image-host.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2013, Google Inc.
  4. *
  5. * (C) Copyright 2008 Semihalf
  6. *
  7. * (C) Copyright 2000-2006
  8. * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
  9. */
  10. #include "mkimage.h"
  11. #include <bootm.h>
  12. #include <image.h>
  13. #include <version.h>
  14. /**
  15. * fit_set_hash_value - set hash value in requested has node
  16. * @fit: pointer to the FIT format image header
  17. * @noffset: hash node offset
  18. * @value: hash value to be set
  19. * @value_len: hash value length
  20. *
  21. * fit_set_hash_value() attempts to set hash value in a node at offset
  22. * given and returns operation status to the caller.
  23. *
  24. * returns
  25. * 0, on success
  26. * -1, on failure
  27. */
  28. static int fit_set_hash_value(void *fit, int noffset, uint8_t *value,
  29. int value_len)
  30. {
  31. int ret;
  32. ret = fdt_setprop(fit, noffset, FIT_VALUE_PROP, value, value_len);
  33. if (ret) {
  34. printf("Can't set hash '%s' property for '%s' node(%s)\n",
  35. FIT_VALUE_PROP, fit_get_name(fit, noffset, NULL),
  36. fdt_strerror(ret));
  37. return ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO;
  38. }
  39. return 0;
  40. }
  41. /**
  42. * fit_image_process_hash - Process a single subnode of the images/ node
  43. *
  44. * Check each subnode and process accordingly. For hash nodes we generate
  45. * a hash of the supplised data and store it in the node.
  46. *
  47. * @fit: pointer to the FIT format image header
  48. * @image_name: name of image being processes (used to display errors)
  49. * @noffset: subnode offset
  50. * @data: data to process
  51. * @size: size of data in bytes
  52. * @return 0 if ok, -1 on error
  53. */
  54. static int fit_image_process_hash(void *fit, const char *image_name,
  55. int noffset, const void *data, size_t size)
  56. {
  57. uint8_t value[FIT_MAX_HASH_LEN];
  58. const char *node_name;
  59. int value_len;
  60. char *algo;
  61. int ret;
  62. node_name = fit_get_name(fit, noffset, NULL);
  63. if (fit_image_hash_get_algo(fit, noffset, &algo)) {
  64. printf("Can't get hash algo property for '%s' hash node in '%s' image node\n",
  65. node_name, image_name);
  66. return -ENOENT;
  67. }
  68. if (calculate_hash(data, size, algo, value, &value_len)) {
  69. printf("Unsupported hash algorithm (%s) for '%s' hash node in '%s' image node\n",
  70. algo, node_name, image_name);
  71. return -EPROTONOSUPPORT;
  72. }
  73. ret = fit_set_hash_value(fit, noffset, value, value_len);
  74. if (ret) {
  75. printf("Can't set hash value for '%s' hash node in '%s' image node\n",
  76. node_name, image_name);
  77. return ret;
  78. }
  79. return 0;
  80. }
  81. /**
  82. * fit_image_write_sig() - write the signature to a FIT
  83. *
  84. * This writes the signature and signer data to the FIT.
