Commit graph

79908 commits

Author SHA1 Message Date
Dinesh Maniyam
7f85330782 arm: dts: socfpga: agilex: Add freeze controller node
The freeze controller is required for FPGA partial reconfig.
This node is disable on default.
Enable this node via u-boot fdt command when needed.

Signed-off-by: Yau Wai Gan <yau.wai.gan@intel.com>
Signed-off-by: Dinesh Maniyam <dinesh.maniyam@intel.com>
Reviewed-by: Tien Fong Chee <tien.fong.chee@intel.com>
2022-06-17 16:27:04 +08:00
Dinesh Maniyam
373c1428a0 arch: arm: socfpga: timer_s10: Override udelay for secure section
Override __udelay() as 'always inlined' function so that PSCI code
run in '__secure' section can call this delay function as well.

Signed-off-by: Chee Hong Ang <chee.hong.ang@intel.com>
Signed-off-by: Dinesh Maniyam <dinesh.maniyam@intel.com>
Reviewed-by: Tien Fong Chee <tien.fong.chee@intel.com>
2022-06-17 16:26:52 +08:00
Marek Vasut
163863d572 arm: socfpga: vining: Unmount UBIFS and detach UBI in ubi_load script
Clean up in ubiload script. Unmount UBIFS from which kernel image was
loaded and detach UBI on which the UBIFS is located, otherwise message
similar to the following is printed just before booting kernel:

Removing MTD device #7 (rootfs) with use count 1
Error when deleting partition "rootfs" (-16)

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Siew Chin Lim <elly.siew.chin.lim@intel.com>
Cc: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
Cc: Tien Fong Chee <tien.fong.chee@intel.com>
Reviewed-by: Tien Fong Chee  <tien.fong.chee@intel.com>
2022-06-16 16:11:06 +08:00
Tien Fong Chee
39bbcc341b ddr: altera: Stratix10: Use phys_size_t for memory size
Replace with phys_size_t for all memory size variables declaration
for the sake of scalability. phys_size_t is defined in
/arch/arm/include/asm/types.h.

Signed-off-by: Tien Fong Chee <tien.fong.chee@intel.com>
2022-06-16 16:10:58 +08:00
Tien Fong Chee
ee06c5390f ddr: altera: Ignore bit[7-4] for both seq2core & core2seq handshake in HPS
Bit[7-4] for both register seq2core and core2seq handshake in HPS are not
required for triggering DDR re-calibration or resetting EMIF. So, ignoring
these bits just for playing it safe.

Signed-off-by: Tien Fong Chee <tien.fong.chee@intel.com>
2022-06-16 16:10:44 +08:00
Yau Wai Gan
f70e00fa7d arm: dts: socfpga: stratix10: Update MMC smplsel value
This new MMC sample select value is obtained from running
tests on multiple Stratix 10 boards and proven working.

Signed-off-by: Yau Wai Gan <yau.wai.gan@intel.com>
Reviewed-by: Tien Fong Chee <tien.fong.chee@intel.com>
2022-06-16 16:02:26 +08:00
Tien Fong Chee
166e5b82a3 intel: n5x: ddr: update license
All the source code of sdram_n5x.c are from Intel, update the license to
use both GPL2.0 and BSD-3 Clause because this copy of code may used for
open source and internal project.

Signed-off-by: Tien Fong Chee <tien.fong.chee@intel.com>
2022-06-15 17:48:22 +08:00
Tom Rini
c18e5fb055 dtoc: Update test_src_scan.py for new tegra compatibles
This test was written to match up with the list of compatibles in
drivers/i2c/tegra_i2c.c so adding another one requires the test to be
updated to match.

Fixes: 0d2105ae5e ("arm: tegra: Update some DT compatibles")
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-06-14 13:59:23 -04:00
Tom Rini
c1d9020cc7 Merge branch 'master' of https://source.denx.de/u-boot/custodians/u-boot-tegra
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-06-14 12:59:12 -04:00
Marcel Ziswiler
8f27bf114e board: apalis_t30/tk1/colibri_t20/t30: integrate mac address via dt
Use device tree to set MAC address of the Ethernet chip.

Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
Signed-off-by: Tom Warren <twarren@nvidia.com>
2022-06-13 15:31:15 -07:00
Peter Robinson
0d2105ae5e arm: tegra: Update some DT compatibles
Some of the DT compatibles have changed upstream so add new DT compatibles
to ensure things continue to keep working if the device trees are
updated.

Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Signed-off-by: Tom Warren <twarren@nvidia.com>
2022-06-13 15:31:10 -07:00
Peter Robinson
b5cf255f73 pci: tegra: Update error prints with new lines
Add new lines to make errorr messages easier to read.

Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Signed-off-by: Tom Warren <twarren@nvidia.com>
2022-06-13 15:31:00 -07:00
Peter Robinson
5b060e465e ARM: tegra: XUSB padctl: Add new lines for errors
Add new lines for error messages to make them easier to read.

Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Signed-off-by: Tom Warren <twarren@nvidia.com>
2022-06-13 15:31:00 -07:00
Tom Rini
92a8bc6b41 Pull request for efi-2022-07-rc5
UEFI:
 
 * Ignore OsIndications if CONFIG_EFI_IGNORE_OSINDICATIONS=y
 * Correct UEFI default binary name
 * Let efidebug create boot options without file path
 * Support booting with a boot option with shortened device only device path
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAmKm12gACgkQxIHbvCwF
 GsTYDQ/+P4s0HdA8mb05PdInq2NZs1nSX89sHYLt9yC9ElBdZ3O399GmfOVDRpfa
 qBjh+N0p2B6PwQc4xN0b+pn/Rj+PV8aqG06hV3ASY63xpLxq2tKvnwUKexTyb7Wz
 l+StEUz63NO1PNNdSz/uDUFkLqdjV28ys6Qz8N0tUNNE63lVtxO7oNhyARc3/VRh
 +Rry4/iO3tCvEr6EUGOWzWbOwt4AVUk0bBSpoBG0CvmOTjtS8lKAJXDYYqOxZxXi
 J+tLramOUHgEbZmGLSFBvx9WOFHnIvAV7H4dJ19d7V2YZUwXcBNinSNjwgTDVXJ+
 o5NXyxnpsyrUTdm0g9lE2hmmhz/LlrlYzIQ4Rz6v0b4Gk1ZS5fFeUVhNp6B1hTL9
 hN8lJ2Jn3+inGrIRkCiG30b6qEU14YmjBpJ3Z5nZZSOkx6ce4TZNKb0VUD2DFeYc
 JCHg8Cecv361cM5LS2BVT2a2+1zghEWpv4xHh0m+xAccUM3E3kdDZGo2EiLQXGvp
 wPF0hX2K0LqZt6lD2Vyk5aBKTxz9XRDjzXXVKJCnLFcCSBlASRAymQu53xHd5/7L
 jAtvwVhDw//IWo9bA+5qjJqdDD9zgUE0ujrVOqU9/L3Oa55hYyM0WMBiDtM0xiSY
 GiPvmdDXqhCyNEfZNPcoAE6GUG1mq5Qdwt1NVQOhg85+TdvvcGI=
 =Ylyv
 -----END PGP SIGNATURE-----

Merge tag 'efi-2022-07-rc5' of https://source.denx.de/u-boot/custodians/u-boot-efi

Pull request for efi-2022-07-rc5

UEFI:

* Ignore OsIndications if CONFIG_EFI_IGNORE_OSINDICATIONS=y
* Correct UEFI default binary name
* Let efidebug create boot options without file path
* Support booting with a boot option with shortened device only device path
2022-06-13 09:33:37 -04:00
Heinrich Schuchardt
72fa9cd59e efi_loader: create boot options without file path
Allow the efidebug command to create boot options without file path, e.g.

    efidebug boot add -b 0001 'short dev only' host 0:1 ''
    efidebug boot add -B 0002 'long dev only' host 0:1 ''

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2022-06-12 13:02:34 +02:00
Heinrich Schuchardt
178667b34b efi_loader: allow booting from short dev only DP
Allow booting from a short form device-path without file path, e.g.

    /HD(1,GPT,5ef79931-a1aa-4c70-9d67-611e8f69eafd,0x800,0x1000)

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2022-06-12 09:17:54 +02:00
Heinrich Schuchardt
3a0654ecd0 efi_loader: correctly identify binary name
Only on the sandbox the default EFI binary name (e.g. BOOTX64.EFI) must
match the host architecture.

