imx: ahab: Use authenticated header for images loading

When loading container image, the container header is loaded into
heap memory. If ahab is enabled, the header is be copied to another
fixed RAM for authentication in ahab_auth_cntr_hdr. The better method
is using container header memory being authenticated for following
image loading.
So update ahab_auth_cntr_hdr to return the address of container header
being authenticated. Caller uses this header for following parsing
and image loading.

Signed-off-by: Ye Li <ye.li@nxp.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

diff --git a/arch/arm/include/asm/mach-imx/ahab.h b/arch/arm/include/asm/mach-imx/ahab.h
index 4884f056251025988f14350cda108c4e92a12cdf..dad170cee47b111585b098fe2c23430ae28fa40f 100644 (file)
--- a/arch/arm/include/asm/mach-imx/ahab.h
+++ b/arch/arm/include/asm/mach-imx/ahab.h
@@ -8,7 +8,7 @@
 
 #include <imx_container.h>
 
-int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length);
+void *ahab_auth_cntr_hdr(struct container_hdr *container, u16 length);
 int ahab_auth_release(void);
 int ahab_verify_cntr_image(struct boot_img_t *img, int image_index);
 

diff --git a/arch/arm/mach-imx/ele_ahab.c b/arch/arm/mach-imx/ele_ahab.c
index 9794391fb354d6da74bd4c204b457e91cdb4aac8..86b11bdf2acc315224933b05b3bb50d0cbc8ed15 100644 (file)
--- a/arch/arm/mach-imx/ele_ahab.c
+++ b/arch/arm/mach-imx/ele_ahab.c
@@ -255,7 +255,7 @@ static void display_ahab_auth_ind(u32 event)
        printf("%s\n", ele_ind_str[get_idx(ele_ind, resp_ind, ARRAY_SIZE(ele_ind))]);
 }
 
-int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
+void *ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
 {
        int err;
        u32 resp;
@@ -271,9 +271,10 @@ int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
                printf("Authenticate container hdr failed, return %d, resp 0x%x\n",
                       err, resp);
                display_ahab_auth_ind(resp);
+               return NULL;
        }
 
-       return err;
+       return (void *)IMG_CONTAINER_BASE; /* Return authenticated container header */
 }
 
 int ahab_auth_release(void)
@@ -327,7 +328,6 @@ int authenticate_os_container(ulong addr)
 {
        struct container_hdr *phdr;
        int i, ret = 0;
-       int err;
        u16 length;
        struct boot_img_t *img;
        unsigned long s, e;
@@ -357,8 +357,8 @@ int authenticate_os_container(ulong addr)
 
        debug("container length %u\n", length);
 
-       err = ahab_auth_cntr_hdr(phdr, length);
-       if (err) {
+       phdr = ahab_auth_cntr_hdr(phdr, length);
+       if (!phdr) {
                ret = -EIO;
                goto exit;
        }
@@ -367,7 +367,7 @@ int authenticate_os_container(ulong addr)
 
        /* Copy images to dest address */
        for (i = 0; i < phdr->num_images; i++) {
-               img = (struct boot_img_t *)(addr +
+               img = (struct boot_img_t *)((ulong)phdr +
                                            sizeof(struct container_hdr) +
                                            i * sizeof(struct boot_img_t));
 

diff --git a/arch/arm/mach-imx/imx8/ahab.c b/arch/arm/mach-imx/imx8/ahab.c
index f13baa871cc2c333c20e948b0c10547ece449c36..71a3b3419137115eb47823e842213cf5bda20329 100644 (file)
--- a/arch/arm/mach-imx/imx8/ahab.c
+++ b/arch/arm/mach-imx/imx8/ahab.c
@@ -28,7 +28,7 @@ DECLARE_GLOBAL_DATA_PTR;
 #define AHAB_HASH_TYPE_MASK    0x00000700
 #define AHAB_HASH_TYPE_SHA256  0
 
-int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
+void *ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
 {
        int err;
 
@@ -37,10 +37,12 @@ int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
 
        err = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER,
                                   SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE);
-       if (err)
+       if (err) {
                printf("Authenticate container hdr failed, return %d\n", err);
+               return NULL;
+       }
 
-       return err;
+       return (void *)SEC_SECURE_RAM_BASE; /* Return authenticated container header */
 }
 
 int ahab_auth_release(void)
@@ -126,7 +128,7 @@ int authenticate_os_container(ulong addr)
 {
        struct container_hdr *phdr;
        int i, ret = 0;
-       int err;
+       __maybe_unused int err;
        u16 length;
        struct boot_img_t *img;
        unsigned long s, e;
@@ -159,15 +161,15 @@ int authenticate_os_container(ulong addr)
 
        debug("container length %u\n", length);
 
-       err = ahab_auth_cntr_hdr(phdr, length);
-       if (err) {
+       phdr = ahab_auth_cntr_hdr(phdr, length);
+       if (!phdr) {
                ret = -EIO;
                goto exit;
        }
 
        /* Copy images to dest address */
        for (i = 0; i < phdr->num_images; i++) {
-               img = (struct boot_img_t *)(addr +
+               img = (struct boot_img_t *)((ulong)phdr +
                                            sizeof(struct container_hdr) +
                                            i * sizeof(struct boot_img_t));
 

diff --git a/common/spl/spl_imx_container.c b/common/spl/spl_imx_container.c
index 79d021f81dcd3c513115d1c828049c52a2a14c20..57cd75b9b5e9395ed80074ca14de0d0cfe3c1216 100644 (file)
--- a/common/spl/spl_imx_container.c
+++ b/common/spl/spl_imx_container.c
@@ -88,6 +88,7 @@ static int read_auth_container(struct spl_image_info *spl_image,
                               struct spl_load_info *info, ulong offset)
 {
        struct container_hdr *container = NULL;
+       struct container_hdr *authhdr;
        u16 length;
        int i, size, ret = 0;
 
@@ -140,15 +141,19 @@ static int read_auth_container(struct spl_image_info *spl_image,
                }
        }
 
+       authhdr = container;
+
 #ifdef CONFIG_AHAB_BOOT
-       ret = ahab_auth_cntr_hdr(container, length);
-       if (ret)
+       authhdr = ahab_auth_cntr_hdr(authhdr, length);
+       if (!authhdr) {
+               ret = -EINVAL;
                goto end_auth;
+       }
 #endif
 
-       for (i = 0; i < container->num_images; i++) {
+       for (i = 0; i < authhdr->num_images; i++) {
                struct boot_img_t *image = read_auth_image(spl_image, info,
-                                                          container, i,
+                                                          authhdr, i,
                                                           offset);
 
                if (!image) {