search

nxp-qoriq / qoriq-mc-binary

Other
8 stars 7 forks source link

MC firmware FIT images contain a unit address #2

Closed radolin closed 6 months ago

radolin commented 9 months ago

I recently tried to enable verified boot ("CONFIG_FIT_SIGNATURE=y) in U-boot on an lx216xa board, after which MC firmware failed to load with a "fsl-mc: ERR: Bad firmware image (bad FIT header)" error.

I have traced this to the existence of unit addresses for the firmware and hash nodes (I'm was using an older version): 

/ {
        timestamp = <0x5e724ba7>;
        description = "MC Firmware";
        #address-cells = <0x01>;

        images {

                firmware@1 {
.....
                        hash@1 {
                                value = <0x3d89348>;
                                algo = "crc32";
                        };
                };

In the current version only the hash node has one, but that still prevent u-boot from properly loading the MC firmware when FIT image signature checking is enabled.

U-boot has deprecated the usage of unit addressed some time ago (https://source.denx.de/u-boot/u-boot/-/commit/3f04db891a) due to security issues and the solution is to just remove them.

IoanaCiornei commented 8 months ago

As a general note, It seems that even newer images of mkimage will fail for an its like the MC's

I am not sure what we can do for the already released images, but I will make sure to change the its for the next ones.

Thanks!

IoanaCiornei commented 6 months ago

The latest MC 10.38.1 release removed the usage of the unit address. Thanks for the report!