The DSA (Distributed Switch Architecture) implementation has made a
design decision when it got introduced to the Linux kernel in 2008.
That was to hide away from the user the CPU-facing Ethernet MAC, since
it does not make sense to register it as a struct net_device (UCLASS_ETH
udevice for U-Boot), because that would never be beneficial for a user:
they would not be able to use it for traffic, since conceptually, a
packet delivered to the CPU port should loop back into the system.
Nonetheless, DSA has had numerous growing pains due to the lack of a
struct net_device for the CPU port, but so far it has overcome them.
It is unlikely at this stage of maturity that this aspect of it will
change.
We would like U-Boot to present the same information as Linux, to be at
parity in terms of number of interfaces, so that ethNaddr environment
variables could directly be associated between U-Boot and Linux.
Therefore, we would implicitly like U-Boot to hide the CPU port from the
user as well.
But the paradox is that DSA still needs a struct phy_device to inform
the driver of the parameters of the link that it should configure the
CPU port to. The problem is that the phy_device is typically returned
via a call to phy_connect, which needs an udevice to attach the PHY to,
and to search its ofnode for the 'fixed-link' property. But we don't
have an udevice to present for the CPU port.
Since 99% of DSA setups are MAC-to-MAC connections between the switch
and the host Ethernet controller, the struct phy_device is going to be a
fixed PHY. This simplifies things quite a bit. In U-Boot, a fixed PHY
does not need an MDIO bus, and does not need an attached dev either.
Basically, the phy_connect call doesn't do any connection, it just
creates the fixed PHY.
The proposal of this patch is to introduce a new fixed_phy_create
function which will take a single argument: the ofnode that holds this:
port@4 {
reg = <4>;
phy-mode = "internal";
fixed-link {
speed = <2500>;
full-duplex;
};
};
and probe a fixed PHY driver using the information from this ofnode.
DSA will probably be the only user of this function.
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Unlike the Linux fixed PHY driver, the one in U-Boot does not attempt to
emulate the clause 22 register set of a gigabit copper PHY driver
through the swphy framework. Therefore, the limitation of being unable
to support speeds higher than gigabit in fixed-link does not apply to
the U-Boot fixed PHY driver. This makes the fixed-link U-Boot
implementation more similar to the one from phylink, which can work with
any valid link speed.
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Extend existing DM tee tests adding test coverage for reverse RPC calls.
Currently this commit only adds tests for I2C requests from TEE driver
to TEE supplicant, for instance reading/writing data to emulated i2c
eeprom defines in standard sandbox test device tree
(arch/sandbox/dts/test.dtb):
=> i2c bus
Bus 0: i2c@0 (active 0)
2c: eeprom@2c, offset len 1, flags 0
...
Running TEE tests:
=> ut dm tee
Test: dm_test_tee: tee.c
Test: dm_test_tee: tee.c (flat tree)
Failures: 0
Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io>
Reviewed-by: Simon Glass <sjg@chromium.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
This adds support for RPC test trusted application emulation, which
permits to test reverse RPC calls to TEE supplicant. Currently it covers
requests to the I2C bus from TEE.
Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Add pygit2 and pyelftools to the list of packages for virtualenv
needed to run all sets of pytests.This fixes warnings like:
binman.elf_test.TestElf.testDecodeElf (subunit.RemotedTestCase):
Python elftools not available
Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit gives the secure world access to the I2C bus so it can
communicate with I2C slaves (typically those would be secure elements
like the NXP SE050).
A similar service implementation has been merged in linux:
c05210ab ("drivers: optee: allow op-tee to access devices on the i2c
bus")
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
In case of IOMUX enabled it assumes that console devices in the list
are available to get them stopped properly via ->stop() callback.
However, the USB keyboard driver violates this assumption and tries
to play tricks so the device get destroyed while being listed as
an active console.
Swap the order of device deregistration and IOMUX update along with
converting to use iomux_replace_device() jelper to avoid the use-after-free.
