On Mon, 27 Jun 2022 at 08:48, Steven Lee <steven_...@aspeedtech.com> wrote: > > Hi Joel, > > I was wondering if you could share the commit hash of u-boot you tested. > I would like to test it on qemu.
I recommend using master with the patch that fixes FIT hash checking: https://lore.kernel.org/r/20220620070117.3443066-1-j...@jms.id.au I use a script to build the image (also attached to this email): https://ozlabs.org/~joel/build-ast2600-spl.sh Run that script from the u-boot source tree. It provides an example qemu commandline when it finishes: /usr/bin/qemu-system-arm -M ast2600-evb -nographic -drive file=ast2600-obj/test.img,if=mtd,format=raw -nic user,tftp=/srv/tftp/ U-Boot SPL 2022.07-rc5-00010-g75967970850a (Jun 27 2022 - 19:00:15 +0930) Trying to boot from RAM ## Checking hash(es) for config conf-1 ... OK ## Checking hash(es) for Image firmware-1 ... sha256 error! Bad hash value for 'hash-1' hash node in 'firmware-1' image node One thing to note is the conf-1 check succeeds, but the firmware-1 check fails. I suspect this is because the conf-1 check is less than 64 bytes, so it only requires one pass of the HACE. That's also why the qemu unit test you wrote works; it only tests one pass, so doesn't trigger the accumulation part of the model. I was running with this patch to see the output of the hash operation: Author: Joel Stanley <j...@jms.id.au> Date: Sat Jun 18 18:20:08 2022 +0930 fit: Print hash results on failure Signed-off-by: Joel Stanley <j...@jms.id.au> diff --git a/boot/image-fit.c b/boot/image-fit.c index df3e5df8836a..63aa46e51270 100644 --- a/boot/image-fit.c +++ b/boot/image-fit.c @@ -1302,7 +1302,18 @@ static int fit_image_check_hash(const void *fit, int noffset, const void *data, *err_msgp = "Bad hash value len"; return -1; } else if (memcmp(value, fit_value, value_len) != 0) { + int i; *err_msgp = "Bad hash value"; + printf("\ncalculated: "); + for (i=0; i<value_len; i++) + printf("%02x ", value[i]); + printf("\n"); + + printf(" expected: "); + for (i=0; i<value_len; i++) + printf("%02x ", fit_value[i]); + printf("\n"); + return -1; } If you forget the FIT hash checking patch I linked above, the calculated value is zero. The value with that fix applied is non-zero, but incorrect: ## Checking hash(es) for config conf-1 ... OK ## Checking hash(es) for Image firmware-1 ... sha256 calculated: ae e0 4c 59 7c ec 06 72 68 6c 97 86 ea 6c da d0 6d 66 69 18 0d a2 29 05 15 60 ed 38 b0 31 9b 7b expected: 21 b0 f9 d8 2c 54 51 58 b7 22 bd 79 26 4a 99 c9 42 45 fd 5d f3 3f 4e 66 d2 67 cb bf 5d fa eb ab If it helps, here's a tree with u-master plus the two patches I mentioned: git clone -b aspeed-test https://github.com/shenki/u-boot/ Cheers, Joel
build-ast2600-spl.sh
Description: Bourne shell script