>>    FIT_LOADABLE_LOADADDRESS[tee] = "0x21000000"
>>
>> Signed-off-by: Francesco Valla <francesco@valla.it>
>> ---
>> Hello,
>>
>> (sending this shortly after the v1 because that one had a wrong approach
>> to testing - sorry for the noise)
>>
>> this patchset adds the possibility to include arbitrary loadables in a
>> kernel FIT image and to define all associated parameters (description,
>> compression, type, arch, os, load address and entry address) through
>> variables.
>>
>> The idea behind the proposal is to be able to generate FIT images for
>> complex boot flows, in which components beyond the Linux kernel, its FDT
>> and an initramfs need to be loaded before the aforementioned Linux
>> kernel is up and running.
>>
>> As an example, the setup propose by Marek Vasut in [1] (boot of the
>> kernel through OP-TEE, with both components being loaded from a single
>> FIT by U-Boot) could be simply obtained with:
>>
>>    FIT_LOADABLES = "tee"
>>    FIT_LOADABLE_DESCRIPTION[tee] = "OP-TEE"
>>    FIT_LOADABLE_TYPE[tee] = "tee"
>>    FIT_LOADABLE_ARCH = "arm"
>>    FIT_LOADABLE_OS[tee] = "tee"
>>    FIT_LOADABLE_LOADADDRESS[tee] = "0xde000000"
>>    FIT_LOADABLE_ENTRYPOINT[tee] = "0xde000000"
>>
>> while a more complex flow I'm experimenting on (boot of the OP-TEE and
>> the kernel through TF-A on the i.MX93, with all components being loaded
>> from a single FIT by U-Boot SPL after verification) as:
>>
>>    FIT_LOADABLES = "atf tee"
>>
>>    FIT_LOADABLE_FILENAME[atf] = "bl31-imx93.bin-optee"
>>    FIT_LOADABLE_DESCRIPTION[atf] = "TF-A Firmware"
>>    FIT_LOADABLE_TYPE[atf] = "tfa-bl31"
>>    FIT_LOADABLE_OS[atf] = "arm-trusted-firmware"
>>    FIT_LOADABLE_LOADADDRESS[atf] = "0x204E0000"
>>
>>    FIT_LOADABLE_FILENAME[tee] = "tee.bin"
>>    FIT_LOADABLE_DESCRIPTION[tee] = "OP-TEE"
>>    FIT_LOADABLE_TYPE[tee] = "tee"
>>    FIT_LOADABLE_OS[tee] = "tee"
>>    FIT_LOADABLE_LOADADDRESS[tee] = "0x96000000"
>>
>> Being inside the FIT image, and part of all configurations, the
>> loadables can be in this way hashed and (optionally) signed and/or
>> encrypted with the same flow and key(s) already in place for the kernel.
>>
>> The generated FIT image is compatible with the U-Boot FIT "full" boot
>> flow, which loads any component part of the "loadables" group after the
>> kernel, the fdt and the initramfs.
>>
>> Regards,
>> Francesco Valla
>
> Hi,
>
> Thanks for submitting this. LGTM, but it'd be nice to have it
> documented as well.
>
> Could you add some details to the Yocto Project docs (e.g. in the
> "Variables Glossary" section) and submit it to
> docs@lists.yoctoproject.org?

Yes, documentation here is pretty much necessary to understand how this
shall be used.
I'll work on it as soon as possible.

>
> Thanks,
>
> Trevor
>
Regards,

Francesco