From: Jun Nie <jun.nie@linaro.org>
To: u-boot@lists.denx.de
Subject: [U-Boot] [PATCH] fit: skip signature verification if board request
Date: Fri, 13 Apr 2018 17:58:28 +0800 [thread overview]
Message-ID: <CABymUCN8wnB8uSFBQq61XBu+B52fwWgDR8XU15VtwyZD6chN5Q@mail.gmail.com> (raw)
In-Reply-To: <20180412135340.GV10996@bill-the-cat.ec.rr.com>
2018-04-12 21:53 GMT+08:00 Tom Rini <trini@konsulko.com>:
> On Wed, Apr 11, 2018 at 11:13:05PM +0800, Jun Nie wrote:
>
>> It may be unnecessary to check signature on unlocked board.
>> Get the hint from platform specific code to support secure boot
>> and non-secure boot with the same binary, so that boot is not
>> blocked if board is not locked and has no key for signature
>> verification.
>>
>> Signed-off-by: Jun Nie <jun.nie@linaro.org>
>> ---
> I'm not sure I like the concept here. Wouldn't this make it easier to
> break in to a secure setup with some binary editing? Or is that really
> no worse than today? Also, can you please follow up with an
> implementation of fit_board_skip_sig_verification? Thanks!
>
> --
> Tom
SoC boot ROM shall verify signature of SPL before running. Binary
editing shall make signature invalid. If it is possible to run an
edited SPL, the secure boot is already hacked and this patch does not
make it worse. I surely will post implementation, which is just
reading some register to get fuse value for lock status. I post this
patch to get opinions from community first.
Jun
next prev parent reply other threads:[~2018-04-13 9:58 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-11 15:13 [U-Boot] [PATCH] fit: skip signature verification if board request Jun Nie
2018-04-12 13:53 ` Tom Rini
2018-04-13 9:58 ` Jun Nie [this message]
2018-04-12 17:24 ` Simon Glass
2018-04-13 10:05 ` Jun Nie
2018-04-16 19:06 ` Simon Glass
2018-04-18 15:34 ` Jun Nie
2018-04-17 12:06 ` Quentin Schulz
2018-04-18 15:22 ` Jun Nie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CABymUCN8wnB8uSFBQq61XBu+B52fwWgDR8XU15VtwyZD6chN5Q@mail.gmail.com \
--to=jun.nie@linaro.org \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.