[PATCH 0/6] Support fastboot boot in SPL

[PATCH 0/6] Support fastboot boot in SPL

[Carlo Caione]

Test farms need to run successive U-Boot builds without rewriting boot
storage. Add optional fastboot boot support to SPL so an already-running
SPL can receive U-Boot over USB and hand off to it in RAM. U-Boot proper can
then load the operating system using its usual boot methods.

The standard host command, fastboot boot u-boot.itb, accepts a FIT built
for the target, including any firmware required by its SPL handoff.
Uncompressed legacy U-Boot images and raw binaries are also supported
when enabled by the board. Raw binaries use the board's configured load
and entry addresses. Legacy and raw downloads are rejected when SPL FIT
signature verification is enabled.

The series reuses the SPL RAM loader and normal SPL handoff. It also fixes
ignored errors when loading an explicitly requested FIT device tree and
invalidates stale or incomplete fastboot downloads, so neither can be
used to boot an unintended image.

Signed-off-by: Carlo Caione <ccaione@baylibre.com>
---
Carlo Caione (6):
      spl: fit: reject failures loading an explicitly requested FDT
      fastboot: invalidate stale and incomplete downloads
      spl: ram: allow loading FIT images from a supplied buffer
      spl: support booting FIT images downloaded with fastboot
      spl: fastboot: support legacy U-Boot images
      spl: fastboot: support raw U-Boot images

 MAINTAINERS                     |   3 +
 common/spl/Makefile             |   1 +
 common/spl/spl_fastboot_boot.c  |  76 +++++++++++++
 common/spl/spl_fit.c            |  14 ++-
 common/spl/spl_ram.c            | 101 ++++++++++++++----
 configs/sandbox_spl_defconfig   |   1 +
 doc/android/fastboot.rst        |  56 +++++++++-
 drivers/fastboot/Kconfig        |  16 +++
 drivers/fastboot/fb_command.c   |  43 +++++++-
 drivers/fastboot/fb_common.c    |   3 +-
 drivers/usb/gadget/f_fastboot.c |   9 +-
 include/fastboot-internal.h     |   3 +
 include/fastboot.h              |   8 ++
 include/spl.h                   |  25 +++++
 include/spl_load.h              |   2 +
 test/image/Kconfig              |   9 ++
 test/image/Makefile             |   2 +
 test/image/spl_fastboot.c       | 230 ++++++++++++++++++++++++++++++++++++++++
 test/image/spl_load.c           |  46 +++++++-
 test/image/spl_ram.c            |  48 +++++++++
 20 files changed, 666 insertions(+), 30 deletions(-)
---
base-commit: fed92546960a92177d67c0b8d7b22385f50fed29
change-id: 20261014-ccaione-upstream-spl-fastboot-boot-5d8e28a700ad

Best regards,
--  
Carlo Caione <ccaione@baylibre.com>

[PATCH 1/6] spl: fit: reject failures loading an explicitly requested FDT

[Carlo Caione]

A U-Boot image may embed its device tree, but a FIT which explicitly
names an FDT must not boot after that FDT fails to load or verify.
External FDT data is copied to its load address before verification,
so ignoring the error can leave an unverified device tree for U-Boot.

Keep support for U-Boot images without a separate FDT, but reject
failures for an explicitly requested FDT in both firmware and loadables.

Fixes: d879616e9e64 ("spl: fit: simplify logic for FDT loading for non-OS boots")
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
---
 common/spl/spl_fit.c  | 14 +++++++++++---
 test/image/spl_load.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 3 deletions(-)

diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c
index 64e5f95546f..a520db76506 100644
--- a/common/spl/spl_fit.c
+++ b/common/spl/spl_fit.c
@@ -491,11 +491,14 @@ static int spl_fit_append_fdt(struct spl_image_info *spl_image,
 	image_info.load_addr = ALIGN(spl_image->load_addr + spl_image->size, 8);
 
 	/* Figure out which device tree the board wants to use */
+	spl_image->fdt_addr = NULL;
 	node = spl_fit_get_image_node(ctx, FIT_FDT_PROP, index++);
 	if (node < 0) {
 		size_t size;
 
 		debug("%s: cannot find FDT node\n", __func__);
+		if (fdt_getprop(ctx->fit, ctx->conf_node, FIT_FDT_PROP, NULL))
+			return node;
 
 		/*
 		 * U-Boot did not find a device tree inside the FIT image. Use
@@ -896,6 +899,7 @@ int spl_load_simple_fit(struct spl_image_info *spl_image,
 	int ret;
 	int index = 0;
 	int firmware_node;
+	bool has_fdt;
 
 	ret = spl_simple_fit_read(&ctx, info, offset, fit);
 	if (ret < 0)
@@ -911,6 +915,8 @@ int spl_load_simple_fit(struct spl_image_info *spl_image,
 	if (ret < 0)
 		return ret;
 
+	has_fdt = fdt_getprop(ctx.fit, ctx.conf_node, FIT_FDT_PROP, NULL);
+
 	if (IS_ENABLED(CONFIG_SPL_FPGA))
 		spl_fit_load_fpga(&ctx, info, offset);
 
@@ -958,11 +964,11 @@ int spl_load_simple_fit(struct spl_image_info *spl_image,
 
 	/*
 	 * Booting a next-stage U-Boot may require us to append the FDT.
-	 * We allow this to fail, as the U-Boot image might embed its FDT.
+	 * A U-Boot image may omit it when the FDT is embedded in the binary.
 	 */
 	if (os_takes_devicetree(spl_image->os)) {
 		ret = spl_fit_append_fdt(spl_image, info, offset, &ctx);
-		if (ret < 0 && spl_image->os != IH_OS_U_BOOT)
+		if (ret < 0 && (has_fdt || spl_image->os != IH_OS_U_BOOT))
 			return ret;
 	}
 
@@ -999,7 +1005,9 @@ int spl_load_simple_fit(struct spl_image_info *spl_image,
 			debug("Loadable is %s\n", genimg_get_os_name(os_type));
 
 		if (os_takes_devicetree(os_type)) {
-			spl_fit_append_fdt(&image_info, info, offset, &ctx);
+			ret = spl_fit_append_fdt(&image_info, info, offset, &ctx);
+			if (ret < 0 && has_fdt)
+				return ret;
 			spl_image->fdt_addr = image_info.fdt_addr;
 		}
 
diff --git a/test/image/spl_load.c b/test/image/spl_load.c
index 334ec77b18e..166cf331194 100644
--- a/test/image/spl_load.c
+++ b/test/image/spl_load.c
@@ -367,6 +367,48 @@ SPL_IMG_TEST(spl_test_image, IMX8, 0);
 SPL_IMG_TEST(spl_test_image, FIT_INTERNAL, 0);
 SPL_IMG_TEST(spl_test_image, FIT_EXTERNAL, 0);
 
+static int spl_test_fit_missing_fdt(struct unit_test_state *uts)
+{
+	struct spl_image_info expected = {
+		.name = "missing FDT",
+		.size = SPL_TEST_DATA_SIZE,
+	};
+	struct spl_image_info loaded = {};
+	struct spl_load_info load;
+	size_t size, offset;
+	void *image;
+	int node, ret;
+
+	if (!IS_ENABLED(CONFIG_SPL_LOAD_FIT))
+		return -EAGAIN;
+	size = create_image(NULL, FIT_INTERNAL, &expected, &offset);
+	image = calloc(1, size + 128);
+	ut_assertnonnull(image);
+	generate_data(image + offset, expected.size, expected.name);
+	if (create_image(image, FIT_INTERNAL, &expected, NULL) != size) {
+		ret = -EINVAL;
+		goto out;
+	}
+	ret = fdt_open_into(image, image, size + 128);
+	if (ret)
+		goto out;
+	node = fdt_path_offset(image, "/configurations/config-1");
+	ret = fdt_setprop_string(image, node, FIT_FDT_PROP, "missing");
+	if (ret)
+		goto out;
+	spl_load_init(&load, spl_test_read, image, 1);
+	ret = spl_load_simple_fit(&loaded, &load, 0, image);
+	free(image);
+	ut_assert(ret < 0);
+	return 0;
+out:
+	free(image);
+	ut_assertok(ret);
+	return 0;
+}
+
+SPL_TEST(spl_test_fit_missing_fdt, 0);
+
 /*
  * Build a FIT with external data, overwrite one property of the image node
  * with a hostile value and check that loading fails with the expected error.

-- 
2.56.0

[PATCH 2/6] fastboot: invalidate stale and incomplete downloads

[Carlo Caione]

A new session or download must not retain the size of an earlier image.
Otherwise a failed transfer can leave commands operating on stale or
partially overwritten data. Only mark a download complete once all
expected bytes have arrived.

Signed-off-by: Carlo Caione <ccaione@baylibre.com>
---
 drivers/fastboot/fb_command.c | 14 +++++++++++++-
 drivers/fastboot/fb_common.c  |  3 ++-
 include/fastboot-internal.h   |  3 +++
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/drivers/fastboot/fb_command.c b/drivers/fastboot/fb_command.c
index a2a89fc04f8..68983f5098a 100644
--- a/drivers/fastboot/fb_command.c
+++ b/drivers/fastboot/fb_command.c
@@ -272,6 +272,13 @@ static void getvar(char *cmd_parameter, char *response)
 	fastboot_getvar(cmd_parameter, response);
 }
 
+void fastboot_download_reset(void)
+{
+	image_size = 0;
+	fastboot_bytes_received = 0;
+	fastboot_bytes_expected = 0;
+}
+
 /**
  * fastboot_download() - Start a download transfer from the client
  *
@@ -282,11 +289,11 @@ static void download(char *cmd_parameter, char *response)
 {
 	char *tmp;
 
+	fastboot_download_reset();
 	if (!cmd_parameter) {
 		fastboot_fail("Expected command parameter", response);
 		return;
 	}
-	fastboot_bytes_received = 0;
 	fastboot_bytes_expected = hextoul(cmd_parameter, &tmp);
 	if (fastboot_bytes_expected == 0) {
 		fastboot_fail("Expected nonzero image size", response);
@@ -370,6 +377,11 @@ void fastboot_data_download(const void *fastboot_data,
  */
 void fastboot_data_complete(char *response)
 {
+	if (!fastboot_bytes_expected || fastboot_data_remaining()) {
+		fastboot_fail("Incomplete download", response);
+		return;
+	}
+
 	/* Download complete. Respond with "OKAY" */
 	fastboot_okay(NULL, response);
 	printf("\ndownloading of %d bytes finished\n", fastboot_bytes_received);
diff --git a/drivers/fastboot/fb_common.c b/drivers/fastboot/fb_common.c
index 9184bc6346d..59a08018a79 100644
--- a/drivers/fastboot/fb_common.c
+++ b/drivers/fastboot/fb_common.c
@@ -15,6 +15,7 @@
 #include <cpu_func.h>
 #include <env.h>
 #include <fastboot.h>
+#include <fastboot-internal.h>
 #include <net.h>
 #include <vsprintf.h>
 
