public inbox for u-boot@lists.denx.de
 help / color / mirror / Atom feed
From: Andrew Davis <afd@ti.com>
To: Simon Glass <sjg@chromium.org>, Tom Rini <trini@konsulko.com>,
	<u-boot@lists.denx.de>
Cc: Andrew Davis <afd@ti.com>
Subject: [PATCH 3/4] arm: mach-k3: security: Bypass image signing at runtime for GP devices
Date: Fri, 15 Jul 2022 11:34:34 -0500	[thread overview]
Message-ID: <20220715163435.1725-3-afd@ti.com> (raw)
In-Reply-To: <20220715163435.1725-1-afd@ti.com>

We can skip the image authentication check at runtime if the device is GP.
This reduces the delta between GP and HS U-Boot builds. End goal is
to re-unify the two build types into one build that can run on all
device types.

Signed-off-by: Andrew Davis <afd@ti.com>
---
 arch/arm/mach-k3/Makefile   | 3 +--
 arch/arm/mach-k3/common.c   | 2 --
 arch/arm/mach-k3/security.c | 3 +++
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm/mach-k3/Makefile b/arch/arm/mach-k3/Makefile
index 8459bef93b..1c4a328af7 100644
--- a/arch/arm/mach-k3/Makefile
+++ b/arch/arm/mach-k3/Makefile
@@ -10,9 +10,8 @@ obj-$(CONFIG_SOC_K3_AM642) += am642_init.o
 obj-$(CONFIG_SOC_K3_AM625) += am625_init.o am62x/
 obj-$(CONFIG_ARM64) += arm64-mmu.o
 obj-$(CONFIG_CPU_V7R) += r5_mpu.o lowlevel_init.o
-obj-$(CONFIG_TI_SECURE_DEVICE) += security.o
 obj-$(CONFIG_ARM64) += cache.o
 ifeq ($(CONFIG_SPL_BUILD),y)
 obj-$(CONFIG_K3_LOAD_SYSFW) += sysfw-loader.o
 endif
-obj-y += common.o
+obj-y += common.o security.o
diff --git a/arch/arm/mach-k3/common.c b/arch/arm/mach-k3/common.c
index ac14975694..3962f2800f 100644
--- a/arch/arm/mach-k3/common.c
+++ b/arch/arm/mach-k3/common.c
@@ -290,9 +290,7 @@ void board_fit_image_post_process(const void *fit, int node, void **p_image,
 	}
 #endif
 
-#if IS_ENABLED(CONFIG_TI_SECURE_DEVICE)
 	ti_secure_image_post_process(p_image, p_size);
-#endif
 }
 #endif
 
diff --git a/arch/arm/mach-k3/security.c b/arch/arm/mach-k3/security.c
index 5bfcecd44d..add7f413a4 100644
--- a/arch/arm/mach-k3/security.c
+++ b/arch/arm/mach-k3/security.c
@@ -41,6 +41,9 @@ void ti_secure_image_post_process(void **p_image, size_t *p_size)
 	image_addr = (uintptr_t)*p_image;
 	image_size = *p_size;
 
+	if (!image_size || get_device_type() == K3_DEVICE_TYPE_GP)
+		return;
+
 	if (get_device_type() != K3_DEVICE_TYPE_HS_SE &&
 	    !ti_secure_cert_detected(*p_image)) {
 		printf("Warning: Did not detect image signing certificate. "
-- 
2.36.1


  parent reply	other threads:[~2022-07-15 16:34 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-07-15 16:34 [PATCH 1/4] arm: mach-k3: Add support for device type detection Andrew Davis
2022-07-15 16:34 ` [PATCH 2/4] arm: mach-k3: security: Allow signing bypass if type is HS-FS Andrew Davis
2022-08-04 20:52   ` Tom Rini
2022-07-15 16:34 ` Andrew Davis [this message]
2022-08-04 20:52   ` [PATCH 3/4] arm: mach-k3: security: Bypass image signing at runtime for GP devices Tom Rini
2022-07-15 16:34 ` [PATCH 4/4] arm: mach-k3: security: Remove certificate if detected on GP device Andrew Davis
2022-07-18 12:08   ` Tom Rini
2022-08-04 20:52   ` Tom Rini
2022-07-18 12:08 ` [PATCH 1/4] arm: mach-k3: Add support for device type detection Tom Rini
2022-07-25 16:57 ` Tom Rini
2022-07-26  1:29   ` Andrew Davis
2022-08-04 20:51 ` Tom Rini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220715163435.1725-3-afd@ti.com \
    --to=afd@ti.com \
    --cc=sjg@chromium.org \
    --cc=trini@konsulko.com \
    --cc=u-boot@lists.denx.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox