Commit graph

888 commits

Author SHA1 Message Date
Viacheslav Mitrofanov
eeb0a2c693 net: ping6: Add ping6 command
Implement ping6 command to ping hosts using IPv6. It works the same way as
an ordinary ping command. There is no ICMP request so it is not possible
to ping our host. This patch adds options in Kconfig and Makefile to
build ping6 command.

Series-changes: 3
- Added structures and functions descriptions
- Added to ping6_receive() return value instead of void

Series-changes: 4
- Fixed structures and functions description style

Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05 12:47:16 -05:00
Viacheslav Mitrofanov
7fbf230d79 net: tftp: Add IPv6 support for tftpboot
The command tftpboot uses IPv4 by default. Add the possibility to use IPv6
instead. If an address in the command is an IPv6 address it will use IPv6
to boot or if there is a suffix -ipv6 in the end of the command it also
force using IPv6. All other tftpboot features and parameters are left
the same.

Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05 12:47:16 -05:00
Viacheslav Mitrofanov
ffdbf3bad5 net: ipv6: Incorporate IPv6 support into u-boot net subsystem
Add net_ip6_handler (an IPv6 packet handler) into net_loop. Add
neighbor discovery mechanism into network init process. That is the
main step to run IPv6 in u-boot. Now u-boot is capable to use NDP and
handle IPv6 packets.

Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05 12:47:16 -05:00
Viacheslav Mitrofanov
1feb697830 net: ipv6: Add implementation of main IPv6 functions
Functions that were exposed in "net: ipv6: Add IPv6 basic primitives"
had only empty implementations and were exposed as API for futher
patches. This patch add implementation of these functions. Main
functions are: net_ip6_handler() - IPv6 packet handler for incoming
packets; net_send_udp_packet6() - make up and send an UDP packet;
csum_ipv6_magic() - compute checksum of IPv6 "psuedo-header" per RFC2460
section 8.1; ip6_addr_in_subnet() - check if an address is in our
subnet. Other functions are auxiliary.

Series-changes: 3
- Added comments
- Fixed style problems
- Fixed return codes instead of -1

Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05 12:47:16 -05:00
Viacheslav Mitrofanov
43ab8ecc7d net: ipv6: Add ip6addr, gatewayip6, serverip6 variables callbacks
Implement actions on ip6addr, gatewayip6, serverip6 varaibles.
on_ip6addr - convert IPv6 string addr to struct ip6_addr
on_gatewayip6 - convert IPv6 string addr to struct ip6_addr
on_serverip6 - convert IPv6 string addr to struct ip6_addr

Series-changes: 3
- Removed memory allocation
- Substituted -1 for error code

Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05 12:47:16 -05:00
Viacheslav Mitrofanov
c6610e1d90 net: ipv6: Add Neighbor Discovery Protocol (NDP)
Implement basic of NDP. It doesn't include such things as Router
Solicitation, Router Advertisement and Redirect. It just has Neighbor
Solicitation and Neighbor Advertisement. Only these two features are used
in u-boot IPv6. Implementation of some NDP functions uses API that was
exposed in "net: ipv6: Add IPv6 basic primitives".

Also this patch inlcudes update in Makefile to build NDP.

Series-changes: 3
- Added structures and functions descriptions
- Fixed style problems

Series-changes: 4
- Fixed structures and functions description style

Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05 12:47:16 -05:00
Viacheslav Mitrofanov
3cc04a3ab2 net: ipv6: Add IPv6 build options
Add options to Makefile and Kconfig file to build IPv6

Series-changes: 3
- Added help for IPv6 support

Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05 12:47:16 -05:00
Viacheslav Mitrofanov
33b5066a59 net: ipv6: Add IPv6 basic primitives
This patch is a collection of basic primitives that are prerequisite for
further IPv6 implementation.

There are structures definition such as IPv6 header, UDP header
(for TFTP), ICMPv6 header. There are auxiliary defines such as protocol
codes, padding, struct size and etc. Also here are functions prototypes
and its empty implementation that will be used as API for further patches.
Here are variables declaration such as IPv6 address of our host,
gateway, ipv6 server.

Series-changes: 3
- Added functions and structures descriptions
- Removed enums ND_OPT_*. It will be moved into further patches
- Substituted -1 for error codes

Series-changes: 4
- Changed functions and structures description style

Signed-off-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-12-05 12:47:15 -05:00
Heinrich Schuchardt
bdb060a3eb net: CONFIG_NET_DEVICES in dhcp_handler()
The symbol CONFIG_NET_DEVICES does not exist.
The correct name is CONFIG_NETDEVICES.

Fixes: 77b5c4a5b1 ("efi_loader: Let networking support depend on NETDEVICES")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-12-02 19:17:24 +01:00
Ying-Chun Liu (PaulLiu)
cfbae48219 net: Add wget application
This commit adds a simple wget command that can download files
from http server.

The command syntax is
wget ${loadaddr} <path of the file from server>

Signed-off-by: Duncan Hare <DuncanCHare@yahoo.com>
Signed-off-by: Ying-Chun Liu (PaulLiu) <paul.liu@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Cc: Christian Gmeiner <christian.gmeiner@gmail.com>
Cc: Joe Hershberger <joe.hershberger@ni.com>
Cc: Michal Simek <michal.simek@xilinx.com>
Cc: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 13:06:39 -05:00
Ying-Chun Liu (PaulLiu)
a3bf193bf4 net: Add TCP protocol
Currently file transfers are done using tftp or NFS both
over udp. This requires a request to be sent from client
(u-boot) to the boot server.

The current standard is TCP with selective acknowledgment.

Signed-off-by: Duncan Hare <DH@Synoia.com>
Signed-off-by: Duncan Hare <DuncanCHare@yahoo.com>
Signed-off-by: Ying-Chun Liu (PaulLiu) <paul.liu@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Cc: Christian Gmeiner <christian.gmeiner@gmail.com>
Cc: Joe Hershberger <joe.hershberger@ni.com>
Cc: Michal Simek <michal.simek@xilinx.com>
Cc: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 13:06:39 -05:00
Rasmus Villemoes
0686968639 net: deal with fragment-overlapping-two-holes case
With a suitable sequence of malicious packets, it's currently possible
to get a hole descriptor to contain arbitrary attacker-controlled
contents, and then with one more packet to use that as an arbitrary
write vector.

While one could possibly change the algorithm so we instead loop over
all holes, and in each hole puts as much of the current fragment as
belongs there (taking care to carefully update the hole list as
appropriate), it's not worth the complexity: In real, non-malicious
scenarios, one never gets overlapping fragments, and certainly not
fragments that would be supersets of one another.

So instead opt for this simple protection: Simply don't allow the
eventual memcpy() to write beyond the last_byte of the current hole.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-11-28 13:06:39 -05:00
Rasmus Villemoes
087648b5df net: tftp: sanitize tftp block size, especially for TX
U-Boot does not support IP fragmentation on TX (and unless
CONFIG_IP_DEFRAG is set, neither on RX). So the blocks we send must
fit in a single ethernet packet.

Currently, if tftpblocksize is set to something like 5000 and I
tftpput a large enough file, U-Boot crashes because we overflow
net_tx_packet (which only has room for 1500 bytes plus change).

Similarly, if tftpblocksize is set to something larger than what we
can actually receive (e.g. 50000, with NET_MAXDEFRAG being 16384), any
tftp get just hangs because we never receive any packets.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 13:06:39 -05:00
Rasmus Villemoes
4b8c44e39c net: tftp: use IS_ENABLED(CONFIG_NET_TFTP_VARS) instead of #if
Nothing inside this block depends on NET_TFTP_VARS to be set to parse
correctly. Switch to C if() in preparation for adding code before
this (to avoid a declaration-after-statement warning).

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
[trini: Update to cover CONFIG_TFTP_PORT case as well]
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-11-28 13:06:14 -05:00
Rasmus Villemoes
06653c7010 net: fix ip_len in reassembled IP datagram
For some reason, the ip_len field in a reassembled IP datagram is set
to just the size of the payload, but it should be set to the value it
would have had if the datagram had never been fragmented in the first
place, i.e. size of payload plus size of IP header.

That latter value is currently returned correctly via the "len"
variable. And before entering net_defragment(), len does have the
value ntohs(ip->ip_len), so if we're not dealing with a
fragment (so net_defragment leaves *len alone), that relationship of
course also holds after the net_defragment() call.

The only use I can find of ip->ip_len after the net_defragment call is
the ntohs(ip->udp_len) > ntohs(ip->ip_len) sanity check - none of the
functions that are passed the "ip" pointer themselves inspect ->ip_len
but instead use the passed len.

But that sanity check is a bit odd, since the RHS really should be
"ntohs(ip->ip_len) - 20", i.e. the IP payload size.

Now that we've fixed things so that len == ntohs(ip->ip_len) in all
cases, change that sanity check to use len-20 as the RHS.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-11-28 10:25:18 -05:00
Rasmus Villemoes
1817c3824a net: (actually/better) deal with CVE-2022-{30790,30552}
I hit a strange problem with v2022.10: Sometimes my tftp transfer
would seemingly just hang. It only happened for some files. Moreover,
changing tftpblocksize from 65464 to 65460 or 65000 made it work again
for all the files I tried. So I started suspecting it had something to
do with the file sizes and in particular the way the tftp blocks get
fragmented and reassembled.

v2022.01 showed no problems with any of the files or any value of
tftpblocksize.

Looking at what had changed in net.c or tftp.c since January showed
only one remotely interesting thing, b85d130ea0.

So I fired up wireshark on my host to see if somehow one of the
packets would be too small. But no, with both v2022.01 and v2022.10,
the exact same sequence of packets were sent, all but the last of size
1500, and the last being 1280 bytes.

But then it struck me that 1280 is 5*256, so one of the two bytes
on-the-wire is 0 and the other is 5, and when then looking at the code
again the lack of endianness conversion becomes obvious. [ntohs is
both applied to ip->ip_off just above, as well as to ip->ip_len just a
little further down when the "len" is actually computed].

IOWs the current code would falsely reject any packet which happens to
be a multiple of 256 bytes in size, breaking tftp transfers somewhat
randomly, and if it did get one of those "malicious" packets with
ip_len set to, say, 27, it would be seen by this check as being 6912
and hence not rejected.

====

Now, just adding the missing ntohs() would make my initial problem go
away, in that I can now download the file where the last fragment ends
up being 1280 bytes. But there's another bug in the code and/or
analysis: The right-hand side is too strict, in that it is ok for the
last fragment not to have a multiple of 8 bytes as payload - it really
must be ok, because nothing in the IP spec says that IP datagrams must
have a multiple of 8 bytes as payload. And comments in the code also
mention this.

To fix that, replace the comparison with <= IP_HDR_SIZE and add
another check that len is actually a multiple of 8 when the "more
fragments" bit is set - which it necessarily is for the case where
offset8 ends up being 0, since we're only called when

  (ip_off & (IP_OFFS | IP_FLAGS_MFRAG)).

====

So, does this fix CVE-2022-30790 for real? It certainly correctly
rejects the POC code which relies on sending a packet of size 27 with
the MFRAG flag set. Can the attack be carried out with a size 27
packet that doesn't set MFRAG (hence must set a non-zero fragment
offset)? I dunno. If we get a packet without MFRAG, we update
h->last_byte in the hole we've found to be start+len, hence we'd enter
one of

	if ((h >= thisfrag) && (h->last_byte <= start + len)) {

or

	} else if (h->last_byte <= start + len) {

and thus won't reach any of the

		/* overlaps with initial part of the hole: move this hole */
		newh = thisfrag + (len / 8);

		/* fragment sits in the middle: split the hole */
		newh = thisfrag + (len / 8);

IOW these division are now guaranteed to be exact, and thus I think
the scenario in CVE-2022-30790 cannot happen anymore.

====

However, there's a big elephant in the room, which has always been
spelled out in the comments, and which makes me believe that one can
still cause mayhem even with packets whose payloads are all 8-byte
aligned:

    This code doesn't deal with a fragment that overlaps with two
    different holes (thus being a superset of a previously-received
    fragment).

Suppose each character below represents 8 bytes, with D being already
received data, H being a hole descriptor (struct hole), h being
non-populated chunks, and P representing where the payload of a just
received packet should go:

  DDDHhhhhDDDDHhhhDDDD
        PPPPPPPPP

I'm pretty sure in this case we'd end up with h being the first hole,
enter the simple

	} else if (h->last_byte <= start + len) {
		/* overlaps with final part of the hole: shorten this hole */
		h->last_byte = start;

case, and thus in the memcpy happily overwrite the second H with our
chosen payload. This is probably worth fixing...

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-11-28 10:25:18 -05:00
Rasmus Villemoes
ad359d89ec net: compare received length to sizeof(ip_hdr), not sizeof(ip_udp_hdr)
While the code mostly/only handles UDP packets, it's possible for the
last fragment of a fragmented UDP packet to be smaller than 28 bytes;
it can be as small as 21 bytes (an IP header plus one byte of
payload). So until we've performed the defragmentation step and thus
know whether we're now holding a full packet, we should only check for
the existence of the fields in the ip header, i.e. that there are at
least 20 bytes present.

In practice, we always seem to be handed a "len" of minimum 60 from the
device layer, i.e. minimal ethernet frame length minus FCS, so this is
mostly theoretical.

After we've fetched the header's claimed length and used that to
update the len variable, check that the header itself claims to be the
minimal possible length.

This is probably how CVE-2022-30552 should have been dealt with in the
first place, because net_defragment() is not the only place that wants
to know the size of the IP datagram payload: If we receive a
non-fragmented ICMP packet, we pass "len" to receive_icmp() which in
turn may pass it to ping_receive() which does

  compute_ip_checksum(icmph, len - IP_HDR_SIZE)

and due to the signature of compute_ip_checksum(), that would then
lead to accessing ~4G of address space, very likely leading to a
crash.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
2022-11-28 10:25:18 -05:00
Rasmus Villemoes
b0fcc48cb3 net: improve check for no IP options
There's no reason we should accept an IP packet with a malformed IHL
field. So ensure that it is exactly 5, not just <= 5.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-11-28 10:25:18 -05:00
Jan Kiszka
77b5c4a5b1 efi_loader: Let networking support depend on NETDEVICES
CONFIG_NET does not imply that there are actually network devices
available, only CONFIG_NETDEVICES does. Changing to this dependency
obsoletes the check in Kconfig because NETDEVICES means DM_ETH.

Fixes: 0efe1bcf5c ("efi_loader: Add network access support")
Suggested-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2022-11-06 10:50:04 +01:00
Samuel Mendoza-Jonas
4b290d4a75 cmd: Add ncsi command
Adds an "ncsi" command to manually start NC-SI configuration.

Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
2022-10-21 16:04:39 -04:00
Samuel Mendoza-Jonas
09bd3d0b0a net: NC-SI setup and handling
Add the handling of NC-SI ethernet frames, and add a check at the start
of net_loop() to configure NC-SI before starting other network commands.

Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-10-21 16:04:39 -04:00
Michal Suchanek
0736f7aa3b net: eth-uclass: Do not set device on error
eth_get_dev relies on the broken behavior that returns an error but not
the device on which the error happened which gives the caller no
reasonable way to report or handle the error.

In a later patch uclass_first_device_err will be changed to return the
device on error but eth_get_dev stores the returned device pointer
directly in a global state without checking the return value. Unset the
pointer again in the error case.

Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-10-17 21:17:12 -06:00
Michal Suchanek
c726fc01cf dm: treewide: Use uclass_first_device_err when accessing one device
There is a number of users that use uclass_first_device to access the
first and (assumed) only device in uclass.

Some check the return value of uclass_first_device and also that a
device was returned which is exactly what uclass_first_device_err does.

Some are not checking that a device was returned and can potentially
crash if no device exists in the uclass. Finally there is one that
returns NULL on error either way.

Convert all of these to use uclass_first_device_err instead, the return
value will be removed from uclass_first_device in a later patch.

Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-10-17 21:17:12 -06:00
Simon Glass
8909066199 dm: core: Drop ofnode_is_available()
This function is also available as ofnode_is_enabled(), so use that
instead.

Signed-off-by: Simon Glass <sjg@chromium.org>
2022-09-29 16:11:31 -04:00
Stefan Roese
29caf9305b cyclic: Use schedule() instead of WATCHDOG_RESET()
Globally replace all occurances of WATCHDOG_RESET() with schedule(),
which handles the HW_WATCHDOG functionality and the cyclic
infrastructure.

Signed-off-by: Stefan Roese <sr@denx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
Tested-by: Tom Rini <trini@konsulko.com> [am335x_evm, mx6cuboxi, rpi_3,dra7xx_evm, pine64_plus, am65x_evm, j721e_evm]
2022-09-18 10:26:33 +02:00
Simon Glass
4e4bf9449b common: Drop display_options.h from common header
Move this out of the common header and include it only where needed.

Signed-off-by: Simon Glass <sjg@chromium.org>
2022-08-10 13:46:55 -04:00
Andre Kalb
5e6e41b3ba net: bootp: Make root path (option 17) length configurable
to adjust the root path length.
Eg to 256 from Linux Kernel

Signed-off-by: Andre Kalb <andre.kalb@sma.de>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
[trini: Guard extern so that !CONFIG_NET platforms will build]
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-08-08 10:49:51 -04:00
Tom Rini
17ead040d4 Audit <flash.h> inclusion
A large number of files include <flash.h> as it used to be how various
SPI flash related functions were found, or for other reasons entirely.
In order to migrate some further CONFIG symbols to Kconfig we need to
not include flash.h in cases where we don't have a NOR flash of some
sort enabled.  Furthermore, in cases where we are in common code and it
doesn't make sense to try and further refactor the code itself in to new
files we need to guard this inclusion.

Signed-off-by: Tom Rini <trini@konsulko.com>
2022-08-04 16:18:47 -04:00
Tom Rini
52938fc4f0 net: Remove CONFIG_SYS_DIRECT_FLASH_TFTP
No platforms enable the functionality to tftp directly to NOR flash, and
this is discouraged by the documentation.  Remove this code.  Further,
this highlights an oddity of the code.  Un-indent the start of this
function.

Cc: Joe Hershberger <joe.hershberger@ni.com>
Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-08-04 16:18:47 -04:00
Tom Rini
52af0101be Merge branch 'master' into next
Merge in v2022.07-rc5.
2022-06-20 14:40:59 -04:00
Marek Vasut
3c07d639ed net: Fix discuss discard typo
Replace discuss with discard, that is what happens with packet with
incorrect checksum. Fix the typo.

Fixes: 4b37fd146b ("Convert CONFIG_UDP_CHECKSUM to Kconfig")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Ramon Fried <rfried.dev@gmail.com>
Cc: Simon Glass <sjg@chromium.org>
2022-06-16 18:51:07 -04:00
Sean Anderson
97d0f9bfdd net: Add support for reading mac addresses from nvmem cells
This adds support for reading mac addresses from the "mac-address" nvmem
cell. If there is no (local-)mac-address property, then we will try
reading from an nvmem cell.

For some existing examples of this property, refer to imx8mn.dtsi and
imx8mp.dtsi. Unfortunately, fuse drivers have not yet been converted
to DM.

Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-06-08 14:00:22 -04:00
Sean Anderson
2a5af4049c net: dsa: Fix segmentation fault if master fails to probe
If the DSA master fails to probe for whatever reason, then DSA devices
will continue on as if nothing is wrong. This can cause incorrect
behavior. In particular, on sandbox, dsa_sandbox_probe attempts to
access the master's private data. This is only safe to do if the master
has been probed first. Fix this by probing the master after we look it
up, and bailing out if we get an error.

Fixes: fc054d563b ("net: Introduce DSA class for Ethernet switches")
Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
2022-06-08 13:59:53 -04:00
Fabio Estevam
b85d130ea0 net: Check for the minimum IP fragmented datagram size
Nicolas Bidron and Nicolas Guigo reported the two bugs below:

"
----------BUG 1----------

In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) higher than `IP_HDR_SIZE`
and strictly lower than `IP_HDR_SIZE+8` will lead to a value for `len`
comprised between `0` and `7`. This will ultimately result in a
truncated division by `8` resulting value of `0` forcing the hole
metadata and fragment to point to the same location. The subsequent
memcopy will overwrite the hole metadata with the fragment data. Through
a second fragment, this can be exploited to write to an arbitrary offset
controlled by that overwritten hole metadata value.

This bug is only exploitable locally as it requires crafting two packets
the first of which would most likely be dropped through routing due to
its unexpectedly low Total Length. However, this bug can potentially be
exploited to root linux based embedded devices locally.

```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
     static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
     static u16 first_hole, total_len;
     struct hole *payload, *thisfrag, *h, *newh;
     struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
     uchar *indata = (uchar *)ip;
     int offset8, start, len, done = 0;
     u16 ip_off = ntohs(ip->ip_off);

     /* payload starts after IP header, this fragment is in there */
     payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
     offset8 =  (ip_off & IP_OFFS);
     thisfrag = payload + offset8;
     start = offset8 * 8;
     len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```

The last line of the previous excerpt from `u-boot/net/net.c` shows how
the attacker can control the value of `len` to be strictly lower than
`8` by issuing a packet with `ip_len` between `21` and `27`
(`IP_HDR_SIZE` has a value of `20`).

Also note that `offset8` here is `0` which leads to `thisfrag = payload`.

```C
     } else if (h >= thisfrag) {
         /* overlaps with initial part of the hole: move this hole */
         newh = thisfrag + (len / 8);
         *newh = *h;
         h = newh;
         if (h->next_hole)
             payload[h->next_hole].prev_hole = (h - payload);
         if (h->prev_hole)
             payload[h->prev_hole].next_hole = (h - payload);
         else
             first_hole = (h - payload);

     } else {
```

Lower down the same function, execution reaches the above code path.
Here, `len / 8` evaluates to `0` leading to `newh = thisfrag`. Also note
that `first_hole` here is `0` since `h` and `payload` point to the same
location.

```C
     /* finally copy this fragment and possibly return whole packet */
     memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```

Finally, in the above excerpt the `memcpy` overwrites the hole metadata
since `thisfrag` and `h` both point to the same location. The hole
metadata is effectively overwritten with arbitrary data from the
fragmented IP packet data. If `len` was crafted to be `6`, `last_byte`,
`next_hole`, and `prev_hole` of the `first_hole` can be controlled by
the attacker.

Finally the arbitrary offset write occurs through a second fragment that
only needs to be crafted to write data in the hole pointed to by the
previously controlled hole metadata (`next_hole`) from the first packet.

 ### Recommendation

Handle cases where `len` is strictly lower than 8 by preventing the
overwrite of the hole metadata during the memcpy of the fragment. This
could be achieved by either:
* Moving the location where the hole metadata is stored when `len` is
lower than `8`.
* Or outright rejecting fragmented IP datagram with a Total Length
(`ip_len`) lower than 28 bytes which is the minimum valid fragmented IP
datagram size (as defined as the minimum fragment of 8 octets in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 25).

----------BUG 2----------

In compiled versions of U-Boot that define CONFIG_IP_DEFRAG, a value of
`ip->ip_len` (IP packet header's Total Length) lower than `IP_HDR_SIZE`
will lead to a negative value for `len` which will ultimately result in
a buffer overflow during the subsequent `memcpy` that uses `len` as it's
`count` parameter.

This bug is only exploitable on local ethernet as it requires crafting
an invalid packet to include an unexpected `ip_len` value in the IP UDP
header that's lower than the minimum accepted Total Length of a packet
(21 as defined in the IP Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791)). Such packet
would in all likelihood be dropped while being routed to its final
destination through most routing equipment and as such requires the
attacker to be in a local position in order to be exploited.

```C
static struct ip_udp_hdr *__net_defragment(struct ip_udp_hdr *ip, int *lenp)
{
     static uchar pkt_buff[IP_PKTSIZE] __aligned(PKTALIGN);
     static u16 first_hole, total_len;
     struct hole *payload, *thisfrag, *h, *newh;
     struct ip_udp_hdr *localip = (struct ip_udp_hdr *)pkt_buff;
     uchar *indata = (uchar *)ip;
     int offset8, start, len, done = 0;
     u16 ip_off = ntohs(ip->ip_off);

     /* payload starts after IP header, this fragment is in there */
     payload = (struct hole *)(pkt_buff + IP_HDR_SIZE);
     offset8 =  (ip_off & IP_OFFS);
     thisfrag = payload + offset8;
     start = offset8 * 8;
     len = ntohs(ip->ip_len) - IP_HDR_SIZE;
```

The last line of the previous excerpt from `u-boot/net/net.c` shows
where the underflow to a negative `len` value occurs if `ip_len` is set
to a value strictly lower than 20 (`IP_HDR_SIZE` being 20). Also note
that in the above excerpt the `pkt_buff` buffer has a size of
`CONFIG_NET_MAXDEFRAG` which defaults to 16 KB but can range from 1KB to
64 KB depending on configurations.

```C
     /* finally copy this fragment and possibly return whole packet */
     memcpy((uchar *)thisfrag, indata + IP_HDR_SIZE, len);
```

In the above excerpt the `memcpy` overflows the destination by
attempting to make a copy of nearly 4 gigabytes in a buffer that's
designed to hold `CONFIG_NET_MAXDEFRAG` bytes at most which leads to a DoS.

 ### Recommendation

Stop processing of the packet if `ip_len` is lower than 21 (as defined
by the minimum length of a data carrying datagram in the IP
Specification Document:
[RFC791](https://datatracker.ietf.org/doc/html/rfc791) page 34)."

Add a check for ip_len lesser than 28 and stop processing the packet
in this case.

Such a check covers the two reported bugs.

Reported-by: Nicolas Bidron <nicolas.bidron@nccgroup.com>
Signed-off-by: Fabio Estevam <festevam@denx.de>
2022-06-03 11:15:24 -04:00
Andrea zi0Black Cappa
bdbf7a05e2 net: nfs: Fix CVE-2022-30767 (old CVE-2019-14196)
This patch mitigates the vulnerability identified via CVE-2019-14196.

The previous patch was bypassed/ineffective, and now the vulnerability
is identified via CVE-2022-30767. The patch removes the sanity check
introduced to mitigate CVE-2019-14196 since it's ineffective.
filefh3_length is changed to unsigned type integer, preventing negative
numbers from being used during comparison with positive values during
size sanity checks.

Signed-off-by: Andrea zi0Black Cappa <zi0Black@protonmail.com>
2022-05-26 10:32:06 -04:00
Marek Behún
00b1bad961 net: mdio-uclass: add dm_phy_find_by_ofnode() helper
Add helper to resolve PHY node from it's ofnode via DM MDIO subsystem.

Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Stefan Roese <sr@denx.de>
2022-05-04 07:05:51 +02:00
Simon Glass
4fd8d077cb bootstd: ethernet: Add a bootdev driver
Add a bootdev driver for Ethernet. It can use the PXE boot mechanism to
locate a file, added later.

Signed-off-by: Simon Glass <sjg@chromium.org>
2022-04-25 10:00:04 -04:00
Lyle Franklin
85f8e03b2a Allow colon in PXE bootfile URLs
- U-boot's PXE flow supports prefixing your bootfile name with an
  IP address to fetch from a server other than the DHCP server,
  e.g. `hostIPaddr:bootfilename`:
  a93907c43f
- However, this breaks bootfile paths which contain a colon, e.g.
  `f0:ad:4e:10:1b:87/7/pxelinux.cfg/default`
- This patch checks whether the `hostIPaddr` prefix is a valid
  IP address before overriding the serverIP otherwise the whole
  bootfile path is preserved

Signed-off-by: Lyle Franklin <lylejfranklin@gmail.com>
2022-04-22 15:44:10 -04:00
Arjan Minzinga Zijlstra
1ffe366881 net: tftp: fix tftp server initialization
Some globals where not properly initialized causing timeouts
as data packets where not immediately acknowledged.

Fixes: cc6b87ecaa ("net: tftp: Add client support for RFC 7440")
Signed-off-by: Arjan Minzinga Zijlstra <arjan.minzingazijlstra@fox-it.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-04-12 22:41:27 +03:00
Marek Behún
ffb0f6f488 treewide: Rename PHY_INTERFACE_MODE_NONE to PHY_INTERFACE_MODE_NA
Rename constant PHY_INTERFACE_MODE_NONE to PHY_INTERFACE_MODE_NA to make
it compatible with Linux' naming.

Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Stefan Roese <sr@denx.de>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
2022-04-10 08:44:13 +03:00
Marek Behún
123ca114e0 net: introduce helpers to get PHY interface mode from a device/ofnode
Add helpers ofnode_read_phy_mode() and dev_read_phy_mode() to parse the
"phy-mode" / "phy-connection-type" property. Add corresponding UT test.

Use them treewide.

This allows us to inline the phy_get_interface_by_name() into
ofnode_read_phy_mode(), since the former is not used anymore.

Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Tested-by: Patrice Chotard <patrice.chotard@foss.st.com>
2022-04-10 08:44:12 +03:00
Marek Behún
1776a24bbb treewide: use dm_mdio_read/write/reset() wrappers
Use the new dm_mdio_read/write/reset() wrappers treewide, instead of
always getting and dereferencing MDIO operations structure pointer.

Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
2022-04-10 08:44:12 +03:00
Marek Behún
351bfa6ebd net: mdio-uclass: add wrappers for read/write/reset operations
Add wrappers dm_mdio_read(), dm_mdio_write() and dm_mdio_reset() for
DM MDIO's .read(), .write() and .reset() operations.

Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
2022-04-10 08:44:12 +03:00
Marek Behún
f3dd213e15 net: introduce helpers to get PHY ofnode from MAC
Add helpers ofnode_get_phy_node() and dev_get_phy_node() and use it in
net/mdio-uclass.c function dm_eth_connect_phy_handle(). Also add
corresponding UT test.

This is useful because other part's of U-Boot may want to get PHY ofnode
without connecting a PHY.

Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2022-04-10 08:44:12 +03:00
Marek Behún
a7a96ef812 net: mdio-uclass: use ARRAY_SIZE()
Use the ARRAY_SIZE() macro instead of hardcoding sizes of arrays in
macros.

Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
2022-04-10 08:44:12 +03:00
Marek Behún
6fb4482ea2 net: mdio-uclass: fix type for phy_mode_str and phy_handle_str
These global variables should both have type
  static const char * const

Signed-off-by: Marek Behún <marek.behun@nic.cz>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
2022-04-10 08:44:12 +03:00
Tom Rini
0b956e3987 Convert CONFIG_SYS_RX_ETH_BUFFER to Kconfig
This converts the following to Kconfig:
   CONFIG_SYS_RX_ETH_BUFFER

Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-03-25 12:01:15 +00:00
Tom Rini
5842c8107d Convert CONFIG_TFTP_PORT to Kconfig
This converts the following to Kconfig:
   CONFIG_TFTP_PORT

Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-03-25 12:01:15 +00:00
Tom Rini
1d5686acfd Convert CONFIG_SYS_FAULT_ECHO_LINK_DOWN to Kconfig
This converts the following to Kconfig:
   CONFIG_SYS_FAULT_ECHO_LINK_DOWN

Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-03-25 12:01:15 +00:00
Tom Rini
eeda762af3 Convert CONFIG_NFS_TIMEOUT to Kconfig
This converts the following to Kconfig:
   CONFIG_NFS_TIMEOUT

Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-03-18 12:48:17 -04:00
Tom Rini
01d1b99c9b Convert CONFIG_NET_RETRY_COUNT to Kconfig
This converts the following to Kconfig:
   CONFIG_NET_RETRY_COUNT

Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-03-18 12:48:17 -04:00
Tom Rini
5d4e863bf8 Convert CONFIG_ARP_TIMEOUT to Kconfig
This converts the following to Kconfig:
   CONFIG_ARP_TIMEOUT

Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
2022-03-18 12:48:17 -04:00
Tom Rini
f0171e7ea7 net: Remove CONFIG_BOOTP_DHCP_REQUEST_DELAY
This option is not in use anywhere and the documentation implies it's
for some very old and unlikely to be seen currently issues.  Rather than
update the code so the CONFIG symbol could be easily in Kconfig, remove
the code.

Cc: Ramon Fried <rfried.dev@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Acked-by: Ramon Fried <rfried.dev@gmail.com>
2022-03-03 16:51:20 -05:00
Simon Glass
434075393d net: Drop #ifdefs with CONFIG_BOOTP_SERVERIP
Use IS_ENABLED() instead, to reduce the number of build paths.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-01-21 14:01:35 -05:00
Simon Glass
d3877fba31 Convert CONFIG_BOOTP_SERVERIP to Kconfig
This converts the following to Kconfig:
   CONFIG_BOOTP_SERVERIP

Signed-off-by: Simon Glass <sjg@chromium.org>
2022-01-21 14:01:35 -05:00
Simon Glass
d6b318de2f Convert CONFIG_TIMESTAMP to Kconfig
This converts the following to Kconfig:
   CONFIG_TIMESTAMP

Signed-off-by: Simon Glass <sjg@chromium.org>
2022-01-21 14:01:34 -05:00
Simon Glass
4b37fd146b Convert CONFIG_UDP_CHECKSUM to Kconfig
This converts the following to Kconfig:
   CONFIG_UDP_CHECKSUM

Signed-off-by: Simon Glass <sjg@chromium.org>
2022-01-21 14:01:34 -05:00
Simon Glass
3df6cd4d63 Convert CONFIG_KEEP_SERVERADDR to Kconfig
This converts the following to Kconfig:
   CONFIG_KEEP_SERVERADDR

Drop the preprocessor usage also.

Signed-off-by: Simon Glass <sjg@chromium.org>
2022-01-21 14:01:34 -05:00
Tom Rini
280db76f15 Pull request doc-2022-04-rc1
Replace @return by Return: in code comments.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAmHpCv4ACgkQxIHbvCwF
 GsRxNhAAkJXbngwkfdM5O3eZH2zuI0av9GDBLoFoxTWFviwDpCcyzb/XsQgZ8IE5
 Cff9Y6P/SlNPdoE4pvDFqAItvmrvcZ9b/oeAmhVDaMMv1dGEOV9uSQvuQkpJWt/V
 nHtRuCVjSK6qqor3fSTHNMyFcG+gkAG/+8T+KuU8gUDKECQgzJqgixcdKvTjF9jL
 DOIxVKAPRrxlzuJ0u2eovVSZFBB3mik7fnDmOGnbKjj87FvUuOZCX/VWCC5zMGmY
 eOi+C2ONnUleeivWAJrU6AxP28BkCR1q3U1F0LH2LVjolX8WZByYdzlBAOr3RkK0
 0sYxxShdrF+2cYmQP1/wo4z8AySkSBrbr6WTQ58i5vsqFm4sb1FF52cQHQOaFOaV
 Gp/NokHMuzhx7YQr4Ps0TvpROoW6L3Vt2SqA58FoHXzTvWpTi+terdAodL8rH3+1
 yGGNzYW6C79qqMKLclvuLvy/6IWf1UekTo45ocP47vhieRbxyGr8UZ8KMnX6Yx0e
 Y6U34K820fgfTLHM5MOgXMvBXqpskcWnR5hZWdrN9fJyqAZ7AxXQvdDDdIIEMPM9
 MBiFDH8seE62SkTbAEjrSU6RE76WovUISlegmBaB8ihs588au/BQCrsSxmNqT1SV
 SCp8D/GBSjwv+utWlneH6JKAIYxvpsgWeWzr27lA5F3m3j+5gKI=
 =iOT9
 -----END PGP SIGNATURE-----

Merge tag 'doc-2022-04-rc1' of https://source.denx.de/u-boot/custodians/u-boot-efi

Pull request doc-2022-04-rc1

Replace @return by Return: in code comments.
2022-01-20 09:39:45 -05:00
Heinrich Schuchardt
185f812c41 doc: replace @return by Return:
Sphinx expects Return: and not @return to indicate a return value.

find . -name '*.c' -exec \
sed -i 's/^\(\s\)\*\(\s*\)@return\(\s\)/\1*\2Return:\3/' {} \;

find . -name '*.h' -exec \
sed -i 's/^\(\s\)\*\(\s*\)@return\(\s\)/\1*\2Return:\3/' {} \;

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
2022-01-19 18:11:34 +01:00
Tom Rini
068415eade Xilinx changes for v2022.04-rc1
gpio:
 - Add modepin driver
 
 net:
 - Save random mac addresses to eth variable
 
 zynqmp gem:
 - Add support for mdio bus DT description
 - Add support for reset and SGMII phy configuration
 - Reduce timeout for MDIO accesses
 
 zynqmp clk:
 - Fix clock handling for gem and usb
 
 phy:
 - Add zynqmp phy/serdes driver
 
 serial:
 - Add one missing compatible string
 
 microblaze:
 - Symbol alignement
 - SPL fixups
 - Code cleanups
 
 zynqmp:
 - Various dt changes, DP pre-reloc, gem resets, gem clocks
 - Switch SOM to shared psu configuration
 - Move dcache handling to firmware driver
 - Workaround gmii2rgmii DT description issue
 - Enable broadcasts again
 - Change firmware enablement logic
 - Small adjustement in firmware driver
 
 versal:
 - Support new mmc@ DT nodes
 - Fix run time variable handling
 - Add missing I2C_PMC ID for power domain
 -----BEGIN PGP SIGNATURE-----
 
 iF0EABECAB0WIQQbPNTMvXmYlBPRwx7KSWXLKUoMIQUCYeg7sQAKCRDKSWXLKUoM
 IVhJAKCAiNx/joEeFBJ0XgThtJzFhCjdMwCfYKY9Ewz4L0n2I56lDgR3UJroct0=
 =HtB+
 -----END PGP SIGNATURE-----

