Am 29. September 2026 00:10:05 MESZ schrieb Heinrich Schuchardt <[email protected]>: >Am 3. September 2026 15:09:47 MESZ schrieb Carlo Caione <[email protected]>: >>EBBR-style firmware owns the devicetree: the OS is booted via UEFI and >>receives the devicetree from the firmware through the EFI configuration >>table instead of shipping its own. U-Boot has the handoff mechanism >>(efi_install_fdt()), but no generic way to describe and load the >>firmware-owned source. As a result, platforms carry downstream commands >>to provide it. >> >>This series adds a firmware-FDT uclass with storage-specific source >>drivers and common FIT selection, verification, overlay assembly and >>caching: >> >>- one FIT ("fdt.itb" by default) carries the base devicetree and its >> overlays. FIT configurations describe valid combinations, so a signed >> configuration authenticates the base, overlay set and ordering; >> >>- the first backend, selected by a standalone >> 'u-boot,firmware-fdt-block' control-DT node, reads the FIT from a >> filesystem on a GPT partition. The compatible suffix leaves room for >> drivers which obtain the same FIT from other firmware storage; >> > >Why should a "firmware-owned" device-tree live on an OS owned block device? > >This lack of separation of duties is bound to lead to total failure once I >reinstall my OS which typically starts with repartitioning the block device. > >Please, put anything that is firmware owned on a storage device that is >firmware owned and not OS owned. > >>- 'fw_fdt_part' can override the partition for A/B firmware selection, >> while 'fw_fdt_config' can select the configuration for the current boot >> policy. Otherwise compatible best-match against the control devicetree >> is used, falling back to the FIT default; >> >>- the source device caches the assembled result by those two selectors, >> avoiding repeated reads and verification while the EFI bootmeth scans >> bootflow candidates; >> >>- once a source is configured, any failure to assemble the devicetree is >> fatal rather than silently falling back to an unverified source. Every >> image is verified up front so a corrupt overlay cannot be silently >> skipped. >> >>The loader does not depend on standard boot. EFI is its first consumer, > >The topic of constructing a firmware device-tree seems to be completely >independent of the way the boot binary is invoked. > >The easiest way to make such a device-tree available for other boot methods >would be providing an environment variable that can be used instead of >$fdtcontroladdr. > >The construction should only occur once and not repeatedly for each of the EFI >binaries that is executed.
Thinking of other boot stages like EDK II the device-tree may already have to be created in U-Boot SPL. Multiple RISC-V systems boot via U-Boot SPL -> OpenSBI-> EDK II Best regards Heinrich >>but the source drivers, FIT handling and staging interface are generic. >>Both the EFI bootmeth and EFI boot manager use the same staging helper. >> >>Patch 1 makes an FDT passed to efi_bootmgr_run() outrank a Boot#### FDT, >>as an independent behaviour fix. Patch 2 adds the uclass, block backend, >>documentation and staging interface. Patches 3 and 4 integrate the EFI >>bootmeth and boot manager. Patch 5 adds sandbox coverage. >> >>Signed-off-by: Carlo Caione <[email protected]> >>--- >>Changes in v3: >>- Model firmware-FDT sources as a uclass with storage backend drivers; >> split out the block backend and reject multiple enabled sources. >>- Cache the verified, assembled devicetree by the partition and >> configuration runtime selectors. >>- Rename efi_stage_firmware_fdt() to the generic firmware_fdt_stage(). >>- Add separate configurable size limits for the input FIT and assembled >> devicetree. >>- Validate the assembled devicetree before publishing it and avoid >> duplicating the internal FIT filename. >>- Keep EFI and firmware-FDT sizes separate in the boot manager and retain >> the FIT filename for failure diagnostics. >>- Extend sandbox coverage for caching and selector invalidation, a missing >> FIT and multiple configured sources. >>- Use the current SystemReady DeviceTree name. >>- Clarify fw_fdt_part as the A/B partition override and fw_fdt_config as >> the per-boot-target configuration override accepted in the v2 review. >>- Add Reviewed-by tags from Ilias Apalodimas and Simon Glass to patch 1. >>- Link to v2: >>https://patch.msgid.link/[email protected] >> >>Changes in v2: >>- Make the loader independent of bootstd and describe EFI as its first >> consumer. >>- Describe the source with a standalone compatible node which points to >> the backing media through a phandle. >>- Rename 'boot_dtb' to 'fw_fdt_part' and document both environment >> variables in doc/usage/environment.rst. >>- Factor EFI staging and fail-closed policy into one helper used by all >> three call sites. >>- Track the assembled FDT's ownership explicitly and own the FIT filename. >>- Select FIT_BEST_MATCH and add explicit compatible-selection coverage. >>- Split the passed-FDT precedence change into its own first patch. >>- Build the entire sandbox source topology at runtime, store mmc11.img in >> persistent_data_dir and add staging, configuration-chaining and corrupt >> base/overlay fail-closed coverage. >>- Link to v1: >>https://patch.msgid.link/[email protected] >> >>--- >>Carlo Caione (5): >> efi_loader: bootmgr: preserve a passed devicetree >> boot: add a firmware-owned devicetree source >> bootmeth: efi: use the firmware-owned devicetree >> efi_loader: bootmgr: install the firmware-owned devicetree >> test: boot: add firmware-FDT source tests >> >> MAINTAINERS | 3 + >> boot/Kconfig | 49 +++ >> boot/Makefile | 2 + >> boot/bootmeth_efi.c | 45 ++- >> boot/firmware_fdt.c | 303 ++++++++++++++++++ >> boot/firmware_fdt_block.c | 143 +++++++++ >> boot/image-fdt.c | 3 +- >> boot/image-fit.c | 9 +- >> configs/sandbox_defconfig | 1 + >> doc/develop/uefi/firmware_fdt.rst | 118 +++++++ >> doc/develop/uefi/index.rst | 1 + >> doc/device-tree-bindings/firmware-fdt.txt | 160 ++++++++++ >> doc/usage/environment.rst | 13 + >> include/dm/uclass-id.h | 1 + >> include/firmware_fdt.h | 106 +++++++ >> include/image.h | 5 +- >> lib/efi_loader/efi_bootmgr.c | 45 ++- >> test/boot/Makefile | 1 + >> test/boot/firmware_fdt.c | 498 >> ++++++++++++++++++++++++++++++ >> test/py/tests/test_ut.py | 183 +++++++++++ >> 20 files changed, 1670 insertions(+), 19 deletions(-) >>--- >>base-commit: 3f19667468fb93bcb5702d23aa057b72639e3ac8 >>change-id: 20260706-ccaione-upstream-ebbr-206c30be3a3a >> >>Best regards, >>-- >>Carlo Caione <[email protected]> >> >
