image-host.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright (c) 2013, Google Inc.
  4. *
  5. * (C) Copyright 2008 Semihalf
  6. *
  7. * (C) Copyright 2000-2006
  8. * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
  9. */
  10. #include "mkimage.h"
  11. #include <bootm.h>
  12. #include <image.h>
  13. #include <version.h>
  14. /**
  15. * fit_set_hash_value - set hash value in requested has node
  16. * @fit: pointer to the FIT format image header
  17. * @noffset: hash node offset
  18. * @value: hash value to be set
  19. * @value_len: hash value length
  20. *
  21. * fit_set_hash_value() attempts to set hash value in a node at offset
  22. * given and returns operation status to the caller.
  23. *
  24. * returns
  25. * 0, on success
  26. * -1, on failure
  27. */
  28. static int fit_set_hash_value(void *fit, int noffset, uint8_t *value,
  29. int value_len)
  30. {
  31. int ret;
  32. ret = fdt_setprop(fit, noffset, FIT_VALUE_PROP, value, value_len);
  33. if (ret) {
  34. printf("Can't set hash '%s' property for '%s' node(%s)\n",
  35. FIT_VALUE_PROP, fit_get_name(fit, noffset, NULL),
  36. fdt_strerror(ret));
  37. return ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO;
  38. }
  39. return 0;
  40. }
  41. /**
  42. * fit_image_process_hash - Process a single subnode of the images/ node
  43. *
  44. * Check each subnode and process accordingly. For hash nodes we generate
  45. * a hash of the supplised data and store it in the node.
  46. *
  47. * @fit: pointer to the FIT format image header
  48. * @image_name: name of image being processes (used to display errors)
  49. * @noffset: subnode offset
  50. * @data: data to process
  51. * @size: size of data in bytes
  52. * @return 0 if ok, -1 on error
  53. */
  54. static int fit_image_process_hash(void *fit, const char *image_name,
  55. int noffset, const void *data, size_t size)
  56. {
  57. uint8_t value[FIT_MAX_HASH_LEN];
  58. const char *node_name;
  59. int value_len;
  60. char *algo;
  61. int ret;
  62. node_name = fit_get_name(fit, noffset, NULL);
  63. if (fit_image_hash_get_algo(fit, noffset, &algo)) {
  64. printf("Can't get hash algo property for '%s' hash node in '%s' image node\n",
  65. node_name, image_name);
  66. return -ENOENT;
  67. }
  68. if (calculate_hash(data, size, algo, value, &value_len)) {
  69. printf("Unsupported hash algorithm (%s) for '%s' hash node in '%s' image node\n",
  70. algo, node_name, image_name);
  71. return -EPROTONOSUPPORT;
  72. }
  73. ret = fit_set_hash_value(fit, noffset, value, value_len);
  74. if (ret) {
  75. printf("Can't set hash value for '%s' hash node in '%s' image node\n",
  76. node_name, image_name);
  77. return ret;
  78. }
  79. return 0;
  80. }
  81. /**
  82. * fit_image_write_sig() - write the signature to a FIT
  83. *
  84. * This writes the signature and signer data to the FIT.
