[PATCH v5 16/29] efi: Correct dependency on FIT_SIGNATURE

All of lore.kernel.org
 help / color / mirror / Atom feed

From: Simon Glass <sjg@chromium.org>
To: U-Boot Mailing List <u-boot@lists.denx.de>
Cc: Alexandru Gagniuc <mr.nuke.me@gmail.com>,
	Andre Przywara <andre.przywara@arm.com>,
	Rasmus Villemoes <rasmus.villemoes@prevas.dk>,
	Robert Marko <robert.marko@sartura.hr>,
	Masahiro Yamada <masahiroy@kernel.org>,
	Tom Rini <trini@konsulko.com>, Simon Glass <sjg@chromium.org>,
	Alexander Graf <agraf@csgraf.de>
Subject: [PATCH v5 16/29] efi: Correct dependency on FIT_SIGNATURE
Date: Sat, 25 Sep 2021 19:43:29 -0600	[thread overview]
Message-ID: <20210926014342.127913-10-sjg@chromium.org> (raw)
In-Reply-To: <20210926014342.127913-1-sjg@chromium.org>

At present EFI_SECURE BOOT selects RSA but does not necessarily enable
FIT_SIGNATURE. Mostly this is fine, but a few boards do not enable it,
so U-Boot tries to do RSA verification when loading FIT images, but it
is not enabled.

This worked because the condition for checking the RSA signature is
wrong in the fit_image_verify_with_data() function. In order to fix it
we need to fix this dependency. Make sure that FIT_SIGNATURE is enabled
so that RSA can be used.

It might be better to avoid using 'select' in this situation.

Signed-off-by: Simon Glass <sjg@chromium.org>
---

(no changes since v1)

 lib/efi_loader/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
index 14bf5f7e92e..c1cc143f354 100644
--- a/lib/efi_loader/Kconfig
+++ b/lib/efi_loader/Kconfig
@@ -343,7 +343,7 @@ config EFI_LOAD_FILE2_INITRD

 config EFI_SECURE_BOOT
 	bool "Enable EFI secure boot support"
-	depends on EFI_LOADER
+	depends on EFI_LOADER && FIT_SIGNATURE
 	select HASH
 	select SHA256
 	select RSA
-- 
2.33.0.685.g46640cef36-goog

next prev parent reply	other threads:[~2021-09-26  1:46 UTC|newest]

