LFU-573-2 imx8m: hab: Verify optional FIT FDT signature

One limitation of verifying FIT hash approach is SPL must bind with FIT,
because FIT FDT hash is inserted into SPL image and authenticated by ROM.
For use cases need to upgrade the FIT individually, for example, android's
dual bootloader, this patch introduces an optional approach.

This optional approach adds FIT FDT signature (a new pair of IVT and CSF
for FIT FDT structure) after original FIT image IVT and CSF. imx-mkimage
always generates the new IVT and reserves the space for the new CSF.
Users just need an additional signing step.

This approach is default not enabled in SPL except Android build.
To enable it, set CONFIG_IMX_SPL_FIT_FDT_SIGNATURE=y with CONFIG_IMX_HAB=y
in u-boot defconfig

Signed-off-by: Ye Li <ye.li@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

Upstream-Status: Inappropriate [downstream specific]

Upstream U-Boot fixed this differently in combination with binman to
create the final bootcontainer.
Commit 6039e0edc854 ("imx: hab: Simplify the mechanism")

Backport from NXP downstream  [07b688228c5817e4d76cdc5484fd50f92e9cf1f0]

Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>

0 files changed, 0 insertions, 0 deletions