Fixes: 3cbcb28928 ("usb: Fix usb_kbd_deregister when console-muxing is used")
Fixes: 8a83487030 ("dm: usb: Add a remove() method for USB keyboards")
Reported-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Some console devices may appear or disappear at run time. In order to
support such a hotplug mechanism introduce a new iomux_replace_device()
helper to update the list of devices without altering environment.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
It is not only less lines of code, but also better readability
when new macro is being in use. Introduce for_each_console_dev()
helper macro and convert current users to it.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Logical continuation of the change that brought console_devices_set() is
to unify console_setfile() with it and replace in the callers.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
console_devices_set() missed the console device counter to be set correctly.
Fixes: 45375adc97 ("console: add function console_devices_set")
Cc: Patrick Delaunay <patrick.delaunay@foss.st.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
It's possible that NULLDEV can be disabled while it makes leftovers,
move entire device under #if.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Nobody is using stdio_deregister(), remove for good.
Note, even its parameters are not consistent with stdio_register().
So, if anyone want to introduce this again, better with some consistency.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Using unit addresses in a FIT is a security risk. Add a check for this
and disallow it.
CVE-2021-27138
Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>
It is possible to construct a devicetree blob with multiple root nodes.
Update fdt_check_full() to check for this, along with a root node with an
invalid name.
CVE-2021-27097
Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>
Some strange modifications of the FIT can introduce security risks. Add an
option to check it thoroughly, using libfdt's fdt_check_full() function.
Enable this by default if signature verification is enabled.
CVE-2021-27097
Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>
At present this function does not accept a size for the FIT. This means
that it must be read from the FIT itself, introducing potential security
risk. Update the function to include a size parameter, which can be
invalid, in which case fit_check_format() calculates it.
For now no callers pass the size, but this can be updated later.
Also adjust the return value to an error code so that all the different
types of problems can be distinguished by the user.
Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>
Add tests to check that these two attacks are mitigated by recent patches.
Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>
Add a library which performs two different attacks on a FIT.
Signed-off-by: Julien Lenoir <julien.lenoir@intel.com>
Signed-off-by: Bruce Monroe <bruce.monroe@intel.com>
Signed-off-by: Arie Haenel <arie.haenel@intel.com>
Signed-off-by: Simon Glass <sjg@chromium.org>
When searching for a node called 'fred', any unit address appended to the
name is ignored by libfdt, meaning that 'fred' can match 'fred@1'. This
means that we cannot be sure that the node originally intended is the one
that is used.
Disallow use of nodes with unit addresses.
Update the forge test also, since it uses @ addresses.
CVE-2021-27138
Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>
At present fdt_find_regions() assumes that the FIT is a valid devicetree.
If the FIT has two root nodes this is currently not detected in this
function, nor does libfdt's fdt_check_full() notice. Also it is possible
for the root node to have a name even though it should not.
Add checks for these and return -FDT_ERR_BADSTRUCTURE if a problem is
detected.
CVE-2021-27097
Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>
This board has not been converted to CONFIG_DM by the deadline of v2020.01
and is missing other conversions which depend on this as well. Remove it.
Cc: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
Signed-off-by: Tom Rini <trini@konsulko.com>
This board has not been converted to CONFIG_DM by the deadline of v2020.01
and is missing other conversions which depend on this as well. Remove it.
As this is the last SH4A board, remove that support as well.
Cc: Marek Vasut <marek.vasut+renesas@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
This board has not been converted to CONFIG_DM by the deadline of v2020.01
and is missing other conversions which depend on this as well. Remove it.
Signed-off-by: Tom Rini <trini@konsulko.com>
This board has not been converted to CONFIG_DM by the deadline of v2020.01
and is missing other conversions which depend on this as well. Remove it.
Signed-off-by: Tom Rini <trini@konsulko.com>
This board has not been converted to CONFIG_DM by the deadline of v2020.01
and is missing other conversions which depend on this as well. Remove it.
