May 2022 - U-Boot

[PATCH 1/2] test/py: efi_capsule: repair image authentication test
by Vincent Stehlé 04 Jun '22

04 Jun '22

Repair the python tests for authenticated EFI capsules, which can be run with sandbox_defconfig plus CONFIG_EFI_CAPSULE_AUTHENTICATE=y. - Account for the reset changes done by commit 3e6f81000672 ("efi_loader: test/py: Reset system after capsule update on disk"). - Fix the capsule GUID typo introduced by commit 2e9c3c6965ba ("test: capsule: Modify the capsule tests to use GUID values for sandbox"). Signed-off-by: Vincent Stehlé <vincent.stehle(a)arm.com> Cc: Heinrich Schuchardt <xypron.glpk(a)gmx.de> --- test/py/tests/test_efi_capsule/conftest.py | 4 ++-- .../tests/test_efi_capsule/test_capsule_firmware_signed.py | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/test/py/tests/test_efi_capsule/conftest.py b/test/py/tests/test_efi_capsule/conftest.py index d757415c881..5a8826a5a6b 100644 --- a/test/py/tests/test_efi_capsule/conftest.py +++ b/test/py/tests/test_efi_capsule/conftest.py @@ -101,7 +101,7 @@ def efi_capsule_data(request, u_boot_config): check_call('cd %s; ' '%s/tools/mkeficapsule --index 1 --monotonic-count 1 ' '--private-key SIGNER.key --certificate SIGNER.crt ' - '--guid 09D7DF52-0720-4710-91D1-08469B7FE9C8 ' + '--guid 09D7CF52-0720-4710-91D1-08469B7FE9C8 ' 'u-boot.bin.new Test11' % (data_dir, u_boot_config.build_dir), shell=True) @@ -110,7 +110,7 @@ def efi_capsule_data(request, u_boot_config): '%s/tools/mkeficapsule --index 1 --monotonic-count 1 ' '--private-key SIGNER2.key ' '--certificate SIGNER2.crt ' - '--guid 09D7DF52-0720-4710-91D1-08469B7FE9C8 ' + '--guid 09D7CF52-0720-4710-91D1-08469B7FE9C8 ' 'u-boot.bin.new Test12' % (data_dir, u_boot_config.build_dir), shell=True) diff --git a/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py index 593b032e901..a0b6a1ac86f 100644 --- a/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py +++ b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py @@ -85,7 +85,7 @@ class TestEfiCapsuleFirmwareSigned(object): # need to run uefi command to initiate capsule handling output = u_boot_console.run_command( - 'env print -e Capsule0000') + 'env print -e Capsule0000', wait_for_reboot = True) output = u_boot_console.run_command_list([ 'host bind 0 %s' % disk_img, @@ -160,7 +160,7 @@ class TestEfiCapsuleFirmwareSigned(object): # need to run uefi command to initiate capsule handling output = u_boot_console.run_command( - 'env print -e Capsule0000') + 'env print -e Capsule0000', wait_for_reboot = True) # deleted any way output = u_boot_console.run_command_list([ @@ -237,7 +237,7 @@ class TestEfiCapsuleFirmwareSigned(object): # need to run uefi command to initiate capsule handling output = u_boot_console.run_command( - 'env print -e Capsule0000') + 'env print -e Capsule0000', wait_for_reboot = True) # deleted any way output = u_boot_console.run_command_list([ -- 2.35.1

