While doing DHCP the interface IP is set to 0.0.0.0. This causes the
check in net.c on dst_ip to be effectively skipped, and all IP datagrams
are accepted up the IP stack. In the case of an ICMP_ECHO_REQUEST for the
matching MAC address (regardless of destination IP), the result is that
an ICMP_ECHO_REPLY is sent. The source address of the ICMP_ECHO_REPLY is
0.0.0.0, which is an illegal source address.
This can happen in common practice with the following sequence:
DHCP (U-Boot or OS) acquires IP address 10.0.0.1
System reboots
U-Boot starts DHCP and send DHCP DISCOVER
DHCP server decides to OFFER 10.0.0.1 again
(perhaps because of existing lease or manual configuration)
DHCP server tries to PING 10.0.0.1 to see if anyone is squatting on it
DHCP server still has our MAC address in its ARP table for 10.0.0.1
U-Boot receives PING, and responds with an illegal source address
This may further result in a the DHCP server seeing the response as
confirmation that someone is squatting on 10.0.0.1, and picking a
new IP address from the pool to try again
Signed-off-by: David Rivshin <drivshin@allworx.com>
Running the start() handler twice without a stop() inbetween completely
breaks communication for some ethernet drivers like fec_mxc.
eth_halt() is called before each eth_init(). Due to the switch to
eth_is_active() in commit 68acb51f44 ("net: Only call halt on a driver
that has been init'ed"), this is not sufficient anymore when netconsole
is active: eth_init_state_only()/eth_halt_state_only() manipulate the
state check that is performed by eth_is_active() without actually
calling into the driver.
The issue can be triggered by starting a network operation (e.g. ping or
tftp) while netconsole is active.
Add an additional "running" flag that reflects the actual state of the
driver and use it to ensure that eth_halt() actually stops the device as
it is supposed to.
Fixes: 68acb51f44 ("net: Only call halt on a driver that has been init'ed")
Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
Up to now the bootefi command used the last file loaded to determine the
boot partition. This has led to errors when the fdt had been loaded from
another partition after the EFI binary.
Before setting the boot device from a loaded file check if it is a PE-COFF
image or a FIT image.
For a PE-COFF image remember address and size, boot device and path.
For a FIT image remember boot device and path.
If the PE-COFF image is overwritten by loading another file, forget it.
Do not allow to start an image via bootefi which is not the last loaded
PE-COFF image.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
At present ofnode is present in the device even if it is never used. With
of-platdata this field is not used, so can be removed. In preparation for
this, change the access to go through inline functions.
Signed-off-by: Simon Glass <sjg@chromium.org>
Most drivers use these access methods but a few do not. Update them.
In some cases the access is not permitted, so mark those with a FIXME tag
for the maintainer to check.
Signed-off-by: Simon Glass <sjg@chromium.org>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Pratyush Yadav <p.yadav@ti.com>
Now that there is only one sequence number (rather than both requested and
assigned ones) we can simplify this function. Also update its caller to
simplify the logic.
Signed-off-by: Simon Glass <sjg@chromium.org>
Checking for seq == -1 is effectively checking that the device is
activated. The new sequence numbers are never -1 for a bound device, so
update the check.
Also drop the note about valid sequence numbers so it is accurate with the
new approach.
Signed-off-by: Simon Glass <sjg@chromium.org>
At present various drivers etc. access the device's 'seq' member directly.
This makes it harder to change the meaning of that member. Change access
to go through a function instead.
The drivers/i2c/lpc32xx_i2c.c file is left unchanged for now.
Signed-off-by: Simon Glass <sjg@chromium.org>
We use 'priv' for private data but often use 'platdata' for platform data.
We can't really use 'pdata' since that is ambiguous (it could mean private
or platform data).
Rename some of the latter variables to end with 'plat' for consistency.
Signed-off-by: Simon Glass <sjg@chromium.org>
This construct is quite long-winded. In earlier days it made some sense
since auto-allocation was a strange concept. But with driver model now
used pretty universally, we can shorten this to 'auto'. This reduces
verbosity and makes it easier to read.
Coincidentally it also ensures that every declaration is on one line,
thus making dtoc's job easier.
