mpc8313: ids8313 board updates

Disabling legacy image format is useful when using signed FIT images with required signature check. Use CONFIG_DISABLE_IMAGE_FORMAT_LEGACY in the board config file.

Signed-off-by Heiko Schocher <[email protected]>

Cc Simon Glass <[email protected]>

Cc Lars Steubesand <[email protected]>

Cc Mike Pearce <[email protected]>

Cc Wolfgang Denk <[email protected]>

---
  README                       |  5 +++++
  common/cmd_bootm.c           | 14 ++++++++++++++
  common/cmd_disk.c            |  4 ++++
  common/cmd_fdc.c             |  4 ++++
  common/cmd_fpga.c            |  2 ++
  common/cmd_nand.c            |  4 ++++
  common/cmd_source.c          |  4 ++++
  common/cmd_ximg.c            |  7 ++++++-
  common/image-fdt.c           | 10 ++++++++--
  common/image.c               | 23 ++++++++++++++++-------
  doc/uImage.FIT/signature.txt |  3 +++
  include/image.h              |  2 ++
  12 files changed, 72 insertions(+), 10 deletions(-)

README +5 -0

index b973344..b1f0ea3 100644
@@ -3152,6 +3152,11 @@ FIT uImage format:
  		using a hash signed and verified using RSA. See
  		doc/uImage.FIT/signature.txt for more details.
 
+		CONFIG_DISABLE_IMAGE_FORMAT_LEGACY
+		WARNING: When relying on signed FIT images with required
+		signature check the legacy image format should be disabled by
+		using this define.
+
  - Standalone program support:
  		CONFIG_STANDALONE_LOAD_ADDR
 

common/cmd_bootm.c +14 -0

index c243a5b..69b86ee 100644
@@ -233,6 +233,7 @@ static int bootm_find_os(cmd_tbl_t *cmdtp, int flag, int argc,
 
  	/* get image parameters */
  	switch (genimg_get_format(os_hdr)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	case IMAGE_FORMAT_LEGACY:
  		images.os.type = image_get_type(os_hdr);
  		images.os.comp = image_get_comp(os_hdr);

@@ -241,6 +242,7 @@ static int bootm_find_os(cmd_tbl_t *cmdtp, int flag, int argc,
  		images.os.end = image_get_image_end(os_hdr);
  		images.os.load = image_get_load(os_hdr);
  		break;
+#endif
  #if defined(CONFIG_FIT)
  	case IMAGE_FORMAT_FIT:
  		if (fit_image_get_type(images.fit_hdr_os,

@@ -838,6 +840,7 @@ int bootm_maybe_autostart(cmd_tbl_t *cmdtp, const char *cmd)
  	return 0;
  }
 
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  /**
   * image_get_kernel - verify legacy format kernel image
   * @img_addr: in RAM address of the legacy format image to be verified

@@ -888,6 +891,7 @@ static image_header_t *image_get_kernel(ulong img_addr, int verify)
  	}
  	return hdr;
  }
+#endif
 
  /**
   * boot_get_kernel - find kernel image

@@ -905,7 +909,9 @@ static const void *boot_get_kernel(cmd_tbl_t *cmdtp, int flag, int argc,
  		char * const argv[], bootm_headers_t *images, ulong *os_data,
  		ulong *os_len)
  {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	image_header_t	*hdr;
+#endif
  	ulong		img_addr;
  	const void *buf;
  #if defined(CONFIG_FIT)

@@ -943,6 +949,7 @@ static const void *boot_get_kernel(cmd_tbl_t *cmdtp, int flag, int argc,
  	*os_data = *os_len = 0;
  	buf = map_sysmem(img_addr, 0);
  	switch (genimg_get_format(buf)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	case IMAGE_FORMAT_LEGACY:
  		printf("## Booting kernel from Legacy Image at %08lx ...\n",
  				img_addr);

