The unsigned bootloader FIT only provides hashes, so SPL cannot establish a chain of trust before loading BL31, OP-TEE and U-Boot.
When SPL FIT signature verification is enabled, sign the complete configuration and require its public key in the SPL control devicetree. The configuration signature covers the firmware, all loadables and U-Boot's control devicetree. Use binman's u-boot-spl-pubkey-dtb entry to inject the key while preserving the fixed SPL region expected by the external DDR loader. Unsigned builds keep using the existing image layout. Signed-off-by: Carlo Caione <[email protected]> --- arch/arm/dts/mtk-genio-bootloaders-binman-u-boot.dtsi | 11 +++++++++++ arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi | 16 ++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/arch/arm/dts/mtk-genio-bootloaders-binman-u-boot.dtsi b/arch/arm/dts/mtk-genio-bootloaders-binman-u-boot.dtsi index ce492790aee..c5e6da7c58a 100644 --- a/arch/arm/dts/mtk-genio-bootloaders-binman-u-boot.dtsi +++ b/arch/arm/dts/mtk-genio-bootloaders-binman-u-boot.dtsi @@ -12,6 +12,9 @@ fit { description = MTK_BOOTLOADERS_DESCRIPTION; #address-cells = <1>; +#ifdef CONFIG_SPL_FIT_SIGNATURE + fit,sign; +#endif images { uboot { @@ -90,6 +93,14 @@ firmware = "atf"; loadables = "uboot", "optee-1"; fdt = "uboot-fdt"; +#ifdef CONFIG_SPL_FIT_SIGNATURE + + signature { + algo = "sha256,rsa3072"; + key-name-hint = "bootloaders"; + sign-images = "firmware", "loadables", "fdt"; + }; +#endif }; }; }; diff --git a/arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi b/arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi index e49ad5c471f..30de2ec621c 100644 --- a/arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi +++ b/arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi @@ -11,6 +11,22 @@ ddr-loader { size = <CONFIG_MTK_GENIO_DDR_LOADER_SIZE>; }; +#ifdef CONFIG_SPL_FIT_SIGNATURE +u-boot-spl { + type = "section"; + size = <CONFIG_SPL_MAX_SIZE>; + + u-boot-spl-nodtb { + }; + + u-boot-spl-pubkey-dtb { + algo = "sha256,rsa3072"; + required = "conf"; + key-name-hint = "bootloaders"; + }; +}; +#else u-boot-spl { size = <CONFIG_SPL_MAX_SIZE>; }; +#endif -- 2.55.0
