From 06bea4980980c05106944b0192f24700fe479f0b Mon Sep 17 00:00:00 2001 From: Dhananjay Phadke Date: Thu, 4 Jun 2020 16:43:59 -0700 Subject: tpm: add TPM2_GetRandom command support Add support for TPM2 GetRandom command Signed-off-by: Dhananjay Phadke Reviewed-by: Simon Glass --- include/tpm-v2.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'include') diff --git a/include/tpm-v2.h b/include/tpm-v2.h index d53d2e40239..f6c045d3548 100644 --- a/include/tpm-v2.h +++ b/include/tpm-v2.h @@ -70,6 +70,7 @@ enum tpm2_handles { * @TPM2_CC_DAM_RESET: TPM2_DictionaryAttackLockReset(). * @TPM2_CC_DAM_PARAMETERS: TPM2_DictionaryAttackParameters(). * @TPM2_CC_GET_CAPABILITY: TPM2_GetCapibility(). + * @TPM2_CC_GET_RANDOM: TPM2_GetRandom(). * @TPM2_CC_PCR_READ: TPM2_PCR_Read(). * @TPM2_CC_PCR_EXTEND: TPM2_PCR_Extend(). * @TPM2_CC_PCR_SETAUTHVAL: TPM2_PCR_SetAuthValue(). @@ -85,6 +86,7 @@ enum tpm2_command_codes { TPM2_CC_DAM_PARAMETERS = 0x013A, TPM2_CC_NV_READ = 0x014E, TPM2_CC_GET_CAPABILITY = 0x017A, + TPM2_CC_GET_RANDOM = 0x017B, TPM2_CC_PCR_READ = 0x017E, TPM2_CC_PCR_EXTEND = 0x0182, TPM2_CC_PCR_SETAUTHVAL = 0x0183, @@ -339,4 +341,15 @@ u32 tpm2_pcr_setauthvalue(struct udevice *dev, const char *pw, const ssize_t pw_sz, u32 index, const char *key, const ssize_t key_sz); +/** + * Issue a TPM2_GetRandom command. + * + * @dev TPM device + * @param data output buffer for the random bytes + * @param count size of output buffer + * + * @return return code of the operation + */ +u32 tpm2_get_random(struct udevice *dev, void *data, u32 count); + #endif /* __TPM_V2_H */ -- cgit v1.3.1 From ce6515ecee1fa060a7a4e79eafc8db5f86d259a0 Mon Sep 17 00:00:00 2001 From: Stefan Roese Date: Fri, 15 May 2020 07:09:03 +0200 Subject: debug_uart: Add CR before and after announce string Add linefeeds before and after the announce string. This makes the output easier to read, especially if some text follows the announce message without a specific additional CR. Signed-off-by: Stefan Roese Reviewed-by: Bin Meng --- include/debug_uart.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/debug_uart.h b/include/debug_uart.h index 4d1c58075cf..714b369e6fe 100644 --- a/include/debug_uart.h +++ b/include/debug_uart.h @@ -112,7 +112,7 @@ void printhex8(unsigned int value); void printdec(unsigned int value); #ifdef CONFIG_DEBUG_UART_ANNOUNCE -#define _DEBUG_UART_ANNOUNCE printascii(" "); +#define _DEBUG_UART_ANNOUNCE printascii("\n\n"); #else #define _DEBUG_UART_ANNOUNCE #endif -- cgit v1.3.1 From 146a17ad64e2132222d7134b6961b26817faa3bd Mon Sep 17 00:00:00 2001 From: Dario Binacchi Date: Wed, 27 May 2020 13:56:18 +0200 Subject: spl: fix format of function documentation U-Boot adopted the kernel-doc annotation style. cc: Michael Trimarchi Signed-off-by: Dario Binacchi Reviewed-by: Simon Glass --- include/spl.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/spl.h b/include/spl.h index b31c9bb4ab2..580e4e024fd 100644 --- a/include/spl.h +++ b/include/spl.h @@ -155,7 +155,7 @@ struct spl_image_info { #endif }; -/* +/** * Information required to load data from a device * * @dev: Pointer to the device, e.g. struct mmc * -- cgit v1.3.1 From 9f6a14c47ff95354185248ea6e7b1c695e64939e Mon Sep 17 00:00:00 2001 From: Dario Binacchi Date: Wed, 27 May 2020 13:56:20 +0200 Subject: spl: fit: nand: fix fit