image-host.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728
  1. /*
  2. * Copyright (c) 2013, Google Inc.
  3. *
  4. * (C) Copyright 2008 Semihalf
  5. *
  6. * (C) Copyright 2000-2006
  7. * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
  8. *
  9. * SPDX-License-Identifier: GPL-2.0+
  10. */
  11. #include "mkimage.h"
  12. #include <bootm.h>
  13. #include <image.h>
  14. #include <version.h>
  15. /**
  16. * fit_set_hash_value - set hash value in requested has node
  17. * @fit: pointer to the FIT format image header
  18. * @noffset: hash node offset
  19. * @value: hash value to be set
  20. * @value_len: hash value length
  21. *
  22. * fit_set_hash_value() attempts to set hash value in a node at offset
  23. * given and returns operation status to the caller.
  24. *
  25. * returns
  26. * 0, on success
  27. * -1, on failure
  28. */
  29. static int fit_set_hash_value(void *fit, int noffset, uint8_t *value,
  30. int value_len)
  31. {
  32. int ret;
  33. ret = fdt_setprop(fit, noffset, FIT_VALUE_PROP, value, value_len);
  34. if (ret) {
  35. printf("Can't set hash '%s' property for '%s' node(%s)\n",
  36. FIT_VALUE_PROP, fit_get_name(fit, noffset, NULL),
  37. fdt_strerror(ret));
  38. return -1;
  39. }
  40. return 0;
  41. }
  42. /**
  43. * fit_image_process_hash - Process a single subnode of the images/ node
  44. *
  45. * Check each subnode and process accordingly. For hash nodes we generate
  46. * a hash of the supplised data and store it in the node.
  47. *
  48. * @fit: pointer to the FIT format image header
  49. * @image_name: name of image being processes (used to display errors)
  50. * @noffset: subnode offset
  51. * @data: data to process
  52. * @size: size of data in bytes
  53. * @return 0 if ok, -1 on error
  54. */
  55. static int fit_image_process_hash(void *fit, const char *image_name,
  56. int noffset, const void *data, size_t size)
  57. {
  58. uint8_t value[FIT_MAX_HASH_LEN];
  59. const char *node_name;
  60. int value_len;
  61. char *algo;
  62. node_name = fit_get_name(fit, noffset, NULL);
  63. if (fit_image_hash_get_algo(fit, noffset, &algo)) {
  64. printf("Can't get hash algo property for '%s' hash node in '%s' image node\n",
  65. node_name, image_name);
  66. return -1;
  67. }
  68. if (calculate_hash(data, size, algo, value, &value_len)) {
  69. printf("Unsupported hash algorithm (%s) for '%s' hash node in '%s' image node\n",
  70. algo, node_name, image_name);
  71. return -1;
  72. }
  73. if (fit_set_hash_value(fit, noffset, value, value_len)) {
  74. printf("Can't set hash value for '%s' hash node in '%s' image node\n",
  75. node_name, image_name);
  76. return -1;
  77. }
  78. return 0;
  79. }
  80. /**
  81. * fit_image_write_sig() - write the signature to a FIT
  82. *
  83. * This writes the signature and signer data to the FIT.
