{"id":2224478,"url":"http://patchwork.ozlabs.org/api/patches/2224478/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/patch/20260417130204.49896-10-philippe.reynes@softathome.com/","project":{"id":18,"url":"http://patchwork.ozlabs.org/api/projects/18/?format=json","name":"U-Boot","link_name":"uboot","list_id":"u-boot.lists.denx.de","list_email":"u-boot@lists.denx.de","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260417130204.49896-10-philippe.reynes@softathome.com>","list_archive_url":null,"date":"2026-04-17T13:01:59","name":"[v4,09/14] tools: mkimage: pre-load: add support of ecdsa","commit_ref":null,"pull_url":null,"state":"superseded","archived":false,"hash":"ab4e456f8f63cca7a70f8babf957d090353cfdb3","submitter":{"id":74351,"url":"http://patchwork.ozlabs.org/api/people/74351/?format=json","name":"Philippe Reynes","email":"philippe.reynes@softathome.com"},"delegate":{"id":161313,"url":"http://patchwork.ozlabs.org/api/users/161313/?format=json","username":"raymo200915","first_name":"Raymond","last_name":"Mao","email":"raymondmaoca@gmail.com"},"mbox":"http://patchwork.ozlabs.org/project/uboot/patch/20260417130204.49896-10-philippe.reynes@softathome.com/mbox/","series":[{"id":500332,"url":"http://patchwork.ozlabs.org/api/series/500332/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/list/?series=500332","date":"2026-04-17T13:02:04","name":"add software ecdsa support","version":4,"mbox":"http://patchwork.ozlabs.org/series/500332/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2224478/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2224478/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com\n header.a=rsa-sha256 header.s=selector1-softathome1-onmicrosoft-com\n header.b=Gb5VXrkq;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)","phobos.denx.de;\n dmarc=none (p=none dis=none) header.from=softathome.com","phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de","phobos.denx.de;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=softathome1.onmicrosoft.com header.i=@softathome1.onmicrosoft.com\n header.b=\"Gb5VXrkq\";\n\tdkim-atps=neutral","phobos.denx.de; dmarc=none (p=none dis=none)\n header.from=softathome.com","phobos.denx.de;\n spf=pass smtp.mailfrom=philippe.reynes@softathome.com"],"Received":["from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxw5z1ND9z1yCv\n\tfor ; Fri, 17 Apr 2026 23:02:47 +1000 (AEST)","from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id 4EC9F8431C;\n\tFri, 17 Apr 2026 15:02:18 +0200 (CEST)","by phobos.denx.de (Postfix, from userid 109)\n id 18B3884297; Fri, 17 Apr 2026 15:02:17 +0200 (CEST)","from PAUP264CU001.outbound.protection.outlook.com\n (mail-francecentralazlp170110002.outbound.protection.outlook.com\n [IPv6:2a01:111:f403:c20a::2])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id A434A8429E\n for ; Fri, 17 Apr 2026 15:02:13 +0200 (CEST)","from PA7P264CA0087.