The iminfo command already verifies hashes of images. This change also verifies signatures of configurations if enabled. If FIT_REQUIRE_CONFIG_SIGS is enabled, iminfo also fails if signatures are missing.
While at it print "OK\n" in success case of fit_all_image_verify() too so iminfo output matches bootm. This will simplify the tests. Adjusts error output slightly to be on stderr Signed-off-by: Ludwig Nussel <[email protected]> Reviewed-by: Simon Glass <[email protected]> --- (no changes since v6) Changes in v6: - move 'ret' declaration to top of block Changes in v5: - rely on inline dummy for fit_all_configurations_verify - use CONFIG_IS_ENABLED(FIT_SIGNATURE) to guard fit_all_configurations_verify - print warning if /configurations node is missing - print "OK\n" in fit_all_image_verify() Changes in v4: - fix documentation to use kdoc style Changes in v3: - use log_err instead of printf in fit_config_verify_required_keys() - don't make iminfo fail unless FIT_SIGNATURE_REQUIRED is set - update fit_all_configurations_verify documentation - stub fit_all_configurations_verify unless FIT_SIGNATURES Changes in v2: - document fit_all_configurations_verify() boot/image-fit.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++- cmd/bootm.c | 10 +++++++++ include/image.h | 8 +++++++ 3 files changed, 72 insertions(+), 1 deletion(-) diff --git a/boot/image-fit.c b/boot/image-fit.c index 60e47db5fb0..ade8d706d55 100644 --- a/boot/image-fit.c +++ b/boot/image-fit.c @@ -1558,11 +1558,64 @@ int fit_all_image_verify(const void *fit) if (!fit_image_verify(fit, noffset)) return 0; - printf("\n"); + printf("OK\n"); } return 1; } +/** + * fit_all_configurations_verify() - verify signatures of all configurations + * @fit: pointer to the FIT format image header + * + * fit_all_configurations_verify() iterates over all configurations + * in the FIT and checks the signatures. Returns success if all + * configurations have valid signatures. See documentation at + * fit_config_verify_required_keys() or fit_config_verify_key(). + * + * Return: + * * 0, all configurations have valid signatures + * * -ENOENT, no configurations found + * * < 0, -errno + */ +#if CONFIG_IS_ENABLED(FIT_SIGNATURE) +int fit_all_configurations_verify(const void *fit) +{ + int confs_noffset; + int noffset; + int r = -ENOENT; + + /* Find configurations parent node offset */ + confs_noffset = fdt_path_offset(fit, FIT_CONFS_PATH); + if (confs_noffset < 0) { + log_info("Missing '%s' node: %s\n", + FIT_CONFS_PATH, fdt_strerror(confs_noffset)); + return r; + } + + /* Process all config subnodes, check signature for each */ + log_info("## Checking configuration signatures ...\n"); + + fdt_for_each_subnode(noffset, fit, confs_noffset) { + int ret; + + log_info(" %s ... ", fit_get_name(fit, noffset, NULL)); + ret = fit_config_verify(fit, noffset); + if (ret) { + r = ret; + log_err("FAIL\n"); + continue; + } + /* valid config found */ + if (r == -ENOENT) + r = 0; + + log_info("OK\n"); + } + + return r; +} +#endif + static int fit_image_uncipher(const void *fit, int image_noffset, void **data, size_t *size) { diff --git a/cmd/bootm.c b/cmd/bootm.c index 07fd995ebed..eb4c7c89d65 100644 --- a/cmd/bootm.c +++ b/cmd/bootm.c @@ -255,6 +255,9 @@ static int do_iminfo(struct cmd_tbl *cmdtp, int flag, int argc, static int image_info(ulong addr) { void *hdr = (void *)map_sysmem(addr, 0); +#if defined(CONFIG_FIT) + int ret; +#endif printf("\n## Checking Image at %08lx ...\n", addr); @@ -305,6 +308,13 @@ static int image_info(ulong addr) fit_print_contents(hdr); + ret = fit_all_configurations_verify(hdr); + if (ret != 0 && (ret != -ENOENT || + CONFIG_IS_ENABLED(FIT_REQUIRE_CONFIG_SIGS))) { + unmap_sysmem(hdr); + return 1; + } + if (!fit_all_image_verify(hdr)) { puts("Bad hash in FIT image!\n"); unmap_sysmem(hdr); diff --git a/include/image.h b/include/image.h index d991b4c2bc3..96b341a48e6 100644 --- a/include/image.h +++ b/include/image.h @@ -1488,6 +1488,14 @@ static inline int fit_config_verify_with_key_blob(const void *fit, } #endif int fit_all_image_verify(const void *fit); +#if CONFIG_IS_ENABLED(FIT_SIGNATURE) +int fit_all_configurations_verify(const void *fit); +#else +static inline int fit_all_configurations_verify(const void *fit) +{ + return 0; +} +#endif int fit_config_decrypt(const void *fit, int conf_noffset); int fit_image_check_os(const void *fit, int noffset, uint8_t os); int fit_image_check_arch(const void *fit, int noffset, uint8_t arch); -- 2.43.0