  84. *
  85. * @fit: pointer to the FIT format image header
  86. * @noffset: hash node offset
  87. * @value: signature value to be set
  88. * @value_len: signature value length
  89. * @comment: Text comment to write (NULL for none)
  90. *
  91. * returns
  92. * 0, on success
  93. * -FDT_ERR_..., on failure
  94. */
  95. static int fit_image_write_sig(void *fit, int noffset, uint8_t *value,
  96. int value_len, const char *comment, const char *region_prop,
  97. int region_proplen)
  98. {
  99. int string_size;
  100. int ret;
  101. /*
  102. * Get the current string size, before we update the FIT and add
  103. * more
  104. */
  105. string_size = fdt_size_dt_strings(fit);
  106. ret = fdt_setprop(fit, noffset, FIT_VALUE_PROP, value, value_len);
  107. if (!ret) {
  108. ret = fdt_setprop_string(fit, noffset, "signer-name",
  109. "mkimage");
  110. }
  111. if (!ret) {
  112. ret = fdt_setprop_string(fit, noffset, "signer-version",
  113. PLAIN_VERSION);
  114. }
  115. if (comment && !ret)
  116. ret = fdt_setprop_string(fit, noffset, "comment", comment);
  117. if (!ret)
  118. ret = fit_set_timestamp(fit, noffset, time(NULL));
  119. if (region_prop && !ret) {
  120. uint32_t strdata[2];
  121. ret = fdt_setprop(fit, noffset, "hashed-nodes",
  122. region_prop, region_proplen);
  123. strdata[0] = 0;
  124. strdata[1] = cpu_to_fdt32(string_size);
  125. if (!ret) {
  126. ret = fdt_setprop(fit, noffset, "hashed-strings",
  127. strdata, sizeof(strdata));
  128. }
  129. }
  130. return ret;
  131. }
  132. static int fit_image_setup_sig(struct image_sign_info *info,
  133. const char *keydir, void *fit, const char *image_name,
  134. int noffset, const char *require_keys)
  135. {
  136. const char *node_name;
  137. char *algo_name;
  138. node_name = fit_get_name(fit, noffset, NULL);
  139. if (fit_image_hash_get_algo(fit, noffset, &algo_name)) {
  140. printf("Can't get algo property for '%s' signature node in '%s' image node\n",
  141. node_name, image_name);
  142. return -1;
  143. }
  144. memset(info, '\0', sizeof(*info));
  145. info->keydir = keydir;
  146. info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
  147. info->fit = fit;
  148. info->node_offset = noffset;
  149. info->algo = image_get_sig_algo(algo_name);
  150. info->require_keys = require_keys;
  151. if (!info->algo) {
  152. printf("Unsupported signature algorithm (%s) for '%s' signature node in '%s' image node\n",
  153. algo_name, node_name, image_name);
  154. return -1;
  155. }
  156. return 0;
  157. }
  158. /**
  159. * fit_image_process_sig- Process a single subnode of the images/ node
  160. *
  161. * Check each subnode and process accordingly. For signature nodes we
  162. * generate a signed hash of the supplised data and store it in the node.
  163. *
  164. * @keydir: Directory containing keys to use for signing
  165. * @keydest: Destination FDT blob to write public keys into
  166. * @fit: pointer to the FIT format image header
  167. * @image_name: name of image being processes (used to display errors)
  168. * @noffset: subnode offset
  169. * @data: data to process
  170. * @size: size of data in bytes
  171. * @comment: Comment to add to signature nodes
  172. * @require_keys: Mark all keys as 'required'
  173. * @return 0 if ok, -1 on error
  174. */
  175. static int fit_image_process_sig(const char *keydir, void *keydest,
  176. void *fit, const char *image_name,
  177. int noffset, const void *data, size_t size,
  178. const char *comment, int require_keys)
  179. {
  180. struct image_sign_info info;
  181. struct image_region region;
  182. const char *node_name;
  183. uint8_t *value;
  184. uint value_len;
  185. int ret;
  186. if (fit_image_setup_sig(&info, keydir, fit, image_name, noffset,
  187. require_keys ? "image" : NULL))
  188. return -1;
  189. node_name = fit_get_name(fit, noffset, NULL);
  190. region.data = data;
  191. region.size = size;
  192. ret = info.algo->sign(&info, &region, 1, &value, &value_len);
  193. if (ret) {
  194. printf("Failed to sign '%s' signature node in '%s' image node: %d\n",
  195. node_name, image_name, ret);
  196. /* We allow keys to be missing */
  197. if (ret == -ENOENT)
  198. return 0;
  199. return -1;
  200. }
  201. ret = fit_image_write_sig(fit, noffset, value, value_len, comment,
  202. NULL, 0);
  203. if (ret) {
  204. if (ret == -FDT_ERR_NOSPACE)
  205. return -ENOSPC;
  206. printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
  207. node_name, image_name, fdt_strerror(ret));
  208. return -1;
  209. }
  210. free(value);
  211. /* Get keyname again, as FDT has changed and invalidated our pointer */
  212. info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
  213. /* Write the public key into the supplied FDT file */
  214. if (keydest && info.algo->add_verify_data(&info, keydest)) {
  215. printf("Failed to add verification data for '%s' signature node in '%s' image node\n",
  216. node_name, image_name);
  217. return -1;
  218. }
  219. return 0;
  220. }
  221. /**
  222. * fit_image_add_verification_data() - calculate/set verig. data for image node
  223. *
  224. * This adds hash and signature values for an component image node.
