Mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2026-06-13 15:03:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

image: Add support for signing of FIT configurations

Browse Source 
While signing images is useful, it does not provide complete protection
against several types of attack. For example, it it possible to create a
FIT with the same signed images, but with the configuration changed such
that a different one is selected (mix and match attack). It is also possible
to substitute a signed image from an older FIT version into a newer FIT
(roll-back attack).

Add support for signing of FIT configurations using the libfdt's region
support.

Please see doc/uImage.FIT/signature.txt for more information.

Signed-off-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Simon Glass
2013-06-13 15:10:09 -07:00
committed by Tom Rini
parent 3e06cd1f97
commit 4d0985295b
5 changed files with 798 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
include/image.h
View File

@@ -964,6 +964,22 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
int fit_image_check_sig(const void *fit, int noffset, const void *data,
size_t size, int required_keynode, char **err_msgp);
/**
* fit_region_make_list() - Make a list of regions to hash
*
* Given a list of FIT regions (offset, size) provided by libfdt, create
* a list of regions (void *, size) for use by the signature creationg
* and verification code.
*
* @fit: FIT image to process
* @fdt_regions: Regions as returned by libfdt
* @count: Number of regions returned by libfdt
* @region: Place to put list of regions (NULL to allocate it)
* @return pointer to list of regions, or NULL if out of memory
*/
struct image_region *fit_region_make_list(const void *fit,
struct fdt_region *fdt_regions, int count,
struct image_region *region);
static inline int fit_image_check_target_arch(const void *fdt, int node)
{