On Wed, Nov 04, 2026 at 10:11:15PM +0800, eli wrote: > A verified FIT is authentic but not necessarily current: replacing the > next-stage image with an older, still correctly signed image reintroduces > vulnerabilities fixed in newer firmware. This series adds opt-in software > rollback protection to the SPL verified FIT flow. > > Patch 1 adds CONFIG_SPL_MINIMUM_FIT_VERSION: after signature verification > succeeds, SPL compares the configuration's "version" property (covered by > the signature; missing counts as 0) against the minimum and refuses to > boot a lower version. The default of 0 disables the check, so existing > boards are unaffected unless they opt in. > > Patch 2 documents the mechanism, including its trust-root boundary: the > minimum version lives in the SPL binary itself, so this is a software > trust root only. > > Related work: "Add anti-rollback validation feature" by Sean Edmond > (2023, Patchwork series 372657, currently changes-requested) addresses > anti-rollback at the OS/boot-flow level; this series instead targets the > SPL FIT configuration-verification step and is complementary to > monotonic-counter approaches (RPMB/TEE-based). > > Validation: the same mechanism was validated on real StarFive > VisionFive2 (JH7110) hardware against a vendor 2026.07-based tree: > signed version=2 FITs pass (cold boot x3), a correctly signed version=1 > image is rejected with a dedicated message independently of hash > verification, and recovery was re-verified. This series was replayed on > v2026.07 and builds for starfive_visionfive2_defconfig with > CONFIG_SPL_FIT_SIGNATURE=y / CONFIG_SPL_MINIMUM_FIT_VERSION=2; the SPL > binary contains both the hash-verification and rollback-check strings. > > eli (2): > spl: fit: add software rollback protection for verified FIT > configurations > doc: spl: describe SPL FIT anti-rollback usage > > boot/Kconfig | 11 +++++++++++ > common/spl/spl_fit.c | 24 ++++++++++++++++++++++++ > doc/develop/spl.rst | 43 +++++++++++++++++++++++++++++++++++++++++++ > 3 files changed, 78 insertions(+)
Please re-send this to the correct list, and also since you're sending this to the old address, verify it at least on v2027.01-rc1 if not current 'main' branch, and check out the existing and outstanding FIT related patches, thanks. -- Tom
signature.asc
Description: PGP signature
