]>
git.ipfire.org Git - thirdparty/u-boot.git/blob - tools/image-host.c
1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright (c) 2013, Google Inc.
5 * (C) Copyright 2008 Semihalf
7 * (C) Copyright 2000-2006
8 * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
13 #include <fdt_region.h>
18 * fit_set_hash_value - set hash value in requested has node
19 * @fit: pointer to the FIT format image header
20 * @noffset: hash node offset
21 * @value: hash value to be set
22 * @value_len: hash value length
24 * fit_set_hash_value() attempts to set hash value in a node at offset
25 * given and returns operation status to the caller.
31 static int fit_set_hash_value(void *fit
, int noffset
, uint8_t *value
,
36 ret
= fdt_setprop(fit
, noffset
, FIT_VALUE_PROP
, value
, value_len
);
38 printf("Can't set hash '%s' property for '%s' node(%s)\n",
39 FIT_VALUE_PROP
, fit_get_name(fit
, noffset
, NULL
),
41 return ret
== -FDT_ERR_NOSPACE
? -ENOSPC
: -EIO
;
48 * fit_image_process_hash - Process a single subnode of the images/ node
50 * Check each subnode and process accordingly. For hash nodes we generate
51 * a hash of the supplised data and store it in the node.
53 * @fit: pointer to the FIT format image header
54 * @image_name: name of image being processes (used to display errors)
55 * @noffset: subnode offset
56 * @data: data to process
57 * @size: size of data in bytes
58 * @return 0 if ok, -1 on error
60 static int fit_image_process_hash(void *fit
, const char *image_name
,
61 int noffset
, const void *data
, size_t size
)
63 uint8_t value
[FIT_MAX_HASH_LEN
];
64 const char *node_name
;
69 node_name
= fit_get_name(fit
, noffset
, NULL
);
71 if (fit_image_hash_get_algo(fit
, noffset
, &algo
)) {
72 printf("Can't get hash algo property for '%s' hash node in '%s' image node\n",
73 node_name
, image_name
);
77 if (calculate_hash(data
, size
, algo
, value
, &value_len
)) {
78 printf("Unsupported hash algorithm (%s) for '%s' hash node in '%s' image node\n",
79 algo
, node_name
, image_name
);
80 return -EPROTONOSUPPORT
;
83 ret
= fit_set_hash_value(fit
, noffset
, value
, value_len
);
85 printf("Can't set hash value for '%s' hash node in '%s' image node\n",
86 node_name
, image_name
);
94 * fit_image_write_sig() - write the signature to a FIT
96 * This writes the signature and signer data to the FIT.
98 * @fit: pointer to the FIT format image header
99 * @noffset: hash node offset
100 * @value: signature value to be set
101 * @value_len: signature value length
102 * @comment: Text comment to write (NULL for none)
106 * -FDT_ERR_..., on failure
108 static int fit_image_write_sig(void *fit
, int noffset
, uint8_t *value
,
109 int value_len
, const char *comment
, const char *region_prop
,
110 int region_proplen
, const char *cmdname
)
116 * Get the current string size, before we update the FIT and add
119 string_size
= fdt_size_dt_strings(fit
);
121 ret
= fdt_setprop(fit
, noffset
, FIT_VALUE_PROP
, value
, value_len
);
123 ret
= fdt_setprop_string(fit
, noffset
, "signer-name",
127 ret
= fdt_setprop_string(fit
, noffset
, "signer-version",
131 ret
= fdt_setprop_string(fit
, noffset
, "comment", comment
);
133 time_t timestamp
= imagetool_get_source_date(cmdname
,
136 ret
= fit_set_timestamp(fit
, noffset
, timestamp
);
138 if (region_prop
&& !ret
) {
141 ret
= fdt_setprop(fit
, noffset
, "hashed-nodes",
142 region_prop
, region_proplen
);
143 /* This is a legacy offset, it is unused, and must remain 0. */
145 strdata
[1] = cpu_to_fdt32(string_size
);
147 ret
= fdt_setprop(fit
, noffset