@@ -261,5 +262,5 @@ void fastboot_init(void *buf_addr, u32 buf_size)
 				       (void *)CONFIG_FASTBOOT_BUF_ADDR;
 	fastboot_buf_size = buf_size ? buf_size : CONFIG_FASTBOOT_BUF_SIZE;
 	fastboot_set_progress_callback(NULL);
-
+	fastboot_download_reset();
 }
diff --git a/include/fastboot-internal.h b/include/fastboot-internal.h
index 610d4f91414..41411601da3 100644
--- a/include/fastboot-internal.h
+++ b/include/fastboot-internal.h
@@ -13,6 +13,9 @@ extern void *fastboot_buf_addr;
  */
 extern u32 fastboot_buf_size;
 
+/* Invalidate downloaded data when starting a new session or download. */
+void fastboot_download_reset(void);
+
 /**
  * fastboot_progress_callback - callback executed during long operations
  */

-- 
2.56.0

[PATCH 3/6] spl: ram: allow loading FIT images from a supplied buffer

[Carlo Caione]

RAM FIT loading currently assumes a configured image address. Downloaded
images need the same loader with a caller-provided buffer and length so
reads cannot run beyond the received data.

Expose a reusable RAM FIT loader with header validation, bounded reads
and overlap-safe copying. Keep preloaded images working when their buffer
size is unknown. Add tests for embedded and external FIT data.

Signed-off-by: Carlo Caione <ccaione@baylibre.com>
---
 MAINTAINERS           |  1 +
 common/spl/spl_ram.c  | 49 +++++++++++++++++++++++++++----------------------
 include/spl.h         |  9 +++++++++
 test/image/Kconfig    |  9 +++++++++
 test/image/Makefile   |  1 +
 test/image/spl_load.c |  4 +++-
 test/image/spl_ram.c  | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 7 files changed, 98 insertions(+), 23 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index d1f51d9197d..f464e0bd2bc 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1923,5 +1923,6 @@ Q:	http://patchwork.ozlabs.org/project/uboot/list/
 S:	Maintained
 T:	git https://git.u-boot-project.org/u-boot/u-boot.git
 F:	configs/tools-only_defconfig
+F:	test/image/spl_ram.c
 F:	*
 F:	*/
diff --git a/common/spl/spl_ram.c b/common/spl/spl_ram.c
index 0c501cf02f2..ee588ef4718 100644
--- a/common/spl/spl_ram.c
+++ b/common/spl/spl_ram.c
@@ -16,32 +16,39 @@
 #include <spl.h>
 #include <linux/libfdt.h>
 
-static ulong spl_ram_load_read(struct spl_load_info *load, ulong sector,
+struct spl_ram_image {
+	const void *data;
+	size_t size;
+};
+
+static ulong spl_ram_load_read(struct spl_load_info *load, ulong offset,
 			       ulong count, void *buf)
 {
-	ulong addr = 0;
-
-	debug("%s: sector %lx, count %lx, buf %lx\n",
-	      __func__, sector, count, (ulong)buf);
+	struct spl_ram_image *image = load->priv;
 
-	if (IS_ENABLED(CONFIG_SPL_LOAD_FIT)) {
-		addr = IF_ENABLED_INT(CONFIG_SPL_LOAD_FIT,
-				      CONFIG_SPL_LOAD_FIT_ADDRESS);
+	if (offset >= image->size)
+		return 0;
+	count = min_t(ulong, count, image->size - offset);
+	memmove(buf, image->data + offset, count);
+	return count;
+}
 
-#ifdef	CONFIG_SPL_PCI_DFU
-		if (spl_boot_device() == BOOT_DEVICE_PCIE)
-			addr = CONFIG_SPL_PCI_DFU_SPL_LOAD_FIT_ADDRESS;
-#endif
-	}
-	addr += sector;
-	if (CONFIG_IS_ENABLED(IMAGE_PRE_LOAD))
-		addr += image_load_offset;
+int spl_ram_load_fit(struct spl_image_info *spl_image, void *fit, size_t size)
+{
+	struct spl_ram_image image = { .data = fit, .size = size };
+	struct spl_load_info load;
 
-	memcpy(buf, (void *)addr, count);
+	if (!CONFIG_IS_ENABLED(LOAD_FIT))
+		return -EOPNOTSUPP;
+	if (size < sizeof(struct fdt_header) || fdt_check_header(fit) ||
+	    fdt_totalsize(fit) > size)
+		return -EINVAL;
 
-	return count;
+	spl_load_init(&load, spl_ram_load_read, &image, 1);
+	return spl_load_simple_fit(spl_image, &load, 0, fit);
 }
 
+#if CONFIG_IS_ENABLED(RAM_SUPPORT)
 static int spl_ram_load_image(struct spl_image_info *spl_image,
 			      struct spl_boot_device *bootdev)
 {
@@ -81,11 +88,8 @@ static int spl_ram_load_image(struct spl_image_info *spl_image,
 
 	if (IS_ENABLED(CONFIG_SPL_LOAD_FIT) &&
 	    image_get_magic(header) == FDT_MAGIC) {
-		struct spl_load_info load;
-
 		debug("Found FIT\n");
-		spl_load_init(&load, spl_ram_load_read, NULL, 1);
-		ret = spl_load_simple_fit(spl_image, &load, 0, header);
+		ret = spl_ram_load_fit(spl_image, header, SIZE_MAX);
 	} else {
 		ulong u_boot_pos = spl_get_image_pos();
 
@@ -120,3 +124,4 @@ SPL_LOAD_IMAGE_METHOD("DFU", 0, BOOT_DEVICE_DFU, spl_ram_load_image);
 #if CONFIG_IS_ENABLED(PCI_DFU)
 SPL_LOAD_IMAGE_METHOD("PCIE", 0, BOOT_DEVICE_PCIE, spl_ram_load_image);
 #endif
+#endif
diff --git a/include/spl.h b/include/spl.h
index 390d18fd9d5..f884c24b85e 100644
--- a/include/spl.h
+++ b/include/spl.h
@@ -989,6 +989,15 @@ bool spl_was_boot_source(void);
  */
 int spl_dfu_cmd(int usbctrl, char *dfu_alt_info, char *interface, char *devstr);
 
+/**
+ * spl_ram_load_fit() - Load a FIT from a RAM buffer
+ * @spl_image: Receives the loaded image information
+ * @fit: FIT image, including any external data
+ * @size: Buffer size, or SIZE_MAX for a preloaded image of unknown size
+ * Return: 0 on success, or a negative error code
+ */
+int spl_ram_load_fit(struct spl_image_info *spl_image, void *fit, size_t size);
+
 /**
  * spl_mmc_clear_cache() - Clear cached MMC devices
  *
diff --git a/test/image/Kconfig b/test/image/Kconfig
index 45b6e8c52e6..1cb8337e0f4 100644
--- a/test/image/Kconfig
+++ b/test/image/Kconfig
@@ -41,6 +41,15 @@ config SPL_UT_LOAD_NET
 	help
 	  Test loading images over TFTP using the NET image load method.
 
+config SPL_UT_LOAD_RAM
+	bool "Test loading images from RAM"
+	depends on SANDBOX && SPL_LOAD_FIT
+	select SPL_RAM_SUPPORT
+	default y
+	help
+	  Test loading FIT images from a RAM buffer, including images with
+	  embedded and external payloads.
+
 config SPL_UT_LOAD_SPI
 	bool "Test loading from SPI Flash"
 	depends on SANDBOX && SPL_OF_REAL
diff --git a/test/image/Makefile b/test/image/Makefile
index 11ed25734e8..feca0611fcf 100644
--- a/test/image/Makefile
+++ b/test/image/Makefile
@@ -7,5 +7,6 @@ obj-$(CONFIG_SPL_UT_LOAD_FS) += spl_load_fs.o
 obj-$(CONFIG_SPL_UT_LOAD_NAND) += spl_load_nand.o
 obj-$(CONFIG_SPL_UT_LOAD_NET) += spl_load_net.o
 obj-$(CONFIG_SPL_NOR_SUPPORT) += spl_load_nor.o
+obj-$(CONFIG_SPL_UT_LOAD_RAM) += spl_ram.o
 obj-$(CONFIG_SPL_UT_LOAD_OS) += spl_load_os.o
 obj-$(CONFIG_SPL_UT_LOAD_SPI) += spl_load_spi.o
diff --git a/test/image/spl_load.c b/test/image/spl_load.c
index 166cf331194..0e3bc0d6caa 100644
--- a/test/image/spl_load.c
+++ b/test/image/spl_load.c
@@ -163,7 +163,9 @@ static size_t start_fit(void *dst, size_t fit_size, size_t data_size,
 static size_t create_fit(void *dst, struct spl_image_info *spl_image,
 			 size_t *data_offset, bool external)
 {
-	size_t prop_size = 596, total_size = prop_size + spl_image->size;
+	/* Both the image and configuration have a description. */
+	size_t prop_size = ALIGN(596 + 2 * (strlen(spl_image->name) + 1), 4);
+	size_t total_size = prop_size + spl_image->size;
 	size_t off, size;
 
 	if (external) {
diff --git a/test/image/spl_ram.c b/test/image/spl_ram.c
new file mode 100644
index 00000000000..5874ac02a3a
--- /dev/null
+++ b/test/image/spl_ram.c
@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: GPL-2.0+
+/* Copyright (C) 2026 Carlo Caione <ccaione@baylibre.com> */
+
+#include <image.h>
+#include <mapmem.h>
+#include <spl.h>
+#include <test/spl.h>
+#include <test/ut.h>
+
+static int check_ram_image(struct unit_test_state *uts, void *image, size_t size,
+			   struct spl_image_info *expected, const void *data)
+{
+	struct spl_image_info loaded = {};
+
+	ut_assertok(spl_ram_load_fit(&loaded, image, size));
+	ut_assertok(check_image_info(uts, expected, &loaded));
+	ut_asserteq_mem(data, map_sysmem(loaded.load_addr, loaded.size), loaded.size);
+	return 0;
+}
+
+static int spl_test_ram(struct unit_test_state *uts, const char *name,
+			enum spl_test_image type)
+{
+	struct spl_image_info info = { .name = name, .size = SPL_TEST_DATA_SIZE };
+	size_t size, offset;
+	void *image;
+	int ret;
+
+	size = create_image(NULL, type, &info, &offset);
+	ut_assert(size);
+	image = calloc(1, size);
+	ut_assertnonnull(image);
+	generate_data(image + offset, info.size, name);
+	if (create_image(image, type, &info, NULL) != size) {
+		free(image);
+		return -EINVAL;
+	}
+	if (type == FIT_INTERNAL)
+		size = fdt_totalsize(image);
+	ret = check_ram_image(uts, image, size, &info, image + offset);
+	if (!ret)
+		ret = check_ram_image(uts, image, SIZE_MAX, &info, image + offset);
+	free(image);
+	return ret;
+}
+
+SPL_IMG_TEST(spl_test_ram, FIT_INTERNAL, 0);
+SPL_IMG_TEST(spl_test_ram, FIT_EXTERNAL, 0);

-- 
2.56.0

[PATCH 4/6] spl: support booting FIT images downloaded with fastboot

[Carlo Caione]

Test farms need to run successive U-Boot builds without rewriting boot
storage. Add an optional RAM boot path for FIT images, including firmware
needed to enter U-Boot.

