rsa: read back to check the key hash after writing OTP

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I9cee6e758b487e3947727dc4c68df66ef2c51f67

rsa: support write public hash in spl

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I4120d0cad1cb24b45c3b281649e1eba520a11ee2

lib: rsa-sign: add rockchip rsa key hash

SPL requires key hash to verify and flash it to OTP/EFUSE.

- hash@c: n, e, c
- hash@np: n, e, np

/ {
signature {
key-dev {
require

lib: rsa-sign: add rockchip rsa key hash

SPL requires key hash to verify and flash it to OTP/EFUSE.

- hash@c: n, e, c
- hash@np: n, e, np

/ {
signature {
key-dev {
required = "conf";
algo = "sha256,rsa2048";
rsa,np = <...>;
rsa,c = <...>;
rsa,modulus = <...>;
rsa,exponent-BN = <...>;
...
key-name-hint = "dev";
hash@np {
algo = "sha256";
value = <0x0934bc4d 0xfbc31ffe 0x9224d6c2 0x1a3aa280 0x881d881e 0xe2006246 0x01b9e724 0x35c03428>;
};
hash@c {
algo = "sha256";
value = <0x08962385 0x34585e06 0x0b73a496 0x374b148d 0xa2700a75 0x4aae08ad 0xb2a324a3 0x95ee6b52>;
};
};
};
...
};

But after processed by scripts/fit.sh, only one of "hash@c" and "hash@np" would be left.

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: Id9454100f9fdb06b30f9a4b2a7bdd180f117cb68

show more ...

lib: avb: support crypto sha256/512

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: Ifbcc1940d9b494fc488c0b9e95f88d7c98604f62

lib: sysmem: update help of "sysmem_search" command

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: Ie747d258fa00301c488f5747cf729c242e4d6033

lib: avb: independent on optee client

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I1bab69baf97b5174024db25278cf30efafd3e34e

lib: avb: separate the ab from the avb lib

Open CONFIG_AVB_LIBAVB_USER & CONFIG_ANDROID_AB &
CONFIG_AVB_LIBAVB_AB to enable ab.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I16119

lib: avb: separate the ab from the avb lib

Open CONFIG_AVB_LIBAVB_USER & CONFIG_ANDROID_AB &
CONFIG_AVB_LIBAVB_AB to enable ab.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I1611907b3cb82f72d5e706ed966ee98c7569d230

show more ...

lib: rsa-verify: require np/c factor if using hardware decrypt

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I2c5a68e86a04f4c65719521ac9aac62297432beb

lib: avb: update ops functions

1.read_from_partition: support read vbmeta from the partition tail.
2.validate_public_key_for_partition: support this function

Signed-off-by: Jason Zhu <jason.zhu@roc

lib: avb: update ops functions

1.read_from_partition: support read vbmeta from the partition tail.
2.validate_public_key_for_partition: support this function

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I5372848a9339b10f5b1a66e92f5217a0a3122392

show more ...

lib: optee_client: add README

Add README file to record some important information of optee_client.

Signed-off-by: Elon Zhang <zhangzj@rock-chips.com>
Change-Id: I66788f021d38c4617c87b46b6e3640ed7d

lib: optee_client: add README

Add README file to record some important information of optee_client.

Signed-off-by: Elon Zhang <zhangzj@rock-chips.com>
Change-Id: I66788f021d38c4617c87b46b6e3640ed7dd9e22f

show more ...

rochchip: board: only map op-tee share memory as dcache enabled

The cache fixup is for the data coherence when communication
between U-Boot and OP-TEE. And data abort exception appeares on
OP-TEE V1

rochchip: board: only map op-tee share memory as dcache enabled

The cache fixup is for the data coherence when communication
between U-Boot and OP-TEE. And data abort exception appeares on
OP-TEE V1 32bit platform due to unknown reason.
So only the share memory need be mapped as dcache enabled.

Signed-off-by: Elon Zhang <zhangzj@rock-chips.com>
Change-Id: I92b62ef5fbdf47adc0328a14034a5861e8e77fed

show more ...

lib: optee_client: add optee initialize flag

Add optee initialize flag to reduce redundant calling.

Signed-off-by: Elon Zhang <zhangzj@rock-chips.com>
Change-Id: Ib3e883c48d5c85c446f3e9e991cd4cfcd1

lib: optee_client: add optee initialize flag

Add optee initialize flag to reduce redundant calling.

Signed-off-by: Elon Zhang <zhangzj@rock-chips.com>
Change-Id: Ib3e883c48d5c85c446f3e9e991cd4cfcd1cede90

show more ...

lib: optee_client: update to new optee msg for optee v1 platform

optee v1 smc message is deprecated and update to new optee msg,
api revision smc call is add in init func to check capcibility.

Chan

lib: optee_client: update to new optee msg for optee v1 platform

optee v1 smc message is deprecated and update to new optee msg,
api revision smc call is add in init func to check capcibility.

