treewide: validate unified uImage.FIT images before flashing

Prevent flashing truncated or otherwise corrupted uImage.FIT images
by verifying checksums and hashes of all sub-images before flashing
using the newly packaged fit_check_sign tool.

Signed-off-by: Daniel Golle <[email protected]>

package/utils/fitblk/Makefile

@@ -16,6 +16,7 @@ define Package/fitblk
   SECTION:=base
   CATEGORY:=Base system
   TITLE:=fitblk firmware release tool
+  DEPENDS:=+fit-check-sign
 endef
 
 define Package/fitblk/description

package/utils/fitblk/files/fit.sh

@@ -61,3 +61,13 @@ fit_do_upgrade() {
 		;;
 	esac
 }
+
+fit_check_image() {
+	local magic="$(get_magic_long "$1")"
+	[ "$magic" != "d00dfeed" ] && {
+		echo "Invalid image type."
+		return 74
+	}
+
+	fit_check_sign -f "$1" >/dev/null || return 74
+}

target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh

@@ -1,5 +1,5 @@
 REQUIRE_IMAGE_METADATA=1
-RAMFS_COPY_BIN='fitblk'
+RAMFS_COPY_BIN='fitblk fit_check_sign'
 
 asus_initial_setup()
 {
@@ -224,11 +224,8 @@ platform_check_image() {
 	xiaomi,redmi-router-ax6000-ubootmod|\
 	xiaomi,mi-router-wr30u-ubootmod|\
 	zyxel,ex5601-t0-ubootmod)
-		[ "$magic" != "d00dfeed" ] && {
-			echo "Invalid image type."
-			return 1
-		}
-		return 0
+		fit_check_image "$1"
+		return $?
 		;;
 	nradio,c8-668gl)
 		# tar magic `ustar`

target/linux/mediatek/mt7622/base-files/lib/upgrade/platform.sh

@@ -1,5 +1,5 @@
 REQUIRE_IMAGE_METADATA=1
-RAMFS_COPY_BIN='fitblk'
+RAMFS_COPY_BIN='fitblk fit_check_sign'
 
 platform_do_upgrade() {
 	local board=$(board_name)

target/linux/mediatek/mt7623/base-files/lib/upgrade/platform.sh

@@ -1,5 +1,5 @@
 REQUIRE_IMAGE_METADATA=1
-RAMFS_COPY_BIN='fitblk'
+RAMFS_COPY_BIN='fitblk fit_check_sign'
 
 # Legacy full system upgrade including preloader for MediaTek SoCs on eMMC or SD
 legacy_mtk_mmc_full_upgrade() {

target/linux/siflower/sf21/base-files/lib/upgrade/platform.sh

@@ -1,5 +1,5 @@
 REQUIRE_IMAGE_METADATA=1
-RAMFS_COPY_BIN='fitblk'
+RAMFS_COPY_BIN='fitblk fit_check_sign'
 
 platform_do_upgrade() {
 	local board=$(board_name)
@@ -18,17 +18,13 @@ PART_NAME=firmware
 
 platform_check_image() {
 	local board=$(board_name)
-	local magic="$(get_magic_long "$1")"
 
 	[ "$#" -gt 1 ] && return 1
 
 	case "$board" in
 	*)
-		[ "$magic" != "d00dfeed" ] && {
-			echo "Invalid image type."
-			return 1
-		}
-		return 0
+		fit_check_image "$1"
+		return $?
 		;;
 	esac