Accept the Android v0 envelope used by the standard fastboot client so
the same fastboot boot u-boot.itb workflow can be used with SPL.

Do not boot after a failed USB acknowledgment, in SPL or U-Boot proper,
so the host can retry the command.

Signed-off-by: Carlo Caione <ccaione@baylibre.com>
---
 MAINTAINERS                     |   2 +
 common/spl/Makefile             |   1 +
 common/spl/spl_fastboot_boot.c  |  76 +++++++++++++++++
 configs/sandbox_spl_defconfig   |   1 +
 doc/android/fastboot.rst        |  45 +++++++++-
 drivers/fastboot/Kconfig        |  15 ++++
 drivers/fastboot/fb_command.c   |  29 +++++++
 drivers/usb/gadget/f_fastboot.c |   9 +-
 include/fastboot.h              |   8 ++
 include/spl.h                   |   7 ++
 test/image/Makefile             |   1 +
 test/image/spl_fastboot.c       | 183 ++++++++++++++++++++++++++++++++++++++++
 12 files changed, 374 insertions(+), 3 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index f464e0bd2bc..d62e04907c6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1038,6 +1038,8 @@ M:	Mattijs Korpershoek <mkorpershoek@kernel.org>
 S:	Maintained
 T:	git https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu.git
 F:	cmd/fastboot.c
+F:	common/spl/spl_fastboot_boot.c
+F:	test/image/spl_fastboot.c
 F:	doc/android/fastboot*.rst
 F:	include/fastboot.h
 F:	include/fastboot-internal.h
diff --git a/common/spl/Makefile b/common/spl/Makefile
index 9c94e8f143e..710463f2a3b 100644
--- a/common/spl/Makefile
+++ b/common/spl/Makefile
@@ -38,6 +38,7 @@ obj-$(CONFIG_$(PHASE_)DFU) += spl_dfu.o
 obj-$(CONFIG_$(PHASE_)SPI_LOAD) += spl_spi.o
 obj-$(CONFIG_$(PHASE_)RAM_SUPPORT) += spl_ram.o
 obj-$(CONFIG_$(PHASE_)USB_SDP_SUPPORT) += spl_sdp.o
+obj-$(CONFIG_$(PHASE_)FASTBOOT_BOOT) += spl_fastboot_boot.o spl_ram.o
 obj-$(CONFIG_$(PHASE_)UFS_SUPPORT) += spl_ufs.o
 endif
 
diff --git a/common/spl/spl_fastboot_boot.c b/common/spl/spl_fastboot_boot.c
new file mode 100644
index 00000000000..f52ea83b230
--- /dev/null
+++ b/common/spl/spl_fastboot_boot.c
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: GPL-2.0+
+/* Copyright (C) 2026 Carlo Caione <ccaione@baylibre.com> */
+
+#include <android_image.h>
+#include <fastboot.h>
+#include <spl.h>
+#include <linux/log2.h>
+
+struct fastboot_image {
+	const void *data;
+	size_t size;
+};
+
+/* The standard fastboot client wraps a FIT in an Android v0 boot image. */
+static int spl_fastboot_unwrap(struct fastboot_image *image)
+{
+	const struct andr_boot_img_hdr_v0 *hdr = image->data;
+	u32 page_size, kernel_size;
+	size_t hdr_size = offsetof(struct andr_boot_img_hdr_v0,
+				   recovery_dtbo_size);
+
+	if (image->size < ANDR_BOOT_MAGIC_SIZE ||
+	    memcmp(image->data, ANDR_BOOT_MAGIC, ANDR_BOOT_MAGIC_SIZE))
+		return 0;
+
+	if (image->size < hdr_size)
+		return -EINVAL;
+	if (le32_to_cpu(hdr->header_version) || hdr->ramdisk_size ||
+	    hdr->second_size)
+		return -EPROTONOSUPPORT;
+
+	page_size = le32_to_cpu(hdr->page_size);
+	kernel_size = le32_to_cpu(hdr->kernel_size);
+	if (!is_power_of_2(page_size) || page_size < hdr_size ||
+	    page_size > image->size || kernel_size > image->size - page_size)
+		return -EINVAL;
+
+	image->data += page_size;
+	image->size = kernel_size;
+	return 0;
+}
+
+int spl_fastboot_load(struct spl_image_info *spl_image)
+{
+	struct fastboot_image image;
+	void *buf;
+	int ret;
+
+	image.size = fastboot_get_boot_image(&buf);
+	image.data = buf;
+	if (!image.size)
+		return -EAGAIN;
+
+	ret = spl_fastboot_unwrap(&image);
+	if (ret)
+		return ret;
+	return spl_ram_load_fit(spl_image, (void *)image.data, image.size);
+}
+
+/* Sandbox tests the loader directly, without a physical USB boot method. */
+#if !IS_ENABLED(CONFIG_SANDBOX)
+static int spl_fastboot_load_image(struct spl_image_info *spl_image,
+				   struct spl_boot_device *bootdev)
+{
+	int ret;
+
+	ret = fastboot_usb_run(CONFIG_SPL_FASTBOOT_USB_DEV, NULL, 0);
+	if (ret)
+		return ret;
+
+	return spl_fastboot_load(spl_image);
+}
+
+SPL_LOAD_IMAGE_METHOD("USB fastboot", 0, BOOT_DEVICE_BOARD,
+		      spl_fastboot_load_image);
+#endif
diff --git a/configs/sandbox_spl_defconfig b/configs/sandbox_spl_defconfig
index b1112fd45e7..67640c7d85d 100644
--- a/configs/sandbox_spl_defconfig
+++ b/configs/sandbox_spl_defconfig
@@ -217,6 +217,7 @@ CONFIG_SPL_DM_USB_GADGET=y
 CONFIG_USB_GADGET=y
 CONFIG_SPL_USB_GADGET=y
 CONFIG_SPL_FASTBOOT=y
+CONFIG_SPL_FASTBOOT_BOOT=y
 CONFIG_USB_EMUL=y
 CONFIG_USB_KEYBOARD=y
 CONFIG_VIDEO=y
diff --git a/doc/android/fastboot.rst b/doc/android/fastboot.rst
index 8e15f287f9b..9898348c961 100644
--- a/doc/android/fastboot.rst
+++ b/doc/android/fastboot.rst
@@ -96,7 +96,7 @@ stub. The ``continue`` command ends the session and returns control to the
 caller. The ``flash`` and ``erase`` commands are available when their SPL
 backend is enabled. A recognized command whose optional backend is disabled is
 reported as unsupported. Commands omitted from the SPL table, including
-``boot``, ``ucmd``, ``acmd`` and the OEM commands, are reported as unrecognized.
+``ucmd``, ``acmd`` and the OEM commands, are reported as unrecognized.
 
 MMC flash and erase support is enabled with
 ``CONFIG_SPL_FASTBOOT_FLASH_MMC``. The SPL partition-table parser matching the
@@ -120,6 +120,49 @@ Reboot commands require ``CONFIG_SPL_FASTBOOT_REBOOT`` and a platform
 and ``reboot-recovery`` commands also require a platform
 ``fastboot_set_reboot_flag()`` implementation.
 
+Booting a downloaded FIT from SPL
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Enable ``CONFIG_SPL_FASTBOOT_BOOT`` and include ``BOOT_DEVICE_BOARD`` in the
+board's SPL boot order. This load method starts the fastboot session itself;
+select the USB controller with ``CONFIG_SPL_FASTBOOT_USB_DEV``. RAM and the
+USB controller must be ready before the load method runs.
+
+The host can then download and run a U-Boot FIT without flashing it::
+
+   fastboot boot u-boot.itb
+
+::
+
+   Host                         Target
+   +----------------+           +-----------------------+
+   | U-Boot FIT     | -- USB -->| SPL fastboot download |
+   +----------------+           +-----------+-----------+
+                                            |
+                                  acknowledge boot,
+                                  stop USB session
+                                            |
+                                +-----------v-----------+
+                                | SPL FIT loader        |
+                                +-----------+-----------+
+                                            |
+                                +-----------v-----------+
+                                | Firmware / U-Boot     |
+                                | running from RAM      |
+                                +-----------------------+
+
+Use a FIT built for the target, including any firmware required by its normal
+SPL handoff (for example BL31 or OP-TEE). FIT verification uses the board's
+existing SPL configuration. Raw U-Boot binaries are not supported. The loader
+accepts a bare FIT or the Android v0 wrapper added by the standard fastboot
+client; separate ramdisk and second-stage arguments are not supported.
+
+Keep the download buffer separate from SPL, its heap and stack, and all FIT
+load destinations. ``CONFIG_SPL_FASTBOOT_FLASH`` is optional.
+
+``continue`` leaves fastboot and lets SPL try the remaining boot methods.
+Loading errors also follow SPL's normal boot order.
+
 Fastboot environment variables
 ------------------------------
 
diff --git a/drivers/fastboot/Kconfig b/drivers/fastboot/Kconfig
index 88ed42ca5b9..c2055132ccc 100644
--- a/drivers/fastboot/Kconfig
+++ b/drivers/fastboot/Kconfig
@@ -67,6 +67,21 @@ config SPL_FASTBOOT
 config SPL_USB_FUNCTION_FASTBOOT
 	bool
 
