[PATCH v3 4/6] arm: dts: mediatek: support signed Genio 510 and 700 bootloader FIT
Carlo Caione <[email protected]>
| Newsgroups | gmane.comp.boot-loaders.u-boot |
|---|---|
| Message-ID | <20260730-ccaione-upstream-mt8390-spl-v3-4-82fb3bca27a4@baylibre.com> |
The unsigned bootloader FIT only provides hashes, so SPL cannot establish a chain of trust before loading BL31, OP-TEE and U-Boot. When SPL FIT signature verification is enabled, sign the complete configuration and require its public key in the SPL control devicetree. The configuration signature covers the firmware, all loadables and U-Boot's control devicetree. Use binman's u-boot-spl-pubkey-dtb entry to inject the key while preserving the fixed SPL region expected by the external DDR loader. Unsigned builds keep using the existing image layout. Signed-off-by: Carlo Caione <[email protected]> --- arch/arm/dts/mt8390-genio-common-binman.dtsi | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/arch/arm/dts/mt8390-genio-common-binman.dtsi b/arch/arm/dts/mt8390-genio-common-binman.dtsi index c16282027c6..1fa5502c17e 100644 --- a/arch/arm/dts/mt8390-genio-common-binman.dtsi +++ b/arch/arm/dts/mt8390-genio-common-binman.dtsi @@ -31,9 +31,25 @@ size = <0x4b000>; }; +#ifdef CONFIG_SPL_FIT_SIGNATURE u-boot-spl { + type = "section"; size = <CONFIG_SPL_MAX_SIZE>; + + u-boot-spl-nodtb { + }; + + u-boot-spl-pubkey-dtb { + algo = "sha256,rsa3072"; + required = "conf"; + key-name-hint = "bootloaders"; + }; }; +#else + u-boot-spl { + size = <CONFIG_SPL_MAX_SIZE>; + }; +#endif }; }; }; @@ -44,6 +60,9 @@ fit { description = MTK_BOOTLOADERS_DESCRIPTION; #address-cells = <1>; +#ifdef CONFIG_SPL_FIT_SIGNATURE + fit,sign; +#endif images { uboot { @@ -120,6 +139,14 @@ firmware = "atf"; loadables = "uboot", "optee"; fdt = "uboot-fdt"; +#ifdef CONFIG_SPL_FIT_SIGNATURE + + signature { + algo = "sha256,rsa3072"; + key-name-hint = "bootloaders"; + sign-images = "firmware", "loadables", "fdt"; + }; +#endif }; }; }; -- 2.55.0