loading in case of bad blocks The offset at which the image to be loaded from NAND is located is retrieved from the itb header. The presence of bad blocks in the area of the NAND where the itb image is located could invalidate the offset which must therefore be adjusted taking into account the state of the sectors concerned. cc: Michael Trimarchi Signed-off-by: Dario Binacchi Reviewed-by: Michael Trimarchi --- common/spl/spl_nand.c | 5 ++++- drivers/mtd/nand/raw/nand_spl_loaders.c | 28 ++++++++++++++++++++++++++++ include/nand.h | 1 + 3 files changed, 33 insertions(+), 1 deletion(-) (limited to 'include') diff --git a/common/spl/spl_nand.c b/common/spl/spl_nand.c index 48c97549eb9..1e6f2dce569 100644 --- a/common/spl/spl_nand.c +++ b/common/spl/spl_nand.c @@ -42,8 +42,11 @@ static int spl_nand_load_image(struct spl_image_info *spl_image, static ulong spl_nand_fit_read(struct spl_load_info *load, ulong offs, ulong size, void *dst) { + ulong sector; int ret; + sector = *(int *)load->priv; + offs = sector + nand_spl_adjust_offset(sector, offs - sector); ret = nand_spl_load_image(offs, size, dst); if (!ret) return size; @@ -66,7 +69,7 @@ static int spl_nand_load_element(struct spl_image_info *spl_image, debug("Found FIT\n"); load.dev = NULL; - load.priv = NULL; + load.priv = &offset; load.filename = NULL; load.bl_len = 1; load.read = spl_nand_fit_read; diff --git a/drivers/mtd/nand/raw/nand_spl_loaders.c b/drivers/mtd/nand/raw/nand_spl_loaders.c index 177c12b5815..4befc75c047 100644 --- a/drivers/mtd/nand/raw/nand_spl_loaders.c +++ b/drivers/mtd/nand/raw/nand_spl_loaders.c @@ -41,6 +41,34 @@ int nand_spl_load_image(uint32_t offs, unsigned int size, void *dst) return 0; } +/** + * nand_spl_adjust_offset - Adjust offset from a starting sector + * @sector: Address of the sector + * @offs: Offset starting from @sector + * + * If one or more bad blocks are in the address space between @sector + * and @sector + @offs, @offs is increased by the NAND block size for + * each bad block found. + */ +u32 nand_spl_adjust_offset(u32 sector, u32 offs) +{ + unsigned int block, lastblock; + + block = sector / CONFIG_SYS_NAND_BLOCK_SIZE; + lastblock = (sector + offs) / CONFIG_SYS_NAND_BLOCK_SIZE; + + while (block <= lastblock) { + if (nand_is_bad_block(block)) { + offs += CONFIG_SYS_NAND_BLOCK_SIZE; + lastblock++; + } + + block++; + } + + return offs; +} + #ifdef CONFIG_SPL_UBI /* * Temporary storage for non NAND page aligned and non NAND page sized diff --git a/include/nand.h b/include/nand.h index 93cbe1e25db..80dd6469bc0 100644 --- a/include/nand.h +++ b/include/nand.h @@ -120,6 +120,7 @@ int nand_unlock(struct mtd_info *mtd, loff_t start, size_t length, int allexcept); int nand_get_lock_status(struct mtd_info *mtd, loff_t offset); +u32 nand_spl_adjust_offset(u32 sector, u32 offs); int nand_spl_load_image(uint32_t offs, unsigned int size, void *dst); int nand_spl_read_block(int block, int offset, int len, void *dst); void nand_deselect(void); -- cgit v1.3.1 From 3428faf23af5079e80c53d0d8473af30d3c19fca Mon Sep 17 00:00:00 2001 From: Simon Glass Date: Tue, 2 Jun 2020 19:26:44 -0600 Subject: Update MEM_SUPPORT_64BIT_DATA to be always defined Define this macro always so we don't need the preprocessor to check it. Convert the users to #if instead of #ifdef. Note that '#if