, "hashed-strings",
148 strdata
, sizeof(strdata
));
155 static int fit_image_setup_sig(struct image_sign_info
*info
,
156 const char *keydir
, void *fit
, const char *image_name
,
157 int noffset
, const char *require_keys
, const char *engine_id
)
159 const char *node_name
;
161 const char *padding_name
;
163 node_name
= fit_get_name(fit
, noffset
, NULL
);
164 if (fit_image_hash_get_algo(fit
, noffset
, &algo_name
)) {
165 printf("Can't get algo property for '%s' signature node in '%s' image node\n",
166 node_name
, image_name
);
170 padding_name
= fdt_getprop(fit
, noffset
, "padding", NULL
);
172 memset(info
, '\0', sizeof(*info
));
173 info
->keydir
= keydir
;
174 info
->keyname
= fdt_getprop(fit
, noffset
, FIT_KEY_HINT
, NULL
);
176 info
->node_offset
= noffset
;
177 info
->name
= strdup(algo_name
);
178 info
->checksum
= image_get_checksum_algo(algo_name
);
179 info
->crypto
= image_get_crypto_algo(algo_name
);
180 info
->padding
= image_get_padding_algo(padding_name
);
181 info
->require_keys
= require_keys
;
182 info
->engine_id
= engine_id
;
183 if (!info
->checksum
|| !info
->crypto
) {
184 printf("Unsupported signature algorithm (%s) for '%s' signature node in '%s' image node\n",
185 algo_name
, node_name
, image_name
);
193 * fit_image_process_sig- Process a single subnode of the images/ node
195 * Check each subnode and process accordingly. For signature nodes we
196 * generate a signed hash of the supplised data and store it in the node.
198 * @keydir: Directory containing keys to use for signing
199 * @keydest: Destination FDT blob to write public keys into
200 * @fit: pointer to the FIT format image header
201 * @image_name: name of image being processes (used to display errors)
202 * @noffset: subnode offset
203 * @data: data to process
204 * @size: size of data in bytes
205 * @comment: Comment to add to signature nodes
206 * @require_keys: Mark all keys as 'required'
207 * @engine_id: Engine to use for signing
208 * @return 0 if ok, -1 on error
210 static int fit_image_process_sig(const char *keydir
, void *keydest
,
211 void *fit
, const char *image_name
,
212 int noffset
, const void *data
, size_t size
,
213 const char *comment
, int require_keys
, const char *engine_id
,
216 struct image_sign_info info
;
217 struct image_region region
;
218 const char *node_name
;
223 if (fit_image_setup_sig(&info
, keydir
, fit
, image_name
, noffset
,
224 require_keys
? "image" : NULL
, engine_id
))
227 node_name
= fit_get_name(fit
, noffset
, NULL
);
230 ret
= info
.crypto
->sign(&info
, ®ion
, 1, &value
, &value_len
);
232 printf("Failed to sign '%s' signature node in '%s' image node: %d\n",
233 node_name
, image_name
, ret
);
235 /* We allow keys to be missing */
241 ret
= fit_image_write_sig(fit
, noffset
, value
, value_len
, comment
,
244 if (ret
== -FDT_ERR_NOSPACE
)
246 printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
247 node_name
, image_name
, fdt_strerror(ret
));
252 /* Get keyname again, as FDT has changed and invalidated our pointer */
253 info
.keyname
= fdt_getprop(fit
, noffset
, FIT_KEY_HINT
, NULL
);
256 * Write the public key into the supplied FDT file; this might fail
257 * several times, since we try signing with successively increasing
261 ret
= info
.crypto
->add_verify_data(&info
, keydest
);
263 printf("Failed to add verification data for '%s' signature node in '%s' image node\n",
264 node_name
, image_name
);
272 static int fit_image_read_data(char *filename
, unsigned char *data
,
280 fd
= open(filename
, O_RDONLY
| O_BINARY
