mkimage: Add -F option to modify an existing .fit file

When signing images it is sometimes necessary to sign with different keys
at different times, or make the signer entirely separate from the FIT
creation to avoid needing the private keys to be publicly available in
the system.

Add a -F option so that key signing can be a separate step, and possibly
done multiple times as different keys are avaiable.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Marek Vasut <marex@denx.de>

diff --git a/doc/mkimage.1 b/doc/mkimage.1
index 8185ff5647e43386af42e2293664d38c2823700d..f9c733a5e6212e5795dd3210294c5d4a28c226bc 100644 (file)
--- a/doc/mkimage.1
+++ b/doc/mkimage.1
@@ -9,6 +9,9 @@ mkimage \- Generate image for U-Boot
 .B mkimage
 .RB [\fIoptions\fP] " \-f [" "image tree source file" "]" " [" "uimage file name" "]"
 
+.B mkimage
+.RB [\fIoptions\fP] " \-F [" "uimage file name" "]"
+
 .B mkimage
 .RB [\fIoptions\fP] " (legacy mode)"
 
@@ -103,6 +106,13 @@ create the image.
 Image tree source file that describes the structure and contents of the
 FIT image.
 
+.TP
+.BI "\-F"
+Indicates that an existing FIT image should be modified. No dtc
+compilation is performed and the -f flag should not be given.
+This can be used to sign images with additional keys after initial image
+creation.
+
 .TP
 .BI "\-k [" "key_directory" "]"
 Specifies the directory containing keys to use for signing. This directory
@@ -144,6 +154,16 @@ skipping those for which keys cannot be found. Also add a comment.
 -c "Kernel 3.8 image for production devices" kernel.itb
 .fi
 
+.P
+Update an existing FIT image, signing it with additional keys.
+Add corresponding public keys into u-boot.dtb. This will resign all images
+with keys that are available in the new directory. Images that request signing
+with unavailable keys are skipped.
+.nf
+.B mkimage -F -k /secret/signing-keys -K u-boot.dtb \\\\
+-c "Kernel 3.8 image for production devices" kernel.itb
+.fi
+
 .SH HOMEPAGE
 http://www.denx.de/wiki/U-Boot/WebHome
 .PP

diff --git a/tools/fit_image.c b/tools/fit_image.c
index b17fa2d6c0247db447b7609ed4d6829f067b83b4..645e93c346e15e4e2756bbd395adbb160fe1ed65 100644 (file)
--- a/tools/fit_image.c
+++ b/tools/fit_image.c
@@ -124,10 +124,16 @@ static int fit_handle_file (struct mkimage_params *params)
        }
        sprintf (tmpfile, "%s%s", params->imagefile, MKIMAGE_TMPFILE_SUFFIX);
 
-       /* dtc -I dts -O dtb -p 500 datafile > tmpfile */
-       sprintf (cmd, "%s %s %s > %s",
-               MKIMAGE_DTC, params->dtc, params->datafile, tmpfile);
-       debug ("Trying to execute \"%s\"\n", cmd);
+       /* We either compile the source file, or use the existing FIT image */
+       if (params->datafile) {
+               /* dtc -I dts -O dtb -p 500 datafile > tmpfile */
+               snprintf(cmd, sizeof(cmd), "%s %s %s > %s",
+                        MKIMAGE_DTC, params->dtc, params->datafile, tmpfile);
+               debug("Trying to execute \"%s\"\n", cmd);
+       } else {
+               snprintf(cmd, sizeof(cmd), "cp %s %s",
+                        params->imagefile, tmpfile);
+       }
        if (system (cmd) == -1) {
                fprintf (stderr, "%s: system(%s) failed: %s\n",
                                params->cmdname, cmd, strerror(errno));
@@ -153,8 +159,8 @@ static int fit_handle_file (struct mkimage_params *params)
                goto err_add_hashes;
        }
 
-       /* add a timestamp at offset 0 i.e., root  */
-       if (fit_set_timestamp (ptr, 0, sbuf.st_mtime)) {
+       /* for first image creation, add a timestamp at offset 0 i.e., root  */
+       if (params->datafile && fit_set_timestamp(ptr, 0, sbuf.st_mtime)) {
                fprintf (stderr, "%s: Can't add image timestamp\n",
                                params->cmdname);
                goto err_add_timestamp;

diff --git a/tools/mkimage.c b/tools/mkimage.c
index 376039228a93d75b084f69cc83c9bbec05931833..e2b82d0c5c360af0b2fc9751db4f1ee85c46986e 100644 (file)
--- a/tools/mkimage.c
+++ b/tools/mkimage.c
@@ -240,12 +240,14 @@ main (int argc, char **argv)
                        case 'f':
                                if (--argc <= 0)
                                        usage ();
+                               params.datafile = *++argv;
+                               /* no break */
+                       case 'F':
                                /*
                                 * The flattened image tree (FIT) format
                                 * requires a flattened device tree image type
                                 */
                                params.type = IH_TYPE_FLATDT;
-                               params.datafile = *++argv;
                                params.fflag = 1;
                                goto NXTARG;
                        case 'k':
@@ -633,14 +635,15 @@ usage ()
                         "          -d ==> use image data from 'datafile'\n"
                         "          -x ==> set XIP (execute in place)\n",
                params.cmdname);
-       fprintf(stderr, "       %s [-D dtc_options] -f fit-image.its fit-image\n",
+       fprintf(stderr, "       %s [-D dtc_options] [-f fit-image.its|-F] fit-image\n",
                params.cmdname);
        fprintf(stderr, "          -D => set options for device tree compiler\n"
                        "          -f => input filename for FIT source\n");
 #ifdef CONFIG_FIT_SIGNATURE
        fprintf(stderr, "Signing / verified boot options: [-k keydir] [-K dtb]\n"
                        "          -k => set directory containing private keys\n"
-                       "          -K => write public keys to this .dtb file\n");
+                       "          -K => write public keys to this .dtb file\n"
+                       "          -F => re-sign existing FIT image\n");
 #else
        fprintf(stderr, "Signing / verified boot not supported (CONFIG_FIT_SIGNATURE undefined)\n");
 #endif