Thread overview: 90+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-26  1:43 [PATCH v5 00/29] image: Reduce #ifdefs and ad-hoc defines in image code (Part B) Simon Glass
2021-09-26  1:43 ` [PATCH v5 01/29] compiler: Rename host_build() to tools_build() Simon Glass
2021-10-05 18:09   ` Alex G.
2021-10-09  1:39   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 02/29] kconfig: Add tools support to CONFIG_IS_ENABLED() Simon Glass
2021-09-27 16:11   ` Alex G.
2021-09-27 16:50     ` Masahiro Yamada
2021-09-27 20:17       ` Simon Glass
2021-09-27 20:17     ` Simon Glass
2021-10-05 18:11   ` Alex G.
2021-10-07  0:26   ` Tom Rini
2021-10-07  2:49     ` Simon Glass
2021-10-07  2:52       ` Tom Rini
2021-10-07 13:32         ` Simon Glass
2021-10-07 13:42           ` Tom Rini
2021-10-07 18:02             ` Simon Glass
2021-10-07 18:30               ` Tom Rini
2021-10-07 18:50                 ` Simon Glass
2021-10-07 19:32                   ` Alex G.
2021-10-07 19:39                     ` Tom Rini
2021-10-07 20:33                       ` Alex G.
2021-10-07 21:04                         ` Tom Rini
2021-10-07 21:15                           ` Alex G.
2021-10-09  1:39   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 03/29] image: Add Kconfig options for FIT in the tools build Simon Glass
2021-10-05 18:17   ` Alex G.
2021-10-05 18:17   ` Alex G.
2021-10-09  1:39   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 04/29] spl: cypto: Bring back SPL_ versions of SHA Simon Glass
2021-10-05 18:19   ` Alex G.
2021-10-09  1:39   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 05/29] hash: Use Kconfig to enable hashing in host tools and SPL Simon Glass
2021-09-27 15:53   ` Alex G.
2021-09-27 16:06     ` Simon Glass
2021-09-27 16:12       ` Alex G.
2021-10-05 18:21   ` Alex G.
2021-10-09  1:39   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 06/29] hash: Drop some #ifdefs in hash.c Simon Glass
2021-10-05 18:24   ` Alex G.
2021-10-09  1:39   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 07/29] image: Drop IMAGE_ENABLE_FIT Simon Glass
2021-10-05 18:26   ` Alex G.
2021-10-09  1:39   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 08/29] image: Drop IMAGE_ENABLE_OF_LIBFDT Simon Glass
2021-10-05 18:27   ` Alex G.
2021-10-09  1:40   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 09/29] image: Use Kconfig to enable CONFIG_FIT_VERBOSE on host Simon Glass
2021-10-05 18:29   ` Alex G.
2021-10-09  1:40   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 10/29] image: Use Kconfig to enable FIT_RSASSA_PSS " Simon Glass
2021-10-05 18:32   ` Alex G.
2021-10-09  1:40   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 11/29] image: Use the correct checks for CRC32 Simon Glass
2021-10-05 18:34   ` Alex G.
2021-10-09  1:40   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 12/29] image: Drop IMAGE_BOOT_GET_CMDLINE Simon Glass
2021-10-05 18:36   ` Alex G.
2021-10-09  1:40   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 13/29] image: Drop IMAGE_OF_BOARD_SETUP Simon Glass
2021-10-05 18:57   ` Alex G.
2021-10-09  1:40   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 14/29] image: Drop IMAGE_OF_SYSTEM_SETUP Simon Glass
2021-10-05 18:58   ` Alex G.
2021-10-09  1:40   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 15/29] image: Drop IMAGE_ENABLE_IGNORE Simon Glass
2021-10-05 18:58   ` Alex G.
2021-10-09  1:40   ` Tom Rini
2021-09-26  1:43 ` Simon Glass [this message]
2021-10-09  1:40   ` [PATCH v5 16/29] efi: Correct dependency on FIT_SIGNATURE Tom Rini
2021-09-26  1:43 ` [PATCH v5 19/29] image: Tidy up fit_unsupported_reset() Simon Glass
2021-10-09  1:40   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 20/29] image: Drop unnecessary #ifdefs from image.h Simon Glass
2021-10-09  1:41   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 21/29] image: Drop #ifdefs for fit_print_contents() Simon Glass
2021-10-09  1:41   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 22/29] image: Drop most #ifdefs in image-board.c Simon Glass
2021-10-09  1:41   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 23/29] image: Reduce variable scope in boot_get_ramdisk() Simon Glass
2021-10-09  1:41   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 24/29] image: Split up boot_get_ramdisk() Simon Glass
2021-10-09  1:41   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 25/29] image: Remove #ifdefs from select_ramdisk() Simon Glass
2021-10-09  1:41   ` Tom Rini
2021-12-17 17:40     ` Neil Armstrong
2021-09-26  1:43 ` [PATCH v5 26/29] image: Remove some #ifdefs from image-fit and image-fit-sig Simon Glass
2021-10-09  1:41   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 27/29] image: Reduce variable scope in boot_get_fdt() Simon Glass
2021-10-09  1:41   ` Tom Rini
2021-09-26  1:43 ` [PATCH v5 28/29] image: Split up boot_get_fdt() Simon Glass
2021-10-09  1:41   ` Tom Rini

find likely ancestor, descendant, or conflicting patches for this message:
( dfblob:14bf5f7e92 dfblob:c1cc143f35 )
 OR (
bs:"[PATCH v5 16/29] efi: Correct dependency on FIT_SIGNATURE" )
	(help)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210926014342.127913-10-sjg@chromium.org \
    --to=sjg@chromium.org \
    --cc=agraf@csgraf.de \
    --cc=andre.przywara@arm.com \
    --cc=masahiroy@kernel.org \
    --cc=mr.nuke.me@gmail.com \
    --cc=rasmus.villemoes@prevas.dk \
    --cc=robert.marko@sartura.hr \
    --cc=trini@konsulko.com \
    --cc=u-boot@lists.denx.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.