On Fri, Dec 6, 2019 at 2:50 PM Rick Chen rickchen36@gmail.com wrote:

...

From: Lukas Auer [mailto:lukas.auer@aisec.fraunhofer.de] Sent: Wednesday, December 04, 2019 5:40 AM To: u-boot@lists.denx.de Cc: Rick Jian-Zhi Chen(陳建志); Anup Patel; Bin Meng; Lukas Auer; Anup Patel Subject: [PATCH 1/4] spl: opensbi: specify main hart as preferred boot hart

OpenSBI uses a relocation lottery to determine the hart to relocate OpenSBI to its link address. In the U-Boot SPL boot flow, the main hart schedules the secondary harts to enter OpenSBI before doing so itself. One of the secondary harts will therefore always be the winner of the relocation lottery. This is problematic if the link address ranges of OpenSBI and U-Boot SPL overlap. OpenSBI will be relocated and therefore overwrite U-Boot SPL while some harts may still run it, leading to code corruption.

Avoid this problem by specifying the main hart as the preferred boot hart to perform the OpenSBI relocation. The main hart will be the last hart to enter OpenSBI, relocation can therefore occur safely.

The boot hart field was added to version 2 of the OpenSBI FW_DYNAMIC info structure. The header file include/opensbi.h is synchronized with include/sbi/fw_dynamic.h from the OpenSBI project to update the info structure. The header file is recent as of commit 7a13beb21326 ("firmware: Add preferred boot HART field in struct fw_dynamic_info").

Reported-by: Rick Chen rick@andestech.com Suggested-by: Anup Patel Anup.Patel@wdc.com Signed-off-by: Lukas Auer lukas.auer@aisec.fraunhofer.de

---

Reviewed-by: Rick Chen rick@andestech.com Tested-by: Rick Chen rick@andestech.com

...

common/spl/spl_opensbi.c | 1 + include/opensbi.h | 18 +++++++++++++++++- 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/common/spl/spl_opensbi.c b/common/spl/spl_opensbi.c index a6b4480ed2..79ee7edcf9 100644 --- a/common/spl/spl_opensbi.c +++ b/common/spl/spl_opensbi.c @@ -69,6 +69,7 @@ void spl_invoke_opensbi(struct spl_image_info *spl_image) opensbi_info.next_addr = uboot_entry; opensbi_info.next_mode = FW_DYNAMIC_INFO_NEXT_MODE_S; opensbi_info.options = SBI_SCRATCH_NO_BOOT_PRINTS;

•   opensbi_info.boot_hart = gd->arch.boot_hart;
  
    opensbi_entry = (void (*)(ulong, ulong, ulong))spl_image->entry_point;
    invalidate_icache_all();
  

diff --git a/include/opensbi.h b/include/opensbi.h index 9f1d62e7dd..d812cc8ccd 100644 --- a/include/opensbi.h +++ b/include/opensbi.h @@ -11,7 +11,7 @@ #define FW_DYNAMIC_INFO_MAGIC_VALUE 0x4942534f

/** Maximum supported info version */ -#define FW_DYNAMIC_INFO_VERSION 0x1 +#define FW_DYNAMIC_INFO_VERSION 0x2

/** Possible next mode values */ #define FW_DYNAMIC_INFO_NEXT_MODE_U 0x0 @@ -35,6 +35,22 @@ struct fw_dynamic_info { unsigned long next_mode; /** Options for OpenSBI library */ unsigned long options;

•   /**
  

•    * Preferred boot HART id
  

•    *
  

•    * It is possible that the previous booting stage uses same link
  

•    * address as the FW_DYNAMIC firmware. In this case, the relocation
  

•    * lottery mechanism can potentially overwrite the previous booting
  

•    * stage while other HARTs are still running in the previous booting
  

•    * stage leading to boot-time crash. To avoid this boot-time crash,
  

•    * the previous booting stage can specify last HART that will jump
  

•    * to the FW_DYNAMIC firmware as the preferred boot HART.
  

•    *
  

•    * To avoid specifying a preferred boot HART, the previous booting
  

•    * stage can set it to -1UL which will force the FW_DYNAMIC firmware
  

•    * to use the relocation lottery mechanism.
  

•    */
  

•   unsigned long boot_hart;
  

} __packed;

#endif

2.21.0

Looks good to me.

Reviewed-by: Anup Patel anup.patel@wdc.com

Regards, Anup