From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tom Rini Date: Tue, 13 Oct 2020 10:06:37 -0400 Subject: [PATCH v3 1/3] vboot: add DTB policy for supporting multiple required conf keys In-Reply-To: <35f9b89f77db026ba36929d1f17cef007099c14b.1597643014.git.thiruan@linux.microsoft.com> References: <35f9b89f77db026ba36929d1f17cef007099c14b.1597643014.git.thiruan@linux.microsoft.com> Message-ID: <20201013140637.GH14816@bill-the-cat> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de On Sun, Aug 16, 2020 at 11:01:09PM -0700, Thirupathaiah Annapureddy wrote: > Currently FIT image must be signed by all required conf keys. This means > Verified Boot fails if there is a signature verification failure > using any required key in U-Boot DTB. > > This patch introduces a new policy in DTB that can be set to any required > conf key. This means if verified boot passes with one of the required > keys, U-Boot will continue the OS hand off. > > There were prior attempts to address this: > https://lists.denx.de/pipermail/u-boot/2019-April/366047.html > The above patch was failing "make tests". > https://lists.denx.de/pipermail/u-boot/2020-January/396629.html > > Signed-off-by: Thirupathaiah Annapureddy > Reviewed-by: Simon Glass Applied to u-boot/master, thanks! -- Tom -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 659 bytes Desc: not available URL: