Am 3. September 2026 15:09:47 MESZ schrieb Carlo Caione <[email protected]>: >EBBR-style firmware owns the devicetree: the OS is booted via UEFI and >receives the devicetree from the firmware through the EFI configuration >table instead of shipping its own. U-Boot has the handoff mechanism >(efi_install_fdt()), but no generic way to describe and load the >firmware-owned source. As a result, platforms carry downstream commands >to provide it. > >This series adds a firmware-FDT uclass with storage-specific source >drivers and common FIT selection, verification, overlay assembly and >caching: > >- one FIT ("fdt.itb" by default) carries the base devicetree and its > overlays. FIT configurations describe valid combinations, so a signed > configuration authenticates the base, overlay set and ordering; > >- the first backend, selected by a standalone > 'u-boot,firmware-fdt-block' control-DT node, reads the FIT from a > filesystem on a GPT partition. The compatible suffix leaves room for > drivers which obtain the same FIT from other firmware storage; >
Why should a "firmware-owned" device-tree live on an OS owned block device? This lack of separation of duties is bound to lead to total failure once I reinstall my OS which typically starts with repartitioning the block device. Please, put anything that is firmware owned on a storage device that is firmware owned and not OS owned. >- 'fw_fdt_part' can override the partition for A/B firmware selection, > while 'fw_fdt_config' can select the configuration for the current boot > policy. Otherwise compatible best-match against the control devicetree > is used, falling back to the FIT default; > >- the source device caches the assembled result by those two selectors, > avoiding repeated reads and verification while the EFI bootmeth scans > bootflow candidates; > >- once a source is configured, any failure to assemble the devicetree is > fatal rather than silently falling back to an unverified source. Every > image is verified up front so a corrupt overlay cannot be silently > skipped. > >The loader does not depend on standard boot. EFI is its first consumer, The topic of constructing a firmware device-tree seems to be completely independent of the way the boot binary is invoked. The easiest way to make such a device-tree available for other boot methods would be providing an environment variable that can be used instead of $fdtcontroladdr. The construction should only occur once and not repeatedly for each of the EFI binaries that is executed. Best regards Heinrich >but the source drivers, FIT handling and staging interface are generic. >Both the EFI bootmeth and EFI boot manager use the same staging helper. > >Patch 1 makes an FDT passed to efi_bootmgr_run() outrank a Boot#### FDT, >as an independent behaviour fix. Patch 2 adds the uclass, block backend, >documentation and staging interface. Patches 3 and 4 integrate the EFI >bootmeth and boot manager. Patch 5 adds sandbox coverage. > >Signed-off-by: Carlo Caione <[email protected]> >--- >Changes in v3: >- Model firmware-FDT sources as a uclass with storage backend drivers; > split out the block backend and reject multiple enabled sources. >- Cache the verified, assembled devicetree by the partition and > configuration runtime selectors. >- Rename efi_stage_firmware_fdt() to the generic firmware_fdt_stage(). >- Add separate configurable size limits for the input FIT and assembled > devicetree. >- Validate the assembled devicetree before publishing it and avoid > duplicating the internal FIT filename. >- Keep EFI and firmware-FDT sizes separate in the boot manager and retain > the FIT filename for failure diagnostics. >- Extend sandbox coverage for caching and selector invalidation, a missing > FIT and multiple configured sources. >- Use the current SystemReady DeviceTree name. >- Clarify fw_fdt_part as the A/B partition override and fw_fdt_config as > the per-boot-target configuration override accepted in the v2 review. >- Add Reviewed-by tags from Ilias Apalodimas and Simon Glass to patch 1. >- Link to v2: >https://patch.msgid.link/[email protected] > >Changes in v2: >- Make the loader independent of bootstd and describe EFI as its first > consumer. >- Describe the source with a standalone compatible node which points to > the backing media through a phandle. >- Rename 'boot_dtb' to 'fw_fdt_part' and document both environment > variables in doc/usage/environment.rst. >- Factor EFI staging and fail-closed policy into one helper used by all > three call sites. >- Track the assembled FDT's ownership explicitly and own the FIT filename. >- Select FIT_BEST_MATCH and add explicit compatible-selection coverage. >- Split the passed-FDT precedence change into its own first patch. >- Build the entire sandbox source topology at runtime, store mmc11.img in > persistent_data_dir and add staging, configuration-chaining and corrupt > base/overlay fail-closed coverage. >- Link to v1: >https://patch.msgid.link/[email protected] > >--- >Carlo Caione (5): > efi_loader: bootmgr: preserve a passed devicetree > boot: add a firmware-owned devicetree source > bootmeth: efi: use the firmware-owned devicetree > efi_loader: bootmgr: install the firmware-owned devicetree > test: boot: add firmware-FDT source tests > > MAINTAINERS | 3 + > boot/Kconfig | 49 +++ > boot/Makefile | 2 + > boot/bootmeth_efi.c | 45 ++- > boot/firmware_fdt.c | 303 ++++++++++++++++++ > boot/firmware_fdt_block.c | 143 +++++++++ > boot/image-fdt.c | 3 +- > boot/image-fit.c | 9 +- > configs/sandbox_defconfig | 1 + > doc/develop/uefi/firmware_fdt.rst | 118 +++++++ > doc/develop/uefi/index.rst | 1 + > doc/device-tree-bindings/firmware-fdt.txt | 160 ++++++++++ > doc/usage/environment.rst | 13 + > include/dm/uclass-id.h | 1 + > include/firmware_fdt.h | 106 +++++++ > include/image.h | 5 +- > lib/efi_loader/efi_bootmgr.c | 45 ++- > test/boot/Makefile | 1 + > test/boot/firmware_fdt.c | 498 ++++++++++++++++++++++++++++++ > test/py/tests/test_ut.py | 183 +++++++++++ > 20 files changed, 1670 insertions(+), 19 deletions(-) >--- >base-commit: 3f19667468fb93bcb5702d23aa057b72639e3ac8 >change-id: 20260706-ccaione-upstream-ebbr-206c30be3a3a > >Best regards, >-- >Carlo Caione <[email protected]> >