In all other cases we must use the target architecture.

Use #elif where appropriate.

Reported-by: Vagrant Cascadian <vagrant@reproducible-builds.org>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-06-12 09:17:54 +02:00
Sughosh Ganu
556a12654a EFI: FMP: Use a common GetImageInfo function for FIT and raw images
The GetImageInfo function definitions for the FIT images and raw
images are the same. Use a common function for the both the Firmware
Management Protocol(FMP) instances for raw and FIT images.

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-06-12 09:17:54 +02:00
Sughosh Ganu
119fafdefb EFI: Do not consider OsIndications variable if CONFIG_EFI_IGNORE_OSINDICATIONS is enabled
The EFI_IGNORE_OSINDICATIONS config symbol was introduced as a
mechanism to have capsule updates work even on platforms where the
SetVariable runtime service was not supported. The current logic
requires the OsIndications variable to have been set to a 64 bit value
even when the EFI_IGNORE_OSINDICATIONS config is enabled. Return an
error code on not being able to read the variable only when
EFI_IGNORE_OSINDICATIONS is not enabled.

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-06-12 09:17:54 +02:00
Tom Rini
57bd363de7 Merge https://source.denx.de/u-boot/custodians/u-boot-usb
- MediaTek XHCI bugfix, add  USB251xB/xBi driver
2022-06-08 08:25:30 -04:00
Marek Vasut
02544db9a7 misc: Port USB251xB/xBi Hi-Speed Hub Controller Driver from Linux
This patch adds a driver for configuration of the Microchip USB251xB/xBi
USB 2.0 hub controller series with USB 2.0 upstream connectivity, SMBus
configuration interface and two to four USB 2.0 downstream ports.

This is ported from Linux as of Linux kernel commit
5c2b9c61ae5d8 ("usb: usb251xb: add boost-up property support")

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Bin Meng <bmeng.cn@gmail.com>
Cc: Michal Simek <michal.simek@xilinx.com>
Cc: Simon Glass <sjg@chromium.org>
2022-06-07 16:14:20 +02:00
Tom Rini
6530de23e9 Merge https://source.denx.de/u-boot/custodians/u-boot-watchdog
- Fix SPL build with watchdog disabled in asm files (Pali)
2022-06-07 08:17:24 -04:00
Tom Rini
d9ad48464c Xilinx changes for v2022.07-rc4-v2
- Fix revision name (remove spaces)
 -----BEGIN PGP SIGNATURE-----
 
 iF0EABECAB0WIQQbPNTMvXmYlBPRwx7KSWXLKUoMIQUCYp2yXgAKCRDKSWXLKUoM
 IQ7xAJ9ij0dfw07bNWHTIx8teEWaIxX4wwCfU4BAIP5t1cA6iBXtR7zgDkF6Doo=
 =ydrb
 -----END PGP SIGNATURE-----

Merge tag 'xilinx-for-v2022.07-rc4-v2' of https://source.denx.de/u-boot/custodians/u-boot-microblaze

Xilinx changes for v2022.07-rc4-v2

- Fix revision name (remove spaces)
2022-06-07 08:17:08 -04:00
Chunfeng Yun
fe8e8af36c usb: xhci-mtk: disable all ports when disable host controller
This is used to avoid the ports status of IPPC being brought in kernel
stage, it may cause ports error especially when the xhci controller is
a component of dual-role controller.

Reported-by: Yun-Chien Yu <yun-chien.yu@mediatek.com>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
2022-06-07 09:55:57 +02:00
Pali Rohár
06ceff70bf watchdog: Fix SPL build with watchdog disabled in asm files
Allow to compile assembler files in SPL build which calls WATCHDOG_RESET
function when watchdog is disabled in SPL and enabled in U-Boot proper.

This issue was fixed in past by commit 7fbd42f5af ("watchdog: Handle SPL
build with watchdog disabled") for C source files, but not for assembler
source files.

Currently the only assembler source file which calls WATCHDOG_RESET is
arch/powerpc/lib/ticks.S, so this patch affects and fixes powerpc SPL
builds.

Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Stefan Roese <sr@denx.de>
2022-06-07 08:45:35 +02:00
Tom Rini
8f527342db Prepare v2022.07-rc4
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-06-06 10:25:13 -04:00
Camelia Groza
380e32b171 configs: fsl: add missing SYS_FMAN_FW_ADDR defines
Two defconfigs were missed when transitioning the SYS_FMAN_FW_ADDR
symbol to Kconfig. CONFIG_SYS_FMAN_FW_ADDR is currently initialized to
0 by default on these builds, which prevents the firmware from loading.

Add the correct symbols to these defconfigs.

Fixes: a97a071d10 ("configs: fsl: migrate FMAN/QE specific defines to Kconfig")
Signed-off-by: Camelia Groza <camelia.groza@nxp.com>
2022-06-06 10:20:09 -04:00
Patrick Delaunay
660d74278f doc: update mail author for st-dt.rst
Update author email address with the one dedicated to
upstream activities.

Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
2022-06-06 10:20:04 -04:00
Michal Simek
93216276f5 xilinx: fru: Replace spaces with \0 in detected revision
Also fix board revision field where spaces are used instead of \0.
The same change was done for board name by commit 530560b6f8 ("xilinx:
fru: Replace spaces with \0 in detected name").

Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/e069e5134e57899e859786ad8ba48721df6df752.1653911444.git.michal.simek@amd.com
2022-06-06 09:32:26 +02:00
Tom Rini
0f259fe79d Pull request for efi-2022-07-rc4-4
UEFI:
 
 * Fix the implementation of the firmware management protocol
 * Fix the unit tests for signed update capsules
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAmKbUokACgkQxIHbvCwF
 GsT28A/+OWQm641wcLnt88KfTX31lI7suJK+E75wmLK205lUQT8EtqMCg/YAI1Ck
 oHrEzjjmoaiGQGFtZ466adpVerRETLyJBAAWVxClzoVwqhnvfQnHuHUWRwjTVffr
 FT89LQphHMQOfOPC0JIxFl9NHRQLc4cWxIskN2AfavyD+PC2PuL1g5lxPtTYlUS/
 2vCyE6Hi5xZSBWv9qJDsM6DsIZF4hGgOuov8Bk/WRCuA3+rXzAtU8pSy25Q55H3C
 f+shgZagpIVTSmS4+VRScGXPfTmTsM2B/Gs93bIAuGCqz/TYR9a11eHZkf7jg7Kq
 UDeTVm/+VaIVThNent+KBGvrl9c/4S9iuYUv04U54FoNQz9eim98P5ELctW1mI5M
 TTZy8CRblDupFKjLnJeqmjrJuNFak2jgp9T6n/X9FdiJR3EnugV+x+iGpiEyfNxq
 meYi55/H0pgKaD2MCRaUeuY9LZznLQ1ZDyRxQ31+kYPU9/GEYmHS+HoiLDDuIDlF
 Ok2wGRsw/hSkGbSvzdZTY+m8QAOIq0dSvV57H5kS/T48hv46NeJYmgmlIP4TUWl4
 ClkElIEIOt10fRcPQC81wtzip9DuuTHnYqwXCR0XlqO27jcnw5dAN8CH7l1y7gWp
 kxnPkhIVfk7jk/hyix6yVTKrn04OMWsRRa+F1ibJFTVBICdAMW8=
 =Eb4i
 -----END PGP SIGNATURE-----

Merge tag 'efi-2022-07-rc4-4' of https://source.denx.de/u-boot/custodians/u-boot-efi

Pull request for efi-2022-07-rc4-4

UEFI:

* Fix the implementation of the firmware management protocol
* Fix the unit tests for signed update capsules
2022-06-04 09:38:56 -04:00
Vincent Stehlé
8645aefc8b efi: test/py: authenticate fit capsules
Add support for the authentication of UEFI capsules containing FIT images.

The authentication code is moved out of the function handling raw images
into a new function efi_firmware_capsule_authenticate(). The special case
for the FMP header coming from edk2 tools is preserved. There is no
functional change for capsules containing raw images.

The python test for signed capsules with raw images is renamed with no
functional change and a new test is added for signed capsules containing
FIT images.

