Boot a FIT with no kernel load/entry and no device tree

.github/workflows/test-configs.yml

@@ -1332,12 +1332,35 @@ jobs:
       arch: aarch64
       config-file: ./config/examples/versal_vmk180.config
 
+  versal_vmk180_highddr_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/versal_vmk180_highddr.config
+
   versal_vmk180_sdcard_test:
     uses: ./.github/workflows/test-build-aarch64.yml
     with:
       arch: aarch64
       config-file: ./config/examples/versal_vmk180_sdcard.config
 
+  # FIT read from a filesystem with no kernel load/entry and no fdt
+  # sub-image, so the staging addresses come from the build.
+  versal_vmk180_sdcard_fit_file_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/versal_vmk180_sdcard.config
+      make-args: DISK_FS=fat32 FIT_RAMDISK=1 WOLFBOOT_LOAD_KERNEL_ADDRESS=0x200000 WOLFBOOT_LOAD_RAMDISK_ADDRESS=0x40000000
+
+  # Same, with every address moved into a high DDR aperture.
+  versal_vmk180_sdcard_fit_file_highddr_test:
+    uses: ./.github/workflows/test-build-aarch64.yml
+    with:
+      arch: aarch64
+      config-file: ./config/examples/versal_vmk180_sdcard.config
+      make-args: DISK_FS=fat32 FIT_RAMDISK=1 DDR_HIGH_BASE=0x40000000000 DDR_HIGH_SIZE=0x10000000000 NO_DDR_LOW=1 WOLFBOOT_ORIGIN=0x40000800000 WOLFBOOT_LOAD_ADDRESS=0x40010000000 WOLFBOOT_LOAD_DTS_ADDRESS=0x40000001000 WOLFBOOT_LOAD_KERNEL_ADDRESS=0x40002000000 WOLFBOOT_LOAD_RAMDISK_ADDRESS=0x40030000000
+
   versal_vmk180_sdcard_fs_test:
     uses: ./.github/workflows/test-build-aarch64.yml
     with:

Makefile

@@ -887,8 +887,6 @@ include/target.h: $(TARGET_H_TEMPLATE) FORCE
 	sed -e "s/@WOLFBOOT_DTS_UPDATE_ADDRESS@/$(WOLFBOOT_DTS_UPDATE_ADDRESS)/g" | \
 	sed -e "s/@WOLFBOOT_LOAD_ADDRESS@/$(WOLFBOOT_LOAD_ADDRESS)/g" | \
 	sed -e "s/@WOLFBOOT_LOAD_DTS_ADDRESS@/$(WOLFBOOT_LOAD_DTS_ADDRESS)/g" | \
-	sed -e "s/@WOLFBOOT_LOAD_RAMDISK_ADDRESS@/$(WOLFBOOT_LOAD_RAMDISK_ADDRESS)/g" | \
-	sed -e "s/@WOLFBOOT_LOAD_FPGA_ADDRESS@/$(WOLFBOOT_LOAD_FPGA_ADDRESS)/g" | \
 	sed -e "s|@WOLFBOOT_RAMBOOT_MAX_SIZE_DEFINE@|$(if $(strip $(WOLFBOOT_RAMBOOT_MAX_SIZE)),#define WOLFBOOT_RAMBOOT_MAX_SIZE             $(WOLFBOOT_RAMBOOT_MAX_SIZE),/* WOLFBOOT_RAMBOOT_MAX_SIZE undefined */)|g" | \
 	sed -e "s/@WOLFBOOT_PARTITION_SELF_HEADER_ADDRESS@/$(WOLFBOOT_PARTITION_SELF_HEADER_ADDRESS)/g" \
 		> $@

