eaw/u-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

lib: rsa: decouple rsa from FIT image verification

Browse Source 
Introduce new configuration, CONFIG_RSA_VERIFY which will decouple building
RSA functions from FIT verification and allow for adding a RSA-based
signature verification for other file formats, in particular PE file
for UEFI secure boot.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
AKASHI Takahiro
2020-02-21 15:12:55 +09:00
committed by Tom Rini
parent d08b16edf8
commit b983cc2da0
11 changed files with 501 additions and 438 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
include/image.h
View File

@@ -1114,6 +1114,7 @@ int fit_conf_get_prop_node(const void *fit, int noffset,
int fit_check_ramdisk(const void *fit, int os_noffset,
uint8_t arch, int verify);
#endif /* IMAGE_ENABLE_FIT */
int calculate_hash(const void *data, int data_len, const char *algo,
uint8_t *value, int *value_len);
@@ -1126,16 +1127,20 @@ int calculate_hash(const void *data, int data_len, const char *algo,
# if defined(CONFIG_FIT_SIGNATURE)
# define IMAGE_ENABLE_SIGN 1
# define IMAGE_ENABLE_VERIFY 1
# define FIT_IMAGE_ENABLE_VERIFY 1
# include <openssl/evp.h>
# else
# define IMAGE_ENABLE_SIGN 0
# define IMAGE_ENABLE_VERIFY 0
# define FIT_IMAGE_ENABLE_VERIFY 0
# endif
#else
# define IMAGE_ENABLE_SIGN 0
# define IMAGE_ENABLE_VERIFY CONFIG_IS_ENABLED(FIT_SIGNATURE)
# define IMAGE_ENABLE_VERIFY CONFIG_IS_ENABLED(RSA_VERIFY)
# define FIT_IMAGE_ENABLE_VERIFY CONFIG_IS_ENABLED(FIT_SIGNATURE)
#endif
#if IMAGE_ENABLE_FIT
#ifdef USE_HOSTCC
void *image_get_host_blob(void);
void image_set_host_blob(void *host_blob);
@@ -1149,6 +1154,7 @@ void image_set_host_blob(void *host_blob);
#else
#define IMAGE_ENABLE_BEST_MATCH 0
#endif
#endif /* IMAGE_ENABLE_FIT */
/* Information passed to the signing routines */
struct image_sign_info {
@@ -1166,16 +1172,12 @@ struct image_sign_info {
const char *engine_id; /* Engine to use for signing */
};
#endif /* Allow struct image_region to always be defined for rsa.h */
/* A part of an image, used for hashing */
struct image_region {
const void *data;
int size;
};
#if IMAGE_ENABLE_FIT
#if IMAGE_ENABLE_VERIFY
# include <u-boot/rsa-checksum.h>
#endif
@@ -1276,6 +1278,8 @@ struct crypto_algo *image_get_crypto_algo(const char *full_name);
*/
struct padding_algo *image_get_padding_algo(const char *name);
#if IMAGE_ENABLE_FIT
/**
* fit_image_verify_required_sigs() - Verify signatures marked as 'required'
*