@@ -985,6 +992,7 @@ static const void *boot_get_kernel(cmd_tbl_t *cmdtp, int flag, int argc,
  		images->legacy_hdr_valid = 1;
  		bootstage_mark(BOOTSTAGE_ID_DECOMP_IMAGE);
  		break;
+#endif
  #if defined(CONFIG_FIT)
  	case IMAGE_FORMAT_FIT:
  		os_noffset = fit_image_load(images, FIT_KERNEL_PROP,

@@ -1114,6 +1122,7 @@ static int image_info(ulong addr)
  	printf("\n## Checking Image at %08lx ...\n", addr);
 
  	switch (genimg_get_format(hdr)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	case IMAGE_FORMAT_LEGACY:
  		puts("   Legacy image found\n");
  		if (!image_check_magic(hdr)) {

@@ -1135,6 +1144,7 @@ static int image_info(ulong addr)
  		}
  		puts("OK\n");
  		return 0;
+#endif
  #if defined(CONFIG_FIT)
  	case IMAGE_FORMAT_FIT:
  		puts("   FIT image found\n");

@@ -1194,6 +1204,7 @@ static int do_imls_nor(void)
  				goto next_sector;
 
  			switch (genimg_get_format(hdr)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  			case IMAGE_FORMAT_LEGACY:
  				if (!image_check_hcrc(hdr))
  					goto next_sector;

@@ -1208,6 +1219,7 @@ static int do_imls_nor(void)
  					puts("OK\n");
  				}
  				break;
+#endif
  #if defined(CONFIG_FIT)
  			case IMAGE_FORMAT_FIT:
  				if (!fit_check_format(hdr))

@@ -1342,12 +1354,14 @@ static int do_imls_nand(void)
  			}
 
  			switch (genimg_get_format(buffer)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  			case IMAGE_FORMAT_LEGACY:
  				header = (const image_header_t *)buffer;
 
  				len = image_get_image_size(header);
  				nand_imls_legacyimage(nand, nand_dev, off, len);
  				break;
+#endif
  #if defined(CONFIG_FIT)
  			case IMAGE_FORMAT_FIT:
  				len = fit_get_size(buffer);

common/cmd_disk.c +4 -0

index 3e457f6..9b1ba7f 100644
@@ -17,7 +17,9 @@ int common_diskboot(cmd_tbl_t *cmdtp, const char *intf, int argc,
  	ulong addr = CONFIG_SYS_LOAD_ADDR;
  	ulong cnt;
  	disk_partition_t info;
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	image_header_t *hdr;
+#endif
  	block_dev_desc_t *dev_desc;
 
  #if defined(CONFIG_FIT)

@@ -62,6 +64,7 @@ int common_diskboot(cmd_tbl_t *cmdtp, const char *intf, int argc,
  	bootstage_mark(BOOTSTAGE_ID_IDE_PART_READ);
 
  	switch (genimg_get_format((void *) addr)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	case IMAGE_FORMAT_LEGACY:
  		hdr = (image_header_t *) addr;
 

@@ -78,6 +81,7 @@ int common_diskboot(cmd_tbl_t *cmdtp, const char *intf, int argc,
 
  		cnt = image_get_image_size(hdr);
  		break;
+#endif
  #if defined(CONFIG_FIT)
  	case IMAGE_FORMAT_FIT:
  		fit_hdr = (const void *) addr;

common/cmd_fdc.c +4 -0

index 1cfb656..409a216 100644
@@ -635,7 +635,9 @@ int do_fdcboot (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
  	FD_GEO_STRUCT *pFG = (FD_GEO_STRUCT *)floppy_type;
  	FDC_COMMAND_STRUCT *pCMD = &cmd;
  	unsigned long addr,imsize;
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	image_header_t *hdr;  /* used for fdc boot */
+#endif
  	unsigned char boot_drive;
  	int i,nrofblk;
  #if defined(CONFIG_FIT)

