1 /*
2 * Copyright (c) 2013, Google Inc.
3 *
4 * (C) Copyright 2008 Semihalf
5 *
6 * (C) Copyright 2000-2006
7 * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
8 *
9 * SPDX-License-Identifier: GPL-2.0+
10 */
11
12 #include "mkimage.h"
13 #include <bootm.h>
14 #include <image.h>
15 #include <version.h>
16
17 /**
18 * fit_set_hash_value - set hash value in requested has node
19 * @fit: pointer to the FIT format image header
20 * @noffset: hash node offset
21 * @value: hash value to be set
22 * @value_len: hash value length
23 *
24 * fit_set_hash_value() attempts to set hash value in a node at offset
25 * given and returns operation status to the caller.
26 *
27 * returns
28 * 0, on success
29 * -1, on failure
30 */
fit_set_hash_value(void * fit,int noffset,uint8_t * value,int value_len)31 static int fit_set_hash_value(void *fit, int noffset, uint8_t *value,
32 int value_len)
33 {
34 int ret;
35
36 ret = fdt_setprop(fit, noffset, FIT_VALUE_PROP, value, value_len);
37 if (ret) {
38 printf("Can't set hash '%s' property for '%s' node(%s)\n",
39 FIT_VALUE_PROP, fit_get_name(fit, noffset, NULL),
40 fdt_strerror(ret));
41 return ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO;
42 }
43
44 return 0;
45 }
46
47 /**
48 * fit_image_process_hash - Process a single subnode of the images/ node
49 *
50 * Check each subnode and process accordingly. For hash nodes we generate
51 * a hash of the supplised data and store it in the node.
52 *
53 * @fit: pointer to the FIT format image header
54 * @image_name: name of image being processes (used to display errors)
55 * @noffset: subnode offset
56 * @data: data to process
57 * @size: size of data in bytes
58 * @return 0 if ok, -1 on error
59 */
fit_image_process_hash(void * fit,const char * image_name,int noffset,const void * data,size_t size)60 static int fit_image_process_hash(void *fit, const char *image_name,
61 int noffset, const void *data, size_t size)
62 {
63 uint8_t value[FIT_MAX_HASH_LEN];
64 const char *node_name;
65 int value_len;
66 char *algo;
67 int ret;
68
69 node_name = fit_get_name(fit, noffset, NULL);
70
71 if (fit_image_hash_get_algo(fit, noffset, &algo)) {
72 printf("Can't get hash algo property for '%s' hash node in '%s' image node\n",
73 node_name, image_name);
74 return -ENOENT;
75 }
76
77 if (calculate_hash(data, size, algo, value, &value_len)) {
78 printf("Unsupported hash algorithm (%s) for '%s' hash node in '%s' image node\n",
79 algo, node_name, image_name);
80 return -EPROTONOSUPPORT;
81 }
82
83 ret = fit_set_hash_value(fit, noffset, value, value_len);
84 if (ret) {
85 printf("Can't set hash value for '%s' hash node in '%s' image node\n",
86 node_name, image_name);
87 return ret;
88 }
89
90 return 0;
91 }
92
93 /**
94 * fit_image_write_sig() - write the signature to a FIT
95 *
96 * This writes the signature and signer data to the FIT.
