From 1abff55a199b733c1addb8792db33ad5054bcd21 Mon Sep 17 00:00:00 2001 From: Yegor Yefremov Date: Thu, 22 Nov 2018 09:19:32 +0100 Subject: arm: baltos: move CONFIG_SYS_NAND_U_BOOT_OFFS to defconfig Also get rid of CONFIG_SYS_NAND_SPL_KERNEL_OFFS as SPL_OS_BOOT feature won't be used. Signed-off-by: Yegor Yefremov Reviewed-by: Simon Glass --- include/configs/baltos.h | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) (limited to 'include') diff --git a/include/configs/baltos.h b/include/configs/baltos.h index 006b049d09d..7b5f652f7e7 100644 --- a/include/configs/baltos.h +++ b/include/configs/baltos.h @@ -34,15 +34,8 @@ /* FIT support */ #define CONFIG_SYS_BOOTM_LEN SZ_64M -/* UBI Support */ - -/* I2C configuration */ - #ifdef CONFIG_NAND -#define CONFIG_SYS_NAND_U_BOOT_OFFS 0x00080000 -#ifdef CONFIG_SPL_OS_BOOT -#define CONFIG_SYS_NAND_SPL_KERNEL_OFFS 0x00200000 /* kernel offset */ -#endif + #define NANDARGS \ "mtdids=" CONFIG_MTDIDS_DEFAULT "\0" \ "mtdparts=" CONFIG_MTDPARTS_DEFAULT "\0" \ -- cgit v1.3.1 From 8ce7f2c11577a0353a1bc7ddeff3c751f66f3521 Mon Sep 17 00:00:00 2001 From: Yegor Yefremov Date: Thu, 22 Nov 2018 09:19:33 +0100 Subject: arm: baltos: migrate Ethernet PHYs configuration to Kconfig Remove CONFIG_PHY_ATHEROS and CONFIG_PHY_SMSC from defconfig and select them in Kconfig. Signed-off-by: Yegor Yefremov Reviewed-by: Simon Glass --- configs/am335x_baltos_defconfig | 2 ++ include/configs/baltos.h | 4 ---- 2 files changed, 2 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/configs/am335x_baltos_defconfig b/configs/am335x_baltos_defconfig index 74fd4870975..05d41aea87e 100644 --- a/configs/am335x_baltos_defconfig +++ b/configs/am335x_baltos_defconfig @@ -50,6 +50,8 @@ CONFIG_NAND=y CONFIG_SYS_NAND_U_BOOT_LOCATIONS=y CONFIG_SYS_NAND_U_BOOT_OFFS=0x00080000 CONFIG_PHY_ADDR_ENABLE=y +CONFIG_PHY_ATHEROS=y +CONFIG_PHY_SMSC=y CONFIG_MII=y CONFIG_DRIVER_TI_CPSW=y CONFIG_SPI=y diff --git a/include/configs/baltos.h b/include/configs/baltos.h index 7b5f652f7e7..ccbdc0a3356 100644 --- a/include/configs/baltos.h +++ b/include/configs/baltos.h @@ -257,10 +257,6 @@ #define CONFIG_AM335X_USB1 #define CONFIG_AM335X_USB1_MODE MUSB_OTG -/* Network. */ -#define CONFIG_PHY_SMSC -#define CONFIG_PHY_ATHEROS - /* NAND support */ #ifdef CONFIG_NAND #define GPMC_NAND_ECC_LP_x8_LAYOUT 1 -- cgit v1.3.1 From d27db67e6b130972441ea27344d09395dee0ae42 Mon Sep 17 00:00:00 2001 From: Lukasz Majewski Date: Thu, 22 Nov 2018 14:54:31 +0100 Subject: Kconfig: Migrate CONFIG_RTC_M41T62 define to Kconfig This patch moves the RTC M41T62 config define to Kconfig. Signed-off-by: Lukasz Majewski Reviewed-by: Stefan Roese Reviewed-by: Simon Glass --- configs/bk4r1_defconfig | 1 + configs/m53menlo_defconfig | 1 + configs/pcm052_defconfig | 1 + configs/x600_defconfig | 1 + drivers/rtc/Kconfig | 6 ++++++ include/configs/m53menlo.h | 1 - include/configs/pcm052.h | 1 - include/configs/x600.h | 1 - scripts/config_whitelist.txt | 1 - 9 files changed, 10 insertions(+), 4 deletions(-) (limited to 'include') diff --git a/configs/bk4r1_defconfig b/configs/bk4r1_defconfig index cf1fd0b6c64..9e31b4ac979 100644 --- a/configs/bk4r1_defconfig +++ b/configs/bk4r1_defconfig @@ -40,6 +40,7 @@ CONFIG_SPI_FLASH_MTD=y CONFIG_PHYLIB=y CONFIG_PHY_MICREL=y CONFIG_MII=y +CONFIG_RTC_M41T62=y CONFIG_DM_SERIAL=y CONFIG_FSL_LPUART=y CONFIG_SPI=y diff --git a/configs/m53menlo_defconfig b/configs/m53menlo_defconfig index 795f8a3ebc9..dd7aed324f8 100644 --- a/configs/m53menlo_defconfig +++ b/configs/m53menlo_defconfig @@ -49,6 +49,7 @@ CONFIG_NAND=y CONFIG_NAND_MXC=y CONFIG_PHYLIB=y CONFIG_PHY_MICREL=y +CONFIG_RTC_M41T62=y CONFIG_USB=y CONFIG_USB_STORAGE=y CONFIG_USB_HOST_ETHER=y diff --git a/configs/pcm052_defconfig b/configs/pcm052_defconfig index 0c8e31a9ece..e207df51a80 100644 --- a/configs/pcm052_defconfig +++ b/configs/pcm052_defconfig @@ -35,5 +35,6 @@ CONFIG_SYS_NAND_BUSWIDTH_16BIT=y CONFIG_PHYLIB=y CONFIG_PHY_MICREL=y CONFIG_MII=y +CONFIG_RTC_M41T62=y CONFIG_DM_SERIAL=y