  85. *
  86. * @fit: pointer to the FIT format image header
  87. * @noffset: hash node offset
  88. * @value: signature value to be set
  89. * @value_len: signature value length
  90. * @comment: Text comment to write (NULL for none)
  91. *
  92. * returns
  93. * 0, on success
  94. * -FDT_ERR_..., on failure
  95. */
  96. static int fit_image_write_sig(void *fit, int noffset, uint8_t *value,
  97. int value_len, const char *comment, const char *region_prop,
  98. int region_proplen)
  99. {
  100. int string_size;
  101. int ret;
  102. /*
  103. * Get the current string size, before we update the FIT and add
  104. * more
  105. */
  106. string_size = fdt_size_dt_strings(fit);
  107. ret = fdt_setprop(fit, noffset, FIT_VALUE_PROP, value, value_len);
  108. if (!ret) {
  109. ret = fdt_setprop_string(fit, noffset, "signer-name",
  110. "mkimage");
  111. }
  112. if (!ret) {
  113. ret = fdt_setprop_string(fit, noffset, "signer-version",
  114. PLAIN_VERSION);
  115. }
  116. if (comment && !ret)
  117. ret = fdt_setprop_string(fit, noffset, "comment", comment);
  118. if (!ret)
  119. ret = fit_set_timestamp(fit, noffset, time(NULL));
  120. if (region_prop && !ret) {
  121. uint32_t strdata[2];
  122. ret = fdt_setprop(fit, noffset, "hashed-nodes",
  123. region_prop, region_proplen);
  124. strdata[0] = 0;
  125. strdata[1] = cpu_to_fdt32(string_size);
  126. if (!ret) {
  127. ret = fdt_setprop(fit, noffset, "hashed-strings",
  128. strdata, sizeof(strdata));
  129. }
  130. }
  131. return ret;
  132. }
  133. static int fit_image_setup_sig(struct image_sign_info *info,
  134. const char *keydir, void *fit, const char *image_name,
  135. int noffset, const char *require_keys, const char *engine_id)
  136. {
  137. const char *node_name;
  138. char *algo_name;
  139. node_name = fit_get_name(fit, noffset, NULL);
  140. if (fit_image_hash_get_algo(fit, noffset, &algo_name)) {
  141. printf("Can't get algo property for '%s' signature node in '%s' image node\n",
  142. node_name, image_name);
  143. return -1;
  144. }
  145. memset(info, '\0', sizeof(*info));
  146. info->keydir = keydir;
  147. info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
  148. info->fit = fit;
  149. info->node_offset = noffset;
  150. info->name = strdup(algo_name);
  151. info->checksum = image_get_checksum_algo(algo_name);
  152. info->crypto = image_get_crypto_algo(algo_name);
  153. info->require_keys = require_keys;
  154. info->engine_id = engine_id;
  155. if (!info->checksum || !info->crypto) {
  156. printf("Unsupported signature algorithm (%s) for '%s' signature node in '%s' image node\n",
  157. algo_name, node_name, image_name);
  158. return -1;
  159. }
  160. return 0;
  161. }
  162. /**
  163. * fit_image_process_sig- Process a single subnode of the images/ node
  164. *
  165. * Check each subnode and process accordingly. For signature nodes we
  166. * generate a signed hash of the supplised data and store it in the node.
  167. *
  168. * @keydir: Directory containing keys to use for signing
  169. * @keydest: Destination FDT blob to write public keys into
  170. * @fit: pointer to the FIT format image header
  171. * @image_name: name of image being processes (used to display errors)
  172. * @noffset: subnode offset
  173. * @data: data to process
  174. * @size: size of data in bytes
  175. * @comment: Comment to add to signature nodes
  176. * @require_keys: Mark all keys as 'required'
  177. * @engine_id: Engine to use for signing
  178. * @return 0 if ok, -1 on error
  179. */
  180. static int fit_image_process_sig(const char *keydir, void *keydest,
  181. void *fit, const char *image_name,
  182. int noffset, const void *data, size_t size,
  183. const char *comment, int require_keys, const char *engine_id)
  184. {
  185. struct image_sign_info info;
  186. struct image_region region;
  187. const char *node_name;
  188. uint8_t *value;
  189. uint value_len;
  190. int ret;
  191. if (fit_image_setup_sig(&info, keydir, fit, image_name, noffset,
  192. require_keys ? "image" : NULL, engine_id))
  193. return -1;
  194. node_name = fit_get_name(fit, noffset, NULL);
  195. region.data = data;
  196. region.size = size;
  197. ret = info.crypto->sign(&info, &region, 1, &value, &value_len);
  198. if (ret) {
  199. printf("Failed to sign '%s' signature node in '%s' image node: %d\n",
  200. node_name, image_name, ret);
  201. /* We allow keys to be missing */
  202. if (ret == -ENOENT)
  203. return 0;
  204. return -1;
  205. }
  206. ret = fit_image_write_sig(fit, noffset, value, value_len, comment,
  207. NULL, 0);
  208. if (ret) {
  209. if (ret == -FDT_ERR_NOSPACE)
  210. return -ENOSPC;
  211. printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
  212. node_name, image_name, fdt_strerror(ret));
  213. return -1;
  214. }
  215. free(value);
  216. /* Get keyname again, as FDT has changed and invalidated our pointer */
  217. info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
  218. /*
  219. * Write the public key into the supplied FDT file; this might fail
  220. * several times, since we try signing with successively increasing
  221. * size values
  222. */
  223. if (keydest) {
  224. ret = info.crypto->add_verify_data(&info, keydest);
  225. if (ret) {
  226. printf("Failed to add verification data for '%s' signature node in '%s' image node\n",
  227. node_name, image_name);
  228. return ret;
  229. }
  230. }
  231. return 0;
  232. }
  233. /**
  234. * fit_image_add_verification_data() - calculate/set verig. data for image node
  235. *
  236. * This adds hash and signature values for an component image node.