97 *
98 * @fit: pointer to the FIT format image header
99 * @noffset: hash node offset
100 * @value: signature value to be set
101 * @value_len: signature value length
102 * @comment: Text comment to write (NULL for none)
103 *
104 * returns
105 * 0, on success
106 * -FDT_ERR_..., on failure
107 */
fit_image_write_sig(void * fit,int noffset,uint8_t * value,int value_len,const char * comment,const char * region_prop,int region_proplen)108 static int fit_image_write_sig(void *fit, int noffset, uint8_t *value,
109 int value_len, const char *comment, const char *region_prop,
110 int region_proplen)
111 {
112 int string_size;
113 int ret;
114
115 /*
116 * Get the current string size, before we update the FIT and add
117 * more
118 */
119 string_size = fdt_size_dt_strings(fit);
120
121 ret = fdt_setprop(fit, noffset, FIT_VALUE_PROP, value, value_len);
122 if (!ret) {
123 ret = fdt_setprop_string(fit, noffset, "signer-name",
124 "mkimage");
125 }
126 if (!ret) {
127 ret = fdt_setprop_string(fit, noffset, "signer-version",
128 PLAIN_VERSION);
129 }
130 if (comment && !ret)
131 ret = fdt_setprop_string(fit, noffset, "comment", comment);
132 if (!ret)
133 ret = fit_set_timestamp(fit, noffset, time(NULL));
134 if (region_prop && !ret) {
135 uint32_t strdata[2];
136
137 ret = fdt_setprop(fit, noffset, "hashed-nodes",
138 region_prop, region_proplen);
139 strdata[0] = 0;
140 strdata[1] = cpu_to_fdt32(string_size);
141 if (!ret) {
142 ret = fdt_setprop(fit, noffset, "hashed-strings",
143 strdata, sizeof(strdata));
144 }
145 }
146
147 return ret;
148 }
149
fit_image_setup_sig(struct image_sign_info * info,const char * keydir,void * fit,const char * image_name,int noffset,const char * require_keys,const char * engine_id)150 static int fit_image_setup_sig(struct image_sign_info *info,
151 const char *keydir, void *fit, const char *image_name,
152 int noffset, const char *require_keys, const char *engine_id)
153 {
154 const char *node_name;
155 char *algo_name;
156 const char *padding_name;
157
158 node_name = fit_get_name(fit, noffset, NULL);
159 if (fit_image_hash_get_algo(fit, noffset, &algo_name)) {
160 printf("Can't get algo property for '%s' signature node in '%s' image node\n",
161 node_name, image_name);
162 return -1;
163 }
164
165 padding_name = fdt_getprop(fit, noffset, "padding", NULL);
166 if (!padding_name)
167 padding_name = "pkcs-1.5";
168 memset(info, '\0', sizeof(*info));
169 info->keydir = keydir;
170 info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
171 info->fit = fit;
172 info->node_offset = noffset;
173 info->name = algo_name;
174 info->checksum = image_get_checksum_algo(algo_name);
175 info->crypto = image_get_crypto_algo(algo_name);
176 info->padding = image_get_padding_algo(padding_name);
177 info->require_keys = require_keys;
178 info->engine_id = engine_id;
179 if (!info->checksum || !info->crypto) {
180 printf("Unsupported signature algorithm (%s) for '%s' signature node in '%s' image node\n",
181 algo_name, node_name, image_name);
182 return -1;
183 }
184
185 return 0;
186 }
187
188 /**
189 * fit_image_process_sig- Process a single subnode of the images/ node
190 *
191 * Check each subnode and process accordingly. For signature nodes we
192 * generate a signed hash of the supplised data and store it in the node.
