December 2018 - U-Boot

[U-Boot] [PATCH v6 0/9] Fix CVE-2018-18440 and CVE-2018-18439
by Simon Goldschmidt 14 Jan '19

14 Jan '19

This series fixes CVE-2018-18440 ("insufficient boundary checks in filesystem image load") by adding restrictions to the 'load' command and fixes CVE-2018-18439 ("insufficient boundary checks in network image boot") by adding restrictions to the tftp code. The functions from lmb.c are used to setup regions of allowed and reserved memory. Then, the file size to load is checked against these addresses and loading the file is aborted if it would overwrite reserved memory. The memory reservation code is reused from bootm/image. Changes in v6: - fix size of allocated regions that need alignment padding - fix compiling without OF_CONTROL - fixed NULL pointer access in 'fdt_blob' passed to 'boot_fdt_add_mem_rsv_regions' Changes in v5: - added tests for lib/lmb.c - fixed bug in lmb.c when ram is at the end of 32-bit address range - fixed a bug in lmb_alloc_addr when resulting reserved ranges get combined Changes in v4: - fixed invalid 'if' statement without braces in boot_fdt_reserve_region - removed patch 7 ("net: remove CONFIG_MCAST_TFTP), adapted patch 8 Changes in v3: - No patch changes, but needed to resend since patman added too many cc addresses that gmail seemed to detect as spam :-( Changes in v2: - added code to reserve devicetree reserved-memory in lmb - added tftp fixes (patches 7 and 8) - fixed a bug in new function lmb_alloc_addr Simon Goldschmidt (9): test: add test for lib/lmb.c lmb: fix allocation at end of address range lib: lmb: reserving overlapping regions should fail fdt: parse "reserved-memory" for memory reservation lib: lmb: extend lmb for checks at load time fs: prevent overwriting reserved memory bootm: use new common function lmb_init_and_reserve lmb: remove unused extern declaration tftp: prevent overwriting reserved memory common/bootm.c | 8 +- common/image-fdt.c | 53 +++- fs/fs.c | 56 ++++- include/lmb.h | 7 +- lib/Makefile | 1 + lib/lmb.c | 106 ++++++-- net/tftp.c | 66 ++++- test/lib/Makefile | 1 + test/lib/lmb.c | 600 +++++++++++++++++++++++++++++++++++++++++++++ 9 files changed, 846 insertions(+), 52 deletions(-) create mode 100644 test/lib/lmb.c -- 2.17.1

3 16

[U-Boot] [PATCH v2] mmc: fsl_esdhc: Avoid infinite loop in esdhc_send_cmd_common()
by Fabio Estevam 14 Jan '19

14 Jan '19

The following hang is observed on a Hummingboard 2 MicroSOM i2eX iMX6D - rev 1.3 with no eMMC populated on board: U-Boot SPL 2018.11+gf6206f8587 (Nov 16 2018 - 00:56:34 +0000) Trying to boot from MMC1 U-Boot 2018.11+gf6206f8587 (Nov 16 2018 - 00:56:34 +0000) CPU: Freescale i.MX6D rev1.5 996 MHz (running at 792 MHz) CPU: Extended Commercial temperature grade (-20C to 105C) at 33C Reset cause: POR Board: MX6 HummingBoard2 DRAM: 1 GiB MMC: FSL_SDHC: 0, FSL_SDHC: 1 Loading Environment from MMC... *** Warning - bad CRC, using default environment No panel detected: default to HDMI Display: HDMI (1024x768) In: serial Out: serial Err: serial ---> hangs which is caused by the following infinite loop inside esdhc_send_cmd_common() while (!(esdhc_read32(&regs->irqstat) & flags)) ; Instead of looping forever, provide an exit path so that a timeout error can be propagated in the case irqstat does not report any interrupts, which may happen when no eMMC is populated on board. Reported-by: Ricardo Salveti <rsalveti(a)rsalveti.net> Signed-off-by: Fabio Estevam <festevam(a)gmail.com> --- Changes since v1: - Jump to the label out on error path (Baruch). drivers/mmc/fsl_esdhc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/fsl_esdhc.c b/drivers/mmc/fsl_esdhc.c index 3cdfa7f..b8d0b00 100644 --- a/drivers/mmc/fsl_esdhc.c +++ b/drivers/mmc/fsl_esdhc.c @@ -396,6 +396,7 @@ static int esdhc_send_cmd_common(struct fsl_esdhc_priv *priv, struct mmc *mmc, uint irqstat; u32 flags = IRQSTAT_CC | IRQSTAT_CTOE; struct fsl_esdhc *regs = priv->esdhc_regs; + unsigned long start; #ifdef CONFIG_SYS_FSL_ERRATUM_ESDHC111 if (cmd->cmdidx == MMC_CMD_STOP_TRANSMISSION) @@ -453,8 +454,13 @@ static int esdhc_send_cmd_common(struct fsl_esdhc_priv *priv, struct mmc *mmc, flags = IRQSTAT_BRR; /* Wait for the command to complete */ - while (!(esdhc_read32(&regs->irqstat) & flags)) - ; + start = get_timer(0); + while (!(esdhc_read32(&regs->irqstat) & flags)) { + if (get_timer(start) > 1000) { + err = -ETIMEDOUT; + goto out; + } + } irqstat = esdhc_read32(&regs->irqstat); -- 2.7.4