Signed-off-by: Simon Glass <sjg@chromium.org>
CONFIG_TIMESTAMP is not related to the RTC drivers. It does not make any
sense to let the updating of the RTC by the sntp command depend on it.
Drop the CONFIG_TIMESTAMP checks.
Furthermore function dm_rtc_set() is enabled by CONFIG_DM_RTC. There is no
reason to require CONFIG_CMD_DATE when using a driver model RTC. The UEFI
sub-system can consume the RTC functions even if there is not date command.
Only check CONFIG_CMD_DATE when using a non-driver model RTC.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
- ProxyDHCP allows a second DHCP server to exist alongside your main
DHCP server and supply additional BOOTP related options
- When u-boot sends out a DHCP request, the real DHCP server will
respond with a normal response containing the new client IP address
while simultaneously the ProxyDHCP server will respond with a blank
client IP address and a `bootfile` option
- This patch adds CONFIG_SERVERIP_FROM_PROXYDHCP (default false) to
enable this behavior and CONFIG_SERVERIP_FROM_PROXYDHCP_DELAY_MS
(default 100) which tells u-boot to wait additional time after
receiving the main DHCP response to give the ProxyDHCP response time
to arrive
- The PXE spec for ProxyDHCP is more complicated than the solution
added here as diagramed on page 16:
http://www.pix.net/software/pxeboot/archive/pxespec.pdf:
```
DHCP Discover will be retried four times. The four timeouts are 4, 8, 16
and 32 seconds respectively. If a DHCPOFFER is received without an Option
timeouts in an attempt to receive a PXE response.
```
- Adding a simple delay worked for my purposes but let me know if a
more robust solution is required
Signed-off-by: Lyle Franklin <lylejfranklin@gmail.com>
With a define for the magic number of packets received as batch
we can make sure that the EFI network stack caches the same amount
of packets.
Signed-off-by: Patrick Wildt <patrick@blueri.se>
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
net_init does not always succeed, and there is no existing mechanism to
discover errors. This patch allows callers of net_init (such as net_init)
to handle errors. The root issue is that eth_get_dev can fail, but
net_init_loop doesn't expose that. The ideal way to fix eth_get_dev would
be to return an error with ERR_PTR, but there are a lot of callers, and all
of them just check if it's NULL. Another approach would be to change the
signature to something like
int eth_get_dev(struct udevice **pdev)
but that would require rewriting all of the many callers.
Signed-off-by: Sean Anderson <seanga2@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commits update the support of sntp to use
the framework udp. This change allows to remove
all the reference to sntp in the main network
file net/net.c.
Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit adds a generic udp protocol framework in the
network loop. So protocol based on udp may be implemented
without modifying the network loop (for example custom
wait magic packet).
Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Write the 'No ethernet found' message via the log drivers. This allows
suppressing it during output via the syslog driver.
This fixes the problem reported in:
[PATCH 0/4] log: Fix the syslog spam when running tests
https://lists.denx.de/pipermail/u-boot/2020-September/426343.html
Reported-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
When load the last block, the "len" might not be a block size. This cause
loading the incorrect last block data.
The fix change "len" to tftp_block_size and minus one tftp_block_size
for offset calculation.
Use same offset calculation formula as in store_block().
Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
Reviewed-By: Ramon Fried <rfried.dev@gmail.com>
tftp_cur_block start with 1 for first block, but tftp_cur_block counter is
start with zero when block number is rollover. The existing code
"tftp_cur_block - 1" will cause the block number become -1 in store_block()
when tftp_cur_block is 0 when tftp_cur_block is rollover.
The fix pass in tftp_cur_block to store_block() and minus the
tftp_block_size when do the offset calculation.
Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
Reviewed-By: Ramon Fried <rfried.dev@gmail.com>
Fixes missing update to tftp_prev_block counter before increase
tftp_cur_block counter when do the tftpput operation.
tftp_prev_block counter is used in update_block_number() function to
check whether block number (sequence number) is rollover. This bug
cause the tftpput command fail to upload a large file when block
number is greater than 16-bit (0xFFFF).
Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
Reviewed-By: Ramon Fried <rfried.dev@gmail.com>
The name of the device we are working on is `ethdev` and not just `dev`.
