image-host.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746
  1. /*
  2. * Copyright (c) 2013, Google Inc.
  3. *
  4. * (C) Copyright 2008 Semihalf
  5. *
  6. * (C) Copyright 2000-2006
  7. * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
  8. *
  9. * SPDX-License-Identifier: GPL-2.0+
  10. */
  11. #include "mkimage.h"
  12. #include <bootm.h>
  13. #include <image.h>
  14. #include <version.h>
  15. /**
  16. * fit_set_hash_value - set hash value in requested has node
  17. * @fit: pointer to the FIT format image header
  18. * @noffset: hash node offset
  19. * @value: hash value to be set
  20. * @value_len: hash value length
  21. *
  22. * fit_set_hash_value() attempts to set hash value in a node at offset
  23. * given and returns operation status to the caller.
  24. *
  25. * returns
  26. * 0, on success
  27. * -1, on failure
  28. */
  29. static int fit_set_hash_value(void *fit, int noffset, uint8_t *value,
  30. int value_len)
  31. {
  32. int ret;
  33. ret = fdt_setprop(fit, noffset, FIT_VALUE_PROP, value, value_len);
  34. if (ret) {
  35. printf("Can't set hash '%s' property for '%s' node(%s)\n",
  36. FIT_VALUE_PROP, fit_get_name(fit, noffset, NULL),
  37. fdt_strerror(ret));
  38. return ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO;
  39. }
  40. return 0;
  41. }
  42. /**
  43. * fit_image_process_hash - Process a single subnode of the images/ node
  44. *
  45. * Check each subnode and process accordingly. For hash nodes we generate
  46. * a hash of the supplised data and store it in the node.
  47. *
  48. * @fit: pointer to the FIT format image header
  49. * @image_name: name of image being processes (used to display errors)
  50. * @noffset: subnode offset
  51. * @data: data to process
  52. * @size: size of data in bytes
  53. * @return 0 if ok, -1 on error
  54. */
  55. static int fit_image_process_hash(void *fit, const char *image_name,
  56. int noffset, const void *data, size_t size)
  57. {
  58. uint8_t value[FIT_MAX_HASH_LEN];
  59. const char *node_name;
  60. int value_len;
  61. char *algo;
  62. int ret;
  63. node_name = fit_get_name(fit, noffset, NULL);
  64. if (fit_image_hash_get_algo(fit, noffset, &algo)) {
  65. printf("Can't get hash algo property for '%s' hash node in '%s' image node\n",
  66. node_name, image_name);
  67. return -ENOENT;
  68. }
  69. if (calculate_hash(data, size, algo, value, &value_len)) {
  70. printf("Unsupported hash algorithm (%s) for '%s' hash node in '%s' image node\n",
  71. algo, node_name, image_name);
  72. return -EPROTONOSUPPORT;
  73. }
  74. ret = fit_set_hash_value(fit, noffset, value, value_len);
  75. if (ret) {
  76. printf("Can't set hash value for '%s' hash node in '%s' image node\n",
  77. node_name, image_name);
  78. return ret;
  79. }
  80. return 0;
  81. }
  82. /**
  83. * fit_image_write_sig() - write the signature to a FIT
  84. *
  85. * This writes the signature and signer data to the FIT.