5 9

[U-Boot] [PATCH v2] imx8mq_evk_defconfig: Move file system options to Kconfig
by Fabio Estevam 14 Jan '19

14 Jan '19

Chris Spencer reports that when enabling ext4 read support without also enabling write support the following error is seen: fs/fs.c:198:12: error: 'ext4_write_file' undeclared here (not in a function); did you mean 'ext4_read_file'? .write = ext4_write_file, ^~~~~~~~~~~~~~~ Fix this problem by moving these options to Kconfig. Reported-by: Chris Spencer <spencercw(a)gmail.com> Acked-by: Peng Fan <peng.fan(a)nxp.com> Signed-off-by: Fabio Estevam <festevam(a)gmail.com> --- Changes since v1: - Added missing y to CONFIG_CMD_FAT configs/imx8mq_evk_defconfig | 5 +++++ include/configs/imx8mq_evk.h | 6 ------ 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/configs/imx8mq_evk_defconfig b/configs/imx8mq_evk_defconfig index f216d46a8f..b473fcd61b 100644 --- a/configs/imx8mq_evk_defconfig +++ b/configs/imx8mq_evk_defconfig @@ -15,6 +15,11 @@ CONFIG_SPL_LOAD_FIT=y CONFIG_SPL=y CONFIG_SPL_BOARD_INIT=y CONFIG_HUSH_PARSER=y +CONFIG_DOS_PARTITION=y +CONFIG_CMD_EXT2=y +CONFIG_CMD_EXT4=y +CONFIG_CMD_EXT4_WRITE=y +CONFIG_CMD_FAT=y CONFIG_CMD_GPIO=y CONFIG_CMD_I2C=y CONFIG_CMD_CACHE=y diff --git a/include/configs/imx8mq_evk.h b/include/configs/imx8mq_evk.h index 35f81152f2..f0430224cb 100644 --- a/include/configs/imx8mq_evk.h +++ b/include/configs/imx8mq_evk.h @@ -226,12 +226,6 @@ #define CONFIG_SYS_FSL_USDHC_NUM 2 #define CONFIG_SYS_FSL_ESDHC_ADDR 0 -#define CONFIG_DOS_PARTITION -#define CONFIG_CMD_EXT2 -#define CONFIG_CMD_EXT4 -#define CONFIG_CMD_EXT4_WRITE -#define CONFIG_CMD_FAT - #define CONFIG_SUPPORT_EMMC_BOOT /* eMMC specific */ #define CONFIG_SYS_MMC_IMG_LOAD_PART 1 -- 2.17.1

2 2

[U-Boot] [PATCH] poplar: save environment at a different offset
by Shawn Guo 14 Jan '19

14 Jan '19

From: Alex Elder <elder(a)linaro.org> Change CONFIG_ENV_OFFSET for Poplar to be 1MB further into the eMMC than before. This puts it immediately prior to the space we are reserving offset 0x200000-0x400000 for UEFI to save its persistent data. Define CONFIG_ENV_SIZE as a product of env_mmc_nblks and the sector size, like CONFIG_ENV_OFFSET is. Signed-off-by: Alex Elder <elder(a)linaro.org> Signed-off-by: Shawn Guo <shawn.guo(a)linaro.org> --- include/configs/poplar.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/configs/poplar.h b/include/configs/poplar.h index 0a126002d7f9..6b93b76ab9ba 100644 --- a/include/configs/poplar.h +++ b/include/configs/poplar.h @@ -44,7 +44,7 @@ #define CONFIG_EXTRA_ENV_SETTINGS \ "loader_mmc_blknum=0x0\0" \ "loader_mmc_nblks=0x780\0" \ - "env_mmc_blknum=0x780\0" \ + "env_mmc_blknum=0xf80\0" \ "env_mmc_nblks=0x80\0" \ "kernel_addr_r=0x30000000\0" \ "pxefile_addr_r=0x32000000\0" \ @@ -57,8 +57,8 @@ /* Command line configuration */ #define CONFIG_SYS_MMC_ENV_DEV 0 -#define CONFIG_ENV_OFFSET (0x780 * 512) /* env_mmc_blknum */ -#define CONFIG_ENV_SIZE 0x10000 /* env_mmc_nblks bytes */ +#define CONFIG_ENV_OFFSET (0xf80 * 512) /* env_mmc_blknum bytes */ +#define CONFIG_ENV_SIZE (0x80 * 512) /* env_mmc_nblks bytes */ /* Monitor Command Prompt */ #define CONFIG_SYS_CBSIZE 512 -- 2.18.0

4 3

[U-Boot] [PATCH v2 1/1] avb: add support for named persistent values
by Igor Opaniuk 14 Jan '19

