Hi Patrick,
On 2/9/21 9:11 AM, Patrick DELAUNAY wrote:
Hi,
On 1/11/21 4:41 PM, Alexandru Gagniuc wrote:
Prepare the source tree for accepting implementations of the ECDSA
algorithm. This patch deals with the boring aspects of Makefiles and
Kconfig files.
Signed-off-by: Alexandru Gagniuc<mr.nuke...@gmail.com>
---
include/image.h | 10 +++++-----
include/u-boot/rsa.h | 2 +-
lib/Kconfig | 1 +
lib/Makefile | 1 +
lib/ecdsa/Kconfig | 23 +++++++++++++++++++++++
lib/ecdsa/Makefile | 1 +
lib/ecdsa/ecdsa-verify.c | 13 +++++++++++++
7 files changed, 45 insertions(+), 6 deletions(-)
create mode 100644 lib/ecdsa/Kconfig
create mode 100644 lib/ecdsa/Makefile
create mode 100644 lib/ecdsa/ecdsa-verify.c
diff --git a/include/image.h b/include/image.h
index 6628173dca..1d70ba0ece 100644
--- a/include/image.h
+++ b/include/image.h
@@ -1198,20 +1198,20 @@ int calculate_hash(const void *data, int
data_len, const char *algo,
#if defined(USE_HOSTCC)
# if defined(CONFIG_FIT_SIGNATURE)
# define IMAGE_ENABLE_SIGN 1
-# define IMAGE_ENABLE_VERIFY 1
+# define IMAGE_ENABLE_VERIFY_RSA 1
# define IMAGE_ENABLE_VERIFY_ECDSA 1
# define FIT_IMAGE_ENABLE_VERIFY 1
# include <openssl/evp.h>
# else
# define IMAGE_ENABLE_SIGN 0
-# define IMAGE_ENABLE_VERIFY 0
+# define IMAGE_ENABLE_VERIFY_RSA 0
# define IMAGE_ENABLE_VERIFY_ECDSA 0
# define FIT_IMAGE_ENABLE_VERIFY 0
# endif
#else
# define IMAGE_ENABLE_SIGN 0
-# define IMAGE_ENABLE_VERIFY CONFIG_IS_ENABLED(RSA_VERIFY)
-# define IMAGE_ENABLE_VERIFY_ECDSA 0
+# define IMAGE_ENABLE_VERIFY_RSA CONFIG_IS_ENABLED(RSA_VERIFY)
+# define IMAGE_ENABLE_VERIFY_ECDSA CONFIG_IS_ENABLED(ECDSA_VERIFY)
here you are using CONFIG_IS_ENABLED.
This macro imply to test CONFIG_ECDSA_VERIFY or CONFIG_SPL_ECDSA_VERIFY
(for SPL build)
=> but CONFIG_SPL_ECDSA_VERIFY is missing, I think you need to add it,
as RSA
This patch adds both "config ECDSA_VERIFY" and "config SPL_ECDSA_VERIFY"
see @lib/ecdsa/Kconfig. I believe this achieves what you need.
[snip]
diff --git a/lib/Makefile b/lib/Makefile
index cf64188ba5..ab86be2678 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -59,6 +59,7 @@ endif
obj-$(CONFIG_$(SPL_)ACPIGEN) += acpi/
obj-$(CONFIG_$(SPL_)MD5) += md5.o
+obj-$(CONFIG_ECDSA) += ecdsa/
obj-$(CONFIG_$(SPL_)ECDSA) += ecdsa/
The intent here is to use CONFIG_ECDSA to denote ECDSA support.
CONFIG_ECDSA_VERIFY and CONFIG_SPL_ECDSA_VERIFY are used to enable the
code in u-boot and SPL respectively. Only verification is supported on
the target, so these are the only switches that enable or disable code.
obj-$(CONFIG_$(SPL_)RSA) += rsa/
obj-$(CONFIG_FIT_SIGNATURE) += hash-checksum.o
obj-$(CONFIG_SHA1) += sha1.o
diff --git a/lib/ecdsa/Kconfig b/lib/ecdsa/Kconfig
new file mode 100644
index 0000000000..1244d6b6ea
--- /dev/null
+++ b/lib/ecdsa/Kconfig
@@ -0,0 +1,23 @@
+config ECDSA
+ bool "Enable ECDSA support"
+ depends on DM
+ help
+ This enables the ECDSA algorithm for FIT image verification in
U-Boot.
+ See doc/uImage.FIT/signature.txt for more details.
+ The ECDSA algorithm is implemented using the driver model. So
+ CONFIG_DM is required by this library.
+ ECDSA is enabled for mkimage regardless of this option.
+
+if ECDSA
+
Add CONFIG_SPL_ECDSA to select independently support in SPL et/or in U-Boot
as it is done for RSA
+ config SPL_ECDSA
+ bool "Use ECDSA library within in SPL"
I though about an SPL_ECDSA kconfig. As mentioned above, we have
independent switches to enable the code for u-boot/SPL. We can enable
ECDSA support in u-boot, SPL, neither or both. What would this switch add?
+config ECDSA_VERIFY
+ bool "Enable ECDSA verification support in U-Boot."
+ select SPL_ECDSA
+ help
+ Allow ECDSA signatures to be recognized and verified in U-Boot.
+
+config SPL_ECDSA_VERIFY
+ bool "Enable ECDSA verification support in SPL"
+ help
+ Allow ECDSA signatures to be recognized and verified in SPL.
This is the switch for SPL (@mentioned earlier).
Alex
