[PATCH 1/2] bootm: don't allow bootm_set_verify_mode if BOOTM_FORCE_SIGNED_IMAGES is enabled

[Marco Felsch]

The only allowed value for bootm_verify_mode is BOOTM_VERIFY_SIGNATURE
if CONFIG_BOOTM_FORCE_SIGNED_IMAGES is enabled. This is set via the
bootm_init() initcall. All further attempts to modify this variable
should be prevented.

Signed-off-by: Marco Felsch <m.felsch at pengutronix.de>
---
 common/bootm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/common/bootm.c b/common/bootm.c
index a59fa35008a9..e6703b19b3ba 100644
--- a/common/bootm.c
+++ b/common/bootm.c
@@ -75,6 +75,11 @@ enum bootm_verify bootm_get_verify_mode(void)
 
 void bootm_set_verify_mode(enum bootm_verify mode)
 {
+	if (IS_ENABLED(CONFIG_BOOTM_FORCE_SIGNED_IMAGES)) {
+		pr_err("BOOTM_FORCE_SIGNED_IMAGES enabled, prevent modifying bootm_verify_mode\n");
+		return;
+	}
+
 	bootm_verify_mode = mode;
 }
 
-- 
2.39.2