@@ -689,12 +691,14 @@ int do_fdcboot (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
  	}
 
  	switch (genimg_get_format ((void *)addr)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	case IMAGE_FORMAT_LEGACY:
  		hdr = (image_header_t *)addr;
  		image_print_contents (hdr);
 
  		imsize = image_get_image_size (hdr);
  		break;
+#endif
  #if defined(CONFIG_FIT)
  	case IMAGE_FORMAT_FIT:
  		fit_hdr = (const void *)addr;

common/cmd_fpga.c +2 -0

index 010cd24..34eb3f0 100644
@@ -155,6 +155,7 @@ int do_fpga(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 
  	case FPGA_LOADMK:
  		switch (genimg_get_format(fpga_data)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  		case IMAGE_FORMAT_LEGACY:
  			{
  				image_header_t *hdr =

@@ -182,6 +183,7 @@ int do_fpga(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
  				rc = fpga_load(dev, (void *)data, data_size);
  			}
  			break;
+#endif
  #if defined(CONFIG_FIT)
  		case IMAGE_FORMAT_FIT:
  			{

common/cmd_nand.c +4 -0

index 04ab0f1..67d0796 100644
@@ -904,7 +904,9 @@ static int nand_load_image(cmd_tbl_t *cmdtp, nand_info_t *nand,
  	int r;
  	char *s;
  	size_t cnt;
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	image_header_t *hdr;
+#endif
  #if defined(CONFIG_FIT)
  	const void *fit_hdr = NULL;
  #endif

@@ -930,6 +932,7 @@ static int nand_load_image(cmd_tbl_t *cmdtp, nand_info_t *nand,
  	bootstage_mark(BOOTSTAGE_ID_NAND_HDR_READ);
 
  	switch (genimg_get_format ((void *)addr)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	case IMAGE_FORMAT_LEGACY:
  		hdr = (image_header_t *)addr;
 

@@ -938,6 +941,7 @@ static int nand_load_image(cmd_tbl_t *cmdtp, nand_info_t *nand,
 
  		cnt = image_get_image_size (hdr);
  		break;
+#endif
  #if defined(CONFIG_FIT)
  	case IMAGE_FORMAT_FIT:
  		fit_hdr = (const void *)addr;

common/cmd_source.c +4 -0

index 54ffd16..51043a1 100644
@@ -29,7 +29,9 @@ int
  source (ulong addr, const char *fit_uname)
  {
  	ulong		len;
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	const image_header_t *hdr;
+#endif
  	ulong		*data;
  	int		verify;
  	void *buf;

@@ -44,6 +46,7 @@ source (ulong addr, const char *fit_uname)
 
  	buf = map_sysmem(addr, 0);
  	switch (genimg_get_format(buf)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	case IMAGE_FORMAT_LEGACY:
  		hdr = buf;
 

@@ -84,6 +87,7 @@ source (ulong addr, const char *fit_uname)
  		 */
  		while (*data++);
  		break;
+#endif
  #if defined(CONFIG_FIT)
  	case IMAGE_FORMAT_FIT:
  		if (fit_uname == NULL) {

common/cmd_ximg.c +6 -1

index 65a8319..527b1bd 100644
@@ -32,10 +32,13 @@ do_imgextract(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
  {
  	ulong		addr = load_addr;
  	ulong		dest = 0;
-	ulong		data, len, count;
+	ulong		data, len;
  	int		verify;
  	int		part = 0;
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
+	ulong		count;
  	image_header_t	*hdr = NULL;
+#endif
  #if defined(CONFIG_FIT)
  	const char	*uname = NULL;
  	const void*	fit_hdr;

@@ -64,6 +67,7 @@ do_imgextract(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
  	}
 
  	switch (genimg_get_format((void *)addr)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	case IMAGE_FORMAT_LEGACY:
 
  		printf("## Copying part %d from legacy image "

@@ -114,6 +118,7 @@ do_imgextract(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
 
  		image_multi_getimg(hdr, part, &data, &len);
  		break;
+#endif
  #if defined(CONFIG_FIT)
  	case IMAGE_FORMAT_FIT:
  		if (uname == NULL) {

common/image-fdt.c +8 -2

index a54a919..2a3262d 100644
@@ -29,6 +29,7 @@ static void fdt_error(const char *msg)
  	puts(" - must RESET the board to recover.\n");
  }
 
