summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorYe Li <ye.li@nxp.com>2016-03-08 22:03:47 +0800
committerYe Li <ye.li@nxp.com>2017-04-05 14:04:41 +0800
commitfd9a9759ed9b3a9fc26b18aff00880382213b1ca (patch)
tree9736960f4a23b27b1c75c683c7a03cd770146b4c
parent8f8699a8845c3f1a838d0e8a258ceebcc60f5622 (diff)
downloadu-boot-imx-fd9a9759ed9b3a9fc26b18aff00880382213b1ca.zip
u-boot-imx-fd9a9759ed9b3a9fc26b18aff00880382213b1ca.tar.gz
u-boot-imx-fd9a9759ed9b3a9fc26b18aff00880382213b1ca.tar.bz2
MLK-12500-1 HAB: Add kernel image authentication in image loading
To support the trust boot chain, we integrate the authentication into the kernel image loading process. The kernel image will be verified at its load address. So when signing the kernel image, we need to use this load address which may change on different platforms. Signed-off-by: Ye Li <ye.li@nxp.com> (cherry picked from commit 3c118b8d6bbe1a25ca8c8bafeb528309f16fc73d)
-rw-r--r--cmd/bootm.c25
-rw-r--r--cmd/bootz.c8
2 files changed, 33 insertions, 0 deletions
diff --git a/cmd/bootm.c b/cmd/bootm.c
index 953a57d..f5cd60a 100644
--- a/cmd/bootm.c
+++ b/cmd/bootm.c
@@ -123,6 +123,31 @@ int do_bootm(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
return do_bootm_subcommand(cmdtp, flag, argc, argv);
}
+#ifdef CONFIG_SECURE_BOOT
+ extern uint32_t authenticate_image(
+ uint32_t ddr_start, uint32_t image_size);
+
+ switch (genimg_get_format((const void *)load_addr)) {
+#if defined(CONFIG_IMAGE_FORMAT_LEGACY)
+ case IMAGE_FORMAT_LEGACY:
+ if (authenticate_image(load_addr,
+ image_get_image_size((image_header_t *)load_addr)) == 0) {
+ printf("Authenticate uImage Fail, Please check\n");
+ return 1;
+ }
+ break;
+#endif
+#ifdef CONFIG_ANDROID_BOOT_IMAGE
+ case IMAGE_FORMAT_ANDROID:
+ /* Do this authentication in boota command */
+ break;
+#endif
+ default:
+ printf("Not valid image format for Authentication, Please check\n");
+ return 1;
+ }
+#endif
+
return do_bootm_states(cmdtp, flag, argc, argv, BOOTM_STATE_START |
BOOTM_STATE_FINDOS | BOOTM_STATE_FINDOTHER |
BOOTM_STATE_LOADOS |
diff --git a/cmd/bootz.c b/cmd/bootz.c
index ceff01b..4c72395 100644
--- a/cmd/bootz.c
+++ b/cmd/bootz.c
@@ -55,6 +55,14 @@ static int bootz_start(cmd_tbl_t *cmdtp, int flag, int argc,
if (bootm_find_images(flag, argc, argv))
return 1;
+#ifdef CONFIG_SECURE_BOOT
+ extern uint32_t authenticate_image(
+ uint32_t ddr_start, uint32_t image_size);
+ if (authenticate_image(images->ep, zi_end - zi_start) == 0) {
+ printf("Authenticate zImage Fail, Please check\n");
+ return 1;
+ }
+#endif
return 0;
}