This can be tested with sandbox64_defconfig or sandbox_flattree_defconfig,
plus CONFIG_EFI_CAPSULE_AUTHENTICATE=y.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
2022-06-04 08:43:55 +02:00
Vincent Stehlé
82b3f4cb46 test/py: efi_capsule: repair image authentication test
Repair the python tests for authenticated EFI capsules, which can be run
with sandbox_defconfig plus CONFIG_EFI_CAPSULE_AUTHENTICATE=y.

- Account for the reset changes done by commit 3e6f810006 ("efi_loader:
  test/py: Reset system after capsule update on disk").
- Fix the capsule GUID typo introduced by commit 2e9c3c6965 ("test:
  capsule: Modify the capsule tests to use GUID values for sandbox").

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
2022-06-04 08:43:55 +02:00
Sughosh Ganu
aad7f1ad60 EFI: Update the documentation to reflect the correct value of OsIndications
The OsIndications is a 64 bit variable, and the current code expects
the value of the variable to be 64 bit. Update the documentation to
reflect this fact.

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-06-04 08:43:55 +02:00
Sughosh Ganu
6a463bc1c9 EFI: Populate descriptor_count value only when image_info_size is not zero
The GetImageInfo function of the Firmware Mangement Protocol(FMP) gets
called initially to query the size of the image descriptor array that
would have to be allocated. During this call, the rest of the function
arguments, specifically pointers might be passed as NULL. Do not
populate the descriptor_count value before it is known that the call
to GetImageInfo has been made with the allocated buffer for the image
descriptors.

Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-06-04 08:43:55 +02:00
Chris Packham
f1533c41a7 doc: environment: Fix typo
"valu" should be "value".

Signed-off-by: Chris Packham <judge.packham@gmail.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-06-04 08:43:55 +02:00
Tom Rini
90189ecd59 Merge branch '2022-06-03-assorted-fixes'
- armv8 TCR write bugfix, ubifs bugfix, imx8mq clk bugfixes, two network
  fixes, Add U-Boot version to chosen node, update TI AM64x board
  maintainers
2022-06-03 15:42:13 -04:00
Dave Gerlach
c30f6d62f0 board: ti: am64x: Update MAINTAINERS
Move maintainership of TI AM64x boards to Vignesh.

Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
2022-06-03 15:42:05 -04:00
Pali Rohár
9320db0926 squashfs: Fix compilation on big endian systems
Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
2022-06-03 11:15:24 -04:00
Peng Fan
ad9f3771f6 imx: imx8mq: select CONFIG_CMD_CLK
select CONFIG_CMD_CLK to enable dump clk in uboot shell

Signed-off-by: Peng Fan <peng.fan@nxp.com>
2022-06-03 11:15:24 -04:00
Peng Fan
4230d68aa8 imx: imx8mq: default select CLK_IMX8MQ
Since the power domain driver default select CONFIG_CLK, so we will
meet lots failures without CLK_IMX8MQ, so default select it.

Fixes: commit 4eb82c2e56 ("imx: power-domain: Get rid of SMCCC dependency")
Signed-off-by: Peng Fan <peng.fan@nxp.com>
2022-06-03 11:15:24 -04:00
Francesco Dolcini
622ecee93a fdt: Add U-Boot version to chosen node
Add a new device tree property "u-boot,version" in the chosen node to
pass the U-Boot version to the operating system.
This can be useful to implement a firmware upgrade procedure from the
operating system.

Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
2022-06-03 11:15:24 -04:00
Fabio Estevam
b85d130ea0 net: Check for the minimum IP fragmented datagram size
Nicolas Bidron and Nicolas Guigo reported the two bugs below:

"
----------BUG 1----------

In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) higher than `IP_HDR_SIZE`
and strictly lower than `IP_HDR_SIZE+8` will lead to a value for `len`
comprised between `0` and `7`. This will ultimately result in a
truncated division by `8` resulting value of `0` forcing the hole
metadata and fragment to point to the same location. The subsequent
memcopy will overwrite the hole metadata with the fragment data. Through
a second fragment, this can be exploited to write to an arbitrary offset
controlled by that overwritten hole metadata value.