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:349::12)\n by MRZP264MB2713.FRAP264.PROD.OUTLOOK.COM (2603:10a6:501:1e::8) with\n Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9818.25; Fri, 17 Apr\n 2026 13:02:10 +0000","from PA3PEPF000089BB.FRAP264.PROD.OUTLOOK.COM\n (2603:10a6:102:349:cafe::ee) by PA7P264CA0087.outlook.office365.com\n (2603:10a6:102:349::12) with Microsoft SMTP Server (version=TLS1_3,\n cipher=TLS_AES_256_GCM_SHA384) id 15.20.9769.52 via Frontend Transport; Fri,\n 17 Apr 2026 13:02:10 +0000","from proxy.softathome.com (149.6.166.170) by\n PA3PEPF000089BB.mail.protection.outlook.com (10.167.242.23) with Microsoft\n SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9769.17\n via Frontend Transport; Fri, 17 Apr 2026 13:02:10 +0000","from sah1lpt726.home (unknown [192.168.72.39])\n by proxy.softathome.com (Postfix) with ESMTPSA id 4DB6820E34;\n Fri, 17 Apr 2026 15:02:10 +0200 (CEST)"],"X-Spam-Checker-Version":"SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,\n DKIM_VALID,RCVD_IN_DNSWL_BLOCKED,SPF_HELO_PASS,SPF_PASS autolearn=ham\n autolearn_force=no version=3.4.2","ARC-Seal":"i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;\n b=WGG8g7SGtdxsd8F8ZN3OhRJVkrXvSrJW4qLIoYluOTZY6VhekSTCIN1TrZuwoTFaBk8L3iem5QhnWANsOOSMtREX8Pqvrvt5nkZzOQxvOjp0/V8IFDuQqP0tFyDuZfVbxG01f4sul6unMyUcCBK+LU4h7vP34fIAvkSw2wUS8LUsXIlpCouVqm3RuiT4w46S2fFrXzvF2ufToHiWZwKacTiHtME7a5pbi3CuE5iB+gbQ2RT9sfEU2THzsYwa+Ux9X8i34xNNYU+7JVfJY+bj0hZvONvZo8/nNc64gTIPpv65nA48SpT71pWpTjAZbwcQYZlI4CeiZ2vnOOBnbpI64Q==","ARC-Message-Signature":"i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;\n s=arcselector10001;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;\n bh=U1/7PlbnEMOaHCBUc5ixttVBigiZ7ptmOc0s2cexhJ4=;\n b=wORKL0Z/Io+TV/6pGOjUoHWYiBSlRDDxVRne8HalrWfmgduLrV4+L6xU5g/IdqqdP13jxqkfWGgZ08E0/CW509dRvDDqwNfBbTAILddFbRLEMTkVaIssSyAl7c9KBVUSVoywrqQn03639jZZn/15E72/oNniIep/aGqAKquTTF0EZPt+z29AQ0IRW+HvAgr5xb5xHdwYEiITB5+yENaUrfcm7r7FxHkwm2u/PgLb4EkMIVoRZixVOJJgGdVfH+8qAe5hymQe+mDQmDNV1TC0rRFnUkyux9e9QEnIDKRhZl1e+pW9KNIjKNguwPEvliNuypkP6s0RLk+PJKbPCMViSw==","ARC-Authentication-Results":"i=1; mx.microsoft.com 1; spf=pass (sender ip is\n 149.6.166.170) smtp.rcpttodomain=canonical.com smtp.mailfrom=softathome.com;\n dmarc=bestguesspass action=none header.from=softathome.com; dkim=none\n (message not signed); arc=none (0)","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=softathome1.onmicrosoft.com; s=selector1-softathome1-onmicrosoft-com;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;\n bh=U1/7PlbnEMOaHCBUc5ixttVBigiZ7ptmOc0s2cexhJ4=;\n b=Gb5VXrkqovplFKpzHXzdzgREkJMywFReuX9efZ7LB8g4zbQG3yAS/qcF5Qyx8JhPUyZCHDC1jJt51GTKDuEgUX5cH10u35kVwsaIeZpPaTfVfE/xWSS1C3mk94eLEMLxuIGDCtU77HnnJwMuvOEaN6C8F6LbDrrBByYbF0z4JlxmFd19XcBXcOWs36iOyxJeWVy9pYSZnxibF43kLi8BX5gdYMdJI5JQrukwKm0LtGcnxgKPqqy/axmhnl5XzbR02wbRN+4ejYo/PvU0sQO+yP65x5RIoE6/zcq3M+p+0LbrXjaNcSiuKu9n+erclyqQ426BqZmXyBa1im/Ypfj+lQ==","X-MS-Exchange-Authentication-Results":"spf=pass (sender IP is 149.6.166.170)\n smtp.mailfrom=softathome.com; dkim=none (message not signed)\n header.d=none;dmarc=bestguesspass action=none