Skip to content

Commit

Permalink
bootutil: Enable hash calculation directly on storage
Browse files Browse the repository at this point in the history
The commit add support for passing storage device address space
to hash calculation functions, which allows to use hardware
accelerated hash calculation on storage.
This feature only works when image encryption is not enabled
and all slots are defined within internal storage of device.

The feature is enabled using Kconfig option
 CONFIG_BOOT_IMG_HASH_DIRECTLY_ON_STORAGE

Signed-off-by: Dominik Ermel <[email protected]>
  • Loading branch information
de-nordic committed Oct 2, 2024
1 parent c894d04 commit e505c36
Show file tree
Hide file tree
Showing 3 changed files with 35 additions and 3 deletions.
15 changes: 12 additions & 3 deletions boot/bootutil/src/image_validate.c
Original file line number Diff line number Diff line change
Expand Up @@ -68,13 +68,15 @@ bootutil_img_hash(struct enc_key_data *enc_state, int image_index,
uint8_t *seed, int seed_len)
{
bootutil_sha_context sha_ctx;
uint32_t blk_sz;
uint32_t size;
uint16_t hdr_size;
uint32_t off;
int rc;
uint32_t blk_off;
uint32_t tlv_off;
#if !defined(MCUBOOT_HASH_STORAGE_DIRECTLY)
int rc;
uint32_t off;
uint32_t blk_sz;
#endif

#if (BOOT_IMAGE_NUMBER == 1) || !defined(MCUBOOT_ENC_IMAGES) || \
defined(MCUBOOT_RAM_LOAD)
Expand Down Expand Up @@ -117,6 +119,12 @@ bootutil_img_hash(struct enc_key_data *enc_state, int image_index,
/* If protected TLVs are present they are also hashed. */
size += hdr->ih_protect_tlv_size;

#ifdef MCUBOOT_HASH_STORAGE_DIRECTLY
/* No chunk loading, storage is mapped to address space and can
* be directly given to hashing function.
*/
bootutil_sha_update(&sha_ctx, (void *)flash_area_get_off(fap), size);
#else /* MCUBOOT_HASH_STORAGE_DIRECTLY */
#ifdef MCUBOOT_RAM_LOAD
bootutil_sha_update(&sha_ctx,
(void*)(IMAGE_RAM_BASE + hdr->ih_load_addr),
Expand Down Expand Up @@ -161,6 +169,7 @@ bootutil_img_hash(struct enc_key_data *enc_state, int image_index,
bootutil_sha_update(&sha_ctx, tmp_buf, blk_sz);
}
#endif /* MCUBOOT_RAM_LOAD */
#endif /* MCUBOOT_HASH_STORAGE_DIRECTLY */
bootutil_sha_finish(&sha_ctx, hash_result);
bootutil_sha_drop(&sha_ctx);

Expand Down
16 changes: 16 additions & 0 deletions boot/zephyr/Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,22 @@ config BOOT_IMG_HASH_ALG_SHA512_ALLOW
help
Hidden option set by configurations that allow SHA512

config BOOT_IMG_HASH_DIRECTLY_ON_STORAGE
bool "Hash calculation functions access storage through address space"
depends on !BOOT_ENCRYPT_IMAGE
help
When possible to map storage device, at least for read operations,
to address space or RAM area, enabling this option allows hash
calculation functions to directly access the storage through that address
space or using its own DMA. This reduces flash read overhead done
by the MCUboot.
Notes:
- not supported when encrypted images are in use, because calculating
SHA requires image to be decrypted first, which is done to RAM.
- currently only supported on internal storage of devices; this
option will not work with devices that use external storage for
either of image slots.

choice BOOT_IMG_HASH_ALG
prompt "Selected image hash algorithm"
default BOOT_IMG_HASH_ALG_SHA256 if BOOT_IMG_HASH_ALG_SHA256_ALLOW
Expand Down
7 changes: 7 additions & 0 deletions boot/zephyr/include/mcuboot_config/mcuboot_config.h
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,13 @@
#define MCUBOOT_DECOMPRESS_IMAGES
#endif

/* Invoke hashing functions directly on storage. This requires for device
* to be able to map storage to address space or RAM.
*/
#ifdef CONFIG_BOOT_IMG_HASH_DIRECTLY_ON_STORAGE
#define MCUBOOT_HASH_STORAGE_DIRECTLY
#endif

#ifdef CONFIG_BOOT_BOOTSTRAP
#define MCUBOOT_BOOTSTRAP 1
#endif
Expand Down

0 comments on commit e505c36

Please sign in to comment.