tfa-layerscape: pad the byte swapped PBL with zeros

The firmware images of Layerscape boards booting from QSPI, e.g. the
LS1046A-FRWY, differ between builds in 4 bytes at the end of the PBL:

  -00009e80: 019f 1e98 0000 0000 0000 0000 0000 0000
  +00009e80: e10f e4a8 0000 0000 0000 0000 0000 0000

byte_swap pads the PBL to a multiple of 8 bytes from a 4 byte variable,
so fwrite() reads up to 4 bytes of the stack past it, and an aligned
PBL always gets 8 bytes appended, 4 of them random.

Add a patch that pads with an 8 byte buffer of zeros. The output keeps
its length and layout: for an aligned input only the 4 former random
bytes become zeros, an unaligned input gives the same output as before.

Link: https://github.com/openwrt/openwrt/pull/25720
Signed-off-by: Paul Spooren <mail@aparcar.org>

2 files changed, 45 insertions, 1 deletions

diff --git a/package/boot/tfa-layerscape/Makefile b/package/boot/tfa-layerscape/Makefile
index d734066abb..e41a0d9075 100644
--- a/package/boot/tfa-layerscape/Makefile
+++ b/package/boot/tfa-layerscape/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=tfa-layerscape
 PKG_VERSION:=6.18.2.1.0.0
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/nxp-qoriq/atf
diff --git a/package/boot/tfa-layerscape/patches/005-tools-nxp-byte_swap-pad-with-zeros.patch b/package/boot/tfa-layerscape/patches/005-tools-nxp-byte_swap-pad-with-zeros.patch
new file mode 100644
index 0000000000..bfdb2b378d
--- /dev/null
+++ b/package/boot/tfa-layerscape/patches/005-tools-nxp-byte_swap-pad-with-zeros.patch
@@ -0,0 +1,44 @@
+From dc40636972d8f0c7cbe34c9967ff5c43ab2244df Mon Sep 17 00:00:00 2001
+From: Paul Spooren <mail@aparcar.org>
+Date: Tue, 6 Oct 2026 20:14:17 +0200
+Subject: [PATCH] tools/nxp: byte_swap: pad with zeros
+
+do_byteswap() pads the image to a multiple of 8 bytes with up to 8 bytes
+taken from a 4 byte variable, so fwrite() reads up to 4 bytes past it
+from the stack. append_bytes is never 0, so an image which is already
+aligned always gets 8 bytes appended, 4 of them random. This makes the
+PBL of every build different:
+
+  -00009e80: 019f 1e98 0000 0000 0000 0000 0000 0000
+  +00009e80: e10f e4a8 0000 0000 0000 0000 0000 0000
+
+Use an 8 byte buffer of zeros. The length and the layout of the output
+stay the same.
+
+Signed-off-by: Paul Spooren <mail@aparcar.org>
+---
+ tools/nxp/create_pbl/byte_swap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/nxp/create_pbl/byte_swap.c b/tools/nxp/create_pbl/byte_swap.c
+index 1d0bfce..b862e33 100644
+--- a/tools/nxp/create_pbl/byte_swap.c
++++ b/tools/nxp/create_pbl/byte_swap.c
+@@ -36,7 +36,7 @@ int do_byteswap(FILE *fp)
+ 	int bytes = 0;
+ 	uint32_t  upper_byte;
+ 	uint32_t  lower_byte;
+-	uint32_t  pad = 0U;
++	uint8_t  pad[EIGHT_BYTE_ALIGN] = { 0 };
+ 	/* Carries number of Padding bytes to be appended to
+ 	 * make file size 8 byte aligned.
+ 	 */
+@@ -48,7 +48,7 @@ int do_byteswap(FILE *fp)
+ 
+ 	append_bytes = EIGHT_BYTE_ALIGN - (bytes % EIGHT_BYTE_ALIGN);
+ 	if (append_bytes != 0) {
+-		if (fwrite(&pad, append_bytes, NUM_MEM_BLOCK, fp)
++		if (fwrite(pad, append_bytes, NUM_MEM_BLOCK, fp)
+ 			!= NUM_MEM_BLOCK) {
+ 			printf("%s: Error in appending padding bytes.\n",
+ 				__func__);