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  static const image_header_t *image_get_fdt(ulong fdt_addr)
  {
  	const image_header_t *fdt_hdr = map_sysmem(fdt_addr, 0);

@@ -61,6 +62,7 @@ static const image_header_t *image_get_fdt(ulong fdt_addr)
  	}
  	return fdt_hdr;
  }
+#endif
 
  /**
   * boot_fdt_add_mem_rsv_regions - Mark the memreserve sections as unusable

@@ -220,11 +222,13 @@ error:
  int boot_get_fdt(int flag, int argc, char * const argv[], uint8_t arch,
  		bootm_headers_t *images, char **of_flat_tree, ulong *of_size)
  {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	const image_header_t *fdt_hdr;
+	ulong		load, load_end;
+	ulong		image_start, image_data, image_end;
+#endif
  	ulong		fdt_addr;
  	char		*fdt_blob = NULL;
-	ulong		image_start, image_data, image_end;
-	ulong		load, load_end;
  	void		*buf;
  #if defined(CONFIG_FIT)
  	const char	*fit_uname_config = images->fit_uname_cfg;

@@ -298,6 +302,7 @@ int boot_get_fdt(int flag, int argc, char * const argv[], uint8_t arch,
  		 */
  		buf = map_sysmem(fdt_addr, 0);
  		switch (genimg_get_format(buf)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  		case IMAGE_FORMAT_LEGACY:
  			/* verify fdt_addr points to a valid image header */
  			printf("## Flattened Device Tree from Legacy Image at %08lx\n",

@@ -337,6 +342,7 @@ int boot_get_fdt(int flag, int argc, char * const argv[], uint8_t arch,
 
  			fdt_addr = load;
  			break;
+#endif
  		case IMAGE_FORMAT_FIT:
  			/*
  			 * This case will catch both: new uImage format

common/image.c +16 -7

index 9c6bec5..ae7105e 100644
@@ -44,8 +44,10 @@ extern int do_bdinfo(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]);
 
  DECLARE_GLOBAL_DATA_PTR;
 
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  static const image_header_t *image_get_ramdisk(ulong rd_addr, uint8_t arch,
  						int verify);
+#endif
  #else
  #include "mkimage.h"
  #include <u-boot/md5.h>

@@ -328,6 +330,7 @@ void image_print_contents(const void *ptr)
 
 
  #ifndef USE_HOSTCC
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  /**
   * image_get_ramdisk - get and verify ramdisk image
   * @rd_addr: ramdisk image start address

@@ -389,6 +392,7 @@ static const image_header_t *image_get_ramdisk(ulong rd_addr, uint8_t arch,
 
  	return rd_hdr;
  }
+#endif
  #endif /* !USE_HOSTCC */
 
  /*****************************************************************************/

@@ -652,20 +656,19 @@ int genimg_get_comp_id(const char *name)
   */
  int genimg_get_format(const void *img_addr)
  {
-	ulong format = IMAGE_FORMAT_INVALID;
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	const image_header_t *hdr;
 
  	hdr = (const image_header_t *)img_addr;
  	if (image_check_magic(hdr))
-		format = IMAGE_FORMAT_LEGACY;
+		return IMAGE_FORMAT_LEGACY;
+#endif
  #if defined(CONFIG_FIT) || defined(CONFIG_OF_LIBFDT)
-	else {
-		if (fdt_check_header(img_addr) == 0)
-			format = IMAGE_FORMAT_FIT;
-	}
+	if (fdt_check_header(img_addr) == 0)
+			return IMAGE_FORMAT_FIT;
  #endif
 
-	return format;
+	return IMAGE_FORMAT_INVALID;
  }
 
  /**

@@ -707,12 +710,14 @@ ulong genimg_get_image(ulong img_addr)
 
  		/* get data size */
  		switch (genimg_get_format(buf)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  		case IMAGE_FORMAT_LEGACY:
  			d_size = image_get_data_size(buf);
  			debug("   Legacy format image found at 0x%08lx, "
  					"size 0x%08lx\n",
  					ram_addr, d_size);
  			break;
+#endif
  #if defined(CONFIG_FIT)
  		case IMAGE_FORMAT_FIT:
  			d_size = fit_get_size(buf) - h_size;

