[PATCH v4 4/6] arm: dts: mediatek: support signed Genio 510 and 700 bootloader FIT
Carlo Caione <[email protected]>
| Newsgroups | org.u-boot-project.lists.u-boot |
|---|---|
| Message-ID | <20260814-ccaione-upstream-mt8390-spl-v4-4-f4f92978a79e@baylibre.com> |
The unsigned bootloader FIT only provides hashes, so SPL cannot establish a chain of trust before loading BL31, OP-TEE and U-Boot. When SPL FIT signature verification is enabled, sign the complete configuration and require its public key in the SPL control devicetree. The configuration signature covers the firmware, all loadables and U-Boot's control devicetree. Use binman's u-boot-spl-pubkey-dtb entry to inject the key while preserving the fixed SPL region expected by the external DDR loader. Unsigned builds keep using the existing image layout. Signed-off-by: Carlo Caione <[email protected]> --- arch/arm/dts/mtk-genio-bootloaders-binman.dtsi | 11 +++++++++++ arch/arm/dts/mtk-genio-loader-spl-binman.dtsi | 16 ++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/arch/arm/dts/mtk-genio-bootloaders-binman.dtsi b/arch/arm/dts/mtk-genio-bootloaders-binman.dtsi index c43d8c32507..de97b2c3705 100644 --- a/arch/arm/dts/mtk-genio-bootloaders-binman.dtsi +++ b/arch/arm/dts/mtk-genio-bootloaders-binman.dtsi @@ -12,6 +12,9 @@ fit { description = MTK_BOOTLOADERS_DESCRIPTION; #address-cells = <1>; +#ifdef CONFIG_SPL_FIT_SIGNATURE + fit,sign; +#endif images { uboot { @@ -88,6 +91,14 @@ firmware = "atf"; loadables = "uboot", "optee"; fdt = "uboot-fdt"; +#ifdef CONFIG_SPL_FIT_SIGNATURE + + signature { + algo = "sha256,rsa3072"; + key-name-hint = "bootloaders"; + sign-images = "firmware", "loadables", "fdt"; + }; +#endif }; }; }; diff --git a/arch/arm/dts/mtk-genio-loader-spl-binman.dtsi b/arch/arm/dts/mtk-genio-loader-spl-binman.dtsi index e49ad5c471f..30de2ec621c 100644 --- a/arch/arm/dts/mtk-genio-loader-spl-binman.dtsi +++ b/arch/arm/dts/mtk-genio-loader-spl-binman.dtsi @@ -11,6 +11,22 @@ ddr-loader { size = <CONFIG_MTK_GENIO_DDR_LOADER_SIZE>; }; +#ifdef CONFIG_SPL_FIT_SIGNATURE +u-boot-spl { + type = "section"; + size = <CONFIG_SPL_MAX_SIZE>; + + u-boot-spl-nodtb { + }; + + u-boot-spl-pubkey-dtb { + algo = "sha256,rsa3072"; + required = "conf"; + key-name-hint = "bootloaders"; + }; +}; +#else u-boot-spl { size = <CONFIG_SPL_MAX_SIZE>; }; +#endif -- 2.55.0