From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Walle Date: Wed, 06 May 2020 12:15:50 +0200 Subject: [PATCH V2] mkimage: fit: Do not tail-pad fitImage with external data In-Reply-To: <1073087038ce37a09715bcb5054c7931@walle.cc> References: <20200501154026.79169-1-marex@denx.de> <20200504112749.GE12564@bill-the-cat> <20200505175022.GW12564@bill-the-cat> <1073087038ce37a09715bcb5054c7931@walle.cc> Message-ID: <501a2ab121fa2e21663e6979627b0ee3@walle.cc> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de Am 2020-05-05 23:17, schrieb Michael Walle: > Hi all, > > Am 2020-05-05 20:41, schrieb Simon Glass: >> Hi Tom, >> >> On Tue, 5 May 2020 at 11:50, Tom Rini wrote: >>> >>> On Tue, May 05, 2020 at 06:39:58PM +0200, Marek Vasut wrote: >>> > On 5/5/20 6:37 PM, Alex Kiernan wrote: >>> > > On Tue, May 5, 2020 at 2:28 PM Marek Vasut wrote: >>> > >> >>> > >> On 5/5/20 3:22 PM, Alex Kiernan wrote: >>> > >>> On Mon, May 4, 2020 at 12:28 PM Tom Rini wrote: >>> > >>>> >>> > >>>> On Fri, May 01, 2020 at 05:40:25PM +0200, Marek Vasut wrote: >>> > >>>> >>> > >>>>> There is no reason to tail-pad fitImage with external data to 4-bytes, >>> > >>>>> while fitImage without external data does not have any such padding and >>> > >>>>> is often unaligned. DT spec also does not mandate any such padding. >>> > >>>>> >>> > >>>>> Moreover, the tail-pad fills the last few bytes with uninitialized data, >>> > >>>>> which could lead to a potential information leak. >>> > >>>>> >>> > >>>>> $ echo -n xy > /tmp/data ; \ >>> > >>>>> ./tools/mkimage -E -f auto -d /tmp/data /tmp/fitImage ; \ >>> > >>>>> hexdump -vC /tmp/fitImage | tail -n 3 >>> > >>>>> >>> > >>>>> before: >>> > >>>>> 00000260 61 2d 6f 66 66 73 65 74 00 64 61 74 61 2d 73 69 |a-offset.data-si| >>> > >>>>> 00000270 7a 65 00 00 78 79 64 64 |ze..xydd| >>> > >>>>> ^^ ^^ ^^ >>> > >>>>> after: >>> > >>>>> 00000260 61 2d 6f 66 66 73 65 74 00 64 61 74 61 2d 73 69 |a-offset.data-si| >>> > >>>>> 00000270 7a 65 00 78 79 |ze.xy| >>> > >>>>> >>> > >>>>> Signed-off-by: Marek Vasut >>> > >>>>> Reviewed-by: Simon Glass >>> > >>>>> Cc: Heinrich Schuchardt >>> > >>>>> Cc: Tom Rini >>> > >>>> >>> > >>>> Applied to u-boot/master, thanks! >>> > >>>> >>> > >>> >>> > >>> This breaks booting on my board (am3352, eMMC boot, FIT u-boot, >>> > >>> CONFIG_SPL_LOAD_FIT). Not got any useful diagnostics - if I boot it >>> > >>> from eMMC I get nothing at all on the console, if I boot over ymodem >>> > >>> it stalls at 420k, before continuing to 460k. My guess is there's some >>> > >>> error going to the console at the 420k mark, but obviously it's lost >>> > >>> in the ymodem... I have two DTBs in the FIT image, 420k would about >>> > >>> align to the point between them. >>> > >> >>> > >> My bet would be on some padding / unaligned access problem that this >>> > >> patch uncovered. Can you take a look ? >>> > > >>> > > Seems plausible. With this change my external data starts at 0x483 and >>> > > everything after it is non-aligned: >>> > >>> > Should the beginning of external data be aligned ? >>> >>> If in U-Boot we revert e8c2d25845c72c7202a628a97d45e31beea40668 does >>> the >>> problem go away? If so, that's not a fix outright, it means we need >>> to >>> dig back in to the libfdt thread and find the "make this work without >>> killing performance everywhere all the time" option. >> >> If it is a device tree, it must be 32-bit aligned. > > This commit actually breaks my board too (which I was just about to > send > upstream, but realized it was broken). > > Said board uses SPL and main U-Boot. SPL runs fine and main u-boot > doesn't > output anything. The only difference which I found is that fit-dtb.blob > is > 2 bytes shorter. And the content is shifted by one byte although > data-offset is the same. Strange. In the non-working case, the inner > FDT magic isn't 4 byte aligned. Here are the steps to reproduce it on the uboot master branch: $ CROSS_COMPILE=arm-linux-gnueabihf- make pico-imx6_defconfig fit-dtb.blob tools $ tools/dumpimage -T flat_dt -p 1 -o fdt-1 fit-dtb.blob $ file fdt-1 fdt-1: data $ git revert 20a154f95bfe0a3b5bfba90bea7f001c58217536 $ git clean -fdx $ CROSS_COMPILE=arm-linux-gnueabihf- make pico-imx6_defconfig fit-dtb.blob tools $ tools/dumpimage -T flat_dt -p 1 -o fdt-1 fit-dtb.blob $ file fdt-1 fdt-1: Device Tree Blob version 17, size=34978, boot CPU=0, string block size=1746, DT structure block size=33176 -michael