Boot a FIT with no kernel load/entry and no device tree

[dgarske]

Description

Found working through a Versal customer image: a Flattened Image Tree (FIT) built without load/entry on the kernel node and with no fdt sub-image at all.

Fixes two problems and adds a new configuration option:

1. A FIT with no fdt sub-image entered Linux with a null device tree

src/update_ram.c reached its raw-DTB path - hal_get_dts_address(), else WOLFBOOT_DTS_BOOT_ADDRESS out of flash - only in the else of the FIT branch, so it ran only when the payload was not a FIT at all. A kernel-only FIT parses, finds no fdt node, leaves dts_addr NULL, and do_boot() hands that to the kernel in x0. The raw path is now entered whenever no device tree came out of the FIT, matching what src/update_disk.c already did. A FIT fdt node that fails validation now logs the fallback instead of taking it silently, since it substitutes a different device tree than the FIT names.

2. The initrd fixup ran before the device tree was chosen

fit_load_ramdisk() was called inside the FIT branch, with a context opened only on a DTB the FIT itself supplied. When the device tree comes from the boot firmware instead, the ramdisk loaded but /chosen/linux,initrd-start and -end were never written, so the kernel saw no initrd. Both loaders now defer the fixup until the device tree source is settled.

New option

WOLFBOOT_LOAD_KERNEL_ADDRESS stages the FIT kernel at a configured address, overriding the FIT's load/entry. It mirrors the existing WOLFBOOT_LOAD_RAMDISK_ADDRESS and WOLFBOOT_LOAD_FPGA_ADDRESS, and 0 - the default - honors the FIT, so no existing target changes behavior. It is what makes such a FIT bootable without editing it: a gzip kernel with no load has nowhere to decompress to and fails closed.

config/examples/versal_vmk180_highddr.config is a worked configuration for a DDR aperture at 0x400_0000_0000, with a CI build job. docs/Targets.md covers both FIT shapes, including the two-cell load/entry an ITS needs above 4 GB and the bootargs consequence of a device tree that sits outside the signature.

Hardware / test status

Validated end-to-end on a Versal VMK180 (Platform Cable USB II, QSPI payload): a FIT whose kernel node declares no load/entry, whose ramdisk node declares no load, and which carries no fdt sub-image, with the device tree supplied by the BIF's { type=raw, load=0x1000, file=system-default.dtb } partition. Read back out of DDR: an arm64 Image (MZ, and ARM\x64 at offset 0x38) at the configured kernel address, and a live /chosen carrying linux,initrd-start/-end spanning exactly the ramdisk, in the BIF-supplied tree rather than a FIT one.

Also covered by unit tests for the override, for the initrd fixup applied to a device tree the FIT did not supply, and for two-cell address decoding. Build-verified across the Xilinx, NXP, PolarFire and Raspberry Pi targets that share these loaders.

[Copilot]

Copilot review overview

🟡 Changes recommended

Two-cell addresses truncate unsafely on 32-bit builds, and the central loader-level initrd regression lacks direct coverage.

Review effort: Balanced
Findings: 1 · 3

Open (4)

• Reject addresses that exceed uintptr_t instead of truncating them · New
• Correct documentation for the high-DDR wolfBoot origin · New
• Clarify override diagnostics for unsupported FIT sub-images · New
• Add an end-to-end test for ramdisk loading without a FIT DTB · New

What changed in this PR

Adds support for booting kernel-only FIT images without kernel load/entry addresses or an embedded device tree.

Changes:

• Adds configurable FIT kernel relocation and 64-bit address handling.
• Defers initrd fixups until the final DTB is selected.
• Adds Versal high-DDR configuration, documentation, CI, and tests.

File	Description
src/​fdt.c	Adds kernel relocation helper and diagnostics.
src/​update_ram.c	Adds DTB fallback and deferred initrd fixup.
src/​update_disk.c	Defers initrd fixup and improves address logging.
src/​boot_aarch64.c	Prints full-width boot addresses.
include/​fdt.h	Declares the kernel-loading API.
include/​target.h.in	Exposes the kernel load address.
Makefile	Generates the new target setting.
options.mk	Defines the kernel relocation option.
tools/​config.mk	Persists the new configuration variable.
tools/​unit-tests/​Makefile	Enables ramdisk testing.
tools/​unit-tests/​unit-fit-gzip.c	Tests relocation and initrd helpers.
tools/​unit-tests/​unit-fdt.c	Tests two-cell FIT addresses.
tools/​unit-tests/​unit-update-disk-fit.c	Adds the kernel loader stub.
docs/​Targets.md	Documents supported FIT layouts.
config/​examples/​versal_vmk180.config	Documents optional relocation settings.
config/​examples/​versal_vmk180_highddr.config	Adds a high-DDR Versal example.
.github/​workflows/​test-configs.yml	Builds the new example in CI.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It changes security-sensitive boot loading, DTB selection, memory relocation, and AArch64 handoff behavior across multiple targets.

Review effort: Balanced
Findings: None

Resolved since last review (4)

• Reject addresses that exceed uintptr_t instead of truncating them
• Add an end-to-end test for ramdisk loading without a FIT DTB
• Clarify override diagnostics for unsupported FIT sub-images
• Correct documentation for the high-DDR wolfBoot origin