config/examples/versal_vmk180.config

@@ -47,12 +47,11 @@ WOLFTPM?=0
 EXT_FLASH?=1
 NO_XIP=1
 
-# Boot Exception Level
-# Choose the exception level for booting applications (mutually exclusive):
-#   BOOT_EL1: Transition applications to EL1 (default - for Linux, most bare-metal)
-#   BOOT_EL2: Boot applications at EL2 (for hypervisors, RTOSes that expect EL2)
-# Default is BOOT_EL1 if neither is specified.
-# Uncomment one of the following to override:
+# Boot Exception Level (mutually exclusive)
+#   BOOT_EL1: drop to EL1 via ERET before entering the application.
+#   BOOT_EL2: enter the application at the EL2 wolfBoot runs at (default).
+# EL2 is the default: PSCI brings the secondary cores up at EL2, so dropping
+# only the boot core leaves Linux with "CPUs started in inconsistent modes".
 #BOOT_EL1=1
 #BOOT_EL2=1
 
@@ -67,6 +66,13 @@ GZIP?=1
 # "bootm" loads; without this wolfBoot ignores it.
 FIT_RAMDISK?=1
 
+# Load address for the FIT kernel sub-image, overriding the FIT's own
+# `load`/`entry`. Needed when the ITS omits them. 0 honors the FIT.
+#WOLFBOOT_LOAD_KERNEL_ADDRESS?=0x200000
+
+# Likewise for the ramdisk: 0 honors the FIT's own `load`.
+#WOLFBOOT_LOAD_RAMDISK_ADDRESS?=0x40000000
+
 # Toolchain
 USE_GCC=1
 CROSS_COMPILE=aarch64-none-elf-
@@ -107,17 +113,25 @@ WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x6000000
 WOLFBOOT_LOAD_DTS_ADDRESS?=0x1000
 
 # High DDR aperture: for designs whose DDR lives above the default address map
-# (e.g. DDR at 0x400_0000_0000). These must stay BELOW the defaults above and
-# use '=' so they override them. Base and size are 512 GB aligned with no
-# UL/ULL suffix (the assembler consumes them); the FIT ITS must then use
+# (e.g. DDR at 0x400_0000_0000). config/examples/versal_vmk180_highddr.config
+# is this recipe already applied. These must stay BELOW the defaults above
+# and use '=' so they override them. Base and size are 512 GB aligned with
+# no UL/ULL suffix (the assembler consumes them); the FIT ITS must then use
 # #address-cells = <2> with two-cell load/entry values, and the bootgen BIF
 # and BL31 BL33 entry must match WOLFBOOT_ORIGIN.
+#
+# Note 0x40000800000 is 0x400_0080_0000 (8 MB in), not 0x400_0800_0000.
+# The kernel and ramdisk destinations must clear the FIT staging buffer at
+# WOLFBOOT_LOAD_ADDRESS, which the sub-images are read out of, and
+# WOLFBOOT_PARTITION_SIZE must fit the whole signed FIT.
 #WOLFBOOT_ORIGIN=0x40000800000
 #WOLFBOOT_LOAD_ADDRESS=0x40010000000
 #WOLFBOOT_LOAD_DTS_ADDRESS=0x40000001000
-#CFLAGS_EXTRA+=-DVERSAL_DDR_HIGH_BASE=0x40000000000
-#CFLAGS_EXTRA+=-DVERSAL_DDR_HIGH_SIZE=0x10000000000
-#CFLAGS_EXTRA+=-DVERSAL_NO_DDR_LOW
+#WOLFBOOT_LOAD_KERNEL_ADDRESS=0x40002000000
+#WOLFBOOT_LOAD_RAMDISK_ADDRESS=0x40030000000
+#DDR_HIGH_BASE=0x40000000000
+#DDR_HIGH_SIZE=0x10000000000
+#NO_DDR_LOW=1
 WOLFBOOT_DTS_BOOT_ADDRESS?=0x7B0000
 WOLFBOOT_DTS_UPDATE_ADDRESS?=0x39B0000
 