14 Jan '19

AVB version 1.1 introduces support for named persistent values that must be tamper evident and allows AVB to store arbitrary key-value pairs [1]. Introduce implementation of two additional AVB operations read_persistent_value()/write_persistent_value() for retrieving/storing named persistent values. Correspondent pull request in the OP-TEE OS project repo [2]. [1]: https://android.googlesource.com/platform/external/avb/+/android-9.0.0_r22 [2]: https://github.com/OP-TEE/optee_os/pull/2699 Signed-off-by: Igor Opaniuk <igor.opaniuk(a)linaro.org> --- Changes in v2: - fix output format for avb read_pvalue/write_pvalue commands - fix issue with named value buffer size cmd/avb.c | 78 +++++++++++++++++++++++++++++ common/avb_verify.c | 122 +++++++++++++++++++++++++++++++++++++++++++++ include/tee.h | 2 + include/tee/optee_ta_avb.h | 16 ++++++ 4 files changed, 218 insertions(+) diff --git a/cmd/avb.c b/cmd/avb.c index ff00be4..8387cc7 100644 --- a/cmd/avb.c +++ b/cmd/avb.c @@ -340,6 +340,76 @@ int do_avb_is_unlocked(cmd_tbl_t *cmdtp, int flag, return CMD_RET_FAILURE; } +int do_avb_read_pvalue(cmd_tbl_t *cmdtp, int flag, int argc, + char * const argv[]) +{ + const char *name; + size_t bytes; + size_t bytes_read; + void *buffer; + + if (!avb_ops) { + printf("AVB 2.0 is not initialized, run 'avb init' first\n"); + return CMD_RET_FAILURE; + } + + if (argc != 3) + return CMD_RET_USAGE; + + name = argv[1]; + bytes = simple_strtoul(argv[2], NULL, 10); + buffer = malloc(bytes); + if (!buffer) + return CMD_RET_FAILURE; + + printf("Reading persistent value, name = %s, bytes = %ld\n", + name, bytes); + if (avb_ops->read_persistent_value(avb_ops, name, bytes, buffer, + &bytes_read) == AVB_IO_RESULT_OK) { + printf("Read %ld bytes, value = %s\n", bytes_read, + (char *)buffer); + free(buffer); + return CMD_RET_SUCCESS; + } + + printf("Failed to write in partition\n"); + + free(buffer); + + return CMD_RET_FAILURE; +} + +int do_avb_write_pvalue(cmd_tbl_t *cmdtp, int flag, int argc, + char * const argv[]) +{ + const char *name; + const char *value; + + if (!avb_ops) { + printf("AVB 2.0 is not initialized, run 'avb init' first\n"); + return CMD_RET_FAILURE; + } + + if (argc != 3) + return CMD_RET_USAGE; + + name = argv[1]; + value = argv[2]; + + printf("Writing persistent value, name = %s, value = %s\n", + name, value); + if (avb_ops->write_persistent_value(avb_ops, name, strlen(value) + 1, + (const uint8_t *)value) == + AVB_IO_RESULT_OK) { + printf("Wrote %ld bytes\n", strlen(value) + 1); + return CMD_RET_SUCCESS; + } + + printf("Failed to write persistent value\n"); + + return CMD_RET_FAILURE; +} + static cmd_tbl_t cmd_avb[] = { U_BOOT_CMD_MKENT(init, 2, 0, do_avb_init, "", ""), U_BOOT_CMD_MKENT(read_rb, 2, 0, do_avb_read_rb, "", ""), @@ -350,6 +420,10 @@ static cmd_tbl_t cmd_avb[] = { U_BOOT_CMD_MKENT(read_part_hex, 4, 0, do_avb_read_part_hex, "", ""), U_BOOT_CMD_MKENT(write_part, 5, 0, do_avb_write_part, "", ""), U_BOOT_CMD_MKENT(verify, 1, 0, do_avb_verify_part, "", ""), +#ifdef CONFIG_OPTEE_TA_AVB + U_BOOT_CMD_MKENT(read_pvalue, 3, 0, do_avb_read_pvalue, "", ""), + U_BOOT_CMD_MKENT(write_pvalue, 3, 0, do_avb_write_pvalue, "", ""), +#endif }; static int do_avb(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) @@ -384,6 +458,10 @@ U_BOOT_CMD( " partition <partname> and print to stdout\n" "avb write_part <partname> <offset> <num> <addr> - write <num> bytes to\n" " <partname> by <offset> using data from <addr>\n" +#ifdef CONFIG_OPTEE_TA_AVB + "avb read_pvalue <name> <bytes> - read a persistent value <name>\n" + "avb write_pvalue <name> <value> - write a persistent value <name>\n" +#endif "avb verify - run verification process using hash data\n" " from vbmeta structure\n" ); diff --git a/common/avb_verify.c b/common/avb_verify.c index a8c5a3e..292ad8f 100644 --- a/common/avb_verify.c +++ b/common/avb_verify.c @@ -647,6 +647,10 @@ static AvbIOResult invoke_func(struct AvbOpsData *ops_data, u32 func, return AVB_IO_RESULT_OK; case TEE_ERROR_OUT_OF_MEMORY: return AVB_IO_RESULT_ERROR_OOM; + case TEE_ERROR_STORAGE_NO_SPACE: + return AVB_IO_RESULT_ERROR_INSUFFICIENT_SPACE; + case TEE_ERROR_ITEM_NOT_FOUND: + return AVB_IO_RESULT_ERROR_NO_SUCH_VALUE; case TEE_ERROR_TARGET_DEAD: /* * The TA has paniced, close the session to reload the TA @@ -847,6 +851,120 @@ static AvbIOResult get_size_of_partition(AvbOps *ops, return AVB_IO_RESULT_OK; } +static