How U‑Boot Passes the Device Tree to the ARM Kernel: A Deep Dive

Device‑Tree Transfer from U‑Boot to the Kernel

U‑Boot loads the device‑tree blob (DTB) into memory and passes its physical address to the ARM kernel in register r2. The kernel receives this address and processes the DTB during early boot.

boot_jump_linux and the r2 Register

The final hand‑off function is boot_jump_linux located in arch/arm/lib. It selects the DTB address based on whether the image contains a flattened device tree (FDT) and stores it in r2 before jumping to the kernel entry point.

static void boot_jump_linux(bootm_headers_t *images, int flag)
{
    debug("## Transferring control to Linux (at address %08lx)
",
          (ulong)kernel_entry);
    bootstage_mark(BOOTSTAGE_ID_RUN_OS);
    announce_and_cleanup(fake);

    if (IMAGE_ENABLE_OF_LIBFDT && images->ft_len)
        r2 = (unsigned long)images->ft_addr;
    else
        r2 = gd->bd->bi_boot_params;
    /* jump to kernel_entry ... */
}

Methods for setting r2

bootm_header_t method – The structure bootm_headers_t contains ft_addr (DTB address) and ft_len (length). During image parsing (e.g., do_bootz), these fields are filled and the above branch stores ft_addr into r2.

typedef struct bootm_headers {
    /* ... other fields ... */
    char *ft_addr;   /* flat device tree address */
    ulong ft_len;    /* length of flat device tree */
    /* ... */
} bootm_headers_t;

Legacy gd‑>bd‑>bi_boot_params method – If no FDT is present, U‑Boot falls back to the board‑level boot‑parameter address stored in gd->bd->bi_boot_params. This path is retained for compatibility but is rarely used in modern builds.

Kernel Parsing of the Device Tree

The kernel processes the DTB in two phases: validation/early scanning and unflattening.

Phase 1 – Validation and Early Scanning

Early boot prints a line such as:

Booting Linux on physical CPU 0x0
Linux version 5.4.124 (qemu@qemu) ...
OF: fdt: Machine model: V2P-CA9

The model name comes from the model property in the DTB header. The kernel then executes:

early_init_dt_verify();          // CRC32 check of the DTB
early_init_dt_scan_nodes();      // Scan /chosen, root, memory, etc.
__machine_arch_type = mdesc->nr; // Set machine type
/* update chosen node */

Relevant call stack (ARM architecture):

setup_arch(char **cmdline_p)          // arch/arm/kernel/setup.c
    atags_vaddr = FDT_VIRT_BASE(__atags_pointer);
    setup_machine_fdt(void *dt_virt) // arch/arm/kernel/devtree.c
        early_init_dt_verify();
        of_flat_dt_match_machine(); // drivers/of/fdt.c
        early_init_dt_scan_nodes();
        __machine_arch_type = mdesc->nr;

Because U‑Boot supplies a physical address, the kernel translates it to a virtual address before processing.

Phase 2 – Unflattening the DTB

The flattened device tree is converted into an expanded device tree (EDT) and a hierarchy of device_node structures.

unflatten_device_tree();
    __unflatten_device_tree()
        /* First pass – compute size */
        size = unflatten_dt_nodes(blob, NULL, dad, NULL);
        /* Second pass – actual unflattening */
        unflatten_dt_nodes(blob, mem, dad, mynodes);
            populate_node();

The resulting device_node tree is used to create platform_device objects, making the hardware description available to driver code.