Change-Id: Ia54a1257050b5e3776a00b6b76ca608c939bb401
Signed-off-by: Hisping Lin <hisping.lin@rock-chips.com>
Signed-off-by: Elon Zhang <zhangzj@rock-chips.com>

show more ...

lib: lz4_wrapper: fix data-abort due to odd address access

We don't clearly know why there is odd address, maybe the
compression itself does.

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Chan

lib: lz4_wrapper: fix data-abort due to odd address access

We don't clearly know why there is odd address, maybe the
compression itself does.

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: Iabf2c09839485a0b12301ea003f945e1de414d83

show more ...

lib: gunzip: add hw gunzip support

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I52b6d090fdc7d535a4b0804826f5669c068464dc

UPSTREAM: rsa: add support of padding pss

We add the support of the padding pss for rsa signature.
This new padding is often recommended instead of pkcs-1.5.

Signed-off-by: Philippe Reynes <philipp

UPSTREAM: rsa: add support of padding pss

We add the support of the padding pss for rsa signature.
This new padding is often recommended instead of pkcs-1.5.

Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
(cherry picked from commit 061daa0b61f0fbeb214c566f3adb23da05545320)

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I28e5722504bfd0428cd119b2aaae60682a720648

show more ...

UPSTREAM: rsa: add a structure for the padding

The rsa signature use a padding algorithm. By default, we use the
padding pkcs-1.5. In order to add some new padding algorithm, we
add a padding framew

UPSTREAM: rsa: add a structure for the padding

The rsa signature use a padding algorithm. By default, we use the
padding pkcs-1.5. In order to add some new padding algorithm, we
add a padding framework to manage several padding algorithm.
The choice of the padding is done in the file .its.

Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
(cherry picked from commit 20031567e12bb312bff95b70767f6275e20f0346)

Conflicts:
common/image-fit.c
lib/rsa/rsa-sign.c
lib/rsa/rsa-verify.c

Change-Id: Ie522fec1ea69e6b86ebde0f7dad91a45670da66b
Signed-off-by: Joseph Chen <chenjh@rock-chips.com>

show more ...

UPSTREAM: rsa: use new openssl API to create signature

Previous implementation of the rsa signature was using
the openssl API EVP_Sign*, but the new openssl API
EVP_DigestSign* is more flexible. So

UPSTREAM: rsa: use new openssl API to create signature

Previous implementation of the rsa signature was using
the openssl API EVP_Sign*, but the new openssl API
EVP_DigestSign* is more flexible. So we move to this
new API.

Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
(cherry picked from commit 3b5d6979fcb80ffae3b140be6edc04cbde1a0b72)

Conflicts:
lib/rsa/rsa-sign.c

Change-Id: I6016a13904024a63d6fb8110cef37e57a164eed9
Signed-off-by: Joseph Chen <chenjh@rock-chips.com>

show more ...

lib: rsa: checksum: clean up hash calculate

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I9a8d30923c8744e4af9612b0edeaed10410b0b32

lib: rsa: verify: rename hw_crypto_rsa() => rsa_mod_exp_hw()

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I7164a2001f386b18a0e502be4735be45ed9907f1

lib: optee_client v2: support RKFS version 2

1.use get_rkss_version function to get rkss version,
if security partition have data with rkss version 1, then
we choice rkss version 1, if security

lib: optee_client v2: support RKFS version 2

1.use get_rkss_version function to get rkss version,
if security partition have data with rkss version 1, then
we choice rkss version 1, if security partition is empty,
then we choice rkss version 2
2.rkss version 2 support dual backup mechanism,
security partition total use 1M
3.rkss version 2 R&W 256k data one time

Change-Id: I2f17b22d6a442df84be0d94a808b03465dc6fefe
Signed-off-by: Hisping Lin <hisping.lin@rock-chips.com>

show more ...

lib: optee_client v1: support RKFS version 2

1.use get_rkss_version function to get rkss version,
if security partition have data with rkss version 1, then
we choice rkss version 1, if security

lib: optee_client v1: support RKFS version 2

1.use get_rkss_version function to get rkss version,
if security partition have data with rkss version 1, then
we choice rkss version 1, if security partition is empty,
then we choice rkss version 2
2.rkss version 2 support dual backup mechanism,
security partition total use 1M
3.rkss version 2 R&W 256k data one time

Change-Id: I4103b6600666dffccf473ec4ed8854776a46da31
Signed-off-by: Hisping Lin <hisping.lin@rock-chips.com>

show more ...

lib: optee_client: communicate with optee os v2 32 bits

Change-Id: Ic352f86e73631b64110b9d0d1742dc6b98e97d59
Signed-off-by: Hisping Lin <hisping.lin@rock-chips.com>

lib: optee_client: free section in write and truncate func

Change-Id: Ifd7b53d4c2d1e08591192aa44f04af2b1ff07e5b
Signed-off-by: Hisping Lin <hisping.lin@rock-chips.com>

lib: hang: reset the device if hang in spl

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: Ica9426db31809dc316ef0cad3e4b2c0ff7985632