header.from=softathome.com;","Received-SPF":"Pass (protection.outlook.com: domain of softathome.com\n designates 149.6.166.170 as permitted sender)\n receiver=protection.outlook.com; client-ip=149.6.166.170;\n helo=proxy.softathome.com; pr=C","From":"Philippe Reynes ","To":"marko.makela@iki.fi, jonny.green@keytechinc.com, raymondmaoca@gmail.com,\n trini@konsulko.com, simon.glass@canonical.com","Cc":"u-boot@lists.denx.de,\n\tPhilippe Reynes ","Subject":"[PATCH v4 09/14] tools: mkimage: pre-load: add support of ecdsa","Date":"Fri, 17 Apr 2026 15:01:59 +0200","Message-ID":"<20260417130204.49896-10-philippe.reynes@softathome.com>","X-Mailer":"git-send-email 2.43.0","In-Reply-To":"<20260417130204.49896-1-philippe.reynes@softathome.com>","References":"<20260417130204.49896-1-philippe.reynes@softathome.com>","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","X-EOPAttributedMessage":"0","X-MS-PublicTrafficType":"Email","X-MS-TrafficTypeDiagnostic":"PA3PEPF000089BB:EE_|MRZP264MB2713:EE_","Content-Type":"text/plain","X-MS-Office365-Filtering-Correlation-Id":"f6783423-5842-427e-286f-08de9c81897f","X-MS-Exchange-SenderADCheck":"1","X-MS-Exchange-AntiSpam-Relay":"0","X-Microsoft-Antispam":"BCL:0;\n ARA:13230040|82310400026|36860700016|376014|1800799024|18002099003|56012099003|22082099003;","X-Microsoft-Antispam-Message-Info":"\n KFb7H6bbRlxpRn+kt1OG7AZarXH1xAeoks8v3QcUBV7xq3h2y7xNgx4B79ChpTnYF7rp2LGLqTMZdHFvn0+cqqDHex2xLSyI6MmqDjEi0qNB2Y6T2NenZuKZxl6SADjYyX3+8gnjcWF3oWOEVzV5bjqboFSg4CQxG1IklfDGjEpuBeks1v5TWYE3E6bBcHG28etlIyhzh7V0RFDx81g67xlvLU0T3mRNRr91502H07EHp7WPuTfznk9N/SlbO618kfLBI8DQ2lU1vXHHrcuJnYcSU8QjVAoWmXl6hfICGZgyc2v60RiMHprcvytrOwz50JccXClLD4dQuoMsqUNNtBljPe56gfTedm0T4MLiTf3opp5rCDy9vM1yAF9J5pBPv93NKj9j9iEHEmw/3z+4T9Yd/mZ3iQpsctS1hx9Ao/dUihweQ8OvCB2BWCyeFbTM8DMWX9SzSf7H/r5qpnMeAQfIUIk7c6NMrDKAEx2YC/tegKgXPKHRDoNjH+55RrWrVmQwI4qm0FPgDVvnzYzaeu9dgYqbdLx5vFB8+Ku3KRKNDICJVVwMSNBXbGDnP9NIeoUHWLTQa6Tj5xVxJ1+UtDUPVMJuxqPsfm8NDF3ZvurRaEAi7vEb4TK/EwKfZ3sT1gxm/NNnf0GsdSSMJC6EbqhV4xxyohIZbOCYgM2FX9n+aCmhNlVbnsWpKa5pGdHktiVnohJAPgZYWBIbRu57fGwt1EzfrJECTGrNtFrPfY6jkrguFNzVi34Lpwamrb4eEW8URPl9r1ryyqBPaxCKMw==","X-Forefront-Antispam-Report":"CIP:149.6.166.170; CTRY:FR; LANG:en; SCL:1; SRV:;\n IPV:CAL; SFV:NSPM; H:proxy.softathome.com; PTR:InfoDomainNonexistent;\n CAT:NONE;\n SFS:(13230040)(82310400026)(36860700016)(376014)(1800799024)(18002099003)(56012099003)(22082099003);\n DIR:OUT; SFP:1101;","X-MS-Exchange-AntiSpam-MessageData-ChunkCount":"1","X-MS-Exchange-AntiSpam-MessageData-0":"\n rM4Z9fRGDJZdTUk2qjrS9IMWZbUjDg9mLfnnLESo371GRZho+p25M66tYZ8vd1CdZveLL8hosgpESYgYTubkvLMlNZZktqzFb69Dh+vgLvBwaek9Yz+yA9MeADXRlgXY8et+wLNFMQD6F+X19Kjel98r0yRQ6U8C9f6yvmbfknaud78NBS/HA9Blmd/q8eEqWFHKQ+XtoISXjmfe1n0z7IGOfIY40dDziC1ObfSNT5mZkrYZ2k/o9/UMjJRHJ/wmb3UXnru8tusCDO8qWLu0KPx1Fv7WlEe/r0zTNRigaZ9NfWsKK4OfRwyhGuNd6atfJxTcWfFwEB0gM2AoUQGas18r8mqFRAX5h3AV5VaUuejyaIzMtxDK4rBzTIsjPlL3DLJrRPgdT8lRtJ+o7bOABDIa7zM7X1jkpmbLreq+TsIXBHCkalliLvf0rNiyyWT0","X-OriginatorOrg":"softathome.com","X-MS-Exchange-CrossTenant-OriginalArrivalTime":"17 