Some boards keep a base devicetree and its overlays in a FIT, while the
kernel or EFI application comes from another source. Boot scripts need
a way to verify and assemble that tree without booting an OS from the FIT.
This series adds:
fdt fit <addr>[#<conf>] <dest> [<len>]
The script loads the FIT into memory with an existing command. fdt fit
then prepares the devicetree described by one configuration, verifies it,
applies its overlays and copies the completed result to the chosen
destination. The script can pass that address to bootefi, booti or
another boot command, and must stop the boot if preparation fails.
The command reuses the FIT loader, always checks image hashes and
enforces any required configuration signatures, even with verify=no.
It rejects chained configurations: signing each configuration separately
does not authenticate their combination. FIT image load addresses are
ignored, so preparation does not write to them before checks complete.
The first three patches provide the loader support, including rejecting
missing or invalid overlays. The last two add the command, documentation
and sandbox tests.
Patch 2 also changes bootm, even when fdt fit is disabled. If a listed
overlay cannot be loaded or verified, bootm now aborts instead of booting
without it. Boards which previously relied on a broken overlay being
skipped must fix their FIT configuration or overlay. The new bootm tests
cover successful preparation and rejection of bad or missing overlays.
This is a new, simpler approach to the firmware-owned devicetree work
previously submitted in the EBBR series [1]. Storage, configuration
selection and boot policy stay in the script. There is no new DT binding,
storage driver or automatic hook into the EFI boot paths.
[1]
https://lore.kernel.org/all/[email protected]/
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Carlo Caione <[email protected]>
---
Changes in v3:
- Make patch 2's bootm behaviour change explicit in its commit message
and the cover letter.
- Add direct bootm tests for valid, corrupted-hash and missing overlays,
independent of CMD_FDT_FIT.
- Collect Simon Glass's remaining Reviewed-by tags for patch 3 and the cover.
- Link to v2:
https://patch.msgid.link/[email protected]
Changes in v2:
- Clarify that load_op controls only the base devicetree and document the
overlay policy and enum values.
- Collect Simon Glass's Reviewed-by tags for patches 1, 2, 4 and 5.
- Link to v1:
https://patch.msgid.link/[email protected]
---
Carlo Caione (5):
boot: fit: tell callers when a devicetree buffer must be freed
boot: fit: reject configurations with missing or invalid overlays
boot: fit: let callers choose where to place the devicetree
cmd: fdt: add 'fdt fit' to prepare a devicetree for other boot commands
test: py: cover fdt fit preparation and failure handling
boot/image-fdt.c | 4 +-
boot/image-fit.c | 84 +++++++---
cmd/Kconfig | 9 +
cmd/fdt.c | 83 ++++++++++
configs/sandbox_defconfig | 1 +
doc/usage/cmd/fdt.rst | 75 +++++++++
include/image.h | 11 +-
test/py/tests/test_fdt_fit.py | 371 ++++++++++++++++++++++++++++++++++++++++++
test/py/tests/test_fit.py | 60 +++++++
9 files changed, 676 insertions(+), 22 deletions(-)
---
base-commit: ed869863c7e2aca50d57a05d843830dd843138c4
change-id: 20261016-ccaione-upstream-fdt-fit-29f83d0fa6ac
Best regards,
--
Carlo Caione <[email protected]>
