diff options
| author | Simon Glass | 2013-06-13 15:10:09 -0700 |
|---|---|---|
| committer | Tom Rini | 2013-06-26 10:18:56 -0400 |
| commit | 4d0985295bbb50a952f4312c0a818cd89b8ee7aa (patch) | |
| tree | 44414eb8dfd6309ba56a21a8d8982a5d8f938f2b /include/image.h | |
| parent | 3e06cd1f97792b4bc3882de1ac99f031fb0eaa80 (diff) | |
image: Add support for signing of FIT configurations
While signing images is useful, it does not provide complete protection
against several types of attack. For example, it it possible to create a
FIT with the same signed images, but with the configuration changed such
that a different one is selected (mix and match attack). It is also possible
to substitute a signed image from an older FIT version into a newer FIT
(roll-back attack).
Add support for signing of FIT configurations using the libfdt's region
support.
Please see doc/uImage.FIT/signature.txt for more information.
Signed-off-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'include/image.h')
| -rw-r--r-- | include/image.h | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/include/image.h b/include/image.h index da7b9a04f1e..261491880e5 100644 --- a/include/image.h +++ b/include/image.h @@ -964,6 +964,22 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset, int fit_image_check_sig(const void *fit, int noffset, const void *data, size_t size, int required_keynode, char **err_msgp); +/** + * fit_region_make_list() - Make a list of regions to hash + * + * Given a list of FIT regions (offset, size) provided by libfdt, create + * a list of regions (void *, size) for use by the signature creationg + * and verification code. + * + * @fit: FIT image to process + * @fdt_regions: Regions as returned by libfdt + * @count: Number of regions returned by libfdt + * @region: Place to put list of regions (NULL to allocate it) + * @return pointer to list of regions, or NULL if out of memory + */ +struct image_region *fit_region_make_list(const void *fit, + struct fdt_region *fdt_regions, int count, + struct image_region *region); static inline int fit_image_check_target_arch(const void *fdt, int node) { |