This is my first post to the U-Boot mailing list so if I'm doing it wrong I
apologize in advance and would welcome feedback.
I was able to bypass the SHA+RSA check of an image by performing a "fdt
checksign" followed by a load of an unsigned image, even though I have
'required="conf"' in my control FDT.
Below, I have 2 images. linuxnosec.itb is not signed. linux.itb IS signed
correctly.
How do I report the bug?
Thanks,
Larry
------------------------------------------------------------------------------------------------
Good behavior:
=> fatload mmc 1:1 0x20000000 linuxnosec.itb
4989282 bytes read in 331 ms (14.4 MiB/s)
=> bootm 0x20000000
## Loading kernel from FIT Image at 20000000 ...
Using 'conf@1' configuration
Verifying Hash Integrity ... sha256,rsa4096:samkey- Failed to verify
required signature 'key-samkey'
Bad Data Hash
ERROR: can't get kernel image!
=>
-------------------------------------------------------------------------------------------------
How to bypass the signature check:
=> fatload mmc 1:1 0x20000000 linux.itb
4975090 bytes read in 330 ms (14.4 MiB/s)
=> bdinfo
arch_number = 0x00000000
boot_params = 0x20000100
DRAM bank = 0x00000000
-> start = 0x20000000
-> size = 0x20000000
baudrate = 115200 bps
TLB addr = 0x3FFF0000
relocaddr = 0x3FD58000
reloc off = 0x18E58000
irq_sp = 0x3F952FB0
sp start = 0x3F952FA0
Early malloc usage: 14f0 / 2000
fdt_blob = 3f952fc8
=> fdt addr 0x3f952fc8
=> fdt check 0x20000000
=> fatload mmc 1:1 0x20000000 linuxnosec.itb
4989282 bytes read in 332 ms (14.3 MiB/s)
=> bootm 0x20000000
## Loading kernel from FIT Image at 20000000 ...
Using 'conf@1' configuration
Verifying Hash Integrity ... OK
Trying 'kernel@1' kernel subimage
Description: unavailable
Type: Kernel Image
Compression: uncompressed
Data Start: 0x200000c4
Data Size: 4937752 Bytes = 4.7 MiB
Architecture: ARM
OS: Linux
Load Address: 0x21000000
Entry Point: 0x21000000
Hash algo: sha256
Hash value:
a6fa3b9d6b8ec4e302130b56a95dfdbcb5845980a6cd8fbf7de1f21dafaa3229
Verifying Hash Integrity ... sha256+ OK
## Loading fdt from FIT Image at 20000000 ...
Using 'conf@1' configuration
Trying 'fdt@1' fdt subimage
Description: unavailable
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x204b59b4
Data Size: 33480 Bytes = 32.7 KiB
Architecture: ARM
Hash algo: sha256
Hash value:
4e338db79f27d05fc666aaffce73c5e03562562da7b59913eec2b374aaef4b07
Verifying Hash Integrity ... sha256+ OK
Booting using the fdt blob at 0x204b59b4
Loading Kernel Image ... OK
Loading Device Tree to 3f946000, end 3f9512c7 ... OK
Starting kernel ...
_______________________________________________
U-Boot mailing list
U-Boot@lists.denx.de
https://lists.denx.de/listinfo/u-boot