@@ -788,7 +793,9 @@ int boot_get_ramdisk(int argc, char * const argv[], bootm_headers_t *images,
  {
  	ulong rd_addr, rd_load;
  	ulong rd_data, rd_len;
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  	const image_header_t *rd_hdr;
+#endif
  	void *buf;
  #ifdef CONFIG_SUPPORT_RAW_INITRD
  	char *end;

@@ -871,6 +878,7 @@ int boot_get_ramdisk(int argc, char * const argv[], bootm_headers_t *images,
  		 */
  		buf = map_sysmem(rd_addr, 0);
  		switch (genimg_get_format(buf)) {
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  		case IMAGE_FORMAT_LEGACY:
  			printf("## Loading init Ramdisk from Legacy "
  					"Image at %08lx ...\n", rd_addr);

@@ -886,6 +894,7 @@ int boot_get_ramdisk(int argc, char * const argv[], bootm_headers_t *images,
  			rd_len = image_get_data_size(rd_hdr);
  			rd_load = image_get_load(rd_hdr);
  			break;
+#endif
  #if defined(CONFIG_FIT)
  		case IMAGE_FORMAT_FIT:
  			rd_noffset = fit_image_load(images, FIT_RAMDISK_PROP,

doc/uImage.FIT/signature.txt +3 -0

index 9502037..4e32aa0 100644
@@ -328,6 +328,9 @@ be enabled:
  CONFIG_FIT_SIGNATURE - enable signing and verfication in FITs
  CONFIG_RSA - enable RSA algorithm for signing
 
+WARNING: When relying on signed FIT images with required signature check
+the legacy image format should be disabled by using
+CONFIG_DISABLE_IMAGE_FORMAT_LEGACY
 
  Testing
  -------

include/image.h +2 -0

index 2508d7d..c46b1e0 100644
@@ -410,7 +410,9 @@ enum fit_load_op {
  #ifndef USE_HOSTCC
  /* Image format types, returned by _get_format() routine */
  #define IMAGE_FORMAT_INVALID	0x00
+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)
  #define IMAGE_FORMAT_LEGACY	0x01	/* legacy image_header based format */
+#endif
  #define IMAGE_FORMAT_FIT	0x02	/* new, libfdt based format */
 
  int genimg_get_format(const void *img_addr);

Hi Heiko,

Did you see my last email? The one that bounced with a mime header and where I attached a patch file.

I just wonder if its not better to switch the define to be

if (CONFIG_SIGNATURE_VERIFICATION_WITH_LEGACY_SIDE_DOOR). It can become mutually exclusive with the existing signature verification define.

Hi Heiko,

Did you see my last email? The one that bounced with a mime header and where I attached a patch file.

I just wonder if its not better to switch the define to be

if (CONFIG_SIGNATURE_VERIFICATION_WITH_LEGACY_SIDE_DOOR). It can become mutually exclusive with the existing signature verification define.

That way the legacy stuff is removed automatically upon requesting verification unless defined otherwise. When you fail to boot an unsigned legacy kernel then its kind of obvious that you have to solve something but if you implement verified boot and forget this new variable then you leave a security hole.

In my last email I also discussed my confusion regard the 'required' variable. Similar argument to the above plus some other thoughts.

Hello Mike,

Am 08.05.2014 15:02, schrieb mike:

Quoted 4 lines

Hi Heiko,

Did you see my last email? The one that bounced with a mime header and where I attached a patch file.

Seems I missed this EMail ...

Quoted 2 lines

I just wonder if its not better to switch the define to be

Quoted 2 lines

if (CONFIG_SIGNATURE_VERIFICATION_WITH_LEGACY_SIDE_DOOR). It can become mutually exclusive with the existing signature verification define.

The define length seems a little long, but this is also an option. I just prepared my patch after Simons comment, see:

http://lists.denx.de/pipermail/u-boot/2014-May/179139.html

Quoted 10 lines

That way the legacy stuff is removed automatically upon requesting verification unless defined otherwise. When you fail to boot an unsigned legacy kernel then its kind of obvious that you have to solve something but if you implement verified boot and
forget this new variable then you leave a security hole.