Merge tag 'xilinx-for-v2022.04-rc1' of https://source.denx.de/u-boot/custodians/u-boot-microblaze

Xilinx changes for v2022.04-rc1

gpio:
- Add modepin driver

net:
- Save random mac addresses to eth variable

zynqmp gem:
- Add support for mdio bus DT description
- Add support for reset and SGMII phy configuration
- Reduce timeout for MDIO accesses

zynqmp clk:
- Fix clock handling for gem and usb

phy:
- Add zynqmp phy/serdes driver

serial:
- Add one missing compatible string

microblaze:
- Symbol alignement
- SPL fixups
- Code cleanups

zynqmp:
- Various dt changes, DP pre-reloc, gem resets, gem clocks
- Switch SOM to shared psu configuration
- Move dcache handling to firmware driver
- Workaround gmii2rgmii DT description issue
- Enable broadcasts again
- Change firmware enablement logic
- Small adjustement in firmware driver

versal:
- Support new mmc@ DT nodes
- Fix run time variable handling
- Add missing I2C_PMC ID for power domain
2022-01-19 11:43:44 -05:00
Christian Gmeiner
046bf8d4c5 net: fastboot: make UDP port net: configurable
The fastboot protocol uses per default the UDP port 5554. In some cases
it might be needed to change the used port. The fastboot utility provides
a way to specifiy an other port number to use already.

  fastboot -s udp:192.168.1.76:1234 boot fastboot.img

Signed-off-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Reviewed-by: Heiko Schocher <hs@denx.de>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-01-15 18:54:21 +02:00
Vladimir Oltean
0fa4448d51 net: dsa: fix phydev->speed being uninitialized for the CPU port fixed PHY
If the DSA API is going to allow drivers to do things such as:

- phy_config in dsa_ops :: port_probe
- phy_startup in dsa_ops :: port_enable

then it would actually be good if the ->port_probe() method would
actually be called in all cases before the ->port_enable() is.

Currently this is true for user ports, but not true for the CPU port,
because the CPU port does not have a udevice registered for it (this is
all part of DSA's design). So the current issue is that after
phy_startup has finished for the CPU port, its phydev->speed is an
uninitialized value, because phy_config() was never called for the
priv->cpu_port_fixed_phy, and it is precisely phy_config() who copies
the speed into the phydev in the case of the fixed PHY driver.

So we need to simulate a probing event for the CPU port by manually
calling the driver's ->port_probe() method for the CPU port.

Fixes: 8a2982574854 ("net: dsa: introduce a .port_probe() method in struct dsa_ops")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2022-01-15 18:49:03 +02:00
Michal Simek
381e6e5494 net: uclass: Save generated ethernet MAC addresses to the environment
When a MAC address is randomly generated we currently only update the
appropriate data structure.  For consistency and to re-align with
historic usage, it should be also saved to the appropriate environment
variable as well.

Cc: Wolfgang Denk <wd@denx.de>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
[trini: Update Kconfig, handle legacy networking case as well]
Signed-off-by: Tom Rini <trini@konsulko.com>
Acked-by: Ramon Fried <rfried.dev@gmail.com>
Link: https://lore.kernel.org/r/1a2518e3cc19c14a41875ef64c5acc1f16edc813.1641893287.git.michal.simek@xilinx.com
2022-01-11 10:33:42 +01:00
Bin Meng
c7ae46efdc net: dsa: Use true instead of 1 in the set_promisc() call
set_promisc() call accepts the parameter of a bool type. Make it
clear by using true instead of 1.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2021-11-23 09:57:56 +02:00
Walter Stoll
d4a660aafa net: bootp: Correct VCI string transmission
The VCI string sent during bootp of U-Boot-SPL is corrupt. This is
because the byte counter is not adjusted within the bootp_extended()
function when the VCI string is added. We fix this.

Signed-off-by: Walter Stoll <walter.stoll@duagon.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2021-11-23 09:57:56 +02:00
Vladimir Oltean
0783b16509 net: dsa: allow drivers to get the port OF node
In the current DSA switch driver API, only the udevice of the switch
(belonging to UCLASS_DSA) is exposed, as well as an "int port" argument.
So drivers do not have access to the udevice of individual ports
(belonging to UCLASS_ETH), one of the reasons being that not all ports
have an associated UCLASS_ETH udevice.

However, all DSA ports have an OF node, and in some cases the driver
needs a handle to it, for all ports including the CPU port. Example: the
following Linux per-port device tree property:

	managed = "in-band-status";

states whether a port should operate with clause 37 in-band autoneg
enabled or not.

This patch exposes a function which can be called by individual drivers
as needed.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2021-11-23 09:57:55 +02:00
Wolfgang Denk
66356b4c06 WS cleanup: remove trailing empty lines
Signed-off-by: Wolfgang Denk <wd@denx.de>
2021-09-30 08:08:56 -04:00
Tom Rini
6eecaf5d0f Merge branch 'network_master' of https://source.denx.de/u-boot/custodians/u-boot-net into next
- Fix some non-NULL terminated strings in the networking subsystem
- net: tsec: Mark tsec_get_interface as __maybe_unused
2021-09-29 07:58:20 -04:00
Vladimir Oltean
4fdc7e3530 net: dsa: ensure port names are NULL-terminated after DSA_PORT_NAME_LENGTH truncation
strncpy() simply bails out when copying a source string whose size
exceeds the destination string size, potentially leaving the destination
string unterminated.

One possible way to address is to pass DSA_PORT_NAME_LENGTH - 1 and a
previously zero-initialized destination string, but this is more
difficult to maintain.

The chosen alternative is to use strlcpy(), which properly limits the
copy len in the (srclen >= size) case to "size - 1", and which is also
more efficient than the strncpy() byte-by-byte implementation by using
memcpy. The destination string returned by strlcpy() is always NULL
terminated.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2021-09-28 18:50:57 +03:00
Vladimir Oltean
bf35c3121a net: mdio-uclass: rewrite dm_mdio_post_probe using strlcpy
dm_mdio_post_probe used to be vulnerable after truncation, but has been
patched by commit 398e7512d8 ("net: Fix Covarity Defect 244093").
Nonetheless, we can use strlcpy like the rest of the code base now,
which yields the same result.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2021-09-28 18:50:57 +03:00
Vladimir Oltean
5ecdf0a5a4 net: dsa: remove unused variables
"dev" and "dsa_pdata" are unused inside dsa_port_of_to_pdata.

"dsa_priv" is unused inside dsa_port_probe.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2021-09-28 18:50:56 +03:00
Vladimir Oltean
5cc283b781 net: dsa: pass CPU port fixed PHY to .port_disable
While adding the logic for DSA to register a fixed-link PHY for the CPU
port, I forgot to pass it to the .port_disable method too, just
.port_enable.

Bug had no impact for felix_switch.c, due to the phy argument not being
used, but ksz9477.c does use it => NULL pointer dereference.

Fixes: fc054d563b ("net: Introduce DSA class for Ethernet switches")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2021-09-28 18:50:56 +03:00
Vladimir Oltean
4b46e83885 net: dsa: introduce a .port_probe() method in struct dsa_ops
Some drivers might want to execute code for each port at probe time, as
opposed to executing code just-in-time for the port selected for
networking.

