Skip to content
Snippets Groups Projects
  1. Dec 09, 2024
  2. Dec 08, 2024
  3. Dec 06, 2024
  4. Dec 05, 2024
    • Tom Rini's avatar
    • Tom Rini's avatar
      Merge tag 'efi-master-05122024' of https://source.denx.de/u-boot/custodians/u-boot-tpm · ac3428fc
      Tom Rini authored
      CI: https://source.denx.de/u-boot/custodians/u-boot-tpm/-/pipelines/23719
      
      Two fixes for the EFI subsystem coming via the TPM tree as agreed by Heinrich
      
      The LMB patch fixes a failure in SystemReady testing. Nothing bad happens
      without the patch in the device operation, but the return values are wrong
      and SCT tests fail for MemoryAllocationServicesTest category.
      
      The second is a shielding the device against mistakes in the definition of
      struct fields needed by the capsule update mechanism. Instead of crashing,
      print a humna readable message of what's wrong.
      ac3428fc
    • Ilias Apalodimas's avatar
      lmb: Fix the allocation of overlapping memory areas with !LMB_NONE · 1d9aa4a2
      Ilias Apalodimas authored
      
      At the moment the LMB allocator will return 'success' immediately on two
      consecutive allocations if the second one is smaller and the flags match
      without resizing the reserved area.
      
      This is problematic for two reasons, first of all the new updated
      allocation won't update the size and we end up holding more memory than
      needed, but most importantly it breaks the EFI SCT tests since EFI
      now allocates via LMB.
      
      More specifically when EFI requests a specific address twice with the
      EFI_ALLOCATE_ADDRESS flag set, the first allocation will succeed and
      update the EFI memory map. Due to the LMB behavior the second allocation
      will also succeed but the address ranges are already in the EFI memory
      map due the first allocation. EFI will then fail to update the memory map,
      returning EFI_OUT_OF_RESOURCES instead of EFI_NOT_FOUND which break EFI
      conformance.
      
      So let's remove the fast check with is problematic anyway and leave LMB
      resize and calculate address properly. LMB will now
      - try to resize the reservations for LMB_NONE
      - return -1 if the memory is not LMB_NONE and already reserved
      
      The LMB code needs some cleanup in that part, but since we are close to
      2025.01 do the easy fix and plan to refactor it later.
      Also update the dm tests with the new behavior.
      
      Fixes: commit 22f2c9ed ("efi: memory: use the lmb API's for allocating and freeing memory")
      Signed-off-by: default avatarIlias Apalodimas <ilias.apalodimas@linaro.org>
      1d9aa4a2
    • Ilias Apalodimas's avatar
      efi_loader: Check for a valid fw_name before auto generating GUIDs · 05396fb7
      Ilias Apalodimas authored
      
      The gen_v5_guid() is a void and does no error checking with pointers
      being available etc. Instead it expects all things to be in place to
      generate GUIDs. If a board capsule definition is buggy and does not
      define the firmware names when enabling capsule updates, the board will
      crash trying to bring up the EFI subsystem.
      
      Check for a valid firmware name before generating GUIDs.
      
      Reviewed-by: Heinrich Schuchardt's avatarHeinrich Schuchardt <xypron.glpk@gmx.de>
      Signed-off-by: default avatarIlias Apalodimas <ilias.apalodimas@linaro.org>
      05396fb7
  5. Dec 04, 2024
  6. Dec 03, 2024
  7. Dec 02, 2024
    • Evgeny Bachinin's avatar
      common: relocate fdt_blob in global_data for FDTSRC_EMBED case · acab6e78
      Evgeny Bachinin authored and Tom Rini's avatar Tom Rini committed
      
      Patch resolves two kind of bugs, one of which is vulnerability related
      to KASLR.
      
      === Issue briefly ===
      
        Working with FDT (via non-relocated gd::fdt_blob) from inside bootm
      command may lead to the reading the garbage instead of FDT nodes. And
      this can result in various side-effects depending on DTS nodes, being
      parsed during bootm.
      
        But below is my specific story how I faced with this issue due to
      MESON_RNG probing failure.
      
