From patchwork Mon May 18 16:06:34 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heiko Stuebner X-Patchwork-Id: 245958 List-Id: U-Boot discussion From: heiko at sntech.de (Heiko Stuebner) Date: Mon, 18 May 2020 18:06:34 +0200 Subject: [PATCH v3 1/4] lib: rsa: distinguish between tpl and spl for CONFIG_RSA_VERIFY Message-ID: <20200518160637.2245371-1-heiko@sntech.de> From: Heiko Stuebner While the SPL may want to do signature checking this won't be the case for TPL in all cases, as TPL is mostly used when the amound of initial memory is not enough for a full SPL. So on a system where SPL uses DM but TPL does not we currently end up with a TPL compile error of: lib/rsa/rsa-verify.c:48:25: error: dereferencing pointer to incomplete type ?struct checksum_algo? To prevent that change the $(SPL_) to $(SPL_TPL_) to distinguish between both. If someone really needs FIT signature checking in TPL as well, a new TPL_RSA_VERIFY config symbol needs to be added. Signed-off-by: Heiko Stuebner Reviewed-by: Philipp Tomsich Reviewed-by: Kever Yang --- changes in v2: - fix typo "distinguis(h)" I've split out the build fixes from the signature series. It would be cool to get these applied already, as they do fix actual issues to be seen when enabling signature support in spl. lib/rsa/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rsa/Makefile b/lib/rsa/Makefile index 14ed3cb401..c61ebfd79e 100644 --- a/lib/rsa/Makefile +++ b/lib/rsa/Makefile @@ -5,6 +5,6 @@ # (C) Copyright 2000-2007 # Wolfgang Denk, DENX Software Engineering, wd at denx.de. -obj-$(CONFIG_$(SPL_)RSA_VERIFY) += rsa-verify.o rsa-checksum.o +obj-$(CONFIG_$(SPL_TPL_)RSA_VERIFY) += rsa-verify.o rsa-checksum.o obj-$(CONFIG_RSA_VERIFY_WITH_PKEY) += rsa-keyprop.o obj-$(CONFIG_RSA_SOFTWARE_EXP) += rsa-mod-exp.o From patchwork Mon May 18 16:06:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heiko Stuebner X-Patchwork-Id: 245960 List-Id: U-Boot discussion From: heiko at sntech.de (Heiko Stuebner) Date: Mon, 18 May 2020 18:06:35 +0200 Subject: [PATCH v3 2/4] lib: rsa: take spl/non-spl into account when building rsa_verify_with_pkey() In-Reply-To: <20200518160637.2245371-1-heiko@sntech.de> References: <20200518160637.2245371-1-heiko@sntech.de> Message-ID: <20200518160637.2245371-2-heiko@sntech.de> From: Heiko Stuebner Right now in multiple places there are only checks for the full CONFIG_RSA_VERIFY_WITH_PKEY option, not split into main,spl,tpl variants. This breaks when the rsa functions get enabled for SPL, for example to verify u-boot proper from spl. So fix this by using the existing helpers to distinguis between build-steps. Signed-off-by: Heiko Stuebner Change-Id: Idbd112b8544befa9bf809279d819d5fb444f0125 --- changes in v3: - new patch with another build issue lib/rsa/Makefile | 2 +- lib/rsa/rsa-verify.