[PATCH 3/5] config/ast2600: Disable hash hardware accel

[Joel Stanley]

On Mon, 27 Jun 2022 at 08:48, Steven Lee <steven_lee at aspeedtech.com> wrote:
>
> Hi Joel,
>
> I was wondering if you could share the commit hash of u-boot you tested.
> I would like to test it on qemu.

I recommend using master with the patch that fixes FIT hash checking:

https://lore.kernel.org/r/20220620070117.3443066-1-joel@jms.id.au

I use a script to build the image (also attached to this email):

https://ozlabs.org/~joel/build-ast2600-spl.sh

Run that script from the u-boot source tree. It provides an example
qemu commandline when it finishes:

/usr/bin/qemu-system-arm -M ast2600-evb -nographic -drive
file=ast2600-obj/test.img,if=mtd,format=raw -nic user,tftp=/srv/tftp/
U-Boot SPL 2022.07-rc5-00010-g75967970850a (Jun 27 2022 - 19:00:15 +0930)
Trying to boot from RAM
## Checking hash(es) for config conf-1 ... OK
## Checking hash(es) for Image firmware-1 ... sha256 error!
Bad hash value for 'hash-1' hash node in 'firmware-1' image node

One thing to note is the conf-1 check succeeds, but the firmware-1
check fails. I suspect this is because the conf-1 check is less than
64 bytes, so it only requires one pass of the HACE. That's also why
the qemu unit test you wrote works; it only tests one pass, so doesn't
trigger the accumulation part of the model.

I was running with this patch to see the output of the hash operation:

Author: Joel Stanley <joel at jms.id.au>
Date:   Sat Jun 18 18:20:08 2022 +0930

    fit: Print hash results on failure

    Signed-off-by: Joel Stanley <joel at jms.id.au>

diff --git a/boot/image-fit.c b/boot/image-fit.c
index df3e5df8836a..63aa46e51270 100644
--- a/boot/image-fit.c
+++ b/boot/image-fit.c
@@ -1302,7 +1302,18 @@ static int fit_image_check_hash(const void
*fit, int noffset, const void *data,
                *err_msgp = "Bad hash value len";
                return -1;
        } else if (memcmp(value, fit_value, value_len) != 0) {
+               int i;
                *err_msgp = "Bad hash value";
+               printf("\ncalculated: ");
+               for (i=0; i<value_len; i++)
+                       printf("%02x ", value[i]);
+               printf("\n");
+
+               printf("  expected: ");
+               for (i=0; i<value_len; i++)
+                       printf("%02x ", fit_value[i]);
+               printf("\n");
+
                return -1;
        }


If you forget the FIT hash checking patch I linked above, the
calculated value is zero. The value with that fix applied is non-zero,
but incorrect:

## Checking hash(es) for config conf-1 ... OK
## Checking hash(es) for Image firmware-1 ... sha256
calculated: ae e0 4c 59 7c ec 06 72 68 6c 97 86 ea 6c da d0 6d 66 69
18 0d a2 29 05 15 60 ed 38 b0 31 9b 7b
  expected: 21 b0 f9 d8 2c 54 51 58 b7 22 bd 79 26 4a 99 c9 42 45 fd
5d f3 3f 4e 66 d2 67 cb bf 5d fa eb ab

If it helps, here's a tree with u-master plus the two patches I mentioned:

 git clone -b aspeed-test https://github.com/shenki/u-boot/

Cheers,

Joel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: build-ast2600-spl.sh
Type: application/x-sh
Size: 2224 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20220627/d2557f9d/attachment.sh>