3 3

[PATCH] net: enetc: unregister mdiobus
by Michael Walle 03 Jun '22

03 Jun '22

If the device fails to probe - for example, when there is no ethaddr set - then the private data is automatically freed but the mdiobus remains registered. Fixes: 1e354cb39314 ("drivers: net: fsl_enetc: register internal MDIO bus") Signed-off-by: Michael Walle <michael(a)walle.cc> --- This actually causes the kontron sl28 board (variant 2) to oops when no ethaddr is set. It would be good if it still makes it into the next release. That miiphy_get_dev_by_name() hack is actually borrowed from the handling in the driver. It should probably be converted to a proper flag ENETC_IMDIO_REGISTERED or something like that. But that is beyond the scope of this patch. drivers/net/fsl_enetc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/fsl_enetc.c b/drivers/net/fsl_enetc.c index 9b97a03ccb..cd4c2c29a6 100644 --- a/drivers/net/fsl_enetc.c +++ b/drivers/net/fsl_enetc.c @@ -361,6 +361,9 @@ static int enetc_remove(struct udevice *dev) { struct enetc_priv *priv = dev_get_priv(dev); + if (miiphy_get_dev_by_name(priv->imdio.name)) + mdio_unregister(&priv->imdio); + free(priv->enetc_txbd); free(priv->enetc_rxbd); -- 2.30.2

2 1

[PATCH] squashfs: Fix compilation on big endian systems
by Pali Rohár 03 Jun '22

03 Jun '22

Signed-off-by: Pali Rohár <pali(a)kernel.org> --- fs/squashfs/sqfs.c | 3 +-- fs/squashfs/sqfs_dir.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index 5d9c52af80ba..41cb811c1b32 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -11,8 +11,7 @@ #include <errno.h> #include <fs.h> #include <linux/types.h> -#include <linux/byteorder/little_endian.h> -#include <linux/byteorder/generic.h> +#include <asm/byteorder.h> #include <memalign.h> #include <stdlib.h> #include <string.h> diff --git a/fs/squashfs/sqfs_dir.c b/fs/squashfs/sqfs_dir.c index a265b98fe685..ed83c90682ff 100644 --- a/fs/squashfs/sqfs_dir.c +++ b/fs/squashfs/sqfs_dir.c @@ -7,8 +7,7 @@ #include <errno.h> #include <linux/types.h> -#include <linux/byteorder/little_endian.h> -#include <linux/byteorder/generic.h> +#include <asm/byteorder.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> -- 2.20.1

3 9

[PATCH] ubifs: Fix lockup/crash when reading files
by Pali Rohár 03 Jun '22

03 Jun '22

Commit b1a14f8a1c2e ("UBIFS: Change ubifsload to not read beyond the requested size") added optimization to do not read more bytes than it is really needed. But this commit introduced incorrect handling of the hole at the end of file. This logic cause U-Boot to crash or lockup when trying to read from the ubifs filesystem. When read_block() call returns -ENOENT error (not an error, but the hole) then dn-> structure is not filled and contain garbage. So using of dn->size for memcpy() argument cause that U-Boot tries to copy unspecified amount of bytes from possible unmapped memory. Which randomly cause lockup of P2020 CPU. Fix this issue by copying UBIFS_BLOCK_SIZE bytes from read buffer when dn->size is not available. UBIFS_BLOCK_SIZE is the size of the buffer itself and read_block() fills buffer by zeros when it returns -ENOENT. This patch fixes ubifsload on P2020. Fixes: b1a14f8a1c2e ("UBIFS: Change ubifsload to not read beyond the requested size") Signed-off-by: Pali Rohár <pali(a)kernel.org> --- Stefan, could you please look at this patch? Mentioned commit was introduced by you more than 11 years ago. I'm surprised that nobody hit this issue yet, but it looks like older U-Boot versions somehow filled small garbage number into dn->size and did not cause U-Boot lockup/crash. --- fs/ubifs/ubifs.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ubifs/ubifs.c b/fs/ubifs/ubifs.c index d6be5c947d7e..d3026e310168 100644 --- a/fs/ubifs/ubifs.c +++ b/fs/ubifs/ubifs.c @@ -771,40 +771,42 @@ static int do_readpage(struct ubifs_info *c, struct inode *inode, buff = malloc_cache_aligned(UBIFS_BLOCK_SIZE); if (!buff) { printf("%s: Error, malloc fails!\n", __func__); err = -ENOMEM; break; } /* Read block-size into temp buffer */ ret = read_block(inode, buff, block, dn); if (ret) { err = ret; if (err != -ENOENT) { free(buff); break; } } if (last_block_size) dlen = last_block_size; + else if (ret) + dlen = UBIFS_BLOCK_SIZE; else dlen = le32_to_cpu(dn->size); /* Now copy required size back to dest */ memcpy(addr, buff, dlen); free(buff); } else { ret = read_block(inode, addr, block, dn); if (ret) { err = ret; if (err != -ENOENT) break; } } } if (++i >= UBIFS_BLOCKS_PER_PAGE) break; block += 1; addr += UBIFS_BLOCK_SIZE; -- 2.20.1