  86. *
  87. * @fit: pointer to the FIT format image header
  88. * @noffset: hash node offset
  89. * @value: signature value to be set
  90. * @value_len: signature value length
  91. * @comment: Text comment to write (NULL for none)
  92. *
  93. * returns
  94. * 0, on success
  95. * -FDT_ERR_..., on failure
  96. */
  97. static int fit_image_write_sig(void *fit, int noffset, uint8_t *value,
  98. int value_len, const char *comment, const char *region_prop,
  99. int region_proplen)
  100. {
  101. int string_size;
  102. int ret;
  103. /*
  104. * Get the current string size, before we update the FIT and add
  105. * more
  106. */
  107. string_size = fdt_size_dt_strings(fit);
  108. ret = fdt_setprop(fit, noffset, FIT_VALUE_PROP, value, value_len);
  109. if (!ret) {
  110. ret = fdt_setprop_string(fit, noffset, "signer-name",
  111. "mkimage");
  112. }
  113. if (!ret) {
  114. ret = fdt_setprop_string(fit, noffset, "signer-version",
  115. PLAIN_VERSION);
  116. }
  117. if (comment && !ret)
  118. ret = fdt_setprop_string(fit, noffset, "comment", comment);
  119. if (!ret)
  120. ret = fit_set_timestamp(fit, noffset, time(NULL));
  121. if (region_prop && !ret) {
  122. uint32_t strdata[2];
  123. ret = fdt_setprop(fit, noffset, "hashed-nodes",
  124. region_prop, region_proplen);
  125. strdata[0] = 0;
  126. strdata[1] = cpu_to_fdt32(string_size);
  127. if (!ret) {
  128. ret = fdt_setprop(fit, noffset, "hashed-strings",
  129. strdata, sizeof(strdata));
  130. }
  131. }
  132. return ret;
  133. }
  134. static int fit_image_setup_sig(struct image_sign_info *info,
  135. const char *keydir, void *fit, const char *image_name,
  136. int noffset, const char *require_keys, const char *engine_id)
  137. {
  138. const char *node_name;
  139. char *algo_name;
  140. node_name = fit_get_name(fit, noffset, NULL);
  141. if (fit_image_hash_get_algo(fit, noffset, &algo_name)) {
  142. printf("Can't get algo property for '%s' signature node in '%s' image node\n",
  143. node_name, image_name);
  144. return -1;
  145. }
  146. memset(info, '\0', sizeof(*info));
  147. info->keydir = keydir;
  148. info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
  149. info->fit = fit;
  150. info->node_offset = noffset;
  151. info->name = strdup(algo_name);
  152. info->checksum = image_get_checksum_algo(algo_name);
  153. info->crypto = image_get_crypto_algo(algo_name);
  154. info->require_keys = require_keys;
  155. info->engine_id = engine_id;
  156. if (!info->checksum || !info->crypto) {
  157. printf("Unsupported signature algorithm (%s) for '%s' signature node in '%s' image node\n",
  158. algo_name, node_name, image_name);
  159. return -1;
  160. }
  161. return 0;
  162. }
  163. /**
  164. * fit_image_process_sig- Process a single subnode of the images/ node
  165. *
  166. * Check each subnode and process accordingly. For signature nodes we
  167. * generate a signed hash of the supplised data and store it in the node.
  168. *
  169. * @keydir: Directory containing keys to use for signing
  170. * @keydest: Destination FDT blob to write public keys into
  171. * @fit: pointer to the FIT format image header
  172. * @image_name: name of image being processes (used to display errors)
  173. * @noffset: subnode offset
  174. * @data: data to process
  175. * @size: size of data in bytes
  176. * @comment: Comment to add to signature nodes
  177. * @require_keys: Mark all keys as 'required'
  178. * @engine_id: Engine to use for signing
  179. * @return 0 if ok, -1 on error
  180. */
  181. static int fit_image_process_sig(const char *keydir, void *keydest,
  182. void *fit, const char *image_name,
  183. int noffset, const void *data, size_t size,
  184. const char *comment, int require_keys, const char *engine_id)
  185. {
  186. struct image_sign_info info;
  187. struct image_region region;
  188. const char *node_name;
  189. uint8_t *value;
  190. uint value_len;
  191. int ret;
  192. if (fit_image_setup_sig(&info, keydir, fit, image_name, noffset,
  193. require_keys ? "image" : NULL, engine_id))
  194. return -1;
  195. node_name = fit_get_name(fit, noffset, NULL);
  196. region.data = data;
  197. region.size = size;
  198. ret = info.crypto->sign(&info, &region, 1, &value, &value_len);
  199. if (ret) {
  200. printf("Failed to sign '%s' signature node in '%s' image node: %d\n",
  201. node_name, image_name, ret);
  202. /* We allow keys to be missing */
  203. if (ret == -ENOENT)
  204. return 0;
  205. return -1;
  206. }
  207. ret = fit_image_write_sig(fit, noffset, value, value_len, comment,
  208. NULL, 0);
  209. if (ret) {
  210. if (ret == -FDT_ERR_NOSPACE)
  211. return -ENOSPC;
  212. printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
  213. node_name, image_name, fdt_strerror(ret));
  214. return -1;
  215. }
  216. free(value);
  217. /* Get keyname again, as FDT has changed and invalidated our pointer */
  218. info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
  219. /*
  220. * Write the public key into the supplied FDT file; this might fail
  221. * several times, since we try signing with successively increasing
  222. * size values
  223. */
  224. if (keydest) {
  225. ret = info.crypto->add_verify_data(&info, keydest);
  226. if (ret) {
  227. printf("Failed to add verification data for '%s' signature node in '%s' image node\n",
  228. node_name, image_name);
  229. return ret;
  230. }
  231. }
  232. return 0;
  233. }
  234. /**
  235. * fit_image_add_verification_data() - calculate/set verig. data for image node
  236. *
  237. * This adds hash and signature values for an component image node.