  85. *
  86. * @fit: pointer to the FIT format image header
  87. * @noffset: hash node offset
  88. * @value: signature value to be set
  89. * @value_len: signature value length
  90. * @comment: Text comment to write (NULL for none)
  91. *
  92. * returns
  93. * 0, on success
  94. * -FDT_ERR_..., on failure
  95. */
  96. static int fit_image_write_sig(void *fit, int noffset, uint8_t *value,
  97. int value_len, const char *comment, const char *region_prop,
  98. int region_proplen, const char *cmdname)
  99. {
  100. int string_size;
  101. int ret;
  102. /*
  103. * Get the current string size, before we update the FIT and add
  104. * more
  105. */
  106. string_size = fdt_size_dt_strings(fit);
  107. ret = fdt_setprop(fit, noffset, FIT_VALUE_PROP, value, value_len);
  108. if (!ret) {
  109. ret = fdt_setprop_string(fit, noffset, "signer-name",
  110. "mkimage");
  111. }
  112. if (!ret) {
  113. ret = fdt_setprop_string(fit, noffset, "signer-version",
  114. PLAIN_VERSION);
  115. }
  116. if (comment && !ret)
  117. ret = fdt_setprop_string(fit, noffset, "comment", comment);
  118. if (!ret) {
  119. time_t timestamp = imagetool_get_source_date(cmdname,
  120. time(NULL));
  121. ret = fit_set_timestamp(fit, noffset, timestamp);
  122. }
  123. if (region_prop && !ret) {
  124. uint32_t strdata[2];
  125. ret = fdt_setprop(fit, noffset, "hashed-nodes",
  126. region_prop, region_proplen);
  127. /* This is a legacy offset, it is unused, and must remain 0. */
  128. strdata[0] = 0;
  129. strdata[1] = cpu_to_fdt32(string_size);
  130. if (!ret) {
  131. ret = fdt_setprop(fit, noffset, "hashed-strings",
  132. strdata, sizeof(strdata));
  133. }
  134. }
  135. return ret;
  136. }
  137. static int fit_image_setup_sig(struct image_sign_info *info,
  138. const char *keydir, void *fit, const char *image_name,
  139. int noffset, const char *require_keys, const char *engine_id)
  140. {
  141. const char *node_name;
  142. char *algo_name;
  143. const char *padding_name;
  144. node_name = fit_get_name(fit, noffset, NULL);
  145. if (fit_image_hash_get_algo(fit, noffset, &algo_name)) {
  146. printf("Can't get algo property for '%s' signature node in '%s' image node\n",
  147. node_name, image_name);
  148. return -1;
  149. }
  150. padding_name = fdt_getprop(fit, noffset, "padding", NULL);
  151. memset(info, '\0', sizeof(*info));
  152. info->keydir = keydir;
  153. info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
  154. info->fit = fit;
  155. info->node_offset = noffset;
  156. info->name = strdup(algo_name);
  157. info->checksum = image_get_checksum_algo(algo_name);
  158. info->crypto = image_get_crypto_algo(algo_name);
  159. info->padding = image_get_padding_algo(padding_name);
  160. info->require_keys = require_keys;
  161. info->engine_id = engine_id;
  162. if (!info->checksum || !info->crypto) {
  163. printf("Unsupported signature algorithm (%s) for '%s' signature node in '%s' image node\n",
  164. algo_name, node_name, image_name);
  165. return -1;
  166. }
  167. return 0;
  168. }
  169. /**
  170. * fit_image_process_sig- Process a single subnode of the images/ node
  171. *
  172. * Check each subnode and process accordingly. For signature nodes we
  173. * generate a signed hash of the supplised data and store it in the node.
  174. *
  175. * @keydir: Directory containing keys to use for signing
  176. * @keydest: Destination FDT blob to write public keys into
  177. * @fit: pointer to the FIT format image header
  178. * @image_name: name of image being processes (used to display errors)
  179. * @noffset: subnode offset
  180. * @data: data to process
  181. * @size: size of data in bytes
  182. * @comment: Comment to add to signature nodes
  183. * @require_keys: Mark all keys as 'required'
  184. * @engine_id: Engine to use for signing
  185. * @return 0 if ok, -1 on error
  186. */
  187. static int fit_image_process_sig(const char *keydir, void *keydest,
  188. void *fit, const char *image_name,
  189. int noffset, const void *data, size_t size,
  190. const char *comment, int require_keys, const char *engine_id,
  191. const char *cmdname)
  192. {
  193. struct image_sign_info info;
  194. struct image_region region;
  195. const char *node_name;
  196. uint8_t *value;
  197. uint value_len;
  198. int ret;
  199. if (fit_image_setup_sig(&info, keydir, fit, image_name, noffset,
  200. require_keys ? "image" : NULL, engine_id))
  201. return -1;
  202. node_name = fit_get_name(fit, noffset, NULL);
  203. region.data = data;
  204. region.size = size;
  205. ret = info.crypto->sign(&info, &region, 1, &value, &value_len);
  206. if (ret) {
  207. printf("Failed to sign '%s' signature node in '%s' image node: %d\n",
  208. node_name, image_name, ret);
  209. /* We allow keys to be missing */
  210. if (ret == -ENOENT)
  211. return 0;
  212. return -1;
  213. }
  214. ret = fit_image_write_sig(fit, noffset, value, value_len, comment,
  215. NULL, 0, cmdname);
  216. if (ret) {
  217. if (ret == -FDT_ERR_NOSPACE)
  218. return -ENOSPC;
  219. printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
  220. node_name, image_name, fdt_strerror(ret));
  221. return -1;
  222. }
  223. free(value);
  224. /* Get keyname again, as FDT has changed and invalidated our pointer */
  225. info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
  226. /*
  227. * Write the public key into the supplied FDT file; this might fail
  228. * several times, since we try signing with successively increasing
  229. * size values
  230. */
  231. if (keydest) {
  232. ret = info.crypto->add_verify_data(&info, keydest);
  233. if (ret) {
  234. printf("Failed to add verification data for '%s' signature node in '%s' image node\n",
  235. node_name, image_name);
  236. return ret;
  237. }
  238. }
  239. return 0;
  240. }
  241. /**
  242. * fit_image_add_verification_data() - calculate/set verig. data for image node
  243. *
  244. * This adds hash and signature values for an component image node.
