diff options
Diffstat (limited to 'include/image.h')
| -rw-r--r-- | include/image.h | 117 |
1 files changed, 115 insertions, 2 deletions
diff --git a/include/image.h b/include/image.h index 34efac6056d..9c8a746d576 100644 --- a/include/image.h +++ b/include/image.h @@ -396,7 +396,19 @@ struct bootm_headers { ulong cmdline_start; ulong cmdline_end; struct bd_info *kbd; -#endif + +#if CONFIG_IS_ENABLED(FIT_VERITY) + /* + * dm-verity kernel command-line fragments, populated during FIT + * parsing by fit_verity_build_cmdline(). Bootmeths can check + * fit_verity_active() between bootm states, and + * fit_verity_apply_bootargs() appends these to the "bootargs" + * env var during BOOTM_STATE_OS_PREP. + */ + char *dm_mod_create; + char *dm_mod_waitfor; +#endif /* FIT_VERITY */ +#endif /* !USE_HOSTCC */ int verify; /* env_get("verify")[0] != 'n' */ @@ -756,6 +768,72 @@ int fit_image_load(struct bootm_headers *images, ulong addr, int arch, int image_ph_type, int bootstage_id, enum fit_load_op load_op, ulong *datap, ulong *lenp); +#if !defined(USE_HOSTCC) && CONFIG_IS_ENABLED(FIT_VERITY) +/** + * fit_verity_build_cmdline() - build dm-verity cmdline from FIT metadata + * @fit: pointer to the FIT blob + * @conf_noffset: configuration node offset in @fit + * @images: bootm headers; dm_mod_create / dm_mod_waitfor are + * populated on success + * + * Called automatically from boot_get_loadable() during FIT parsing. + * For each IH_TYPE_FILESYSTEM loadable with a dm-verity subnode, + * builds the corresponding dm target specification. + * + * Return: 0 on success, -ve errno on error + */ +int fit_verity_build_cmdline(const void *fit, int conf_noffset, + struct bootm_headers *images); + +/** + * fit_verity_apply_bootargs() - append dm-verity params to bootargs env + * @images: bootm headers with dm-verity cmdline fragments + * + * Called from BOOTM_STATE_OS_PREP before bootm_process_cmdline_env(). + * + * Return: 0 on success, -ve errno on error + */ +int fit_verity_apply_bootargs(const struct bootm_headers *images); + +/** + * fit_verity_active() - check whether dm-verity targets were found + * @images: bootm headers + * + * Return: true if at least one dm-verity target was built + */ +static inline bool fit_verity_active(const struct bootm_headers *images) +{ + return !!images->dm_mod_create; +} + +/** + * fit_verity_free() - free dm-verity cmdline allocations + * @images: bootm headers + */ +void fit_verity_free(struct bootm_headers *images); + +#else /* !FIT_VERITY */ + +static inline int fit_verity_build_cmdline(const void *fit, int conf_noffset, + struct bootm_headers *images) +{ + return 0; +} + +static inline int fit_verity_apply_bootargs(const struct bootm_headers *images) +{ + return 0; +} + +static inline bool fit_verity_active(const struct bootm_headers *images) +{ + return false; +} + +static inline void fit_verity_free(struct bootm_headers *images) {} + +#endif /* FIT_VERITY */ + /** * image_locate_script() - Locate the raw script in an image * @@ -827,7 +905,7 @@ int boot_get_fdt(void *buf, const char *select, uint arch, struct bootm_headers *images, char **of_flat_tree, ulong *of_size); -void boot_fdt_add_mem_rsv_regions(void *fdt_blob); +void boot_fdt_add_mem_rsv_regions(const void *fdt_blob); int boot_relocate_fdt(char **of_flat_tree, ulong *of_size); int boot_ramdisk_high(ulong rd_data, ulong rd_len, ulong *initrd_start, @@ -1079,6 +1157,23 @@ int booti_setup(ulong image, ulong *relocated_addr, ulong *size, #define FIT_CIPHER_NODENAME "cipher" #define FIT_ALGO_PROP "algo" +/* dm-verity node */ +#define FIT_VERITY_NODENAME "dm-verity" +#define FIT_VERITY_ALGO_PROP "algo" +#define FIT_VERITY_DBS_PROP "data-block-size" +#define FIT_VERITY_HBS_PROP "hash-block-size" +#define FIT_VERITY_NBLK_PROP "num-data-blocks" +#define FIT_VERITY_HBLK_PROP "hash-start-block" +#define FIT_VERITY_DIGEST_PROP "digest" +#define FIT_VERITY_SALT_PROP "salt" + +/* dm-verity error-handling modes (optional boolean property names) */ +#define FIT_VERITY_OPT_RESTART "restart-on-corruption" +#define FIT_VERITY_OPT_PANIC "panic-on-corruption" +#define FIT_VERITY_OPT_RERR "restart-on-error" +#define FIT_VERITY_OPT_PERR "panic-on-error" +#define FIT_VERITY_OPT_ONCE "check-at-most-once" + /* image node */ #define FIT_DATA_PROP "data" #define FIT_DATA_POSITION_PROP "data-position" @@ -1332,6 +1427,24 @@ int fit_add_verification_data(const char *keydir, const char *keyfile, const char *cmdname, const char *algo_name, struct image_summary *summary); +#ifdef USE_HOSTCC +/** + * fit_verity_get_expanded() - look up the cached dm-verity expanded buffer + * + * After mkimage has run veritysetup on a FILESYSTEM image, the original + * data concatenated with the Merkle hash tree is cached in memory keyed + * by image name. fit_extract_data() retrieves it to write the external + * data section without having to re-read a temporary file from disk. + * + * @name: image unit name (FDT node name under /images) + * @data: output -- pointer to cached buffer (do NOT free; lifetime + * ends when mkimage exits) + * @size: output -- size of @data in bytes + * Return: 0 if a cache entry exists for @name, -ENOENT otherwise + */ +int fit_verity_get_expanded(const char *name, const void **data, size_t *size); +#endif /* USE_HOSTCC */ + /** * fit_image_verify_with_data() - Verify an image with given data * |