  237. *
  238. * All existing hash subnodes are checked, if algorithm property is set to
  239. * one of the supported hash algorithms, hash value is computed and
  240. * corresponding hash node property is set, for example:
  241. *
  242. * Input component image node structure:
  243. *
  244. * o image-1 (at image_noffset)
  245. * | - data = [binary data]
  246. * o hash-1
  247. * |- algo = "sha1"
  248. *
  249. * Output component image node structure:
  250. *
  251. * o image-1 (at image_noffset)
  252. * | - data = [binary data]
  253. * o hash-1
  254. * |- algo = "sha1"
  255. * |- value = sha1(data)
  256. *
  257. * For signature details, please see doc/uImage.FIT/signature.txt
  258. *
  259. * @keydir Directory containing *.key and *.crt files (or NULL)
  260. * @keydest FDT Blob to write public keys into (NULL if none)
  261. * @fit: Pointer to the FIT format image header
  262. * @image_noffset: Requested component image node
  263. * @comment: Comment to add to signature nodes
  264. * @require_keys: Mark all keys as 'required'
  265. * @engine_id: Engine to use for signing
  266. * @return: 0 on success, <0 on failure
  267. */
  268. int fit_image_add_verification_data(const char *keydir, void *keydest,
  269. void *fit, int image_noffset, const char *comment,
  270. int require_keys, const char *engine_id)
  271. {
  272. const char *image_name;
  273. const void *data;
  274. size_t size;
  275. int noffset;
  276. /* Get image data and data length */
  277. if (fit_image_get_data(fit, image_noffset, &data, &size)) {
  278. printf("Can't get image data/size\n");
  279. return -1;
  280. }
  281. image_name = fit_get_name(fit, image_noffset, NULL);
  282. /* Process all hash subnodes of the component image node */
  283. for (noffset = fdt_first_subnode(fit, image_noffset);
  284. noffset >= 0;
  285. noffset = fdt_next_subnode(fit, noffset)) {
  286. const char *node_name;
  287. int ret = 0;
  288. /*
  289. * Check subnode name, must be equal to "hash" or "signature".
  290. * Multiple hash nodes require unique unit node
  291. * names, e.g. hash-1, hash-2, signature-1, etc.
  292. */
  293. node_name = fit_get_name(fit, noffset, NULL);
  294. if (!strncmp(node_name, FIT_HASH_NODENAME,
  295. strlen(FIT_HASH_NODENAME))) {
  296. ret = fit_image_process_hash(fit, image_name, noffset,
  297. data, size);
  298. } else if (IMAGE_ENABLE_SIGN && keydir &&
  299. !strncmp(node_name, FIT_SIG_NODENAME,
  300. strlen(FIT_SIG_NODENAME))) {
  301. ret = fit_image_process_sig(keydir, keydest,
  302. fit, image_name, noffset, data, size,
  303. comment, require_keys, engine_id);
  304. }
  305. if (ret)
  306. return ret;
  307. }
  308. return 0;
  309. }
  310. struct strlist {
  311. int count;
  312. char **strings;
  313. };
  314. static void strlist_init(struct strlist *list)
  315. {
  316. memset(list, '\0', sizeof(*list));
  317. }
  318. static void strlist_free(struct strlist *list)
  319. {
  320. int i;
  321. for (i = 0; i < list->count; i++)
  322. free(list->strings[i]);
  323. free(list->strings);
  324. }
  325. static int strlist_add(struct strlist *list, const char *str)
  326. {
  327. char *dup;
  328. dup = strdup(str);
  329. list->strings = realloc(list->strings,
  330. (list->count + 1) * sizeof(char *));
  331. if (!list || !str)
  332. return -1;
  333. list->strings[list->count++] = dup;
  334. return 0;
  335. }
  336. static const char *fit_config_get_image_list(void *fit, int noffset,
  337. int *lenp, int *allow_missingp)
  338. {
  339. static const char default_list[] = FIT_KERNEL_PROP "\0"
  340. FIT_FDT_PROP;
  341. const char *prop;
  342. /* If there is an "image" property, use that */
  343. prop = fdt_getprop(fit, noffset, "sign-images", lenp);
  344. if (prop) {
  345. *allow_missingp = 0;
  346. return *lenp ? prop : NULL;
  347. }
  348. /* Default image list */
  349. *allow_missingp = 1;
  350. *lenp = sizeof(default_list);
  351. return default_list;
  352. }
  353. static int fit_config_get_hash_list(void *fit, int conf_noffset,
  354. int sig_offset, struct strlist *node_inc)
  355. {
  356. int allow_missing;
  357. const char *prop, *iname, *end;
  358. const char *conf_name, *sig_name;
  359. char name[200], path[200];
  360. int image_count;
  361. int ret, len;
  362. conf_name = fit_get_name(fit, conf_noffset, NULL);
  363. sig_name = fit_get_name(fit, sig_offset, NULL);
  364. /*
  365. * Build a list of nodes we need to hash. We always need the root
  366. * node and the configuration.