Patch-cc: Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com>
Patch-cc: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
Signed-off-by: Tom Rini <trini@konsulko.com>
This board has not been converted to CONFIG_DM by the deadline of v2020.01
and is missing other conversions which depend on this as well. Remove it.
Signed-off-by: Tom Rini <trini@konsulko.com>
This board relies on using CONFIG_LIBATA but does not enable CONFIG_AHCI. The
deadline for this conversion was the v2019.07 release. The use of CONFIG_AHCI
requires CONFIG_DM. The deadline for this conversion was v2020.01. Remove
this board.
Cc: Priyanka Jain <priyanka.jain@nxp.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
This board relies on using CONFIG_LIBATA but does not enable CONFIG_AHCI. The
deadline for this conversion was the v2019.07 release. The use of CONFIG_AHCI
requires CONFIG_DM. The deadline for this conversion was v2020.01. Remove
this board.
Cc: Priyanka Jain <priyanka.jain@nxp.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
This board relies on using CONFIG_LIBATA but does not enable CONFIG_AHCI. The
deadline for this conversion was the v2019.07 release. The use of CONFIG_AHCI
requires CONFIG_DM. The deadline for this conversion was v2020.01. Remove
this board.
Cc: Priyanka Jain <priyanka.jain@nxp.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
This board relies on using CONFIG_LIBATA but does not enable CONFIG_AHCI. The
deadline for this conversion was the v2019.07 release. The use of CONFIG_AHCI
requires CONFIG_DM. The deadline for this conversion was v2020.01. Remove
this board.
Cc: Priyanka Jain <priyanka.jain@nxp.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
This board has not been converted to CONFIG_DM_MMC by the deadline of
v2019.04, which is almost two years ago. In addition there are other DM
migrations it is also missing. Remove it.
Cc: Chris Packham <judge.packham@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Acked-by: Chris Packham <judge.packham@gmail.com>
This board has not been converted to CONFIG_DM_MMC by the deadline of
v2019.04, which is almost two years ago. In addition there are other DM
migrations it is also missing. Remove it.
Cc: Prabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
Cc: Priyanka Jain <priyanka.jain@nxp.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
This board has not been converted to CONFIG_DM_MMC by the deadline of
v2019.04, which is almost two years ago. In addition there are other DM
migrations it is also missing. Remove it.
Cc: Stefano Babic <sbabic@denx.de>
Signed-off-by: Tom Rini <trini@konsulko.com>
Acked-by: Stefano Babic <sbabic@denx.de>
This board has not been converted to CONFIG_DM_MMC by the deadline of
v2019.04, which is almost two years ago. In addition there are other DM
migrations it is also missing. Remove it.
Cc: Lauri Hintsala <lauri.hintsala@bluegiga.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Acked-by: Lauri Hintsala <lauri.hintsala@silabs.com<mailto:lauri.hintsala@silabs.com>>
Signed-off-by: Tom Rini <trini@konsulko.com<mailto:trini@konsulko.com>>
On Rockchip platforms we need this area of code in TPL, but there is no
TPL_SEPARATE_BSS symbol.
This reverts commit 0a2aaab0b6.
Reported-by: Markus Reichl <m.reichl@fivetechno.de>
Reported-by: Jesper Schmitz Mouridsen <jesper@schmitz.computer>
Reported-by: Peter Robinson <pbrobinson@gmail.com>
Tested-by: Peter Robinson <pbrobinson@gmail.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Bug fixes:
* fix stack smashing in UEFI capsule updates
* correct loading of UEFI binaries where Virtual size is not a
multiple of FileAlignment
* simplify detection of capsule files.