Signed-off-by: Sean Anderson <seanga2@gmail.com>
Tested-by: Patrick Delaunay <patrick.delaunay@st.com>
Android 10 adds support for dynamic partitions and in order to support
this userspace fastboot must be used[1]. New tool fastbootd is
included into recovery.
Userspace fastboot works from recovery and is launched if:
1) - Dynamic partitioning is enabled
2) - Boot control block has 'boot-fastboot' value into command field
The bootloader is expected to load and boot into the recovery image
upon seeing boot-fastboot in the BCB command. Recovery then parses the
BCB message and switches to fastbootd mode[2].
Please note that boot script is expected to handle 'boot-fastboot'
command in BCB and load into recovery mode.
Bootloader must support 'reboot fastboot' command which should reboot
device into userspace fastboot to accomodate those changes[3].
Another command that bootloader must support[3] is 'reboot recovery'. This
command should simply reboot device into recovery mode.
[1] - https://source.android.com/devices/bootloader/fastbootd
[2] - https://source.android.com/devices/bootloader/fastbootd#unified_fastboot_and_recovery
[3] - https://source.android.com/devices/bootloader/fastbootd#modifications_to_the_bootloader
Signed-off-by: Roman Kovalivskyi <roman.kovalivskyi@globallogic.com>
Signed-off-by: Roman Stratiienko <r.stratiienko@gmail.com>
Change-Id: I9d2bdc9a6f6f31ea98572fe155e1cc8341e9af76
Reset the stored ping IP address before entering a netloop with different
protocol to ensure that it won't be interrupted by the received
correct ICMP_ECHO_REPLY packet.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Add support for RFC 7440: "TFTP Windowsize Option".
This optional feature allows the client and server
to negotiate a window size of consecutive blocks to send as an
alternative for replacing the single-block lockstep schema.
windowsize can be defined statically during compilation by
setting CONFIG_TFTP_WINDOWSIZE, or defined in runtime by
setting an environment variable: "tftpwindowsize"
If not defined, the windowsize is set to 1, meaning that it
behaves as it was never defined.
Choosing the appropriate windowsize depends on the specific
network topology, underlying NIC.
You should test various windowsize scenarios and see which
best work for you.
Setting a windowsize too big can actually decreases performance.
Signed-off-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Marek Vasut <marex@denx.de>
This header file should not be included in other header files. Remove it
and use other headers and C inclusions instead.
Signed-off-by: Simon Glass <sjg@chromium.org>
The Linux coding style guide (Documentation/process/coding-style.rst)
clearly says:
It's a **mistake** to use typedef for structures and pointers.
Besides, using typedef for structures is annoying when you try to make
headers self-contained.
Let's say you have the following function declaration in a header:
void foo(bd_t *bd);
This is not self-contained since bd_t is not defined.
To tell the compiler what 'bd_t' is, you need to include <asm/u-boot.h>
#include <asm/u-boot.h>
void foo(bd_t *bd);
Then, the include direcective pulls in more bloat needlessly.
If you use 'struct bd_info' instead, it is enough to put a forward
declaration as follows:
struct bd_info;
void foo(struct bd_info *bd);
Right, typedef'ing bd_t is a mistake.
I used coccinelle to generate this commit.
The semantic patch that makes this change is as follows:
<smpl>
@@
typedef bd_t;
@@
-bd_t
+struct bd_info
</smpl>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Similar to patch 821fec0ceb ("net: remove scary warning about EEPROM
provided MAC address") this removes the somewhat awkward "warning" on
boards using DM_ETH:
In many parts of the computing world having a unique MAC address
sitting in some on-NIC storage is considered the normal case.
If there is a properly provided MAC address (either from ROM or from DT),
remove the warning to not scare the user unnecessarily.
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-By: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
The random_port() routine is not used anywhere else. Make it local to
dns.c to reduce code clutter, and shrink generated code a little.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
RFC2348, RFC2349:
- Option string is case in-sensitive.
- Client must generate ERR pkt in case option value mismatch in server OACK
- Fix debug print for options
Signed-off-by: Ravik Hasija <rahasij@linux.microsoft.com>
Reviewed-By: Ramon Fried <rfried.dev@gmail.com>
During packet sequence number wraparound the show_block_marker() API was
not called, as a result the progress marker doesn't stay within column
boundary. Use position in file instead of sequence number to align the
marker.
