Fixes from peer review. Thank you Alex

Author: dgarske

config/examples/zynqmp_sdcard.config

@@ -114,7 +114,7 @@ CFLAGS_EXTRA+=-DLINUX_BOOTARGS_ROOT=\"/dev/mmcblk0p4\"
 #
 # To enable: uncomment the three lines below and comment out the
 # LINUX_BOOTARGS_ROOT line above (root= is supplied by the cpio's /init).
-#RAMDISK?=1
+#FIT_RAMDISK?=1
 #WOLFBOOT_LOAD_RAMDISK_ADDRESS?=0x40000000
 #CFLAGS_EXTRA+=-DLINUX_BOOTARGS='"earlycon console=ttyPS0,115200 init_fatal_sh=1"'
 

docs/Targets.md

@@ -3428,12 +3428,20 @@ Application running successfully!
 Entering idle loop...
 ```
 
-**Booting PetaLinux**
+**Booting Linux via FIT image**
 
-ZynqMP can chain into a PetaLinux kernel using the same FIT mechanism as
-the Versal target. wolfBoot's FIT-using configs (`zynqmp.config` and
-`zynqmp_sdcard.config`) default to `GZIP=1`, which lets you point the
-FIT at a gzipped kernel (`Image.gz`) directly:
+wolfBoot is a drop-in replacement for U-Boot's FIT image loader: it parses
+the same `mkimage`-produced multi-component FIT (kernel + DTB + optional
+ramdisk), honors per-subimage `load`/`entry`/`compression` properties, and
+hands off to the kernel the same way - with the added value of
+authenticating the entire FIT against a wolfBoot signature before any
+subimage is touched.
+
+ZynqMP can chain into a Linux kernel (PetaLinux, Yocto, or any other
+producer) using the same FIT mechanism as the Versal target. wolfBoot's
+FIT-using configs (`zynqmp.config` and `zynqmp_sdcard.config`) default to
+`GZIP=1`, which lets you point the FIT at a gzipped kernel (`Image.gz`)
+directly:
 
 ```dts
 images {
@@ -3449,9 +3457,10 @@ images {
 
 `mkimage -f your-zynqmp.its fitImage` then produces a single signed FIT
 that wolfBoot decompresses straight to the kernel load address at boot.
-See the [Versal "Booting PetaLinux"](#versal-gen-1-vmk180) section for a
-full walkthrough - the flow is identical apart from the load addresses
-and the `bl31`/`fsbl` versus `bl31`/`plm` boot chain. Set `GZIP=0` in
+See the [Versal "Booting Linux via FIT image"](#versal-gen-1-vmk180)
+section for a full walkthrough - the flow is identical apart from the
+load addresses and the `bl31`/`fsbl` versus `bl31`/`plm` boot chain. Set
+`GZIP=0` in
 `.config` if you want to keep using an uncompressed `Image` plus
 `compression = "none"`.
 
@@ -3468,18 +3477,18 @@ When PetaLinux is built with `INITRAMFS_IMAGE_BUNDLE = "0"` the rootfs cpio
 ships as a separate `ramdisk` node in the FIT alongside the kernel and DTB.
 wolfBoot can extract it, copy it to a configurable RAM address, and patch the
 loaded DTB with `/chosen/linux,initrd-{start,end}` so the kernel finds it.
-Enable this with `RAMDISK=1`:
+Enable this with `FIT_RAMDISK=1`:
 
 ```sh
 cp config/examples/zynqmp_sdcard.config .config
-# Uncomment the RAMDISK / WOLFBOOT_LOAD_RAMDISK_ADDRESS / LINUX_BOOTARGS
+# Uncomment the FIT_RAMDISK / WOLFBOOT_LOAD_RAMDISK_ADDRESS / LINUX_BOOTARGS
 # block under "Optional: FIT-bundled initramfs" and comment out the
 # LINUX_BOOTARGS_ROOT line above it.
 make
 ```
 