AvbIOResult read_persistent_value(AvbOps *ops, + const char *name, + size_t buffer_size, + u8 *out_buffer, + size_t *out_num_bytes_read) +{ + AvbIOResult rc; + struct tee_shm *shm_name; + struct tee_shm *shm_buf; + struct tee_param param[2]; + struct udevice *tee; + + if (get_open_session(ops->user_data)) + return AVB_IO_RESULT_ERROR_IO; + + tee = ((struct AvbOpsData *)ops->user_data)->tee; + + rc = tee_shm_alloc(tee, strlen(name) + 1, + TEE_SHM_ALLOC, &shm_name); + if (rc) + return AVB_IO_RESULT_ERROR_OOM; + + rc = tee_shm_alloc(tee, buffer_size, + TEE_SHM_ALLOC, &shm_buf); + if (rc) { + rc = AVB_IO_RESULT_ERROR_OOM; + goto free_name; + } + + memcpy(shm_name->addr, name, strlen(name) + 1); + + memset(param, 0, sizeof(param)); + param[0].attr = TEE_PARAM_ATTR_TYPE_MEMREF_INPUT; + param[0].u.memref.shm = shm_name; + param[0].u.memref.size = strlen(name) + 1; + param[1].attr = TEE_PARAM_ATTR_TYPE_MEMREF_INOUT; + param[1].u.memref.shm = shm_buf; + param[1].u.memref.size = buffer_size; + + rc = invoke_func(ops->user_data, TA_AVB_CMD_READ_PERSIST_VALUE, + 2, param); + if (rc) + goto out; + + *out_num_bytes_read = param[1].u.memref.size; + + memcpy(out_buffer, shm_buf->addr, *out_num_bytes_read); + + return AVB_IO_RESULT_OK; + +out: + tee_shm_free(shm_buf); +free_name: + tee_shm_free(shm_name); + + return rc; +} + +static AvbIOResult write_persistent_value(AvbOps *ops, + const char *name, + size_t value_size, + const u8 *value) +{ + AvbIOResult rc; + struct tee_shm *shm_name; + struct tee_shm *shm_buf; + struct tee_param param[2]; + struct udevice *tee; + + if (get_open_session(ops->user_data)) + return AVB_IO_RESULT_ERROR_IO; + + tee = ((struct AvbOpsData *)ops->user_data)->tee; + + if (!value_size) + return AVB_IO_RESULT_ERROR_NO_SUCH_VALUE; + + rc = tee_shm_alloc(tee, strlen(name) + 1, + TEE_SHM_ALLOC, &shm_name); + if (rc) + return AVB_IO_RESULT_ERROR_OOM; + + rc = tee_shm_alloc(tee, value_size, + TEE_SHM_ALLOC, &shm_buf); + if (rc) { + rc = AVB_IO_RESULT_ERROR_OOM; + goto free_name; + } + + memcpy(shm_name->addr, name, strlen(name) + 1); + memcpy(shm_buf->addr, value, value_size); + + memset(param, 0, sizeof(param)); + param[0].attr = TEE_PARAM_ATTR_TYPE_MEMREF_INPUT; + param[0].u.memref.shm = shm_name; + param[0].u.memref.size = strlen(name) + 1; + param[1].attr = TEE_PARAM_ATTR_TYPE_MEMREF_INPUT; + param[1].u.memref.shm = shm_buf; + param[1].u.memref.size = value_size; + + rc = invoke_func(ops->user_data, TA_AVB_CMD_WRITE_PERSIST_VALUE, + 2, param); + if (rc) + goto out; + + return AVB_IO_RESULT_OK; + +out: + tee_shm_free(shm_buf); +free_name: + tee_shm_free(shm_name); + + return rc; +} /** * ============================================================================ * AVB2.0 AvbOps alloc/initialisation/free @@ -870,6 +988,10 @@ AvbOps *avb_ops_alloc(int boot_device) ops_data->ops.read_is_device_unlocked = read_is_device_unlocked; ops_data->ops.get_unique_guid_for_partition = get_unique_guid_for_partition; +#ifdef CONFIG_OPTEE_TA_AVB + ops_data->ops.write_persistent_value = write_persistent_value; + ops_data->ops.read_persistent_value = read_persistent_value; +#endif ops_data->ops.get_size_of_partition = get_size_of_partition; ops_data->mmc_dev = boot_device; diff --git a/include/tee.h b/include/tee.h index 98b1c9c..69de924 100644 --- a/include/tee.h +++ b/include/tee.h @@ -42,7 +42,9 @@ #define TEE_ERROR_COMMUNICATION 0xffff000e #define TEE_ERROR_SECURITY 0xffff000f #define TEE_ERROR_OUT_OF_MEMORY 0xffff000c +#define TEE_ERROR_OVERFLOW 0xffff300f #define TEE_ERROR_TARGET_DEAD 0xffff3024 +#define TEE_ERROR_STORAGE_NO_SPACE 0xffff3041 #define TEE_ORIGIN_COMMS 0x00000002 #define TEE_ORIGIN_TEE 0x00000003 diff --git a/include/tee/optee_ta_avb.h b/include/tee/optee_ta_avb.h index 074386a..ef84488 100644 --- a/include/tee/optee_ta_avb.h +++ b/include/tee/optee_ta_avb.h @@ -45,4 +45,20 @@ */ #define TA_AVB_CMD_WRITE_LOCK_STATE 3 +/* + * Reads a persistent value corresponding to the given name. + * + * in params[0].u.memref: persistent value name + * ioout params[1].u.memref: read persistent value buffer + */ +#define TA_AVB_CMD_READ_PERSIST_VALUE 4 + +/* + * Writes a persistent value corresponding to the given name. + * + * in params[0].u.memref: persistent value name + * in params[1].u.memref: persistent value buffer to write + */ +#define TA_AVB_CMD_WRITE_PERSIST_VALUE 5 + #endif /* __TA_AVB_H */ -- 2.7.4