  245. *
  246. * All existing hash subnodes are checked, if algorithm property is set to
  247. * one of the supported hash algorithms, hash value is computed and
  248. * corresponding hash node property is set, for example:
  249. *
  250. * Input component image node structure:
  251. *
  252. * o image-1 (at image_noffset)
  253. * | - data = [binary data]
  254. * o hash-1
  255. * |- algo = "sha1"
  256. *
  257. * Output component image node structure:
  258. *
  259. * o image-1 (at image_noffset)
  260. * | - data = [binary data]
  261. * o hash-1
  262. * |- algo = "sha1"
  263. * |- value = sha1(data)
  264. *
  265. * For signature details, please see doc/uImage.FIT/signature.txt
  266. *
  267. * @keydir Directory containing *.key and *.crt files (or NULL)
  268. * @keydest FDT Blob to write public keys into (NULL if none)
  269. * @fit: Pointer to the FIT format image header
  270. * @image_noffset: Requested component image node
  271. * @comment: Comment to add to signature nodes
  272. * @require_keys: Mark all keys as 'required'
  273. * @engine_id: Engine to use for signing
  274. * @return: 0 on success, <0 on failure
  275. */
  276. int fit_image_add_verification_data(const char *keydir, void *keydest,
  277. void *fit, int image_noffset, const char *comment,
  278. int require_keys, const char *engine_id, const char *cmdname)
  279. {
  280. const char *image_name;
  281. const void *data;
  282. size_t size;
  283. int noffset;
  284. /* Get image data and data length */
  285. if (fit_image_get_data(fit, image_noffset, &data, &size)) {
  286. printf("Can't get image data/size\n");
  287. return -1;
  288. }
  289. image_name = fit_get_name(fit, image_noffset, NULL);
  290. /* Process all hash subnodes of the component image node */
  291. for (noffset = fdt_first_subnode(fit, image_noffset);
  292. noffset >= 0;
  293. noffset = fdt_next_subnode(fit, noffset)) {
  294. const char *node_name;
  295. int ret = 0;
  296. /*
  297. * Check subnode name, must be equal to "hash" or "signature".
  298. * Multiple hash nodes require unique unit node
  299. * names, e.g. hash-1, hash-2, signature-1, etc.
  300. */
  301. node_name = fit_get_name(fit, noffset, NULL);
  302. if (!strncmp(node_name, FIT_HASH_NODENAME,
  303. strlen(FIT_HASH_NODENAME))) {
  304. ret = fit_image_process_hash(fit, image_name, noffset,
  305. data, size);
  306. } else if (IMAGE_ENABLE_SIGN && keydir &&
  307. !strncmp(node_name, FIT_SIG_NODENAME,
  308. strlen(FIT_SIG_NODENAME))) {
  309. ret = fit_image_process_sig(keydir, keydest,
  310. fit, image_name, noffset, data, size,
  311. comment, require_keys, engine_id, cmdname);
  312. }
  313. if (ret)
  314. return ret;
  315. }
  316. return 0;
  317. }
  318. struct strlist {
  319. int count;
  320. char **strings;
  321. };
  322. static void strlist_init(struct strlist *list)
  323. {
  324. memset(list, '\0', sizeof(*list));
  325. }
  326. static void strlist_free(struct strlist *list)
  327. {
  328. int i;
  329. for (i = 0; i < list->count; i++)
  330. free(list->strings[i]);
  331. free(list->strings);
  332. }
  333. static int strlist_add(struct strlist *list, const char *str)
  334. {
  335. char *dup;
  336. dup = strdup(str);
  337. list->strings = realloc(list->strings,
  338. (list->count + 1) * sizeof(char *));
  339. if (!list || !str)
  340. return -1;
  341. list->strings[list->count++] = dup;
  342. return 0;
  343. }
  344. static const char *fit_config_get_image_list(void *fit, int noffset,
  345. int *lenp, int *allow_missingp)
  346. {
  347. static const char default_list[] = FIT_KERNEL_PROP "\0"
  348. FIT_FDT_PROP;
  349. const char *prop;