config/examples/versal_vmk180_highddr.config

@@ -0,0 +1,159 @@
+# wolfBoot configuration for AMD Versal - DDR Boot with a high DDR aperture
+# Versal with DDR mapped at 0x400_0000_0000 instead of the default map.
+#
+#   PLM -> PSM -> BL31 (EL3) -> wolfBoot (EL2) -> Linux (EL2)
+#
+# Derived from versal_vmk180.config; see that file for the knobs this one
+# does not change. Every address here lives inside the aperture declared by
+# DDR_HIGH_BASE/DDR_HIGH_SIZE.
+#
+# Three things outside this file have to agree with it: the bootgen BIF
+# (wolfboot.elf at WOLFBOOT_ORIGIN, raw DTB at WOLFBOOT_LOAD_DTS_ADDRESS),
+# BL31's PRELOADED_BL33_BASE = WOLFBOOT_ORIGIN, and the FIT ITS using
+# #address-cells = <2>.
+
+ARCH?=AARCH64
+TARGET?=versal
+
+WOLFBOOT_VERSION?=1
+
+# ECC-384 with SHA-384 (good balance of security and performance)
+SIGN?=ECC384
+HASH?=SHA384
+IMAGE_HEADER_SIZE?=512
+
+# RSA 4096-bit with SHA3-384 (alternative)
+#SIGN?=RSA4096
+#HASH?=SHA3
+#IMAGE_HEADER_SIZE?=1024
+
+# Debug options
+DEBUG?=1
+DEBUG_SYMBOLS=1
+DEBUG_UART=1
+
+# Boot Benchmarking (optional):
+# Enables timing of boot operations (flash read, integrity, signature).
+BOOT_BENCHMARK?=1
+
+VTOR?=1
+CORTEX_M0?=0
+NO_ASM?=0
+ALLOW_DOWNGRADE?=0
+NVM_FLASH_WRITEONCE?=0
+V?=0
+SPMATH?=1
+RAM_CODE?=0
+DUALBANK_SWAP?=0
+PKA?=0
+WOLFTPM?=0
+
+# Flash configuration
+EXT_FLASH?=1
+NO_XIP=1
+
+# Boot Exception Level (mutually exclusive)
+#   BOOT_EL1: drop to EL1 via ERET before entering the application.
+#   BOOT_EL2: enter the application at the EL2 wolfBoot runs at (default).
+# EL2 is the default: PSCI brings the secondary cores up at EL2, so dropping
+# only the boot core leaves Linux with "CPUs started in inconsistent modes".
+#BOOT_EL1=1
+#BOOT_EL2=1
+
+# ELF loading support
+ELF?=1
+
+# Native gzip decompression for FIT subimages (set GZIP=0 to disable)
+GZIP?=1
+
+# FIT ramdisk (initramfs) extraction plus the /chosen/linux,initrd-{start,end}
+# fixup. A stock PetaLinux image.ub carries a ramdisk sub-image that a U-Boot
+# "bootm" loads; without this wolfBoot ignores it.
+FIT_RAMDISK?=1
+
+# WOLFBOOT_LOAD_KERNEL_ADDRESS / WOLFBOOT_LOAD_RAMDISK_ADDRESS override the
+# FIT's own `load`/`entry`, so a FIT built without them boots. Set below.
+
+# Toolchain
+USE_GCC=1
+CROSS_COMPILE=aarch64-none-elf-
+
+# ============================================================================
+# Boot Memory Layout
+# ============================================================================
+# wolfBoot runs from DDR inside the high aperture, at EL2 non-secure.
+# WOLFBOOT_ORIGIN is set with the rest of the layout further down.
+
+# Optional debugging with OCRAM
+# Versal Gen 1 (VMK180): OCM is 256KB at 0xFFFC0000 - 0xFFFFFFFF
+# Versal Gen 2: OCM is 2MB at 0xFFE00000 - 0xFFFFFFFF