To cater to that use case, introduce a .port_probe() callback method
into the DSA switch operations which is called for each available port,
at the end of dsa_port_probe().

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Tested-by: Michael Walle <michael@walle.cc>
2021-09-28 18:50:56 +03:00
Vladimir Oltean
5eee5ab916 net: dsa: refactor the code to set the port MAC address into a dedicated function
This snippet of code has a bothering "if (...) return 0" in it which
assumes it is the last piece of code running in dsa_port_probe().

This makes it difficult to add further code at the end of dsa_port_probe()
which does not depend on MAC address stuff.

So move the code to a dedicated function which returns void and let the
code flow through.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Tested-by: Michael Walle <michael@walle.cc>
2021-09-28 18:50:55 +03:00
Vladimir Oltean
f4b712b840 net: dsa: use "err" instead of "ret" in dsa_port_probe
DM DSA uses "err" for error code values, so use this consistently.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Tested-by: Michael Walle <michael@walle.cc>
2021-09-28 18:50:55 +03:00
Pali Rohár
0072f5fce3 Remove #include <timestamp.h> from files which do not need it
Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
2021-09-17 12:10:44 -04:00
Simon Glass
9f6649209f net: Move network rules to drivers/net
The code under drivers/net is related to ethernet networking drivers, in
some fashion or another.  Drop these from the top-level Makefile and
also move the phy rule into drivers/net/Makefile which is where it
belongs.  Make the new rule for drivers/net check for the build-stage
relevant ETH symbol.

Fix up some Kconfig dependencies while we're here to mirror how the
Makefile logic now works.

Signed-off-by: Simon Glass <sjg@chromium.org>
[trini: Introduce ETH, Kconfig dependency changes, am43xx fix]
Signed-off-by: Tom Rini <trini@konsulko.com>
2021-09-04 12:51:47 -04:00
Michal Simek
b4c2c151b1 Kconfig: Remove all default n/no options
default n/no doesn't need to be specified. It is default option anyway.

Signed-off-by: Michal Simek <michal.simek@xilinx.com>
[trini: Rework FSP_USE_UPD portion]
Signed-off-by: Tom Rini <trini@konsulko.com>
2021-08-31 17:47:49 -04:00
Simon Glass
0b1284eb52 global: Convert simple_strtoul() with decimal to dectoul()
It is a pain to have to specify the value 10 in each call. Add a new
dectoul() function and update the code to use it.

Signed-off-by: Simon Glass <sjg@chromium.org>
2021-08-02 13:32:14 -04:00
Patrick Delaunay
79d191efa1 net: define LOG_CATEGORY
Define LOG_CATEGORY to allow filtering with log command.

Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2021-07-22 22:09:27 +03:00
Tim Harvey
431f9d72ff net: dsa: enable master promisc mode if available and needed
If ports have their own unique MAC addrs and master has a set_promisc
function, call it so that packets will be received for ports.

Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2021-07-10 18:12:41 +02:00
Tom Rini
6d0453d889 Prepare v2021.07-rc5
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAmDaJXgACgkQFHw5/5Y0
 tyySmwwAkW7GVAv+bXSd+8u1IsScl0QrSCoBdfHpdMcAME3gZmXqxClxskfbYJR/
 3IByQFlsn7j8HruR/49+etk0i0Pc4HNfynTLuAy+77/lh+h3Pnru/VPBhQqR7KW0
 NN5STn91QWLl74vRmx5wmEfSMhg7LTE1US8Rh6UXAd2dAiPd+hUawIR9D0Pq5Gzm
 nn7HvamDYspFUgSYYl8h1RtRQ9VqAFpnnPphpLkvX6323uCQwccXu5pnj1fLfGfj
 iO2Q+bDcwpEdUosox/LM1BdMoaSA+opOjk/e72y9V84+Jk6D+Jn5zQEpF5TJnTyI
 Yi2+NuJWS5xFWk1dnJrbGt0HpWM2oO12dZZ7eYy/FdsPJiWAS0ppRuxHVb868vjD
 ulca7acFPUjGyo3vBw1S0iVmPCBFGHBoyg3QLrUHYbpISeBeoa2w2cDxQl90ahw/
 TgRx+yutKfwkBPfILwDylNOgCGRwvLfroRyMEMiQ3gTSOCBmBX/yMv1k8tb9ZvPZ
 /WVsK6dw
 =F7x1
 -----END PGP SIGNATURE-----

Merge tag 'v2021.07-rc5' into next

Prepare v2021.07-rc5

# gpg: Signature made Mon 28 Jun 2021 03:39:36 PM EDT
# gpg:                using RSA key 1A3C7F70E08FAB1707809BBF147C39FF9634B72C
# gpg: Good signature from "Thomas Rini <trini@konsulko.com>" [ultimate]

# Conflicts:
#	configs/am64x_evm_r5_defconfig
2021-06-28 16:22:13 -04:00
Michael Walle
82a3c9ef20 net: use the same alias stem for ethernet as linux
Linux uses the prefix "ethernet" whereas u-boot uses "eth". This is from
the linux tree:

$ grep "eth[0-9].*=.*&" arch/**/*dts{,i}|wc -l
0
$ grep "ethernet[0-9].*=.*&" arch/**/*dts{,i}|wc -l
633

In u-boot device trees both prefixes are used. Until recently the only
user of the ethernet alias was the sandbox test device tree. This
changed with commit fc054d563b ("net: Introduce DSA class for Ethernet
switches"). There, the MAC addresses are inherited based on the devices
sequence IDs which is in turn given by the device tree.

Before there are more users in u-boot and both worlds will differ even
more, rename the alias prefix to "ethernet" to match the linux ones.
Also adapt the test cases and rename any old aliases in the u-boot
device trees.

Cc: David Wu <david.wu@rock-chips.com>
Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2021-06-18 11:29:17 +03:00
Michael Walle
6e424b4aca net: use a more deterministic approach to get the active ethernet device
If the environment variable "ethact" is not set, the first device in the
uclass is returned. This depends on the probing order of the ethernet
devices. Moreover it is not not configurable at all.

Try to return the ethernet device with sequence id 0 first which then
can be configured by the aliases in a device tree. Fall back to the old
mechanism in case of an error.

Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
2021-06-18 11:29:17 +03:00
Tero Kristo
2509493cc1 net: convert TFTP_TSIZE to proper Kconfig option
TFTP transfer size can be used to re-size the TFTP progress bar on
single line based on the server reported file size. The support for
this has been around from 2019, but it was never converted to proper
Kconfig.

While adding this new Kconfig, enable it by default for OMAP2+ and K3
devices also.

Signed-off-by: Tero Kristo <kristo@kernel.org>
2021-06-08 21:38:51 -04:00
Vladimir Oltean
f27bc8afd5 net: phy: fixed: Be compatible with live OF tree
On systems that use CONFIG_OF_LIVE, the "ofnode" type is defined
as const struct device_node *np, while on the flat DT systems it
is defined as a long of_offset into gd->fdt_blob.

It is desirable that the fixed PHY driver uses the higher-level
ofnode abstraction instead of parsing gd->fdt_blob directly,
because that enables it to work on live OF systems.

The fixed PHY driver has used a nasty hack since its introduction in
commit db40c1aa1c ("drivers/net/phy: add fixed-phy /
fixed-link support"),
which is to pass the long gd->fdt_blob offset inside int phydev->addr
(a value that normally holds the MDIO bus address at which the PHY
responds). Even ignoring the fact that the types were already
mismatched leading to a potential truncation (flat OF offset was
supposed to be a long and not an int), we really cannot extend this
hack any longer, because there's no way an int will hold the other
representation of ofnode, the struct device_node *np.