Signed-off-by: Ravik Hasija <rahasij@linux.microsoft.com>
Reviewed-By: Ramon Fried <rfried.dev@gmail.com>
If 'CONFIG_CMD_TFTPBOOT' or 'CONFIG_CMD_BOOTP' are disabled, the usage must be disabled, too!
Signed-off-by: Olaf Krebs <olaf.krebs@emh-metering.com>
CC: Joe Hershberger <joe.hershberger@ni.com>
We should not use typedefs in U-Boot. They cannot be used as forward
declarations which means that header files must include the full header to
access them.
Drop the typedef and rename the struct to remove the _s suffix which is
now not useful.
This requires quite a few header-file additions.
Signed-off-by: Simon Glass <sjg@chromium.org>
Move this header out of the common header. Network support is used in
quite a few places but it still does not warrant blanket inclusion.
Note that this net.h header itself has quite a lot in it. It could be
split into the driver-mode support, functions, structures, checksumming,
etc.
Signed-off-by: Simon Glass <sjg@chromium.org>
For dual ethernet controllers, the HW design may connect ETH phys to
one MDIO ports. So two different ethernet drivers have to share MDIO bus.
Since two ethernet drivers are independent, we can't ensure their probe
order.
To resolve this problem, introduce an eth phy generic driver and uclass.
After eth-uclass binds, we search the mdio node and binds the phy node
with the eth-phy-generic driver.
When one eth driver get its phy device, the parent of phy device will
probe prior than phy device. So this ensure the eth driver ownes the
MDIO bus will be probed before using its MDIO.
Signed-off-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Remove the unneeded define TFTP_MTU_BLOCKSIZE.
Since the KConfig migration done by commit b618b37076 ("net:
Convert CONFIG_TFTP_BLOCKSIZE to Kconfig"), CONFIG_TFTP_BLOCKSIZE
is always defined and can be used directly to avoid confusion
(fallback to 1468 in code is never used).
Signed-off-by: Patrick Delaunay <patrick.delaunay@st.com>
Add help message for the CONFIG_TFTP_BLOCKSIZE default value,
as explain in tftp.c before migration in commit b618b37076
("net: Convert CONFIG_TFTP_BLOCKSIZE to Kconfig")
Signed-off-by: Patrick Delaunay <patrick.delaunay@st.com>
When local-mac-address DT property is specified it is reported the same way
as address read from eeprom/ROM. Show properly if mac address is coming
from DT or ROM.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
At present dm/device.h includes the linux-compatible features. This
requires including linux/compat.h which in turn includes a lot of headers.
One of these is malloc.h which we thus end up including in every file in
U-Boot. Apart from the inefficiency of this, it is problematic for sandbox
which needs to use the system malloc() in some files.
Move the compatibility features into a separate header file.
Signed-off-by: Simon Glass <sjg@chromium.org>
These global variables are quite short and generic. In fact the same name
is more often used locally for struct members and function arguments.
Add a image_ prefix to make them easier to distinguish.
Signed-off-by: Simon Glass <sjg@chromium.org>
This function belongs more in flash.h than common.h so move it.
Also remove the space before the bracket in some calls.
Signed-off-by: Simon Glass <sjg@chromium.org>
These functions are used by code outside the network support, so move them
to lib/ to be more accessible.
Without this, the functions are only accessible in SPL/TPL only if
CONFIG_SPL/TPL_NET are defined. Many boards do not enable those option but
still want to do checksums in this format.
Fix up a few code-style nits while we are here.
Signed-off-by: Simon Glass <sjg@chromium.org>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
The function connects an ethernet device to a PHY using DT information.
This API is only available for eth devices with an associated device tree
node.
Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Renamed dm_mdio_phy_connect arguments dev to mdiodev and addr to phyaddr
for a bit more clarity and consistency with the following patches.
Also use NULL instead of 0 on error return path.
Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Commit b618b37076 ("net: Convert CONFIG_TFTP_BLOCKSIZE to Kconfig")
accidentally set the default *option* TFTP block size to 512 bytes, even
though the comment in the code says that this is a terrible choice. Most
boards didn't define the symbol before, so they got the default block size
of 1468 bytes before, but now use 512 bytes, which is also the fallback.