  238. *
  239. * All existing hash subnodes are checked, if algorithm property is set to
  240. * one of the supported hash algorithms, hash value is computed and
  241. * corresponding hash node property is set, for example:
  242. *
  243. * Input component image node structure:
  244. *
  245. * o image@1 (at image_noffset)
  246. * | - data = [binary data]
  247. * o hash@1
  248. * |- algo = "sha1"
  249. *
  250. * Output component image node structure:
  251. *
  252. * o image@1 (at image_noffset)
  253. * | - data = [binary data]
  254. * o hash@1
  255. * |- algo = "sha1"
  256. * |- value = sha1(data)
  257. *
  258. * For signature details, please see doc/uImage.FIT/signature.txt
  259. *
  260. * @keydir Directory containing *.key and *.crt files (or NULL)
  261. * @keydest FDT Blob to write public keys into (NULL if none)
  262. * @fit: Pointer to the FIT format image header
  263. * @image_noffset: Requested component image node
  264. * @comment: Comment to add to signature nodes
  265. * @require_keys: Mark all keys as 'required'
  266. * @engine_id: Engine to use for signing
  267. * @return: 0 on success, <0 on failure
  268. */
  269. int fit_image_add_verification_data(const char *keydir, void *keydest,
  270. void *fit, int image_noffset, const char *comment,
  271. int require_keys, const char *engine_id)
  272. {
  273. const char *image_name;
  274. const void *data;
  275. size_t size;
  276. int noffset;
  277. /* Get image data and data length */
  278. if (fit_image_get_data(fit, image_noffset, &data, &size)) {
  279. printf("Can't get image data/size\n");
  280. return -1;
  281. }
  282. image_name = fit_get_name(fit, image_noffset, NULL);
  283. /* Process all hash subnodes of the component image node */
  284. for (noffset = fdt_first_subnode(fit, image_noffset);
  285. noffset >= 0;
  286. noffset = fdt_next_subnode(fit, noffset)) {
  287. const char *node_name;
  288. int ret = 0;
  289. /*
  290. * Check subnode name, must be equal to "hash" or "signature".
  291. * Multiple hash nodes require unique unit node
  292. * names, e.g. hash@1, hash@2, signature@1, etc.
  293. */
  294. node_name = fit_get_name(fit, noffset, NULL);
  295. if (!strncmp(node_name, FIT_HASH_NODENAME,
  296. strlen(FIT_HASH_NODENAME))) {
  297. ret = fit_image_process_hash(fit, image_name, noffset,
  298. data, size);
  299. } else if (IMAGE_ENABLE_SIGN && keydir &&
  300. !strncmp(node_name, FIT_SIG_NODENAME,
  301. strlen(FIT_SIG_NODENAME))) {
  302. ret = fit_image_process_sig(keydir, keydest,
  303. fit, image_name, noffset, data, size,
  304. comment, require_keys, engine_id);
  305. }
  306. if (ret)
  307. return ret;
  308. }
  309. return 0;
  310. }
  311. struct strlist {
  312. int count;
  313. char **strings;
  314. };
  315. static void strlist_init(struct strlist *list)
  316. {
  317. memset(list, '\0', sizeof(*list));
  318. }
  319. static void strlist_free(struct strlist *list)
  320. {
  321. int i;
  322. for (i = 0; i < list->count; i++)
  323. free(list->strings[i]);
  324. free(list->strings);
  325. }
  326. static int strlist_add(struct strlist *list, const char *str)
  327. {
  328. char *dup;
  329. dup = strdup(str);
  330. list->strings = realloc(list->strings,
  331. (list->count + 1) * sizeof(char *));
  332. if (!list || !str)
  333. return -1;
  334. list->strings[list->count++] = dup;
  335. return 0;
  336. }
  337. static const char *fit_config_get_image_list(void *fit, int noffset,
  338. int *lenp, int *allow_missingp)
  339. {
  340. static const char default_list[] = FIT_KERNEL_PROP "\0"
  341. FIT_FDT_PROP;
  342. const char *prop;
  343. /* If there is an "image" property, use that */
  344. prop = fdt_getprop(fit, noffset, "sign-images", lenp);
  345. if (prop) {
  346. *allow_missingp = 0;
  347. return *lenp ? prop : NULL;
  348. }
  349. /* Default image list */
  350. *allow_missingp = 1;
  351. *lenp = sizeof(default_list);
  352. return default_list;
  353. }
  354. static int fit_config_get_hash_list(void *fit, int conf_noffset,
  355. int sig_offset, struct strlist *node_inc)
  356. {
  357. int allow_missing;
  358. const char *prop, *iname, *end;
  359. const char *conf_name, *sig_name;
  360. char name[200], path[200];
  361. int image_count;
  362. int ret, len;
  363. conf_name = fit_get_name(fit, conf_noffset, NULL);
  364. sig_name = fit_get_name(fit, sig_offset, NULL);
  365. /*
  366. * Build a list of nodes we need to hash. We always need the root
  367. * node and the configuration.