This bug is only exploitable locally as it requires crafting two packets
the first of which would most likely be dropped through routing due to
its unexpectedly low Total Length. However, this bug can potentially be
exploited to root linux based embedded devices locally.

```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
     static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
     static u16 first_hole, total_len;
     struct hole *payload, *thisfrag, *h, *newh;
     struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
     uchar *indata = (uchar *)ip;
     int offset8, start, len, done = 0;
     u16 ip_off = ntohs(ip->ip_off);

     /* payload starts after IP header, this fragment is in there */
     payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
     offset8 =  (ip_off & IP_OFFS);
     thisfrag = payload + offset8;
     start = offset8 * 8;
     len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```

The last line of the previous excerpt from `u-boot/net/net.c` shows how
the attacker can control the value of `len` to be strictly lower than
`8` by issuing a packet with `ip_len` between `21` and `27`
(`IP_HDR_SIZE` has a value of `20`).

Also note that `offset8` here is `0` which leads to `thisfrag = payload`.

```C
     } else if (h >= thisfrag) {
         /* overlaps with initial part of the hole: move this hole */
         newh = thisfrag + (len / 8);
         *newh = *h;
         h = newh;
         if (h->next_hole)
             payload[h->next_hole].prev_hole = (h - payload);
         if (h->prev_hole)
             payload[h->prev_hole].next_hole = (h - payload);
         else
             first_hole = (h - payload);

     } else {
```

Lower down the same function, execution reaches the above code path.
Here, `len / 8` evaluates to `0` leading to `newh = thisfrag`. Also note
that `first_hole` here is `0` since `h` and `payload` point to the same
location.

```C
     /* finally copy this fragment and possibly return whole packet */
     memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```

Finally, in the above excerpt the `memcpy` overwrites the hole metadata
since `thisfrag` and `h` both point to the same location. The hole
metadata is effectively overwritten with arbitrary data from the
fragmented IP packet data. If `len` was crafted to be `6`, `last_byte`,
`next_hole`, and `prev_hole` of the `first_hole` can be controlled by
the attacker.

Finally the arbitrary offset write occurs through a second fragment that
only needs to be crafted to write data in the hole pointed to by the
previously controlled hole metadata (`next_hole`) from the first packet.

 ### Recommendation

Handle cases where `len` is strictly lower than 8 by preventing the
overwrite of the hole metadata during the memcpy of the fragment. This
could be achieved by either:
* Moving the location where the hole metadata is stored when `len` is
lower than `8`.
* Or outright rejecting fragmented IP datagram with a Total Length
(`ip_len`) lower than 28 bytes which is the minimum valid fragmented IP
datagram size (as defined as the minimum fragment of 8 octets in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 25).

----------BUG 2----------

In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) lower than `IP_HDR_SIZE`
will lead to a negative value for `len` which will ultimately result in
a buffer overflow during the subsequent `memcpy` that uses `len` as it's
`count` parameter.

This bug is only exploitable on local ethernet as it requires crafting
an invalid packet to include an unexpected `ip_len` value in the IP UDP
header that's lower than the minimum accepted Total Length of a packet
(21 as defined in the IP Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791)). Such packet
would in all likelihood be dropped while being routed to its final
destination through most routing equipment and as such requires the
attacker to be in a local position in order to be exploited.

```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
     static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
     static u16 first_hole, total_len;
     struct hole *payload, *thisfrag, *h, *newh;
     struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
     uchar *indata = (uchar *)ip;
     int offset8, start, len, done = 0;
     u16 ip_off = ntohs(ip->ip_off);

     /* payload starts after IP header, this fragment is in there */
     payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
     offset8 =  (ip_off & IP_OFFS);
     thisfrag = payload + offset8;
     start = offset8 * 8;
     len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```

The last line of the previous excerpt from `u-boot/net/net.c` shows
where the underflow to a negative `len` value occurs if `ip_len` is set
to a value strictly lower than 20 (`IP_HDR_SIZE` being 20). Also note
that in the above excerpt the `pkt_buff` buffer has a size of
`CONFIG_NET_MAXDEFRAG` which defaults to 16 KB but can range from 1KB to
64 KB depending on configurations.