3 6

[U-Boot] [PATCH v2 0/5] dm: serial: Fix up some serial API errors
by Simon Glass 12 Jan '19

12 Jan '19

New serial functions should use a driver pointer as the first argument. The old functions are only there for backwards compatibilty, and can be adjusted soon. For now, adjust the new functions to work correctly. Changes in v2: - Add a comment about reusing the device pointer - Fix @return comment on getinfo() method Simon Glass (5): serial: Move new functions to serial.h dm: serial: Adjust serial_getconfig() to use proper API dm: serial: Adjust serial_setconfig() to use proper API dm: serial: Adjust serial_getinfo() to use proper API dm: serial: Tidy up header file comments arch/x86/lib/acpi_table.c | 12 +++++++---- drivers/serial/serial-uclass.c | 27 ++++++++---------------- include/common.h | 5 ----- include/serial.h | 38 +++++++++++++++++++++++++++++++--- test/dm/serial.c | 19 ++++++++++------- 5 files changed, 63 insertions(+), 38 deletions(-) -- 2.20.1.415.g653613c723-goog

2 10

[U-Boot] [PATCH 0/3] tools: mkimage: Add Allwinner eGON support
by Andre Przywara 11 Jan '19

11 Jan '19

So far creating a bootable SPL image for Allwinner based boards uses the mksunxiboot tool. Most other platforms seemed to have integrated this kind of functionality into the common mkimage tool. Since there is nothing special about the Allwinner image in this respect, just add support for the so-called "eGON" image type into mkimage. If there was a particular reason this hasn't been done before, please let me know. This will eventually allow us to remove mksunxiboot, but I leave it around for now in case of regressions and since some people depend on it from external projects. Patch 1/3 fixes a small annoyance in mkimage -T list. Patch 2/3 adds the actually support to mkimage, patch 3/3 then switches the Makefile to use mkimage instead of mksunxiboot. I tested all 144 Allwinner boards by building each sunxi-spl.bin and comparing it against the version created using mksunxiboot (using SOURCE_DATE_EPOCH and .scmversion to create reproducible builds). All files before and after were identical. Cheers, Andre Andre Przywara (3): tools: mkimage: Add missing names for imx8mimage and loadables tools: mkimage: Add Allwinner eGON support sunxi: Use mkimage -T sunxi_egon for SPL boot image generation common/image.c | 3 ++ include/image.h | 1 + scripts/Makefile.spl | 8 +-- tools/Makefile | 1 + tools/sunxi_egon.c | 136 +++++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 145 insertions(+), 4 deletions(-) create mode 100644 tools/sunxi_egon.c -- 2.14.5

4 10

[U-Boot] SPL Platdata howto?
by Simon Goldschmidt 11 Jan '19

11 Jan '19

Hi, while searching for bytes to save in SPL in order to add FIT signature handling, I am currently trying to get socfpga-gen5 to use OF_PLATDATA. To begin, I stripped down socfpga_socrates_defconfig to absolutely nothing but serial drivers in SPL (with some modifications to the Kconfig) and enabled DEBUG_UART to see what's going on. Now while this config runs OK with a dtb (it just won't boot as drivers are missing -> "failed to boot from all boot devices"), it does not find the serial driver after enabling OF_PLATDATA. So since serial_rockchip.c already uses OF_PLATDATA and is based on ns16550 that my socfpga-gen5 platform is using: what do I have to do besides enabling OF_PLATDATA to get this working? I just seems like uclass_first_device does not find any UCLASS_SERIAL deivce when OF_PLATDATA is enabled. (And when answering this, keep in mind I need to get MMC and QSPI drivers working with OF_PLATDATA - I already fixed compiler errors in those, nothing more.) Thanks, Simon

2 10

[U-Boot] [PATCH v2] misc: fs_loader: Add support for initializing MMC
by tien.fong.chee＠intel.com 10 Jan '19