  368. */
  369. strlist_init(node_inc);
  370. snprintf(name, sizeof(name), "%s/%s", FIT_CONFS_PATH, conf_name);
  371. if (strlist_add(node_inc, "/") ||
  372. strlist_add(node_inc, name))
  373. goto err_mem;
  374. /* Get a list of images that we intend to sign */
  375. prop = fit_config_get_image_list(fit, sig_offset, &len,
  376. &allow_missing);
  377. if (!prop)
  378. return 0;
  379. /* Locate the images */
  380. end = prop + len;
  381. image_count = 0;
  382. for (iname = prop; iname < end; iname += strlen(iname) + 1) {
  383. int noffset;
  384. int image_noffset;
  385. int hash_count;
  386. image_noffset = fit_conf_get_prop_node(fit, conf_noffset,
  387. iname);
  388. if (image_noffset < 0) {
  389. printf("Failed to find image '%s' in configuration '%s/%s'\n",
  390. iname, conf_name, sig_name);
  391. if (allow_missing)
  392. continue;
  393. return -ENOENT;
  394. }
  395. ret = fdt_get_path(fit, image_noffset, path, sizeof(path));
  396. if (ret < 0)
  397. goto err_path;
  398. if (strlist_add(node_inc, path))
  399. goto err_mem;
  400. snprintf(name, sizeof(name), "%s/%s", FIT_CONFS_PATH,
  401. conf_name);
  402. /* Add all this image's hashes */
  403. hash_count = 0;
  404. for (noffset = fdt_first_subnode(fit, image_noffset);
  405. noffset >= 0;
  406. noffset = fdt_next_subnode(fit, noffset)) {
  407. const char *name = fit_get_name(fit, noffset, NULL);
  408. if (strncmp(name, FIT_HASH_NODENAME,
  409. strlen(FIT_HASH_NODENAME)))
  410. continue;
  411. ret = fdt_get_path(fit, noffset, path, sizeof(path));
  412. if (ret < 0)
  413. goto err_path;
  414. if (strlist_add(node_inc, path))
  415. goto err_mem;
  416. hash_count++;
  417. }
  418. if (!hash_count) {
  419. printf("Failed to find any hash nodes in configuration '%s/%s' image '%s' - without these it is not possible to verify this image\n",
  420. conf_name, sig_name, iname);
  421. return -ENOMSG;
  422. }
  423. image_count++;
  424. }
  425. if (!image_count) {
  426. printf("Failed to find any images for configuration '%s/%s'\n",
  427. conf_name, sig_name);
  428. return -ENOMSG;
  429. }
  430. return 0;
  431. err_mem:
  432. printf("Out of memory processing configuration '%s/%s'\n", conf_name,
  433. sig_name);
  434. return -ENOMEM;
  435. err_path:
  436. printf("Failed to get path for image '%s' in configuration '%s/%s': %s\n",
  437. iname, conf_name, sig_name, fdt_strerror(ret));
  438. return -ENOENT;
  439. }
  440. static int fit_config_get_data(void *fit, int conf_noffset, int noffset,
  441. struct image_region **regionp, int *region_countp,
  442. char **region_propp, int *region_proplen)
  443. {
  444. char * const exc_prop[] = {"data"};
  445. struct strlist node_inc;
  446. struct image_region *region;
  447. struct fdt_region fdt_regions[100];
  448. const char *conf_name, *sig_name;
  449. char path[200];
  450. int count, i;
  451. char *region_prop;
  452. int ret, len;
  453. conf_name = fit_get_name(fit, conf_noffset, NULL);
  454. sig_name = fit_get_name(fit, noffset, NULL);
  455. debug("%s: conf='%s', sig='%s'\n", __func__, conf_name, sig_name);
  456. /* Get a list of nodes we want to hash */
  457. ret = fit_config_get_hash_list(fit, conf_noffset, noffset, &node_inc);
  458. if (ret)
  459. return ret;
  460. /* Get a list of regions to hash */
  461. count = fdt_find_regions(fit, node_inc.strings, node_inc.count,
