Merge tag 'dm-pull9apr20' of git://git.denx.de/u-boot-dm

[oweals/u-boot.git] / common / image-sig.c

diff --git a/common/image-sig.c b/common/image-sig.c
index 004fbc525b5c0dcac81e6fcf974f52806cdd1898..6563effcf347d359350fe7193ffccf0371af52af 100644 (file)
--- a/common/image-sig.c
+++ b/common/image-sig.c
@@ -89,6 +89,21 @@ struct checksum_algo *image_get_checksum_algo(const char *full_name)
        int i;
        const char *name;
 
+#if !defined(USE_HOSTCC) && defined(CONFIG_NEEDS_MANUAL_RELOC)
+       static bool done;
+
+       if (!done) {
+               done = true;
+               for (i = 0; i < ARRAY_SIZE(checksum_algos); i++) {
+                       checksum_algos[i].name += gd->reloc_off;
+#if IMAGE_ENABLE_SIGN
+                       checksum_algos[i].calculate_sign += gd->reloc_off;
+#endif
+                       checksum_algos[i].calculate += gd->reloc_off;
+               }
+       }
+#endif
+
        for (i = 0; i < ARRAY_SIZE(checksum_algos); i++) {
                name = checksum_algos[i].name;
                /* Make sure names match and next char is a comma */
@@ -105,6 +120,20 @@ struct crypto_algo *image_get_crypto_algo(const char *full_name)
        int i;
        const char *name;
 
+#if !defined(USE_HOSTCC) && defined(CONFIG_NEEDS_MANUAL_RELOC)
+       static bool done;
+
+       if (!done) {
+               done = true;
+               for (i = 0; i < ARRAY_SIZE(crypto_algos); i++) {
+                       crypto_algos[i].name += gd->reloc_off;
+                       crypto_algos[i].sign += gd->reloc_off;
+                       crypto_algos[i].add_verify_data += gd->reloc_off;
+                       crypto_algos[i].verify += gd->reloc_off;
+               }
+       }
+#endif
+
        /* Move name to after the comma */
        name = strchr(full_name, ',');
        if (!name)
@@ -200,7 +229,7 @@ static int fit_image_setup_verify(struct image_sign_info *info,
                padding_name = RSA_DEFAULT_PADDING_NAME;
 
        memset(info, '\0', sizeof(*info));
-       info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
+       info->keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
        info->fit = (void *)fit;
        info->node_offset = noffset;
        info->name = algo_name;
@@ -311,7 +340,8 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
                const char *required;
                int ret;
 
-               required = fdt_getprop(sig_blob, noffset, "required", NULL);
+               required = fdt_getprop(sig_blob, noffset, FIT_KEY_REQUIRED,
+                                      NULL);
                if (!required || strcmp(required, "image"))
                        continue;
                ret = fit_image_verify_sig(fit, image_noffset, data, size,
@@ -330,20 +360,39 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
        return 0;
 }
 
-int fit_config_check_sig(const void *fit, int noffset, int required_keynode,
-                        char **err_msgp)
+/**
+ * fit_config_check_sig() - Check the signature of a config
+ *
+ * @fit: FIT to check
+ * @noffset: Offset of configuration node (e.g. /configurations/conf-1)
+ * @required_keynode:  Offset in the control FDT of the required key node,
+ *                     if any. If this is given, then the configuration wil not
+ *                     pass verification unless that key is used. If this is
+ *                     -1 then any signature will do.
+ * @conf_noffset: Offset of the configuration subnode being checked (e.g.
+ *      /configurations/conf-1/kernel)
+ * @err_msgp:          In the event of an error, this will be pointed to a
+ *                     help error string to display to the user.
+ * @return 0 if all verified ok, <0 on error
+ */
+static int fit_config_check_sig(const void *fit, int noffset,
+                               int required_keynode, int conf_noffset,
+                               char **err_msgp)
 {
        char * const exc_prop[] = {"data"};
        const char *prop, *end, *name;
        struct image_sign_info info;
        const uint32_t *strings;
+       const char *config_name;
        uint8_t *fit_value;
        int fit_value_len;
+       bool found_config;
        int max_regions;
        int i, prop_len;
        char path[200];
        int count;
 
+       config_name = fit_get_name(fit, conf_noffset, NULL);
        debug("%s: fdt=%p, conf='%s', sig='%s'\n", __func__, gd_fdt_blob(),
              fit_get_name(fit, noffset, NULL),
              fit_get_name(gd_fdt_blob(), required_keynode, NULL));
@@ -384,9 +433,20 @@ int fit_config_check_sig(const void *fit, int noffset, int required_keynode,
        char *node_inc[count];
 
        debug("Hash nodes (%d):\n", count);
+       found_config = false;
        for (name = prop, i = 0; name < end; name += strlen(name) + 1, i++) {
                debug("   '%s'\n", name);
                node_inc[i] = (char *)name;
+               if (!strncmp(FIT_CONFS_PATH, name, strlen(FIT_CONFS_PATH)) &&
+                   name[sizeof(FIT_CONFS_PATH) - 1] == '/' &&
+                   !strcmp(name + sizeof(FIT_CONFS_PATH), config_name)) {
+                       debug("      (found config node %s)", config_name);
+                       found_config = true;
+               }
+       }
+       if (!found_config) {
+               *err_msgp = "Selected config not in hashed nodes";
+               return -1;
        }
 
        /*
@@ -454,7 +514,7 @@ static int fit_config_verify_sig(const void *fit, int conf_noffset,
                if (!strncmp(name, FIT_SIG_NODENAME,
                             strlen(FIT_SIG_NODENAME))) {
                        ret = fit_config_check_sig(fit, noffset, sig_offset,
-                                                  &err_msg);
+                                                  conf_noffset, &err_msg);
                        if (ret) {
                                puts("- ");
                        } else {
@@ -470,13 +530,14 @@ static int fit_config_verify_sig(const void *fit, int conf_noffset,
                goto error;
        }
 
-       return verified ? 0 : -EPERM;
+       if (verified)
+               return 0;
 
 error:
        printf(" error!\n%s for '%s' hash node in '%s' config node\n",
               err_msg, fit_get_name(fit, noffset, NULL),
               fit_get_name(fit, conf_noffset, NULL));
-       return -1;
+       return -EPERM;
 }
 
 int fit_config_verify_required_sigs(const void *fit, int conf_noffset,
@@ -497,7 +558,8 @@ int fit_config_verify_required_sigs(const void *fit, int conf_noffset,
                const char *required;
                int ret;
 
-               required = fdt_getprop(sig_blob, noffset, "required", NULL);
+               required = fdt_getprop(sig_blob, noffset, FIT_KEY_REQUIRED,
+                                      NULL);
                if (!required || strcmp(required, "conf"))
                        continue;
                ret = fit_config_verify_sig(fit, conf_noffset, sig_blob,