+config SPL_FASTBOOT_BOOT
+	bool "Boot FIT images downloaded with fastboot in SPL"
+	depends on ARM || MIPS || RISCV || SANDBOX
+	depends on SPL_FASTBOOT && SPL_FRAMEWORK && SPL_LOAD_FIT
+	depends on !SPL_LOAD_FIT_FULL && !SPL_USB_SDP_SUPPORT
+	help
+	  Enable fastboot boot to load a downloaded FIT image through the SPL
+	  image loader. Boards enter the USB session by selecting
+	  BOOT_DEVICE_BOARD in their SPL boot order.
+
+config SPL_FASTBOOT_USB_DEV
+	int "SPL fastboot USB controller number"
+	depends on SPL_FASTBOOT_BOOT
+	default 0
+
 config SPL_FASTBOOT_REBOOT
 	bool "Enable fastboot reboot commands in SPL"
 	depends on SPL_FASTBOOT
diff --git a/drivers/fastboot/fb_command.c b/drivers/fastboot/fb_command.c
index 68983f5098a..cc5862d566f 100644
--- a/drivers/fastboot/fb_command.c
+++ b/drivers/fastboot/fb_command.c
@@ -32,9 +32,12 @@ static u32 fastboot_bytes_received;
  */
 static u32 fastboot_bytes_expected;
 
+static bool boot_requested;
+
 static void okay(char *, char *);
 static void getvar(char *, char *);
 static void download(char *, char *);
+static void boot(char *, char *);
 static void flash(char *, char *);
 static void erase(char *, char *);
 static void reboot_bootloader(char *, char *);
@@ -71,6 +74,10 @@ static const struct fastboot_command commands[FASTBOOT_COMMAND_COUNT] = {
 		.command = "erase",
 		.dispatch = CONFIG_IS_ENABLED(FASTBOOT_FLASH, (erase), (NULL))
 	},
+	[FASTBOOT_COMMAND_BOOT] = {
+		.command = "boot",
+		.dispatch = CONFIG_IS_ENABLED(FASTBOOT_BOOT, (boot), (NULL))
+	},
 	[FASTBOOT_COMMAND_CONTINUE] =  {
 		.command = "continue",
 		.dispatch = okay
@@ -277,6 +284,7 @@ void fastboot_download_reset(void)
 	image_size = 0;
 	fastboot_bytes_received = 0;
 	fastboot_bytes_expected = 0;
+	boot_requested = false;
 }
 
 /**
@@ -393,6 +401,27 @@ void fastboot_data_complete(char *response)
 	fastboot_bytes_received = 0;
 }
 
+static void __maybe_unused boot(char *cmd_parameter, char *response)
+{
+	if (!image_size || fastboot_bytes_expected)
+		fastboot_fail("No complete image downloaded", response);
+	else
+		fastboot_okay(NULL, response);
+}
+
+#if CONFIG_IS_ENABLED(FASTBOOT_BOOT)
+void fastboot_boot(void)
+{
+	boot_requested = true;
+}
+
+u32 fastboot_get_boot_image(void **buf)
+{
+	*buf = fastboot_buf_addr;
+	return boot_requested ? image_size : 0;
+}
+#endif
+
 /**
  * flash() - write the downloaded image to the indicated partition.
  *
diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c
index 9a2e9850112..cdd88035eed 100644
--- a/drivers/usb/gadget/f_fastboot.c
+++ b/drivers/usb/gadget/f_fastboot.c
@@ -489,9 +489,14 @@ static void do_exit_on_complete(struct usb_ep *ep, struct usb_request *req)
 	g_dnl_trigger_detach();
 }
 
-#ifndef CONFIG_XPL_BUILD
+#if !defined(CONFIG_XPL_BUILD) || CONFIG_IS_ENABLED(FASTBOOT_BOOT)
 static void do_bootm_on_complete(struct usb_ep *ep, struct usb_request *req)
 {
+	req->complete = fastboot_complete;
+	/* Do not boot if the acknowledgment transfer failed. */
+	if (req->status)
+		return;
+
 	fastboot_boot();
 	do_exit_on_complete(ep, req);
 }
@@ -561,7 +566,7 @@ static void rx_handler_command(struct usb_ep *ep, struct usb_request *req)
 	if (!strncmp("OKAY", response, 4)) {
 		switch (cmd) {
 		case FASTBOOT_COMMAND_BOOT:
-#ifndef CONFIG_XPL_BUILD
+#if !defined(CONFIG_XPL_BUILD) || CONFIG_IS_ENABLED(FASTBOOT_BOOT)
 			fastboot_func->in_req->complete = do_bootm_on_complete;
 #endif
 			break;
diff --git a/include/fastboot.h b/include/fastboot.h
index f02d2559f2b..e132b776c7b 100644
--- a/include/fastboot.h
+++ b/include/fastboot.h
@@ -144,9 +144,17 @@ int fastboot_usb_run(int controller_index, void *buf_addr, u32 buf_size);
  *
  * Otherwise execute "bootm <fastboot_buf_addr>", if that fails, reset
  * the board.
+ * In SPL, record the request for loading after the USB session stops.
  */
 void fastboot_boot(void);
 
+/**
+ * fastboot_get_boot_image() - Get the download requested for booting in SPL
+ * @buf: Receives the download buffer address
+ * Return: Image size, or zero if no boot command has completed
+ */
+u32 fastboot_get_boot_image(void **buf);
+
 /**
  * fastboot_handle_boot() - Shared implementation of system reaction to
  * fastboot commands
diff --git a/include/spl.h b/include/spl.h
index f884c24b85e..2b12dbb7215 100644
--- a/include/spl.h
+++ b/include/spl.h
@@ -998,6 +998,13 @@ int spl_dfu_cmd(int usbctrl, char *dfu_alt_info, char *interface, char *devstr);
  */
 int spl_ram_load_fit(struct spl_image_info *spl_image, void *fit, size_t size);
 
+/**
+ * spl_fastboot_load() - Load a FIT after the fastboot USB session has stopped
+ * @spl_image: Receives the image's load address and entry point
+ * Return: 0 on success, -EAGAIN if no boot was requested, or another error
+ */
+int spl_fastboot_load(struct spl_image_info *spl_image);
+
 /**
  * spl_mmc_clear_cache() - Clear cached MMC devices
  *
diff --git a/test/image/Makefile b/test/image/Makefile
index feca0611fcf..67d9b97a2d2 100644
--- a/test/image/Makefile
+++ b/test/image/Makefile
@@ -3,6 +3,7 @@
 # Copyright 2021 Google LLC
 
