arm: socfpga: Enable FIT signature with crc32 for SOC64 devices

Add signature with crc32 value for all images in binman node for FIT
image in device tree. And, enable FIT signature checking for Stratix10
and Agilex ATF and VAB sdmmc boot.

Signed-off-by: Siew Chin Lim <elly.siew.chin.lim@intel.com>

diff --git a/arch/arm/dts/socfpga_soc64_fit-u-boot.dtsi b/arch/arm/dts/socfpga_soc64_fit-u-boot.dtsi
index 4b30473743763f1cb3965ea37277a5be9662085e..84b91e8df09d04629eb4a69302f8a311fb2c10da 100644 (file)
--- a/arch/arm/dts/socfpga_soc64_fit-u-boot.dtsi
+++ b/arch/arm/dts/socfpga_soc64_fit-u-boot.dtsi
@@ -29,10 +29,12 @@
                                        arch = "arm64";
                                        compression = "none";
                                        load = <0x00200000>;
-
                                        uboot_blob: blob-ext {
                                                filename = "u-boot-nodtb.bin";
                                        };
+                                       hash {
+                                               algo = "crc32";
+                                       };
                                };
 
                                atf {
@@ -43,20 +45,24 @@
                                        compression = "none";
                                        load = <0x00001000>;
                                        entry = <0x00001000>;
-
                                        atf_blob: blob-ext {
                                                filename = "bl31.bin";
                                        };
+                                       hash {
+                                               algo = "crc32";
+                                       };
                                };
 
                                fdt {
                                        description = "U-Boot SoC64 flat device-tree";
                                        type = "flat_dt";
                                        compression = "none";
-
                                        uboot_fdt_blob: blob-ext {
                                                filename = "u-boot.dtb";
                                        };
+                                       hash {
+                                               algo = "crc32";
+                                       };
                                };
                        };
 
@@ -67,6 +73,11 @@
                                        firmware = "atf";
                                        loadables = "uboot";
                                        fdt = "fdt";
+                                       signature {
+                                               algo = "crc32";
+                                               key-name-hint = "dev";
+                                               sign-images = "atf", "fdt", "uboot";
+                                       };
                                };
                        };
                };
@@ -87,10 +98,12 @@
                                        compression = "none";
                                        load = <0x4080000>;
                                        entry = <0x4080000>;
-
                                        kernel_blob: blob-ext {
                                                filename = "Image";
                                        };
+                                       hash {
+                                               algo = "crc32";
+                                       };
                                };
 
                                fdt {
@@ -98,10 +111,12 @@
                                        type = "flat_dt";
                                        arch = "arm64";
                                        compression = "none";
-
                                        kernel_fdt_blob: blob-ext {
                                                filename = "linux.dtb";
                                        };
+                                       hash {
+                                               algo = "crc32";
+                                       };
                                };
                        };
 
@@ -111,6 +126,11 @@
                                        description = "Intel SoC64 FPGA";
                                        kernel = "kernel";
                                        fdt = "fdt";
+                                       signature {
+                                               algo = "crc32";
+                                               key-name-hint = "dev";
+                                               sign-images = "fdt", "kernel";
+                                       };
                                };
                        };
                };

diff --git a/configs/socfpga_agilex_atf_defconfig b/configs/socfpga_agilex_atf_defconfig
index 7adda02b000e85ebd679d9cebce93c4cf3fc76b1..e5b7f4b52a36713cbd64ade3312f6b36d1b347e4 100644 (file)
--- a/configs/socfpga_agilex_atf_defconfig
+++ b/configs/socfpga_agilex_atf_defconfig
@@ -14,6 +14,10 @@ CONFIG_IDENT_STRING="socfpga_agilex"
 CONFIG_SPL_FS_FAT=y
 CONFIG_DEFAULT_DEVICE_TREE="socfpga_agilex_socdk"
 CONFIG_FIT=y
+CONFIG_FIT_SIGNATURE=y
+CONFIG_FIT_SIGNATURE_MAX_SIZE=0x10000000
+CONFIG_SPL_FIT_SIGNATURE=y
+CONFIG_SPL_CRC32_SUPPORT=y
 CONFIG_SPL_LOAD_FIT=y
 CONFIG_SPL_LOAD_FIT_ADDRESS=0x02000000
 # CONFIG_USE_SPL_FIT_GENERATOR is not set

diff --git a/configs/socfpga_agilex_vab_defconfig b/configs/socfpga_agilex_vab_defconfig
index bca663ed617c7e8979e498934737af6b7dbe1a00..fac9cf72e5c1a9eac721328c3730bddcc2b95453 100644 (file)
--- a/configs/socfpga_agilex_vab_defconfig
+++ b/configs/socfpga_agilex_vab_defconfig
@@ -15,6 +15,10 @@ CONFIG_IDENT_STRING="socfpga_agilex"
 CONFIG_SPL_FS_FAT=y
 CONFIG_DEFAULT_DEVICE_TREE="socfpga_agilex_socdk"
 CONFIG_FIT=y
+CONFIG_FIT_SIGNATURE=y
+CONFIG_FIT_SIGNATURE_MAX_SIZE=0x10000000
+CONFIG_SPL_FIT_SIGNATURE=y
+CONFIG_SPL_CRC32_SUPPORT=y
 CONFIG_SPL_LOAD_FIT=y
 CONFIG_SPL_LOAD_FIT_ADDRESS=0x02000000
 # CONFIG_USE_SPL_FIT_GENERATOR is not set

diff --git a/configs/socfpga_stratix10_atf_defconfig b/configs/socfpga_stratix10_atf_defconfig
index 8dbb7424ba8a023f0aa49b66c70baa4dd2300825..7466025bc007bfa5274ffdb1deb2fb3b90877410 100644 (file)
--- a/configs/socfpga_stratix10_atf_defconfig
+++ b/configs/socfpga_stratix10_atf_defconfig
@@ -14,6 +14,10 @@ CONFIG_IDENT_STRING="socfpga_stratix10"
 CONFIG_SPL_FS_FAT=y
 CONFIG_DEFAULT_DEVICE_TREE="socfpga_stratix10_socdk"
 CONFIG_FIT=y
+CONFIG_FIT_SIGNATURE=y
+CONFIG_FIT_SIGNATURE_MAX_SIZE=0x10000000
+CONFIG_SPL_FIT_SIGNATURE=y
+CONFIG_SPL_CRC32_SUPPORT=y
 CONFIG_SPL_LOAD_FIT=y
 CONFIG_SPL_LOAD_FIT_ADDRESS=0x02000000
 # CONFIG_USE_SPL_FIT_GENERATOR is not set