[PATCH 09/23] hash: integrate hash on mbedtls
Raymond Mao
raymond.mao at linaro.org
Tue Apr 16 21:00:05 CEST 2024
Integrate common/hash.c on the hash shim layer so that hash APIs
from mbedtls can be leveraged by boot/image and efi_loader.
Signed-off-by: Raymond Mao <raymond.mao at linaro.org>
---
common/hash.c | 161 +++++++++++++++++++++++++++++++++
include/u-boot/hash-checksum.h | 6 ++
2 files changed, 167 insertions(+)
diff --git a/common/hash.c b/common/hash.c
index 3d6b84de47..5352ba88e3 100644
--- a/common/hash.c
+++ b/common/hash.c
@@ -31,10 +31,143 @@
#include <hash.h>
#include <image.h>
#include <u-boot/crc.h>
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+#include <mbedtls/sha1.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/sha512.h>
+#include <mbedtls/md5.h>
+#else
#include <u-boot/sha1.h>
#include <u-boot/sha256.h>
#include <u-boot/sha512.h>
#include <u-boot/md5.h>
+#endif
+
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+
+static int hash_init_sha1(struct hash_algo *algo, void **ctxp)
+{
+ int ret;
+ mbedtls_sha1_context *ctx = malloc(sizeof(mbedtls_sha1_context));
+
+ mbedtls_sha1_init(ctx);
+ ret = mbedtls_sha1_starts(ctx);
+ if (!ret) {
+ *ctxp = ctx;
+ } else {
+ mbedtls_sha1_free(ctx);
+ free(ctx);
+ }
+
+ return ret;
+}
+
+static int hash_update_sha1(struct hash_algo *algo, void *ctx, const void *buf,
+ unsigned int size, int is_last)
+{
+ return mbedtls_sha1_update((mbedtls_sha1_context *)ctx, buf, size);
+}
+
+static int
+hash_finish_sha1(struct hash_algo *algo, void *ctx, void *dest_buf, int size)
+{
+ int ret;
+
+ if (size < algo->digest_size)
+ return -1;
+
+ ret = mbedtls_sha1_finish((mbedtls_sha1_context *)ctx, dest_buf);
+ if (!ret) {
+ mbedtls_sha1_free((mbedtls_sha1_context *)ctx);
+ free(ctx);
+ }
+
+ return ret;
+}
+
+static int hash_init_sha256(struct hash_algo *algo, void **ctxp)
+{
+ int ret;
+ int is224 = algo->digest_size == SHA224_SUM_LEN ? 1 : 0;
+ mbedtls_sha256_context *ctx = malloc(sizeof(mbedtls_sha256_context));
+
+ mbedtls_sha256_init(ctx);
+ ret = mbedtls_sha256_starts(ctx, is224);
+ if (!ret) {
+ *ctxp = ctx;
+ } else {
+ mbedtls_sha256_free(ctx);
+ free(ctx);
+ }
+
+ return ret;
+}
+
+static int hash_update_sha256(struct hash_algo *algo, void *ctx, const void *buf,
+ uint size, int is_last)
+{
+ return mbedtls_sha256_update((mbedtls_sha256_context *)ctx, buf, size);
+}
+
+static int
+hash_finish_sha256(struct hash_algo *algo, void *ctx, void *dest_buf, int size)
+{
+ int ret;
+
+ if (size < algo->digest_size)
+ return -1;
+
+ ret = mbedtls_sha256_finish((mbedtls_sha256_context *)ctx, dest_buf);
+ if (!ret) {
+ mbedtls_sha256_free((mbedtls_sha256_context *)ctx);
+ free(ctx);
+ }
+
+ return ret;
+}
+
+static int hash_init_sha512(struct hash_algo *algo, void **ctxp)
+{
+ int ret;
+ int is384 = algo->digest_size == SHA384_SUM_LEN ? 1 : 0;
+ mbedtls_sha512_context *ctx = malloc(sizeof(mbedtls_sha512_context));
+
+ mbedtls_sha512_init(ctx);
+ ret = mbedtls_sha512_starts(ctx, is384);
+ if (!ret) {
+ *ctxp = ctx;
+ } else {
+ mbedtls_sha512_free(ctx);
+ free(ctx);
+ }
+
+ return ret;
+}
+
+static int hash_update_sha512(struct hash_algo *algo, void *ctx, const void *buf,
+ uint size, int is_last)
+{
+ return mbedtls_sha512_update((mbedtls_sha512_context *)ctx, buf, size);
+}
+
+static int
+hash_finish_sha512(struct hash_algo *algo, void *ctx, void *dest_buf, int size)
+{
+ int ret;
+
+ if (size < algo->digest_size)
+ return -1;
+
