Re: [PATCH v2 37/50] image: Drop IMAGE_ENABLE_SIGN/VERIFY defines

On 5/6/21 9:24 AM, Simon Glass wrote:

Add host Kconfigs for FIT_SIGN and RSA_VERIFY. With these we can use CONFIG_IS_ENABLED() directly in the host build, so drop the unnecessary indirections IMAGE_ENABLE_SIGN and HOST_RSA_VERIFY. Also drop FIT_IMAGE_ENABLE_VERIFY which is not actually used.

Leave IMAGE_ENABLE_VERIFY_ECDSA along since this feature is incomplete and needs to be integrated with RSA.

Signed-off-by: Simon Glass sjg@chromium.org

(no changes since v1)

common/image-fit.c | 6 +++--- common/image-sig.c | 10 +++++----- include/image.h | 13 ++----------- include/u-boot/ecdsa.h | 2 +- include/u-boot/rsa.h | 4 ++-- tools/Kconfig | 10 ++++++++++ tools/image-host.c | 4 ++-- 7 files changed, 25 insertions(+), 24 deletions(-)

diff --git a/common/image-fit.c b/common/image-fit.c index c13ff6bba24..e81a0858dc1 100644 --- a/common/image-fit.c +++ b/common/image-fit.c @@ -1301,7 +1301,7 @@ int fit_image_verify_with_data(const void *fit, int image_noffset, int ret;

/* Verify all required signatures */

• if (FIT_IMAGE_ENABLE_VERIFY &&

• if (CONFIG_IS_ENABLED(RSA_VERIFY) &&

NAK. Having verification depend directly on CONFIG_RSA_VERIFY will make adding ECDSA support that much more convoluted.

   fit_image_verify_required_sigs(fit, image_noffset, data, size,
			   gd_fdt_blob(), &verify_all)) {
err_msg = "Unable to verify required signature";

@@ -1323,7 +1323,7 @@ int fit_image_verify_with_data(const void *fit, int image_noffset, &err_msg)) goto error; puts("+ ");

• } else if (FIT_IMAGE_ENABLE_VERIFY && verify_all &&
  

• } else if (CONFIG_IS_ENABLED(RSA_VERIFY) && verify_all &&
  	!strncmp(name, FIT_SIG_NODENAME,
  		strlen(FIT_SIG_NODENAME))) {
  ret = fit_image_check_sig(fit, noffset, data,
  

@@ -2045,7 +2045,7 @@ int fit_image_load(bootm_headers_t *images, ulong addr, if (image_type == IH_TYPE_KERNEL) images->fit_uname_cfg = fit_base_uname_config;

• if (FIT_IMAGE_ENABLE_VERIFY && images->verify) {
  

• if (CONFIG_IS_ENABLED(RSA_VERIFY) && images->verify) {
  puts("   Verifying Hash Integrity ... ");
  if (fit_config_verify(fit, cfg_noffset)) {
  	puts("Bad Data Hash\n");
  

diff --git a/common/image-sig.c b/common/image-sig.c index bbc6bb3b1e3..74ca96a39e9 100644 --- a/common/image-sig.c +++ b/common/image-sig.c @@ -29,7 +29,7 @@ struct checksum_algo checksum_algos[] = { .checksum_len = SHA1_SUM_LEN, .der_len = SHA1_DER_LEN, .der_prefix = sha1_der_prefix, -#if IMAGE_ENABLE_SIGN +#if CONFIG_IS_ENABLED(FIT_SIGN) .calculate_sign = EVP_sha1, #endif .calculate = hash_calculate, @@ -39,7 +39,7 @@ struct checksum_algo checksum_algos[] = { .checksum_len = SHA256_SUM_LEN, .der_len = SHA256_DER_LEN, .der_prefix = sha256_der_prefix, -#if IMAGE_ENABLE_SIGN +#if CONFIG_IS_ENABLED(FIT_SIGN) .calculate_sign = EVP_sha256, #endif .calculate = hash_calculate, @@ -50,7 +50,7 @@ struct checksum_algo checksum_algos[] = { .checksum_len = SHA384_SUM_LEN, .der_len = SHA384_DER_LEN, .der_prefix = sha384_der_prefix, -#if IMAGE_ENABLE_SIGN +#if CONFIG_IS_ENABLED(FIT_SIGN) .calculate_sign = EVP_sha384, #endif .calculate = hash_calculate, @@ -62,7 +62,7 @@ struct checksum_algo checksum_algos[] = { .checksum_len = SHA512_SUM_LEN, .der_len = SHA512_DER_LEN, .der_prefix = sha512_der_prefix, -#if IMAGE_ENABLE_SIGN +#if CONFIG_IS_ENABLED(FIT_SIGN) .calculate_sign = EVP_sha512, #endif .calculate = hash_calculate, @@ -122,7 +122,7 @@ struct checksum_algo *image_get_checksum_algo(const char *full_name) struct checksum_algo *algo = &checksum_algos[i];

		MANUAL_RELOC(algo->name);

