This series brings back the FIT load address overlap detection that
was applied to next in September 2025 and reverted a day later in
commit e482fdbbca93 ("Revert "Merge patch series "mkimage: Detect FIT
image load address overlaps and fix related test/DTS issues""").
The v2 revert had two causes. On TI AM62x family boards the tispl FIT
image references the mutually exclusive tifsstub variants at a single
shared load address, and v2 tried to satisfy the checker by moving the
variants 64 KiB apart. Neha had warned in the v1 review that this
address is fixed by the platform and that moving the images would
break tifsstub selection, and that feedback was regrettably still
unaddressed when the series was applied. Nishanth then hit exactly
this class of failure in the K3 upstream boot build with real firmware
binaries, where am62px_evm, a board v2 had not even touched, failed
the new check on tifsstub-hs and tifsstub-fs sharing 0x9ca00000.
Separately, E Shattow reported an overlap on the StarFive VisionFive
2, which we later narrowed down to OpenSBI fw_payload.bin having been
passed to the build instead of the documented fw_dynamic.bin. With
fw_dynamic.bin the board has no overlap, as confirmed on the list in
January 2026.
Since then the structural fix for the tifsstub case has landed. The
series merged as commit 4e7a9bb0885e ("Merge patch series "arm: k3:
replace tifsstub runtime filter with per-state FIT configurations"")
gives each K3 security state its own FIT configuration referencing
only the matching tifsstub variant, so a per configuration overlap
check sees no conflict while the variants keep their required common
load address. That series was written precisely to unblock this one.
The underlying semantics, that overlap is a property of a single
configuration and that images referenced by different configurations
never coexist in memory, were discussed with the FIT spec folks in
flat-image-tree issue #32 [1].
The check itself is unchanged in spirit: for every configuration,
collect the load regions of all referenced images that have both a
load address and data, and fail the build if any two regions within
that configuration intersect. Images referenced only by different
configurations may freely share addresses.
Verification done for this version:
Running the new mkimage in reprocess mode over every FIT produced by
current master builds of am62x_evm, verdin-am62 and phycore_am62x
(A53 and R5 each) flags exactly one problem: the phycore u-boot FIT,
where the four SPL devicetree overlays are loaded simultaneously from
one configuration but are spaced only 4 KiB apart while each packaged
image measures 5.9 to 6.1 KiB including its ti-secure certificate.
That is a real overlap shipping today and patch 4 widens the spacing.
All tispl FITs with the per-state tifsstub configurations pass.
buildman with binman missing blob handling, matching CI, builds all of
phycore_am62x, phycore_am62ax, phycore_am64x, am62x_evm, am62ax_evm,
am62px_evm, am64x_evm, verdin-am62, verdin-am62p and am62x_beagleplay
(A53 and R5 each) plus starfive_visionfive2 with the check active,
since binman invokes the freshly built mkimage during these builds.
starfive_visionfive2 was additionally built with a real OpenSBI 1.7
fw_dynamic.bin passed via OPENSBI and completes cleanly.
The binman functional test suite shows no new failures compared to
master in the same environment. The nine tests whose fixtures are
touched by patches 1 to 3, including the OpenSSL engine and PKCS11
signing tests that only run when softhsm2 and opensc are available,
all pass. The mkimage validation pytests, including the two new
ones, pass against a sandbox build.
Changes in v4:
- collect the review and test tags from Simon and Wadim
- patch 3: reword the commit message into imperative mood and add a
comment in elf_sections_tee.lds noting that it mirrors
elf_sections.lds at a higher base, so the two stay in sync (Simon)
- patch 6: also assert that the configuration name appears in the
overlap error message (Simon)
- patch 7: add blank lines around the command examples so the
generated documentation renders each one on its own line, and note
that the overlap check compares packaged data sizes and so assumes
uncompressed images (Simon)
Changes in v3:
- rebase on master, on top of the per-state tifsstub configuration
series
- drop the k3-am6xx tifsstub load address changes, obsolete after the
per-state configuration series
- add a patch widening the phyCORE SPL overlay slot spacing, a real
overlap the checker found (see above)
- extend the binman fixture fixes to the signing fixtures added since
v2 (OpenSSL engine, PKCS11, multiple key paths, key name hint
directory); their tests only run where the signing tools exist, so
local testing without those tools missed them and GitLab CI caught
them
- drop the "not able to get `load`" warning printed for every image
without a load address, it was noise in every build log
- name the configuration in the overlap error message, matching the
neighbouring reference validation messages
- move the test into the existing test_fit_mkimage_validate.py and add
a companion test asserting that images may share a load address when
no single configuration references both
- move the fit,load documentation into the binman fit etype docstring
as Jonas asked for in v2; entries.rst is generated by Sphinx at doc
build time since commit 090a7eb9cf36 ("binman: Remove pre-generated
entries.rst and bintools.rst"), so the note can only live there now.
Simon gave a Reviewed-by in v2 conditional on exactly this move, but
given how long ago that was and how much the patch changed shape, I
have not carried the tag and would welcome a fresh look
- drop the review tags collected on the v1 posting last year for the
binman fixture patches for the same reason, only Dhruva's tag on the
unchanged one line typo patch is kept
- collect regions with a dynamically grown array shared across
configurations instead of per configuration allocations
[1] https://github.com/open-source-firmware/flat-image-tree/issues/32
Link to v2:
https://lore.kernel.org/u-boot/[email protected]/
Link to the revert:
https://lore.kernel.org/u-boot/20250924135139.GH197373@bill-the-cat/
Aristo Chen (7):
binman: Fix typo for the test case name
binman: Fix FIT image overlap issues
binman: Fix FIT image overlap issues for testFitSplitElf
arm: dts: k3: phycore: widen SPL overlay load address spacing
tools: mkimage: detect overlapping load regions in FIT configurations
test: fit: cover mkimage load address overlap detection
binman: fit: document how ELF load addresses are determined
arch/arm/dts/k3-am625-phycore-som-binman.dtsi | 6 +-
arch/arm/dts/k3-am62a-phycore-som-binman.dtsi | 6 +-
arch/arm/dts/k3-am642-phycore-som-binman.dtsi | 6 +-
test/py/tests/test_fit_mkimage_validate.py | 136 ++++++++++++++++++
tools/binman/etype/fit.py | 26 ++++
tools/binman/ftest.py | 4 +-
tools/binman/test/Makefile | 8 +-
tools/binman/test/elf_sections_tee.c | 1 +
tools/binman/test/elf_sections_tee.lds | 35 +++++
tools/binman/test/fit/firmware_loadables.dts | 4 +-
.../test/fit/key_name_hint_dir_signature.dts | 4 +-
tools/binman/test/fit/signature.dts | 4 +-
tools/binman/test/fit/signature_engine.dts | 4 +-
.../test/fit/signature_engine_encrypt.dts | 4 +-
.../test/fit/signature_engine_pkcs11.dts | 4 +-
.../fit/signature_engine_pkcs11_object.dts | 4 +-
tools/binman/test/fit/signature_multi_key.dts | 4 +-
tools/binman/test/fit/signature_no_nodes.dts | 4 +-
tools/fit_image.c | 99 +++++++++++++
tools/mkimage.c | 3 +-
20 files changed, 334 insertions(+), 32 deletions(-)
create mode 120000 tools/binman/test/elf_sections_tee.c
create mode 100644 tools/binman/test/elf_sections_tee.lds
--
2.43.0
