Designated initializers are more readable because we do not
have to check the order in the struct definitions.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Reviewed-by: Simon Glass <sjg@chromium.org>

Remove the need to explicitly add SHA/RSA pairings. Invalid SHA/RSA
pairings will still fail on verify operations when the hash length is
longer than the key length.

Follow the same naming scheme "checksum,crytpo" without explicitly
defining the string.

Indirectly adds support for "sha1,rsa4096" signing/verification.

Signed-off-by: Andrew Duda <aduda@meraki.com>
Signed-off-by: aduda <aduda@meraki.com>
Reviewed-by: Simon Glass <sjg@chromium.org>

Cut down on the repetition of algorithm information by defining separate
checksum and crypto structs. image_sig_algos are now simply pairs of
unique checksum and crypto algos.

Signed-off-by: Andrew Duda <aduda@meraki.com>
Signed-off-by: aduda <aduda@meraki.com>
Reviewed-by: Simon Glass <sjg@chromium.org>

Padding verification was done against static SHA/RSA pair arrays which
take up a lot of static memory, are mostly 0xff, and cannot be reused
for additional SHA/RSA pairings. The padding can be easily computed
according to PKCS#1v2.1 as:

  EM = 0x00 || 0x01 || PS || 0x00 || T

where PS is (emLen - tLen - 3) octets of 0xff and T is DER encoding
of the hash.

Store DER prefix in checksum_algo and create rsa_verify_padding
function to handle verification of a message for any SHA/RSA pairing.

Signed-off-by: Andrew Duda <aduda@meraki.com>
Signed-off-by: aduda <aduda@meraki.com>
Reviewed-by: Simon Glass <sjg@chromium.org>

The signature for this macro has changed. Bring in the upstream version and
adjust U-Boot's usages to suit.

Signed-off-by: Simon Glass <sjg@chromium.org>
Update to drivers/power/pmic/palmas.c:
Signed-off-by: Keerthy <j-keerthy@ti.com>

Change-Id: I6cc9021339bfe686f9df21d61a1095ca2b3776e8

Use fdt_for_each_subnode macro to simplify the code a bit.

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Acked-by: Simon Glass <sjg@chromium.org>

Currently the hash functions used in RSA are called directly from the sha1
and sha256 libraries. Change the RSA checksum library to use the progressive
hash API's registered with struct hash_algo. This will allow the checksum
library to use the hardware accelerated progressive hash API's once available.

Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com>
CC: Simon Glass <sjg@chromium.org>
Acked-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Simon Glass <sjg@chromium.org>
(Fixed build error in am335x_boneblack_vboot due to duplicate CONFIG_DM)

Change-Id: Ic44279432f88d4e8594c6e94feb1cfcae2443a54

commit 18b06652 "tools: include u-boot version of sha256.h"
unconditionally forced the sha256.h from u-boot to be used
for tools instead of the host version. This is fragile though
as it will also include the host version. Therefore move it
to include/u-boot to join u-boot/md5.h etc which were renamed
for the same reason.

cc: Simon Glass <sjg@chromium.org>
Signed-off-by: Jeroen Hofstee <jeroen@myspectrum.nl>

It is more common to have 0 mean OK, and -ve mean error. Change this
function to work the same way to avoid confusion.

Signed-off-by: Simon Glass <sjg@chromium.org>

add host tool "fit_check_sign" which verifies, if a fit image is
signed correct.

Signed-off-by: Heiko Schocher <hs@denx.de>
Cc: Simon Glass <sjg@chromium.org>

Add support for sha256,rsa4096 signatures in u-boot.

Signed-off-by: Heiko Schocher <hs@denx.de>
Acked-by: Simon Glass <sjg@chromium.org>
Cc: andreas@oetken.name

based on patch from andreas@oetken.name:

http://patchwork.ozlabs.org/patch/294318/


commit message:
I currently need support for rsa-sha256 signatures in u-boot and found out that
the code for signatures is not very generic. Thus adding of different
hash-algorithms for rsa-signatures is not easy to do without copy-pasting the
rsa-code. I attached a patch for how I think it could be better and included
support for rsa-sha256. This is a fast first shot.

aditionally work:
- removed checkpatch warnings
- removed compiler warnings
- rebased against current head

Signed-off-by: Heiko Schocher <hs@denx.de>
Cc: andreas@oetken.name
Cc: Simon Glass <sjg@chromium.org>

Signed-off-by: Wolfgang Denk <wd@denx.de>
[trini: Fixup common/cmd_io.c]
Signed-off-by: Tom Rini <trini@ti.com>

While signing images is useful, it does not provide complete protection
against several types of attack. For example, it it possible to create a
FIT with the same signed images, but with the configuration changed such
that a different one is selected (mix and match attack). It is also possible
to substitute a signed image from an older FIT version into a newer FIT
(roll-back attack).