10 Jan '19

From: Tien Fong Chee <tien.fong.chee(a)intel.com> Firmware loader would encounter problem if the MMC is accessed before initializing it. This patch would adding the support of probing block device and initializing MMC before the MMC is accessed by firmware loader. Signed-off-by: Tien Fong Chee <tien.fong.chee(a)intel.com> --- Changes in v2: - Initializing MMC through probing the blk device --- drivers/misc/fs_loader.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/drivers/misc/fs_loader.c b/drivers/misc/fs_loader.c index 57a14a3..5858073 100644 --- a/drivers/misc/fs_loader.c +++ b/drivers/misc/fs_loader.c @@ -12,6 +12,7 @@ #include <linux/string.h> #include <mapmem.h> #include <malloc.h> +#include <mmc.h> #include <spl.h> DECLARE_GLOBAL_DATA_PTR; @@ -252,6 +253,38 @@ static int fs_loader_ofdata_to_platdata(struct udevice *dev) static int fs_loader_probe(struct udevice *dev) { +#if defined(CONFIG_DM_MMC) && defined(CONFIG_BLK) + int ret; + struct device_platdata *plat = dev->platdata; + + ret = mmc_initialize(NULL); + if (ret) { + debug("MMC: could not initialize mmc. error: %d\n", ret); + + return ret; + } + + if (plat->phandlepart.phandle) { + ofnode node = ofnode_get_by_phandle(plat->phandlepart.phandle); + + struct udevice *mmc_dev = NULL; + + ret = device_get_global_by_ofnode(node, &mmc_dev); + if (!ret) { + struct mmc *mmc = mmc_get_mmc_dev(mmc_dev); + struct udevice *dev; + + ret = blk_get_from_parent(mmc->dev, &dev); + if (ret) { + debug("MMC: No block device: %d\n", + ret); + + return ret; + } + } + } +#endif + return 0; }; -- 2.2.0

3 4

[U-Boot] Issue with memcpy when booting a fitImage on SPEAr600
by Quentin Schulz 10 Jan '19