-#if IMAGE_ENABLE_SIGN +#if CONFIG_IS_ENABLED(FIT_SIGN) MANUAL_RELOC(algo->calculate_sign); #endif MANUAL_RELOC(algo->calculate); diff --git a/include/image.h b/include/image.h index 64866c609f4..12043abd049 100644 --- a/include/image.h +++ b/include/image.h @@ -1139,22 +1139,13 @@ int calculate_hash(const void *data, int data_len, const char *algo, */ #if defined(USE_HOSTCC) # if defined(CONFIG_FIT_SIGNATURE) -# define IMAGE_ENABLE_SIGN 1 -# define IMAGE_ENABLE_VERIFY 1 # define IMAGE_ENABLE_VERIFY_ECDSA 1 -# define FIT_IMAGE_ENABLE_VERIFY 1 # include <openssl/evp.h> # else -# define IMAGE_ENABLE_SIGN 0 -# define IMAGE_ENABLE_VERIFY 0 # define IMAGE_ENABLE_VERIFY_ECDSA 0 -# define FIT_IMAGE_ENABLE_VERIFY 0 # endif #else -# define IMAGE_ENABLE_SIGN 0 -# define IMAGE_ENABLE_VERIFY CONFIG_IS_ENABLED(RSA_VERIFY) # define IMAGE_ENABLE_VERIFY_ECDSA 0 -# define FIT_IMAGE_ENABLE_VERIFY CONFIG_IS_ENABLED(FIT_SIGNATURE) #endif

#if CONFIG_IS_ENABLED(FIT) @@ -1209,7 +1200,7 @@ struct image_region { int size; };

-#if IMAGE_ENABLE_VERIFY +#if CONFIG_IS_ENABLED(RSA_VERIFY) # include <u-boot/hash-checksum.h> #endif struct checksum_algo { @@ -1217,7 +1208,7 @@ struct checksum_algo { const int checksum_len; const int der_len; const uint8_t *der_prefix; -#if IMAGE_ENABLE_SIGN +#if CONFIG_IS_ENABLED(FIT_SIGN) const EVP_MD *(*calculate_sign)(void); #endif int (*calculate)(const char *name, diff --git a/include/u-boot/ecdsa.h b/include/u-boot/ecdsa.h index 979690d9660..a446b656a29 100644 --- a/include/u-boot/ecdsa.h +++ b/include/u-boot/ecdsa.h @@ -15,7 +15,7 @@

• @see "struct crypto_algo"
• @{

*/ -#if IMAGE_ENABLE_SIGN +#if CONFIG_IS_ENABLED(FIT_SIGN) /**

• sign() - calculate and return signature for given input data

diff --git a/include/u-boot/rsa.h b/include/u-boot/rsa.h index 45fe3509093..84cefbab442 100644 --- a/include/u-boot/rsa.h +++ b/include/u-boot/rsa.h @@ -31,7 +31,7 @@ struct rsa_public_key {

struct image_sign_info;

-#if IMAGE_ENABLE_SIGN +#if CONFIG_IS_ENABLED(FIT_SIGN) /**

• sign() - calculate and return signature for given input data

@@ -81,7 +81,7 @@ static inline int rsa_add_verify_data(struct image_sign_info *info, } #endif

-#if IMAGE_ENABLE_VERIFY +#if CONFIG_IS_ENABLED(RSA_VERIFY) /**

• rsa_verify_hash() - Verify a signature against a hash

diff --git a/tools/Kconfig b/tools/Kconfig index bbd6e8b9d79..13f923c7ac7 100644 --- a/tools/Kconfig +++ b/tools/Kconfig @@ -59,6 +59,11 @@ config HOST_FIT_SIGNATURE help Enable signature verification of FIT uImages in the host build

+config HOST_FIT_SIGN

• def_bool y
• help

•  Enable signing FIT uImages in the host build
  

• config HOST_FIT_SIGNATURE_MAX_SIZE hex depends on HOST_FIT_SIGNATURE

@@ -79,6 +84,11 @@ config HOST_OF_LIBFDT help Enable libfdt support in the host build.

+config HOST_RSA_VERIFY

• def_bool y
• help

•  Enable RSA verification support in the host build.
  

• config HOST_SHA1 def_bool y help

diff --git a/tools/image-host.c b/tools/image-host.c index 270d36fe451..2be897db943 100644 --- a/tools/image-host.c +++ b/tools/image-host.c @@ -636,7 +636,7 @@ int fit_image_add_verification_data(const char *keydir, const char *keyfile, strlen(FIT_HASH_NODENAME))) { ret = fit_image_process_hash(fit, image_name, noffset, data, size);

• } else if (IMAGE_ENABLE_SIGN && (keydir || keyfile) &&
  

• } else if (CONFIG_IS_ENABLED(FIT_SIGN) && (keydir || keyfile) &&
     !strncmp(node_name, FIT_SIG_NODENAME,
  	strlen(FIT_SIG_NODENAME))) {
  ret = fit_image_process_sig(keydir, keyfile, keydest,
  

@@ -1086,7 +1086,7 @@ int fit_add_verification_data(const char *keydir, const char *keyfile, }

/* If there are no keys, we can't sign configurations */

• if (!IMAGE_ENABLE_SIGN || !(keydir || keyfile))

• if (!CONFIG_IS_ENABLED(FIT_SIGN) || !(keydir || keyfile)) return 0;

  /* Find configurations parent node offset */