EBBR-style firmware (SystemReady IR) owns the devicetree: the OS is
booted via UEFI and receives the devicetree from the firmware through
the EFI configuration table instead of shipping its own. U-Boot has
the handoff mechanism (efi_install_fdt()), but no generic way to say
which devicetree the firmware owns or where it lives. As a result,
platforms carry downstream commands to provide it.
This series adds a generic loader for a firmware-owned devicetree FIT on
a dedicated GPT partition:
- one FIT ("fdt.itb" by default) carries the base devicetree and its
overlays. FIT configurations describe the valid combinations, so a
signed configuration authenticates the base, overlay set and ordering;
- a standalone 'u-boot,firmware-fdt-block' control-DT node points to the
media device through a 'firmware-fdt-store' phandle. The node selects
a partition by type UUID and/or name;
- 'fw_fdt_part' can pin an A/B partition and 'fw_fdt_config' can select
an explicit configuration. Otherwise compatible best-match against the
control devicetree is used, falling back to the FIT default. Configuration
chaining is rejected so each combination remains one authenticated unit;
- one staging helper owns the EFI policy: use fdt_addr_r, enforce the
size cap and distinguish an absent source from a configured source
which failed. Both the EFI bootmeth and EFI boot manager use it;
- once a source is configured, any failure to assemble the devicetree is
fatal rather than silently falling back to an unverified source. Every
image is verified up front so a corrupt overlay cannot be silently skipped.
The loader itself does not depend on standard boot. EFI is its first
consumer, but the source lookup, FIT selection, verification and overlay
assembly are generic.
Patch 1 makes an FDT passed to efi_bootmgr_run() outrank a Boot#### FDT,
as an independent behaviour fix. Patch 2 adds the loader, binding,
documentation and shared EFI staging policy. Patches 3 and 4 integrate
the EFI bootmeth and boot manager. Patch 5 adds sandbox coverage.
Signed-off-by: Carlo Caione <[email protected]>
---
Changes in v2:
- Make the loader independent of bootstd and describe EFI as its first
consumer.
- Describe the source with a standalone compatible node which points to
the backing media through a phandle.
- Rename 'boot_dtb' to 'fw_fdt_part' and document both environment
variables in doc/usage/environment.rst.
- Factor EFI staging and fail-closed policy into one helper used by all
three call sites.
- Track the assembled FDT's ownership explicitly and own the FIT filename.
- Select FIT_BEST_MATCH and add explicit compatible-selection coverage.
- Split the passed-FDT precedence change into its own first patch.
- Build the entire sandbox source topology at runtime, store mmc11.img in
persistent_data_dir and add staging, configuration-chaining and corrupt
base/overlay fail-closed coverage.
- Link to v1:
https://patch.msgid.link/[email protected]
---
Carlo Caione (5):
efi_loader: bootmgr: preserve a passed devicetree
boot: add a firmware-owned devicetree source
bootmeth: efi: use the firmware-owned devicetree
efi_loader: bootmgr: install the firmware-owned devicetree
test: boot: add firmware-FDT source tests
MAINTAINERS | 3 +
boot/Kconfig | 24 ++
boot/Makefile | 1 +
boot/bootmeth_efi.c | 45 +++-
boot/firmware_fdt.c | 420 ++++++++++++++++++++++++++++++
boot/image-fdt.c | 3 +-
boot/image-fit.c | 9 +-
configs/sandbox_defconfig | 1 +
doc/develop/uefi/firmware_fdt.rst | 112 ++++++++
doc/develop/uefi/index.rst | 1 +
doc/device-tree-bindings/firmware-fdt.txt | 150 +++++++++++
doc/usage/environment.rst | 11 +
include/firmware_fdt.h | 95 +++++++
include/image.h | 4 +-
lib/efi_loader/efi_bootmgr.c | 39 ++-
test/boot/Makefile | 1 +
test/boot/firmware_fdt.c | 411 +++++++++++++++++++++++++++++
test/py/tests/test_ut.py | 181 +++++++++++++
18 files changed, 1492 insertions(+), 19 deletions(-)
---
base-commit: b635d43bca429500cb8ef20aa151cb5773b9a8a5
change-id: 20260706-ccaione-upstream-ebbr-206c30be3a3a
Best regards,
--
Carlo Caione <[email protected]>
