October 2016 - U-Boot

[U-Boot] [PATCH] efi_loader: Allow bouncing for network
by Alexander Graf 13 Oct '16

13 Oct '16

So far bounce buffers were only used for disk I/O, but network I/O may suffer from the same problem. On platforms that have problems doing DMA on high addresses, let's also bounce outgoing network packets. Incoming ones always already get bounced. This patch fixes EFI PXE boot on ZynqMP for me. Signed-off-by: Alexander Graf <agraf(a)suse.de> --- lib/efi_loader/efi_net.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lib/efi_loader/efi_net.c b/lib/efi_loader/efi_net.c index dd3b485..6a8a0d7 100644 --- a/lib/efi_loader/efi_net.c +++ b/lib/efi_loader/efi_net.c @@ -152,7 +152,14 @@ static efi_status_t EFIAPI efi_net_transmit(struct efi_simple_network *this, return EFI_EXIT(EFI_INVALID_PARAMETER); } +#ifdef CONFIG_EFI_LOADER_BOUNCE_BUFFER + /* Ethernet packets always fit, just bounce */ + memcpy(efi_bounce_buffer, buffer, buffer_size); + net_send_packet(efi_bounce_buffer, buffer_size); +#else net_send_packet(buffer, buffer_size); +#endif + new_tx_packet = buffer; return EFI_EXIT(EFI_SUCCESS); -- 1.8.5.6

1 1

[U-Boot] [PATCH v3 5/7] efi_loader: Readd freed pages to memory pool
by Stefan Brüns 13 Oct '16

13 Oct '16

Currently each allocation creates a new mapping. Readding the mapping as free memory (EFI_CONVENTIONAL_MEMORY) potentially allows to hand out an existing mapping, thus limiting the number of mapping descriptors in the memory map. Mitigates a problem with current (4.8rc7) linux kernels when doing an efi_get_memory map, resulting in an infinite loop. Space for the memory map is reserved with allocate_pool (implicitly creating a new mapping) and filled. If there is insufficient slack space (8 entries) in the map, the space is freed and a new round is started, with space for one more entry. As each round increases requirement and allocation by exactly one, there is never enough slack space. (At least 32 entries are allocated, so as long as there are less than 24 entries, there is enough slack). Earlier kernels reserved no slack, and did less allocations, so this problem was not visible. Signed-off-by: Stefan Brüns <stefan.bruens(a)rwth-aachen.de> Reviewed-by: Alexander Graf <agraf(a)suse.de> --- include/efi_loader.h | 2 +- lib/efi_loader/efi_memory.c | 11 +++++++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/include/efi_loader.h b/include/efi_loader.h index 341d4a4..6d64f4b 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -117,7 +117,7 @@ void *efi_alloc(uint64_t len, int memory_type); /* More specific EFI memory allocator, called by EFI payloads */ efi_status_t efi_allocate_pages(int type, int memory_type, unsigned long pages, uint64_t *memory); -/* EFI memory free function. Not implemented today */ +/* EFI memory free function. */ efi_status_t efi_free_pages(uint64_t memory, unsigned long pages); /* EFI memory allocator for small allocations, called by EFI payloads */ efi_status_t efi_allocate_pool(int pool_type, unsigned long size, diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c index fa5c639..7051948 100644 --- a/lib/efi_loader/efi_memory.c +++ b/lib/efi_loader/efi_memory.c @@ -335,8 +335,15 @@ void *efi_alloc(uint64_t len, int memory_type) efi_status_t efi_free_pages(uint64_t memory, unsigned long pages) { - /* We don't free, let's cross our fingers we have plenty RAM */ - return EFI_SUCCESS; + uint64_t r = 0; + + r = efi_add_memory_map(memory, pages, EFI_CONVENTIONAL_MEMORY, false); + /* Merging of adjacent free regions is missing */ + + if (r == memory) + return EFI_SUCCESS; + + return EFI_NOT_FOUND; } efi_status_t efi_allocate_pool(int pool_type, unsigned long size, -- 2.10.0

2 1

[U-Boot] [PATCH v4 4/7] efi_loader: Track size of pool allocations to allow freeing
by Stefan Brüns 13 Oct '16