So we unfortunately need to do the right thing, which is to use the
framework introduced by Grygorii Strashko in
commit eef0b8a930 ("net: phy: add ofnode node to struct phy_device").
This will populate phydev->node for the fixed PHY.

Note that phydev->node will not be valid in the probe function, since
that is called synchronously from phy_device_create and we really have
no way of passing the ofnode directly through the phy_device_create API.
So we do what other drivers do too: we move the OF parsing logic from
the .probe to the .config method of the PHY driver. The new function
will be called at phy_config() time.

I do believe I've converted all the possible call paths for creating
a PHY with PHY_FIXED_ID, so there is really no reason to maintain
compatibility with the old logic of retrieving a flat OF tree offset
from phydev->addr. We just pass 0 to phydev->addr now.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Tested-by: Bin Meng <bmeng.cn@gmail.com>
Message-Id: <20210216224804.3355044-2-olteanv@gmail.com>
[bmeng: keep fixedphy_probe(); update mdio-uclass.c to handle fixed phy]
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
2021-04-15 14:22:17 +05:30
Bin Meng
33aad0b092 dm: mdio: Use ofnode_phy_is_fixed_link() API
Switch to use the ofnode_phy_is_fixed_link() API which can support
both the new and old DT bindings.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
2021-04-15 14:22:17 +05:30
Michael Walle
714555374f net: dsa: remove master santiy check
Because we probe the master ourselves (and fail if there is no master),
it is not possible that we don't have a master device.

There is one catch though: device removal. We don't support that. It
wasn't supported neither before this patch. Because the master device
was only set in .pre_probe(), if a device was removed master_dev was a
dangling pointer and transmitting a frame cause a panic. I don't see a
good solution without having some sort of notify machanism when a
udevice is removed.

Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Tested-by: Michael Walle <michael@walle.cc> [DSA unit tests]
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
2021-03-05 10:25:42 +05:30
Michael Walle
108157c468 net: dsa: remove NULL check for priv and platform data
Because the uclass has the "*_auto" properties set, the driver model
will take care of allocating the private structures for us and they
can't be NULL. Drop the checks.

Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
2021-03-05 10:25:42 +05:30
Michael Walle
e5d7d11928 net: dsa: probe master device
DSA needs to have the master device probed first for MAC inheritance.
Until now, it only works by chance because the only user (LS1028A SoC)
will probe the master device first. The probe order is given by the PCI
device ordering, thus it works because the master device has a "smaller"
BDF then the switch device.

Explicitly probe the master device in dsa_port_probe().

Fixes: fc054d563b ("net: Introduce DSA class for Ethernet switches")
Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
2021-03-05 10:25:42 +05:30
Michael Walle
a02dcbbb5a net: dsa: return early if there is no master
It doesn't make sense to have DSA without a master port. Error out early
if there is no master port.

Fixes: fc054d563b ("net: Introduce DSA class for Ethernet switches")
Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
2021-03-05 10:25:42 +05:30
Rasmus Villemoes
bdf319273b mdio-uclass.c: support fixed-link subnodes
When trying to port our mpc8309-based board to DM_ETH, on top of
Heiko's patches, I found that nothing in mdio-uclass.c seems to
support the use of a fixed-link subnode of the ethernet DT node. That
is, the ethernet node looks like

		enet0: ethernet@2000 {
			device_type = "network";
			compatible = "ucc_geth";
			...
			fixed-link {
				reg = <0xffffffff>;
				speed = <100>;
				full-duplex;
			};

but the current code expects there to be phy-handle property. Adding
that, i.e.

			phy-handle = <&enet0phy>;
			enet0phy: fixed-link {

just makes the code break a few lines later since a fixed-link node
doesn't have a reg property. Ignoring the dtc complaint and adding a
dummy reg property, we of course hit "can't find MDIO bus for node
ethernet@2000" since indeed, the parent node of the phy node does not
represent an MDIO bus. So that's obviously the wrong path.

Now, in linux, it seems that the fixed link case is treated specially;
in the of_phy_get_and_connect() which roughly corresponds to
dm_eth_connect_phy_handle() we have

    if (of_phy_is_fixed_link(np)) {
        ret = of_phy_register_fixed_link(np);
        ...
    } else {
        phy_np = of_parse_phandle(np, "phy-handle", 0);
	...
    }

    phy = of_phy_connect(dev, phy_np, hndlr, 0, iface);

And U-Boot's phy_connect() does have support for fixed-link
subnodes. Calling phy_connect() directly with NULL bus and a dummy
address does seem to make the ethernet work.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Reviewed-by: Heiko Schocher <hs@denx.de>
2021-02-21 18:46:41 -05:00
Ramon Fried
2dddc1bb29 net: tftp: Avoid sending extra ack on completion
in tftpboot, if ack was already sent previously for this
packet, don't send again.

Fixes: cc6b87ecaa ("net: tftp: Add client support for RFC 7440")

Reported-by: Suneel Garapati <suneelglinux@gmail.com>
Signed-off-by: Ramon Fried <rfried.dev@gmail.com>
Tested-by: Suneel Garapati <suneelglinux@gmail.com>
Tested-by: Oliver Graute <oliver.graute@kococonnector.com>
2021-02-18 08:20:34 -05:00
Claudiu Manoil
fc054d563b net: Introduce DSA class for Ethernet switches
DSA stands for Distributed Switch Architecture and it covers switches that
are connected to the CPU through an Ethernet link and generally use frame
tags to pass information about the source/destination ports to/from CPU.
Front panel ports are presented as regular ethernet devices in U-Boot and
they are expected to support the typical networking commands.
DSA switches may be cascaded, DSA class code does not currently support
this.

Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
2021-02-16 11:48:20 -05:00
Simon Glass
401d1c4f5d common: Drop asm/global_data.h from common header
Move this out of the common header and include it only where needed.  In
a number of cases this requires adding "struct udevice;" to avoid adding
another large header or in other cases replacing / adding missing header
files that had been pulled in, very indirectly.   Finally, we have a few
cases where we did not need to include <asm/global_data.h> at all, so
remove that include.

Signed-off-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Tom Rini <trini@konsulko.com>
2021-02-02 15:33:42 -05:00
Simon Glass
177e7f9ce7 net: Use CONFIG_IS_ENABLED() in eth_dev_get_mac_address()
This function may be used in SPL where devicetree is not available.
Use the correct macro so that the function does not try to read it.

Signed-off-by: Simon Glass <sjg@chromium.org>
2021-01-27 17:03:16 -05:00
Yang Liu
d9506cd41c net: fix ping in netconsole
Should not init eth device when doing ping in netconsole.

Signed-off-by: Yang Liu <yliu@cybertec.com.au>
Cc: Joe Hershberger <joe.hershberger@ni.com>
2021-01-27 08:25:31 -05:00
Tom Rini
26e85bf77a Revert "net: eth-uclass: Change uclass driver name to ethernet"
This reverts commit 1231184caa.

While the change is fine in theory, a number of tests need to be updated
to match.

Signed-off-by: Tom Rini <trini@konsulko.com>
2021-01-19 15:35:00 -05:00
David Wu
1231184caa net: eth-uclass: Change uclass driver name to ethernet
dev_read_alias_seq() used uc_drv->name compared to alias
stem string, Ethernet's alias stem uses "ethernet", which
does not match the eth-uclass driver name "eth", can not
get the correct index of ethernet alias namer. So it seems
change uclass driver name to match the alias stem is a more
reasonable way.

Signed-off-by: David Wu <david.wu@rock-chips.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2021-01-19 09:15:02 -05:00