  367. */
  368. strlist_init(node_inc);
  369. snprintf(name, sizeof(name), "%s/%s", FIT_CONFS_PATH, conf_name);
  370. if (strlist_add(node_inc, "/") ||
  371. strlist_add(node_inc, name))
  372. goto err_mem;
  373. /* Get a list of images that we intend to sign */
  374. prop = fit_config_get_image_list(fit, sig_offset, &len,
  375. &allow_missing);
  376. if (!prop)
  377. return 0;
  378. /* Locate the images */
  379. end = prop + len;
  380. image_count = 0;
  381. for (iname = prop; iname < end; iname += strlen(iname) + 1) {
  382. int noffset;
  383. int image_noffset;
  384. int hash_count;
  385. image_noffset = fit_conf_get_prop_node(fit, conf_noffset,
  386. iname);
  387. if (image_noffset < 0) {
  388. printf("Failed to find image '%s' in configuration '%s/%s'\n",
  389. iname, conf_name, sig_name);
  390. if (allow_missing)
  391. continue;
  392. return -ENOENT;
  393. }
  394. ret = fdt_get_path(fit, image_noffset, path, sizeof(path));
  395. if (ret < 0)
  396. goto err_path;
  397. if (strlist_add(node_inc, path))
  398. goto err_mem;
  399. snprintf(name, sizeof(name), "%s/%s", FIT_CONFS_PATH,
  400. conf_name);
  401. /* Add all this image's hashes */
  402. hash_count = 0;
  403. for (noffset = fdt_first_subnode(fit, image_noffset);
  404. noffset >= 0;
  405. noffset = fdt_next_subnode(fit, noffset)) {
  406. const char *name = fit_get_name(fit, noffset, NULL);
  407. if (strncmp(name, FIT_HASH_NODENAME,
  408. strlen(FIT_HASH_NODENAME)))
  409. continue;
  410. ret = fdt_get_path(fit, noffset, path, sizeof(path));
  411. if (ret < 0)
  412. goto err_path;
  413. if (strlist_add(node_inc, path))
  414. goto err_mem;
  415. hash_count++;
  416. }
  417. if (!hash_count) {
  418. printf("Failed to find any hash nodes in configuration '%s/%s' image '%s' - without these it is not possible to verify this image\n",
  419. conf_name, sig_name, iname);
  420. return -ENOMSG;
  421. }
  422. image_count++;
  423. }
  424. if (!image_count) {
  425. printf("Failed to find any images for configuration '%s/%s'\n",
  426. conf_name, sig_name);
  427. return -ENOMSG;
  428. }
  429. return 0;
  430. err_mem:
  431. printf("Out of memory processing configuration '%s/%s'\n", conf_name,
  432. sig_name);
  433. return -ENOMEM;
  434. err_path:
  435. printf("Failed to get path for image '%s' in configuration '%s/%s': %s\n",
  436. iname, conf_name, sig_name, fdt_strerror(ret));
  437. return -ENOENT;
  438. }
  439. static int fit_config_get_data(void *fit, int conf_noffset, int noffset,
  440. struct image_region **regionp, int *region_countp,
  441. char **region_propp, int *region_proplen)
  442. {
  443. char * const exc_prop[] = {"data"};
  444. struct strlist node_inc;
  445. struct image_region *region;
  446. struct fdt_region fdt_regions[100];
  447. const char *conf_name, *sig_name;
  448. char path[200];
  449. int count, i;
  450. char *region_prop;
  451. int ret, len;
  452. conf_name = fit_get_name(fit, conf_noffset, NULL);
  453. sig_name = fit_get_name(fit, noffset, NULL);
  454. debug("%s: conf='%s', sig='%s'\n", __func__, conf_name, sig_name);
  455. /* Get a list of nodes we want to hash */
  456. ret = fit_config_get_hash_list(fit, conf_noffset, noffset, &node_inc);
  457. if (ret)
  458. return ret;
  459. /* Get a list of regions to hash */
  460. count = fdt_find_regions(fit, node_inc.strings, node_inc.count,
