Re: [PATCH v2 0/5] firmware-owned devicetree for EBBR / SystemReady IR

On Tue, 28 Jul 2026 at 14:21, Carlo Caione <[email protected]> wrote:
>
> EBBR-style firmware (SystemReady IR) owns the devicetree: the OS is

For reference it's no long SystemReady IR, but SystemReady DT [1] or
SystemReady DeviceTree.

[1] https://www.arm.com/architecture/system-architectures/systemready-compliance-program

> booted via UEFI and receives the devicetree from the firmware through
> the EFI configuration table instead of shipping its own. U-Boot has
> the handoff mechanism (efi_install_fdt()), but no generic way to say
> which devicetree the firmware owns or where it lives. As a result,
> platforms carry downstream commands to provide it.
>
> This series adds a generic loader for a firmware-owned devicetree FIT on
> a dedicated GPT partition:
>
> - one FIT ("fdt.itb" by default) carries the base devicetree and its
>   overlays. FIT configurations describe the valid combinations, so a
>   signed configuration authenticates the base, overlay set and ordering;
>
> - a standalone 'u-boot,firmware-fdt-block' control-DT node points to the
>   media device through a 'firmware-fdt-store' phandle. The node selects
>   a partition by type UUID and/or name;
>
> - 'fw_fdt_part' can pin an A/B partition and 'fw_fdt_config' can select
>   an explicit configuration. Otherwise compatible best-match against the
>   control devicetree is used, falling back to the FIT default. Configuration
>   chaining is rejected so each combination remains one authenticated unit;
>
> - one staging helper owns the EFI policy: use fdt_addr_r, enforce the
>   size cap and distinguish an absent source from a configured source
>   which failed. Both the EFI bootmeth and EFI boot manager use it;
>
> - once a source is configured, any failure to assemble the devicetree is
>   fatal rather than silently falling back to an unverified source. Every
>   image is verified up front so a corrupt overlay cannot be silently skipped.
>
> The loader itself does not depend on standard boot. EFI is its first
> consumer, but the source lookup, FIT selection, verification and overlay
> assembly are generic.
>
> Patch 1 makes an FDT passed to efi_bootmgr_run() outrank a Boot#### FDT,
> as an independent behaviour fix. Patch 2 adds the loader, binding,
> documentation and shared EFI staging policy. Patches 3 and 4 integrate
> the EFI bootmeth and boot manager. Patch 5 adds sandbox coverage.
>
> Signed-off-by: Carlo Caione <[email protected]>
> ---
> Changes in v2:
> - Make the loader independent of bootstd and describe EFI as its first
>   consumer.
> - Describe the source with a standalone compatible node which points to
>   the backing media through a phandle.
> - Rename 'boot_dtb' to 'fw_fdt_part' and document both environment
>   variables in doc/usage/environment.rst.
> - Factor EFI staging and fail-closed policy into one helper used by all
>   three call sites.
> - Track the assembled FDT's ownership explicitly and own the FIT filename.
> - Select FIT_BEST_MATCH and add explicit compatible-selection coverage.
> - Split the passed-FDT precedence change into its own first patch.
> - Build the entire sandbox source topology at runtime, store mmc11.img in
>   persistent_data_dir and add staging, configuration-chaining and corrupt
>   base/overlay fail-closed coverage.
> - Link to v1: https://patch.msgid.link/[email protected]
>
> ---
> Carlo Caione (5):
>       efi_loader: bootmgr: preserve a passed devicetree
>       boot: add a firmware-owned devicetree source
>       bootmeth: efi: use the firmware-owned devicetree
>       efi_loader: bootmgr: install the firmware-owned devicetree
>       test: boot: add firmware-FDT source tests
>
>  MAINTAINERS                               |   3 +
>  boot/Kconfig                              |  24 ++
>  boot/Makefile                             |   1 +
>  boot/bootmeth_efi.c                       |  45 +++-
>  boot/firmware_fdt.c                       | 420 ++++++++++++++++++++++++++++++
>  boot/image-fdt.c                          |   3 +-
>  boot/image-fit.c                          |   9 +-
>  configs/sandbox_defconfig                 |   1 +
>  doc/develop/uefi/firmware_fdt.rst         | 112 ++++++++
>  doc/develop/uefi/index.rst                |   1 +
>  doc/device-tree-bindings/firmware-fdt.txt | 150 +++++++++++
>  doc/usage/environment.rst                 |  11 +
>  include/firmware_fdt.h                    |  95 +++++++
>  include/image.h                           |   4 +-
>  lib/efi_loader/efi_bootmgr.c              |  39 ++-
>  test/boot/Makefile                        |   1 +
>  test/boot/firmware_fdt.c                  | 411 +++++++++++++++++++++++++++++
>  test/py/tests/test_ut.py                  | 181 +++++++++++++
>  18 files changed, 1492 insertions(+), 19 deletions(-)
> ---
> base-commit: b635d43bca429500cb8ef20aa151cb5773b9a8a5
> change-id: 20260706-ccaione-upstream-ebbr-206c30be3a3a
>
> Best regards,
> --
> Carlo Caione <[email protected]>
>