3 6

[PATCH v1 1/9] ARM: hpe: gxp: add core support
by nick.hawkins＠hpe.com 03 Jun '22

03 Jun '22

From: Nick Hawkins <nick.hawkins(a)hpe.com> The GXP is the HPE BMC SoC that is used in the majority of current generation HPE servers. Traditionally the asic will last multiple generations of server before being replaced. Info about SoC: HPE GXP is the name of the HPE Soc. This SoC is used to implement many BMC features at HPE. It supports ARMv7 architecture based on the Cortex A9 core. It is capable of using an AXI bus to whicha memory controller is attached. It has multiple SPI interfaces to connect boot flash and BIOS flash. It uses a 10/100/1000 MAC for network connectivity. It has multiple i2c engines to drive connectivity with a host infrastructure. There currently are no public specifications but this process is being worked. Signed-off-by: Nick Hawkins <nick.hawkins(a)hpe.com> --- arch/arm/Kconfig | 8 ++++++++ arch/arm/Makefile | 1 + arch/arm/mach-hpe/Makefile | 1 + arch/arm/mach-hpe/gxp/Kconfig | 9 +++++++++ arch/arm/mach-hpe/gxp/Makefile | 1 + arch/arm/mach-hpe/gxp/reset.c | 26 ++++++++++++++++++++++++++ 6 files changed, 46 insertions(+) create mode 100644 arch/arm/mach-hpe/Makefile create mode 100644 arch/arm/mach-hpe/gxp/Kconfig create mode 100644 arch/arm/mach-hpe/gxp/Makefile create mode 100644 arch/arm/mach-hpe/gxp/reset.c diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig index 9898c7d68e..1f9fc1bb8e 100644 --- a/arch/arm/Kconfig +++ b/arch/arm/Kconfig @@ -2085,6 +2085,12 @@ config TARGET_XENGUEST_ARM64 select SSCANF imply OF_HAS_PRIOR_STAGE +config ARCH_GXP + bool "Support HPE GXP SoCs" + select DM + select OF_CONTROL + imply CMD_DM + endchoice config SUPPORT_PASSING_ATAGS @@ -2193,6 +2199,8 @@ source "arch/arm/mach-davinci/Kconfig" source "arch/arm/mach-exynos/Kconfig" +source "arch/arm/mach-hpe/gxp/Kconfig" + source "arch/arm/mach-highbank/Kconfig" source "arch/arm/mach-integrator/Kconfig" diff --git a/arch/arm/Makefile b/arch/arm/Makefile index 85c23bcf77..cfaa38594c 100644 --- a/arch/arm/Makefile +++ b/arch/arm/Makefile @@ -62,6 +62,7 @@ machine-$(CONFIG_ARCH_BCM283X) += bcm283x machine-$(CONFIG_ARCH_BCMSTB) += bcmstb machine-$(CONFIG_ARCH_DAVINCI) += davinci machine-$(CONFIG_ARCH_EXYNOS) += exynos +machine-$(CONFIG_ARCH_GXP) += hpe machine-$(CONFIG_ARCH_HIGHBANK) += highbank machine-$(CONFIG_ARCH_IPQ40XX) += ipq40xx machine-$(CONFIG_ARCH_K3) += k3 diff --git a/arch/arm/mach-hpe/Makefile b/arch/arm/mach-hpe/Makefile new file mode 100644 index 0000000000..afe5f7a29e --- /dev/null +++ b/arch/arm/mach-hpe/Makefile @@ -0,0 +1 @@ +obj-$(CONFIG_SOC_GXP) += gxp/ diff --git a/arch/arm/mach-hpe/gxp/Kconfig b/arch/arm/mach-hpe/gxp/Kconfig new file mode 100644 index 0000000000..2d43133ab0 --- /dev/null +++ b/arch/arm/mach-hpe/gxp/Kconfig @@ -0,0 +1,9 @@ +if ARCH_GXP + +config SOC_GXP + bool + select CPU_V7A + +source "board/hpe/gxp/Kconfig" + +endif diff --git a/arch/arm/mach-hpe/gxp/Makefile b/arch/arm/mach-hpe/gxp/Makefile new file mode 100644 index 0000000000..f3cc6684b8 --- /dev/null +++ b/arch/arm/mach-hpe/gxp/Makefile @@ -0,0 +1 @@ +obj-y += reset.o diff --git a/arch/arm/mach-hpe/gxp/reset.c b/arch/arm/mach-hpe/gxp/reset.c new file mode 100644 index 0000000000..4d4d5f015f --- /dev/null +++ b/arch/arm/mach-hpe/gxp/reset.c @@ -0,0 +1,26 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * GXP driver + * + * (C) Copyright 2022 Hewlett Packard Enterprise Development LP. + * Author: Nick Hawkins <nick.hawkins(a)hpe.com> + * Author: Jean-Marie Verdun <verdun(a)hpe.com> + */ + +#include <common.h> +#include <asm/io.h> + +#define GXP_CCR 0xc0000000 + +/* empty to satisfy current lowlevel_init, can be removed any time */ +void lowlevel_init(void) +{ +} + +void reset_cpu(ulong ignored) +{ + writel(1, GXP_CCR); + + while (1) + ; /* loop forever till reset */ +} -- 2.17.1

