From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71339C4338F for ; Tue, 17 Aug 2021 06:17:30 +0000 (UTC) Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 12C9160F5C for ; Tue, 17 Aug 2021 06:17:28 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 12C9160F5C Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=denx.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=lists.denx.de Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id B630482903; Tue, 17 Aug 2021 08:17:25 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=denx.de Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=denx.de; s=phobos-20191101; t=1629181046; bh=EaW6tF7GtwwbtpzNB/u9lEn5M4NGzZ+5Rn/pGke7zmA=; h=From:To:Cc:Subject:Date:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:From; b=mT5D9BGZ9vMhnawZVveH0mPx3uoVoIcyLKn4Or9Kl059FpNLEdm8Rmy4q+m+UHpaP ubIDhDihqlMcxtYpnUchzL1n7LXkb7oAtxfiUNxm4dX2F1IEiwPW9x9YCKFWrQHvrr 6YVH4AjrjyWH2jExe9ylVQ/+Voe3kBqTilGFVsfPLMZQwNp0En/dKv2czMOOTagxD9 URYohDyNyPF7TmDxkPvFBXga91JpvTyIvGCQPj+/wS/e8XskN8juM0soLwZnGBRdh/ LgYci8bMgqCWYxKGMTY33CUEX/pmyWPnhx0lIBLcCFkmB2jLfzDT9jmIViMv/9J80a RlKecROjYAaLw== Received: from mail-internal.denx.de (p578adb1c.dip0.t-ipconnect.de [87.138.219.28]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: noc@denx.de) by phobos.denx.de (Postfix) with ESMTPSA id 03FE281FA5; Tue, 17 Aug 2021 08:17:24 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=denx.de; s=phobos-20191101; t=1629181044; bh=EaW6tF7GtwwbtpzNB/u9lEn5M4NGzZ+5Rn/pGke7zmA=; h=From:To:Cc:Subject:Date:From; b=ZPRUeAA+CYLBa4ilTDCS4EH68mhU8fld5BPNv2RcXj5fuzCvq+ehVwFAnOYJqNRUJ SSvRbxZRL54etnDFPOc4hncJbhQPW3Y+nxRYTwvMvzc76V9rflNyQCS7xUp7adQq5i 6DYhC8qsK6Aidrke09EgpNhWiPn2Hnd0kQsA5FjWxoRNV3vkvQRuOFo6VJYUF1lxjx HJBxEMLQp6IY/TeoJjFclkVOEmdwGOOJdaKdlQVGrS6cTvhoz4AqlWQGEnlKmOG1vG OqADnkg/JGblHy1P/6dUc7er1hPqq8pQtFEDUr5zbfaF+AfzwMe3sK2iF/h0asZRyO 0inD8Ose2GePQ== Received: from pollux.denx.de (pollux [192.168.1.1]) by mail-internal.denx.de (Postfix) with ESMTP id 1E3AB182BA6; Tue, 17 Aug 2021 08:17:20 +0200 (CEST) Received: by pollux.denx.de (Postfix, from userid 515) id F04C71A8BA1; Tue, 17 Aug 2021 08:17:19 +0200 (CEST) From: Heiko Schocher To: U-Boot Mailing List Cc: Heiko Schocher , Alexandru Gagniuc , Fabio Estevam , Marek Vasut , Michal Simek , "NXP i.MX U-Boot Team" , "Peng Fan (OSS)" , Philippe Reynes , Simon Glass , Stefano Babic , Tim Harvey Subject: [PATCH v2] imx: spl: fix imx8m secure boot Date: Tue, 17 Aug 2021 08:17:18 +0200 Message-Id: <20210817061718.2709676-1-hs@denx.de> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean cherry-picked from NXP code: 719d665a87c6: ("MLK-20467 imx8m: Fix issue for booting signed image through uuu") which fixes secure boot on imx8m based boards. Problem was that FIT header and so IVT header too, was loaded to memallocated address. So the ivt header address coded in IVT itself does not fit with the real position. Signed-off-by: Heiko Schocher --- replaces Series: https://lists.denx.de/pipermail/u-boot/2021-August/457308.html @Tim: could you please test this version on your hardware? azure build: https://dev.azure.com/hs0298/hs/_build/results?buildId=72&view=results Works on sdcard and QSPI NOR boot on phycore-imx8mp board. Changes in v2: - use code from NXP commit 719d665 as Ye Li suggested. arch/arm/mach-imx/spl.c | 14 ++++++++++++++ common/spl/spl_fit.c | 7 ++++++- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/arch/arm/mach-imx/spl.c b/arch/arm/mach-imx/spl.c index 36033d611c..59c6c3752d 100644 --- a/arch/arm/mach-imx/spl.c +++ b/arch/arm/mach-imx/spl.c @@ -334,6 +334,20 @@ void board_spl_fit_post_load(const void *fit) } #endif +void *board_spl_fit_buffer_addr(ulong fit_size, int sectors, int bl_len) +{ + int align_len = ARCH_DMA_MINALIGN - 1; + + /* Some devices like SDP, NOR, NAND, SPI are using bl_len =1, so their fit address + * is different with SD/MMC, this cause mismatch with signed address. Thus, adjust + * the bl_len to align with SD/MMC. + */ + if (bl_len < 512) + bl_len = 512; + + return (void *)((CONFIG_SYS_TEXT_BASE - fit_size - bl_len - + align_len) & ~align_len); +} #endif #if defined(CONFIG_MX6) && defined(CONFIG_SPL_OS_BOOT) diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c index f41abca0cc..a4337d3c88 100644 --- a/common/spl/spl_fit.c +++ b/common/spl/spl_fit.c @@ -538,6 +538,11 @@ static void *spl_get_fit_load_buffer(size_t size) return buf; } +__weak void *board_spl_fit_buffer_addr(ulong fit_size, int sectors, int bl_len) +{ + return spl_get_fit_load_buffer(sectors * bl_len); +} + /* * Weak default function to allow customizing SPL fit loading for load-only * use cases by allowing to skip the parsing/processing of the FIT contents @@ -631,7 +636,7 @@ static int spl_simple_fit_read(struct spl_fit_info *ctx, * For FIT with external data, data is not loaded in this step. */ sectors = get_aligned_image_size(info, size, 0); - buf = spl_get_fit_load_buffer(sectors * info->bl_len); + buf = board_spl_fit_buffer_addr(size, sectors, info->bl_len); count = info->read(info, sector, sectors, buf); ctx->fit = buf; -- 2.31.1