+#WOLFBOOT_ORIGIN=0xFFFC0000
+
+# Flash Sector Size (QSPI)
+WOLFBOOT_SECTOR_SIZE=0x20000
+
+# Application Partition Size (44MB)
+WOLFBOOT_PARTITION_SIZE=0x2C00000
+
+# Location in Flash for Primary Boot Partition
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x800000
+
+# Load Partition to RAM Address (Linux kernel loads here)
+WOLFBOOT_LOAD_ADDRESS?=0x10000000
+
+# Location in Flash for Secondary Partition (update image)
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x3400000
+
+# Location to store wolfBoot state/swap
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x6000000
+
+# DTS (Device Tree) - matches addresses from BOOT.BIN analysis
+WOLFBOOT_LOAD_DTS_ADDRESS?=0x1000
+
+# The aperture itself. Base and size are 512 GB aligned with no UL/ULL
+# suffix - the assembler consumes them. NO_DDR_LOW drops the low mapping.
+DDR_HIGH_BASE=0x40000000000
+DDR_HIGH_SIZE=0x10000000000
+NO_DDR_LOW=1
+
+# DDR layout inside the aperture, using '=' to override the '?=' defaults
+# above. Each region is distinct: the kernel and ramdisk destinations must
+# clear the FIT staging buffer the sub-images are read out of.
+#
+#   0x400_0000_1000  DTB                  (WOLFBOOT_LOAD_DTS_ADDRESS)
+#   0x400_0080_0000  wolfBoot             (WOLFBOOT_ORIGIN)
+#   0x400_0200_0000  kernel               (WOLFBOOT_LOAD_KERNEL_ADDRESS)
+#   0x400_1000_0000  FIT staging          (WOLFBOOT_LOAD_ADDRESS)
+#   0x400_3000_0000  ramdisk              (WOLFBOOT_LOAD_RAMDISK_ADDRESS)
+WOLFBOOT_ORIGIN=0x40000800000
+WOLFBOOT_LOAD_DTS_ADDRESS=0x40000001000
+WOLFBOOT_LOAD_KERNEL_ADDRESS=0x40002000000
+WOLFBOOT_LOAD_ADDRESS=0x40010000000
+WOLFBOOT_LOAD_RAMDISK_ADDRESS=0x40030000000
+
+# Cap the decompressed kernel at the 224 MB gap to the staging buffer above,
+# which is tighter than the 256 MB WOLFBOOT_FIT_MAX_DECOMP default.
+CFLAGS_EXTRA+=-DWOLFBOOT_FIT_MAX_KERNEL=0xE000000
+WOLFBOOT_DTS_BOOT_ADDRESS?=0x7B0000
+WOLFBOOT_DTS_UPDATE_ADDRESS?=0x39B0000
+
+# Speed up reads by using larger blocks
+CFLAGS_EXTRA+=-DWOLFBOOT_SHA_BLOCK_SIZE=4096
+
+# UART Configuration - UART0 for APU console
+CFLAGS_EXTRA+=-DDEBUG_UART_NUM=0
+
+# QSPI Reference Clock: Ref (300MHz default for Versal)
+#CFLAGS_EXTRA+=-DGQSPI_CLK_REF=300000000
+
+# QSPI Bus Divisor: (2 << div) = BUS (0=div2, 1=div4, 2=div8)
+# MT25QU01G max: 133MHz Quad Read (0x6C) with 8 dummy cycles
+# div=0: 300MHz/2 = 150MHz (above spec but tested working)
+# div=1: 300MHz/4 = 75MHz (within spec, default)
+# div=2: 300MHz/8 = 37.5MHz (conservative)
+#CFLAGS_EXTRA+=-DGQSPI_CLK_DIV=1
+
+# QSPI flash options (uncomment to enable)
+#CFLAGS_EXTRA+=-DDEBUG_QSPI       # Enable QSPI debug logging
+#CFLAGS_EXTRA+=-DGQSPI_MODE_IO    # Use polling instead of DMA (slower)
+#CFLAGS_EXTRA+=-DTEST_EXT_FLASH   # Run flash erase/write/read test

