mkimage: Support signing 'auto' FITs
This adds support for signing images in auto-generated FITs. To do this,
we need to add a signature node. The algorithm name property already has
its own option, but we need one for the key name hint. We could have
gone the -G route and added an explicit name for the public key (like
what is done for the private key). However, many places assume the
public key can be constructed from the key dir and hint, and I don't
want to do the refactoring necessary.
As a consequence of this, it is now easier to add public keys to an
existing image without signing something. This could be done all along,
but now you don't have to create an its just to do it. Ideally, we
wouldn't create a FIT at the end. This could be done by calling
fit_image_setup_sig/info.crypto->add_verify_data directly.
Signed-off-by: Sean Anderson <sean.anderson@seco.com>
diff --git a/doc/mkimage.1 b/doc/mkimage.1
index 878db90..759dc2d 100644
--- a/doc/mkimage.1
+++ b/doc/mkimage.1
@@ -219,6 +219,13 @@
instead of \-k.
.TP
+.BI "\-g [" "key_name_hint" "]"
+Sets the key-name-hint property when used with \-f auto. This is the <name>
+part of the key. The directory part is set by \-k. This option also indicates
+that the images included in the FIT should be signed. If this option is
+specified, \-o must be specified as well.
+
+.TP
.BI "\-o [" "signing algorithm" "]"
Specifies the algorithm to be used for signing a FIT image. The default is
taken from the signature node's 'algo' property.
@@ -279,6 +286,15 @@
.fi
.P
+Add public keys to u-boot.dtb without needing a FIT to sign. This will also
+create a FIT containing an images node with no data named unused.itb.
+.nf
+.B mkimage -f auto -d /dev/null -k /public/signing-keys -g dev \\\\
+.br
+.B -o sha256,rsa2048 -K u-boot.dtb unused.itb
+.fi
+
+.P
Update an existing FIT image, signing it with additional keys.
Add corresponding public keys into u-boot.dtb. This will resign all images
with keys that are available in the new directory. Images that request signing
@@ -306,6 +322,14 @@
.B -c """Kernel 4.4 image for production devices""" -d vmlinuz \\\\
.B -b /path/to/rk3288-firefly.dtb -b /path/to/rk3288-jerry.dtb kernel.itb
.fi
+.P
+Create a FIT image containing a signed kernel, using automatic mode. No .its
+file is required.
+.nf
+.B mkimage -f auto -A arm -O linux -T kernel -C none -a 43e00000 -e 0 \\\\
+.br
+.B -d vmlinuz -k /secret/signing-keys -g dev -o sha256,rsa2048 kernel.itb
+.fi
.SH HOMEPAGE
http://www.denx.de/wiki/U-Boot/WebHome
diff --git a/tools/fit_image.c b/tools/fit_image.c
index 1884a2eb..979f241 100644
--- a/tools/fit_image.c
+++ b/tools/fit_image.c
@@ -199,15 +199,36 @@
}
/**
- * add_crc_node() - Add a hash node to request a CRC checksum for an image
+ * add_hash_node() - Add a hash or signature node
*
+ * @params: Image parameters
* @fdt: Device tree to add to (in sequential-write mode)
+ *
+ * If there is a key name hint, try to sign the images. Otherwise, just add a
+ * CRC.
+ *
+ * Return: 0 on success, or -1 on failure
*/
-static void add_crc_node(void *fdt)
+static int add_hash_node(struct image_tool_params *params, void *fdt)
{
- fdt_begin_node(fdt, "hash-1");
- fdt_property_string(fdt, FIT_ALGO_PROP, "crc32");
+ if (params->keyname) {
+ if (!params->algo_name) {
+ fprintf(stderr,
+ "%s: Algorithm name must be specified\n",
+ params->cmdname);
+ return -1;
+ }
+
+ fdt_begin_node(fdt, "signature-1");
+ fdt_property_string(fdt, FIT_ALGO_PROP, params->algo_name);
+ fdt_property_string(fdt, FIT_KEY_HINT, params->keyname);
+ } else {
+ fdt_begin_node(fdt, "hash-1");
+ fdt_property_string(fdt, FIT_ALGO_PROP, "crc32");
+ }
+
fdt_end_node(fdt);
+ return 0;
}
/**
@@ -248,7 +269,9 @@
ret = fdt_property_file(params, fdt, FIT_DATA_PROP, params->datafile);
if (ret)
return ret;
- add_crc_node(fdt);
+ ret = add_hash_node(params, fdt);
+ if (ret)
+ return ret;
fdt_end_node(fdt);
/* Now the device tree files if available */
@@ -271,7 +294,9 @@
genimg_get_arch_short_name(params->arch));
fdt_property_string(fdt, FIT_COMP_PROP,
genimg_get_comp_short_name(IH_COMP_NONE));
- add_crc_node(fdt);
+ ret = add_hash_node(params, fdt);
+ if (ret)
+ return ret;
fdt_end_node(fdt);
}
@@ -289,7 +314,9 @@
params->fit_ramdisk);
if (ret)
return ret;
- add_crc_node(fdt);
+ ret = add_hash_node(params, fdt);
+ if (ret)
+ return ret;
fdt_end_node(fdt);
}
diff --git a/tools/imagetool.h b/tools/imagetool.h
index 05dd94d..ca7c2e4 100644
--- a/tools/imagetool.h
+++ b/tools/imagetool.h
@@ -71,6 +71,7 @@
const char *keydir; /* Directory holding private keys */
const char *keydest; /* Destination .dtb for public key */
const char *keyfile; /* Filename of private or public key */
+ const char *keyname; /* Key name "hint" */
const char *comment; /* Comment to add to signature node */
/* Algorithm name to use for hashing/signing or NULL to use the one
* specified in the its */
diff --git a/tools/mkimage.c b/tools/mkimage.c
index 5c6a60e..0e1198b 100644
--- a/tools/mkimage.c
+++ b/tools/mkimage.c
@@ -119,6 +119,7 @@
"Signing / verified boot options: [-k keydir] [-K dtb] [ -c <comment>] [-p addr] [-r] [-N engine]\n"
" -k => set directory containing private keys\n"
" -K => write public keys to this .dtb file\n"
+ " -g => set key name hint\n"
" -G => use this signing key (in lieu of -k)\n"
" -c => add comment in signature node\n"
" -F => re-sign existing FIT image\n"
@@ -163,7 +164,7 @@
int opt;
while ((opt = getopt(argc, argv,
- "a:A:b:B:c:C:d:D:e:Ef:FG:k:i:K:ln:N:p:o:O:rR:qstT:vVx")) != -1) {
+ "a:A:b:B:c:C:d:D:e:Ef:Fg:G:k:i:K:ln:N:p:o:O:rR:qstT:vVx")) != -1) {
switch (opt) {
case 'a':
params.addr = strtoull(optarg, &ptr, 16);
@@ -239,6 +240,8 @@
params.type = IH_TYPE_FLATDT;
params.fflag = 1;
break;
+ case 'g':
+ params.keyname = optarg;
case 'G':
params.keyfile = optarg;
break;