Apr 2026 13:02:10.4250 (UTC)","X-MS-Exchange-CrossTenant-Network-Message-Id":"\n f6783423-5842-427e-286f-08de9c81897f","X-MS-Exchange-CrossTenant-Id":"aa10e044-e405-4c10-8353-36b4d0cce511","X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp":"\n TenantId=aa10e044-e405-4c10-8353-36b4d0cce511; Ip=[149.6.166.170];\n Helo=[proxy.softathome.com]","X-MS-Exchange-CrossTenant-AuthSource":"PA3PEPF000089BB.FRAP264.PROD.OUTLOOK.COM","X-MS-Exchange-CrossTenant-AuthAs":"Anonymous","X-MS-Exchange-CrossTenant-FromEntityHeader":"HybridOnPrem","X-MS-Exchange-Transport-CrossTenantHeadersStamped":"MRZP264MB2713","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.39","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" ","X-Virus-Scanned":"clamav-milter 0.103.8 at phobos.denx.de","X-Virus-Status":"Clean"},"content":"Right now, mkimage can only create pre-load header\nusing rsa. We add the support of ecdsa.\n\nSigned-off-by: Philippe Reynes \n---\nv3:\n- initial version\nv4:\n- use pre_load_noffset (do not compute it again)\n- release memory allocated with strdup\n- clean code\n\n lib/ecdsa/ecdsa-libcrypto.c | 29 ++++++++++----\n tools/image-host.c | 79 +++++++++++++++++++++++++++++++------\n 2 files changed, 90 insertions(+), 18 deletions(-)","diff":"diff --git a/lib/ecdsa/ecdsa-libcrypto.c b/lib/ecdsa/ecdsa-libcrypto.c\nindex 9218d06bda0..6f347e6751f 100644\n--- a/lib/ecdsa/ecdsa-libcrypto.c\n+++ b/lib/ecdsa/ecdsa-libcrypto.c\n@@ -496,14 +496,9 @@ int ecdsa_verify(struct image_sign_info *info,\n \treturn ret;\n }\n \n-static int do_add(struct signer *ctx, void *fdt, const char *key_node_name,\n-\t\t struct image_sign_info *info)\n+static int search_key_node(void *fdt, const char *key_node_name)\n {\n-\tint signature_node, key_node, ret, key_bits;\n-\tconst char *curve_name;\n-\tconst EC_GROUP *group;\n-\tconst EC_POINT *point;\n-\tBIGNUM *x, *y;\n+\tint signature_node, key_node;\n \n \tsignature_node = fdt_subnode_offset(fdt, 0, FIT_SIG_NODENAME);\n \tif (signature_node == -FDT_ERR_NOTFOUND) {\n@@ -538,6 +533,26 @@ static int do_add(struct signer *ctx, void *fdt, const char *key_node_name,\n \t\treturn key_node;\n \t}\n \n+\treturn key_node;\n+}\n+\n+static int do_add(struct signer *ctx, void *fdt, const char *key_node_name,\n+\t\t struct image_sign_info *info)\n+{\n+\tint key_node, ret, key_bits;\n+\tconst char *curve_name;\n+\tconst EC_GROUP *group;\n+\tconst EC_POINT *point;\n+\tBIGNUM *x, *y;\n+\n+\tif (info->required_keynode > 0) {\n+\t\tkey_node = info->required_keynode;\n+\t} else {\n+\t\tkey_node = search_key_node(fdt, key_node_name);\n+\t\tif (key_node < 0)\n+\t\t\treturn key_node;\n+\t}\n+\n \tgroup = EC_KEY_get0_group(ctx->ecdsa_key);\n \tkey_bits = EC_GROUP_order_bits(group);\n \tcurve_name = OBJ_nid2sn(EC_GROUP_get_curve_name(group));\ndiff --git a/tools/image-host.c b/tools/image-host.c\nindex 8b550af0dc1..5577d25a95e 100644\n--- a/tools/image-host.c\n+++ b/tools/image-host.c\n@@ -13,6 +13,7 @@\n #include \n #include \n #include \n+#include \n \n #if CONFIG_IS_ENABLED(FIT_SIGNATURE)\n #include \n@@ -1244,13 +1245,61 @@ err_cert:\n \treturn ret;\n }\n \n+static int fit_pre_load_data_key_rsa(const char *keydir, void *keydest,\n+\t\t\t\t int pre_load_noffset, const void *key_name)\n+{\n+\tunsigned char *pubkey = NULL;\n+\tint ret, pubkey_len;\n+\n+\t/* Read public key */\n+\tret = read_pub_key(keydir, key_name, &pubkey, &pubkey_len);\n+\tif (ret < 0)\n+\t\tgoto out;\n+\n+\t/* Add the public key to the device tree */\n+\tret = fdt_setprop(keydest, pre_load_noffset, \"public-key\",\n+\t\t\t pubkey, pubkey_len);\n+\tif (ret)\n+\t\tfprintf(stderr, \"Can't set public-key in node %s (ret = %d)\\n\",\n+\t\t\tIMAGE_PRE_LOAD_PATH, ret);\n+ out:\n+\treturn ret;\n+}\n+\n+static int fit_pre_load_data_key_ecdsa(const char *keydir, void *keydest,\n+\t\t\t\t int pre_load_noffset, const void *key_name,\n+\t\t\t\t const void *algo_name)\n+{\n+\tstruct image_sign_info info;\n+\tint node, ret = 0;\n+\n+\tmemset(&info, 0, sizeof(info));\n+\tinfo.keydir = keydir;\n+\tinfo.keyname = strdup(key_name);\n+\tinfo.name = strdup(algo_name);\n+\tinfo.checksum = image_get_checksum_algo(algo_name);\n+\tinfo.crypto = image_get_crypto_algo(algo_name);\n+\tinfo.required_keynode = pre_load_noffset;\n+\n+\tnode = ecdsa_add_verify_data(&info, keydest);\n+\tif (node < 0) {\n+\t\tfprintf(stderr, \"Can't add verify data: err = %d\\n\", node);\n+\t\tret = -EIO;\n+\t}\n+\n+\tfree((void *)info.keyname);\n+\tfree((void *)info.name);\n+\n+\treturn ret;\n+}\n+\n int fit_pre_load_data(const char *keydir, void *keydest, void *fit)\n {\n \tint pre_load_noffset;\n \tconst void *algo_name;\n \tconst void *key_name;\n-\tunsigned char *pubkey = NULL;\n-\tint ret, pubkey_len;\n+\tchar *name;\n+\tint ret;\n \n \tif (!keydir || !keydest || !fit)\n \t\treturn 0;\n@@ -1277,17 +1326,25 @@ int fit_pre_load_data(const char *keydir, void *keydest, void *fit)\n \t\tgoto out;\n \t}\n \n-\t/* Read public key */\n-\tret = read_pub_key(keydir, key_name, &pubkey, &pubkey_len);\n-\tif (ret < 0)\n+\t/* Is it a RSA or an ECDSA key */\n+\tname = strchr((const char *)algo_name, ',');\n+\tif (!name) {\n+\t\tfprintf(stderr, \"The name of the algo is invalid: %s\\n\",\n+\t\t\t(char *)algo_name);\n+\t\tret = -EINVAL;\n \t\tgoto out;\n+\t}\n+\tname += 1;\n \n-\t/* Add the public key to the device tree */\n-\tret = fdt_setprop(keydest, pre_load_noffset, \"public-key\",\n-\t\t\t pubkey, pubkey_len);\n-\tif (ret)\n-\t\tfprintf(stderr, \"Can't set public-key in node %s (ret = %d)\\n\",\n-\t\t\tIMAGE_PRE_LOAD_PATH, ret);\n+\tif (!strncmp(name, \"rsa\", 3)) {\n+\t\tret = fit_pre_load_data_key_rsa(keydir, keydest, pre_load_noffset, key_name);\n+\t} else if (!strncmp(name, \"ecdsa\", 5)) {\n+\t\tret = fit_pre_load_data_key_ecdsa(keydir, keydest, pre_load_noffset,\n+\t\t\t\t\t\t key_name, algo_name);\n+\t} else {\n+\t\tfprintf(stderr, \"The algo %s is not supported\\n\", (char *)algo_name);\n+\t\tret = -EINVAL;\n+\t}\n \n out:\n \treturn ret;\n","prefixes":["v4","09/14"]}