[PATCH] arm: imx: Remove arch_env_get_location to fix env lockdown

This patch resolves an issue encountered with Layerscape SoCs, where attempts to restrict write access to environment variables to enforce secureboot are ineffective when using the CONFIG_ENV_IS_NOWHERE configuration in combination with CONFIG_ENV_IS_IN_xxx.
Signed-off-by: Abdelrahman Ibrahem mail@aibrahem.com ---
arch/arm/cpu/armv8/fsl-layerscape/cpu.c | 41 ------------------------- 1 file changed, 41 deletions(-)
diff --git a/arch/arm/cpu/armv8/fsl-layerscape/cpu.c b/arch/arm/cpu/armv8/fsl-layerscape/cpu.c index d2d3e346a3..7dd5f429bf 100644 --- a/arch/arm/cpu/armv8/fsl-layerscape/cpu.c +++ b/arch/arm/cpu/armv8/fsl-layerscape/cpu.c @@ -819,47 +819,6 @@ int mmc_get_env_dev(void) } #endif
-enum env_location arch_env_get_location(enum env_operation op, int prio) -{ - enum boot_src src = get_boot_src(); - enum env_location env_loc = ENVL_NOWHERE; - - if (prio) - return ENVL_UNKNOWN; - -#ifdef CONFIG_ENV_IS_NOWHERE - return env_loc; -#endif - - switch (src) { - case BOOT_SOURCE_IFC_NOR: - env_loc = ENVL_FLASH; - break; - case BOOT_SOURCE_QSPI_NOR: - /* FALLTHROUGH */ - case BOOT_SOURCE_XSPI_NOR: - env_loc = ENVL_SPI_FLASH; - break; - case BOOT_SOURCE_IFC_NAND: - /* FALLTHROUGH */ - case BOOT_SOURCE_QSPI_NAND: - /* FALLTHROUGH */ - case BOOT_SOURCE_XSPI_NAND: - env_loc = ENVL_NAND; - break; - case BOOT_SOURCE_SD_MMC: - /* FALLTHROUGH */ - case BOOT_SOURCE_SD_MMC2: - env_loc = ENVL_MMC; - break; - case BOOT_SOURCE_I2C1_EXTENDED: - /* FALLTHROUGH */ - default: - break; - } - - return env_loc; -} #endif /* CONFIG_TFABOOT */
u32 initiator_type(u32 cluster, int init_id)

s/imx/layerscape/
On Thu, Nov 07, 2024 at 01:50:44PM +0100, Abdelrahman Ibrahem wrote:
This patch resolves an issue encountered with Layerscape SoCs, where attempts to restrict write access to environment variables to enforce secureboot are ineffective when using the CONFIG_ENV_IS_NOWHERE configuration in combination with CONFIG_ENV_IS_IN_xxx.
Signed-off-by: Abdelrahman Ibrahem mail@aibrahem.com
arch/arm/cpu/armv8/fsl-layerscape/cpu.c | 41 ------------------------- 1 file changed, 41 deletions(-)
diff --git a/arch/arm/cpu/armv8/fsl-layerscape/cpu.c b/arch/arm/cpu/armv8/fsl-layerscape/cpu.c index d2d3e346a3..7dd5f429bf 100644 --- a/arch/arm/cpu/armv8/fsl-layerscape/cpu.c +++ b/arch/arm/cpu/armv8/fsl-layerscape/cpu.c @@ -819,47 +819,6 @@ int mmc_get_env_dev(void) } #endif
-enum env_location arch_env_get_location(enum env_operation op, int prio) -{
This looks wrong to me. Drop the arch_env_get_location would break other cases.
Thanks, Peng

Thank you for your feedback.
This file is global for all Layerscape Processors, if this function is needed for a specific board then it needs to be moved to only be included for that board.
Let me know if you have further suggestions.
Best regards, Abdelrahman Ibrahem

On Sun, Dec 15, 2024 at 09:55:53PM +0100, Abdelrahman Ibrahem wrote:
Thank you for your feedback.
This file is global for all Layerscape Processors, if this function is needed for a specific board then it needs to be moved to only be included for that board.
Let me know if you have further suggestions.
Please override env_get_location for you specific usage. Removing the whole function will break current users.
Thanks, Peng
Best regards, Abdelrahman Ibrahem
participants (2)
-
Abdelrahman Ibrahem
-
Peng Fan