);
282 printf("Can't open file %s (err=%d => %s)\n",
283 filename
, errno
, strerror(errno
));
287 /* Compute file size */
288 if (fstat(fd
, &sbuf
) < 0) {
289 printf("Can't fstat file %s (err=%d => %s)\n",
290 filename
, errno
, strerror(errno
));
294 /* Check file size */
295 if (sbuf
.st_size
!= expected_size
) {
296 printf("File %s don't have the expected size (size=%ld, expected=%d)\n",
297 filename
, sbuf
.st_size
, expected_size
);
302 n
= read(fd
, data
, sbuf
.st_size
);
304 printf("Can't read file %s (err=%d => %s)\n",
305 filename
, errno
, strerror(errno
));
309 /* Check that we have read all the file */
310 if (n
!= sbuf
.st_size
) {
311 printf("Can't read all file %s (read %zd bytes, expexted %ld)\n",
312 filename
, n
, sbuf
.st_size
);
323 static int fit_image_setup_cipher(struct image_cipher_info
*info
,
324 const char *keydir
, void *fit
,
325 const char *image_name
, int image_noffset
,
326 const char *node_name
, int noffset
)
332 if (fit_image_cipher_get_algo(fit
, noffset
, &algo_name
)) {
333 printf("Can't get algo name for cipher '%s' in image '%s'\n",
334 node_name
, image_name
);
338 info
->keydir
= keydir
;
340 /* Read the key name */
341 info
->keyname
= fdt_getprop(fit
, noffset
, FIT_KEY_HINT
, NULL
);
342 if (!info
->keyname
) {
343 printf("Can't get key name for cipher '%s' in image '%s'\n",
344 node_name
, image_name
);
348 /* Read the IV name */
349 info
->ivname
= fdt_getprop(fit
, noffset
, "iv-name-hint", NULL
);
351 printf("Can't get iv name for cipher '%s' in image '%s'\n",
352 node_name
, image_name
);
357 info
->node_noffset
= noffset
;
358 info
->name
= algo_name
;
360 info
->cipher
= image_get_cipher_algo(algo_name
);
362 printf("Can't get algo for cipher '%s'\n", image_name
);
366 /* Read the key in the file */
367 snprintf(filename
, sizeof(filename
), "%s/%s%s",
368 info
->keydir
, info
->keyname
, ".bin");
369 info
->key
= malloc(info
->cipher
->key_len
);
371 printf("Can't allocate memory for key\n");
375 ret
= fit_image_read_data(filename
, (unsigned char *)info
->key
,
376 info
->cipher
->key_len
);
380 /* Read the IV in the file */
381 snprintf(filename
, sizeof(filename
), "%s/%s%s",
382 info
->keydir
, info
->ivname
, ".bin");
383 info
->iv
= malloc(info
->cipher
->iv_len
);
385 printf("Can't allocate memory for iv\n");
389 ret
= fit_image_read_data(filename
, (unsigned char *)info
->iv
,
390 info
->cipher
->iv_len
);
396 int fit_image_write_cipher(void *fit
, int image_noffset
, int noffset
,
397 const void *data
, size_t size
,
398 unsigned char *data_ciphered
, int data_ciphered_len
)
402 /* Remove unciphered data */
403 ret
= fdt_delprop(fit
, image_noffset
, FIT_DATA_PROP
);
405 printf("Can't remove data (err = %d)\n", ret
);
409 /* Add ciphered data */
410 ret
= fdt_setprop(fit
, image_noffset
, FIT_DATA_PROP
,
411 data_ciphered
, data_ciphered_len
);
413 printf("Can't add ciphered data (err = %d)\n", ret
);
417 /* add non ciphered data size */
418 ret
= fdt_setprop_u32(fit
, image_noffset
, "data-size-unciphered", size
);
420 printf("Can't add unciphered data size (err = %d)\n", ret
);
429 fit_image_process_cipher(const char *keydir
, void *keydest
, void *fit
,
430 const char *image_name
, int image_noffset
,
431 const char *node_name
, int node_noffset
,
432 const void *data
, size_t size
,
435 struct image_cipher_info info
;
436 unsigned char *data_ciphered
= NULL
;
437 int data_ciphered_len
;
440 memset(&info
, 0, sizeof(info
));
442 ret
= fit_image_setup_cipher(&info
, keydir
, fit
, image_name
,
443 image_noffset
