vhaudiquet/u-boot-krane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

imx: ahab: Use authenticated header for images loading

Browse Source 
When loading container image, the container header is loaded into
heap memory. If ahab is enabled, the header is be copied to another
fixed RAM for authentication in ahab_auth_cntr_hdr. The better method
is using container header memory being authenticated for following
image loading.
So update ahab_auth_cntr_hdr to return the address of container header
being authenticated. Caller uses this header for following parsing
and image loading.

Signed-off-by: Ye Li <ye.li@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
This commit is contained in:
Ye Li
2026-05-15 17:31:39 -03:00
committed by Fabio Estevam
parent 6b9813ff88
commit 84a17fea21
4 changed files with 25 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
arch/arm/include/asm/mach-imx/ahab.h
+1 -1
View File
@@ -8,7 +8,7 @@
#include <imx_container.h>
int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length);
void *ahab_auth_cntr_hdr(struct container_hdr *container, u16 length);
int ahab_auth_release(void);
int ahab_verify_cntr_image(struct boot_img_t *img, int image_index);
arch/arm/mach-imx/ele_ahab.c
+6 -6
View File
@@ -255,7 +255,7 @@ static void display_ahab_auth_ind(u32 event)
printf("%s\n", ele_ind_str[get_idx(ele_ind, resp_ind, ARRAY_SIZE(ele_ind))]);
}
int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
void *ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
{
int err;
u32 resp;
@@ -271,9 +271,10 @@ int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
printf("Authenticate container hdr failed, return %d, resp 0x%x\n",
err, resp);
display_ahab_auth_ind(resp);
return NULL;
}
return err;
return (void *)IMG_CONTAINER_BASE; /* Return authenticated container header */
}
int ahab_auth_release(void)
@@ -327,7 +328,6 @@ int authenticate_os_container(ulong addr)
{
struct container_hdr *phdr;
int i, ret = 0;
int err;
u16 length;
struct boot_img_t *img;
unsigned long s, e;
@@ -357,8 +357,8 @@ int authenticate_os_container(ulong addr)
debug("container length %u\n", length);
err = ahab_auth_cntr_hdr(phdr, length);
if (err) {
phdr = ahab_auth_cntr_hdr(phdr, length);
if (!phdr) {
ret = -EIO;
goto exit;
}
@@ -367,7 +367,7 @@ int authenticate_os_container(ulong addr)
/* Copy images to dest address */
for (i = 0; i < phdr->num_images; i++) {
img = (struct boot_img_t *)(addr +
img = (struct boot_img_t *)((ulong)phdr +
sizeof(struct container_hdr) +
i * sizeof(struct boot_img_t));
arch/arm/mach-imx/imx8/ahab.c
+9 -7
View File
@@ -28,7 +28,7 @@ DECLARE_GLOBAL_DATA_PTR;
#define AHAB_HASH_TYPE_MASK 0x00000700
#define AHAB_HASH_TYPE_SHA256 0
int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
void *ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
{
int err;
@@ -37,10 +37,12 @@ int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
err = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER,
SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE);
if (err)
if (err) {
printf("Authenticate container hdr failed, return %d\n", err);
return NULL;
}
return err;
return (void *)SEC_SECURE_RAM_BASE; /* Return authenticated container header */
}
int ahab_auth_release(void)
@@ -126,7 +128,7 @@ int authenticate_os_container(ulong addr)
{
struct container_hdr *phdr;
int i, ret = 0;
int err;
__maybe_unused int err;
u16 length;
struct boot_img_t *img;
unsigned long s, e;
@@ -159,15 +161,15 @@ int authenticate_os_container(ulong addr)
debug("container length %u\n", length);
err = ahab_auth_cntr_hdr(phdr, length);
if (err) {
phdr = ahab_auth_cntr_hdr(phdr, length);
if (!phdr) {
ret = -EIO;
goto exit;
}
/* Copy images to dest address */
for (i = 0; i < phdr->num_images; i++) {
img = (struct boot_img_t *)(addr +
img = (struct boot_img_t *)((ulong)phdr +
sizeof(struct container_hdr) +
i * sizeof(struct boot_img_t));
common/spl/spl_imx_container.c
+9 -4
View File
@@ -88,6 +88,7 @@ static int read_auth_container(struct spl_image_info *spl_image,
struct spl_load_info *info, ulong offset)
{
struct container_hdr *container = NULL;
struct container_hdr *authhdr;
u16 length;
int i, size, ret = 0;
@@ -140,15 +141,19 @@ static int read_auth_container(struct spl_image_info *spl_image,
}
}
authhdr = container;
#ifdef CONFIG_AHAB_BOOT
ret = ahab_auth_cntr_hdr(container, length);
if (ret)
authhdr = ahab_auth_cntr_hdr(authhdr, length);
if (!authhdr) {
ret = -EINVAL;
goto end_auth;
}
#endif
for (i = 0; i < container->num_images; i++) {
for (i = 0; i < authhdr->num_images; i++) {
struct boot_img_t *image = read_auth_image(spl_image, info,
container, i,
authhdr, i,
offset);
if (!image) {