3 20

[PATCH] boot: pxe_utils: Do not use fdtcontroladdr for FIT Image format
by Neil Armstrong 03 Jun '22

03 Jun '22

When patch [1] introduced "fdtcontroladdr" fallback in order to use built-in DT when no DT in provided in PXE config, it broke FIT image boot where the DT from the FIT configuration was used. This disables the "fdtcontroladdr" fallback when the provided image is from the FIT image type. [1] d5ba6188dfbf ("cmd: pxe_utils: Check fdtcontroladdr in label_boot") Fixes: d5ba6188dfbf ("cmd: pxe_utils: Check fdtcontroladdr in label_boot") Cc: Tom Rini <trini(a)konsulko.com> Cc: Peter Hoyes <peter.hoyes(a)arm.com> Signed-off-by: Neil Armstrong <narmstrong(a)baylibre.com> --- boot/pxe_utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/boot/pxe_utils.c b/boot/pxe_utils.c index b08aee9896..5eb328c86b 100644 --- a/boot/pxe_utils.c +++ b/boot/pxe_utils.c @@ -725,7 +725,7 @@ static int label_boot(struct pxe_context *ctx, struct pxe_label *label) if (!bootm_argv[3]) bootm_argv[3] = env_get("fdt_addr"); - if (!bootm_argv[3]) + if (genimg_get_format(buf) != IMAGE_FORMAT_FIT && !bootm_argv[3]) bootm_argv[3] = env_get("fdtcontroladdr"); if (bootm_argv[3]) { -- 2.25.1

2 1

[PATCH RFC v2 00/11] Integration of sysfw, tispl and tiboot3
by Neha Malcom Francis 03 Jun '22