config/examples/versal_vmk180_sdcard.config

@@ -103,6 +103,20 @@ CFLAGS_EXTRA+=-DBOOT_PART_B=2
 #DISK_FS=both
 #CFLAGS_EXTRA+=-DBOOT_FILE_A='"/boot/fitImage_A.itb"'
 #CFLAGS_EXTRA+=-DBOOT_FILE_B='"/boot/fitImage_B.itb"'
+#
+# A U-Boot "fatload mmc 0:1 <addr> image.ub ; bootm <addr> <addr>
+# ${fdtcontroladdr}" flow maps onto DISK_FS=fat32 plus BOOT_FILE_A, with
+# wolfBoot reading the file itself. If that FIT declares no `load`/`entry`
+# and carries no `fdt`, add the staging addresses below and point
+# WOLFBOOT_LOAD_DTS_ADDRESS at the DTB the bootgen BIF leaves.
+#DISK_FS=fat32
+#CFLAGS_EXTRA+=-DBOOT_FILE_A='"/image.ub"'
+#FIT_RAMDISK=1
+#WOLFBOOT_LOAD_KERNEL_ADDRESS=0x200000
+#WOLFBOOT_LOAD_RAMDISK_ADDRESS=0x40000000
+#
+# For DDR above the default address map see the "High DDR aperture" block
+# in config/examples/versal_vmk180.config; the ITS then needs 2 cells.
 # Select the partitions by name instead of by index. The GPT partition label
 # is matched first, then the filesystem volume label (which is what makes
 # this work on MBR disks, where partitions have no names).

docs/Targets.md

@@ -4552,7 +4552,7 @@ qemu-system-aarch64 -machine xlnx-zcu102 -cpu cortex-a53 -serial stdio -display
 
 Use `config/examples/zynqmp_sdcard.config`. This uses the Arasan SDHCI controller (SD1 - external SD card slot on ZCU102) and an **MBR** partitioned SD card.
 
-On the direct-jump handoff path, wolfBoot flushes the EL2 D-cache/I-cache and disables the EL2 MMU via `el2_flush_and_disable_mmu` in `src/boot_aarch64_start.S` when `BOOT_EL1` is not enabled and the current exception level is EL2. The ERET-to-EL1 handoff path is different, so this cleanup is not unconditional.
+Both handoff paths flush the EL2 D-cache/I-cache and disable the EL2 MMU via `el2_flush_and_disable_mmu` in `src/boot_aarch64_start.S`, under different conditions: the ERET-to-EL1 path whenever `BOOT_EL1` and `EL2_HYPERVISOR=1` are both set, and the direct-jump path when `EL2_HYPERVISOR=1` and the current exception level is EL2.
 
 **Partition layout**
 | Partition | Name   | Size      | Type                          | Contents                                   |
@@ -5204,11 +5204,13 @@ AMD Versal Prime Series VMK180 Evaluation Kit - Versal Prime XCVM1802-2MSEVSVA21
 
 wolfBoot replaces U-Boot in the Versal boot flow:
 ```
-PLM -> PSM -> BL31 (EL3) -> wolfBoot (EL2) -> Linux (EL1)
+PLM -> PSM -> BL31 (EL3) -> wolfBoot (EL2) -> Linux (EL2)
 ```
 
 wolfBoot runs from DDR at `0x8000000` (EL2, non-secure). All clock, MIO, and DDR initialization is handled by PLM/PSM before wolfBoot starts.
 
