This patch series tries to improve dealing with FIT
(configuration-)signatures a bit:
- (optionally) enforce signatures so we can't accidentally boot
unsigned fit images. Quite an easy oversight, esp when qemu
previously didn't even use the built in DT.
- make iminfo verify configuration signatures, not just image hashes
- I've dropped the qemu dt merging code for now as it conflicts with the
changes introduced in commit 68e65953400. Requires further discussion.
Verification run: https://github.com/u-boot/u-boot/pull/1054
Changes in v11:
- rebased on next (ed869863c7e)
- removed qemu signature merging code
Changes in v10:
- fix description referring to CONFIG_FIT_REQUIRE_CONFIG_SIGS
- rebased on next (0a61439db5e)
Changes in v9:
- restore debug message instead of errro
Changes in v7:
- mention CONFIG_FIT_REQUIRE_CONFIG_SIGS in documentation
Changes in v6:
- move 'ret' declaration to top of block
- Add missing return value documentation to run_fit_commands()
- use f-strings for the refactored code
- drop not needed length check for command list
- remove superfluous blank line
Changes in v5:
- refactor ubman.config.buildconfig access
- reword commit message to mention disabling of pre-load global
signature test
- rely on inline dummy for fit_all_configurations_verify
- use CONFIG_IS_ENABLED(FIT_SIGNATURE) to guard fit_all_configurations_verify
- print warning if /configurations node is missing
- print "OK\n" in fit_all_image_verify()
- new patch
- use helper function shared with bootm
- introduce assert_fit()
Changes in v4:
- fix and reword comment
- reword Kconfig help text
- rename option to FIT_REQUIRE_CONFIG_SIGS
- introduce SPL_FIT_REQUIRE_CONFIG_SIGS
- test CONFIG_FIT_REQUIRE_CONFIG_SIGS in test_vboot
- set CONFIG_FIT_REQUIRE_CONFIG_SIGS in sandbox_defconfig
- fix documentation to use kdoc style
- test iminfo in test_vboot
Changes in v3:
- make log_err use stdout too
- clarify error message when no keys were found
- change printfs to log_err
- reword Kconfig
- keep FIT_SIGNATURE_REQUIRED off by default
- use log_err instead of printf in fit_config_verify_required_keys()
- don't make iminfo fail unless FIT_SIGNATURE_REQUIRED is set
- update fit_all_configurations_verify documentation
- stub fit_all_configurations_verify unless FIT_SIGNATURES
Changes in v2:
- introduce FIT_SIGNATURE_REQUIRED
- document fit_all_configurations_verify()
Ludwig Nussel (6):
mkimage: define log_err and log_info
image-fit-sig: Optionally require signatures
test: vboot: handle CONFIG_FIT_REQUIRE_CONFIG_SIGS in test_vboot
iminfo: also verify signatures
test: vboot: refactor run_bootm
test: vboot: add iminfo checks
boot/Kconfig | 22 ++++
boot/image-fit-sig.c | 19 ++--
boot/image-fit.c | 55 +++++++++-
boot/image-pre-load.c | 3 -
cmd/bootm.c | 10 ++
configs/sandbox_noinst_defconfig | 2 +
doc/usage/fit/signature.rst | 13 ++-
include/image.h | 8 ++
test/py/tests/test_vboot.py | 171 ++++++++++++++++++++++++-------
tools/mkimage.h | 6 ++
10 files changed, 259 insertions(+), 50 deletions(-)
--
2.43.0
base-commit: ed869863c7e2aca50d57a05d843830dd843138c4
branch: us-qemu-signatures11