193 *
194 * @keydir: Directory containing keys to use for signing
195 * @keydest: Destination FDT blob to write public keys into
196 * @fit: pointer to the FIT format image header
197 * @image_name: name of image being processes (used to display errors)
198 * @noffset: subnode offset
199 * @data: data to process
200 * @size: size of data in bytes
201 * @comment: Comment to add to signature nodes
202 * @require_keys: Mark all keys as 'required'
203 * @engine_id: Engine to use for signing
204 * @return 0 if ok, -1 on error
205 */
fit_image_process_sig(const char * keydir,void * keydest,void * fit,const char * image_name,int noffset,const void * data,size_t size,const char * comment,int require_keys,const char * engine_id)206 static int fit_image_process_sig(const char *keydir, void *keydest,
207 void *fit, const char *image_name,
208 int noffset, const void *data, size_t size,
209 const char *comment, int require_keys, const char *engine_id)
210 {
211 struct image_sign_info info;
212 struct image_region region;
213 const char *node_name;
214 uint8_t *value;
215 uint value_len;
216 int ret;
217
218 if (fit_image_setup_sig(&info, keydir, fit, image_name, noffset,
219 require_keys ? "image" : NULL, engine_id))
220 return -1;
221
222 node_name = fit_get_name(fit, noffset, NULL);
223 region.data = data;
224 region.size = size;
225 ret = info.crypto->sign(&info, ®ion, 1, &value, &value_len);
226 if (ret) {
227 printf("Failed to sign '%s' signature node in '%s' image node: %d\n",
228 node_name, image_name, ret);
229
230 /* We allow keys to be missing */
231 if (ret == -ENOENT)
232 return 0;
233 return -1;
234 }
235
236 ret = fit_image_write_sig(fit, noffset, value, value_len, comment,
237 NULL, 0);
238 if (ret) {
239 if (ret == -FDT_ERR_NOSPACE)
240 return -ENOSPC;
241 printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
242 node_name, image_name, fdt_strerror(ret));
243 return -1;
244 }
245 free(value);
246
247 /* Get keyname again, as FDT has changed and invalidated our pointer */
248 info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
249
250 if (keydest)
251 ret = info.crypto->add_verify_data(&info, keydest);
252 else
253 return -1;
254
255 /*
256 * Write the public key into the supplied FDT file; this might fail
257 * several times, since we try signing with successively increasing
258 * size values
259 */
260 if (keydest && ret)
261 return ret;
262
263 return 0;
264 }
265
266 /**
267 * fit_image_add_verification_data() - calculate/set verig. data for image node
268 *
269 * This adds hash and signature values for an component image node.
270 *
271 * All existing hash subnodes are checked, if algorithm property is set to
272 * one of the supported hash algorithms, hash value is computed and
273 * corresponding hash node property is set, for example:
274 *
275 * Input component image node structure:
276 *
277 * o image@1 (at image_noffset)
278 * | - data = [binary data]
279 * o hash@1
280 * |- algo = "sha1"
281 *
282 * Output component image node structure:
283 *
284 * o image@1 (at image_noffset)
285 * | - data = [binary data]
286 * o hash@1
287 * |- algo = "sha1"
288 * |- value = sha1(data)
289 *
290 * For signature details, please see doc/uImage.FIT/signature.txt
291 *
292 * @keydir Directory containing *.key and *.crt files (or NULL)
293 * @keydest FDT Blob to write public keys into (NULL if none)
294 * @fit: Pointer to the FIT format image header
295 * @image_noffset: Requested component image node
296 * @comment: Comment to add to signature nodes
297 * @require_keys: Mark all keys as 'required'
298 * @engine_id: Engine to use for signing
299 * @return: 0 on success, <0 on failure
300 */
fit_image_add_verification_data(const char * keydir,void * keydest,void * fit,int image_noffset,const char * comment,int require_keys,const char * engine_id)301 int fit_image_add_verification_data(const char *keydir, void *keydest,
302 void *fit, int image_noffset, const char *comment,
303 int require_keys, const char *engine_id)
304 {
305 const char *image_name;
306 const void *data;
307 size_t size;
308 int noffset;
309
310 /* Get image data and data length */
311 if (fit_image_get_data(fit, image_noffset, &data, &size)) {
312 printf("Can't get image data/size\n");
313 return -1;
314 }
315
316 image_name = fit_get_name(fit, image_noffset, NULL);
317
318 /* Process all hash subnodes of the component image node */
319 for (noffset = fdt_first_subnode(fit, image_noffset);
320 noffset >= 0;
321 noffset = fdt_next_subnode(fit, noffset)) {
322 const char *node_name;
323 int ret = 0;
324
325 /*
326 * Check subnode name, must be equal to "hash" or "signature".
327 * Multiple hash nodes require unique unit node
328 * names, e.g. hash@1, hash@2, signature@1, etc.
329 */
330 node_name = fit_get_name(fit, noffset, NULL);
331 if (!strncmp(node_name, FIT_HASH_NODENAME,
332 strlen(FIT_HASH_NODENAME))) {
333 ret = fit_image_process_hash(fit, image_name, noffset,
334 data, size);
335 } else if (IMAGE_ENABLE_SIGN && keydir &&
336 !strncmp(node_name, FIT_SIG_NODENAME,
337 strlen(FIT_SIG_NODENAME))) {
338 ret = fit_image_process_sig(keydir, keydest,
339 fit, image_name, noffset, data, size,
340 comment, require_keys, engine_id);
341 }
342 if (ret)
343 return ret;
344 }
345
346 return 0;
347 }
348
349 struct strlist {
350 int count;
351 char **strings;
352 };
353
strlist_init(struct strlist * list)354 static void strlist_init(struct strlist *list)
355 {
356 memset(list, '\0', sizeof(*list));
357 }
358
strlist_free(struct strlist * list)359 static void strlist_free(struct strlist *list)
360 {
361 int i;
362
363 for (i = 0; i < list->count; i++)
364 free(list->strings[i]);
365 free(list->strings);
366 }
367
strlist_add(struct strlist * list,const char * str)368 static int strlist_add(struct strlist *list, const char *str)
369 {
370 char *dup;
371
372 dup = strdup(str);
373 list->strings = realloc(list->strings,
374 (list->count + 1) * sizeof(char *));
375 if (!list || !str)
376 return -1;
377 list->strings[list->count++] = dup;
378
379 return 0;
380 }
381
fit_config_get_image_list(void * fit,int noffset,int * lenp,int * allow_missingp)382 static const char *fit_config_get_image_list(void *fit, int noffset,
383 int *lenp, int *allow_missingp)
384 {
385 static const char default_list[] = FIT_KERNEL_PROP "\0"
386 FIT_FDT_PROP;
387 const char *prop;
388
389 /* If there is an "image" property, use that */
390 prop = fdt_getprop(fit, noffset, "sign-images", lenp);
391 if (prop) {
392 *allow_missingp = 0;
393 return *lenp ? prop : NULL;
394 }
395
396 /* Default image list */
397 *allow_missingp = 1;
398 *lenp = sizeof(default_list);
399
400 return default_list;
401 }
402
fit_config_get_hash_list(void * fit,int conf_noffset,int sig_offset,struct strlist * node_inc)403 static int fit_config_get_hash_list(void *fit, int conf_noffset,
404 int sig_offset, struct strlist *node_inc)
405 {
406 int allow_missing;
407 const char *prop, *iname, *end;
408 const char *conf_name, *sig_name;
409 char name[200], path[200];
410 int image_count;
411 int ret, len;
412
413 conf_name = fit_get_name(fit, conf_noffset, NULL);
414 sig_name = fit_get_name(fit, sig_offset, NULL);
415
416 /*
417 * Build a list of nodes we need to hash. We always need the root
418 * node and the configuration.
