Compile error with SPL_FIT_FULL_CHECK and SPL_LOAD_FIT_FULL enabled

[Simon Glass]

Hi Johann,

On Tue, 8 Feb 2022 at 08:44, Johann Neuhauser
<jneuhauser at dh-electronics.com> wrote:
>
> Dear developers and Simon,
>
> we wanna run secure boot with U-Boot's SPL_FIT_SIGNATURE and FIT_SIGNATURE on our STM32MP1 boards and discovered the CVE-2021-27097.

That is already fixed in 2021.04 so you can just use a mainline U-Boot
to avoid it.

> To mitigate this vulnerability we wanna enable SPL_LOAD_FIT_FULL and SPL_FIT_FULL_CHECK.
> If I compile any U-Boot SPL with the mentioned config symbols after commit 6f3c2d8a, it fails always with the following error message:
>
> Used defconfig: stm32mp15_dhcom_basic_defconfig (+ mentioned configs enabled)
> ```
> ...
>   LD      spl/lib/built-in.o
>   LD      spl/u-boot-spl
> /usr/bin/arm-linux-gnueabihf-ld.bfd: common/built-in.o: in function `fit_check_format':
> /mnt/work/dev/u-boot/common/image-fit.c:1591: undefined reference to `fdt_check_full'
> make[1]: *** [scripts/Makefile.spl:432: spl/u-boot-spl] Error 1
> make: *** [Makefile:1941: spl/u-boot-spl] Error 2
> ```
> After diging around to find the cause, we're out of ideas.
> Does anyone have a clue why the needed function is not compiled in libfdt for the spl build?

SPL_OF_LIBFDT_ASSUME_MASK is set to 0xff so this check is not enabled.
I suspect that the value of that setting should change to 0 or 1 if
the full check is enabled.

Regards,
Simon