  350. /* If there is an "image" property, use that */
  351. prop = fdt_getprop(fit, noffset, "sign-images", lenp);
  352. if (prop) {
  353. *allow_missingp = 0;
  354. return *lenp ? prop : NULL;
  355. }
  356. /* Default image list */
  357. *allow_missingp = 1;
  358. *lenp = sizeof(default_list);
  359. return default_list;
  360. }
  361. static int fit_config_get_hash_list(void *fit, int conf_noffset,
  362. int sig_offset, struct strlist *node_inc)
  363. {
  364. int allow_missing;
  365. const char *prop, *iname, *end;
  366. const char *conf_name, *sig_name;
  367. char name[200], path[200];
  368. int image_count;
  369. int ret, len;
  370. conf_name = fit_get_name(fit, conf_noffset, NULL);
  371. sig_name = fit_get_name(fit, sig_offset, NULL);
  372. /*
  373. * Build a list of nodes we need to hash. We always need the root
  374. * node and the configuration.
  375. */
  376. strlist_init(node_inc);
  377. snprintf(name, sizeof(name), "%s/%s", FIT_CONFS_PATH, conf_name);
  378. if (strlist_add(node_inc, "/") ||
  379. strlist_add(node_inc, name))
  380. goto err_mem;
  381. /* Get a list of images that we intend to sign */
  382. prop = fit_config_get_image_list(fit, sig_offset, &len,
  383. &allow_missing);
  384. if (!prop)
  385. return 0;
  386. /* Locate the images */
  387. end = prop + len;
  388. image_count = 0;
  389. for (iname = prop; iname < end; iname += strlen(iname) + 1) {
  390. int noffset;
  391. int image_noffset;
  392. int hash_count;
  393. image_noffset = fit_conf_get_prop_node(fit, conf_noffset,
  394. iname);
  395. if (image_noffset < 0) {
  396. printf("Failed to find image '%s' in configuration '%s/%s'\n",
  397. iname, conf_name, sig_name);
  398. if (allow_missing)
  399. continue;
  400. return -ENOENT;
  401. }
  402. ret = fdt_get_path(fit, image_noffset, path, sizeof(path));
  403. if (ret < 0)
  404. goto err_path;
  405. if (strlist_add(node_inc, path))
  406. goto err_mem;
  407. snprintf(name, sizeof(name), "%s/%s", FIT_CONFS_PATH,
  408. conf_name);
  409. /* Add all this image's hashes */
  410. hash_count = 0;
  411. for (noffset = fdt_first_subnode(fit, image_noffset);
  412. noffset >= 0;
  413. noffset = fdt_next_subnode(fit, noffset)) {
  414. const char *name = fit_get_name(fit, noffset, NULL);
  415. if (strncmp(name, FIT_HASH_NODENAME,
  416. strlen(FIT_HASH_NODENAME)))
  417. continue;
  418. ret = fdt_get_path(fit, noffset, path, sizeof(path));
  419. if (ret < 0)
  420. goto err_path;
  421. if (strlist_add(node_inc, path))
  422. goto err_mem;
  423. hash_count++;
  424. }
  425. if (!hash_count) {
  426. printf("Failed to find any hash nodes in configuration '%s/%s' image '%s' - without these it is not possible to verify this image\n",
  427. conf_name, sig_name, iname);
  428. return -ENOMSG;
  429. }
  430. image_count++;
  431. }
  432. if (!image_count) {
  433. printf("Failed to find any images for configuration '%s/%s'\n",
  434. conf_name, sig_name);
  435. return -ENOMSG;
  436. }
  437. return 0;
  438. err_mem:
  439. printf("Out of memory processing configuration '%s/%s'\n", conf_name,
  440. sig_name);
  441. return -ENOMEM;
  442. err_path:
  443. printf("Failed to get path for image '%s' in configuration '%s/%s': %s\n",
  444. iname, conf_name, sig_name, fdt_strerror(ret));
  445. return -ENOENT;
  446. }
  447. static int fit_config_get_data(void *fit, int conf_noffset, int noffset,
  448. struct image_region **regionp, int *region_countp,
  449. char **region_propp, int *region_proplen)
  450. {
  451. char * const exc_prop[] = {"data"};
  452. struct strlist node_inc;
  453. struct image_region *region;
  454. struct fdt_region fdt_regions[100];