13 Oct '16

We need a functional free_pool implementation, as otherwise each allocate_pool causes growth of the memory descriptor table. Different to free_pages, free_pool does not provide the size for the to be freed allocation, thus we have to track the size ourselves. As the only EFI requirement for pool allocation is an alignment of 8 bytes, we can keep allocating a range using the page allocator, reserve the first 8 bytes for our bookkeeping and hand out the remainder to the caller. This saves us from having to use any independent data structures for tracking. To simplify the conversion between pool allocations and the corresponding page allocation, we create an auxiliary struct efi_pool_allocation. Given the allocation size free_pool size can handoff freeing the page range, which was indirectly allocated by a call to allocate_pool, to free_pages. Signed-off-by: Stefan Brüns <stefan.bruens(a)rwth-aachen.de> --- include/efi_loader.h | 2 ++ lib/efi_loader/efi_boottime.c | 6 +++--- lib/efi_loader/efi_memory.c | 42 +++++++++++++++++++++++++++++++++++++++--- 3 files changed, 44 insertions(+), 6 deletions(-) diff --git a/include/efi_loader.h b/include/efi_loader.h index f0473ab..3dad24e 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -122,6 +122,8 @@ efi_status_t efi_free_pages(uint64_t memory, unsigned long pages); /* EFI memory allocator for small allocations */ efi_status_t efi_allocate_pool(int pool_type, unsigned long size, void **buffer); +/* EFI pool memory free function. */ +efi_status_t efi_free_pool(void *buffer); /* Returns the EFI memory map */ efi_status_t efi_get_memory_map(unsigned long *memory_map_size, struct efi_mem_desc *memory_map, diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c index eb74cb0..8274d8e 100644 --- a/lib/efi_loader/efi_boottime.c +++ b/lib/efi_loader/efi_boottime.c @@ -141,12 +141,12 @@ static efi_status_t EFIAPI efi_allocate_pool_ext(int pool_type, return EFI_EXIT(r); } -static efi_status_t EFIAPI efi_free_pool(void *buffer) +static efi_status_t EFIAPI efi_free_pool_ext(void *buffer) { efi_status_t r; EFI_ENTRY("%p", buffer); - r = efi_free_pages((ulong)buffer, 0); + r = efi_free_pool(buffer); return EFI_EXIT(r); } @@ -736,7 +736,7 @@ static const struct efi_boot_services efi_boot_services = { .free_pages = efi_free_pages_ext, .get_memory_map = efi_get_memory_map_ext, .allocate_pool = efi_allocate_pool_ext, - .free_pool = efi_free_pool, + .free_pool = efi_free_pool_ext, .create_event = efi_create_event, .set_timer = efi_set_timer, .wait_for_event = efi_wait_for_event, diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c index be642f1..de28db6 100644 --- a/lib/efi_loader/efi_memory.c +++ b/lib/efi_loader/efi_memory.c @@ -34,6 +34,19 @@ void *efi_bounce_buffer; #endif /* + * U-Boot services each EFI AllocatePool request as a separate + * (multiple) page allocation. We have to track the number of pages + * to be able to free the correct amount later. + * EFI requires 8 byte alignment for pool allocations, so we can + * prepend each allocation with an 64 bit header tracking the + * allocation size, and hand out the remainder to the caller. + */ +struct efi_pool_allocation { + u64 num_pages; + char data[]; +}; + +/* * Sorts the memory list from highest address to lowest address * * When allocating memory we should always start from the highest @@ -332,11 +345,34 @@ efi_status_t efi_allocate_pool(int pool_type, unsigned long size, { efi_status_t r; efi_physical_addr_t t; - u64 num_pages = (size + EFI_PAGE_MASK) >> EFI_PAGE_SHIFT; + u64 num_pages = (size + sizeof(u64) + EFI_PAGE_MASK) >> EFI_PAGE_SHIFT; + + if (size == 0) { + *buffer = NULL; + return EFI_SUCCESS; + } r = efi_allocate_pages(0, pool_type, num_pages, &t); - if (r == EFI_SUCCESS) - *buffer = (void *)(uintptr_t)t; + + if (r == EFI_SUCCESS) { + struct efi_pool_allocation *alloc = (void *)(uintptr_t)t; + alloc->num_pages = num_pages; + *buffer = alloc->data; + } + + return r; +} + +efi_status_t efi_free_pool(void *buffer) +{ + efi_status_t r; + struct efi_pool_allocation *alloc; + + alloc = container_of(buffer, struct efi_pool_allocation, data); + /* Sanity check, was the supplied address returned by allocate_pool */ + assert(((uintptr_t)alloc & EFI_PAGE_MASK) == 0); + + r = efi_free_pages((uintptr_t)alloc, alloc->num_pages); return r; } -- 2.10.0

2 2

[U-Boot] [PATCH] efi_loader: Fix crash on 32-bit systems
by Robin Randhawa 13 Oct '16