      === Bugs description ===
      
      1) Bug is revealed on:
      * configuration below
      * U-boot 2024.10 - f919c3a8 ("Prepare v2024.10")
      
        It seems, the following patch is a trigger:
      ea955eea ("fdt: automatically add /chosen/kaslr-seed if DM_RNG is enabled")
      
        Generally, CONFIG_OF_EMBED=y & CONFIG_RNG_MESON=y are the most
      valuable ones for reproducing the issue.
      ```
        CONFIG_ARCH_FIXUP_FDT_MEMORY=y
        CONFIG_CMD_FDT=y
        CONFIG_DEFAULT_FDT_FILE=""
        CONFIG_FDT_64BIT=y
        CONFIG_OF_BOARD_SETUP=y
        CONFIG_OF_CONTROL=y
        CONFIG_OF_EMBED=y
        CONFIG_OF_LIBFDT_ASSUME_MASK=0x0
        CONFIG_OF_LIBFDT_OVERLAY=y
        CONFIG_OF_LIBFDT=y
        CONFIG_OF_LIST="meson-axg-our-device-name"
        CONFIG_OF_REAL=y
        CONFIG_OF_TRANSLATE=y
        CONFIG_SUPPORT_OF_CONTROL=y
        CONFIG_SYS_FDT_PAD=0x3000
        CONFIG_TOOLS_OF_LIBFDT=y
      
        CONFIG_DM_RNG=y
        CONFIG_RNG_MESON=y
      ```
      
      2) Due to CONFIG_OF_EMBED, the DTS is embedded into U-boot ELF and
      accessible via __dtb_dt_begin symbol.
      
        On early boot stage (board_f.c) the fdtdec_setup() is called only
      once before U-boot's relocation into top of RAM. fdtdec_setup()
      initializes gd::fdt_blob for FDTSRC_EMBED case:
      ```
        gd->fdt_blob = dtb_dt_embedded();
        gd->fdt_src = FDTSRC_EMBED;
      ```
      
      3) Then reloc_fdt() is called in board_f.c
      
        But due to CONFIG_OF_EMBED=y the reloc_fdt() does not update
      gd::fdt_blob value (strictly speaking, it is impossible for
      CONFIG_OF_EMBED=y, because U-boot ELF has not been relocated yet
      at this moment).
      
        As a result after relocation we get fdt_blob, pointing to DTS address
      before relocation:
      ```
         # bdinfo
        <...>
        relocaddr = 0x000000000fedf000
        reloc off = 0x000000000eedf000
        <...>
        fdt_blob = 0x010ce6c0 << points to __dtb_dt_begin before relocation
        new_fdt = 0x0000000000000000  << empty erroneously
        fdt_size = 0x0000000000000000 << zero erroneously
      ```
      
      4) During bootm command (according to our ITS-config file) the Linux
      is loaded into 0x01080000 (which is very close to fdt_blob addr
      0x010ce6c0).
      ```
        ## Loading kernel from FIT Image at 04000000 ...
           Trying 'kernel' kernel subimage
             <...>
             Load Address: 0x01080000
      ```
      
        So Linux image overwrites the gd::fdt_blob memory location
      in RAM (0x010ce6c0).
      
      5) Issue:
      
        Hence any manipulation with DTS (say, via FDT API) inside
      implementation of bootm command leads to accessing the fdt_blob area
      with garbage, that can lead to two situations:
      
      5.1) Abort.
      
        Call to fdt_off_dt_struct() from fdt_next_tag() :: fdt_offset_ptr()::
      fdt_offset_ptr_() returns with garbage, that leads to tagp value
      being out of RAM top addr (256 Mb in our board), causing the abort:
      ```
        Boot cmd: bootm 0x4000000#boot_evt1
        bootm_run_states()
        <...>
        image_setup_libfdt()
         fdt_chosen()
          fdt_kaslrseed()
           uclass_get_device()
            uclass_get_device_tail()
             device_probe()
              device_of_to_plat()
              meson_rng_of_to_plat()
               clk_get_by_name_optional()
                clk_get_by_name()
                 clk_get_by_name_nodev()
                  ofnode_stringlist_search()
                   fdt_stringlist_search()
                    fdt_getprop()
                     fdt_get_property_namelen_()
                      fdt_first_property_offset()
                       fdt_check_node_offset_()
                        fdt_next_tag():
                          ```
                            tagp = fdt_offset_ptr(fdt, offset, FDT_TAGSIZE);
                          ```
                        fdt_next_tag() tagp:0x22890766
                        fdt_next_tag() ram_top:0x10000000 (tagp OUT of RAM)
        "Synchronous Abort" handler, esr 0x96000010, far 0x22890766
        elr: 000000000108be24 lr : 000000000108be24 (reloc)
        elr: 000000000ff6fe24 lr : 000000000ff6fe24
        x0 : 0000000000000041 x1 : 0000000000000000
        x2 : 000000000ff3b57c x3 : 0000000000000012
        x4 : 000000000ded2ad5 x5 : 0000000000000020
        x6 : 00000000ffffffe8 x7 : 000000000ded2f40
        x8 : 00000000ffffffd8 x9 : 000000000000000d
        x10: 0000000000000006 x11: 000000000001869f
        x12: 000000000fffffff x13: 000000000fffffff
        x14: 0000000000000000 x15: 000000000ded2abb
        x16: 000000000ff3b080 x17: 0000000000000001
        x18: 000000000ded3dc0 x19: 0000000022890766
        x20: 00000000010cb0f0 x21: 00000000000015e4
        x22: 000000000ff8f4d8 x23: 000000000000000b
        x24: 000000000ded2fbc x25: 000000000ffe2000
        x22: 000000000ff8f4d8 x23: 000000000000000b
        x24: 000000000ded2fbc x25: 000000000ffe2000
        x26: 000000000ffe2000 x27: 000000000000000b
        x28: 000000000ff9cf2d x29: 000000000ded2f40
      