This leads to both abysmal performance and a lot of hashes printed
on the screen (one character for every 5K), which is both annoying and
slow over serial links.
Set the default block size in Kconfig back to the value it had before.
This improves TFTP performance from 2.8 MB/s to 6.9 MB/s on a Pine64.
Fixes: b618b37076 ("net: Convert CONFIG_TFTP_BLOCKSIZE to Kconfig")
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
device_probe() may fail in which case the seq_id will be -1. Don't
display these devices during startup. While this is only a cosmetic
change, the return value of eth_initialize() will also change to the
actual number of available devices. The return value is only used in
spl_net to decide whether there are any devices to boot from. So
returning only available devices is also more correct in that case.
Signed-off-by: Michael Walle <michael@walle.cc>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
During testing of qemu-riscv32 with a 2GiB memory configuration,
tftp always fails with a error message:
Load address: 0x84000000
Loading: #
TFTP error: trying to overwrite reserved memory...
It turns out the result of 'tftp_load_addr + tftp_load_size' just
overflows (0x100000000) and the test logic in store_block() fails.
Fix this by adjusting the end address to ULONG_MAX when overflow
is detected.
Fixes: a156c47e39 ("tftp: prevent overwriting reserved memory")
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
sandbox_defconfig does not compile using GCC 9.2.1:
net/net.c: In function ‘net_process_received_packet’:
net/net.c:1288:23: error: taking address of packed member of ‘struct
ip_udp_hdr’ may result in an unaligned pointer value
[-Werror=address-of-packed-member]
1288 | sumptr = (ushort *)&(ip->udp_src);
| ^~~~~~~~~~~~~~
Avoid the error by using a u8 pointer instead of an u16 pointer and
in-lining ntohs().
Simplify the checksumming of the last message byte.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
While we have networking use cases within SPL we do not support loading
files via NFS at this point in time. Disable calling nfs_start() so
that the NFS related code can be garbage collected at link time.
Signed-off-by: Tom Rini <trini@konsulko.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Part of the env cleanup moved this out of the environment code and into
the net code. However, this helper is sometimes needed even when the net
stack isn't included.
Move the helper to lib/net_utils.c like it's similarly-purposed
string_to_ip(). Also rename the moved function to similar naming.
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
Reported-by: Ondrej Jirman <megous@megous.com>
This function belongs in time.h so move it over and add a comment.
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
Create a new rand.h header file and move functions into it, to reduce
the size of common.h
Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
With GCC 9.2.1 net/nfs.c leads to multiple errors of type
address-of-packed-member.
net/nfs.c: In function ‘rpc_req’:
net/nfs.c:199:18: error: taking address of packed member of
‘struct rpc_t’ may result in an unaligned pointer value
[-Werror=address-of-packed-member]
199 | p = (uint32_t *)&(rpc_pkt.u.call.data);
| ^~~~~~~~~~~~~~~~~~~~~~
net/nfs.c: In function ‘nfs_readlink_reply’:
net/nfs.c:631:46: error: taking address of packed member of
‘struct rpc_t’ may result in an unaligned pointer value
[-Werror=address-of-packed-member]
631 | nfs3_get_attributes_offset(rpc_pkt.u.reply.data);
| ~~~~~~~~~~~~~~~^~~~~
LD drivers/block/built-in.o
net/nfs.c: In function ‘nfs_read_reply’:
net/nfs.c:692:46: error: taking address of packed member of
‘struct rpc_t’ may result in an unaligned pointer value
[-Werror=address-of-packed-member]
692 | nfs3_get_attributes_offset(rpc_pkt.u.reply.data);
| ~~~~~~~~~~~~~~~^~~~~
struct rpc_t is only used as local variable. It is naturally packed. So
there is no need for the attribute packed.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
rpc_pkt.u.call.data is an array of uint32_t. There is no need to convert
it to uint32_t *.
memcpy() expects void * as it 1st and 2nd argument. There is no point in
converting pointers to char * before passing them to memcpy().
In ntohl(data[1]) != 0 calling ntohl() is superfluous. If the value is
zero, does not depend on the byte order.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
This patch adds a check to rpc_pkt.u.reply.data at nfs_lookup_reply.
Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reported-by: Fermín Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
This patch adds a check to rpc_pkt.u.reply.data at nfs_readlink_reply.
Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reported-by: Fermín Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
This patch adds a check to rpc_pkt.u.reply.data at nfs_read_reply.
Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reported-by: Fermín Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
This patch adds a check to nfs_handler to fix buffer overflow for CVE-2019-14197,
CVE-2019-14200, CVE-2019-14201, CVE-2019-14202, CVE-2019-14203 and CVE-2019-14204.
Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reported-by: Fermín Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
This patch adds a check to udp_len to fix unbounded memcpy for
CVE-2019-14192, CVE-2019-14193 and CVE-2019-14199.
Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reviewed-by: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
Reported-by: Fermín Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Use the optional property device-name to name the MDIO bus. This works
around limitations with using the DT node name on devices such as
Armada-8040, which integrates two cp100 cores, both featuring MDIOs at the
same relative offsets and with the same DT node names.
The concept was originally proposed by Marvell as a custom property called
mdio-name specific to Marvell driver. This patch uses the more generic
property device-name and moves this into MDIO class code so other can use
it as well.
Signed-off-by: Alex Marginean <alexm.osslist@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Add support for capturing ethernet packets and storing
them in memory in PCAP(2.4) format, later to be analyzed by
any PCAP viewer software (IE. Wireshark)
This feature greatly assist debugging network issues such
as detecting dropped packets, packet corruption etc.
Signed-off-by: Ramon Fried <rfried.dev@gmail.com>
Reviewed-by: Alex Marginean <alexm.osslist@gmail.com>
Tested-by: Alex Marginean <alexm.osslist@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
This file contains lots of internal details about the environment. Most
code can include env.h instead, calling the functions there as needed.
Rename this file and add a comment at the top to indicate its internal
nature.
Signed-off-by: Simon Glass <sjg@chromium.org>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Reviewed-by: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
[trini: Fixup apalis-tk1.c]
Signed-off-by: Tom Rini <trini@konsulko.com>
This header file is now only used by files that access internal
environment features. Drop it from various places where it is not needed.
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Signed-off-by: Simon Glass <sjg@chromium.org>
This function fits better with the network subsystem, so move it.
Signed-off-by: Simon Glass <sjg@chromium.org>
Suggested-by: Joe Hershberger <joe.hershberger@ni.com>
Move env_set_hex() over to the new header file along with env_set_addr()
which uses it.
Signed-off-by: Simon Glass <sjg@chromium.org>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Move this function over to the new header file. Also rename it to have an
env_ prefix like the other functions.
Signed-off-by: Simon Glass <sjg@chromium.org>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Adds a class for MDIO MUXes, which control access to a series of
downstream child MDIOs.
MDIO MUX drivers are required to implement a select function used to switch
between child buses.
MUX children are registered as MDIO buses and they can be used just like
regular MDIOs.
Signed-off-by: Alex Marginean <alexm.osslist@gmail.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Adds UCLASS_MDIO DM class supporting MDIO buses that are probed as
stand-alone devices. Useful in particular for systems that support
DM_ETH and have a stand-alone MDIO hardware block shared by multiple
Ethernet interfaces.
Signed-off-by: Alex Marginean <alexm.osslist@gmail.com>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Convert CONFIG_TFTP_BLOCKSIZE to Kconfig, update defconfigs,
headers and whitelist.
Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
Cc: Christian Gmeiner <christian.gmeiner@gmail.com>
Cc: Joe Hershberger <joe.hershberger@ni.com>
Convert CONFIG_IP_DEFRAG to Kconfig, update defconfigs, headers
and whitelist. This patch is a follow-up on a patch by Christian
Gmeiner with the added config/header/whitelist updates.
Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
Reported-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Cc: Joe Hershberger <joe.hershberger@ni.com>
Add the standard Ethernet device tree bindings (imported from v5.0 of
the Linux kernel) and implement support for reading the MAC address for
Ethernet devices in the Ethernet uclass. If the "mac-address" property
exists, the MAC address will be parsed from that. If that property does
not exist, the "local-mac-address" property will be tried as fallback.
MAC addresses from device tree take precedence over the ones stored in
a network interface card's ROM.
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
In order for the device to use the proper MAC address, which can have
been configured in the environment prior to the device being registered,
ensure that the MAC address is written after the device has been probed.