419 */
420 strlist_init(node_inc);
421 snprintf(name, sizeof(name), "%s/%s", FIT_CONFS_PATH, conf_name);
422 if (strlist_add(node_inc, "/") ||
423 strlist_add(node_inc, FIT_CONFS_PATH) ||
424 strlist_add(node_inc, name))
425 goto err_mem;
426
427 /* Get a list of images that we intend to sign */
428 prop = fit_config_get_image_list(fit, sig_offset, &len,
429 &allow_missing);
430 if (!prop)
431 return 0;
432
433 /* Locate the images */
434 end = prop + len;
435 image_count = 0;
436 for (iname = prop; iname < end; iname += strlen(iname) + 1) {
437 int noffset;
438 int image_noffset;
439 int hash_count;
440 int i, max_index;
441
442 max_index = fdt_stringlist_count(fit, conf_noffset, iname);
443
444 for (i = 0; i < max_index; i++) {
445 image_noffset =
446 fit_conf_get_prop_node_index(fit, conf_noffset,
447 iname, i);
448 if (image_noffset < 0) {
449 if (i > 0)
450 break;
451
452 printf("Failed to find image '%s' in configuration '%s/%s'\n",
453 iname, conf_name, sig_name);
454 if (allow_missing)
455 continue;
456
457 return -ENOENT;
458 }
459
460 ret = fdt_get_path(fit, image_noffset, path, sizeof(path));
461 if (ret < 0)
462 goto err_path;
463 if (strlist_add(node_inc, path))
464 goto err_mem;
465
466 snprintf(name, sizeof(name), "%s/%s", FIT_CONFS_PATH,
467 conf_name);
468
469 /* Add all this image's hashes */
470 hash_count = 0;
471 for (noffset = fdt_first_subnode(fit, image_noffset);
472 noffset >= 0;
473 noffset = fdt_next_subnode(fit, noffset)) {
474 const char *name = fit_get_name(fit, noffset, NULL);
475
476 if (strncmp(name, FIT_HASH_NODENAME,
477 strlen(FIT_HASH_NODENAME)))
478 continue;
479 ret = fdt_get_path(fit, noffset, path, sizeof(path));
480 if (ret < 0)
481 goto err_path;
482 if (strlist_add(node_inc, path))
483 goto err_mem;
484 hash_count++;
485 }
486
487 if (!hash_count) {
488 printf("Failed to find any hash nodes in configuration '%s/%s' image '%s' - without these it is not possible to verify this image\n",
489 conf_name, sig_name, iname);
490 return -ENOMSG;
491 }
492
493 /* Add this image's cipher node if present */
494 noffset = fdt_subnode_offset(fit, image_noffset,
495 FIT_CIPHER_NODENAME);
496 if (noffset != -FDT_ERR_NOTFOUND) {
497 if (noffset < 0) {
498 fprintf(stderr,
499 "Failed to get cipher node in configuration '%s/%s' image '%s': %s\n",
500 conf_name, sig_name, iname,
501 fdt_strerror(noffset));
502 return -EIO;
503 }
504 ret = fdt_get_path(fit, noffset, path, sizeof(path));
505 if (ret < 0)
506 goto err_path;
507 if (strlist_add(node_inc, path))
508 goto err_mem;
509 }
510 image_count++;
511 }
512 }
513
514 if (!image_count) {
515 printf("Failed to find any images for configuration '%s/%s'\n",
516 conf_name, sig_name);
517 return -ENOMSG;
518 }
519
520 return 0;
521
522 err_mem:
523 printf("Out of memory processing configuration '%s/%s'\n", conf_name,
524 sig_name);
525 return -ENOMEM;
526
527 err_path:
528 printf("Failed to get path for image '%s' in configuration '%s/%s': %s\n",
529 iname, conf_name, sig_name, fdt_strerror(ret));
530 return -ENOENT;
531 }
532
fit_config_get_data(void * fit,int conf_noffset,int noffset,struct image_region ** regionp,int * region_countp,char ** region_propp,int * region_proplen)533 static int fit_config_get_data(void *fit, int conf_noffset, int noffset,
534 struct image_region **regionp, int *region_countp,
535 char **region_propp, int *region_proplen)
536 {
537 char * const exc_prop[] = {"data"};
538 struct strlist node_inc;
539 struct image_region *region;
540 struct fdt_region fdt_regions[100];
541 const char *conf_name, *sig_name;
542 char path[200];
543 int count, i;
