Update to internal 0.43

Signed-off-by: Jason M. Bills <jason.m.bills@linux.intel.com>

3 files changed, 0 insertions, 181 deletions

diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0002-image-Be-a-little-more-verbose-when-checking-signatu.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0002-image-Be-a-little-more-verbose-when-checking-signatu.patch
deleted file mode 100644
index 230a7bb0a..000000000
--- a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0002-image-Be-a-little-more-verbose-when-checking-signatu.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 63c22eddb8fba1b6ffb845765e91587e998e470e Mon Sep 17 00:00:00 2001
-From: Simon Glass <sjg@chromium.org>
-Date: Tue, 31 Mar 2020 18:43:55 +0200
-Subject: [PATCH] image: Be a little more verbose when checking signatures
-
-It is useful to be a little more specific about what is being checked.
-Update a few messages to help with this.
-
-Signed-off-by: Simon Glass <sjg@chromium.org>
-Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
----
- common/image-fit.c | 2 +-
- tools/image-host.c | 3 ++-
- 2 files changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/common/image-fit.c b/common/image-fit.c
-index 06f3358c931c..58923cbc9371 100644
---- a/common/image-fit.c
-+++ b/common/image-fit.c
-@@ -1850,7 +1850,7 @@ int fit_image_load(bootm_headers_t *images, ulong addr,
- 		fit_uname = fit_get_name(fit, noffset, NULL);
- 	}
- 	if (noffset < 0) {
--		puts("Could not find subimage node\n");
-+		printf("Could not find subimage node type '%s'\n", prop_name);
- 		bootstage_error(bootstage_id + BOOTSTAGE_SUB_SUBNODE);
- 		return -ENOENT;
- 	}
-diff --git a/tools/image-host.c b/tools/image-host.c
-index 88b329502ca3..8e94ee8f3e31 100644
---- a/tools/image-host.c
-+++ b/tools/image-host.c
-@@ -743,7 +743,8 @@ int fit_check_sign(const void *fit, const void *key)
- 	if (!cfg_noffset)
- 		return -1;
- 
--	printf("Verifying Hash Integrity ... ");
-+	printf("Verifying Hash Integrity for node '%s'... ",
-+	       fdt_get_name(fit, cfg_noffset, NULL));
- 	ret = fit_config_verify(fit, cfg_noffset);
- 	if (ret)
- 		return ret;
--- 
-2.17.1
-
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0003-image-Return-an-error-message-from-fit_config_verify.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0003-image-Return-an-error-message-from-fit_config_verify.patch
deleted file mode 100644
index 5f82abeda..000000000
--- a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0003-image-Return-an-error-message-from-fit_config_verify.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 2fa27334977ba688f17edb6b66c8eb355d4a53a5 Mon Sep 17 00:00:00 2001
-From: Simon Glass <sjg@chromium.org>
-Date: Tue, 31 Mar 2020 18:43:55 +0200
-Subject: [PATCH] image: Return an error message from fit_config_verify_sig()
-
-This function only returns an error message sometimes. Update it to always
-return an error message if one is available. This makes it easier to see
-what went wrong.
-
-Signed-off-by: Simon Glass <sjg@chromium.org>
-Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
----
- common/image-sig.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/common/image-sig.c b/common/image-sig.c
-index 4f6b4ec412c3..48c89f930276 100644
---- a/common/image-sig.c
-+++ b/common/image-sig.c
-@@ -470,13 +470,14 @@ static int fit_config_verify_sig(const void *fit, int conf_noffset,
- 		goto error;
- 	}
- 
--	return verified ? 0 : -EPERM;
-+	if (verified)
-+		return 0;
- 
- error:
- 	printf(" error!\n%s for '%s' hash node in '%s' config node\n",
- 	       err_msg, fit_get_name(fit, noffset, NULL),
- 	       fit_get_name(fit, conf_noffset, NULL));
--	return -1;
-+	return -EPERM;
- }
- 
- int fit_config_verify_required_sigs(const void *fit, int conf_noffset,
--- 
-2.17.1
-