 obj-y += spl_load.o
+obj-$(CONFIG_SPL_FASTBOOT_BOOT) += spl_fastboot.o
 obj-$(CONFIG_SPL_UT_LOAD_FS) += spl_load_fs.o
 obj-$(CONFIG_SPL_UT_LOAD_NAND) += spl_load_nand.o
 obj-$(CONFIG_SPL_UT_LOAD_NET) += spl_load_net.o
diff --git a/test/image/spl_fastboot.c b/test/image/spl_fastboot.c
new file mode 100644
index 00000000000..39dc784e5e6
--- /dev/null
+++ b/test/image/spl_fastboot.c
@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: GPL-2.0+
+/* Copyright (C) 2026 Carlo Caione <ccaione@baylibre.com> */
+
+#include <android_image.h>
+#include <fastboot.h>
+#include <image.h>
+#include <mapmem.h>
+#include <spl.h>
+#include <test/spl.h>
+#include <test/ut.h>
+
+static int run_fastboot_command(struct unit_test_state *uts, const char *command,
+				int expected_cmd, const char *expected_response)
+{
+	char response[FASTBOOT_RESPONSE_LEN];
+	char cmd[FASTBOOT_COMMAND_LEN];
+
+	strlcpy(cmd, command, sizeof(cmd));
+	ut_asserteq(expected_cmd, fastboot_handle_command(cmd, response));
+	ut_asserteq_str(expected_response, response);
+	return 0;
+}
+
+static int download_image(struct unit_test_state *uts, const void *data,
+			  size_t size)
+{
+	char command[FASTBOOT_COMMAND_LEN];
+	char expected[FASTBOOT_RESPONSE_LEN];
+	char response[FASTBOOT_RESPONSE_LEN];
+
+	snprintf(command, sizeof(command), "download:%08x", (uint)size);
+	snprintf(expected, sizeof(expected), "DATA%08x", (uint)size);
+	ut_assertok(run_fastboot_command(uts, command, FASTBOOT_COMMAND_DOWNLOAD, expected));
+	fastboot_data_download(data, size, response);
+	ut_asserteq_str("", response);
+	fastboot_data_complete(response);
+	ut_asserteq_str("OKAY", response);
+	return 0;
+}
+
+static int spl_test_fastboot_state(struct unit_test_state *uts)
+{
+	char buffer[64], data[32] = {}, response[FASTBOOT_RESPONSE_LEN];
+	struct spl_image_info info = {};
+	void *image;
+
+	fastboot_init(buffer, sizeof(buffer));
+	ut_assertok(run_fastboot_command(uts, "boot", FASTBOOT_COMMAND_BOOT,
+					 "FAILNo complete image downloaded"));
+	ut_asserteq(-EAGAIN, spl_fastboot_load(&info));
+	ut_assertok(download_image(uts, data, sizeof(data)));
+	ut_assertok(run_fastboot_command(uts, "continue", FASTBOOT_COMMAND_CONTINUE, "OKAY"));
+	ut_asserteq(0, fastboot_get_boot_image(&image));
+	ut_assertok(run_fastboot_command(uts, "boot", FASTBOOT_COMMAND_BOOT, "OKAY"));
+	/* The request is only made when the USB OKAY has completed. */
+	ut_asserteq(0, fastboot_get_boot_image(&image));
+	fastboot_boot();
+	ut_asserteq(sizeof(data), fastboot_get_boot_image(&image));
+	ut_asserteq_ptr(buffer, image);
+
+	ut_assertok(run_fastboot_command(uts, "download:00000020", FASTBOOT_COMMAND_DOWNLOAD,
+					 "DATA00000020"));
+	fastboot_data_download(data, 16, response);
+	fastboot_data_complete(response);
+	ut_asserteq_str("FAILIncomplete download", response);
+	ut_assertok(run_fastboot_command(uts, "boot", FASTBOOT_COMMAND_BOOT,
+					 "FAILNo complete image downloaded"));
+	ut_asserteq(0, fastboot_get_boot_image(&image));
+
+	ut_assertok(download_image(uts, data, sizeof(data)));
+	fastboot_boot();
+	fastboot_init(buffer, sizeof(buffer));
+	ut_asserteq(0, fastboot_get_boot_image(&image));
+	ut_assertok(run_fastboot_command(uts, "boot", FASTBOOT_COMMAND_BOOT,
+					 "FAILNo complete image downloaded"));
+	return 0;
+}
+
+SPL_TEST(spl_test_fastboot_state, 0);
+
+static int check_download(struct unit_test_state *uts, void *image, size_t size,
+			  struct spl_image_info *expected, const void *data)
+{
+	struct spl_image_info loaded = {};
+	int ret;
+
+	ut_assertok(download_image(uts, image, size));
+	ut_assertok(run_fastboot_command(uts, "boot", FASTBOOT_COMMAND_BOOT, "OKAY"));
+	fastboot_boot();
+	ret = spl_fastboot_load(&loaded);
+	if (!expected) {
+		ut_assert(ret < 0);
+		return 0;
+	}
+	ut_assertok(ret);
+	ut_assertok(check_image_info(uts, expected, &loaded));
+	ut_asserteq_mem(data, map_sysmem(expected->load_addr, expected->size),
+			expected->size);
+	return 0;
+}
+
+static int check_images(struct unit_test_state *uts, void *image, size_t size,
+			struct spl_image_info *info, const void *data,
+			void *wrapped, enum spl_test_image type)
+{
+	struct andr_boot_img_hdr_v0 *hdr = wrapped;
+	size_t wrapped_size = 2048 + size;
+	u32 magic;
+
+	ut_assertok(check_download(uts, image, size, info, data));
+	/* Truncated FIT metadata and external payloads must both fail. */
+	ut_assertok(check_download(uts, image, sizeof(struct fdt_header) - 1,
+				   NULL, NULL));
+	if (type == FIT_EXTERNAL)
+		ut_assertok(check_download(uts, image, fdt_totalsize(image) - 1,
+					   NULL, NULL));
+	ut_assertok(check_download(uts, image, size - 1, NULL, NULL));
+
+	magic = fdt_magic(image);
+	fdt_set_magic(image, 0);
+	ut_assertok(check_download(uts, image, size, NULL, NULL));
+	fdt_set_magic(image, magic);
+
+	/* The Android envelope is independent of the payload format. */
+	if (type != FIT_INTERNAL)
+		return 0;
+
+	memcpy(hdr->magic, ANDR_BOOT_MAGIC, ANDR_BOOT_MAGIC_SIZE);
+	hdr->page_size = cpu_to_le32(2048);
+	hdr->kernel_size = cpu_to_le32(size);
+	ut_assertok(check_download(uts, wrapped, wrapped_size, info, data));
+	ut_assertok(check_download(uts, wrapped, sizeof(*hdr) - 100, NULL, NULL));
+	ut_assertok(check_download(uts, wrapped, wrapped_size - 1, NULL, NULL));
+	/* Android padding must not make a truncated FIT payload look complete. */
+	hdr->kernel_size = cpu_to_le32(size - 1);
+	ut_assertok(check_download(uts, wrapped, wrapped_size, NULL, NULL));
+	hdr->kernel_size = cpu_to_le32(size);
+	hdr->header_version = cpu_to_le32(3);
+	ut_assertok(check_download(uts, wrapped, wrapped_size, NULL, NULL));
+	hdr->header_version = 0;
+	hdr->page_size = cpu_to_le32(2047);
+	ut_assertok(check_download(uts, wrapped, wrapped_size, NULL, NULL));
+	hdr->page_size = cpu_to_le32(2048);
+	hdr->ramdisk_size = cpu_to_le32(1);
+	ut_assertok(check_download(uts, wrapped, wrapped_size, NULL, NULL));
+	return 0;
+}
+
+static int spl_test_fastboot(struct unit_test_state *uts, const char *name,
+			     enum spl_test_image type)
+{
+	struct spl_image_info info = { .name = name, .size = SPL_TEST_DATA_SIZE };
+	size_t size, offset;
+	void *image, *buffer, *wrapped;
+	int ret = -ENOMEM;
+
+	size = create_image(NULL, type, &info, &offset);
+	ut_assert(size);
+	buffer = malloc(size + 2048);
+	wrapped = calloc(1, size + 2048);
+	if (!buffer || !wrapped)
+		goto out;
+
+	image = wrapped + 2048;
+	generate_data(image + offset, info.size, name);
+	if (create_image(image, type, &info, NULL) != size) {
+		ret = -EINVAL;
+		goto out;
+	}
+	if (type == FIT_INTERNAL)
+		size = fdt_totalsize(image);
+	fastboot_init(buffer, size + 2048);
+	ret = check_images(uts, image, size, &info, image + offset, wrapped, type);
+out:
+	fastboot_init(NULL, 0);
+	free(wrapped);
+	free(buffer);
+	ut_assertok(ret);
+	return 0;
+}
+
+SPL_IMG_TEST(spl_test_fastboot, FIT_INTERNAL, 0);
+SPL_IMG_TEST(spl_test_fastboot, FIT_EXTERNAL, 0);

-- 
2.56.0

[PATCH 5/6] spl: fastboot: support legacy U-Boot images

[Carlo Caione]

Boards using a single legacy U-Boot image should be able to test it over
fastboot without changing their image format. Use the shared RAM reader
and SPL loader, with the downloaded length limiting header and payload
accesses.

Keep legacy support optional and reject compressed images, which this
RAM path does not yet support.

Reject legacy downloads when SPL FIT signature verification is enabled
to prevent bypassing that verification with an unsigned image.

Signed-off-by: Carlo Caione <ccaione@baylibre.com>
---
 common/spl/spl_fastboot_boot.c |  4 ++--
 common/spl/spl_ram.c           | 32 ++++++++++++++++++++++++++++++++
 doc/android/fastboot.rst       | 22 +++++++++++++++-------
 drivers/fastboot/Kconfig       |  7 ++++---
 include/spl.h                  | 11 ++++++++++-
 include/spl_load.h             |  2 ++
 test/image/spl_fastboot.c      | 13 +++++++++++--
 7 files changed, 76 insertions(+), 15 deletions(-)

diff --git a/common/spl/spl_fastboot_boot.c b/common/spl/spl_fastboot_boot.c
index f52ea83b230..6a765f91cba 100644
--- a/common/spl/spl_fastboot_boot.c
+++ b/common/spl/spl_fastboot_boot.c
@@ -11,7 +11,7 @@ struct fastboot_image {
 	size_t size;
 };
 
-/* The standard fastboot client wraps a FIT in an Android v0 boot image. */
+/* The standard fastboot client wraps non-Android images in a v0 header. */
 static int spl_fastboot_unwrap(struct fastboot_image *image)
 {
 	const struct andr_boot_img_hdr_v0 *hdr = image->data;
@@ -54,7 +54,7 @@ int spl_fastboot_load(struct spl_image_info *spl_image)
 	ret = spl_fastboot_unwrap(&image);
 	if (ret)
 		return ret;
-	return spl_ram_load_fit(spl_image, (void *)image.data, image.size);
+	return spl_ram_load(spl_image, (void *)image.data, image.size);
 }
 
 /* Sandbox tests the loader directly, without a physical USB boot method. */
diff --git a/common/spl/spl_ram.c b/common/spl/spl_ram.c
index ee588ef4718..43d9bc95516 100644
--- a/common/spl/spl_ram.c
+++ b/common/spl/spl_ram.c
@@ -14,6 +14,7 @@
 #include <log.h>
 #include <mapmem.h>
 #include <spl.h>
+#include <spl_load.h>
 #include <linux/libfdt.h>
 
 struct spl_ram_image {
@@ -48,6 +49,37 @@ int spl_ram_load_fit(struct spl_image_info *spl_image, void *fit, size_t size)
 	return spl_load_simple_fit(spl_image, &load, 0, fit);
 }
 
+int spl_ram_load(struct spl_image_info *spl_image, void *buf, size_t size)
+{
+	struct legacy_img_hdr *header = buf;
+	struct spl_ram_image image = { .data = buf, .size = size };
+	struct spl_load_info load;
+
+	/* Require a complete magic word to identify a headered image. */
+	if (size < sizeof(header->ih_magic))
+		return -EINVAL;
+
+	/* FIT images can contain multiple payloads with separate load addresses. */
+	if (image_get_magic(header) == FDT_MAGIC)
+		return spl_ram_load_fit(spl_image, buf, size);
+	if (image_get_magic(header) != IH_MAGIC)
+		return -ENOEXEC;
+
+	/* Legacy images need a complete header and an uncompressed payload. */
+	if (CONFIG_IS_ENABLED(FIT_SIGNATURE))
+		return -EPERM;
+	if (!CONFIG_IS_ENABLED(LEGACY_IMAGE_FORMAT))
+		return -EOPNOTSUPP;
+	if (size < sizeof(*header) || !image_get_data_size(header) ||
+	    image_get_data_size(header) > size - sizeof(*header))
+		return -EINVAL;
+	if (image_get_comp(header) != IH_COMP_NONE)
+		return -EPROTONOSUPPORT;
+
+	spl_load_init(&load, spl_ram_load_read, &image, 1);
+	return spl_load(spl_image, NULL, &load, size, 0);
+}
+
 #if CONFIG_IS_ENABLED(RAM_SUPPORT)
 static int spl_ram_load_image(struct spl_image_info *spl_image,
 			      struct spl_boot_device *bootdev)
diff --git a/doc/android/fastboot.rst b/doc/android/fastboot.rst
index 9898348c961..73241e717b8 100644
--- a/doc/android/fastboot.rst
+++ b/doc/android/fastboot.rst
@@ -120,8 +120,8 @@ Reboot commands require ``CONFIG_SPL_FASTBOOT_REBOOT`` and a platform
 and ``reboot-recovery`` commands also require a platform
 ``fastboot_set_reboot_flag()`` implementation.
 
