From patchwork Mon Aug 24 17:14:05 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Baruch Siach X-Patchwork-Id: 1350558 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=85.214.62.61; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=tkos.co.il Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4BZzJf74fmz9sSP for ; Tue, 25 Aug 2020 03:14:56 +1000 (AEST) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 9F21880422; Mon, 24 Aug 2020 19:14:49 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=tkos.co.il Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: by phobos.denx.de (Postfix, from userid 109) id 1C5C3806CA; Mon, 24 Aug 2020 19:14:48 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=BAYES_00,RDNS_NONE, SPF_HELO_NONE,SUBJ_OBFU_PUNCT_FEW,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.2 Received: from mx.tkos.co.il (unknown [192.115.133.116]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id BD44B80404 for ; Mon, 24 Aug 2020 19:14:44 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=tkos.co.il Authentication-Results: phobos.denx.de; spf=none smtp.mailfrom=baruch@tkos.co.il Received: from tarshish.tkos.co.il (unknown [10.0.8.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx.tkos.co.il (Postfix) with ESMTPS id BDDEB44057F; Mon, 24 Aug 2020 20:14:42 +0300 (IDT) From: Baruch Siach To: Tom Rini Cc: u-boot@lists.denx.de, Patrice CHOTARD , Baruch Siach Subject: [PATCH] image: don't exceed gd->ram_top in bootm_size Date: Mon, 24 Aug 2020 20:14:05 +0300 Message-Id: <7eb007e7698f5a1775410bef5765b627744ee9a7.1598289245.git.baruch@tkos.co.il> X-Mailer: git-send-email 2.28.0 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.3 at phobos.denx.de X-Virus-Status: Clean When board_get_usable_ram_top() limits gd->ram_top, env_get_bootm_size() must not exceed that limit. Otherwise, boot_relocate_fdt() might put fdt out of the allowed RAM range. The similar commit 8ce1f10cf2b1 ("ARM: bootm: take into account gd->ram_top") exposed this bug. This fixes boot on Armada 8040 based Clearfog GT-8K where ram_top is set to 0x80000000 (2GB), but bi_dram[0].size might be up to 0xc0000000 (3GB). Note the relocated fdt address (0xbfff4000) in the console output listed below: Found /extlinux/extlinux.conf Retrieving file: /extlinux/extlinux.conf 62 bytes read in 21 ms (2 KiB/s) 1: linux Retrieving file: /extlinux/Image 13740544 bytes read in 1266 ms (10.4 MiB/s) Retrieving file: /extlinux/armada-8040-clearfog-gt-8k.dtb 33368 bytes read in 31 ms (1 MiB/s) Booting using the fdt blob at 0x4f00000 Loading Device Tree to 00000000bfff4000, end 00000000bffff257 ... "Synchronous Abort" handler, esr 0x96000045 elr: 000000000006e1cc lr : 0000000000068fd8 (reloc) elr: 000000007ffa91cc lr : 000000007ffa3fd8 x0 : ffffffffffffffff x1 : 00000000bfffc258 x2 : 0000000000000000 x3 : ffffffffffff7da7 x4 : 0000000004f08258 x5 : 00000000bfff4000 x6 : 00000000bfff4000 x7 : 000000000000000f x8 : 000000007fb23bf8 x9 : 0000000000000008 x10: 00000000bffff257 x11: 00000000bffff257 x12: 0000000000000000 x13: fffffffffffff000 x14: 00000000bfff4000 x15: 0000000000000021 x16: 000000007ff7bc38 x17: 0000000000000000 x18: 000000007fb2add0 x19: 00000000bfff4000 x20: 0000000004f00000 x21: 000000000000b258 x22: 0000000058820000 x23: 0000000000000010 x24: 000000007ffe3c40 x25: 000000007fb23cb8 x26: 00000000c0000000 x27: 0000000000000000 x28: 000000007fc3fd50 x29: 000000007fb23bd0 Code: 54000061 aa0603e0 d65f03c0 38606882 (38206822) Resetting CPU ... Thanks to Patrice CHOTARD who directed me to the right way. Signed-off-by: Baruch Siach --- common/image.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/common/image.c b/common/image.c index 9d7d5c17d122..da8bccd400dd 100644 --- a/common/image.c +++ b/common/image.c @@ -694,6 +694,9 @@ phys_size_t env_get_bootm_size(void) size = gd->bd->bi_memsize; #endif + if (start + size > gd->ram_top) + size = gd->ram_top - start; + s = env_get("bootm_low"); if (s) tmp = (phys_size_t)simple_strtoull(s, NULL, 16);