In my last email I also discussed my confusion regard the 'required' variable. Similar argument to the above plus some other thoughts.

Was this EMail on the U-Boot ML? I could not find it... Can you send a link?

bye,
Heiko

I agree that it might be dangerous to allow legacy boot when signature verification is used. It would be nice to fix that.

This means that legacy is on by default, unless signature verification is enabled, in which case the default flips. But I worry that it might only confuse people. This seems like a Wolfgang / Tom question :-)

Dear Simon,

Quoted 3 lines · In message <CAPnjgZ1_Cf-eu592YqF0=th7MT1da6Gh7Pv1Lxaf79kV8Lw9OQ@mail.gmail.com>…

I agree that it might be dangerous to allow legacy boot when signature verification is used. It would be nice to fix that.

I think there is general agreement on this point.

Quoted 3 lines

This means that legacy is on by default, unless signature verification is enabled, in which case the default flips. But I worry that it might only confuse people. This seems like a Wolfgang / Tom question :-)

OK, here is my 0.02? to it:

I think, no matter how we implement it, this should exactly the behaviour. Average users tend to avoid reading documentation, so if they enable signature verification the most likely want a secure system, so we should give them just that. Only if someone really knows what he is doing he should be able to enable support for (insecure) legacy images.

As for the implementation - yes, the
#ifdef CONFIG_FIT_SIGNATURE_VERIFICATION
approach indeed does not look very nice, but then, it appears to be the straightforward implementation of what we want to do?

Hi Wolfgang,

Quoted 22 lines · Wolfgang Denk

Dear Simon,

Quoted 3 lines · In message <CAPnjgZ1_Cf-eu592YqF0=th7MT1da6Gh7Pv1Lxaf79kV8Lw9OQ@mail.gmail.com>…

I agree that it might be dangerous to allow legacy boot when signature verification is used. It would be nice to fix that.

I think there is general agreement on this point.

Quoted 3 lines

This means that legacy is on by default, unless signature verification is enabled, in which case the default flips. But I worry that it might only confuse people. This seems like a Wolfgang / Tom question :-)

OK, here is my 0.02? to it:

I think, no matter how we implement it, this should exactly the behaviour. Average users tend to avoid reading documentation, so if they enable signature verification the most likely want a secure system, so we should give them just that. Only if someone really knows what he is doing he should be able to enable support for (insecure) legacy images.

Quoted 4 lines

As for the implementation - yes, the
#ifdef CONFIG_FIT_SIGNATURE_VERIFICATION
approach indeed does not look very nice, but then, it appears to be the straightforward implementation of what we want to do?

OK, well in that case, let's do it that way.

Quoted 25 lines

Hi Wolfgang,

Quoted 22 lines · Wolfgang Denk

Dear Simon,

Quoted 3 lines · In message<CAPnjgZ1_Cf-eu592YqF0=th7MT1da6Gh7Pv1Lxaf79kV8Lw9OQ@mail.gmail.com>…

I agree that it might be dangerous to allow legacy boot when signature verification is used. It would be nice to fix that.

I think there is general agreement on this point.

Quoted 3 lines

This means that legacy is on by default, unless signature verification is enabled, in which case the default flips. But I worry that it might only confuse people. This seems like a Wolfgang / Tom question :-)

OK, here is my 0.02? to it:

I think, no matter how we implement it, this should exactly the behaviour. Average users tend to avoid reading documentation, so if they enable signature verification the most likely want a secure system, so we should give them just that. Only if someone really knows what he is doing he should be able to enable support for (insecure) legacy images.

Quoted 6 lines

Quoted 4 lines

As for the implementation - yes, the
#ifdef CONFIG_FIT_SIGNATURE_VERIFICATION
approach indeed does not look very nice, but then, it appears to be the straightforward implementation of what we want to do?

OK, well in that case, let's do it that way.

Agreed, then we can look for clever ways to refactor the code after.