-Booting a downloaded FIT from SPL
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Booting a downloaded image from SPL
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Enable ``CONFIG_SPL_FASTBOOT_BOOT`` and include ``BOOT_DEVICE_BOARD`` in the
 board's SPL boot order. This load method starts the fastboot session itself;
@@ -151,11 +151,19 @@ The host can then download and run a U-Boot FIT without flashing it::
                                 | running from RAM      |
                                 +-----------------------+
 
-Use a FIT built for the target, including any firmware required by its normal
-SPL handoff (for example BL31 or OP-TEE). FIT verification uses the board's
-existing SPL configuration. Raw U-Boot binaries are not supported. The loader
-accepts a bare FIT or the Android v0 wrapper added by the standard fastboot
-client; separate ramdisk and second-stage arguments are not supported.
+With ``CONFIG_SPL_LOAD_FIT``, use a FIT built for the target, including any
+firmware required by its normal SPL handoff (for example BL31 or OP-TEE).
+FIT verification uses the board's existing SPL configuration.
+``CONFIG_SPL_LEGACY_IMAGE_FORMAT`` also permits uncompressed legacy U-Boot
+images, using their header's load address and entry point. Legacy CRC checks
+follow ``CONFIG_SPL_LEGACY_IMAGE_CRC_CHECK``.
+With ``CONFIG_SPL_FIT_SIGNATURE``, legacy downloads are rejected to prevent
+bypassing FIT verification.
+Raw U-Boot binaries are not supported.
+
+The loader accepts these images directly or inside the Android v0 wrapper
+added by the standard fastboot client; separate ramdisk and second-stage
+arguments are not supported.
 
 Keep the download buffer separate from SPL, its heap and stack, and all FIT
 load destinations. ``CONFIG_SPL_FASTBOOT_FLASH`` is optional.
diff --git a/drivers/fastboot/Kconfig b/drivers/fastboot/Kconfig
index c2055132ccc..f57b959f0ea 100644
--- a/drivers/fastboot/Kconfig
+++ b/drivers/fastboot/Kconfig
@@ -68,12 +68,13 @@ config SPL_USB_FUNCTION_FASTBOOT
 	bool
 
 config SPL_FASTBOOT_BOOT
-	bool "Boot FIT images downloaded with fastboot in SPL"
+	bool "Boot images downloaded with fastboot in SPL"
 	depends on ARM || MIPS || RISCV || SANDBOX
-	depends on SPL_FASTBOOT && SPL_FRAMEWORK && SPL_LOAD_FIT
+	depends on SPL_FASTBOOT && SPL_FRAMEWORK
+	depends on SPL_LOAD_FIT || SPL_LEGACY_IMAGE_FORMAT
 	depends on !SPL_LOAD_FIT_FULL && !SPL_USB_SDP_SUPPORT
 	help
-	  Enable fastboot boot to load a downloaded FIT image through the SPL
+	  Enable fastboot boot to load a downloaded image through the SPL
 	  image loader. Boards enter the USB session by selecting
 	  BOOT_DEVICE_BOARD in their SPL boot order.
 
diff --git a/include/spl.h b/include/spl.h
index 2b12dbb7215..3348b424b54 100644
--- a/include/spl.h
+++ b/include/spl.h
@@ -999,7 +999,16 @@ int spl_dfu_cmd(int usbctrl, char *dfu_alt_info, char *interface, char *devstr);
 int spl_ram_load_fit(struct spl_image_info *spl_image, void *fit, size_t size);
 
 /**
- * spl_fastboot_load() - Load a FIT after the fastboot USB session has stopped
+ * spl_ram_load() - Load a downloaded image from RAM
+ * @spl_image: Receives the loaded image information
+ * @buf: Image buffer
+ * @size: Number of bytes in the buffer
+ * Return: 0 on success, or a negative error code
+ */
+int spl_ram_load(struct spl_image_info *spl_image, void *buf, size_t size);
+
+/**
+ * spl_fastboot_load() - Load an image after the fastboot USB session has stopped
  * @spl_image: Receives the image's load address and entry point
  * Return: 0 on success, -EAGAIN if no boot was requested, or another error
  */
diff --git a/include/spl_load.h b/include/spl_load.h
index 31ed5651f7b..44c972b10fd 100644
--- a/include/spl_load.h
+++ b/include/spl_load.h
@@ -114,6 +114,8 @@ static inline int _spl_load(struct spl_image_info *spl_image,
 	IS_ENABLED(CONFIG_SPL_NOR_SUPPORT) + \
 	IS_ENABLED(CONFIG_SPL_SEMIHOSTING) + \
 	IS_ENABLED(CONFIG_SPL_SPI_LOAD) + \
+	(IS_ENABLED(CONFIG_SPL_FASTBOOT_BOOT) && \
+	 IS_ENABLED(CONFIG_SPL_LEGACY_IMAGE_FORMAT)) + \
 	0
 
 #if SPL_LOAD_USERS > 1
diff --git a/test/image/spl_fastboot.c b/test/image/spl_fastboot.c
index 39dc784e5e6..1263416ba8d 100644
--- a/test/image/spl_fastboot.c
+++ b/test/image/spl_fastboot.c
@@ -92,6 +92,12 @@ static int check_download(struct unit_test_state *uts, void *image, size_t size,
 		ut_assert(ret < 0);
 		return 0;
 	}
+	if (CONFIG_IS_ENABLED(FIT_SIGNATURE) &&
+	    !(expected->flags & SPL_FIT_FOUND)) {
+		ut_asserteq(-EPERM, ret);
+		ut_asserteq(0, loaded.size);
+		return 0;
+	}
 	ut_assertok(ret);
 	ut_assertok(check_image_info(uts, expected, &loaded));
 	ut_asserteq_mem(data, map_sysmem(expected->load_addr, expected->size),
@@ -106,10 +112,12 @@ static int check_images(struct unit_test_state *uts, void *image, size_t size,
 	struct andr_boot_img_hdr_v0 *hdr = wrapped;
 	size_t wrapped_size = 2048 + size;
 	u32 magic;
+	bool fit = image_get_magic(image) == FDT_MAGIC;
 
 	ut_assertok(check_download(uts, image, size, info, data));
-	/* Truncated FIT metadata and external payloads must both fail. */
-	ut_assertok(check_download(uts, image, sizeof(struct fdt_header) - 1,
+	/* Both metadata and payload must fit in the completed download. */
+	ut_assertok(check_download(uts, image, (fit ? sizeof(struct fdt_header) :
+				   sizeof(struct legacy_img_hdr)) - 1,
 				   NULL, NULL));
 	if (type == FIT_EXTERNAL)
 		ut_assertok(check_download(uts, image, fdt_totalsize(image) - 1,
@@ -181,3 +189,4 @@ out:
 
 SPL_IMG_TEST(spl_test_fastboot, FIT_INTERNAL, 0);
 SPL_IMG_TEST(spl_test_fastboot, FIT_EXTERNAL, 0);
+SPL_IMG_TEST(spl_test_fastboot, LEGACY, 0);

-- 
2.56.0

[PATCH 6/6] spl: fastboot: support raw U-Boot images

[Carlo Caione]

Boards with fixed U-Boot load and entry addresses do not need an image
container for RAM boot. Allow raw downloads when SPL_RAW_IMAGE_SUPPORT
is enabled, using the board's existing address configuration and the
completed download length.

Keep recognized FIT and legacy images on their respective validation
paths, so an invalid container cannot fall back to raw execution.

Reject raw downloads when SPL FIT signature verification is enabled
to prevent bypassing that verification with an unsigned image.

Signed-off-by: Carlo Caione <ccaione@baylibre.com>
---
 common/spl/spl_ram.c      | 28 ++++++++++++++++++++++++---
 doc/android/fastboot.rst  |  9 ++++++---
 drivers/fastboot/Kconfig  |  2 +-
 test/image/spl_fastboot.c | 48 ++++++++++++++++++++++++++++++++++++++++++-----
 4 files changed, 75 insertions(+), 12 deletions(-)

diff --git a/common/spl/spl_ram.c b/common/spl/spl_ram.c
index 43d9bc95516..463f5e48929 100644
--- a/common/spl/spl_ram.c
+++ b/common/spl/spl_ram.c
@@ -49,21 +49,43 @@ int spl_ram_load_fit(struct spl_image_info *spl_image, void *fit, size_t size)
 	return spl_load_simple_fit(spl_image, &load, 0, fit);
 }
 
+static int spl_ram_load_raw(struct spl_image_info *spl_image, void *buf,
+			    size_t size)
+{
+	if (CONFIG_IS_ENABLED(FIT_SIGNATURE))
+		return -EPERM;
+	if (!IS_ENABLED(CONFIG_SPL_RAW_IMAGE_SUPPORT))
+		return -ENOEXEC;
+	if (!size || size == SIZE_MAX)
+		return -EINVAL;
+	if (size > CONFIG_SYS_BOOTM_LEN)
+		return -EFBIG;
+
+	spl_set_header_raw_uboot(spl_image);
+	if (size > ULONG_MAX - spl_image->load_addr)
+		return -EOVERFLOW;
+	spl_image->size = size;
+	memmove(map_sysmem(spl_image->load_addr, size), buf, size);
+	return 0;
+}
+
 int spl_ram_load(struct spl_image_info *spl_image, void *buf, size_t size)
 {
 	struct legacy_img_hdr *header = buf;
 	struct spl_ram_image image = { .data = buf, .size = size };
 	struct spl_load_info load;
 
-	/* Require a complete magic word to identify a headered image. */
+	/* A buffer too short for a magic word can only be a raw image. */
 	if (size < sizeof(header->ih_magic))
-		return -EINVAL;
+		return spl_ram_load_raw(spl_image, buf, size);
 
 	/* FIT images can contain multiple payloads with separate load addresses. */
 	if (image_get_magic(header) == FDT_MAGIC)
 		return spl_ram_load_fit(spl_image, buf, size);
+
+	/* Only unknown magic selects raw; recognized formats keep their errors. */
 	if (image_get_magic(header) != IH_MAGIC)
-		return -ENOEXEC;
+		return spl_ram_load_raw(spl_image, buf, size);
 
 	/* Legacy images need a complete header and an uncompressed payload. */
 	if (CONFIG_IS_ENABLED(FIT_SIGNATURE))
diff --git a/doc/android/fastboot.rst b/doc/android/fastboot.rst
index 73241e717b8..73b7825d726 100644
--- a/doc/android/fastboot.rst
+++ b/doc/android/fastboot.rst
@@ -157,9 +157,12 @@ FIT verification uses the board's existing SPL configuration.
 ``CONFIG_SPL_LEGACY_IMAGE_FORMAT`` also permits uncompressed legacy U-Boot
 images, using their header's load address and entry point. Legacy CRC checks
 follow ``CONFIG_SPL_LEGACY_IMAGE_CRC_CHECK``.
-With ``CONFIG_SPL_FIT_SIGNATURE``, legacy downloads are rejected to prevent
-bypassing FIT verification.
-Raw U-Boot binaries are not supported.
+``CONFIG_SPL_RAW_IMAGE_SUPPORT`` permits a raw ``u-boot.bin``. SPL uses its
+configured or binman-provided load address and entry point, and loads exactly
+the downloaded bytes. The image must match that address and firmware handoff
+contract; raw images carry no size, checksum or signature of their own.
+With ``CONFIG_SPL_FIT_SIGNATURE``, legacy and raw downloads are rejected to
+prevent bypassing FIT verification.
 