  461. exc_prop, ARRAY_SIZE(exc_prop),
  462. fdt_regions, ARRAY_SIZE(fdt_regions),
  463. path, sizeof(path), 1);
  464. if (count < 0) {
  465. printf("Failed to hash configuration '%s/%s': %s\n", conf_name,
  466. sig_name, fdt_strerror(ret));
  467. return -EIO;
  468. }
  469. if (count == 0) {
  470. printf("No data to hash for configuration '%s/%s': %s\n",
  471. conf_name, sig_name, fdt_strerror(ret));
  472. return -EINVAL;
  473. }
  474. /* Build our list of data blocks */
  475. region = fit_region_make_list(fit, fdt_regions, count, NULL);
  476. if (!region) {
  477. printf("Out of memory hashing configuration '%s/%s'\n",
  478. conf_name, sig_name);
  479. return -ENOMEM;
  480. }
  481. /* Create a list of all hashed properties */
  482. debug("Hash nodes:\n");
  483. for (i = len = 0; i < node_inc.count; i++) {
  484. debug(" %s\n", node_inc.strings[i]);
  485. len += strlen(node_inc.strings[i]) + 1;
  486. }
  487. region_prop = malloc(len);
  488. if (!region_prop) {
  489. printf("Out of memory setting up regions for configuration '%s/%s'\n",
  490. conf_name, sig_name);
  491. return -ENOMEM;
  492. }
  493. for (i = len = 0; i < node_inc.count;
  494. len += strlen(node_inc.strings[i]) + 1, i++)
  495. strcpy(region_prop + len, node_inc.strings[i]);
  496. strlist_free(&node_inc);
  497. *region_countp = count;
  498. *regionp = region;
  499. *region_propp = region_prop;
  500. *region_proplen = len;
  501. return 0;
  502. }
  503. static int fit_config_process_sig(const char *keydir, void *keydest,
  504. void *fit, const char *conf_name, int conf_noffset,
  505. int noffset, const char *comment, int require_keys,
  506. const char *engine_id)
  507. {
  508. struct image_sign_info info;
  509. const char *node_name;
  510. struct image_region *region;
  511. char *region_prop;
  512. int region_proplen;
  513. int region_count;
  514. uint8_t *value;
  515. uint value_len;
  516. int ret;
  517. node_name = fit_get_name(fit, noffset, NULL);
  518. if (fit_config_get_data(fit, conf_noffset, noffset, &region,
  519. &region_count, &region_prop, &region_proplen))
  520. return -1;
  521. if (fit_image_setup_sig(&info, keydir, fit, conf_name, noffset,
  522. require_keys ? "conf" : NULL, engine_id))
  523. return -1;
  524. ret = info.crypto->sign(&info, region, region_count, &value,
  525. &value_len);
  526. free(region);
  527. if (ret) {
  528. printf("Failed to sign '%s' signature node in '%s' conf node\n",
  529. node_name, conf_name);
  530. /* We allow keys to be missing */
  531. if (ret == -ENOENT)
  532. return 0;
  533. return -1;
  534. }
  535. ret = fit_image_write_sig(fit, noffset, value, value_len, comment,
  536. region_prop, region_proplen);
  537. if (ret) {
  538. if (ret == -FDT_ERR_NOSPACE)
  539. return -ENOSPC;
  540. printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
  541. node_name, conf_name, fdt_strerror(ret));
  542. return -1;
  543. }
  544. free(value);
  545. free(region_prop);
  546. /* Get keyname again, as FDT has changed and invalidated our pointer */
  547. info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
  548. /* Write the public key into the supplied FDT file */
  549. if (keydest) {
  550. ret = info.crypto->add_verify_data(&info, keydest);
  551. if (ret) {