Add support for signing of FIT configurations using the libfdt's region
support.

Please see doc/uImage.FIT/signature.txt for more information.

Signed-off-by: Simon Glass <sjg@chromium.org>

RSA provides a public key encryption facility which is ideal for image
signing and verification.

Images are signed using a private key by mkimage. Then at run-time, the
images are verified using a private key.

This implementation uses openssl for the host part (mkimage). To avoid
bringing large libraries into the U-Boot binary, the RSA public key
is encoded using a simple numeric representation in the device tree.

Signed-off-by: Simon Glass <sjg@chromium.org>

Add support for signing images using a new signature node. The process
is handled by fdt_add_verification_data() which now takes parameters to
provide the keys and related information.

Signed-off-by: Simon Glass <sjg@chromium.org>

Add a structure to describe an algorithm which can sign and (later) verify
images.

Signed-off-by: Simon Glass <sjg@chromium.org>

This stuff has been rotting in the tree for a while now. Remove it.

Signed-off-by: Marek Vasut <marex@denx.de>

Signed-off-by: Wolfgang Denk <wd@denx.de>
Cc: Albert ARIBAUD <albert.u.boot@aribaud.net>
Cc: Marius Gröger <mag@sysgo.de>

Signed-off-by: Wolfgang Denk <wd@denx.de>
Cc: Albert ARIBAUD <albert.u.boot@aribaud.net>
Cc: Marius Gröger <mag@sysgo.de>

This helps to clean up the include/ directory so that it only contains
non-architecture-specific headers and also matches Linux's directory
layout which many U-Boot developers are already familiar with.

Signed-off-by: Peter Tyser <ptyser@xes-inc.com>

The appropriate include/asm-$ARCH directory should already by symlinked
to include/asm so using the whole "asm-$ARCH" path is unnecessary.

This change should also allow us to move the include/asm-$ARCH
directories into their appropriate lib/$ARCH/ directories.

Signed-off-by: Peter Tyser <ptyser@xes-inc.com>

Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>

Use lowlevel_init() instead of platformsetup() [rename].
Patch by Peter Pearse, 06 Oct 2005

Patch by Rowel Atienza, 06 Apr 2005

* Patch by Curt Brune, 17 May 2004:
  - Add support for Samsung S3C4510B CPU (ARM7tdmi based SoC)
  - Add support for ESPD-Inc. EVB4510 Board

- DDR Ram support for PM520 (MPC5200)
- support for different flash types (PM520)
- USB / IDE / CF-Card / DiskOnChip support for PM520
- 8 bit boot rom support for PM520/CE520
- Add auto SDRAM module detection for MicroSys CPC45 board (MPC8245)
- I2C and RTC support for CPC45
- support of new flash type (28F160C3T) for CPC45

  "miivals.h" is missing

* Patches by Mark Jonas, 13 Apr 2004:
  - Remove CS0 chip select timing setting from cpu/mpc5xxx/start.S
  - Add sync instructions to IceCube SDRAM init code
  - Move SDRAM chip constants into seperate include files
  - Unify DDR and SDR initialization code
  - Unify all IceCube (Lite5xxx) target names

* Add support for MGT5100 and MPC5200 processors

  - Correct flash and JFFS2 support for MPC8260ADS
  - fix PVR values and clock generation for PowerQUICC II family
    (8270/8275/8280)

* Patch by Bernhard Kuhn, 08 Jul 2003:
  - add support for M68K targets

* Patch by Ken Chou, 3 Jul:
  - Fix PCI config table for A3000
  - Fix iobase for natsemi.c
    (PCI_BASE_ADDRESS_0 is the IO base register for DP83815)

* Allow to enable "slow" POST routines by key press on power-on
* Fix temperature dependend switching of LCD backlight on LWMON
* Tweak output format for LWMON