10 Jan '19

Hello everyone, I'm working on porting a mainline U-Boot on a custom board based on a SPEAr600. Right now, I'm facing an issue related with fitImage booting. Before starting on the fitImage issue, let me state that the zImage and the custom DTB concatenated in a uImage have the load address and entry point be respectively 0x0200.0000 and 0x0200.0040. The fitImage load and entry are both 0x0200.0000. The uImage loaded at the address 0x0080.0000 is booted fine by U-Boot, the fitImage at the same address, not. The datasheet of the SoC states that the external SDRAM is located between 0x0000.0000 and 0x3fff.ffff. The size of the fitImage is currently 0x0038.9484 bytes, the uImage 0x0038.9007. The fitImage booting abruptly stops right after "Loading Device Tree to 0778a000, end 0778e7d6 ... OK" with the following trace: "prefetch abort pc : [<f188af44>] lr : [<07fca8c7>] reloc pc : [<ed7f8f44>] lr : [<03f388c7>] sp : 0778fb78 ip : fffc4c98 fp : 03f00020 r10: deadbeef r9 : 0778ff00 r8 : 07f922a0 r7 : 00ff0000 r6 : 000047d7 r5 : 00004700 r4 : 0778a1b8 r3 : 00000008 r2 : 000016c4 r1 : 0778a1b8 r0 : 0778a1b8 Flags: nZCv IRQs off FIQs off Mode SVC_32 Code: data abort pc : [<07f931c6>] lr : [<07fb2dd1>] reloc pc : [<03f011c6>] lr : [<03f20dd1>] sp : 0778fa80 ip : 00000114 fp : 03f00020 r10: deadbeef r9 : 0778ff00 r8 : 07f922a0 r7 : 60000000 r6 : 00000698 r5 : f188af44 r4 : fffffffc r3 : fffffff0 r2 : 0778ff00 r1 : 00000020 r0 : 00000006 Flags: NzCv IRQs on FIQs on Mode SVC_32 Code: 23036be5 439d4818 f885f038 42642404 (595a00a3) Resetting CPU ... resetting ... System is going to reboot ..." I've narrowed down the issue to a memmove being called with destination pointer being the source pointer. If I print a debug message before and after this memcpy[1], the first debug message is printed but not the second one. If I add a condition for (dest == src) return dest in the very beginning of memmove, the fitImage boots just fine. This test seemed to have been removed by commit cb0eae8cf8aaca76910dee4c7eb536d0814d1bd2[12], and by reverting this commit, I was able to successfuly boot Linux with a fitImage. Here is the log without debug messages WITHOUT the dest == src check in memmove: U-Boot 2018.11-00007-g0b16f8424a-dirty (Dec 05 2018 - 09:23:31 +0100)-SPEAr CPU: SPEAr600 DRAM: 128 MiB Flash: 512 KiB NAND: 128 MiB Loading Environment from Flash... OK Net: dwmac.e0800000 Hit SPACE in 3 seconds to stop autoboot. => dhcp; tftp fitImage; bootm Speed: 100, full duplex BOOTP broadcast 1 DHCP client bound to address 192.168.0.169 (3 ms) Speed: 100, full duplex Using dwmac.e0800000 device TFTP from server 192.168.0.13; our IP address is 192.168.0.169 Filename 'fitImage'. Load address: 0x800000 Loading: ################################################################# ################################################################# ################################################################# ########################################################## 5.5 MiB/s done Bytes transferred = 3708036 (389484 hex) ## Loading kernel from FIT Image at 00800000 ... Using 'conf@default' configuration Trying 'kernel@0' kernel subimage Description: Linux Type: Kernel Image Compression: uncompressed Data Start: 0x008000b0 Data Size: 3700720 Bytes = 3.5 MiB Architecture: ARM OS: Linux Load Address: 0x02000000 Entry Point: 0x02000000 Hash algo: sha1 Hash value: efe249f573647bad3ce87c9c4b244986a90234db ## Loading fdt from FIT Image at 00800000 ... Using 'conf@default' configuration Trying 'fdt@0' fdt subimage Description: Device Tree Type: Flat Device Tree Compression: uncompressed Data Start: 0x00b87984 Data Size: 6103 Bytes = 6 KiB Architecture: ARM Hash algo: sha1 Hash value: 53089fa031e727f094e6bf9ad4e93f4e95b7fba3 Booting using the fdt blob at 0xb87984 Loading Kernel Image ... OK Loading Device Tree to 0778a000, end 0778e7d6 ... OK prefetch abort pc : [<f188af44>] lr : [<07fca8c7>] reloc pc : [<ed7f8f44>] lr : [<03f388c7>] sp : 0778fb78 ip : fffc4c98 fp : 03f00020 r10: deadbeef r9 : 0778ff00 r8 : 07f922a0 r7 : 00ff0000 r6 : 000047d7 r5 : 00004700 r4 : 0778a1b8 r3 : 00000008 r2 : 000016c4 r1 : 0778a1b8 r0 : 0778a1b8 Flags: nZCv IRQs off FIQs off Mode SVC_32 Code: data abort pc : [<07f931c6>] lr : [<07fb2dd1>] reloc pc : [<03f011c6>] lr : [<03f20dd1>] sp : 0778fa80 ip : 00000114 fp : 03f00020 r10: deadbeef r9 : 0778ff00 r8 : 07f922a0 r7 : 60000000 r6 : 00000698 r5 : f188af44 r4 : fffffffc r3 : fffffff0 r2 : 0778ff00 r1 : 00000020 r0 : 00000006 Flags: NzCv IRQs on FIQs on Mode SVC_32 Code: 23036be5 439d4818 f885f038 42642404 (595a00a3) Resetting CPU ... resetting ... System is going to reboot ... With debug messages (_DEBUG = 1 and a few printf("%s: %d\n", __func__, __LINE__);): => dhcp; tftp fitImage; bootm Trying dwmac.e0800000 Speed: 100, full duplex BOOTP broadcast 1 DHCPHandler: got packet: (src=67, dst=68, len=300) state: 3 Filtering pkt = 0 DHCPHandler: got DHCP packet: (src=67, dst=68, len=300) state: 3 DHCP: state=SELECTING bp_file: "" TRANSITIONING TO REQUESTING STATE dhcp_send_request_packet: Sending DHCPREQUEST Transmitting DHCPREQUEST packet: len = 342 DHCPHandler: got packet: (src=67, dst=68, len=300) state: 4 Filtering pkt = 0 DHCPHandler: got DHCP packet: (src=67, dst=68, len=300) state: 4 DHCP State: REQUESTING net_boot_file_name: DHCP client bound to address 192.168.0.169 (21 ms) Initial value for argc=3 Final value for argc=3 Initial value for argc=3 Final value for argc=3 Initial value for argc=3 Final value for argc=3 Initial value for argc=3 Final value for argc=3 Initial value for argc=3 Final value