MEM_SUPPORT_64BIT_DATA' does not give an error if the macro is not define. It just assumes zero. Signed-off-by: Simon Glass Reviewed-by: Stefan Roese --- cmd/mem.c | 54 +++++++++++++++++++++++++-------------------------- common/command.c | 2 +- include/compiler.h | 4 +++- lib/display_options.c | 6 +++--- 4 files changed, 34 insertions(+), 32 deletions(-) (limited to 'include') diff --git a/cmd/mem.c b/cmd/mem.c index 9b97f7bf694..fe43427d3cf 100644 --- a/cmd/mem.c +++ b/cmd/mem.c @@ -116,7 +116,7 @@ static int do_mem_nm(struct cmd_tbl *cmdtp, int flag, int argc, static int do_mem_mw(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) { -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA u64 writeval; #else ulong writeval; @@ -141,7 +141,7 @@ static int do_mem_mw(struct cmd_tbl *cmdtp, int flag, int argc, /* Get the value to write. */ -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA writeval = simple_strtoull(argv[2], NULL, 16); #else writeval = simple_strtoul(argv[2], NULL, 16); @@ -160,7 +160,7 @@ static int do_mem_mw(struct cmd_tbl *cmdtp, int flag, int argc, while (count-- > 0) { if (size == 4) *((u32 *)buf) = (u32)writeval; -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA else if (size == 8) *((u64 *)buf) = (u64)writeval; #endif @@ -240,7 +240,7 @@ static int do_mem_cmp(struct cmd_tbl *cmdtp, int flag, int argc, int rcode = 0; const char *type; const void *buf1, *buf2, *base; -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA u64 word1, word2; #else ulong word1, word2; @@ -272,7 +272,7 @@ static int do_mem_cmp(struct cmd_tbl *cmdtp, int flag, int argc, if (size == 4) { word1 = *(u32 *)buf1; word2 = *(u32 *)buf2; -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA } else if (size == 8) { word1 = *(u64 *)buf1; word2 = *(u64 *)buf2; @@ -286,7 +286,7 @@ static int do_mem_cmp(struct cmd_tbl *cmdtp, int flag, int argc, } if (word1 != word2) { ulong offset = buf1 - base; -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA printf("%s at 0x%p (%#0*llx) != %s at 0x%p (%#0*llx)\n", type, (void *)(addr1 + offset), size, word1, type, (void *)(addr2 + offset), size, word2); @@ -391,7 +391,7 @@ static int do_mem_loop(struct cmd_tbl *cmdtp, int flag, int argc, { ulong addr, length, i, bytes; int size; -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA volatile u64 *llp; #endif volatile u32 *longp; @@ -424,7 +424,7 @@ static int do_mem_loop(struct cmd_tbl *cmdtp, int flag, int argc, * If we have only one object, just run infinite loops. */ if (length == 1) { -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA if (size == 8) { llp = (u64 *)buf; for (;;) @@ -446,7 +446,7 @@ static int do_mem_loop(struct cmd_tbl *cmdtp, int flag, int argc, i = *cp; } -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA if (size == 8) { for (;;) { llp = (u64 *)buf; @@ -489,7 +489,7 @@ static int do_mem_loopw(struct cmd_tbl *cmdtp, int flag, int argc, { ulong addr, length, i, bytes; int size; -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA volatile u64 *llp; u64 data; #else @@ -519,7 +519,7 @@ static int do_mem_loopw(struct cmd_tbl *cmdtp, int flag, int argc, length = simple_strtoul(argv[2], NULL, 16); /* data to write */ -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA data = simple_strtoull(argv[3], NULL, 16); #else data = simple_strtoul(argv[3], NULL, 