[PATCH 1/4] bootstd: add a firmware-owned devicetree source

[Simon Glass]

Hi Carlo,

On 2026-07-06T15:06:41, Carlo Caione <ccaione at baylibre.com> wrote:
> bootstd: add a firmware-owned devicetree source
>
> Platforms following EBBR / Arm SystemReady IR keep the devicetree on
> a firmware-owned partition, updated independently of the operating
> system, rather than shipping it in the OS image or on the EFI System
> Partition. U-Boot has no generic way to source the devicetree from such
> a partition, so vendors carry out-of-tree machinery for it.
>
> Add a bootstd helper, firmware_fdt_load(), that assembles the OS
> devicetree from a FIT manifest carried on that partition: the FIT images
> hold the base DTB and its overlays, and each FIT configuration names one
> bootable combination through its 'fdt' property.
>
> The partition is described in the control devicetree: the bootstd node
> carries a 'firmware-fdt-source' phandle to a source node, a child of
> the media device owning the partition, which identifies it by GPT type
> UUID and/or name. The 'boot_dtb' environment variable may pin an A/B
> partition number.
>
> The error semantics are fail closed: -ENOENT strictly means "no source
> [...]
>
> MAINTAINERS                               |   3 +
>  boot/Kconfig                              |  23 ++
>  boot/Makefile                             |   1 +
>  boot/firmware_fdt.c                       | 382 ++++++++++++++++++++++++++++++
>  doc/develop/bootstd/firmware_fdt.rst      |  94 ++++++++
>  doc/develop/bootstd/index.rst             |   1 +
>  doc/device-tree-bindings/firmware-fdt.txt | 149 ++++++++++++
>  include/firmware_fdt.h                    |  78 ++++++
>  8 files changed, 731 insertions(+)

(See naming comment on the cover letter)

diff --git a/boot/firmware_fdt.c b/boot/firmware_fdt.c
new file mode 100644
index 00000000000..952299f1e1b
--- /dev/null
+++ b/boot/firmware_fdt.c
@@ -0,0 +1,382 @@

> diff --git a/boot/firmware_fdt.c b/boot/firmware_fdt.c
> @@ -0,0 +1,382 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Firmware-owned devicetree (FDT) source.
+ *
+ * Some platforms (EBBR / Arm SystemReady IR) keep the devicetree on a
+ * firmware-owned partition rather than in the OS image or the EFI System
+ * Partition. The devicetree is carried by a FIT manifest on that partition:
+ * the FIT images hold the base DTB and its overlays, and each FIT
+ * configuration names one bootable combination through its 'fdt' property.
+ *

By FIT manifest I think you mean a FIT?

> +static int fw_fdt_get_source(ofnode *srcp)
> +{
> +     ofnode bootstd, src;
> +     const void *prop;
> +
> +     bootstd = ofnode_by_compatible(ofnode_null(), 'u-boot,boot-std');
> +     if (!ofnode_valid(bootstd))
> +             return -ENOENT;

Please look the node up via the bootstd device rather than the raw
compatible string - every other bootstd consumer uses
uclass_first_device_err(UCLASS_BOOTSTD, &dev) and dev_ofnode(dev),
which also ensures the device is probed. Open-coding the compatible
walk bypasses the uclass and duplicates knowledge that lives in
bootstd-uclass.c

> diff --git a/boot/firmware_fdt.c b/boot/firmware_fdt.c
> @@ -0,0 +1,382 @@
> +void firmware_fdt_free(struct firmware_fdt *fw)
> +{
> +     u8 *fit = fw->fit;
> +
> +     /*
> +      * The assembled devicetree either points into the manifest buffer or
> +      * is a separate allocation (made when applying overlays, or when
> +      * aligning the devicetree); free it only in the latter case.
> +      */
> +     if (fw->fdt &&
> +         ((u8 *)fw->fdt < fit || (u8 *)fw->fdt >= fit + fw->fit_size))
> +             free(fw->fdt);

Comparing pointers from two different allocations is undefined in
strict C, and the "is fdt inside fit?" heuristic depends on assembly
internals that could change. Please track ownership explicitly, e.g.
a bool fdt_owned set at assemble time, and free based on that.
I am nervous about mentioning it, but an abuf could help here, since
it handles things which are allocated or not.

> diff --git a/boot/firmware_fdt.c b/boot/firmware_fdt.c
> @@ -0,0 +1,382 @@
> +     fname = ofnode_read_string(src, 'filename');
> +     if (!fname)
> +             fname = FW_FDT_FILENAME;
> ...
> +     out->fdt = fdt;
> +     out->size = len;
> +     out->name = fname;

out->name either points into the live devicetree or at a static
string; the caller (bootmeth_efi in patch 2) strdup()s it, but
nothing in the API contract says the caller must copy before the
tree is modified. Please strdup() here, or spell out the lifetime
rule in the header.

> diff --git a/boot/Kconfig b/boot/Kconfig
> @@ -671,6 +671,29 @@ config BOOTMETH_EFILOADER
> +config BOOTSTD_FIRMWARE_FDT
> +     bool "Source the devicetree from a firmware-owned partition"
> +     depends on BOOTSTD && BLK && FIT
> +     select EFI_PARTITION
> +     select PARTITION_TYPE_GUID
> +     select OF_LIBFDT
> +     select OF_LIBFDT_OVERLAY

The cover letter advertises best-match against the control DT
(CONFIG_FIT_BEST_MATCH), but nothing here selects or depends on
FIT_BEST_MATCH - with the default config selection silently falls
through to the manifest default. Either select FIT_BEST_MATCH or
note in the help text and doc that best-match applies only when the
user turns it on.

Selecting it might have code-size implementation, though...

Regards,
Simon