544 char *region_prop;
545 int ret, len;
546
547 conf_name = fit_get_name(fit, conf_noffset, NULL);
548 sig_name = fit_get_name(fit, noffset, NULL);
549 debug("%s: conf='%s', sig='%s'\n", __func__, conf_name, sig_name);
550
551 /* Get a list of nodes we want to hash */
552 ret = fit_config_get_hash_list(fit, conf_noffset, noffset, &node_inc);
553 if (ret)
554 return ret;
555
556 /* Get a list of regions to hash */
557 count = fdt_find_regions(fit, node_inc.strings, node_inc.count,
558 exc_prop, ARRAY_SIZE(exc_prop),
559 fdt_regions, ARRAY_SIZE(fdt_regions),
560 path, sizeof(path), 1);
561 if (count < 0) {
562 printf("Failed to hash configuration '%s/%s': %s\n", conf_name,
563 sig_name, fdt_strerror(ret));
564 return -EIO;
565 }
566 if (count == 0) {
567 printf("No data to hash for configuration '%s/%s': %s\n",
568 conf_name, sig_name, fdt_strerror(ret));
569 return -EINVAL;
570 }
571
572 /* Build our list of data blocks */
573 region = fit_region_make_list(fit, fdt_regions, count, NULL);
574 if (!region) {
575 printf("Out of memory hashing configuration '%s/%s'\n",
576 conf_name, sig_name);
577 return -ENOMEM;
578 }
579
580 /* Create a list of all hashed properties */
581 debug("Hash nodes:\n");
582 for (i = len = 0; i < node_inc.count; i++) {
583 debug(" %s\n", node_inc.strings[i]);
584 len += strlen(node_inc.strings[i]) + 1;
585 }
586 region_prop = malloc(len);
587 if (!region_prop) {
588 printf("Out of memory setting up regions for configuration '%s/%s'\n",
589 conf_name, sig_name);
590 return -ENOMEM;
591 }
592 for (i = len = 0; i < node_inc.count;
593 len += strlen(node_inc.strings[i]) + 1, i++)
594 strcpy(region_prop + len, node_inc.strings[i]);
595 strlist_free(&node_inc);
596
597 *region_countp = count;
598 *regionp = region;
599 *region_propp = region_prop;
600 *region_proplen = len;
601
602 return 0;
603 }
604
fit_config_process_sig(const char * keydir,void * keydest,void * fit,const char * conf_name,int conf_noffset,int noffset,const char * comment,int require_keys,const char * engine_id)605 static int fit_config_process_sig(const char *keydir, void *keydest,
606 void *fit, const char *conf_name, int conf_noffset,
607 int noffset, const char *comment, int require_keys,
608 const char *engine_id)
609 {
610 struct image_sign_info info;
611 const char *node_name;
612 struct image_region *region;
613 char *region_prop;
614 int region_proplen;
615 int region_count;
616 uint8_t *value;
617 uint value_len;
618 int ret;
619
620 node_name = fit_get_name(fit, noffset, NULL);
621 if (fit_config_get_data(fit, conf_noffset, noffset, ®ion,
622 ®ion_count, ®ion_prop, ®ion_proplen))
623 return -1;
624
625 if (fit_image_setup_sig(&info, keydir, fit, conf_name, noffset,
626 require_keys ? "conf" : NULL, engine_id))
627 return -1;
628
629 ret = info.crypto->sign(&info, region, region_count, &value,
630 &value_len);
631 free(region);
632 if (ret) {
633 printf("Failed to sign '%s' signature node in '%s' conf node\n",
634 node_name, conf_name);
635 return -1;
636 }
637
638 ret = fit_image_write_sig(fit, noffset, value, value_len, comment,
639 region_prop, region_proplen);
640 if (ret) {
641 if (ret == -FDT_ERR_NOSPACE)
642 return -ENOSPC;
643 printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
644 node_name, conf_name, fdt_strerror(ret));
645 return -1;
646 }
647 free(value);
648 free(region_prop);
649
650 /* Get keyname again, as FDT has changed and invalidated our pointer */
651 info.keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
652
653 /* Write the public key into the supplied FDT file */
654 if (keydest) {
655 ret = info.crypto->add_verify_data(&info, keydest);