  455. const char *conf_name, *sig_name;
  456. char path[200];
  457. int count, i;
  458. char *region_prop;
  459. int ret, len;
  460. conf_name = fit_get_name(fit, conf_noffset, NULL);
  461. sig_name = fit_get_name(fit, noffset, NULL);
  462. debug("%s: conf='%s', sig='%s'\n", __func__, conf_name, sig_name);
  463. /* Get a list of nodes we want to hash */
  464. ret = fit_config_get_hash_list(fit, conf_noffset, noffset, &node_inc);
  465. if (ret)
  466. return ret;
  467. /* Get a list of regions to hash */
  468. count = fdt_find_regions(fit, node_inc.strings, node_inc.count,
  469. exc_prop, ARRAY_SIZE(exc_prop),
  470. fdt_regions, ARRAY_SIZE(fdt_regions),
  471. path, sizeof(path), 1);
  472. if (count < 0) {
  473. printf("Failed to hash configuration '%s/%s': %s\n", conf_name,
  474. sig_name, fdt_strerror(ret));
  475. return -EIO;
  476. }
  477. if (count == 0) {
  478. printf("No data to hash for configuration '%s/%s': %s\n",
  479. conf_name, sig_name, fdt_strerror(ret));
  480. return -EINVAL;
  481. }
  482. /* Build our list of data blocks */
  483. region = fit_region_make_list(fit, fdt_regions, count, NULL);
  484. if (!region) {
  485. printf("Out of memory hashing configuration '%s/%s'\n",
  486. conf_name, sig_name);
  487. return -ENOMEM;
  488. }
  489. /* Create a list of all hashed properties */
  490. debug("Hash nodes:\n");
  491. for (i = len = 0; i < node_inc.count; i++) {
  492. debug(" %s\n", node_inc.strings[i]);
  493. len += strlen(node_inc.strings[i]) + 1;
  494. }
  495. region_prop = malloc(len);
  496. if (!region_prop) {
  497. printf("Out of memory setting up regions for configuration '%s/%s'\n",
  498. conf_name, sig_name);
  499. return -ENOMEM;
  500. }
  501. for (i = len = 0; i < node_inc.count;
  502. len += strlen(node_inc.strings[i]) + 1, i++)
  503. strcpy(region_prop + len, node_inc.strings[i]);
  504. strlist_free(&node_inc);
  505. *region_countp = count;
  506. *regionp = region;
  507. *region_propp = region_prop;
  508. *region_proplen = len;
  509. return 0;
  510. }
  511. static int fit_config_process_sig(const char *keydir, void *keydest,
  512. void *fit, const char *conf_name, int conf_noffset,
  513. int noffset, const char *comment, int require_keys,
  514. const char *engine_id, const char *cmdname)
  515. {
  516. struct image_sign_info info;
  517. const char *node_name;
  518. struct image_region *region;
  519. char *region_prop;
  520. int region_proplen;
  521. int region_count;
  522. uint8_t *value;
  523. uint value_len;
  524. int ret;
  525. node_name = fit_get_name(fit, noffset, NULL);
  526. if (fit_config_get_data(fit, conf_noffset, noffset, &region,
  527. &region_count, &region_prop, &region_proplen))
  528. return -1;
  529. if (fit_image_setup_sig(&info, keydir, fit, conf_name, noffset,
  530. require_keys ? "conf" : NULL, engine_id))
  531. return -1;
  532. ret = info.crypto->sign(&info, region, region_count, &value,
  533. &value_len);
  534. free(region);
  535. if (ret) {
  536. printf("Failed to sign '%s' signature node in '%s' conf node\n",
  537. node_name, conf_name);
  538. /* We allow keys to be missing */
  539. if (ret == -ENOENT)
  540. return 0;
  541. return -1;
  542. }
  543. ret = fit_image_write_sig(fit, noffset, value, value_len, comment,
  544. region_prop, region_proplen, cmdname);
  545. if (ret) {
  546. if (ret == -FDT_ERR_NOSPACE)
  547. return -ENOSPC;
  548. printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
  549. node_name, conf_name, fdt_strerror(ret));
  550. return -1;
  551. }
  552. free(value);
  553. free(region_prop);
  554. /* Get keyname again, as FDT has changed and invalidated our pointer */