 Key options (in `config/examples/zynqmp_sdcard.config`):
-- `RAMDISK=1` - enables FIT ramdisk extraction (`-DWOLFBOOT_FIT_RAMDISK`).
+- `FIT_RAMDISK=1` - enables FIT ramdisk extraction (`-DWOLFBOOT_FIT_RAMDISK`).
 - `WOLFBOOT_LOAD_RAMDISK_ADDRESS=0x40000000` - destination address. Pick a
   region clear of the kernel image (`~0x80000` + tens of MB) and clear of
   FIT staging (`WOLFBOOT_LOAD_ADDRESS=0x10000000` + FIT size). The default
@@ -3679,7 +3688,7 @@ Application running successfully!
 Entering idle loop...
 ```
 
-**Booting PetaLinux (QSPI)**
+**Booting Linux via FIT image (QSPI)**
 
 wolfBoot can boot a signed Linux kernel on the Versal VMK180, replacing U-Boot entirely for a secure boot chain.
 

hal/mpfs250.c

@@ -327,8 +327,10 @@ int hal_dts_fixup(void* dts_addr)
     wolfBoot_printf("FDT: Version %d, Size %d\n",
         fdt_version(fdt), fdt_totalsize(fdt));
 
-    /* Expand total size to allow adding/modifying properties */
-    fdt_set_totalsize(fdt, fdt_totalsize(fdt) + 512);
+    /* Expand total size to allow adding/modifying properties.
+     * Sizing comes from WOLFBOOT_FDT_FIXUP_HEADROOM in include/fdt.h. */
+    fdt_set_totalsize(fdt,
+        fdt_totalsize(fdt) + WOLFBOOT_FDT_FIXUP_HEADROOM);
 
     /* Find /chosen node */
     off = fdt_find_node_offset(fdt, -1, "chosen");

hal/versal.c

@@ -1277,8 +1277,10 @@ int hal_dts_fixup(void* dts_addr)
         fdt_version(fdt), fdt_totalsize(fdt));
 
     /* Expand total size to allow adding/modifying properties (bootargs and,
-     * when WOLFBOOT_FIT_RAMDISK is in play, linux,initrd-{start,end}). */
-    fdt_set_totalsize(fdt, fdt_totalsize(fdt) + 768);
+     * when WOLFBOOT_FIT_RAMDISK is in play, linux,initrd-{start,end}).
+     * Sizing comes from WOLFBOOT_FDT_FIXUP_HEADROOM in include/fdt.h. */
+    fdt_set_totalsize(fdt,
+        fdt_totalsize(fdt) + WOLFBOOT_FDT_FIXUP_HEADROOM);
 
     /* Find /chosen node; create it only if genuinely missing. Any other
      * negative return (malformed FDT, etc.) is surfaced directly rather

hal/zynq.c

@@ -1931,8 +1931,10 @@ int hal_dts_fixup(void* dts_addr)
      * play) the linux,initrd-{start,end} properties. Physical headroom is
      * already guaranteed by the load-address layout (DTB at
      * WOLFBOOT_LOAD_DTS_ADDRESS, kernel loaded much higher), so growing
-     * the header is safe. Matches the pattern in hal/versal.c. */
-    fdt_set_totalsize(fdt, fdt_totalsize(fdt) + 768);
+     * the header is safe. Sizing comes from WOLFBOOT_FDT_FIXUP_HEADROOM
+     * in include/fdt.h - same constant as hal/versal.c. */
+    fdt_set_totalsize(fdt,
+        fdt_totalsize(fdt) + WOLFBOOT_FDT_FIXUP_HEADROOM);
 
     /* Find /chosen node; create it only if genuinely missing. Any other
      * negative return (malformed FDT, etc.) is surfaced directly rather

include/fdt.h

@@ -127,6 +127,16 @@ uint64_t fdt64_to_cpu(uint64_t x);
 #define fdt_set_size_dt_strings(fdt, val)   (fdt_set_header(fdt, size_dt_strings, (val)))
 #define fdt_set_size_dt_struct(fdt, val)    (fdt_set_header(fdt, size_dt_struct, (val)))
 
+/* Headroom (bytes) appended to fdt_totalsize() before wolfBoot inserts
+ * /chosen properties. Sized to comfortably hold a full LINUX_BOOTARGS
+ * plus, when WOLFBOOT_FIT_RAMDISK is enabled, two 64-bit
+ * linux,initrd-{start,end} cells with property-name overhead. A target
+ * whose hal_dts_fixup() inserts more chosen entries can override this
+ * with -DWOLFBOOT_FDT_FIXUP_HEADROOM=<bytes>. */
+#ifndef WOLFBOOT_FDT_FIXUP_HEADROOM
+#define WOLFBOOT_FDT_FIXUP_HEADROOM 768
+#endif
+
 int fdt_check_header(const void *fdt);
 int fdt_next_node(const void *fdt, int offset, int *depth);
 int fdt_first_property_offset(const void *fdt, int nodeoffset);

options.mk

@@ -908,11 +908,11 @@ ifeq ($(GZIP),1)
   CFLAGS+=-DWOLFBOOT_GZIP
 endif
 
-# RAMDISK=1 enables FIT ramdisk (initramfs) extraction and DTB
+# FIT_RAMDISK=1 enables FIT ramdisk (initramfs) extraction and DTB
 # /chosen/linux,initrd-{start,end} fixup. Compressed (gzip) ramdisks
 # decompress through the same path when GZIP=1.
-RAMDISK ?= 0
-ifeq ($(RAMDISK),1)
+FIT_RAMDISK ?= 0
+ifeq ($(FIT_RAMDISK),1)
   CFLAGS+=-DWOLFBOOT_FIT_RAMDISK
 endif
 

tools/config.mk

@@ -94,8 +94,8 @@ ifeq ($(ARCH),)
 endif
 
 # Global default: 0 means "use the FIT image's `load` property verbatim".
-# Defaulted globally (outside the CI ifeq block above) so RAMDISK=1 can
-# be toggled on any target without forcing an explicit address.
+# Defaulted globally (outside the CI ifeq block above) so FIT_RAMDISK=1
+# can be toggled on any target without forcing an explicit address.
 WOLFBOOT_LOAD_RAMDISK_ADDRESS?=0
 
 CONFIG_VARS:= ARCH TARGET SIGN HASH MCUXSDK MCUXPRESSO MCUXPRESSO_CPU MCUXPRESSO_DRIVERS \
@@ -123,7 +123,7 @@ CONFIG_VARS:= ARCH TARGET SIGN HASH MCUXSDK MCUXPRESSO MCUXPRESSO_CPU MCUXPRESSO
 	WOLFBOOT_UNIVERSAL_KEYSTORE \
 	XMSS_PARAMS \
 	ELF BIG_ENDIAN \
-	GZIP RAMDISK \
+	GZIP FIT_RAMDISK \
 	NXP_CUSTOM_DCD NXP_CUSTOM_DCD_OBJS \
 	FLASH_OTP_KEYSTORE \
 	KEYVAULT_OBJ_SIZE \