CONFIG_FSL_LPUART=y diff --git a/configs/x600_defconfig b/configs/x600_defconfig index c8f5f662327..a96f54c7371 100644 --- a/configs/x600_defconfig +++ b/configs/x600_defconfig @@ -52,6 +52,7 @@ CONFIG_PHY_MICREL=y CONFIG_PHY_MICREL_KSZ90X1=y CONFIG_ETH_DESIGNWARE=y CONFIG_MII=y +CONFIG_RTC_M41T62=y CONFIG_CONS_INDEX=0 CONFIG_USB=y CONFIG_USB_EHCI_HCD=y diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig index 6038b43230d..fd0009b2e2d 100644 --- a/drivers/rtc/Kconfig +++ b/drivers/rtc/Kconfig @@ -104,4 +104,10 @@ config RTC_MC146818 clock with a wide array of features and 50 bytes of general-purpose, battery-backed RAM. The driver supports access to the clock and RAM. +config RTC_M41T62 + bool "Enable M41T62 driver" + help + Enable driver for ST's M41T62 compatible RTC devices (like RV-4162). + It is a serial (I2C) real-time clock (RTC) with alarm. + endmenu diff --git a/include/configs/m53menlo.h b/include/configs/m53menlo.h index 94214b135df..3fca28da6b5 100644 --- a/include/configs/m53menlo.h +++ b/include/configs/m53menlo.h @@ -110,7 +110,6 @@ * RTC */ #ifdef CONFIG_CMD_DATE -#define CONFIG_RTC_M41T62 #define CONFIG_SYS_I2C_RTC_ADDR 0x68 #define CONFIG_SYS_M41T11_BASE_YEAR 2000 #endif diff --git a/include/configs/pcm052.h b/include/configs/pcm052.h index 99977954341..e125a38e7d4 100644 --- a/include/configs/pcm052.h +++ b/include/configs/pcm052.h @@ -58,7 +58,6 @@ #define CONFIG_SYS_I2C_MXC /* RTC (actually an RV-4162 but M41T62-compatible) */ -#define CONFIG_RTC_M41T62 #define CONFIG_SYS_I2C_RTC_ADDR 0x68 #define CONFIG_SYS_RTC_BUS_NUM 2 diff --git a/include/configs/x600.h b/include/configs/x600.h index a6835ebbd56..639da8012c6 100644 --- a/include/configs/x600.h +++ b/include/configs/x600.h @@ -75,7 +75,6 @@ #define CONFIG_SYS_I2C_SLAVE 0x02 #define CONFIG_I2C_CHIPADDRESS 0x50 -#define CONFIG_RTC_M41T62 1 #define CONFIG_SYS_I2C_RTC_ADDR 0x68 /* FPGA config options */ diff --git a/scripts/config_whitelist.txt b/scripts/config_whitelist.txt index b3f525fc02c..bd14fe22c65 100644 --- a/scripts/config_whitelist.txt +++ b/scripts/config_whitelist.txt @@ -1661,7 +1661,6 @@ CONFIG_RTC_DS3231 CONFIG_RTC_FTRTC010 CONFIG_RTC_IMXDI CONFIG_RTC_M41T11 -CONFIG_RTC_M41T62 CONFIG_RTC_MC13XXX CONFIG_RTC_MCFRRTC CONFIG_RTC_MCP79411 -- cgit v1.3.1 From 20031567e12bb312bff95b70767f6275e20f0346 Mon Sep 17 00:00:00 2001 From: Philippe Reynes Date: Wed, 14 Nov 2018 13:51:00 +0100 Subject: rsa: add a structure for the padding The rsa signature use a padding algorithm. By default, we use the padding pkcs-1.5. In order to add some new padding algorithm, we add a padding framework to manage several padding algorithm. The choice of the padding is done in the file .its. Signed-off-by: Philippe Reynes Reviewed-by: Simon Glass --- common/image-fit.c | 5 +++++ common/image-sig.c | 29 ++++++++++++++++++++++++++ include/image.h | 16 +++++++++++++++ include/u-boot/rsa.h | 13 ++++++++++++ lib/rsa/rsa-sign.c | 15 +++++++++++--- lib/rsa/rsa-verify.c | 57 ++++++++++++++++++++++++++++++++++------------------ tools/image-host.c | 4 ++++ 7 files changed, 116 insertions(+), 23 deletions(-) (limited to 'include') diff --git a/common/image-fit.c b/common/image-fit.c index 8d39a243f8d..ac901e131ca 100644 --- a/common/image-fit.c +++ b/common/image-fit.c @@ -165,6 +165,7 @@ static void fit_image_print_data(const void *fit, int noffset, const char *p, uint8_t *value; int value_len; char *algo; + const char *padding; int required; int ret, i; @@ -184,6 +185,10 @@ static void fit_image_print_data(const void *fit, int noffset, const char *p, printf(" (required)"); printf("\n"); + padding = fdt_getprop(fit, noffset, "padding", NULL); + if (padding) + printf("%s %s padding: %s\n", p, type, padding); + ret = fit_image_hash_get_value(fit, noffset, &value, &value_len); printf("%s %s value: ", p, type); diff --git a/common/image-sig.c b/common/image-sig.c index 5d860e12663..3d8281f2faa 100644 --- a/common/image-sig.c +++ b/common/image-sig.c @@ -71,6 +71,13 @@ struct crypto_algo