656 if (ret == -ENOSPC)
657 return -ENOSPC;
658 if (ret) {
659 printf("Failed to add verification data for '%s' signature node in '%s' image node\n",
660 node_name, conf_name);
661 }
662 return ret;
663 }
664
665 return 0;
666 }
667
fit_config_add_verification_data(const char * keydir,void * keydest,void * fit,int conf_noffset,const char * comment,int require_keys,const char * engine_id)668 static int fit_config_add_verification_data(const char *keydir, void *keydest,
669 void *fit, int conf_noffset, const char *comment,
670 int require_keys, const char *engine_id)
671 {
672 const char *conf_name;
673 int noffset;
674
675 conf_name = fit_get_name(fit, conf_noffset, NULL);
676
677 /* Process all hash subnodes of the configuration node */
678 for (noffset = fdt_first_subnode(fit, conf_noffset);
679 noffset >= 0;
680 noffset = fdt_next_subnode(fit, noffset)) {
681 const char *node_name;
682 int ret = 0;
683
684 node_name = fit_get_name(fit, noffset, NULL);
685 if (!strncmp(node_name, FIT_SIG_NODENAME,
686 strlen(FIT_SIG_NODENAME))) {
687 ret = fit_config_process_sig(keydir, keydest,
688 fit, conf_name, conf_noffset, noffset, comment,
689 require_keys, engine_id);
690 }
691 if (ret)
692 return ret;
693 }
694
695 return 0;
696 }
697
fit_add_verification_data(const char * keydir,void * keydest,void * fit,const char * comment,int require_keys,const char * engine_id)698 int fit_add_verification_data(const char *keydir, void *keydest, void *fit,
699 const char *comment, int require_keys,
700 const char *engine_id)
701 {
702 int images_noffset, confs_noffset;
703 int noffset;
704 int ret;
705
706 /* Find images parent node offset */
707 images_noffset = fdt_path_offset(fit, FIT_IMAGES_PATH);
708 if (images_noffset < 0) {
709 printf("Can't find images parent node '%s' (%s)\n",
710 FIT_IMAGES_PATH, fdt_strerror(images_noffset));
711 return images_noffset;
712 }
713
714 /* Process its subnodes, print out component images details */
715 for (noffset = fdt_first_subnode(fit, images_noffset);
716 noffset >= 0;
717 noffset = fdt_next_subnode(fit, noffset)) {
718 /*
719 * Direct child node of the images parent node,
720 * i.e. component image node.
721 */
722 ret = fit_image_add_verification_data(keydir, keydest,
723 fit, noffset, comment, require_keys, engine_id);
724 if (ret)
725 return ret;
726 }
727
728 /* If there are no keys, we can't sign configurations */
729 if (!IMAGE_ENABLE_SIGN || !keydir)
730 return 0;
731
732 /* Find configurations parent node offset */
733 confs_noffset = fdt_path_offset(fit, FIT_CONFS_PATH);
734 if (confs_noffset < 0) {
735 printf("Can't find images parent node '%s' (%s)\n",
736 FIT_CONFS_PATH, fdt_strerror(confs_noffset));
737 return -ENOENT;
738 }
739
740 /* Process its subnodes, print out component images details */
741 for (noffset = fdt_first_subnode(fit, confs_noffset);
742 noffset >= 0;
743 noffset = fdt_next_subnode(fit, noffset)) {
744 ret = fit_config_add_verification_data(keydir, keydest,
745 fit, noffset, comment,
746 require_keys,
747 engine_id);
748 if (ret)
749 return ret;
750 }
751
752 return 0;
753 }
754
755 #ifdef CONFIG_FIT_SIGNATURE
fit_check_sign(const void * fit,const void * key,int is_spl)756 int fit_check_sign(const void *fit, const void *key, int is_spl)
757 {
758 int cfg_noffset;
759 int ret;
760
761 cfg_noffset = fit_conf_get_node(fit, NULL);
762 if (!cfg_noffset)
763 return -1;
764
765 printf("Verifying Hash Integrity ... ");
766 ret = fit_config_verify(fit, cfg_noffset);
767 if (ret)
768 return ret;
769 ret = bootm_host_load_images(fit, cfg_noffset, is_spl);
770
771 return ret;
772 }
773 #endif
774