  225. *
  226. * All existing hash subnodes are checked, if algorithm property is set to
  227. * one of the supported hash algorithms, hash value is computed and
  228. * corresponding hash node property is set, for example:
  229. *
  230. * Input component image node structure:
  231. *
  232. * o image@1 (at image_noffset)
  233. * | - data = [binary data]
  234. * o hash@1
  235. * |- algo = "sha1"
  236. *
  237. * Output component image node structure:
  238. *
  239. * o image@1 (at image_noffset)
  240. * | - data = [binary data]
  241. * o hash@1
  242. * |- algo = "sha1"
  243. * |- value = sha1(data)
  244. *
  245. * For signature details, please see doc/uImage.FIT/signature.txt
  246. *
  247. * @keydir Directory containing *.key and *.crt files (or NULL)
  248. * @keydest FDT Blob to write public keys into (NULL if none)
  249. * @fit: Pointer to the FIT format image header
  250. * @image_noffset: Requested component image node
  251. * @comment: Comment to add to signature nodes
  252. * @require_keys: Mark all keys as 'required'
  253. * @return: 0 on success, <0 on failure
  254. */
  255. int fit_image_add_verification_data(const char *keydir, void *keydest,
  256. void *fit, int image_noffset, const char *comment,
  257. int require_keys)
  258. {
  259. const char *image_name;
  260. const void *data;
  261. size_t size;
  262. int noffset;
  263. /* Get image data and data length */
  264. if (fit_image_get_data(fit, image_noffset, &data, &size)) {
  265. printf("Can't get image data/size\n");
  266. return -1;
  267. }
  268. image_name = fit_get_name(fit, image_noffset, NULL);
  269. /* Process all hash subnodes of the component image node */
  270. for (noffset = fdt_first_subnode(fit, image_noffset);
  271. noffset >= 0;
  272. noffset = fdt_next_subnode(fit, noffset)) {
  273. const char *node_name;
  274. int ret = 0;
  275. /*
  276. * Check subnode name, must be equal to "hash" or "signature".
  277. * Multiple hash nodes require unique unit node
  278. * names, e.g. hash@1, hash@2, signature@1, etc.
  279. */
  280. node_name = fit_get_name(fit, noffset, NULL);
  281. if (!strncmp(node_name, FIT_HASH_NODENAME,
  282. strlen(FIT_HASH_NODENAME))) {
  283. ret = fit_image_process_hash(fit, image_name, noffset,
  284. data, size);
  285. } else if (IMAGE_ENABLE_SIGN && keydir &&
  286. !strncmp(node_name, FIT_SIG_NODENAME,
  287. strlen(FIT_SIG_NODENAME))) {
  288. ret = fit_image_process_sig(keydir, keydest,
  289. fit, image_name, noffset, data, size,
  290. comment, require_keys);
  291. }
  292. if (ret)
  293. return -1;
  294. }
  295. return 0;
  296. }
  297. struct strlist {
  298. int count;
  299. char **strings;
  300. };
  301. static void strlist_init(struct strlist *list)
  302. {
  303. memset(list, '\0', sizeof(*list));
  304. }
  305. static void strlist_free(struct strlist *list)
  306. {
  307. int i;
  308. for (i = 0; i < list->count; i++)
  309. free(list->strings[i]);
  310. free(list->strings);
  311. }
  312. static int strlist_add(struct strlist *list, const char *str)
  313. {
  314. char *dup;
  315. dup = strdup(str);
  316. list->strings = realloc(list->strings,
  317. (list->count + 1) * sizeof(char *));
  318. if (!list || !str)
  319. return -1;
  320. list->strings[list->count++] = dup;
  321. return 0;
  322. }
  323. static const char *fit_config_get_image_list(void *fit, int noffset,
  324. int *lenp, int *allow_missingp)
  325. {
  326. static const char default_list[] = FIT_KERNEL_PROP "\0"
  327. FIT_FDT_PROP;
  328. const char *prop;
  329. /* If there is an "image" property, use that */
  330. prop = fdt_getprop(fit, noffset, "sign-images", lenp);
  331. if (prop) {
  332. *allow_missingp = 0;
  333. return *lenp ? prop : NULL;
  334. }
  335. /* Default image list */
  336. *allow_missingp = 1;
  337. *lenp = sizeof(default_list);
  338. return default_list;
  339. }
  340. static int fit_config_get_hash_list(void *fit, int conf_noffset,
  341. int sig_offset, struct strlist *node_inc)
  342. {
  343. int allow_missing;
  344. const char *prop, *iname, *end;
  345. const char *conf_name, *sig_name;
  346. char name[200], path[200];
  347. int image_count;
  348. int ret, len;
  349. conf_name = fit_get_name(fit, conf_noffset, NULL);
  350. sig_name = fit_get_name(fit, sig_offset, NULL);
  351. /*
  352. * Build a list of nodes we need to hash. We always need the root
  353. * node and the configuration.