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/rsa/Makefile b/lib/rsa/Makefile index c61ebfd79e..8b75d41f04 100644 --- a/lib/rsa/Makefile +++ b/lib/rsa/Makefile @@ -6,5 +6,5 @@ # Wolfgang Denk, DENX Software Engineering, wd at denx.de. obj-$(CONFIG_$(SPL_TPL_)RSA_VERIFY) += rsa-verify.o rsa-checksum.o -obj-$(CONFIG_RSA_VERIFY_WITH_PKEY) += rsa-keyprop.o +obj-$(CONFIG_$(SPL_TPL_)RSA_VERIFY_WITH_PKEY) += rsa-keyprop.o obj-$(CONFIG_RSA_SOFTWARE_EXP) += rsa-mod-exp.o diff --git a/lib/rsa/rsa-verify.c b/lib/rsa/rsa-verify.c index f7ae174cb0..681b53eeb9 100644 --- a/lib/rsa/rsa-verify.c +++ b/lib/rsa/rsa-verify.c @@ -284,7 +284,7 @@ out: } #endif -#if CONFIG_IS_ENABLED(FIT_SIGNATURE) || IS_ENABLED(CONFIG_RSA_VERIFY_WITH_PKEY) +#if CONFIG_IS_ENABLED(FIT_SIGNATURE) || CONFIG_IS_ENABLED(RSA_VERIFY_WITH_PKEY) /** * rsa_verify_key() - Verify a signature against some data using RSA Key * @@ -358,7 +358,7 @@ static int rsa_verify_key(struct image_sign_info *info, } #endif -#ifdef CONFIG_RSA_VERIFY_WITH_PKEY +#if CONFIG_IS_ENABLED(RSA_VERIFY_WITH_PKEY) /** * rsa_verify_with_pkey() - Verify a signature against some data using * only modulus and exponent as RSA key properties. From patchwork Mon May 18 16:06:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heiko Stuebner X-Patchwork-Id: 245961 List-Id: U-Boot discussion From: heiko at sntech.de (Heiko Stuebner) Date: Mon, 18 May 2020 18:06:36 +0200 Subject: [PATCH v3 3/4] spl: fit: select SPL_HASH_SUPPORT for SPL_FIT_SIGNATURE In-Reply-To: <20200518160637.2245371-1-heiko@sntech.de> References: <20200518160637.2245371-1-heiko@sntech.de> Message-ID: <20200518160637.2245371-3-heiko@sntech.de> From: Heiko Stuebner rsa-checksum needs support for hash functions or else will run into compile errors like: u-boot/lib/rsa/rsa-checksum.c:28: undefined reference to `hash_progressive_lookup_algo' So similar to the main FIT_SIGNATURE entry selects HASH, select SPL_HASH_SUPPORT for SPL_FIT_SIGNATURE. Cc: Heinrich Schuchardt Signed-off-by: Heiko Stuebner Reviewed-by: Philipp Tomsich Reviewed-by: Kever Yang --- Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/Kconfig b/Kconfig index 0e7ccc0b07..482f39c66f 100644 --- a/Kconfig +++ b/Kconfig @@ -459,6 +459,7 @@ config SPL_FIT_SIGNATURE bool "Enable signature verification of FIT firmware within SPL" depends on SPL_DM select SPL_FIT + select SPL_HASH_SUPPORT select SPL_RSA select SPL_RSA_VERIFY select SPL_IMAGE_SIGN_INFO From patchwork Mon May 18 16:06:37 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Heiko Stuebner X-Patchwork-Id: 245959 List-Id: U-Boot discussion From: heiko at sntech.de (Heiko Stuebner) Date: Mon, 18 May 2020 18:06:37 +0200 Subject: [PATCH v3 4/4] spl: fit: select SPL_CRYPTO_SUPPORT for SPL_FIT_SIGNATURE In-Reply-To: <20200518160637.2245371-1-heiko@sntech.de> References: <20200518160637.2245371-1-heiko@sntech.de> Message-ID: <20200518160637.2245371-4-heiko@sntech.de> From: Heiko Stuebner Verifying FIT images obviously needs the rsa parts of crypto support and while main uboot always compiles crypto support, it's optional for SPL and we should thus select the necessary option to not end up in compile errors like: u-boot/lib/rsa/rsa-verify.c:328: undefined reference to `rsa_mod_exp' So select SPL_CRYPTO_SUPPORT in SPL_FIT_SIGNATURE. Signed-off-by: Heiko Stuebner Reviewed-by: Philipp Tomsich Reviewed-by: Kever Yang --- Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/Kconfig b/Kconfig index 482f39c66f..0c184f7f06 100644 --- a/Kconfig +++ b/Kconfig @@ -459,6 +459,7 @@ config SPL_FIT_SIGNATURE bool "Enable signature verification of FIT firmware within SPL" depends on SPL_DM select SPL_FIT + select SPL_CRYPTO_SUPPORT select SPL_HASH_SUPPORT select SPL_RSA select SPL_RSA_VERIFY