  552. printf("Failed to add verification data for '%s' signature node in '%s' configuration node\n",
  553. node_name, conf_name);
  554. }
  555. return ret;
  556. }
  557. return 0;
  558. }
  559. static int fit_config_add_verification_data(const char *keydir, void *keydest,
  560. void *fit, int conf_noffset, const char *comment,
  561. int require_keys, const char *engine_id)
  562. {
  563. const char *conf_name;
  564. int noffset;
  565. conf_name = fit_get_name(fit, conf_noffset, NULL);
  566. /* Process all hash subnodes of the configuration node */
  567. for (noffset = fdt_first_subnode(fit, conf_noffset);
  568. noffset >= 0;
  569. noffset = fdt_next_subnode(fit, noffset)) {
  570. const char *node_name;
  571. int ret = 0;
  572. node_name = fit_get_name(fit, noffset, NULL);
  573. if (!strncmp(node_name, FIT_SIG_NODENAME,
  574. strlen(FIT_SIG_NODENAME))) {
  575. ret = fit_config_process_sig(keydir, keydest,
  576. fit, conf_name, conf_noffset, noffset, comment,
  577. require_keys, engine_id);
  578. }
  579. if (ret)
  580. return ret;
  581. }
  582. return 0;
  583. }
  584. int fit_add_verification_data(const char *keydir, void *keydest, void *fit,
  585. const char *comment, int require_keys,
  586. const char *engine_id)
  587. {
  588. int images_noffset, confs_noffset;
  589. int noffset;
  590. int ret;
  591. /* Find images parent node offset */
  592. images_noffset = fdt_path_offset(fit, FIT_IMAGES_PATH);
  593. if (images_noffset < 0) {
  594. printf("Can't find images parent node '%s' (%s)\n",
  595. FIT_IMAGES_PATH, fdt_strerror(images_noffset));
  596. return images_noffset;
  597. }
  598. /* Process its subnodes, print out component images details */
  599. for (noffset = fdt_first_subnode(fit, images_noffset);
  600. noffset >= 0;
  601. noffset = fdt_next_subnode(fit, noffset)) {
  602. /*
  603. * Direct child node of the images parent node,
  604. * i.e. component image node.
  605. */
  606. ret = fit_image_add_verification_data(keydir, keydest,
  607. fit, noffset, comment, require_keys, engine_id);
  608. if (ret)
  609. return ret;
  610. }
  611. /* If there are no keys, we can't sign configurations */
  612. if (!IMAGE_ENABLE_SIGN || !keydir)
  613. return 0;
  614. /* Find configurations parent node offset */
  615. confs_noffset = fdt_path_offset(fit, FIT_CONFS_PATH);
  616. if (confs_noffset < 0) {
  617. printf("Can't find images parent node '%s' (%s)\n",
  618. FIT_CONFS_PATH, fdt_strerror(confs_noffset));
  619. return -ENOENT;
  620. }
  621. /* Process its subnodes, print out component images details */
  622. for (noffset = fdt_first_subnode(fit, confs_noffset);
  623. noffset >= 0;
  624. noffset = fdt_next_subnode(fit, noffset)) {
  625. ret = fit_config_add_verification_data(keydir, keydest,
  626. fit, noffset, comment,
  627. require_keys,
  628. engine_id);
  629. if (ret)
  630. return ret;
  631. }
  632. return 0;
  633. }
  634. #ifdef CONFIG_FIT_SIGNATURE
  635. int fit_check_sign(const void *fit, const void *key)
  636. {
  637. int cfg_noffset;
  638. int ret;
  639. cfg_noffset = fit_conf_get_node(fit, NULL);
  640. if (!cfg_noffset)
  641. return -1;
  642. printf("Verifying Hash Integrity ... ");
  643. ret = fit_config_verify(fit, cfg_noffset);
  644. if (ret)
  645. return ret;
  646. ret = bootm_host_load_images(fit, cfg_noffset);
  647. return ret;
  648. }
  649. #endif