  354. */
  355. strlist_init(node_inc);
  356. snprintf(name, sizeof(name), "%s/%s", FIT_CONFS_PATH, conf_name);
  357. if (strlist_add(node_inc, "/") ||
  358. strlist_add(node_inc, name))
  359. goto err_mem;
  360. /* Get a list of images that we intend to sign */
  361. prop = fit_config_get_image_list(fit, sig_offset, &len,
  362. &allow_missing);
  363. if (!prop)
  364. return 0;
  365. /* Locate the images */
  366. end = prop + len;
  367. image_count = 0;
  368. for (iname = prop; iname < end; iname += strlen(iname) + 1) {
  369. int noffset;
  370. int image_noffset;
  371. int hash_count;
  372. image_noffset = fit_conf_get_prop_node(fit, conf_noffset,
  373. iname);
  374. if (image_noffset < 0) {
  375. printf("Failed to find image '%s' in configuration '%s/%s'\n",
  376. iname, conf_name, sig_name);
  377. if (allow_missing)
  378. continue;
  379. return -ENOENT;
  380. }
  381. ret = fdt_get_path(fit, image_noffset, path, sizeof(path));
  382. if (ret < 0)
  383. goto err_path;
  384. if (strlist_add(node_inc, path))
  385. goto err_mem;
  386. snprintf(name, sizeof(name), "%s/%s", FIT_CONFS_PATH,
  387. conf_name);
  388. /* Add all this image's hashes */
  389. hash_count = 0;
  390. for (noffset = fdt_first_subnode(fit, image_noffset);
  391. noffset >= 0;
  392. noffset = fdt_next_subnode(fit, noffset)) {
  393. const char *name = fit_get_name(fit, noffset, NULL);
  394. if (strncmp(name, FIT_HASH_NODENAME,
  395. strlen(FIT_HASH_NODENAME)))
  396. continue;
  397. ret = fdt_get_path(fit, noffset, path, sizeof(path));
  398. if (ret < 0)
  399. goto err_path;
  400. if (strlist_add(node_inc, path))
  401. goto err_mem;
  402. hash_count++;
  403. }
  404. if (!hash_count) {
  405. printf("Failed to find any hash nodes in configuration '%s/%s' image '%s' - without these it is not possible to verify this image\n",
  406. conf_name, sig_name, iname);
  407. return -ENOMSG;
  408. }
  409. image_count++;
  410. }
  411. if (!image_count) {
  412. printf("Failed to find any images for configuration '%s/%s'\n",
  413. conf_name, sig_name);
  414. return -ENOMSG;
  415. }
  416. return 0;
  417. err_mem:
  418. printf("Out of memory processing configuration '%s/%s'\n", conf_name,
  419. sig_name);
  420. return -ENOMEM;
  421. err_path:
  422. printf("Failed to get path for image '%s' in configuration '%s/%s': %s\n",
  423. iname, conf_name, sig_name, fdt_strerror(ret));
  424. return -ENOENT;
  425. }
  426. static int fit_config_get_data(void *fit, int conf_noffset, int noffset,
  427. struct image_region **regionp, int *region_countp,
  428. char **region_propp, int *region_proplen)
  429. {
  430. char * const exc_prop[] = {"data"};
  431. struct strlist node_inc;
  432. struct image_region *region;
  433. struct fdt_region fdt_regions[100];
  434. const char *conf_name, *sig_name;
  435. char path[200];
  436. int count, i;
  437. char *region_prop;
  438. int ret, len;
  439. conf_name = fit_get_name(fit, conf_noffset, NULL);
  440. sig_name = fit_get_name(fit, conf_noffset, NULL);
  441. debug("%s: conf='%s', sig='%s'\n", __func__, conf_name, sig_name);
  442. /* Get a list of nodes we want to hash */
  443. ret = fit_config_get_hash_list(fit, conf_noffset, noffset, &node_inc);
  444. if (ret)
  445. return ret;
  446. /* Get a list of regions to hash */
