Linux DT signing issue

[psingh3086]

Hi Team,
Continue with ticket #458 . we got to know that ARM is working to provide some alternative solution for above issue. can you update what would be solution?

[chetan-rathore]

Hi @psingh3086,

We are investigating on refactoring scripts to enable building systemready images with a non ACS key.

For you case I want to understand, how the DT blob is passed to OS.

On most other systems, my understanding is that the DTB is typically passed as part of the firmware or through the standard firmware-to-OS handoff, and we have not had to handle it as a separately signed artifact.

Thanks,
Chetan

[psingh3086]

We are implementing DT signing at compile time, and during UEFI execution, we load the DT image and authenticate it.

[chetan-rathore]

@psingh3086, Can you please elaborate a bit. :)

[psingh3086]

DTB Verification Flow:

1. Load DTB file (e.g., combined-dtb.dtb)
2. Load signature file (e.g., combined-dtb.sig)
3. Verify signature using platform keys
4. If verification fails → Boot fails
5. If verification succeeds → Continue boot

We perform DT authentication before loading the kernel. currently we are adding DTB during compile time
If you have any specific question, please let me know.