13 Oct '16

A type mismatch in the efi_allocate_pool boot service flow causes hazardous memory scribbling on 32-bit systems. This is efi_allocate_pool's prototype: static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size, void **buffer); Internally, it invokes efi_allocate_pages as follows: efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer); This is efi_allocate_pages' prototype: efi_status_t efi_allocate_pages(int type, int memory_type, unsigned long pages, uint64_t *memory); The problem: efi_allocate_pages does this internally: *memory = addr; This fix in efi_allocate_pool uses a transitional uintptr_t cast to ensure the correct outcome, irrespective of the system's native word size. This was observed when bootefi'ing the EFI instance of FreeBSD's first stage bootstrap (boot1.efi) on a 32-bit ARM platform (Qemu VExpress + Cortex-a9). Signed-off-by: Robin Randhawa <robin.randhawa(a)arm.com> --- lib/efi_loader/efi_boottime.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c index be6f5e8..784891b 100644 --- a/lib/efi_loader/efi_boottime.c +++ b/lib/efi_loader/efi_boottime.c @@ -134,9 +134,11 @@ static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size, void **buffer) { efi_status_t r; + efi_physical_addr_t t; EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer); - r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, (void*)buffer); + r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, &t); + *buffer = (void *)(uintptr_t)t; return EFI_EXIT(r); } -- 2.9.0

2 3

[U-Boot] [PATCH v4 3/7] efi_loader: Move efi_allocate_pool implementation to efi_memory.c
by Stefan Brüns 13 Oct '16

13 Oct '16

We currently handle efi_allocate_pool() in our boot time service file. In the following patch, pool allocation will receive additional internal semantics that we should preserve inside efi_memory.c instead. As foundation for those changes, split the function into an externally facing efi_allocate_pool_ext() for use by payloads and an internal helper efi_allocate_pool() in efi_memory.c that handles the actual allocation. While at it, change the magic 0xfff / 12 constants to the more obvious EFI_PAGE_MASK/SHIFT defines. Signed-off-by: Stefan Brüns <stefan.bruens(a)rwth-aachen.de> --- include/efi_loader.h | 3 +++ lib/efi_loader/efi_boottime.c | 11 +++++------ lib/efi_loader/efi_memory.c | 14 ++++++++++++++ 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/include/efi_loader.h b/include/efi_loader.h index 9738835..f0473ab 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -119,6 +119,9 @@ efi_status_t efi_allocate_pages(int type, int memory_type, unsigned long pages, uint64_t *memory); /* EFI memory free function. Not implemented today */ efi_status_t efi_free_pages(uint64_t memory, unsigned long pages); +/* EFI memory allocator for small allocations */ +efi_status_t efi_allocate_pool(int pool_type, unsigned long size, + void **buffer); /* Returns the EFI memory map */ efi_status_t efi_get_memory_map(unsigned long *memory_map_size, struct efi_mem_desc *memory_map, diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c index 784891b..eb74cb0 100644 --- a/lib/efi_loader/efi_boottime.c +++ b/lib/efi_loader/efi_boottime.c @@ -130,15 +130,14 @@ efi_status_t EFIAPI efi_get_memory_map_ext(unsigned long *memory_map_size, return EFI_EXIT(r); } -static efi_status_t EFIAPI efi_allocate_pool(int pool_type, unsigned long size, - void **buffer) +static efi_status_t EFIAPI efi_allocate_pool_ext(int pool_type, + unsigned long size, + void **buffer) { efi_status_t r; - efi_physical_addr_t t; EFI_ENTRY("%d, %ld, %p", pool_type, size, buffer); - r = efi_allocate_pages(0, pool_type, (size + 0xfff) >> 12, &t); - *buffer = (void *)(uintptr_t)t; + r = efi_allocate_pool(pool_type, size, buffer); return EFI_EXIT(r); } @@ -736,7 +735,7 @@ static const struct efi_boot_services efi_boot_services = { .allocate_pages = efi_allocate_pages_ext, .free_pages = efi_free_pages_ext, .get_memory_map = efi_get_memory_map_ext, - .allocate_pool = efi_allocate_pool, + .allocate_pool = efi_allocate_pool_ext, .free_pool = efi_free_pool, .create_event = efi_create_event, .set_timer = efi_set_timer, diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c index 1d23783..be642f1 100644 --- a/lib/efi_loader/efi_memory.c +++ b/lib/efi_loader/efi_memory.c @@ -327,6 +327,20 @@ efi_status_t efi_free_pages(uint64_t memory, unsigned long pages) return EFI_SUCCESS; } +efi_status_t efi_allocate_pool(int pool_type, unsigned long size, + void **buffer) +{ + efi_status_t r; + efi_physical_addr_t t; + u64 num_pages = (size + EFI_PAGE_MASK) >> EFI_PAGE_SHIFT; + + r = efi_allocate_pages(0, pool_type, num_pages, &t); + if (r == EFI_SUCCESS) + *buffer = (void *)(uintptr_t)t; + + return r; +} + efi_status_t efi_get_memory_map(unsigned long *memory_map_size, struct efi_mem_desc *memory_map, unsigned long *map_key, -- 2.10.0