16); @@ -532,7 +532,7 @@ static int do_mem_loopw(struct cmd_tbl *cmdtp, int flag, int argc, * If we have only one object, just run infinite loops. */ if (length == 1) { -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA if (size == 8) { llp = (u64 *)buf; for (;;) @@ -554,7 +554,7 @@ static int do_mem_loopw(struct cmd_tbl *cmdtp, int flag, int argc, *cp = data; } -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA if (size == 8) { for (;;) { llp = (u64 *)buf; @@ -1023,7 +1023,7 @@ mod_mem(struct cmd_tbl *cmdtp, int incrflag, int flag, int argc, char *const argv[]) { ulong addr; -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA u64 i; #else ulong i; @@ -1062,7 +1062,7 @@ mod_mem(struct cmd_tbl *cmdtp, int incrflag, int flag, int argc, printf("%08lx:", addr); if (size == 4) printf(" %08x", *((u32 *)ptr)); -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA else if (size == 8) printf(" %016llx", *((u64 *)ptr)); #endif @@ -1089,7 +1089,7 @@ mod_mem(struct cmd_tbl *cmdtp, int incrflag, int flag, int argc, #endif else { char *endp; -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA i = simple_strtoull(console_buffer, &endp, 16); #else i = simple_strtoul(console_buffer, &endp, 16); @@ -1101,7 +1101,7 @@ mod_mem(struct cmd_tbl *cmdtp, int incrflag, int flag, int argc, bootretry_reset_cmd_timeout(); if (size == 4) *((u32 *)ptr) = i; -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA else if (size == 8) *((u64 *)ptr) = i; #endif @@ -1196,7 +1196,7 @@ static int do_random(struct cmd_tbl *cmdtp, int flag, int argc, U_BOOT_CMD( md, 3, 1, do_mem_md, "memory display", -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA "[.b, .w, .l, .q] address [# of objects]" #else "[.b, .w, .l] address [# of objects]" @@ -1207,7 +1207,7 @@ U_BOOT_CMD( U_BOOT_CMD( mm, 2, 1, do_mem_mm, "memory modify (auto-incrementing address)", -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA "[.b, .w, .l, .q] address" #else "[.b, .w, .l] address" @@ -1218,7 +1218,7 @@ U_BOOT_CMD( U_BOOT_CMD( nm, 2, 1, do_mem_nm, "memory modify (constant address)", -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA "[.b, .w, .l, .q] address" #else "[.b, .w, .l] address" @@ -1228,7 +1228,7 @@ U_BOOT_CMD( U_BOOT_CMD( mw, 4, 1, do_mem_mw, "memory write (fill)", -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA "[.b, .w, .l, .q] address value [count]" #else "[.b, .w, .l] address value [count]" @@ -1238,7 +1238,7 @@ U_BOOT_CMD( U_BOOT_CMD( cp, 4, 1, do_mem_cp, "memory copy", -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA "[.b, .w, .l, .q] source target count" #else "[.b, .w, .l] source target count" @@ -1248,7 +1248,7 @@ U_BOOT_CMD( U_BOOT_CMD( cmp, 4, 1, do_mem_cmp, "memory compare", -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA "[.b, .w, .l, .q] addr1 addr2 count" #else "[.b, .w, .l] addr1 addr2 count" @@ -1299,7 +1299,7 @@ U_BOOT_CMD( U_BOOT_CMD( loop, 3, 1, do_mem_loop, "infinite loop on address range", -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA "[.b, .w, .l, .q] address number_of_objects" #else "[.b, .w, .l] address number_of_objects" @@ -1310,7 +1310,7 @@ U_BOOT_CMD( U_BOOT_CMD( loopw, 4, 1, do_mem_loopw, "infinite write loop on address range", -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA "[.b, .w, .l, .q] address