 The loader accepts these images directly or inside the Android v0 wrapper
 added by the standard fastboot client; separate ramdisk and second-stage
diff --git a/drivers/fastboot/Kconfig b/drivers/fastboot/Kconfig
index f57b959f0ea..d83f0e371a8 100644
--- a/drivers/fastboot/Kconfig
+++ b/drivers/fastboot/Kconfig
@@ -71,7 +71,7 @@ config SPL_FASTBOOT_BOOT
 	bool "Boot images downloaded with fastboot in SPL"
 	depends on ARM || MIPS || RISCV || SANDBOX
 	depends on SPL_FASTBOOT && SPL_FRAMEWORK
-	depends on SPL_LOAD_FIT || SPL_LEGACY_IMAGE_FORMAT
+	depends on SPL_LOAD_FIT || SPL_LEGACY_IMAGE_FORMAT || SPL_RAW_IMAGE_SUPPORT
 	depends on !SPL_LOAD_FIT_FULL && !SPL_USB_SDP_SUPPORT
 	help
 	  Enable fastboot boot to load a downloaded image through the SPL
diff --git a/test/image/spl_fastboot.c b/test/image/spl_fastboot.c
index 1263416ba8d..b519ac8911f 100644
--- a/test/image/spl_fastboot.c
+++ b/test/image/spl_fastboot.c
@@ -124,10 +124,13 @@ static int check_images(struct unit_test_state *uts, void *image, size_t size,
 					   NULL, NULL));
 	ut_assertok(check_download(uts, image, size - 1, NULL, NULL));
 
-	magic = fdt_magic(image);
-	fdt_set_magic(image, 0);
-	ut_assertok(check_download(uts, image, size, NULL, NULL));
-	fdt_set_magic(image, magic);
+	if (!IS_ENABLED(CONFIG_SPL_RAW_IMAGE_SUPPORT) ||
+	    CONFIG_IS_ENABLED(FIT_SIGNATURE)) {
+		magic = fdt_magic(image);
+		fdt_set_magic(image, 0);
+		ut_assertok(check_download(uts, image, size, NULL, NULL));
+		fdt_set_magic(image, magic);
+	}
 
 	/* The Android envelope is independent of the payload format. */
 	if (type != FIT_INTERNAL)
@@ -139,7 +142,7 @@ static int check_images(struct unit_test_state *uts, void *image, size_t size,
 	ut_assertok(check_download(uts, wrapped, wrapped_size, info, data));
 	ut_assertok(check_download(uts, wrapped, sizeof(*hdr) - 100, NULL, NULL));
 	ut_assertok(check_download(uts, wrapped, wrapped_size - 1, NULL, NULL));
-	/* Android padding must not make a truncated FIT payload look complete. */
+	/* Android padding must not make a truncated payload look complete. */
 	hdr->kernel_size = cpu_to_le32(size - 1);
 	ut_assertok(check_download(uts, wrapped, wrapped_size, NULL, NULL));
 	hdr->kernel_size = cpu_to_le32(size);
@@ -190,3 +193,38 @@ out:
 SPL_IMG_TEST(spl_test_fastboot, FIT_INTERNAL, 0);
 SPL_IMG_TEST(spl_test_fastboot, FIT_EXTERNAL, 0);
 SPL_IMG_TEST(spl_test_fastboot, LEGACY, 0);
+
+static int spl_test_fastboot_raw(struct unit_test_state *uts)
+{
+	u8 image[31], buffer[sizeof(image)], *dest;
+	struct spl_image_info expected = {}, loaded = {};
+	int ret;
+
+	if (!IS_ENABLED(CONFIG_SPL_RAW_IMAGE_SUPPORT))
+		return -EAGAIN;
+	generate_data(image, sizeof(image), __func__);
+	spl_set_header_raw_uboot(&expected);
+	dest = map_sysmem(expected.load_addr, sizeof(image) + 1);
+	dest[sizeof(image)] = 0xa5;
+	fastboot_init(buffer, sizeof(buffer));
+	ut_assertok(download_image(uts, image, sizeof(image)));
+	ut_assertok(run_fastboot_command(uts, "boot", FASTBOOT_COMMAND_BOOT, "OKAY"));
+	fastboot_boot();
+	ret = spl_fastboot_load(&loaded);
+	fastboot_init(NULL, 0);
+	ut_asserteq(0xa5, dest[sizeof(image)]);
+	if (CONFIG_IS_ENABLED(FIT_SIGNATURE)) {
+		ut_asserteq(-EPERM, ret);
+		ut_asserteq(0, loaded.size);
+		return 0;
+	}
+	ut_assertok(ret);
+	ut_asserteq(expected.load_addr, loaded.load_addr);
+	ut_asserteq(expected.entry_point, loaded.entry_point);
+	ut_asserteq(expected.os, loaded.os);
+	ut_asserteq(sizeof(image), loaded.size);
+	ut_asserteq_mem(image, dest, sizeof(image));
+	return 0;
+}
+
+SPL_TEST(spl_test_fastboot_raw, 0);

-- 
2.56.0

Re: [PATCH 1/6] spl: fit: reject failures loading an explicitly requested FDT

[Mattijs Korpershoek]

Hi Carlo,

Thank you for the patch.

> A U-Boot image may embed its device tree, but a FIT which explicitly
> names an FDT must not boot after that FDT fails to load or verify.
> External FDT data is copied to its load address before verification,
> so ignoring the error can leave an unverified device tree for U-Boot.
> 
> Keep support for U-Boot images without a separate FDT, but reject
> failures for an explicitly requested FDT in both firmware and loadables.
> 
> Fixes: d879616e9e64 ("spl: fit: simplify logic for FDT loading for non-OS boots")
> Signed-off-by: Carlo Caione <ccaione@baylibre.com>
>
> diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c
> index 64e5f95546f1..a520db765065 100644
> --- a/common/spl/spl_fit.c
> +++ b/common/spl/spl_fit.c
> @@ -491,11 +491,14 @@ static int spl_fit_append_fdt(struct spl_image_info *spl_image,
>  	image_info.load_addr = ALIGN(spl_image->load_addr + spl_image->size, 8);
>  
>  	/* Figure out which device tree the board wants to use */
> +	spl_image->fdt_addr = NULL;

What's the point of initializing fdt_addr to NULL here?
It's assigned in both cases (whether node < 0 or not).

The rest looks good, thanks.

-- 
Mattijs Korpershoek <mkorpershoek@kernel.org>

Re: [PATCH 2/6] fastboot: invalidate stale and incomplete downloads

[Mattijs Korpershoek]

On Wed, 14 Oct 2026 14:24:30 +0200, Carlo Caione <ccaione@baylibre.com> wrote:
> A new session or download must not retain the size of an earlier image.
> Otherwise a failed transfer can leave commands operating on stale or
> partially overwritten data. Only mark a download complete once all
> expected bytes have arrived.

Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>

-- 
Mattijs Korpershoek <mkorpershoek@kernel.org>

Re: [PATCH 3/6] spl: ram: allow loading FIT images from a supplied buffer

[Mattijs Korpershoek]

Hi Carlo,

Thank you for the patch.

> RAM FIT loading currently assumes a configured image address. Downloaded
> images need the same loader with a caller-provided buffer and length so
> reads cannot run beyond the received data.
> 
> Expose a reusable RAM FIT loader with header validation, bounded reads
> and overlap-safe copying. Keep preloaded images working when their buffer
> size is unknown. Add tests for embedded and external FIT data.
> 
> Signed-off-by: Carlo Caione <ccaione@baylibre.com>
>
> diff --git a/MAINTAINERS b/MAINTAINERS
> index d1f51d9197d9..f464e0bd2bce 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -1923,5 +1923,6 @@ Q:	http://patchwork.ozlabs.org/project/uboot/list/
>  S:	Maintained
>  T:	git https://git.u-boot-project.org/u-boot/u-boot.git
>  F:	configs/tools-only_defconfig
> +F:	test/image/spl_ram.c
>  F:	*
>  F:	*/
> diff --git a/common/spl/spl_ram.c b/common/spl/spl_ram.c
> index 0c501cf02f28..ee588ef4718b 100644
> --- a/common/spl/spl_ram.c
> +++ b/common/spl/spl_ram.c
> @@ -16,32 +16,39 @@
>  #include <spl.h>
>  #include <linux/libfdt.h>
>  
> -static ulong spl_ram_load_read(struct spl_load_info *load, ulong sector,
> +struct spl_ram_image {
> +	const void *data;
> +	size_t size;
> +};
> +
> +static ulong spl_ram_load_read(struct spl_load_info *load, ulong offset,

Why changing sector -> offset? It makes the diff more difficult to read and
as far as I understand, the callers are still passing the same argument to
this function.

>  			       ulong count, void *buf)
>  {
> -	ulong addr = 0;
> -
> -	debug("%s: sector %lx, count %lx, buf %lx\n",
> -	      __func__, sector, count, (ulong)buf);

Why is this dropped? It's not mentioned in the commit message.

Rest looks good, thanks

-- 
Mattijs Korpershoek <mkorpershoek@kernel.org>

Re: [PATCH 4/6] spl: support booting FIT images downloaded with fastboot

[Mattijs Korpershoek]

> Test farms need to run successive U-Boot builds without rewriting boot
> storage. Add an optional RAM boot path for FIT images, including firmware
> needed to enter U-Boot.
> 
> Accept the Android v0 envelope used by the standard fastboot client so
> the same fastboot boot u-boot.itb workflow can be used with SPL.
> 
> Do not boot after a failed USB acknowledgment, in SPL or U-Boot proper,
> so the host can retry the command.