For devices that are registered before the network stack is initialized,
this is already done during eth_initialize(). If the Ethernet device is
on a bus that is not initialized on early boot, such as PCI, the device
is not available at the time eth_initialize() is called, so we need the
MAC address programming to also happen after probe.
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
This fixes the automatic lmb initialization and reservation for boards
with more than one DRAM bank.
This fixes the CVE-2018-18439 and -18440 fixes that only allowed to load
files into the firs DRAM bank from fs and via tftp.
Found-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
Tested-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Simon Glass <sjg@chromium.org>
As a follow-up, change the name of the newly introduced function
'lmb_get_unreserved_size' to 'lmb_get_free_size', which is more
appropriate.
Signed-off-by: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
[trini: Fix test/lib/lmb.c]
Signed-off-by: Tom Rini <trini@konsulko.com>
No mainline board enables CONFIG_MCAST_TFTP and there have been
compilation issues with the code for some time. Additionally, it has a
potential buffer underrun issue (reported as a side note in
CVE-2018-18439).
Remove the multicast TFTP code but keep the driver API for the future
addition of IPv6.
Cc: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
Signed-off-by: Chris Packham <judge.packham@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
ether_crc was added to the core net code in commit 53a5c424bf
("multicast tftp: RFC2090") so that other drivers could use it. However
the only current user of it is tsec.c so move it there.
Signed-off-by: Chris Packham <judge.packham@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
When dealing with two ethernet ports and having "netretry" set
to "once", it could occur that the connection (e.g. an ARP
request) failed, hence the status of the netloop was
"NETLOOP_FAIL". Due to the setting of "netretry", the network
logic would then switch to the other network interface,
assigning "ret" with the return value of "net_start_again()".
If this call succeeded we would return 0 (i.e. success) to
the caller when in reality the network action failed.
Signed-off-by: Thomas RIENOESSL <thomas.rienoessl@bachmann.info>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
This fixes CVE-2018-18439 ("insufficient boundary checks in network
image boot") by using lmb to check for a valid range to store
received blocks.
Signed-off-by: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
[trini: Always build lib/lmb.o on LMB and lib/fdtdec.o on OF_LIBFDT]
Signed-off-by: Tom Rini <trini@konsulko.com>
Make it possible to add TCP versions of the same, while reusing
IP portions. This patch should not change any behavior.
Signed-off-by: Duncan Hare <DH@Synoia.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
Peter originally sent a fix, but it breaks a number of other things.
This addresses the original reported issue in a different way.
That report was:
> U-Boot has 1 common buffer to send Ethernet frames, pointed to by
> net_tx_packet. When sending to an IP address without knowing the MAC
> address, U-Boot makes an ARP request (using the arp_tx_packet buffer)
> to find out the MAC address of the IP addressr. When a matching ARP
> reply is received, U-Boot continues sending the frame stored in the
> net_tx_packet buffer.
>
> However, in the mean time, if U-Boot needs to send out any network
> packets (e.g. replying ping packets or ARP requests for its own IP
> address etc.), it will use the net_tx_packet buffer to prepare the
> new packet. Thus this buffer is no longer the original packet meant
> to be transmitted after the ARP reply. The original packet will be
> lost.
This instead uses the ARP tx buffer to send async replies in the case
where we are actively waiting for an ARP reply.
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
Reported-by: Tran Tien Dat <peter.trantiendat@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Tested-by: Bin Meng <bmeng.cn@gmail.com>
This single-sources the state of the ARP.
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
When a USB ethernet device is halted, the device driver is removed. When
this happens the uclass private memory is freed and uclass_priv is set to
NULL. This causes a data abort when uclass_priv->state is then set to
ETH_STATE_PASSIVE.
Fix it by checking if uclass_priv is NULL before setting uclass_priv->state
Signed-off-by: Jean-Jacques Hiblot <jjhiblot@ti.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
The same basic parsing was implemented in tftp and nfs, so add a helper
function to do the work once.
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
Instead of depending on a env callback for bootfile, read it explicitly.
We do this because the bootfile can be specified on the command line and
if it is, we will overwrite the internal variable. If a netboot_common()
is called again with no bootfile parameter, we want to use the one in
the environment.
Signed-off-by: Joe Hershberger <joe.hershberger@ni.com>