crypto_algos[] = { }; +struct padding_algo padding_algos[] = { + { + .name = "pkcs-1.5", + .verify = padding_pkcs_15_verify, + }, +}; + struct checksum_algo *image_get_checksum_algo(const char *full_name) { int i; @@ -106,6 +113,21 @@ struct crypto_algo *image_get_crypto_algo(const char *full_name) return NULL; } +struct padding_algo *image_get_padding_algo(const char *name) +{ + int i; + + if (!name) + return NULL; + + for (i = 0; i < ARRAY_SIZE(padding_algos); i++) { + if (!strcmp(padding_algos[i].name, name)) + return &padding_algos[i]; + } + + return NULL; +} + /** * fit_region_make_list() - Make a list of image regions * @@ -155,6 +177,7 @@ static int fit_image_setup_verify(struct image_sign_info *info, char **err_msgp) { char *algo_name; + const char *padding_name; if (fdt_totalsize(fit) > CONFIG_FIT_SIGNATURE_MAX_SIZE) { *err_msgp = "Total size too large"; @@ -165,6 +188,11 @@ static int fit_image_setup_verify(struct image_sign_info *info, *err_msgp = "Can't get hash algo property"; return -1; } + + padding_name = fdt_getprop(fit, noffset, "padding", NULL); + if (!padding_name) + padding_name = RSA_DEFAULT_PADDING_NAME; + memset(info, '\0', sizeof(*info)); info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL); info->fit = (void *)fit; @@ -172,6 +200,7 @@ static int fit_image_setup_verify(struct image_sign_info *info, info->name = algo_name; info->checksum = image_get_checksum_algo(algo_name); info->crypto = image_get_crypto_algo(algo_name); + info->padding = image_get_padding_algo(padding_name); info->fdt_blob = gd_fdt_blob(); info->required_keynode = required_keynode; printf("%s:%s", algo_name, info->keyname); diff --git a/include/image.h b/include/image.h index f67502e333e..e75d1763b58 100644 --- a/include/image.h +++ b/include/image.h @@ -1101,6 +1101,7 @@ struct image_sign_info { int node_offset; /* Offset of signature node */ const char *name; /* Algorithm name */ struct checksum_algo *checksum; /* Checksum algorithm information */ + struct padding_algo *padding; /* Padding algorithm information */ struct crypto_algo *crypto; /* Crypto algorithm information */ const void *fdt_blob; /* FDT containing public keys */ int required_keynode; /* Node offset of key to use: -1=any */ @@ -1186,6 +1187,13 @@ struct crypto_algo { uint8_t *sig, uint sig_len); }; +struct padding_algo { + const char *name; + int (*verify)(struct image_sign_info *info, + uint8_t *pad, int pad_len, + const uint8_t *hash, int hash_len); +}; + /** * image_get_checksum_algo() - Look up a checksum algorithm * @@ -1202,6 +1210,14 @@ struct checksum_algo *image_get_checksum_algo(const char *full_name); */ struct crypto_algo *image_get_crypto_algo(const char *full_name); +/** + * image_get_padding_algo() - Look up a padding algorithm + * + * @param name Name of padding algorithm + * @return pointer to algorithm information, or NULL if not found + */ +struct padding_algo *image_get_padding_algo(const char *name); + /** * fit_image_verify_required_sigs() - Verify signatures marked as 'required' * diff --git a/include/u-boot/rsa.h b/include/u-boot/rsa.h index 68bcb14c74d..16b4c4caeea 100644 --- a/include/u-boot/rsa.h +++ b/include/u-boot/rsa.h @@ -97,6 +97,10 @@ static inline int rsa_add_verify_data(struct image_sign_info *info, int rsa_verify(struct image_sign_info *info, const struct image_region region[], int region_count, uint8_t *sig, uint sig_len); + +int padding_pkcs_15_verify(struct image_sign_info *info, + uint8_t *msg, int msg_len, + const uint8_t *hash, int hash_len); #else static inline int rsa_verify(struct image_sign_info *info, const struct image_region region[], int region_count, @@ -104,8 +108,17 @@ static inline int rsa_verify(struct image_sign_info *info, { return -ENXIO; } + +static inline int padding_pkcs_15_verify(struct image_sign_info *info, + uint8_t *msg, int msg_len, + const uint8_t *hash, int hash_len) +{ + return -ENXIO; +} #endif +#define RSA_DEFAULT_PADDING_NAME "pkcs-1.5" + #define RSA2048_BYTES (2048 / 8) #define RSA4096_BYTES (4096 / 8) diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c index 78e348eeea0..6aa0e2ab5df 100644 --- a/lib/rsa/rsa-sign.c +++ b/lib/rsa/rsa-sign.c @@ -387,11 +387,13 @@ static void rsa_engine_remove(ENGINE *e) } } -static int rsa_sign_with_key(RSA *rsa, struct checksum_algo *checksum_algo, +static int rsa_sign_with_key(RSA *rsa, struct padding_algo *padding_algo, + struct checksum_algo *checksum_algo, const struct image_region region[], int region_count, uint8_t **sigp, uint *sig_size) { EVP_PKEY *key; + EVP_PKEY_CTX *ckey; EVP_MD_CTX *context; int ret = 0; size_t size; @@ -422,7 +424,14 @@ static int rsa_sign_with_key(RSA *rsa, struct checksum_algo *checksum_algo, goto err_create; } EVP_MD_CTX_init(context); - if (EVP_DigestSignInit(context, NULL, + + ckey = EVP_PKEY_CTX_new(key, NULL); + if (!ckey) { + ret = rsa_err("EVP key context creation failed"); + goto err_create; + } + + if (EVP_DigestSignInit(context, &ckey, checksum_algo->calculate_sign(), NULL, key) <= 0) { ret = rsa_err("Signer setup failed"); @@ -488,7 +497,7 @@ int rsa_sign(struct image_sign_info *info, ret = rsa_get_priv_key(info->keydir, info->keyname, e, &rsa); if (ret) goto err_priv; - ret = rsa_sign_with_key(rsa, info->checksum, region, + ret = rsa_sign_with_key(rsa, info->padding, info->checksum, region, region_count, sigp, sig_len); if (ret) goto err_sign; diff --git a/lib/rsa/rsa-verify.c b/lib/rsa/rsa-verify.c index bc833543788..279a9ba4562 100644 --- a/lib/rsa/rsa-verify.c +++ b/lib/rsa/rsa-verify.c @@ -57,31 +57,57 @@ static int rsa_verify_padding(const uint8_t *msg, const int pad_len, return ret; } +int padding_pkcs_15_verify(struct image_sign_info *info, + uint8_t *msg, int msg_len, + const uint8_t *hash, int hash_len) +{ + struct checksum_algo *checksum = info->checksum; + int ret, pad_len = msg_len - checksum->checksum_len; + + /* Check pkcs1.5 padding bytes. */ + ret = rsa_verify_padding(msg, pad_len, checksum); + if (ret) { + debug("In RSAVerify(): Padding check failed!\n"); + return -EINVAL; + } + + /* Check hash. */ + if (memcmp((uint8_t *)msg + pad_len, hash, msg_len - pad_len)) { + debug("In RSAVerify(): Hash check failed!\n"); + return -EACCES; + } + + return 0; +} + /** * rsa_verify_key() - Verify a signature against some data using RSA Key * * Verify a RSA PKCS1.5 signature against an expected hash using * the RSA Key properties in prop structure. * + * @info: Specifies key and FIT information * @prop: Specifies key * @sig: Signature * @sig_len: Number of bytes in signature * @hash: Pointer to the expected hash * @key_len: Number of bytes in rsa key - * @algo: Checksum algo structure having information on DER encoding etc. * @return 0 if verified, -ve on error */ -static int rsa_verify_key(struct key_prop *prop, const uint8_t *sig, +static int rsa_verify_key(struct image_sign_info *info, + struct key_prop *prop, const uint8_t *sig, const uint32_t sig_len, const uint8_t *hash, - const uint32_t key_len, struct checksum_algo *algo) + const uint32_t key_len) { - int pad_len; int ret; #if !defined(USE_HOSTCC) struct udevice *mod_exp_dev; #endif + struct checksum_algo *checksum = info->checksum; + struct padding_algo *padding = info->padding; + int hash_len = checksum->checksum_len; - if (!prop || !sig || !hash || !algo) + if (!prop || !sig || !hash || !checksum) return -EIO; if (sig_len != (prop->num_bits / 8)) { @@ -89,7 +115,7 @@ static int rsa_verify_key(struct key_prop *prop, const uint8_t *sig, return -EINVAL; } - debug("Checksum algorithm: %s", algo->name); + debug("Checksum algorithm: %s", checksum->name); /* Sanity check for stack size */ if (sig_len > RSA_MAX_SIG_BITS / 8) { @@ -116,19 +142,10 @@ static int rsa_verify_key(struct key_prop *prop, const uint8_t *sig, return ret; } - pad_len = key_len - algo->checksum_len; - - /* Check pkcs1.5 padding bytes. */ - ret = rsa_verify_padding(buf, pad_len, algo); + ret = padding->verify(info, buf, key_len, hash, hash_len); if (ret) { - debug("In RSAVerify(): Padding check failed!