, node_name
, node_noffset
);
447 ret
= info
.cipher
->encrypt(&info
, data
, size
,
448 &data_ciphered
, &data_ciphered_len
);
453 * Write the public key into the supplied FDT file; this might fail
454 * several times, since we try signing with successively increasing
458 ret
= info
.cipher
->add_cipher_data(&info
, keydest
);
460 printf("Failed to add verification data for cipher '%s' in image '%s'\n",
461 info
.keyname
, image_name
);
466 ret
= fit_image_write_cipher(fit
, image_noffset
, node_noffset
,
468 data_ciphered
, data_ciphered_len
);
472 free((void *)info
.key
);
473 free((void *)info
.iv
);
477 int fit_image_cipher_data(const char *keydir
, void *keydest
,
478 void *fit
, int image_noffset
, const char *comment
,
479 int require_keys
, const char *engine_id
,
482 const char *image_name
;
488 image_name
= fit_get_name(fit
, image_noffset
, NULL
);
490 printf("Can't get image name\n");
494 /* Get image data and data length */
495 if (fit_image_get_data(fit
, image_noffset
, &data
, &size
)) {
496 printf("Can't get image data/size\n");
500 /* Process all hash subnodes of the component image node */
501 for (node_noffset
= fdt_first_subnode(fit
, image_noffset
);
503 node_noffset
= fdt_next_subnode(fit
, node_noffset
)) {
504 const char *node_name
;
507 node_name
= fit_get_name(fit
, node_noffset
, NULL
);
509 printf("Can't get node name\n");
513 if (IMAGE_ENABLE_ENCRYPT
&& keydir
&&
514 !strncmp(node_name
, FIT_CIPHER_NODENAME
,
515 strlen(FIT_CIPHER_NODENAME
)))
516 ret
= fit_image_process_cipher(keydir
, keydest
,
519 node_name
, node_noffset
,
520 data
, size
, cmdname
);
529 * fit_image_add_verification_data() - calculate/set verig. data for image node
531 * This adds hash and signature values for an component image node.
533 * All existing hash subnodes are checked, if algorithm property is set to
534 * one of the supported hash algorithms, hash value is computed and
535 * corresponding hash node property is set, for example:
537 * Input component image node structure:
539 * o image-1 (at image_noffset)
540 * | - data = [binary data]
544 * Output component image node structure:
546 * o image-1 (at image_noffset)
547 * | - data = [binary data]
550 * |- value = sha1(data)
552 * For signature details, please see doc/uImage.FIT/signature.txt
554 * @keydir Directory containing *.key and *.crt files (or NULL)
555 * @keydest FDT Blob to write public keys into (NULL if none)
556 * @fit: Pointer to the FIT format image header
557 * @image_noffset: Requested component image node
558 * @comment: Comment to add to signature nodes
559 * @require_keys: Mark all keys as 'required'
560 * @engine_id: Engine to use for signing
561 * @return: 0 on success, <0 on failure
563 int fit_image_add_verification_data(const char *keydir
, void *keydest
,
564 void *fit
, int image_noffset
, const char *comment
,
565 int require_keys
, const char *engine_id
, const char *cmdname
)
567 const char *image_name
;
572 /* Get image data and data length */
573 if (fit_image_get_data(fit
, image_noffset
, &data
, &size
)) {
574 printf("Can't get image data/size\n");
578 image_name
= fit_get_name(fit
, image_noffset
, NULL
);
580 /* Process all hash subnodes of the component image node */
581 for (noffset
= fdt_first_subnode(fit
, image_noffset
);
583 noffset
= fdt_next_subnode(fit
, noffset
)) {
584 const char *node_name
;
588 * Check subnode name, must be equal to "hash" or "signature".
589 * Multiple hash nodes require unique unit node
590 * names, e.g. hash-1, hash-2, signature-1, etc.