        Code: aa1603e1 91197484 52801742 94004de8 (b9400276)
      ```
      
      5.2) Vulnerability situation "KASLR is disabled".
      
      Almost the same as in (5.1), but 2 situations happen (depending on
      the value of garbage):
        * call to fdt_offset_ptr_() :: fdt_off_dt_struct(fdt)
          returns not so big garbage, leading to tagp, being inside RAM.
        * or calculations of absoffset inside fdt_offset_ptr() leads to
          failure of the one of if() conditions with NULL as retval.
      
        Result is fdt_next_tag() interprets the tagp as FDT_END. And we are
      returning from our callstack via functions' error paths, leading to
      "No RNG device" and "KASLR disabled due to lack of seed":
      ```
        fdt_kaslrseed()
         uclass_get_device()
         <...>
          device_probe()
           device_of_to_plat()
            meson_rng_of_to_plat()
             clk_get_by_name()
              clk_get_by_name_nodev()
              <...>
               fdt_stringlist_search()
                fdt_getprop()
                 fdt_get_property_namelen_()
                  fdt_first_property_offset()
                   fdt_check_node_offset_()
                    fdt_next_tag():
                      ```
                        tagp = fdt_offset_ptr(fdt, offset, FDT_TAGSIZE);
                      ```
                    fdt_next_tag() tagp:0000000001890677
                    fdt_next_tag() ram_top:0x10000000 (tagp is inside RAM)
            uclass_get_device_tail():486 device_probe() ret:-22
        No RNG device
       Starting kernel ...
      
        [ 0.000000] Linux version 6.9.12
        [ 0.000000] KASLR disabled due to lack of seed
      ```
      
      Signed-off-by: default avatarEvgeny Bachinin <EABachinin@salutedevices.com>
      acab6e78
    • Simon Glass's avatar
      Revert "global_data: Drop spl_handoff" · 924a5e4e
      Simon Glass authored and Tom Rini's avatar Tom Rini committed
      
      This breaks chromebook_coral which says:
      
         Video: No video mode configured in FSP!
      
      This reverts commit 2e931317.
      
      Signed-off-by: Simon Glass's avatarSimon Glass <sjg@chromium.org>
      924a5e4e
    • Simon Glass's avatar
      binman: Avoid skipping binman_init() · 03e57244
      Simon Glass authored and Tom Rini's avatar Tom Rini committed
      
      A recent lwip change stopped binman's init from working, so it is not
      possible to read nodes from the image description anymore.
      
      Correct this by dropping the offending line.
      
      Signed-off-by: Simon Glass's avatarSimon Glass <sjg@chromium.org>
      Fixes: 4d4d7838 net: lwip: add TFTP support and tftpboot command
      03e57244
  8. Nov 30, 2024
  9. Nov 29, 2024
    • Jerome Forissier's avatar
      test/cmd/wget.c: move net_test_wget() to the cmd test suite · 20f64198
      Jerome Forissier authored and Tom Rini's avatar Tom Rini committed
      
      Since net_test_wget() is testing a command and is in test/cmd it should
      be in the 'cmd' test suite, not 'lib'.
      
      Saving and restoring the values of the environment variables that the
      test manipulates is necessary to avoid a regression when running the
      whole ut test suite. A minimal reproducer is:
      
       $ ./u-boot -T -c "ut cmd net_test_wget; ut dm dm_test_eth_act" | \
           grep -E "(Test:|Failures:)"
      
      Reported-by: Simon Glass's avatarSimon Glass <sjg@chromium.org>
      Signed-off-by: default avatarJerome Forissier <jerome.forissier@linaro.org>
      20f64198
    • Tom Rini's avatar
      Revert "arm64: dts: ti: k3-j7200: Fix OSPI boot" · 6ceb8618
      Tom Rini authored
      
      While I had thought this commit was a cherry-pick from upstream, it is
      not. And so, this is not allowed here.
      