  447. count = fdt_find_regions(fit, node_inc.strings, node_inc.count,
  448. exc_prop, ARRAY_SIZE(exc_prop),
  449. fdt_regions, ARRAY_SIZE(fdt_regions),
  450. path, sizeof(path), 1);
  451. if (count < 0) {
  452. printf("Failed to hash configuration '%s/%s': %s\n", conf_name,
  453. sig_name, fdt_strerror(ret));
  454. return -EIO;
  455. }
  456. if (count == 0) {
  457. printf("No data to hash for configuration '%s/%s': %s\n",
  458. conf_name, sig_name, fdt_strerror(ret));
  459. return -EINVAL;
  460. }
  461. /* Build our list of data blocks */
  462. region = fit_region_make_list(fit, fdt_regions, count, NULL);
  463. if (!region) {
  464. printf("Out of memory hashing configuration '%s/%s'\n",
  465. conf_name, sig_name);
  466. return -ENOMEM;
  467. }
  468. /* Create a list of all hashed properties */
  469. debug("Hash nodes:\n");
  470. for (i = len = 0; i < node_inc.count; i++) {
  471. debug(" %s\n", node_inc.strings[i]);
  472. len += strlen(node_inc.strings[i]) + 1;
  473. }
  474. region_prop = malloc(len);
  475. if (!region_prop) {
  476. printf("Out of memory setting up regions for configuration '%s/%s'\n",
  477. conf_name, sig_name);
  478. return -ENOMEM;
  479. }
  480. for (i = len = 0; i < node_inc.count;
  481. len += strlen(node_inc.strings[i]) + 1, i++)
  482. strcpy(region_prop + len, node_inc.strings[i]);
  483. strlist_free(&node_inc);
  484. *region_countp = count;
  485. *regionp = region;
  486. *region_propp = region_prop;
  487. *region_proplen = len;
  488. return 0;
  489. }
  490. static int fit_config_process_sig(const char *keydir, void *keydest,
  491. void *fit, const char *conf_name, int conf_noffset,
  492. int noffset, const char *comment, int require_keys)
  493. {
  494. struct image_sign_info info;
  495. const char *node_name;
  496. struct image_region *region;
  497. char *region_prop;
  498. int region_proplen;
  499. int region_count;
  500. uint8_t *value;
  501. uint value_len;
  502. int ret;
  503. node_name = fit_get_name(fit, noffset, NULL);
  504. if (fit_config_get_data(fit, conf_noffset, noffset, &region,
  505. &region_count, &region_prop, &region_proplen))
  506. return -1;
  507. if (fit_image_setup_sig(&info, keydir, fit, conf_name, noffset,
  508. require_keys ? "conf" : NULL))
  509. return -1;
  510. ret = info.algo->sign(&info, region, region_count, &value, &value_len);
  511. free(region);
  512. if (ret) {
  513. printf("Failed to sign '%s' signature node in '%s' conf node\n",
  514. node_name, conf_name);
  515. /* We allow keys to be missing */
  516. if (ret == -ENOENT)
  517. return 0;
  518. return -1;
  519. }
  520. ret = fit_image_write_sig(fit, noffset, value, value_len, comment,
  521. region_prop, region_proplen);
  522. if (ret) {
  523. if (ret == -FDT_ERR_NOSPACE)
  524. return -ENOSPC;
  525. printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
  526. node_name, conf_name, fdt_strerror(ret));
  527. return -1;
  528. }
  529. free(value);
  530. free(region_prop);
  531. /* Get keyname again, as FDT has changed and invalidated our pointer */
  532. info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
  533. /* Write the public key into the supplied FDT file */
  534. if (keydest) {
  535. ret = info.algo->add_verify_data(&info, keydest);
  536. if (ret == -ENOSPC)
