On 4 November 2026 14:11:15 GMT, eli <[email protected]> wrote: >A verified FIT is authentic but not necessarily current: replacing the >next-stage image with an older, still correctly signed image reintroduces >vulnerabilities fixed in newer firmware. This series adds opt-in software >rollback protection to the SPL verified FIT flow. > >Patch 1 adds CONFIG_SPL_MINIMUM_FIT_VERSION: after signature verification >succeeds, SPL compares the configuration's "version" property (covered by >the signature; missing counts as 0) against the minimum and refuses to >boot a lower version. The default of 0 disables the check, so existing >boards are unaffected unless they opt in. > >Patch 2 documents the mechanism, including its trust-root boundary: the >minimum version lives in the SPL binary itself, so this is a software >trust root only. > >Related work: "Add anti-rollback validation feature" by Sean Edmond >(2023, Patchwork series 372657, currently changes-requested) addresses >anti-rollback at the OS/boot-flow level; this series instead targets the >SPL FIT configuration-verification step and is complementary to >monotonic-counter approaches (RPMB/TEE-based). > >Validation: the same mechanism was validated on real StarFive >VisionFive2 (JH7110) hardware against a vendor 2026.07-based tree: >signed version=2 FITs pass (cold boot x3), a correctly signed version=1 >image is rejected with a dedicated message independently of hash >verification, and recovery was re-verified. This series was replayed on >v2026.07 and builds for starfive_visionfive2_defconfig with >CONFIG_SPL_FIT_SIGNATURE=y / CONFIG_SPL_MINIMUM_FIT_VERSION=2; the SPL >binary contains both the hash-verification and rollback-check strings.
Hi, not complaining, this idea is awesome! Saves vulns from causing havock. Well, let's poke and prod. Since this is very very very interesting. > >eli (2): > spl: fit: add software rollback protection for verified FIT > configurations > doc: spl: describe SPL FIT anti-rollback usage > > boot/Kconfig | 11 +++++++++++ > common/spl/spl_fit.c | 24 ++++++++++++++++++++++++ > doc/develop/spl.rst | 43 +++++++++++++++++++++++++++++++++++++++++++ > 3 files changed, 78 insertions(+) > > --- Thanks!