```C
     /* finally copy this fragment and possibly return whole packet */
     memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```

In the above excerpt the `memcpy` overflows the destination by
attempting to make a copy of nearly 4 gigabytes in a buffer that's
designed to hold `CONFIG_NET_MAXDEFRAG` bytes at most which leads to a DoS.

 ### Recommendation

Stop processing of the packet if `ip_len` is lower than 21 (as defined
by the minimum length of a data carrying datagram in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 34)."

Add a check for ip_len lesser than 28 and stop processing the packet
in this case.

Such a check covers the two reported bugs.

Reported-by: Nicolas Bidron <nicolas.bidron@nccgroup.com>
Signed-off-by: Fabio Estevam <festevam@denx.de>
2022-06-03 11:15:24 -04:00
Andre Przywara
2b641211c5 armv8: Fix TCR 64-bit writes
The AArch64 TCR_ELx register is a 64-bit register, and many newer
architecture features use bits in the upper half. So far U-Boot was
igorant of those bits, trying to leave them alone.
However, in an effort to set bit 31 to 1, it failed doing so, because
the compiler sign-extended "1 << 31", so that all bits[63:31] got set.

Older ARMv8.0 cores don't define anything dangerous up there, but newer
architecture revisions do, and setting all those bits will end badly:
=================
$ qemu-system-aarch64 -cpu max ....
U-Boot 2022.07-rc1 (May 09 2022 - 15:21:00 +0100)

DRAM:  1.5 GiB
=================  (hangs here)

Defining TCR_ELx_RSVD to "1U << 31" avoids the sign-extension, so all
upper bits stay at a safe 0 value. This means no more surprises when
U-Boot runs on a more capable CPU core.

Reported-by: Balaji Anandapadmanaban <Balaji.Anandapadmanaban@arm.com>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Tested-by: Peter Collingbourne <pcc@google.com>
Reviewed-by: Peter Collingbourne <pcc@google.com>
2022-06-03 11:15:24 -04:00
Michael Walle
7704b7fd67 net: enetc: unregister mdiobus
If the device fails to probe - for example, when there is no
ethaddr set - then the private data is automatically freed
but the mdiobus remains registered.

Fixes: 1e354cb393 ("drivers: net: fsl_enetc: register internal MDIO bus")
Signed-off-by: Michael Walle <michael@walle.cc>
2022-06-03 11:15:24 -04:00
Pali Rohár
339f652992 ubifs: Fix lockup/crash when reading files
Commit b1a14f8a1c ("UBIFS: Change ubifsload to not read beyond the
requested size") added optimization to do not read more bytes than it is
really needed. But this commit introduced incorrect handling of the hole at
the end of file. This logic cause U-Boot to crash or lockup when trying to
read from the ubifs filesystem.

When read_block() call returns -ENOENT error (not an error, but the hole)
then dn-> structure is not filled and contain garbage. So using of dn->size
for memcpy() argument cause that U-Boot tries to copy unspecified amount of
bytes from possible unmapped memory. Which randomly cause lockup of P2020
CPU.

Fix this issue by copying UBIFS_BLOCK_SIZE bytes from read buffer when
dn->size is not available. UBIFS_BLOCK_SIZE is the size of the buffer
itself and read_block() fills buffer by zeros when it returns -ENOENT.

This patch fixes ubifsload on P2020.

Fixes: b1a14f8a1c ("UBIFS: Change ubifsload to not read beyond the requested size")
Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Stefan Roese <sr@denx.de>
2022-06-03 10:23:22 -04:00
Tom Rini
3053b78146 Pull request for efi-2022-07-rc4-3
UEFI:
 
 * fix a problem in loading an image from a short-path
 * fix building the bootmenu command for CONFIG_EFI_LOADER=n
 * correct the bootefi command syntax
 * add firmware management protocol to the documentation
 
 Others:
 
