diff options
| author | Ye Li <ye.li@nxp.com> | 2023-07-27 09:50:49 +0800 |
|---|---|---|
| committer | Marcel Ziswiler <marcel.ziswiler@toradex.com> | 2023-12-22 09:31:10 +0000 |
| commit | 8f253d01813221e7400e5b828b1f1479f5e95aa3 (patch) | |
| tree | 41a7da704e04d2c7f633334e8283110eed54bb41 /arch/arm/mach-imx/Kconfig | |
| parent | 2227ef5837b91acf4197078b7bf1642ca69f8d47 (diff) | |
LFU-573-2 imx8m: hab: Verify optional FIT FDT signature
One limitation of verifying FIT hash approach is SPL must bind with FIT,
because FIT FDT hash is inserted into SPL image and authenticated by ROM.
For use cases need to upgrade the FIT individually, for example, android's
dual bootloader, this patch introduces an optional approach.
This optional approach adds FIT FDT signature (a new pair of IVT and CSF
for FIT FDT structure) after original FIT image IVT and CSF. imx-mkimage
always generates the new IVT and reserves the space for the new CSF.
Users just need an additional signing step.
This approach is default not enabled in SPL except Android build.
To enable it, set CONFIG_IMX_SPL_FIT_FDT_SIGNATURE=y with CONFIG_IMX_HAB=y
in u-boot defconfig
Signed-off-by: Ye Li <ye.li@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Upstream-Status: Inappropriate [downstream specific]
Upstream U-Boot fixed this differently in combination with binman to
create the final bootcontainer.
Commit 6039e0edc854 ("imx: hab: Simplify the mechanism")
Backport from NXP downstream [07b688228c5817e4d76cdc5484fd50f92e9cf1f0]
Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>
Diffstat (limited to 'arch/arm/mach-imx/Kconfig')
| -rw-r--r-- | arch/arm/mach-imx/Kconfig | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig index 0616b05a05..b51a0464bf 100644 --- a/arch/arm/mach-imx/Kconfig +++ b/arch/arm/mach-imx/Kconfig @@ -81,6 +81,14 @@ config IMX_HAB This option enables the support for secure boot (HAB). See doc/imx/habv4/* for more details. +config IMX_SPL_FIT_FDT_SIGNATURE + bool "Enable to verify signature of FIT FDT" + depends on IMX_HAB + depends on ARCH_IMX8M + help + Enable SPL to verify signature of FIT FDT during FIT loading. + This needs additional signing to FIT FDT part. + config CSF_SIZE hex "Maximum size for Command Sequence File (CSF) binary" depends on IMX_HAB @@ -275,6 +283,7 @@ config ANDROID_SUPPORT select SUPPORT_RAW_INITRD select LIBAVB select AVB_SUPPORT + imply IMX_SPL_FIT_FDT_SIGNATURE config ANDROID_AUTO_SUPPORT bool "Android Automotive features support" |