  537. return -ENOSPC;
  538. if (ret) {
  539. printf("Failed to add verification data for '%s' signature node in '%s' image node\n",
  540. node_name, conf_name);
  541. }
  542. return ret;
  543. }
  544. return 0;
  545. }
  546. static int fit_config_add_verification_data(const char *keydir, void *keydest,
  547. void *fit, int conf_noffset, const char *comment,
  548. int require_keys)
  549. {
  550. const char *conf_name;
  551. int noffset;
  552. conf_name = fit_get_name(fit, conf_noffset, NULL);
  553. /* Process all hash subnodes of the configuration node */
  554. for (noffset = fdt_first_subnode(fit, conf_noffset);
  555. noffset >= 0;
  556. noffset = fdt_next_subnode(fit, noffset)) {
  557. const char *node_name;
  558. int ret = 0;
  559. node_name = fit_get_name(fit, noffset, NULL);
  560. if (!strncmp(node_name, FIT_SIG_NODENAME,
  561. strlen(FIT_SIG_NODENAME))) {
  562. ret = fit_config_process_sig(keydir, keydest,
  563. fit, conf_name, conf_noffset, noffset, comment,
  564. require_keys);
  565. }
  566. if (ret)
  567. return ret;
  568. }
  569. return 0;
  570. }
  571. int fit_add_verification_data(const char *keydir, void *keydest, void *fit,
  572. const char *comment, int require_keys)
  573. {
  574. int images_noffset, confs_noffset;
  575. int noffset;
  576. int ret;
  577. /* Find images parent node offset */
  578. images_noffset = fdt_path_offset(fit, FIT_IMAGES_PATH);
  579. if (images_noffset < 0) {
  580. printf("Can't find images parent node '%s' (%s)\n",
  581. FIT_IMAGES_PATH, fdt_strerror(images_noffset));
  582. return images_noffset;
  583. }
  584. /* Process its subnodes, print out component images details */
  585. for (noffset = fdt_first_subnode(fit, images_noffset);
  586. noffset >= 0;
  587. noffset = fdt_next_subnode(fit, noffset)) {
  588. /*
  589. * Direct child node of the images parent node,
  590. * i.e. component image node.
  591. */
  592. ret = fit_image_add_verification_data(keydir, keydest,
  593. fit, noffset, comment, require_keys);
  594. if (ret)
  595. return ret;
  596. }
  597. /* If there are no keys, we can't sign configurations */
  598. if (!IMAGE_ENABLE_SIGN || !keydir)
  599. return 0;
  600. /* Find configurations parent node offset */
  601. confs_noffset = fdt_path_offset(fit, FIT_CONFS_PATH);
  602. if (confs_noffset < 0) {
  603. printf("Can't find images parent node '%s' (%s)\n",
  604. FIT_CONFS_PATH, fdt_strerror(confs_noffset));
  605. return -ENOENT;
  606. }
  607. /* Process its subnodes, print out component images details */
  608. for (noffset = fdt_first_subnode(fit, confs_noffset);
  609. noffset >= 0;
  610. noffset = fdt_next_subnode(fit, noffset)) {
  611. ret = fit_config_add_verification_data(keydir, keydest,
  612. fit, noffset, comment,
  613. require_keys);
  614. if (ret)
  615. return ret;
  616. }
  617. return 0;
  618. }
  619. #ifdef CONFIG_FIT_SIGNATURE
  620. int fit_check_sign(const void *fit, const void *key)
  621. {
  622. int cfg_noffset;
  623. int ret;
  624. cfg_noffset = fit_conf_get_node(fit, NULL);
  625. if (!cfg_noffset)
  626. return -1;
  627. printf("Verifying Hash Integrity ... ");
  628. ret = fit_config_verify(fit, cfg_noffset);
  629. if (ret)
  630. return ret;
  631. ret = bootm_host_load_images(fit, cfg_noffset);
  632. return ret;
  633. }
  634. #endif