mirror/u-boot-2016
1
0
Fork 0
mirror of https://git.codelinaro.org/clo/qsdk/oss/boot/u-boot-2016.git synced 2026-03-06 17:30:35 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge "image-sig: Check hash-nodes when checking configurations"

Browse source
This commit is contained in:
Linux Build Service Account 2022-11-25 05:58:54 -08:00 • committed by Gerrit - the friendly Code Review server
commit 7a0843a1c2
1 changed files with 33 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
common/image-sig.c
View file

@ -283,20 +283,39 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
return 0;
}
int fit_config_check_sig(const void *fit, int noffset, int required_keynode,
char **err_msgp)
/**
* fit_config_check_sig() - Check the signature of a config
* @fit: FIT to check
* @noffset: Offset of configuration node (e.g. /configurations/conf-1)
* @required_keynode: Offset in the control FDT of the required key node,
* if any. If this is given, then the configuration wil not
* pass verification unless that key is used. If this is
* -1 then any signature will do.
* @conf_noffset: Offset of the configuration subnode being checked (e.g.
* /configurations/conf-1/kernel)
* @err_msgp: In the event of an error, this will be pointed to a
* help error string to display to the user.
* @return 0 if all verified ok, <0 on error
*/
int fit_config_check_sig(const void *fit, int noffset,
int required_keynode, int conf_noffsetchar,
char **err_msgp)
{
char * const exc_prop[] = {"data"};
const char *prop, *end, *name;
struct image_sign_info info;
const uint32_t *strings;
const char *config_name;
uint8_t *fit_value;
int fit_value_len;
bool found_config;
int max_regions;
int i, prop_len;
char path[200];
int count;
config_name = fit_get_name(fit, conf_noffset, NULL);
debug("%s: fdt=%p, conf='%s', sig='%s'\n", __func__, gd_fdt_blob(),
fit_get_name(fit, noffset, NULL),
fit_get_name(gd_fdt_blob(), required_keynode, NULL));
@ -332,9 +351,20 @@ int fit_config_check_sig(const void *fit, int noffset, int required_keynode,
char *node_inc[count];
debug("Hash nodes (%d):\n", count);
found_config = false;
for (name = prop, i = 0; name < end; name += strlen(name) + 1, i++) {
debug(" '%s'\n", name);
node_inc[i] = (char *)name;
if (!strncmp(FIT_CONFS_PATH, name, strlen(FIT_CONFS_PATH)) &&
name[sizeof(FIT_CONFS_PATH) - 1] == '/' &&
!strcmp(name + sizeof(FIT_CONFS_PATH), config_name)) {
debug(" (found config node %s)", config_name);
found_config = true;
}
}
if (!found_config) {
*err_msgp = "Selected config not in hashed nodes";
return -1;
}
/*
@ -399,7 +429,7 @@ static int fit_config_verify_sig(const void *fit, int conf_noffset,
if (!strncmp(name, FIT_SIG_NODENAME,
strlen(FIT_SIG_NODENAME))) {
ret = fit_config_check_sig(fit, noffset, sig_offset,
&err_msg);
conf_noffset, &err_msg);
if (ret) {
puts("- ");
} else {