This looks like a bug fix on its own and should be in a dedicated patch. Please
split it out.
See the following
https://docs.u-boot-project.org/en/latest/develop/sending_patches.html#general-patch-submission-rules

-- 
Mattijs Korpershoek <mkorpershoek@kernel.org>

Re: [PATCH 5/6] spl: fastboot: support legacy U-Boot images

[Mattijs Korpershoek]

On Wed, 14 Oct 2026 14:24:33 +0200, Carlo Caione <ccaione@baylibre.com> wrote:
> Boards using a single legacy U-Boot image should be able to test it over
> fastboot without changing their image format. Use the shared RAM reader
> and SPL loader, with the downloaded length limiting header and payload
> accesses.
> 
> Keep legacy support optional and reject compressed images, which this
> RAM path does not yet support.
> 
> [...]

Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>

-- 
Mattijs Korpershoek <mkorpershoek@kernel.org>

Re: [PATCH 6/6] spl: fastboot: support raw U-Boot images

[Mattijs Korpershoek]

On Wed, 14 Oct 2026 14:24:34 +0200, Carlo Caione <ccaione@baylibre.com> wrote:
> Boards with fixed U-Boot load and entry addresses do not need an image
> container for RAM boot. Allow raw downloads when SPL_RAW_IMAGE_SUPPORT
> is enabled, using the board's existing address configuration and the
> completed download length.
> 
> Keep recognized FIT and legacy images on their respective validation
> paths, so an invalid container cannot fall back to raw execution.
> 
> [...]

Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>

-- 
Mattijs Korpershoek <mkorpershoek@kernel.org>

Re: [PATCH 1/6] spl: fit: reject failures loading an explicitly requested FDT

[Carlo Caione]

On Tue, Nov 03, 2026 at 11:09:31 +0100, Mattijs Korpershoek wrote:
> Hi Carlo,
> 
> Thank you for the patch.
> 
> > A U-Boot image may embed its device tree, but a FIT which explicitly
> > names an FDT must not boot after that FDT fails to load or verify.
> > External FDT data is copied to its load address before verification,
> > so ignoring the error can leave an unverified device tree for U-Boot.
> > 
> > Keep support for U-Boot images without a separate FDT, but reject
> > failures for an explicitly requested FDT in both firmware and loadables.
> > 
> > Fixes: d879616e9e64 ("spl: fit: simplify logic for FDT loading for non-OS boots")
> > Signed-off-by: Carlo Caione <ccaione@baylibre.com>
> >
> > diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c
> > index 64e5f95546f1..a520db765065 100644
> > --- a/common/spl/spl_fit.c
> > +++ b/common/spl/spl_fit.c
> > @@ -491,11 +491,14 @@ static int spl_fit_append_fdt(struct spl_image_info *spl_image,
> >  	image_info.load_addr = ALIGN(spl_image->load_addr + spl_image->size, 8);
> >  
> >  	/* Figure out which device tree the board wants to use */
> > +	spl_image->fdt_addr = NULL;
> 
> What's the point of initializing fdt_addr to NULL here?
> It's assigned in both cases (whether node < 0 or not).

We actually have a way out if (node < 0) and (!gd->fdt_blob) and the
problematic path is that early return.

The problem starts in spl_load_simple_fit() where image_info is not
zero-initialized so ->fdt_addr is basically garbage. 

When we return early this garbage is copied into spl_image->fdt_addr.

Even zero-initializing the passed struct doesn't fully solve the issue
because the helper also receives the main spl_image, which is reused
across boot attempts and can contain a stale FDT pointer.

So, setting fdt_addr to NULL is the quickest fix for all the cases.

--
Carlo Caione

Re: [PATCH 3/6] spl: ram: allow loading FIT images from a supplied buffer

[Carlo Caione]

On Tue, Nov 03, 2026 at 11:09:31 +0100, Mattijs Korpershoek wrote:
> Hi Carlo,
> 
> Thank you for the patch.
> 
> > RAM FIT loading currently assumes a configured image address. Downloaded
> > images need the same loader with a caller-provided buffer and length so
> > reads cannot run beyond the received data.
> > 
> > Expose a reusable RAM FIT loader with header validation, bounded reads
> > and overlap-safe copying. Keep preloaded images working when their buffer
> > size is unknown. Add tests for embedded and external FIT data.
> > 
> > Signed-off-by: Carlo Caione <ccaione@baylibre.com>
> >
> > diff --git a/MAINTAINERS b/MAINTAINERS
> > index d1f51d9197d9..f464e0bd2bce 100644
> > --- a/MAINTAINERS
> > +++ b/MAINTAINERS
> > @@ -1923,5 +1923,6 @@ Q:	http://patchwork.ozlabs.org/project/uboot/list/
> >  S:	Maintained
> >  T:	git https://git.u-boot-project.org/u-boot/u-boot.git
> >  F:	configs/tools-only_defconfig
> > +F:	test/image/spl_ram.c
> >  F:	*
> >  F:	*/
> > diff --git a/common/spl/spl_ram.c b/common/spl/spl_ram.c
> > index 0c501cf02f28..ee588ef4718b 100644
> > --- a/common/spl/spl_ram.c
> > +++ b/common/spl/spl_ram.c
> > @@ -16,32 +16,39 @@
> >  #include <spl.h>
> >  #include <linux/libfdt.h>
> >  
> > -static ulong spl_ram_load_read(struct spl_load_info *load, ulong sector,
> > +struct spl_ram_image {
> > +	const void *data;
> > +	size_t size;
> > +};
> > +
> > +static ulong spl_ram_load_read(struct spl_load_info *load, ulong offset,
> 
> Why changing sector -> offset? It makes the diff more difficult to read and
> as far as I understand, the callers are still passing the same argument to
> this function.

It was just for the sake of clarity. I'll dump this.
 
> >  			       ulong count, void *buf)
> >  {
> > -	ulong addr = 0;
> > -
> > -	debug("%s: sector %lx, count %lx, buf %lx\n",
> > -	      __func__, sector, count, (ulong)buf);
> 
> Why is this dropped? It's not mentioned in the commit message.

Ooops, I'll restore it.

> Rest looks good, thanks
> 
> -- 
> Mattijs Korpershoek <mkorpershoek@kernel.org>

Thanks,

--
Carlo Caione

Re: [PATCH 4/6] spl: support booting FIT images downloaded with fastboot

[Carlo Caione]

On Tue, Nov 03, 2026 at 11:09:31 +0100, Mattijs Korpershoek wrote:
> > Test farms need to run successive U-Boot builds without rewriting boot
> > storage. Add an optional RAM boot path for FIT images, including firmware
> > needed to enter U-Boot.
> > 
> > Accept the Android v0 envelope used by the standard fastboot client so
> > the same fastboot boot u-boot.itb workflow can be used with SPL.
> > 
> > Do not boot after a failed USB acknowledgment, in SPL or U-Boot proper,
> > so the host can retry the command.
> 
> This looks like a bug fix on its own and should be in a dedicated patch. Please
> split it out.
> See the following
> https://docs.u-boot-project.org/en/latest/develop/sending_patches.html#general-patch-submission-rules

I'll do, thanks.

--
Carlo Caione

Re: [PATCH 1/6] spl: fit: reject failures loading an explicitly requested FDT

[Guillaume La Roque]

Hi,

On 2026-11-03 17:50:46+01:00, Carlo Caione wrote:
> On Tue, Nov 03, 2026 at 11:09:31 +0100, Mattijs Korpershoek wrote:
> 
> > Hi Carlo,
> > 
> > Thank you for the patch.
> > 
> > 
> > What's the point of initializing fdt_addr to NULL here?
> > It's assigned in both cases (whether node < 0 or not).
> 
> We actually have a way out if (node < 0) and (!gd->fdt_blob) and the
> problematic path is that early return.
> 
> The problem starts in spl_load_simple_fit() where image_info is not
> zero-initialized so ->fdt_addr is basically garbage. 
> 
> When we return early this garbage is copied into spl_image->fdt_addr.
> 
> Even zero-initializing the passed struct doesn't fully solve the issue
> because the helper also receives the main spl_image, which is reused
> across boot attempts and can contain a stale FDT pointer.
> 
> So, setting fdt_addr to NULL is the quickest fix for all the cases.

perhaps talk about this in commit message or a comment in code could 
be great, otherwile :

Reviewed-by: Guillaume La Roque <glaroque@baylibre.com>

Regards,
Guillaume
> 
> --
> Carlo Caione

Re: [PATCH 2/6] fastboot: invalidate stale and incomplete downloads

[Guillaume La Roque]

On Wed, 14 Oct 2026 14:24:30 +0200, Carlo Caione <ccaione@baylibre.com> wrote:
> A new session or download must not retain the size of an earlier image.
> Otherwise a failed transfer can leave commands operating on stale or
> partially overwritten data. Only mark a download complete once all
> expected bytes have arrived.

Reviewed-by: Guillaume La Roque <glaroque@baylibre.com>

-- 
Guillaume La Roque <glaroque@baylibre.com>

Re: [PATCH 5/6] spl: fastboot: support legacy U-Boot images

[Guillaume La Roque]

On Wed, 14 Oct 2026 14:24:33 +0200, Carlo Caione <ccaione@baylibre.com> wrote:
> Boards using a single legacy U-Boot image should be able to test it over
> fastboot without changing their image format. Use the shared RAM reader
> and SPL loader, with the downloaded length limiting header and payload
> accesses.
> 
> Keep legacy support optional and reject compressed images, which this
> RAM path does not yet support.
> 
> [...]

Reviewed-by: Guillaume La Roque <glaroque@baylibre.com>

-- 
Guillaume La Roque <glaroque@baylibre.com>

Re: [PATCH 6/6] spl: fastboot: support raw U-Boot images

[Guillaume La Roque]

On Wed, 14 Oct 2026 14:24:34 +0200, Carlo Caione <ccaione@baylibre.com> wrote:
> Boards with fixed U-Boot load and entry addresses do not need an image
> container for RAM boot. Allow raw downloads when SPL_RAW_IMAGE_SUPPORT
> is enabled, using the board's existing address configuration and the
> completed download length.
> 
> Keep recognized FIT and legacy images on their respective validation
> paths, so an invalid container cannot fall back to raw execution.
> 
> [...]

Reviewed-by: Guillaume La Roque <glaroque@baylibre.com>

-- 
Guillaume La Roque <glaroque@baylibre.com>