\n"); - return -EINVAL; - } - - /* Check hash. */ - if (memcmp((uint8_t *)buf + pad_len, hash, sig_len - pad_len)) { - debug("In RSAVerify(): Hash check failed!\n"); - return -EACCES; + debug("In RSAVerify(): padding check failed!\n"); + return ret; } return 0; @@ -182,8 +199,8 @@ static int rsa_verify_with_keynode(struct image_sign_info *info, return -EFAULT; } - ret = rsa_verify_key(&prop, sig, sig_len, hash, - info->crypto->key_len, info->checksum); + ret = rsa_verify_key(info, &prop, sig, sig_len, hash, + info->crypto->key_len); return ret; } diff --git a/tools/image-host.c b/tools/image-host.c index 09e4f47e5ab..88b329502ca 100644 --- a/tools/image-host.c +++ b/tools/image-host.c @@ -157,6 +157,7 @@ static int fit_image_setup_sig(struct image_sign_info *info, { const char *node_name; char *algo_name; + const char *padding_name; node_name = fit_get_name(fit, noffset, NULL); if (fit_image_hash_get_algo(fit, noffset, &algo_name)) { @@ -165,6 +166,8 @@ static int fit_image_setup_sig(struct image_sign_info *info, return -1; } + padding_name = fdt_getprop(fit, noffset, "padding", NULL); + memset(info, '\0', sizeof(*info)); info->keydir = keydir; info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL); @@ -173,6 +176,7 @@ static int fit_image_setup_sig(struct image_sign_info *info, info->name = strdup(algo_name); info->checksum = image_get_checksum_algo(algo_name); info->crypto = image_get_crypto_algo(algo_name); + info->padding = image_get_padding_algo(padding_name); info->require_keys = require_keys; info->engine_id = engine_id; if (!info->checksum || !info->crypto) { -- cgit v1.3.1 From 061daa0b61f0fbeb214c566f3adb23da05545320 Mon Sep 17 00:00:00 2001 From: Philippe Reynes Date: Wed, 14 Nov 2018 13:51:01 +0100 Subject: rsa: add support of padding pss We add the support of the padding pss for rsa signature. This new padding is often recommended instead of pkcs-1.5. Signed-off-by: Philippe Reynes Reviewed-by: Simon Glass --- Kconfig | 8 +++ common/image-sig.c | 6 ++ include/image.h | 1 + include/u-boot/rsa.h | 15 ++++ lib/rsa/rsa-sign.c | 10 +++ lib/rsa/rsa-verify.c | 190 +++++++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 230 insertions(+) (limited to 'include') diff --git a/Kconfig b/Kconfig index dca9bb4e432..31205534941 100644 --- a/Kconfig +++ b/Kconfig @@ -290,6 +290,14 @@ config FIT_SIGNATURE_MAX_SIZE device memory. Assure this size does not extend past expected storage space. +config FIT_ENABLE_RSASSA_PSS_SUPPORT + bool "Support rsassa-pss signature scheme of FIT image contents" + depends on FIT_SIGNATURE + default n + help + Enable this to support the pss padding algorithm as described + in the rfc8017 (https://tools.ietf.org/html/rfc8017). + config FIT_VERBOSE bool "Show verbose messages when FIT images fail" help diff --git a/common/image-sig.c b/common/image-sig.c index 3d8281f2faa..4f6b4ec412c 100644 --- a/common/image-sig.c +++ b/common/image-sig.c @@ -76,6 +76,12 @@ struct padding_algo padding_algos[] = { .name = "pkcs-1.5", .verify = padding_pkcs_15_verify, }, +#ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT + { + .name = "pss", + .verify = padding_pss_verify, + } +#endif /* CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT */ }; struct checksum_algo *image_get_checksum_algo(const char *full_name) diff --git a/include/image.h b/include/image.h index e75d1763b58..83a2d412c9f 100644 --- a/include/image.h +++ b/include/image.h @@ -30,6 +30,7 @@ struct fdt_region; #define IMAGE_ENABLE_FIT 1 #define IMAGE_ENABLE_OF_LIBFDT 1 #define CONFIG_FIT_VERBOSE 1 /* enable fit_format_{error,warning}() */ +#define CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT 1 #define CONFIG_FIT_ENABLE_SHA256_SUPPORT #define CONFIG_SHA1 #define CONFIG_SHA256 diff --git a/include/u-boot/rsa.h b/include/u-boot/rsa.h index 16b4c4caeea..2d3024d8b71 100644 --- a/include/u-boot/rsa.h +++ b/include/u-boot/rsa.h @@ -101,6 +101,12 @@ int rsa_verify(struct image_sign_info *info, int padding_pkcs_15_verify(struct image_sign_info *info, uint8_t *msg, int msg_len, const uint8_t *hash, int hash_len); + +#ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT +int padding_pss_verify(struct image_sign_info *info, + uint8_t *msg, int msg_len, + const uint8_t *hash, int hash_len); +#endif /* CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT */ #else static inline int rsa_verify(struct image_sign_info *info, const struct image_region region[], int region_count, @@ -115,6 +121,15 @@ static inline int padding_pkcs_15_verify(struct image_sign_info *info, { return -ENXIO; } + +#ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT +static inline int padding_pss_verify(struct image_sign_info *info, + uint8_t *msg, int msg_len, + const uint8_t *hash, int hash_len) +{ + return -ENXIO; +} +#endif /* CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT */ #endif #define RSA_DEFAULT_PADDING_NAME "pkcs-1.5" diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c index 6aa0e2ab5df..fb5e07b56d8 100644 --- a/lib/rsa/rsa-sign.c +++ b/lib/rsa/rsa-sign.c @@ -438,6 +438,16 @@ static int rsa_sign_with_key(RSA *rsa, struct padding_algo *padding_algo, goto err_sign; } +#ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT + if (padding_algo && !strcmp(padding_algo->name, "pss")) { + if (EVP_PKEY_CTX_set_rsa_padding(ckey, + RSA_PKCS1_PSS_PADDING) <= 0) { + ret = rsa_err("Signer padding setup failed"); + goto err_sign; + } + } +#endif /* CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT */ + for (i = 0; i < region_count; i++) { if (!EVP_DigestSignUpdate(context, region[i].data, region[i].size)) { diff --git a/lib/rsa/rsa-verify.c b/lib/rsa/rsa-verify.c index 279a9ba4562..9734f6d3bd6 100644 --- a/lib/rsa/rsa-verify.c +++ b/lib/rsa/rsa-verify.c @@ -80,6 +80,196 @@ int padding_pkcs_15_verify(struct image_sign_info *info, return 0; } +#ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT +static void u32_i2osp(uint32_t val, uint8_t *buf) +{ + buf[0] = (uint8_t)((val >> 24) & 0xff); + buf[1] = (uint8_t)((val >> 16) & 0xff); + buf[2] = (uint8_t)((val >> 8) & 0xff); + buf[3] = (uint8_t)((val >> 0) & 0xff); +} + +/** + * mask_generation_function1() - generate an octet string + * + * Generate an octet string used to check rsa signature. + * It use an input octet string and a hash function. + * + * @checksum: A Hash function + * @seed: Specifies an input variable octet string + * @seed_len: Size of the input octet string + * @output: Specifies the output octet string + * @output_len: Size of the output octet string + * @return 0 if the octet string was correctly generated, others on error + */ +static int mask_generation_function1(struct checksum_algo *checksum, + uint8_t *seed, int seed_len, + uint8_t *output, int output_len) +{ + struct image_region region[2]; + int ret = 0, i, i_output = 0, region_count = 2; + uint32_t counter = 0; + uint8_t buf_counter[4], *tmp; + int hash_len = checksum->checksum_len; + + memset(output, 0, output_len); + + region[0].data = seed; + region[0].size = seed_len; + region[1].data = &buf_counter[0]; + region[1].size = 4; + + tmp = malloc(hash_len); + if (!tmp) { + debug("%s: can't allocate array tmp\n", __func__); + ret = -ENOMEM; + goto out; + } + + while (i_output < output_len) { + u32_i2osp(counter, &buf_counter[0]); + + ret = checksum->calculate(checksum->name, + region, region_count, + tmp); + if (ret < 0) { + debug("%s: Error in checksum calculation\n", __func__); + goto out; + } + + i = 0; + while ((i_output < output_len) && (i < hash_len)) { + output[i_output] = tmp[i]; + i_output++; + i++; + } + + counter++; + } + +out: + free(tmp); + + return ret; +} + +static int compute_hash_prime(struct checksum_algo *checksum, + uint8_t *pad, int pad_len, + uint8_t *hash, int hash_len, + uint8_t *salt, int salt_len, + uint8_t *hprime) +{ + struct image_region region[3]; + int ret, region_count = 3; + + region[0].data = pad; + region[0].size = pad_len; + region[1].data = hash; + region[1].size = hash_len; + region[2].data = salt; + region[2].size = salt_len; + + ret = checksum->calculate(checksum->name, region, region_count, hprime); + if (ret < 0) { + debug("%s: Error in checksum calculation\n", __func__); + goto out; + } + +out: + return ret; +} + +int padding_pss_verify(struct image_sign_info *info, + uint8_t *msg, int msg_len, + const uint8_t *hash, int hash_len) +{ + uint8_t *masked_db = NULL; + int masked_db_len = msg_len - hash_len - 1; + uint8_t *h = NULL, *hprime = NULL; + int h_len = hash_len; + uint8_t *db_mask = NULL; + int db_mask_len = masked_db_len; + uint8_t *db = NULL, *salt = NULL; + int db_len = masked_db_len, salt_len = msg_len - hash_len - 2; + uint8_t pad_zero[8] = { 0 }; + int ret, i, leftmost_bits = 1; + uint8_t leftmost_mask; + struct checksum_algo *checksum = info->checksum; + + /* first, allocate everything */ + masked_db = malloc(masked_db_len); + h = malloc(h_len); + db_mask = malloc(db_mask_len); + db = malloc(db_len); + salt = malloc(salt_len); + hprime = malloc(hash_len); + if (!masked_db || !h || !db_mask || !db || !salt || !hprime) { + printf("%s: can't allocate some buffer\n", __func__); + ret = -ENOMEM; + goto out; + } + + /* step 4: check if the last byte is 0xbc */ + if (msg[msg_len - 1] != 0xbc) { + printf("%s: invalid pss padding (0xbc is missing)\n", __func__); + ret = -EINVAL; + goto out; + } + + /* step 5 */ + memcpy(masked_db, msg, masked_db_len); + memcpy(h, msg + masked_db_len, h_len); + + /* step 6 */ + leftmost_mask = (0xff >> (8 - leftmost_bits)) << (8 - leftmost_bits); + if (masked_db[0] & leftmost_mask) { + printf("%s: invalid pss padding ", __func__); + printf("(leftmost bit of maskedDB not zero)\n"); + ret = -EINVAL; + goto out; + } + + /* step 7 */ + mask_generation_function1(checksum, h, h_len, db_mask, db_mask_len); + + /* step 8 */ + for (i = 0; i < db_len; i++) + db[i] = masked_db[i] ^ db_mask[i]; + + /* step 9 */ + db[0] &= 0xff >> leftmost_bits; + + /* step 10 */ + if (db[0] != 0x01) { + printf("%s: invalid pss padding ", __func__); + printf("(leftmost byte of db isn't 0x01)\n"); + ret = EINVAL; + goto out; + } + + /* step 11 */ + memcpy(salt, &db[1], salt_len); + + /* step 12 & 13 */ + compute_hash_prime(checksum, pad_zero, 8, + (uint8_t *)hash, hash_len, + salt, salt_len, hprime); + + /* step 14 */ + ret = memcmp(h, hprime, hash_len); + +out: + free(hprime); + free(salt); + free(db); + free(db_mask); + free(h); + free(masked_db); + + return ret; +} +#endif + /** * rsa_verify_key() - Verify a signature against some data using RSA Key * -- cgit v1.3.1 From 42b54013a08dbda78b466243f03ced249a7fbe84 Mon Sep 17 00:00:00 2001 From: Christophe Leroy Date: Wed, 21 Nov 2018 08:51:53 +0000 Subject: drivers: serial: get rid of non DM mpc8xx driver Signed-off-by: Christophe Leroy --- drivers/serial/serial.c | 2 - drivers/serial/serial_mpc8xx.c | 97 ++++++------------------------------------ include/serial.h | 1 - 3 files changed, 14 insertions(+), 86 deletions(-) (limited to 'include') diff --git a/drivers/serial/serial.c b/drivers/serial/serial.c index c499601f000..09365ba6a1e 100644 --- a/drivers/serial/serial.c +++ b/drivers/serial/serial.c @@ -119,7 +119,6 @@ U_BOOT_ENV_CALLBACK(baudrate, on_baudrate); serial_initfunc(atmel_serial_initialize); serial_initfunc(mcf_serial_initialize); serial_initfunc(mpc85xx_serial_initialize); -serial_initfunc(mpc8xx_serial_initialize); serial_initfunc(mxc_serial_initialize); serial_initfunc(ns16550_serial_initialize); serial_initfunc(pl01x_serial_initialize); @@ -173,7 +172,6 @@ void serial_initialize(void) atmel_serial_initialize(); mcf_serial_initialize(); mpc85xx_serial_initialize(); - mpc8xx_serial_initialize(); mxc_serial_initialize(); ns16550_serial_initialize(); pl01x_serial_initialize(); diff --git a/drivers/serial/serial_mpc8xx.c b/drivers/serial/serial_mpc8xx.c index f2d241417a4..50d6e70f177 100644 --- a/drivers/serial/serial_mpc8xx.c +++ b/drivers/serial/serial_mpc8xx.c @@ -59,7 +59,7 @@ static void serial_setdivisor(cpm8xx_t __iomem *cp, int baudrate) * as serial