592 node_name
= fit_get_name(fit
, noffset
, NULL
);
593 if (!strncmp(node_name
, FIT_HASH_NODENAME
,
594 strlen(FIT_HASH_NODENAME
))) {
595 ret
= fit_image_process_hash(fit
, image_name
, noffset
,
597 } else if (IMAGE_ENABLE_SIGN
&& keydir
&&
598 !strncmp(node_name
, FIT_SIG_NODENAME
,
599 strlen(FIT_SIG_NODENAME
))) {
600 ret
= fit_image_process_sig(keydir
, keydest
,
601 fit
, image_name
, noffset
, data
, size
,
602 comment
, require_keys
, engine_id
, cmdname
);
616 static void strlist_init(struct strlist
*list
)
618 memset(list
, '\0', sizeof(*list
));
621 static void strlist_free(struct strlist
*list
)
625 for (i
= 0; i
< list
->count
; i
++)
626 free(list
->strings
[i
]);
630 static int strlist_add(struct strlist
*list
, const char *str
)
635 list
->strings
= realloc(list
->strings
,
636 (list
->count
+ 1) * sizeof(char *));
639 list
->strings
[list
->count
++] = dup
;
644 static const char *fit_config_get_image_list(void *fit
, int noffset
,
645 int *lenp
, int *allow_missingp
)
647 static const char default_list
[] = FIT_KERNEL_PROP
"\0"
651 /* If there is an "image" property, use that */
652 prop
= fdt_getprop(fit
, noffset
, "sign-images", lenp
);
655 return *lenp
? prop
: NULL
;
658 /* Default image list */
660 *lenp
= sizeof(default_list
);
665 static int fit_config_get_hash_list(void *fit
, int conf_noffset
,
666 int sig_offset
, struct strlist
*node_inc
)
669 const char *prop
, *iname
, *end
;
670 const char *conf_name
, *sig_name
;
671 char name
[200], path
[200];
675 conf_name
= fit_get_name(fit
, conf_noffset
, NULL
);
676 sig_name
= fit_get_name(fit
, sig_offset
, NULL
);
679 * Build a list of nodes we need to hash. We always need the root
680 * node and the configuration.
682 strlist_init(node_inc
);
683 snprintf(name
, sizeof(name
), "%s/%s", FIT_CONFS_PATH
, conf_name
);
684 if (strlist_add(node_inc
, "/") ||
685 strlist_add(node_inc
, name
))
688 /* Get a list of images that we intend to sign */
689 prop
= fit_config_get_image_list(fit
, sig_offset
, &len
,
694 /* Locate the images */
697 for (iname
= prop
; iname
< end
; iname
+= strlen(iname
) + 1) {
702 image_noffset
= fit_conf_get_prop_node(fit
, conf_noffset
,
704 if (image_noffset
< 0) {
705 printf("Failed to find image '%s' in configuration '%s/%s'\n",
706 iname
, conf_name
, sig_name
);
713 ret
= fdt_get_path(fit
, image_noffset
, path
, sizeof(path
));
716 if (strlist_add(node_inc
, path
))
719 snprintf(name
, sizeof(name
), "%s/%s", FIT_CONFS_PATH
,
722 /* Add all this image's hashes */
724 for (noffset
= fdt_first_subnode(fit
, image_noffset
);
726 noffset
= fdt_next_subnode(fit
, noffset
)) {
727 const char *name
= fit_get_name(fit
, noffset
, NULL
);
729 if (strncmp(name
, FIT_HASH_NODENAME
,
730 strlen(FIT_HASH_NODENAME
)))
732 ret
= fdt_get_path(fit
, noffset
, path
, sizeof(path
));
735 if (strlist_add(node_inc
, path
))
741 printf("Failed to find any hash nodes in configuration '%s/%s' image '%s' - without these it is not possible to verify this image\n",
742 conf_name
, sig_name
, iname
);
750 printf("Failed to find any images for configuration '%s/%s'\n",
751 conf_name
, sig_name
);
758 printf("Out of memory processing configuration '%s/%s'\n", conf_name
,
763 printf("Failed to get path for image '%s' in configuration '%s/%s': %s\n",
764 iname
, conf_name
, sig_name
, fdt_strerror(ret
));
768 static int fit_config_get_data(void *fit
, int conf_noffset
, int noffset
,
769 struct image_region