number_of_objects data_to_write" #else "[.b, .w, .l] address number_of_objects data_to_write" @@ -1330,7 +1330,7 @@ U_BOOT_CMD( U_BOOT_CMD( mdc, 4, 1, do_mem_mdc, "memory display cyclic", -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA "[.b, .w, .l, .q] address count delay(ms)" #else "[.b, .w, .l] address count delay(ms)" @@ -1340,7 +1340,7 @@ U_BOOT_CMD( U_BOOT_CMD( mwc, 4, 1, do_mem_mwc, "memory write cyclic", -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA "[.b, .w, .l, .q] address value delay(ms)" #else "[.b, .w, .l] address value delay(ms)" diff --git a/common/command.c b/common/command.c index 4f49f15bfdf..fc37ed4d7c8 100644 --- a/common/command.c +++ b/common/command.c @@ -473,7 +473,7 @@ int cmd_get_data_size(char* arg, int default_size) return 2; case 'l': return 4; -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA case 'q': return 8; #endif diff --git a/include/compiler.h b/include/compiler.h index ed74c272b8c..90b7afae537 100644 --- a/include/compiler.h +++ b/include/compiler.h @@ -145,7 +145,9 @@ typedef unsigned long int uintptr_t; #define unlikely(x) __builtin_expect(!!(x), 0) #ifdef __LP64__ -#define MEM_SUPPORT_64BIT_DATA +#define MEM_SUPPORT_64BIT_DATA 1 +#else +#define MEM_SUPPORT_64BIT_DATA 0 #endif #endif diff --git a/lib/display_options.c b/lib/display_options.c index 1dd5b6affdc..f4b1059c244 100644 --- a/lib/display_options.c +++ b/lib/display_options.c @@ -138,7 +138,7 @@ int print_buffer(ulong addr, const void *data, uint width, uint count, { /* linebuf as a union causes proper alignment */ union linebuf { -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA uint64_t uq[MAX_LINE_LENGTH_BYTES/sizeof(uint64_t) + 1]; #endif uint32_t ui[MAX_LINE_LENGTH_BYTES/sizeof(uint32_t) + 1]; @@ -146,7 +146,7 @@ int print_buffer(ulong addr, const void *data, uint width, uint count, uint8_t uc[MAX_LINE_LENGTH_BYTES/sizeof(uint8_t) + 1]; } lb; int i; -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA uint64_t __maybe_unused x; #else uint32_t __maybe_unused x; @@ -169,7 +169,7 @@ int print_buffer(ulong addr, const void *data, uint width, uint count, for (i = 0; i < thislinelen; i++) { if (width == 4) x = lb.ui[i] = *(volatile uint32_t *)data; -#ifdef MEM_SUPPORT_64BIT_DATA +#if MEM_SUPPORT_64BIT_DATA else if (width == 8) x = lb.uq[i] = *(volatile uint64_t *)data; #endif -- cgit v1.3.1 From c89b41b4db4a746647c4f0e6d33c6f4edfe96e38 Mon Sep 17 00:00:00 2001 From: Heiko Stuebner Date: Fri, 22 May 2020 16:20:33 +0200 Subject: lib: rsa: function to verify a signature against a hash rsa_verify() expects a memory region and wants to do the hashing itself, but there may be cases where the hashing is done via other means, like hashing a squashfs rootfs. So add rsa_verify_hash() to allow verifiying a signature against an existing hash. As this entails the same verification routines we can just move the relevant code over from rsa_verify() and also call rsa_verify_hash() from there. Signed-off-by: Heiko Stuebner --- include/u-boot/rsa.h | 21 ++++++++++++++++++++ lib/rsa/rsa-verify.c | 56 ++++++++++++++++++++++++++++++---------------------- 2 files changed, 53 insertions(+), 24 deletions(-) (limited to 'include') diff --git a/include/u-boot/rsa.h b/include/u-boot/rsa.h index 2d3024d8b71..a0bae495f05 100644 --- a/include/u-boot/rsa.h +++ b/include/u-boot/rsa.h @@ -82,6 +82,20 @@ static inline int rsa_add_verify_data(struct image_sign_info *info, #endif #if IMAGE_ENABLE_VERIFY +/** + * rsa_verify_hash() - Verify a signature against a hash + * + * Verify a RSA PKCS1.5 signature against an expected hash. + * + * @info: Specifies key and FIT information + * @hash: Hash according to algorithm specified in @info + * @sig: Signature + * @sig_len: Number of bytes in signature + * @return 0 if verified, -ve on error + */ +int rsa_verify_hash(struct image_sign_info *info, + const uint8_t *hash, uint8_t *sig, uint sig_len); + /** * rsa_verify() - Verify a signature against some data * @@ -108,6 +122,13 @@ int padding_pss_verify(struct image_sign_info *info, const uint8_t *hash, int hash_len); #endif /* CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT */ #else +static inline int rsa_verify_hash(struct image_sign_info *info, + const uint8_t *hash, + uint8_t *sig, uint sig_len) +{ + return -ENXIO; +} + static inline int rsa_verify(struct image_sign_info *info, const struct image_region region[], int region_count, uint8_t *sig, uint sig_len) diff --git a/lib/rsa/rsa-verify.c b/lib/rsa/rsa-verify.c index 61d98e6e2d5..6c4bbc46250 100644 --- a/lib/rsa/rsa-verify.c +++ b/lib/rsa/rsa-verify.c @@ -478,33 +478,11 @@ static int rsa_verify_with_keynode(struct image_sign_info *info, } #endif -int rsa_verify(struct image_sign_info *info, - const struct image_region region[], int region_count, - uint8_t *sig, uint sig_len) +int rsa_verify_hash(struct image_sign_info *info, + const uint8_t *hash, uint8_t *sig, uint sig_len) { - /* Reserve memory for maximum checksum-length */ - uint8_t hash[info->crypto->key_len]; int ret = -EACCES; - /* - * Verify that the checksum-length does not exceed the - * rsa-signature-length - */ - if (info->checksum->checksum_len > - info->crypto->key_len) { - debug("%s: invlaid checksum-algorithm %s for %s\n", - __func__, info->checksum->name, info->crypto->name); - return -EINVAL; - } - - /* Calculate checksum with checksum-algorithm */ - ret = info->checksum->calculate(info->checksum->name, - region, region_count, hash); - if (ret < 0) { - debug("%s: Error in checksum calculation\n", __func__); - return -EINVAL; - } - if (CONFIG_IS_ENABLED(RSA_VERIFY_WITH_PKEY) && !info->fdt_blob) { /* don't rely on fdt properties */ ret = rsa_verify_with_pkey(info, hash, sig, sig_len); @@ -555,3 +533,33 @@ int rsa_verify(struct image_sign_info *info, return ret; } + +int rsa_verify(struct image_sign_info *info, + const struct image_region region[], int region_count, + uint8_t *sig, uint sig_len) +{ + /* Reserve memory for maximum checksum-length */ + uint8_t hash[info->crypto->key_len]; + int ret = -EACCES; + + /* + * Verify that the checksum-length does not exceed the + * rsa-signature-length + */ + if (info->checksum->checksum_len > + info->crypto->key_len) { + debug("%s: invlaid checksum-algorithm %s for %s\n", + __func__, info->checksum->name, info->crypto->name); + return -EINVAL; + } + + /* Calculate checksum with checksum-algorithm */ + ret = info->checksum->calculate(info->checksum->name, + region, region_count, hash); + if (ret < 0) { + debug("%s: Error in checksum calculation\n", __func__); + return -EINVAL; + } + + return rsa_verify_hash(info, hash, sig, sig_len); +} -- cgit v1.3.1