  555. info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
  556. /* Write the public key into the supplied FDT file */
  557. if (keydest) {
  558. ret = info.crypto->add_verify_data(&info, keydest);
  559. if (ret) {
  560. printf("Failed to add verification data for '%s' signature node in '%s' configuration node\n",
  561. node_name, conf_name);
  562. }
  563. return ret;
  564. }
  565. return 0;
  566. }
  567. static int fit_config_add_verification_data(const char *keydir, void *keydest,
  568. void *fit, int conf_noffset, const char *comment,
  569. int require_keys, const char *engine_id, const char *cmdname)
  570. {
  571. const char *conf_name;
  572. int noffset;
  573. conf_name = fit_get_name(fit, conf_noffset, NULL);
  574. /* Process all hash subnodes of the configuration node */
  575. for (noffset = fdt_first_subnode(fit, conf_noffset);
  576. noffset >= 0;
  577. noffset = fdt_next_subnode(fit, noffset)) {
  578. const char *node_name;
  579. int ret = 0;
  580. node_name = fit_get_name(fit, noffset, NULL);
  581. if (!strncmp(node_name, FIT_SIG_NODENAME,
  582. strlen(FIT_SIG_NODENAME))) {
  583. ret = fit_config_process_sig(keydir, keydest,
  584. fit, conf_name, conf_noffset, noffset, comment,
  585. require_keys, engine_id, cmdname);
  586. }
  587. if (ret)
  588. return ret;
  589. }
  590. return 0;
  591. }
  592. int fit_add_verification_data(const char *keydir, void *keydest, void *fit,
  593. const char *comment, int require_keys,
  594. const char *engine_id, const char *cmdname)
  595. {
  596. int images_noffset, confs_noffset;
  597. int noffset;
  598. int ret;
  599. /* Find images parent node offset */
  600. images_noffset = fdt_path_offset(fit, FIT_IMAGES_PATH);
  601. if (images_noffset < 0) {
  602. printf("Can't find images parent node '%s' (%s)\n",
  603. FIT_IMAGES_PATH, fdt_strerror(images_noffset));
  604. return images_noffset;
  605. }
  606. /* Process its subnodes, print out component images details */
  607. for (noffset = fdt_first_subnode(fit, images_noffset);
  608. noffset >= 0;
  609. noffset = fdt_next_subnode(fit, noffset)) {
  610. /*
  611. * Direct child node of the images parent node,
  612. * i.e. component image node.
  613. */
  614. ret = fit_image_add_verification_data(keydir, keydest,
  615. fit, noffset, comment, require_keys, engine_id,
  616. cmdname);
  617. if (ret)
  618. return ret;
  619. }
  620. /* If there are no keys, we can't sign configurations */
  621. if (!IMAGE_ENABLE_SIGN || !keydir)
  622. return 0;
  623. /* Find configurations parent node offset */
  624. confs_noffset = fdt_path_offset(fit, FIT_CONFS_PATH);
  625. if (confs_noffset < 0) {
  626. printf("Can't find images parent node '%s' (%s)\n",
  627. FIT_CONFS_PATH, fdt_strerror(confs_noffset));
  628. return -ENOENT;
  629. }
  630. /* Process its subnodes, print out component images details */
  631. for (noffset = fdt_first_subnode(fit, confs_noffset);
  632. noffset >= 0;
  633. noffset = fdt_next_subnode(fit, noffset)) {
  634. ret = fit_config_add_verification_data(keydir, keydest,
  635. fit, noffset, comment,
  636. require_keys,
  637. engine_id, cmdname);
  638. if (ret)
  639. return ret;
  640. }
  641. return 0;
  642. }
  643. #ifdef CONFIG_FIT_SIGNATURE
  644. int fit_check_sign(const void *fit, const void *key)
  645. {
  646. int cfg_noffset;
  647. int ret;
  648. cfg_noffset = fit_conf_get_node(fit, NULL);
  649. if (!cfg_noffset)
  650. return -1;
  651. printf("Verifying Hash Integrity ... ");
  652. ret = fit_config_verify(fit, cfg_noffset);
  653. if (ret)
  654. return ret;
  655. ret = bootm_host_load_images(fit, cfg_noffset);
  656. return ret;
  657. }
  658. #endif