diff options
| author | Tom Rini <[email protected]> | 2026-03-09 15:26:34 -0600 |
|---|---|---|
| committer | Tom Rini <[email protected]> | 2026-03-09 15:26:34 -0600 |
| commit | 1e240f7206fccde4ec73ea432ab8360d321c5fe5 (patch) | |
| tree | 931d5985e8a237b5604999922f5662fc464a8817 /doc/usage | |
| parent | 36add050eea439f0b2a15e4ea0d3a8e21216f159 (diff) | |
| parent | ba7bf918dafcd093ad733b07ba490baeb20cf5da (diff) | |
Merge tag 'v2026.04-rc4' into next
Prepare v2026.04-rc4
Diffstat (limited to 'doc/usage')
| -rw-r--r-- | doc/usage/fit/signature.rst | 19 |
1 files changed, 13 insertions, 6 deletions
diff --git a/doc/usage/fit/signature.rst b/doc/usage/fit/signature.rst index e5b5a8432e9..da08cc75c3a 100644 --- a/doc/usage/fit/signature.rst +++ b/doc/usage/fit/signature.rst @@ -353,20 +353,27 @@ meantime. Details ------- The signature node contains a property ('hashed-nodes') which lists all the -nodes that the signature was made over. The image is walked in order and each -tag processed as follows: +nodes that the signature was made over. The signer (mkimage) writes this +property as a record of what was included in the hash. During verification, +however, U-Boot does not read 'hashed-nodes'. Instead it rebuilds the node +list from the configuration's own image references (kernel, fdt, ramdisk, +etc.), since 'hashed-nodes' is not itself covered by the signature. The +rebuilt list always includes the root node, the configuration node, each +referenced image node and its hash/cipher subnodes. + +The image is walked in order and each tag processed as follows: DTB_BEGIN_NODE The tag and the following name are included in the signature - if the node or its parent are present in 'hashed-nodes' + if the node or its parent are present in the node list DTB_END_NODE The tag is included in the signature if the node or its parent - are present in 'hashed-nodes' + are present in the node list DTB_PROPERTY The tag, the length word, the offset in the string table, and - the data are all included if the current node is present in 'hashed-nodes' + the data are all included if the current node is present in the node list and the property name is not 'data'. DTB_END @@ -374,7 +381,7 @@ DTB_END DTB_NOP The tag is included in the signature if the current node is present - in 'hashed-nodes' + in the node list In addition, the signature contains a property 'hashed-strings' which contains the offset and length in the string table of the strings that are to be |