+ ret = mbedtls_sha512_finish((mbedtls_sha512_context *)ctx, dest_buf);
+ if (!ret) {
+ mbedtls_sha512_free((mbedtls_sha512_context *)ctx);
+ free(ctx);
+ }
+
+ return ret;
+}
+
+#else /* CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO) */
static int __maybe_unused hash_init_sha1(struct hash_algo *algo, void **ctxp)
{
@@ -144,6 +277,8 @@ static int __maybe_unused hash_finish_sha512(struct hash_algo *algo, void *ctx,
return 0;
}
+#endif /* CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO) */
+
static int hash_init_crc16_ccitt(struct hash_algo *algo, void **ctxp)
{
uint16_t *ctx = malloc(sizeof(uint16_t));
@@ -209,7 +344,11 @@ static struct hash_algo hash_algo[] = {
.name = "md5",
.digest_size = MD5_SUM_LEN,
.chunk_size = CHUNKSZ_MD5,
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ .hash_func_ws = md5_wd_mb,
+#else
.hash_func_ws = md5_wd,
+#endif
},
#endif
#if CONFIG_IS_ENABLED(SHA1)
@@ -219,9 +358,13 @@ static struct hash_algo hash_algo[] = {
.chunk_size = CHUNKSZ_SHA1,
#if CONFIG_IS_ENABLED(SHA_HW_ACCEL)
.hash_func_ws = hw_sha1,
+#else
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ .hash_func_ws = sha1_csum_wd_mb,
#else
.hash_func_ws = sha1_csum_wd,
#endif
+#endif
#if CONFIG_IS_ENABLED(SHA_PROG_HW_ACCEL)
.hash_init = hw_sha_init,
.hash_update = hw_sha_update,
@@ -240,9 +383,13 @@ static struct hash_algo hash_algo[] = {
.chunk_size = CHUNKSZ_SHA256,
#if CONFIG_IS_ENABLED(SHA_HW_ACCEL)
.hash_func_ws = hw_sha256,
+#else
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ .hash_func_ws = sha256_csum_wd_mb,
#else
.hash_func_ws = sha256_csum_wd,
#endif
+#endif
#if CONFIG_IS_ENABLED(SHA_PROG_HW_ACCEL)
.hash_init = hw_sha_init,
.hash_update = hw_sha_update,
@@ -261,17 +408,27 @@ static struct hash_algo hash_algo[] = {
.chunk_size = CHUNKSZ_SHA384,
#if CONFIG_IS_ENABLED(SHA512_HW_ACCEL)
.hash_func_ws = hw_sha384,
+#else
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ .hash_func_ws = sha384_csum_wd_mb,
#else
.hash_func_ws = sha384_csum_wd,
#endif
+#endif
#if CONFIG_IS_ENABLED(SHA512_HW_ACCEL) && CONFIG_IS_ENABLED(SHA_PROG_HW_ACCEL)
.hash_init = hw_sha_init,
.hash_update = hw_sha_update,
.hash_finish = hw_sha_finish,
+#else
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ .hash_init = hash_init_sha512,
+ .hash_update = hash_update_sha512,
+ .hash_finish = hash_finish_sha512,
#else
.hash_init = hash_init_sha384,
.hash_update = hash_update_sha384,
.hash_finish = hash_finish_sha384,
+#endif
#endif
},
#endif
@@ -282,9 +439,13 @@ static struct hash_algo hash_algo[] = {
.chunk_size = CHUNKSZ_SHA512,
#if CONFIG_IS_ENABLED(SHA512_HW_ACCEL)
.hash_func_ws = hw_sha512,
+#else
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ .hash_func_ws = sha512_csum_wd_mb,
#else
.hash_func_ws = sha512_csum_wd,
#endif
+#endif
#if CONFIG_IS_ENABLED(SHA512_HW_ACCEL) && CONFIG_IS_ENABLED(SHA_PROG_HW_ACCEL)
.hash_init = hw_sha_init,
.hash_update = hw_sha_update,
diff --git a/include/u-boot/hash-checksum.h b/include/u-boot/hash-checksum.h
index bcc6ba48fc..7f898b0b35 100644
--- a/include/u-boot/hash-checksum.h
+++ b/include/u-boot/hash-checksum.h
@@ -7,9 +7,15 @@
#define _RSA_CHECKSUM_H
#include <errno.h>
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+#include <mbedtls/sha1.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/sha512.h>
+#else
#include <u-boot/sha1.h>
#include <u-boot/sha256.h>
#include <u-boot/sha512.h>
+#endif
struct image_region;
--
2.25.1
More information about the U-Boot
mailing list