* buildman: use threading.is_alive() instead of removed method IsAlive()
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEbcT5xx8ppvoGt20zxIHbvCwFGsQFAmApIc4ACgkQxIHbvCwF
GsRQpQ//Zk4eJAHeibV4whdjyWpVXEnRR1fMFDgD7WUq3jTZmUvNp99ME5UJv+6J
9R3WHZGfYIS+SypEe1BhzaSOfeS8GPkuk6bkEeM8MRA5L5vAdnONmUAa5TGp+xaq
0V//k9U7raeWD+pdo7WA3GA8wQ4BoOgbCVNJfePfO2bD3okJZOT4S5qjFWD7Thfj
TgiN6L44he5MrY9rKF0ZJcijtKpKBbwf5AYSurafgEJJJWkaEDynt2H5aJiIJ67v
8LiomMPmvke7owft7JxntScvxNfcKagFojtSB3zShJ7Fbx0EMJFyGHfdBQHNiqgA
7GbQyhdk6FFlhlAwanTjxMfPfpLBjeTZhv5UtIpEDU8gv7PHEgVAT2NAQjcEbU6G
TssHzaWvpA/fNlV/s7b+uoW4pyvuvbeCtdxj7WB8O+j7uW5Z6APzMAxJZJ6RoCx/
GDtsvkUUKpLwpPXQwsi/+BS6FNZGqY/GnijZmFdQZkUieXVLqCmuyu83UKfa8jMH
6Q9yjSH9jDEWe4xS3XwfLY49k6qeKNjOZbB1aYQPqZallfvXx9qOYzQi1HHSx6Z5
FngAYj3c6lxHp0p726m2Vjgceg02O3AmMaVHOkIh4TpLoRzR2msJAgpOghNtAi49
vV47rr0HpvhBwfgVuJ+uVf7lFDbondoX5t9OuptUFxmyEZH5b5o=
=Na9Y
-----END PGP SIGNATURE-----
Merge tag 'efi-2021-04-rc2-2' of https://gitlab.denx.de/u-boot/custodians/u-boot-efi
Pull request for UEFI sub-system for efi-2021-04-rc2-2
Bug fixes:
* fix stack smashing in UEFI capsule updates
* correct loading of UEFI binaries where Virtual size is not a
multiple of FileAlignment
* simplify detection of capsule files.
* buildman: use threading.is_alive() instead of removed method IsAlive()
The isAlive() method was deprecated in Python 3.8 and has been removed in
Python 3.9. See https://bugs.python.org/issue37804. Use is_alive() instead.
Since Python 2.6 is_alive() has been a synonym for isAlive(). So there
should be no problems for users using elder Python 3 versions.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
fix get_last_capsule() leads to writes beyond the stack allocated buffer.
This was indicated when enabling the stack protector.
utf16_utf8_strcpy() only stops copying when reaching '\0'. The current
invocation always writes beyond the end of value[].
The output length of utf16_utf8_strcpy() may be longer than the number of
UTF-16 tokens. E.g has "CapsuleКиев" has 11 UTF-16 tokens but 15 UTF-8
tokens. Hence, using utf16_utf8_strcpy() without checking the input may
lead to further writes beyond value[].
The current invocation of strict_strtoul() reads beyond the end of value[].
A non-hexadecimal value after "Capsule" (e.g. "CapsuleZZZZ") must result in
an error. We cat catch this by checking the return value of strict_strtoul().
A value that is too short after "Capsule" (e.g. "Capsule0") must result in
an error. We must check the string length of value[].
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
'.' and '..' are directories. So when looking for capsule files it is
sufficient to check that the attribute EFI_FILE_DIRECTORY is not set. We
don't have to check for these special names.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
PE section table entries' SizeOfRawData must be a multiple of
FileAlignment, and thus may be rounded up and larger than their
VirtualSize.
We should not load beyond the VirtualSize, which is "the total size of
the section when loaded into memory" -- we may clobber real data at the
target in some other section, since we load sections in reverse order
and sections are usually laid out sequentially.
Signed-off-by: Asherah Connor <ashe@kivikakk.ee>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