 * bootmenu: fix bootmenu title handling
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAmKVrnUACgkQxIHbvCwF
 GsRzqA//Wrr9DzoYEdOHlRUc87SN3AjVGSwH6GvD6AJZY5aLQxc5crg2dNtf2YvD
 NmWXBLb58a2iyA2QO2KSJB8+Of/4ZhXi3chmw5KOxRVw2NFQGLYEmKjgPWRbg46X
 ijygtI4XmcNQSPgKe+IcXHu5rED4YtmvK55bfD60Zg1qeWXrlNtQw7MI0HI7o6ct
 +1YGG6aXbqyobzGdDGTpXRzwNlrkqqnBw3u+ckpDvnNMrEHSYKJZQ9KBd2fnlnvY
 vLM7MnwbZaIBdd9bG6dlNUgRsvzjTmUCoye0llZ0teo8VjIRNiyeXbPgJvuMB074
 4Kw23dfHvvQnMehuqORJ0rFMJN4LqwlageHfb0hTZsLSfDDhTMLbNcGJQbWbfMBp
 3i5KUtNDMs8Go4ODQV9QNvW0jk+VPE2O9Q6uT1bZMDVuG0fTvJDCxopeoEn8UZFl
 kc3IyukPH8G7l0TL5JGR4wtFitBjBNWtpMuOUO8GHtjZAi6j32pS5oG7z2lrz2l7
 cYuLJYYYP+Tw3N4/LI5R6lEbMMCLTDZvTiUOWaYjCz8A5tL/HntgZ7AAP6bSnarD
 rujnUkYFoYc5VIaDftVm/MVzU9Dn1Mr/wAySSOUrmDJBa45DIs/MV1JnRO+VxjOA
 jIFWRt5l1ckWRvancZuKp9uwrGoZXYe18oya3l24/qaTkUSuZ4k=
 =LXcP
 -----END PGP SIGNATURE-----

Merge tag 'efi-2022-07-rc4-3' of https://source.denx.de/u-boot/custodians/u-boot-efi

Pull request for efi-2022-07-rc4-3

UEFI:

* fix a problem in loading an image from a short-path
* fix building the bootmenu command for CONFIG_EFI_LOADER=n
* correct the bootefi command syntax
* add firmware management protocol to the documentation

Others:

* bootmenu: fix bootmenu title handling

Tested-by: Pali Rohár <pali@kernel.org> [n900, for bootmenu working as before]
2022-05-31 13:05:53 -04:00
Masahisa Kojima
e85727ddb6 bootmenu: use utf-8 for menu title
The commit a3d0aa87ac ("bootmenu: update bootmenu_entry structure")
changes the bootmenu title type from char to u16(UTF16 string)
to support EFI based system. If EFI_LOADER is not enabled,
printf("%ls") is not supported, so bootmenu does not appear
correctly.

This commit changes the type of menu title from u16(UTF16) to
utf-8 string and EFI strings is conveted into utf-8.

Fixes: a3d0aa87ac ("bootmenu: update bootmenu_entry structure")
Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Tested-by: Pali Rohar <pali@kernel.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-05-31 07:57:02 +02:00
Vincent Stehlé
2ee9550a7d doc/efi: add firmware management protocol to the documentation
The firmware management protocol can be used to manage device firmware.
U-Boot can be configured to provide an implementation.

Document the related functions in the API section.

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-05-28 10:59:27 +02:00
Vincent Stehlé
7751d2ef86 efi: fix documentation warnings
This fixes the following warnings:

  ./lib/efi_loader/efi_firmware.c:283: warning: Function parameter or member 'package_version' not described in 'efi_firmware_fit_get_image_info'
  ./lib/efi_loader/efi_firmware.c:283: warning: Function parameter or member 'package_version_name' not described in 'efi_firmware_fit_get_image_info'
  ./lib/efi_loader/efi_firmware.c:369: warning: bad line: firmware image
  ./lib/efi_loader/efi_firmware.c:395: warning: Function parameter or member 'package_version' not described in 'efi_firmware_raw_get_image_info'
  ./lib/efi_loader/efi_firmware.c:395: warning: Function parameter or member 'package_version_name' not described in 'efi_firmware_raw_get_image_info'

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-05-28 10:59:27 +02:00
Masahisa Kojima
afbeedc868 lib/charset: fix compile warnings
This commit fixes the following compile warnings
for the documentation.

./include/charset.h:276: warning: Function parameter or member 'size' not described in 'u16_strlcat'
./include/charset.h:276: warning: Excess function parameter 'count' description in 'u16_strlcat'

Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-05-28 10:59:27 +02:00