From: Philippe Schenker <[email protected]>

After ti_secure_image_post_process() authenticates the image, it may
relocate it to a different memory location and update image_addr to
point to the verified image.

However, rproc_elf_load_image() and rproc_elf_get_boot_addr() were
still using the original "addr" parameter, potentially operating on
the unverified or stale image location instead of the authenticated
image.

Use image_addr (cast to ulong to match function signatures) after
authentication to ensure all operations work with the verified image.

Signed-off-by: Philippe Schenker <[email protected]>
---

(no changes since v1)

 drivers/remoteproc/ti_k3_r5f_rproc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/remoteproc/ti_k3_r5f_rproc.c 
b/drivers/remoteproc/ti_k3_r5f_rproc.c
index 48ebdaf06931..c6356729e9db 100644
--- a/drivers/remoteproc/ti_k3_r5f_rproc.c
+++ b/drivers/remoteproc/ti_k3_r5f_rproc.c
@@ -346,13 +346,13 @@ static int k3_r5f_load(struct udevice *dev, ulong addr, 
ulong size)
        ti_secure_image_post_process(&image_addr, &size_img);
        size = size_img;
 
-       ret = rproc_elf_load_image(dev, addr, size);
+       ret = rproc_elf_load_image(dev, (ulong)image_addr, size);
        if (ret < 0) {
                dev_err(dev, "Loading elf failedi %d\n", ret);
                goto proc_release;
        }
 
-       boot_vector = rproc_elf_get_boot_addr(dev, addr);
+       boot_vector = rproc_elf_get_boot_addr(dev, (ulong)image_addr);
 
        dev_dbg(dev, "%s: Boot vector = 0x%llx\n", __func__, boot_vector);
 
-- 
2.51.2

Reply via email to