  462. exc_prop, ARRAY_SIZE(exc_prop),
  463. fdt_regions, ARRAY_SIZE(fdt_regions),
  464. path, sizeof(path), 1);
  465. if (count < 0) {
  466. printf("Failed to hash configuration '%s/%s': %s\n", conf_name,
  467. sig_name, fdt_strerror(ret));
  468. return -EIO;
  469. }
  470. if (count == 0) {
  471. printf("No data to hash for configuration '%s/%s': %s\n",
  472. conf_name, sig_name, fdt_strerror(ret));
  473. return -EINVAL;
  474. }
  475. /* Build our list of data blocks */
  476. region = fit_region_make_list(fit, fdt_regions, count, NULL);
  477. if (!region) {
  478. printf("Out of memory hashing configuration '%s/%s'\n",
  479. conf_name, sig_name);
  480. return -ENOMEM;
  481. }
  482. /* Create a list of all hashed properties */
  483. debug("Hash nodes:\n");
  484. for (i = len = 0; i < node_inc.count; i++) {
  485. debug(" %s\n", node_inc.strings[i]);
  486. len += strlen(node_inc.strings[i]) + 1;
  487. }
  488. region_prop = malloc(len);
  489. if (!region_prop) {
  490. printf("Out of memory setting up regions for configuration '%s/%s'\n",
  491. conf_name, sig_name);
  492. return -ENOMEM;
  493. }
  494. for (i = len = 0; i < node_inc.count;
  495. len += strlen(node_inc.strings[i]) + 1, i++)
  496. strcpy(region_prop + len, node_inc.strings[i]);
  497. strlist_free(&node_inc);
  498. *region_countp = count;
  499. *regionp = region;
  500. *region_propp = region_prop;
  501. *region_proplen = len;
  502. return 0;
  503. }
  504. static int fit_config_process_sig(const char *keydir, void *keydest,
  505. void *fit, const char *conf_name, int conf_noffset,
  506. int noffset, const char *comment, int require_keys,
  507. const char *engine_id)
  508. {
  509. struct image_sign_info info;
  510. const char *node_name;
  511. struct image_region *region;
  512. char *region_prop;
  513. int region_proplen;
  514. int region_count;
  515. uint8_t *value;
  516. uint value_len;
  517. int ret;
  518. node_name = fit_get_name(fit, noffset, NULL);
  519. if (fit_config_get_data(fit, conf_noffset, noffset, &region,
  520. &region_count, &region_prop, &region_proplen))
  521. return -1;
  522. if (fit_image_setup_sig(&info, keydir, fit, conf_name, noffset,
  523. require_keys ? "conf" : NULL, engine_id))
  524. return -1;
  525. ret = info.crypto->sign(&info, region, region_count, &value,
  526. &value_len);
  527. free(region);
  528. if (ret) {
  529. printf("Failed to sign '%s' signature node in '%s' conf node\n",
  530. node_name, conf_name);
  531. /* We allow keys to be missing */
  532. if (ret == -ENOENT)
  533. return 0;
  534. return -1;
  535. }
  536. ret = fit_image_write_sig(fit, noffset, value, value_len, comment,
  537. region_prop, region_proplen);
  538. if (ret) {
  539. if (ret == -FDT_ERR_NOSPACE)
  540. return -ENOSPC;
  541. printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
  542. node_name, conf_name, fdt_strerror(ret));
  543. return -1;
  544. }
  545. free(value);
  546. free(region_prop);
  547. /* Get keyname again, as FDT has changed and invalidated our pointer */
  548. info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
  549. /* Write the public key into the supplied FDT file */
  550. if (keydest) {
  551. ret = info.crypto->add_verify_data(&info, keydest);
  552. if (ret == -ENOSPC)
  553. return -ENOSPC;
  554. if (ret) {