      This reverts commit dfe5f16a.
      
      Signed-off-by: default avatarTom Rini <trini@konsulko.com>
      6ceb8618
    • Marek Vasut's avatar
      ARM: dts: imx: Enable PCIe and NVMe on Data Modul i.MX8M Mini eDM SBC · 4835efca
      Marek Vasut authored
      
      Enable PCIe/NVMe support on Data Modul i.MX8M Mini eDM SBC. Except for
      the configuration options which are enabled, add slight adjustment
      to board u-boot.dtsi, which is necessary as there is currently no
      driver for the I2C PCIe clock generator. Since the generator is
      strapped to be always on, it is possible to supplant the generator
      functionality by fixed-clock.
      
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      4835efca
    • Marek Vasut's avatar
      ARM: imx: Replace YModem with SDP on Data Modul i.MX8M Mini eDM SBC SPL · 0b97a394
      Marek Vasut authored
      
      The YModem support in SPL was never really used on this device,
      the SDP support is much more convenient on i.MX8M Mini based
      hardware. Replace the YModem support with SDP support.
      
      The SDP can be utilized by forcing the board into SDP boot mode
      by grounding test point right next to silkscreen label U30, and
      then by using mfgtools 'uuu -brun spl flash.bin' once the device
      enumerates on host system USB bus. The SDP capable USB port is
      available on the USB micro-B port on the base board.
      
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      Reviewed-by: Peng Fan's avatarPeng Fan <peng.fan@nxp.com>
      0b97a394
    • Marek Vasut's avatar
      ARM: imx: Deduplicate Data Modul i.MX8M eDM SBC defconfigs · 3a689038
      Marek Vasut authored
      
      Deduplicate defconfigs for all Data Modul i.MX8M eDM SBC systems by factoring
      out the common parts into generic imx8m_data_modul.config and including
      those using the #include <configs/...> preprocessor macro in the current
      set of board specific defconfigs. The preprocessor macro is applicable
      to defconfigs as well.
      
      This introduces no functional change, the resulting .config is almost
      identical for all Data Modul i.MX8M eDM SBC systems, except for slight
      alignment in DEBUG_UART and SYS_PBSIZE.
      
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      3a689038
    • Marek Vasut's avatar
      ARM: imx: Perform plain boot in altbootcmd on Data Modul i.MX8M Mini/Plus eDM SBC · ec3e5fa5
      Marek Vasut authored
      
      The current A/B switching preparatory altbootcmd is confusing
      to users, replace it with plain 'run bootcmd' which can be
      replaced by proper A/B switching altbootcmd when the matching
      updater is added on top of the platform. By default, keep the
      boot counter incrementing, but do not do any A/B partition
      switching.
      
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      ec3e5fa5
    • Marek Vasut's avatar
      ARM: dts: imx: Pick safe DRAM size on failure on Data Modul i.MX8M Mini/Plus eDM SBC · 1171adfd
      Marek Vasut authored
      
      In case gpio_request_list_by_name_nodev() in board dmo_get_memcfg()
      returns error code, pick a safe default DRAM configuration instead
      of bailing out with some sort of hang() or panic(). The BIT(2)|BIT(0)
      strap option is the lowest known option of 2 GiB , use that.
      
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      1171adfd
    • Marek Vasut's avatar
      ARM: dts: imx: Make DRAM coding GPIOs available before relocation on Data... · 6e18eec9
      Marek Vasut authored
      ARM: dts: imx: Make DRAM coding GPIOs available before relocation on Data Modul i.MX8M Mini/Plus eDM SBC
      
      The DRAM configuration GPIO straps must be accessible in SPL and before
      relocation because the GPIOs are sampled both in U-Boot SPL as well as early
      on in U-Boot proper. The already present bootph-pre-ram DT property made the
      GPIO controllers available in SPL, but not early on in U-Boot proper, which
      made gpio_request_list_by_name_nodev() in board dmo_get_memcfg() fail. Add
      missing bootph-some-ram DT property to all GPIO controllers which are
      referenced in dmo,ram-coding-gpios DT property to make those GPIO
      controllers available early in U-Boot proper as well.
      
      Fixes: 8c103c33 ("dm: dts: Convert driver model tags to use new schema")
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      6e18eec9
  10. Nov 27, 2024
Loading