MediaTek secure-boot tooling signs the raw DDR-loader and SPL payload before adding the BootROM headers. Signing mtk-boot.bin would instead sign an image that already carries the unsigned headers.
Have binman emit the existing payload section as mtk-boot-payload.bin. This keeps the fixed DDR-loader and SPL layout in one description and does not change mtk-boot.bin. Signed-off-by: Carlo Caione <[email protected]> --- arch/arm/dts/mt8390-genio-common-binman.dtsi | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/dts/mt8390-genio-common-binman.dtsi b/arch/arm/dts/mt8390-genio-common-binman.dtsi index 1fa5502c17e..b9ff1214245 100644 --- a/arch/arm/dts/mt8390-genio-common-binman.dtsi +++ b/arch/arm/dts/mt8390-genio-common-binman.dtsi @@ -22,6 +22,7 @@ "-n", "media=emmc;arm64=1"; section { + filename = "mtk-boot-payload.bin"; pad-byte = <0>; /* Must match SPL_OFFSET in the external DDR loader. */ -- 2.55.0