for argc=3 Initial value for argc=3 Final value for argc=3 Trying dwmac.e0800000 Speed: 100, full duplex TFTP blocksize = 1468, timeout = 5000 ms Using dwmac.e0800000 device TFTP from server 192.168.0.13; our IP address is 192.168.0.169 Filename 'fitImage'. Load address: 0x800000 Loading: send option "timeout 5" Got OACK: timeout 5 Blocksize ack: 1468, 1468 ################################################################# ################################################################# ################################################################# ########################################################## 5.3 MiB/s done Bytes transferred = 3708036 (389484 hex) Initial value for argc=3 Final value for argc=3 Initial value for argc=3 Final value for argc=3 Initial value for argc=3 Final value for argc=3 Initial value for argc=3 Final value for argc=3 Initial value for argc=3 Final value for argc=3 Initial value for argc=3 Final value for argc=3 Initial value for argc=3 Final value for argc=3 ## Current stack ends at 0x0778dd04 * kernel: default image load address = 0x00800000 ## Loading kernel from FIT Image at 00800000 ... No configuration specified, trying default... Found default configuration: 'conf@default' Using 'conf@default' configuration Trying 'kernel@0' kernel subimage Description: Linux Type: Kernel Image Compression: uncompressed Data Start: 0x008000b0 Data Size: 3700720 Bytes = 3.5 MiB Architecture: ARM OS: Linux Load Address: 0x02000000 Entry Point: 0x02000000 Hash node: 'hash@0' Hash algo: sha1 Hash value: efe249f573647bad3ce87c9c4b244986a90234db Hash len: 20 kernel data at 0x008000b0, len = 0x003877f0 (3700720) * ramdisk: using config 'conf@default' from image at 0x00800000 * ramdisk: no 'ramdisk' in config * fdt: using config 'conf@default' from image at 0x00800000 ## Checking for 'FDT'/'FDT Image' at 00800000 ## Loading fdt from FIT Image at 00800000 ... Using 'conf@default' configuration Trying 'fdt@0' fdt subimage Description: Device Tree Type: Flat Device Tree Compression: uncompressed Data Start: 0x00b87984 Data Size: 6103 Bytes = 6 KiB Architecture: ARM Can't get 'load' property from FIT 0x00800000, node: offset 3701020, name fdt@0 (FDT_ERR_NOTFOUND) Hash node: 'hash@0' Hash algo: sha1 Hash value: 53089fa031e727f094e6bf9ad4e93f4e95b7fba3 Hash len: 20 Can't get 'load' property from FIT 0x00800000, node: offset 3701020, name fdt@0 (FDT_ERR_NOTFOUND) fit_uname=fdt@0, fit_uname_config=conf@default Booting using the fdt blob at 0xb87984 of_flat_tree at 0x00b87984 size 0x000017d7 Initial value for argc=3 Final value for argc=3 Loading Kernel Image ... OK kernel loaded at 0x02000000, end = 0x023877f0 ## initrd_high = 0x08000000, copy_to_ram = 1 ramdisk load start = 0x00000000, ramdisk load end = 0x00000000 Initial value for argc=3 Final value for argc=3 Initial value for argc=3 Final value for argc=3 using: FDT ## device tree at 00b87984 ... 00b8915a (len=18391 [0x47D7]) Loading Device Tree to 07788000, end 0778c7d6 ... OK Initial value for argc=3 Final value for argc=3 image_setup_linux: 1511 fdt_setprop: 300 fdt_setprop_placeholder: 283 fdt_splice_: 108 fdt_splice_struct_: 132 fdt_splice_: 108 image_setup_libfdt: 480 arch_fixup_fdt: 54 fdt_fixup_memory_banks: 440 fdt_setprop: 300 fdt_setprop_placeholder: 283 fdt_resize_property_: 215 fdt_splice_struct_: 132 fdt_splice_: 108 memmove: 547 dest=0x77881b8 src=0x77881b8 size=0x16c4 undefined instruction pc : [<07fc9534>] lr : [<07fc9537>] reloc pc : [<03f39534>] lr : [<03f39537>] sp : 0778db58 ip : fffc3f40 fp : 03f00020 r10: deadbeef r9 : 0778df00 r8 : 07f902a0 r7 : 00ff0000 r6 : 077881b8 r5 : 077881b8 r4 : 000016c4 r3 : 07fc952d r2 : 000016c4 r1 : 077881b8 r0 : 077881b8 Flags: nZCv IRQs off FIQs off Mode SVC_32 Code: 48094908 fd17f000 00310022 f0030028 (0028faf1) Resetting CPU ... resetting ... System is going to reboot ... Basically, the error path is: image_setup_linux[2]->image_setup_libfdt[3]->arch_fixup_fdt[4]-> fdt_fixup_memory_banks[5]->fdt_setprop[6]->fdt_setprop_placeholder[7]-> fdt_resize_property_[8]->fdt_splice_struct_[9]->fdt_splice_[10]-> memmove[11]->memcpy The bootloader build is marked as dirty but I'm only adding files (board C and header files, board defconfig, etc...) for board support, no modifications otherwise, it's based on 2018.11. It's weird to me that it's happening with this SoC because it's based on ARM926ejs which is widely used I assume. Shouldn't have anyone already encountered the bug? Or is nobody actually booting a fitImage and had the luck to never call memcpy with src == dest anywhere else in the code? Let me know if I can be of any help for debugging. Thanks, Quentin [1] https://elixir.bootlin.com/u-boot/latest/source/lib/string.c#L547 [2] https://elixir.bootlin.com/u-boot/latest/source/common/image.c#L1511 [3] https://elixir.bootlin.com/u-boot/latest/source/common/image-fdt.c#L480 [4] https://elixir.bootlin.com/u-boot/latest/source/arch/arm/lib/bootm-fdt.c#L54 [5] https://elixir.bootlin.com/u-boot/latest/source/common/fdt_support.c#L440 [6] https://elixir.bootlin.com/u-boot/latest/source/scripts/dtc/libfdt/fdt_rw.c… [7] https://elixir.bootlin.com/u-boot/latest/source/scripts/dtc/libfdt/fdt_rw.c… [8] https://elixir.bootlin.com/u-boot/latest/source/scripts/dtc/libfdt/fdt_rw.c… [9] https://elixir.bootlin.com/u-boot/latest/source/scripts/dtc/libfdt/fdt_rw.c… [10] https://elixir.bootlin.com/u-boot/latest/source/scripts/dtc/libfdt/fdt_rw.c… [11] https://elixir.bootlin.com/u-boot/latest/source/lib/string.c#L547 [12] http://git.denx.de/?p=u-boot.git;a=commit;h=cb0eae8cf8aaca76910dee4c7eb536d…

4 6