[PATCH] arm: imx: Remove arch_env_get_location to fix env lockdown

[PATCH] arm: imx: Remove arch_env_get_location to fix env lockdown

[Abdelrahman Ibrahem]

This patch resolves an issue encountered with Layerscape SoCs, where
attempts to restrict write access to environment variables to enforce
secureboot are ineffective when using the CONFIG_ENV_IS_NOWHERE
configuration in combination with CONFIG_ENV_IS_IN_xxx.

Signed-off-by: Abdelrahman Ibrahem <mail@aibrahem.com>
---

 arch/arm/cpu/armv8/fsl-layerscape/cpu.c | 41 -------------------------
 1 file changed, 41 deletions(-)

diff --git a/arch/arm/cpu/armv8/fsl-layerscape/cpu.c b/arch/arm/cpu/armv8/fsl-layerscape/cpu.c
index d2d3e346a3..7dd5f429bf 100644
--- a/arch/arm/cpu/armv8/fsl-layerscape/cpu.c
+++ b/arch/arm/cpu/armv8/fsl-layerscape/cpu.c
@@ -819,47 +819,6 @@ int mmc_get_env_dev(void)
 }
 #endif
 
-enum env_location arch_env_get_location(enum env_operation op, int prio)
-{
-	enum boot_src src = get_boot_src();
-	enum env_location env_loc = ENVL_NOWHERE;
-
-	if (prio)
-		return ENVL_UNKNOWN;
-
-#ifdef	CONFIG_ENV_IS_NOWHERE
-	return env_loc;
-#endif
-
-	switch (src) {
-	case BOOT_SOURCE_IFC_NOR:
-		env_loc = ENVL_FLASH;
-		break;
-	case BOOT_SOURCE_QSPI_NOR:
-		/* FALLTHROUGH */
-	case BOOT_SOURCE_XSPI_NOR:
-		env_loc = ENVL_SPI_FLASH;
-		break;
-	case BOOT_SOURCE_IFC_NAND:
-		/* FALLTHROUGH */
-	case BOOT_SOURCE_QSPI_NAND:
-		/* FALLTHROUGH */
-	case BOOT_SOURCE_XSPI_NAND:
-		env_loc = ENVL_NAND;
-		break;
-	case BOOT_SOURCE_SD_MMC:
-		/* FALLTHROUGH */
-	case BOOT_SOURCE_SD_MMC2:
-		env_loc =  ENVL_MMC;
-		break;
-	case BOOT_SOURCE_I2C1_EXTENDED:
-		/* FALLTHROUGH */
-	default:
-		break;
-	}
-
-	return env_loc;
-}
 #endif	/* CONFIG_TFABOOT */
 
 u32 initiator_type(u32 cluster, int init_id)
-- 
2.43.0

Re: [PATCH] arm: imx: Remove arch_env_get_location to fix env lockdown

[Peng Fan]

s/imx/layerscape/

On Thu, Nov 07, 2024 at 01:50:44PM +0100, Abdelrahman Ibrahem wrote:
>This patch resolves an issue encountered with Layerscape SoCs, where
>attempts to restrict write access to environment variables to enforce
>secureboot are ineffective when using the CONFIG_ENV_IS_NOWHERE
>configuration in combination with CONFIG_ENV_IS_IN_xxx.
>
>Signed-off-by: Abdelrahman Ibrahem <mail@aibrahem.com>
>---
>
> arch/arm/cpu/armv8/fsl-layerscape/cpu.c | 41 -------------------------
> 1 file changed, 41 deletions(-)
>
>diff --git a/arch/arm/cpu/armv8/fsl-layerscape/cpu.c b/arch/arm/cpu/armv8/fsl-layerscape/cpu.c
>index d2d3e346a3..7dd5f429bf 100644
>--- a/arch/arm/cpu/armv8/fsl-layerscape/cpu.c
>+++ b/arch/arm/cpu/armv8/fsl-layerscape/cpu.c
>@@ -819,47 +819,6 @@ int mmc_get_env_dev(void)
> }
> #endif
> 
>-enum env_location arch_env_get_location(enum env_operation op, int prio)
>-{

This looks wrong to me. Drop the arch_env_get_location would break
other cases.

Thanks,
Peng

Re: [PATCH] arm: imx: Remove arch_env_get_location to fix env lockdown

[Abdelrahman Ibrahem]

Thank you for your feedback.

This file is global for all Layerscape Processors, if this function is
needed for a specific board then it needs to be moved to only be included
for that board.

Let me know if you have further suggestions.

Best regards,
Abdelrahman Ibrahem

Re: [PATCH] arm: imx: Remove arch_env_get_location to fix env lockdown

[Peng Fan]

On Sun, Dec 15, 2024 at 09:55:53PM +0100, Abdelrahman Ibrahem wrote:
>Thank you for your feedback.
>
>This file is global for all Layerscape Processors, if this function is
>needed for a specific board then it needs to be moved to only be included
>for that board.
>
>Let me know if you have further suggestions.

Please override env_get_location for you specific usage. Removing
the whole function will break current users.

Thanks,
Peng

>
>Best regards,
>Abdelrahman Ibrahem