Hello Tom, Simon, Wolfgang, Lars,

Ok, summary for one first step (I can do):

- introduce CONFIG_IMAGE_FORMAT_LEGACY based on patch [1] (rename "+#if !defined(CONFIG_DISABLE_IMAGE_FORMAT_LEGACY)" to "+#if defined(CONFIG_IMAGE_FORMAT_LEGACY)")

- set CONFIG_IMAGE_FORMAT_LEGACY as default:
(little bit adapted towards simons CONFIG_FIT_SIGNATURE_VERIFICATION
proposal ... I dont want to introduce a new define ...)

in config_defaults:

(quoted diff) +3 -0

+#ifndef CONFIG_FIT_SIGNATURE
+#define CONFIG_IMAGE_LEGACY
+#endif

so, if boards not define CONFIG_FIT_SIGNATURE, they have default CONFIG_IMAGE_FORMAT_LEGACY enabled (as currently).

If CONFIG_FIT_SIGNATURE is enabled, legacy image format is default disabled (change current behaviour of boards, which use this feature! This is only the case for:

$ grep -lr CONFIG_FIT_SIGNATURE include/
include/configs/zynq-common.h -> Michal, add Michal therefore to Cc
include/configs/sandbox.h -> Simon
include/configs/ids8313.h -> me
include/image.h
$

), but boards can enable it if needed (as ids8313 board needs it ... yes not nice ...)

If boards which have not enabled CONFIG_FIT_SIGNATURE and want to disable legacy image format ... we can add this case if we want like:

in config_defaults:

(quoted diff) +7 -0

+#ifndef CONFIG_FIT_SIGNATURE
+#define CONFIG_IMAGE_LEGACY
+#endif
+
+#ifdef CONFIG_DISABLE_IMAGE_LEGACY
+#undef CONFIG_IMAGE_LEGACY
+#endif

Is this a way to go?

Disable legacy image format with CONFIG_DISABLE_IMAGE_FORMAT_LEGACY on the ids8313 board, as it uses signed FIT images for booting Linux.

Signed-off-by Heiko Schocher <[email protected]>

Cc Simon Glass <[email protected]>

Cc Kim Phillips <[email protected]>

Cc Michael Conrad <[email protected]>

---

move fdtdec_get_int() out of lib/fdtdec.c into lib/fdtdec_common.c as this function is also used, if CONFIG_OF_CONTROL is not used. Poped up on the ids8313 board using signed FIT images, and activating CONFIG_SYS_GENERIC_BOARD. Without this patch it shows on boot:

No valid FDT found - please append one to U-Boot binary, use u-boot-dtb.bin or define CONFIG_OF_EMBED. For sandbox, use -d <file.dtb>

With this patch, it boots again with CONFIG_SYS_GENERIC_BOARD enabled.

Signed-off-by Heiko Schocher <[email protected]>

Cc Simon Glass <[email protected]>

Cc Tom Rini <[email protected]>

Hi Heiko,

Quoted 11 lines · Heiko Schocher

move fdtdec_get_int() out of lib/fdtdec.c into lib/fdtdec_common.c as this function is also used, if CONFIG_OF_CONTROL is not used. Poped up on the ids8313 board using signed FIT images, and activating CONFIG_SYS_GENERIC_BOARD. Without this patch it shows on boot:

No valid FDT found - please append one to U-Boot binary, use u-boot-dtb.bin or define CONFIG_OF_EMBED. For sandbox, use -d<file.dtb>

With this patch, it boots again with CONFIG_SYS_GENERIC_BOARD enabled.

Quoted 3 lines

Signed-off-by Heiko Schocher<[email protected]>

Cc Simon Glass<[email protected]>

Cc Tom Rini<[email protected]>

What is the reason why we can't have a common function? Is it because of the s32 type?

- add CONFIG_SYS_GENERIC_BOARD
- remove CONFIG_OF_CONTROL to boot again

Signed-off-by Heiko Schocher <[email protected]>

Cc Simon Glass <[email protected]>

Cc Kim Phillips <[email protected]>

---