From: Jun Nie <jun.nie@linaro.org>
To: u-boot@lists.denx.de
Subject: [U-Boot] [PATCH] fit: skip signature verification if board request
Date: Wed, 11 Apr 2018 23:13:05 +0800 [thread overview]
Message-ID: <1523459585-7594-1-git-send-email-jun.nie@linaro.org> (raw)
It may be unnecessary to check signature on unlocked board.
Get the hint from platform specific code to support secure boot
and non-secure boot with the same binary, so that boot is not
blocked if board is not locked and has no key for signature
verification.
Signed-off-by: Jun Nie <jun.nie@linaro.org>
---
common/image-sig.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/common/image-sig.c b/common/image-sig.c
index d9f712f..f3d1252 100644
--- a/common/image-sig.c
+++ b/common/image-sig.c
@@ -151,6 +151,11 @@ struct image_region *fit_region_make_list(const void *fit,
return region;
}
+int __attribute__((weak)) fit_board_skip_sig_verification(void)
+{
+ return 0;
+}
+
static int fit_image_setup_verify(struct image_sign_info *info,
const void *fit, int noffset, int required_keynode,
char **err_msgp)
@@ -188,6 +193,12 @@ int fit_image_check_sig(const void *fit, int noffset, const void *data,
uint8_t *fit_value;
int fit_value_len;
+ /* Skip verification if board says that */
+ if (fit_board_skip_sig_verification()) {
+ printf("signature check skipped\n");
+ return 0;
+ }
+
*err_msgp = NULL;
if (fit_image_setup_verify(&info, fit, noffset, required_keynode,
err_msgp))
@@ -438,6 +449,12 @@ int fit_config_verify_required_sigs(const void *fit, int conf_noffset,
int noffset;
int sig_node;
+ /* Skip verification if board says that */
+ if (fit_board_skip_sig_verification()) {
+ printf("signature check skipped\n");
+ return 0;
+ }
+
/* Work out what we need to verify */
sig_node = fdt_subnode_offset(sig_blob, 0, FIT_SIG_NODENAME);
if (sig_node < 0) {
--
2.7.4
next reply other threads:[~2018-04-11 15:13 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-11 15:13 Jun Nie [this message]
2018-04-12 13:53 ` [U-Boot] [PATCH] fit: skip signature verification if board request Tom Rini
2018-04-13 9:58 ` Jun Nie
2018-04-12 17:24 ` Simon Glass
2018-04-13 10:05 ` Jun Nie
2018-04-16 19:06 ` Simon Glass
2018-04-18 15:34 ` Jun Nie
2018-04-17 12:06 ` Quentin Schulz
2018-04-18 15:22 ` Jun Nie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1523459585-7594-1-git-send-email-jun.nie@linaro.org \
--to=jun.nie@linaro.org \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.