diff options
Diffstat (limited to 'include')
| -rw-r--r-- | include/hexdump.h | 8 | ||||
| -rw-r--r-- | include/image.h | 115 |
2 files changed, 120 insertions, 3 deletions
diff --git a/include/hexdump.h b/include/hexdump.h index f2ca4793d69..5cb48d79efe 100644 --- a/include/hexdump.h +++ b/include/hexdump.h @@ -7,7 +7,11 @@ #ifndef HEXDUMP_H #define HEXDUMP_H +#ifdef USE_HOSTCC +#include <ctype.h> +#else #include <linux/ctype.h> +#endif #include <linux/types.h> enum dump_prefix_t { @@ -20,7 +24,7 @@ extern const char hex_asc[]; #define hex_asc_lo(x) hex_asc[((x) & 0x0f)] #define hex_asc_hi(x) hex_asc[((x) & 0xf0) >> 4] -static inline char *hex_byte_pack(char *buf, u8 byte) +static inline char *hex_byte_pack(char *buf, uint8_t byte) { *buf++ = hex_asc_hi(byte); *buf++ = hex_asc_lo(byte); @@ -52,7 +56,7 @@ static inline int hex_to_bin(char ch) * * Return 0 on success, -1 in case of bad input. */ -static inline int hex2bin(u8 *dst, const char *src, size_t count) +static inline int hex2bin(uint8_t *dst, const char *src, size_t count) { while (count--) { int hi = hex_to_bin(*src++); diff --git a/include/image.h b/include/image.h index 34efac6056d..7b16284257a 100644 --- a/include/image.h +++ b/include/image.h @@ -396,7 +396,19 @@ struct bootm_headers { ulong cmdline_start; ulong cmdline_end; struct bd_info *kbd; -#endif + +#if CONFIG_IS_ENABLED(FIT_VERITY) + /* + * dm-verity kernel command-line fragments, populated during FIT + * parsing by fit_verity_build_cmdline(). Bootmeths can check + * fit_verity_active() between bootm states, and + * fit_verity_apply_bootargs() appends these to the "bootargs" + * env var during BOOTM_STATE_OS_PREP. + */ + char *dm_mod_create; + char *dm_mod_waitfor; +#endif /* FIT_VERITY */ +#endif /* !USE_HOSTCC */ int verify; /* env_get("verify")[0] != 'n' */ @@ -756,6 +768,72 @@ int fit_image_load(struct bootm_headers *images, ulong addr, int arch, int image_ph_type, int bootstage_id, enum fit_load_op load_op, ulong *datap, ulong *lenp); +#if !defined(USE_HOSTCC) && CONFIG_IS_ENABLED(FIT_VERITY) +/** + * fit_verity_build_cmdline() - build dm-verity cmdline from FIT metadata + * @fit: pointer to the FIT blob + * @conf_noffset: configuration node offset in @fit + * @images: bootm headers; dm_mod_create / dm_mod_waitfor are + * populated on success + * + * Called automatically from boot_get_loadable() during FIT parsing. + * For each IH_TYPE_FILESYSTEM loadable with a dm-verity subnode, + * builds the corresponding dm target specification. + * + * Return: 0 on success, -ve errno on error + */ +int fit_verity_build_cmdline(const void *fit, int conf_noffset, + struct bootm_headers *images); + +/** + * fit_verity_apply_bootargs() - append dm-verity params to bootargs env + * @images: bootm headers with dm-verity cmdline fragments + * + * Called from BOOTM_STATE_OS_PREP before bootm_process_cmdline_env(). + * + * Return: 0 on success, -ve errno on error + */ +int fit_verity_apply_bootargs(const struct bootm_headers *images); + +/** + * fit_verity_active() - check whether dm-verity targets were found + * @images: bootm headers + * + * Return: true if at least one dm-verity target was built + */ +static inline bool fit_verity_active(const struct bootm_headers *images) +{ + return !!images->dm_mod_create; +} + +/** + * fit_verity_free() - free dm-verity cmdline allocations + * @images: bootm headers + */ +void fit_verity_free(struct bootm_headers *images); + +#else /* !FIT_VERITY */ + +static inline int fit_verity_build_cmdline(const void *fit, int conf_noffset, + struct bootm_headers *images) +{ + return 0; +} + +static inline int fit_verity_apply_bootargs(const struct bootm_headers *images) +{ + return 0; +} + +static inline bool fit_verity_active(const struct bootm_headers *images) +{ + return false; +} + +static inline void fit_verity_free(struct bootm_headers *images) {} + +#endif /* FIT_VERITY */ + /** * image_locate_script() - Locate the raw script in an image * @@ -1079,6 +1157,23 @@ int booti_setup(ulong image, ulong *relocated_addr, ulong *size, #define FIT_CIPHER_NODENAME "cipher" #define FIT_ALGO_PROP "algo" +/* dm-verity node */ +#define FIT_VERITY_NODENAME "dm-verity" +#define FIT_VERITY_ALGO_PROP "algo" +#define FIT_VERITY_DBS_PROP "data-block-size" +#define FIT_VERITY_HBS_PROP "hash-block-size" +#define FIT_VERITY_NBLK_PROP "num-data-blocks" +#define FIT_VERITY_HBLK_PROP "hash-start-block" +#define FIT_VERITY_DIGEST_PROP "digest" +#define FIT_VERITY_SALT_PROP "salt" + +/* dm-verity error-handling modes (optional boolean property names) */ +#define FIT_VERITY_OPT_RESTART "restart-on-corruption" +#define FIT_VERITY_OPT_PANIC "panic-on-corruption" +#define FIT_VERITY_OPT_RERR "restart-on-error" +#define FIT_VERITY_OPT_PERR "panic-on-error" +#define FIT_VERITY_OPT_ONCE "check-at-most-once" + /* image node */ #define FIT_DATA_PROP "data" #define FIT_DATA_POSITION_PROP "data-position" @@ -1332,6 +1427,24 @@ int fit_add_verification_data(const char *keydir, const char *keyfile, const char *cmdname, const char *algo_name, struct image_summary *summary); +#ifdef USE_HOSTCC +/** + * fit_verity_get_expanded() - look up the cached dm-verity expanded buffer + * + * After mkimage has run veritysetup on a FILESYSTEM image, the original + * data concatenated with the Merkle hash tree is cached in memory keyed + * by image name. fit_extract_data() retrieves it to write the external + * data section without having to re-read a temporary file from disk. + * + * @name: image unit name (FDT node name under /images) + * @data: output -- pointer to cached buffer (do NOT free; lifetime + * ends when mkimage exits) + * @size: output -- size of @data in bytes + * Return: 0 if a cache entry exists for @name, -ENOENT otherwise + */ +int fit_verity_get_expanded(const char *name, const void **data, size_t *size); +#endif /* USE_HOSTCC */ + /** * fit_image_verify_with_data() - Verify an image with given data * |