03 Jun '22

Devices that belong to the K3 architecture require SYSFW which is a FIT image consisting of a signed system firmware image and board config binaries. Board config binaries are needed to bring up SYSFW during U-Boot SPL startup. The board config data is given in YAML as input. These board configs contain board-specific information such as resource management, power management and security. The following series intends to plumb the system firmware generation into U-Boot using binman for packaging. Thus it will eliminate the need for additional custom repositories for SYSFW generation and also moves t owards the community standard build flow. We use binman to package tiboot3.bin and sysfw.itb images. These images also require x509 certificates which are created using the etype x509-cert. The series also plumbs the generation of tispl.bin into the build flow. This image is required for loading u-boot in K3 devices. The image is packaged using ATF, OPTEE and DM (Device Manager). Please note that the following series has implemented the above for J721E general purpose board. The board configs and device trees added are specific to J721E GP devices. Also note the introduction of three new etypes: ti-sysfw, ti-dm and x509-cert. On running CI tests on Github, errors were produced during world builds of keystone2_keystone3 and siemens (I0T2050 which is based on AM65x). This patch series is intended for only J721E and future work is to expand to the remaining K3 devices as well. The errors that come are mainly due to the boards other than J721E trying to generate tispl.bin. v2: - Added etype x509-cert for creating x509 Texas Instruments certificate binary - Added packaging of tiboot3.bin - Packaging of tiboot3.bin and sysfw.itb using new etype x509 - sysfw --> ti-sysfw - Reformatted and re-arranged patches - Removed k3_fit_atf.sh and k3_gen_x509_cert.sh as their functionality is provided by binman now Neha Malcom Francis (11): j721e_evm: schema: yaml: Add general schema and J721E board config files ti: tools: config: Add board config class to generate config binaries ti: etype: sysfw: Add entry type for sysfw ti: etype: dm: Add entry type for TI DM ti: etype: x509: Add etype for x509 certificate for K3 devices ti: sysfw: Add support for packaging sysfw.itb ti: tiboot3.bin: Remove tiboot3.bin target from makefile ti: tispl.bin: Removed script that packages tispl.bin ti: x509: Remove shell script used for signing ti: dtsi: j721e: Use binman to package sysfw.itb and tiboot3.bin ti: dtsi: j721e: Use binman to package tispl.bin Makefile | 2 + arch/arm/dts/k3-j721e-a72-binman.dtsi | 86 + .../k3-j721e-common-proc-board-u-boot.dtsi | 1 + arch/arm/dts/k3-j721e-r5-binman.dtsi | 88 + .../k3-j721e-r5-common-proc-board-u-boot.dtsi | 1 + arch/arm/mach-k3/config.mk | 64 +- board/ti/common/schema.yaml | 355 ++ board/ti/j721e/Kconfig | 2 + board/ti/j721e/config.yaml | 3162 +++++++++++++++++ scripts/Makefile.spl | 4 - test/py/requirements.txt | 1 + tools/binman/entries.rst | 36 + tools/binman/etype/ti_dm.py | 23 + tools/binman/etype/ti_sysfw.py | 28 + tools/binman/etype/x509_cert.py | 248 ++ tools/binman/ftest.py | 21 + tools/binman/test/225_ti_dm.dts | 13 + tools/binman/test/232_ti_sysfw.dts | 13 + tools/binman/test/232_x509_cert.dts | 18 + tools/k3_fit_atf.sh | 123 - tools/k3_gen_x509_cert.sh | 252 -- tools/tibcfg_gen.py | 114 + 22 files changed, 4227 insertions(+), 428 deletions(-) create mode 100644 arch/arm/dts/k3-j721e-a72-binman.dtsi create mode 100644 arch/arm/dts/k3-j721e-r5-binman.dtsi create mode 100644 board/ti/common/schema.yaml create mode 100644 board/ti/j721e/config.yaml create mode 100644 tools/binman/etype/ti_dm.py create mode 100644 tools/binman/etype/ti_sysfw.py create mode 100644 tools/binman/etype/x509_cert.py create mode 100644 tools/binman/test/225_ti_dm.dts create mode 100644 tools/binman/test/232_ti_sysfw.dts create mode 100644 tools/binman/test/232_x509_cert.dts delete mode 100755 tools/k3_fit_atf.sh delete mode 100755 tools/k3_gen_x509_cert.sh create mode 100644 tools/tibcfg_gen.py -- 2.17.1