  555. printf("Failed to add verification data for '%s' signature node in '%s' image node\n",
  556. node_name, conf_name);
  557. }
  558. return ret;
  559. }
  560. return 0;
  561. }
  562. static int fit_config_add_verification_data(const char *keydir, void *keydest,
  563. void *fit, int conf_noffset, const char *comment,
  564. int require_keys, const char *engine_id)
  565. {
  566. const char *conf_name;
  567. int noffset;
  568. conf_name = fit_get_name(fit, conf_noffset, NULL);
  569. /* Process all hash subnodes of the configuration node */
  570. for (noffset = fdt_first_subnode(fit, conf_noffset);
  571. noffset >= 0;
  572. noffset = fdt_next_subnode(fit, noffset)) {
  573. const char *node_name;
  574. int ret = 0;
  575. node_name = fit_get_name(fit, noffset, NULL);
  576. if (!strncmp(node_name, FIT_SIG_NODENAME,
  577. strlen(FIT_SIG_NODENAME))) {
  578. ret = fit_config_process_sig(keydir, keydest,
  579. fit, conf_name, conf_noffset, noffset, comment,
  580. require_keys, engine_id);
  581. }
  582. if (ret)
  583. return ret;
  584. }
  585. return 0;
  586. }
  587. int fit_add_verification_data(const char *keydir, void *keydest, void *fit,
  588. const char *comment, int require_keys,
  589. const char *engine_id)
  590. {
  591. int images_noffset, confs_noffset;
  592. int noffset;
  593. int ret;
  594. /* Find images parent node offset */
  595. images_noffset = fdt_path_offset(fit, FIT_IMAGES_PATH);
  596. if (images_noffset < 0) {
  597. printf("Can't find images parent node '%s' (%s)\n",
  598. FIT_IMAGES_PATH, fdt_strerror(images_noffset));
  599. return images_noffset;
  600. }
  601. /* Process its subnodes, print out component images details */
  602. for (noffset = fdt_first_subnode(fit, images_noffset);
  603. noffset >= 0;
  604. noffset = fdt_next_subnode(fit, noffset)) {
  605. /*
  606. * Direct child node of the images parent node,
  607. * i.e. component image node.
  608. */
  609. ret = fit_image_add_verification_data(keydir, keydest,
  610. fit, noffset, comment, require_keys, engine_id);
  611. if (ret)
  612. return ret;
  613. }
  614. /* If there are no keys, we can't sign configurations */
  615. if (!IMAGE_ENABLE_SIGN || !keydir)
  616. return 0;
  617. /* Find configurations parent node offset */
  618. confs_noffset = fdt_path_offset(fit, FIT_CONFS_PATH);
  619. if (confs_noffset < 0) {
  620. printf("Can't find images parent node '%s' (%s)\n",
  621. FIT_CONFS_PATH, fdt_strerror(confs_noffset));
  622. return -ENOENT;
  623. }
  624. /* Process its subnodes, print out component images details */
  625. for (noffset = fdt_first_subnode(fit, confs_noffset);
  626. noffset >= 0;
  627. noffset = fdt_next_subnode(fit, noffset)) {
  628. ret = fit_config_add_verification_data(keydir, keydest,
  629. fit, noffset, comment,
  630. require_keys,
  631. engine_id);
  632. if (ret)
  633. return ret;
  634. }
  635. return 0;
  636. }
  637. #ifdef CONFIG_FIT_SIGNATURE
  638. int fit_check_sign(const void *fit, const void *key)
  639. {
  640. int cfg_noffset;
  641. int ret;
  642. cfg_noffset = fit_conf_get_node(fit, NULL);
  643. if (!cfg_noffset)
  644. return -1;
  645. printf("Verifying Hash Integrity ... ");
  646. ret = fit_config_verify(fit, cfg_noffset);
  647. if (ret)
  648. return ret;
  649. ret = bootm_host_load_images(fit, cfg_noffset);
  650. return ret;
  651. }
  652. #endif