LM
/
u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

image: Use Kconfig to enable FIT_RSASSA_PSS on host 

Add a host Kconfig for FIT_RSASSA_PSS. With this we can use
CONFIG_IS_ENABLED(FIT_RSASSA_PSS) directly in the host build, so drop the
forcing of this in the image.h header.

Drop the #ifdef around padding_pss_verify() too since it is not needed.
Use the compiler to check the config where possible, instead of the
preprocessor.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
This commit is contained in:
Simon Glass 2021-09-25 19:43:23 -06:00 committed by Tom Rini
parent e059157f0d
commit 2bbed3ff8c
5 changed files with 11 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/image.h
View File

@ -27,9 +27,6 @@ struct fdt_region;
#include <sys/types.h> #include <sys/types.h>
#include <linux/kconfig.h> #include <linux/kconfig.h>
/* new uImage format support enabled on host */
#define CONFIG_FIT_RSASSA_PSS 1
#define IMAGE_ENABLE_IGNORE 0 #define IMAGE_ENABLE_IGNORE 0
#define IMAGE_INDENT_STRING "" #define IMAGE_INDENT_STRING ""

2
include/u-boot/rsa.h
View File

@ -103,11 +103,9 @@ int padding_pkcs_15_verify(struct image_sign_info *info,
uint8_t *msg, int msg_len, uint8_t *msg, int msg_len,
const uint8_t *hash, int hash_len); const uint8_t *hash, int hash_len);
#ifdef CONFIG_FIT_RSASSA_PSS
int padding_pss_verify(struct image_sign_info *info, int padding_pss_verify(struct image_sign_info *info,
uint8_t *msg, int msg_len, uint8_t *msg, int msg_len,
const uint8_t *hash, int hash_len); const uint8_t *hash, int hash_len);
#endif /* CONFIG_FIT_RSASSA_PSS */
#define RSA_DEFAULT_PADDING_NAME "pkcs-1.5" #define RSA_DEFAULT_PADDING_NAME "pkcs-1.5"

5
lib/rsa/rsa-sign.c
View File

@ -401,15 +401,14 @@ static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo,
goto err_sign; goto err_sign;
} }
#ifdef CONFIG_FIT_RSASSA_PSS if (CONFIG_IS_ENABLED(FIT_RSASSA_PSS) && padding_algo &&
if (padding_algo && !strcmp(padding_algo->name, "pss")) { !strcmp(padding_algo->name, "pss")) {
if (EVP_PKEY_CTX_set_rsa_padding(ckey, if (EVP_PKEY_CTX_set_rsa_padding(ckey,
RSA_PKCS1_PSS_PADDING) <= 0) { RSA_PKCS1_PSS_PADDING) <= 0) {
ret = rsa_err("Signer padding setup failed"); ret = rsa_err("Signer padding setup failed");
goto err_sign; goto err_sign;
} }
} }
#endif /* CONFIG_FIT_RSASSA_PSS */
for (i = 0; i < region_count; i++) { for (i = 0; i < region_count; i++) {
if (!EVP_DigestSignUpdate(context, region[i].data, if (!EVP_DigestSignUpdate(context, region[i].data,

15
lib/rsa/rsa-verify.c
View File

@ -102,7 +102,7 @@ U_BOOT_PADDING_ALGO(pkcs_15) = {
}; };
#endif #endif
#ifdef CONFIG_FIT_RSASSA_PSS #if CONFIG_IS_ENABLED(FIT_RSASSA_PSS)
static void u32_i2osp(uint32_t val, uint8_t *buf) static void u32_i2osp(uint32_t val, uint8_t *buf)
{ {
buf[0] = (uint8_t)((val >> 24) & 0xff); buf[0] = (uint8_t)((val >> 24) & 0xff);
@ -313,7 +313,6 @@ U_BOOT_PADDING_ALGO(pss) = {
#endif #endif
#if CONFIG_IS_ENABLED(FIT_SIGNATURE) || CONFIG_IS_ENABLED(RSA_VERIFY_WITH_PKEY)
/** /**
* rsa_verify_key() - Verify a signature against some data using RSA Key * rsa_verify_key() - Verify a signature against some data using RSA Key
* *
@ -385,9 +384,7 @@ static int rsa_verify_key(struct image_sign_info *info,
return 0; return 0;
} }
#endif
#if CONFIG_IS_ENABLED(RSA_VERIFY_WITH_PKEY)
/** /**
* rsa_verify_with_pkey() - Verify a signature against some data using * rsa_verify_with_pkey() - Verify a signature against some data using
* only modulus and exponent as RSA key properties. * only modulus and exponent as RSA key properties.
@ -408,6 +405,9 @@ int rsa_verify_with_pkey(struct image_sign_info *info,
struct key_prop *prop; struct key_prop *prop;
int ret; int ret;
if (!CONFIG_IS_ENABLED(RSA_VERIFY_WITH_PKEY))
return -EACCES;
/* Public key is self-described to fill key_prop */ /* Public key is self-described to fill key_prop */
ret = rsa_gen_key_prop(info->key, info->keylen, &prop); ret = rsa_gen_key_prop(info->key, info->keylen, &prop);
if (ret) { if (ret) {
@ -422,13 +422,6 @@ int rsa_verify_with_pkey(struct image_sign_info *info,
return ret; return ret;
} }
#else
int rsa_verify_with_pkey(struct image_sign_info *info,
const void *hash, uint8_t *sig, uint sig_len)
{
return -EACCES;
}
#endif
#if CONFIG_IS_ENABLED(FIT_SIGNATURE) #if CONFIG_IS_ENABLED(FIT_SIGNATURE)
/** /**

5
tools/Kconfig
View File

@ -35,6 +35,11 @@ config TOOLS_FIT_PRINT
help help
Print the content of the FIT verbosely in the tools builds Print the content of the FIT verbosely in the tools builds
config TOOLS_FIT_RSASSA_PSS
def_bool y
help
Support the rsassa-pss signature scheme in the tools builds
config TOOLS_FIT_SIGNATURE config TOOLS_FIT_SIGNATURE
def_bool y def_bool y
help help