**regionp
, int *region_countp
,
770 char **region_propp
, int *region_proplen
)
772 char * const exc_prop
[] = {"data"};
773 struct strlist node_inc
;
774 struct image_region
*region
;
775 struct fdt_region fdt_regions
[100];
776 const char *conf_name
, *sig_name
;
782 conf_name
= fit_get_name(fit
, conf_noffset
, NULL
);
783 sig_name
= fit_get_name(fit
, noffset
, NULL
);
784 debug("%s: conf='%s', sig='%s'\n", __func__
, conf_name
, sig_name
);
786 /* Get a list of nodes we want to hash */
787 ret
= fit_config_get_hash_list(fit
, conf_noffset
, noffset
, &node_inc
);
791 /* Get a list of regions to hash */
792 count
= fdt_find_regions(fit
, node_inc
.strings
, node_inc
.count
,
793 exc_prop
, ARRAY_SIZE(exc_prop
),
794 fdt_regions
, ARRAY_SIZE(fdt_regions
),
795 path
, sizeof(path
), 1);
797 printf("Failed to hash configuration '%s/%s': %s\n", conf_name
,
798 sig_name
, fdt_strerror(ret
));
802 printf("No data to hash for configuration '%s/%s': %s\n",
803 conf_name
, sig_name
, fdt_strerror(ret
));
807 /* Build our list of data blocks */
808 region
= fit_region_make_list(fit
, fdt_regions
, count
, NULL
);
810 printf("Out of memory hashing configuration '%s/%s'\n",
811 conf_name
, sig_name
);
815 /* Create a list of all hashed properties */
816 debug("Hash nodes:\n");
817 for (i
= len
= 0; i
< node_inc
.count
; i
++) {
818 debug(" %s\n", node_inc
.strings
[i
]);
819 len
+= strlen(node_inc
.strings
[i
]) + 1;
821 region_prop
= malloc(len
);
823 printf("Out of memory setting up regions for configuration '%s/%s'\n",
824 conf_name
, sig_name
);
827 for (i
= len
= 0; i
< node_inc
.count
;
828 len
+= strlen(node_inc
.strings
[i
]) + 1, i
++)
829 strcpy(region_prop
+ len
, node_inc
.strings
[i
]);
830 strlist_free(&node_inc
);
832 *region_countp
= count
;
834 *region_propp
= region_prop
;
835 *region_proplen
= len
;
840 static int fit_config_process_sig(const char *keydir
, void *keydest
,
841 void *fit
, const char *conf_name
, int conf_noffset
,
842 int noffset
, const char *comment
, int require_keys
,
843 const char *engine_id
, const char *cmdname
)
845 struct image_sign_info info
;
846 const char *node_name
;
847 struct image_region
*region
;
855 node_name
= fit_get_name(fit
, noffset
, NULL
);
856 if (fit_config_get_data(fit
, conf_noffset
, noffset
, ®ion
,
857 ®ion_count
, ®ion_prop
, ®ion_proplen
))
860 if (fit_image_setup_sig(&info
, keydir
, fit
, conf_name
, noffset
,
861 require_keys
? "conf" : NULL
, engine_id
))
864 ret
= info
.crypto
->sign(&info
, region
, region_count
, &value
,
868 printf("Failed to sign '%s' signature node in '%s' conf node\n",
869 node_name
, conf_name
);
871 /* We allow keys to be missing */
877 ret
= fit_image_write_sig(fit
, noffset
, value
, value_len
, comment
,
878 region_prop
, region_proplen
, cmdname
);
880 if (ret
== -FDT_ERR_NOSPACE
)
882 printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
883 node_name
, conf_name
, fdt_strerror(ret
));
889 /* Get keyname again, as FDT has changed and invalidated our pointer */
890 info
.keyname
= fdt_getprop(fit
, noffset
, FIT_KEY_HINT
, NULL
);
892 /* Write the public key into the supplied FDT file */
894 ret
= info
.crypto
->add_verify_data(&info
, keydest
);
896 printf("Failed to add verification data for '%s' signature node in '%s' configuration node\n",
897 node_name
, conf_name
);
905 static int fit_config_add_verification_data(const char *keydir
, void *keydest
,
906 void *fit
, int conf_noffset