5 35

Out of bounds write vulnerability in the sqfs_readdir() function
by Jincheng Wang 01 Jun '22

01 Jun '22

Hello u-boot list, I found the sqfs_readdir() function is vulnerable to Out-of-Bound write, which will cause arbitrary code execution. ``` int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp) { ...... /* Set entry name */ strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1); dent->name[dirs->entry->name_size + 1] = '\0'; offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; dirs->entry_count--; ....... } struct squashfs_dir_stream { struct fs_dir_stream fs_dirs; struct fs_dirent dentp; size_t size; int entry_count; struct squashfs_directory_header *dir_header; struct squashfs_directory_entry *entry; ...... }; static int sqfs_search_dir(struct squashfs_dir_stream *dirs, char **token_list, int token_count, u32 *m_list, int m_count) { ...... while (!sqfs_readdir(dirsp, &dent)) { ret = strcmp(dent->name, token_list[j]); if (!ret) break; free(dirs->entry); dirs->entry = NULL; } ...... } ``` The sqfs_readdir() function use strncpy to set entry name, while the type of dirs->entry->name_size is defined as "u16" in the struct squashfs_directory_entry and dent->name is defined as "char[256]" in the struct fs_dirent. We can overwrite *dirs_header and *entry in the struct squashfs_dir_stream, so that we can use the sqfs_search_dir() function to free a fake chunk which causes arbitrary code execution. You can see the Poc in the attachment. host bind 0 test4.sqfs ls host 0 /dirs

2 1

[PATCH] arm: socfpga: spl: To notify SDM when SPL pass control to U-Boot
by dinesh.maniyam＠intel.com 01 Jun '22

01 Jun '22

From: Dinesh Maniyam <dinesh.maniyam(a)intel.com> Prior SPL pass control to U-Boot, SPL will send a mailbox command "HPS_STAGE_NOTIFY" to notify Secure Device Manager (SDM) on HPS SW transition. The purpose is for debug as user can query SDM on HPS error details when HPS enters a warm reset due to error such as watchdog. Signed-off-by: Dinesh Maniyam <dinesh.maniyam(a)intel.com> --- arch/arm/mach-socfpga/spl_s10.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm/mach-socfpga/spl_s10.c b/arch/arm/mach-socfpga/spl_s10.c index c20e87cdbe..9bfd1a0f6a 100644 --- a/arch/arm/mach-socfpga/spl_s10.c +++ b/arch/arm/mach-socfpga/spl_s10.c @@ -92,3 +92,9 @@ void board_init_f(ulong dummy) mbox_qspi_open(); #endif } + +/* board specific function prior loading SSBL / U-Boot */ +void spl_board_prepare_for_boot(void) +{ + mbox_hps_stage_notify(HPS_EXECUTION_STATE_SSBL); +} -- 2.26.2

2 1

[PATCH 0/3] EFI: Miscellaneous capsule update fixes
by Sughosh Ganu 01 Jun '22

01 Jun '22

The following set of patches fix separate issues relating to the capsule update code. The first patch moves the setting of the descriptor_count parameter to the GetImageInfo function after assertion of a non zero image descriptor buffer. The second patch enables capsule update to proceed even when the OsIndications variable is not set with EFI_IGNORE_OSINDICATIONS config enabled. The third patch updates the capsule update documentation to highlight the 64 bit value of OsIndications that needs to be set. Sughosh Ganu (3): EFI: Populate descriptor_count value only when image_info_size is not zero EFI: Do not read OsIndications variable if EFI_IGNORE_OSINDICATIONS is enabled EFI: Update the documentation to reflect the correct value of OsIndications doc/develop/uefi/uefi.rst | 2 +- lib/efi_loader/efi_capsule.c | 5 +++-- lib/efi_loader/efi_firmware.c | 5 ++--- 3 files changed, 6 insertions(+), 6 deletions(-) -- 2.25.1

3 9