+The application is entered at **EL2** by default (`BOOT_EL2` in `hal/versal.h`). PSCI brings the secondary cores up at EL2, so dropping only the boot core to EL1 leaves Linux with `CPUs started in inconsistent modes`. Set `BOOT_EL1=1` for a payload that requires EL1 - that was the previous default, so it now has to be stated explicitly.
+
 This target supports **two boot paths**:
 - **QSPI boot** (primary, production-style): `config/examples/versal_vmk180.config`
 - **SD card boot** (MBR, A/B images): `config/examples/versal_vmk180_sdcard.config`
@@ -5225,7 +5227,7 @@ Note: If using QSPI there are bootgen issues with 2025.1+, so recommend 2024.1 o
 ### Common Notes
 
 - Debugging with OCRAM (OCM): set `WOLFBOOT_ORIGIN=0xFFFC0000` (OCM is 256KB at `0xFFFC0000 - 0xFFFFFFFF`).
-- **High DDR apertures**: designs whose DDR window lives above the default map (for example DDR at `0x400_0000_0000`) add `CFLAGS_EXTRA+=-DVERSAL_DDR_HIGH_BASE=...` and `-DVERSAL_DDR_HIGH_SIZE=...` (512 GB aligned, plain hex literals with no `UL` suffix) to map the window in the translation table, plus `-DVERSAL_NO_DDR_LOW` when nothing remains at `0x0`. Move `WOLFBOOT_ORIGIN`, `WOLFBOOT_LOAD_ADDRESS` and `WOLFBOOT_LOAD_DTS_ADDRESS` into the window (`hal/versal.ld` follows `WOLFBOOT_ORIGIN` from the config), update the bootgen BIF load/exec and the BL31 BL33 entry to match, and switch the FIT ITS to `#address-cells = <2>` with two-cell `load`/`entry` values since 32-bit cells cannot hold addresses above 4 GB. A commented recipe is in `config/examples/versal_vmk180.config`; the DDR aperture itself must be routed to the APU by the design's PDI.
+- **High DDR apertures**: designs whose DDR window lives above the default map (for example DDR at `0x400_0000_0000`) set `DDR_HIGH_BASE=...` and `DDR_HIGH_SIZE=...` (512 GB aligned, plain hex with no `UL` suffix) to map the window in the translation table, plus `NO_DDR_LOW=1` when nothing remains at `0x0`. These are AArch64-generic, and the assembler rejects a window outside the VA region the target's TCR covers; the older `-DVERSAL_DDR_HIGH_*` spellings are still accepted. Move `WOLFBOOT_ORIGIN`, `WOLFBOOT_LOAD_ADDRESS` and `WOLFBOOT_LOAD_DTS_ADDRESS` into the window (`hal/versal.ld` follows `WOLFBOOT_ORIGIN` from the config), update the bootgen BIF load/exec and the BL31 BL33 entry to match, and switch the FIT ITS to `#address-cells = <2>` with two-cell `load`/`entry` values since 32-bit cells cannot hold addresses above 4 GB. A commented recipe is in `config/examples/versal_vmk180.config`; the DDR aperture itself must be routed to the APU by the design's PDI.
 - Test application uses generic `boot_arm64_start.S` and `AARCH64.ld` and prints EL + version.
   - Entry point: `_start` (in `boot_arm64_start.S`) which sets up stack, clears BSS, and calls `main()`
 
@@ -5435,6 +5437,41 @@ A stock PetaLinux `image.ub` carries a `ramdisk` sub-image that `bootm` passes t
 
 `WOLFBOOT_LOAD_RAMDISK_ADDRESS` defaults to 0, which uses the ramdisk in place inside the staged FIT. Set it to a DDR address clear of the kernel, DTB and staging area if the payload needs a fixed location.
 