diff --git a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0007-image-Check-hash-nodes-when-checking-configurations.patch b/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0007-image-Check-hash-nodes-when-checking-configurations.patch
deleted file mode 100644
index 9dd5e6668..000000000
--- a/meta-openbmc-mods/meta-ast2600/recipes-bsp/u-boot/files/CVE-2020-10648/0007-image-Check-hash-nodes-when-checking-configurations.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From c7c1af4f9996986f05ced17694b68a575eda328e Mon Sep 17 00:00:00 2001
-From: Simon Glass <sjg@chromium.org>
-Date: Tue, 31 Mar 2020 18:43:55 +0200
-Subject: [PATCH] image: Check hash-nodes when checking configurations
-
-It is currently possible to use a different configuration's signature and
-thus bypass the configuration check. Make sure that the configuration node
-that was hashed matches the one being checked, to catch this problem.
-
-Also add a proper function comment to fit_config_check_sig() and make it
-static.
-
-Signed-off-by: Simon Glass <sjg@chromium.org>
-Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
----
- common/image-sig.c | 36 +++++++++++++++++++++++++++++++++---
- 1 file changed, 33 insertions(+), 3 deletions(-)
-
-diff --git a/common/image-sig.c b/common/image-sig.c
-index 48c89f930276..4526c82acf75 100644
---- a/common/image-sig.c
-+++ b/common/image-sig.c
-@@ -330,20 +330,39 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
- 	return 0;
- }
- 
--int fit_config_check_sig(const void *fit, int noffset, int required_keynode,
--			 char **err_msgp)
-+/**
-+ * fit_config_check_sig() - Check the signature of a config
-+ *
-+ * @fit: FIT to check
-+ * @noffset: Offset of configuration node (e.g. /configurations/conf-1)
-+ * @required_keynode:	Offset in the control FDT of the required key node,
-+ *			if any. If this is given, then the configuration wil not
-+ *			pass verification unless that key is used. If this is
-+ *			-1 then any signature will do.
-+ * @conf_noffset: Offset of the configuration subnode being checked (e.g.
-+ *	 /configurations/conf-1/kernel)
-+ * @err_msgp:		In the event of an error, this will be pointed to a
-+ *			help error string to display to the user.
-+ * @return 0 if all verified ok, <0 on error
-+ */
-+static int fit_config_check_sig(const void *fit, int noffset,
-+				int required_keynode, int conf_noffset,
-+				char **err_msgp)
- {
- 	char * const exc_prop[] = {"data"};
- 	const char *prop, *end, *name;
- 	struct image_sign_info info;
- 	const uint32_t *strings;
-+	const char *config_name;
- 	uint8_t *fit_value;
- 	int fit_value_len;
-+	bool found_config;
- 	int max_regions;
- 	int i, prop_len;
- 	char path[200];
- 	int count;
- 
-+	config_name = fit_get_name(fit, conf_noffset, NULL);
- 	debug("%s: fdt=%p, conf='%s', sig='%s'\n", __func__, gd_fdt_blob(),
- 	      fit_get_name(fit, noffset, NULL),
- 	      fit_get_name(gd_fdt_blob(), required_keynode, NULL));
-@@ -384,9 +403,20 @@ int fit_config_check_sig(const void *fit, int noffset, int required_keynode,
- 	char *node_inc[count];
- 
- 	debug("Hash nodes (%d):\n", count);
-+	found_config = false;
- 	for (name = prop, i = 0; name < end; name += strlen(name) + 1, i++) {
- 		debug("   '%s'\n", name);
- 		node_inc[i] = (char *)name;
-+		if (!strncmp(FIT_CONFS_PATH, name, strlen(FIT_CONFS_PATH)) &&
-+		    name[sizeof(FIT_CONFS_PATH) - 1] == '/' &&
-+		    !strcmp(name + sizeof(FIT_CONFS_PATH), config_name)) {
-+			debug("      (found config node %s)", config_name);
-+			found_config = true;
-+		}
-+	}
-+	if (!found_config) {
-+		*err_msgp = "Selected config not in hashed nodes";
-+		return -1;
- 	}
- 
- 	/*
-@@ -454,7 +484,7 @@ static int fit_config_verify_sig(const void *fit, int conf_noffset,
- 		if (!strncmp(name, FIT_SIG_NODENAME,
- 			     strlen(FIT_SIG_NODENAME))) {
- 			ret = fit_config_check_sig(fit, noffset, sig_offset,
--						   &err_msg);
-+						   conf_noffset, &err_msg);
- 			if (ret) {
- 				puts("- ");
- 			} else {
--- 
-2.17.1
-