2 2

[U-Boot] [PATCH v4 2/7] efi_loader: Fix memory map size check to avoid out-of-bounds access
by Stefan Brüns 13 Oct '16

13 Oct '16

The current efi_get_memory_map() function overwrites the map_size property before reading its value. That way the sanity check whether our memory map fits into the given array always succeeds, potentially overwriting arbitrary payload memory. This patch moves the property update write after its sanity check, so that the check actually verifies the correct value. So far this has not triggered any known bugs, but we're better off safe than sorry. If the buffer is to small, the returned memory_map_size indicates the required size to the caller. Signed-off-by: Stefan Brüns <stefan.bruens(a)rwth-aachen.de> --- lib/efi_loader/efi_memory.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c index ebe8e94..1d23783 100644 --- a/lib/efi_loader/efi_memory.c +++ b/lib/efi_loader/efi_memory.c @@ -336,6 +336,7 @@ efi_status_t efi_get_memory_map(unsigned long *memory_map_size, ulong map_size = 0; int map_entries = 0; struct list_head *lhandle; + unsigned long provided_map_size = *memory_map_size; list_for_each(lhandle, &efi_mem) map_entries++; @@ -350,7 +351,7 @@ efi_status_t efi_get_memory_map(unsigned long *memory_map_size, if (descriptor_version) *descriptor_version = EFI_MEMORY_DESCRIPTOR_VERSION; - if (*memory_map_size < map_size) + if (provided_map_size < map_size) return EFI_BUFFER_TOO_SMALL; /* Copy list into array */ -- 2.10.0

2 2

[U-Boot] [PATCH v3 6/7] efi_loader: Keep memory mapping sorted when splitting an entry
by Stefan Brüns 13 Oct '16

13 Oct '16

The code assumes sorted mappings in descending address order. When splitting a mapping, insert the new part next to the current mapping. Signed-off-by: Stefan Brüns <stefan.bruens(a)rwth-aachen.de> Reviewed-by: Alexander Graf <agraf(a)suse.de> --- lib/efi_loader/efi_memory.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c index 7051948..2bbf8eb 100644 --- a/lib/efi_loader/efi_memory.c +++ b/lib/efi_loader/efi_memory.c @@ -134,7 +134,8 @@ static int efi_mem_carve_out(struct efi_mem_list *map, newmap->desc = map->desc; newmap->desc.physical_start = carve_start; newmap->desc.num_pages = (map_end - carve_start) >> EFI_PAGE_SHIFT; - list_add_tail(&newmap->link, &efi_mem); + /* Insert before current entry (descending address order) */ + list_add_tail(&newmap->link, &map->link); /* Shrink the map to [ map_start ... carve_start ] */ map_desc->num_pages = (carve_start - map_start) >> EFI_PAGE_SHIFT; -- 2.10.0

2 1

[U-Boot] [PATCH 0/3] ext4: cleanup/fix unlink_filename function
by Stefan Brüns 13 Oct '16

13 Oct '16

This patch series addresses Coverity defects CID 153383/153384. The first patch is a preparation patch, the second addresses the actual issue. The last patch corrects the journal handling in the same function. Stefan Brüns (3): ext4: cleanup unlink_filename function ext4: Fix handling of direntlen in unlink_filename ext4: Only write journal entries for modified blocks in unlink_filename fs/ext4/ext4_common.c | 87 +++++++++++++++++++++++---------------------------- 1 file changed, 40 insertions(+), 47 deletions(-) -- 2.10.0

2 1

[U-Boot] [PATCH v2 0/6] imx6: icorem6: Add framebuffer support
by Jagan Teki 13 Oct '16

13 Oct '16

4 11

[U-Boot] Passing numeric values via fdt
by Gary Thomas 13 Oct '16

13 Oct '16

I have a device tree property which in the .dts looks like this: prop = <1>; I'd like to be able to pass a 0 or 1 to this property via the 'fdt set' command, but it seems to only be able to push a string into the field, which in turn is always interpreted as 0. How can I push a numeric '1' to my property? Do I have to change it to be a string and force my driver to manage those instead of numeric values? Thanks -- ------------------------------------------------------------ Gary Thomas | Consulting for the MLB Associates | Embedded world ------------------------------------------------------------

2 2