+##### FIT images built without `load`/`entry`
+
+Some producers emit a FIT whose kernel node declares neither `load` nor `entry` - Yocto's `kernel-fitimage` class omits both unless `UBOOT_LOADADDRESS` and `UBOOT_ENTRYPOINT` are set - and leave it to U-Boot to place the image. wolfBoot needs a destination: a `gzip` kernel has nowhere to decompress to, and an uncompressed one would be entered in place inside the staged FIT at whatever alignment the FIT gives it.
+
+Either add the properties to the ITS, or set `WOLFBOOT_LOAD_KERNEL_ADDRESS` to the address the kernel should be staged at; a nonzero value overrides the FIT's `load`/`entry` and is returned as the entry point. `WOLFBOOT_LOAD_RAMDISK_ADDRESS` does the same for the `ramdisk` node.
+
+For a DDR aperture above 4 GB the ITS must use `#address-cells = <2>` and two-cell values:
+
+```dts
+/ {
+    #address-cells = <2>;
+    images {
+        kernel-1 {
+            data = /incbin/("Image.gz");
+            compression = "gzip";
+            load = <0x00000400 0x08000000>;
+            entry = <0x00000400 0x08000000>;
+            hash-1 { algo = "sha256"; };
+        };
+    };
+};
+```
+
+##### FIT images with no device tree
+
+A kernel-only FIT - no `fdt` sub-image, and no `fdt` property on the configuration node - takes its device tree from the boot firmware instead, which is the arrangement U-Boot describes with `fdtcontroladdr`. Point `WOLFBOOT_LOAD_DTS_ADDRESS` at wherever the earlier stage left the blob; for a bootgen raw partition that is the `load` address in the BIF:
+
+```
+{ type=raw, load=0x40000001000, file=system-top.dtb }
+```
+
+wolfBoot then relocates and validates that DTB exactly as it does for a non-FIT payload, and hands it to the kernel in `x0`.
+
+Such a DTB is outside the FIT, so the signature does not cover it: `/chosen/bootargs` from the blob is **not** trusted and `LINUX_BOOTARGS` replaces it. On the RAM/flash loader (`src/update_ram.c`) a digest bound with `sign --dts` authenticates it and honors its bootargs, and `WOLFBOOT_REQUIRE_SIGNED_DTB=1` makes a missing digest fatal. The disk loader (`src/update_disk.c`) has no DTB-digest machinery, so put the DTB in the FIT as an `fdt` sub-image to bring it inside the root of trust there.
+
 **Kernel Command Line (bootargs)**
 
 If the FIT's DTB carries `/chosen/bootargs`, wolfBoot keeps them by default - an image boots with the arguments its kernel was validated with. Setting `LINUX_BOOTARGS` or `LINUX_BOOTARGS_ROOT` in the config replaces the DTB's value (the replaced value is logged); `CFLAGS_EXTRA+=-DLINUX_BOOTARGS_OVERRIDE=0` demotes an explicit `LINUX_BOOTARGS` to a fallback used only when the DTB has none.
@@ -5543,7 +5580,7 @@ Typical boot timing with ECC384/SHA384 signing:
 
 Use `config/examples/versal_vmk180_sdcard.config`. This uses the Arasan SDHCI controller and an **MBR** partitioned SD card.
 
-Versal defaults to `BOOT_EL1` — the handoff goes through `el2_to_el1_boot` (ERET to EL1). Custom `BOOT_EL2` Versal configs get the same EL2 cache/MMU teardown as ZynqMP via `el2_flush_and_disable_mmu` in `src/boot_aarch64_start.S`, so no extra config flag is needed to boot Linux directly at EL2.
+Versal enters the application at `BOOT_EL2` by default, with the same EL2 cache/MMU teardown as ZynqMP via `el2_flush_and_disable_mmu` in `src/boot_aarch64_start.S`, so no extra config flag is needed to boot Linux directly at EL2. Set `BOOT_EL1=1` to hand off through `el2_to_el1_boot` (ERET to EL1) instead.
 
 **Partition layout**
 | Partition | Name | Size | Type | Contents |

hal/hal.c

@@ -284,6 +284,15 @@ int hal_flash_test_dualbank(void)
 
 #endif /* TEST_FLASH */
 
+#ifdef MMU
+/* Weak default for targets with no configured device tree; some HALs also
+ * compile their own out under WOLFBOOT_NO_PARTITIONS. */
+WEAKFUNCTION void* hal_get_dts_address(void)
+{
+    return NULL;
+}
+#endif /* MMU */
+
 WEAKFUNCTION int RAMFUNCTION hal_flash_protect(haladdr_t address, int len)
 {
     (void)address;