In case the image that is wrapped in the nxp_imx8mcst already contains an FCFB header which is mandatory for SPI NOR boot, then the IVT is at offset 0x1000 instead of offset 0x0, but the whole image including the FCFB header must be signed to prevent attacker from tampering with any of the headers. Add the FCFB handling.
Signed-off-by: Marek Vasut <[email protected]> --- Cc: "NXP i.MX U-Boot Team" <[email protected]> Cc: Fabio Estevam <[email protected]> Cc: Simon Glass <[email protected]> Cc: Stefano Babic <[email protected]> Cc: Tom Rini <[email protected]> Cc: [email protected] --- V2: Update the block comment to mention the FCFB --- tools/binman/etype/nxp_imx8mcst.py | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/tools/binman/etype/nxp_imx8mcst.py b/tools/binman/etype/nxp_imx8mcst.py index a10f61aa01f..de7032c88f3 100644 --- a/tools/binman/etype/nxp_imx8mcst.py +++ b/tools/binman/etype/nxp_imx8mcst.py @@ -20,8 +20,9 @@ from binman import elf from dtoc import fdt_util from u_boot_pylib import tools -MAGIC_NXP_IMX_IVT = 0x412000d1 -MAGIC_FITIMAGE = 0xedfe0dd0 +MAGIC_NXP_IMX_IVT = 0x412000d1 +MAGIC_NXP_IMX_FCFB = 0x42464346 +MAGIC_FITIMAGE = 0xedfe0dd0 KEY_NAME = 'sha256_4096_65537_v3_usr_crt' @@ -112,6 +113,9 @@ class Entry_nxp_imx8mcst(Entry_mkimage): # - If it is mkimage'd imx8mimage, then extract to be signed data size # from imx8mimage header, and calculate CSF blob offset right past # the SPL from this information. + # - If it is mkimage'd imx8mimage wrapped in FCFB, then extract to be + # signed data size from imx8mimage header past the FCFB header, and + # calculate CSF blob offset right past the SPL from this information. # - If it is fitImage, then pad the image to 4k, add generated IVT and # sign the whole payload, then append CSF blob at the end right past # the IVT. @@ -125,6 +129,13 @@ class Entry_nxp_imx8mcst(Entry_mkimage): signsize = struct.unpack('<I', data[24:28])[0] - signbase # Remove mkimage generated padding from the end of data data = data[:signsize] + elif signtype == MAGIC_NXP_IMX_FCFB: # SPL/imx8mimage with FCFB + # Sign the payload including FCFB and imx8mimage headers + # (extra 0x1000 and 0x40 bytes before the payload) + signbase -= 0x1040 + signsize = struct.unpack('<I', data[4120:4124])[0] - signbase + # Remove mkimage generated padding from the end of data + data = data[:signsize] elif signtype == MAGIC_FITIMAGE: # fitImage # Align fitImage to 4k signsize = tools.align(len(data), 0x1000) -- 2.53.0
