EBBR-style firmware owns the devicetree: the OS is booted via UEFI and
receives the devicetree from the firmware through the EFI configuration
table instead of shipping its own. U-Boot has the handoff mechanism
(efi_install_fdt()), but no generic way to describe and load the
firmware-owned source. As a result, platforms carry downstream commands
to provide it.
This series adds a firmware-FDT uclass with storage-specific source
drivers and common FIT selection, verification, overlay assembly and
caching:
- one FIT ("fdt.itb" by default) carries the base devicetree and its
overlays. FIT configurations describe valid combinations, so a signed
configuration authenticates the base, overlay set and ordering;
- the first backend, selected by a standalone
'u-boot,firmware-fdt-block' control-DT node, reads the FIT from a
filesystem on a GPT partition. The compatible suffix leaves room for
drivers which obtain the same FIT from other firmware storage;
- 'fw_fdt_part' can override the partition for A/B firmware selection,
while 'fw_fdt_config' can select the configuration for the current boot
policy. Otherwise compatible best-match against the control devicetree
is used, falling back to the FIT default;
- the source device caches the assembled result by those two selectors,
avoiding repeated reads and verification while the EFI bootmeth scans
bootflow candidates;
- once a source is configured, any failure to assemble the devicetree is
fatal rather than silently falling back to an unverified source. Every
image is verified up front so a corrupt overlay cannot be silently
skipped.
The loader does not depend on standard boot. EFI is its first consumer,
but the source drivers, FIT handling and staging interface are generic.
Both the EFI bootmeth and EFI boot manager use the same staging helper.
Patch 1 makes an FDT passed to efi_bootmgr_run() outrank a Boot#### FDT,
as an independent behaviour fix. Patch 2 adds the uclass, block backend,
documentation and staging interface. Patches 3 and 4 integrate the EFI
bootmeth and boot manager. Patch 5 adds sandbox coverage.
Signed-off-by: Carlo Caione <[email protected]>
---
Changes in v3:
- Model firmware-FDT sources as a uclass with storage backend drivers;
split out the block backend and reject multiple enabled sources.
- Cache the verified, assembled devicetree by the partition and
configuration runtime selectors.
- Rename efi_stage_firmware_fdt() to the generic firmware_fdt_stage().
- Add separate configurable size limits for the input FIT and assembled
devicetree.
- Validate the assembled devicetree before publishing it and avoid
duplicating the internal FIT filename.
- Keep EFI and firmware-FDT sizes separate in the boot manager and retain
the FIT filename for failure diagnostics.
- Extend sandbox coverage for caching and selector invalidation, a missing
FIT and multiple configured sources.
- Use the current SystemReady DeviceTree name.
- Clarify fw_fdt_part as the A/B partition override and fw_fdt_config as
the per-boot-target configuration override accepted in the v2 review.
- Add Reviewed-by tags from Ilias Apalodimas and Simon Glass to patch 1.
- Link to v2:
https://patch.msgid.link/[email protected]
Changes in v2:
- Make the loader independent of bootstd and describe EFI as its first
consumer.
- Describe the source with a standalone compatible node which points to
the backing media through a phandle.
- Rename 'boot_dtb' to 'fw_fdt_part' and document both environment
variables in doc/usage/environment.rst.
- Factor EFI staging and fail-closed policy into one helper used by all
three call sites.
- Track the assembled FDT's ownership explicitly and own the FIT filename.
- Select FIT_BEST_MATCH and add explicit compatible-selection coverage.
- Split the passed-FDT precedence change into its own first patch.
- Build the entire sandbox source topology at runtime, store mmc11.img in
persistent_data_dir and add staging, configuration-chaining and corrupt
base/overlay fail-closed coverage.
- Link to v1:
https://patch.msgid.link/[email protected]
---
Carlo Caione (5):
efi_loader: bootmgr: preserve a passed devicetree
boot: add a firmware-owned devicetree source
bootmeth: efi: use the firmware-owned devicetree
efi_loader: bootmgr: install the firmware-owned devicetree
test: boot: add firmware-FDT source tests
MAINTAINERS | 3 +
boot/Kconfig | 49 +++
boot/Makefile | 2 +
boot/bootmeth_efi.c | 45 ++-
boot/firmware_fdt.c | 303 ++++++++++++++++++
boot/firmware_fdt_block.c | 143 +++++++++
boot/image-fdt.c | 3 +-
boot/image-fit.c | 9 +-
configs/sandbox_defconfig | 1 +
doc/develop/uefi/firmware_fdt.rst | 118 +++++++
doc/develop/uefi/index.rst | 1 +
doc/device-tree-bindings/firmware-fdt.txt | 160 ++++++++++
doc/usage/environment.rst | 13 +
include/dm/uclass-id.h | 1 +
include/firmware_fdt.h | 106 +++++++
include/image.h | 5 +-
lib/efi_loader/efi_bootmgr.c | 45 ++-
test/boot/Makefile | 1 +
test/boot/firmware_fdt.c | 498 ++++++++++++++++++++++++++++++
test/py/tests/test_ut.py | 183 +++++++++++
20 files changed, 1670 insertions(+), 19 deletions(-)
---
base-commit: 3f19667468fb93bcb5702d23aa057b72639e3ac8
change-id: 20260706-ccaione-upstream-ebbr-206c30be3a3a
Best regards,
--
Carlo Caione <[email protected]>