, const char *comment
,
907 int require_keys
, const char *engine_id
, const char *cmdname
)
909 const char *conf_name
;
912 conf_name
= fit_get_name(fit
, conf_noffset
, NULL
);
914 /* Process all hash subnodes of the configuration node */
915 for (noffset
= fdt_first_subnode(fit
, conf_noffset
);
917 noffset
= fdt_next_subnode(fit
, noffset
)) {
918 const char *node_name
;
921 node_name
= fit_get_name(fit
, noffset
, NULL
);
922 if (!strncmp(node_name
, FIT_SIG_NODENAME
,
923 strlen(FIT_SIG_NODENAME
))) {
924 ret
= fit_config_process_sig(keydir
, keydest
,
925 fit
, conf_name
, conf_noffset
, noffset
, comment
,
926 require_keys
, engine_id
, cmdname
);
935 int fit_cipher_data(const char *keydir
, void *keydest
, void *fit
,
936 const char *comment
, int require_keys
,
937 const char *engine_id
, const char *cmdname
)
943 /* Find images parent node offset */
944 images_noffset
= fdt_path_offset(fit
, FIT_IMAGES_PATH
);
945 if (images_noffset
< 0) {
946 printf("Can't find images parent node '%s' (%s)\n",
947 FIT_IMAGES_PATH
, fdt_strerror(images_noffset
));
948 return images_noffset
;
951 /* Process its subnodes, print out component images details */
952 for (noffset
= fdt_first_subnode(fit
, images_noffset
);
954 noffset
= fdt_next_subnode(fit
, noffset
)) {
956 * Direct child node of the images parent node,
957 * i.e. component image node.
959 ret
= fit_image_cipher_data(keydir
, keydest
,
960 fit
, noffset
, comment
,
961 require_keys
, engine_id
,
970 int fit_add_verification_data(const char *keydir
, void *keydest
, void *fit
,
971 const char *comment
, int require_keys
,
972 const char *engine_id
, const char *cmdname
)
974 int images_noffset
, confs_noffset
;
978 /* Find images parent node offset */
979 images_noffset
= fdt_path_offset(fit
, FIT_IMAGES_PATH
);
980 if (images_noffset
< 0) {
981 printf("Can't find images parent node '%s' (%s)\n",
982 FIT_IMAGES_PATH
, fdt_strerror(images_noffset
));
983 return images_noffset
;
986 /* Process its subnodes, print out component images details */
987 for (noffset
= fdt_first_subnode(fit
, images_noffset
);
989 noffset
= fdt_next_subnode(fit
, noffset
)) {
991 * Direct child node of the images parent node,
992 * i.e. component image node.
994 ret
= fit_image_add_verification_data(keydir
, keydest
,
995 fit
, noffset
, comment
, require_keys
, engine_id
,
1001 /* If there are no keys, we can't sign configurations */
1002 if (!IMAGE_ENABLE_SIGN
|| !keydir
)
1005 /* Find configurations parent node offset */
1006 confs_noffset
= fdt_path_offset(fit
, FIT_CONFS_PATH
);
1007 if (confs_noffset
< 0) {
1008 printf("Can't find images parent node '%s' (%s)\n",
1009 FIT_CONFS_PATH
, fdt_strerror(confs_noffset
));
1013 /* Process its subnodes, print out component images details */
1014 for (noffset
= fdt_first_subnode(fit
, confs_noffset
);
1016 noffset
= fdt_next_subnode(fit
, noffset
)) {
1017 ret
= fit_config_add_verification_data(keydir
, keydest
,
1018 fit
, noffset
, comment
,
1020 engine_id
, cmdname
);
1028 #ifdef CONFIG_FIT_SIGNATURE
1029 int fit_check_sign(const void *fit
, const void *key
,
1030 const char *fit_uname_config
)
1035 cfg_noffset
= fit_conf_get_node(fit
, fit_uname_config
);
1039 printf("Verifying Hash Integrity for node '%s'... ",
1040 fdt_get_name(fit
, cfg_noffset
, NULL
));
1041 ret
= fit_config_verify(fit
, cfg_noffset
);
1044 printf("Verified OK, loading images\n");
1045 ret
= bootm_host_load_images(fit
, cfg_noffset
);