console interface. */ -static void smc_setbrg(void) +static int serial_mpc8xx_setbrg(struct udevice *dev, int baudrate) { immap_t __iomem *im = (immap_t __iomem *)CONFIG_SYS_IMMR; cpm8xx_t __iomem *cp = &(im->im_cpm); @@ -72,10 +72,12 @@ static void smc_setbrg(void) out_be32(&cp->cp_simode, 0); - serial_setdivisor(cp, gd->baudrate); + serial_setdivisor(cp, baudrate); + + return 0; } -static int smc_init(void) +static int serial_mpc8xx_probe(struct udevice *dev) { immap_t __iomem *im = (immap_t __iomem *)CONFIG_SYS_IMMR; smc_t __iomem *sp; @@ -140,7 +142,7 @@ static int smc_init(void) out_8(&sp->smc_smce, 0xff); /* Set up the baud rate generator */ - smc_setbrg(); + serial_mpc8xx_setbrg(dev, gd->baudrate); /* Make the first buffer the only buffer. */ setbits_be16(&rtx->txbd.cbd_sc, BD_SC_WRAP); @@ -167,14 +169,14 @@ static int smc_init(void) return 0; } -static void smc_putc(const char c) +static int serial_mpc8xx_putc(struct udevice *dev, const char c) { immap_t __iomem *im = (immap_t __iomem *)CONFIG_SYS_IMMR; cpm8xx_t __iomem *cpmp = &(im->im_cpm); struct serialbuffer __iomem *rtx; if (c == '\n') - smc_putc('\r'); + serial_mpc8xx_putc(dev, '\r'); rtx = (struct serialbuffer __iomem *)&cpmp->cp_dpmem[CPM_SERIAL_BASE]; @@ -185,17 +187,11 @@ static void smc_putc(const char c) while (in_be16(&rtx->txbd.cbd_sc) & BD_SC_READY) WATCHDOG_RESET(); -} -#ifndef CONFIG_DM_SERIAL -static void smc_puts(const char *s) -{ - while (*s) - smc_putc(*s++); + return 0; } -#endif -static int smc_getc(void) +static int serial_mpc8xx_getc(struct udevice *dev) { immap_t __iomem *im = (immap_t __iomem *)CONFIG_SYS_IMMR; cpm8xx_t __iomem *cpmp = &(im->im_cpm); @@ -225,84 +221,20 @@ static int smc_getc(void) return c; } -static int smc_tstc(void) +static int serial_mpc8xx_pending(struct udevice *dev, bool input) { immap_t __iomem *im = (immap_t __iomem *)CONFIG_SYS_IMMR; cpm8xx_t __iomem *cpmp = &(im->im_cpm); struct serialbuffer __iomem *rtx; + if (!input) + return 0; + rtx = (struct serialbuffer __iomem *)&cpmp->cp_dpmem[CPM_SERIAL_BASE]; return !(in_be16(&rtx->rxbd.cbd_sc) & BD_SC_EMPTY); } -#ifndef CONFIG_DM_SERIAL -struct serial_device serial_smc_device = { - .name = "serial_smc", - .start = smc_init, - .stop = NULL, - .setbrg = smc_setbrg, - .getc = smc_getc, - .tstc = smc_tstc, - .putc = smc_putc, - .puts = smc_puts, -}; - -__weak struct serial_device *default_serial_console(void) -{ - return &serial_smc_device; -} - -void mpc8xx_serial_initialize(void) -{ - serial_register(&serial_smc_device); -} -#endif - -#ifdef CONFIG_DM_SERIAL -static int serial_mpc8xx_setbrg(struct udevice *dev, int baudrate) -{ - immap_t __iomem *im = (immap_t __iomem *)CONFIG_SYS_IMMR; - cpm8xx_t __iomem *cp = &(im->im_cpm); - - /* Set up the baud rate generator. - * See 8xx_io/commproc.c for details. - * - * Wire BRG1 to SMCx - */ - - out_be32(&cp->cp_simode, 0); - - serial_setdivisor(cp, baudrate); - - return 0; -} - -static int serial_mpc8xx_probe(struct udevice *dev) -{ - return smc_init(); -} - -static int serial_mpc8xx_putc(struct udevice *dev, const char ch) -{ - smc_putc(ch); - - return 0; -} - -static int serial_mpc8xx_getc(struct udevice *dev) -{ - return smc_getc(); -} - -static int serial_mpc8xx_pending(struct udevice *dev, bool input) -{ - if (input) - return smc_tstc(); - - return 0; -} - static const struct dm_serial_ops serial_mpc8xx_ops = { .putc = serial_mpc8xx_putc, .pending = serial_mpc8xx_pending, @@ -323,4 +255,3 @@ U_BOOT_DRIVER(serial_mpc8xx) = { .ops = &serial_mpc8xx_ops, .flags = DM_FLAG_PRE_RELOC, }; -#endif diff --git a/include/serial.h b/include/serial.h index ec25db6e601..9133d07fd51 100644 --- a/include/serial.h +++ b/include/serial.h @@ -224,7 +224,6 @@ struct serial_dev_priv { void atmel_serial_initialize(void); void mcf_serial_initialize(void); void mpc85xx_serial_initialize(void); -void mpc8xx_serial_initialize(void); void mxc_serial_initialize(void); void ns16550_serial_initialize(void); void pl01x_serial_initialize(void); -- cgit v1.3.1